# 0114 — namespace aliases leak transitively and collide first-wins, silently

> **RESOLVED** (2026-06-11). Root cause: `lowerCall`'s namespace branch
> consulted the global `fn_ast_map["alias.fn"]` (registered first-wins by
> `registerQualifiedFn`) with no per-importer gate, and fell back to the
> global LAST-wins bare map for comptime/generic members. Fix: the branch
> now routes plain-identifier alias roots through the carry-aware
> `namespaceAliasVerdict` — visible targets dispatch the member fd pinned
> to the TARGET module (`namespaceFnMember` + fd-keyed `bareAuthorFuncId`),
> ambiguous carries diagnose loudly, and an alias that exists only beyond
> one flat hop errors "namespace 'X' is not visible". Extern/builtin/
> #compiler members keep the literal-symbol path. Regression tests:
> `examples/0832-modules-namespace-alias-two-hop-not-visible.sx`,
> `examples/0833-modules-namespace-alias-carried-collision-ambiguous.sx`,
> `examples/0834-modules-namespace-alias-own-target-pin.sx`.

**Symptom.** A namespace alias (`t :: #import "target.sx";`) declared in module
B is usable from ANY module whose import closure reaches B — at any depth, flat
or not — and when two modules register the same qualified name (`t.helper`),
the first registration silently wins (`registerQualifiedFn`:
`if contains return`). Expected (the approved carry design, session 72f): an
alias is visible one level deep — in the declaring module and in its DIRECT
flat importers — with own-wins / ambiguity-diagnostic collision semantics,
mirroring ordinary declarations.

This is the alias-side sibling of issue 0106 (bare-name over-permissiveness),
plus a REJECTED-PATTERNS silent first-wins.

## Reproduction

```sx
// target.sx
helper :: () -> i64 { 7 }
```
```sx
// facade.sx
t :: #import "target.sx";
```
```sx
// facade2.sx
#import "facade.sx";
```
```sx
// main.sx
#import "modules/std.sx";
#import "facade2.sx";          // TWO flat hops from the alias declaration
main :: () { print("{}\n", t.helper()); }
```

- **Observed**: prints `7` — the alias rides two flat hops.
- **Expected**: `'t' is not visible` (one-level carry; `facade2.sx` would need
  to re-alias or flat-import `facade.sx`'s surface deliberately).

Collision face: two modules each declaring `t :: #import` of DIFFERENT
targets, both flat-imported by main — first-lowered wins silently.

## Suspected area / fix shape

Qualified members are registered GLOBALLY (`fn_ast_map["t.helper"]`,
`registerQualifiedFn` in src/ir/lower/decl.zig ~1912) with no per-importer
gate; `lowerCall`'s namespace path (src/ir/lower/call.zig ~687) and the
comptime field-access path consult only that global map. Meanwhile
`nominal.zig`'s `qualifiedStructTemplate`/`qualifiedMemberMissing` use STRICT
per-file `namespace_edges` — so carried aliases are inconsistently
over-visible for plain/comptime fns and under-visible for generic structs
(and `alias.Type.method` heads — see PLAN-STDLIB).

Fix shape: one carry-aware resolver on Lowering —
`resolveNamespaceAlias(alias) → {own | carried(target) | ambiguous | none}`
walking own `namespace_edges[from]` first, then the DIRECT
`flat_import_graph[from]` targets' edges (one level; ≥2 distinct targets →
diagnostic). Route every `ns.member` consumer through it: the global
qualified-name paths gain the gate, the strict nominal/type paths gain the
carry. See `current/PLAN-STDLIB.md` for the full design and the std.sx
restructure that depends on it.