@geastack/compiler 1.0.15

package/dist/semantics/normalize/contribution.d.ts

@@ -0,0 +1,63 @@
+import type { OperationFamily } from '../../identity/ids.js';
+import type { CensusBlocker, FamilyReport } from '../model/coverage.js';
+import type { SemanticEdge } from '../model/edges.js';
+import type { SemanticOperation } from '../model/operations.js';
+import type { CensusCandidate } from './census.js';
+/**
+ * Publication transactions.
+ *
+ * Publication is transactional at the smallest complete authority-connected
+ * component -- never at family scope. Family-global all-or-nothing publication
+ * is forbidden precisely because it lets one blocked construct suppress an
+ * unrelated one that was fully proven, which then reads as "the family is not
+ * installed" and hides how much actually works.
+ *
+ * The scope that matters is the program, not the family. Producers cite each
+ * other across families -- an invocation's callee is a reference, a loop's
+ * element is a protocol result -- so a citation's producer often lives in a
+ * different family than the citing operation. Deciding what commits one family
+ * at a time cannot see those edges, and publishes operations whose operands name
+ * results nobody published.
+ */
+/** What one candidate produced: operations and edges, or the reason it could not. */
+export type CandidateContribution = {
+    readonly kind: 'operations';
+    readonly operations: readonly SemanticOperation[];
+    readonly edges: readonly SemanticEdge[];
+} | {
+    readonly kind: 'blocked';
+    readonly blocker: CensusBlocker;
+};
+/** A family producer: it sees the census and returns one contribution per candidate. */
+export interface FamilyProducer {
+    readonly family: OperationFamily;
+    readonly contribute: (candidate: CensusCandidate) => CandidateContribution;
+}
+export interface ProgramPublication {
+    readonly reports: ReadonlyMap<OperationFamily, FamilyReport>;
+    readonly operations: readonly SemanticOperation[];
+    readonly edges: readonly SemanticEdge[];
+}
+/**
+ * Run every installed producer over its census and commit what survives.
+ *
+ * A family with no producer is not skipped: every candidate it censused becomes
+ * a stated blocker, so "no producer" and "no such construct in this program"
+ * stay different answers.
+ */
+/**
+ * Producers for one monomorphized copy.
+ *
+ * A copy needs its own producer set because a producer closes over the
+ * structural mapper it will ask, and `T` resolves differently in each copy. The
+ * alternative -- threading the copy through every `typeAt` call in every
+ * producer -- would put the same forwarded argument in a hundred signatures to
+ * express one fact that belongs to the candidate.
+ *
+ * What must NOT be per copy is the ordinal counters the context carries: two
+ * copies minting from independent counters would hand two different operations
+ * the same identity. The caller keeps one context and swaps only its mapper,
+ * which is why this is a lookup rather than a factory.
+ */
+export type ProducersFor = (candidate: CensusCandidate) => ReadonlyMap<OperationFamily, FamilyProducer>;
+export declare const publishProgram: (families: readonly OperationFamily[], producersFor: ProducersFor, census: ReadonlyMap<OperationFamily, readonly CensusCandidate[]>) => ProgramPublication;

package/dist/semantics/normalize/contribution.js

@@ -0,0 +1,172 @@
+const resultsOf = (prepared) => {
+    const published = new Set();
+    for (const entry of prepared) {
+        if (!entry.live)
+            continue;
+        for (const operation of entry.operations) {
+            for (const result of operation.results)
+                published.add(result.id);
+        }
+    }
+    return published;
+};
+/** The first operand of `entry` naming a result nobody published, if any. */
+const danglingCitation = (entry, published) => {
+    for (const operation of entry.operations) {
+        for (const operand of operation.operands) {
+            if (operand.source.kind !== 'result')
+                continue;
+            if (!published.has(operand.source.result))
+                return operand.source.result;
+        }
+    }
+    return null;
+};
+/**
+ * Withhold every candidate whose operands cite a result no producer published.
