…d shapes

The IR described what fields a stanza has. That is enough to read a
well-formed stanza and not enough to produce one, or to know why a real
client rejected the one you produced. Every rule below is symmetric — it
serves a parser and an emitter equally — and each one has cost a consumer
real debugging time.

Additive and schema-versioned (schemaVersion 1.0.0 -> 1.1.0): every new
field is optional, no existing field changes shape or value, and the whole
generated/ diff is verified strictly additive (nothing removed anywhere,
including assertion arrays).

1. Echo rules. A new `reference` assertion kind carrying `referencePath`,
   the argument list of WA's `attrStringFromReference`: an answer's `from`
   must equal the REQUEST's `to`, its `id` the request's `id`. 17 of the 26
   namespace error mixins enforce it, and so does every success parser. An
   emitter that hardcodes from="s.whatsapp.net" makes every answer to a
   g.us request unparseable. 579 recovered — including the <ack> shapes in
   the incoming domain, which share the analyzer.

2. Pinned field values. `literalValue` on ParsedField, from both `literal`
   (required, a hard discriminator) and `optionalLiteral` (pinned only when
   present) — type="admin" on a successful promote, matched="true"/"false"
   on a blocklist update, code=429 on a rate-limit error. `required` tells
   the two apart, which is what decides whether an emitter MUST send the
   attribute or merely must not contradict it. An optional echo, which
   guards nothing, rides on the field as `referencePath` instead. Numeric
   literals are now captured too (they were silently dropped). 2174 pins.

3. Per-RPC error vocabulary. `errorClass` (client/server, derived from the
   codes, not from the variant's inconsistently-spelled name) plus the
   closed `errorCodes`/`errorTexts` sets and the `errorCodeMin`/`Max` range
   of the open-ended fallback arms. The vocabulary is per-RPC:
   BatchGetGroupInfo takes 400/429 and rejects 404 item-not-found, though
   that mixin exists and other RPCs use it. `kind` is deliberately left
   alone so existing consumers keep matching on success/error.

4. Response enums. `enumRef` on ParsedField, resolved through the same
   path the request side already uses, so an `attrStringEnum` field carries
   its legal values instead of a bare "type": "enum". 277 resolved.

5. Notification action unions. A new `actions` list per notification: the
   payload inside the envelope, keyed by child tag. The wireTag ->
   actionType mapping is many-to-one (not_ephemeral normalises into
   ephemeral with duration 0, so a NOT_EPHEMERAL branch is dead code) and
   field names are rebound (the timer arrives in `expiration`, the action
   field is `duration`). Neither is derivable from the wire. 55 arms, 45 of
   them w:gp2, with fields, constants, and repeated sub-elements resolved
   through the handler's local helpers.

Guards:

- A round-trip test (crates/wa-scan/tests/iq_roundtrip.rs) builds a stanza
  for every IQ success shape from the IR alone and checks the recorded
  constraints accept it — 141 shapes, plus a negative control proving a
  hardcoded `from` is caught. Emitter and checker share no code with the
  extractor, so a mis-extraction cannot cancel itself out.
- manifest.diagnostics.iq.constraints and diagnostics.notif.actions are
  floor-guarded, so a WA refactor that hides one of these constructs fails
  the update instead of silently emptying a field.
- Constraints seen but not structurally resolvable are counted under
  dropsByReason, so "no constraint here" and "we failed to extract one"
  never look alike.

Determinism holds (update --check is clean from the pinned bundles) and
the reference Rust codegen is byte-identical, verified by A/B-ing it
against the same IR with the new fields stripped.

`referencePath` is documented as relative to the request, and a consumer
acts on that. The extractor keyed only on the binding being a
`WASmaxParseReference` helper, so it was reporting an observed property as
if it were a guaranteed one: if WA ever pointed one of those helpers at a
node other than the parser's `reference` parameter, the IR would still say
"the request" and every consumer would be silently wrong.

The reference argument is now checked against the parser's second
parameter and rejected otherwise, with the rejection counted under
dropsByReason rather than dropped in silence.

The invariant already held: coverage is unchanged at 579 reference
constraints, no new drop reason appears, and generated/ is byte-identical.
That is the point — it is now enforced instead of assumed.

