sx/issues/0114-namespace-alias-transitive-first-wins.md

0114 — namespace aliases leak transitively and collide first-wins, silently

Symptom. A namespace alias (t :: #import "target.sx";) declared in module B is usable from ANY module whose import closure reaches B — at any depth, flat or not — and when two modules register the same qualified name (t.helper), the first registration silently wins (registerQualifiedFn: if contains return). Expected (the approved carry design, session 72f): an alias is visible one level deep — in the declaring module and in its DIRECT flat importers — with own-wins / ambiguity-diagnostic collision semantics, mirroring ordinary declarations.

This is the alias-side sibling of issue 0106 (bare-name over-permissiveness), plus a REJECTED-PATTERNS silent first-wins.

Reproduction

// target.sx
helper :: () -> s64 { 7 }

// facade.sx
t :: #import "target.sx";

// facade2.sx
#import "facade.sx";

// main.sx
#import "modules/std.sx";
#import "facade2.sx";          // TWO flat hops from the alias declaration
main :: () { print("{}\n", t.helper()); }

• Observed: prints 7 — the alias rides two flat hops.
• Expected: 't' is not visible (one-level carry; facade2.sx would need to re-alias or flat-import facade.sx's surface deliberately).

Collision face: two modules each declaring t :: #import of DIFFERENT targets, both flat-imported by main — first-lowered wins silently.

Suspected area / fix shape

Qualified members are registered GLOBALLY (fn_ast_map["t.helper"], registerQualifiedFn in src/ir/lower/decl.zig ~1912) with no per-importer gate; lowerCall's namespace path (src/ir/lower/call.zig ~687) and the comptime field-access path consult only that global map. Meanwhile nominal.zig's qualifiedStructTemplate/qualifiedMemberMissing use STRICT per-file namespace_edges — so carried aliases are inconsistently over-visible for plain/comptime fns and under-visible for generic structs (and alias.Type.method heads — see PLAN-STDLIB).

Fix shape: one carry-aware resolver on Lowering — resolveNamespaceAlias(alias) → {own | carried(target) | ambiguous | none} walking own namespace_edges[from] first, then the DIRECT flat_import_graph[from] targets' edges (one level; ≥2 distinct targets → diagnostic). Route every ns.member consumer through it: the global qualified-name paths gain the gate, the strict nominal/type paths gain the carry. See current/PLAN-STDLIB.md for the full design and the std.sx restructure that depends on it.