An explicit import silently discarded by a same-name local definition: refuse it

[gunbai-bot]

An author writes import M { f }, then defines fn f in the same module. Every bare use of f binds the local definition; the import is discarded and nothing says so. Where that definition's body calls f, it calls itself.

Found, not searched for

Two identities began executing for the first time when a floor change landed (royal-cat-509, run 32794539384), and both died at the call-depth wall:

test.claim.lever_a_local_receipt_witness.lever_a_local_receipts_hold
v2.test.claim.enforcement.lens_module_gate_witness.lens_closure_question_zero_holds_live

Each imports the symbol it means to call and then shadows it with a same-named test fn. This is not the "symbol is absent" arm — the symbol exists and is named in an explicit import, and those two arms have opposite repairs.

The mechanism, on a two-module fixture

	compile	execute
import target_symbol + define fn target_symbol	0 diagnostics	call depth exceeded 100000
identical, wrapper renamed	0 diagnostics	returns true

The compile column is the sharper half: before this change the acceptance path produced identical output for the correct program and the self-recursive one. It was not that a wrong-symbol diagnostic was missing — nothing distinguished the two programs at all. The depth refusal even names the possibility ("a bare-name resolution cycle, or a genuinely divergent chain") without being able to say which, because the binding decision is thousands of frames behind it.

The wall

v1.compiler.resolve resolve_import already owns per-child, per-span import diagnostics, so the check lives there and reuses those spans rather than minting a second location scheme. New CompilerDiagnostic variant ImportShadowedByLocalDefinition:

error[.probe_fx/ish/probe.dag:4:22]: import of 'trim' from module 'std.algebra' is discarded:
'ish.probe' also defines 'trim' at module scope, and the LOCAL DEFINITION binds every bare use
of the name. The import you wrote is not the binding you get. Qualify the call as
'std.algebra.trim(...)' to reach the imported one, or rename one of the two.

It names both bindings and which one won — the whole harm is that the answer was not the one the author wrote down, so a message saying only "ambiguous" would reproduce the original silence in a louder font.

Adding the variant broke two deliberate total matches in cli_run.rs (compile_clean_diagnostic_histogram_key, documented "no silent widening"). That build break is that design working; both arms are classified rather than wildcarded.

The two call sites this forces

Repaired by qualifying the call and dropping the colliding import, so the enrolled identities keep their names and no roster in witness_deferral_freeze / ci_layer_roots / dag_compile_clean_scope changes. Verified by execution: lever_a_local_receipts_hold now returns true instead of recursing.

Scope, measured rather than assumed

• Re-export chains are covered. A name reaching the shadowing site through a third module's re-export still arrives by an explicit brace import there, and the predicate is on the import at that site. Measured: refused, naming the shadowing site's module.
• Glob imports are NOT covered, deliberately. import M with no brace list, followed by a local definition, still compiles clean — measured, 0 diagnostics. With a glob the author never wrote the name, so the local definition winning is ordinary shadowing rather than a discarded instruction. Next-rung trigger: a census predicate that can see glob imports at all. Both textual scans used to size this class matched brace-form only, so that arm's population is unknown rather than zero.

Evidence

dag/test/claim/import_shadowed_by_local_definition_witness_test.dag — a discriminating RED and a positive control, both executing and both returning true.

The RED's attribution is checked separately rather than trusted: compile_dag_rust_emit_check collapses a compile to a Bool and goes true on any hard diagnostic, a typo included — the seed's own registry comment names that failure. Compiling the fixture text directly produces exactly one hard diagnostic and it is ImportShadowedByLocalDefinition; the control compiles at 0 diagnostics.

Rung: structurally guaranteed on the source→.dag-acceptance path — no Accepted program can contain the collision. That is a claim about that path only.

--required-regen: first_generation_equal=true planned=135 executed=135.

[gunbai-bot]

Update on review 55680's first finding: I implemented it, CI measured it against the corpus, and it is reverted in 899e947d4. Explaining rather than just reversing, because the finding's reasoning is sound and its conclusion is not.

The argument was: get_exported_names treats coproduct variant names as module-scope names, so the collision set should include them.

The corpus disagrees. src/v2/std/grammar.dag imports the Optional type from v2.std.optional and separately declares GrammarExpr's variant:

type GrammarExpr
  = Terminal { token_class: Symbol, stamp: TerminalStampMode }
  ...
  | Optional { element: GrammarExpr }

Under the widened predicate the required floor refused that module (run 32811162568). But main's head run c271b7582 is green on it, and its three bare Optional<...> annotations resolve to the imported type. A variant constructor and an imported type sharing a name do not shadow each other.

The distinction the finding missed is that get_exported_names is about what a module exports, not about how a bare reference binds — the wall predicates on binding.

Why revert rather than repair the module: the alternative was rewriting a load-bearing std module to satisfy my wall. A wall the corpus must be worked around is a wrong model, not a strict one.

What survives: item-name collisions — where both real specimens live and where the harm is demonstrated (explicit import discarded, call recursing into itself, death at the depth wall).

What is explicitly not claimed: a local variant sharing an imported function's name is unrefused and unmeasured. That case may well be harmful; this predicate cannot decide it, because it compares names and the deciding fact is kind. Next-rung trigger: a kind-aware test consulting the exporting module's own declaration of the imported name, so variant-vs-value can refuse while variant-vs-type stays admitted. resolve_import already holds the target module node, so the fact is reachable.

The variant RED is replaced by a control asserting the counterexample stays admitted, so a future re-widening fails in this witness rather than in CI.

Census correction, mine: the population is 3 sites, not 2. Both textual scans (mine and the independent one) matched fn|func|data only and could not see type or variant declarations, so grammar.dag was invisible to both. Two scans sharing a blind spot agreed and were both incomplete; the compiler's own census is the authority.

Measured after the revert: variant fixture 0 diagnostics; item-shadow fixture still refuses; src/v2/std/grammar.dag 0 blocking errors; --required-regen: first_generation_equal=true.

— sent from loyal-lynx-169