behavior-contracts 0.8.5 → 0.8.6

package/dist/generator/emit-typed-native-rust.js

@@ -20,25 +20,71 @@ function rustErr(code, msgExpr) {
  * fail closed with ZERO bc-runtime import. Codes match run_behavior verbatim (byte-equal). `code()` /
  * `failure_code()` expose the stable code without a bc-runtime type. */
 function emitBehaviorErrorType() {
-    return `// BehaviorError — the LOCAL concrete failure type for the covered read plane (runtime-free): a
+    return `// ErrorKind — what went wrong (the closed set of scp-error.md). A concrete enum: the covered plane
+// carries no strings-as-tags and no dynamic kind lookup.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ErrorKind {
+    TypeMismatch,
+    MissingField,
+    Overflow,
+}
+
+impl ErrorKind {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            ErrorKind::TypeMismatch => "typeMismatch",
+            ErrorKind::MissingField => "missingField",
+            ErrorKind::Overflow => "overflow",
+        }
+    }
+}
+
+// ErrorDetail — the structured, recoverable payload a failure carries (scp-error.md "The Error
+// Value"). The LEAF produces it at the wire boundary (it is the only party holding both the declared
+// type and the raw wire datum); the runner transports it verbatim. Concrete fields — no boxed Value,
+// no serialized blob in a string: \`expected_type\` is Portable Type Notation, a rendering of a
+// STATICALLY DECLARED type, so nothing walks a type at runtime.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct ErrorDetail {
+    pub kind: Option<ErrorKind>,
+    pub model: Option<String>,
+    pub field: Option<String>,
+    pub expected_type: Option<String>,
+    pub actual_wire_type: Option<String>,
+    pub raw_value: Option<String>,
+    pub context: std::collections::BTreeMap<String, String>,
+}
+
+// BehaviorError — the LOCAL concrete failure type for the covered read plane (runtime-free): a
 // covered runner returns \`Result<T, BehaviorError>\` over THIS local type instead of a bc-runtime
 // failure, so the fully-covered module imports ZERO bc runtime. Codes match run_behavior verbatim
-// (byte-equal). The observe companion (test glue, a super:: submodule) bridges this local error to the
-// bc-runtime BehaviorError at the observe boundary — the covered module itself stays runtime-free.
+// (byte-equal). \`detail\` carries the leaf's structured Error Value across the seam so a caller can
+// log / skip / repair / migrate rather than parse a message. The observe companion (test glue, a
+// super:: submodule) bridges this local error to the bc-runtime failure at the observe boundary —
+// the covered module itself stays runtime-free.
 #[derive(Debug, Clone)]
 pub struct BehaviorError {
     pub code: String,
     pub message: String,
+    pub detail: Option<Box<ErrorDetail>>,
 }
 
 impl BehaviorError {
     pub fn new(code: impl Into<String>, message: impl Into<String>) -> Self {
-        BehaviorError { code: code.into(), message: message.into() }
+        BehaviorError { code: code.into(), message: message.into(), detail: None }
+    }
+    /// The same failure carrying the leaf's structured Error Value.
+    pub fn with_detail(code: impl Into<String>, message: impl Into<String>, detail: ErrorDetail) -> Self {
+        BehaviorError { code: code.into(), message: message.into(), detail: Some(Box::new(detail)) }
     }
     /// The stable failure code (byte-equal to run_behavior) WITHOUT a bc-runtime type.
     pub fn code(&self) -> &str {
         &self.code
     }
+    /// The structured payload, if this failure is about a datum.
+    pub fn detail(&self) -> Option<&ErrorDetail> {
+        self.detail.as_deref()
+    }
 }
 
 impl std::fmt::Display for BehaviorError {
@@ -46,7 +92,75 @@ impl std::fmt::Display for BehaviorError {
         write!(f, "{}: {}", self.code, self.message)
     }
 }
-impl std::error::Error for BehaviorError {}`;
+impl std::error::Error for BehaviorError {}
+
+// op_failed — wrap a leaf failure as the node's Failure under its Error Policy Kind, carrying the
+// leaf's structured detail through unchanged (the runner transports the Error Value; it does not
+// synthesize or re-interpret it).
+#[allow(dead_code)]
+fn op_failed(node: &str, policy: &str, e: BehaviorError) -> BehaviorError {
+    BehaviorError {
+        code: "OP_FAILED".to_string(),
+        message: format!("operation '{node}' failed under '{policy}' policy: {}", e.message),
+        detail: e.detail,
+    }
+}
+
+// de_type_mismatch / de_missing_field / de_overflow — the de-box mismatch failures the generated decode
+// produces (scp-error.md "The Error Value"). Codes are byte-equal to the runtime outType check
+// (TYPE_MISMATCH / MISSING_PROP) so the covered read stays equivalent to run_behavior; detail.kind
+// distinguishes typeMismatch / missingField / overflow.
+#[allow(dead_code)]
+fn de_type_mismatch(model: &str, field: &str, expected: &str, actual_wire: String, raw: String) -> BehaviorError {
+    BehaviorError::with_detail(
+        "TYPE_MISMATCH",
+        format!("node '{model}': {field}: expected {expected}, got {actual_wire}"),
+        ErrorDetail {
+            kind: Some(ErrorKind::TypeMismatch),
+            model: Some(model.to_string()),
+            field: Some(field.to_string()),
+            expected_type: Some(expected.to_string()),
+            actual_wire_type: Some(actual_wire),
+            raw_value: Some(raw),
+            context: std::collections::BTreeMap::new(),
+        },
+    )
+}
+
+#[allow(dead_code)]
+fn de_missing_field(model: &str, field: &str, expected: &str) -> BehaviorError {
+    BehaviorError::with_detail(
+        "MISSING_PROP",
+        format!("node '{model}': {field}: required field is absent"),
+        ErrorDetail {
+            kind: Some(ErrorKind::MissingField),
+            model: Some(model.to_string()),
+            field: Some(field.to_string()),
+            expected_type: Some(expected.to_string()),
+            actual_wire_type: None,
+            raw_value: None,
+            context: std::collections::BTreeMap::new(),
+        },
+    )
+}
+
+#[allow(dead_code)]
+fn de_overflow(model: &str, field: &str, expected: &str, actual_wire: String, raw: String) -> BehaviorError {
+    let message = format!("node '{model}': {field}: {raw} is outside the range of {expected}");
+    BehaviorError::with_detail(
+        "TYPE_MISMATCH",
+        message,
+        ErrorDetail {
+            kind: Some(ErrorKind::Overflow),
+            model: Some(model.to_string()),
+            field: Some(field.to_string()),
+            expected_type: Some(expected.to_string()),
+            actual_wire_type: Some(actual_wire),
+            raw_value: Some(raw),
+            context: std::collections::BTreeMap::new(),
+        },
+    )
+}`;
 }
 function portFieldName(wire) {
     const safe = wire.replace(/[^A-Za-z0-9_]/g, "_").toLowerCase();
@@ -78,6 +192,431 @@ function nodeMethodName(nodeId) {
 function inStructName(compName) {
     return `InNR${pascal(compName)}`;
 }
+function recordTop(ref) {
+    if (ref.kind === "named")
+        return { kind: "named", innerName: ref.name };
+    if (ref.kind === "arr" && ref.elem.kind === "named")
+        return { kind: "arr", innerName: ref.elem.name };
+    if (ref.kind === "opt" && ref.inner.kind === "named")
+        return { kind: "opt", innerName: ref.inner.name };
+    if (ref.kind === "map" && ref.value.kind === "named")
+        return { kind: "map", innerName: ref.value.name };
+    return null;
+}
+/** deBoxEligible — a componentRef node whose result is a record-containing top (named / arr(named) /
+ * opt(named) / map(named)). Its handler returns the wire; the generated decode probes each record. */
+function deBoxEligible(ref) {
+    return recordTop(ref) !== null;
+}
+/** rustWireTypeForTop — the Rust handler return type (over the associated Self::Wire) for a record top. */
+function rustWireTypeForTop(top) {
+    switch (top.kind) {
+        case "named":
+            return "Self::Wire";
+        case "arr":
+            return "Vec<Self::Wire>";
+        case "opt":
+            return "Option<Self::Wire>";
+        case "map":
+            return "std::collections::BTreeMap<String, Self::Wire>";
+    }
+}
+/** notationOfRef — the Portable Type Notation of a TypeRef (scp-error.md), resolving a named ref to its
+ * obj notation via the plan. Baked as the `expectedType` literal (a rendering of the STATICALLY declared
+ * type — nothing walks a type at runtime). */
+function notationOfRef(ref, plan) {
+    switch (ref.kind) {
+        case "scalar":
+            return ref.scalar;
+        case "opt":
+            return `opt(${notationOfRef(ref.inner, plan)})`;
+        case "arr":
+            return `arr(${notationOfRef(ref.elem, plan)})`;
+        case "map":
+            return `map(${notationOfRef(ref.value, plan)})`;
+        case "named": {
+            const decl = findDecl(plan, ref.name);
+            return `obj{${decl.fields.map((f) => `${f.name}:${notationOfRef(f.type, plan)}`).join(",")}}`;
+        }
+    }
+}
+/** emitRustProbeWireTypes — the once-per-module probe enums + WireRow/WireList seam traits. Concrete
+ * enums; monomorphized traits (mutual Row/List associated types keep nesting concrete, no dyn/Box). */
+function emitRustProbeWireTypes() {
+    return `// Probe<T> / NumProbe — the outcome of classifying one wire attribute against a declared type. Got carries
+// the matched value (a NumProbe's raw numeric text, which the de-box parses + range-checks so overflow is
+// BC's to detect); actual_wire_type is the producer's own wire tag (a free string, e.g. a DynamoDB
+// "S"/"N"/"BOOL"); raw_value is the offending value stringified. Concrete enums — no boxed Value.
+pub enum Probe<T> {
+    Got(T),
+    Wrong { actual_wire_type: String, raw_value: String },
+    Null { actual_wire_type: String, raw_value: String },
+    Absent,
+}
+
+pub enum NumProbe {
+    Got { raw: String, actual_wire_type: String },
+    Wrong { actual_wire_type: String, raw_value: String },
+    Null { actual_wire_type: String, raw_value: String },
+    Absent,
+}
+
+// WireRow / WireList — the consumer's wire item / wire array, probed per declared field / element by the
+// generated de-box. The consumer implements them over its wire payload (a DynamoDB AttributeValue map)
+// and classifies each attribute's variant; the de-box owns strictness. Monomorphized (Row/List mutual
+// associated types) — no dyn, no Box, no boxed Value crosses the seam.
+pub trait WireRow: Sized {
+    type List: WireList<Row = Self>;
+    // the attribute keys present (the entries of a wire map / DynamoDB "M") — iterated to decode a map(V).
+    fn keys(&self) -> Vec<String>;
+    fn probe_string(&self, field: &str) -> Probe<String>;
+    fn probe_number(&self, field: &str) -> NumProbe;
+    fn probe_bool(&self, field: &str) -> Probe<bool>;
+    fn probe_row(&self, field: &str) -> Probe<Self>;
+    fn probe_list(&self, field: &str) -> Probe<Self::List>;
+}
+
+pub trait WireList: Sized {
+    type Row: WireRow<List = Self>;
+    fn len(&self) -> usize;
+    fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+    fn elem_string(&self, i: usize) -> Probe<String>;
+    fn elem_number(&self, i: usize) -> NumProbe;
+    fn elem_bool(&self, i: usize) -> Probe<bool>;
+    fn elem_row(&self, i: usize) -> Probe<Self::Row>;
+    fn elem_list(&self, i: usize) -> Probe<Self>;
+}`;
+}
+/** rustDecodeNamedName — the decode function name for a named type (deduped across the module). */
+function rustDecodeNamedName(name) {
+    return `decode_wire_${name.replace(/[^A-Za-z0-9_]/g, "_").toLowerCase()}`;
+}
+/**
+ * emitRustDecodeNamed — emit (once, deduped) `decode_wire_<name><W: WireRow>(w: &W) -> Result<Name,
+ * BehaviorError>`: probe each declared field from the type SSoT (via the single rustDecodeValue
+ * recursion) and build the struct, failing closed with the structured Error Value on a mismatch.
+ */
+function emitRustDecodeNamed(name, plan, emitted, out) {
+    const fn = rustDecodeNamedName(name);
+    if (emitted.has(fn))
+        return fn;
+    emitted.add(fn);
+    const decl = findDecl(plan, name);
+    const lines = [];
+    lines.push(`// ${fn} — the strict de-box for '${name}': probe each declared field, fail closed on a`);
+    lines.push(`// wire mismatch with the structured Error Value (byte-equal codes to run_behavior).`);
+    lines.push(`fn ${fn}<W: WireRow>(w: &W) -> Result<${name}, BehaviorError> {`);
+    const ctr = { n: 0 };
+    const binds = [];
+    for (const f of decl.fields) {
+        const rf = rustFieldName(f.name);
+        const expr = rustDecodeValue(f.type, "w", rustStrLit(f.name), "row", name, f.name, plan, emitted, out, ctr, 1);
+        lines.push(`    let ${rf} = ${expr};`);
+        binds.push(rf);
+    }
+    lines.push(`    Ok(${name} { ${binds.join(", ")} })`);
+    lines.push(`}`);
+    out.push(lines.join("\n"));
+    return fn;
+}
+/**
+ * rustDecodeValue — the SINGLE recursive decode over the full TypeRef grammar (scalar / opt(scalar) /
+ * named / arr / map). Returns a Rust expression (a match block) that evaluates to the decoded value of
+ * `ref`, obtained by probing `srcExpr` at `keyExpr` (a WireRow field via `probe_*`, srcKind "row"; or a
+ * WireList element via `elem_*`, srcKind "list"). Every nested position (arr element, map value, obj
+ * field) recurses through THIS function, so arbitrary nesting works by construction. A mismatch does
+ * `return Err(<structured error>)`; no panic, no boxed value.
+ */
+function rustDecodeValue(ref, srcExpr, keyExpr, srcKind, model, fieldRaw, plan, emitted, out, ctr, indent) {
+    const I = "    ".repeat(indent);
+    const I1 = "    ".repeat(indent + 1);
+    const ml = rustStrLit(model);
+    const fl = rustStrLit(fieldRaw);
+    const nl = rustStrLit(notationOfRef(ref, plan));
+    const id = ctr.n++;
+    const prefix = srcKind === "row" ? "probe_" : "elem_";
+    const mismatch = `return Err(de_type_mismatch(${ml}, ${fl}, ${nl}, actual_wire_type, raw_value))`;
+    const missing = `return Err(de_missing_field(${ml}, ${fl}, ${nl}))`;
+    if (ref.kind === "opt" && ref.inner.kind === "scalar" && ref.inner.scalar !== "null") {
+        const inner = ref.inner.scalar;
+        if (inner === "int" || inner === "float") {
+            const rustT = inner === "int" ? "i64" : "f64";
+            return `match ${srcExpr}.${prefix}number(${keyExpr}) {
+${I1}NumProbe::Got { raw, actual_wire_type } => match raw.parse::<${rustT}>() {
+${I1}    Ok(n) => Some(n),
+${I1}    Err(_) => return Err(de_overflow(${ml}, ${fl}, ${nl}, actual_wire_type, raw)),
+${I1}},
+${I1}NumProbe::Wrong { actual_wire_type, raw_value } => ${mismatch},
+${I1}NumProbe::Null { .. } | NumProbe::Absent => None,
+${I}}`;
+        }
+        const meth = inner === "string" ? "string" : "bool";
+        return `match ${srcExpr}.${prefix}${meth}(${keyExpr}) {
+${I1}Probe::Got(v) => Some(v),
+${I1}Probe::Wrong { actual_wire_type, raw_value } => ${mismatch},
+${I1}Probe::Null { .. } | Probe::Absent => None,
+${I}}`;
+    }
+    if (ref.kind === "scalar" && ref.scalar !== "null") {
+        if (ref.scalar === "int" || ref.scalar === "float") {
+            const rustT = ref.scalar === "int" ? "i64" : "f64";
+            return `match ${srcExpr}.${prefix}number(${keyExpr}) {
+${I1}NumProbe::Got { raw, actual_wire_type } => match raw.parse::<${rustT}>() {
+${I1}    Ok(n) => n,
+${I1}    Err(_) => return Err(de_overflow(${ml}, ${fl}, ${nl}, actual_wire_type, raw)),
+${I1}},
+${I1}NumProbe::Wrong { actual_wire_type, raw_value }
+${I1}| NumProbe::Null { actual_wire_type, raw_value } => ${mismatch},
+${I1}NumProbe::Absent => ${missing},
+${I}}`;
+        }
+        const meth = ref.scalar === "string" ? "string" : "bool";
+        return `match ${srcExpr}.${prefix}${meth}(${keyExpr}) {
+${I1}Probe::Got(v) => v,
+${I1}Probe::Wrong { actual_wire_type, raw_value }
+${I1}| Probe::Null { actual_wire_type, raw_value } => ${mismatch},
+${I1}Probe::Absent => ${missing},
+${I}}`;
+    }
+    if (ref.kind === "named") {
+        const dec = emitRustDecodeNamed(ref.name, plan, emitted, out);
+        const rowMeth = srcKind === "row" ? "probe_row" : "elem_row";
+        return `match ${srcExpr}.${rowMeth}(${keyExpr}) {
+${I1}Probe::Got(sub) => ${dec}(&sub)?,
+${I1}Probe::Wrong { actual_wire_type, raw_value }
+${I1}| Probe::Null { actual_wire_type, raw_value } => ${mismatch},
+${I1}Probe::Absent => ${missing},
+${I}}`;
+    }
+    if (ref.kind === "arr") {
+        const listMeth = srcKind === "row" ? "probe_list" : "elem_list";
+        const elemExpr = rustDecodeValue(ref.elem, `l${id}`, `i${id}`, "list", model, fieldRaw, plan, emitted, out, ctr, indent + 2);
+        return `match ${srcExpr}.${listMeth}(${keyExpr}) {
+${I1}Probe::Got(l${id}) => {
+${I1}    let mut acc = Vec::with_capacity(l${id}.len());
+${I1}    for i${id} in 0..l${id}.len() {
+${I1}        acc.push(${elemExpr});
+${I1}    }
+${I1}    acc
+${I1}}
+${I1}Probe::Wrong { actual_wire_type, raw_value }
+${I1}| Probe::Null { actual_wire_type, raw_value } => ${mismatch},
+${I1}Probe::Absent => ${missing},
+${I}}`;
+    }
+    if (ref.kind === "map") {
+        // a declared map(V): the wire value is a producer map (a DynamoDB "M"); enumerate its keys and decode
+        // each value as V through THIS same recursion (so map-of-map / map-of-arr nest by construction).
