Loss site pinned: the from / from_key nickname (§3), not a lost property

Instrumented run (temporary eprintln! inside child_from_key in the generated mirror, reverted before commit; BuildBuddy invocation, three-output fixture from the probe in this PR). Every declared output child reaches the shell renderer carrying its property:

PROBE child_from_key: name="success" props=["from"]
PROBE child_from_key: name="out"     props=["from"]
PROBE child_from_key: name="err"     props=["from"]

The property is not lost. It is present on all three children — and its resolved name is "from", while v1.compiler.emit's child_from_key filters on == "from_key" and therefore matches nothing, on every field, always.

This corrects the diagnosis in the body above (which said the key was "lost between parse and the shell renderer"). It is not lost; it is nicknamed. parse_optional_from_key mints the property with the synthetic name "from_key", but the name a reader gets back through field_init_node_name_at is resolved from the authored source span — the token the author actually wrote, which is from. One property, two names.

This is exactly why the interpreter works and the emitter does not. v1_interpreter::extract_from_key reads:

if prop_name == "from_key" || prop_name == "from" {

— it accepts both spellings. child_from_key accepts only one. Two readers of one fact, disagreeing about the fact's name: DESIGN §3's nickname failure, with the two halves having silently diverged. The interpreter's || prop_name == "from" is the tell that someone met this before and repaired it on their side only.

What this changes for the repair

It makes the root cheaper and the walls more necessary, not less:

• The name must have one authority. Reading the property through a single shared accessor (which child_from_key was already supposed to be — 05_emit.dag says it was moved there so the wall and the renderer "read the operation's output contract through one reader rather than two that happen to agree") and deleting the second spelling from the interpreter. Adding || "from" to child_from_key would fix the symptom by cementing the nickname — two names for one property, now agreed on by three readers instead of two. That is the wrong repair.
• The fabricating arms still land as specified. This defect was silent for its entire life because Absent => "stdout" answered for it. A reader that cannot name the property it is looking for is precisely the case §5 says must refuse. Had the fallthrough refused, this nickname would have been a loud diagnostic on the first service declaration instead of a handoff.
• The exit_code finding (107 declarations, integer channel, silently emitting stdout.clone()) is independent of this and survives the name fix — it is the trailing else in emit_shell_channel_expr, a second fabricating arm reached through a correctly-read key.

So the repair is three things, and the ordering matters: fix the name (one authority), close the channel coproduct (exhaustive, 8 measured members, refusing the 4 the Rust emitter cannot honestly realize), and replace both fabricating fallbacks and the REST/shell error-arm fork with refusals and one shared error-return authority.

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Census: where the Rust emitter guesses a callee's INSTANTIATED parameter type

Requested by gentle-koi-869 after their target_carriers.rs:105 and v2_compiler_compile.rs:288
repairs both bottomed out in one missing capability: nothing records the per-call type-argument
substitution, so the emitter reads the DECLARED parameter type (or the enclosing expression's
type) wherever it needs the instantiated one.

Censused from the EMITTER SOURCE, at symbol grain, not from the rustc error list -- the error list
is selected on "the guess was wrong AND rustc noticed", which is the safe half.

The six decision sites (all in v1.compiler.emit_rust unless noted)

1. rust_call_arg_fail_closed_unwrap
   Reads: param_node_type_expr of the callee's declared param -> cardinality / Optional carrier.
   Decides: whether to inject .expect("fail-closed: ...") on the argument.
   Unanswerable when the declared type is the callee's own type variable: optionality is a property
   of the INSTANTIATION. Both arms are guesses -- T may instantiate to Optional<X> (unwrap
   wrong) or to X (unwrap right). gentle-koi's repair makes it decline; a decline is a declared
   inability, not an answer.
   FAILS LOUD when wrong (E0308), which is why this one was found.

2. rust_call_arg_function_value_adapt
   Reads: param_node_type_expr(n: param).params |> count -- the declared ARITY of a
   function-typed parameter.
   Decides: whether to wrap the argument in the __adapt_f forwarding closure that closes the
   Rc<dyn Fn> -> impl Fn seam.
   A parameter declared as a bare type variable has arity 0, so the adapter is silently NOT emitted;
   a declared arrow whose instantiation differs is the same guess.
   FAILS SILENT in the negative direction -- no adapter, no diagnostic, and the E0277 only appears
   if the seam happens to be crossed. This is the dangerous half.

