fix: hold aliases and string lists to their rules, quote messages

[fuad-daoud]

Summary

Three gaps in what checks an IR document's names and string lists, each settled where the rule belongs.

An alias another entity also answers to (#398). A property alias that a sibling property of the same model answers to, by its wire name or by an alias of its own, leaves a reader resolving that field with two candidates. A source can write one: Avro accepts any string as an alias, and no lowering can drop either claim without choosing between them. So this is a problem in the spec, not a compiler bug. pass/validate now reports it as pass/ambiguous-alias, beside pass/duplicate-wire-name, which already holds that scope.

Across the type registry nothing reports a collision, because nothing in the IR can decide one:

• A relative Avro alias is qualified by its own type's namespace, so one string on two types in two namespaces names two different types.
• One document can hold several independent schemas, such as the message payloads of an AsyncAPI document, and each may legally declare the same type with the same alias.

A collision between named types is the compiler's to report, within the schema it parsed. ir-design §3.2 records both halves. TestVerify_AliasClaimedByAnotherEntityIsClean pins that irverify stays out of them, and it still catches a per-list seen map hoisted across Namings.

Every []string field gets a decision (#399). irverify keeps a stringLists table keyed Type.Field, the shape idPositions already uses for ID positions. TestStringLists_AreAllClassified fails when the ir package declares a []string field the table does not classify, or when the table names one that is gone. Two rules come out of it:

• Paths. TypeCommon.Namespace, Service.Namespace and GraphQLBinding.FieldPath never hold a blank segment (ir/path-segment-blank). A segment may repeat: com.acme.acme has three levels, and every namespace grammar allows that.
• Lifecycle sets. Visibility.Only, Operation.ParameterVisibility and Operation.ReturnTypeVisibility hold no blank entry and no repeat (ir/set-entry-blank, ir/set-entry-duplicate). ir.Lifecycle is an alias of string, so a text search for []string misses these three. The type-checked test is what found them.

The rest carry no list rule:

• Tags, scopes, media types, encodings and server variable values are the source's own entries, and only the source format can say whether one may repeat or be blank. openapi: repeated tags and scopes pass into the IR undeduplicated #738 holds OpenAPI's tags and scopes.
• Version labels answer to Document.Versions as a whole, which irverify: version labels are not held to Document.Versions #860 tracks.

Messages quote document text (#400). Every Violation.Message that interpolates text from the document passes it through strconv.Quote, so a message is valid UTF-8 whatever the document holds. Violation.Message now states that contract. The member-ID scope message was the one site still spelling raw bytes. TestVerify_MessagesQuoteWhatTheDocumentSpells pins the exact message at every quoting site, with an ill-formed byte in the quoted text wherever the check still reaches it. Violation.Path is the other half of #400, and #739 holds it.

Alternatives considered

• Holding cross-entity alias collisions in irverify. irverify reports compiler bugs only. A collision a source wrote is carried by a correct compiler, as two fields with one wire name are, so irverify would report a defect the compiler did not make. At registry scope it would also fire on both legal shapes above.
• A repeat rule for namespace segments. It would reject a legal namespace such as com.acme.acme, which is three levels deep.
• A generic list helper with per-list flags. Only two acting rules exist. A table of decisions keeps the verdict for every field in one place a new field cannot skip.

Limitations

• The blank rules share isBlankName, so irverify: the blank-alias rule misreads Unicode's default-ignorable set #832 (its misreading of Unicode's default-ignorable set) applies to path segments and set entries too.
• pass/ambiguous-alias compares a model's own properties, the scope pass/duplicate-wire-name holds. Inherited properties and other property lists, such as headers and resource identifiers, are not compared, matching that rule.
• checkStringLists is one more reflective walk, as every irverify check is. Against main, Verify took 6–9% longer on the three largest reference specs (github.json at 11,968 types: 2.59 s → 2.82 s). Validate was unchanged within noise. ir: build WalkValues paths only when a visitor reads them #813 tracks walk cost in general.

Test plan

• go test ./ir/irverify ./pass ./internal/archtest -count=1
• Mutation sweep. Each strconv.Quote site in ir/irverify, unquoted one at a time, reddens a test. Each of the following, planted one at a time, reddens a named test:
  • in stringlists: the blank rule, the repeat rule (off, and on for paths), the ill-formed skip, the path/set selection, the first-index bookkeeping, three of the classifications, an unlisted field let through rather than held as a path, and a held list without a test fixture or with a fixture expecting the other rule;
  • in the validate check: the wire-name pre-claim, the first-claimant guard, the own-name skip, the empty-alias skip, the reported node, and the per-model scope;
  • and a per-list seen map hoisted across Namings.
• Real-world sweep: about 2,000 OpenAPI 3 specs (the reference corpora plus testdata), compiled through main and this branch, give identical irverify violations, validate diagnostics and error diagnostics on every spec.
• make gate, with the pinned golangci-lint v2.14.0, on the branch before main's cycle check (fix(ir): report a document that contains itself #737) was merged in. After that merge: build, vet, lint and the affected packages' tests. CI runs the full gate on the head.

Closes #398
Closes #399
Closes #400