Split the checkpoint row's two spelling roles: what a reference renders and what a declaration grounds in

[briansrls]

Provenance note. This branch was attached to a work item whose (immutable) title names the lambda/bare-name-roster investigation that preceded this change; the dashboard seeded that title onto the PR on attach and it has been corrected. Nothing here touches emit_typed_call or that roster — that half landed separately as #8772, and its measured null is what re-diagnosed this half as a two-role defect in the checkpoint row rather than a second bare-name bypass. If the seeded title reappears, this diff is the authority, not the title.

Summary

A TypeCheckpoint row was answering two different questions with one field, and the six facts of this change are:

1. A row now carries two spelling roles — target_type, what a reference renders, and grounding_type, what a declaration's right-hand side is grounded in.
2. Across all 37 rows in five language tables, Rust's String is the only row where they differ (String vs std::string::String) — the one self-referencing shape.
3. The compensating item_text == "String" arm in emit_typed_item is deleted, not guarded, along with its helper.
4. Production callers are three reference readers and one grounding reader, each naming its question through rust_scalar_checkpoint_reference_base / _grounding_base over one shared identity-keyed body.
5. The shared helper stays public and reachable, which is why the claim stops at mechanically preventable rather than structurally impossible.
6. The stage0 mirrors were regenerated, not hand-written: the sequence reached a repeatable candidate with no hand edits to any generated file.

Test plan

• Witness rows, green by execution. Three rows added to v1.tests.claim.checkpoint_identity_keying_witness_test, run via cargo test -p v1-compiler: test result: ok.
• Discriminating RED. With rust_scalar_checkpoint_grounding_base flipped to read target_type, the run fails at the grounding assertion specifically while both reference assertions before it still pass. Collapsing the split reds exactly one row, whichever field survives.
• Caller census. The shared body's only direct callers are the two wrappers, in the authority and in the emitted seed alike.
• Regen. claim_executor --required-regen: round 1 first_generation_equal=false, adopt candidate, rebuild, round 2 true. All eight changed mirrors md5-verified byte-identical to what the emitter produced.
• CI: witnesses (parse, regen, floor).

Coverage boundary: the witness rows execute, but they are not enrolled

Stated here rather than left implied, because the obvious reading of a green run is stronger than the instrument.

The required-CI invocation is claim_executor --required-ci --source-root dag --source-root src/v2. The three rows this PR adds live in src/v1/tests/claim/, outside that envelope. They were run directly during authoring — green, plus the discriminating RED — and that is evidence the assertions hold; it is not evidence that CI runs them. So §4b(4), which keeps the discriminating RED enrolled as the executing evidence that a rung stays real, does not yet hold for these rows. Trigger: src/v1 witnesses reachable from the required-CI envelope.

Re-homing them to the dag/ sibling is not the fix and was not done. These rows import v1.compiler.emit_rust and read the function's answer directly; the dag/ sibling can only observe the emitter black-box through compile_dag_rust_emit_check, which sees rendered output rather than the function's answer. Moving them would trade a real instrument for an enrolled weaker one.

Related, and the reason this section exists: a floor pass covers the routed roster, not the discovered one — this branch's run reported offered=11609 routed=10253, so 1362 discovered sites are declined by home policy before the fold sees them. A green floor is a claim about the witnesses that ran.

Why the two questions cannot share one field

The recorded framing of this gap was wrong, and correcting it is the change. checkpoint_table_bypasses_identity_note called the String declaration-site arm a second bare-name bypass to delete. Deleting it alone emits pub type String = String; — self-referential — because the checkpoint's target_type for String is the bare spelling and the declaration site used it as the alias's right-hand side. The arm was compensating, not bypassing.

So the defect was not a wrong value in the row; it was one field carrying two roles. Whichever spelling it held, one consumer was wrong, and the arm was the visible cost of making it try. (Earlier revisions of this description called that an arity defect. That word already means type-parameter count in this exact area — rust_checkpoint_scalar_arity_note sits a few lines away — so the durable wording is two spelling roles, or two projections.)

Two named entry points, not one function with a position argument: an argument is a discriminator a caller can get wrong, and nothing stops the next caller passing the one that compiles rather than the one that is true. Naming the question makes the wrong selection require visibly calling the wrong function.

The honest rung, and what a green regen does not establish

The class sits at mechanically preventable, not structurally impossible, and an earlier revision of the annotation claimed otherwise. rust_scalar_checkpoint_spelling is reachable and carries the grounding Bool — exactly the discriminator the two surfaces exist to remove — so a caller can still select the wrong spelling by calling the shared body directly, and nothing refuses it. What the entry points buy is that every production caller goes through a question-named surface: a fact about the current call graph, not a property of the API. The caller census is the standing evidence that keeps that claim checkable rather than merely modest.

Ceiling, not a defect left unfixed: .dag has no function-privacy concept, so the shared body cannot be made unreachable however it is written — measured on the emitted emitter: 665 pub fn, zero non-pub, and no privacy keyword in the parser. Next-rung trigger: a module-private function boundary in the language.

A note on the regen evidence, because the obvious reading of it is wrong: first_generation_equal=false beside fixed_point_equal=true establishes only that emission is repeatable, not that it is correct — a deterministic wrong emitter reproduces its wrong output forever. What those two readings together rule out is unstable or non-converging emission; correctness is established by the witness execution and the discriminating RED above, never by a green regen.

Pre-empting the redundancy objection: the field is not optional, and must not become so

Eight of the nine Rust rows carry grounding_type identical to target_type, and every other language table is identical throughout. That reads as redundancy, and the natural suggestion is to make the field optional and default it to target_type when absent. That suggestion undoes this change and should be declined.

A default is a rule about what a row means when it stays silent — which is precisely the compensation this PR deletes. It does not remove the ambiguity, it moves it from the declaration site into the row's absence arm, where it is harder to see and nothing executes over it. The eight coincidences are not one fact written twice; they are two facts that happen to agree for those types. The value of the full field is that the next name colliding with its own host spelling cannot be added without someone deciding both answers. Optional-with-default lets exactly that name be added silently and wrong.

The numeric witness row exists for the same reason: it states by execution that grounding equals reference where the two coincide, so the coincidence is asserted rather than assumed — which is the honest version of what a default would have papered over.