1. Given a M.( * ) without warning the * may be the one of M or the one in scope. Ambiguous, can't be resolved locally.

2. Given a M.( id ) without warning, if [id] is in scope I *know* this [id] is being used. If it's not I know M.id is being used. No ambiguity, can be resolved locally.

If you allow each identifier in a module to sport an @shadow annotation you lose 2. which I find a  very valuable property. Without it, given that identifiers are much more widespread than operators, we get a much more ambiguous language.

It is a very valid point. However, I would argue that 1. and 2. are transformed to

1. Given a M.( [edsl_keyword] ) is the one of M. If I know the EDSL keywords, there is no ambiguity.

2. Given a M.( non_keyword ) without warning, if [non_keyword] is in scope then [non_keyword] is
being used. Otherwise, [M.non_keyword] is being used. No global ambiguity.

This approach, contrarily to yours, has a major disadvantage: its relies on a tacit agreement on the
EDSL keywords. At the same time, it allows EDSL authors to tailor the warnings to the EDSL
context. If the keyword list is small/sensible enough, it might result in better warnings.

But yes, implicit agreements are clearly more brittle than broad rules. A (over?)complicated
solution might be to add module alias annotation in order to modify shadow annotations locally
(e.g. " module N = M [@@only_shadow "+"] ").

Regards,
octachron.