@geastack/compiler 1.0.15

package/dist/projection/callee.js

@@ -0,0 +1,444 @@
+import { narrowedOperandView } from '../conversion/operand-view.js';
+import { abiKey } from '../representation/model.js';
+import { hostMemberOf } from '../targets/cpp/host/host-members.js';
+import { classMemberOf, classMethodOverrideOf, classStaticMemberOf } from './fields.js';
+import { callableBuiltinIsUnshadowed, callableMutationFactsOf } from '../semantics/callable-origins.js';
+import { operandOf, resultOf } from '../semantics/model/operands.js';
+/**
+ * What a callee carrier says about the frame a call fills.
+ *
+ * These queries are asked twice in the pipeline -- once when a call lowers
+ * (`ir/lower-invocation.ts`) and once when the slot census states which
+ * carrier each argument must arrive in (`projection/slots.ts`). They live
+ * here, below both, so the two cannot drift: a lowering that packed
+ * arguments against one reading of a callee and a census that checked them
+ * against another would be two authorities over one convention.
+ */
+/** The convention a callable carrier states, or `null` for a carrier that states none. */
+export const abiOfCallee = (representation) => {
+    switch (representation.kind) {
+        case 'function':
+        case 'function-family':
+        case 'function-value-family':
+        case 'function-value-dispatch':
+        case 'constructor-family':
+        case 'constructor-value-dispatch':
+            return representation.abi;
+        case 'function-and-constructor':
+            return representation.call;
+        default:
+            return null;
+    }
+};
+/**
+ * The `[[Construct]]` convention a callee carries, which is the frame
+ * `super(...)` and `new` fill.
+ *
+ * Distinct from `abiOfCallee` for exactly one carrier: a value that is both
+ * callable and constructible states two conventions, and a construction fills
+ * the constructing one. Reusing `abiOfCallee` there would pack the arguments
+ * against a `[[Call]]` signature the base's initialization never reads.
+ */
+export const constructAbiOfCallee = (representation) => {
+    if (representation.kind === 'function-and-constructor')
+        return representation.construct;
+    return abiOfCallee(representation);
+};
+/**
+ * The convention a method VALUE carries when a receiver-less slot takes it:
+ * the source states a receiver and the slot states the identical convention
+ * without one. Such a value is bound to the object it was read from before it
+ * enters the slot (`ir/lower-operands.ts`'s `enter`, minting a detached
+ * `bind-callable`); `null` for any other pair.
+ */
+export const detachedMethodAbiOf = (source, target) => {
+    const from = abiOfCallee(source);
+    const to = abiOfCallee(target);
+    if (from === null || to === null || from.receiver === null || to.receiver !== null)
+        return null;
+    return abiKey({ ...from, receiver: null }) === abiKey(to) ? from : null;
+};
+/**
+ * Whether a rest slot's carrier is a fixed-arity tuple: a record whose keys
+ * are exactly `0..n-1` in order. Such a rest slot is filled field by field,
+ * never by a runtime-sized array.
+ */
+export const isClosedContiguousTupleRecord = (representation) => representation.kind === 'record' &&
+    representation.accessors.length === 0 &&
+    representation.fields.length > 0 &&
+    representation.fields.every((field, index) => field.key === String(index));
+/**
+ * The value a body's `return` hands back, given the convention's own result:
+ * the payload of an async function's promise, the completion of a generator's
+ * cursor, and otherwise the result itself.
+ */
+export const returnPayloadOf = (result) => result.kind === 'promise' ? result.value : result.kind === 'iterator' ? result.completion : result;
+/**
+ * The source function a method read as a VALUE names: `host.readFile` read
+ * off a class instance, or `Host.create` off its constructor, is the member
+ * declaration's own body -- provenance `callableOriginsOf` cannot carry,
+ * since it follows allocations and the cells that alias them, and a method
+ * is never allocated. `null` for a read that is not that: a computed key, a
+ * receiver that is no class, a member that is a field or an accessor, or a
+ * value whose convention states no receiver (a bound callable, an arrow
+ * field), which the read cannot have produced from a method body.
