PrimitiveIdentity join: one identity per primitive across registry, PrimitiveContract rows, algebra templates, interpreter dispatch and emit handlers

[briansrls]

What this lands

One authority that can answer, of a declaration, whether it is the modeled surface of a primitive — keyed on identity rather than on a spelling, and total.

fn primitive_projection_for_declaration(declaration: DeclarationRef) -> PrimitiveProjectionAnswer

type PrimitiveProjectionAnswer
  = DeclarationProjectsPrimitive { identity: PrimitiveIdentity, fidelity: ProjectionFidelity }
  | DeclarationProjectsNoPrimitive                              // classified: not a projection
  | DeclarationPrimitiveUndisposed { authored_symbol }          // unclassified: nobody has said

type ProjectionFidelity
  = HostRealizedSeam
  | ModeledProjection
  | DivergentProjection { divergence: NonEmptyStr }

The consumer is the bare-call candidate collector in #8952, whose first corpus run refused 1215 sites across 5 names because a modeled std surface and the primitive it projects are two co-candidates with no relation between them. That is the §3 defect in its plainest form: the fact this primitive is served by the host is carried in three forked places (builtin_function_registry on the typecheck side, the interpreter dispatch tables on the runtime side, X_host_binding rows on the declaration side, present for two names out of the population), and there is no single authority to ask.

Why three fidelities and not a boolean suppress

I read the declarations rather than matching the names. The five collision names are three classes, and a boolean would have had to put map_get somewhere — suppress it and the only real finding in the 1215 is erased; refuse everything and the wall stays unlandable. A three-state does not choose, it distinguishes, and the residue falls out of the model instead of out of a threshold.

fidelity	rows	evidence
HostRealizedSeam	v2.std.decl_index decl_facts, export_signature_facts, data_decl_type_facts; v2.std.concept_index concept_decl_facts, concept_decl_facts_live; v2.std.collection empty_map_primitive_delegate	the whole body is a self-call (decl_facts(pool_roots: pool_roots))
ModeledProjection	v2.std.algebra length; v2.std.collection map_insert, empty_map	a real body the builtin arm intercepts ahead of
DivergentProjection	v2.std.collection map_get	declared Outcome<Optional<V>> against the primitive's Optional<V>

declaration_and_primitive_are_one_authority is true for exactly the first two.

Why the first two are not one variant

They agree at the resolver — both suppress — so the distinction has to earn its keep elsewhere, and it does. A HostRealizedSeam body is correct by construction: reaching it recurses to the evaluation-budget refusal, which is what a declared host seam should look like. A ModeledProjection body is dead code that looks live — v2.std.algebra length has a genuine fold_list body that no bare call reaches, and someone will eventually edit it believing it runs. Different facts, different futures; averaging them would erase that. tidy-pike had this recorded as an open question in #8952 and will carry the fidelity into the advisory rather than only the boolean. Repairing the dead-code half is not claimed here.

The identity key — DFS before minting

No new identity type was minted. The key is std.decl_ref DeclarationRef, which is the namespace layer's own identity for a declaration; §3 makes namespace the declaration-identity authority and its cite-the-symbol rule is literally name the module and the symbol. What I looked at before settling on it: v2.std.qualified_name QualifiedName (FreeMonoid<Symbol>) is the v2 segment-list form and lives downstream of dag/std, so a std carrier keying on it inverts the direction its consumers read; std.decl_ref DeclarationRef is already the carrier D0 uses, already carries a field discriminator and declaration_ref_eq, and its own header records that two parallel lanes minting duplicate constructors was the collision that redded this witness closure once already. Minting a third module-path-plus-decl-name pair beside it would have repeated, inside the PR whose subject is single authority, exactly the history DESIGN records for ModulePath.

The shape explicitly refused (operator ruling, relayed): generalizing the X_host_binding: PrimitiveContract marker to the ~8 declarations. It is a second representation scattered beside each fn rather than one authority; it keys on a bare name inside a module scope so two same-named declarations collapse; and it has no room for a fidelity. Module qualification answers the second, one carrier answers the first, ProjectionFidelity answers the third.

