@geastack/compiler 1.0.15

package/dist/targets/cpp/prototype/emit-prototype-string.d.ts

@@ -0,0 +1,42 @@
+import type { IrOperand, IrResult } from '../../../ir/model.js';
+import { type EmitContext } from '../emit-context.js';
+/**
+ * `String.prototype`, as this backend renders it.
+ *
+ * The mechanism -- a deferred `[[Get]]` fused with the call that follows it --
+ * is `emit-prototype-invoke.ts`'s, and its header states why a String method
+ * cannot be materialized as a first-class value. What lives here is only the
+ * table: which members are claimed, at which arities, over which argument
+ * carriers, and which are refused BY NAME with what missing.
+ *
+ * Every runtime function named below is `gea::runtime::string`'s, which is a
+ * port of v1 geatsc's own `src/targets/cpp/runtime/string.cpp` -- the shipping
+ * implementation, not a re-derivation. That port is also what settles the
+ * index space: v1 indexes in UTF-16 CODE UNITS over UTF-8 storage, which is
+ * what ECMA-262 specifies and what node answers, and `.length` moved with it
+ * (`emit-carrier-members.ts`).
+ */
+/** A native scalar primitive may preserve its refined result locally. The
+ * primitive producer publishes expression and storage together; ordinary
+ * Number ABI positions still receive its exact implicit double conversion. */
+export interface NativeScalarCall {
+    readonly expression: string;
+    readonly resultStorage: 'gea::runtime::string::CodeUnit';
+}
+/** The one signature every member's renderer has. `result` is read only by the two members whose ECMA-262 result is `undefined` out of range. */
+export type StringCallRenderer = (ctx: EmitContext, receiverText: string, args: readonly IrOperand[], result: IrResult | null, metadata?: string) => string | NativeScalarCall;
+/** `emit-carrier-members.ts`'s `stringMemberText` defers exactly these keys off a `string` receiver -- one authority for "is this method implemented", never two lists that could drift. */
+export declare const stringMethods: ReadonlyMap<string, StringCallRenderer>;
+export declare const stringPrototypeMethods: ReadonlySet<string>;
+/**
+ * Members this backend states a REASON for not implementing, rather than
+ * letting them fall into the generic "here is the list of what is implemented"
+ * refusal.
+ *
+ * A member is here when the gap is a specific missing thing a reader would
+ * otherwise have to guess at -- a Unicode table, a regular-expression engine,
+ * a locale database. The distinction matters: "not built yet" and "cannot be
+ * built without X" are different answers, and only the second one tells you
+ * what to build.
+ */
+export declare const stringMemberRefusals: ReadonlyMap<string, string>;

package/dist/targets/cpp/prototype/emit-prototype-string.js

@@ -0,0 +1,252 @@
+import { representationKey } from '../../../representation/model.js';
+import { createCppEmitBlockedError, operandText } from '../emit-context.js';
+import { toStringText } from '../emit-tostring.js';
+import { matchAllRefusal, regexpMatchText, regexpReplaceText, regexpSearchText, regexpSplitText } from './emit-prototype-regexp.js';
+const stringMethodShapes = new Map([
+    ['substring', { clause: '22.1.3.24', arities: [1, 2], carriers: ['number', 'number'] }],
+    ['substr', { clause: 'B.2.3.1', arities: [1, 2], carriers: ['number', 'number'] }],
+    ['slice', { clause: '22.1.3.22', arities: [1, 2], carriers: ['number', 'number'] }],
+    ['trim', { clause: '22.1.3.32', arities: [0], carriers: [] }],
+    ['trimStart', { clause: '22.1.3.34', arities: [0], carriers: [] }],
+    ['trimEnd', { clause: '22.1.3.33', arities: [0], carriers: [] }],
+    ['toLowerCase', { clause: '22.1.3.29', arities: [0], carriers: [] }],
+    ['toUpperCase', { clause: '22.1.3.31', arities: [0], carriers: [] }],
+    ['charCodeAt', { clause: '22.1.3.3', arities: [1], carriers: ['number'] }],
+    ['charAt', { clause: '22.1.3.2', arities: [1], carriers: ['number'] }],
+    ['indexOf', { clause: '22.1.3.9', arities: [1, 2], carriers: ['string', 'number'] }],
+    ['lastIndexOf', { clause: '22.1.3.10', arities: [1, 2], carriers: ['string', 'number'] }],
+    ['includes', { clause: '22.1.3.8', arities: [1, 2], carriers: ['string', 'number'] }],
+    ['startsWith', { clause: '22.1.3.23', arities: [1, 2], carriers: ['string', 'number'] }],
+    ['endsWith', { clause: '22.1.3.7', arities: [1, 2], carriers: ['string', 'number'] }],
+    ['padStart', { clause: '22.1.3.16', arities: [1, 2], carriers: ['number', 'string'] }],
+    ['padEnd', { clause: '22.1.3.15', arities: [1, 2], carriers: ['number', 'string'] }],
+    ['repeat', { clause: '22.1.3.17', arities: [1], carriers: ['number'] }],
+    ['localeCompare', { clause: '22.1.3.12', arities: [1], carriers: ['string'] }],
+    // The three members `lib.es5.d.ts` declares over `string | RegExp`. These
+    // rows are the STRING form only; the pattern form is rendered by
+    // `emit-prototype-regexp.ts` and asked first (see `shapedStringMethodText`).
