nomen-lang 0.6.12 → 0.7.0

package/core/System/Buffer.nm

@@ -3,7 +3,7 @@
 // class, the monomorphizer rewrites a Buffer<T> field to ClassBuffer<T>.
 //
 // Public API is the size-aware family (`alloc`/`grow`/`load`/`replace`/
-// `move`/`modify`/`shift`/`slice` plus the readonly `cap`). `replace` is the
+// `mv`/`modify`/`shift`/`slice` plus the readonly `cap`). `replace` is the
 // public write — it reclaims the displaced element, so it is correct on both
 // fresh and occupied slots. `store` (which assumes a fresh slot and leaks on
 // overwrite), `zero`, the fixed-width `*_u32`/`*_int`/`*_float` primitives,
@@ -93,6 +93,35 @@ pub struct Buffer<T> {
 		```
 	}
 
+	// Byte-width primitives (uint8 elements): the width-matched family the
+	// NEON planner's `.16b` descriptor keys on — one 16-byte group carries
+	// 16 lanes. `ldrb`/`strb` zero-extend/clobber exactly one byte.
+	internal inline func load_u8 = (self, int i: i >= 0 && i < self.cap, out uint8) {
+		```
+		#arch: c
+		return ((unsigned char*)(unsigned long long)self->data)[i];
+		```
+		```
+		#arch: aarch64
+		ldr x0, [x19, #8]
+		add x0, x0, x1
+		ldrb w0, [x0]
+		```
+	}
+
+	internal inline func store_u8 = (ref self, int i: i >= 0 && i < self.cap, uint8 val) {
+		```
+		#arch: c
+		((unsigned char*)(unsigned long long)self->data)[i] = val;
+		```
+		```
+		#arch: aarch64
+		ldr x0, [x19, #8]
+		add x0, x0, x1
+		strb w2, [x0]
+		```
+	}
+
 	internal func alloc_int = (ref self, int size, out int: out >= size) {
 		self.cap = size
 		self.data = calloc(size, 8)
@@ -259,7 +288,7 @@ pub struct Buffer<T> {
 	}
 
 	// Store `val` into slot `i`, which MUST be fresh (calloc'd, or zeroed by
-	// move). For an owning T (string, or a struct with string fields) the
+	// mv). For a mv T (string, or a struct with string fields) the
 	// specialised body deep-copies the incoming value but does NOT free the
 	// slot's previous occupant — a second `store` at an occupied index
 	// leaks it. To overwrite a live slot use replace (frees the displaced
@@ -308,11 +337,11 @@ pub struct Buffer<T> {
 	}
 
 	// Move a value out of a T_SIZE-sized slot: return it and zero the slot so the
-	// buffer no longer holds a (possibly owning) copy. Declared `move out T` so
+	// buffer no longer holds a (possibly mv) copy. Declared `mv out T` so
 	// the result is treated as OWNED by the borrow checker — the slot is
 	// relinquished, so the caller is the sole remaining owner. The value
 	// counterpart of ClassBuffer.move_int — used by List.pop for any value T.
-	inline func move = (ref self, int i: i >= 0 && i < self.cap, move out T) {
+	inline func move = (ref self, int i: i >= 0 && i < self.cap, mv out T) {
 		```
 		#arch: c
 		T* _slots = (T*)(unsigned long long)self->data;
@@ -375,8 +404,8 @@ pub struct Buffer<T> {
 	// aliases the slot's own copy (the round-trip case) is kept, not freed or
 	// re-copied. Unlike store this never leaks on overwrite, and unlike
 	// replace it is safe to derive the new value from the old one. The
-	// returned struct's owning fields must be fresh, null, or identical to
-	// the corresponding input fields (no cross-field aliasing). For owning
+	// returned struct's mv fields must be fresh, null, or identical to
+	// the corresponding input fields (no cross-field aliasing). For mv
 	// elements (string / structs with string fields) the build phase replaces
 	// this body with a specialized one (see owning_buffer_specialize.ts);
 	// this raw form is correct for trivially-copyable elements only. NOT
@@ -464,7 +493,7 @@ pub struct Buffer<T> {
 