+        const rowMeth = srcKind === "row" ? "probe_row" : "elem_row";
+        const valExpr = rustDecodeValue(ref.value, `m${id}`, `&k${id}`, "row", model, fieldRaw, plan, emitted, out, ctr, indent + 2);
+        return `match ${srcExpr}.${rowMeth}(${keyExpr}) {
+${I1}Probe::Got(m${id}) => {
+${I1}    let mut acc = std::collections::BTreeMap::new();
+${I1}    for k${id} in m${id}.keys() {
+${I1}        let v${id} = ${valExpr};
+${I1}        acc.insert(k${id}, v${id});
+${I1}    }
+${I1}    acc
+${I1}}
+${I1}Probe::Wrong { actual_wire_type, raw_value }
+${I1}| Probe::Null { actual_wire_type, raw_value } => ${mismatch},
+${I1}Probe::Absent => ${missing},
+${I}}`;
+    }
+    throw new GeneratorFailure("UNSUPPORTED_NODE_STRAIGHTLINE", `rust strict de-box: '${fieldRaw}' of '${model}' has type ${JSON.stringify(ref)} which the generated de-box does not decode (supported: scalar / opt(scalar) / named / arr / map).`);
+}
+/** rustDecodeElemName — the element de-box function name for a map/fanout node. */
+function rustDecodeElemName(compName, nodeId) {
+    return `decode_wire_elem_${sanitize(compName)}_${nodeId.replace(/[^A-Za-z0-9_]/g, "_").toLowerCase()}`;
+}
+/** mapFanoutElemRef — the element ROW TypeRef a map/fanout node decodes (the per-element record). */
+function mapFanoutElemRef(node, typedNodes, plan) {
+    const ref = typedNodes.get(node.id);
+    if ("fanout" in node)
+        return fanoutItemsElemRef(node, ref, plan);
+    return mapElemRowRef(node, ref, plan);
+}
+/** mapFanoutElemDeBoxEligible — a map/fanout node whose element ROW is a named record de-boxes each
+ * element through the generated decode_wire_elem_* (closing the scan-row silent-default hole). */
+function mapFanoutElemDeBoxEligible(node, typedNodes, plan) {
+    return mapFanoutElemRef(node, typedNodes, plan).kind === "named";
+}
+/**
+ * emitRustDecodeElemRow — emit (once) `decode_wire_elem_<comp>_<node><W: WireRow>(w: &W) ->
+ * Result<RawElemNR<comp><node>, BehaviorError>` for a map/fanout node whose element ROW is a named
+ * record: probe each declared field via the SAME rustDecodeValue recursion as record reads and build the
+ * concrete RawElemNR struct, failing closed with the structured Error Value on a mismatch.
+ */
+function emitRustDecodeElemRow(comp, node, elemRowRef, plan, emitted, out) {
+    const nodeId = node.id;
+    const fn = rustDecodeElemName(comp.name, nodeId);
+    if (emitted.has(fn))
+        return fn;
+    emitted.add(fn);
+    const retType = rawElemStructName(comp.name, nodeId);
+    const decl = findDecl(plan, elemRowRef.name);
+    const lines = [];
+    lines.push(`// ${fn} — the strict de-box for a '${nodeId}' element row: probe each declared field, fail`);
+    lines.push(`// closed on a wire mismatch with the structured Error Value (byte-equal codes to run_behavior).`);
+    lines.push(`fn ${fn}<W: WireRow>(w: &W) -> Result<${retType}, BehaviorError> {`);
+    const ctr = { n: 0 };
+    const binds = [];
+    for (const f of decl.fields) {
+        const rf = rustFieldName(f.name);
+        const expr = rustDecodeValue(f.type, "w", rustStrLit(f.name), "row", elemRowRef.name, f.name, plan, emitted, out, ctr, 1);
+        lines.push(`    let ${rf} = ${expr};`);
+        binds.push(rf);
+    }
+    lines.push(`    Ok(${retType} { ${binds.join(", ")} })`);
+    lines.push(`}`);
+    out.push(lines.join("\n"));
+    return fn;
+}
+/** emitRustNodeDecodeFns — emit the decode functions for every de-box-eligible node: a componentRef
+ * record read (decode_wire_<name>) OR a map/fanout element row (decode_wire_elem_<comp>_<node>). */
+/** rustDecodeResultName — the top-result decode function name for a de-box componentRef node. */
+function rustDecodeResultName(compName, nodeId) {
+    return `decode_wire_result_${sanitize(compName)}_${nodeId.replace(/[^A-Za-z0-9_]/g, "_").toLowerCase()}`;
+}
+/**
+ * emitRustDecodeWireResult — emit (once) `decode_wire_result_<comp>_<node><W: WireRow>(wire: <WireArg>)
+ * -> Result<<ResultType>, BehaviorError>` for a componentRef node whose result is a record-containing
+ * top: it decodes each record via decode_wire_<name> and assembles the top (record / Vec / Option /
+ * BTreeMap). One path covers named / arr(named) / opt(named) / map(named).
+ */
+function emitRustDecodeWireResult(comp, node, ref, plan, emitted, out) {
+    const top = recordTop(ref);
+    const fn = rustDecodeResultName(comp.name, node.id);
+    if (emitted.has(fn))
+        return fn;
+    emitted.add(fn);
+    const innerDecode = emitRustDecodeNamed(top.innerName, plan, emitted, out);
+    const resultType = renderTypeRef(ref);
+    const lines = [];
+    lines.push(`// ${fn} — decode the node's record-containing '${top.kind}' result from the wire (each record`);
+    lines.push(`// via ${innerDecode}); a de-box mismatch fails closed with the structured Error Value.`);
+    switch (top.kind) {
+        case "named":
+            lines.push(`fn ${fn}<W: WireRow>(wire: W) -> Result<${resultType}, BehaviorError> {`);
+            lines.push(`    ${innerDecode}(&wire)`);
+            break;
+        case "arr":
+            lines.push(`fn ${fn}<W: WireRow>(wire: Vec<W>) -> Result<${resultType}, BehaviorError> {`);
+            lines.push(`    let mut out = Vec::with_capacity(wire.len());`);
+            lines.push(`    for w in wire {`);
+            lines.push(`        out.push(${innerDecode}(&w)?);`);
+            lines.push(`    }`);
+            lines.push(`    Ok(out)`);
+            break;
+        case "opt":
+            lines.push(`fn ${fn}<W: WireRow>(wire: Option<W>) -> Result<${resultType}, BehaviorError> {`);
+            lines.push(`    match wire {`);
+            lines.push(`        Some(w) => Ok(Some(${innerDecode}(&w)?)),`);
+            lines.push(`        None => Ok(None),`);
+            lines.push(`    }`);
+            break;
+        case "map":
+            lines.push(`fn ${fn}<W: WireRow>(wire: std::collections::BTreeMap<String, W>) -> Result<${resultType}, BehaviorError> {`);
+            lines.push(`    let mut out = std::collections::BTreeMap::new();`);
+            lines.push(`    for (k, w) in wire {`);
+            lines.push(`        out.insert(k, ${innerDecode}(&w)?);`);
+            lines.push(`    }`);
+            lines.push(`    Ok(out)`);
+            break;
+    }
+    lines.push(`}`);
+    out.push(lines.join("\n"));
+    return fn;
+}
+function emitRustNodeDecodeFns(comp, typedNodes, plan, emitted, out) {
+    for (const n of comp.body) {
+        if ("cond" in n)
+            continue;
+        if ("map" in n || "fanout" in n) {
+            const node = n;
+            if (!mapFanoutElemDeBoxEligible(node, typedNodes, plan))
+                continue;
+            emitRustDecodeElemRow(comp, node, mapFanoutElemRef(node, typedNodes, plan), plan, emitted, out);
+            continue;
+        }
+        const ref = typedNodes.get(n.id);
+        if (ref === undefined)
+            continue;
+        const top = recordTop(ref);
+        if (top === null)
+            continue;
+        // a NAMED top decodes in place via decode_wire_<name>; an arr/opt/map top assembles via
+        // decode_wire_result_* (which recurses into decode_wire_<name> per record).
+        if (top.kind === "named")
+            emitRustDecodeNamed(top.innerName, plan, emitted, out);
+        else
+            emitRustDecodeWireResult(comp, n, ref, plan, emitted, out);
+    }
+}
+/** containsNamed — whether a TypeRef transitively contains a named record (through arr / opt / map). */
+function containsNamed(ref) {
+    switch (ref.kind) {
+        case "scalar":
+            return false;
+        case "named":
+            return true;
+        case "opt":
+            return containsNamed(ref.inner);
+        case "arr":
+            return containsNamed(ref.elem);
+        case "map":
+            return containsNamed(ref.value);
+    }
+}
+/**
+ * assertDeBoxableResults — fail closed (never a silent trust) for a covered node whose de-boxable result
+ * is a NON-named top (arr / opt / map) that transitively contains a record: the generated de-box decodes
+ * records only under a NAMED top (decode_wire_* / decode_wire_elem_*), so a record inside a non-named top
+ * would be materialized on the trusting `.val` path and silently default its wire fields. That is the
+ * silent-default red line forbids, so it is a loud generation-time error (native-codegen-standard
+ * §2). A NAMED top (de-boxed) or a pure-scalar non-named top (no records to de-box) is fine.
+ */
+/** readsAPriorNode — a componentRef node is a DATAFLOW consumer iff at least one input port is a ref
+ * headed by a PRIOR BODY NODE (it reads a prior node's already-native result, #129), rather than a fresh
+ * external wire read whose ports come from input params / static / an element ($as) binding. Same
+ * head-is-a-body-node signal priorNodeArrElemInfo (#129) uses to lower a prior-node array feed. */
+function readsAPriorNode(node, typedNodes) {
+    for (const expr of Object.values(node.ports ?? {})) {
+        const e = classifyExpr(expr);
+        if (e.kind === "ref" && e.path.length >= 1 && typedNodes.has(e.path[0]))
+            return true;
+    }
+    return false;
+}
+function assertDeBoxableResults(comp, typedNodes, plan) {
+    for (const n of comp.body) {
+        if ("cond" in n)
+            continue;
+        const isMapFanout = "map" in n || "fanout" in n;
+        const ref = isMapFanout ? mapFanoutElemRef(n, typedNodes, plan) : typedNodes.get(n.id);
+        const deBoxed = isMapFanout ? ref.kind === "named" : recordTop(ref) !== null;
+        if (deBoxed)
+            continue;
+        const nodeId = n.id;
+        if (containsNamed(ref)) {
+            throw new GeneratorFailure("UNSUPPORTED_NODE_STRAIGHTLINE", `rust strict de-box: node '${nodeId}' shape ${JSON.stringify(ref)} contains a record the de-box does not decode (a deeper nesting than a direct named / arr / opt / map of a named record). It would trust the record's wire fields (silent default) — the silent-default red line forbids. Fail closed: reshape so the record is a direct de-box top, or extend the recursion for this nesting.`);
+        }
+        // a map/fanout element is ALWAYS a per-element wire read; only a named record is de-boxed
+        // (decode_wire_elem_*). A scalar / scalar-collection element materializes from the trusting per-element
+        // path — a wrong wire value silent-defaults. Fail closed.
+        if (isMapFanout) {
+            throw new GeneratorFailure("UNSUPPORTED_NODE_STRAIGHTLINE", `rust strict de-box: map/fanout node '${nodeId}' element ${JSON.stringify(ref)} is a scalar / scalar-collection per-element wire read that materializes on the trusting typed path — a wrong wire value would silent-default (diverging from run_behavior's outType check). Fail closed: declare the element as a record (de-boxed).`);
+        }
+        // a pure-scalar / scalar-collection top on a HANDLER-BACKED componentRef wire read trusts the typed
+        // materialization (a wrong wire value silent-defaults). A DATAFLOW consumer (a port fed by a prior
+        // node) computes from already-native data and generates.
+        if (!readsAPriorNode(n, typedNodes)) {
+            throw new GeneratorFailure("UNSUPPORTED_NODE_STRAIGHTLINE", `rust strict de-box: node '${nodeId}' result top ${JSON.stringify(ref)} is a handler-backed scalar / scalar-collection read that materializes on the trusting typed path — a wrong wire value would silent-default (diverging from run_behavior's outType check). Fail closed: declare the result as a record (de-boxed) or feed it as dataflow from a prior node.`);
+        }
+    }
+}
 function staticArrElems(node) {
     if (node === null || typeof node !== "object" || Array.isArray(node))
         return null;
@@ -88,11 +627,60 @@ function staticArrElems(node) {
     return Array.isArray(arg) ? arg : null;
 }
 /**
- * portFieldRustType — the NATIVE Rust type for a covered port field (bc#90 / runtime-free), read off the
- * ONE port lowering (compilePortNode / native-expr). The covered ports struct carries NO `Value` field:
- * every port lowers to a concrete Rust type, and a port that cannot lower FAILS CLOSED. The field type is
- * the compiled expression's TypeRef, so it can never disagree with the initializer (emitPortInit), which
- * is the SAME lowering read for its value. `where` names the emission site for the error.
+ * portFieldRustType — the NATIVE Rust type for a covered port field (bc#90 / runtime-free). The covered
+ * ports struct carries NO `Value` field: every port lowers to a concrete Rust type.
+/** rustOwn — the ownership renderer native-expr applies at a resolved ref LEAF: an array field is cloned
+ * (owned) when `ownArrays` (a port) or borrowed (a cond `len`); a Copy scalar behind a guard is deref'd
+ * (unless a field was already accessed by value); anything else clones. */
+function rustOwn(guard, ownArrays) {
+    return (expr, ref, fieldAccessed) => {
+        if (ref.kind === "arr")
+            return ownArrays ? `${expr}.clone()` : expr;
+        if (typeRefIsCopy(ref))
+            return guard && !fieldAccessed ? `*${expr}` : expr;
+        return `${expr}.clone()`;
+    };
+}
+/** nativeResolveHead — the ONE ref-head resolver the runtime-free native-expr compiler reads (cond `if`/
+ * branches, a map/fanout `when` guard, AND a port). A head is a `$as` element binding, a prior body node's
+ * typed cell (behind a RefCell borrow guard), or an input port (a by-value struct field). #139: the input
+ * ref comes from the inputPortTypeRef SSoT so an OPTIONAL port resolves as `{opt:…}` (native Option<T>). */
+function nativeResolveHead(comp, plan, typedNodes, isPrior, opts) {
+    const ownArrays = opts?.ownArrays === true;
+    return (head) => {
+        if (opts?.asBinding !== undefined && opts.asBase !== undefined && head === opts.asBinding.name) {
+            return { expr: opts.asBase, ref: opts.asBinding.ref, own: rustOwn(true, ownArrays) };
+        }
+        if (isPrior(head)) {
+            const ref = typedNodes.get(head);
+            return { expr: `${typedCell(head)}.borrow()`, ref, own: rustOwn(true, ownArrays) };
+        }
+        const ref = inputPortTypeRef(comp.inputPorts?.[head], plan);
+        if (ref === undefined)
+            return null;
+        return { expr: `in_.${rustFieldName(head)}`, ref, own: rustOwn(false, ownArrays) };
+    };
+}
+/** compilePortNode — lower a port expression to its native ports-struct field via the runtime-free
+ * native-expr compiler: the ONE port lowering. The port's field TYPE is the compiled `ref`, its
+ * initializer the compiled `expr` — derived from a SINGLE lowering, so they cannot disagree. A port that
+ * cannot lower FAILS CLOSED; a FALLIBLE lowering (hoists statements) is returned as-is (only emitPortInit
+ * rejects it). Reuses the same nativeResolveHead cond/guard/port share, with `ownArrays` (a port owns). */
+function compilePortNode(node, comp, plan, typedNodes, isPrior, where, opts) {
+    const resolveHead = nativeResolveHead(comp, plan, typedNodes, isPrior, { ...opts, ownArrays: true });
+    try {
+        return new NativeExprCompiler(makeRustExprBackend(resolveHead, plan)).compilePort(node);
+    }
+    catch (e) {
+        if (!(e instanceof GeneratorFailure))
+            throw e;
+        throw new GeneratorFailure("UNSUPPORTED_NODE_STRAIGHTLINE", `rust typed-native (runtime-free): ${where} ${JSON.stringify(node)} does not lower to a native Rust value: ${e.message}`);
+    }
+}
+/**
+ * portFieldRustType — the NATIVE Rust type for a covered port field, read off the ONE port lowering
+ * (compilePortNode / native-expr). Field type = the compiled TypeRef, so it can never disagree with the
+ * initializer (emitPortInit), which reads the SAME lowering for its value. `where` names the site.
  */
 function portFieldRustType(node, comp, plan, typedNodes, where = "port", opts) {
     const c = compilePortNode(node, comp, plan, typedNodes, (h) => typedNodes.has(h), where, opts);
@@ -105,12 +693,17 @@ function portFieldRustType(node, comp, plan, typedNodes, where = "port", opts) {
  * reads `ports.f_<field>` DIRECTLY. The struct derives Clone (a bc#87 parallel stage clones it into the
  * per-worker dispatch). Every field is a NATIVE Rust type (bc#90 / runtime-free) — NO boxed `Value`.
  */
-function emitPortsStruct(comp, node, plan, typedNodes, asBinding) {
+function emitPortsStruct(comp, node, asBinding, plan, typedNodes) {
     const name = portsStructName(comp.name, node.id);
     const portNames = Object.keys(node.ports);
     if (portNames.length === 0) {
         return `// ${name} — native ports for node '${node.id}' (${node.component}); no ports.\n#[derive(Clone)]\npub struct ${name};`;
     }
+    // a node WITH ports always resolves through the one port lowering, which needs the type plan + the
+    // prior-node map (both are supplied by every caller — narrow the optional params for the fields below).