The second direction, from #8952's own finding

The projection query is blind by construction to a primitive with no declaration. tidy-pike found one by probing: emit_map_has was a registry row with no runtime at any tier, typechecking clean at 21 call sites that all happened to reach a same-named declaration through their own closure. So this PR also lands the opposite question:

fn primitive_runtime_coverage(authored_symbol: String) -> PrimitiveSurfaceRuntimeCoverage
  = RuntimeRowOnInterpreterDispatch | RuntimeRowOnEmitHandlerOnly | NoRuntimeRowOnAnySurface

It reports a census fact — no InterpreterDispatch and no EmitHandler row on the derived five-surface census joins this symbol — not an adjudication that no runtime exists. A dispatch site the interpreter roster does not enumerate is invisible here exactly as it is to every other consumer of that roster, which is the standing limit that roster records for itself.

The residue is counted, not described

The open denominator was prose. Prose has no size, so it never ranks for closing. It is now a typed disposition at symbol grain:

type PrimitiveSymbolDisposition
  = SymbolJoinsDeclaredPrimitive { authored_symbol, identity }
  | SymbolUndisposed { authored_symbol }

primitive_undisposed_surface_symbol_count() is a number the next session re-derives by running it. The witness over it deliberately asserts that the classifier is total over the census, not that the residue has any particular size: a size assertion would be a tree-copied census pin, and it would go red the day the terminal bar is reached — which is the defect the roadmap node already records against an earlier acceptance clause of this same carrier. Measured population for context (five surfaces, distinct authored symbols): registry 122, contract rows 64, algebra 87 rows / 59 names, emit handlers 57, interpreter 188 rows / 164 spellings — 209 distinct symbols over ~518 census rows.

The census join now consults the declared population by canonical name after the D0 alias table. That is not a spelling rule: a symbol joins only if a PrimitiveDefinition for that canonical name has been declared, so a surface growing a new symbol nobody declared stays SymbolUndisposed and is counted.

What the consumer gets at merge

This carrier's claim is about what the query answers, which is executed here. It is deliberately not a claim about how many call sites a consumer's resolver refuses — that population belongs to #8952, is measured there, and has moved twice while this PR was open.

At head 1b741a705c, asking the exact query that resolver will ask. The evidence column says how each row is established, because they are not all established the same way:

declaration	answer	consumer's action	evidence
v2.std.algebra length	ModeledProjection	suppress the builtin co-candidate	probe, executed
v2.std.collection map_insert	ModeledProjection	suppress	probe, executed
v2.std.decl_index decl_facts	HostRealizedSeam	suppress	probe, executed
v2.std.decl_index data_decl_type_facts	HostRealizedSeam	suppress	probe, executed
v2.std.collection map_get	DivergentProjection	refuse, with the divergence text	probe + witness
v2.std.collection empty_map	ModeledProjection	suppress	witness asserts one authority; the fidelity value is read from the roster, not executed
v2.std.algebra to_upper (no row)	DeclarationPrimitiveUndisposed	fall through, do not refuse	witness, executed
v2.std.collection list_at_optional	DeclarationProjectsNoPrimitive	two authorities	witness, executed

The empty_map caveat is small and stated anyway: w_seam_and_modeled_projections_are_one_authority proves it is one authority, which is what the consumer acts on, but no executed assertion distinguishes its ModeledProjection from HostRealizedSeam. The value in the table is read from the roster literal in this diff.

Every name #8952 identified as a collision is disposed and carries a row, so nothing in their merge is serialised behind further disposition work here.

An earlier revision of this section asserted site counts — "all 1161 sites resolve at merge, 1149 suppressed and the 12 map_get sites correctly refusing". Both halves were wrong and the error is worth naming rather than just deleting. The counts were #8952's, measured before their resolver gained a level-1a arm that resolves any name the author brought into scope; and the map_get sites in particular all name map_get in an import list, so they resolve at 1a and never reach the divergent verdict at all. DivergentProjection remains the right verdict for the symbol — what I got wrong was where that verdict gets consulted, which is a fact about the consumer's resolver and not about this carrier.

