CALLABLE-LOOKUP-UNIQUE: collect every admissible callable candidate before deciding, and stop erasing the ambiguity arm

[briansrls]

Two findings that came out of executing this, stated first

1. The wall could not fire for its own specimen, because of a guard I wrote

builtin_callable_candidates excluded every algebra method template name. I wrote that guard and justified it in a paragraph: receiver-dispatched names (filter, any, contains) belong to the known-method ExprCall arm, and admitting them would make every module declaring a collection-shaped name a collision.

Measured, the guard was redundant for the names it named and fatal for the ones it did not. Of ~50 algebra template names only 19 carry a builtin_function_registry row, and filter/any/contains/fold/map are not among them — infer_builtin_call_type already answered Absent, so they were never candidates and the guard changed nothing about them. What it actually excluded was the 19 names that do have a free-call surface, map_get first among them — the exact name row 30 is about.

So the wall was inert on the collision it was built for, and the witness that should have shown that returned false in a way indistinguishable from a broken fixture (which it also was). The admission test is now the registry alone, which is precisely the question being asked: a registry row means "a bare call to this name types against a primitive."

Worth naming beyond the fix: a justification is not evidence, and the paragraph made the guard more durable rather than less — a defended exclusion is harder to question than an undefended one.

The wall does not add a diagnostic — it replaces three false ones with one true one

Measured on the RED source, before and after, through compile_dag_diagnostic_census with the mirrors regenerated and installed:

	rows produced
before	VariantNotFound/Present, VariantNotFound/Absent, NonExhaustiveMatch/(non-exhaustive)
after	AmbiguousReference/BLOCK/map_get

The three "before" rows are all downstream, and all describe the damage rather than the cause: each one points the author at a match arm that was never the problem. The single "after" row sits at the call and names both authorities. This is not a stricter compiler — it is a compiler that stops lying about where the defect is, which is the difference between a check and a diagnosis.

It also closes row 30's own text, which recorded the class as latent and observable only as downstream non-exhaustive matches. The same source now produces the refusal instead of those matches, on the real acceptance path.

2. Row 30 is now reproducible on demand, not just historically observed

Two sources, identical call, import closure the only difference — measured through compile_dag_diagnostic_census:

source imports	census
std.types only	[] — completely clean; bare map_get is the builtin and Present/Absent is exhaustive
extdeps.posix.identity	VariantNotFound/Present, VariantNotFound/Absent, NonExhaustiveMatch

The second module names no authority for map_get; posix.identity's own closure supplies the Outcome-returning declaration. That is the incident, on demand, under a controlled fixture — converting the specification from a historical observation into a discriminating RED.

---

What this is

Two independent things, deliberately in one PR and named separately so neither hides inside the other.

1. The wall. lookup_func_sig stops asking the environment first and the builtin surface second. It now collects every admissible callable candidate and then decides: zero → typed FuncSigUnresolved; exactly one → resolve; two or more → typed FuncSigAmbiguous naming every exact candidate. And the projection that erased that third arm (func_sig_if_resolved, which mapped FuncSigAmbiguous { candidates: _ } to Absent for ten consumers) is deleted, replaced by a total func_sig_for_derivation whose NoDerivableSig carries a typed reason.

2. An independent repair, in its own commit: the emit_map_has builtin registry row is deleted. It certified a call that nothing at any tier could run.

Specification: row 30 of docs/plans/compiler-guarantee-recovery-gap-analysis.md.

---

The wall

Mechanism (a) — the candidate set is now assembled. callable_lookup_over_candidates reads four levels, and the level structure is the whole point, because the failure mode this lane must not become is "the leaf name appears twice, therefore refuse":

• level 0 — the caller's own declaration. A lexical relation, not a candidate. It wins outright and is never entered into the decision. Body-scope binders shadow one seam further up, in body_shadow_aware_func_sig. Legitimate shadowing stays legal.
• level 1a — names the author explicitly brought into scope (type_env.source_visible_names: the module's own declarations, the kernel surface, selectively imported names, all-module import exports). import v2.std.collection { map_get } names one exact declaration, and every later bare call in that module is a reference to the thing the author named — the same authorial act as a qualified reference, one line higher. The builtin surface is not a co-candidate here.
• level 1b — the transitive closure and the builtin surface, together, as peers. This is the change, and this is the incident. Both are visible without the author naming either anywhere, so two answers here are two answers at one level and nothing ranks them.
• level 2 — the corpus-wide census (func_sig_from_global_bare), reached only when nothing above produced a candidate. Preserved: a bare call to a declaration outside the closure still resolves exactly as before.