 	// Store into a T_SIZE-sized slot, overwriting the previous value. For
 	// trivially-destructible value structs this is a plain overwrite. For
-	// owning value structs (with string fields), the build phase replaces this
+	// mv value structs (with string fields), the build phase replaces this
 	// body with a specialised version that calls T_destroy on the old slot
 	// value, then deep-copies (strdup per string field). See
 	// owning_buffer_specialize.ts (both backends). ClassBuffer.replace
@@ -512,12 +541,12 @@ pub struct Buffer<T> {
 
 	// Move-taking write, mirroring `List.set`: the caller's value is
 	// consumed and an independent copy is installed in the slot (replace
-	// deep-copies owning elements). The owning entry point a caller uses
+	// deep-copies mv elements). The mv entry point a caller uses
 	// when it wants to hand over a value — `replace`'s by-value parameter
-	// cannot accept the `move` keyword, so a borrow being transferred
+	// cannot accept the `mv` keyword, so a borrow being transferred
 	// (e.g. a loaded element) must go through here rather than be bound to
 	// a freed local.
-	pub func set = (ref self, int i: i >= 0 && i < self.cap, move T value) {
+	pub func set = (ref self, int i: i >= 0 && i < self.cap, mv T value) {
 		self.replace(i, value)
 	}
 
@@ -526,7 +555,7 @@ pub struct Buffer<T> {
 	// ownership-transferring primitive behind backward-shift deletion
 	// (Map/Set.remove) — unlike store, which gives the slot its own deep
 	// copy and leaves the source slot intact, a shift transfers the source's
-	// heap pointers wholesale. For owning elements (string / value structs
+	// heap pointers wholesale. For mv elements (string / value structs
 	// with string fields) the build replaces this body with a specialized
 	// version that also reclaims dst's previous value first (see
 	// owning_buffer_specialize.ts); this raw form is correct for
@@ -555,7 +584,7 @@ pub struct Buffer<T> {
 		b.eq .Lbuffer_shift_T_end
 		cmp x3, #8
 		b.gt .Lbuffer_shift_T_copy
-		// Width-matched move: an 8-byte access on a sub-8 element would
+		// Width-matched mv: an 8-byte access on a sub-8 element would
 		// clobber the following slot (and run past the slab's end).
 		cmp x3, #1
 		b.eq .Lbuffer_shift_T_1
@@ -597,7 +626,7 @@ pub struct Buffer<T> {
 		```
 	}
 
-	// A non-owning (ptr, len) slice [start, end) over this buffer's element
+	// A non-mv (ptr, len) slice [start, end) over this buffer's element
 	// storage, returned as a `view T`. It borrows from self: it may not outlive
 	// self's scope and is invalidated if self is reassigned. This is the single
 	// primitive every other slice (Array<T>, List<T>, user containers) builds
@@ -626,13 +655,13 @@ pub struct Buffer<T> {
 		```
 	}
 
-	// Internal: zeroes slots without reclaiming owning elements.
+	// Internal: zeroes slots without reclaiming mv elements.
 	internal inline func zero = (ref self, int len) {
 		memset(self.data, 0, len * T_SIZE)
 	}
 
 	// An independent copy: fresh slab, per-element deep copies. Each slot
-	// round-trips load→replace through a local, so owning element types get
+	// round-trips load→replace through a local, so mv element types get
 	// the same treatment a List<T>.copy slot does (the load materializes an
 	// owned copy, replace gives the destination its own). Class elements
 	// never reach this body (a `Buffer<T>` with T a class monomorphizes to
@@ -643,10 +672,10 @@ pub struct Buffer<T> {
 			dst.alloc(self.cap)
 			var i = 0
 			while i < self.cap {
-				// Bind the loaded element and hand it to `set` (move): for a
+				// Bind the loaded element and hand it to `set` (mv): for a
 				// string element load returns a BORROW of the source slot, and
-				// the move transfers it into the write without a scope-exit
-				// reclaim (which would free the source's buffer); for an owning
+				// the mv transfers it into the write without a scope-exit
+				// reclaim (which would free the source's buffer); for a mv
 				// struct element load returns an owned copy that transfers the
 				// same way. Mirrors List.copy's `var T v = self.at(i)` +
 				// `dst.push(v)`.

