@geastack/compiler 1.0.15

package/dist/ir/native-fixed-layout.js

@@ -0,0 +1,232 @@
+import { representationKey } from '../representation/model.js';
+/**
+ * Whether a native object has only compiler-owned, fixed slots.
+ *
+ * This is a fact about the object's own slots, not the protocol of their
+ * payloads. An array, optional, callable or host reference in a fixed field
+ * does not make reading that field dynamic. `directChildrenOf` separately
+ * censuses those payloads, and `promoteFull` closes over them when an actual
+ * operation exposes the enclosing object. Requiring a child's layout to be
+ * closed here retains unused boxed reads on an otherwise closed parent.
+ * `native-record-ref` is admitted only when it names a compiler-owned record
+ * layout from the sealed deriver. Host layouts, index sidecars and record
+ * accessors still require their own full protocol. Class prototype accessors
+ * are body entries, not own storage; their effects belong to accessor flow.
+ * Recursive native wrappers remain
+ * excluded because their physical layout is not the ordinary record layout.
+ *
+ * A container with an intrinsically open element/key domain -- `array-object`,
+ * `dictionary`, `keyed-collection` -- asks a narrower version of the same
+ * question. Their indexed/keyed storage is never finite (that openness is
+ * what makes them a container rather than a record) and is never what this
+ * function is being asked about: reads and writes through it are served by
+ * their own dedicated native transports (`native-array-transport.ts`,
+ * `native-dictionary-transport.ts`, direct `get`/`set`/`has` method calls),
+ * never by the generic `gea_readOwnField`/`gea_ownFieldDescriptor` hooks this
+ * proof gates. What is left to check is only the OWN NAMED-FIELD surface
+ * beyond that index -- an array's `extension`, or nothing at all for a plain
+ * array, a bare dictionary, or a Map/Set/WeakMap/WeakSet -- which can be
+ * exactly as closed as an ordinary record's fields even though the container
+ * around it is open-ended.
+ */
+export const hasClosedFixedLayout = (representation, deriver, classes, visiting = new Set(), completed = new Map()) => {
+    // `representationKey` intentionally folds recursive wrapper metadata into
+    // the same physical native-record-ref identity.  Inspect this marker before
+    // consulting the key cache so a plain record reference cannot certify a
+    // recursive array/dictionary/callable wrapper that happens to share its
+    // shape id.
+    if (representation.kind === 'native-record-ref' && representation.recursive !== undefined)
+        return false;
+    const identity = representationKey(representation);
+    const known = completed.get(identity);
+    if (known !== undefined)
+        return known;
+    if (visiting.has(identity))
+        return false;
+    visiting.add(identity);
+    let closed = false;
+    switch (representation.kind) {
+        case 'record':
+            closed =
+                representation.accessors.length === 0 &&
+                    representation.fields.every((field) => !field.key.startsWith('sym(') && field.value.kind !== 'unresolved');
+            break;
+        case 'native-record-ref': {
+            // A stated native name is a host-owned layout.  Its fields are not a
+            // sealed compiler fact, even when a deriver can describe the shape.
+            if (representation.native !== null || representation.recursive !== undefined || deriver === null)
+                break;
+            closed = hasClosedFixedLayout(deriver.layoutOf(representation.shapeId), deriver, classes, visiting, completed);
+            break;
+        }
+        case 'class-ref': {
+            const layout = classes.get(representation.declaration);
+            // A class the lifecycle census published no layout for is still emitted.
+            // `targets/cpp/records.ts` renders its struct from the CARRIER'S OWN
+            // SHAPE (`recordLayoutOfShape`), standalone -- `classBaseLinks` walks the
+            // same layout map, so it has no row to give this struct a base clause --
+            // which makes that shape's fields the exact slots the object has. They
+            // are as compiler-owned and as fixed as any other class's, so a missing
+            // lifecycle row is evidence about the CENSUS, not about the storage.
+            // Asking the shape here asks the one authority the struct was rendered
+            // from, exactly as the `native-record-ref` case above already does.
+            // Answering "unproven" instead retained the unrestricted field protocol
+            // for a struct whose every slot the compiler itself chose: in the three.js app the
+            // carriers in this state are reached only through an INFERRED field type