Why 1a exists, and why it is not the precedence this cut removes. The row-30 incident is transitive: dag/extdeps/git/object_store.dag at ac9e010a83~1 names v2.std.collection zero times — the declaration reached it through somebody else's edge. Meanwhile six modules bare-call map_get while naming it in a listed import — 03_ingest, target_model, compilation_unit, cli_surface, affected_set, v2_effect_io_pure — and zero reach it through an is_all import. Without 1a the wall refuses all six, which includes the v2 compiler's ingest and target-model stages. (An earlier revision of this section said sixteen: that was modules importing v2.std.collection at all, only six of which bare-call map_get.)

1a ranks nothing this cut forbids: not import order (a listed import is set membership, not a position, and two listed imports of one name are still ambiguous), not "declared beats builtin" (an unlisted declaration still does not beat the builtin — that is exactly the case that refuses). It distinguishes what the author named from what a closure happened to supply, which is the definition of the defect rather than a tiebreak between kinds of callable.

It reuses source_visible_names rather than minting a visibility notion beside it: that map is already the corpus authority for "the author named this", and v1.compiler.infer_env's closure_independent_bare_free_call_note already refuses global-bare and pool-coincidence resolution for registered symbols absent from it — same question, same authority, one seam over. Empty is ignorance, not an answer: source_visible_names is built at resolve time and is not persisted onto TypedModule.type_env, so the emit-side consumer reads an empty map and cannot distinguish listed from transitive. An empty map therefore takes the 1a arm (today's behaviour), never "nothing was named", which would make the wall strictest exactly where it knows least.

Rung, per path (§4b), minimum governing: refuses on the source→resolve path; silent on the emit path. Next-rung trigger for the emit row: persisting source_visible_names onto TypedModule.type_env. Citing only the resolve path would be inflation.

The decision itself is not new logic. It routes through module_path_owner_binding_decide, the existing single 0/1/many cardinality authority, so the wall does not mint a second answer to "how many owners does this name have" (§3).

Order-independence falls out of the shape rather than being asserted: the candidate list is decided by cardinality, not scanned for a first hit. There is no "first imported wins", no "declared beats builtin", no import-order arm to be sensitive to.

One deliberate asymmetry, stated because it looks like a hole. A lone builtin candidate answers FuncSigUnresolved rather than resolving. The registry maps a name to a return type and carries no parameters, so resolving from it would assert a call shape the registry does not know — a fabricated plausible signature (§5). Unresolved is the correct answer and routes the call to the known-builtin bridge exactly as today. The builtin's presence is load-bearing only for counting, which is the half row 30 needed.

Diagnostic. Candidates carry exact identities — DeclaredCallable { owner_module_path, decl_name } / BuiltinCallable { primitive_name } — not bare strings, so the measured specimen reads:

callable 'map_get' is ambiguous: <builtin:map_get> / v2.std.collection.map_get

Evidence — three sources, all through the real acceptance path (compile_dag_diagnostic_census runs the production resolve/typecheck over the live source roots), in dag/test/claim/callable_candidate_ambiguity_witness_test.dag, enrolled in the required floor (no live_tree_disposition, so it executes rather than being declined):

	source	asserts
RED	a module naming no authority, reaching a declarer only transitively (import extdeps.posix.identity, whose own closure contains v2.std.collection)	refuses
GREEN 1	the same spelling with the authority named (import v2.std.collection { map_get })	resolves
GREEN 2	the same spelling declared by the caller itself (lexical shadowing)	resolves

The counter returns 0 - 1 on CensusNotRunnable, so a broken harness fails in both directions rather than passing the RED by silence.

The RED had to be rebuilt, and that is worth recording rather than quietly fixing. Its first version used the listed-import source as its RED and asserted a refusal — which is not the incident's shape at all. A witness that certifies a wall while testing a shape the defect never had is worse than no witness, because it goes green and reads as coverage: this one would have certified refusing the v2 compiler core as correct behaviour. It was found by checking the specimen against the incident, which is the only way it could have been found.