+ *
+ * Asked by the property lowering, which records the receiver a method value
+ * must be bound to (`LoweringProgram.methodValueReceivers`), and by the
+ * `Function.prototype.bind` rewrite below, which binds the same body.
+ */
+export const methodValueOriginOf = (classes, receiver, key, representation) => {
+    if (abiOfCallee(representation)?.receiver === null)
+        return null;
+    const isStatic = receiver.kind === 'constructor-family';
+    const declarations = receiver.kind === 'class-ref' ? [receiver.declaration] : isStatic ? receiver.members : [];
+    for (const declaration of declarations) {
+        if (!isStatic && classMethodOverrideOf(classes, declaration, key))
+            return null;
+        const site = isStatic ? classStaticMemberOf(classes, declaration, key) : classMemberOf(classes, declaration, key);
+        if (site?.kind === 'method' && site.method.callable)
+            return site.method.callable;
+    }
+    return null;
+};
+/** `methodValueOriginOf` for a property read operation, from the carriers the plan selected. */
+const methodValueOriginOfRead = (input, producer) => {
+    if (producer.family !== 'property' || producer.internalMethod !== 'get' || producer.keyIsComputed)
+        return null;
+    const key = operandOf(producer, 'key');
+    const receiver = operandOf(producer, 'receiver');
+    const value = resultOf(producer, 'value');
+    if (!key || key.source.kind !== 'constant' || !receiver || receiver.source.kind !== 'result' || !value)
+        return null;
+    const held = input.plan.selected.get(receiver.source.result);
+    const read = input.plan.selected.get(value.id);
+    return held && read ? methodValueOriginOf(input.classes, held, key.source.text, read) : null;
+};
+const callAbiOfCallableReceiver = (representation) => {
+    switch (representation.kind) {
+        case 'function':
+        case 'function-family':
+        case 'function-value-family':
+        case 'function-value-dispatch':
+            return representation.abi;
+        case 'function-and-constructor':
+            return representation.call;
+        default:
+            return null;
+    }
+};
+const bindAbiOfCallableReceiver = (representation) => {
+    switch (representation.kind) {
+        case 'function':
+        case 'function-family':
+        case 'function-value-family':
+        case 'function-value-dispatch':
+            return representation.abi;
+        default:
+            return null;
+    }
+};
+const memberNames = ['call', 'apply', 'bind'];
+export const deferredCalleeOf = (input, operation) => {
+    if (operation.internalMethod !== 'call' || operation.optionalChain)
+        return null;
+    const callee = operandOf(operation, 'callee');
+    if (!callee || callee.source.kind !== 'result')
+        return null;
+    const producerId = input.graph.results.get(callee.source.result);
+    const producer = producerId === undefined ? undefined : input.graph.operations.get(producerId);
+    if (!producer || producer.family !== 'property' || producer.internalMethod !== 'get' || producer.keyIsComputed)
+        return null;
+    const key = operandOf(producer, 'key');
+    if (!key || key.source.kind !== 'constant')
+        return null;
+    const keyText = key.source.text;
+    const member = memberNames.find((name) => name === keyText);
+    if (!member)
+        return null;
+    const receiver = operandOf(producer, 'receiver');
+    if (!receiver || receiver.source.kind !== 'result')
+        return null;
+    const representation = input.plan.selected.get(receiver.source.result);
+    if (!representation)
+        return null;
+    const receiverProducerId = input.graph.results.get(receiver.source.result);
+    const receiverProducer = receiverProducerId === undefined ? undefined : input.graph.operations.get(receiverProducerId);
+    const functionId = input.callableOrigins.get(receiver.source.result) ?? (receiverProducer ? methodValueOriginOfRead(input, receiverProducer) : null);
+    const facts = callableMutationFactsOf(input.graph, input.plan, input.callableOrigins);
+    if (!callableBuiltinIsUnshadowed(facts, functionId, member))
+        return null;
+    // Read off the receiver's own carrier, which is what decides how the call
+    // renders -- see `DeferredCallee.frame`.