+            // -- no live identifier spells the class, so reachability never opens its
+            // declaration -- and the generic protocol they kept was the single
+            // largest source of reflection boxing in the program.
+            if (layout === undefined) {
+                closed =
+                    deriver !== null &&
+                        hasClosedFixedLayout(deriver.layoutOf(representation.shapeId), deriver, classes, visiting, completed);
+                break;
+            }
+            const instanceShape = layout?.instance;
+            const shape = deriver !== null && instanceShape?.kind === 'class-ref' ? deriver.layoutOf(instanceShape.shapeId) : null;
+            // Parameter properties and inferred fields acquire their carrier during
+            // lowering. The earlier declaration can remain unrepresented after the
+            // physical census has published a complete, typed storage slot.
+            const fields = layout?.nativeStorage?.fields.map((field) => ({ key: field.key, value: field.value })) ??
+                layout?.fields.map((field) => ({ key: field.key, value: field.representation })) ??
+                [];
+            const unprovenAncestry = (() => {
+                const seen = new Set();
+                let current = representation.declaration;
+                while (current !== null && !seen.has(current)) {
+                    seen.add(current);
+                    const currentLayout = classes.get(current);
+                    if (!currentLayout)
+                        return true;
+                    if (currentLayout.nativeBase !== null)
+                        return true;
+                    current = currentLayout.base;
+                }
+                return false;
+            })();
+            closed =
+                layout !== undefined &&
+                    layout.nativeBase === null &&
+                    !unprovenAncestry &&
+                    shape?.kind === 'record' &&
+                    shape.fields.every((field) => !field.key.startsWith('sym(') && field.value.kind !== 'unresolved') &&
+                    fields.every((field) => !field.key.startsWith('sym(') &&
+                        field.value !== null &&
+                        // Slot eligibility is independent from the nested carrier's own
+                        // reflection demand.  A typed Array/Map/callable field is still
+                        // a sealed native slot; its child surface is censused separately
+                        // through directChildrenOf and must not force this class's generic
+                        // field protocol to remain available.
+                        field.value.kind !== 'unresolved');
+            break;
+        }
+        // An Array's own indexed storage (`length`, holes, index reads/writes) is
+        // deliberately NOT what this checks -- that is served entirely by
+        // `native-array-transport.ts`'s dedicated recipes, independent of this
+        // proof. What is left is the `extension`: the closed, typed field set an
+        // interface like `NodeArray<T>` adds on top of `Array<T>`
+        // (`representation/model.ts`'s own doc on `extension`). A plain array
+        // (`extension === null`) adds none, so it is trivially closed; an
+        // extended one is closed on exactly the same terms a `record`'s fields
+        // are, above. `element` must still have an actual carrier -- lattice
+        // bottom here is a failed derivation, not a legitimate payload, exactly
+        // as an unresolved record field is refused above. `recursive` is excluded
+        // for the same reason the `native-record-ref` case excludes it before
+        // touching the cache: a recursive array's `representationKey` collapses
+        // to `recursive(type,container,ownership)` (`representation/model.ts`'s
+        // `buildRepresentationKey`), which drops `extension`/`element` entirely,
+        // so a `true` cached under that identity would not actually have come
+        // from checking THIS array's own fields.
+        case 'array-object':
+            closed =
+                representation.recursive === undefined &&
+                    representation.element.kind !== 'unresolved' &&
+                    (representation.extension === null ||
+                        representation.extension.every((field) => !field.key.startsWith('sym(') && field.value.kind !== 'unresolved'));
+            break;
+        // A dictionary IS its index -- `interface StringCounts { [key: string]:
+        // number }` names no member at all -- so it is the degenerate case of
+        // `record-with-index` with an empty `fields` array, and the same "key
+        // enumeration consumes the protocol, not the values stored in it"
+        // argument that admits that sidecar (see `hasNativePropertyLayout`'s own