---

What the wall's 1215-site output IS

Turning the wall on exposes 1215 sites. That number is not a defect count and must not be read as one. It is the first-ever measurement of the surface-versus-primitive fork: how much of this corpus calls a name that exists both as a registered primitive and as a .dag declaration.

name	sites	modules	verdict
length	615	211	one authority
map_insert	505	59	one authority
decl_facts	27	16	one authority
map_get	12	6	two authorities
data_decl_type_facts	2		one authority
src/v1: to_string 31, emit_map_has 20, map_has 3	54		see below

1147 of the 1161 dag+src/v2 sites are not ambiguity bugs. They are a nickname census (§3): one concept wearing one spelling across two carriers, where the second carrier adds no meaning. The dissolution is the PrimitiveDefinition/PrimitiveIdentity join (dag/std/primitive_identity.dag), dispatched as its own lane; this PR is stacked behind it and stays draft until it lands. It is explicitly not dissolved by generalizing the _host_binding marker: that marker links a contract to its fn by name, through a module-level data row — the same nickname class the wall exists to remove.

Per-name verdicts, each established by execution

Asked for per name, no bulk judgment, and each carries its own evidence class:

• map_get — TWO AUTHORITIES. control 14 diagnostics, call 17: +3, including one NonExhaustiveMatch — row 30's signature exactly. The builtin returns Optional<V>; v2.std.collection.map_get returns Outcome<Optional<V>>. Different shape, so a Present/Absent match over the declared one is non-exhaustive.
• length — ONE AUTHORITY. control 14, call 14: no drift. The free-call builtin arm intercepts ahead of user-fn dispatch.
• map_insert — ONE AUTHORITY. control 14, call 14: no drift. The module declares map_insert_host_binding: PrimitiveContract, and the interpreter carries try_v2_std_collection_map_primitive_grounding → MapGroundingMapInsert — grounded, not forked.
• decl_facts, data_decl_type_facts, export_signature_facts, concept_decl_facts — ONE AUTHORITY, and by a different and stronger instrument than the probe: an already-green floor witness (test.claim.record_construction_census_witness_test) imports and bare-calls decl_facts, whose declared body is fn decl_facts(x) { decl_facts(x: x) } — an infinite self-call. A green run is only possible if the builtin served it. The existing corpus was the oracle; no new probe needed.
• emit_map_has — PHANTOM. Registry-typed Bool, no arm at any tier, bare call → NoSuchFunction. Deleted in this PR (below).

The control construction — the reusable part

The first pass of this probe reported map_get +17, length +14, map_insert +14, decl_facts +8 and read as all four names drifting. Three of those four were false.

The bug: the probe counted every diagnostic a source produced, and an importing source inherits diagnostics from the imported closure, not only from the call site. So the instrument was measuring "did I import a big module", not "did this call resolve differently".

The fix, and the thing worth keeping:

For each name, author two sources: a CALL source that imports the declarer and calls the name, and a CONTROL source that imports the same declarer and never calls it. Drift is CALL − CONTROL, not CALL.

Under that control only map_get moved. This is written down because the next person measuring a closure-sensitive property will otherwise rebuild the instrument wrong the same way — an uncontrolled count over an import closure looks like a measurement and is a measurement of the closure.

---

The map_get residue: there is none, and that is a positive result

I initially reported "12 sites to repair". Classifying by the match arms rather than the spelling, over current main:

• 12 sites reach v2.std.collection and match Accepted/Rejected — Outcome-shaped, i.e. correct consumers of the declared fn. These are the twelve. Repairing them would have rewritten twelve correct call sites away from the authority they were deliberately written against — a regression, in a lane whose entire subject is that one name can mean two things.
• 85 sites are builtin-shaped (Present/Absent), and every one has reaches_declarer = false — they resolve to the builtin and typecheck, as written.
• The intersection of builtin-shaped and reaches the declarer — the only actually mis-resolved shape — is ZERO.