+    const frame = representation.kind === 'dynamic' ? 'boxed' : 'native';
+    if (member === 'bind') {
+        // `functionId` names the checker-authenticated DECLARATION a `dynamic`
+        // receiver's own-property facts are read off -- needed only to recover a
+        // boxed Function's native ABI (`emit-callable.ts`'s `bindCallable`, the
+        // `operation.source.representation.kind === 'dynamic'` branch). A
+        // `function-value-dispatch` receiver already carries its own physical
+        // ABI on the representation itself and needs no such lookup: a bind
+        // chained off ANOTHER bind's result (`bound.bind(...)`) has no known
+        // origin -- `callableOriginsOf` traces identity through ordinary
+        // allocations and bindings, never through a prior `.bind()` -- and
+        // unconditionally refusing for `functionId === null` bailed out of the
+        // native fast path for exactly that non-dynamic, well-typed case, onto
+        // an ordinary property-read whose STATIC checker type (`.bind`'s own
+        // generic signature, `thisArg: T` inferred from the call's actual
+        // argument) is a completely different, wrong convention for calling the
+        // already-typed receiver directly.
+        const abi = representation.kind === 'dynamic'
+            ? functionId !== null && !input.constructs.has(functionId)
+                ? (input.abis.get(functionId) ?? null)
+                : null
+            : bindAbiOfCallableReceiver(representation);
+        return abi ? { member, receiver, abi, functionId, frame, receiverCarrier: representation } : null;
+    }
+    if (functionId === null && representation.kind !== 'function-value-dispatch')
+        return null;
+    const abi = representation.kind === 'dynamic' && functionId !== null
+        ? (input.abis.get(functionId) ?? null)
+        : callAbiOfCallableReceiver(representation);
+    return abi ? { member, receiver, abi, functionId, frame, receiverCarrier: representation } : null;
+};
+/**
+ * `hasOwnProperty`/`propertyIsEnumerable` reached as instance methods off a
+ * known-shape receiver (`record`/`class-ref`/a `native-record-ref` naming no
+ * native type) -- the two ambient `Object.prototype` members the C++
+ * backend's object-shape protocol (`targets/cpp/host/object-protocol.ts`'s
+ * `objectShapePrototypeMemberRead`) claims regardless of the receiver's own
+ * layout: the GET renders nothing and the CALL fuses receiver, key and field
+ * list into one expression, never going through `Object.prototype`'s
+ * declared `(v: PropertyKey) => boolean` convention. `calleeRenderingOf`
+ * below is the ONE authority for whether a call renders from a template or a
+ * convention, so it states this claim too, rather than leaving the printer
+ * as a second, silent authority the census cannot see: a census that let
+ * this call's ABI apply would convert a literal string key into the
+ * `PropertyKey` tagged union, which `objectShapeCallText` explicitly refuses.
+ */
+export const objectShapePrototypeMethods = new Set(['hasOwnProperty', 'propertyIsEnumerable']);
+/** A direct read of a host callable whose numeric rest frame need not escape to an array. */
+export const numericRestHostCallOf = (input, operation) => {
+    if (operation.internalMethod !== 'call' || operation.optionalChain || !input.hostMembers)
+        return null;
+    const callee = operandOf(operation, 'callee');
+    if (callee?.source.kind !== 'result')
+        return null;
+    const producerId = input.graph.results.get(callee.source.result);
+    const producer = producerId === undefined ? undefined : input.graph.operations.get(producerId);
+    if (producer?.family !== 'property' || producer.internalMethod !== 'get' || producer.keyIsComputed)
+        return null;
+    const receiver = operandOf(producer, 'receiver');
+    const key = operandOf(producer, 'key');
+    if (receiver?.source.kind !== 'result' || key?.source.kind !== 'constant')
+        return null;
+    const held = input.plan.selected.get(receiver.source.result);
+    if (held?.kind !== 'native-handle')
+        return null;
+    const protocol = held.native ?? held.protocol;
+    const member = key.source.text;
+    const host = hostMemberOf(input.hostMembers, protocol, member);
+    return host?.kind === 'property' && host.numericRestCall !== undefined ? { protocol, member } : null;
+};
+/**
+ * Declarations written exactly once, from a direct read of a host METHOD --
+ * `var __isArray = Array.isArray`, the shape test262's propertyHelper and any
+ * program guarding a later monkey-patch names a builtin through.
