@geastack/compiler 1.0.15

package/dist/targets/cpp/manifest.d.ts

@@ -0,0 +1,23 @@
+import type { SealedRepresentationPlan } from '../../representation/plan.js';
+import type { Representation } from '../../representation/model.js';
+import type { TargetRuntimeManifest } from '../../preflight/obligations.js';
+import type { CppRuntimeCapabilities } from './manifest/capabilities.js';
+import type { HostMemberTable } from './host/host-members.js';
+/**
+ * What the C++ backend can actually do, stated as a manifest preflight censuses
+ * against.
+ *
+ * The manifest is computed, not declared. A hand-written list of capabilities
+ * drifts from the emitter the moment either changes, and a manifest that claims
+ * more than the emitter implements turns a preflight pass into a crash during
+ * rendering -- which is precisely the failure preflight exists to prevent.
+ *
+ * So the physical-type rows are derived by asking the one authoritative type
+ * mapping whether it can spell each carrier the plan actually selected. Every
+ * other row reports what the emitter has been written to render, and the sets
+ * are small on purpose: reporting empty where nothing is built is the honest
+ * answer, and it makes each gap measurable instead of invisible.
+ */
+export type { CppRuntimeCapabilities } from './manifest/capabilities.js';
+export { currentCppRuntimeCapabilities } from './manifest/capabilities.js';
+export declare const createCppTargetManifest: (plan: SealedRepresentationPlan, capabilities?: CppRuntimeCapabilities, typeofOperandRepresentations?: Iterable<Representation>, hostMembers?: HostMemberTable, objectTagOperands?: Iterable<Representation>, hostInstanceTests?: ReadonlyMap<string, string>) => TargetRuntimeManifest;