The general shape: I borrowed another lane's measurement to assert a consequence in a graph I had not measured. Both halves checked out on their own; only the arrow between them was invented. This PR now states what it executed and points at #8952 for the population, which is where that authority lives.

Absence is two states, and collapsing them would have inverted this PR's purpose

DeclarationProjectsNoPrimitive originally carried both "no primitive-bearing surface carries this name, so no builtin co-candidate can exist" and "a surface does carry it, and nobody has classified this declaration". Those have opposite repairs — the first is closed by qualifying a reference at a call site, the second by disposing a symbol in this carrier — and at a candidate-resolution wall the ignorance arm lands on the refusing side.

The consequence is the part worth stating: the wall's strictness would have scaled inversely with how much of the census is disposed. At 13 of 209, that is 196 manufactured refusals from a join whose entire purpose is to remove refusals — and it would have looked correct from both ends. This side answers truthfully that no projection is declared; the consumer reasons soundly that an undeclared projection means two authorities. Both halves check out; only the arrow between them is invented.

So it is a third arm of the same total answer rather than an agreement between two sessions — both of which will be archived. A consumer cannot silently merge them, and every future one must name all three to compile.

The same split existed one layer down, in the runtime-coverage arm: NoRuntimeRowOnAnySurface measured the rosters do not enumerate this and read as nothing runs it. It is now RuntimeRowAbsentFromEnumeratedSurfaces, which says what it measures. to_int and with are exactly the symbols where that distinction decides whether someone files a defect against a live method-dispatch path. Carried as a variant rather than a note, because a caveat gets read later as hedging and dropped while a variant has to be named to compile.

Raised by #8952 in review of the query shape; correct independently of that consumer.

What this does NOT claim

• Not the terminal bar of roadmap node primitive-identity-join. Population-wide closure across all five surfaces stays open and stays that node's; the 209-symbol disposition is roughly 80 host query bridges that are not primitives at all, it is a large volume of individual judgment calls, and none of it is what unblocks CALLABLE-LOOKUP-UNIQUE: collect every admissible callable candidate before deciding, and stop erasing the ambiguity arm #8952. Scoped deliberately, on the operator's ruling, with the distance to the bar now a number instead of a sentence.
• Not a repair of the ModeledProjection dead-code class. This carrier makes it observable; fixing it is a separate lane.
• Not a change to the interpreter's resolution path. Nothing in src/v1 is touched.

Evidence

The carrier is verified by execution. A local probe (uncommitted, deleted after the run) called the carrier's own functions against the live five-surface census on the tree at d3d173dc7f:

PROBE HELD distinct=209 disposed=13 undisposed=196 registry_no_runtime=4

PROBE HELD means every one of these passed: the three fidelities answer for their named declarations (decl_facts seam, length modeled, map_get divergent); an unclassified declaration answers DeclarationProjectsNoPrimitive; map_get is not one authority while decl_facts / length / map_insert / empty_map are; length against primitive_map_insert is not one authority; the roster carries zero violations, exactly 1 divergent row and exactly 9 one-authority rows. Those two row counts are a controlled fixture — the population and the expectation are both authored in this PR — not a measurement copied from the tree.

Two numbers in it were predictions I had made statically and had labelled as unverified, and execution confirmed both: the census derives exactly 209 distinct authored symbols, and registry_no_runtime=4.

registry_no_runtime=4 is a CANDIDATE SET, not a defect count, and it should be quoted as one. The four are emit_map_has, Some, to_int, with. What the carrier measured is that no InterpreterDispatch and no EmitHandler row on the derived census joins these symbols — it did not establish that they have no runtime. A method-dispatch site the interpreter roster does not enumerate would look identical here, and to_int and with both have contract rows and algebra templates, so they are exactly the shape that could be perfectly live. Some is a constructor spelling. Only emit_map_has is an established defect, and it was established by #8952's probe, not by this count — the value of reaching it here is convergence: two instruments of independent construction, one probing the runtime and one reading the census, returning the same specimen. That is a receipt that the mechanism generalizes; it is not a licence to read the other three as findings.

disposed=13 / undisposed=196 is the counted residue against the terminal bar, and it is the number this PR exists to make readable.