+    ['split', { clause: '22.1.3.21', arities: [1], carriers: ['string'] }],
+    ['replace', { clause: '22.1.3.18', arities: [2], carriers: ['string', 'string'] }],
+    ['replaceAll', { clause: '22.1.3.20', arities: [2], carriers: ['string', 'string'] }]
+]);
+const carrierMatches = (operand, wanted) => wanted === 'string'
+    ? operand.representation.kind === 'string'
+    : (operand.representation.kind === 'scalar' && operand.representation.domain === 'number') || isOptionalNumber(operand.representation);
+/**
+ * Whether a carrier is `T | undefined` over a number -- ECMA-262's OWN
+ * spelling for "this parameter was not supplied", not a caller's mistake.
+ * `String.prototype.slice`/`substring`'s numeric parameters are declared
+ * optional in `lib.es5.d.ts`, so a call that forwards an already-optional
+ * local (`s.slice(maybeStart)`) hands this renderer `optional(scalar(number),
+ * undefined)` rather than a bare number -- the value genuinely may be absent
+ * at RUNTIME, which an omitted argument (a different arity, handled by the
+ * overload set above) cannot express. `numericDefaultText` below is what
+ * turns the flag back into ECMA-262's own default for the position.
+ */
+const isOptionalNumber = (representation) => representation.kind === 'optional' &&
+    representation.absence === 'undefined' &&
+    representation.payload.kind === 'scalar' &&
+    representation.payload.domain === 'number';
+/**
+ * The C++ text for a `number`-shaped argument, materializing an absent
+ * `optional` into the ECMA-262 default ToIntegerOrInfinity(undefined) already
+ * gives its position -- 0 for a leading index (22.1.3.22 step 4, 22.1.3.24
+ * step 4) and `+Infinity` for a trailing one (22.1.3.22 step 3: "If end is
+ * undefined, let relativeEnd be len"). `+Infinity` is not a guess: it is the
+ * exact sentinel the runtime's own single-argument `slice` overload
+ * (gea_runtime.h) already passes for a genuinely OMITTED end, so a present-
+ * but-undefined end renders through the identical downstream clamp to `len`
+ * rather than a second, possibly-disagreeing spelling of the same default.
+ */
+const numericArgumentText = (ctx, operand, position) => {
+    const text = operandText(ctx, operand);
+    if (!isOptionalNumber(operand.representation))
+        return text;
+    const fallback = position === 0 ? '0.0' : 'std::numeric_limits<double>::infinity()';
+    return `(${text}.has_value() ? *${text} : ${fallback})`;
+};
+/**
+ * A carrier the runtime overload does not take is refused by name here rather
+ * than handed to C++ to reject: the specification COERCES it (ToString /
+ * ToIntegerOrInfinity of an arbitrary value), and coercion of an arbitrary
+ * value is exactly what this backend has no box for.
+ *
+ * The check reads the ARGUMENT OPERAND's own resolved carrier, never the
+ * declared ABI parameter's. `lib.es5.d.ts` declares `split(separator: string |
+ * RegExp)` and `replace(searchValue: string | RegExp, ...)`, so the declared
+ * parameter is a `tagged-union` at every call site including the ones that
+ * pass a plain string -- the checker's ABI states what is LEGAL to pass, not
+ * what this call passes. Reading the operand is what lets a string separator
+ * render natively while a RegExp one refuses by name instead of being forced
+ * through a carrier this file does not implement.
+ */
+const shapedStringMethodText = (member, shape) => (ctx, receiverText, args, result, metadata) => {
+    // The three members `lib.es5.d.ts` declares over `string | RegExp` are
+    // asked of `emit-prototype-regexp.ts` first, and it answers `null` for a
+    // string argument so the shaped rendering below is reached unchanged. This
+    // is what replaced the union refusal that used to stand here: a RegExp
+    // member of the declared union is now rendered, not named as missing.
+    const byPattern = member === 'split'
+        ? regexpSplitText(ctx, receiverText, args, result)
+        : member === 'replace' || member === 'replaceAll'
+            ? regexpReplaceText(member, ctx, receiverText, args)
+            : null;
+    if (byPattern !== null)
+        return byPattern;
+    if (!shape.arities.includes(args.length)) {
+        throw createCppEmitBlockedError(`runtime-helper:element:${member}:string`, `"String.prototype.${member}" is spelled for ${shape.arities.join(' or ')} argument(s) (ECMA-262 ${shape.clause}); this call passes ${args.length}`);
+    }
+    const rendered = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const argument = args[index];
+        const wanted = shape.carriers[index];
+        // ReplaceValue is specified as `callable ? callback : ToString(value)`.