+        // doc, and `nativeDictionaryTransportOf` for the per-operation half of the
+        // same proof) applies here with nothing else left to check. `recursive`
+        // is excluded for the identical key-collapsing reason given at
+        // `array-object` above.
+        case 'dictionary':
+            closed = representation.recursive === undefined && representation.value.kind !== 'unresolved';
+            break;
+        // `Map`/`Set`/`WeakMap`/`WeakSet` are read and written through `get`/
+        // `set`/`has`/`delete` METHOD CALLS, not ordinary property gets -- an
+        // unmodified instance has ZERO enumerable own data properties for
+        // `Object.keys`/`for`-`in` to find, and a program typed against a plain
+        // `Map<K, V>` is refused by the checker for `someMap.x = 1` the same way
+        // it is for a plain array or dictionary. The own-field surface this proof
+        // covers is therefore vacuously empty no matter what `key`/`value` carry;
+        // `recursive` is excluded for the same key-collapsing reason as the two
+        // cases above.
+        case 'keyed-collection':
+            closed =
+                representation.recursive === undefined &&
+                    representation.key.kind !== 'unresolved' &&
+                    (representation.value === null || representation.value.kind !== 'unresolved');
+            break;
+        // Left unproven, deliberately:
+        // - `native-handle`: a host-declared protocol (`Math`, `Date`, an
+        //   embedder type, ...) whose member set lives in an external plugin
+        //   manifest this function has no access to, exactly like a
+        //   `native-record-ref` carrying a stated `native` name above. There is
+        //   no field list here to check for symbol keys or unresolved values, so
+        //   there is nothing to prove -- a host name is not a sealed compiler
+        //   fact any more for a handle than it is for a record reference.
+        // - `optional`, `tagged-union`, `borrowed-ref`: wrapper kinds, not
+        //   objects. `objectSurfacesOf` (`reflection-demand.ts`) already unwraps
+        //   every one of these before this function is ever asked about a
+        //   "surface", and neither of this function's own recursive callers
+        //   (`native-record-ref`, `class-ref` above) can hand one back from
+        //   `deriver.layoutOf`: both name an OBJECT shape, never a union or an
+        //   optional value. Proving one closed here would also be the wrong
+        //   question -- "closed" has to mean something about the payload it
+        //   unwraps to, and unwrapping first (as every actual caller does) already
+        //   gives that an honest answer.
+        // - `native-sequence`, `dense-buffer`: compiler/runtime-private storage
+        //   with no JavaScript identity and no source syntax a program could ever
+        //   name as a class's or interface's own shape, so `deriver.layoutOf`
+        //   cannot produce either one here either.
+        default:
+            break;
+    }
+    visiting.delete(identity);
+    completed.set(identity, closed);
+    return closed;
+};
+/** A typed native index has a complete property protocol even though its key
+ * set changes at runtime. Key enumeration consumes that protocol, not the
+ * values stored in it. Keep fixed-slot proofs separate: an index must never
+ * qualify a record for a finite-field lookup or fixed-layout conversion.
+ */
+export const hasNativePropertyLayout = (representation, deriver, classes, visiting = new Set(), completed = new Map()) => {
+    if (representation.kind === 'native-record-ref' && representation.recursive !== undefined)
+        return false;
+    const identity = representationKey(representation);
+    const cached = completed.get(identity);
+    if (cached !== undefined)
+        return cached;
+    if (visiting.has(identity))
+        return false;
+    visiting.add(identity);
+    let complete = false;
+    if (representation.kind === 'record-with-index') {
+        complete =
+            representation.fields.every((field) => !field.key.startsWith('sym(') && field.value.kind !== 'unresolved') &&
+                representation.indexes.every((index) => (index.key === 'string' || index.key === 'number' || index.key === 'symbol') && index.value.kind !== 'unresolved');
+    }
+    else if (representation.kind === 'native-record-ref' && representation.native === null && deriver !== null) {
+        complete = hasNativePropertyLayout(deriver.layoutOf(representation.shapeId), deriver, classes, visiting, completed);
+    }
+    else
+        complete = hasClosedFixedLayout(representation, deriver, classes);
+    visiting.delete(identity);
+    completed.set(identity, complete);
+    return complete;
+};

