rust_runtime_bridge_name's Absent arm is the identity case, not a fail-open: the premise falsified, and the join enrolled

dag/test/claim/rt_bridge_registry_witness_test.dag

@@ -0,0 +1,23 @@
+module test.claim.rt_bridge_registry_witness_test
+
+import extdeps.languages.rust.emit { rt_function_registry, rt_bridge_name }
+
+// This witness lives in its own module rather than beside the other
+// registry-derivation checks in test.claim.v1_source_audit_witness_test because
+// that module declares ReadsLiveTree, and the required floor DECLINES the whole
+// live-tree arm: measured on run 32778297671, every one of its identities is
+// declined_live_tree -- discovered, counted, folded never. This fold reads no
+// live tree at all (rt_function_registry is an in-corpus declaration), so
+// declining it would have enrolled evidence that cannot execute, which is worse
+// than no evidence because it is cited as coverage.
+//
+// What it holds: rt_bridge_name's Absent arm returns its input UNCHANGED, and
+// that is the IDENTITY case rather than a fallback for an unknown name --
+// rt_bridge_function_names keeps only the rows where name != bridge_name, so a
+// miss means this bridge's v1_rt symbol is spelled like its .dag name. The join
+// is by identity over every row, with no count and no tree-copied literal, so a
+// future row whose override is dropped from the derived map goes red here
+// instead of emitting a call to a v1_rt symbol that does not exist.
+test fn rt_bridge_name_agrees_with_registry_on_every_row() -> Bool {
+  rt_function_registry |> all(entry => rt_bridge_name(name: entry.name) == entry.bridge_name)
+}

src/v1/05_emit_rust.dag

@@ -7922,6 +7922,22 @@ fn rust_runtime_bridge_passes_receiver_by_ref(function_name: String) -> Bool {
   map_contains_key(rt_ref_map_functions(), function_name)
 }
 
+// The Absent arm returns function_name UNCHANGED, and that is the identity case,
+// not a fallback for an unknown name. rt_bridge_function_names is derived by
+// filter(f => f.name != f.bridge_name) over rt_function_registry, so it holds
+// ONLY the rows that rename; a miss means this bridge's v1_rt symbol is spelled
+// exactly like its .dag name, which is true of most of the registry.
+// The totality of the Absent arm DEPENDS on that derivation: if
+// rt_bridge_function_names ever becomes hand-authored rather than derived from
+// rt_function_registry, a miss stops meaning "spelled the same" and this arm
+// becomes a fabrication, so that change invalidates this argument.
+// An unknown name cannot reach either use of the result, which a reader of this
+// function alone cannot see: emit_typed_call consumes runtime_name only inside
+// `if is_rt`, and is_rt requires map_contains_key(rt_functions(), func); and
+// emit_rust_generic_method_call computes bridge_name only in the else of a guard
+// that already refuses when rt_functions() misses. Registry-vs-derivation
+// agreement is held by test.claim.rt_bridge_registry_witness_test
+// rt_bridge_name_agrees_with_registry_on_every_row.
 fn rust_runtime_bridge_name(function_name: String) -> String {
   match map_get(rt_bridge_function_names(), function_name) {
     Present { value: runtime_name } => runtime_name