+        // The checker overload describes its common string case, while the
+        // operand still records the concrete non-callable value this call uses.
+        // Reuse the language's one ToString table so numbers and other proven
+        // carriers reach GetSubstitution without a dynamic box.
+        const replacementText = argument && wanted === 'string' && (member === 'replace' || member === 'replaceAll') && index === 1
+            ? toStringText(operandText(ctx, argument), argument.representation, ctx.classes, ctx.deriver)
+            : null;
+        if (!argument || !wanted || (!carrierMatches(argument, wanted) && replacementText === null)) {
+            throw createCppEmitBlockedError(`runtime-helper:element:${member}:string`, `"String.prototype.${member}" argument ${index} carries ` +
+                `"${argument ? representationKey(argument.representation) : 'nothing'}", and this backend spells it only for a ${wanted ?? 'declared'} carrier` +
+                (wanted === 'string' && argument && argument.representation.kind === 'tagged-union'
+                    ? ' -- the declared parameter is a union, and this call passes an operand carried as the union itself rather than as one resolved arm, ' +
+                        'so neither the string spelling nor the RegExp one above can be selected'
+                    : ''));
+        }
+        rendered.push(wanted === 'number' ? numericArgumentText(ctx, argument, index) : (replacementText ?? operandText(ctx, argument)));
+    }
+    if (member === 'charCodeAt' && metadata !== undefined) {
+        return {
+            expression: `gea::runtime::string::charCodeAtWithMetadata(${[receiverText, ...rendered, `${metadata}_units`, `${metadata}_basic_latin`, `${metadata}.cursor`].join(', ')})`,
+            resultStorage: 'gea::runtime::string::CodeUnit'
+        };
+    }
+    return `gea::runtime::string::${shape.spelling ?? member}(${[receiverText, ...rendered].join(', ')})`;
+};
+/**
+ * `at` and `codePointAt` -- the two String members whose ECMA-262 result is
+ * `undefined` when the index is out of range (22.1.3.1 step 7, 22.1.3.4 step
+ * 5), rather than the empty string (`charAt`) or NaN (`charCodeAt`).
+ *
+ * `undefined` is a real value here, not an absence to shrug at, so the runtime
+ * returns a `gea::Optional<T>` and this checks that the plan agrees before
+ * rendering: an `Optional`-producing expression assigned into a bare `T` does
+ * not compile, and an `Optional` silently unwrapped would answer the payload
+ * type's zero for an out-of-range read. If the plan gave the result a
+ * non-optional carrier, the disagreement is upstream and is refused by name
+ * rather than papered over at the C++ boundary.
+ */
+const optionalResultMethodText = (member, clause, payload) => (ctx, receiverText, args, result) => {
+    const index = args[0];
+    if (args.length !== 1 || !index) {
+        throw createCppEmitBlockedError(`runtime-helper:element:${member}:string`, `"String.prototype.${member}" is spelled for its one index argument (ECMA-262 ${clause}); this call passes ${args.length}`);
+    }
+    if (!carrierMatches(index, 'number')) {
+        throw createCppEmitBlockedError(`runtime-helper:element:${member}:string`, `"String.prototype.${member}"'s index argument carries a "${representationKey(index.representation)}" carrier, not a number scalar`);
+    }
+    // A call with NO result at all passes: `s.at(0);` in statement position
+    // discards the value and `emitCall` renders it as a bare expression
+    // statement, so there is no carrier to disagree with.
+    const carrier = result?.representation;
+    const payloadMatches = carrier === undefined ||
+        (carrier.kind === 'optional' &&
+            (payload === 'string'
+                ? carrier.payload.kind === 'string'
+                : carrier.payload.kind === 'scalar' && carrier.payload.domain === 'number'));
+    if (!payloadMatches) {
+        throw createCppEmitBlockedError(`conversion:optional(${payload})->${carrier ? representationKey(carrier) : 'nothing'}`, `"String.prototype.${member}" answers \`undefined\` for an out-of-range index (ECMA-262 ${clause}), so this backend renders it as an ` +
+            `optional ${payload}; this call's result carries "${carrier ? representationKey(carrier) : 'nothing'}", and narrowing the absence away here would ` +
+            "answer the payload type's zero for a read the program can observe as absent");
+    }
+    return `gea::runtime::string::${member}(${receiverText}, ${operandText(ctx, index)})`;
+};
+/**
+ * ECMA-262 22.1.3.5 `String.prototype.concat(...strings)`.