+ *
+ * `targets/cpp/host/host-method-aliases.ts` proves the identical fact, but
+ * over the LOWERED ir, for the printer to fold a read of the cell back into a
+ * bare host-member name. `calleeRenderingOf` needs the same fact one stage
+ * earlier, over the semantic graph and its sealed plan -- before lowering
+ * builds a call's argument `convert`s -- because a call through such a cell
+ * renders as a host call-site template exactly like `Array.isArray(v)`
+ * itself, and a template's arguments enter their OWN carrier
+ * (`invocationSlot`'s `host-overload`), never the `dynamic` an ordinary
+ * callable's declared-`any` formal would otherwise ask the census for. Both
+ * live on the sealed plan, which is why this can answer without waiting for
+ * a lowered body: a `native-handle` receiver and a host member table are
+ * exactly what the plan and `hosts.members` already state.
+ */
+export const hostMethodAliasDeclarations = (graph, plan, deriver, hostMembers) => {
+    const methodReads = new Set();
+    for (const operation of graph.operations.values()) {
+        if (operation.family !== 'property' || operation.internalMethod !== 'get' || operation.keyIsComputed)
+            continue;
+        const key = operandOf(operation, 'key');
+        if (!key || key.source.kind !== 'constant')
+            continue;
+        const receiver = operandOf(operation, 'receiver');
+        if (!receiver)
+            continue;
+        const held = receiver.source.kind === 'result'
+            ? (plan.selected.get(receiver.source.result) ?? null)
+            : receiver.source.kind === 'constant'
+                ? deriver.derive(receiver.type)
+                : null;
+        if (held === null)
+            continue;
+        const view = narrowedOperandView(held, receiver, deriver);
+        const carrier = view.kind === 'borrowed-ref' ? view.referent : view;
+        if (carrier.kind !== 'native-handle')
+            continue;
+        const protocol = carrier.native ?? carrier.protocol;
+        if (hostMemberOf(hostMembers, protocol, key.source.text)?.kind !== 'method')
+            continue;
+        const result = resultOf(operation, 'value');
+        if (result)
+            methodReads.add(result.id);
+    }
+    const writeCounts = new Map();
+    const written = new Set();
+    for (const operation of graph.operations.values()) {
+        if (operation.family !== 'binding' || (operation.action !== 'write' && operation.action !== 'initialize'))
+            continue;
+        writeCounts.set(operation.declaration, (writeCounts.get(operation.declaration) ?? 0) + 1);
+        // `var x = Array.isArray` publishes an `initialize` whose operand is the
+        // `initializer`; a later `x = ...` is a `write` of a `value`.
