feat: release Dever 0.1.4 with enforceable project guidance

.trellis/spec/backend/compiler-contracts.md

@@ -28,7 +28,7 @@ Applies to AST/HIR contract metadata, typed LLVM/resource/coroutine lowering, pr
 - Application tests use `test/<component>/<domain>/<topic>.dever[.md]`; the filename selects the one ordinary zero-input, zero-output `<topic>() ()` entry. Test helpers/types remain private to that file. Tests call same-domain App/Domain and cross-domain App only; they cannot call Model operations, Port, Adapter, API or another test, and production cannot call tests.
 - Test assertions are compiler-owned `assert(Bool)` and `assert_eq(actual, expected)`. Equality requires the same comparable type; only `null`/empty expressions that already require context receive the left type, so numeric promotion does not make unequal source types valid. Business failures continue through `result(call)` and explicit recovery.
 - CLI: `check <root>`, `test <root>`, `run <root> [--tenant <id>] [-- <cmd> <json>]`, `build <root> --output <new-file>`, `tenant migrate <root> <id>`, `tenant owner <root> <id> <site> <user-id>` and `tenant component enable|disable <root> <id> <component>`. Run/build collect checked API/CMD/Job declarations into one generated entry and reject application `main.dever`. Test checks `module/ + test/` before running stable-sorted cases; check/run/build load only module/. Deployment and database settings come only from `config/setting.json`.
-- CLI check and application compilation share `Program::application_errors()` before resource preparation: C016 rejects unreachable App/Domain functions and recognized trivial private forwarders or Model CRUD wrappers, not every wrapper shape. Check remains static and offline, with no Worker preparation, runtime pack, native compilation, service or database execution. Test retains its case-local roots and Port fakes without applying production reachability; core library checking still permits exports whose consumers are unknown.
+- CLI check and application compilation share `Program::application_errors()` before resource preparation: C016 rejects unreachable App/Domain functions and recognized trivial private forwarders or Model CRUD wrappers, not every wrapper shape. Within production-reachable App/Domain, it also rejects same-owner private implementations with identical full contracts/bodies and empty transitive effects, and repeated pure calls with unchanged inputs whose previous result remains available. Reuse the W003 structural key and W004 version/result proof rather than interpreting warning text. Do not promote effectful W003 matches: the structural key does not encode every Model query property. Keep different owners/contracts, mutations, Adapter and bundled code outside these two hard rules. Check remains static and offline, with no Worker preparation, runtime pack, native compilation, service or database execution. Test retains its case-local roots and Port fakes without applying production application errors; core library checking still permits exports whose consumers are unknown.
 - Module API files contain declarations such as `get profile = app.profile`, `post publish = app.publish`, `cmd bootstrap = app.bootstrap` and `rest model`; they do not contain handler function bodies. HTTP routes inherit the App signature and return the fixed envelope. `public` is valid only on one HTTP declaration. Recursive `api/<site-path>/<topic>.dever` supplies configured site ownership without source `site` statements.
 - Authentication providers, sites, external HTTP origins, Cookie names/lifetimes and tenant routing come only from `config/setting.json`. Verify is one read-only App function from `Claims` to an App-owned record with exactly `id: Text`, `user_id: ModelId?`, and `tenant_id: ModelId?`; it cannot return permissions. A protected site's generated entry verifies its configured provider, enters trusted tenant scope, checks every reachable tenant component and authorizes the exact permission before reading business input or dispatching App. A `public` declaration ignores an ambient browser Cookie, but an explicitly supplied invalid `Authorization` credential remains an authentication error.
 
@@ -82,7 +82,7 @@ Facts, effects and failures share `contracts/dependencies.rs` for function/stati
 
 Domain dependency edges come only from resolved type, function and handler references. Physical role files in one domain share one dependency boundary; cross-domain cycles remain invalid and function recursion remains independently invalid. Source code does not duplicate edges in a header, and dependency inference does not install or download packages.
 