package/dist/targets/cpp/manifest.js

@@ -0,0 +1,113 @@
+import { objectTagExpression, objectTagCapability } from './emit-object-tag.js';
+import { representationKey } from '../../representation/model.js';
+import { cppTypeOf } from './types.js';
+import { presenceIsAnswerable } from './emit-presence.js';
+import { typeofIsAnswerable } from './emit-typeof.js';
+import { currentCppRuntimeCapabilities } from './manifest/capabilities.js';
+import { coreHostMembers } from './host/host-members.js';
+import { cppNativeProtocolsOf } from './host/native-protocols.js';
+import { cppInstanceofLeftKinds } from './emit-instanceof.js';
+export { currentCppRuntimeCapabilities } from './manifest/capabilities.js';
+/** Whether the one authoritative type mapping can spell this carrier. */
+const isSpellable = (representation) => {
+    // `void` is spellable even though it has no storage: a result that occupies
+    // nothing still lowers, as an absent slot or a `void` return.
+    if (representation.kind === 'void')
+        return true;
+    try {
+        cppTypeOf(representation);
+        return true;
+    }
+    catch {
+        // The mapping throws for exactly the carriers it cannot spell. Treating the
+        // throw as the answer keeps one authority instead of a second predicate
+        // that could disagree with it.
+        return false;
+    }
+};
+export const createCppTargetManifest = (plan, capabilities = currentCppRuntimeCapabilities, typeofOperandRepresentations = [], 
+// The host member table this compilation's native-boundary claims are
+// derived from -- defaulted to the core, plugin-independent table so every
+// existing caller (tests included) keeps computing the same answer
+// `capabilities.nativeProtocols` already states, without having to learn
+// about this parameter. `compiler.ts`'s own call passes `coreHostMembers`
+// explicitly, from the one place in that file it is already imported,
+// which is what lets this manifest's claim stay tied to the same table the
+// emitter renders from rather than to a frozen capabilities snapshot taken
+// before any host tables for THIS compilation existed.
+hostMembers = coreHostMembers, objectTagOperands = [], 
+// The installed hosts' own `[[HasInstance]]` predicates, keyed by the native
+// type the right-hand operand of `instanceof` carries -- see
+// `PluginCapabilities.hostInstanceTests`. A row here is a claim for EVERY
+// left carrier kind, which is what that capability's contract states the
+// spelling must accept; `emit-instanceof.ts`'s `hostInstanceTestText`
+// unwraps an optional or a union first and calls the predicate on each leaf.
+hostInstanceTests = new Map()) => {
+    const spellable = new Set();
+    for (const representation of plan.selected.values()) {
+        if (isSpellable(representation))
+            spellable.add(representationKey(representation));
+    }
+    // `typeof` is answerable over a complete carrier, not its outer kind. An
+    // optional and a tagged union recurse into their payloads and arms, so two
+    // values with the same outer kind may have different answers. Keying the
+    // claim by kind made one unsupported union withdraw the capability for every
+    // other union in the program, including unions this emitter could render.
+    // The representation key is the same complete carrier the emitter receives;
+    // an unsupported shape remains absent without vetoing an unrelated one.
+    const typeofRepresentations = new Set();
+    // This is deliberately NOT every selected carrier: a target capability
+    // claim is evidence that this particular compilation has an emitted
+    // `typeof` over that carrier. Results, constants, and null all arrive here
+    // through the same operand resolver in `runtime-helper-key.ts`, so the
+    // manifest and obligation census have exactly one set to compare.
+    for (const representation of typeofOperandRepresentations) {
+        if (typeofIsAnswerable(representation))
+            typeofRepresentations.add(representationKey(representation));
+    }
+    const runtimeHelpers = new Set(capabilities.runtimeHelpers);
+    for (const key of typeofRepresentations)
+        runtimeHelpers.add(`computation:typeof:${key}`);
+    // Tag lookup support is keyed by the complete carrier, including constants
+    // that publish no result in the selected representation plan.
+    for (const representation of objectTagOperands) {
+        if (objectTagExpression(representation, 'value') !== null)
+            runtimeHelpers.add(objectTagCapability(representation));
+    }
+    // The nullish test is likewise derived from the actual carrier contents.
+    const presenceKinds = new Map();
+    for (const representation of plan.selected.values()) {
+        const answerable = presenceIsAnswerable(representation);
+        presenceKinds.set(representation.kind, (presenceKinds.get(representation.kind) ?? true) && answerable);
+    }
+    for (const [kind, answerable] of presenceKinds)
+        if (answerable)
+            runtimeHelpers.add(`conversion:is-present:${kind}`);
+    for (const native of hostInstanceTests.keys()) {
+        for (const left of cppInstanceofLeftKinds)
+            runtimeHelpers.add(`computation:instanceof:${left}:native-record-ref(${native})`);
+    }
+    return {
+        hasGenericCallPath: capabilities.hasGenericCallPath,
+        hasDynamicCallPath: capabilities.hasDynamicCallPath,
+        // No devirtualization fast path is registered: without one, preflight takes
+        // the mandatory generic path, which is a slower answer and not a wrong one.
+        functionAbis: new Set(),
+        implicitConstructorAbis: new Set(),
+        propertyRecipes: capabilities.propertyRecipes,
+        captureOwnershipSupport: capabilities.captureOwnershipSupport,
+        nativeProtocols: cppNativeProtocolsOf(hostMembers),
+        hostMembers: new Set(hostMembers.keys()),
+        dynamicArgumentHostParameters: capabilities.dynamicArgumentHostParameters,
+        runtimeHelpers,
+        unsupportedRuntimeHelpers: capabilities.unsupportedRuntimeHelpers,
+        physicalTypes: spellable,
+        spellable: isSpellable,
+        // A carrier this backend can spell is one it can verify and emit: all three
+        // come from the same mapping, so publishing different sets would claim a
+        // distinction that does not exist.
+        verifierRecipes: spellable,
+        emitterRecipes: spellable,
+        abruptEdgeHandlers: capabilities.abruptEdgeHandlers
+    };
+};