Row 30 asserted that none of the 43 is currently mis-resolved, from the absence of diagnostics. This establishes the same claim constructively, from a direction the row could not reach: absence of a symptom and emptiness of the intersection are different facts, and the second is the one that holds. The class is latent, not live — now on evidence rather than on silence.

gunbc#8944 (merged, ac9e010a83) repaired four sites — dag/extdeps/git/object_store.dag ×2, src/v2/workflow/floor_preparation.dag ×2 — using the Map primitive method X.lookup(key) rather than switching to map_lookup, because map_lookup lives in v2.std.collection, the very module whose closure presence is the unstable fact. Those four are in main and in this branch via a merge; they are absent from every count above. No exclusion set was needed, and no repair set exists.

This PR therefore edits no map_get call site.

---

The emit_map_has deletion (independent repair, own commit)

Row 30 with the halves swapped: there, a consumer's import closure changes a name's meaning; here, the closure is the only thing supplying one.

A registry row types a bare call; an interpreter arm runs it. emit_map_has had the first and not the second — no free-call arm, no method arm, no bridge — so the call typechecked clean and answered NoSuchFunction at evaluation. Measured by execution, not by reading the dispatch table: a probe calling it bare through gunbc run refused with NoSuchFunction, while the same probe's map_get and length returned 7 and 3.

20 of 20 live call sites reach the declared v1.compiler.infer_types emit_map_has through their own closure, so none loses resolution. That is exactly what kept the row invisible: nothing was ever served by it. (An earlier message of mine said 21. That figure counted the declaration in 04_types.dag as one of its own callers — the measure-the-name-rather-than-the-binding error this PR exists to close, committed inside the receipt for it. git grep puts the occurrence count at 21 on every commit involved, so nothing moved under me; I simply miscounted, and the correction is recorded in the source note rather than quietly applied.)

Deleting the row costs no call site and makes the typecheck honest: a future caller outside that closure now gets an unresolved-name refusal at compile time instead of a runtime NoSuchFunction. Rung: runtime failure → compile-time refusal for that name; mechanically preventable, not structural — nothing yet prevents authoring the next registry row with no runtime behind it. Next-rung trigger: the PrimitiveIdentity join, which is precisely the registry-row-to-runtime join this row was missing.

---

src/v1's 54 sites — named, not deferred silently

to_string 31, emit_map_has 20, map_has 3. They fall in the gap between the two arms above: the witness roots are ["dag", "src/v2"], so no floor witness can import a src/v1 module, and the census instruments above do not reach them. They are in scope for this program and are recorded here rather than dropped:

• emit_map_has's 20 are resolved by this PR — all reach the declaration, and the phantom row that could have shadowed them is gone.
• to_string (31) and map_has (3) remain unmeasured by execution. Not asserted clean: no control probe was run against them, because the instrument that would run it cannot reach src/v1. They ride the same PrimitiveIdentity dissolution as the dag/src-v2 census, and the honest status is unmeasured, not one authority.

The length question is answered, by the join lane rather than here

I had recorded this as open: the length verdict shows the free-call builtin arm intercepting ahead of user-fn dispatch, so the declared v2.std.algebra.length body cannot run for a bare call — does that generalize to the other projection declarations?

It does, and gunbc#8964 (the PrimitiveIdentity join, gentle-koi-563) establishes it by reading the declarations rather than by probing them, and splits the five names into three fidelities:

• HostRealizedSeam — body is a self-call, so the declaration could not survive being reached. decl_facts, export_signature_facts, data_decl_type_facts, concept_decl_facts, concept_decl_facts_live, empty_map_primitive_delegate.
• ModeledProjection — a real body the builtin arm intercepts ahead of. length, map_insert, empty_map. This is the answer to my question: dead code with a live spelling.
• DivergentProjection — map_get, Outcome<Optional<V>> against the primitive's Optional<V>. Genuinely two authorities, and it must keep refusing at this wall.

That carrier reproduced the emit_map_has finding below from the model (registry_no_runtime=4: emit_map_has, Some, to_int, with) rather than from my probe — which is the receipt that the mechanism works, not that one specimen happened to be found.

What this wall will consume when the join merges, agreed across the two lanes and stated here so a future reader can check my seam against their type rather than against a message thread: my suppression consumes DeclarationProjectsPrimitive and nothing else. Every other arm is either a refusal (NotAProjection, DivergentProjection) or a fall-through (SymbolUndisposed). Concretely — seam → suppress silently; modeled → suppress plus an advisory naming the intercepting primitive; divergent → refuse with the divergence text beside both candidate identities; not-a-projection → refuse; undisposed → do not refuse, fall through to today's behaviour and count.