+ *
+ * Producers cite each other by recomputing the identity a sibling family will
+ * mint, which is correct -- identity is deterministic -- but it is a prediction,
+ * and the sibling may have been blocked or never installed. Committing the
+ * citing operation anyway publishes an operand pointing at nothing.
+ *
+ * Withholding one candidate removes its results, which can strand a second, so
+ * this runs to a fixed point rather than in a single pass.
+ *
+ * Withholding an INVOCATION is different in kind, and is reported as a root
+ * rather than as a derived consequence. A withheld value is a value the citing
+ * operation then does without; a withheld call is a call the source performs and
+ * the program does not, while still emitting -- the operands stay materialised
+ * and the emitter renders them as `(void)` discards. Three's
+ * `materials.refreshFogUniforms( m_uniforms, fog )` was dropped exactly this way
+ * for want of a `dictionary -> native-record-ref` argument conversion, so
+ * The three.js app rendered with no fog at all and nothing in the report said so:
+ * `diagnostics/sweep.ts` grades every `withheld:` reason `derived`, and the
+ * coverage report filters those out by default. Naming the dropped call keeps
+ * the guard fail-closed -- a missing conversion stays a compile-time answer
+ * instead of becoming a silently wrong picture.
+ */
+const withholdDanglingCitations = (prepared, blockers) => {
+    let changed = true;
+    while (changed) {
+        changed = false;
+        const published = resultsOf(prepared);
+        for (const entry of prepared) {
+            if (!entry.live)
+                continue;
+            const dangling = danglingCitation(entry, published);
+            if (dangling === null)
+                continue;
+            entry.live = false;
+            const dropsInvocation = entry.operations.some((operation) => operation.family === 'invocation');
+            blockers.set(entry.candidate, {
+                source: entry.candidate.id,
+                family: entry.family,
+                reason: dropsInvocation
+                    ? `dropped invocation: cites result ${dangling}, which no installed producer publishes`
+                    : `withheld: cites result ${dangling}, which no installed producer publishes`,
+                missingPrimitive: null
+            });
+            changed = true;
+        }
+    }
+};
+const coverageOf = (published, blocked) => blocked === 0 ? 'complete' : published > 0 ? 'partial' : 'not-installed';
+/**
+ * One candidate's contribution, with a producer's own failure turned into a
+ * stated blocker.
+ *
+ * A producer that throws has met a construct it cannot model. That is exactly
+ * what a blocker records, and letting the throw escape instead takes down the
+ * whole compilation over one node -- so a program containing a single
+ * unmodelled expression reports nothing at all, when it could have reported
+ * every other gap it has. Nothing is hidden by this: a blocker refuses the
+ * certificate just as loudly, and it names the candidate.
+ */
+const contributionOf = (producer, candidate) => {
+    try {
+        return producer.contribute(candidate);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const detail = process.env['GEA_PRODUCER_STACK_DEBUG'] && error instanceof Error && error.stack ? error.stack : message;
+        return {
+            kind: 'blocked',
+            blocker: {
+                source: candidate.id,
+                family: producer.family,
+                reason: `producer failed: ${detail}`,
+                missingPrimitive: null
+            }
+        };
+    }
+};
+export const publishProgram = (families, producersFor, census) => {
+    const prepared = [];
+    const blockers = new Map();
+    const candidateCount = new Map();
+    for (const family of families) {
+        const candidates = census.get(family) ?? [];
+        candidateCount.set(family, candidates.length);
+        for (const candidate of candidates) {
+            const producer = producersFor(candidate).get(family);
+            if (!producer) {
+                blockers.set(candidate, {
+                    source: candidate.id,
+                    family,
+                    reason: `family ${family} has no installed producer`,
+                    missingPrimitive: null
+                });
+                prepared.push({ family, candidate, operations: [], edges: [], live: false });
+                continue;
+            }
+            const contribution = contributionOf(producer, candidate);
+            if (contribution.kind === 'blocked') {
+                blockers.set(candidate, contribution.blocker);
+                prepared.push({ family, candidate, operations: [], edges: [], live: false });
+                continue;
+            }
+            prepared.push({ family, candidate, operations: contribution.operations, edges: contribution.edges, live: true });
+        }
+    }
+    withholdDanglingCitations(prepared, blockers);
+    const operations = [];
+    const edges = [];
+    const publishedByFamily = new Map();
+    const operationsByFamily = new Map();
+    for (const entry of prepared) {
+        if (!entry.live)
+            continue;
+        publishedByFamily.set(entry.family, (publishedByFamily.get(entry.family) ?? 0) + 1);
+        operations.push(...entry.operations);
+        edges.push(...entry.edges);
+        for (const operation of entry.operations) {
+            // Attribution follows the operation's own family, not the candidate's: a
+            // loop candidate mints the protocol operations its iteration needs, and
+            // those belong to the protocol family's coverage.
