Module known_calls 

Definition-time resolution of CALLED NAMES — a call to a name that exists NOWHERE in the program is a check error, not a native-build E0425 or a runtime surprise.

This is a NAME pass, not a type pass: it never unifies, so it cannot change any inference outcome. A called name is KNOWN when it is any of:

• a ## To function (user, prelude .lg, or ## To native) anywhere in the program — forward references and mutual recursion resolve, exactly as super::check’s preregistration and the VM’s fn_index do;
• a kernel builtin (crate::semantics::builtins::builtin_from_name) or one of the VM’s by-name intercepts (show, args, loaded);
• an enum variant constructor (the registry’s callable spellings);
• a pub fn export of a mixed document’s bundled proven module — proven functions, check_* predicates, and constructor wrappers, in scope via use proven::*; (proven_module_exports, threaded through check_unknown_calls_with_exports by the mixed compile seam);
• a name BOUND anywhere as a variable, parameter, pattern, or handle — the closure-called-by-name form (Let f be (x: Int) -> x. Show f(42).).

The binding rule is deliberately program-wide rather than scope-precise: a false accept merely defers to the runtime tiers’ existing Unknown function: <name> error, while a false reject would refuse a valid program. Every runtime tier keeps its own call-time dispatch; this pass only closes the “name exists nowhere” hole, definition-independently (a call in a never-taken branch is still an error).

CALLERS: the post-prelude compile seams (compile_program_full_with_proven, compile_to_rust_with_registry_full — i.e. largo check/largo build and every string-compile entry). The LSP’s raw-source diagnostics pass must NOT run this (it cannot see the prelude, so every stdlib call would misfire); its deep flycheck covers unknown names through rustc translation.

Both walkers match EXHAUSTIVELY — no wildcard arm — so a new Stmt/Expr variant fails this build until its call and binder positions are wired.

Functions

check_unknown_calls

Reject the first call (in source order) to a name that exists nowhere in the post-prelude program. See the module docs for the KNOWN-name rule.

check_unknown_calls_with_exports

check_unknown_calls for the mixed-document seam: exports is the callable surface of a bundled proven module (see proven_module_exports), whose names the imperative half calls by design (use proven::*;).

proven_module_exports

The callable surface of a bundled proven module: every pub fn name. The Forge emits proven functions, check_* predicates, and non-nullary enum constructors all as pub fns (a nullary constructor is a pub const, which is an identifier reference, not a call — outside this pass’s domain).

refuse_retired_calls

The first call, in source order, to a builtin the language no longer has (crate::semantics::builtins::retired_builtin), refused in that builtin’s own sentence. A name the program defines or binds is its own and is called. Every tier’s front end runs this before the program runs, so each refuses the call in the same words, whether or not the call is ever reached.