+        const value = operandOf(operation, 'initializer') ?? operandOf(operation, 'value');
+        if (value?.source.kind === 'result' && methodReads.has(value.source.result))
+            written.add(operation.declaration);
+    }
+    const aliases = new Set();
+    for (const declaration of written)
+        if (writeCounts.get(declaration) === 1)
+            aliases.add(declaration);
+    return aliases;
+};
+const templateReceiverKinds = new Set([
+    'native-handle',
+    'string',
+    'scalar',
+    'array-object',
+    'typed-array',
+    'keyed-collection',
+    'promise',
+    'iterator',
+    'dictionary',
+    'array-buffer',
+    'shared-array-buffer',
+    'data-view',
+    'dense-buffer',
+    'native-sequence',
+    'proxy-object',
+    'dynamic',
+    'optional',
+    'tagged-union',
+    'symbol'
+]);
+export const calleeRenderingOf = (input, operation) => {
+    // `Object.keys`/`getOwnPropertyNames`/`getOwnPropertySymbols`/`Reflect.ownKeys`
+    // are already checker-authenticated above this call
+    // (`intrinsic-property-call.ts`'s `intrinsicPropertyCallOf`, gated on
+    // standard-library provenance for both the owner and the member, with no
+    // global host-mutation taint) -- `operation.intrinsicOwnKeys` IS that
+    // authentication, not a guess about this callee's shape. Without this, the
+    // generic receiver-kind walk below has to answer for the OWNER of the
+    // property read (`Object`/`Reflect` itself) rather than the call's real
+    // subject, and neither read as a `template` receiver: the ambient
+    // `ObjectConstructor`/`Reflect` singleton is never given a `native-handle`
+    // tag the way `Math`/`Date`/`JSON` are (`host-protocols.ts` binds those by a
+    // plugin-supplied native-protocol table; `Object`'s own statics are answered
+    // by this backend's dedicated `[[OwnPropertyKeys]]` primitives in
+    // `targets/cpp/host/object-protocol.ts` instead, which never registers a
+    // handle tag for the receiver `Object` itself). Falling through to
+    // `'callable'` published the intrinsic's *declared* `(o: object) => string[]`
+    // ABI as the call's convention, whose vacuous `object` parameter this
+    // program models soundly on its own (an empty `record`, per
+    // `representation/derive.ts`'s `deriveObject`) but which the generic
+    // argument-conversion path cannot honor without erasing the real argument's
+    // type to match it -- exactly the "intrinsic accepts any object, so the
+    // argument becomes dynamic" defect this authentication exists to prevent.
+    // `lower-invocation.ts` already licenses `intrinsicOwnKeys` through to the
+    // IR ONLY when this function answers `'template'`
+    // (`operation.intrinsicOwnKeys && calleeRenderingOf(...) === 'template'`) --
+    // so answering it here, directly from the same authenticated fact, closes
+    // the license this function was always supposed to grant instead of gating
+    // it behind a receiver classification that was never going to recognize it.
+    if (operation.intrinsicOwnKeys)
+        return 'template';
+    // `Object.defineProperty` on a closed data descriptor is the same shape of
+    // authenticated fact, one call later: `intrinsic-data-definition.ts`'s
+    // `intrinsicDataDefinitionTargetOf` (consumed by `producers/invocations.ts`
+    // as `operation.intrinsicDataDefinition`, alongside the host-mutation
+    // census's own `operation.intrinsicMutation === 'object-define-property'`)
+    // has ALREADY proven the receiver is not published by this call and the
+    // descriptor names only `value`/`writable`/`enumerable`/`configurable`.
+    // `lower-invocation.ts`'s `fixedDataDefinition` is written to consume
+    // exactly that pair through `fixedDataDefinitionRecipeOf`, gated on this
+    // function answering `'template'` -- but nothing here ever did, so every
+    // authenticated call still fell through to the generic receiver-kind walk
+    // below. `Object` itself is not a `native-handle` (same reason
+    // `intrinsicOwnKeys` names above), so it answered `'callable'`, publishing
+    // `defineProperty`'s OWN ambient `(o, p, attributes: PropertyDescriptor &
+    // ThisType<any>) => any` signature as the call's ABI -- `PropertyDescriptor`
+    // types `value` as `any`, so THAT declared signature, not the literal
+    // descriptor each call site actually writes, became the carrier: three's
+    // `Object3D` constructor defines `position`/`rotation`/`quaternion`/`scale`
+    // this way, and every one of those `Object.defineProperty` call sites
+    // selected a `dynamic` `.value` field for a descriptor whose own literal
+    // states a concrete `Vector3`/`Euler`/`Quaternion`. Answering `'template'`
+    // here closes the same license `intrinsicOwnKeys` closes above, from the
+    // same authenticated fact, instead of a receiver classification that was
+    // never going to recognize `Object` as one either.