+            const bucket = operationsByFamily.get(operation.family) ?? [];
+            bucket.push(operation);
+            operationsByFamily.set(operation.family, bucket);
+        }
+    }
+    const blockersByFamily = new Map();
+    for (const blocker of blockers.values()) {
+        const bucket = blockersByFamily.get(blocker.family) ?? [];
+        bucket.push(blocker);
+        blockersByFamily.set(blocker.family, bucket);
+    }
+    const reports = new Map();
+    for (const family of families) {
+        const familyBlockers = blockersByFamily.get(family) ?? [];
+        const published = publishedByFamily.get(family) ?? 0;
+        reports.set(family, {
+            family,
+            coverage: coverageOf(published, familyBlockers.length),
+            operations: (operationsByFamily.get(family) ?? []).map((operation) => operation.id),
+            blockers: familyBlockers,
+            publishedCandidates: published,
+            censusedCandidates: candidateCount.get(family) ?? 0
+        });
+    }
+    return { reports, operations, edges };
+};

package/dist/semantics/normalize/dead-typeof-guards.d.ts

@@ -0,0 +1,64 @@
+import ts from 'typescript';
+import type { OperationId } from '../../identity/ids.js';
+import type { AbsentGlobalCensus } from './absent-globals.js';
+import type { IdentityTable } from './identities.js';
+/**
+ * Provably-dead consequents of a host-absence `typeof` guard.
+ *
+ * `absent-globals.ts` answers "is this value/type absent" at a POSITION. This
+ * answers a different question: is a whole REGION of code unreachable,
+ * because the guard that would have to pass for it to run cannot pass on
+ * this host. The two are not the same fact and must not share a mechanism --
+ * see the doc comment on `isDeadOperation` below for why.
+ *
+ * Scope, deliberately narrow, matching exactly what a real corpus program
+ * does and nothing more:
+ *
+ *   if ( typeof X !== 'undefined' && x instanceof X ) { ... }
+ *
+ * Both conjuncts must independently resolve, BY SYMBOL through
+ * `AbsentGlobalCensus.typeAt` (never by spelling), to a host-declared-absent
+ * ambient value. `X` cannot exist on this host, so `typeof X !== 'undefined'`
+ * is provably `false`; `&&` short-circuits; the consequent never executes.
+ * That is a proof from the host's own statement, not an inference this
+ * compiler drew -- the one warrant this rule is allowed to rest on. Either
+ * conjunct may be individually wrapped in its own `( ... )` (three.js's
+ * `Source.js`) -- `unwrapParens` strips that before the shape checks, since
+ * it is a syntactic artifact of how the source was written, not a different
+ * logical shape. Only the `!==` polarity is handled. The `else`/`else if`
+ * chain is never touched: it
+ * is the code that actually runs on this host. A `typeof` guard that is not
+ * this exact `&&`-of-two-conjuncts shape -- nested inside a longer `&&`/`||`
+ * chain, written as a ternary, or checked with `===` and an early return --
+ * is out of scope and left alone rather than guessed at.
