Preserve resolved callable identity through Rust emission

dag/gunbc/host_effect_realize.dag

@@ -2639,6 +2639,10 @@ fn srv3_toolchain_receipt(observations: List<Srv3ToolObservation>) -> String {
   )
 }
 
+fn srv3_observation_verdict(observation: Srv3ToolObservation) -> Srv3HostPredicate {
+  observation.verdict
+}
+
 fn srv3_realize_os_install_actuator_toolchain_ensure_body(
   transport: HostEffectTransport,
   effect_intent: HostEffectIntent,
@@ -2653,7 +2657,7 @@ fn srv3_realize_os_install_actuator_toolchain_ensure_body(
     },
   )
   let verdict = srv3_summarize_independent_observations(
-    steps: list_map(xs: observations, f: fn(o) { o.verdict }),
+    steps: list_map(xs: observations, f: fn(o) { srv3_observation_verdict(observation: o) }),
   )
   let stdout = srv3_toolchain_receipt(observations: observations)
   match verdict {

dag/std/primitive_projection.dag

@@ -5,10 +5,20 @@ import std.types { List, NonEmptyStr, String }
 
 data primitive_projection_seed_boundary_note: String = "The declaration-to-primitive projection is a seed-consumed substrate authority, so its import closure stops at std.decl_ref/std.types and never reaches a target roster or v2 module. This module is a strict relocation of the projection identity, fidelity, roster, and exact-declaration query formerly declared inside std.primitive_identity. std.primitive_identity consumes this authority for its census and total disposed/undisposed answer; the stage0 resolver consumes the same exact-declaration query. Required regen is the mechanical wall: src/v1 importing the former home reached gunbc.v1_interpreter_primitive_surface and then v2.std.qualified_name, which the src/v1 + dag bootstrap closure correctly refuses. The refusal is the seed-safety boundary working, not build friction."
 
-type PrimitiveIdentity { slug: NonEmptyStr }
+data primitive_identity_slug_prefix: String = "primitive."
+
+type PrimitiveIdentity sole_constructor { slug: NonEmptyStr }
+
+// The seal governs .dag construction; generated Rust mirrors remain ordinary
+// structs and therefore are not an end-to-end construction wall.
 
 fn primitive_identity_slug(name: String) -> PrimitiveIdentity {
-  PrimitiveIdentity { slug: concat("primitive.", name) as NonEmptyStr }
+  PrimitiveIdentity { slug: concat(primitive_identity_slug_prefix, name) as NonEmptyStr }
+}
+
+fn primitive_identity_runtime_name(identity: PrimitiveIdentity) -> String {
+  let slug = identity.slug as String
+  substring(s: slug, start: string_length(s: primitive_identity_slug_prefix), end: string_length(s: slug))
 }
 
 data primitive_projection_identity_key_note: String = "The projection is keyed on std.decl_ref DeclarationRef, which is the namespace layer's own identity for a declaration (DESIGN section 3: namespace supplies declaration identity, this carrier supplies semantic primitive identity). No new identity type is minted here. The alternative shape considered and refused was a per-declaration marker row beside each fn: it is a second representation scattered across modules rather than one authority, it keys on a bare name inside a module scope so two same-named declarations collapse into one, and it has no room for a fidelity distinction. Module qualification answers the second; this single carrier answers the first; ProjectionFidelity answers the third."