Also groups the per-function analysis context (locals, resolver, reference
parameter) into `FnCtx` so the classifier keeps a readable signature.

docs: a cache filename is a location label, not a content address

The durable release store is content-addressed (`bundles-<version>-<setHash>`),
the cache is not: a JS entry is named after the URL's last segment and a
wasm entry after `sha256(url)`, while the hash of the *bytes* lives in the
cache manifest and is what integrity is verified against. Two hashes of
different things sat three lines apart in the README with nothing saying so,
which is enough to cost a reader time even though no sentence was false.

Sixteen of the seventeen review findings applied; one rejected with
evidence. The four that changed committed output were all verified against
the bundle first.

Wrong data in the committed IR:

- `iq_constraint_counts` walked `response.fields` AND every variant, but
  `response.fields` is a *clone* of the primary success variant's fields
  whenever variants exist — so 97 of 143 stanzas had their constraints
  counted twice, and the inflation wasn't even uniform. fieldLiterals
  2174 -> 1782 and fieldEnumRefs 277 -> 146 are the corrected totals, not a
  regression: counting the OLD IR with the fixed logic gives exactly the
  same numbers. `--allow-shrink` was required once to move past the
  inflated floor.
- The error vocabulary was read only from fields inside a `UnionVariant`,
  but plenty of RPCs parse a single `<error>` child directly instead of an
  `errorMixinDisjunction`. 29 error variants silently had no vocabulary:
  `SetResponseConflict` (409/conflict), `…TooManyAttempts` (431), and so
  on. The code/text reading now applies to every traversed field.
- Conversely, the vocabulary was computed for EVERY variant kind and only
  `error_class` was gated on `Error`, so three PreKeys *success* variants
  carried a bogus accepted-error set. The whole computation is now gated.
- An optional echo consumed as a presence flag lost its rule entirely. The
  blocklist shapes bind `optionalLiteral(attrString, list, "c_dhash",
  ref.item.dhash)` and expose only `{hasListCDhash: m.value != null}`, so
  the pin was dropped with no field and no drop note — worse than before,
  since the previous behaviour at least counted it. The presence field now
  carries the pin (5 recovered; referenceConstraints 579 -> 584).

Latent correctness:

- `optionalLiteral` hardcoded `maybeAttrString`/String instead of deriving
  the type from its wrapped accessor, so an `optionalLiteral(attrInt, …,
  429)` pin would be mis-typed — and `field_type` is exactly what tells a
  consumer how to read `literalValue` back.
- A request-derived output field dropped its `path` after using the tail as
  `wire_name`, making it indistinguishable from a field read off the
  response.
- `find_accessor` recursed through `deref_ident` with no depth budget, so
  mutually referential minified bindings would blow the stack — a crash of
  the generator rather than a field that isn't recovered.
- A merged action branch only weakened fields it contained, leaving a field
  absent from that branch wrongly required.
- A hoisted content receiver (`var body = child.child("body")`) yielded an
  empty wire name; the receiver is now dereferenced through the scope.
- Returns nested in `if`/`else` were skipped, exposing only the last shape
  of a branching arm. Nested `switch`es are still not descended into —
  those are a different dispatch level, not branches of this arm.
- A constant-table local bound twice to different objects now resolves to
  nothing instead of last-one-wins, so a reused minified name cannot mint
  wrong wire tags.

Diagnostics:

- The enum drop counter was memoized, so it counted distinct enums rather
  than occurrences while every other reason here is per-occurrence (10 ->
  65), and an enum argument that wasn't an `o("Mod").NAME` reference at all
  was dropped with no note.

