fix(0114): gate alias-qualified calls to one-level carry, pin to target

The lowerCall namespace branch routed alias.fn() through the global
qualified registration (first-wins) at any import depth, and through the
global last-wins bare map for comptime/generic members. Plain-identifier
alias roots now resolve via the carry-aware namespaceAliasVerdict:

- visible alias (own edge or ONE flat hop): the member dispatches the
  TARGET module's own fn (namespaceFnMember + fd-keyed bareAuthorFuncId),
  so two modules' same-named aliases each call their own target.
- two direct flat imports carrying the alias to distinct targets:
  loud ambiguity diagnostic.
- alias only reachable beyond one hop: "namespace 'X' is not visible".
- foreign / builtin / #compiler members keep the literal-symbol path.

Regressions: examples 0832 (two-hop), 0833 (carried collision),
0834 (own-target pin / first-wins repair).

examples/0832-modules-namespace-alias-two-hop-not-visible.sx

@@ -0,0 +1,15 @@
+// Namespace aliases carry ONE level: an alias declared by a module is
+// usable in that module's DIRECT flat importers only. Two flat hops away
+// (`facade.sx` declares `t`, `facade2.sx` flat-imports facade, this file
+// flat-imports facade2) the alias is NOT visible — the carry does not
+// chain, mirroring bare-name non-transitivity (0763).
+//
+// Regression (issue 0114): the bare `alias.fn()` call path used to serve
+// this from the global qualified registration at any import depth.
+
+#import "modules/std.sx";
+#import "0832-modules-namespace-alias-two-hop-not-visible/facade2.sx";
+
+main :: () {
+    print("{}\n", t.helper());
+}

examples/0832-modules-namespace-alias-two-hop-not-visible/facade.sx

@@ -0,0 +1 @@
+t :: #import "target.sx";

examples/0832-modules-namespace-alias-two-hop-not-visible/facade2.sx

@@ -0,0 +1 @@
+#import "facade.sx";

examples/0832-modules-namespace-alias-two-hop-not-visible/target.sx

@@ -0,0 +1 @@
+helper :: () -> s64 { 7 }

examples/0833-modules-namespace-alias-carried-collision-ambiguous.sx

@@ -0,0 +1,15 @@
+// Two direct flat imports each declare the SAME alias name `t` pointing at
+// DIFFERENT targets. Using the carried alias here is ambiguous and rejected
+// loudly — never a silent first-registration pick. (Each module's own use
+// of its own `t` stays valid — see 0834.)
+//
+// Regression (issue 0114): collisions used to resolve silently first-wins
+// through the global qualified-fn registration.
+
+#import "modules/std.sx";
+#import "0833-modules-namespace-alias-carried-collision-ambiguous/a.sx";
+#import "0833-modules-namespace-alias-carried-collision-ambiguous/b.sx";
+
+main :: () {
+    print("{} {} {}\n", use_a(), use_b(), t.fx());
+}

examples/0833-modules-namespace-alias-carried-collision-ambiguous/a.sx

@@ -0,0 +1,2 @@
+t :: #import "x.sx";
+use_a :: () -> s64 { t.fx() }

examples/0833-modules-namespace-alias-carried-collision-ambiguous/b.sx

@@ -0,0 +1,2 @@
+t :: #import "y.sx";
+use_b :: () -> s64 { t.fy() }

examples/0833-modules-namespace-alias-carried-collision-ambiguous/x.sx

@@ -0,0 +1 @@
+fx :: () -> s64 { 1 }

examples/0833-modules-namespace-alias-carried-collision-ambiguous/y.sx

@@ -0,0 +1 @@
+fy :: () -> s64 { 2 }

examples/0834-modules-namespace-alias-own-target-pin.sx

@@ -0,0 +1,15 @@
+// Two modules each declare their OWN alias `t` to different targets, and the
+// targets export the SAME member name `f`. Each module's `t.f()` dispatches
+// its OWN target's `f` — a.sx gets x.sx's (1), b.sx gets y.sx's (2). The
+// caller here never uses `t` itself, so no ambiguity arises.
+//
+// Regression (issue 0114): the global qualified-fn map registered `t.f`
+// first-wins, so both modules used to call whichever registered first.
+
+#import "modules/std.sx";
+#import "0834-modules-namespace-alias-own-target-pin/a.sx";
+#import "0834-modules-namespace-alias-own-target-pin/b.sx";
+
+main :: () {
+    print("{} {}\n", use_a(), use_b());
+}

