Implement ADR-0078: single-candidate import resolution

[steveklabnik]

Implements ADR-0078 (RUE-1127), all five phases. The ruling was recorded in #2522; this is the language change itself.

The change

Policy version 2. Every @import specifier owns exactly one candidate path:

• Importer-relative only. The root-directory fallback is gone, so adding a nearer file can no longer silently retarget an unchanged import.
• Extensionless means facade. @import("foo") names foo/_foo.rue alone; a file module is spelled @import("foo.rue"). Both forms may coexist — the ambiguity is deleted, not diagnosed.
• std anchors to the program. Vendored {root}/std/_std.rue, then the toolchain root. Ambient environment can no longer replace a standard library the program ships.
• Project-root identity is total. A relative import whose normalized candidate leaves the root is E0713, derived lexically with no filesystem probe.

The core is ~40 lines in discovery_candidate_groups / discovery_groups_for_occurrence; the rest is consequence.

Two rulings settled after the ADR merged

--std-path is deferred, not shipped. No present workflow needs a deliberate-override channel — every harness overrides through the environment against non-vendoring programs — and CLI surface shipped now is surface RUE-1586's distribution design must later honor or break. Adding a flag later is additive. The chain is vendored → env → E0705.

Under a manifest, the manifest decides which std is in the build. A candidate the manifest does not declare is skipped and the walk continues: declare the vendored copy and it wins, omit it and the declared toolchain facade resolves.

This narrows an earlier form of the ruling that required an undeclared-but-present vendored std to fail closed. That rule is not implementable as stated, and CI proved it: hermetic denial is lexical and takes no probe — by design, so a hermetic build never touches an undeclared path — so the compiler cannot distinguish "absent" from "present but undeclared". Treating the denial as conclusive failed every hermetic build whose program does not vendor std at all, because the vendored candidate is probed first and denied even when nothing is there. The repository's own reproducible-programs fixture is exactly that shape. Preserving the stricter rule would require statting undeclared candidates, weakening the no-probe guarantee to sharpen a case a correct manifest never reaches.

Consequently a failed observation is conclusive only when no candidate in the occurrence's chain resolved. Under policy v2 only std has more than one candidate, so this is confined to the std chain; every relative specifier still fails on its single candidate's failure. Denied and absent remain distinguishable typed observations per ADR-0063 — they are merely both non-resolutions for precedence purposes.

E0708 retired

With one candidate per group a group can never accept two sources, so the ambiguity surface is structurally unreachable. Removed end to end rather than left dead: CanonicalImportResolution::Ambiguous, AmbiguousResolution, the winner and diagnostic arms, ImportBindingFailure::Ambiguous and its AIR projection, the envelope outcome, and ErrorKind::AmbiguousModule. E0708 stays a retired number per the registry convention.

Verified against a built compiler

Every hazard the ADR cites, re-run after the change:

Behavior	Before	After
Nearer file added, no source edited	silently retargets (7 → 42)	root sibling is not a candidate
Alternate module form added	working program → E0708	both forms coexist, facade resolves
sub/std/_std.rue beside importer, env unset	captures the stdlib (→ 13)	ignored; E0705
Vendored std, nested importer	worked only via the fallback	works from any depth
@import("../outside.rue")	accepted, identity "../outside.rue"	E0713

Plus the three manifest arms: no vendored std compiles; undeclared vendored std falls through to the declared toolchain std; declared vendored std wins.

Suites: compiler units 901, AIR 653, driver 45, rue 201, spec 2350, CLI integration 1891, and the premerge tier 194/194.

Migration

Zero real-code changes. dijkstra, calculator and tinydb were facade imports all along, so they compile untouched — the ADR's estimate of three affected files was wrong in the safe direction. The churn is ~280 fixture sites that exercised the policy deliberately.

Three fixture classes needed judgment rather than mechanical rewriting, all flagged in commit messages:

• RUE-317's ../ reconciliation cases are superseded. They pinned that an escaping import reconciles with a CLI-listed file; total root-relative identity forbids exactly that. Replaced with an E0713 pin.
• Root-relative intra-facade spellings were masked bugs. Fixtures where outer/_outer.rue imported "outer/inner.rue" only resolved through the fallback; they are importer-relative now.
• Two fixtures were purpose-built on the fallback (reproducibility/semantic-order, fixtures/rue-program/hello) and said so in their comments. They now name their paths explicitly, keeping the contracts they exist to pin. A static audit over every .rue file outside crates/ confirms no fallback-dependent import remains.

Spec

Amended under the permanent-ID law — every touched rule reworded under its stable ID, never renumbered. 10.2:1 (one candidate), 10.2:2 (one base), 10.2:4 (canonical identity), 10.2:6 (program-anchored std), new 10.2:7 (total identity), 4.13:89 (escape legality), 10.1:5 (coexistence). ADR-0026 marked amended-by: [0078] where it stated the E0708 ambiguity.

New coverage

Importer-relative-only locality, negative→positive at the single candidate, vendored std serving a nested importer while an adjacent sub/std/_std.rue stays inert, escape rejection, the migration help, and the undeclared-vendored-std skip.

Closes RUE-1127.