Tests:

- The round-trip guard modelled only the root, so it skipped every
  `sourcePath` and nested-child pin — including `matched="true"` on
  `<list>` and `type="admin"` on `<participant>`, i.e. it would have
  accepted the very malformed promote response its own header describes.
  It now models the stanza as a path-addressed tree: 175 nested pins
  exercised where there were none, plus a regression test that a wrong
  value on a nested node is caught. Optional containers are deliberately
  not descended into — WA models mutually exclusive alternatives as
  several optional same-node mixins (a newsletter `<meta>` pins
  `interaction_type` to both "question" and "question_reshare"), so
  descending into all of them would build a self-contradicting node.
- `checked > 0` stayed green on a layer that had degraded to tag-only;
  the echo/pin coverage is floored too.
- `handler_without_a_const_keyed_switch_has_no_actions` was vacuous: the
  fixture dispatched only `w:gp2`, so the loop body never ran. It now
  dispatches a second, action-less type, and asserts the fixture does so.

Rejected: scoping action discovery to the notification's `handler_function`.
The switch is not in the handler — `handleGroupNotification` builds a
`WADeprecatedWapParser` around a sibling local and the child-tag switch
lives there, so scoping to the handler body finds nothing and loses all 45
`w:gp2` arms. The underlying risk (a module hosting two handlers with two
switches) is real but latent; a module serving more than one notification
type is now skipped instead, so the failure is a visible omission rather
than a union attributed to the wrong type.

Determinism holds, the schemas validate, and the reference Rust codegen is
still byte-identical.

Ten further findings from two Codex passes (one landed mid-work on 5500115,
one on 08c01ed). Nine applied, one already fixed, one adjudicated against a
finding from the same reviewer.

The flattened error vocabulary was ambiguous — the same failure class the
domain exists to prevent. `errorCodes: [400, 501]` beside `errorTexts:
["bad-request", "feature-not-implemented"]` admits four combinations when
the parser accepts two, so an emitter picking one value from each list can
produce `400 feature-not-implemented`, which matches no branch and is
unparseable. 117 variants were ambiguous this way. `ResponseVariant` now
carries `errorArms: [{name, code, text, codeMin, codeMax}]` — the accepted
shapes, paired — and the flat lists are derived from it as a view, so the
two can never disagree.

Data that was being lost:

- A required echo on a DESCENDED node vanished entirely. `literal` on a node
  reached through `flattenedChildWithTag` records no root assertion (the
  assertion vocabulary is root-relative) and the initializer discarded the
  reference too, so a nested attribute that must mirror the request reached
  the IR with no constraint at all.
- `locked`'s `threshold` was missing because the minifier hides the accessor
  in the ternary's TEST — `(n = child.maybeAttrString("threshold")) != null
  ? n : void 0` — and following the consequent alone finds a bare `n` that
  no declaration binds.
- `unlink` reported a single `delete_parent_group_unlink`. Its helper
  branches into four different actions, and the recursive return collector
  added last round exposed them only to have them folded into one — keeping
  whichever `actionType` resolved first. A wholesale delegation now expands
  the helper's branches into sibling arms and runs them through the same
  merge-by-`actionType` grouping the switch arms use. 55 -> 58 arms.

Latent:

- A helper name bound twice now resolves to nothing rather than
  last-one-wins, so a nested function reusing a minified identifier cannot
  make an arm inline an unrelated function. Same rule the constant tables
  already use.
- A switch fall-through label (`case A: case B: return {…}`) inherits the
  next executed body instead of being recorded as an empty action. Not
  present in today's bundle.

Diagnostics:

- The enum drop counter double-counted: the same parser source is analyzed
  twice (once for fields, once for assertions) and a module is reachable
  from several RPCs, so per-invocation counting reported one lost enum many
  times. CodeRabbit asked for per-occurrence and Codex for once-per-loss;
  both are right about the failure and the unit is the disagreement. Drops
  are now keyed by the constraint lost, so the number means "distinct
  constraints" — back to 10, and stable across analysis passes.
- The notif floor counted ARMS, which cannot regress while the switch is
  still recognized: every case yields one arm even if its whole shape
  vanished. `actionShapes` (resolved action types + fields + constants +
  child fields, 181) is floored alongside it, as is `errorArms` (639).

Adjudicated: carrying an optional echo on a `Bool` presence flag, which the
previous round added to recover the blocklist `c_dhash` rule, was then
flagged for conflating an always-present boolean with an optional string
attribute. Both halves are right — the rule must be recorded, and
`required: true` on the flag must not be read as "the attribute is
required". The rule is now explicit rather than inferred: on a `Bool` field
the pin constrains the underlying attribute *when present*, never the
boolean, documented on both `literalValue` and `referencePath`. The
round-trip guard was demonstrating the harm (it demanded an optional
`c_dhash` and compared a request string with a boolean) and now honours the
rule, with a regression test.

