P6.x: convert instantiate_provider_expr to bynk-emit::ir's CapRefIr (Provider given/deps wiring)

[accuser]

Summary

• Scope: project.rs's instantiate_provider_expr (the deps-object constructor for a provides
  binding, both Bynk-authored and external/adapter-supplied) now reads a provider's own given clause
  through bynk-emit::ir::CapRefIr instead of walking bynk_syntax::ast::CapRef directly.
• Addresses: the smallest of the deferred pieces the design-doc reconciliation (a companion PR)
  found still blocking project.rs's own eventual slice 6 cleanup.
• Realises: byte-identical output confirmed across the entire fixture suite.

A real fix found along the way, not just a data-source swap

ProviderBody::External was a bare unit variant carrying no given field at all — silently dropping an
external provider's own given clause, despite its own doc comment already claiming "given lowers
unconditionally" (P6.14, #1186). ProviderDecl::given is populated the same way regardless of
external — nothing in the grammar or checker gates it — so this was a real gap between the type's
documented intent and its actual shape, not a deliberate omission. ProviderBody::External now carries
given: Vec<CapRefIr> too, and lower_provider_item_ir populates it for both branches via a new
lower_provider_given_ir.

Why a standalone lower_provider_given_ir, not the full IrItem::Provider

Building a real IrItem::Provider at project.rs's call site would be unsafe for a Bynk provider
specifically: ProviderBody::Bynk::ops unconditionally lowers every op's body through
lower_provider_op_ir → lower_expr_ir, which still can't handle Ok/Err/Some/None construction
— the same gap that made Agent/Service's own full IrItem construction impractical at their emitter
call sites (#1196/#1198). lower_provider_given_ir never touches ops/bodies, mirroring #1198's own
lower_service_handler_signature_ir precedent: a narrow standalone reader, not the full assembly.

What's not changed

• plan_agent_given_deps (project.rs) stays AST-driven — it's Agent handler given, a separate
  concern from Provider given, and IrHandler::given is bare names only (no context/prefix data),
  blocked on Agent's own still-deferred given-with-context IR work.
• Raw CapRef/ProviderDecl.given reads persist elsewhere too: emitter/workers.rs's own deps
  construction and cross-context scan, project.rs's own second given scan, and
  EmitProjectCtx::agent_method_givens, which stores raw Vec<CapRef> directly. This slice does not
  remove bynk_syntax::ast::CapRef coupling from the crate, only from this one call site.
• ast_importers unaffected (still 8) — stated explicitly.

Test coverage

• lower_provider_item_ir's own external-provider test now exercises a non-empty given (previously
  always empty), pinning that ProviderBody::External carries it correctly where it used to be silently
  dropped.
• Fixture-level: BYNK_BLESS=1 cargo test -p bynkc --test e2e bless_positive_fixtures — zero files
  changed across the whole positive fixture suite.

cargo build --workspace / cargo clippy --workspace --all-targets / cargo fmt --all -- --check /
cargo test --workspace all clean (164 test-result blocks, 0 failures; 212/212 in bynk-emit's own
lib suite).

Done when

• instantiate_provider_expr reads CapRefIr, not raw CapRef, for a provider's own given.
• ProviderBody::External carries given — the silent-drop gap fixed, not just worked around.
• New standalone lower_provider_given_ir, avoiding the Ok/Err/Some/None body-lowering
  panic risk a full IrItem::Provider construction would carry.
• Byte-identical output confirmed across the fixture suite.
• ast_importers unaffected (still 8) — stated explicitly.
• Named, not attempted: plan_agent_given_deps, workers.rs's own given reads,
  agent_method_givens's raw CapRef storage.
• design/pending/p6-provider-given-deps-wiring.md added (patch level — internal only, no language
  surface change).
• A new ADR records this decision if the reviewing bot calls for one; its number is assigned at merge.
  Part of Phase 6 — The IR (spine) #1137 — a step toward project.rs's own slice 6 cleanup, not slice 6 itself.

[claude]

Review: sound — no blocking findings

I verified the equivalence claim rather than taking it on faith, since the whole PR rests on it.

The data-source swap is exactly semantics-preserving. CapRef::key() is &self.name.name and CapRef::prefix() is self.context.as_ref().map(|q| q.joined()) (bynk-syntax/src/ast.rs:432-446); lower_cap_ref_ir builds CapRefIr { context: cap_ref.context.as_ref().map(QualifiedName::joined), name: cap_ref.name.name.clone() } (bynk-emit/src/ir/lower.rs:1595). Same joined(), same field — the three replaced call sites (resolve_consume_prefix(p, ..), flattened.get(&g.name), format!("{}: {}", g.name, ..)) cannot diverge. Types line up too: resolve_consume_prefix takes &str (bynk-check/src/project_model.rs:2619) so &String derefs, and flattened: HashMap<String, String> accepts &String via Borrow. The byte-identical bless result is what I'd expect, not a coincidence.

The branch that could have diverged is genuinely covered. The Some(context) arm is the only place a flattening bug could hide, and bynkc/tests/fixtures/positive/169_cross_ctx_cap_in_provider has provides Stamp = ClockStamp given platform.time.Clock — a multi-part qualified prefix through a provider's own given, which is precisely the multi-segment joined() path. So the fixture suite exercises the risky edge, not just the bare-name happy path. (lower_cap_ref_ir_preserves_a_cross_context_prefix only pins a single-segment prefix, but the fixture covers the rest.)

The ProviderBody::External fix is real, not cosmetic. ProviderDecl::given is populated identically regardless of external — nothing in the grammar or checker gates it — so the bare unit variant was structurally unable to represent a valid input. The unit-test change is the right shape: it swaps the matches! for a let-else destructure and asserts given.len() == 1 / context == None / name == "Clock", so the field can't silently regress to empty. Worth noting the field has no consumer yet — the ir module is still #[allow(dead_code)] (bynk-emit/src/lib.rs:30), so this is correctness-of-shape ahead of a reader, consistent with how ProviderBody::Bynk::given already sits.

Scoping judgement is right. Standalone lower_provider_given_ir over a full IrItem::Provider avoids ProviderBody::Bynk::ops → lower_provider_op_ir → lower_expr_ir, which would panic on Ok/Err/Some/None bodies — the same trap #1196/#1198 hit. It also correctly de-duplicates: lower_provider_item_ir now calls the new helper instead of keeping its own inline map, so there's one lowering path, not two that can drift. The let given = ... before the if moves into exactly one branch, which is fine.

Nothing else in instantiate_provider_expr still reads provider.given — the later provider.external / provider_name reads are untouched, so no half-migrated state.

Release discipline: correct. Exactly one increment file, design/pending/p6-provider-given-deps-wiring.md, with both level and changelog. patch is the right level for an internal refactor with byte-identical output and no language-surface change.

Only observation, not a request: the Vec<CapRefIr> now allocates cloned Strings per call on a self-recursive path that fans out over the dep graph. It's negligible next to the .cloned() on consumed/aliases/flattened already sitting right beside it, and paying it buys the AST-decoupling this slice is for.

The PR body's own "what's not changed" list (plan_agent_given_deps, workers.rs deps construction, agent_method_givens' raw Vec<CapRef>) matches what's actually still in the tree — the scope claim is honest.

LGTM.