examples/0834-modules-namespace-alias-own-target-pin/a.sx

@@ -0,0 +1,2 @@
+t :: #import "x.sx";
+use_a :: () -> s64 { t.f() }

examples/0834-modules-namespace-alias-own-target-pin/b.sx

@@ -0,0 +1,2 @@
+t :: #import "y.sx";
+use_b :: () -> s64 { t.f() }

examples/0834-modules-namespace-alias-own-target-pin/x.sx

@@ -0,0 +1 @@
+f :: () -> s64 { 1 }

examples/0834-modules-namespace-alias-own-target-pin/y.sx

@@ -0,0 +1 @@
+f :: () -> s64 { 2 }

examples/expected/0832-modules-namespace-alias-two-hop-not-visible.exit

@@ -0,0 +1 @@
+1

examples/expected/0832-modules-namespace-alias-two-hop-not-visible.stderr

@@ -0,0 +1,5 @@
+error: namespace 't' is not visible; #import the module that declares it
+  --> examples/0832-modules-namespace-alias-two-hop-not-visible.sx:14:19
+   |
+14 |     print("{}\n", t.helper());
+   |                   ^

examples/expected/0832-modules-namespace-alias-two-hop-not-visible.stdout

@@ -0,0 +1 @@
+

examples/expected/0833-modules-namespace-alias-carried-collision-ambiguous.exit

@@ -0,0 +1 @@
+1

examples/expected/0833-modules-namespace-alias-carried-collision-ambiguous.stderr

@@ -0,0 +1,5 @@
+error: namespace 't' is ambiguous: aliases from multiple flat-imported modules point at different targets; declare the alias locally
+  --> examples/0833-modules-namespace-alias-carried-collision-ambiguous.sx:14:43
+   |
+14 |     print("{} {} {}\n", use_a(), use_b(), t.fx());
+   |                                           ^

examples/expected/0833-modules-namespace-alias-carried-collision-ambiguous.stdout

@@ -0,0 +1 @@
+

examples/expected/0834-modules-namespace-alias-own-target-pin.exit

@@ -0,0 +1 @@
+0

examples/expected/0834-modules-namespace-alias-own-target-pin.stderr

@@ -0,0 +1 @@
+

examples/expected/0834-modules-namespace-alias-own-target-pin.stdout

@@ -0,0 +1 @@
+1 2

issues/0114-namespace-alias-transitive-first-wins.md

@@ -1,5 +1,19 @@
 # 0114 — namespace aliases leak transitively and collide first-wins, silently
 
+> **RESOLVED** (2026-06-11). Root cause: `lowerCall`'s namespace branch
+> consulted the global `fn_ast_map["alias.fn"]` (registered first-wins by
+> `registerQualifiedFn`) with no per-importer gate, and fell back to the
+> global LAST-wins bare map for comptime/generic members. Fix: the branch
+> now routes plain-identifier alias roots through the carry-aware
+> `namespaceAliasVerdict` — visible targets dispatch the member fd pinned
+> to the TARGET module (`namespaceFnMember` + fd-keyed `bareAuthorFuncId`),
+> ambiguous carries diagnose loudly, and an alias that exists only beyond
+> one flat hop errors "namespace 'X' is not visible". Foreign/builtin/
+> #compiler members keep the literal-symbol path. Regression tests:
+> `examples/0832-modules-namespace-alias-two-hop-not-visible.sx`,
+> `examples/0833-modules-namespace-alias-carried-collision-ambiguous.sx`,
+> `examples/0834-modules-namespace-alias-own-target-pin.sx`.
+
 **Symptom.** A namespace alias (`t :: #import "target.sx";`) declared in module
 B is usable from ANY module whose import closure reaches B — at any depth, flat
 or not — and when two modules register the same qualified name (`t.helper`),

