feat(v0.44): define compiler intrinsics by binding provenance, not spelling (#1209)

Alpha.10 truth closure: the compiler admitted intrinsics by identifier
spelling (getText === 'element'), letting foreign/ambient same-name
bindings into the OE grammar, with three disagreeing recognizers.

- one canonical intrinsic-binding model in the semantic core
  (createModuleIntrinsicBindings / resolveIntrinsic): module specifier +
  imported name, aliases followed; bare/global/local spellings never
  admit; type-only/namespace/default/conflicting/relative-re-export
  provenance fails closed with OEC9027
- compile.ts: every recognition site uses the model; import injection
  deleted; generated modules strip compile-time-only element/property
  bindings; codegen follows aliases
- plugin.ts prefilter documented as a non-recognizer; ambiguous
  provenance routes to the compiler boundary for fail-closed diagnostics
- element gains runtime no-op element/property exports (@experimental
  dual-use contract) so ui/www modules evaluate uncompiled; the ui
  compile-decorators impostor shim is deleted
- all declare-spelling fixtures/templates/www/examples/tools and the
  MDX generator + v0.44 codemod migrated to canonical imports
- 19 hostile provenance tests (RED at baseline) + 3 no-op contract tests

Implemented by fresh kimi-code/k3-256k HIGH session
(.agents/v044-kimi-implementer.md), packet A10.1 with two
orchestrator-reviewed repair rounds (scope expansion + ui dual-use
resolution). No frozen ADR-0122 paths touched. No publish, no tag.

Author: DevBot

docs/current/PACKAGE_SURFACE.md

@@ -191,9 +191,10 @@ unaffected: their `tagName` export remains the registration tag.
 
 ### v0.44 experimental additions (unfrozen)
 
-| Export (element root)                                 | Class                | Purpose                                                                                                                                                                                                       | Removal/move condition                                              |
-| ----------------------------------------------------- | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
-| `isDangerousKey`, `injectPropsSafe`, `DANGEROUS_KEYS` | experimental (#1214) | The one canonical prototype-pollution guard shared by page projection (SPA bootstrap, `projectPageProps`) and adapter codegen, which serializes `DANGEROUS_KEYS` into generated server runtimes at build time | May move to a dedicated security subpath at the B1.2 surface freeze |
+| Export (element root)                                 | Class                | Purpose                                                                                                                                                                                                                                                                                                                                 | Removal/move condition                                               |
+| ----------------------------------------------------- | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- |
+| `isDangerousKey`, `injectPropsSafe`, `DANGEROUS_KEYS` | experimental (#1214) | The one canonical prototype-pollution guard shared by page projection (SPA bootstrap, `projectPageProps`) and adapter codegen, which serializes `DANGEROUS_KEYS` into generated server runtimes at build time                                                                                                                           | May move to a dedicated security subpath at the B1.2 surface freeze  |
+| `element`, `property`                                 | experimental (#1209) | Compile-time-only decorator intrinsics: the compiler admits them by binding provenance (a runtime named import from `@openelement/element`) and erases them from generated code; evaluated without the compiler (unit tests, config evaluation) they are inert no-ops, carrying no runtime semantics and acting as no second recognizer | May move to a dedicated authoring subpath at the B1.2 surface freeze |
 
 ## Removed from current graph
 

docs/current/v0.44.0-MIGRATION.md

@@ -44,13 +44,7 @@ The canonical route module is a thin wrapper around the compiled page element
 
 ```tsx
 // app/components/page-form.tsx — compiled by the open:compiled-element transform
-import { OpenElement } from '@openelement/element';
-
-declare function element(
-  tag: string,
-  options?: { root: 'light' | 'shadow-open' | 'shadow-closed' },
-): ClassDecorator;
-declare function property(options: { reflect: boolean; attribute?: false }): PropertyDecorator;
+import { element, OpenElement, property } from '@openelement/element';
 
 @element('form-page', { root: 'shadow-open' })
 export default class FormPage extends OpenElement {
@@ -113,15 +107,9 @@ Islands are single-module compiled classes; the delivery policy stays in the
 statically scanned `defineIslandConfig` export:
 
 ```tsx
-import { OpenElement } from '@openelement/element';
+import { element, OpenElement, property } from '@openelement/element';
 import { defineIslandConfig } from '@openelement/app';
 
-declare function element(
-  tag: string,
-  options?: { root: 'light' | 'shadow-open' | 'shadow-closed' },
-): ClassDecorator;
-declare function property(options: { reflect: boolean; attribute?: false }): PropertyDecorator;
-
 export const openElement = defineIslandConfig({ hydrate: 'visible', ssr: true, dsd: true });
 
 @element('live-counter', { root: 'shadow-open' })
@@ -205,12 +193,14 @@ The automatic subset is deliberately narrow:
   or a zero-argument render function.
 
