src/rules/laws/law.bend fails

rule coverage (project-wide; its module is law.bend, since law is a Bend keyword and no bolt.bend could name it): in a project that states laws (a LAWS.bend among the files the linter read), every def and type of every file is reached from a quantified law in a LAWS.bend. A def is reached when such a law names it (its binders or its statement use it, through an import alias or in the law's own file), or when a reached def calls it: a use on the def's lines, in its file or behind a relative import, across the files of the run. A def no law reaches has no stated property, not even through its callers: it is the coverage gap. A closed law, a law's own name, and a law outside a LAWS.bend name nothing. A type is reached when such a law or a reached def names it or one of its constructors (M.Sq{..} reaches a type Shape with Sq{..}); a use of another def of its module does not reach it, and a type reaches nothing. Out of scope: helper defs (dotted names; a dotted type is graded, and a helper still carries the reach to what it calls), tests, and the law files themselves -- decided by the name and the file's path, never by what the file's text mentions. IO is no exemption: a law can quantify over an IO value or state an IO equality, so a def returning IO(..) is graded like any other, and so is every pure def beside it. main is a def: a law that names it covers it. The rule reads each file's digest (src/rules/digest.bend), never the parsed source: its phases use the list three times, and a + reuse copies it. The reach is one walk over one graph, the walk the unsafe rule takes over imports (src/rules/imports.bend): its nodes are the defs, types and constructors of the run by key (name, a space, path), and one more node, the empty key, that leads to what the laws name.