Already fixed before the comment landed: gating the whole error vocabulary
on `kind == Error` (that pass reviewed 5500115; 08c01ed had it).

No `--allow-shrink` needed. Determinism holds, schemas validate, and the
reference codegen is still byte-identical.

…nd 3 left

Four more Codex findings on 28b8b14. All applied; two were live, two latent.

A nested payload union erased its parent's pins. An error alternative can
both pin a code/text and carry a further union of reasons that pin nothing:
`CreateOrAddGroupRateLimitError` pins 429/rate-overlimit and nests
`AddParticipantTimeRateLimit` / `AddParticipantCountRateLimit`. The nested
leaves replaced the outer arm, so `errorArms` — documented as the
authoritative form — published four entries with no usable pairing while
the shape the server actually sends was absent. Nested arms now inherit the
outer pins wherever they have none of their own, and the specific inner name
still wins. 4 empty arms -> 0.

Accessor aliases were typed as strings. `find_accessor` returns the raw
method name and `wap::method_field_type` did not know `attrPhoneUserJid`,
`maybeAttrPhoneUserJid`, `attrPhoneDeviceJid`, `attrJidEnum`,
`attrDomainJid`, `attrLidJid`, `attrIntRange`, `attrStringEnum` or
`attrEnumOrNullIfUnknown`, while `is_wire_accessor` deliberately accepts
every `attr*` — so those fields were kept and silently mistyped. Live case:
the group-notification `phone_number`, a PN user JID reported as `string`,
which is precisely the conflation that function's own doc comment calls
protocol-safety-critical. Fixed in the shared classifier rather than locally,
since it is wrong everywhere; blast radius is nil — none of those spellings
appears as a `method` in any committed domain today.

Two latent gaps the previous round opened or left:

- Returns are now collected through `if`/`else`, but the scope was still
  built from direct declarations only, so `if (c) { var id =
  child.attrString("id"); return {id} }` yielded a return whose `id`
  resolved to nothing. `var` is function-scoped, so bindings are now
  collected through the same control flow.
- An expression-bodied arrow callback (`p => wid(p.attrUserJid("jid"))`)
  has no `return` — oxc stores the body as a lone expression — so a
  repeated child was catalogued with an empty field list despite the
  comment promising that shape. Handled for callbacks and for inlined
  helpers alike.

Neither changes today's output (WA's minifier emits `function(){}`, and no
arm declares inside a nested block), so both are covered by fixture cases
instead.

Determinism holds, schemas validate, codegen still byte-identical, and no
--allow-shrink was needed.

Six findings on bd585b6 — one from CodeRabbit, five from Codex, two of them
the same defect from both. All applied.

schemaVersion 1.1.0 -> 2.0.0. Nearly everything this branch adds is
optional and a 1.x consumer ignores it, but `AssertionKind` gained a
`reference` variant, which widens the value space of an EXISTING field. A
consumer with a closed enum — generated from the 1.0 JSON Schema, or the
Rust enum itself — rejects the document rather than ignoring an unknown
key, and that is not hypothetical: validating the current `iq/index.json`
against the committed 1.0 schema fails with 579 errors, all `'reference' is
not valid under any of the given schemas`. Shipping that as a minor bump
would tell consumers the opposite of the truth. The migration is one
variant wide, and the reasoning is recorded on the constant.

A flattened branch scope produced WRONG field names, not missing ones.
Making return collection recursive last round left the scope flat and
first-wins, so mutually exclusive branches rebinding the same minified name
made one branch's return read the other branch's attribute. Both reviewers
flagged it; CodeRabbit proposed refusing the ambiguity, Codex proposed
per-return scopes. Per-return is strictly better — it keeps both branches
correct instead of dropping both — so shapes now carry the scope in force
where they are returned. The one caller with no return path to attribute a
binding to (the object-property walker) does refuse ambiguity, which is the
"missing, not wrong" rule the rest of the module already follows.