package/dist/ir/native-host-construction.d.ts

@@ -0,0 +1,53 @@
+import type { ConversionCensus } from '../conversion/nodes.js';
+import { type CallableAbi } from '../representation/model.js';
+import type { ConstructOperation } from './model.js';
+/**
+ * A construction through a host constructor whose frame is native end to end,
+ * or `null`.
+ *
+ * The rule the reflection census already applies to a sealed native call --
+ * the exact frame is the whole proof -- applied to `[[Construct]]`. Every
+ * received argument reaches its formal in native storage, so none is
+ * published as a `gea::Value`; and the result is a FRESH host object the
+ * construction mints in the carrier this site holds, so it publishes no
+ * object that existed before it. What the program later reads or writes
+ * through the new collection is a `get`/`set`/call of its own and is censused
+ * there, the same way a closed call's result is.
+ *
+ * three.js is the shape this exists for. `WebGLProperties` holds every
+ * texture/material/render-target bag in `new WeakMap()`, `WebGLRenderStates`
+ * its per-scene state arrays in `new Map()`, `WebGLShaderCache`,
+ * `WebGLGeometries`, `WebGLMorphtargets`, `WebGLTextures` and
+ * `WebGLObjects` the same. None of these callees states a construct
+ * convention (`native-handle(...;construct=-)`): their overload sets join
+ * into none, correctly. So each construction read as unknown and published
+ * the collection's key and value carriers -- the full field protocol of every
+ * record those caches hold -- while the emitted C++ was a bare
+ * `gea::makeRef<...>()`. The site's own frame comes from the overload the
+ * checker selected there (`ConstructOperation.hostFrame`); a handle that
+ * does join (`ErrorConstructor`'s `(message?: string, options?)`) is asked for
+ * its own convention, under which `new Error("...")`'s string argument
+ * reaches the `string | undefined` formal through the census's native
+ * optional injection.
+ *
+ * Why not `nativeCallFrameOf` (call-entry.ts): it confirms the frame against
+ * the convention the callee VALUE states through `abiOfCallee`, and a
+ * `native-handle` states only `construct` -- null exactly where this is
+ * needed. The argument half is the same `nativeArgumentsMatch` under the same
+ * `native-transfer` proof, and the receiver half has nothing to check: a
+ * construction's receiver is the object it allocates.
+ *
+ * Refused, and left to the unknown-construction boundary:
+ * - a callee that is not a bare `native-handle` -- `new this.constructor()`
+ *   in three's `clone()` bodies holds a `dynamic[]`-rest constructor value;
+ *   that is genuinely dynamic and belongs to the class paths, not here;
+ * - a construction whose new-target is not its own callee, which emission
+ *   refuses as well (`emitConstruct`);
+ * - a rest frame, which this does not pack;
+ * - a `dynamic` result -- `new Proxy(...)` and `new Function(...)`, the two
+ *   host constructions whose renderers box their arguments into the result;
+ * - a result carrier that is not the frame's, where the construction would
+ *   first mint one object and then convert it;
+ * - any argument the census does not carry natively into its formal.
+ */
+export declare const nativeHostConstructionOf: (operation: ConstructOperation, conversions?: Pick<ConversionCensus, "nodeById">) => CallableAbi | null;

package/dist/ir/native-host-construction.js

@@ -0,0 +1,62 @@
+import { representationKey } from '../representation/model.js';
+import { hostConstructFrameOf, nativeArgumentsMatch } from './call-entry.js';
+/**
+ * A construction through a host constructor whose frame is native end to end,
+ * or `null`.
+ *
+ * The rule the reflection census already applies to a sealed native call --
+ * the exact frame is the whole proof -- applied to `[[Construct]]`. Every
+ * received argument reaches its formal in native storage, so none is
+ * published as a `gea::Value`; and the result is a FRESH host object the
+ * construction mints in the carrier this site holds, so it publishes no
+ * object that existed before it. What the program later reads or writes
+ * through the new collection is a `get`/`set`/call of its own and is censused
+ * there, the same way a closed call's result is.
+ *
+ * three.js is the shape this exists for. `WebGLProperties` holds every
+ * texture/material/render-target bag in `new WeakMap()`, `WebGLRenderStates`
+ * its per-scene state arrays in `new Map()`, `WebGLShaderCache`,
+ * `WebGLGeometries`, `WebGLMorphtargets`, `WebGLTextures` and
+ * `WebGLObjects` the same. None of these callees states a construct
+ * convention (`native-handle(...;construct=-)`): their overload sets join
+ * into none, correctly. So each construction read as unknown and published
+ * the collection's key and value carriers -- the full field protocol of every
+ * record those caches hold -- while the emitted C++ was a bare
+ * `gea::makeRef<...>()`. The site's own frame comes from the overload the
+ * checker selected there (`ConstructOperation.hostFrame`); a handle that
+ * does join (`ErrorConstructor`'s `(message?: string, options?)`) is asked for
+ * its own convention, under which `new Error("...")`'s string argument
+ * reaches the `string | undefined` formal through the census's native
+ * optional injection.
+ *
+ * Why not `nativeCallFrameOf` (call-entry.ts): it confirms the frame against
+ * the convention the callee VALUE states through `abiOfCallee`, and a
+ * `native-handle` states only `construct` -- null exactly where this is
+ * needed. The argument half is the same `nativeArgumentsMatch` under the same
+ * `native-transfer` proof, and the receiver half has nothing to check: a
+ * construction's receiver is the object it allocates.
+ *
+ * Refused, and left to the unknown-construction boundary:
+ * - a callee that is not a bare `native-handle` -- `new this.constructor()`
+ *   in three's `clone()` bodies holds a `dynamic[]`-rest constructor value;
+ *   that is genuinely dynamic and belongs to the class paths, not here;
+ * - a construction whose new-target is not its own callee, which emission
+ *   refuses as well (`emitConstruct`);
+ * - a rest frame, which this does not pack;
+ * - a `dynamic` result -- `new Proxy(...)` and `new Function(...)`, the two
+ *   host constructions whose renderers box their arguments into the result;
+ * - a result carrier that is not the frame's, where the construction would
+ *   first mint one object and then convert it;
+ * - any argument the census does not carry natively into its formal.
+ */
+export const nativeHostConstructionOf = (operation, conversions) => {
+    // The frame itself has one authority, shared with the census that publishes
+    // this construction's omitted-formal conversions.
+    const abi = hostConstructFrameOf(operation);
+    if (abi === null || abi.receiver !== null || abi.restFrom !== null)
+        return null;
+    const result = operation.result.representation;
+    if (result.kind === 'dynamic' || representationKey(result) !== representationKey(abi.result))
+        return null;
+    return nativeArgumentsMatch(abi, operation.arguments, conversions, 'native-transfer') ? abi : null;
+};