+    if (plan === undefined || typedNodes === undefined) {
+        throw new GeneratorFailure("UNSUPPORTED_NODE_STRAIGHTLINE", `rust typed-native: ports struct for node '${node.id}' needs a type plan + prior-node map`);
+    }
     const types = portNames.map((p) => portFieldRustType(node.ports[p], comp, plan, typedNodes, `port '${p}' of node '${node.id}'`, asBinding !== undefined ? { asBinding, asBase: asBinding.name } : undefined));
     const fields = portNames
         .map((p, i) => `    pub ${portFieldName(p)}: ${types[i]}, // ${JSON.stringify(p)}`)
@@ -135,7 +728,7 @@ function emitMapPortsStructs(comp, node, typedNodes, plan) {
     // #108: element ports may read the `$as` binding — resolve the over element type for native typing.
     const { elemRef } = mapOverElemInfo(comp, node, typedNodes, plan);
     const asBinding = { name: m.as, ref: elemRef, plan };
-    const elemStruct = emitPortsStruct(comp, { id: node.id, component: m.component, ports: m.ports }, plan, typedNodes, asBinding);
+    const elemStruct = emitPortsStruct(comp, { id: node.id, component: m.component, ports: m.ports }, asBinding, plan, typedNodes);
     return `${elemStruct}
 
 // ${batch} — CONCRETE batched ports for map '${node.id}': the Vec of per-element CONCRETE ports structs
@@ -153,7 +746,7 @@ function emitFanoutPortsStructs(comp, node, typedNodes, plan) {
     const batch = `${name}Batch`;
     const { elemRef } = fanoutOverElemInfo(comp, node, typedNodes, plan);
     const asBinding = { name: f.as, ref: elemRef, plan };
-    const elemStruct = emitPortsStruct(comp, { id: node.id, component: f.component, ports: f.ports }, plan, typedNodes, asBinding);
+    const elemStruct = emitPortsStruct(comp, { id: node.id, component: f.component, ports: f.ports }, asBinding, plan, typedNodes);
     return `${elemStruct}
 
 // ${batch} — CONCRETE batched ports for fanout '${node.id}': the Vec of per-id CONCRETE ports structs.
@@ -173,6 +766,20 @@ let rustExprTempSeq = 0;
 /** module-level accumulator: set when the native-expr compiler emits a fallible helper call (so emit()
  * bakes the helper library). Reset at the start of each emit(). */
 const rustExprUsed = { helpers: false };
+/** rustBlockBody — the body of a block-expression that runs `stmts` then yields `expr`. A trailing
+ * `let t = E; t` collapses to `E` (clippy `let_and_return`). */
+function rustBlockBody(stmts, expr) {
+    const last = stmts[stmts.length - 1];
+    const m = last !== undefined ? /^let\s+([A-Za-z0-9_]+)(?::\s*[^=]+)?\s*=\s*(.+);$/.exec(last) : null;
+    if (m !== null && m[1] === expr)
+        return [...stmts.slice(0, -1), m[2]].join(" ");
+    return [...stmts, rustStripOuterParens(expr)].join(" ");
+}
+/** Drop a TRAILING `.clone()` — for a position that only reads the value (a presence test), so an owning
+ * clone added by a head resolver is pure waste. Only a clone at the very END is dropped. */
+function rustStripTrailingClone(expr) {
+    return expr.endsWith(".clone()") ? expr.slice(0, -".clone()".length) : expr;
+}
 /** makeRustExprBackend — renders native-expr for Rust. `resolveHead` maps a ref head to an OWNED typed
  * base expr (a prior-node cell clone / an input field / a $as element). Sets rustExprUsed.helpers when
  * a fallible helper is emitted. The runner is Result<_, BehaviorError>, so hoistFallible uses `?`. */
@@ -216,47 +823,39 @@ function makeRustExprBackend(resolveHead, plan) {
         notOp: (a) => `(!${a})`,
         structLit: (name, inits) => `${name} { ${inits.map((i) => `${rustFieldName(i.field)}: ${i.expr}`).join(", ")} }`,
         arrLit: (elemTy, items) => `{ let __v: Vec<${elemTy}> = vec![${items.join(", ")}]; __v }`,
-        // a projection port of static string literals — bare `&'static str` literals, ZERO heap allocation
-        // (the field is `Vec<&'static str>`, so `vec!["a", "b"]` infers `&'static str` elements).
+        // a projection port of static string literals — `vec!["a", "b"]` infers `&'static str` (the field is
+        // Vec<&'static str>), ZERO heap allocation.
         staticStrArr: (literals) => ({ expr: `vec![${literals.map((s) => rustStrLit(s)).join(", ")}]`, type: "Vec<&'static str>" }),
-        // an opt (`Option<T>`) NONE literal. Annotate as `Option::<T>::None` so it type-infers in ANY
-        // position (a bare `None` can be ambiguous; the explicit turbofish keeps it a fully-typed value).
-        optNone: (innerTy) => `Option::<${innerTy}>::None`,
-        // opt (`Option<T>`) null-presence test: present = `expr.is_some()`, absent = `expr.is_none()`.
-        // A presence test only READS the discriminant, so an owning clone of the operand (which a head
-        // resolver adds so the value can be moved into a port) is dropped here — testing `Option<String>`
-        // must not heap-allocate. Mirrors the go twin's zero-cost `!= nil`.
-        optIsSome: (expr) => `${rustStripTrailingClone(expr)}.is_some()`,
-        optIsNone: (expr) => `${rustStripTrailingClone(expr)}.is_none()`,
-        // opt (`Option<T>`) defaulted to a PURE default — it cannot fail and has no effect, so its
-        // evaluation order is UNOBSERVABLE and both forms below are correct (a FALLIBLE default, where
-        // laziness IS observable, goes to optCoalesceGuard instead). `unwrap_or` is EAGER — fine for a plain
-        // literal/copy. A default that allocates (an owned `String`, a struct/vec literal) uses
-        // `unwrap_or_else`, whose closure defers the allocation to the absent branch: not a semantic
-        // requirement here, but pointless work otherwise — and what clippy `or_fun_call` asks for.
+        // opt (Option<T>) defaulted to a PURE default — eager unwrap_or for a plain copy/path, else the lazy
+        // unwrap_or_else closure (defers an allocating default to the absent branch; clippy or_fun_call).
         optUnwrapOr: (optExpr, defaultExpr, _innerTy) => /^[A-Za-z0-9_.:]+$/.test(defaultExpr) ? `${optExpr}.unwrap_or(${defaultExpr})` : `${optExpr}.unwrap_or_else(|| ${defaultExpr})`,
         // opt defaulted to a FALLIBLE default — a `match`, NOT a closure: the default's hoisted `?` early
-        // returns must propagate out of the ENCLOSING fn, which `unwrap_or_else`'s closure would swallow
-        // (it would try to return from the closure). Only the None arm evaluates the default.
+        // returns must propagate out of the ENCLOSING fn. Only the None arm evaluates the default.
         optCoalesceGuard: (temp, ty, optExpr, bindTemp, dStmts, dExpr) => [
             `let ${temp}: ${ty} = match ${optExpr} {`,
             `    Some(${bindTemp}) => ${bindTemp},`,
             `    None => { ${rustBlockBody(dStmts, dExpr)} }`,
             `};`,
         ],
+        // an opt (`Option<T>`) NONE literal. Annotate as `Option::<T>::None` so it type-infers in ANY
+        // position (a bare `None` can be ambiguous; the explicit turbofish keeps it a fully-typed value).
+        optNone: (innerTy) => `Option::<${innerTy}>::None`,
+        // opt (`Option<T>`) null-presence test: present = `expr.is_some()`, absent = `expr.is_none()`.
+        optIsSome: (expr) => `${rustStripTrailingClone(expr)}.is_some()`,
+        optIsNone: (expr) => `${rustStripTrailingClone(expr)}.is_none()`,
         ternary: (cond, t, e, _ty) => `(if ${rustStripOuterParens(cond)} { ${rustStripOuterParens(t)} } else { ${rustStripOuterParens(e)} })`,
         shortCircuitBool: (op, temp, left, rStmts, rExpr) => {
             // and: let temp = if left { <rStmts> rExpr } else { false };  or: if left { true } else { <rStmts> rExpr }.
             // build a block that runs rStmts then yields rExpr (parens stripped — block-tail is not a sub-expr).
-            const rblock = `{ ${rustBlockBody(rStmts, rExpr)} }`;
+            const rblock = `{ ${rStmts.join(" ")} ${rustStripOuterParens(rExpr)} }`;
             if (op === "and") {
                 return [`let ${temp}: bool = if ${rustStripOuterParens(left)} ${rblock} else { false };`];
             }
             return [`let ${temp}: bool = if ${rustStripOuterParens(left)} { true } else ${rblock};`];
         },
         condGuard: (temp, ty, cond, tStmts, tExpr, eStmts, eExpr) => {
-            const tblock = `{ ${rustBlockBody(tStmts, tExpr)} }`;
-            const eblock = `{ ${rustBlockBody(eStmts, eExpr)} }`;
+            const tblock = `{ ${tStmts.join(" ")} ${rustStripOuterParens(tExpr)} }`;
+            const eblock = `{ ${eStmts.join(" ")} ${rustStripOuterParens(eExpr)} }`;
             return [`let ${temp}: ${ty} = if ${rustStripOuterParens(cond)} ${tblock} else ${eblock};`];
         },
     };
@@ -265,17 +864,6 @@ function makeRustExprBackend(resolveHead, plan) {
 function rustSnake(name) {
     return name.replace(/([a-z])([A-Z0-9])/g, "$1_$2").replace(/([0-9])([a-z])/g, "$1_$2").toLowerCase();
 }
-/** rustBlockBody — the body of a block-expression that runs `stmts` then yields `expr`. A trailing
- * `let t = E; t` is collapsed to `E`: binding a temp only to return it on the next line is clippy's
- * `let_and_return` (an error under `-D warnings`), and the hoisted-fallible shape produces exactly that
- * whenever the block's tail IS the hoisted temp. */
-function rustBlockBody(stmts, expr) {
-    const last = stmts[stmts.length - 1];
-    const m = last !== undefined ? /^let\s+([A-Za-z0-9_]+)(?::\s*[^=]+)?\s*=\s*(.+);$/.exec(last) : null;
-    if (m !== null && m[1] === expr)
-        return [...stmts.slice(0, -1), m[2]].join(" ");
-    return [...stmts, rustStripOuterParens(expr)].join(" ");
-}
 /** strip ONE redundant outer paren pair from an expr (clippy `if (cond)` unused_parens). Only when the
  * whole string is a single balanced `( … )` — a `(a) && (b)` stays untouched. */
 function rustStripOuterParens(expr) {
@@ -293,12 +881,6 @@ function rustStripOuterParens(expr) {
     }
     return expr.slice(1, -1);
 }
-/** Drop a TRAILING `.clone()` from an expression — for a position that only reads the value (no move),
- * so an owning clone added by a head resolver is pure waste. Only a clone at the very END is dropped: a
- * `.clone()` mid-path (`t_x.borrow().clone().field`) still owns the field access that follows it. */
-function rustStripTrailingClone(expr) {
-    return expr.endsWith(".clone()") ? expr.slice(0, -".clone()".length) : expr;
-}
 /** Rust float literal (finite; integral gets `.0`). */
 function rustFloatLitExpr(n) {
     if (Number.isInteger(n))
@@ -392,13 +974,14 @@ fn bc_expr_str_ge(a: &str, b: &str) -> bool { bc_expr_cmp_cp(a, b) != std::cmp::
 // ── CONCRETE per-node row structs + row→outType copiers (mirror the Go concrete contract) ──────────
 //
 // Each covered node has a CONCRETE row struct `RawRowNR<Comp><Node>` whose fields are the node's projected
-// outType fields (typed, flattened) plus a per-node error signal (is_error/err). A named-struct outType
+// outType fields (typed, flattened). A row models a SUCCESS: failure travels the Result's Err arm as a
+// concrete BehaviorError carrying the leaf's structured Error Value. A named-struct outType
 // flattens to one Rust field per outType field; a scalar/arr/opt node carries a single `val: <typed>`
 // payload. The per-component `HandlerNR<Comp>` trait has one method per node returning that concrete
 // struct; the runner reads `row.<field>` DIRECTLY (no `RawValue`, no `match`, no `Value::`) and copies
 // each field into the node's outType struct local.
 /** emitRawRowStructs — emit the concrete `RawRowNR<Comp><Node>` struct per covered node (+ per-element
- * `RawElemNR<Comp><Node>` for a covered map). Every row carries the per-node error signal (is_error/err). */
+ * `RawElemNR<Comp><Node>` for a covered map). A row models a SUCCESS; failure is the Result's Err arm. */
 function emitRawRowStructs(comp, typedNodes, plan) {
     const parts = [];
     for (const n of comp.body) {
@@ -409,7 +992,7 @@ function emitRawRowStructs(comp, typedNodes, plan) {
             const elemRowRef = fanoutItemsElemRef(n, ref, plan);
             parts.push(emitOneRowStruct(rawElemStructName(comp.name, n.id), elemRowRef, plan));
             parts.push(`// ${rawRowStructName(comp.name, n.id)} — the BATCH row for fanout '${n.id}': the aligned per-body rows.\n` +
-                `#[derive(Default)]\npub struct ${rawRowStructName(comp.name, n.id)} {\n    pub is_error: bool,\n    pub err: String,\n    pub rows: Vec<${rawElemStructName(comp.name, n.id)}>,\n}`);
+                `#[derive(Default)]\npub struct ${rawRowStructName(comp.name, n.id)} {\n    pub rows: Vec<${rawElemStructName(comp.name, n.id)}>,\n}`);
             continue;
         }
         if ("map" in n) {
@@ -417,22 +1000,20 @@ function emitRawRowStructs(comp, typedNodes, plan) {
             const elemRowRef = mapElemRowRef(n, arrRef, plan);
             parts.push(emitOneRowStruct(rawElemStructName(comp.name, n.id), elemRowRef, plan));
             parts.push(`// ${rawRowStructName(comp.name, n.id)} — the BATCH row for map '${n.id}': the aligned per-element rows.\n` +
-                `#[derive(Default)]\npub struct ${rawRowStructName(comp.name, n.id)} {\n    pub is_error: bool,\n    pub err: String,\n    pub rows: Vec<${rawElemStructName(comp.name, n.id)}>,\n}`);
+                `#[derive(Default)]\npub struct ${rawRowStructName(comp.name, n.id)} {\n    pub rows: Vec<${rawElemStructName(comp.name, n.id)}>,\n}`);
             continue;
         }
         parts.push(emitOneRowStruct(rawRowStructName(comp.name, n.id), ref, plan));
     }
     return parts.join("\n\n");
 }
-/** Emit one concrete row struct: flatten a named outType to typed fields, else a single `val` payload;
- * always carry is_error/err. Derives Default so a handler can build an error row cheaply (`..Default`). */
+/** Emit one concrete row struct: flatten a named outType to typed fields, else a single `val` payload.
+ * A row models a SUCCESS — failure is the Result's Err arm, so no in-band error signal. */
 function emitOneRowStruct(name, ref, plan) {
     const lines = [];
-    lines.push(`// ${name} — CONCRETE handler-result row (typed fields = the node's outType; + error signal).`);
+    lines.push(`// ${name} — CONCRETE handler-result row (typed fields = the node's outType).`);
     lines.push(`#[derive(Default)]`);
     lines.push(`pub struct ${name} {`);
-    lines.push(`    pub is_error: bool,`);
-    lines.push(`    pub err: String,`);
     if (ref.kind === "named") {
         const decl = findDecl(plan, ref.name);
         for (const f of decl.fields) {
@@ -507,6 +1088,19 @@ function emitHandlerTrait(comp, typedNodes, plan, ap) {
     lines.push(`// / boxed-value / dynamic accessor crosses the covered boundary — the consumer implements each`);
     lines.push(`// node_* with a decode of its own wire payload into the concrete row (see INTEGRATION.md §6).`);
     lines.push(`pub trait ${handlerTraitName(comp.name)} {`);
+    // a record-read node returns the consumer's WIRE (an associated `Wire: WireRow`); the generated
+    // decode turns it into the concrete row. Declared once when the component has a de-box-eligible node.
+    // The `+ Send` bound lets the wire cross the parallel-stage runner's scoped fan-out threads (the old
+    // concrete row was Send; the associated type needs the bound stated explicitly).
+    const hasDeBox = comp.body.some((n) => {
+        if ("cond" in n)
+            return false;
+        if ("map" in n || "fanout" in n)
+            return mapFanoutElemDeBoxEligible(n, typedNodes, plan);
+        return deBoxEligible(typedNodes.get(n.id));
+    });
+    if (hasDeBox)
+        lines.push(`    type Wire: WireRow + Send;`);
     for (const n of comp.body) {
         if ("cond" in n)
             continue; // #108: a cond node has no handler method (pure Expression).
@@ -514,21 +1108,29 @@ function emitHandlerTrait(comp, typedNodes, plan, ap) {
         const fnKw = fnKwFor(n.id);
         const bt = boundRustType(n, typedNodes, plan);
         if ("fanout" in n) {
-            // fanout (v3): one batched dispatch of the deduped id list — batch ports IN, aligned batch row OUT.