package/dist/targets/cpp/native-error-base.d.ts

@@ -0,0 +1,38 @@
+import type { Representation } from '../../representation/model.js';
+import type { RepresentationDeriver } from '../../representation/derive.js';
+/** One argument reaching the native `Error` base, already rendered as C++. */
+export interface NativeErrorBaseArgument {
+    readonly representation: Representation;
+    readonly text: string;
+}
+/** Why a native-`Error` base could not be initialized, in the two shapes the two call sites need. */
+export type NativeErrorBaseRefusal = {
+    readonly refusal: 'conversion';
+    readonly conversion: string;
+    readonly reason: string;
+} | {
+    readonly refusal: 'super-initialize';
+    readonly reason: string;
+};
+export declare const isNativeErrorBaseRefusal: (value: readonly string[] | NativeErrorBaseRefusal) => value is NativeErrorBaseRefusal;
+/**
+ * `super(message, options)` against the intrinsic `Error` layout, as statements
+ * run on a receiver that already exists.
+ *
+ * This is shared by the two ways a program reaches it, because they are the
+ * same language step and must not drift: a written `constructor` reaches it
+ * through the `super(...)` operation, and a derived class that writes *no*
+ * constructor reaches it through the implicit `constructor(...args) {
+ * super(...args) }`, which the construct wrapper renders directly. A second
+ * copy of this for the implicit case would be a second answer to "what does
+ * ECMA-262 20.5.1.1 do", and the two would disagree the first time either
+ * grew a case.
+ *
+ * The receiver is `static_cast` to the native base rather than reached through
+ * a field: the class layout gives a derived class the base's layout as its own
+ * prefix (`records.ts`'s native-base linking), so the base subobject IS the
+ * receiver's front, and `initialize` writes it in place. Constructing a second
+ * `gea::runtime::Error` and copying it would give the throw site a different
+ * object than the one `instanceof` sees.
+ */
+export declare const nativeErrorBaseInitializeStatements: (deriver: RepresentationDeriver, receiverName: string, args: readonly (NativeErrorBaseArgument | undefined)[]) => readonly string[] | NativeErrorBaseRefusal;

package/dist/targets/cpp/native-error-base.js

@@ -0,0 +1,74 @@
+import { representationKey } from '../../representation/model.js';
+import { recordFieldsOfShape } from '../../projection/fields.js';
+import { cppRecordFieldName, cppRecordFieldPresenceName } from './types.js';
+import { cppErrorNativeType } from './error-types.js';
+const isRefusal = (value) => !Array.isArray(value);
+export const isNativeErrorBaseRefusal = isRefusal;
+/**
+ * `super(message, options)` against the intrinsic `Error` layout, as statements
+ * run on a receiver that already exists.
+ *
+ * This is shared by the two ways a program reaches it, because they are the
+ * same language step and must not drift: a written `constructor` reaches it
+ * through the `super(...)` operation, and a derived class that writes *no*
+ * constructor reaches it through the implicit `constructor(...args) {
+ * super(...args) }`, which the construct wrapper renders directly. A second
+ * copy of this for the implicit case would be a second answer to "what does
+ * ECMA-262 20.5.1.1 do", and the two would disagree the first time either
+ * grew a case.
+ *
+ * The receiver is `static_cast` to the native base rather than reached through
+ * a field: the class layout gives a derived class the base's layout as its own
+ * prefix (`records.ts`'s native-base linking), so the base subobject IS the
+ * receiver's front, and `initialize` writes it in place. Constructing a second
+ * `gea::runtime::Error` and copying it would give the throw site a different
+ * object than the one `instanceof` sees.
+ */
+export const nativeErrorBaseInitializeStatements = (deriver, receiverName, args) => {
+    const lines = [];
+    const message = args[0];
+    let messageText = 'std::string()';
+    if (message) {
+        if (message.representation.kind === 'string')
+            messageText = message.text;
+        else if (message.representation.kind === 'optional' && message.representation.payload.kind === 'string') {
+            messageText = `(${message.text}.has_value() ? *${message.text} : std::string())`;
+        }
+        else if (message.representation.kind !== 'undefined') {
+            return {
+                refusal: 'conversion',
+                conversion: `${representationKey(message.representation)}->string`,
+                reason: `intrinsic Error message carries "${representationKey(message.representation)}", not string or optional string`
+            };
+        }
+    }
+    const base = `static_cast<${cppErrorNativeType}&>(*${receiverName})`;
+    lines.push(`${base}.initialize(${messageText});`);
+    const options = args[1];
+    if (options && options.representation.kind !== 'undefined') {
+        const optionsText = options.text;
+        const outerGuard = options.representation.kind === 'optional' ? `${optionsText}.has_value()` : null;
+        const payload = options.representation.kind === 'optional' ? options.representation.payload : options.representation;
+        const payloadText = options.representation.kind === 'optional' ? `(*${optionsText})` : optionsText;
+        if (payload.kind !== 'record' && payload.kind !== 'record-with-index' && payload.kind !== 'native-record-ref') {
+            return {
+                refusal: 'conversion',
+                conversion: `${representationKey(options.representation)}->record`,
+                reason: `intrinsic Error options carry "${representationKey(options.representation)}", not a static options record`
+            };
+        }
+        const fields = payload.kind === 'record' || payload.kind === 'record-with-index' ? payload.fields : recordFieldsOfShape(deriver, payload.shapeId);
+        const cause = fields?.find((field) => field.key === 'cause');
+        if (!cause || cause.value.kind !== 'dynamic') {
+            return {
+                refusal: 'super-initialize',
+                reason: `intrinsic Error options carry "${representationKey(options.representation)}" without a dynamic cause field`
+            };
+        }
+        const access = payload.ownership === 'shared-refcount' ? '->' : '.';
+        const causeText = `${payloadText}${access}${cppRecordFieldName('cause')}`;
+        const guards = [outerGuard, cause.required ? null : `${payloadText}${access}${cppRecordFieldPresenceName('cause')}`].filter((guard) => guard !== null);
+        lines.push(`${guards.length > 0 ? `if (${guards.join(' && ')}) ` : ''}${base}.setCause(${causeText});`);
+    }
+    return lines;
+};