DeclaredCallable { owner_module_path, decl_name } becomes std.decl_ref DeclarationRef at that point rather than staying a structural twin of it; it is minted locally today only because v1's infer_sigs cannot import a dag/ module.

What remains for the join, measured under 1a

Counting bare calls only — a qualified v2.std.collection.map_get(...) is an exact reference naming one exact declaration, not a bare call, and my first pass wrongly counted three of those as bare — and splitting by whether the author named the authority and whether the closure reaches the declarer:

name	bare sites	1a: named, resolves	1b: refuses	modules
length	797	373	244	76
map_insert	620	434	71	4
empty_map	294	186	23	5
decl_facts	35	24	3	3
map_get	97	12	0	0

341 refusals across ~88 modules, and every one of the four names carrying them is already disposed in gunbc#8964 with a suppress verdict (length/map_insert ModeledProjection, decl_facts HostRealizedSeam). So the stacking is now measured rather than assumed: 341 ≠ 0, this PR cannot merge first, and nothing further is needed from that lane once it does.

There is no live map_get collision left in dag/ or src/v2. After gunbc#8944 the 1b count for it is zero: 12 sites name the authority, 85 never reach the declarer. The wall's RED for it is therefore fixture-authored, not corpus-present — which §4b makes the correct posture rather than a gap, since reachability is judged against what a fixture may author, never against what the accepted corpus contains. What the wall buys is that the next such collision refuses instead of silently re-typechecking three untouched files.

The resolver consumes the join by ordinary import. I claimed src/v1 could not import a dag/ module and built a two-branch integration question on it; that was false, and gentle-koi-563 refuted it by reading the file. src/v1/04_lookup.dag — the module this wall lives in — opens with import std.induction (line 3) and import std.algebra (line 23), both dag/std/*; 31 of 47 src/v1 .dag modules import a std./extdeps./gunbc. module today, and dag/std/primitive_identity.dag imports nothing from src/v1, so the edge cannot close a cycle. The error was reading the witness roots (["dag", "src/v2"], which govern what the floor discovers) as a rule about the import graph — where §3 says acyclicity is the only structural law and folder prefixes are browsing conventions.

Unowned scope, named so it is not silently dropped: to_string (31), map_has (3) and the deleted emit_map_has (20) are src/v1 declarations. A projection row needs a declaration to point at, and whether src/v1 declarations get rows at all is a scope question rather than three rows. It belongs to neither this lane nor the join lane today.

The SymbolUndisposed arm is not bookkeeping — it is where this join could have manufactured 196 refusals

196 of 209 census symbols are undisposed today; 13 are disposed. If "nobody has classified this yet" reaches my seam as the same answer as "classified as not a projection", the wall refuses on the first one — and that is absence of a classification rendered as a classification of not. Two states, opposite repairs: the first is closed by disposing a symbol in the join's carrier, the second by qualifying a reference at a call site.

What makes it worse than an ordinary state-space conflation is the direction it fails in: it converts an incomplete census into a corpus-wide refusal, so the wall's strictness would scale inversely with how much of the census was done. A join whose entire purpose is to remove refusals would have produced more than it removed — and it would have looked correct from both sides, because both halves check out and only the arrow between them is invented: the carrier answers truthfully that no projection is declared, and this resolver reasons soundly that an undeclared projection means two authorities.

It is being fixed structurally rather than by agreement: the two arms are distinct arms of one total answer, so this seam cannot silently merge them and any future consumer must name both. An agreement between two lanes evaporates when either session is archived; a coproduct does not.

The eleventh consumer, and why a .dag census could not see it

The specification names ten consumers of func_sig_if_resolved — nine in v1.compiler.infer, one in v1.compiler.emit. There is an eleventh: src/v1/stage0/src/cli_run.rs, which is hand-written periphery, not emitted code. The modules compiled clean as .dag and emitted fine; the build then failed as Rust with E0432: unresolved import crate::v1_compiler_infer_lookup::func_sig_if_resolved.

That is this PR's own subject turned on the PR: a census over the .dag corpus answers "who consumes this declaration" for the emitted world only, and the hand-written seed periphery is a second population no .dag query reaches — the same shape as the src/v1 residue that no dag/-rooted witness can import.

