[Baoyuan-Xing]

Why

The risk classes describe two different kinds of danger, and the global --coerce switch currently treats them the same.

Truncation / precision loss / runtime check / lossless are value-level effects a caller can accept globally — "I'm fine with narrower numbers" is a coherent blanket policy.

Semantic coercions change what the bytes mean: Timestamp → int64 and Date32 → int32 impose an epoch/unit interpretation the source type doesn't carry (millis? micros? days?); signed ↔ unsigned reinterprets bit patterns; utf8 ↔ bytes crosses a meaning boundary. Whether each is right is a per-field design decision — a global flag can't express it, and enabling them silently invites encodes that succeed while meaning something else entirely. (Motivating case: a pipeline running --coerce for legitimate int-narrowing would silently encode a TIMESTAMP column into an int64 proto field with a unit nobody chose.)

What

--coerce / coerce_all now enables every risk class except Semantic. Semantic coercions require explicit per-field consent — [(apb.apb).coerce = true] on the field, or an explicit binding — where the decision is visible in the proto and reviewed with it.

• resolve_type_check takes CoercionConsent { None | Global | Explicit } instead of a bool
• inference: annotation → Explicit, coerce_all → Global; explicit bindings with coerce: true → Explicit
• new TypeErrorReason::SemanticCoercionNotExplicit with an actionable message: "semantic coercion requires an explicit per-field (apb.apb).coerce annotation; not enabled by global coercion"
• validation reports distinguish the same case; README updated

Compatibility

• Explicit bindings and annotations: unchanged (still enable everything, including Semantic)
• The only behavior change: coerce_all × Semantic-risk pairs now reject at plan time with the actionable error, where they previously coerced silently — which is the point
• resolve_type_check's signature changes (bool → enum); internal callers updated

Tests

194/194 (4 new): consent matrix at the type-check level (Global enables non-semantic, rejects all four semantic families; Explicit enables all), plus an inference-level test that coerce_all fails a utf8→bytes name-match with an error directing to the annotation. Clippy clean.