+            // fanout (v3): one batched dispatch of the deduped id list. A record element returns the aligned
+            // element WIRES the runner de-boxes (decode_wire_elem_*) then dedupe/drops. Each aligned position is
+            // Option<Self::Wire> — None = a DANGLING id (the runner maps it to the zero elem row).
             const portsT = `${portsStructName(comp.name, n.id)}Batch`;
-            const retT = rawRowStructName(comp.name, n.id);
-            lines.push(`    ${fnKw} ${method}(&self, ports: &${portsT}, bound: ${bt}) -> Option<${retT}>;`);
+            const elemDeBox = mapFanoutElemDeBoxEligible(n, typedNodes, plan);
+            const retT = elemDeBox ? "Vec<Option<Self::Wire>>" : rawRowStructName(comp.name, n.id);
+            lines.push(`    ${fnKw} ${method}(&self, ports: &${portsT}, bound: ${bt}) -> Result<${retT}, BehaviorError>;`);
             continue;
         }
         if ("map" in n) {
             const m = n.map;
             const batched = m.batched === true;
             const portsT = batched ? `${portsStructName(comp.name, n.id)}Batch` : portsStructName(comp.name, n.id);
-            const retT = batched ? rawRowStructName(comp.name, n.id) : rawElemStructName(comp.name, n.id);
-            lines.push(`    ${fnKw} ${method}(&self, ports: &${portsT}, bound: ${bt}) -> Option<${retT}>;`);
+            // a record-element map returns the element WIRE(s): batched → Vec<Self::Wire>, nonbatched → Self::Wire.
+            const elemDeBox = mapFanoutElemDeBoxEligible(n, typedNodes, plan);
+            const retT = elemDeBox ? (batched ? "Vec<Self::Wire>" : "Self::Wire") : batched ? rawRowStructName(comp.name, n.id) : rawElemStructName(comp.name, n.id);
+            lines.push(`    ${fnKw} ${method}(&self, ports: &${portsT}, bound: ${bt}) -> Result<${retT}, BehaviorError>;`);
             continue;
         }
-        lines.push(`    ${fnKw} ${method}(&self, ports: &${portsStructName(comp.name, n.id)}, bound: ${bt}) -> Option<${rawRowStructName(comp.name, n.id)}>;`);
+        const ref = typedNodes.get(n.id);
+        const top = ref !== undefined ? recordTop(ref) : null;
+        const retT = top !== null ? rustWireTypeForTop(top) : rawRowStructName(comp.name, n.id);
+        lines.push(`    ${fnKw} ${method}(&self, ports: &${portsStructName(comp.name, n.id)}, bound: ${bt}) -> Result<${retT}, BehaviorError>;`);
     }
     lines.push(`}`);
     return lines.join("\n");
@@ -541,18 +1143,16 @@ function emitHandlerTrait(comp, typedNodes, plan, ap) {
 function mapElemMaterializerName(compName, nodeId) {
     return `materialize_map_elem_${sanitize(compName)}_${typedCell(nodeId)}`;
 }
-/** mapNodeArrRef — the map node's PRODUCED-ARRAY TypeRef from its `outType`, normalizing the two IR
- * conventions to the one array shape every downstream site assumes (`typedNodes.get(mapId)` is an arr):
- *   - the RECORDER SoT (authoring.ts recordMap): `node.outType` is the ELEMENT (pre-array-wrap) — wrap
- *     it to `{arr:element}` here (the map produces `[]element`), matching type-gate's outputType wrap
- *     (`"map" in n ? {arr:ot} : ot`). This is the declarative-authoring form (graphddb batchWrite/forEach).
- *   - legacy hand-built IR: `node.outType` is already the `{arr:element}` produced form — take it as-is.
- * A map ELEMENT is never itself an `{arr:…}` in the covered corpus, so the `arr`-keyed discriminator is
- * unambiguous. Both converge to the SAME produced-array ref, so existing goldens stay byte-identical. */
+/** mapNodeArrRef — the map node's PRODUCED-ARRAY TypeRef from its `outType`.
+ *
+ * A map node's `outType` is its ELEMENT type (scp-error.md "Map element type"), so the produced array
+ * is `{arr: element}`. This is the same reading the compiler applies when it resolves what a node
+ * result reference has (`type-gate`: `"map" in n ? {arr:ot} : ot`) — the emitter follows that SSoT
+ * rather than inspecting the annotation's shape, so an element that is ITSELF an `arr` stays
+ * expressible (element `arr(T)` produces `arr(arr(T))`). */
 function mapNodeArrRef(node, plan) {
     const outT = node.outType;
-    const isArr = outT !== null && typeof outT === "object" && "arr" in outT;
-    return deriveTypeRef((isArr ? outT : { arr: outT }), plan);
+    return deriveTypeRef({ arr: outT }, plan);
 }
 /** mapElemRowRef — the handler's per-element RETURN shape for a covered map node: the `into` field's
  * type (into) or the element outType directly (no-into). This is the type of RawElemNR<Comp><Node>. */
@@ -664,26 +1264,42 @@ function reconstructR(e) {
             return e.node;
     }
 }
-/** Does a port lower to a native value? The ELIGIBILITY gate ASKS the one port lowering (compilePortNode
- * / native-expr) whether it can lower this port, rather than re-deriving the shape rules — so the gate
- * and the emitter can never disagree. A port that does not lower (or lowers fallibly) fails closed. */
-function portIsStatic(node, comp, plan, typedNodes, asBinding) {
-    try {
-        compilePortNode(node, comp, plan, typedNodes, (h) => typedNodes.has(h), "port", asBinding !== undefined ? { asBinding, asBase: asBinding.name } : undefined);
-        return true;
-    }
-    catch {
-        return false; // an eligibility probe: any lowering failure ⇒ not native-covered here.
-    }
-}
-/** the prior-node typed-cell TypeRef map for a component (control-gate nodes are typeless; a map node
- * carries its produced-array ref). Shared by coverage, the struct surface, and the runner. */
+/**
+ * numLiteralRustExpr — a BARE numeric port literal (JSON number, e.g. the `limit: 20` Query port).
+ * `classifyExpr` leaves a bare number `dynamic` (its checked int/float range rules are the evaluate
+ * SSoT), so it never reaches the static str/bool/null branch — but a number literal IS statically
+ * resolvable to a native `Value`: the SAME range check the runtime applies (integral literal in the
+ * safe 2^53-1 window → Value::Int; a fractional/exponent literal → the checked Value::Float) is
+ * performed HERE at generation time. Returns the Rust expression for the literal's Value, or null
+ * when the node is not a bare number OR an integral literal is out of the safe window (keeping the
+ * runtime INVALID_LITERAL semantics — the port is not covered natively, the component falls through).
+ * Mirrors behavior_contracts eval of a bare number literal exactly.
+ */
+const NUM_SAFE_INT_R = 9007199254740991; // 2^53 - 1 (expr safeInt)
+function numLiteralRustExpr(node) {
+    if (typeof node !== "number" || !Number.isFinite(node))
+        return null;
+    if (Number.isInteger(node)) {
+        if (node < -NUM_SAFE_INT_R || node > NUM_SAFE_INT_R)
+            return null; // out of safe window → not covered
+        return `Value::Int(${node}i64)`;
+    }
+    // fractional / exponent literal → checked f64 (finite, guaranteed above).
+    return `Value::Float(${node}f64)`;
+}
+/** A port node is static (literal / ref / concat of those / static arr / bare number literal) —
+ * resolvable to a native Value with no Obj / no evaluate interpreter. */
+/** planForComp — a TypePlan for a single component (its named types are component-scoped). */
+function planForComp(comp) {
+    return buildTypePlan({ irVersion: 1, exprVersion: 2, components: [comp] });
+}
+/** buildTypedNodes — the prior-node typed-cell TypeRef map (control-gate nodes typeless; a map node
+ * carries its produced-array ref). An untyped node is omitted. */
 function buildTypedNodes(comp, plan) {
     const typedNodes = new Map();
     for (const n of comp.body) {
         if (isControlGate(n))
             continue;
-        // coverage probes under-typed components too; an unresolvable node just isn't a prior-node cell.
         try {
             typedNodes.set(n.id, "map" in n ? mapNodeArrRef(n, plan) : deriveTypeRef(n.outType, plan));
         }
@@ -693,6 +1309,26 @@ function buildTypedNodes(comp, plan) {
     }
     return typedNodes;
 }
+/** mapAsBinding — the `$as` element binding for a map node's element ports, or undefined (uncovered). */
+function mapAsBinding(comp, node, typedNodes, plan) {
+    try {
+        return { name: node.map.as, ref: mapOverElemInfo(comp, node, typedNodes, plan).elemRef, plan };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** portIsStatic — the ELIGIBILITY gate ASKS the one port lowering (compilePortNode / native-expr) whether
+ * it can lower this port. A port that does not lower (or lowers fallibly) fails closed. */
+function portIsStatic(node, comp, plan, typedNodes, asBinding) {
+    try {
+        compilePortNode(node, comp, plan, typedNodes, (h) => typedNodes.has(h), "port", asBinding !== undefined ? { asBinding, asBase: asBinding.name } : undefined);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /** The output must lower to a typed struct/value with no scope read: a ref to a BODY NODE, an
  * obj/arr of such, or a concat. A ref to an input param / non-concat operator is not lowerable. */
 function outputIsNativeLowerable(comp) {
@@ -724,7 +1360,7 @@ function outputIsNativeLowerable(comp) {
 /**
  * coveredMapNode — the #86 part 2 covered map shape (nestedBatchGet), rust twin of the go predicate.
  */
-function coveredMapNode(n, bodyIds, comp, plan, typedNodes) {
+function coveredMapNode(n, bodyIds, comp) {
     if (n === null || typeof n !== "object" || !("map" in n))
         return false;
     const m = n.map;
@@ -756,25 +1392,17 @@ function coveredMapNode(n, bodyIds, comp, plan, typedNodes) {
             return false;
     }
     const ports = m.ports;
+    const plan = planForComp(comp);
+    const typedNodes = buildTypedNodes(comp, plan);
     const asBinding = mapAsBinding(comp, n, typedNodes, plan);
     for (const p of Object.keys(ports))
         if (!portIsStatic(ports[p], comp, plan, typedNodes, asBinding))
             return false;
     return true;
 }
-/** the `$as` element binding for a covered map/fanout node's element ports (name + over-element TypeRef),
- * or undefined when the over element type does not resolve (the node is then uncovered upstream). */
-function mapAsBinding(comp, node, typedNodes, plan) {
-    try {
-        return { name: node.map.as, ref: mapOverElemInfo(comp, node, typedNodes, plan).elemRef, plan };
-    }
-    catch {
-        return undefined;
-    }
-}
 /** coveredFanoutNode (v3, rust twin) — a first-class fanout node is covered when its over is a covered
  * ref (prior-node arr / input array with elemType) and its element ports are static. See the go twin. */
-function coveredFanoutNode(n, bodyIds, comp, plan, typedNodes) {
+function coveredFanoutNode(n, bodyIds, comp) {
     if (n === null || typeof n !== "object" || !("fanout" in n))
         return false;
     const f = n.fanout;
@@ -794,6 +1422,8 @@ function coveredFanoutNode(n, bodyIds, comp, plan, typedNodes) {
             return false;
     }
     const ports = f.ports;
+    const plan = planForComp(comp);
+    const typedNodes = buildTypedNodes(comp, plan);
     let asBinding;
     try {
         asBinding = { name: f.as, ref: fanoutOverElemInfo(comp, n, typedNodes, plan).elemRef, plan };
@@ -838,8 +1468,8 @@ function fanoutOverElemInfo(comp, node, typedNodes, plan) {
 }
 /** A covered read SHAPE with static ports + native-lowerable output (+ covered map...into), OR a
  * real-concurrency staged plan (bc#87) whose parallel-stage members are plain componentRef point reads. */
-function isSequentialComponentRefRead(comp, plan) {
-    return coverageRejectReason(comp, plan) === null;
+function isSequentialComponentRefRead(comp) {
+    return coverageRejectReason(comp) === null;
 }
 /**
  * coverageRejectReason — the DIAGNOSTIC twin of isSequentialComponentRefRead (bc#86/#89), rust twin of
@@ -848,11 +1478,12 @@ function isSequentialComponentRefRead(comp, plan) {
  * IDENTICAL to isSequentialComponentRefRead (defined as `coverageRejectReason(c) === null`) so the two
  * can never disagree. This is the message the fail-closed dispatch surfaces per non-native component.
  */
-function coverageRejectReason(comp, plan) {
+function coverageRejectReason(comp) {
+    const crPlan = planForComp(comp);
+    const crTypedNodes = buildTypedNodes(comp, crPlan);
     const ep = execPlan(comp);
     if (ep === null)
         return "component is not a straight-line/staged sequential exec plan (no static exec plan)";
-    const typedNodes = buildTypedNodes(comp, plan);
     // #114: a bindField relation child (single|connection) IS covered inside a parallel stage — the
     // sibling hasMany fan-out (parent → members ∥ permissions). Its bound-key skip-gate is preflighted
     // per member (from the settled parent) BEFORE dispatch, so the scoped-thread fan-out keeps
@@ -890,12 +1521,12 @@ function coverageRejectReason(comp, plan) {
             continue;
         }
         if ("fanout" in n) {
-            if (!coveredFanoutNode(n, bodyIds, comp, plan, typedNodes))
+            if (!coveredFanoutNode(n, bodyIds, comp))
                 return `node '${n.id}' is a non-covered fanout shape (over an input array without elemType, or a dynamic element port)`;
             continue;
         }
         if ("map" in n) {
-            if (!coveredMapNode(n, bodyIds, comp, plan, typedNodes))
+            if (!coveredMapNode(n, bodyIds, comp))
                 return `node '${n.id}' is a non-covered map shape (guard+into heterogeneous, or over an input array without elemType)`;
             continue;
         }
@@ -914,7 +1545,7 @@ function coverageRejectReason(comp, plan) {
         if (cr.relationKind !== undefined && cr.relationKind !== "single" && cr.relationKind !== "connection")
             return `relationKind '${cr.relationKind}' not native-covered (node '${n.id}')`;
         for (const p of Object.keys(cr.ports))
-            if (portIsStatic(cr.ports[p], comp, plan, typedNodes) === false)
+            if (portIsStatic(cr.ports[p], comp, crPlan, crTypedNodes) === false)
                 return `node '${n.id}' port '${p}' is not statically resolvable`;
     }
     if (!outputIsNativeLowerable(comp))
@@ -931,42 +1562,28 @@ function isFullyTyped(comp) {
             return false;
     return true;
 }
-function isNativeRaw(comp, plan) {
-    return isSequentialComponentRefRead(comp, plan) && isFullyTyped(comp);
+function isNativeRaw(comp) {
+    return isSequentialComponentRefRead(comp) && isFullyTyped(comp);
 }
-function assertTypedCoverage(comp, plan) {
-    if (!isSequentialComponentRefRead(comp, plan))
+function assertTypedCoverage(comp) {
+    if (!isSequentialComponentRefRead(comp))
         return;
     if (isFullyTyped(comp))
         return;
     throw new GeneratorFailure("UNSUPPORTED_NODE_STRAIGHTLINE", `rust combined read (bc#77): component '${comp.name}' is a sequential componentRef read but lacks outType/outputType on every node — the combined emitter de-boxes the RESULT into the node's outType struct, so a covered read MUST be fully typed (bc#45). Add outType annotations, or regenerate on rust-straightline-native (boxed result).`);
 }
 // ── typed input struct (InNR<Comp>) + NATIVE scalar port lowering ────────────────────────────
-/**
- * inputPortRustType — the native Rust type for an input port's declared type. Scalars lower to the
- * concrete scalar; `array`/`map` with a declared elemType to `Vec<ElemT>` / `BTreeMap<String, ElemT>`;
- * an OPTIONAL port (`{opt:T}` → `required:false`) to `Option<T>` — the native representation of "the
- * value is absent". A declared type with no native lowering stays the boxed `Value`.
- *
- * An OPTIONAL port whose inner type has no native lowering FAILS CLOSED: `Option<Value>` would be a
- * boxed escape, and emitting the bare inner type would silently turn "absent" into a zero value. A port
- * whose optionality cannot be represented is never silently coerced.
- */
+/** Rust type for an input port's declared type (scalar → concrete; array+elemType → Vec<ElemT>; else Value). */
 function inputPortRustType(schema, plan, where = "input port") {
     const ref = inputPortTypeRef(schema, plan);
     if (ref !== undefined)
         return renderTypeRef(ref);
     if (inputPortIsOptional(schema))
-        throw new GeneratorFailure("UNSUPPORTED_NODE_STRAIGHTLINE", `rust typed-native (runtime-free): ${where} is OPTIONAL (declared {opt:…}) but its inner type ${JSON.stringify(schema?.type)} has no native Rust lowering, so "absent" has no native representation (an Option<Value> would be a boxed escape, and the bare inner type would silently read absent as a zero value). Declare an elemType for an array/map, or use a natively-lowerable scalar.`);
+        throw new GeneratorFailure("UNSUPPORTED_NODE_STRAIGHTLINE", `rust typed-native (runtime-free): ${where} is OPTIONAL (declared {opt:…}) but its inner type ${JSON.stringify(schema?.type)} has no native Rust lowering, so "absent" has no native representation. Declare an elemType for an array/map, or use a natively-lowerable scalar.`);
     return "Value";
 }
-/** The scalar kind a REQUIRED input port declares, or undefined when it is not a required native scalar.
- * An OPTIONAL port is deliberately NOT a scalar kind here: its native type is `Option<T>`, and the
- * callers of this function build REQUIRED scalar slots (`in_.<field>` read straight into a non-opt port
- * field). Answering "i64" for an `{opt:"int"}` port is exactly how "absent" would silently become `0`. */
+/** The scalar kind an input port declares, or undefined if it is not a native scalar. */
 function inputScalarKind(schema) {
-    if (inputPortIsOptional(schema))
-        return undefined;
     switch (schema?.type) {
         case "string":
         case "literal": // a `"literal"` union is a constrained String (see inputPortRustType).