package/core/System/Channel.nm

@@ -2,8 +2,8 @@
 // tasks. Unbounded, FIFO, blocking receive.
 //
 // The queue node's payload is three words wide: every message carries a
-// (value, len, kind) triple. `send`/`receive` move uint64 values (len and
-// kind stay 0); `send_string`/`receive_string` move fat strings (kind = 1)
+// (value, len, kind) triple. `send`/`receive` mv uint64 values (len and
+// kind stay 0); `send_string`/`receive_string` mv fat strings (kind = 1)
 // without truncating the len half. `#destroy` frees only string payloads —
 // a raw uint64 payload is a value, not a pointer. A typed Channel<T>
 // wrapper can come later — the storage story is identical, only the
@@ -19,10 +19,22 @@
 // Default stance in Nomen is "no shared mutable state" — channels are the
 // preferred way for tasks to communicate. See ASYNC.md.
 
+// Channel is an OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 3 — the shape
+// menu): every field is an opaque handle/counter word, so the value is
+// movable and its `#destroy` closes what the handles name. Sharing one
+// across tasks rides the checked region borrows (`async { }` — the join
+// bounds the borrow) or a transfer (`mv ch` — the receiver owns the
+// queue). The send/receive methods take the receiver bare (struct receivers
+// travel by address), so queue mutations land in the one shared instance,
+// never in a copy.
+//
+// Default stance in Nomen is "no shared mutable state" — channels are the
+// preferred way for tasks to communicate. See ASYNC.md.
+
 /**
  * A thread-safe, blocking FIFO queue for passing values between tasks
  **/
-pub class Channel: Sendable {
+pub mv struct Channel {
 	pub var uint64 mu = 0
 	pub var uint64 not_empty_cv = 0
 	pub var uint64 head = 0
@@ -44,13 +56,17 @@ pub class Channel: Sendable {
 		```
 		```
 		#arch: c
-		self->mu = (unsigned long long)malloc(sizeof(pthread_mutex_t));
-		self->not_empty_cv = (unsigned long long)malloc(sizeof(pthread_cond_t));
-		pthread_mutex_init((pthread_mutex_t *)self->mu, NULL);
-		pthread_cond_init((pthread_cond_t *)self->not_empty_cv, NULL);
-		self->head = 0;
-		self->tail = 0;
-		self->waiters = 0;
+		// The constructor's `self` is the INLINE instance (a local value in
+		// the C lowering — methods take the pointer form, the ctor does not),
+		// so this body uses the `.` accessor; the aarch64 body writes through
+		// x19 = &instance as always.
+		self.mu = (unsigned long long)malloc(sizeof(pthread_mutex_t));
+		self.not_empty_cv = (unsigned long long)malloc(sizeof(pthread_cond_t));
+		pthread_mutex_init((pthread_mutex_t *)self.mu, NULL);
+		pthread_cond_init((pthread_cond_t *)self.not_empty_cv, NULL);
+		self.head = 0;
+		self.tail = 0;
+		self.waiters = 0;
 		```
 		```
 		#arch: aarch64
@@ -251,7 +267,7 @@ pub class Channel: Sendable {
 	// (the node's copy is moved out — the payload leaves the channel, and a
 	// second receive of the same message is not possible). The fat (ptr, len)
 	// pair survives intact. Pair with send_string.
-	pub func receive_string = (self, move out string) {
+	pub func receive_string = (self, mv out string) {
 		```
 		#arch: c
 		pthread_mutex_lock((pthread_mutex_t *)self->mu);

package/core/System/ClassBuffer.nm

@@ -95,15 +95,15 @@ pub struct ClassBuffer<T> {
 	}
 
 	// Store the owned class pointer `val` into slot `i`, which MUST be fresh
-	// (calloc'd, or zeroed by move/move_int). Takes OWNERSHIP of `val`
-	// (`move`): the slot's #destroy reclaims the instance, so the caller must
+	// (calloc'd, or zeroed by mv/move_int). Takes OWNERSHIP of `val`
+	// (`mv`): the slot's #destroy reclaims the instance, so the caller must
 	// not free its copy — a fresh constructor result transfers here directly,
 	// and a local must be moved (its own cleanup is suppressed at the call
 	// site). This is a plain pointer store — it does NOT destroy/free the
 	// slot's previous occupant, so a second `store` at an occupied index
 	// leaks that instance. Use replace (or replace_int) to overwrite a live
 	// slot.
-	internal inline func store = (ref self, int i: i >= 0 && i < self.cap, move T val: val != 0) {
+	internal inline func store = (ref self, int i: i >= 0 && i < self.cap, mv T val: val != 0) {
 		```
 		#arch: c
 		((long*)(unsigned long long)self->data)[i] = (long)val;
@@ -118,14 +118,14 @@ pub struct ClassBuffer<T> {
 	}
 