+ */
+export interface DeadTypeofGuardCensus {
+    /**
+     * Whether an operation's own source position falls inside a proven-dead
+     * guard consequent.
+     *
+     * Keyed on the OPERATION's identity, not on any operand's structural type.
+     * That is the fix for the defect the prior (reverted) rule had: a
+     * structural `never` is a single, shape-only fact that TypeScript's own
+     * (sometimes unsound) inference produces just as often as a host-absence
+     * proof does, and once interned every occurrence collapses to the SAME
+     * structural type id -- there is no way to tell, from a `StructuralTypeId`
+     * alone, which `never` a given position's is. Reachability, by contrast,
+     * is a property of WHERE in the source an operation sits, which this
+     * census proves directly from the guard's own AST shape and the host's own
+     * absence statement, never from what type anything infers to.
+     */
+    readonly isDeadOperation: (id: OperationId) => boolean;
+    /** How many qualifying guards were found, for measurement. */
+    readonly guardCount: number;
+}
+export declare const emptyDeadTypeofGuardCensus: DeadTypeofGuardCensus;
+/**
+ * The census for one program.
+ *
+ * `emptyDeadTypeofGuardCensus` is returned unchanged when the host census
+ * itself is empty (`absent.absentCount === 0`): nothing is absent, so no
+ * `typeof` guard on this program can ever be proven dead by this rule, and
+ * walking every file to confirm that would be pure cost.
+ */
+export declare const censusDeadTypeofGuards: (files: readonly ts.SourceFile[], absent: AbsentGlobalCensus, identities: IdentityTable) => DeadTypeofGuardCensus;

package/dist/semantics/normalize/dead-typeof-guards.js

@@ -0,0 +1,152 @@
+import ts from 'typescript';
+export const emptyDeadTypeofGuardCensus = {
+    isDeadOperation: () => false,
+    guardCount: 0
+};
+/** Whether `expr` is the string literal `'undefined'`. */
+const isUndefinedStringLiteral = (expr) => ts.isStringLiteralLike(expr) && expr.text === 'undefined';
+/**
+ * Strips a wrapping `( ... )`, repeatedly.
+ *
+ * `( typeof HTMLVideoElement !== 'undefined' ) && ( data instanceof
+ * HTMLVideoElement )` (three.js's `Source.js`) is the identical `&&`-of-two-
+ * conjuncts shape this module matches, with each conjunct individually
+ * parenthesized -- a purely syntactic wrapper TypeScript's parser leaves in
+ * the tree as a `ParenthesizedExpression` node around an otherwise identical
+ * `BinaryExpression`. Unwrapping it before the shape checks below admits no
+ * new logical shape -- the `&&`, the `typeof`, the `instanceof`, and the
+ * symbol-resolved host-absence proof are all still required exactly as
+ * before -- it only stops a wrapper the parser inserts from hiding a shape
+ * this module already handles.
+ */
+const unwrapParens = (expr) => {
+    let current = expr;
+    while (ts.isParenthesizedExpression(current))
+        current = current.expression;
+    return current;
+};
+/**
+ * `typeof <operand> !== 'undefined'`, where `<operand>` resolves BY SYMBOL
+ * (through `absent.typeAt`, the same resolution `absent-globals.ts` already
+ * uses everywhere else) to a host-declared-absent ambient value -- or `null`
+ * when `expr` is not that shape, or resolves to nothing this host denied.
+ *
+ * A program's own same-named local is untouched: `typeAt` only answers for a
+ * reference whose SYMBOL is the standard library's ambient declaration a host
+ * listed, exactly as every other consumer of `AbsentGlobalCensus` requires.