@@ -990,6 +1607,8 @@ function emitInStruct(comp, plan) {
     if (ports.length === 0) {
         return `// ${name} — the CONCRETE input for '${comp.name}' (no input ports).\n#[derive(Default)]\npub struct ${name};`;
     }
+    // #139: inputPortRustType reads the inputPortTypeRef SSoT — an OPTIONAL port is `Option<T>` (absent →
+    // None); an optional whose inner type has no native lowering FAILS CLOSED (never a boxed escape).
     const fields = ports
         .map((p) => `    pub ${rustFieldName(p)}: ${inputPortRustType(comp.inputPorts[p], plan, `input port '${p}' of component '${comp.name}'`)}, // ${JSON.stringify(p)}`)
         .join("\n");
@@ -1000,18 +1619,30 @@ pub struct ${name} {
 ${fields}
 }`;
 }
-/** The port forms the STATIC (non-optional) lane lowers — named in its reject message so the message
- * describes what is actually covered rather than a stale corpus list. */
+/** A ref resolver for native lowering: given a ref head + remaining field path, return a native scalar
+ * Rust expression (typed input field / prior-node typed struct scalar / element binding field), or null
+ * when the ref does not resolve to a REQUIRED (non-opt) native scalar (then the caller falls back to the
+ * Value path). Returned exprs are OWNED (String cloned / scalar copied) — usable in a `format!` / literal. */
+// bc#90 / runtime-free: the old `emitStaticR` / `inputLeafR` / `valueLeafR` port lowering (which built
+// `Value` leaves via the primitives::* helpers and struct-field serializers) is REMOVED — every covered
+// port now lowers to a FULLY NATIVE Rust value in emitPortInit (string / bool / static-string-array /
+// number literal), and a genuinely-dynamic port fails closed. There is no boxed-Value fallback on the
+// covered read plane.
 /**
- * emitPortInit — the port field initializer, read off the ONE port lowering (compilePortNode / native-
- * expr). The field's declared TYPE (portFieldRustType) is the SAME lowering's TypeRef, so type and value
- * can never disagree. `isPrior` tests whether a ref head names a settled prior node at this position;
- * `opts.asBinding`/`opts.asBase` carry a map/fanout element binding.
+ * emitPortInit — emit the port field build for one port as a FULLY NATIVE Rust expression (bc#90 /
+ * runtime-free). Every covered port lowers to a concrete Rust value assigned straight into the ports
+ * struct field — NO `Value`, NO fallback path, NO `match`:
+ *   - a static string array (projection) → `vec!["a", "b", ...]` (change #2);
+ *   - a bare int/float number literal (e.g. Query `limit: 20`) → `20i64` / `<n>f64`;
+ *   - a string/bool/scalar-input port → the native scalar expression (emitNativeScalar).
+ * A port that CANNOT lower natively FAILS CLOSED (there is no boxed Value fallback on the covered plane —
+ * a boxed escape would re-introduce the bc-runtime coupling this module removes). `fieldRustType` is the
+ * ports-struct field type (from portFieldRustType); `resolveRef` resolves a ref head for the scalar path.
  */
 function emitPortInit(pn, expr, comp, plan, typedNodes, isPrior, opts) {
     const c = compilePortNode(expr, comp, plan, typedNodes, isPrior, `port '${pn}'`, opts);
     if (c.stmts.length > 0)
-        throw new GeneratorFailure("UNSUPPORTED_NODE_STRAIGHTLINE", `rust typed-native (runtime-free): port '${pn}' ${JSON.stringify(expr)} lowers to a FALLIBLE expression (one that can raise INT_OVERFLOW / NAN_OR_INF / MOD_ZERO / PRECISION_LOSS). Such an expression lowers to STATEMENTS carrying an early error-return, and a port is built inline in the ports-struct literal — a position that cannot host them. (A cond/guard position CAN host them, so the same expression is covered there — the boundary is the POSITION, not the operator.) Use a non-fallible port expression.`);
+        throw new GeneratorFailure("UNSUPPORTED_NODE_STRAIGHTLINE", `rust typed-native (runtime-free): port '${pn}' ${JSON.stringify(expr)} lowers to a FALLIBLE expression (INT_OVERFLOW / NAN_OR_INF / MOD_ZERO / PRECISION_LOSS) — statements with an early error-return, which a ports-struct literal cannot host. Use a non-fallible port expression.`);
     return `${portFieldName(pn)}: ${c.expr}`;
 }
 // ── the combined runner (STRUCT-returning; INLINE sequential; native ports in; concrete row out) ──
@@ -1216,22 +1847,57 @@ function emitNativeRawRunner(comp, plan, ap) {
         // directly (no `.await`). The runner being `async fn` does not force every call site to await.
         const awaitSfx = ap.nodeIsAsync(node.id) ? ".await" : "";
         lines.push(`${indent}let ports_${s} = ${structName} { ${inits.join(", ")} };`);
-        lines.push(`${indent}let row_${s} = match handlers.${nodeMethodName(node.id)}(&ports_${s}, ${boundArg})${awaitSfx} {`);
-        lines.push(`${indent}    Some(r) => r,`);
-        lines.push(`${indent}    None => return Err(unknown_component(${rustStrLit(node.component)})),`);
-        lines.push(`${indent}};`);
+        // a de-box-eligible node returns the wire (Self::Wire / Vec / Option / BTreeMap); the generated
+        // decode_wire_result_* probes each record strictly and produces the structured error on a mismatch
+        // (byte-equal codes to run_behavior's outType check, so ≡ holds). A non-de-box node keeps its direct
+        // concrete-row move.
+        const top = recordTop(ref);
+        const namedTop = top !== null && top.kind === "named";
+        const deBox = top !== null;
         if (meta.policy === "continue") {
-            lines.push(`${indent}if !row_${s}.is_error {`);
-            lines.push(`${indent}    ${emitRowMove(`*${typedCell(node.id)}.borrow_mut()`, `row_${s}`, ref, plan)}`);
-            lines.push(`${indent}    produced_${s}.set(true);`);
-            lines.push(`${indent}}`);
+            // continue: a failed node (leaf failure OR de-box mismatch) produces no Port — the downstream
+            // Skip propagation is what `continue` means. Only a clean decode commits the result.
+            if (namedTop) {
+                lines.push(`${indent}if let Ok(wire_${s}) = handlers.${nodeMethodName(node.id)}(&ports_${s}, ${boundArg})${awaitSfx} {`);
+                lines.push(`${indent}    if let Ok(row_${s}) = ${rustDecodeNamedName(top.innerName)}(&wire_${s}) {`);
+                lines.push(`${indent}        ${emitRowMove(`*${typedCell(node.id)}.borrow_mut()`, `row_${s}`, ref, plan)}`);
+                lines.push(`${indent}        produced_${s}.set(true);`);
+                lines.push(`${indent}    }`);
+                lines.push(`${indent}}`);
+            }
+            else if (deBox) {
+                lines.push(`${indent}if let Ok(wire_${s}) = handlers.${nodeMethodName(node.id)}(&ports_${s}, ${boundArg})${awaitSfx} {`);
+                lines.push(`${indent}    if let Ok(res_${s}) = ${rustDecodeResultName(comp.name, node.id)}(wire_${s}) {`);
+                lines.push(`${indent}        *${typedCell(node.id)}.borrow_mut() = res_${s};`);
+                lines.push(`${indent}        produced_${s}.set(true);`);
+                lines.push(`${indent}    }`);
+                lines.push(`${indent}}`);
+            }
+            else {
+                lines.push(`${indent}if let Ok(row_${s}) = handlers.${nodeMethodName(node.id)}(&ports_${s}, ${boundArg})${awaitSfx} {`);
+                lines.push(`${indent}    ${emitRowMove(`*${typedCell(node.id)}.borrow_mut()`, `row_${s}`, ref, plan)}`);
+                lines.push(`${indent}    produced_${s}.set(true);`);
+                lines.push(`${indent}}`);
+            }
         }
         else {
-            const label = meta.policy === "retry" ? "retry' policy (exhausted)" : "fail' policy";
-            lines.push(`${indent}if row_${s}.is_error {`);
-            lines.push(`${indent}    return Err(BehaviorError::new("OP_FAILED", format!("operation '{}' failed under '${label}: {}", ${rustStrLit(node.id)}, row_${s}.err)));`);
-            lines.push(`${indent}}`);
-            lines.push(`${indent}${emitRowMove(`*${typedCell(node.id)}.borrow_mut()`, `row_${s}`, ref, plan)}`);
+            const policyLit = meta.policy === "retry" ? "retry' policy (exhausted)" : "fail' policy";
+            const resultVar = deBox ? `wire_${s}` : `row_${s}`;
+            lines.push(`${indent}let ${resultVar} = match handlers.${nodeMethodName(node.id)}(&ports_${s}, ${boundArg})${awaitSfx} {`);
+            lines.push(`${indent}    Ok(r) => r,`);
+            lines.push(`${indent}    Err(e) => return Err(BehaviorError { code: "OP_FAILED".to_string(), message: format!("operation '{}' failed under '${policyLit}: {}", ${rustStrLit(node.id)}, e.message), detail: e.detail }),`);
+            lines.push(`${indent}};`);
+            if (namedTop) {
+                lines.push(`${indent}let row_${s} = ${rustDecodeNamedName(top.innerName)}(&wire_${s})?;`);
+                lines.push(`${indent}${emitRowMove(`*${typedCell(node.id)}.borrow_mut()`, `row_${s}`, ref, plan)}`);
+            }
+            else if (deBox) {
+                lines.push(`${indent}let res_${s} = ${rustDecodeResultName(comp.name, node.id)}(wire_${s})?;`);
+                lines.push(`${indent}*${typedCell(node.id)}.borrow_mut() = res_${s};`);
+            }
+            else {
+                lines.push(`${indent}${emitRowMove(`*${typedCell(node.id)}.borrow_mut()`, `row_${s}`, ref, plan)}`);
+            }
             lines.push(`${indent}produced_${s}.set(true);`);
         }
         for (const c of closers)
@@ -1356,10 +2022,26 @@ function emitParallelStageArm(comp, stage, atPos, concurrency, metas, typedNodes
     const nMembers = refMembers.length;
     const boundN = Math.min(concurrency, nMembers);
     const jobsVar = `jobs_${sanitize(comp.name)}`;
+    const hWire = `<H as ${handlerTraitName(comp.name)}>::Wire`;
+    const hWireTop = (top) => {
+        switch (top.kind) {
+            case "named":
+                return hWire;
+            case "arr":
+                return `Vec<${hWire}>`;
+            case "opt":
+                return `Option<${hWire}>`;
+            case "map":
+                return `std::collections::BTreeMap<String, ${hWire}>`;
+        }
+    };
     for (const i of refMembers) {
         const s = sanitize(comp.body[i].id);
-        const rowT = rawRowStructName(comp.name, comp.body[i].id);
-        lines.push(`        let slot_${s}: std::sync::Mutex<Option<Option<${rowT}>>> = std::sync::Mutex::new(None);`);
+        // a de-box member's thread returns the WIRE (shaped by the record top); a non-de-box member returns
+        // its concrete row directly.
+        const memTop = recordTop(typedNodes.get(comp.body[i].id));
+        const slotT = memTop !== null ? hWireTop(memTop) : rawRowStructName(comp.name, comp.body[i].id);
+        lines.push(`        let slot_${s}: std::sync::Mutex<Option<Result<${slotT}, BehaviorError>>> = std::sync::Mutex::new(None);`);
     }
     lines.push(`        let mut ${jobsVar}: Vec<usize> = Vec::new();`);
     refMembers.forEach((i, slot) => {
@@ -1397,22 +2079,52 @@ function emitParallelStageArm(comp, stage, atPos, concurrency, metas, typedNodes
         const s = sanitize(node.id);
         const ref = typedNodes.get(node.id);
         lines.push(`        if ports_${s}.is_some() {`);
-        lines.push(`            let row_${s} = match slot_${s}.lock().unwrap().take() {`);
-        lines.push(`                Some(Some(r)) => r,`);
-        lines.push(`                _ => return Err(unknown_component(${rustStrLit(node.component)})),`);
-        lines.push(`            };`);
+        lines.push(`            let out_${s} = slot_${s}.lock().unwrap().take().expect("runnable member wrote its slot");`);
+        const top = recordTop(ref);
+        const namedTop = top !== null && top.kind === "named";
+        const deBox = top !== null;
         if (meta.policy === "continue") {
-            lines.push(`            if !row_${s}.is_error {`);
-            lines.push(`                ${emitRowMove(`*${typedCell(node.id)}.borrow_mut()`, `row_${s}`, ref, plan)}`);
-            lines.push(`                produced_${s}.set(true);`);
-            lines.push(`            }`);
+            if (namedTop) {
+                lines.push(`            if let Ok(wire_${s}) = out_${s} {`);
+                lines.push(`                if let Ok(row_${s}) = ${rustDecodeNamedName(top.innerName)}(&wire_${s}) {`);
+                lines.push(`                    ${emitRowMove(`*${typedCell(node.id)}.borrow_mut()`, `row_${s}`, ref, plan)}`);
+                lines.push(`                    produced_${s}.set(true);`);
+                lines.push(`                }`);
+                lines.push(`            }`);
+            }
+            else if (deBox) {
+                lines.push(`            if let Ok(wire_${s}) = out_${s} {`);
+                lines.push(`                if let Ok(res_${s}) = ${rustDecodeResultName(comp.name, node.id)}(wire_${s}) {`);
+                lines.push(`                    *${typedCell(node.id)}.borrow_mut() = res_${s};`);
+                lines.push(`                    produced_${s}.set(true);`);
+                lines.push(`                }`);
+                lines.push(`            }`);
+            }
+            else {
+                lines.push(`            if let Ok(row_${s}) = out_${s} {`);
+                lines.push(`                ${emitRowMove(`*${typedCell(node.id)}.borrow_mut()`, `row_${s}`, ref, plan)}`);
+                lines.push(`                produced_${s}.set(true);`);
+                lines.push(`            }`);
+            }
         }
         else {
-            const label = meta.policy === "retry" ? "retry' policy (exhausted)" : "fail' policy";
-            lines.push(`            if row_${s}.is_error {`);
-            lines.push(`                return Err(BehaviorError::new("OP_FAILED", format!("operation '{}' failed under '${label}: {}", ${rustStrLit(node.id)}, row_${s}.err)));`);
-            lines.push(`            }`);
-            lines.push(`            ${emitRowMove(`*${typedCell(node.id)}.borrow_mut()`, `row_${s}`, ref, plan)}`);
+            const policyLit = meta.policy === "retry" ? "retry' policy (exhausted)" : "fail' policy";
+            const resultVar = deBox ? `wire_${s}` : `row_${s}`;
+            lines.push(`            let ${resultVar} = match out_${s} {`);
+            lines.push(`                Ok(r) => r,`);
+            lines.push(`                Err(e) => return Err(BehaviorError { code: "OP_FAILED".to_string(), message: format!("operation '{}' failed under '${policyLit}: {}", ${rustStrLit(node.id)}, e.message), detail: e.detail }),`);
+            lines.push(`            };`);
+            if (namedTop) {
+                lines.push(`            let row_${s} = ${rustDecodeNamedName(top.innerName)}(&wire_${s})?;`);
+                lines.push(`            ${emitRowMove(`*${typedCell(node.id)}.borrow_mut()`, `row_${s}`, ref, plan)}`);
+            }
+            else if (deBox) {
+                lines.push(`            let res_${s} = ${rustDecodeResultName(comp.name, node.id)}(wire_${s})?;`);
+                lines.push(`            *${typedCell(node.id)}.borrow_mut() = res_${s};`);
+            }
+            else {
+                lines.push(`            ${emitRowMove(`*${typedCell(node.id)}.borrow_mut()`, `row_${s}`, ref, plan)}`);
+            }
             lines.push(`            produced_${s}.set(true);`);
         }
         lines.push(`        }`);
@@ -1449,18 +2161,28 @@ isAsync = false) {
     const portNames = Object.keys(m.ports);
     const elemArrRef = typedNodes.get(node.id);
     const elemName = renderTypeRef(elemArrRef.elem);
-    const asBinding = { name: asName, ref: overElemRef, plan };
+    // a record element is de-boxed strictly: the handler returns the element WIRE(s) and the arm decodes via
+    // decode_wire_elem_* (closing the scan-row hole). A de-box mismatch fails closed regardless of
+    // elementPolicy (matching the interpreter's whole-node outType throw).
+    const elemDeBox = mapFanoutElemDeBoxEligible(node, typedNodes, plan);
+    const decElemFn = elemDeBox ? rustDecodeElemName(comp.name, node.id) : "";
     // build the per-element CONCRETE native ports struct. `il` = indent inside the element loop.
     const buildPorts = (il) => {
-        const inits = portNames.map((pn) => emitPortInit(pn, m.ports[pn], comp, plan, typedNodes, priorHere, { asBinding, asBase: `oel_${s}` }));
-        return [`${il}let ep_${s} = ${structName} { ${inits.join(", ")} };`];
+        const out = [];
+        const inits = [];
+        const asBinding = { name: asName, ref: overElemRef, plan };
+        for (const pn of portNames) {
+            inits.push(emitPortInit(pn, m.ports[pn], comp, plan, typedNodes, priorHere, { asBinding, asBase: `oel_${s}` }));
+        }
+        out.push(`${il}let ep_${s} = ${structName} { ${inits.join(", ")} };`);
+        return out;
     };
     // #108 guard: compile `when` to a native bool over an element-scoped resolveHead ($as element value,
     // prior node, input port). On skip: `continue` (element excluded — matches run_behavior's keep-gate).
     const emitGuard = (il) => {
         if (!hasGuard)
             return [];
-        const resolveHead = nativeResolveHead(comp, plan, typedNodes, priorHere, { asBinding, asBase: `oel_${s}` });
+        const resolveHead = nativeResolveHead(comp, plan, typedNodes, priorHere, { asBinding: { name: asName, ref: overElemRef, plan }, asBase: `oel_${s}` });
         const g = new NativeExprCompiler(makeRustExprBackend(resolveHead, plan)).compileBool(m.when);
         const out = [];
         for (const st of g.stmts)
@@ -1500,26 +2222,30 @@ isAsync = false) {
         lines.push(`${indent}    let want_${s} = items_${s}.len();`);
         lines.push(`${indent}    let bp_${s} = ${batch} { items: items_${s} };`);
         lines.push(`${indent}    let row_${s} = match handlers.${nodeMethodName(node.id)}(&bp_${s}, None)${awaitSfx} {`);
-        lines.push(`${indent}        Some(r) => r,`);
-        lines.push(`${indent}        None => return Err(unknown_component(${rustStrLit(m.component)})),`);
+        lines.push(`${indent}        Ok(r) => r,`);
+        lines.push(`${indent}        Err(e) => return Err(op_failed(${rustStrLit(node.id)}, "fail", e)),`);
         lines.push(`${indent}    };`);
-        lines.push(`${indent}    if row_${s}.is_error {`);
-        lines.push(`${indent}        return Err(BehaviorError::new("OP_FAILED", format!("operation '{}' failed under 'fail' policy: {}", ${rustStrLit(node.id)}, row_${s}.err)));`);
-        lines.push(`${indent}    }`);
-        lines.push(`${indent}    if row_${s}.rows.len() != want_${s} {`);
+        const batchLen = elemDeBox ? `row_${s}.len()` : `row_${s}.rows.len()`;
+        const batchIter = elemDeBox ? `row_${s}.into_iter()` : `row_${s}.rows.into_iter()`;
+        lines.push(`${indent}    if ${batchLen} != want_${s} {`);
         lines.push(`${indent}        return Err(BehaviorError::new("MAP_BATCH_RESULT_MISMATCH", format!("map '{}': batched handler must return a list aligned to items (want {})", ${rustStrLit(node.id)}, want_${s})));`);
         lines.push(`${indent}    }`);
         if (hasInto) {
-            // zip the aligned batch rows onto each KEPT over element (into materializer).