All three of its uses are inside tests that deliberately pin the legacy ImportScoped policy, and their own comment already records that the default policy yields "a typed AmbiguousReference instead of a first-hit pick". So this is the one place the collapse is legitimate — under ImportScoped no ambiguity can arise, and the other assertion is a genuine miss. They now route through a #[cfg(test)] helper that performs the collapse locally and states why, rather than through a production projection that erases the arm for all eleven.

// annotations must sit at module-item grain

Three of this branch's required-regen refusals were mine and all had one cause: ten annotation lines written inside declaration bodies, which the src/v1 parse sweep refuses because only module-item grain is modeled (DESIGN §4c). Hoisted to module scope, each attached to the declaration it describes and naming the arm inside it. Recorded because §4c is behaving exactly as written and this is the second lane to hit it. The #8691 second-pass regen red on main is a different failure, downstream of where mine were stopping — mine are closed and that one is inherited.

The lane's real output

Three times on this lane I was wrong in the same way: I measured a name rather than a binding.

1. The drift probe counted the diagnostics a source produced rather than the ones its call produced — so an import closure's own diagnostics read as drift. Three of four first-pass results were false. Fixed by a control source.

2. The residue count matched a spelling rather than the authority each site was written against — so twelve correct consumers read as twelve repair targets. Fixed by reading the match arms.

3. The emit_map_has receipt counted the declaration as one of its own callers — 21 occurrences reported as 21 call sites, when there are 20 and one definition. Fixed by excluding the definition. This one was committed to source, inside the note explaining that a name's occurrences are not its bindings.

4. I claimed src/v1 cannot import a dag/ module, and built a two-branch integration question on top of it. src/v1/04_lookup.dag — the file the wall lives in — opens with two such imports. I had that import block on screen an hour earlier while looking for something else.

The third is the instructive one, because I already knew the rule when I made it. "Pair the measurement with something that discriminates" is true and turned out to be insufficient as a defence: the discriminator has to be applied to the thing being counted, not held as a principle. The operational form is narrower and checkable:

When the unit is a binding, the denominator must exclude the declaration. A grep for a name returns definitions and uses in one undifferentiated number.

The fourth needed a different control, and gentle-koi-563 supplied the general one after making the same class of error independently (misreading ps -o etime as HH:MM when it is MM:SS, and publishing the wrong figure twice before a 75-second sleep settled it):

Any claim of the form "X cannot Y" or "nothing does Z" names a set it asserts is empty. The control is to go find one element. One grep, and 04_lookup.dag was the first hit.

All four of mine and all three of theirs were claims of that shape, and every one had a cheap counterexample sitting in the tree.

That generalization is worth more than the wall, and it is the thing that otherwise gets rediscovered in six months by someone who greps.

---

---

The architectural constraint nobody has stated

Consuming the PrimitiveIdentity join from the wall means the seed imports std.primitive_identity, and that is where this branch met a boundary that is enforced nowhere:

The v1 seed closure has never contained a v2.* module. Zero of 47 src/v1 modules import v2.*, and neither do the closures of the two dag/ modules the seed already imports (std.algebra closure = 2 modules, 0 of them v2.*; std.induction = 9, 0). std.primitive_identity's closure is 33 modules, 11 of them v2.*, all reached through a single edge: gunbc.v1_interpreter_primitive_surface imports v2.std.qualified_name.

Nothing declares this constraint. It is enforced only accidentally, by regen refusing an unresolved import — a symptom-level refusal that names a missing module rather than the rule it is protecting. A contributor adding one import to a dag/ module the seed consumes has no way to learn the rule exists until a regen red names a file they did not touch. That is worth more than this PR's mechanism, and it is recorded here rather than fixed, because widening the seed's module index is an architectural decision several orders above this brief.

What the 29 → 0 collapse proves

Wiring the join dissolved 29 seed collisions to 0 (to_string ×26, map_has ×3). None of them was a ModeledProjection I had qualified: every one answers DeclarationPrimitiveUndisposed, so the builtin is not admitted as a rival and the refusal never fires.