+    if (operation.intrinsicMutation === 'object-define-property' && operation.intrinsicDataDefinition === true)
+        return 'template';
+    const callee = operandOf(operation, 'callee');
+    if (!callee)
+        return 'callable';
+    if (callee.source.kind === 'parameter' || callee.source.kind === 'constant')
+        return 'callable';
+    if (callee.source.kind !== 'result')
+        return 'callable';
+    const producerId = input.graph.results.get(callee.source.result);
+    const producer = producerId === undefined ? undefined : input.graph.operations.get(producerId);
+    if (!producer)
+        return 'callable';
+    if (producer.family === 'binding' && producer.action === 'read') {
+        // A host FUNCTION is called through the convention its declaration
+        // states -- the printer's host-function path fills that frame with
+        // `argumentText` like any callable -- so its arguments have slots. A
+        // host class, singleton or namespace read is a member path the printer
+        // spells from a template.
+        const storage = input.placements.get(producer.declaration)?.storage.kind;
+        if (storage === 'host-class' || storage === 'host-singleton' || storage === 'host-namespace')
+            return 'template';
+        // A cell that holds one host METHOD forever (`var __isArray =
+        // Array.isArray`) is the same template shape one indirection later --
+        // see `hostMethodAliasDeclarations`.
+        return input.hostMethodAliasDeclarations.has(producer.declaration) ? 'template' : 'callable';
+    }
+    if (producer.family !== 'property' || producer.internalMethod !== 'get')
+        return 'callable';
+    if (producer.hostMethod !== undefined)
+        return 'template';
+    const receiver = operandOf(producer, 'receiver');
+    if (!receiver)
+        return 'callable';
+    const held = receiver.source.kind === 'result'
+        ? (input.plan.selected.get(receiver.source.result) ?? null)
+        : receiver.source.kind === 'constant'
+            ? input.deriver.derive(receiver.type)
+            : null;
+    if (held === null)
+        return 'template';
+    const view = narrowedOperandView(held, receiver, input.deriver);
+    // A receiver with no storage (`undefined`/`null`, the carrier of a branch
+    // flow analysis proved dead) registers no template read at all, so the
+    // printer falls through to the callable path and the ABI's slots apply.
+    const carrier = view.kind === 'borrowed-ref' ? view.referent : view;
+    // `hasOwnProperty`/`propertyIsEnumerable` off a shape the object-shape
+    // protocol claims (see `objectShapePrototypeMethods`'s own comment) render
+    // from a template no matter which of those shapes the receiver is, ahead
+    // of the general per-kind answer below -- a `record`/`class-ref` is not in
+    // `templateReceiverKinds` at all (its OTHER members are real ABI calls),
+    // and a `native-record-ref` naming no native type answers 'callable' next.
+    const key = operandOf(producer, 'key');
+    const staticKey = key?.source.kind === 'constant' ? key.source.text : null;
+    const knownObjectShape = carrier.kind === 'record' || carrier.kind === 'class-ref' || (carrier.kind === 'native-record-ref' && carrier.native === null);
+    if (staticKey !== null && knownObjectShape && objectShapePrototypeMethods.has(staticKey))
+        return 'template';
+    if (carrier.kind === 'native-record-ref')
+        return carrier.native === null ? 'callable' : 'template';
+    return templateReceiverKinds.has(carrier.kind) ? 'template' : 'callable';
+};

package/dist/projection/class-property-presence.d.ts

@@ -0,0 +1,28 @@
+import type { DeclarationId } from '../identity/ids.js';
+import type { ClassLayout } from './classes.js';
+/** A member installed on the native class prototype or an inherited prototype.
