The call axis: shapes that only exist between parameters (#198, step 4)

[milyin]

Step 4 of #198, on shape-coverage (#402).

The axis a per-value cell cannot express

Every cell so far described one value in one position. Aliasing cannot be described that way: two parameters can name the same underlying resource, and what a binding must do about it is a property of the call.

Both generators already say so in their own code. Each emits an alias preflight under a rule about the whole parameter set — at least one consumed handle, and any other handle — and both docs note that the narrower reading ("two consumed parameters") misses the mixed cases, where a borrow dangles the moment a consume takes ownership.

So calls are a second kind of cell, running through the same driver, compile check, header stage and ratchet. Eight, chosen around that rule rather than at random:

Call	Why it is here
(Handle, Handle)	the case both generators name: one allocation, two consuming converters
(Handle, &Handle)	a mixed pair — the narrower rule misses it
(&Handle, &Handle)	must not be guarded: two &T to one resource is legal Rust and legal C
(Handle, Option<Handle>)	same domain, different spelling — why comparison is on the resource, not the declared type
(Handle, Rec), (Handle, Sum)	different domains; nothing to alias
(Rec, Rec)	the control — no handles at all
(&Handle, &Handle, Handle)	three parameters, consume last: position within a call must not matter

All eight are expressible in both targets — header for C, rustc for JNI. No findings. The value is that a call shape becoming inexpressible now falls below a floor, and that the fixtures exist and are named for the stage that can run them.

What no cell here claims

Whether the guard fires — rejecting the aliased call, sparing the unaliased one, running before ownership moves — is a claim about running code.

I deliberately did not assert it against emitted text. A grep for a guard establishes that the text contains a guard, which is not the property anyone cares about, and this crate has been careful to report only what something mechanical established. Those three discriminations wait for the runtime stage, and the branch map now records them as its debt rather than as a checkbox this step ticked.

Exit: answers move, additively

16 new cells (8 header, 8 rustc). No existing cell changed — verified by diffing the old report against the new one per cell, not by reading the diff.

Two integrity tests

In the spirit of the ones already here:

• every call parameter is a type the model accepts — otherwise a header cell would be measuring a fixture that never contained the shape it names;
• every cell id is unique. An id is a file name, a receipt key and a guarantee key at once, so a collision would silently merge two cells: one reporting the other's compiler diagnostics and inheriting the other's floor.

Checks

cargo test -p shape-matrix (16 tests), clippy -D warnings across all targets and features, cargo fmt --check with CI's config, RUSTDOCFLAGS=-D warnings cargo doc, and examples/regen-check.sh clean.