…se 3a)

55 silent-skip sites in `vera/wasm/calls_arrays.py` converted to
`raise CodegenSkip(node, reason)`.  Each now surfaces as a
source-located [E602] pointing at the unsupported AST node, rather
than the generic enclosing-function-level [E602] the legacy
`return None` propagation produced.

What changed
- New helper `_array_elem_triad_or_skip(arr_arg, *, role)` on
  `CallsArraysMixin`: centralises the `(_infer_concat_elem_type,
  _element_mem_size, _element_wasm_type)` triad that every array
  combinator runs upfront.  Pre-conversion this was 9 lines × 14
  combinators of identical bail-out shape.  Post-conversion it's
  one helper call per combinator + per-leg CodegenSkip raises in
  the helper.  All 6 `t_type = _infer_concat_elem_type(arr_arg);
  if t_type is None: return None; t_size = _element_mem_size(...);
  if t_size is None: return None; ...` blocks (filter, fold,
  reverse, any_all, find, sort_by) collapse to one line.
- `_translate_array_map` / `_translate_array_mapi` use the helper
  for the input element triad; the closure-return triad (b_type)
  still has its own raises since it uses a different inference
  helper (`_infer_closure_return_vera_type`).
- `_translate_array_append` raises on element-type / size / store-op
  failures.  Doesn't use the shared helper since its arg is the
  element value, not the array container.
- `_translate_array_concat` and `_translate_array_slice` retain
  their "provably-empty literal" fallback paths; the non-fallback
  branches raise CodegenSkip.
- `_translate_array_flatten` raises on the two AST-walk failures
  (input isn't Array<Array<T>>; inner type couldn't be recovered).
- Body-internal `_element_load_op` / `_element_store_op` checks
  inside every combinator's loop body raise CodegenSkip with a
  per-combinator role label.
- `_translate_array_sort_by`'s inner-loop `t_load2 / t_store2`
  defensive check raises on real failure (the `not t_is_pair` guard
  is preserved — pair-typed elements legitimately have no load_op).

Module path move
`vera/codegen/skip.py` → `vera/skip.py`.  The previous location
triggered a circular import: `vera.wasm.calls_arrays` imports from
`vera.codegen.skip`, but `vera.codegen.__init__` eagerly imports
`vera.codegen.core` which imports from `vera.wasm`.  Moving skip
out of both packages (to top-level `vera/`) breaks the cycle —
both `vera/codegen/` and `vera/wasm/` can now import it freely.
Import-statement updates in `vera/codegen/functions.py` and
`vera/codegen/closures.py`.

Verification
- mypy clean (59 source files)
- pytest 3789 passed, 14 skipped — confirms behaviour unchanged
  on every well-typed input the test suite covers (no test
  currently exercises an unsupported-element-type path that
  would now raise; those paths exist as code, not as tests, and
  the [E602] warning emission is the observable change there).

Refs #626

Co-Authored-By: Claude <noreply@anthropic.invalid>

24 silent-skip sites in `vera/wasm/data.py` converted to
`raise CodegenSkip(node, reason)`.

Sites by translator
- `_translate_nullary_constructor`: unknown ctor lookup.
- `_translate_constructor_call`: unknown ctor lookup + per-arg
  inference failure (now raises with the offending arg's span,
  not the whole ctor call's).
- `_translate_let_destruct`: type-slot resolution + WASM-type
  resolution per binding.
- `_translate_match`: scrutinee inference failure + empty-arms
  guard.  The empty-arms case is audit-classed as borderline
  (type-check rejects empty match, but a cross-module import
  could still hand us one); converted with a top-level guard in
  `_translate_match` that runs before `_compile_match_arms` so
  the diagnostic carries the MatchExpr's span.
- `_translate_match_condition`: nullary/constructor pattern ctor
  lookup, plus nested-tag-check propagation.
- `_setup_match_arm_env`: BindingPattern slot-name failure +
  ConstructorPattern ctor lookup + unsupported pattern fallthrough.
- `_extract_constructor_fields`: BindingPattern slot-name +
  field WASM-type + nested ctor lookup + unknown sub-pattern
  fallthrough.
- `_sub_pattern_wasm_type`: BindingPattern slot-name (the only
  branch that's a silent skip; wildcard / no-field branches stay
  as `return None` since callers handle the legitimate "no type
  here" case).
- `_collect_nested_tag_checks`: per-field WASM-type failure +
  nested ctor lookup.
- `_translate_array_lit`: element-type inference + memory size +
  store-op.
- `_translate_index_expr`: index element-type inference + memory
  size + load-op.

