… fallthrough

Tier 1 — centralised canonicalisation.

Pre-#630 the codebase carried six overlapping canonicalisation
helpers in vera/wasm/inference.py (plus an unaudited seventh in
vera/wasm/calls_arrays.py), each handling a subset of (a)
RefinementType unwrap, (b) alias-chain follow, (c) generic
substitution, (d) type_args formatting.  Site by site, ad-hoc
walks at the apply_fn dispatchers, FnType-return helpers, and
IndexExpr branch independently re-implemented combinations of
these concerns and missed the rest — accumulating the ten
triggers of the i32_pair-into-i64 mismatch bug class addressed
across PRs #627 and #629, with the 9th and 10th landing within
hours of #630 being filed.

Replaced with two helpers in inference.py:

  - `_canonical_named_type(te, alias_map=None) -> NamedType | None`
    — the core walker.  Iteratively unwraps RefinementType layers,
    applies optional alias_map for generic substitution, follows
    NamedType alias chains, returns canonical NamedType or None.

  - `_canonical_wasm_type(te, alias_map=None) -> str | None` —
    convenience wrapper that maps the canonical name to its WASM
    type ("i32_pair" for String/Array, otherwise via
    `_named_type_to_wasm`).

Migrated all callers to delegate:

  - `_format_named_type_canonical` → 3-line delegate
  - `_resolve_i32_pair_ret_te` → 2-line delegate
  - `_fn_type_return_wasm` → single-line delegate
  - `_resolve_generic_fn_return` → builds alias_map, single delegate
  - `_infer_fncall_vera_type` apply_fn dispatcher → 75-line nested
    isinstance ladder collapsed to 18 lines (extract closure return
    TypeExpr + alias_map, call walker once)
  - `_infer_apply_fn_return_type` → same consolidation
  - `_infer_index_element_type_expr` FnCall branch → uses canonical
    NamedType directly to feed `_alias_array_element`
  - `_infer_closure_return_vera_type` (in calls_arrays.py) →
    previously bare-NamedType-only; now handles refinements and
    alias chains uniformly.  Closes a previously-unaudited
    canonicalisation drift site.

Deleted `_resolve_type_name_to_wasm_canonical` — functionally
identical to `_resolve_base_type_name`, an unnoticed duplicate
that had evolved in parallel.  All callers redirected.

Tier 2 — loud diagnostic on the silent amplifier.

The actual silent failure for ten triggers wasn't the inference
miss itself — it was vera/wasm/operators.py:482-486, the else
branch in `_translate_interpolated_string` that wrapped any
unrecognised-type segment with `to_string(...)`.  `to_string`
reads its argument as i64; an i32_pair (String/Array) value then
tripped `expected i64, found i32` at WASM validation.  That
fallthrough turned every canonicalisation gap into invalid
emission rather than a clean compile-time skip.

Added new error code [E615] "Cannot interpolate value of unknown
type — type inference failed".  Converted the silent fallthrough
to record the offending segment on `WasmContext._interp_inference_failures`,
then return None.  `CodeGenerator._compile_fn` harvests the
failures and emits [E615] for each before falling through to the
existing [E602] skip — same loud-skip mechanism that any other
unsupported expression triggers, but now with a specific E-code
pointing at the actual inference gap rather than a generic
"unsupported expressions".

Net effect.

Six canonicalisation helpers → two.  Seventy-five-line apply_fn
dispatcher × two sites → eighteen lines × two.  Silent
miscompilation on inference miss → clean compile-time skip with
specific [E615] diagnostic.  All ten existing #602-class
regression tests in `TestStringInterpolation` continue to pass
— pure refactor + diagnostic conversion, no behavioural change
for valid programs.

New regression test `TestE615LoudInterpolationFallthrough630::test_e615_fires_on_adt_in_interpolation`
pins the new diagnostic surface (interpolating an ADT-typed
value, which the canonicaliser correctly returns a non-recognised
name for, now emits E615 + E602 instead of silently miscompiling).

Pragma audit closed for the canonicalisation cluster.  The
disproved `# pragma: no cover` on closure-return-RefinementType
(PR #629) was already removed during the cluster migration; the
remaining bare `# pragma: no cover` claims in vera/wasm/inference.py
are non-load-bearing defensive fallthroughs in unrelated machinery.
Broader audit (verifying every prose-bearing pragma claim across
the WASM codegen) is queued as a follow-up.