+ * This proves presence only. Missing names still require runtime lookup.
+ */
+export declare const classPrototypeMemberIsPresent: (classes: ReadonlyMap<DeclarationId, ClassLayout>, declaration: DeclarationId, key: string) => boolean;
+/**
+ * Whether a SYMBOL key could name a member this carrier's own layout declares
+ * -- a symbol-keyed field, accessor or prototype method, on the shape itself or
+ * anywhere up a class's base chain.
+ *
+ * It exists so `k in o` can be answered for a key that is a symbol VALUE rather
+ * than a name the program spelled. A compiler-owned object with shared identity
+ * carries a dynamic-property sidecar that answers own-key membership for any
+ * runtime key, symbols included, and a symbol cannot reach an inherited
+ * STRING-named member the way an arbitrary string can -- the two key spaces are
+ * physically disjoint here (`types.ts`'s `sym(<declaration>)` marker). So when
+ * this answers `false`, the sidecar is not merely one source of the answer: it
+ * is the WHOLE answer, and `in` over that receiver is exactly its verdict.
+ *
+ * When it answers `true`, the layout owns a symbol-keyed slot with its own
+ * presence bit that the sidecar knows nothing about, and which of the two holds
+ * the key is undecidable without knowing WHICH symbol -- so the site refuses by
+ * name instead, rather than consulting one half and calling it the answer.
+ */
+export declare const symbolKeyedMemberIsDeclared: (classes: ReadonlyMap<DeclarationId, ClassLayout>, fields: readonly {
+    readonly key: string;
+}[] | null, declaration: DeclarationId | null) => boolean;

package/dist/projection/class-property-presence.js

@@ -0,0 +1,58 @@
+import { symbolPropertyKeyDeclarationOf } from '../semantics/model/structural-types.js';
+/** A member installed on the native class prototype or an inherited prototype.
+ * This proves presence only. Missing names still require runtime lookup.
+ */
+export const classPrototypeMemberIsPresent = (classes, declaration, key) => {
+    const seen = new Set();
+    let current = declaration;
+    while (current && !seen.has(current)) {
+        seen.add(current);
+        const layout = classes.get(current);
+        if (!layout)
+            return false;
+        if (layout.methods.some((method) => method.key === key && method.callable !== null) ||
+            layout.accessors.some((accessor) => accessor.key === key && (accessor.getter !== null || accessor.setter !== null)))
+            return true;
+        current = layout.base;
+    }
+    return false;
+};
+/**
+ * Whether a SYMBOL key could name a member this carrier's own layout declares
+ * -- a symbol-keyed field, accessor or prototype method, on the shape itself or
+ * anywhere up a class's base chain.
+ *
+ * It exists so `k in o` can be answered for a key that is a symbol VALUE rather
+ * than a name the program spelled. A compiler-owned object with shared identity
+ * carries a dynamic-property sidecar that answers own-key membership for any
+ * runtime key, symbols included, and a symbol cannot reach an inherited
+ * STRING-named member the way an arbitrary string can -- the two key spaces are
+ * physically disjoint here (`types.ts`'s `sym(<declaration>)` marker). So when
+ * this answers `false`, the sidecar is not merely one source of the answer: it
+ * is the WHOLE answer, and `in` over that receiver is exactly its verdict.
+ *
+ * When it answers `true`, the layout owns a symbol-keyed slot with its own
+ * presence bit that the sidecar knows nothing about, and which of the two holds
+ * the key is undecidable without knowing WHICH symbol -- so the site refuses by
+ * name instead, rather than consulting one half and calling it the answer.