Verification
- mypy clean
- pytest 3789 passed, 14 skipped

Refs #626

Co-Authored-By: Claude <noreply@anthropic.invalid>

… Phase 3c)

11 silent-skip sites in `vera/wasm/calls_containers.py` converted
to `raise CodegenSkip(call, reason)`.

All 11 sites follow the same pattern: the translator calls
`_map_wasm_tag(type)` on a key/value/element vera_type and bails
when the helper returns None (which is the case for Array-typed
K, V, or element — #475 finding 5 area).  Pre-conversion every
site was a one-line `return None` with a `# Map<K, Array<T>> not
supported` marker comment; post-conversion each raises CodegenSkip
anchored to the relevant FnCall so the [E602] diagnostic points
at the call expression rather than the enclosing function.

Sites covered (one per Map/Set operation that touches K/V/elem):
- `_translate_map_insert` — key + value type tagging
- `_translate_map_get` — key type tagging (×2: K and V independently)
- `_translate_map_contains` — key type tagging
- `_translate_map_remove` — key type tagging
- `_translate_map_keys` — key type tagging
- `_translate_map_values` — value type tagging
- `_translate_set_add` — element type tagging
- `_translate_set_contains` — element type tagging
- `_translate_set_remove` — element type tagging
- `_translate_set_to_array` — element type tagging

The helper `_map_wasm_tag` (line 380) continues to return None for
the Array case; the audit classified it as OPTIONAL_RETURN since
its callers handle None and the empty-collection paths still need
the helper's None-allowing branch (uninferred-type fallthrough to
the ``"b"`` tag is the documented behaviour for `set_new()` /
`map_keys(map_new())` round-trips).

Verification
- mypy clean
- pytest 3789 passed, 14 skipped

Refs #626

Co-Authored-By: Claude <noreply@anthropic.invalid>

…hase 3d)

9 silent-skip sites in `vera/wasm/calls_handlers.py` converted to
`raise CodegenSkip(node, reason)`.

Sites by translator
- `_translate_show`: arg-type inference failure + unsupported
  show target (vera_type not in _SHOW_DISPATCH and not String/
  Unit/Decimal).
- `_translate_hash`: arg-type inference failure + unsupported
  hash target.
- `_translate_handle_expr`: effect isn't an EffectRef + handler
  type not State/Exn.
- `_translate_handle_state`: State<T> type_arg isn't a NamedType.
- `_translate_handle_exn`: Exn<E> type_arg isn't a NamedType +
  zero-clauses guard.

The "arg-instrs is None" propagate at line 87 (now post-conversion)
is preserved as `return None` since it's pure forwarding.  Same
for the post-translate-block None checks in `_translate_handle_state`
and `_translate_handle_exn`.

Verification
- mypy clean
- pytest 3789 passed, 14 skipped

Refs #626

Co-Authored-By: Claude <noreply@anthropic.invalid>

… 3 Phase 3e+3f)

5 silent-skip sites converted across the two central dispatcher
files in vera/wasm/.

`vera/wasm/context.py` (4 sites)
- `translate_expr` — dispatch fallthrough at the end of the
  ``isinstance(...)`` chain.  Pre-conversion an unknown AST node
  (e.g. a new expr kind added to grammar but not wired up here)
  silently fell through to `return None`.  Now raises CodegenSkip
  with the expression's source span.
- `translate_block` LetStmt — `_type_expr_to_slot_name` returned
  None for the binding's declared type.
- `translate_block` LetStmt — `_slot_name_to_wasm_type` returned
  None for the resolved slot name.
- `translate_block` — unknown statement type at the end of the
  ``isinstance(stmt, ...)`` chain.