package/dist/targets/cpp/native-narrowing-transport.d.ts

@@ -0,0 +1,12 @@
+import type { ConversionRuntimeRegistry } from '../../conversion/registry.js';
+import { type Representation } from '../../representation/model.js';
+/**
+ * Whether the census's own answer for one pair, asked in its order as
+ * `leafTransports` asks, states that the text the conversion chain spells for
+ * that pair (`convertedValueText`) reads no dynamic field protocol. Only a
+ * node the chain renders qualifies (`emit-narrowing.ts`'s `recipeText`): a
+ * class-family cascade or a sealed native selection is spelled by its own
+ * renderer, so its contract says nothing about the chain's text for the pair.
+ */
+export declare const chainFieldProtocolUnused: (registry: ConversionRuntimeRegistry, source: Representation, target: Representation) => boolean;
+export declare const nativeSumNarrowingTransports: (registry: ConversionRuntimeRegistry, source: Representation, target: Representation) => boolean;

package/dist/targets/cpp/native-narrowing-transport.js

@@ -0,0 +1,151 @@
+import { narrowsToDescendantClassUnion } from '../../conversion/build.js';
+import { representationKey } from '../../representation/model.js';
+import { conversionRecipeOf } from './emit-narrowing.js';
+/**
+ * The native contract of a narrowing out of a SUM, composed from the contracts
+ * this registry already states for its leaf pairs.
+ *
+ * `emit-narrowing.ts` renders a sum narrowing structurally: tag tests,
+ * `get<I>` loads, `*` presence loads, `ofArm<I>` injections and optional
+ * wraps, around one leaf conversion per candidate alternative
+ * (`taggedUnionArmText`, `nestedArmLoadText`, `narrowedUnionSubsetText`,
+ * `recastedUnionText`). None of that structure reads a field or rebuilds a
+ * payload. So the whole narrowing transfers native payloads exactly when every
+ * leaf conversion the renderer can emit does.
+ *
+ * The renderer only ever converts a source LEAF into the target or one of the
+ * target's own nested alternatives, and it emits a leaf candidate only when
+ * the conversion chain spells that pair. This asks the chain for every such
+ * pair -- a superset of the pairs any render uses -- and requires the
+ * registry's own answer for each one to be a certified native transfer
+ * (`nativePayloadTransportMatches`' statement: non-allocating, field protocol
+ * unused, payload preserved). A leaf pair the chain cannot spell is never a
+ * candidate: the discriminant selects among the remaining alternatives, which
+ * is the narrowing authority's own proof. Callable and dynamic alternatives
+ * are refused outright: their sets and adapters convert as a whole rather than
+ * leaf by leaf.
+ */
+const opaqueKinds = new Set([
+    'dynamic',
+    'function',
+    'function-family',
+    'function-value-family',
+    'function-value-dispatch',
+    'function-and-constructor',
+    'generic-function-set',
+    'callable-identity',
+    'constructor-value-dispatch',
+    'borrowed-ref',
+    'proxy-object',
+    'unresolved',
+    'void'
+]);
+const isSum = (value) => value.kind === 'optional' || value.kind === 'tagged-union';
+const alternativesOf = (value) => value.kind === 'optional'
+    ? [value.payload, { kind: value.absence }]
+    : value.kind === 'tagged-union'
+        ? value.arms.map((arm) => arm.value)
+        : [];
+/** Leaves and (with `sums`) the nested sums themselves, deduplicated by carrier key; representations may be cyclic. */
+const collect = (root, sums) => {
+    const seen = new Map();
+    const pending = [root];
+    while (pending.length > 0) {
+        const next = pending.pop();
+        const key = representationKey(next);
+        if (seen.has(key))
+            continue;
+        const sum = isSum(next);
+        seen.set(key, next);
+        if (sum)
+            pending.push(...alternativesOf(next));
+    }
+    return [...seen.values()].filter((value) => sums || !isSum(value));
+};
+const statesNativeTransport = (materializer) => materializer !== null &&
