[vinniefalco]

Every error the Engine produces now carries the prompt file and line that caused it, wherever one exists. The location shows up in three places: the error's at field, the failed run's message, and the error text that Lua sees. Internal bugs keep pointing at their Rust file and line, and the public API does not change (public-api.txt is untouched). Most of the work routes lines the Engine already had but dropped, plus one new way to read the author's line from the Lua stack.

On top of that, the branch cleans up runvil-lua: stale docs, copied helpers, misplaced items, and a few types that allowed states their docs forbid. Two of those changes alter behavior, listed below; the rest are docs, moves, renames, and narrowed visibility.

The branch holds 36 commits. The first two, which remove SetRule, SetEvidence, SetTool, and DepthVia, came before this work. The next six locate errors, and the last 28 are the cleanup.

Locating errors

• One writer and one formatter (b682c1b8e): place and coordinates in runvil_types::error. place keeps a location an error already has, fills in an empty file, and never gives an Internal error a prompt location. coordinates is the one formatter of file:line.
• Failures that reach Lua (126a8eaa7): every shim yield records the author's call line, and a Rust callback reads the author's line from the running coroutine. A failure crossing into Lua is placed on that line, a failure caught by pcall points at the failing call rather than the pcall, and the error table's message reads {file}:{line}: {prose}. The location never goes into the prose, so it cannot double.
• The Engine's own failures (c5c876da4): tasks_live at the first leaked task's spawn line, a jump to a missing heading at the jump line, the H1 gate at its cause's line, store and malformed-yield failures at the call line, var and argv read-back failures at their block, and a failed substitution at its placeholder's line, library prose included. A located run failure's message now ends with (at {file}:{line}).
• Parse and run-start failures (f2c5fc50e): the parse errors that already knew their line now point at it, frontmatter key lines come from a plain line scan, and a bad uses: entry, an unsupported runvil: version, and the start check's requirement notice point at their key.
• Invariants (fc9438875): the types, Lua, and Engine crates state the location rules in their ## Invariants blocks.
• One depth wording (65c49c3cd): the depth-cap error is now located, so its message no longer names the construct. It reads recursion exceeded cap of {cap}, and SpawnVia, the fanout mark, and the cap_name argument are gone.

Cleaning up runvil-lua

• Docs that no longer matched the code (12 commits, such as 9a4a15238, 3499d9fde, 67d1f0811, d9a0130c3, 6afba7431, 5a1f1f9d2, 37019f690): dozens of docs and comments that described code since changed, restated a rule that lives elsewhere, or named a model handle loop or infer method that handles no longer have. The crate doc now lists all four items the facade re-exports, Request::Call::input runs under the caller's args, and VfsOp::Delete removes an empty directory too. The type-name docs say which refusal uses which rule; no message changes.
• One copy of each shared helper (bf5099943, cad74b11c, 83a4fb299): failure and with_fact are free functions in runvil_types::error, so the Lua, Engine, and prompt crates stop copying them; internal and store_failure are shared from runvil-lua. The universal error fields read from one table in both directions, and tool and Pack objects share one registry lookup and one frozen guard.
• Placement (d4cf401b2, 4951eda8d, 05ebcad20, fb949072f, 83bbb8e55): the chunk-line helpers move to a new chunk_line module, DiscoveryTool to bindings, AdhocTools to a crate-root adhoc module, and two constants and scalar_return out of vm. Six two-module cycles are gone. The alias module is deleted, since its one user discarded its error.
• Types (269b9e797, 7ca443a6e, fb949072f): ModelReport gives way to ModelCall, which held the same two fields; a task's section and blocked live inside TaskPhase::Running, so an ended task cannot hold a live position; and AdhocTools::binding splits into by_id and by_wire_name, so callers stop re-checking for a /.
• Names (539342bb0, 121a7b342, 99473df51): the shim chunk is no longer called a prelude, two private fields that collided with nearby names are renamed, the offers handle runtime becomes offers, and the production VM install helpers take the plain names.
• Visibility: exhaustion_detail, Offer, OfferTarget, UseOptions, MAX_RECORD_META_BYTES, and object_id narrow to what their users need; NonEmpty::new becomes test-only, and store_error_value_fields moves behind test-support.
• AGENTS.md (9b5baa6ab, 6afba7431): the error rule says a crate-private Err marker turned into Error by its caller is not another error type, and the Static Set definition no longer names a model handle loop.

Behavior changes worth a look

• A located Internal or Substitution failure keeps its own code instead of becoming LuaRuntime, so a failed substitution in the H1 ends the run as Substitution (run kind Lua), not RequirementsUnmet. Every other typed failure maps as before.
• Caught tool, store, model, and context failures now show {file}:{line}: in their Lua text. A model still reads a tool's failure as its prose alone.
• Each prompt block compiles behind local __runvil_site <close> = nil; on its first line, so a main-chunk return f() keeps the author's frame. Line numbers do not move, and source() returns the block as written.
• A frontmatter failure's run message no longer shows a refused Pack's id as the prompt's name.
• Frontmatter key lines live on Prompt, not Frontmatter, so Frontmatter equality still compares content only.
• Workshop leaves the line {line}: prefix off an Internal parse failure, whose line is in Rust.
• A record of any message role but assistant that holds tool_calls is now refused by the append or replace call that adds it, with the same messages[{index}] sets tool_calls but is not an assistant message text, instead of failing at the next models.loop (4b577ce97).
• A poisoned model selection, jump slot, or offers lock inside a Lua callback now raises kind internal instead of lua, so an author's pcall cannot treat an Engine fault as an authoring error (56b97661c).

Known limits

• A tail call inside a function the author defined still drops that function's frame, so its failure points at the line that called the function.
• A requirement notice runs over several lines, and its (at ...) suffix comes after the last one, even though it names the first gap's key.
• A parse failure the Harness finds before a run starts still shows no location in the run's message.
• No test covers the H1 gate's fallback to its block's start line, a failed install_lazy_prose, or the new Internal exit in prepare_spawn.
• runvil-lua still has two module cycles: packs with tools, and test_support with vm.

Verification

Each of the first eight commits passed cargo fmt --check, both clippy runs with warnings denied, the workspace and facade docs gates, cargo test -p build-xtask, the docs-claims scan, both nextest runs, and cargo xtask api --check.

Each of the 28 cleanup commits compiles on its own (cargo check of the types, Lua, Engine, and prompt crates with all targets and features). The final tree passed cargo fmt --check, workspace clippy with warnings denied, workspace nextest (4176 passed), the workshop clippy and nextest runs (326 passed), the workspace, facade, and private-items Engine docs gates, cargo xtask api --check with public-api.txt unchanged, cargo test -p build-xtask, the docs-claims scan, and cargo deny. New tests pin the add-time tool_calls refusal, the internal kind of each poisoned lock, the store chunk's name, and every code of the universal error field table; the first two failed before their fixes.

The language guide updates are separate commits in runvil-docs: 5895fba for error locations and f891fca for the cleanup.