 	// Move a class pointer out of a slot: return it and zero the slot so the
-	// buffer no longer references it. Declared `move out T` so the borrow
+	// buffer no longer references it. Declared `mv out T` so the borrow
 	// checker treats the result as OWNED — the slot is relinquished, so the
-	// caller is the sole remaining owner. This is the owning-extract primitive
+	// caller is the sole remaining owner. This is the mv-extract primitive
 	// (parallel to List.pop); use it (not load) when transferring ownership
-	// out of a ClassBuffer slot, or moving a value into a fresh owning
+	// out of a ClassBuffer slot, or moving a value into a fresh mv
 	// container — load returns a BORROW (the slot is unchanged) and storing
 	// it elsewhere would create shared ownership (double-free at destroy).
-	inline func move = (ref self, int i: i >= 0 && i < self.cap, move out T) {
+	inline func move = (ref self, int i: i >= 0 && i < self.cap, mv out T) {
 		```
 		#arch: c
 		long *slots = (long*)(unsigned long long)self->data;
@@ -143,13 +143,19 @@ pub struct ClassBuffer<T> {
 		```
 	}
 
-	// Apply `f` to slot `i` in place — the owning-counterpart of Buffer's
+	// Apply `f` to slot `i` in place — the mv-counterpart of Buffer's
 	// modify for class elements. `f` receives the current instance pointer
-	// as a borrow and returns the replacement instance (fresh, or the same
-	// pointer); the primitive frees the displaced instance (destroy + free)
-	// unless `f` returned it. Storing the returned instance raw is sound:
-	// the slot takes sole ownership and `f`'s return is not retained
-	// elsewhere. NOT `inline`: the body calls through the fn pointer.
+	// as a MOVE argument — the only expressible parameter mode for a
+	// class-tier element (a bare `Box<T>` param is rejected — B2/T2 — and a
+	// `ref` param's &binding lowering mismatches this raw call) — so the
+	// displaced instance's reclamation is the CALLEE's mv-param contract:
+	// a function whose parameter is not returned frees it at its own exit
+	// (the C auto-free registration / the aarch64 return-compare arm). The
+	// body frees nothing — freeing here too was a double free (the
+	// aarch64 callee already reclaimed it; the audit caught the stale
+	// free). Storing the returned instance raw is sound: the slot takes
+	// sole ownership and `f`'s return is not retained elsewhere. NOT
+	// `inline`: the body calls through the fn pointer.
 	func modify = (ref self, int i: i >= 0 && i < self.cap, func(T, out T) f) {