-            lines.push(`${indent}    let mut rows_iter_${s} = row_${s}.rows.into_iter();`);
+            // zip the aligned batch rows onto each KEPT over element (into materializer). A record element's
+            // wire is de-boxed strictly first.
+            lines.push(`${indent}    let mut rows_iter_${s} = ${batchIter};`);
             lines.push(`${indent}    for over_el_${s} in kept_${s}.iter() {`);
             lines.push(`${indent}        let er_${s} = rows_iter_${s}.next().expect("aligned batch row");`);
+            if (elemDeBox)
+                lines.push(`${indent}        let er_${s} = ${decElemFn}(&er_${s})?;`);
             lines.push(`${indent}        built_${s}.push(${elemMat}(over_el_${s}, er_${s}));`);
             lines.push(`${indent}    }`);
         }
         else {
             // no-into: collect each element DIRECTLY from the aligned per-element row (result = kept rows).
-            lines.push(`${indent}    for er_${s} in row_${s}.rows.into_iter() {`);
+            lines.push(`${indent}    for er_${s} in ${batchIter} {`);
+            if (elemDeBox)
+                lines.push(`${indent}        let er_${s} = ${decElemFn}(&er_${s})?;`);
             lines.push(`${indent}        ${emitElemMove(`let el_${s}`, `er_${s}`, elemArrRef.elem, plan)}`);
             lines.push(`${indent}        built_${s}.push(el_${s});`);
             lines.push(`${indent}    }`);
@@ -1533,13 +2259,21 @@ isAsync = false) {
             lines.push(l);
         for (const l of buildPorts(indent + "    "))
             lines.push(l);
+        // Element Error Policy (scp-error.md): `skip` drops the failing element and proceeds (order is
+        // preserved; the leaf keeps the Error Value it produced). `error` (default) promotes the element
+        // Failure to the map's Component Failure, carrying the leaf's detail through.
         lines.push(`${indent}    let er_${s} = match handlers.${nodeMethodName(node.id)}(&ep_${s}, None)${awaitSfx} {`);
-        lines.push(`${indent}        Some(r) => r,`);
-        lines.push(`${indent}        None => return Err(unknown_component(${rustStrLit(m.component)})),`);
+        lines.push(`${indent}        Ok(r) => r,`);
+        if (m.elementPolicy === "skip") {
+            lines.push(`${indent}        Err(_) => continue,`);
+        }
+        else {
+            lines.push(`${indent}        Err(e) => return Err(op_failed(${rustStrLit(node.id)}, "fail", e)),`);
+        }
         lines.push(`${indent}    };`);
-        lines.push(`${indent}    if er_${s}.is_error {`);
-        lines.push(`${indent}        return Err(BehaviorError::new("OP_FAILED", format!("operation '{}' failed under 'fail' policy: {}", ${rustStrLit(node.id)}, er_${s}.err)));`);
-        lines.push(`${indent}    }`);
+        // a record element's wire is de-boxed strictly (fail-closed regardless of elementPolicy).
+        if (elemDeBox)
+            lines.push(`${indent}    let er_${s} = ${decElemFn}(&er_${s})?;`);
         if (hasInto) {
             lines.push(`${indent}    built_${s}.push(${elemMat}(oel_${s}, er_${s}));`);
         }
@@ -1583,9 +2317,12 @@ function emitFanoutArm(comp, node, atPos, typedNodes, plan, priorNodeAt, isAsync
     if (!dkField || dkField.type.kind !== "scalar" || dkField.type.scalar !== "string")
         throw new GeneratorFailure("UNSUPPORTED_NODE_STRAIGHTLINE", `rust fanout (v3): node '${node.id}' dedupeKey '${f.dedupeKey}' must be a string field of the connection items element type '${elemRef.name}'.`);
     const dkRust = rustFieldName(f.dedupeKey);
-    const asBinding = { name: asName, ref: overElemRef, plan };
     const buildPorts = (il) => {
-        const inits = portNames.map((pn) => emitPortInit(pn, f.ports[pn], comp, plan, typedNodes, priorHere, { asBinding, asBase: `oel_${s}` }));
+        const inits = [];
+        const asBinding = { name: asName, ref: overElemRef, plan };
+        for (const pn of portNames) {
+            inits.push(emitPortInit(pn, f.ports[pn], comp, plan, typedNodes, priorHere, { asBinding, asBase: `oel_${s}` }));
+        }
         return [`${il}let ep_${s} = ${structName} { ${inits.join(", ")} };`];
     };
     const lines = [];
@@ -1609,20 +2346,26 @@ function emitFanoutArm(comp, node, atPos, typedNodes, plan, priorNodeAt, isAsync
     lines.push(`${indent}    let want_${s} = pi_${s}.len();`);
     lines.push(`${indent}    let bp_${s} = ${batch} { items: pi_${s} };`);
     lines.push(`${indent}    let row_${s} = match handlers.${nodeMethodName(node.id)}(&bp_${s}, None)${awaitSfx} {`);
-    lines.push(`${indent}        Some(r) => r,`);
-    lines.push(`${indent}        None => return Err(unknown_component(${rustStrLit(f.component)})),`);
+    lines.push(`${indent}        Ok(r) => r,`);
+    lines.push(`${indent}        Err(e) => return Err(op_failed(${rustStrLit(node.id)}, "fail", e)),`);
     lines.push(`${indent}    };`);
-    lines.push(`${indent}    if row_${s}.is_error {`);
-    lines.push(`${indent}        return Err(BehaviorError::new("OP_FAILED", format!("operation '{}' failed under 'fail' policy: {}", ${rustStrLit(node.id)}, row_${s}.err)));`);
-    lines.push(`${indent}    }`);
-    lines.push(`${indent}    if row_${s}.rows.len() != want_${s} {`);
+    // the fanout element row is a named record → the handler returns the aligned element WIRES
+    // (Vec<Option<Self::Wire>>) and each present body is de-boxed strictly (a de-box mismatch fails closed).
+    // A DANGLING id is None → the zero element row (empty dedupeKey), which the dangling drop excludes.
+    const decElemFn = rustDecodeElemName(comp.name, node.id);
+    const rawElemT = rawElemStructName(comp.name, node.id);
+    lines.push(`${indent}    if row_${s}.len() != want_${s} {`);
     lines.push(`${indent}        return Err(BehaviorError::new("FANOUT_BATCH_RESULT_MISMATCH", format!("fanout '{}': batched handler must return a list aligned to the deduped id list (want {})", ${rustStrLit(node.id)}, want_${s})));`);
     lines.push(`${indent}    }`);
     // ── THE ONE dedupe/drop (mirrors fanoutDedupDrop verbatim): first-seen dedupe by dedupeKey field;
     //    drop dangling (empty dedupeKey ≡ interpreter's null/absent-key body); implicitSource strip is
     //    structural (the elem type already omits it). cursor is always None (connection wrap).
     lines.push(`${indent}    let mut seen_${s}: std::collections::HashSet<String> = std::collections::HashSet::new();`);
-    lines.push(`${indent}    for er_${s} in row_${s}.rows.into_iter() {`);
+    lines.push(`${indent}    for opt_er_${s} in row_${s}.into_iter() {`);
+    lines.push(`${indent}        let er_${s}: ${rawElemT} = match opt_er_${s} {`);
+    lines.push(`${indent}            Some(wire_${s}) => ${decElemFn}(&wire_${s})?,`);
+    lines.push(`${indent}            None => Default::default(),`);
+    lines.push(`${indent}        };`);
     lines.push(`${indent}        ${emitElemMove(`let el_${s}`, `er_${s}`, elemRef, plan)}`);
     lines.push(`${indent}        let key_${s} = el_${s}.${dkRust}.clone();`);
     if (f.drop === "dangling") {
@@ -1639,73 +2382,6 @@ function emitFanoutArm(comp, node, atPos, typedNodes, plan, priorNodeAt, isAsync
         lines.push(c);
     return lines.join("\n");
 }
-/**
- * rustOwn — render the OWNED form of a resolved ref value at the LEAF (native-expr calls this after the
- * field path is walked). `guard` marks a value read through a `RefCell`/`&` borrow (a prior node's
- * `cell.borrow()`, a `$as` element `&Elem`): a WHOLE-node Copy scalar dereferences (`*expr`), while a
- * Copy FIELD is already a copy-out of the auto-deref'd place. A String/struct/map clones; an array clones
- * only when the position OWNS it (a port field) and stays borrowed for a `len`. Cloning a Copy value
- * would trip clippy's `clone_on_copy`, so Copy never clones.
- */
-function rustOwn(guard, ownArrays) {
-    return (expr, ref, fieldAccessed) => {
-        if (ref.kind === "arr")
-            return ownArrays ? `${expr}.clone()` : expr;
-        if (typeRefIsCopy(ref))
-            return guard && !fieldAccessed ? `*${expr}` : expr;
-        return `${expr}.clone()`;
-    };
-}
-/**
- * nativeResolveHead — the ONE ref-head resolver the runtime-free native-expr compiler reads, for cond
- * `if`/branches, a map/fanout `when` guard, AND a port. A head is a `$as` element binding, a prior body
- * node's typed cell, or an input port — each a native base expr of the head's TypeRef PLUS an `own`
- * renderer (rustOwn) that native-expr applies at the resolved LEAF. Ownership lives at the leaf so a
- * prior-node field ref clones only the field (`cell.borrow().items.clone()`), never the whole struct.
- * `isPrior` tests whether a head names a settled prior node (position-aware at a runner site; structural
- * at coverage/struct-def). `asBase` is the element base for a `$as`-headed ref; `ownArrays` owns an array
- * (a port field) vs borrows it (a cond `len`).
- */
-function nativeResolveHead(comp, plan, typedNodes, isPrior, opts) {
-    const ownArrays = opts?.ownArrays === true;
-    return (head) => {
-        // a `$as` element (`for oel in vec.iter()`) is a `&Elem` — a borrow guard.
-        if (opts?.asBinding !== undefined && opts.asBase !== undefined && head === opts.asBinding.name) {
-            return { expr: opts.asBase, ref: opts.asBinding.ref, own: rustOwn(true, ownArrays) };
-        }
-        // a prior node's value lives behind a `RefCell` borrow guard.
-        if (isPrior(head)) {
-            const ref = typedNodes.get(head);
-            return { expr: `${typedCell(head)}.borrow()`, ref, own: rustOwn(true, ownArrays) };
-        }
-        // an input port is a by-value struct field (no guard).
-        const ref = inputPortTypeRef(comp.inputPorts?.[head], plan);
-        if (ref === undefined)
-            return null;
-        return { expr: `in_.${rustFieldName(head)}`, ref, own: rustOwn(false, ownArrays) };
-    };
-}
-/**
- * compilePortNode — lower a port expression to its native ports-struct field via the runtime-free
- * native-expr compiler (native-expr.ts): the ONE port lowering. The port's field TYPE is the compiled
- * `ref`, its initializer the compiled `expr` — so the two are derived from a SINGLE lowering and can
- * never disagree. Any closed operator, a literal, a ref (input scalar/array/map, prior-node scalar/array,
- * `$as` element field), a concat, a static array, an optional-input read — all resolve here. A port that
- * cannot lower to a native value FAILS CLOSED loudly. A lowering that is FALLIBLE (hoists statements) is
- * a covered SHAPE returned here as-is; only the value site (emitPortInit) rejects it, since a ports-struct
- * literal cannot host statements — the coverage gate/type site must still see it as covered.
- */
-function compilePortNode(node, comp, plan, typedNodes, isPrior, where, opts) {
-    const resolveHead = nativeResolveHead(comp, plan, typedNodes, isPrior, { ...opts, ownArrays: true });
-    try {
-        return new NativeExprCompiler(makeRustExprBackend(resolveHead, plan)).compilePort(node);
-    }
-    catch (e) {
-        if (!(e instanceof GeneratorFailure))
-            throw e;
-        throw new GeneratorFailure("UNSUPPORTED_NODE_STRAIGHTLINE", `rust typed-native (runtime-free): ${where} ${JSON.stringify(node)} does not lower to a native Rust value: ${e.message}`);
-    }
-}
 /**
  * emitCondArm — the struct-native exec of a covered cond node (#108, rust). Mirrors run_behavior's cond
  * lower: compile `if` to a native bool, materialize the TAKEN branch to the node's outType (only the
@@ -1847,6 +2523,13 @@ pub const COMPONENT_NAMES_NATIVE_RAW: [&str; ${names.length}] = [${names.join(",
 const UNKNOWN_COMPONENT_HELPER = `#[allow(dead_code)]
 fn unknown_component(component: &str) -> BehaviorError {
     BehaviorError::new("UNKNOWN_COMPONENT", format!("component '{component}' has no handler (fail-closed)"))
+}
+
+// leaf_failure — a failure the LEAF reports (test glue): the runner assigns the node's failure code
+// from its Error Policy Kind, so what a leaf carries is its message and its structured Error Value.
+#[allow(dead_code)]
+fn leaf_failure(message: impl Into<String>) -> BehaviorError {
+    BehaviorError::new("LEAF_FAILURE", message)
 }`;
 // ── module assembly ──────────────────────────────────────────────────────────────────
 function emit(ctx) {
@@ -1855,20 +2538,17 @@ function emit(ctx) {
     // rust CONSUMES this annotation (async fn + .await where derived); go ignores it. per-node granularity
     // is a strict generalization of increment-1's uniform ioModel:'async' (= every terminal async).
     const asyncPlans = buildAsyncPlans(ctx.ir, ctx.ioModel);
-    // The type plan is the SSoT the coverage gate + the port lowering both read (the gate ASKS the port
-    // lowering whether a port lowers), so it is built up-front — before the coverage checks.
-    const plan = buildTypePlan(ctx.ir);
     for (const c of ctx.ir.components)
-        assertTypedCoverage(c, plan);
-    const native = ctx.ir.components.filter((c) => isNativeRaw(c, plan));
-    const nonNative = ctx.ir.components.filter((c) => !isNativeRaw(c, plan));
+        assertTypedCoverage(c);
+    const native = ctx.ir.components.filter(isNativeRaw);
+    const nonNative = ctx.ir.components.filter((c) => !isNativeRaw(c));
     // FAIL CLOSED (bc#86/#89): the --typed-native (native codegen) surface is native-only. Previously a
     // non-covered component was SILENTLY DROPPED (emitted only as a comment note), concealing that it
     // never got native codegen. We now throw a LOUD GeneratorFailure naming every uncovered component +
     // its specific reject reason. A fully-covered module is unchanged.
     if (nonNative.length > 0) {
         const rejects = nonNative
-            .map((c) => `  - component '${c.name}': ${coverageRejectReason(c, plan) ?? "not a covered native read"}`)
+            .map((c) => `  - component '${c.name}': ${coverageRejectReason(c) ?? "not a covered native read"}`)
             .join("\n");
         throw new GeneratorFailure("UNSUPPORTED_NODE_STRAIGHTLINE", `rust typed-native (native codegen) surface: ${nonNative.length} component(s) are NOT a covered native read:\n${rejects}\n\n` +
             `The --typed-native (native codegen) surface is native-only and fail-closed: it does not silently ` +
@@ -1882,6 +2562,7 @@ function emit(ctx) {
 ${emitStructSurface([])}
 `;
     }
+    const plan = buildTypePlan(ctx.ir);
     // The typed-native module is a de-boxed CONSUMER artifact: the covered runner RETURNS these outType
     // structs and the consumer reads their fields natively. So the decls (and their FIELDS) are pub — the
     // consumer keeps the model native (mirrors Go's exported outType struct fields on the covered path).
@@ -1898,8 +2579,15 @@ ${emitStructSurface([])}
     const handlerTraits = [];
     const inStructs = [];
     const elemMaterializers = [];
+    // the generated strict de-box functions (deduped by named type across all covered components).
+    const decodeFns = [];
+    const decodeEmitted = new Set();
     for (const c of native) {
-        const typedNodes = buildTypedNodes(c, plan);
+        const typedNodes = new Map();
+        // build the full typed-node map FIRST so a map's over-element resolution can see every node.
+        for (const n of c.body)
+            if (!isControlGate(n))
+                typedNodes.set(n.id, "map" in n ? mapNodeArrRef(n, plan) : deriveTypeRef(n.outType, plan)); // #125: control-gate typeless; map は produced-array ref に正規化
         for (const n of c.body) {
             if ("fanout" in n)
                 structs.push(emitFanoutPortsStructs(c, n, typedNodes, plan));
@@ -1909,10 +2597,13 @@ ${emitStructSurface([])}
                 // #108: a cond node has NO ports struct (pure Expression — no handler dispatch).
             }
             else
-                structs.push(emitPortsStruct(c, n, plan, typedNodes)); // #129: typedNodes for prior-node arr leaf ports.
+                structs.push(emitPortsStruct(c, n, undefined, plan, typedNodes)); // #129: typedNodes for prior-node arr leaf ports.
         }
+        // fail closed for a record inside a non-named top (never a silent trust) — before emitting anything.
