nomen-lang 0.6.13 → 0.7.0

package/core/System/Channel.nm

@@ -2,8 +2,8 @@
 // tasks. Unbounded, FIFO, blocking receive.
 //
 // The queue node's payload is three words wide: every message carries a
-// (value, len, kind) triple. `send`/`receive` move uint64 values (len and
-// kind stay 0); `send_string`/`receive_string` move fat strings (kind = 1)
+// (value, len, kind) triple. `send`/`receive` mv uint64 values (len and
+// kind stay 0); `send_string`/`receive_string` mv fat strings (kind = 1)
 // without truncating the len half. `#destroy` frees only string payloads —
 // a raw uint64 payload is a value, not a pointer. A typed Channel<T>
 // wrapper can come later — the storage story is identical, only the
@@ -19,10 +19,22 @@
 // Default stance in Nomen is "no shared mutable state" — channels are the
 // preferred way for tasks to communicate. See ASYNC.md.
 
+// Channel is an OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 3 — the shape
+// menu): every field is an opaque handle/counter word, so the value is
+// movable and its `#destroy` closes what the handles name. Sharing one
+// across tasks rides the checked region borrows (`async { }` — the join
+// bounds the borrow) or a transfer (`mv ch` — the receiver owns the
+// queue). The send/receive methods take the receiver bare (struct receivers
+// travel by address), so queue mutations land in the one shared instance,
+// never in a copy.
+//
+// Default stance in Nomen is "no shared mutable state" — channels are the
+// preferred way for tasks to communicate. See ASYNC.md.
+
 /**
  * A thread-safe, blocking FIFO queue for passing values between tasks
  **/
-pub class Channel: Sendable {
+pub mv struct Channel {
 	pub var uint64 mu = 0
 	pub var uint64 not_empty_cv = 0
 	pub var uint64 head = 0
@@ -44,13 +56,17 @@ pub class Channel: Sendable {
 		```
 		```
 		#arch: c
-		self->mu = (unsigned long long)malloc(sizeof(pthread_mutex_t));
-		self->not_empty_cv = (unsigned long long)malloc(sizeof(pthread_cond_t));
-		pthread_mutex_init((pthread_mutex_t *)self->mu, NULL);
-		pthread_cond_init((pthread_cond_t *)self->not_empty_cv, NULL);
-		self->head = 0;
-		self->tail = 0;
-		self->waiters = 0;
+		// The constructor's `self` is the INLINE instance (a local value in
+		// the C lowering — methods take the pointer form, the ctor does not),
+		// so this body uses the `.` accessor; the aarch64 body writes through
+		// x19 = &instance as always.
+		self.mu = (unsigned long long)malloc(sizeof(pthread_mutex_t));
+		self.not_empty_cv = (unsigned long long)malloc(sizeof(pthread_cond_t));
+		pthread_mutex_init((pthread_mutex_t *)self.mu, NULL);
+		pthread_cond_init((pthread_cond_t *)self.not_empty_cv, NULL);
+		self.head = 0;
+		self.tail = 0;
+		self.waiters = 0;
 		```
 		```
 		#arch: aarch64
@@ -251,7 +267,7 @@ pub class Channel: Sendable {
 	// (the node's copy is moved out — the payload leaves the channel, and a
 	// second receive of the same message is not possible). The fat (ptr, len)
 	// pair survives intact. Pair with send_string.
-	pub func receive_string = (self, move out string) {
+	pub func receive_string = (self, mv out string) {
 		```
 		#arch: c
 		pthread_mutex_lock((pthread_mutex_t *)self->mu);

package/core/System/ClassBuffer.nm

@@ -95,15 +95,15 @@ pub struct ClassBuffer<T> {
 	}
 
 	// Store the owned class pointer `val` into slot `i`, which MUST be fresh
-	// (calloc'd, or zeroed by move/move_int). Takes OWNERSHIP of `val`
-	// (`move`): the slot's #destroy reclaims the instance, so the caller must
+	// (calloc'd, or zeroed by mv/move_int). Takes OWNERSHIP of `val`
+	// (`mv`): the slot's #destroy reclaims the instance, so the caller must
 	// not free its copy — a fresh constructor result transfers here directly,
 	// and a local must be moved (its own cleanup is suppressed at the call
 	// site). This is a plain pointer store — it does NOT destroy/free the
 	// slot's previous occupant, so a second `store` at an occupied index
 	// leaks that instance. Use replace (or replace_int) to overwrite a live
 	// slot.
-	internal inline func store = (ref self, int i: i >= 0 && i < self.cap, move T val: val != 0) {
+	internal inline func store = (ref self, int i: i >= 0 && i < self.cap, mv T val: val != 0) {
 		```
 		#arch: c
 		((long*)(unsigned long long)self->data)[i] = (long)val;
@@ -118,14 +118,14 @@ pub struct ClassBuffer<T> {
 	}
 