Follow-ups in scope of close-out:

  - #628 (cross-module `_fn_ret_type_exprs` propagation) — same
    bug class, different machinery, unblocked by this PR's
    canonical helper as the natural propagation target.

  - #626 Layer 1 (pre-commit gate on [E602] across the conformance
    suite) — the diagnostic infrastructure landed here generalises
    to the whole channel.

  - Duplicate `_type_expr_name` / `_type_expr_to_slot_name` in
    inference.py — separate concern from canonicalisation,
    surfaced during this audit, deferred to a cleanup PR.

Closes #630.

Co-Authored-By: Claude <noreply@anthropic.invalid>

Stage 12 had drifted to multi-sentence paragraphs per row (the
v0.0.142 entry I just added inherited and worsened the pattern).
HISTORY format is single very short sentences — see Stage 1
(\"Type checker. Decidable type checking, slot reference
resolution, effect tracking, vera typecheck command, 91 new
tests.\") and Stage 2 (\"Closures — closure conversion,
call_indirect.\") for the canonical shape.

Rewrote all five Stage 12 rows. Detail belongs in CHANGELOG.md
(per-release prose) and in the issue tracker; HISTORY is the
chronological index.

Co-Authored-By: Claude <noreply@anthropic.invalid>

…ents + CodeRabbit

Four review agents (code-reviewer, pr-test-analyzer, comment-analyzer,
silent-failure-hunter) plus three CodeRabbit comments produced a
batch of cross-cutting findings.  This commit addresses them all
in one pass to avoid the iterative round-trip cost the bug class
itself was filed to eliminate.

**Critical fixes:**

1. **Closure body E615 harvest gap (silent-failure-hunter C1).**
   `_compile_lifted_closure` constructed its own WasmContext but
   never harvested `_interp_inference_failures` — closure bodies
   with E615-triggering interpolation segments were silently
   dropped, producing call_indirect→missing-table-entry WASM
   validation traps with no source-located diagnostic.  Extracted
   the harvest into `CodeGenerator._harvest_interp_inference_failures`
   on the codegen base and called it from both functions.py and
   closures.py.  Removed the now-disproved `# pragma: no cover —
   defensive` claim on closures.py's body-instrs-None path.  New
   regression test `test_e615_in_closure_body_emits_diagnostic`.

2. **`_canonical_named_type` type_args from terminal NamedType
   (CodeRabbit #3 + code-reviewer I1).**  The walker's
   `outer_type_args` capture rule (always read from first NamedType)
   lost type_args when alias_map substitution bound a generic
   param to a parameterised type.  Empirically reachable today via
   `type Mapper<A, B> = fn(A -> B); Mapper<Int, Array<Int>>` etc.
   Fix: drop the "outermost" rule, return type_args from the
   terminal NamedType reached.  All 21 existing #602-class
   regression tests still pass.  New regression test
   `test_canonical_named_type_terminal_args_propagation`.

3. **HISTORY.md footer (CodeRabbit #1).**  141 tagged releases →
   142 to match the v0.0.142 row added in PR #631.

**UX fix:**

4. **Multiple E615 per function (silent-failure-hunter H2).**
   Pre-this-fix `_translate_interpolated_string` returned None on
   the first failing segment, requiring N round-trips for N bad
   segments in one interpolation.  Now collects every failing
   segment via `had_failure` flag, then bails at the end.  New
   regression test `test_multiple_e615_in_one_interpolation`.

**Doc-quality fixes (comment-analyzer):**

5. **Trigger-count drift** in `operators.py:491-494` —
   "every canonicalisation gap (#602 and ten subsequent triggers)"
   implied 11; rewrote to "the ten triggers of the #602 bug class
   accumulated across PRs #627 + #629".

6. **`_format_named_type_canonical` docstring drift** — claim
   "matches the pre-#630 fallback shape" was empirically wrong
   (pre-#630 resolved through aliases, post-#630 fallback doesn't).
   Rewrote to acknowledge the deliberate behavioural change.

7. **"Future closure-arg shapes plug in here without further
   dispatch ladder"** — overstatement.  Adding a `FnCall`
   returning a closure still needs an `elif`; what's saved is
   canonicalisation logic, not dispatch logic.  `IfExpr` between
   closures has no single `return_type` field — example was
   misleading.  Rewrote in both `_infer_fncall_vera_type` and
   `_infer_apply_fn_return_type`.