+ */
+const absentTypeofOperand = (expr, absent) => {
+    if (!ts.isBinaryExpression(expr))
+        return null;
+    if (expr.operatorToken.kind !== ts.SyntaxKind.ExclamationEqualsEqualsToken)
+        return null;
+    const left = expr.left;
+    const right = expr.right;
+    const [typeofExpr, literal] = ts.isTypeOfExpression(left) ? [left, right] : ts.isTypeOfExpression(right) ? [right, left] : [null, null];
+    if (!typeofExpr || !literal)
+        return null;
+    if (!isUndefinedStringLiteral(literal))
+        return null;
+    return absent.typeAt(typeofExpr.expression) !== null ? typeofExpr.expression : null;
+};
+/**
+ * `<expr> instanceof <name>`, where `<name>` ALSO resolves by symbol to a
+ * host-declared-absent value -- checked independently of, not merely
+ * spelling-matched against, the `typeof` guard's own operand. Two conjuncts
+ * that each independently name an absent global is at least as strong a
+ * proof as one that textually repeats a name, and it costs nothing extra:
+ * `absent.typeAt` is already the one authority for "is this reference
+ * absent," so asking it twice is asking the same question at two positions,
+ * never a second question.
+ */
+const isInstanceofAbsentName = (expr, absent) => ts.isBinaryExpression(expr) && expr.operatorToken.kind === ts.SyntaxKind.InstanceOfKeyword && absent.typeAt(expr.right) !== null;
+/**
+ * Whether this condition is PROVABLY FALSE from the host's own absence
+ * statement -- one `typeof X !== 'undefined' && v instanceof X` conjunction,
+ * or a `||` chain of them where EVERY disjunct is one.
+ *
+ * three's `resizeImage` (`WebGLTextures.js`) is the disjunctive form, and it
+ * is the shape that matters: four clauses, one each for `HTMLImageElement`,
+ * `HTMLCanvasElement`, `ImageBitmap` and `VideoFrame`, all four host-absent.
+ * A disjunction is false exactly when every disjunct is false, so the warrant
+ * is unchanged and the consequent is as dead as a single conjunction's -- the
+ * shape was simply not matched. Its `return canvas` then stops counting as
+ * evidence about what the function returns, and the remaining returns can
+ * agree.
+ *
+ * Requiring EVERY disjunct is what keeps this sound: one live clause makes the
+ * whole condition possibly true, and there is no partial credit to take.
+ *
+ * WHAT IT IS WORTH, MEASURED: 12 fewer obligations on the three.js app and nothing else.
+ * missingRows is unchanged (408), so none of the twelve were mandatory, and the
+ * boxed count does not move.
+ *
+ * ⛔ The obvious next step does NOT pay, and this is the place to say so. It
+ * looks as though `return-bindings.ts` should consult reachability -- a `return`
+ * inside a proven-dead branch is not evidence about what a function returns, and
+ * `resizeImage` (`WebGLTextures.js`) is exactly that shape: `return canvas`
+ * inside this guard, refusing the census against the other returns. It gains
+ * nothing. `resizeImage`'s other two returns are both `return image`, and
+ * `image` is its own unannotated parameter, so the census refuses on `any` with
+ * or without the dead arm excluded. The dead arm was never the binding
+ * constraint. Threading a node-level reachability predicate into the return
+ * census (which would also mean building `absent` before the census chain) buys
+ * nothing until the parameter underneath it is typed.
+ *
+ * ⛔ Read `dead-typeof-guards`'s own header before widening this further. The
+ * warrant is the HOST'S STATEMENT about a global it declares absent -- never a
+ * type. A previous rule keyed on a `never` operand marked LIVE code satisfied,
+ * because TypeScript produces `never` from its own unsound inferences (an
+ * empty array literal, most memorably) just as readily as an absence proof
+ * does, and once interned the two are the same structural id. Reachability is
+ * a property of WHERE an operation sits, proven here from the guard's AST
+ * shape and the host's own list.