dag/test/claim/resolved_call_emission_identity_witness_test.dag

@@ -0,0 +1,79 @@
+module test.claim.resolved_call_emission_identity_witness_test
+
+import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree }
+
+data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
+
+data resolved_call_emission_identity_witness_note: String = "Permanent regression control for post-resolution callable identity at Rust emission. The source resolver chooses once; 05_emit_rust consumes the recorded RuntimePrimitiveCall or exact SourceDeclarationCall and never asks rt_functions by leaf spelling. The positive trap is the real two-String substring primitive, which must still lower to v1_rt::contains. The empty_map arm proves an exact declaration carrying the existing primitive projection remains host-lowered. The contains and map_get arms prove ordinary and DivergentProjection declarations retain their source identities; together they reproduce the 28-block board mechanism across its two live names. The local same-name arm proves an unrelated declaration cannot become a primitive merely because its leaf collides. map_insert is deliberately absent: v2.std.collection currently carries both map_insert_host_binding and a closure-backed modeled body, while no authority decides which one owns calls; this repair consumes the existing projection roster and does not reclassify that unresolved specimen. dissolve-on: never -- emission may change target spelling, but it may never reintroduce name lookup after source resolution."
+
+fn w_two_string_substring_contains_stays_runtime_bound() -> Bool {
+  compile_dag_rust_emit_check(
+    "module test.claim.runtime_substring_contains_probe\nimport std.types { Bool, String }\nfn probe(s: String, sub: String) -> Bool { contains(s, sub) }\n",
+    "src/test_claim_runtime_substring_contains_probe.rs",
+    ["v1_rt::contains("],
+    []
+  )
+}
+
+fn w_primitive_bound_empty_map_stays_runtime_bound() -> Bool {
+  compile_dag_rust_emit_check(
+    "module test.claim.runtime_empty_map_probe\nimport std.types { Int, String, Map }\nimport std.occurrence_identity { OccurrenceId }\nimport v2.std.collection { empty_map }\nfn probe() -> Map<String, Int> { empty_map() }\n",
+    "src/test_claim_runtime_empty_map_probe.rs",
+    ["v1_rt::rc_empty_map"],
+    ["v2_std_collection::empty_map("]
+  )
+}
+
+fn w_imported_generic_contains_keeps_declared_identity() -> Bool {
+  compile_dag_rust_emit_check(
+    "module test.claim.declared_contains_probe\nimport std.types { Int, Bool }\nimport std.occurrence_identity { OccurrenceId }\nimport v2.std.algebra { FreeMonoid, contains }\nfn int_eq(left: Int, right: Int) -> Bool { left == right }\nfn probe(xs: FreeMonoid<Int>) -> Bool { contains(xs: xs, item: 1, eq: int_eq) }\n",
+    "src/test_claim_declared_contains_probe.rs",
+    ["crate::v2_std_algebra::contains("],
+    ["v1_rt::contains("]
+  )
+}
+
+fn w_divergent_map_get_keeps_declared_outcome_identity() -> Bool {
+  compile_dag_rust_emit_check(
+    "module test.claim.declared_map_get_probe\nimport std.types { Int, String, Map }\nimport std.occurrence_identity { OccurrenceId }\nimport v2.std.collection { map_get }\nimport v2.std.diagnostic { Outcome }\nimport v2.std.optional { Optional }\nfn probe(m: Map<String, Int>) -> Outcome<Optional<Int>> { map_get(m: m, key: \"key\") }\n",
+    "src/test_claim_declared_map_get_probe.rs",
+    ["crate::v2_std_collection::map_get("],
+    ["v1_rt::map_get("]
+  )
+}
+
+fn w_unrelated_same_named_declaration_never_becomes_runtime_primitive() -> Bool {
+  compile_dag_rust_emit_check(
+    "module test.claim.local_contains_probe\nimport std.types { Int }\nfn contains(left: Int, right: Int, third: Int) -> Int { left + right + third }\nfn probe() -> Int { contains(1, 2, 3) }\n",
+    "src/test_claim_local_contains_probe.rs",
+    ["contains(1, 2, 3)"],
+    ["v1_rt::contains("]
+  )
+}
+
+fn w_product_data_call_initializer_reaches_typed_call_emission() -> Bool {
+  compile_dag_rust_emit_check(
+    "module test.claim.product_data_call_probe\nimport std.types { String }\ntype ProbeIdentity { slug: String }\nfn make_probe_identity() -> ProbeIdentity { ProbeIdentity { slug: \"probe\" } }\ndata probe_identity: ProbeIdentity = make_probe_identity()\n",
+    "src/test_claim_product_data_call_probe.rs",
+    ["make_probe_identity()"],
+    ["unsupported mock expression"]
+  )
+}
+
+fn w_resolved_signature_owner_selects_runtime_primitive() -> Bool {
+  compile_dag_rust_emit_check(
+    "module test.claim.resolved_signature_owner_probe\nimport std.types { Int, String, Map }\nfn probe(m: Map<String, Int>) -> Map<String, Int> { map_insert(m, \"key\", 1) }\n",
+    "src/test_claim_resolved_signature_owner_probe.rs",
+    ["v1_rt::rc_map_insert("],
+    ["call target identity was not established"]
+  )
+}
+
+fn w_selective_function_import_admits_named_function() -> Bool {
+  compile_dag_rust_emit_check(
+    "module test.claim.selective_function_import_green\nimport std.types { Int }\nimport test.fixture.function_import_surface_provider { imported_fn }\nfn probe() -> Int { imported_fn(1) }\n",
+    "src/test_claim_selective_function_import_green.rs",
+    ["function_import_surface_provider::imported_fn(1)"],
+    []
+  )
+}