src/ir/lower.zig

@@ -1131,34 +1131,80 @@ pub const Lowering = struct {
         };
     }
 
+    /// Carry-rule resolution outcome for a namespace alias, diagnostic-free.
+    pub const AliasVerdict = union(enum) {
+        /// No edge anywhere visible from the current file binds this alias.
+        none,
+        /// ≥2 DIRECT flat imports carry the alias to DISTINCT targets.
+        ambiguous,
+        /// The alias resolves — own edge, or carried over one flat hop.
+        target: imports_mod.NamespaceTarget,
+    };
+
     /// Resolve a namespace alias visible from the current source file under
     /// the carry rule: the file's OWN `ns :: #import` edge wins; otherwise an
     /// alias declared by a DIRECT flat import is carried (one level — flat
     /// edges of flat edges do not chain). Two distinct carried targets for
-    /// the same alias diagnose as ambiguous and resolve to null.
+    /// the same alias are ambiguous.
-    pub fn namespaceAliasTarget(self: *Lowering, alias: []const u8, span: ?ast.Span) ?imports_mod.NamespaceTarget {
+    pub fn namespaceAliasVerdict(self: *Lowering, alias: []const u8) AliasVerdict {
-        const edges = self.program_index.namespace_edges orelse return null;
+        const edges = self.program_index.namespace_edges orelse return .none;
-        const from = self.current_source_file orelse return null;
+        const from = self.current_source_file orelse return .none;
         if (edges.getPtr(from)) |own| {
-            if (own.get(alias)) |t| return t;
+            if (own.get(alias)) |t| return .{ .target = t };
         }
-        const flat = self.program_index.flat_import_graph orelse return null;
+        const flat = self.program_index.flat_import_graph orelse return .none;
-        const direct = flat.get(from) orelse return null;
+        const direct = flat.get(from) orelse return .none;
         var found: ?imports_mod.NamespaceTarget = null;
         var it = direct.keyIterator();
         while (it.next()) |dep| {
             const dep_edges = edges.getPtr(dep.*) orelse continue;
             const t = dep_edges.get(alias) orelse continue;
             if (found) |f| {
-                if (!std.mem.eql(u8, f.target_module_path, t.target_module_path)) {
+                if (!std.mem.eql(u8, f.target_module_path, t.target_module_path)) return .ambiguous;
-                    if (self.diagnostics) |d| {
-                        d.addFmt(.err, span, "namespace '{s}' is ambiguous: aliases from multiple flat-imported modules point at different targets; declare the alias locally", .{alias});
-                    }
-                    return null;
-                }
             } else found = t;
         }
-        return found;
+        return if (found) |f| .{ .target = f } else .none;
+    }
+
+    /// `namespaceAliasVerdict` with the ambiguity diagnosed in place; callers
+    /// that don't distinguish ambiguous-from-missing use this form.
+    pub fn namespaceAliasTarget(self: *Lowering, alias: []const u8, span: ?ast.Span) ?imports_mod.NamespaceTarget {
+        switch (self.namespaceAliasVerdict(alias)) {
+            .target => |t| return t,
+            .ambiguous => {
+                if (self.diagnostics) |d| {
+                    d.addFmt(.err, span, "namespace '{s}' is ambiguous: aliases from multiple flat-imported modules point at different targets; declare the alias locally", .{alias});
+                }
+                return null;
+            },
+            .none => return null,
+        }
+    }
+
+    /// True when ANY module in the program declares `alias` as a namespace
+    /// edge — distinguishes a not-visible alias (gate error) from a name that
+    /// was never an alias at all (fall through to other resolution).
+    pub fn aliasDeclaredAnywhere(self: *Lowering, alias: []const u8) bool {
+        const edges = self.program_index.namespace_edges orelse return false;
+        var it = edges.valueIterator();
+        while (it.next()) |per_file| {
+            if (per_file.contains(alias)) return true;
+        }
+        return false;
+    }
+
+    /// The target module's own fn member named `name` — a top-level fn decl
+    /// or a const-wrapped fn (the same surface `registerNamespaceQualifiedFns`
+    /// registers). Null when the member is absent or not a function.
+    pub fn namespaceFnMember(target: *const imports_mod.NamespaceTarget, name: []const u8) ?*const ast.FnDecl {
+        for (target.own_decls) |decl| {
+            switch (decl.data) {
+                .fn_decl => |*fd| if (std.mem.eql(u8, fd.name, name)) return fd,
+                .const_decl => |*cd| if (std.mem.eql(u8, cd.name, name) and cd.value.data == .fn_decl) return &cd.value.data.fn_decl,
+                else => {},
+            }
+        }
+        return null;
     }
 