 		```
 		#arch: c
@@ -157,15 +163,13 @@ pub struct ClassBuffer<T> {
 		void *old = (void*)slots[i];
 		void *new_value = (void*)((void *(*)(void *, void *))f->code)(f->env, old);
 		slots[i] = (long)new_value;
-		if (old != new_value) {
-			T_destroy(old);
-			free(old);
-		}
 		```
 		```
 		#arch: aarch64
 		// x19 = self, x1 = i, x2 = f (a closure descriptor — env goes in x0,
 		// the old slot value shifts to x1). Class slots are one pointer wide.
+		// `old` is MOVED into f — the callee's mv-param contract reclaims
+		// it; this body frees nothing.
 		stp x20, x21, [sp, #-16]!
 		stp x22, x23, [sp, #-16]!
 		stp x24, x25, [sp, #-16]!
@@ -178,15 +182,7 @@ pub struct ClassBuffer<T> {
 		ldr x1, [x20]
 		blr x24
 		mov x23, x0
-		ldr x9, [x20]
 		str x23, [x20]
-		cmp x9, x23
-		b.eq .Lcb_modify_T_done
-		mov x0, x9
-		bl T_destroy
-		mov x0, x9
-		bl _free
-		.Lcb_modify_T_done:
 		ldp x24, x25, [sp], #16
 		ldp x22, x23, [sp], #16
 		ldp x20, x21, [sp], #16
@@ -262,8 +258,8 @@ pub struct ClassBuffer<T> {
 	// free) then store the new one. Used by List.set so the uniform API
 	// preserves ownership for class elements.
 	// Overwrite a live slot: destroy + free the displaced instance, then take
-	// OWNERSHIP of `val` (`move`) — same transfer rule as store.
-	func replace = (ref self, int i: i >= 0 && i < self.cap, move T val: val != 0) {
+	// OWNERSHIP of `val` (`mv`) — same transfer rule as store.
+	func replace = (ref self, int i: i >= 0 && i < self.cap, mv T val: val != 0) {
 		```
 		#arch: c
 		long *slots = (long*)(unsigned long long)self->data;
@@ -343,7 +339,7 @@ pub struct ClassBuffer<T> {
 		```
 	}
 
-	// A non-owning (ptr, len) slice [start, end) over this buffer's class
+	// A non-mv (ptr, len) slice [start, end) over this buffer's class
 	// pointers, returned as a `view T` (T is a class, so each element is an
 	// 8-byte pointer). Borrows from self — invalidated on reassignment. Mirrors
 	// Buffer.slice; ClassBuffer stores 8-byte slots, so the element width is 8.

package/core/System/Console.nm

@@ -70,8 +70,8 @@ pub struct Console {
 	}
 
 	// Read one line from stdin (newline stripped). The raw body mallocs the
-	// buffer — `move out string` transfers ownership to the caller.
-	pub func read_line = (move out string) {
+	// buffer — `mv out string` transfers ownership to the caller.
+	pub func read_line = (mv out string) {
 		```
 		#arch: c
 		int cap = 16;
@@ -153,8 +153,8 @@ pub struct Console {
 	}
 