8. **`_canonical_wasm_type` docstring** — added explicit `Unit →
   None` documentation; clarified that `None` (no WASM type) and
   `"i64"` (unreachable-NamedType default) are distinct return
   shapes that callers must not conflate.

**Tests added (besides the regressions tied to fixes):**

9. **`test_per_function_isolation_of_failures_list`** — pins
   that a clean function and a dirty function in the same source
   produce independent `_interp_inference_failures` lists.

10. **`test_e615_fires_on_result_in_interpolation`** — adjacent
    ADT shape (Result vs Option) so a future Option-handling
    broadening doesn't accidentally regress the parallel Result
    path.

11. **`test_array_map_refinement_returning_closure`** — pins the
    previously-unaudited `_infer_closure_return_vera_type` path
    in `calls_arrays.py`, which the #630 migration broadened to
    handle refinements.

**Test enhancements:**

12. **E615 ordering before matching E602** in the existing test
    (CodeRabbit #2) — pinned via `warnings.index(e615[0])` <
    `warnings.index(matching_e602)`.  Filtered to the E602 that
    mentions the offending function so prelude-skip E602s don't
    confound the assertion.

13. **E615 source-location attached** in the existing test —
    softened to "line > 0" (any location) because SlotRef-inside-
    InterpolatedString spans are unreliable today (#634, separate
    follow-up).  Tightening to "line points at the segment" is
    the natural acceptance test for that follow-up.

**Skipped with reasons:**

- **Cycle-guard regression on `_resolve_base_type_name`** —
  test-analyzer C1 / code-reviewer S4.  Verified pre-existing
  and dead-code-safe today (cycles crash an upstream resolver
  first).  Filed as #633.

- **`_canonical_wasm_type`'s `i64` default for unhandled
  apply_fn / call_indirect shapes** — silent-failure-hunter H1.
  Bigger refactor parallel to Tier 2 but for the WASM-side
  dispatch.  Filed as #632.

- **SlotRef-inside-InterpolatedString span fidelity** —
  surfaced when writing the E615 source-location assertion.
  Diagnostic-quality concern, separate from #630's
  canonicalisation scope.  Filed as #634.

- **`_canonical_named_type` worked-example docstring**
  (comment-analyzer I6) — superseded by fix #2 above (semantics
  changed; docstring rewritten with concrete examples).

- **Per-context isolation prose-vs-test** (comment-analyzer I4)
  — addressed via fix #9 (test added).

- **`_resolve_i32_pair_ret_te` 30-line upper docstring** —
  comment-analyzer style nit.  The prose is load-bearing
  context (#628 cross-module narrative); trimming would lose
  history without obvious gain.  Defer.

**Follow-ups:** #632 (apply_fn / call_indirect E616), #633
(_resolve_base_type_name cycle guard), #634 (interpolation
SlotRef source spans).  Added to KNOWN_ISSUES.md alongside #628.

Counts: 3,792 tests (3,778 passed, 14 skipped) — six new tests
under `TestE615LoudInterpolationFallthrough630`.  CHANGELOG +
KNOWN_ISSUES + ROADMAP + TESTING.md + HISTORY footer all
synced.  mypy clean.

Co-Authored-By: Claude <noreply@anthropic.invalid>

Per CodeRabbit on PR #631 — the row said "Six canonicalisation
helpers collapsed to one _canonical_named_type walker" but the
PR actually consolidates them into TWO helpers
(_canonical_named_type as the walker + _canonical_wasm_type as
the WASM-type convenience wrapper).  Matches the CHANGELOG entry
which already names both.

Kept to a single sentence per Stage 1/2 HISTORY style.

Co-Authored-By: Claude <noreply@anthropic.invalid>

**Fixed:**

1. **Walker cycle guard for alias_map self-reference (Finding 3).**
   `_canonical_named_type` previously had separate cycle guards
   for alias_map substitution (none) and `_type_aliases` chain
   following (`seen` set, alias-follow only).  An alias_map
   self-reference (`{T: NamedType("T")}`) would loop forever.
   Unified: single `seen` set covers both paths, populated before
   either substitution or alias-follow.