+ */
+const isProvablyFalseGuard = (expr, absent) => {
+    const condition = unwrapParens(expr);
+    if (!ts.isBinaryExpression(condition))
+        return false;
+    if (condition.operatorToken.kind === ts.SyntaxKind.BarBarToken) {
+        return isProvablyFalseGuard(condition.left, absent) && isProvablyFalseGuard(condition.right, absent);
+    }
+    if (condition.operatorToken.kind !== ts.SyntaxKind.AmpersandAmpersandToken)
+        return false;
+    return absentTypeofOperand(unwrapParens(condition.left), absent) !== null && isInstanceofAbsentName(unwrapParens(condition.right), absent);
+};
+/**
+ * The census for one program.
+ *
+ * `emptyDeadTypeofGuardCensus` is returned unchanged when the host census
+ * itself is empty (`absent.absentCount === 0`): nothing is absent, so no
+ * `typeof` guard on this program can ever be proven dead by this rule, and
+ * walking every file to confirm that would be pure cost.
+ */
+export const censusDeadTypeofGuards = (files, absent, identities) => {
+    if (absent.absentCount === 0)
+        return emptyDeadTypeofGuardCensus;
+    const deadSitePrefixes = [];
+    let guardCount = 0;
+    const markDead = (node) => {
+        deadSitePrefixes.push(`op|${identities.nodeIdOf(node)}|`);
+        ts.forEachChild(node, markDead);
+    };
+    for (const file of files) {
+        const visit = (node) => {
+            if (ts.isIfStatement(node) && isProvablyFalseGuard(node.expression, absent)) {
+                markDead(node.thenStatement);
+                guardCount += 1;
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(file);
+    }
+    // `OperationId` is `op|<NodeId>|<family>|<ordinal>`, and a `NodeId` embeds
+    // its own unescaped `|`s (`identity/ids.ts`'s `operationId`/`nodeId`), so
+    // the operation id cannot be split apart and reassembled -- exactly the
+    // hazard `identity/ids.ts`'s own `operationOfResult` comment names. A
+    // prefix test sidesteps it entirely: `deadSitePrefixes` holds full,
+    // independently-computed `op|<deadNodeId>|` strings, and `startsWith`
+    // matches an operation to one of them without parsing anything.
+    const isDeadOperation = (id) => deadSitePrefixes.some((prefix) => id.startsWith(prefix));
+    return { isDeadOperation, guardCount };
+};

package/dist/semantics/normalize/deferred-intrinsic-protocols.d.ts

@@ -0,0 +1,57 @@
+import ts from 'typescript';
+import type { ValueFlowIndex } from './flow/model.js';
+import type { ProducerContext } from './producer-context.js';
+import { type PrototypeKeyQuery } from './host-mutation-keys.js';
+/** @semanticCategory generic-primitive */
+export interface IntrinsicProtocolRequirement {
+    readonly intrinsic: 'Array' | 'Object' | 'Map' | 'WeakMap' | 'Reflect' | 'Function';
+    readonly member?: string;
+    /**
+     * Without `member`: the prototype keys the obligation depends on. Absent,
+     * the obligation is the whole prototype -- which any single key write the
+     * census cannot attribute fails. See `intactIntrinsicPrototypeKeysType`.