+        assertDeBoxableResults(c, typedNodes, plan);
         rowStructs.push(emitRawRowStructs(c, typedNodes, plan));
         handlerTraits.push(emitHandlerTrait(c, typedNodes, plan, asyncPlans.get(c.name)));
+        emitRustNodeDecodeFns(c, typedNodes, plan, decodeEmitted, decodeFns);
         inStructs.push(emitInStruct(c, plan));
         const mm = emitMapElemMaterializers(c, typedNodes, plan);
         if (mm)
@@ -1955,6 +2646,12 @@ use std::cell::RefCell;`;
             : undefined,
         `// CONCRETE per-component input structs (fields = inputPorts).\n${inStructs.join("\n\n")}`,
         `// CONCRETE per-component handler traits (one node_* method per node — native ports IN, row OUT).\n${handlerTraits.join("\n\n")}`,
+        decodeFns.length
+            ? `// strict de-box wire seam — the consumer implements WireRow/WireList over its wire payload (variant\n// classification); the generated decode_wire_* owns strictness (required/optional, present/absent, error\n// assembly, fail-closed). Concrete enums + monomorphized traits — no boxed value, no trait object, no\n// heap allocation crosses the seam.\n${emitRustProbeWireTypes()}`
+            : undefined,
+        decodeFns.length
+            ? `// Generated strict de-box functions (per named record type; structured Error Value on mismatch).\n${decodeFns.join("\n\n")}`
+            : undefined,
         elemMaterializers.length
             ? `// map augmented-element copiers (pure struct field assignment — no dynamic value read).\n${elemMaterializers.join("\n\n")}`
             : undefined,
@@ -1974,8 +2671,8 @@ use std::cell::RefCell;`;
  */
 export function rustTypedNativeObserve(ir, ioModel = "sync") {
     const components = ir.components;
+    const native = components.filter(isNativeRaw);
     const plan = buildTypePlan(ir);
-    const native = components.filter((c) => isNativeRaw(c, plan));
     const needSync = native.some((c) => concurrencyPlan(c) !== null);
     const serializers = emitSerializers(plan);
     const marshallers = emitMarshallers(plan);
@@ -1986,6 +2683,160 @@ export function rustTypedNativeObserve(ir, ioModel = "sync") {
     const anyAsyncRunner = native.some((c) => asyncPlans.get(c.name).runnerIsAsync);
     // ── per-component input decoders: generic &[(String,Value)] -> concrete InNR_<comp> (test glue). ──
     const inDecoders = native.map((c) => emitInDecoder(c, plan)).join("\n\n");
+    // does any covered read de-box a named record — a componentRef record OR a map/fanout element row
+    // (→ the scripted handler returns a ScriptedWireRow / Vec<ScriptedWireRow>)?
+    const anyDeBox = native.some((c) => {
+        const tn = new Map();
+        for (const n of c.body)
+            if (!isControlGate(n))
+                tn.set(n.id, "map" in n ? mapNodeArrRef(n, plan) : deriveTypeRef(n.outType, plan));
+        return c.body.some((n) => {
+            if ("cond" in n)
+                return false;
+            if ("map" in n || "fanout" in n)
+                return mapFanoutElemDeBoxEligible(n, tn, plan);
+            return deBoxEligible(tn.get(n.id));
+        });
+    });
+    // scripted wire adapter (TEST glue): wraps a scripted Value as a WireRow/WireList and classifies each
+    // attribute's native type into a DynamoDB-flavored wire tag (S/N/BOOL/L/M/NULL). A real consumer
+    // implements WireRow over its own AttributeValue map; this drives the generated de-box from the same
+    // scripted vectors run_behavior uses — so actualWireType observed in a mismatch is the PRODUCER tag.
+    const wireAdapter = anyDeBox
+        ? `// ── scripted wire adapter (TEST glue) ──
+fn scripted_wire_tag(v: &Value) -> String {
+    match v {
+        Value::Null => "NULL",
+        Value::Bool(_) => "BOOL",
+        Value::Int(_) | Value::Float(_) => "N",
+        Value::Str(_) => "S",
+        Value::Arr(_) => "L",
+        Value::Obj(_) => "M",
+    }
+    .to_string()
+}
+
+fn scripted_wire_raw(v: &Value) -> String {
+    match v {
+        Value::Null => "null".to_string(),
+        Value::Bool(b) => b.to_string(),
+        Value::Int(n) => n.to_string(),
+        Value::Float(f) => f.to_string(),
+        Value::Str(s) => s.clone(),
+        Value::Arr(_) | Value::Obj(_) => "[composite]".to_string(),
+    }
+}
+
+fn probe_string_val(v: Option<&Value>) -> Probe<String> {
+    match v {
+        None => Probe::Absent,
+        Some(Value::Null) => Probe::Null { actual_wire_type: "NULL".to_string(), raw_value: "null".to_string() },
+        Some(Value::Str(s)) => Probe::Got(s.clone()),
+        Some(other) => Probe::Wrong { actual_wire_type: scripted_wire_tag(other), raw_value: scripted_wire_raw(other) },
+    }
+}
+
+fn probe_number_val(v: Option<&Value>) -> NumProbe {
+    match v {
+        None => NumProbe::Absent,
+        Some(Value::Null) => NumProbe::Null { actual_wire_type: "NULL".to_string(), raw_value: "null".to_string() },
+        Some(Value::Int(n)) => NumProbe::Got { raw: n.to_string(), actual_wire_type: "N".to_string() },
+        Some(Value::Float(f)) => NumProbe::Got { raw: f.to_string(), actual_wire_type: "N".to_string() },
+        Some(other) => NumProbe::Wrong { actual_wire_type: scripted_wire_tag(other), raw_value: scripted_wire_raw(other) },
+    }
+}
+
+fn probe_bool_val(v: Option<&Value>) -> Probe<bool> {
+    match v {
+        None => Probe::Absent,
+        Some(Value::Null) => Probe::Null { actual_wire_type: "NULL".to_string(), raw_value: "null".to_string() },
+        Some(Value::Bool(b)) => Probe::Got(*b),
+        Some(other) => Probe::Wrong { actual_wire_type: scripted_wire_tag(other), raw_value: scripted_wire_raw(other) },
+    }
+}
+
+fn probe_row_val(v: Option<&Value>) -> Probe<ScriptedWireRow> {
+    match v {
+        None => Probe::Absent,
+        Some(Value::Null) => Probe::Null { actual_wire_type: "NULL".to_string(), raw_value: "null".to_string() },
+        Some(Value::Obj(pairs)) => Probe::Got(ScriptedWireRow { obj: pairs.clone() }),
+        Some(other) => Probe::Wrong { actual_wire_type: scripted_wire_tag(other), raw_value: scripted_wire_raw(other) },
+    }
+}
+
+fn probe_list_val(v: Option<&Value>) -> Probe<ScriptedWireList> {
+    match v {
+        None => Probe::Absent,
+        Some(Value::Null) => Probe::Null { actual_wire_type: "NULL".to_string(), raw_value: "null".to_string() },
+        Some(Value::Arr(items)) => Probe::Got(ScriptedWireList { items: items.clone() }),
+        Some(other) => Probe::Wrong { actual_wire_type: scripted_wire_tag(other), raw_value: scripted_wire_raw(other) },
+    }
+}
+
+pub struct ScriptedWireRow {
+    obj: Vec<(String, Value)>,
+}
+
+impl ScriptedWireRow {
+    pub fn new(v: Value) -> Self {
+        match v {
+            Value::Obj(pairs) => ScriptedWireRow { obj: pairs },
+            _ => ScriptedWireRow { obj: Vec::new() },
+        }
+    }
+    fn get(&self, field: &str) -> Option<&Value> {
+        self.obj.iter().find(|(k, _)| k.as_str() == field).map(|(_, v)| v)
+    }
+}
+
+pub struct ScriptedWireList {
+    items: Vec<Value>,
+}
+
+impl WireRow for ScriptedWireRow {
+    type List = ScriptedWireList;
+    fn keys(&self) -> Vec<String> {
+        self.obj.iter().map(|(k, _)| k.clone()).collect()
+    }
+    fn probe_string(&self, field: &str) -> Probe<String> {
+        probe_string_val(self.get(field))
+    }
+    fn probe_number(&self, field: &str) -> NumProbe {
+        probe_number_val(self.get(field))
+    }
+    fn probe_bool(&self, field: &str) -> Probe<bool> {
+        probe_bool_val(self.get(field))
+    }
+    fn probe_row(&self, field: &str) -> Probe<Self> {
+        probe_row_val(self.get(field))
+    }
+    fn probe_list(&self, field: &str) -> Probe<Self::List> {
+        probe_list_val(self.get(field))
+    }
+}
+
+impl WireList for ScriptedWireList {
+    type Row = ScriptedWireRow;
+    fn len(&self) -> usize {
+        self.items.len()
+    }
+    fn elem_string(&self, i: usize) -> Probe<String> {
+        probe_string_val(self.items.get(i))
+    }
+    fn elem_number(&self, i: usize) -> NumProbe {
+        probe_number_val(self.items.get(i))
+    }
+    fn elem_bool(&self, i: usize) -> Probe<bool> {
+        probe_bool_val(self.items.get(i))
+    }
+    fn elem_row(&self, i: usize) -> Probe<Self::Row> {
+        probe_row_val(self.items.get(i))
+    }
+    fn elem_list(&self, i: usize) -> Probe<Self> {
+        probe_list_val(self.items.get(i))
+    }
+}`
+        : "";
     // ── concrete scripted handler: implements every HandlerNR<comp> trait by decoding a scripted Value
     // into the concrete per-node row (the generic scripted-source queue meets the concrete seam). ──
     const decodeFns = [];
@@ -2009,22 +2860,39 @@ export function rustTypedNativeObserve(ir, ioModel = "sync") {
             // Option<K> (NOT a boxed Value) — computed per node so the impl signature matches the trait.
             const bt = boundRustType(n, typedNodes, plan);
             if ("fanout" in n) {
-                // v3: scripted fanout impl — drain one batched outcome, decode the aligned array into per-body
-                // elem rows (a null array element decodes to the zero elem row = dangling → dropped by the arm).
                 const f = n.fanout;
-                const elemRowRef = fanoutItemsElemRef(n, ref, plan);
+                const elemDeBox = mapFanoutElemDeBoxEligible(n, typedNodes, plan);
                 const elemT = rawElemStructName(c.name, n.id);
                 const batchT = rawRowStructName(c.name, n.id);
-                const elemDecode = emitDecodeRow(c.name, n.id, elemT, elemRowRef, plan, emittedDecode, decodeFns, "Elem");
                 const portsT = `${portsStructName(c.name, n.id)}Batch`;
-                methods.push(`    ${fnKw} ${nodeMethodName(n.id)}(&self, _ports: &${portsT}, _bound: ${bt}) -> Option<${batchT}> {
-        let (is_err, err, ok, _echo) = self.next(${rustStrLit(f.component)})?;
+                if (elemDeBox) {
+                    // a record-element fanout returns the aligned element WIRES; a null aligned body is a DANGLING
+                    // id → None (the covered runner maps it to the zero elem row).
+                    methods.push(`    ${fnKw} ${nodeMethodName(n.id)}(&self, _ports: &${portsT}, _bound: ${bt}) -> Result<Vec<Option<ScriptedWireRow>>, BehaviorError> {
+        let (is_err, err, ok, _echo) = self.next(${rustStrLit(f.component)}).ok_or_else(|| unknown_component(${rustStrLit(f.component)}))?;
+        if is_err {
+            return Err(leaf_failure(err));
+        }
+        let arr = match ok { Some(Value::Arr(a)) => a, _ => Vec::new() };
+        let wires = arr
+            .into_iter()
+            .map(|ev| match ev {
+                Value::Null => None,
+                _ => Some(ScriptedWireRow::new(ev)),
+            })
+            .collect();
+        Ok(wires)
+    }`);
+                    continue;
+                }
+                const elemRowRef = fanoutItemsElemRef(n, ref, plan);
+                const elemDecode = emitDecodeRow(c.name, n.id, elemT, elemRowRef, plan, emittedDecode, decodeFns, "Elem");
+                methods.push(`    ${fnKw} ${nodeMethodName(n.id)}(&self, _ports: &${portsT}, _bound: ${bt}) -> Result<${batchT}, BehaviorError> {
+        let (is_err, err, ok, _echo) = self.next(${rustStrLit(f.component)}).ok_or_else(|| unknown_component(${rustStrLit(f.component)}))?;
         if is_err {
-            return Some(${batchT} { is_error: true, err, ..Default::default() });
+            return Err(leaf_failure(err));
         }
         let arr = match ok { Some(Value::Arr(a)) => a, _ => Vec::new() };
-        // v3: a null aligned body is a DANGLING id — decode it to the zero elem row (whose dedupeKey
-        // field is empty), so the runner's dangling-drop excludes it (byte-equal to fanoutDedupDrop).
         let rows = arr
             .iter()
             .map(|ev| match ev {
@@ -2032,7 +2900,7 @@ export function rustTypedNativeObserve(ir, ioModel = "sync") {
                 _ => ${elemDecode}(ev),
             })
             .collect();
-        Some(${batchT} { rows, ..Default::default() })
+        Ok(${batchT} { rows })
     }`);
                 continue;
             }
@@ -2040,70 +2908,172 @@ export function rustTypedNativeObserve(ir, ioModel = "sync") {
                 const m = n.map;
                 const batched = m.batched === true;
                 const arrRef = ref;
-                const elemRowRef = mapElemRowRef(n, arrRef, plan);
+                const elemDeBox = mapFanoutElemDeBoxEligible(n, typedNodes, plan);
                 const elemT = rawElemStructName(c.name, n.id);
                 const batchT = rawRowStructName(c.name, n.id);
-                const elemDecode = emitDecodeRow(c.name, n.id, elemT, elemRowRef, plan, emittedDecode, decodeFns, "Elem");
                 const portsT = batched ? `${portsStructName(c.name, n.id)}Batch` : portsStructName(c.name, n.id);
-                const retT = batched ? batchT : elemT;
+                if (elemDeBox) {
+                    // a record-element map returns the element WIRE(s); the covered runner de-boxes each strictly.
+                    if (batched) {
+                        methods.push(`    ${fnKw} ${nodeMethodName(n.id)}(&self, _ports: &${portsT}, _bound: ${bt}) -> Result<Vec<ScriptedWireRow>, BehaviorError> {
+        let (is_err, err, ok, _echo) = self.next(${rustStrLit(m.component)}).ok_or_else(|| unknown_component(${rustStrLit(m.component)}))?;
+        if is_err {
+            return Err(leaf_failure(err));
+        }
+        let arr = match ok { Some(Value::Arr(a)) => a, _ => Vec::new() };
+        let wires = arr.into_iter().map(ScriptedWireRow::new).collect();
+        Ok(wires)
+    }`);
+                    }
+                    else {
+                        methods.push(`    ${fnKw} ${nodeMethodName(n.id)}(&self, _ports: &${portsT}, _bound: ${bt}) -> Result<ScriptedWireRow, BehaviorError> {
+        let (is_err, err, ok, _echo) = self.next(${rustStrLit(m.component)}).ok_or_else(|| unknown_component(${rustStrLit(m.component)}))?;
+        if is_err {
+            return Err(leaf_failure(err));
+        }
+        Ok(ScriptedWireRow::new(ok.unwrap_or(Value::Null)))
+    }`);
+                    }
+                    continue;
+                }
+                const elemRowRef = mapElemRowRef(n, arrRef, plan);
+                const elemDecode = emitDecodeRow(c.name, n.id, elemT, elemRowRef, plan, emittedDecode, decodeFns, "Elem");
                 if (batched) {
-                    methods.push(`    ${fnKw} ${nodeMethodName(n.id)}(&self, _ports: &${portsT}, _bound: ${bt}) -> Option<${batchT}> {
-        let (is_err, err, ok, _echo) = self.next(${rustStrLit(m.component)})?;
+                    methods.push(`    ${fnKw} ${nodeMethodName(n.id)}(&self, _ports: &${portsT}, _bound: ${bt}) -> Result<${batchT}, BehaviorError> {
+        let (is_err, err, ok, _echo) = self.next(${rustStrLit(m.component)}).ok_or_else(|| unknown_component(${rustStrLit(m.component)}))?;
         if is_err {
-            return Some(${batchT} { is_error: true, err, ..Default::default() });
+            return Err(leaf_failure(err));
         }
         let arr = match ok { Some(Value::Arr(a)) => a, _ => Vec::new() };
         let rows = arr.iter().map(${elemDecode}).collect();
-        Some(${batchT} { rows, ..Default::default() })
+        Ok(${batchT} { rows })
     }`);
                 }
                 else {
-                    methods.push(`    ${fnKw} ${nodeMethodName(n.id)}(&self, _ports: &${portsT}, _bound: ${bt}) -> Option<${elemT}> {
-        let (is_err, err, ok, _echo) = self.next(${rustStrLit(m.component)})?;
+                    methods.push(`    ${fnKw} ${nodeMethodName(n.id)}(&self, _ports: &${portsT}, _bound: ${bt}) -> Result<${elemT}, BehaviorError> {
+        let (is_err, err, ok, _echo) = self.next(${rustStrLit(m.component)}).ok_or_else(|| unknown_component(${rustStrLit(m.component)}))?;
         if is_err {
-            return Some(${elemT} { is_error: true, err, ..Default::default() });
+            return Err(leaf_failure(err));
         }
         let v = ok.unwrap_or(Value::Null);
-        Some(${elemDecode}(&v))
+        Ok(${elemDecode}(&v))
     }`);
                 }
-                void retT;
                 continue;
             }
             const node = n;
             const rowT = rawRowStructName(c.name, node.id);
+            // a de-box-eligible node's scripted handler returns a ScriptedWireRow (the scripted Value wrapped as
+            // a WireRow that classifies each attribute's native type into a DynamoDB-flavored wire tag); the
+            // covered module's generated decode_wire_* then probes it. A real consumer returns its wire payload
+            // for BC to de-box — the de-box no longer lives here.
+            if (deBoxEligible(ref)) {
+                // a record-containing top returns its wire (ScriptedWireRow / Vec / Option / BTreeMap) — the
+                // covered runner de-boxes each record. #129: an arr node with an `items` port echoes the NATIVE
+                // port array, serialized back to Vec<ScriptedWireRow> so the de-box round-trips.