That is a receipt for the join's third arm rather than for this wall. DeclarationPrimitiveUndisposed was authored as the honest third state — this symbol is on a primitive surface, but nothing has disposed of the relationship — and had no consumer at the moment it landed. The first real population it met was these 29, and it classified all of them correctly. A three-arm answer whose middle arm has never been exercised is indistinguishable from a two-arm answer with a dead branch; this is the measurement that separates them.

Four seed import repairs authored before the join was wired are reverted in this branch (b6b547c522). Their justification evaporated when the collisions did, and four edits whose stated reason no longer exists are exactly the residue that gets rediscovered six months later.

Which direction the dependency runs: PrimitiveIdentity sits below callable resolution

Stated explicitly because the opposite wiring is available and would be a layer inversion: callable resolution consumes the projection answer; it never asks whether a declaration happens to equal a primitive.

declared_candidate_rivals_the_builtin calls primitive_projection_for_declaration(decl_ref(owner, decl)) and matches its three arms. That is the whole of the interaction. It performs no taxonomy work of its own — it never inspects a PrimitiveIdentity (the identity field is discarded at the binding), never compares authored symbols, never consults a surface roster, and never repairs or supplements a projection row. It asks one question and maps the total answer onto one local question: is the builtin a second authority for this name, or the same one?

That is the boundary that keeps the two concerns separable. If the wall instead reconstructed the primitive relationship itself, callable resolution would become responsible for repairing primitive taxonomy — every gap in the roster would surface as a resolution defect owned by the wrong lane, and the wall's correctness would be coupled to the completeness of a population it has no standing to fix.

One consumer-side policy choice is worth naming so it isn't misread as taxonomy work: DeclarationPrimitiveUndisposed maps to not a rival, i.e. suppress. The wall does not decide anything about the primitive; it decides what this consumer does under ignorance, and it decides it fail-closed in the direction that matters here — refusing on an unclassified symbol would refuse the 196 undisposed symbols corpus-wide, which is the false-refusal storm rather than a wall. The projection answer keeps absence and ignorance as separate arms precisely so the consumer can make that choice explicitly instead of inheriting it from a collapsed boolean.

---

Import-safe and emit-safe are two properties, and only the first was verified

This is the finding worth more than anything else in the PR, and it was found by being the first consumer of someone else's module.

std.primitive_projection (#9060) was landed as the seed-safe leaf this wall needs. Its acceptance criteria verified that its import closure stops at std.decl_ref/std.types and reaches no v2.* module. That check was correct and it passed.

Nobody checked that the seed can emit it — and the seed must, because a seed-consumed module becomes a committed Rust mirror. Attempting the consumption produced nine compile_error!("unsupported mock expression") rows in src/v1/stage0/src/std_primitive_projection.rs, one per data row in the leaf. The module could not be consumed by its intended consumer.

Generalised, because it outlives this module: for any module intended for seed consumption, closure-stops-here is necessary and not sufficient. The sufficient check is an emit. The two properties are independent, and only one of them has a mechanism today.

The defect underneath it

05_emit_rust.dag data_value_has_cross_refs answers does this initializer reference another declaration, and emit_data_def uses it to choose between the JSON serializer (literals only) and emit_typed_expr (anything):

ExprVar { binding_kind: _ } => true      // a bare name is a reference — correct
ExprListLit                => descends
ExprRecordLit              => descends
_                          => false      // ExprCall lands here

A call is that same reference with an argument list attached. It fell through _, so data d: R = mk(..) went to a serializer that cannot represent a call, which then refused — the failure surfaced one layer below the judgment that caused it.

Total at the level examined, blind one level down. Exhaustive over expr_data, no arm missing, nothing for a reviewer or a wildcard-free lens to catch, because the _ carried the payload. Wrong by the function's own definition rather than incomplete.

The census that authorised the one-arm repair, with three instruments

instrument	scope	count
line regex (wrong)	initializer is a call	1259
multi-line, string-stripped	initializer is or contains a call	3181 across 971 files
emitted mirrors (ground truth)	rows actually refused	9, all in the new leaf

The line regex was wrong by 2.5×: blind to multi-line initializers, and blind to the class that matters most — the predicate descends into record and list literals, so Foo { a: bar() } flips too.