+ *
+ * `concat`'s checker signature is `(...strings: string[]): string` -- a rest
+ * parameter -- so `ir/lower.ts`'s `packRestArguments` has already packed every
+ * call argument into one `array-object` before this runs, exactly as it has
+ * for `Array.prototype.push`. So the rendering takes the packed array rather
+ * than a C++ argument per source argument, and the runtime overload mirrors
+ * that: v1 spells this as a brace-init list because v1's emitter still has the
+ * physical arguments at this point; this backend does not, and inventing them
+ * back would mean unpacking a runtime array at compile time.
+ *
+ * The packed element carrier is checked rather than assumed: a non-string
+ * element would be a value the specification ToStrings, and ToString of an
+ * arbitrary value is what this backend has no box for.
+ */
+const concatText = (ctx, receiverText, args) => {
+    const packed = args[0];
+    if (args.length !== 1 || !packed) {
+        throw createCppEmitBlockedError('runtime-helper:element:concat:string', '"String.prototype.concat" expects its rest argument already packed into one array-object by ir/lower.ts\'s packRestArguments; ' +
+            `this call arrives with ${args.length} operand(s)`);
+    }
+    if (packed.representation.kind !== 'array-object' || packed.representation.element.kind !== 'string') {
+        throw createCppEmitBlockedError('runtime-helper:element:concat:string', `"String.prototype.concat"'s packed rest argument carries "${representationKey(packed.representation)}"; this backend spells it only for an ` +
+            'array-object of strings, because ECMA-262 22.1.3.5 ToStrings every other argument and ToString of an arbitrary value has no box here');
+    }
+    return `gea::runtime::string::concat(${receiverText}, ${operandText(ctx, packed)})`;
+};
+/** Primitive String `toString`/`valueOf` both return the receiver unchanged. */
+const identityText = (member) => (_ctx, receiverText, args) => {
+    if (args.length !== 0) {
+        throw createCppEmitBlockedError(`runtime-helper:element:${member}:string`, `"String.prototype.${member}" takes no arguments; this call passes ${args.length}`);
+    }
+    return receiverText;
+};
+/** `emit-carrier-members.ts`'s `stringMemberText` defers exactly these keys off a `string` receiver -- one authority for "is this method implemented", never two lists that could drift. */
+export const stringMethods = new Map([
+    ['concat', concatText],
+    ['toString', identityText('toString')],
+    ['valueOf', identityText('valueOf')],
+    // The two members that take a regular expression and NOTHING else: ECMA-262
+    // 22.1.3.11 and 22.1.3.13 both `RegExpCreate` a non-RegExp argument first,
+    // so there is no string-shaped form to fall back to and these do not go
+    // through `shapedStringMethodText` at all.
+    ['match', (ctx, receiverText, args, result) => regexpMatchText(ctx, receiverText, args, result)],
+    ['search', (ctx, receiverText, args) => regexpSearchText(ctx, receiverText, args)],
+    ['at', optionalResultMethodText('at', '22.1.3.1', 'string')],
+    ['codePointAt', optionalResultMethodText('codePointAt', '22.1.3.4', 'number')],
+    ...[...stringMethodShapes].map(([member, shape]) => [member, shapedStringMethodText(member, shape)])
+]);
+export const stringPrototypeMethods = new Set(stringMethods.keys());
+/**
+ * Members this backend states a REASON for not implementing, rather than
+ * letting them fall into the generic "here is the list of what is implemented"
+ * refusal.
+ *
+ * A member is here when the gap is a specific missing thing a reader would
+ * otherwise have to guess at -- a Unicode table, a regular-expression engine,
+ * a locale database. The distinction matters: "not built yet" and "cannot be
+ * built without X" are different answers, and only the second one tells you
+ * what to build.
+ */
+export const stringMemberRefusals = new Map([
+    [
+        'normalize',
+        "ECMA-262 22.1.3.13 normalize(form) applies a Unicode Normalization Form (NFC/NFD/NFKC/NFKD), which needs the Unicode Character Database's " +
+            'canonical-decomposition and combining-class tables. Neither this runtime nor v1 carries them, and normalizing without them would return a ' +
+            'string that is not normalized while claiming it is -- so this is refused rather than approximated by an identity function that happens to be ' +
+            'correct for ASCII'
+    ],
+    ['matchAll', matchAllRefusal()],
+    [
+        'toLocaleLowerCase',
+        'ECMA-262 22.1.3.30 / ECMA-402 is the LOCALE-SENSITIVE case conversion (a Turkish locale maps I to a dotless lowercase form, which toLowerCase ' +
+            'explicitly must not do). There is no locale database here, and rendering it as toLowerCase would silently answer the locale-independent ' +
+            'mapping for a call that asked for the other one'
+    ],
+    [
+        'toLocaleUpperCase',
+        'ECMA-262 22.1.3.31 / ECMA-402 is the LOCALE-SENSITIVE case conversion; see toLocaleLowerCase -- there is no locale database here'
+    ],
+    [
+        'localeCompare$options',
+        'ECMA-402 localeCompare(that, locales, options) selects a collation; this runtime has no ICU and no collation table, so only the one-argument ' +
+            'form is rendered, and even that one is a code-unit ordering rather than a collation (see gea::runtime::string::localeCompare)'
+    ]
+]);

package/dist/targets/cpp/prototype/prototype-method-reads.d.ts

@@ -0,0 +1,25 @@
+import type { IrBody } from '../../../ir/model.js';
+import type { IrValueId } from '../../../identity/ids.js';
+import type { EmitContext, PrototypeMethodRead } from '../emit-context.js';
+/**
+ * Every deferred prototype-method read in one body, settled before the body
+ * renders a line.