Also:

- `guard && value` carries the value on the RIGHT; taking the left yielded
  `hasAttr`, deliberately not a wire accessor, so the field vanished.
  `a || b` keeps the left, where the value really is.
- Notification action fields can carry `enumRef`, resolved through the same
  `wa_enums` path the request and response sides use, including when the
  enum argument is hoisted into a local. Currently latent in the bundle —
  the one live enum field (`create.reason`) validates against an ANONYMOUS
  inline table, whose identifier is whatever the minifier picked, so naming
  it would churn the IR every rollout and invent an identity the bundle
  does not have. Left unresolved and documented as such rather than faked.
- Drops found while resolving a fallback response were being discarded: the
  fallback builds its own resolver during the scan, and the snapshot was
  taken before that from the build-pass resolver only. The collector is now
  shared and snapshotted after the scan, so the diagnostic guarantee holds
  for exactly the unusual shapes the fallback exists to serve.

Determinism holds, schemas validate, codegen still byte-identical, no
--allow-shrink.

…a required read

Five findings on 1bf091c. Three applied; two rejected on evidence.

Applied:

- A helper used in VALUE position (an `extends` operand, an object-property
  value) had all its result branches accumulated into one definition, so a
  helper returning `{x}` in one branch and `{y}` in another made the
  enclosing action require both and reject either legal payload. Branches
  are now folded separately and merged with `merge_action`, the same
  optionality rule the switch arms use. The wholesale-delegation path got
  this last round; this is its value-position twin.
- `a || b` / `a ?? b` were classified as presence guards, so a required
  read with a default (`child.attrString("code") || "none"`) came out
  optional — `attrString` still rejects an absent attribute; the right
  operand only defaults a value the parser already demanded. Only a ternary
  and `guard && value` gate a read now.
- An unresolvable `literal` on a node reached through `flattenedChildWithTag`
  reported nothing: the drop note sat inside the same `source_path.is_none()`
  guard as the root assertion, so the field carried no pin while
  `dropsByReason` simultaneously claimed nothing was lost. The assertion is
  root-relative and stays gated; the drop is not and no longer is.

Rejected, with the checks:

- "Include validation-only pins in error arms" — the premise does not hold
  in this bundle. Swept every error variant for a `code`/`text` pinned in a
  `UnionVariant`'s assertions but missing from its fields: zero. The cited
  shape is `IQErrorReportTokenValidationFail`, whose arm carries `code: 548`
  and no `text` — and that is the fact, not a gap: the mixin reads
  `attrString(e, "text")` with no `literal`, so it accepts ANY text with
  that code. Sourcing arms from assertions would be dead code today; the
  actionable part was that a code-only arm looked like a defect, so
  `ErrorArm::text` now documents both ways absence arises (a fallback arm
  pinning neither value, and a code-only arm reading the text freely).
- "Bind helper parameters to call arguments" — latent, and the fix is
  structurally awkward. Every wholesale delegation in the bundle passes
  NODES (`T(chat, child, author)`, `I(child)`), which need no binding since
  accessors are read structurally off whatever receiver they have; a helper
  taking a wire VALUE appears nowhere. Seeding it would also have to pair
  parameter names from the helper's reparse with argument expressions from
  the caller's — two different allocators — for no present gain.

Determinism holds, schemas validate, codegen byte-identical, no
--allow-shrink.

…child branches

Three findings on f71f94a. All applied, and one of them caught a mistake I
made two rounds earlier.

`SetResponsePreKeySuccessVnameFailure` was classified a SUCCESS because
`variant_kind` reads only the tag's name tokens, and every token in that
name says success. It asserts `type="error"` and parses an `<error
code="207">` wrapping an inner `<error code=400..599>`: the prekeys landed,
the vname did not, and the server said so with an error stanza. Because the
error vocabulary is gated on the kind, the codes and texts it accepts were
being dropped.

