(c) arm B: one named conversion at the source-text ingress

[gunbai-bot]

(c) ruling, arm B (operator, 2026-09-01): the filesystem reports source text; the lexer converts it into the structural character carrier. One named conversion at one ingress.

Read this before the zero-error count: the ingress is clean PARTLY BECAUSE A DECLARED HOLE EXISTS

01_tokenize passes structural values into string_head, string_tail and string_is_empty. A callee parameter type is re-resolved in the caller environment, so at those call sites those parameters are typed host, not structural — and the flows are admitted by the same compat-by-leaf-name arm that text_boundary_identity_wall declares unwalled.

So arm B being green is evidence those flows are UNGUARDED, not evidence they are correct. A green that depends on a declared hole must say so, or the next reader prices the hole as closed.

This is also why the report below has three categories and not two. Admitted by the unwalled arm is not a win and is not folded into closed.

What this contains

src/v2/compiler/01_tokenize.dag — every String position the module folds is named by declaration path, and the module's public argument stays host-valued. tokenize(text: String, …) converts exactly once, above the match, via chars; both arms and every lexical callback, prefix operation, walk state and fold below that line consume v2.std.text.String.

src/v2/std/compilers/lexing.dag — four lines: LiteralPattern.text, KeywordPattern.text, and the two matching LexPatternFold callback signatures.

src/v2/test/claim/tokenize/source_text_ingress_test.dag — the executing evidence (new).

src/v2/test/claim/tokenize/annotation_channel_test.dag — four call sites that reach below the ingress now perform the ingress conversion.

DagSourceReadWitness, source_authority_read, and source hashing are byte-unchanged: the read boundary performs one filesystem observation and no lexical interpretation.

One scalar authority, three producers

chars is the same decomposition v1.compiler.infer unfold_scalar_sequence_image calls to build the UnicodeScalarSequenceUnfold image. So the literal path and the runtime path provably share a scalar authority rather than agreeing by coincidence on ASCII — which is the failure an ad hoc loop would produce, invisible until the first non-ASCII source file.

Why the tests call below the ingress

v2.test.tokenize.annotation_channel's subject is the annotation channel. tokenize returns Outcome<TokenStream> — the semantic projection. 01_tokenize's own note records that lex_walk_artifact is the authored result and lex_walk is its projection, derived by dropping the annotation channel, so a semantic consumer cannot reach annotation text.

Annotations are unreachable through tokenize by construction. A public-door test of the annotation channel would be testing the one path that provably cannot observe its subject. This is not a test reaching below a boundary to avoid it — it is a test of the half of the artifact the boundary deliberately drops. ("Call the public door" is right until the public door is a lossy projection of the thing under test.)

Evidence

Scalar-grain rows that red on a byte or UTF-16 substitution — U+00E9 is one scalar 233 against two UTF-8 bytes; U+1F600 is one scalar 128512 against two UTF-16 code units, and the second is the only row that catches a UTF-16 swap. A public-boundary pair that fails if the conversion moves below the match. Assertions are stated over the free-monoid operations, not v2.std.text's, and the file records why.

Correction carried in the code

v2.std.text's bare String spellings do not resolve to its own line-7 declaration. Kernel precedence is uniform and beats locals as well as imports, so that module's own operations take the kernel String — measured: string_head refuses a scalar sequence with declared Primitive(String), produced Container(List, Primitive(Int)). An earlier revision of the witness asserted through those operations and the floor refused it. The population consequence for text_boundary_identity_wall is filed separately as #9924.

What this does NOT do

This authorizes one conversion at one ingress. It is not permission for arbitrary host Strings to inhabit structural text, and it does not retire text_boundary_identity_wall — that row's subject is the arbitrary non-literal host value crossing an exact structural-text boundary through permissive compatibility, and the declared peeling capability remains its trigger. A green ingress here is not that wall coming down.

Status

Reported at identity grain when the run is clean, in three categories, each named individually and never netted:

• CLOSED — the refusal is gone because the value now inhabits the destination.
• MOVED — the refusal reappeared elsewhere; reaching below an ingress obliges a caller to do what the ingress does.
• ADMITTED BY THE UNWALLED ARM — no refusal because compat-by-leaf-name admits it. Not a win.