+ *
+ * This composes; it decides nothing. Each carrier's own resolver already IS
+ * the authority for what a deferred read on that carrier is, so the claim was
+ * lifted out of the resolver as a function and there are exactly two callers
+ * of it: this walk, which records the fact, and the resolver, which spells the
+ * answer. Nothing here re-tests a predicate that lives in a resolver, and a
+ * new carrier is reachable only by adding its claim to both ends -- which is
+ * the whole point (invariant 5: no write during render).
+ *
+ * The order is `emitGet`'s own ladder order, so a receiver two claims could
+ * both answer resolves the way the printer resolves it. The claims are keyed
+ * on disjoint carrier kinds almost everywhere; where they are not -- the four
+ * `Object.prototype` reflection claims -- the ladder is what separates them.
+ *
+ * `hostMemberReads` is asked first because `declaredHostMethodRead` preempts
+ * every branch below it: a read the host tables already claimed is a host
+ * member, never a prototype method.
+ */
+export declare const prototypeMethodReadsOf: (ctx: EmitContext, body: IrBody) => ReadonlyMap<IrValueId, PrototypeMethodRead>;

package/dist/targets/cpp/prototype/prototype-method-reads.js

@@ -0,0 +1,182 @@
+import { allOperationsOf } from '../../../ir/model.js';
+import { deferredArrayMethodClaim, deferredDictionaryMethodClaim, deferredIteratorMethodClaim, deferredKeyedCollectionMethodClaim, deferredPromiseMethodClaim, deferredScalarMethodClaim, deferredStringMethodClaim, deferredTypedArrayMethodClaim } from '../emit-carrier-members.js';
+import { deferredArrayBufferMethodClaim, deferredDataViewMethodClaim } from '../emit-buffers.js';
+import { deferredTypedArrayUnionMethodClaim, deferredUnionToStringClaim } from '../emit-union-properties.js';
+import { isDeclaredStringPrototypeKey } from '../emit-carrier-members.js';
+import { objectPrototypeMemberNames } from '../../../representation/record-fields.js';
+import { deferredCallableShapeMethodClaim } from '../emit-dynamic-properties.js';
+import { deferredDynamicObjectMethodClaim, deferredObjectShapeMethodClaim } from '../host/object-protocol.js';
+import { deferredIntrinsicReflectionClaim } from '../host/emit-host-properties.js';
+import { deferredDateMethodClaim } from './emit-prototype-date.js';
+import { deferredNativeErrorMethodClaim } from './emit-prototype-error.js';
+import { deferredRegexpMethodClaim } from './emit-prototype-regexp.js';
+/**
+ * Every deferred prototype-method read in one body, settled before the body
+ * renders a line.
+ *
+ * This composes; it decides nothing. Each carrier's own resolver already IS
+ * the authority for what a deferred read on that carrier is, so the claim was
+ * lifted out of the resolver as a function and there are exactly two callers
+ * of it: this walk, which records the fact, and the resolver, which spells the
+ * answer. Nothing here re-tests a predicate that lives in a resolver, and a
+ * new carrier is reachable only by adding its claim to both ends -- which is
+ * the whole point (invariant 5: no write during render).
+ *
+ * The order is `emitGet`'s own ladder order, so a receiver two claims could
+ * both answer resolves the way the printer resolves it. The claims are keyed
+ * on disjoint carrier kinds almost everywhere; where they are not -- the four
+ * `Object.prototype` reflection claims -- the ladder is what separates them.
+ *
+ * `hostMemberReads` is asked first because `declaredHostMethodRead` preempts
+ * every branch below it: a read the host tables already claimed is a host
+ * member, never a prototype method.
+ */
+export const prototypeMethodReadsOf = (ctx, body) => {
+    const reads = new Map();
+    // `emitGet` re-enters itself with the proven-present view of an optional
+    // receiver, so that view -- not the optional -- is the operand every claim
+    // below sees at render time. `unwrapPresentValue` is the render-side twin of
+    // this line; it additionally MINTS the unwrap, which is a spelling, not a
+    // fact.