 	// Move a class pointer out of a slot: return it and zero the slot so the
-	// buffer no longer references it. Declared `move out T` so the borrow
+	// buffer no longer references it. Declared `mv out T` so the borrow
 	// checker treats the result as OWNED — the slot is relinquished, so the
-	// caller is the sole remaining owner. This is the owning-extract primitive
+	// caller is the sole remaining owner. This is the mv-extract primitive
 	// (parallel to List.pop); use it (not load) when transferring ownership
-	// out of a ClassBuffer slot, or moving a value into a fresh owning
+	// out of a ClassBuffer slot, or moving a value into a fresh mv
 	// container — load returns a BORROW (the slot is unchanged) and storing
 	// it elsewhere would create shared ownership (double-free at destroy).
-	inline func move = (ref self, int i: i >= 0 && i < self.cap, move out T) {
+	inline func move = (ref self, int i: i >= 0 && i < self.cap, mv out T) {
 		```
 		#arch: c
 		long *slots = (long*)(unsigned long long)self->data;
@@ -143,13 +143,19 @@ pub struct ClassBuffer<T> {
 		```
 	}
 
-	// Apply `f` to slot `i` in place — the owning-counterpart of Buffer's
+	// Apply `f` to slot `i` in place — the mv-counterpart of Buffer's
 	// modify for class elements. `f` receives the current instance pointer
-	// as a borrow and returns the replacement instance (fresh, or the same
-	// pointer); the primitive frees the displaced instance (destroy + free)
-	// unless `f` returned it. Storing the returned instance raw is sound:
-	// the slot takes sole ownership and `f`'s return is not retained
-	// elsewhere. NOT `inline`: the body calls through the fn pointer.
+	// as a MOVE argument — the only expressible parameter mode for a
+	// class-tier element (a bare `Box<T>` param is rejected — B2/T2 — and a
+	// `ref` param's &binding lowering mismatches this raw call) — so the
+	// displaced instance's reclamation is the CALLEE's mv-param contract:
+	// a function whose parameter is not returned frees it at its own exit
+	// (the C auto-free registration / the aarch64 return-compare arm). The
+	// body frees nothing — freeing here too was a double free (the
+	// aarch64 callee already reclaimed it; the audit caught the stale
+	// free). Storing the returned instance raw is sound: the slot takes
+	// sole ownership and `f`'s return is not retained elsewhere. NOT
+	// `inline`: the body calls through the fn pointer.
 	func modify = (ref self, int i: i >= 0 && i < self.cap, func(T, out T) f) {
 		```
 		#arch: c
@@ -157,15 +163,13 @@ pub struct ClassBuffer<T> {
 		void *old = (void*)slots[i];
 		void *new_value = (void*)((void *(*)(void *, void *))f->code)(f->env, old);
 		slots[i] = (long)new_value;
-		if (old != new_value) {
-			T_destroy(old);
-			free(old);
-		}
 		```
 		```
 		#arch: aarch64
 		// x19 = self, x1 = i, x2 = f (a closure descriptor — env goes in x0,
 		// the old slot value shifts to x1). Class slots are one pointer wide.
+		// `old` is MOVED into f — the callee's mv-param contract reclaims
+		// it; this body frees nothing.
 		stp x20, x21, [sp, #-16]!
 		stp x22, x23, [sp, #-16]!
 		stp x24, x25, [sp, #-16]!
@@ -178,15 +182,7 @@ pub struct ClassBuffer<T> {
 		ldr x1, [x20]
 		blr x24
 		mov x23, x0
-		ldr x9, [x20]
 		str x23, [x20]
-		cmp x9, x23
-		b.eq .Lcb_modify_T_done
-		mov x0, x9
-		bl T_destroy
-		mov x0, x9
-		bl _free
-		.Lcb_modify_T_done:
 		ldp x24, x25, [sp], #16
 		ldp x22, x23, [sp], #16
 		ldp x20, x21, [sp], #16
@@ -262,8 +258,8 @@ pub struct ClassBuffer<T> {
 	// free) then store the new one. Used by List.set so the uniform API
 	// preserves ownership for class elements.
 	// Overwrite a live slot: destroy + free the displaced instance, then take
-	// OWNERSHIP of `val` (`move`) — same transfer rule as store.
-	func replace = (ref self, int i: i >= 0 && i < self.cap, move T val: val != 0) {
+	// OWNERSHIP of `val` (`mv`) — same transfer rule as store.
+	func replace = (ref self, int i: i >= 0 && i < self.cap, mv T val: val != 0) {
 		```
 		#arch: c
 		long *slots = (long*)(unsigned long long)self->data;
@@ -343,7 +339,7 @@ pub struct ClassBuffer<T> {
 		```
 	}
 
-	// A non-owning (ptr, len) slice [start, end) over this buffer's class
+	// A non-mv (ptr, len) slice [start, end) over this buffer's class
 	// pointers, returned as a `view T` (T is a class, so each element is an
 	// 8-byte pointer). Borrows from self — invalidated on reassignment. Mirrors
 	// Buffer.slice; ClassBuffer stores 8-byte slots, so the element width is 8.

package/core/System/Console.nm

@@ -70,8 +70,8 @@ pub struct Console {
 	}
 
 	// Read one line from stdin (newline stripped). The raw body mallocs the
-	// buffer — `move out string` transfers ownership to the caller.
-	pub func read_line = (move out string) {
+	// buffer — `mv out string` transfers ownership to the caller.
+	pub func read_line = (mv out string) {
 		```
 		#arch: c
 		int cap = 16;
@@ -153,8 +153,8 @@ pub struct Console {
 	}
 