-API snapshots sort semantic names and contracts, not source paths/IDs. A baseline is optional, explicit and create-new; checks never update it. Protect its edits outside the language. CLI suppresses bundled-source suggestions only; Program retains diagnostics and bundled hard errors remain visible. Entry-specific export advice must not infer unknown library consumers.
+API snapshots sort semantic names and contracts, not source paths/IDs. A baseline is optional, explicit and create-new; checks never update it. Protect its edits outside the language. Program retains all warnings. CLI suppresses bundled-source suggestions and W003/W004/W005 already represented by a C016 with the same primary and nonempty ordered related spans. Different evidence or warning codes remain visible, as do bundled hard errors. Baseline failure takes precedence and retains original warnings; API/Test do not apply production-error suppression. Entry-specific export advice must not infer unknown library consumers.
 
 Test authority comes from compiler-assigned source origin, never a user-controlled path string. A checked `TestCase` holds the private function ID and database-effect metadata; native compilation accepts only that checked identity and does not relax normal entry visibility. Each case runs serially in its own native process and temporary project. Successful child output stays captured; failed stdout/stderr is reported in labelled sections, later tests continue, and any failed case makes the command fail. Tests cannot reach `dever.api.serve()`.
 
@@ -125,6 +125,7 @@ Sensitivity belongs to the cached type graph in `types.rs`: Secret and private M
 | Invalid Model or transaction database contract | C014 |
 | Contract analysis exceeds bounded work | C015, no executable Program |
 | Proven redundant check / duplicate private implementation / repeated pure call / trivial private forwarding | W002 / W003 / W004 / W005 |
+| Production App/Domain orphan, recognized forwarding/CRUD wrapper, same-owner identical private effect-free implementation or proven reusable pure call | C016 before resource preparation; libraries/Test retain warnings |
 | Unused or overwritten write | Existing W001, no duplicate W006 |
 | Unneeded exposure for a selected application | W007, not a hard error |
 | API drift or unreadable baseline | CLI failure before native compilation |
@@ -164,6 +165,8 @@ LLVM changes select root `llvm_lowering` and embedded-bridge `llvm_native`: real
 
 Select `structured_concurrency`, `async_native`, `contract_syntax`, `contract_facts`, `contract_semantics`, `contract_api`, `contract_redundancy`, `contract_execution`, `error_effects` according to changes. Assert suspension propagation through ordinary calls and concrete handler substitution, non-transferable liveness, worker boundaries, API omission, alias mutation, handler variance, short-circuit/empty traversal, overwrite/projection obligations, bounded shared graphs and unchanged native results. Error capture tests cover native/reference wrapping, explicit outer identity, ambiguity and discarded captures. Parser tests must reject the removed package-header dependency clause; formatter round trips must prove it cannot be emitted. Do not run the entire suite or service tests by default.
 
+For C016 duplication changes, `contract_redundancy` must exercise actual production roots, identical private pure implementations and reusable pure calls, unchanged library warnings, and exclusions for effects, input/field/result mutation, owners and output/recovery contracts. CLI `llvm_cli` must reject both proven cases identically through check/run/build before missing runtime packs, database access or output creation; show each hard error and its evidence once, keep distinct-proof/unrelated warnings, and preserve baseline/API/Test behavior. Statically check maintained CMS plain/Markdown and skill examples with application errors; no native execution or database is required for this gate.
+
 For this source/API contract select `source_architecture`, `source_visibility`, `contract_execution`, `markdown_source`, `api_declarations`, `rest_model`, `native_entry`, `api_routes`, `auth_runtime`, `authorization_runtime`, `secure_contracts`, `tenant_database`, `durable_jobs` and `upload_boundary` as needed. Assert App aliases, topic hiding, role call direction, Model ownership, layout rejection, generated roots, strict inputs, JSON envelopes, Markdown parity, site/auth ownership, exact permission keys, duplicate-key rejection, public-to-tenant rejection, REST row scope and Upload cleanup. Authentication coverage includes public Cookie isolation, explicit invalid Authorization, exact Origin, staged metadata ordering, generated System roots, site-scoped multi-role union, Owner isolation and User Job current-role checks. Actual loopback HTTP verification requires an explicitly scoped service check.
 
 Application-test changes select `application_testing`, `formatter` and `cms_project`. Assert stable discovery, plain/Markdown duplicates, filename entry validation, both visibility directions, assertion typing/rendered source locations, existing result-choice recovery, failure continuation/output capture, zero-test success, per-case SQLite Seed isolation, ignored deployment settings, production commands ignoring test sources and module/test formatting preflight.