2. **Future<T> transparency in `_canonical_wasm_type` (Finding 4).**
   `_named_type_to_wasm("Future")` returned `"i32"` (default), so
   a closure return of `Future<String>` at apply_fn / FnType-alias
   positions canonicalised to a wrong WASM type.  Parallel to
   `_slot_name_to_wasm_type`'s existing strip-and-recurse handling
   for Future<T>.  Fix: when canonical name is "Future" with one
   type_arg, recurse into the inner type.

3. **Parameterised-alias substitution (Finding 5).**  Following
   `type Box<T> = Array<T>` with concrete `Box<Int>` previously
   left `T` unsubstituted in the alias body, leaking type
   variables into the canonical NamedType.  Added a
   `_substitute_type_vars` helper (handles NamedType +
   RefinementType; FnType bodies fall through to existing
   None-return) and wired it into the alias-follow path.

4. **Test 1 (Finding 1) updated.**  Switched
   `test_canonical_named_type_terminal_args_propagation` from
   `type IntList = Array<Int>` (non-parameterised — doesn't
   exercise substitution) to `type Box<T> = Array<T>` (which
   does).  CodeRabbit suggested `type Id<T> = T`, but that hits
   a parallel parameterised-alias gap in
   `_type_expr_to_wasm_type` (compilability check, codegen/core.py)
   that's outside #630's scope — filed as #635.  Box<T>=Array<T>
   exercises the same substitution path and runs end-to-end.

5. **Test 2 (Finding 2) reordered + clean_after_dirty.**
   `test_per_function_isolation_of_failures_list` previously had
   `clean` before `dirty`, so a forward leak from dirty would
   never reach a clean function and the test would silently pass.
   Added `clean_after` after `dirty`; both `clean_before` and
   `clean_after` must remain in exports, and exactly one E615
   must fire.

**Follow-up filed:**

- **#635** — `_type_expr_to_wasm_type` parameterised-alias gap.
  Walker fix in `_canonical_named_type` closes the inference half;
  this issue tracks the parallel gap in the compilability check.
  Added to KNOWN_ISSUES.md alongside #628, #632, #633, #634.

**Validation:**

- pytest: 3,778 passed, 14 skipped (no new tests; existing tests
  strengthened in place per Findings 1 and 2)
- mypy: clean (0 issues, 58 source files)
- check_doc_counts: consistent

Co-Authored-By: Claude <noreply@anthropic.invalid>

Per CodeRabbit on PR #631 — the assertion `len(e615) >= 2` would
silently pass with 3, 4, or N duplicates from a regression where
the harvest accidentally walks the failures list more than once
or the per-segment recording emits multiple entries per failure.
Tightened to `== 2` (the program has exactly two failing
interpolation segments — Option<Int> and Result<Int, String>) so
duplicates surface.

Co-Authored-By: Claude <noreply@anthropic.invalid>

… dropped" surface

Per CodeRabbit on PR #631 — finding partially valid, requires nuance.

CodeRabbit suggested asserting `"main" not in result.exports` plus
non-empty E602 in the closure-body E615 test.  Verified empirically
that today:

- E615 fires for the closure body's bad interpolation ✓
- E602 fires (3 times) but for prelude combinators (option_map,
  option_and_then, result_map), NOT for `main`
- `main` IS in result.exports — closure-body failure doesn't
  propagate to drop the enclosing fn
- Module fails at WASM validation/instantiation: call_indirect to
  the dropped closure_id

So CodeRabbit's `"main" not in result.exports` assertion would FAIL
today.  Reason: the closure-compile worklist runs after main's
WAT is already generated, so dropping the closure leaves main's
call_indirect dangling but doesn't drop main itself.  This is a
real gap separate from PR #631's diagnostic-emit work.

Disposition: pin the current surface explicitly with the inverse
assertion (`"main" in result.exports` — documents the bug) plus a
docstring note explaining that the diagnostic is correctly emitted
but the enclosing fn isn't yet dropped.  Filed as #636 with the
acceptance criterion: when #636 lands, the assertion flips and
this test's docstring needs updating.

Added #636 to KNOWN_ISSUES.md alongside #628, #632, #633, #634, #635.

Co-Authored-By: Claude <noreply@anthropic.invalid>

… 1 duplicate

Six findings; verified each.  Fixed 4, skipped the assembly.py:340
finding as duplicate (already addressed in d33a778's
$gc_worklist_end refactor).

