Close the index-truncation class behind the C.1:2 policy

[steveklabnik]

Finishes the capacity work #2105 started: the three remaining silent-truncation residuals get the latch treatment, and the one unreachability hypothesis on offer turned out to be false.

• Air::push_inst latches at the per-body ceiling; Air::finish reports it as E1401 through a typed AirValidationErrorKind (ResourceLimit vs Structural) instead of collapsing into E9000 — no signature change across the ten call sites. A latched owner's structural findings are all consequences of the truncation, so the latch is checked first.
• CFG blocks/values latch per function. The tempting proof — "CFG entities are a small-constant multiple of RIR instructions, bounded by the per-program ceiling" — is false: drop elaboration re-emits every live binding's drop at every return, so entities grow quadratically (N droppable bindings × M returns), reaching 2^32 from ~3 MiB of source. The arithmetic is recorded in new informative rule C.6:5; the latch reports through a new CfgEditError::OwnerLimitExceeded (the existing ResourceLimitExceeded message is about per-program payload words and would have been wrong). Boundaries check before Cfg::finish, where the verifier would otherwise raise E9000 first.
• The type-pool latch window closes from both ends. The window analysis found a genuinely reachable abort (caught by a failing test, not hypothesized): validating entry points expected on kind mismatches reachable between latch and report. Reference-returning reads now degrade to field-less aliased definitions only under the latch — a kind mismatch without it still panics, pinned by a #[should_panic] test, so the ICE surface for real producer bugs is unchanged — and both the declaration-binding boundary and the (moved-up) CFG-query boundary stop before any layout/drop-fact query runs against an aliased universe.

Appendix C gains rows for typed-IR instructions per body and CFG blocks/values per function, plus informative C.6:4 distinguishing per-program from per-function ceilings — a convention the appendix previously lacked. Fuzz ICE surface strictly shrinks (the AIR path previously truncated into a downstream verifier abort); is_ice untouched.

Fixes RUE-1226.

Three latent notes being filed as follow-up: add_local_string_content's per-body len() as u32 (same shape, same magnitude as the new AIR ceiling), the frozen-pool validating accessors that remain a latent abort for any future pre-binding read path, and the observation that MAX_CFG_ENTITIES_PER_FUNCTION becomes load-bearing when the ADR-0049 inlining driver lands (growth turns multiplicative).

Validation

Premerge (78/78), quick (re-run post-rebase), rue-air 687 (post-rebase) / cfg 243 / compiler 786 / fuzz 95, spec appendices (22) + traceability green (794/801 normative, same known-uncovered set), debug-assert policy validator, clippy, fmt, manual smoke compile.

---

Generated by Claude Code