+    const presentView = (receiver) => receiver.representation.kind === 'optional'
+        ? { value: `${receiver.value}:present`, representation: receiver.representation.payload }
+        : receiver;
+    for (const block of body.blocks.values()) {
+        for (const operation of allOperationsOf(block)) {
+            if (operation.kind !== 'get')
+                continue;
+            if (ctx.hostMemberReads.has(operation.result.id))
+                continue;
+            const receiver = presentView(operation.receiver);
+            const claim = claimOf(ctx, receiver, operation) ?? mixedUnionClaimOf(ctx, receiver, operation);
+            if (claim !== null)
+                reads.set(operation.result.id, claim);
+        }
+    }
+    return reads;
+};
+/** The ladder itself, over one receiver operand -- asked of a whole value and, by `mixedUnionClaimOf`, of one arm of one. */
+const claimOf = (ctx, receiver, operation) => {
+    const key = operation.key;
+    const texts = ctx.staticKeyTexts;
+    return (deferredTypedArrayUnionMethodClaim(texts, receiver, key) ??
+        deferredUnionToStringClaim(ctx, receiver, key) ??
+        deferredArrayMethodClaim(texts, receiver, key) ??
+        deferredTypedArrayMethodClaim(texts, receiver, key) ??
+        deferredArrayBufferMethodClaim(texts, receiver, key) ??
+        deferredDataViewMethodClaim(texts, receiver, key) ??
+        deferredStringMethodClaim(texts, receiver, key) ??
+        deferredScalarMethodClaim(texts, receiver, key) ??
+        deferredRegexpMethodClaim(texts, receiver, key) ??
+        deferredPromiseMethodClaim(texts, receiver, key) ??
+        deferredIteratorMethodClaim(texts, receiver, key) ??
+        deferredKeyedCollectionMethodClaim(texts, receiver, key) ??
+        deferredDateMethodClaim(texts, receiver, key) ??
+        deferredNativeErrorMethodClaim(texts, receiver, key) ??
+        deferredIntrinsicReflectionClaim(ctx.hosts, texts, receiver, key) ??
+        deferredDictionaryMethodClaim(texts, receiver, key) ??
+        deferredObjectShapeMethodClaim(ctx, { ...operation, receiver }) ??
+        deferredCallableShapeMethodClaim(texts, receiver, key) ??
+        deferredDynamicObjectMethodClaim(texts, receiver, key));
+};
+/**
+ * A prototype-method read off a HETEROGENEOUS tagged union.
+ *
+ * `deferredTypedArrayUnionMethodClaim` above claims a union whose every arm
+ * means the same thing by the member. This claims the other kind:
+ * `(query(t, k) as string[]).join` reads `join` off `string | string[] |
+ * Record<string, string> | Record<string, string[]>`, where exactly one arm
+ * has an `Array.prototype.join` and the rest have nothing callable of that
+ * name at all. Each arm that answers keeps its OWN recorded read -- asked of
+ * the same ladder, so no arm is answered by a second copy of a rule -- and the
+ * arms that cannot answer are recorded as `null`.
+ *
+ * `null` is admitted only where the arm PROVABLY has no callable member of
+ * that name (`armHasNoCallableMember`), never merely because this backend
+ * renders nothing for it: the difference between "the language answers
+ * undefined here" and "this member is not implemented yet" is the difference
+ * between the TypeError JavaScript throws and a wrong answer, so an arm this
+ * cannot prove refuses the whole claim and the read keeps its named refusal.
+ *
+ * Claimed only at a call fusion, which is what makes the throw exact: a read
+ * that is not called can observe the `undefined`, and this claim is consulted
+ * only through `prototypeMethodCallText`.
+ */
+const mixedUnionClaimOf = (ctx, receiver, operation) => {
+    const carrier = receiver.representation;
+    if (carrier.kind !== 'tagged-union')
+        return null;
+    const member = ctx.staticKeyTexts.get(operation.key.value);
+    if (member === undefined || objectPrototypeMemberNames.has(member))
+        return null;
+    const arms = [];
+    let answered = 0;
+    for (const arm of carrier.arms) {
+        const armClaim = claimOf(ctx, { value: receiver.value, representation: arm.value }, operation);
+        if (armClaim !== null) {
+            arms.push(armClaim);
+            answered += 1;
+            continue;
+        }
+        if (!armHasNoCallableMember(arm.value, member))
+            return null;
+        arms.push(null);
+    }
+    if (answered === 0)
+        return null;
+    return {
+        receiverKind: 'mixed-union',
+        member,
+        receiver: { kind: 'operand', operand: receiver },
+        receiverElement: null,
+        mixedUnionCarrier: carrier,
+        mixedUnionArms: arms
+    };
+};
+/**
+ * Whether this arm PROVABLY holds no callable under this name.
+ *
+ * Only three shapes can be proven here, and each is proven from a table this
+ * backend already owns rather than from the absence of a renderer:
+ *
+ * - a `string` arm: `String.prototype`'s own member set is the modelled one
+ *   (`isDeclaredStringPrototypeKey`), so a name outside it reads `undefined`;
+ * - a `dictionary` arm: the read is an ENTRY, whose carrier is the table's own
+ *   value carrier, and a value carrier that can never be callable can never be
+ *   called -- a number-keyed table additionally has no such key at all;
+ * - `null`/`undefined` arms, which throw on the property read itself and are
+ *   already rendered that way by `armRuntimeFieldText`.