dag/test/claim/serving_privilege_derivation_witness_test.dag

@@ -1,6 +1,7 @@
 module test.claim.serving_privilege_derivation_witness_test
 
 import std.types { String, Bool, List, NonEmptyStr, Int }
+import std.algebra { Empty }
 import std.content_hash { content_hash_of_value }
 import product.placement_supply { HostIdentity }
 import gunbc.spark.serving_realization {

dag/test/claim/sole_constructor_completeness_audit_probe.dag

@@ -11,6 +11,8 @@ import std.types { String, Bool, Int }
 import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree }
 import std.interval { closed_interval, IntervalConstruction, IntervalReady, IntervalRefused }
 
+// Virtual sources resolve imports against the live repository tree; this probe
+// is therefore authoring-time evidence until a live-tree execution home exists.
 data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
 
 fn census_of(source: String) -> CompileDiagnosticCensus {
@@ -125,6 +127,20 @@ test fn f9_generic_carrier_green_control_clean() -> Bool {
   violation_count(source: f9_generic_green_source, wanted: "SoleConstructorViolation") == 0
 }
 
+// PrimitiveIdentity seal controls: forging the cross-module record must refuse,
+// while the sole constructor remains an accepted mint path.
+data primitive_identity_forge_source: String = "module probe_primitive_identity_forge\nimport std.primitive_projection { PrimitiveIdentity }\nfn forged() -> PrimitiveIdentity { PrimitiveIdentity { slug: \"primitive.fake\" } }\n"
+
+test fn primitive_identity_cross_module_forge_refuses() -> Bool {
+  violation_count(source: primitive_identity_forge_source, wanted: "SoleConstructorViolation") >= 1
+}
+
+data primitive_identity_mint_source: String = "module probe_primitive_identity_mint\nimport std.primitive_projection { PrimitiveIdentity, primitive_identity_slug }\nfn legal() -> PrimitiveIdentity { primitive_identity_slug(name: \"fake\") }\n"
+
+test fn primitive_identity_mint_control_clean() -> Bool {
+  violation_count(source: primitive_identity_mint_source, wanted: "SoleConstructorViolation") == 0
+}
+
 // ---------------------------------------------------------------------------
 // Order-dependence probe: two modules declare a bare-name-identical type
 // `DupShape`, one sole_constructor, one not (test.fixture.sole_constructor_order_probe

dag/test/claim/spark_bootstrap_provision_witness_test.dag

@@ -1,5 +1,6 @@
 module test.claim.spark_bootstrap_provision_witness
 
+import std.types { list_length }
 // Adding ANY explicit import scopes this witness's resolution, so the subject module -- previously
 // reached by bare reference through pool coincidence -- must now be named too. That is the correct
 // direction (a witness should carry its own edge to its subject), but the transition is abrupt:
@@ -561,7 +562,7 @@ test fn spark_reported_principal_cannot_actuate() -> Bool {
 test fn spark_effective_access_is_only_partially_observed() -> Bool {
   match spark_effective_access_standing() {
     EffectiveAccessPartiallyObserved { positively_observed: p, requested_but_not_returned: r, overbreadth_unobserved_cause: _ } =>
-      p.length() == 1 && r.length() > 0
+      list_length(items: p) == 1 && list_length(items: r) > 0
     EffectiveAccessExact { observed_cells: _ } => false
     EffectiveAccessOverbroad { extra_cells: _ } => false
     EffectiveAccessUnobserved { cause: _ } => false

dag/test/fixture/function_import_surface_provider.dag

@@ -0,0 +1,7 @@
+module test.fixture.function_import_surface_provider
+
+import std.types { Int }
+
+fn imported_fn(value: Int) -> Int { value }
+
+fn hidden_fn(value: Int) -> Int { value + 1 }

docs/briefs/resolver_pool_fallback_census_2026-08-24.md

@@ -1,31 +1,37 @@
-# Self-host bootstrap contamination receipt (2026-08-24)
+# Resolver pool-fallback census (2026-08-24)
 