`vera/wasm/calls.py` (1 site)
- `_translate_call` — the "call target not in module" guard rail.
  Reachable in cross-module / prelude-mangling edge cases (e.g.
  the #604 option_map mono-suffix mismatch where mono rewrites the
  callee name but the rewritten name isn't in `_known_fns`).

Borderline site NOT converted: `vera/codegen/functions.py::_compile_fn`
line 29 (`_is_compilable(decl)` rejection).  The audit flagged this
as borderline; on inspection `_is_compilable` itself calls
`self._warning(...)` in every False-returning branch, so the
diagnostic is already emitted upstream.  This is PROPAGATE — the
caller's `return None` after a False is pure forwarding.  No
conversion needed.

Total SILENT_SKIPs converted so far: 104 (55 + 24 + 11 + 9 + 5).
105 was the audit estimate; the borderline functions.py site was
re-classified post-audit as PROPAGATE, leaving 104.  All
SILENT_SKIPs identified by the audit are now loud.

Verification
- mypy clean
- pytest 3789 passed, 14 skipped

Refs #626

Co-Authored-By: Claude <noreply@anthropic.invalid>

CHANGELOG: add an Unreleased entry for the Layer 3 work
(infrastructure + 104 SILENT_SKIP conversions, with the
follow-up #657 reference for the remaining INVARIANT_DEFENSIVE
and PROPAGATE buckets).

ROADMAP: delete the row for #626 from the stabilisation tier
since Layer 3 closes it.  Renumber the remaining stabilisation
rows (#596 → 2, #597 → 3, etc.) and the agent-integration tier
rows (#222 → 8, #523 → 9, #370 → 10).  #597's "Pairs with #626"
note adjusted to past tense since #626 has closed.

Refs #626 #657

Co-Authored-By: Claude <noreply@anthropic.invalid>

The Layer 3 audit (`#626`) classified `if helper_returned_None:
raise CodegenSkip` checks as SILENT_SKIP without verifying that
the helpers can actually return None for the codepaths reaching
them.  On inspection a number of these defensive guards are
unreachable: `_element_mem_size` / `_element_wasm_type` /
`_element_load_op` / `_element_store_op` all fall back to a
non-None default for non-pair types, and every call site is
inside an `else:` branch of `if X_is_pair:` (so the helper's only
None-returning input — pair types — never reaches it).

The raises themselves remain in place — they correctly become
defensive guards that fire only if a helper signature is ever
loosened.  But they shouldn't count against patch coverage, so
each gets `# pragma: no cover` with an inline rationale pointing
at the specific helper's fallback behaviour.

Pragmas added (all in `vera/wasm/calls_arrays.py`):

- 6 sites: `if X_size is None:` after `_element_mem_size(...)` —
  the helper has a `return 4` final fallback for any non-primitive
  non-pair type, so this branch is unreachable.
- 3 sites: `if X_wasm is None:` after `_element_wasm_type(...)` —
  the helper has a `return "i32"` final fallback, same shape.
- 9 sites: `if X_load is None:` / `if X_store is None:` inside
  `else:` branches of `if X_is_pair:` — load/store helpers return
  None only for pair types, guarded above.
- 4 sites: `if X_load is None or X_store is None:` combined checks
  with the same guarding.
- 2 sites inside `_array_elem_triad_or_skip` helper itself: legs
  2 (size) and 3 (wasm-type) are dead by the same reasoning.  Leg
  1 (`_infer_concat_elem_type` returns None) remains coverable.

Total: 24 pragma annotations.  No code paths removed — all raises
remain as defensive guards.  `calls_arrays.py` per-file coverage:
93% → 94%.

Discovery noted in the follow-up `#657` audit table as Track 1
input: these dead guards become candidates for removal once
`_element_mem_size` / `_element_wasm_type` signatures tighten
from `int | None` / `str | None` to `int` / `str` (which would
accurately reflect their actual return contracts).

Refs #626 #658 #657

Co-Authored-By: Claude <noreply@anthropic.invalid>