+    materializer !== undefined &&
+    !materializer.allocates &&
+    materializer.nativeFieldProtocol === 'unused' &&
+    materializer.nativePayloadTransport === 'preserved';
+const chainSpells = new WeakMap();
+const chainSpellsPair = (source, target) => {
+    let targets = chainSpells.get(source);
+    if (!targets)
+        chainSpells.set(source, (targets = new Map()));
+    const key = representationKey(target);
+    const known = targets.get(key);
+    if (known !== undefined)
+        return known;
+    const spelled = conversionRecipeOf(source, target)?.renders ?? false;
+    targets.set(key, spelled);
+    return spelled;
+};
+const verdictsByRegistry = new WeakMap();
+const verdictsOf = (registry) => {
+    let verdicts = verdictsByRegistry.get(registry);
+    if (!verdicts)
+        verdictsByRegistry.set(registry, (verdicts = { leaf: new Map(), sum: new Map() }));
+    return verdicts;
+};
+/**
+ * The registry's answer for one leaf pair, asked in the census's own order
+ * (`conversion/nodes.ts`'s `capabilityOf`). A leaf source never reaches the
+ * sum composite below, so this cannot recurse into it. A descendant-union
+ * narrowing is a `class-family` capability, which payload consumers exclude,
+ * so it is refused here as well.
+ */
+const leafTransports = (registry, source, target) => {
+    const sourceKey = representationKey(source);
+    const targetKey = representationKey(target);
+    if (sourceKey === targetKey)
+        return true;
+    const verdicts = verdictsOf(registry).leaf;
+    const pair = `${sourceKey}->${targetKey}`;
+    const known = verdicts.get(pair);
+    if (known !== undefined)
+        return known;
+    let native;
+    if (narrowsToDescendantClassUnion(source, target))
+        native = false;
+    else {
+        const installed = registry.narrowing(source, target) ?? registry.widening(source, target) ?? registry.recasting(source, target);
+        native = statesNativeTransport(installed ? installed.materializer : registry.staticRecipe(source, target));
+    }
+    verdicts.set(pair, native);
+    return native;
+};
+/**
+ * Whether the census's own answer for one pair, asked in its order as
+ * `leafTransports` asks, states that the text the conversion chain spells for
+ * that pair (`convertedValueText`) reads no dynamic field protocol. Only a
+ * node the chain renders qualifies (`emit-narrowing.ts`'s `recipeText`): a
+ * class-family cascade or a sealed native selection is spelled by its own
+ * renderer, so its contract says nothing about the chain's text for the pair.
+ */
+export const chainFieldProtocolUnused = (registry, source, target) => {
+    if (representationKey(source) === representationKey(target))
+        return true;
+    if (narrowsToDescendantClassUnion(source, target))
+        return false;
+    const installed = registry.narrowing(source, target) ?? registry.widening(source, target) ?? registry.recasting(source, target);
+    const materializer = installed ? installed.materializer : registry.staticRecipe(source, target);
+    return (materializer !== null &&
+        materializer !== undefined &&
+        materializer.nativeSelection === undefined &&
+        materializer.nativeFieldProtocol === 'unused');
+};
+export const nativeSumNarrowingTransports = (registry, source, target) => {
+    if (!isSum(source))
+        return false;
+    const verdicts = verdictsOf(registry).sum;
+    const pair = `${representationKey(source)}->${representationKey(target)}`;
+    const known = verdicts.get(pair);
+    if (known !== undefined)
+        return known;
+    const leaves = collect(source, false);
+    const parts = collect(target, true);
+    const native = ![...leaves, ...parts].some((value) => opaqueKinds.has(value.kind)) &&
+        leaves.every((leaf) => parts.every((part) => representationKey(leaf) === representationKey(part) || !chainSpellsPair(leaf, part) || leafTransports(registry, leaf, part)));
+    verdicts.set(pair, native);
+    return native;
+};