+     */
+    readonly prototypeKeys?: PrototypeKeyQuery;
+    readonly location: ts.Node;
+}
+/** @semanticCategory generic-primitive */
+export interface DeferredIntrinsicProtocolLedger {
+    readonly capture: <T>(work: () => T) => {
+        readonly value: T;
+        readonly requirements: readonly IntrinsicProtocolRequirement[];
+    };
+    readonly guard: <T>(work: () => T, accepts: (value: T) => boolean) => T;
+    readonly require: (intrinsic: IntrinsicProtocolRequirement['intrinsic'], location: ts.Node) => boolean;
+    readonly requireMember: (intrinsic: 'Object' | 'Reflect', member: string, location: ts.Node) => boolean;
+    /** The per-key prototype obligation: only `keys` of the intrinsic's prototype must be as declared. */
+    readonly requirePrototypeKeys: (intrinsic: IntrinsicProtocolRequirement['intrinsic'], keys: PrototypeKeyQuery, location: ts.Node) => boolean;
+    readonly include: (requirements: readonly IntrinsicProtocolRequirement[]) => boolean;
+    /** A later inference round replaces its scope, including with no surviving requirements. */
+    readonly replace: (scope: object | string, requirements: readonly IntrinsicProtocolRequirement[]) => void;
+    readonly requirements: () => readonly IntrinsicProtocolRequirement[];
+    /**
+     * Whether a proof resting on an `Object.prototype` key obligation must
+     * refuse instead of recording one -- the installed hosts' statement
+     * (`PluginCapabilities.refusesObjectPrototypeAbsenceProofs`), read by the
+     * class-family and numeric absence proofs before they ask.
+     */
+    readonly refusesObjectPrototypeAbsenceProofs: boolean;
+}
+/** Closure can depend on an intrinsic whose mutation census runs after type
+ * inference. Capture obligations while exploring evidence; only surviving
+ * published inference replaces a ledger scope. Failed alternatives and
+ * withdrawn bindings never become compiler-wide assumptions.
+ */
+export declare const createDeferredIntrinsicProtocolLedger: (options?: {
+    readonly refuseObjectPrototypeAbsenceProofs?: boolean;
+}) => DeferredIntrinsicProtocolLedger;
+/** What distinguishes two obligations on one intrinsic at one location: a static member, a key set, or the whole prototype. */
+export declare const intrinsicProtocolRequirementKind: (requirement: IntrinsicProtocolRequirement) => string | undefined;
+export declare const attachDeferredIntrinsicProtocolLedger: (flow: ValueFlowIndex, ledger: DeferredIntrinsicProtocolLedger) => void;
+export declare const deferredIntrinsicProtocolLedgerOf: (flow: ValueFlowIndex) => DeferredIntrinsicProtocolLedger | null;
+type IntrinsicContext = Pick<ProducerContext, 'checker' | 'identities' | 'globalHostMutationTaint' | 'isStandardLibraryDeclaration'>;
+/** Discharge solely against the final shared mutation census. No preliminary
+ * spelling scan or root inventory substitutes for the sealed host evidence.
+ */
+export declare const failedIntrinsicProtocolRequirements: (context: IntrinsicContext, requirements: readonly IntrinsicProtocolRequirement[]) => readonly IntrinsicProtocolRequirement[];
+export {};

package/dist/semantics/normalize/deferred-intrinsic-protocols.js

@@ -0,0 +1,109 @@
+import ts from 'typescript';
+import { intrinsicStaticMemberIsIntact } from './intrinsic-static-member.js';
+import { intactIntrinsicPrototypeKeysType, intactIntrinsicPrototypeType } from './intrinsic-prototype.js';
+import { prototypeKeyQuerySignature } from './host-mutation-keys.js';
+/** Closure can depend on an intrinsic whose mutation census runs after type
+ * inference. Capture obligations while exploring evidence; only surviving
+ * published inference replaces a ledger scope. Failed alternatives and
+ * withdrawn bindings never become compiler-wide assumptions.
+ */
+export const createDeferredIntrinsicProtocolLedger = (options = {}) => {
+    const captures = [];
+    const scopes = new Map();
+    const unique = (requirements) => {
+        // `capture` wraps nearly every proof in the compiler and most of them raise
+        // no obligation at all, so the common case is de-duplicating nothing --
+        // which still built a Map of Maps of Sets and a copied array per call.
