feat(3vl): FPPC-amended three-valued logic (read-site nulls + null propagation + cod override)

[Felipe705x]

Supersedes #63 and the closed #27. Implements the FPPC 3VL amendment approved by M. Toro, on current main (v0.2.7).

The design (Matías's three rules + FPPC Ra)

1. cod override (typechecker) — for the short-circuit connectives OR/AND only, degrade to bottom only when both operands are bottom. A single bottom/null operand beside a valid Bool still types as Bool. Non-short-circuit ops (+, comparisons) and NOT keep the strict default.
2. Cast — null AS T → null for any target; any other failed cast is an error (not null).
3. Operators follow classic 3VL, propagating nulls.

Plus FPPC rule Ra: a missing property/field reads as ok null, so the connectives see a null (lenient) while genuine errors stay Failure (which empties the path). This is the crux that #63 could not express: it kept missing reads as Failure and absorbed them at the connective, which also laundered real type errors into booleans.

Why this is the right altitude (vs #63)

WHERE x.status OR true must keep all rows, and WHERE ('a' AS INTEGER) OR true must not. These need null ≠ error at the connective:

query	this PR	#63 (Failure-absorbing)
WHERE x.status OR true (missing)	all rows ✅ (null OR true)	all rows (but via error-absorption)
WHERE ('a' AS INTEGER) OR true	empty ✅ (error propagates)	all rows ❌
null = null	null ✅	true (structural)

Read-site nulls make missing-value lenient; errors stay errors. Comparison 3VL comes along necessarily (once missing → null, = null would match unless null = null → null).

Changes

• src/runtime/engine.rs — AttrLookup/FieldAccess missing → Null; null AS T → null; eval_binop null-propagation for arithmetic/comparison, 3VL IN, SQL truth-table AND/OR; NOT null/-null → null. AND/OR route through the existing operand-cast wrapper, so a real error (non-bool / failed cast) propagates and empties the path — no dedicated short-circuit arms, no duplicated truth tables.
• src/typing/checker.rs — the cod override folded into the existing codomain check (ok1 || ok2 for AND/OR, ok1 && ok2 otherwise).
• tests/three_valued_logic_test.rs — 21 tests (below).

One open decision — tagged PENDING(Matías)

At runtime, does a genuine error (failed cast / non-bool value) beside a dominating boolean empty the path or get absorbed? This PR pins the FPPC-faithful reading (empty), consistent with the paper's monadic Rbop and Matías's "failed cast = error, not null". If he rules "absorb", three tagged tests flip and the fix is a localized wrapper change. Nothing else depends on it.

Tests (21) & verification

Truth tables, read-site nulls, comparison 3VL (= null drops / IS NULL matches), arithmetic propagation, 3VL IN, null AS T, null field access, and the PENDING(Matías) error-empties cases.

• cargo fmt --all
• cargo clippy --workspace --all-targets -- -D clippy::all
• Full cargo test sweep (incl. bench_test) — no regressions; null_test, count_test, dm_set_test, record_test all green (read-site nulls don't disturb aggregates/DM/= null)

🤖 Generated with Claude Code