The classification now takes the parser's root discriminator first and
falls back to the tag tokens, so the protocol decides rather than a naming
convention. That also corrects round 2 of this review: I stripped the
vocabulary from three "success" variants as bogus, and for two of them
(`FetchKeyBundlesResponseSuccess`, `FetchMissingPreKeysResponseSuccess`,
both asserting `type="result"` with per-item nested errors) that was right,
but for this one it was not. Exactly one variant reclassifies, and it goes
from an empty vocabulary to `[207]` / three texts / range 400–599.

Its envelope code needed one more thing: a two-level error has pins no ARM
can carry, since an arm describes one innermost alternative and the outer
`code="207"` belongs to none of them. The variant's own pins are now folded
into the flat vocabulary so the envelope is not simply lost, while
`errorArms` stays the per-alternative view.

Also:

- A `mapChildrenWithTag` callback returning different shapes from an `if`
  had every property in its body flattened into one child definition,
  marking a field read in only one branch as required. Callbacks are now
  read per return shape and merged — the third and last place that rule
  was missing.
- A constant table assigned to a non-export receiver (`cache.GROUP_ACTIONS
  = local` before the real export) could be taken as the export and, being
  first, kept — resolving case labels through an unrelated table. Only the
  module factory's own parameters count as receivers now, falling back to
  the old rule when the factory shape is unrecognised, so a narrower rule
  cannot turn an unfamiliar module into a silently empty one.

The mapped-child change initially cost 49 shape elements — the floor guard
caught it, which is what it is for. Two causes, both the minifier's doing:
the object is built into a local and returned by name, and the return is a
comma expression (`return sideEffect(), u`) whose value is its last
element. Both are handled, and coverage is back to 181 with no
`--allow-shrink`.

Round-trip coverage moves 141 -> 140 shapes: the reclassified variant is no
longer a success shape, so the guard no longer walks it.

Determinism holds, schemas validate, codegen byte-identical.

…urce fields

Review round 19 — five findings, four applied.

The finalizer branch added last commit decided the override by asking whether the
finalizer had yielded any shape. That is wrong at both ends: `finally { if (c) return B }`
leaves A legal when `c` is false, and `finally { throw e }` yields nothing yet leaves the
vector empty, so A was published although it never escapes. Only a finalizer that leaves
on every path replaces the earlier shapes.

`find_accessor_at`'s wrapper descent took whichever argument read the wire first, so
`combine(c.attrString("a"), c.attrString("b"))` published `a` as the single source of a
value that depends on both. A `NotifActionField` names one `wireName` with one
requiredness, so two distinct reads are refused — the rule a key bound to two different
reads across branches already follows. The same read twice is not ambiguous and still
resolves.

`w:gp2`'s `create.reason` validates against a module-local table, which is not a nameable
`o("Mod").ENUM` reference, so it shipped as `"type": "enum"` with no values and no signal
anywhere. The action path has no linker to drain a pending marker, so it reports its own
losses: `diagnostics.notif.dropsByReason` now carries 1.

The smax enum-drop occurrence key was `site:attr`, which collapsed one parser reading the
same attribute off two descended nodes into a single loss. It includes the source path
now (no change in today's count — preventive).

Not applied: enforcing `literalValue` / `byteLength` / `byteMin`-`byteMax` in the
generated parsers. Real gap, but not a byte-content one — the reference codegen decodes
and does not validate ANY constraint: 2178 `literalValue`, 169 `intMin`, 88 `byteLength`,
281 `enumRef` all go unchecked today. Enforcing only the newest kind would be arbitrary;
the whole enforcement layer is its own change. Answered on the thread.

537 tests, 12/12 schemas, determinism check clean.

Review round 20 — four findings. The first means the fields the last two rounds
"recovered" would have decoded to zero.

`contentUint` is not a text integer. WA calls it `contentUint(3)` for a prekey id,
`contentUint(4)` for a registration id, `contentUint(1)` for a type — the argument is a
BYTE COUNT and the body is big-endian binary. Grouping it with `contentInt` (which really
is decimal text: a follower count, a participant count) meant the generated parser ran
`content_str().parse()` over binary and silently produced `0` for every one, live in
`WAWebDigestKeyJob`. The byte count was being dropped on both scanner paths too, so the
IR did not even record the width; `byteLength` 1/3/4 now rides on those fields.