-PR #9075 initially produced 361 floor diagnostics and 71 regeneration
-refusals. Those measurements are withdrawn: they came from a compiler seeded
-from an earlier state of the same PR, not from a known-good compiler.
+The required-floor run on PR #9075 exposed 361 diagnostic lines after the
+emission mask was removed. These are not 361 independent defects. Symptom
+bucketization yields two root families:
 
-The discriminating experiment used one dispatch and identical merged sources:
+- No definer in the scoped closure: `split` (26), `first` (38), `skip` (10),
+  `length` (10), `trim` (8), receiver `split` (8), and indexing (8).
+- Wrong carrier selected through pool fallback: `Present`/`Absent` variants
+  on `FreeMonoid` (18 each), `Empty`/`Cons` exhaustiveness (46), incompatible
+  `FreeMonoid`/`List`/`String` branches, and generic-field fallout.
 
-- Seed: `claim_executor` built from merge-base `bd84f6696`.
-- Subject: merged PR sources at `8913ff5`.
-- Result: v2 compilation completed with zero hard diagnostics; regeneration
-  planned/executed 136/136, with only generated-surface drift
-  (`first_generation_equal=false`, `declared_divergent=1`).
+The second family matches the diagnosed alias: `std.types` declares
+`type List<element> = FreeMonoid<element>` (and analogous `Map`/`Set` aliases)
+and records the same mapping in `container_template_alias_rows`. A bare name
+missing scoped visibility can therefore bind a plausible but wrong carrier
+from the pool. A prior `Map` realization defect produced `PartialFunction` in
+kernel `Map` type positions through this same alias family. Counts are symptom
+buckets, not per-site root proofs; resolver provenance is required for exact
+attribution.
 
-The earlier 71 refusals were artifacts of a contaminated self-hosting seed. A
-source-only diff cannot distinguish “the source is wrong” from “the compiler
-that produced its mirror is wrong”; a known-good seed on the same subject is
-the required control. Do not use the withdrawn 361-line taxonomy as evidence
-about resolver behavior.
+There are two lookup layers and their bounds must not be conflated. The
+file-closure `pool_bare_census` is root-scoped and has a measured population
+of 733 cross-root candidates (510 `src/v1 -> dag`, 223 `dag -> src/v1`). The
+function-signature fallback (`func_sig_from_global_bare` and
+`global_bare_callable_node`) has no root parameter and reads `symbol_index.global_bare`;
+the 733 bound is therefore reported only for the file-closure path, not
+transferred to this separate layer. Root A's six representative names
+(`split`, `first`, `skip`, `length`, `trim`, and `join`) are all algebra method
+templates. An explicit law in `04_infer.dag` gates every algebra-template name
+out of the census fallback, so these symptoms cannot be attributed to the
+signature fallback. Their downstream relationship to carrier/profile lookup
+remains a separate measurement, not asserted by this census.
 
-This control rule is scoped to cross-binary comparisons: if each tree is
-measured by a different compiler, the compiler moved with the subject and the
-attribution is invalid. Paired arms measured by the same binary retain their
-delta even if that binary is itself imperfect; state the result as behavior in
-that compiler, not as a universal gunbc claim. This receipt makes no claim
-about the shipped compiler beyond the exact seed revision named above.
-
-This receipt does not invalidate independent observations about pool fallback,
-the `std.types` `List = FreeMonoid` alias, or #9083's stripped-header finding;
-those require their own provenance. It also does not authorize installing the
-drifted candidate mirror; drift remains a separate fixed-point question.
+This census is evidence produced by the floor after the emission leaf-name
+mask was removed. It does not authorize consumer repairs in PR #9075. The
+upstream fix belongs to the namespace/admission work (including #9113).

src/v1/00_core.dag

@@ -91,9 +91,14 @@ type VarBindingKind
   | VariantValueBinding { parent_enum: String }
   | MatchBoundBinding
 
+type CallTargetIdentity
+  = RuntimePrimitiveCall { primitive_name: String }
+  | SourceDeclarationCall { owner_module_path: String, decl_name: String }
+  | CallableTargetUndetermined
+
 type CallSemantics
-  = PlainCallSemantics
-  | LookupCallSemantics
+  = PlainCallSemantics { target: CallTargetIdentity }
+  | LookupCallSemantics { target: CallTargetIdentity }
   | FunctionValueCallSemantics
 
 type MethodSemantics