+ */
+export const symbolKeyedMemberIsDeclared = (classes, fields, declaration) => {
+    const isSymbolKey = (entry) => symbolPropertyKeyDeclarationOf(entry.key) !== null;
+    if (fields !== null && fields.some(isSymbolKey))
+        return true;
+    const seen = new Set();
+    let current = declaration;
+    while (current && !seen.has(current)) {
+        seen.add(current);
+        const layout = classes.get(current);
+        if (!layout)
+            return true;
+        if (layout.fields.some(isSymbolKey) ||
+            layout.methods.some(isSymbolKey) ||
+            layout.accessors.some(isSymbolKey) ||
+            (layout.methodOverrides ?? []).some(isSymbolKey))
+            return true;
+        current = layout.base;
+    }
+    return false;
+};

package/dist/projection/class-prototype.d.ts

@@ -0,0 +1,5 @@
+import type { DeclarationId } from '../identity/ids.js';
+import { type Representation } from '../representation/model.js';
+import type { ClassLayout } from './classes.js';
+/** Native, method-only prototype identity reads do not expose instance fields. */
+export declare const classPrototypeReadOf: (classes: ReadonlyMap<DeclarationId, ClassLayout>, receiver: Representation, key: string, value: Representation) => ClassLayout | null;

package/dist/projection/class-prototype.js

@@ -0,0 +1,23 @@
+import { representationKey } from '../representation/model.js';
+/** Native, method-only prototype identity reads do not expose instance fields. */
+export const classPrototypeReadOf = (classes, receiver, key, value) => {
+    if (key !== 'prototype' || receiver.kind !== 'constructor-family' || receiver.members.length !== 1 || value.kind !== 'class-ref')
+        return null;
+    const layout = classes.get(receiver.members[0]);
+    if (!layout ||
+        layout.instance?.kind !== 'class-ref' ||
+        layout.prototypeUnsupportedUses?.length ||
+        representationKey(layout.instance) !== representationKey(value))
+        return null;
+    const seen = new Set();
+    for (let declaration = layout.declaration; declaration !== null;) {
+        if (seen.has(declaration))
+            return null;
+        seen.add(declaration);
+        const ancestor = classes.get(declaration);
+        if (!ancestor || ancestor.nativeBase !== null)
+            return null;
+        declaration = ancestor.base;
+    }
+    return layout;
+};

package/dist/projection/class-storage.d.ts

@@ -0,0 +1,26 @@
+import type { DeclarationId, OperationId } from '../identity/ids.js';
+import type { RepresentationDeriver } from '../representation/derive.js';
+import { type RecordField } from '../representation/model.js';
+import type { SealedRepresentationPlan } from '../representation/plan.js';
+import type { SemanticGraph } from '../semantics/model/graph.js';
+import type { ClassLayout } from './classes.js';
+import type { SlotCensus } from './slots.js';
+/** Physical slots are separate from the flattened checker view and overlay evidence. */
+export interface NativeClassStorage {
+    readonly fields: readonly RecordField[];
+    readonly omittedOverlays: readonly string[];
+}
+/**
+ * Keep an overlay until every native access through that ancestor has a
+ * descendant-storage dispatch path. An unused overlay needs no such bridge.
+ * Runtime-key accesses use the object's own-property protocol. That protocol
+ * dispatches on the concrete instance and needs its real fields, not a copy
+ * of every possible descendant field in an ancestor.
+ */
+export declare const nativeClassFieldUsesOf: (graph: SemanticGraph, plan: SealedRepresentationPlan, deriver: RepresentationDeriver, classes: ReadonlyMap<DeclarationId, ClassLayout>, slots: SlotCensus, ownerDispatchedReads?: ReadonlySet<OperationId>) => ReadonlyMap<DeclarationId, ReadonlySet<string>>;
+/**
+ * Real inherited properties keep one slot. Synthetic fields without a native
+ * ancestor access are removed; real descendant declarations then own their
+ * own storage. Unclassified shape members retain the existing layout.
+ */
+export declare const projectNativeClassStorage: (classes: ReadonlyMap<DeclarationId, ClassLayout>, deriver: RepresentationDeriver, uses: ReadonlyMap<DeclarationId, ReadonlySet<string>>) => ReadonlyMap<DeclarationId, NativeClassStorage>;