+                const top = recordTop(ref);
+                const wireT = (() => {
+                    switch (top.kind) {
+                        case "named":
+                            return "ScriptedWireRow";
+                        case "arr":
+                            return "Vec<ScriptedWireRow>";
+                        case "opt":
+                            return "Option<ScriptedWireRow>";
+                        case "map":
+                            return "std::collections::BTreeMap<String, ScriptedWireRow>";
+                    }
+                })();
+                // echo-into-record (#141 fixtures): a named de-box node whose result WRAPS an input port — the
+                // scripted leaf echoes port P into the record's single field, so the input-port value flows into
+                // the de-boxed result and the runtime non-vacuity #139/#143/#144 assert survives the record wrap.
+                let namedEcho = "";
+                if (top.kind === "named") {
+                    const decl = findDecl(plan, top.innerName);
+                    const recordRust = renderTypeRef(ref);
+                    const field = decl !== undefined && decl.fields.length === 1 ? decl.fields[0] : undefined;
+                    const fieldRust = field !== undefined ? renderTypeRef(field.type) : null;
+                    for (const pn of Object.keys(node.ports)) {
+                        let portRust = null;
+                        try {
+                            portRust = portFieldRustType(node.ports[pn], c, plan, typedNodes, `echo port '${pn}'`);
+                        }
+                        catch {
+                            portRust = null;
+                        }
+                        if (portRust === recordRust) {
+                            // case 2: the port IS the whole record → echo it DIRECTLY (no field wrap), matching
+                            // run_behavior's plain echo:port of a whole-record port.
+                            const own = typeRefIsCopy(ref) ? `ports.${portFieldName(pn)}` : `ports.${portFieldName(pn)}.clone()`;
+                            namedEcho += `        if echo == ${rustStrLit(pn)} {\n            let tv = ${own};\n            return Ok(ScriptedWireRow::new(${serializeTyped("tv", ref, plan)}));\n        }\n`;
+                        }
+                        else if (fieldRust !== null && field !== undefined && portRust === fieldRust) {
+                            // case 1: a scalar port wraps into the record's single field ({v: ports.X}).
+                            const own = typeRefIsCopy(field.type) ? `ports.${portFieldName(pn)}` : `ports.${portFieldName(pn)}.clone()`;
+                            namedEcho += `        if echo == ${rustStrLit(pn)} {\n            let tv = ${own};\n            return Ok(ScriptedWireRow::new(Value::Obj(vec![(${rustStrLit(field.name)}.to_string(), ${serializeTyped("tv", field.type, plan)})])));\n        }\n`;
+                        }
+                    }
+                }
+                const canEcho = (top.kind === "arr" && Object.prototype.hasOwnProperty.call(node.ports, "items")) || namedEcho !== "";
+                const portsParam = canEcho ? "ports" : "_ports";
+                const okBind = canEcho ? "(is_err, err, ok, echo)" : "(is_err, err, ok, _echo)";
+                let body;
+                if (top.kind === "named") {
+                    body = `${namedEcho}        Ok(ScriptedWireRow::new(ok.unwrap_or(Value::Null)))`;
+                }
+                else if (top.kind === "arr") {
+                    const elemRef = ref.elem;
+                    const itemsF = portFieldName("items");
+                    const echoBranch = canEcho
+                        ? `        if echo == "items" {\n            let wires: Vec<ScriptedWireRow> = ports.${itemsF}.iter().map(|e| { let tv = e.clone(); ScriptedWireRow::new(${serializeTyped("tv", elemRef, plan)}) }).collect();\n            return Ok(wires);\n        }\n`
+                        : "";
+                    body = `${echoBranch}        let arr = match ok { Some(Value::Arr(a)) => a, _ => Vec::new() };\n        Ok(arr.into_iter().map(ScriptedWireRow::new).collect())`;
+                }
+                else if (top.kind === "opt") {
+                    body = `        match ok {\n            None | Some(Value::Null) => Ok(None),\n            Some(v) => Ok(Some(ScriptedWireRow::new(v))),\n        }`;
+                }
+                else {
+                    body = `        let obj = match ok { Some(Value::Obj(pairs)) => pairs, _ => Vec::new() };\n        Ok(obj.into_iter().map(|(k, v)| (k, ScriptedWireRow::new(v))).collect())`;
+                }
+                methods.push(`    ${fnKw} ${nodeMethodName(node.id)}(&self, ${portsParam}: &${portsStructName(c.name, node.id)}, _bound: ${bt}) -> Result<${wireT}, BehaviorError> {
+        let ${okBind} = self.next(${rustStrLit(node.component)}).ok_or_else(|| unknown_component(${rustStrLit(node.component)}))?;
+        if is_err {
+            return Err(leaf_failure(err));
+        }
+${body}
+    }`);
+                continue;
+            }
             const decode = emitDecodeRow(c.name, node.id, rowT, ref, plan, emittedDecode, decodeFns, "");
-            // #129 (TEST glue): support the reference scriptedHandlers' echo forms (PROTOCOL.md §3.5) — the
-            // adapter normalizes `{"echo":"port","port":"X"}` / `{"echo":"items"}` to the port NAME, and the
-            // scripted handler
-            // ECHOES a NATIVE port back as its result. This makes a port-plane pin non-vacuous: the node's
-            // observed result IS the native value that flowed into its ports struct, so a dropped / re-boxed /
-            // zero-defaulted port diverges from run_behavior instead of passing. A port is echoable when its
-            // native type IS the node's outType (that is exactly when the row's `val` can hold it); `ports` is
-            // bound only when at least one port qualifies.
-            const echoable = echoablePorts(c, node, ref, plan, typedNodes);
-            const portsParam = echoable.length > 0 ? "ports" : "_ports";
-            // a Copy value (i64/f64/bool/Option<scalar>) is read directly — cloning it trips clippy clone_on_copy.
-            const own = (expr, r) => `${expr}${typeRefIsCopy(r) ? "" : ".clone()"}`;
-            // a NAMED outType row is FLATTENED (no `val`) — echo a named port by copying the struct's fields;
-            // a scalar/arr/opt outType row holds the port in its single `val` field.
-            const echoRow = (p) => ref.kind === "named"
-                ? `${rowT} { ${findDecl(plan, ref.name).fields.map((f) => `${rustFieldName(f.name)}: ${own(`${portsParam}.${portFieldName(p)}.${rustFieldName(f.name)}`, f.type)}`).join(", ")}, ..Default::default() }`
-                : `${rowT} { val: ${own(`${portsParam}.${portFieldName(p)}`, ref)}, ..Default::default() }`;
-            const echoBranch = echoable
-                .map((p) => `\n        if echo == ${rustStrLit(p)} {\n            return Some(${echoRow(p)});\n        }`)
-                .join("");
-            const okBind = echoable.length > 0 ? "(is_err, err, ok, echo)" : "(is_err, err, ok, _echo)";
-            methods.push(`    ${fnKw} ${nodeMethodName(node.id)}(&self, ${portsParam}: &${portsStructName(c.name, node.id)}, _bound: ${bt}) -> Option<${rowT}> {
-        let ${okBind} = self.next(${rustStrLit(node.component)})?;
+            // #129 (TEST glue): if this node has an `items` port and its outType is a bare arr, support the
+            // reference scriptedHandlers' `echo === "items"` — the scripted handler ECHOES the NATIVE `f_items`
+            // port back as its result. This makes the node→leaf array dataflow test non-vacuous: the leaf's
+            // observed result is exactly the native array that flowed into its ports struct, so a dropped or
+            // boxed native array would diverge from run_behavior. `ports` is bound only on the echo path.
+            const canEcho = ref.kind === "arr" && Object.prototype.hasOwnProperty.call(node.ports, "items");
+            const portsParam = canEcho ? "ports" : "_ports";
+            const echoBranch = canEcho
+                ? `\n        if echo == "items" {\n            return Ok(${rowT} { val: ${portsParam}.${portFieldName("items")}.clone() });\n        }`
+                : "";
+            const okBind = canEcho ? "(is_err, err, ok, echo)" : "(is_err, err, ok, _echo)";
+            methods.push(`    ${fnKw} ${nodeMethodName(node.id)}(&self, ${portsParam}: &${portsStructName(c.name, node.id)}, _bound: ${bt}) -> Result<${rowT}, BehaviorError> {
+        let ${okBind} = self.next(${rustStrLit(node.component)}).ok_or_else(|| unknown_component(${rustStrLit(node.component)}))?;
         if is_err {
-            return Some(${rowT} { is_error: true, err, ..Default::default() });
+            return Err(leaf_failure(err));
         }${echoBranch}
         let v = ok.unwrap_or(Value::Null);
-        Some(${decode}(&v))
+        Ok(${decode}(&v))
     }`);
         }
-        traitImpls.push(`impl ${handlerTraitName(c.name)} for ScriptedNativeRaw {\n${methods.join("\n")}\n}`);
+        const cHasDeBox = c.body.some((n) => {
+            if ("cond" in n)
+                return false;
+            if ("map" in n || "fanout" in n)
+                return mapFanoutElemDeBoxEligible(n, typedNodes, plan);
+            return deBoxEligible(typedNodes.get(n.id));
+        });
+        const wireAssoc = cHasDeBox ? `    type Wire = ScriptedWireRow;\n` : "";
+        traitImpls.push(`impl ${handlerTraitName(c.name)} for ScriptedNativeRaw {\n${wireAssoc}${methods.join("\n")}\n}`);
     }
     const arms = native
         .map((c) => {
@@ -2152,7 +3122,7 @@ impl ScriptedNativeRaw {
     }
 
     // drain one scripted outcome for a component (last entry repeats — mirrors the reference scripted
-    // handlers); None when the component has no scripted queue (fail-closed). Returns (is_error, err,
+    // handlers); None when the component has no scripted queue. Returns (is_error, err,
     // ok_value, echo). The bc#87 parallel-stage runner calls node_* from multiple threads, so the drain
     // is Mutex-guarded. #129: \`echo\` carries the reference scriptedHandlers' \`echo\` directive (e.g.
     // "items") so a scripted node can ECHO a named input PORT back — used to make the node→leaf array
@@ -2162,13 +3132,11 @@ impl ScriptedNativeRaw {
         let mut queues = self.queues.lock().unwrap();
         let (queue, single) = queues.get_mut(component)?;
         let raw = if *single || queue.len() <= 1 { queue[0].clone() } else { queue.remove(0) };
-        // PROTOCOL.md §3.5 echo forms, normalized to the port NAME: {"echo":"port","port":"X"} -> "X"
-        // ({"echo":"items"} is already that shape). The generated node method just compares this
-        // against its echoable port names.
-        let echo = match raw.get("echo").and_then(|e| e.as_str()) {
-            Some("port") => raw.get("port").and_then(|p| p.as_str()).unwrap_or("").to_string(),
-            Some(other) => other.to_string(),
-            None => String::new(),
+        // normalize echo:port to the port NAME X so a de-box handler's echo comparison fires;
+        // echo:items already names the port directly.
+        let echo = {
+            let e = raw.get("echo").and_then(|e| e.as_str()).unwrap_or("");
+            if e == "port" { raw.get("port").and_then(|p| p.as_str()).unwrap_or("").to_string() } else { e.to_string() }
         };
         if let Some(okv) = raw.get("ok") {
             let v = behavior_contracts::decode_value(okv).expect("decode ok");
@@ -2196,9 +3164,27 @@ use behavior_contracts::Value;
 use super::*;
 
 // bridge the covered module's LOCAL BehaviorError (super::BehaviorError) to the bc-runtime failure type
-// the conformance harness reads (same code + message) — the ONLY place the two meet (test glue).
+// the conformance harness reads (same code + message + structured detail) — the ONLY place the two meet
+// (test glue). The de-box's structured Error Value is carried over so the harness can assert it.
 fn to_rt_err(e: BehaviorError) -> behavior_contracts::BehaviorError {
-    behavior_contracts::BehaviorError::new(e.code, e.message)
+    let mut rt = behavior_contracts::BehaviorError::new(e.code, e.message);
+    if let Some(d) = e.detail {
+        let d = *d;
+        rt.detail = Some(Box::new(behavior_contracts::ErrorDetail {
+            kind: d.kind.map(|k| match k {
+                ErrorKind::TypeMismatch => behavior_contracts::ErrorKind::TypeMismatch,
+                ErrorKind::MissingField => behavior_contracts::ErrorKind::MissingField,
+                ErrorKind::Overflow => behavior_contracts::ErrorKind::Overflow,
+            }),
+            model: d.model,
+            field: d.field,
+            expected_type: d.expected_type,
+            actual_wire_type: d.actual_wire_type,
+            raw_value: d.raw_value,
+            context: d.context,
+        }));
+    }
+    rt
 }
 ${anyAsyncRunner
         ? `// bc#97 (TEST glue) — a minimal std-only block-on that drives an async runner Future to completion so
@@ -2238,6 +3224,9 @@ ${decodeFns.join("\n\n")}
 // input decoders (generic &[(String,Value)] -> concrete InNR_<comp>; TEST glue, one decode at the boundary).
 ${inDecoders}
 
+// scripted wire adapter (TEST glue) — wraps a scripted Value as a WireRow the generated de-box probes.
+${wireAdapter}
+
 ${adapter}
 
 // scripted handler trait impls (one per covered component — the concrete node_* seam, test glue).
@@ -2260,10 +3249,8 @@ ${arms}
 }
 /** emitInDecoder — a TEST-glue decoder `decode_InNR_<comp>(input) -> Result<InNR_<comp>, BehaviorError>`.
  * Reads each declared input port from the generic &[(String,Value)] into the concrete field (scalar →
- * typed read; opt → Some/None; Value-typed → the raw Value clone). A key that is absent, or present as
- * `Value::Null`, leaves the field's Default — for an OPTIONAL port that is `None` (absent), which is the
- * same value `refCore` observes for the `null` binding run_behavior is given. Lives ONLY in the observe
- * companion. */
+ * typed read; Value-typed → the raw Value clone). A missing key leaves Default (every covered input is
+ * required + supplied by the corpus). Lives ONLY in the observe companion. */
 function emitInDecoder(comp, plan) {
     const name = inStructName(comp.name);
     const ports = Object.keys(comp.inputPorts ?? {});
@@ -2285,15 +3272,7 @@ function emitInDecoder(comp, plan) {
         const et = schema.elemType;
         const head = i === 0 ? "        if" : "        } else if";
         lines.push(`${head} k == ${rustStrLit(p)} {`);
-        if (inputPortIsOptional(schema)) {
-            // An OPTIONAL port decodes into its native Option<T>. materializeExpr's opt de-box IS the wire
-            // rule: `Value::Null` → None (absent), any other value → Some(<inner>). A key that never appears
-            // keeps the struct Default (None) — the same absent value. Checked FIRST: optionality wraps every
-            // inner type (an optional array is Option<Vec<T>>, not Vec<T>).
-            const optRef = inputPortTypeRef(schema, plan);
-            lines.push(`            in_.${field} = ${materializeExpr("v", optRef, plan)};`);
-        }
-        else if ((schema?.type === "array" || schema?.type === "arr") && et !== undefined) {
+        if ((schema?.type === "array" || schema?.type === "arr") && et !== undefined) {
             // #108: decode the boxed Value::Arr into the native Vec<ElemT> (test glue — materialize each elem).
             const elemRef = deriveTypeRef(et, plan);
             const elemTy = renderTypeRef(elemRef);
@@ -2313,6 +3292,11 @@ function emitInDecoder(comp, plan) {
             const mapRef = { kind: "map", value: deriveTypeRef(et, plan) };
             lines.push(`            in_.${field} = ${materializeExpr("v", mapRef, plan)};`);
         }
+        else if (inputPortIsOptional(schema)) {
+            // #139: an OPTIONAL scalar port decodes into Option<T> via the inputPortTypeRef SSoT (a present key
+            // materializes Some(v); an absent key never enters this block, leaving the Default None).
+            lines.push(`            in_.${field} = ${materializeExpr("v", inputPortTypeRef(schema, plan), plan)};`);
+        }
         else if (scalar === undefined) {
             lines.push(`            in_.${field} = v.clone();`);
         }
@@ -2331,14 +3315,6 @@ function emitInDecoder(comp, plan) {
     lines.push(`}`);
     return lines.join("\n");
 }
-/** echoablePorts (TEST glue) — the node's ports whose NATIVE type is exactly the node's outType, in
- * declaration order. Those are the ports a scripted `echo: "<port>"` can return as the row (a scalar/arr/
- * opt row via its `val`; a NAMED row via its flattened fields copied from the struct port). A port with a
- * different type is not echoable (the row could not hold it). */
-function echoablePorts(comp, node, ref, plan, typedNodes) {
-    const want = renderTypeRef(ref);
-    return Object.keys(node.ports).filter((p) => portFieldRustType(node.ports[p], comp, plan, typedNodes, `port '${p}'`) === want);
-}
 /** emitDecodeRow — emit (once, deduped) a decoder `decode_row_<comp>_<node><suffix>(v: &Value) -> <rowT>`
  * that materializes the scripted ok Value into the concrete row struct. Named: reuse the Value->struct
  * marshaller + move fields; scalar/arr/opt: materialize into .val. TEST glue only. */
@@ -2353,12 +3329,12 @@ function emitDecodeRow(compName, nodeId, rowT, ref, plan, emitted, out, suffix)
         const decl = findDecl(plan, ref.name);
         lines.push(`    let t = marshal_${ref.name}(v).expect("scripted row decode");`);
         const inits = decl.fields.map((f) => `${rustFieldName(f.name)}: t.${rustFieldName(f.name)}`).join(", ");
-        lines.push(`    ${rowT} { ${inits}, ..Default::default() }`);
+        lines.push(`    ${rowT} { ${inits} }`);
     }
     else {
         const mat = materializeExpr("v", ref, plan);
         lines.push(`    let val = (|| -> Result<${renderTypeRef(ref)}, BehaviorError> { Ok(${mat}) })().expect("scripted row decode");`);
-        lines.push(`    ${rowT} { val, ..Default::default() }`);
+        lines.push(`    ${rowT} { val }`);
     }
     lines.push(`}`);
     out.push(lines.join("\n"));