+        if (requirements.length === 0)
+            return requirements;
+        const seen = new Map();
+        return requirements.filter((requirement) => {
+            let protocols = seen.get(requirement.location);
+            if (!protocols)
+                seen.set(requirement.location, (protocols = new Map()));
+            let members = protocols.get(requirement.intrinsic);
+            if (!members)
+                protocols.set(requirement.intrinsic, (members = new Set()));
+            const kind = intrinsicProtocolRequirementKind(requirement);
+            if (members.has(kind))
+                return false;
+            members.add(kind);
+            return true;
+        });
+    };
+    const capture = (work) => {
+        const requirements = [];
+        captures.push(requirements);
+        try {
+            return { value: work(), requirements: unique(requirements) };
+        }
+        finally {
+            captures.pop();
+        }
+    };
+    const include = (requirements) => {
+        const active = captures.at(-1);
+        if (!active)
+            return false;
+        active.push(...requirements);
+        return true;
+    };
+    return {
+        capture,
+        guard: (work, accepts) => {
+            if (captures.length === 0)
+                return work();
+            const result = capture(work);
+            if (accepts(result.value))
+                include(result.requirements);
+            return result.value;
+        },
+        require: (intrinsic, location) => include([{ intrinsic, location }]),
+        requireMember: (intrinsic, member, location) => include([{ intrinsic, member, location }]),
+        requirePrototypeKeys: (intrinsic, prototypeKeys, location) => include([{ intrinsic, prototypeKeys, location }]),
+        include,
+        replace: (scope, requirements) => {
+            const kept = unique(requirements);
+            // `GEA_LEDGER_DEBUG=1` names the scope that publishes each Object
+            // prototype obligation: a failed one at certification says only where
+            // the proof read, never which inference published it.
+            if (process.env['GEA_LEDGER_DEBUG'] !== undefined)
+                for (const requirement of kept) {
+                    if (requirement.member !== undefined)
+                        continue;
+                    const file = requirement.location.getSourceFile();
+                    const line = file.getLineAndCharacterOfPosition(requirement.location.getStart(file)).line + 1;
+                    console.error(`[LEDGER] ${String(scope)} ${intrinsicProtocolRequirementKind(requirement) ?? 'whole'} ${file.fileName.split('/').pop()}:${line}`);
+                }
+            scopes.set(scope, kept);
+        },
+        requirements: () => unique([...scopes.values()].flat()),
+        refusesObjectPrototypeAbsenceProofs: options.refuseObjectPrototypeAbsenceProofs === true
+    };
+};
+/** What distinguishes two obligations on one intrinsic at one location: a static member, a key set, or the whole prototype. */
+export const intrinsicProtocolRequirementKind = (requirement) => requirement.member !== undefined
+    ? requirement.member
+    : requirement.prototypeKeys
+        ? `keys:${prototypeKeyQuerySignature(requirement.prototypeKeys)}`
+        : undefined;
+const ledgers = new WeakMap();
+export const attachDeferredIntrinsicProtocolLedger = (flow, ledger) => {
+    ledgers.set(flow, ledger);
+};
+export const deferredIntrinsicProtocolLedgerOf = (flow) => ledgers.get(flow) ?? null;
+/** Discharge solely against the final shared mutation census. No preliminary
+ * spelling scan or root inventory substitutes for the sealed host evidence.
+ */
+export const failedIntrinsicProtocolRequirements = (context, requirements) => requirements.filter((requirement) => {
+    if (requirement.member === undefined) {
+        return requirement.prototypeKeys
+            ? intactIntrinsicPrototypeKeysType(context, requirement.intrinsic, requirement.prototypeKeys, requirement.location) === null
+            : intactIntrinsicPrototypeType(context, requirement.intrinsic, requirement.location) === null;
+    }
+    const owner = context.checker.resolveName(requirement.intrinsic, requirement.location, ts.SymbolFlags.Value, false);
+    const member = owner
+        ? context.checker.getPropertyOfType(context.checker.getTypeOfSymbolAtLocation(owner, requirement.location), requirement.member)
+        : undefined;
+    return !intrinsicStaticMemberIsIntact(context, owner, member, requirement.location);
+});