 	// The platform name ("macos" / "ios" / …). The raw body strdups a static
-	// string — `move out string` transfers the owned copy to the caller.
-	pub func platform = (move out string) {
+	// string — `mv out string` transfers the owned copy to the caller.
+	pub func platform = (mv out string) {
 		```
 		#arch: c
 		#platform: macos

package/core/System/Controls/Button.nm

@@ -1,7 +1,12 @@
 /**
  * A push-button control that triggers an action when clicked
+ *
+ * An OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 4 — the shape menu): the
+ * single field is an AppKit handle, so the value is movable and its
+ * `#destroy` releases what the handle names. The constructor's `self` is
+ * the inline instance (the `.` accessor); methods keep the pointer form.
  **/
-pub class Button: Control {
+pub mv struct Button : Control {
 	var uint64 handle = 0
 
 	pub func #init = (self, Window window, string title) {
@@ -22,7 +27,7 @@ pub class Button: Control {
 			(id)window->handle, sel_registerName("contentView"));
 		((void(*)(id, SEL, id))objc_msgSend)(
 			contentView, sel_registerName("addSubview:"), btn);
-		self->handle = (uint64_t)btn;
+		self.handle = (uint64_t)btn;
 		```
 		```
 		#arch: aarch64_use_c
@@ -61,7 +66,7 @@ pub class Button: Control {
 			sel_registerName("view"));
 		((void(*)(id, SEL, id))objc_msgSend)(
 			parentView, sel_registerName("addSubview:"), btn);
-		self->handle = (uint64_t)btn;
+		self.handle = (uint64_t)btn;
 		```
 		```
 		#arch: aarch64_use_c

package/core/System/Controls/CheckBox.nm

@@ -1,7 +1,12 @@
 /**
  * A toggle control with a title and checked/hidden state
+ *
+ * An OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 4 — the shape menu): the
+ * single field is an AppKit handle, so the value is movable and its
+ * `#destroy` releases what the handle names. The constructor's `self` is
+ * the inline instance (the `.` accessor); methods keep the pointer form.
  **/
-pub class CheckBox: Control {
+pub mv struct CheckBox : Control {
 	var uint64 handle = 0
 
 	pub func #init = (self, Window window) {
@@ -20,7 +25,7 @@ pub class CheckBox: Control {
 			(id)window->handle, sel_registerName("contentView"));
 		((void(*)(id, SEL, id))objc_msgSend)(
 			contentView, sel_registerName("addSubview:"), cb);
-		self->handle = (uint64_t)cb;
+		self.handle = (uint64_t)cb;
 		```
 		```
 		#arch: aarch64_use_c
@@ -52,7 +57,7 @@ pub class CheckBox: Control {
 			sel_registerName("view"));
 		((void(*)(id, SEL, id))objc_msgSend)(
 			parentView, sel_registerName("addSubview:"), cb);
-		self->handle = (uint64_t)cb;
+		self.handle = (uint64_t)cb;
 		```
 		```
 		#arch: aarch64_use_c

package/core/System/Controls/Container.nm

@@ -241,6 +241,9 @@ pub func native_intrinsic = (uint64 handle, out [int, int]) {
 /**
  * A flexbox-style container that measures and arranges its child controls.
  *
+ * An OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 4 — the shape menu): the
+ * SoA buffers mv with the value and a scope-exit destroy reclaims them.
+ * *
  * Conforms to `Control`: `measure(BoxConstraints)` measures the whole subtree,
  * `set_frame` arranges it into a rectangle, and `intrinsic_size` reports the
  * unbounded-content size. The handle-based `add` API and the SoA engine are
@@ -248,7 +251,7 @@ pub func native_intrinsic = (uint64 handle, out [int, int]) {
  * so a `Container` can also be driven polymorphically as a `Control` (passed to
  * a `Control`-taking function, stored in a `ClassBuffer<Control>`, etc.).
  **/
-pub class Container: Control {
+pub mv struct Container : Control {
 	var kinds = Buffer<int>()
 	// Per-leaf requested size, stored as a (kind, value) pair per axis. The
 	// kind is one of LEN_* (auto/fixed/percent/fill); the value is the pixel
@@ -1454,10 +1457,12 @@ pub class Container: Control {
 		// nomen_layout_thunk is a free function (defined in Nomen below) that
 		// forwards to Container.layout — exported for C linkage on both
 		// backends, unlike the layout method itself. It takes the Container by
-		// `ref` (mutable reference): as a `class`, `ref Container` lowers to
-		// `struct Container **` (reference to the instance pointer), so the