package/dist/targets/cpp/native-selection-helpers.d.ts

@@ -0,0 +1,11 @@
+import { type IrBody } from '../../ir/model.js';
+import type { ConversionCensus } from '../../conversion/nodes.js';
+import type { ConversionNode, ConversionNodeId } from '../../conversion/algebra.js';
+export interface NativeSelectionHelper {
+    readonly name: string;
+    readonly declaration: string;
+    readonly definition: string;
+}
+/** Count certified IR uses before rendering; helper selection never changes conversion authority. */
+export declare const nativeSelectionHelpersForUses: (nodes: Iterable<ConversionNode>) => ReadonlyMap<ConversionNodeId, NativeSelectionHelper>;
+export declare const nativeSelectionHelpers: (bodies: readonly IrBody[], census: ConversionCensus) => ReadonlyMap<ConversionNodeId, NativeSelectionHelper>;

package/dist/targets/cpp/native-selection-helpers.js

@@ -0,0 +1,46 @@
+import { createHash } from 'node:crypto';
+import { allOperationsOf } from '../../ir/model.js';
+import { nativeSelectionBody } from './emit-native-selection.js';
+import { cppTypeOf } from './types.js';
+/** Count certified IR uses before rendering; helper selection never changes conversion authority. */
+export const nativeSelectionHelpersForUses = (nodes) => {
+    const uses = new Map();
+    for (const node of nodes) {
+        const existing = uses.get(node.id);
+        if (existing)
+            existing.count++;
+        else
+            uses.set(node.id, { node, count: 1 });
+    }
+    const result = new Map();
+    for (const { node, count } of uses.values()) {
+        if (count < 2 || (node.capability.kind !== 'atom' && node.capability.kind !== 'static'))
+            continue;
+        const recipe = node.capability.materializer.nativeSelection;
+        if (!recipe)
+            continue;
+        const body = nativeSelectionBody(recipe, node.source, node.target);
+        if (body === null || body.length < 1024)
+            continue;
+        const name = `gea_native_selection_${createHash('sha256').update(node.id).digest('hex')}`;
+        const signature = `${cppTypeOf(node.target)} ${name}(const ${cppTypeOf(node.source)}& gea_selection)`;
+        result.set(node.id, { name, declaration: `${signature};`, definition: `${signature} { ${body} }` });
+    }
+    return result;
+};
+export const nativeSelectionHelpers = (bodies, census) => {
+    function* nodes() {
+        for (const body of bodies) {
+            for (const block of body.blocks.values()) {
+                for (const operation of allOperationsOf(block)) {
+                    if (operation.kind !== 'convert')
+                        continue;
+                    const node = census.nodeById(operation.conversionUse);
+                    if (node)
+                        yield node;
+                }
+            }
+        }
+    }
+    return nativeSelectionHelpersForUses(nodes());
+};

