Formatter.RenderTree

The render tree: an LPNode with the source positions taken off it.

This module is the barrier between the two stages. Formatter.Logical builds an LPNode, whose record caches seven source-position fields (firstPos, lastPos, minRow, maxRow, lastBracketEnd, bracketStart, and the two bracket flags) that the comment-placement pass reads constantly. Formatter.Render must not: after Comments.gren has run, layout is decided from author-intent flags captured at LPT build and from the rendered box shape (isSingleLine / allSingles), never re-derived from source rows. Re-deriving one is the oscillation/crash class this architecture was built to eliminate -- the renderer's own output has different rows from the author's, so a rule that reads rows at render time can disagree with itself on the second format.

lower drops the position cache, and every module under Formatter/Render/ takes RenderNode instead of LPNode. A row read in the render layer is then not a reviewed exception, it is a type error: there is no field to read and no accessor that accepts the type. That used to be enforced by tests/check-render-invariant.py, an allowlist keyed on a regex enumerating eight accessor names -- which is exactly the shape of gate this repo keeps finding holes in, and it had one: lpnBracketStart was not in the enumeration and was called in Render/NodeClassify.gren. Nothing unreviewed slipped through only because that call happened to sit inside an allowlisted function.

RenderShape mirrors LPShape with the Located payloads stripped, because carrying LPShape across unchanged left loc.start.row a legal spelling under Render/ even after the node lost its position cache. The mirror is total over LPShape, so a constructor added there is a compile error here until lowerShape maps it -- which is the point of mirroring the type rather than reusing it, and it immediately found a leak the checker's regex could not have matched: OriginalRows carried two literal source rows, and the renderer only ever wanted the SyntaxType.

check-render-invariant.py is deleted; nothing greps for this any more. docs/commentAlgorithm.md §2.2 states the barrier and docs/testing.md records how the enforcement moved.

The five facts that were rows

Five render-side decisions genuinely needed the author's rows. They are not comment placement or verticality -- each is a structural or author-intent question with a boolean answer -- so lower computes them once, here, and the renderer reads the answer:

• rnSharesRowWithPrevItem -- did the author write this node on the same row as the item before it? (FlowAssembly's function+arg0 glue.)
• rnHasSourceContent -- does this node cover any source row at all? (FlowAssembly's "the previous entry is real content" guard.)
• rnVariantsSpanRows -- did the author write this node's children across rows? (MakeRenderBox.makeUnionBodyBox: flat = A | B vs one variant per line.)
• rnTypeSegmentsBroken -- did the author break this node's children at a -> boundary? (makeSignatureBox / makeTypeAliasBody.)

That finishes the doctrine rather than inventing a mechanism: these were author-intent flags all along, computed lazily at render time instead of eagerly at build time like AcrossOrVertical's forceVertical.