+ *
+ * Everything else -- a record, a class, a dynamic value, a callable, anything
+ * with a sidecar -- can hold a callable this backend has simply not rendered,
+ * and answers `false`.
+ */
+const armHasNoCallableMember = (arm, member) => {
+    if (arm.kind === 'string')
+        return !isDeclaredStringPrototypeKey(member);
+    // A dictionary can genuinely HOLD this key -- `Record<string, string>` admits
+    // a "join" entry -- so absence is not what is proven here. What is proven is
+    // that whatever it holds is not callable, and JavaScript's answer to calling
+    // a non-callable is the same TypeError as calling an absent one.
+    if (arm.kind === 'dictionary')
+        return arm.key === 'number' || !mayBeCallable(arm.value);
+    return false;
+};
+const mayBeCallable = (representation) => {
+    // A union is callable if ANY arm is, and an optional if its payload is:
+    // `Record<string, string | string[]>` holds neither a function nor a
+    // container of one, and answering that needs the carrier looked THROUGH
+    // rather than judged by its top kind.
+    if (representation.kind === 'tagged-union')
+        return representation.arms.some((arm) => mayBeCallable(arm.value));
+    if (representation.kind === 'optional')
+        return mayBeCallable(representation.payload);
+    return (representation.kind === 'dynamic' ||
+        representation.kind === 'function' ||
+        representation.kind === 'function-family' ||
+        representation.kind === 'function-value-family' ||
+        representation.kind === 'function-value-dispatch' ||
+        representation.kind === 'function-and-constructor' ||
+        representation.kind === 'generic-function-set' ||
+        representation.kind === 'callable-identity');
+};

package/dist/targets/cpp/reactive-dependencies.d.ts

@@ -0,0 +1,140 @@
+import type { DeclarationId, FunctionId, RegionId } from '../../identity/ids.js';
+import type { ClassLayout } from '../../projection/classes.js';
+import type { IrBody } from '../../ir/model.js';
+import type { ReactiveCellPlan } from './host/host-members.js';
+/**
+ * Which reactive fields one body READS, and through which receiver.
+ *
+ * A JSX slot whose value is computed -- `class={done ? 'a' : 'b'}` -- reaches
+ * the emitter as a call of a thunk (`plugins/gea/reactive-slots.ts`), and the
+ * caller has to subscribe that thunk to every field the expression depends on.
+ * The caller cannot see inside the callee's body, and the two are emitted
+ * independently and in no guaranteed order, so the answer is computed here,
+ * once, over the whole IR before any body is rendered.
+ *
+ * `source` is what the caller needs in order to NAME the owning object, and
+ * there are exactly two shapes a slot expression uses:
+ *
+ *   - `binding` -- a module-scope store (`todo.done1`). Its cell is a global
+ *     with a stable C++ name, reachable from any body, which is what makes
+ *     subscribing from the caller possible at all.
+ *   - `receiver` -- the component's own field (`this.count`). The thunk's
+ *     receiver and the enclosing template's receiver are the same object, so
+ *     the caller subscribes through its own.
+ *
+ * Any other receiver -- a parameter, a local, a field of a field -- is NOT
+ * recorded. The caller has no expression for such an object, and inventing one
+ * would subscribe the wrong instance; the slot keeps its once-only behaviour
+ * and is a stated gap rather than a binding to the wrong owner.
+ *
+ * TRANSITIVE through a call whose callee this IR closed (`CallOperation.
+ * closedCallee`), and it has to be. A GETTER is spelled exactly like a field --
+ * `{reader.pageNumberLabel}` beside `{reader.openLabel}` -- but lowers to a
+ * call, so a body-only reading found no dependency, `emit-jsx.ts` fell through
+ * to the once-only `leafText`, and the slot froze at whatever it read on the
+ * first render. The e-reader's page counter said "1 / 1" for a fourteen-hundred
+ * page book, for the life of the program.
+ *
+ * What made the old reading "honest" was NAMEABILITY, not locality, and that is
+ * preserved: a callee dependency on a module-scope store is kept as it stands
+ * (a global cell is reachable from any frame), while one on the callee's own
+ * `this` is re-pointed through the receiver THIS call passes -- and dropped
+ * when that receiver is not a shape the caller can name, which is the same test
+ * the direct pass applies to its own reads. So the widening still never
+ * subscribes to the wrong object; it only stops missing the right one.
+ *
+ * Over-subscribing is the failure this trades INTO, and for a VALUE slot it is
+ * benign: a slot that re-renders when a field its callee read changes without
+ * changing the slot's value re-renders to the same text, and every apply there
+ * is idempotent. For a NODE slot it is not -- re-running takes the subtree
+ * down and builds it again, which repaints -- so that census is narrowed; see
+ * `ReactiveDependencyCensus` below.