3. rust_witness_type_arg_from_expected_type (and its caller rust_witness_variant_ctor_path)
   Reads: emit_info.expected_type.
   THE SYSTEMIC FACT behind gentle-koi's :288: emit_typed_call emits every argument with
   emit_info passed through UNCHANGED, and the ONLY writer of expected_type in the whole module
   is the record-field path (emit_field_value_with_context, two call sites). So at an argument
   position expected_type is BY CONSTRUCTION never the argument's parameter type -- it is
   whichever enclosing record field, or none. This is not a bug at the reader; the writer for the
   argument position does not exist.

4. record_field_expected_type / rust_struct_field_type_node_from_container
   The same missing substitution one grain over: a generic struct's DECLARED field type is used as
   the expected type of the field value, with the literal's type arguments never applied.
   Included because the capability that fixes 1-3 is the same one that fixes this, and excluding it
   would ship the capability at call grain only.

5. v1_call_forwarding_forwarded_param_names
   Already performs a substitution -- ad hoc, by STRING equality: it compares the callee's declared
   param type name and its type-argument names against the argument's resolved type names to decide
   trait-bound forwarding. Half the capability exists here, hand-rolled and unshared. When the real
   substitution lands, this is a consumer, not a survivor (DESIGN section 3: two structures
   answering one semantic question).

6. fill_default_args / fill_op_default_args
   Splices a default expression declared in the CALLEE into the caller's argument list, emitted in
   the caller's scope with no substitution. No measured instance; listed to close the census.

NOT a member, named so the census is closed: emit_typed_method_call's service-op path reads
declared op_params optionality and JSON coercion. Service operations carry no type parameters, so
that read is answerable by construction.

Population

Import closure of v2.compiler.compile over dag/ + src/v2/: 158 modules.

call sites to generic callees                                          3507
  >=1 VALUE param declared as a BARE type variable (T / T?)            1258   (19 callees)
  >=1 value param's declared type MENTIONS a type variable             2566   (78 callees)
  >=1 value param is function-typed (the arity site 2 reads)            989

The 1258 is site 1's exact unanswerable condition. The largest contributors:

 505  outcome_accepted<T>(value: T)          <- gentle-koi's :105 is one of these
 247  optional_present<T>(value: T)
 174  fold_list<T, A>(empty: A)
 153  list_snoc_item<T>(item: T)
  69  map_insert<K, V>(key: K, value: V)
  44  outcome_with_diagnostics<U>(value: U)

Two anecdotes were 2 of 1258.

What these numbers DO and DO NOT establish

DO: the emitter cannot answer at 1258 call sites in the closure. That is a property of the
declarations and is exact up to the approximation below.

DO NOT: how many of the 1258 the sites actually FIRE on. Site 1 injects only when the argument is
additionally optional-typed, which is a resolved-type fact no textual pass can read. Measured
instead on the committed emitted bytes: the .expect("fail-closed: ...") string occurs 9 times in
src/v1/stage0/, and EVERY ONE is on a monomorphic callee (semver_compare_identifier,
occurrence_id_eq, schedule_witness_entry_eq, runnable_eq, runnable_batch_eq,
oci_wire_digest_parts_from_split) -- declared types concrete, read answerable, injection legitimate.
Zero fire on a generic callee in committed bytes. That is exactly why the class stayed invisible
until 00_compile was emitted: the unanswerable population lives in emitted output that is not
committed.

APPROXIMATION, stated because it bounds the number: the closure is the TEXTUAL import closure and
call sites are counted by name-with-open-paren over comment-stripped source, so a same-named
monomorphic function inflates and a call reached only through a value-position reference deflates.
It is a sizing instrument, not a gate.