     /// The inner member name when `node` is a namespace-rooted prefix

src/ir/lower/call.zig

@@ -708,6 +708,51 @@ pub fn lowerCall(self: *Lowering, c_in: *const ast.Call) Ref {
                     std.fmt.allocPrint(self.alloc, "{s}.{s}", .{ n, fa.field }) catch func_name
                 else
                     func_name;
+                // The carry gate (issue 0114): a plain-identifier root that is
+                // a namespace ALIAS (not a type / fn global name — those are
+                // the `Type.method` paths below) must be visible under the
+                // carry rule, and its fn members dispatch pinned to the
+                // alias's TARGET module — never the global first-wins
+                // qualified registration, never the last-wins bare fallback.
+                gate: {
+                    if (fa.object.data != .identifier) break :gate;
+                    const oname = fa.object.data.identifier.name;
+                    if (self.program_index.global_names.contains(oname)) break :gate;
+                    switch (self.namespaceAliasVerdict(oname)) {
+                        .target => |target| {
+                            const fd = Lowering.namespaceFnMember(&target, fa.field) orelse break :gate;
+                            // Foreign / builtin / #compiler bodies keep their
+                            // literal global symbol — the existing bare-name
+                            // machinery below resolves them.
+                            switch (fd.body.data) {
+                                .foreign_expr, .builtin_expr, .compiler_expr => break :gate,
+                                else => {},
+                            }
+                            if (hasComptimeParams(fd)) return self.lowerComptimeCall(fd, c);
+                            if (fd.type_params.len > 0) return self.lowerGenericCall(fd, fa.field, c, args.items);
+                            var sf = SelectedFunc{ .decl = fd, .source = target.target_module_path };
+                            const fid = self.selectedFuncId(&sf, fa.field);
+                            const func = &self.module.functions.items[@intFromEnum(fid)];
+                            self.packVariadicCallArgs(fd, c, &args);
+                            const final_args = self.prependCtxIfNeeded(func, args.items);
+                            self.coerceCallArgs(final_args, func.params);
+                            if (func.is_variadic) self.promoteCVariadicArgs(final_args, func.params.len);
+                            return self.builder.call(fid, final_args, func.ret);
+                        },
+                        .ambiguous => {
+                            if (self.diagnostics) |d|
+                                d.addFmt(.err, fa.object.span, "namespace '{s}' is ambiguous: aliases from multiple flat-imported modules point at different targets; declare the alias locally", .{oname});
+                            return Ref.none;
+                        },
+                        .none => {
+                            if (self.aliasDeclaredAnywhere(oname)) {
+                                if (self.diagnostics) |d|
+                                    d.addFmt(.err, fa.object.span, "namespace '{s}' is not visible; #import the module that declares it", .{oname});
+                                return Ref.none;
+                            }
+                        },
+                    }
+                }
                 // Check for comptime-expanded or generic functions (try both names)
                 const effective_name = if (self.program_index.fn_ast_map.get(qualified_name) != null) qualified_name else func_name;
                 if (self.program_index.fn_ast_map.get(effective_name)) |fd| {