-		// callback passes the address of the stored instance pointer.
-		extern void nomen_layout_thunk(struct Container**, struct Window*);
+		// `ref` (mutable reference): as a mv struct, `ref Container` lowers
+		// to `struct Container *` (the address of the value), so the callback
+		// passes the stored instance address directly. The address must stay
+		// valid for as long as the delegate is installed — an app-lifetime
+		// Container binding (or a Box<Container>).
+		extern void nomen_layout_thunk(struct Container*, struct Window*);
 		static void *g_resize_grid = 0;
 		static void *g_resize_win = 0;
 		void nomen_set_resize_target(void *grid, void *win) {
@@ -1467,7 +1472,7 @@ pub class Container: Control {
 		void nomen_window_did_resize(id self, SEL cmd, id notification) {
 			(void)self; (void)cmd; (void)notification;
 			if (g_resize_grid && g_resize_win) {
-				nomen_layout_thunk((struct Container**)&g_resize_grid, (struct Window*)g_resize_win);
+				nomen_layout_thunk((struct Container*)g_resize_grid, (struct Window*)g_resize_win);
 			}
 		}
 		```
@@ -1480,10 +1485,12 @@ pub class Container: Control {
 		// nomen_layout_thunk is a free function (defined in Nomen below) that
 		// forwards to Container.layout — exported for C linkage on both
 		// backends, unlike the layout method itself. It takes the Container by
-		// `ref` (mutable reference): as a `class`, `ref Container` lowers to
-		// `struct Container **` (reference to the instance pointer), so the
-		// callback passes the address of the stored instance pointer.
-		extern void nomen_layout_thunk(struct Container**, struct Window*);
+		// `ref` (mutable reference): as a mv struct, `ref Container` lowers
+		// to `struct Container *` (the address of the value), so the callback
+		// passes the stored instance address directly. The address must stay
+		// valid for as long as the delegate is installed — an app-lifetime
+		// Container binding (or a Box<Container>).
+		extern void nomen_layout_thunk(struct Container*, struct Window*);
 		static void *g_resize_grid = 0;
 		static void *g_resize_win = 0;
 		void nomen_set_resize_target(void *grid, void *win) {
@@ -1493,7 +1500,7 @@ pub class Container: Control {
 		void nomen_window_did_resize(id self, SEL cmd, id notification) {
 			(void)self; (void)cmd; (void)notification;
 			if (g_resize_grid && g_resize_win) {
-				nomen_layout_thunk((struct Container**)&g_resize_grid, (struct Window*)g_resize_win);
+				nomen_layout_thunk((struct Container*)g_resize_grid, (struct Window*)g_resize_win);
 			}
 		}
 		```

package/core/System/Controls/Layout.nm

@@ -4,7 +4,7 @@
 /**
  * A flat, buffer-backed layout tree — nodes stored in parallel arrays for the layout engine
  **/
-pub struct Layout {
+pub mv struct Layout {
 	var kinds = Buffer<int>() // 0=leaf, 1=vstack, 2=hstack
 	var ws = Buffer<int>() // intrinsic width (leaf) or 0
 	var hs = Buffer<int>() // intrinsic height (leaf) or 0

package/core/System/Controls/Text.nm

@@ -1,7 +1,12 @@
 /**
  * A read-only text label control
+ *
+ * An OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 4 — the shape menu): the
+ * AppKit handle plus the cached label text mv with the value, and the
+ * `#destroy` releases what the handle names. The constructor's `self` is
+ * the inline instance (the `.` accessor); methods keep the pointer form.
  **/
-pub class Text: Control {
+pub mv struct Text : Control {
 	var uint64 handle = 0
 	var text = ""
 
@@ -25,7 +30,7 @@ pub class Text: Control {
 			(id)window->handle, sel_registerName("contentView"));
 		((void(*)(id, SEL, id))objc_msgSend)(
 			contentView, sel_registerName("addSubview:"), label);
-		self->handle = (uint64_t)label;
+		self.handle = (uint64_t)label;
 		```
 		```
 		#arch: aarch64_use_c
@@ -67,7 +72,7 @@ pub class Text: Control {
 			sel_registerName("view"));
 		((void(*)(id, SEL, id))objc_msgSend)(
 			parentView, sel_registerName("addSubview:"), label);
-		self->handle = (uint64_t)label;
+		self.handle = (uint64_t)label;
 		```
 		```
 		#arch: aarch64_use_c
@@ -93,7 +98,7 @@ pub class Text: Control {
 	}
 
 	pub func set_text = (ref self, string text) {
-		self.text = text
+		self.text = text.copy()
 		```
 		#arch: c
 		#platform: macos