package/dist/targets/cpp/native-symbol-keys.d.ts

@@ -0,0 +1,8 @@
+import type { Representation } from '../../representation/model.js';
+import { type EmitContext } from './emit-context.js';
+/** A fixed symbol key needs a known runtime identity to participate in own-key
+ * enumeration. Typed symbol indexes already retain their actual evaluated keys.
+ * This checks the same sealed layouts used to emit the protocol, including base
+ * storage, so unsupported class/accessor keys cannot disappear from ownKeys.
+ */
+export declare const unaddressableNativeSymbolKeyOf: (ctx: EmitContext, representation: Representation) => string | null;

package/dist/targets/cpp/native-symbol-keys.js

@@ -0,0 +1,34 @@
+import { wellKnownSymbolMemberOfKey } from './emit-context.js';
+import { cppRecordFieldKeyIsSymbol } from './types.js';
+/** A fixed symbol key needs a known runtime identity to participate in own-key
+ * enumeration. Typed symbol indexes already retain their actual evaluated keys.
+ * This checks the same sealed layouts used to emit the protocol, including base
+ * storage, so unsupported class/accessor keys cannot disappear from ownKeys.
+ */
+export const unaddressableNativeSymbolKeyOf = (ctx, representation) => {
+    const unsupported = (keys) => keys.find((entry) => cppRecordFieldKeyIsSymbol(entry.key) && wellKnownSymbolMemberOfKey(ctx.wellKnownSymbols, entry.key) === null)
+        ?.key ?? null;
+    const shape = (id) => unsupported(ctx.layouts.forShape(id) ?? []) ?? unsupported(ctx.layouts.accessorsForShape?.(id) ?? []);
+    const visited = new Set();
+    const classKey = (declaration) => {
+        if (visited.has(declaration))
+            return null;
+        visited.add(declaration);
+        const layout = ctx.classes.get(declaration);
+        if (!layout)
+            return null;
+        return ((layout.instance?.kind === 'class-ref' ? shape(layout.instance.shapeId) : null) ??
+            unsupported(layout.accessors) ??
+            (layout.base ? classKey(layout.base) : null) ??
+            (layout.nativeBase ? shape(layout.nativeBase.instance.shapeId) : null));
+    };
+    if (representation.kind === 'class-ref')
+        return classKey(representation.declaration);
+    if (representation.kind === 'record')
+        return unsupported(representation.fields) ?? unsupported(representation.accessors);
+    if (representation.kind === 'record-with-index')
+        return unsupported(representation.fields);
+    if (representation.kind === 'native-record-ref' && representation.native === null)
+        return shape(representation.shapeId);
+    return null;
+};

package/dist/targets/cpp/ownership.d.ts

@@ -0,0 +1,43 @@
+import type { FunctionId, RegionId } from '../../identity/ids.js';
+/**
+ * The sealed `ExecutableBodyOwnershipReport` (architecture.md, "Definition of
+ * done"). Every source executable region must be recorded exactly once before
+ * any class header or module body renders: a legacy class method, accessor,
+ * constructor, static-field initializer, or static block acquires its exact
+ * lease before it emits source AST as C++, and a typed-IR member forwarder or
+ * elided/structural region never competes for the same lease. This module is
+ * the only place that lease bookkeeping happens.
+ */
+/**
+ * A source executable region eligible to emit: a callable member keyed by its
+ * checker-stable `FunctionId`, or a class static-lifecycle region keyed by its
+ * censused `RegionId`. There is no third owner kind -- widening this union is
+ * how a region could be recorded that admits no exact identity.
+ */
+export type ExecutableBodyOwner = FunctionId | RegionId;
+/**
+ * An opaque handle. The real ledger lives in a module-private `WeakMap`, not
+ * on the handle itself, so no caller can inspect, copy, or reconstruct
+ * ownership state by holding a reference to the report -- the only way to
+ * affect a lease is through `acquireLease`/`spendLease` below. In particular,
+ * there is no function here that derives a lease or an owner from generated
+ * C++ text: ownership is recorded once, from the identity that authored the
+ * region, and never re-discovered from what that region rendered.
+ */
+export interface ExecutableBodyOwnershipReport {
+    readonly brand: 'ExecutableBodyOwnershipReport';
+}
+export declare const createOwnershipReport: () => ExecutableBodyOwnershipReport;
+/**
+ * Records a region exactly once. A second acquisition for the same owner --
+ * even after its lease has already been spent -- means two emission sites
+ * believe they own one source region, which the sealed boundary must never
+ * allow silently.
+ */
+export declare const acquireLease: (report: ExecutableBodyOwnershipReport, owner: ExecutableBodyOwner) => void;
+/**
+ * Consumes the lease immediately before the owner's C++ actually renders.
+ * Spending an unacquired or already-spent lease names the exact owner, so the
+ * defect is traceable to one region instead of a class of them.
+ */
+export declare const spendLease: (report: ExecutableBodyOwnershipReport, owner: ExecutableBodyOwner) => void;