+ */
+export interface ReactiveDependency {
+    /** The struct that DECLARES the field, which is what a member pointer must name. */
+    readonly struct: string;
+    readonly key: string;
+    /**
+     * `true` when the subscription goes through the field's COMPANION revision
+     * cell rather than the field itself -- an array field, whose own carrier
+     * cannot be a cell. See `records.ts`'s `cppReactiveRevisionFieldName`.
+     */
+    readonly revision: boolean;
+    readonly source: {
+        readonly kind: 'receiver';
+    } | {
+        readonly kind: 'binding';
+        readonly declaration: DeclarationId;
+    };
+}
+/**
+ * The two dependency censuses, one per kind of thing a subscription re-runs.
+ *
+ * `all` is the whole-program reading described at the top of this file: every
+ * cell a body reads, transitively through the calls it closed. It is what a
+ * VALUE slot wants -- a text, a prop, a style member, a class entry -- because
+ * re-running one of those writes the same value again when nothing moved, and
+ * over-subscribing there costs a comparison.
+ *
+ * `node` is the same census with one term narrowed, and it exists because for
+ * a NODE child the trade `all` makes is not benign. Re-running a node binding
+ * takes the subtree down and builds it again, which is a structural change to
+ * the tree, which repaints the viewport. An App whose single ternary child
+ * picks one of seven screens subscribes, under `all`, to every cell every
+ * screen reads -- so tapping a footswitch inside the chain screen rebuilt all
+ * 44 of its nodes and repainted 502x410 pixels, although the condition that
+ * selects the screen never moved.
+ *
+ * The narrowing is two rules, and both are about what is ALREADY bound
+ * somewhere else.
+ *
+ *   - A body's OWN reads are all kept. A component invocation's props record is
+ *     built in the thunk, so `<Row value={store.x}/>` reads `x` here, and a
+ *     prop that changes really does mean a different subtree.
+ *   - A dependency carried in FROM a callee is kept only when it selects
+ *     control flow in that callee -- it reaches a branch condition there, so it
+ *     can change which node the callee returns -- and only when the callee is
+ *     not itself a lifted JSX slot (`CallEdge.lifted`). A read that merely
+ *     flows into the callee's own JSX is dropped, and so is a branch inside a
+ *     slot the callee binds on its own node: in both cases the position that
+ *     changes has a subscription of its own, and re-running the outer binding
+ *     rebuilds everything above it to reach a node that would have updated
+ *     itself.
+ *
+ * What survives the second rule is the one shape with no binding of its own: a
+ * component whose BODY branches on a cell to choose which root it returns.
+ */
+export interface ReactiveDependencyCensus {
+    readonly all: ReadonlyMap<FunctionId | RegionId, readonly ReactiveDependency[]>;
+    readonly node: ReadonlyMap<FunctionId | RegionId, readonly ReactiveDependency[]>;
+}
+export declare const reactiveDependenciesOfBodies: (bodies: readonly IrBody[], classes: ReadonlyMap<DeclarationId, ClassLayout>, reactive: ReactiveCellPlan) => ReactiveDependencyCensus;
+/**
+ * Which RECORD fields a JSX site actually binds, keyed by struct name.
+ *
+ * The elements of a reactive array are only worth celling when a rendered row
+ * reads them -- `records.ts` cells exactly this set. Celling every element
+ * record of every array field instead is not merely wasteful, it is wrong:
+ * `Signal<T>` is not the field's declared carrier, so a struct that is also
+ * read by something carrier-sensitive stops compiling. `gea-bench` holds both
+ * `rows` (rendered) and `items` (parsed out of JSON), and celling `Item.id`
+ * made `gea_json_read(reader, out.id)` an error -- a real defect found by the
+ * corpus, not a hypothetical.
+ *
+ * Two shapes reach a JSX slot, and both are recorded:
+ *
+ *   - a DIRECT read -- `id={cell.id}` -- whose `get` result is the operand of
+ *     an `element-prop`/`element-child`, possibly through the record that a
+ *     `style={{...}}` object is built up as.
+ *   - a THUNK read -- `width={cell.filled ? a : b}`, which
+ *     `plugins/gea/reactive-slots.ts` rewrites to an immediately-called arrow.
+ *     The operand is then the CALL, and the fields live in the callee's own
+ *     body, which is a separate `IrBody`. The callee is recognised by its
+ *     `allocate-callable` defining the callee operand -- the shape only an
+ *     IIFE has -- and its body is swept in a second pass.
+ *
+ * Deliberately computed WITHOUT consulting `ReactiveCellPlan.celled`: that map
+ * is derived from this one, so asking it here would be a cycle. This answers
+ * the prior question -- what does the program bind -- and celling follows.
+ */
+export declare const reactiveBoundRecordFields: (bodies: readonly IrBody[]) => ReadonlyMap<string, ReadonlySet<string>>;