 The generated class uses the canonical `element` decorator and `OpenElement`
-import. If the source does not already declare the decorator, the codemod adds
-`declare function element(tag: string): ClassDecorator;`. This is compiler-only
-input and is erased with the decorator; it is not runtime registration
-machinery. Existing class method bodies are retained as source text; the
-compiler remains responsible for lowering supported render syntax to the Part
-Program.
+import. If the source does not already import the decorator, the codemod adds
+`element` to the canonical named import from `@openelement/element` (#1209:
+the compiler admits intrinsics by binding provenance, never by spelling). The
+binding is compile-time-only — the compiler erases the decorator application
+and strips the binding from generated imports; evaluated without the compiler
+it is an inert no-op, not runtime registration machinery. Existing class
+method bodies are retained as source text; the compiler remains responsible
+for lowering supported render syntax to the Part Program.
 
 ## Manual repair cases
 

docs/release/public-interface-snapshot.json

@@ -12,7 +12,7 @@
       },
       "declarations": {
         ".": {
-          "publicShapeSha256": "3334cfeb124b5ad4d7f22fc6647ed8170fd087fc65412a46852a1d26b670b1bb",
+          "publicShapeSha256": "91ae10b67582b58198720342b1d5e7065af882d94215f04bac7f1adea002c671",
           "publicSymbols": [
             "ACTION_FETCH_HEADER=value:\"x-openelement-action\"",
             "Action=type:{call:(ctx:{env:Env;formData:FormData;params:Record<string, string>;platform:union(Platform|undefined);request:Request;responseHeaders:Headers;route:Route})=>union(Promise<T>|T)}",
@@ -72,6 +72,7 @@
             "createLogger=value:{call:(tag:string)=>{debug:{call:(msg:string,...args:array(unknown))=>void};error:{call:(msg:string,...args:array(unknown))=>void};info:{call:(msg:string,...args:array(unknown))=>void};warn:{call:(msg:string,...args:array(unknown))=>void}}}",
             "deepGetElementById=value:{call:(id:string,root:union(Document|ShadowRoot))=>union(HTMLElement|null)}",
             "effect=value:{call:(fn:{call:()=>union(void|{call:()=>void})})=>{call:()=>void}}",
+            "element=value:{call:(_tag:string,_options:union(undefined|{delegatesFocus?:union(false|true|undefined);formAssociated?:union(false|true|undefined);root?:union(\"light\"|\"shadow-closed\"|\"shadow-open\"|undefined)}))=>{call:(target:unknown,context:unknown)=>void}}",
             "ensureDeepFragmentNavigation=value:{call:(options:{enabled?:union(false|true|undefined)})=>void}",
             "ensurePreHydrationClickCapture=value:{call:(root:union(EventTarget|undefined))=>void}",
             "escapeAttr=value:{call:(value:string)=>string}",
@@ -81,6 +82,7 @@
             "isDangerousKey=value:{call:(key:string)=>union(false|true)}",
             "isSafeAttributeName=value:{call:(name:string)=>union(false|true)}",
             "isValidTagName=value:{call:(tagName:string)=>union(false|true)}",
+            "property=value:{call:(_options:{attribute?:union(false|string|undefined);converter?:unknown;reflect:union(false|true);type?:unknown})=>{call:(target:unknown,context:unknown)=>void}}",
             "provideContext=value:{call:<T>(host:HTMLElement,context:{readonly defaultValue:T;readonly key:symbol},value:T)=>{call:()=>void}}",
             "renderDsd=value:{call:(input:union(CustomElementConstructor|string),options:{componentClass?:union(CustomElementConstructor|undefined);projectedChildren?:union(ReadonlyMap<string, TrustedHtml>|undefined);props?:union(Record<string, unknown>|undefined);sourceInfo?:union(undefined|{route?:union(string|undefined);source?:union(string|undefined)});ssrRenderableTags?:union(array(string)|undefined)})=>{errors:array({code:string;message:string;phase:string;recoverable:union(false|true);severity:union(\"error\"|\"warning\");tagName:string});html:string;hydrationHints:array({hydrate?:union(\"idle\"|\"load\"|\"only\"|\"visible\"|undefined);layer:union(\"dsd-interactive\"|\"dsd-static\"|\"light-dom\"|\"pure-island\");tagName:string});metrics:{hasError:union(false|true);layer:union(\"dsd-interactive\"|\"dsd-static\"|\"light-dom\"|\"pure-island\");nestingDepth:number;renderTimeMs:number;tagName:string;templateSize:number}}}",
             "reportError=value:{call:(error:{readonly code:string;readonly phase:union(\"build\"|\"csr\"|\"navigation\"|\"render\"|\"ssr\"|\"unknown\"|\"validation\");readonly recoverable:union(false|true);readonly severity:union(\"error\"|\"warning\");readonly statusCode?:union(number|undefined);toJSON:{call:()=>Record<string, unknown>}})=>void}",

examples/supabase-cloudflare-starter/app/components/page-admin.tsx

@@ -4,15 +4,7 @@
  * shown in each row through the section-level forms (grammar v1 list Regions
  * carry no per-row forms).
  */
-import { OpenElement } from '@openelement/element';
-
-declare function element(
-  tag: string,
-  options?: { root: 'light' | 'shadow-open' | 'shadow-closed' },
-): ClassDecorator;
-declare function property(
-  options: { reflect: boolean; attribute?: false },
-): (target: undefined, context: ClassFieldDecoratorContext) => void;
+import { element, OpenElement, property } from '@openelement/element';
 