Finding A (test_codegen.py:15931 — stale class docstring) —
FIXED.  ``TestHostHandleReclamation573``'s docstring still said
"Map only" with Set/Decimal "in their own follow-ups", but the
class now contains all three.  Rewrote to enumerate the three
failure modes per type (chain reclaims transients, value
correct after pressure, JSON-only / HTML-only wrap-table
inclusion).

Finding B (test_codegen.py:16220 — missing HTML-only test) —
FIXED.  Added ``test_html_only_module_includes_wrap_table`` as
a sibling of ``test_json_only_module_includes_wrap_table``.
Asserts ``host_decref_handle`` import, ``$register_wrapper``
helper, and the export are all present in WAT for an
html_parse-using program.  Note: html_parse transitively pulls
in the prelude's ``html_attr`` (which calls map_get) so
``_map_ops_used`` ends up set anyway in practice — but the
``_needs_wrap_table`` flip on ``_html_ops_used`` is the load-
bearing fix if that prelude transitivity ever changes (e.g.
if a future codegen DCE eliminates unused prelude functions).

Finding C (api.py:1729 — host_decref_handle map_ops_used gating)
— FIXED.  Real bug: ``kind == 1 and result.map_ops_used`` skips
the pop for JSON-only / HTML-only programs (where
``map_ops_used`` is False but JObject / HtmlElement allocations
still create Map wrappers — ``_map_store`` exists because
its creation is gated on ``map_ops_used or json_ops_used or
html_ops_used``).  Drop the ``map_ops_used`` part of the gate;
the runtime invariant "kind == 1 ⟹ _map_store exists" holds
because the wrap-table only emits kind=1 when the Map store
is created.  ``kind == 2`` and ``kind == 3`` keep their gates
because their stores have a single creation condition.

Finding D (api.py:3114 outside-of-diff — ExecuteResult missing
host_store_sizes in IO.exit early returns) — FIXED.  The two
early-return ``ExecuteResult(...)`` sites in the IO.exit error
paths omitted ``host_store_sizes``, leaving the field empty
even when host stores existed.  Threaded
``{k: len(v) for k, v in _host_store_refs.items()}`` through
both sites so the field is always populated, mirroring the
normal-completion path.

Skipped:
* assembly.py:340 (duplicate) — reviewer suggests using
  ``gc_wraptable_base`` as the worklist end.  This is
  mathematically equivalent to the ``$gc_worklist_end`` global
  introduced in d33a778's round-2 fix
  (``gc_worklist_end = gc_stack_limit + worklist_size`` and
  ``gc_wraptable_base = data_end + gc_stack_size +
  worklist_size``; they refer to the same address when wrap-
  table is enabled and the new constant is independent of
  whether wrap-table is enabled).  Already fixed.

Validation: 3,715 pytest, 99 browser, mypy clean, 82
conformance, 33 examples, all sync scripts pass.

Co-Authored-By: Claude <noreply@anthropic.invalid>

…orted)

Per CodeRabbit on PR #631 — Result test only asserted E615
fires, not the full loud-skip surface (E602 for main + main
dropped from exports).  Parallel to the ADT test's assertions.
Without these, a regression that emits E615 but fails to drop
the function via E602 would silently pass this test.

Three other findings in the same review pass triaged:

- closure_id <-> table_index integrity (calls_arrays.py): Already
  addressed by the snapshot/commit-on-success fix in b29de12.
  Within a single fn's worklist, mixed outcomes can't reach the
  module — either all closures succeed and append in closure_id
  order, or any fail and the whole fn is dropped via #636.
  Plus _next_closure_id rolls back on failure for cross-fn
  integrity.  Skip.

- Future<T> in calls_arrays.py:_infer_closure_return_vera_type
  (duplicate from prior round): Type checker rejects Async
  closures into array_map upstream.  Not reachable.  Skip.

- Return None instead of "i64" default (duplicate from prior
  round): The reachable case (FnType return) was fixed via
  _reaches_fn_type in b29de12.  Remaining cases (refinement-
  over-non-NamedType, alias cycles) aren't empirically
  reachable.  Returning None would conflate Unit with
  inference-miss; needs a separate sentinel which is a
  contract change beyond this PR's scope.  Skip.

Co-Authored-By: Claude <noreply@anthropic.invalid>