BEP-066 hir_ty port contracts

This document freezes the compiler-core contracts for the BEP-066 port after the TIR-to-hir_ty cutover. TYPE_SYSTEM.md and the current hir_ty behavior remain authoritative. The names below may be shortened during implementation, but ownership, identity, ordering, and escape rules are binding.

Semantic port checklist

Every semantic fact in PORT_INVENTORY.md has one checklist item. A checked item means its implementation and slice checkpoint are complete, not merely that code exists.

Runtime type-slot contract

The canonical syntax bridge is an ordered slot enum in baml_compiler2_hir::body_type_refs:

enum BodyTypeArgRef {
    Static(TypeRefId),
    Runtime { operand: ExprId },
}

BodyTypeRefs::expr_type_args stores every written slot in source order. A runtime operand is also a canonical child expression for reachability, defaults, forward references, and throw facts. Its ExprId is its identity; source spans remain in the existing source maps and are not copied into typed data.

Inference lowers that syntax once into the authoritative per-call plan:

enum CallTypeArgPlan {
    Static { ty: Ty },
    Runtime {
        operand: ExprId,
        occurrence_ty: Ty,
        parameter: ParamTy,
    },
}

struct CallPlan {
    bindings: Vec<ParamBinding>,
    type_args: Vec<Ty>,
    own_offset: usize,
    explicit: bool,
    slots: Vec<CallTypeArgPlan>,
    deferred_checks: Vec<RuntimeCheck>,
    runtime_id: Option<ExprId>,
    target: Option<SymbolicCallableTarget>,
}

The full solved type_args remains in declared De Bruijn order and is ground at finalization. slots preserves written provenance and order. For a runtime slot, occurrence_ty is the first usable static bound or unknown; it is not an InferVar, cannot be unified with the runtime value, and is never minted from intern identity. deferred_checks names only argument/bound checks whose expected type actually depends on runtime slots. An all-static plan may use an asserted compatibility shortcut, but mixed plans are never re-lowered from AST syntax by MIR.

The MIR provider converts interned types to plain types once and mirrors this plan losslessly. The plan, rather than syntax inspection, controls type operands, runtime gates, call flags, extraction contracts, and target links.

Loc-free callable-target contract

The canonical serializable descriptor lives beside callable metadata in baml_compiler2_hir_ty::callable; PackageInterface exports it and MemberResolution/CallPlan carry it. This avoids making package-interface storage the semantic owner while still giving source-less consumers a durable value.

enum SymbolicCallableTarget {
    Free { package: Name, namespace: Vec<Name>, function: Name },
    Method { package: Name, owner: QualifiedTypeName, method: Name },
    Interface { package: Name, interface: QualifiedTypeName, slot: Name },
}

struct ExternalCallable {
    target: SymbolicCallableTarget,
    receiver: ReceiverMode,
    owner_generic_params: Vec<BoundedParam>,
    function_generic_params: Vec<BoundedParam>,
    linkability: Linkability,
}

Targets are namespaced structural identities, Borsh-serializable and location-free. No mounted definition receives a forged SourceFile, item id, or source location. Source-backed calls retain their existing location-based resolution variants. A mounted call receives an external resolution containing the descriptor, and its call plan clones the symbolic target before inference finishes. Linkability::ReservedBuiltin is explicit data and produces the unsupported-mounted-call diagnostic instead of failing in MIR or the linker.

Owner parameters precede function parameters. Exported user arity excludes synthetic effect parameters; bounds remain attached to the corresponding rigid parameter. Bound methods consume self and seed the owner prefix, unbound methods retain it, and interface targets identify a virtual slot rather than a concrete source body.

Changing this Borsh schema intentionally invalidates compiler-built cached package-interface bytes. Compatibility is per compiler build; it is not an external persistence or wire-format promise.

Scoped generic-overlay contract

LowerCtx continues to own the immutable declaration frame. Dynamic runtime type bindings are owned by the body-local InferenceContext as an ordered overlay:

struct ScopedTypeBinding {
    name: Name,
    parameter: ParamTy,
    operand: ExprId,
    occurrence_ty: Ty,
}

The synthetic ParamTy is rigid and keyed deterministically by the body owner and StmtId; textual names alone are never identity. Type-name lookup searches the innermost active overlay first, then the fixed declared generic frame, then ordinary type/package names. This gives ordinary lexical shadowing without mutating reusable declaration-lowering contexts.

Block entry records an integer overlay checkpoint. Both inference-driven and expectation-driven block exits call the same finalizer, which resolves types, erases parameters introduced after the checkpoint from the block result and all locals that can leave the block, then truncates the overlay. The erasure uses the binding's static occurrence type (bound or unknown), never the runtime operand as a solver variable. Nested blocks, branches, defaults, and lambdas receive independent checkpoints; a default/lambda body cannot observe or leak an outer transient overlay unless lexical ownership explicitly places the binding in that body.

The implementation uses explicit checkpoint/finalize methods rather than a borrow-holding RAII guard, so recursive mutable inference remains possible and both block paths are mechanically routed through identical cleanup.

Pinned new-engine hole and open-throws behavior

These are existing hir_ty semantics and must not change as a consequence of the port:

• An allowed _ creates a fresh inference hole. let x: _ = 1 resolves the hole exactly to int.
• Expression-position holes participate in contextual inference, including Box<_> { v: 5 }, which resolves to Box<int>.
• A hole that remains unsolved reports the current E0147 diagnostic. Positions where holes are forbidden keep their current E0147 behavior.
• A top-level partial clause such as throws AppError | _ is open: the named part remains declared and the inferred body residue is unioned into the callable effect. The pinned fixture resolves to 7 | user.AppError.
• A missing throws on an ordinary written function type keeps the current diagnostic and never recovery. Only the exact extraction-contract position introduced in Slice 4 may interpret that omission as a runtime wildcard.

The existing type-spec fixtures wildcard_hole_in_let_annotation.baml, wildcard_hole_in_constructor_generic_arg.baml, and partial_throws_clause.baml are the Slice 0 executable pins. Former TIR-era B-230/B-247 integration cases are reviewed individually in Slice 8; an old ignored expectation never overrides these fixtures.