package/dist/ir/native-key-query.d.ts

@@ -0,0 +1,4 @@
+import type { Representation } from '../representation/model.js';
+import type { IrOperation } from './model.js';
+/** A native key/presence query reads metadata without publishing field values. */
+export declare const nativeKeyQueryOf: (operation: IrOperation, closedLayoutOf: (value: Representation) => boolean) => boolean;

package/dist/ir/native-key-query.js

@@ -0,0 +1,38 @@
+/** A native key/presence query reads metadata without publishing field values. */
+export const nativeKeyQueryOf = (operation, closedLayoutOf) => {
+    const closedReceiver = (value) => {
+        if (value.kind === 'optional')
+            return closedReceiver(value.payload);
+        if (value.kind === 'borrowed-ref')
+            return closedReceiver(value.referent);
+        if (value.kind === 'tagged-union')
+            return value.arms.length > 0 && value.arms.every((arm) => closedReceiver(arm.value));
+        // A proxy can execute a trap even when both its target and handler have
+        // native fixed layouts. Their layouts cannot prove this query harmless.
+        return value.kind !== 'proxy-object' && closedLayoutOf(value);
+    };
+    if (operation.kind === 'has-property') {
+        const key = operation.key.representation;
+        // Coercing an object-shaped key can execute user code independently of
+        // the receiver's presence protocol.
+        return (key.kind === 'string' || key.kind === 'symbol' || key.kind === 'scalar') && closedReceiver(operation.receiver.representation);
+    }
+    if (operation.kind === 'own-property-keys' || (operation.kind === 'get-iterator' && operation.protocol === 'enumerate'))
+        return closedReceiver(operation.receiver.representation);
+    if (operation.kind !== 'call' || !operation.intrinsicOwnKeys || operation.argumentsAreSpread)
+        return false;
+    const queried = operation.arguments[0]?.representation;
+    // Lowering authenticates this intrinsic. A same-shaped arbitrary callable
+    // has no such contract and must retain its ordinary call effects.
+    if (queried === undefined || !closedLayoutOf(queried))
+        return false;
+    // `Object.hasOwn(o, key)` is the one member of this family that takes a
+    // second argument -- the queried KEY, not a second object -- and
+    // `HasOwnProperty` runs `ToPropertyKey` on it (7.1.19) before ever
+    // consulting `o`'s own keys. An object-shaped key can execute arbitrary
+    // user code from that coercion alone, independently of whether `o`'s own
+    // layout is closed, so this asks the identical question `has-property`
+    // above already asks of its own key operand.
+    const key = operation.arguments[1]?.representation;
+    return key === undefined || key.kind === 'string' || key.kind === 'symbol' || key.kind === 'scalar';
+};

package/dist/ir/native-merge-transport.d.ts

@@ -0,0 +1,25 @@
+import type { ConversionNodeId } from '../conversion/algebra.js';
+import type { ConversionCensus } from '../conversion/nodes.js';
+import { type Representation } from '../representation/model.js';
+import type { MergeLiveArmRebuildOperation } from './model.js';
+export interface NativeMergeTransport {
+    readonly source: string;
+    readonly target: string;
+    readonly arms: readonly {
+        readonly index: number;
+        readonly conversion: ConversionNodeId;
+    }[];
+    readonly absence?: ConversionNodeId;
+}
+/**
+ * Select only total native steps; branch admission and the live-arm set remain
+ * lowering's facts. A live arm may land in a bare (non-sum) target too:
+ * `undefined | null | X` merged to `X` keeps `X` by identity and stores `null`
+ * as the empty shared handle -- the selection planner's own `null -> Ref`
+ * step, which the sum planner cannot state for a target that is not a sum.
+ */
+export declare const nativeMergeTransportOf: (source: Representation, target: Representation, liveArms: readonly number[], sourceAbsenceLive: boolean, conversions: ConversionCensus) => NativeMergeTransport | undefined;
+/** Validate the exact citations before certification or reflection can consume this contract. */
+export declare const nativeMergeTransportMatches: (operation: MergeLiveArmRebuildOperation, conversions: Pick<ConversionCensus, "nodeById">) => boolean;
+/** Avoiding reflection is weaker than retaining object identity: consume the actual selected payload proofs as well. */
+export declare const nativeMergePayloadTransportMatches: (operation: MergeLiveArmRebuildOperation, conversions: Pick<ConversionCensus, "nodeById">) => boolean;