package/dist/targets/cpp/ownership.js

@@ -0,0 +1,38 @@
+const ledgers = new WeakMap();
+export const createOwnershipReport = () => {
+    const report = { brand: 'ExecutableBodyOwnershipReport' };
+    ledgers.set(report, new Map());
+    return report;
+};
+const ledgerOf = (report) => {
+    const ledger = ledgers.get(report);
+    if (!ledger)
+        throw new Error('ownership report was not created by createOwnershipReport');
+    return ledger;
+};
+/**
+ * Records a region exactly once. A second acquisition for the same owner --
+ * even after its lease has already been spent -- means two emission sites
+ * believe they own one source region, which the sealed boundary must never
+ * allow silently.
+ */
+export const acquireLease = (report, owner) => {
+    const ledger = ledgerOf(report);
+    if (ledger.has(owner))
+        throw new Error(`executable body owner ${owner} already recorded; a region may acquire its lease exactly once`);
+    ledger.set(owner, 'acquired');
+};
+/**
+ * Consumes the lease immediately before the owner's C++ actually renders.
+ * Spending an unacquired or already-spent lease names the exact owner, so the
+ * defect is traceable to one region instead of a class of them.
+ */
+export const spendLease = (report, owner) => {
+    const ledger = ledgerOf(report);
+    const state = ledger.get(owner);
+    if (state === undefined)
+        throw new Error(`executable body owner ${owner} has no acquired lease to spend`);
+    if (state === 'spent')
+        throw new Error(`executable body owner ${owner} lease was already spent`);
+    ledger.set(owner, 'spent');
+};

package/dist/targets/cpp/owning-conversion-input.d.ts

@@ -0,0 +1,14 @@
+import type { IrOperand } from '../../ir/model.js';
+import type { Representation } from '../../representation/model.js';
+import type { EmitContext } from './emit-context.js';
+/** The string-to-dynamic recipe constructs one owned payload from its input.
+ * Moving the finished conversion is too late: its static_cast<std::string>
+ * already copied the input. Transfer a dying input into that same certified
+ * recipe instead. This changes ownership, never which conversion is selected.
+ *
+ * Do not generalize this to arbitrary recipes: sum classification, structural
+ * projection and user-visible conversions may inspect their input repeatedly.
+ * Use the same liveness/physical-storage proof as ordinary moves: deferred
+ * expressions and values needed by later iterations cannot be donated, and
+ * a const borrowed formal still copies when bound to the owning payload. */
+export declare const owningConversionInputText: (ctx: EmitContext, source: IrOperand, target: Representation, text: string) => string;

package/dist/targets/cpp/owning-conversion-input.js

@@ -0,0 +1,12 @@
+import { movedValueText } from './emit-narrowing.js';
+/** The string-to-dynamic recipe constructs one owned payload from its input.
+ * Moving the finished conversion is too late: its static_cast<std::string>
+ * already copied the input. Transfer a dying input into that same certified
+ * recipe instead. This changes ownership, never which conversion is selected.
+ *
+ * Do not generalize this to arbitrary recipes: sum classification, structural
+ * projection and user-visible conversions may inspect their input repeatedly.
+ * Use the same liveness/physical-storage proof as ordinary moves: deferred
+ * expressions and values needed by later iterations cannot be donated, and
+ * a const borrowed formal still copies when bound to the owning payload. */
+export const owningConversionInputText = (ctx, source, target, text) => source.representation.kind === 'string' && target.kind === 'dynamic' ? movedValueText(ctx, source, source.representation, text) : text;