Re-derivation

Two throwaway scripts, run from the repo root; they are pasted here rather than committed because
they are a one-off sizing pass, not a maintained artifact. The DURABLE instrument for this question
is a src/v2/lens/ reader over the same Node tree -- a call site whose callee parameter type is a
bare type variable is a pure structural read -- and I did not build it. If this capability lands
with a gate, that lens is what the gate should run, and the numbers above should be re-derived by
it rather than trusted from this document.

import os,re,sys,json
roots=['dag','src/v2']
mod2file={}
for r in roots:
    for dp,_,fs in os.walk(r):
        for f in fs:
            if f.endswith('.dag'):
                p=os.path.join(dp,f)
                txt=open(p,encoding='utf8',errors='replace').read()
                m=re.search(r'^module\s+([\w.]+)',txt,re.M)
                if m: mod2file[m.group(1)]=p
start=None
for m,p in mod2file.items():
    if p=='src/v2/compiler/00_compile.dag': start=m
seen=set();stack=[start]
while stack:
    m=stack.pop()
    if m in seen or m not in mod2file: continue
    seen.add(m)
    txt=open(mod2file[m],encoding='utf8',errors='replace').read()
    for im in re.findall(r'^import\s+([\w.]+)',txt,re.M):
        if im not in seen: stack.append(im)
print(json.dumps({'start':start,'count':len(seen),'files':sorted(mod2file[m] for m in seen if m in mod2file)}))

import os,re,json,subprocess
files=json.loads(subprocess.check_output(['python3',os.path.dirname(__file__)+'/closure.py']).decode())['files']
def sigs(txt):
    out=[]
    for m in re.finditer(r'\bfn\s+(\w+)<([^>]*)>\s*\(',txt):
        i=m.end()-1;d=0
        for j in range(i,len(txt)):
            if txt[j]=='(':d+=1
            elif txt[j]==')':
                d-=1
                if d==0: break
        out.append((m.group(1),[t.strip() for t in m.group(2).split(',')],txt[i+1:j]))
    return out
gen={}
for p in files:
    txt="\n".join(l for l in open(p,encoding="utf8",errors="replace") if not l.lstrip().startswith("//"))
    for name,tps,params in sigs(txt):
        ps=[]
        d=0;cur=''
        for ch in params:
            if ch in '<([': d+=1
            elif ch in '>)]': d-=1
            if ch==',' and d==0: ps.append(cur);cur=''
            else: cur+=ch
        if cur.strip(): ps.append(cur)
        pl=[]
        for x in ps:
            if ':' in x:
                nm,ty=x.split(':',1); pl.append((nm.strip(),ty.split('=')[0].strip()))
        bare=[ (n,t) for n,t in pl if t.rstrip('?') in tps ]
        ment=[ (n,t) for n,t in pl if any(re.search(r'(?<![\w])'+re.escape(tp)+r'(?![\w])',t) for tp in tps) ]
        gen[name]=dict(file=p,tps=tps,params=pl,bare=bare,mentions=ment)
calls={}
for p in files:
    txt="\n".join(l for l in open(p,encoding="utf8",errors="replace") if not l.lstrip().startswith("//"))
    for name in gen:
        n=len(re.findall(r'(?<![\w.])'+name+r'\s*\(',txt))-len(re.findall(r'fn\s+'+name+r'\s*<',txt))
        if n>0: calls[name]=calls.get(name,0)+n
tot=sum(calls.values())
bare_calls=sum(v for k,v in calls.items() if gen[k]['bare'])
ment_calls=sum(v for k,v in calls.items() if gen[k]['mentions'])
fnty=sum(v for k,v in calls.items() if any('fn(' in t.replace(' ','') for _,t in gen[k]['params']))
print(f"call sites to generic callees: {tot}")
print(f"  ... where >=1 VALUE param is declared as a BARE type variable (T / T?): {bare_calls}  ({sum(1 for k in calls if gen[k]['bare'])} distinct callees)")
print(f"  ... where >=1 value param's declared type MENTIONS a type variable:     {ment_calls}  ({sum(1 for k in calls if gen[k]['mentions'])} distinct callees)")
print(f"  ... where >=1 value param is function-typed (arity read by adapt):      {fnty}")
print()
for k,v in sorted(calls.items(),key=lambda x:-x[1]):
    if gen[k]['bare'] and v>=10:
        print(f"{v:5d}  {k}<{','.join(gen[k]['tps'])}>  bare-tv params: {gen[k]['bare']}")