package/dist/ir/native-merge-transport.js

@@ -0,0 +1,71 @@
+import { nativeSumPlan } from '../conversion/native-sum.js';
+import { nativeTotalSelectionStepOf } from '../conversion/native-selection.js';
+import { nativePayloadTransportMatches } from '../conversion/native-payload-transport.js';
+import { representationKey } from '../representation/model.js';
+/**
+ * Select only total native steps; branch admission and the live-arm set remain
+ * lowering's facts. A live arm may land in a bare (non-sum) target too:
+ * `undefined | null | X` merged to `X` keeps `X` by identity and stores `null`
+ * as the empty shared handle -- the selection planner's own `null -> Ref`
+ * step, which the sum planner cannot state for a target that is not a sum.
+ */
+export const nativeMergeTransportOf = (source, target, liveArms, sourceAbsenceLive, conversions) => {
+    const payload = source.kind === 'optional' ? source.payload : source;
+    if (payload.kind !== 'tagged-union' || liveArms.length === 0)
+        return undefined;
+    const carried = (from) => nativeSumPlan(from, target) !== null || nativeTotalSelectionStepOf(from, target) !== null;
+    const sources = liveArms.map((index) => payload.arms[index]?.value);
+    if (sources.some((arm) => !arm || !carried(arm)))
+        return undefined;
+    const absence = source.kind === 'optional' && sourceAbsenceLive ? { kind: source.absence } : null;
+    if (absence && !carried(absence))
+        return undefined;
+    return {
+        source: representationKey(source),
+        target: representationKey(target),
+        arms: liveArms.map((index) => ({ index, conversion: conversions.nodeFor(payload.arms[index].value, target).id })),
+        ...(absence ? { absence: conversions.nodeFor(absence, target).id } : {})
+    };
+};
+/** Validate the exact citations before certification or reflection can consume this contract. */
+export const nativeMergeTransportMatches = (operation, conversions) => {
+    const recipe = operation.nativeTransport;
+    const source = operation.source.representation;
+    const payload = source.kind === 'optional' ? source.payload : source;
+    if (!recipe ||
+        payload.kind !== 'tagged-union' ||
+        recipe.source !== representationKey(source) ||
+        recipe.target !== representationKey(operation.result.representation) ||
+        recipe.arms.length === 0 ||
+        recipe.arms.length !== operation.liveArms.length)
+        return false;
+    const matches = (id, from) => {
+        const node = conversions.nodeById(id);
+        if (!node || representationKey(node.source) !== representationKey(from) || representationKey(node.target) !== recipe.target)
+            return false;
+        const capability = node.capability;
+        return (capability.kind === 'identity' ||
+            ((capability.kind === 'atom' || capability.kind === 'static' || capability.kind === 'class-family') &&
+                capability.materializer.nativeFieldProtocol === 'unused'));
+    };
+    if (!recipe.arms.every((arm, ordinal) => arm.index === operation.liveArms[ordinal] &&
+        payload.arms[arm.index] !== undefined &&
+        matches(arm.conversion, payload.arms[arm.index].value)))
+        return false;
+    const needsAbsence = source.kind === 'optional' && operation.sourceAbsenceLive;
+    return needsAbsence ? recipe.absence !== undefined && matches(recipe.absence, { kind: source.absence }) : recipe.absence === undefined;
+};
+/** Avoiding reflection is weaker than retaining object identity: consume the actual selected payload proofs as well. */
+export const nativeMergePayloadTransportMatches = (operation, conversions) => {
+    if (!nativeMergeTransportMatches(operation, conversions))
+        return false;
+    const recipe = operation.nativeTransport;
+    const source = operation.source.representation;
+    const payload = source.kind === 'optional' ? source.payload : source;
+    if (payload.kind !== 'tagged-union')
+        return false;
+    const target = operation.result.representation;
+    return (recipe.arms.every((arm) => nativePayloadTransportMatches(payload.arms[arm.index].value, target, conversions.nodeById(arm.conversion))) &&
+        (recipe.absence === undefined ||
+            (source.kind === 'optional' && nativePayloadTransportMatches({ kind: source.absence }, target, conversions.nodeById(recipe.absence)))));
+};

