fix(generator): stop shipping async [Remote] bodies to trimmed clients (TRIM-009)

[keithdv]

Closes the last shape in AC6 of the TRIM arc. With TRIM-008 (#75) this unblocks v1.7.0, and with it zTreatment PCB-003.

The defect

async class-factory operations shipped their [Remote] bodies — [Service] interface names, called members, and string literals — to publish-trimmed Blazor WASM clients, where they are decompilable. Synchronous operations in the same assembly did not.

This was the shape docs/trimming.md, the distributable skill, and CLAUDE-DESIGN.md all held up as the one that works. It affects any aggregate root with async operations — read or write — which is most of them.

Cause, separated by measurement before any design work

The plan stub carried two surviving hypotheses. Rather than pick one, three generator variants were emitted and published trimmed:

Variant	Emitted shape	Result
V1	async, minus all four awaiting lifecycle probes and the OperationCanceledException arm	still leaked
V2	sync, plus an OCE arm and an IFactoryOnCancelled type-test	still clean
V3	guard moved to a sync wrapper, async body in a private core	still leaked

V1 and V2 settle it in both directions: those constructs are neither necessary nor sufficient. The async state machine is the mechanism. Inside an async method the compiler lowers the whole body — guard included — into MoveNext, within the builder's own protected region; ILLink folds the feature switch there but does not eliminate the unreachable remainder.

This also falsifies the arc's long-running TRIM-004 story ("early-throw guard plus try/catch defeats unreachable-code elimination") for the third time, and for the first time by direct additive test.

The apparatus was proven inert first — both knobs at default reproduce HEAD's generated tree byte-for-byte — and reverted after, re-diffed back to HEAD.

The fix — both halves are required

1. Non-async guard wrapper. Guarded async Local* methods are emitted as a sync wrapper carrying the IsServerRuntime guard, forwarding to a private async …Core. Applied at all five emission sites (read, class-level [Execute], write, LocalSave, Can*) through one shared helper.
2. Holder indirection. The class-factory assembly attribute names a generated single-method holder NeatooClassFactoryRegistrar_{ClassName} instead of {X}Factory.

Neither suffices alone — V3 proves it. DynamicallyAccessedMembers(PublicMethods | NonPublicMethods) covers NonPublic, so the wrapper alone leaves DAM rooting the private core. The wrapper-only variant deleted a state machine and shrank the assembly while leaving the IP on the client.

The delegate registrations and the ctor method-group assignment are untouched: both reference the wrapper, whose post-guard call folds away.

Behaviour change (for release notes)

The server-only guard now throws synchronously from the wrapper rather than surfacing as a faulted Task. Whether that reaches the call site synchronously depends on the entry point — non-async ones propagate it, async ones (Save on an authorized factory) capture it back into a faulted Task. Authorization failures, target casts, and DI resolution failures are unaffected in every case.

Verification

• 614+614 unit (3 new), 561+561 integration (5 pre-existing skips), 86+86 Design
• Trimming gate exit 0 — 10 named positive controls, plus six new per-site wrapper discriminators
• Harness exit 0 — every factory resolves, including Class [Execute] factory resolved: True. This is the liveness check that catches a holder silently failing to forward through method?.Invoke
• Untrimmed self-check — every body marker PRESENT before trimming, so the absences are trimming results rather than build artifacts
• Red before green — breaking the holder prefix and disabling the split turned exactly three tests red while the sync-path control stayed green
• Zero incremental-cache delta: Generator/Model/ and Generator/Builder/ diffs are empty

Evidence archived under reviews/009-evidence/.

Gates

Plan review (8 veto-tier), test review, and code review all ran; records in reviews/. No reviewer proposed a change to the generator — the fix was correct on its first pass. Every finding was a claim outrunning its evidence:

• Plan review caught two claims in a plan written to avoid exactly that — including a V3 check that could never have gone red, and a causal attribution the data could not support.
• Test review found a real gate blind spot: body markers cannot distinguish "this site was wrapped" from "an ancestor's fold removed the reference". Unwrapping LocalSave would have passed CI while shipping a guarded async body. Closed by asserting the state machines themselves.
• Code review found two false doc sentences this plan wrote while fixing the previous plan's.

Scope deliberately not taken

• Interface-factory leg (deferred item 20) — carries the identical shape and receives neither fix, and deferred item 19 makes it structurally unmeasurable from a client-side harness. The work is deferred; the claim is not: Interface factory | Yes became "not established" in the skill, docs/trimming.md, and CLAUDE-DESIGN.md, and AC6 carves it out in writing.
• Local{X}Core name-collision hazard (deferred item 21) — same family as items 14/15.
• Narrowing the attribute's DAM — rejected at TRIM-008 review and still rejected; it would silently break prebuilt libraries with internal static registrars.

🤖 Generated with Claude Code