 @element('admin-page', { root: 'shadow-open' })
 export default class AdminPage extends OpenElement {

examples/supabase-cloudflare-starter/app/components/page-auth-callback.tsx

@@ -1,13 +1,5 @@
 /** /auth/callback page element (v0.44 compiled). The PKCE exchange runs in the loader; the page renders the outcome. */
-import { OpenElement } from '@openelement/element';
-
-declare function element(
-  tag: string,
-  options?: { root: 'light' | 'shadow-open' | 'shadow-closed' },
-): ClassDecorator;
-declare function property(
-  options: { reflect: boolean; attribute?: false },
-): (target: undefined, context: ClassFieldDecoratorContext) => void;
+import { element, OpenElement, property } from '@openelement/element';
 
 @element('auth-callback', { root: 'shadow-open' })
 export default class AuthCallbackPage extends OpenElement {

examples/supabase-cloudflare-starter/app/components/page-checkout.tsx

@@ -4,15 +4,7 @@
  * fully static conditional Regions; the attempt id rides a property Part on
  * the hidden input (the form stays no-JS capable).
  */
-import { OpenElement } from '@openelement/element';
-
-declare function element(
-  tag: string,
-  options?: { root: 'light' | 'shadow-open' | 'shadow-closed' },
-): ClassDecorator;
-declare function property(
-  options: { reflect: boolean; attribute?: false },
-): (target: undefined, context: ClassFieldDecoratorContext) => void;
+import { element, OpenElement, property } from '@openelement/element';
 
 @element('checkout-page', { root: 'shadow-open' })
 export default class CheckoutPage extends OpenElement {

examples/supabase-cloudflare-starter/app/components/page-home.tsx

@@ -1,10 +1,5 @@
 /** Home page element — public, prerendered at build time (default static intent). */
-import { OpenElement } from '@openelement/element';
-
-declare function element(
-  tag: string,
-  options?: { root: 'light' | 'shadow-open' | 'shadow-closed' },
-): ClassDecorator;
+import { element, OpenElement } from '@openelement/element';
 
 @element('index-page', { root: 'shadow-open' })
 export default class HomePage extends OpenElement {

examples/supabase-cloudflare-starter/app/components/page-login.tsx

@@ -6,15 +6,7 @@
  * placeholder keeps "no provider configured" an explicit page state that
  * Tier-2 evidence can assert on.
  */
-import { OpenElement } from '@openelement/element';
-
-declare function element(
-  tag: string,
-  options?: { root: 'light' | 'shadow-open' | 'shadow-closed' },
-): ClassDecorator;
-declare function property(
-  options: { reflect: boolean; attribute?: false },
-): (target: undefined, context: ClassFieldDecoratorContext) => void;
+import { element, OpenElement, property } from '@openelement/element';
 
 @element('login-page', { root: 'shadow-open' })
 export default class LoginPage extends OpenElement {

examples/supabase-cloudflare-starter/app/components/page-magic-link.tsx

@@ -2,15 +2,7 @@
  * /magic-link page element (v0.44 compiled). Request-time rendered; the props
  * projector lives in app/route-logic/magic-link.ts.
  */
-import { OpenElement } from '@openelement/element';
-
-declare function element(
-  tag: string,
-  options?: { root: 'light' | 'shadow-open' | 'shadow-closed' },
-): ClassDecorator;
-declare function property(
-  options: { reflect: boolean; attribute?: false },
-): (target: undefined, context: ClassFieldDecoratorContext) => void;
+import { element, OpenElement, property } from '@openelement/element';
 
 @element('magic-link-page', { root: 'shadow-open' })
 export default class MagicLinkPage extends OpenElement {

examples/supabase-cloudflare-starter/app/components/page-notes.tsx

@@ -16,15 +16,7 @@
  * dashed dynamic host attributes); the island's attribute-backed @property
  * fields receive them through the SSR expansion and the client claim.
  */
-import { OpenElement } from '@openelement/element';
-
-declare function element(
-  tag: string,
-  options?: { root: 'light' | 'shadow-open' | 'shadow-closed' },
-): ClassDecorator;
-declare function property(
-  options: { reflect: boolean; attribute?: false },
-): (target: undefined, context: ClassFieldDecoratorContext) => void;
+import { element, OpenElement, property } from '@openelement/element';
 
 @element('notes-page', { root: 'shadow-open' })
 export default class NotesPage extends OpenElement {