All 35 witnesses pass. claim_batch over both entry groups under one prepared subject — the 19 new witnesses plus the 16 existing D0/D1 witnesses, run as a regression check because this PR rewires the census join:

PASS=37 FAIL=0   wall_seconds=132
[floor-phase] phase=whole-tree-graph-facts state=completed wall_ms=30870
[resolve-summary] 2 resolve(s) in 1806ms wall; 37 witness(es) in 1073ms wall

37 = 21 witnesses in the new file + 16 existing D0/D1 witnesses run as a regression check, because this PR rewires the census join. The new discriminating pair for the absence split is list_at_optional (carried by no surface → classified NoPrimitive) against to_upper (on the census, no projection row → Undisposed); a carrier that collapsed absence answers identically for both, so one of them reds.

Per-witness cost is 0–119ms; the most expensive is w_every_census_symbol_lands_in_exactly_one_disposition_arm at 119ms, which derives the whole five-surface census. The run's own cost partition attributes 49.8s of its 51.6s to building the whole-tree bare-reference edge index once (edge_index_tree_census 34.4s over 3881 source files) for declarer discovery — a fixed preparation cost unrelated to this change, which the required floor pays once across every witness.

A correction, recorded rather than silently edited, because I published this claim wrong twice in opposite directions.

An earlier revision of this section said a standalone claim_batch run "takes over an hour per invocation" and blamed the instrument. A later revision retracted the two-minute figure as unreproducible. Both were wrong, and the same mistake produced both. I was reading ps -o etime as HH:MM; it is MM:SS under an hour. Confirmed against a control: a process slept for a clock-measured 75 seconds reports etime=01:15, etimes=75. So every "hour-plus" figure I reported was a run of one or two minutes, and the compounding error was that I had no clock on the wall time between my own observations and assumed successive readings were minutes apart when they were seconds apart.

The measured facts, by date +%s around the invocation rather than by reading ps: a full run of both entry groups completes in roughly two minutes, of which ~30s is the one-time whole-tree graph-facts build. The compiler's own instrumented spans — 1755–1857ms of entry resolve, ~1s for all witnesses, 0–119ms each — were consistent across every run and were the defensible numbers the whole time. There was never a cost problem in this change, and there was never a cost problem in the tooling. There was a misread format.

I am leaving this here at length because the failure shape is the reusable part: three successive conclusions (the run blew its timeout, my census functions were 15x cost, the tooling is inherently slow) were one bad instrument reading wearing three explanations, each moving the cause one layer outward without ever questioning the measurement. When a second explanation is needed to rescue the first, stop explaining and re-measure the baseline with a different instrument.

Two defects found and fixed in this PR's own witnesses

Named here rather than left invisible because they never shipped. Both are the kind that pass review, since a green test reads as evidence.

An inverted red. The residue witness originally asserted undisposed > 0. That red is not merely unreachable — it is inverted: it goes red on the day the work succeeds, silently converting the roadmap node's terminal bar into a permanent obstacle. It was written into the same carrier whose roadmap node already records that exact defect against an earlier acceptance clause of itself, so this is a class recurring inside the file that documents it. The witness now asserts that the disposition classifier is total over the census and says so in a comment, and no size assertion is made anywhere.

A measure() == measure() partition. divergent_row_count and disposed_symbol_count were each computed by subtracting from a total, so the partition witnesses over them restated the definitions of their own operands — the change-detector shape DESIGN's oracle rule names. Both are now independent filter counts, and the one surviving sum assertion tests that the classifier is exhaustive rather than that arithmetic works.

Rung

Mechanically preventable for the projection class: the invalid states (a projection naming an undeclared primitive, two projections for one declaration) are detected by executing detectors with discriminating REDs, but both remain writable. Next-rung trigger: deriving the roster from the declarations rather than authoring it beside them, which needs declaration introspection over .dag bodies — the same trigger primitive_contract_roster_note already carries.