— sent from vivid-deer-102

[gunbai-bot]

(c) — where the host→structural text boundary sits: A vs B, costed

Written for whoever rules on (c). I have not picked a side and have not authored the converter. Everything below is measured against 6c1def3 unless stated.

The finding that reframes the choice

Medium<String> is one spelling carrying two opposite meanings, and neither option is coherent until that is separated.

• Read side — Filesystem.Read(path).content wrapped as Medium { carried, fidelity: Lossless }, flowing into tokenize. This is text the compiler consumes and folds character by character.
• Emit side — emit_module, 05_emit, 05_emit_orchestration, emit_produced, emit_semantic_decl, emit_host, 06_translate, 07_target_carriers all return Outcome<Medium<String>>. This is text the compiler produces and hands to the host to write to a file.

The emit side is genuinely host text and must stay that way — it is bytes destined for a filesystem write. The read side is what the lexer needs structurally. Today both are Medium<String> where String resolves to the kernel, so the two are indistinguishable by type.

Non-test occurrences, 94 total, by file:

file	n	side
05_emit_orchestration.dag	20	emit
source_authority.dag	16	read
emit_host.dag	14	emit
00_compile.dag	8	both (stage_tokenize in, stage_translate out)
self_host.dag	5	emit
program_partition.dag	4	emit
emit_produced, 07_target_carriers, 05_emit, self_host/*	3 each	emit
emit_module, emit_semantic_decl, 06_translate, application_serializer	2 each	emit
03_ingest, compiler_closure_emit, orchestration_bash_test	1 each	mixed

This is a §3 meaning fork in the making, and it is the real subject of (c) — not "add a converter". A materially different contract needs a materially different name, and today input source text and output emitted text share one.

Option A — convert at the read boundary

DagSourceReadWitness.source becomes Medium<v2.std.text.String>; the conversion happens in v2.compiler.source_authority_read immediately after Filesystem.Read.

• Declaration sites that move: the ~16 in source_authority.dag plus source_authority_read.dag's construction, plus stage_tokenize's input in 00_compile.dag. The emit-side ~70 must not move, so the change forces the read/emit split to be made explicit.
• Carrier becomes: two distinct types where there is one today. Medium<v2.std.text.String> for consumed source, Medium<String> (host) for produced output.
• What newly refuses: any site that passes emitted output back into a consuming position, or vice versa — currently silent and type-correct.
• Discriminating test: construct a DagSourceReadWitness from an emit-side Medium<String> and require a typed refusal. Today it compiles.
• Cost: larger diff, and it forces the fork into the open — which is either the main benefit or the main risk depending on whether the ruling wants that surfaced now.

Option B — convert at tokenize's door

tokenize(text:) keeps a host String; it converts once before folding.

• Declaration sites that move: zero. 01_tokenize.dag only.
• Carrier becomes: unchanged. Medium<String> keeps both meanings.
• What newly refuses: nothing. The three source_authority rows close because the parameter goes back to host.
• Discriminating test: feed tokenize text whose bytes are not valid Unicode scalars and require a located refusal rather than a fabricated fold.
• Cost: smallest possible diff, and it leaves the meaning fork in place — the boundary becomes invisible again the moment any other consumer needs structural source.

What both need and neither has

A host→structural conversion. v2.std.text has none: String, HostStringText, host_string_text, host_string_text_value, CharResult, string_is_empty, string_head, string_tail, SourceFold, fold_source, char_eq, string_split_step, string_split, string_join, string_replace. host_string_text is not it — inside that module bare String resolves to its own line-7 declaration by locals-over-kernel, so it takes a structural string and wraps it.

The conversion is not total: Char = Int where unicode_scalar, brand("Char"), so host bytes that are not valid scalars have no image. Whichever option is chosen, the converter's return type has to admit that refusal — a total signature would be fabricating.

The thing a ruler should decide first

Not A or B. Whether input source text and output emitted text are one concept or two. A answers "two" and pays for it; B answers "one" and defers. Every other question follows from that one, and it is a §3 question, not a plumbing question.

Prerequisite for whoever owns it

v2.std.text is the one module whose bare String spellings are already correct — locals beat kernel, and line 7 declares type String = FreeMonoid<Char>. The authority is right; only its consumers are wrong. Without this, the obvious first move is to "fix" the single module that needs no change.

— sent from vivid-deer-102