The other three:

* the multi-source refusal added last commit compared only the SECOND recovered accessor,
  so `combine(a("jid"), a("jid"), a("lid"))` matched on the second and never saw the
  conflicting third. Every argument is inspected now.
* the action enum-drop key was resolver-wide `wireName@method`, so two actions each
  losing `reason` counted once. Keyed by the table argument's source span, which is a
  stronger identity in both directions than the action name would be.
* the request-op fallback classified a candidate by its name suffix with an empty
  assertion list, so a `…Success…` module that asserts `type="error"` could be handed
  back as an operation's only response shape. The name gate stays as a cheap pre-filter;
  the parsed assertions decide.

538 tests, 12/12 schemas, determinism check clean.

…er carries

Review round 21 — five findings, three live in the committed artifacts.

`variant_kind` short-circuited only on `type="error"`, so a parser asserting
`type="result"` fell through to the name heuristic. `CreateResponseGroupAlreadyExists`
and `RequestSilentNonceResponseRecoveryRequired` both assert `result` and shipped as
`kind: "error"` — telling a consumer to route them opposite to the wire, in the one place
this change claims the discriminator outranks the name. The wire wins now; an error-ish
name on a `result` becomes `Alternative`, which is what that variant is for. `error` 47 →
45, `alternative` 0 → 2.

`attach_pending_enum_keys` hung `enumKeys` on the companion `maybeAttrString` read
without retyping it, so the incoming receipt's `type` shipped as `"string"` carrying nine
`enumKeys` — invisible to a consumer selecting enum fields by `type == "enum"`. It is
promoted to the enum accessor and type now.

The incoming ack pass ran its own smax `Resolver` and discarded its drops, so the ack's
`deprecatedEditMixin.edit` was an enum with no values while the domain reported nothing.
Merging them naively gave 29 — but that pass parses every `WASmaxIn*Response*` and keeps
only the `<ack>` roots, so 28 belonged to IQ modules absent from this artifact: the same
"the diagnostic does not describe the file beside it" bug fixed last round on the legacy
path. The collector is rewound for a module that contributes nothing, and the honest
number is 1, matching the one lost constraint the artifact actually carries.

Two more in the action reader: statements after an unconditional `return` were still
scanned, so unreachable returns became additional legal actions; and `{actionType:
"create"}` written as a literal resolved to `None`, publishing an arm with no identity.

542 tests, 12/12 schemas, determinism check clean.

…poisoning the cache

Review round 22 — four findings.

`normalize_accessor` rewrote `contentStringEnum` to `attrEnum`, so codegen — which
switches on the method to choose between an attribute and the element body — emitted
`get_attr(...)` for a value that is not an attribute. 12 fields in the committed IQ
artifact read that way. They are `contentEnum` now, keeping the enum type.

Last round's ack-drop rollback was not enough. It restored the diagnostic set but left
the resolver's caches populated, so a rejected non-ack module could record a loss on a
shared helper, have it rewound, and a later accepted ack would hit the cache and never
record it again. The ack pass builds a resolver PER CANDIDATE now (88 candidates, 8
kept) — a discarded resolver takes its cache with it, so no rejected work is observable
at all. The reported number is unchanged at 1.

`new Uint8Array(4)` is a length, and therefore exactly four zero bytes — as much a
compile-time constant as a literal array, and the request-side constant index already
models it that way. Refusing it lost a recoverable pin. Bounded, so a bogus length
cannot allocate.

`emit_field_parse` routed every JID through the unconditional `ok_or_else("missing …")`
branch while `rust_field_type` declares `Option<Jid>` for a `maybeAttr…Jid` — a `Jid`
initializer for an `Option<Jid>` field, which also rejects the absence the accessor
exists to permit. `union::field_expr` already had the optional branch; only this one
diverged.

That last one is *latent*, not live as reported: `iq.rs` has no `Option<Jid>` field today
and `notif.rs` emits no parser, so nothing miscompiles. It would the moment one appears —
and CI would not catch it, since the generated Rust is only syntax-checked. That is
follow-up 2 in the PR body, and this is the second finding in two rounds arguing for it.

545 tests, 12/12 schemas, determinism check clean.