The third instrument decides, because only the seed closure is lowered to Rust and the JSON branch is guarded by record-shaped type AND no-cross-refs. Every row on that path today emitted successfully, which by construction means it holds no call. So nothing that works today can move. DissolutionCondition (6 seed rows) is a coproduct and String (2) is not a record — which is why PrimitiveIdentity { slug: NonEmptyStr } supplies the first rows in the seed closure's history to satisfy both conditions at once, and why the defect stood this long unasked.

Verified after: JSON-path rows 34 before, 34 after — zero existing rows changed route. The emitter mirror moved by exactly one line.

The discriminating red, demonstrated rather than claimed

The nine compile_error! rows are evidence that self-destructs — they exist only while the defect does. The regen fixed point survives the fix:

arm	verdict
present	first_generation_equal=true
removed	FAIL generated surface drift: v1_compiler_emit_rust.rs

Run both ways rather than argued. Its RED is authorable where the check runs (one arm in a .dag file regen reads every run), so this is not the permanently-green decoration case.

The storm, measured at full scale

The pre-join wall produced 608 refusals across 79 files on four names — length ×454, map_insert ×154, to_string ×26, map_has ×6 — and zero were genuine two-authority collisions. That is the case for the join reaching the seed, stated in the only currency that matters.

With the join wired and the transient bootstrap imports removed: zero ambiguity refusals, first_generation_equal=true, and all six witness assertions returning true against a binary built after install.

Two corrections to my own record

The revert commit message was incomplete. I removed four seed import edits saying their justification had evaporated. The stated one had — the join makes them unnecessary. They carried a second, unstated role I had not identified: they satisfy the old mirror's level 1a, which is what lets regen run at all during the bootstrap. Removing them broke the build for a reason the commit message gave no way to recover.

I quoted a corpus-wide count as a blast radius before reading the guard. 1259, then 3181, when the number that answers the question is 9. The number you can get quickly is not the number that answers the question, and it is always the scarier one. Read the thing that decides — the guard, the scope, the visible set — before counting the thing that is easy to count.

---

Status: ready for review. The closure question that parked this PR is resolved — #9060 landed std.primitive_projection, the seed-safe leaf, and this branch is its first consumer. Consuming it surfaced an emitter defect that blocked the consumption entirely; that repair is authorised, scoped to one arm, measured against the actual guard (34 JSON-path rows before and after — zero existing rows moved), and carries a discriminating red demonstrated in both directions.

Verified on the runner, not just locally: the required CI run — parse, regen, v2-emission, witness floor — is green, with required-regen: first_generation_equal=true. Zero ambiguity refusals corpus-wide, against 608 before the join reached the seed.

The inherited cargo check --all-targets break this branch also repaired was split out as #9142 and then closed as superseded — the identical fix landed independently as #9125. Three sessions found that break in one day, which is the gap its body names: no test-target compilation in CI since 2026-07-11, so the cost is paid in repeated rediscovery rather than once at the break.

[gunbai-bot]

Why this is red, and why it stays red while parked

cited-symbol refuses three sites with ambiguous reference 'length': 2 candidates: v2.std.algebra.length, <builtin:length>.

That is this PR's wall firing from a stale mirror, not a defect in the wall as specified. Measured on the committed src/v1/stage0/src/v1_compiler_infer_lookup.rs:

• the candidate-collection wall is installed (9 references to the ambiguity path), but
• authored_import_names — the 1a narrowing — appears in no mirror, and
• primitive_projection_for_declaration — the join consultation — appears in the lookup mirror not at all.

So CI is executing the pre-1a, pre-join wall: every declared homonym rivals its builtin unconditionally. v2.std.algebra.length is a ModeledProjection in primitive_projection_roster(), so with the join wired the builtin is not admitted as a rival and these three sites resolve. This is precisely the corpus-wide false-refusal storm the join was built to prevent, observed on the population that still runs without it.

Closing it means regenerating and installing the mirrors. That pulls std.primitive_identity into the seed closure, and regen then refuses unresolved import: module 'v2.std.qualified_name' not found (imported by 'gunbc.v1_interpreter_primitive_surface') — the closure constraint recorded above. The red and the parked architectural question are the same fact, so it is not independently fixable here and I am not routing around it.

Status: parked pending an operator ruling on whether the seed's module index may reach src/v2. The branch is deliberately left with the wall consulting the join — the state that is correct if the answer is yes, and mechanical to revert if it is no.