package/dist/ir/native-record-index-transport.d.ts

@@ -0,0 +1,11 @@
+import type { RepresentationDeriver } from '../representation/derive.js';
+import { type Representation } from '../representation/model.js';
+import { type ConversionCensus } from '../conversion/nodes.js';
+import type { IrOperation } from './model.js';
+/** Runtime identity/numeric keys on a native shared record can use its
+ * generated property-presence protocol without reflecting fixed payloads. */
+export declare const nativeRecordIndexHasPropertyOf: (deriver: RepresentationDeriver, receiver: Representation, key: Representation) => boolean;
+/** A disjoint typed index never selects a fixed-field protocol. The installed
+ * value conversion must independently prove native payload transport; a key
+ * domain proof alone says nothing about an adapting or dynamic value. */
+export declare const nativeRecordIndexTransportOf: (operation: IrOperation, deriver: RepresentationDeriver | null, conversions: Pick<ConversionCensus, "nodeById"> | undefined, constantKey: string | null) => boolean;

package/dist/ir/native-record-index-transport.js

@@ -0,0 +1,34 @@
+import { representationKey } from '../representation/model.js';
+import { conversionNodeIdOf } from '../conversion/nodes.js';
+import { nativePayloadTransportMatches } from '../conversion/native-payload-transport.js';
+import { disjointNativeRecordIndexOf, nativeRecordIndexReadCarrierOf } from './native-record-index.js';
+/** Runtime identity/numeric keys on a native shared record can use its
+ * generated property-presence protocol without reflecting fixed payloads. */
+export const nativeRecordIndexHasPropertyOf = (deriver, receiver, key) => 'ownership' in receiver &&
+    receiver.ownership === 'shared-refcount' &&
+    (key.kind === 'symbol' || (key.kind === 'scalar' && key.domain === 'number')) &&
+    disjointNativeRecordIndexOf(deriver, receiver, key) !== null;
+/** A disjoint typed index never selects a fixed-field protocol. The installed
+ * value conversion must independently prove native payload transport; a key
+ * domain proof alone says nothing about an adapting or dynamic value. */
+export const nativeRecordIndexTransportOf = (operation, deriver, conversions, constantKey) => {
+    if (!deriver ||
+        (operation.kind !== 'get' &&
+            operation.kind !== 'set' &&
+            operation.kind !== 'define-own-property' &&
+            operation.kind !== 'delete' &&
+            operation.kind !== 'has-property'))
+        return false;
+    const index = disjointNativeRecordIndexOf(deriver, operation.receiver.representation, operation.key.representation, constantKey ?? undefined);
+    if (!index)
+        return false;
+    if (operation.kind === 'delete' || operation.kind === 'has-property')
+        return true;
+    const source = operation.kind === 'get' ? nativeRecordIndexReadCarrierOf(index, operation.result.representation) : operation.value.representation;
+    const target = operation.kind === 'get' ? operation.result.representation : index.value;
+    const native = (value) => value.kind !== 'dynamic' && value.kind !== 'unresolved';
+    return (native(source) &&
+        native(target) &&
+        (representationKey(source) === representationKey(target) ||
+            nativePayloadTransportMatches(source, target, conversions?.nodeById(conversionNodeIdOf(source, target)))));
+};

package/dist/ir/native-record-index.d.ts

@@ -0,0 +1,12 @@
+import type { RepresentationDeriver } from '../representation/derive.js';
+import { type RecordIndexKey, type RecordIndexSidecar, type Representation } from '../representation/model.js';
+/** Whether a native index domain can select a fixed slot. Symbol identities
+ * never alias string keys; numeric indexes use canonical Number::toString. */
+export declare const recordIndexDomainContainsKey: (domain: RecordIndexKey, key: string) => boolean;
+/** A typed sidecar whose key cannot alias any fixed field. Both transport
+ * emission and protocol demand consume this proof; absence remains an entry
+ * lookup fact, not an implicit promise that the key exists. */
+export declare const disjointNativeRecordIndexOf: (deriver: RepresentationDeriver, receiver: Representation, key: Representation, constantText?: string) => RecordIndexSidecar | null;
+/** An erased read recovering undefined must test entry presence before reading
+ * the native slot. Keep that lookup carrier shared with reflection demand. */
+export declare const nativeRecordIndexReadCarrierOf: (index: RecordIndexSidecar, result: Representation) => Representation;