package/core/System/Controls/TextBox.nm

@@ -1,7 +1,12 @@
 /**
  * An editable single-line text input control
+ *
+ * An OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 4 — the shape menu): the
+ * single field is an AppKit handle, so the value is movable and its
+ * `#destroy` releases what the handle names. The constructor's `self` is
+ * the inline instance (the `.` accessor); methods keep the pointer form.
  **/
-pub class TextBox: Control {
+pub mv struct TextBox : Control {
 	var uint64 handle = 0
 
 	pub func #init = (self, Window window) {
@@ -30,7 +35,7 @@ pub class TextBox: Control {
 			(id)window->handle, sel_registerName("contentView"));
 		((void(*)(id, SEL, id))objc_msgSend)(
 			contentView, sel_registerName("addSubview:"), field);
-		self->handle = (uint64_t)field;
+		self.handle = (uint64_t)field;
 		```
 		```
 		#arch: aarch64_use_c
@@ -74,7 +79,7 @@ pub class TextBox: Control {
 			sel_registerName("view"));
 		((void(*)(id, SEL, id))objc_msgSend)(
 			parentView, sel_registerName("addSubview:"), field);
-		self->handle = (uint64_t)field;
+		self.handle = (uint64_t)field;
 		```
 		```
 		#arch: aarch64_use_c

package/core/System/Controls/Window.nm

@@ -1,7 +1,14 @@
 /**
  * A top-level native window that hosts controls and dispatches events
+ *
+ * An OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 4 — the shape menu): the
+ * single field is an AppKit handle, so the value is movable and its
+ * `#destroy` releases what the handle names. The methods take the receiver
+ * bare (struct receivers travel by address — the raw bodies keep the
+ * pointer form); the constructor's `self` is the inline instance (the `.`
+ * accessor).
  **/
-pub class Window: Control {
+pub mv struct Window : Control {
 	var uint64 handle = 0
 
 	pub func #init = (self, string title, int width, int height) {
@@ -32,7 +39,7 @@ pub class Window: Control {
 		id cv = ((id(*)(id, SEL))objc_msgSend)(win, sel_registerName("contentView"));
 		((void(*)(id, SEL, unsigned long))objc_msgSend)(cv, sel_registerName("setAutoresizingMask:"), 18UL);
 		((void(*)(id, SEL, BOOL))objc_msgSend)(cv, sel_registerName("setAutoresizesSubviews:"), 1);
-		self->handle = (uint64_t)win;
+		self.handle = (uint64_t)win;
 		```
 		```
 		#arch: aarch64_use_c
@@ -71,7 +78,7 @@ pub class Window: Control {
 			sel_registerName("initWithFrame:"),
 			((CGRect(*)(double, double, double, double))CGRectMake)(0, 0, (double)width, (double)height));
 		((void(*)(id, SEL))objc_msgSend)(win, sel_registerName("makeKeyAndVisible"));
-		self->handle = (uint64_t)win;
+		self.handle = (uint64_t)win;
 		```
 		```
 		#arch: aarch64_use_c

package/core/System/Fiber.nm

@@ -29,6 +29,10 @@
 // reads the packed handles from the instance's fields and drives the
 // scheduler. The runtime (scheduler, context switch) lives in the build's
 // emitted companion C — see build_fiber_spawn.
+//
+// Fiber is an OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 2 — the shape
+// menu), exactly like Thread: handle fields only, movable, `#destroy`
+// enforces must-start.
 
 // The launch surface's return type (ASYNC.md: the dependency is
 // declared by the library file, not inferred from user-source tokens).
@@ -37,7 +41,7 @@ import Task
 /**
  * A stackful coroutine: lightweight, cooperatively scheduled, parks instead of blocking
  **/
-pub class Fiber<T> : Sendable, Spawnable<T> {
+pub mv struct Fiber<T> : Spawnable<T> {
 	// The construction hook (see Thread.nm): the deferred-call special form.
 	#spawn = () {
 	}
@@ -67,7 +71,7 @@ pub class Fiber<T> : Sendable, Spawnable<T> {
 	// out of the instance (started; #destroy no-ops), return the handle.
 	// While the fiber waits, it parks and frees its worker instead of
 	// blocking it.
-	pub func start = (ref self, move out Task<T>) {
+	pub func start = (ref self, mv out Task<T>) {
 		```
 		#arch: c
 		struct nomen_future *_f = (struct nomen_future *)self->future;