Model the exact Symbol-to-Rust representation binding and eliminate bare String capture

[briansrls]

Part of #9664.

E0308 does not move in this PR. The ~2400-site capture subset empties only when XL-0B threads DeclarationRef into the checkpoint-spelling callers of 05_emit_rust.dag and asks rust_lookup_exact_binding first; this PR lands the authority, the deletion, the verdicts and the acceptance roster that commit is measured against. Until then, any live caller that renders a reference to v2.std.node Symbol through the spelling-keyed arm of type_realization_decision hits a loud, typed refusal (line-stop), not the prior Realized{String} and not a silent fallback — the seed's generated modules carry no such reference (measured: only hand-retained pilot files spell it), and on the freeze emit path that refusal is the census XL-0B reads.

What

XL-0's first self-host typeck run (#9665 freeze) reported 2799 refusals; ~2400 were one defect: v2.std.node type Symbol (opaque) was projected by the bare-name rust_type_checkpoints row to the bare token String, and every module also importing v2.std.text { String } (structural FreeMonoid<Char>) captured that token via its use-line — so fn f(identity: Symbol) expected Rc<im::Vector<i64>> while callers passed the host string. Two independent faults in one row: keyed on a spelling, and carrying a spelling a use-line can shadow. Both are closed here at the authority layer (DESIGN §2/§3, model before implement).

Model

• std.target_representation — the three identities one TypeCheckpoint row fused, separated by owner: SourceTypeTargetBinding<R> (exact DeclarationRef → representation, corpus-owned), RepresentationSpelling<R> (representation → fully qualified reference/grounding spelling, target-owned), ExactBindingResolution (Resolved | Absent | Ambiguous | SourceIdentityUnavailable — no bare-name fallback; only Resolved yields a table spelling), and CheckpointRowDisposition (MigratedToExactBinding | ProvenUniqueKernelBinding | StillBareNameDebt).
• extdeps.languages.rust.representation — RustRepresentation and its realizations, fully qualified (std::string::String, std::vec::Vec<u8>, …). RustSymbolNewtype / RustInternedSymbol are representable but carry no realization row, so a binding to either refuses at spelling time. rust_exact_type_checkpoint synthesizes the TypeCheckpoint the emitter and std.reference_realization already consume.
• gunbc.rust_source_type_bindings — the exact rows (v2.std.node.Symbol → RustStdString, plus every declaration the bare table answered for), a verdict on every bare row (Symbol migrated + deleted; String/Bool/Unit proven-unique kernel with the shadowing-identity proof; Int/Float/Bytes/Secret/Json declared debt with capability-grain triggers), and the capture acceptance roster by declarer identity (23 declarers; instrument named, counts not transcribed).
• std.symbol_semantics + gunbc.symbol_identity_census — consumer census at exact identity (13 rows, each citing the symbol read), the decision split in two claims — value semantics LexemeBacked (equality/order/hash/serialization by lexeme, no intern table, bijective identity seams) and nominality standing NominalityNotEnforced (the source checker admits Symbol→String/NonEmptyStr flows and the chosen representation erases them; restoration trigger = the ruled six-step chain (a)–(f), nominality true in .dag first, then by construction in the target) — and the representation ruling: std::string::String, with struct Symbol(std::string::String) the named next rung, triggered by the .dag checker distinguishing Symbol from String. Not the newtype now because the erasure is exploited at the source with the checker's blessing (content_hash_atom(value: NonEmptyStr) receives Symbols corpus-wide; v1.compiler.types types ^x as string_type): a newtype would make rustc refuse programs the source Accepts — a divergence, not a wall.
• v1.compiler.coercion — rust_lookup_exact_binding / rust_exact_realization_decision (the exact path), and type_realization_decision now refuses a Migrated name that reaches the spelling-keyed arm without a DeclarationRef. The bare Symbol row is deleted; the kernel ^x literal never needed it (its suffix comes from the String row, matching its kernel type).

Evidence

24 witnesses executing on the remote corpus (dag/test/claim/symbol_identity_binding_witness_test.dag, src/v2/test/claim/symbol_identity_semantics_test.dag): exact resolution; another module's type Symbol receives no binding; missing identity refuses; two rows refuse as ambiguous; no realization spells the bare token; every bare row carries a verdict and migrated names are absent from the table; decision coherence (Eq/Hash/Ord law); symbol_lexeme ∘ symbol_intern_lexeme round trip, lexical equality/ordering/hash on the live substrate. Control run: restoring the Symbol row reds exactly w_migrated_names_are_absent_from_the_bare_table and w_every_bare_row_carries_a_verdict, nothing else.

Seam (agreed with bold-carp-449 / XL-0)

05_emit_rust.dag is untouched. XL-0B's first commit threads DeclarationRef (from typed_modules' module nodes, no path convention) into the checkpoint-spelling callers and asks rust_lookup_exact_binding first; the (dag_name, decl_file) arm stays as the declared residue with its own count. Acceptance is by failing-site identity on the freeze instrument: the symbol_capture_declarers subset empty, no declarer reappearing under another class. The import-collision fixture source is specified beside the witness for that instrument.

Note for the parent: Symbol in the declarer modules resolves only by namespace-only resolution (DESIGN's open thread), not a resolver defect — the identity XL-0B threads must come from the resolver's binding (Resolved { node }), not the import list.

🤖 Generated with Claude Code

https://claude.ai/code/session_016PAyJ8DfoCKPfA7NEBLZBG