package/dist/ir/native-record-index.js

@@ -0,0 +1,27 @@
+import { isCanonicalNumberPropertyKeyText, recordIndexForKeyCarrier } from '../representation/model.js';
+import { symbolPropertyKeyDeclarationOf } from '../semantics/model/structural-types.js';
+/** Whether a native index domain can select a fixed slot. Symbol identities
+ * never alias string keys; numeric indexes use canonical Number::toString. */
+export const recordIndexDomainContainsKey = (domain, key) => {
+    const symbol = symbolPropertyKeyDeclarationOf(key) !== null;
+    return domain === 'symbol' ? symbol : !symbol && (domain === 'string' || isCanonicalNumberPropertyKeyText(key));
+};
+/** A typed sidecar whose key cannot alias any fixed field. Both transport
+ * emission and protocol demand consume this proof; absence remains an entry
+ * lookup fact, not an implicit promise that the key exists. */
+export const disjointNativeRecordIndexOf = (deriver, receiver, key, constantText) => {
+    const layout = receiver.kind === 'native-record-ref' && receiver.native === null ? deriver.layoutOf(receiver.shapeId) : receiver;
+    if (layout.kind !== 'record-with-index')
+        return null;
+    const index = recordIndexForKeyCarrier(layout.indexes, key, constantText);
+    return index && layout.fields.every((field) => !recordIndexDomainContainsKey(index.key, field.key)) ? index : null;
+};
+/** An erased read recovering undefined must test entry presence before reading
+ * the native slot. Keep that lookup carrier shared with reflection demand. */
+export const nativeRecordIndexReadCarrierOf = (index, result) => {
+    if (result.kind !== 'optional' || result.absence !== 'undefined')
+        return index.value;
+    if (index.value.kind === 'optional' && index.value.absence === 'undefined')
+        return index.value;
+    return { kind: 'optional', payload: index.value, absence: 'undefined' };
+};

package/dist/ir/native-reflect-field.d.ts

@@ -0,0 +1,5 @@
+import type { RecordField } from '../representation/model.js';
+import type { RepresentationDeriver } from '../representation/derive.js';
+import type { CallOperation } from './model.js';
+/** Exact native field transport shared by Reflect emission and protocol demand. */
+export declare const nativeReflectFieldTransportOf: (operation: CallOperation, field: RecordField | null, deriver?: RepresentationDeriver | null) => "native-read" | "native-write" | null;

package/dist/ir/native-reflect-field.js

@@ -0,0 +1,33 @@
+import { representationKey } from '../representation/model.js';
+import { recordFieldsOfShape } from '../projection/fields.js';
+/** Exact native field transport shared by Reflect emission and protocol demand. */
+export const nativeReflectFieldTransportOf = (operation, field, deriver = null) => {
+    if (!field || field.value.kind === 'dynamic' || operation.argumentsAreSpread)
+        return null;
+    if (operation.intrinsicReflection === 'getOwnPropertyDescriptor' && operation.result) {
+        const result = operation.result.representation;
+        const descriptor = result.kind === 'optional' ? result.payload : result;
+        const fields = descriptor.kind === 'record' || descriptor.kind === 'record-with-index'
+            ? descriptor.fields
+            : descriptor.kind === 'native-record-ref' && deriver
+                ? recordFieldsOfShape(deriver, descriptor.shapeId)
+                : null;
+        const value = fields?.find((item) => item.key === 'value');
+        // A descriptor reports absence separately from its typed value. Unlike
+        // Reflect.get, deleting the source field does not force its value through
+        // a dynamic carrier or require the field to be permanently present.
+        if (value && representationKey(value.value) === representationKey(field.value))
+            return 'native-read';
+        return null;
+    }
+    if (!field.required)
+        return null;
+    if (operation.intrinsicReflection === 'get' &&
+        operation.result &&
+        representationKey(operation.result.representation) === representationKey(field.value))
+        return 'native-read';
+    const written = operation.arguments[2];
+    if (operation.intrinsicReflection === 'set' && written && representationKey(written.representation) === representationKey(field.value))
+        return 'native-write';
+    return null;
+};

package/dist/ir/native-sequence-transport.d.ts

@@ -0,0 +1,7 @@
+import type { IrOperation } from './model.js';
+/** The sequence/generator distinction is published by representation/publish.ts.
+ * A sequence advances native storage; a generator can execute arbitrary code.
+ * This is an effect query shared by provenance and reflection, not an admission
+ * rule: lowering and certification still validate the complete cursor recipe.
+ */
+export declare const nativeSequenceTransportOf: (operation: IrOperation) => boolean;