 	// The platform name ("macos" / "ios" / …). The raw body strdups a static
-	// string — `move out string` transfers the owned copy to the caller.
-	pub func platform = (move out string) {
+	// string — `mv out string` transfers the owned copy to the caller.
+	pub func platform = (mv out string) {
 		```
 		#arch: c
 		#platform: macos

package/core/System/Controls/Button.nm

@@ -1,7 +1,12 @@
 /**
  * A push-button control that triggers an action when clicked
+ *
+ * An OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 4 — the shape menu): the
+ * single field is an AppKit handle, so the value is movable and its
+ * `#destroy` releases what the handle names. The constructor's `self` is
+ * the inline instance (the `.` accessor); methods keep the pointer form.
  **/
-pub class Button: Control {
+pub mv struct Button : Control {
 	var uint64 handle = 0
 
 	pub func #init = (self, Window window, string title) {
@@ -22,7 +27,7 @@ pub class Button: Control {
 			(id)window->handle, sel_registerName("contentView"));
 		((void(*)(id, SEL, id))objc_msgSend)(
 			contentView, sel_registerName("addSubview:"), btn);
-		self->handle = (uint64_t)btn;
+		self.handle = (uint64_t)btn;
 		```
 		```
 		#arch: aarch64_use_c
@@ -61,7 +66,7 @@ pub class Button: Control {
 			sel_registerName("view"));
 		((void(*)(id, SEL, id))objc_msgSend)(
 			parentView, sel_registerName("addSubview:"), btn);
-		self->handle = (uint64_t)btn;
+		self.handle = (uint64_t)btn;
 		```
 		```
 		#arch: aarch64_use_c

package/core/System/Controls/CheckBox.nm

@@ -1,7 +1,12 @@
 /**
  * A toggle control with a title and checked/hidden state
+ *
+ * An OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 4 — the shape menu): the
+ * single field is an AppKit handle, so the value is movable and its
+ * `#destroy` releases what the handle names. The constructor's `self` is
+ * the inline instance (the `.` accessor); methods keep the pointer form.
  **/
-pub class CheckBox: Control {
+pub mv struct CheckBox : Control {
 	var uint64 handle = 0
 
 	pub func #init = (self, Window window) {
@@ -20,7 +25,7 @@ pub class CheckBox: Control {
 			(id)window->handle, sel_registerName("contentView"));
 		((void(*)(id, SEL, id))objc_msgSend)(
 			contentView, sel_registerName("addSubview:"), cb);
-		self->handle = (uint64_t)cb;
+		self.handle = (uint64_t)cb;
 		```
 		```
 		#arch: aarch64_use_c
@@ -52,7 +57,7 @@ pub class CheckBox: Control {
 			sel_registerName("view"));
 		((void(*)(id, SEL, id))objc_msgSend)(
 			parentView, sel_registerName("addSubview:"), cb);
-		self->handle = (uint64_t)cb;
+		self.handle = (uint64_t)cb;
 		```
 		```
 		#arch: aarch64_use_c

package/core/System/Controls/Container.nm

@@ -241,6 +241,9 @@ pub func native_intrinsic = (uint64 handle, out [int, int]) {
 /**
  * A flexbox-style container that measures and arranges its child controls.
  *
+ * An OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 4 — the shape menu): the
+ * SoA buffers mv with the value and a scope-exit destroy reclaims them.
+ * *
  * Conforms to `Control`: `measure(BoxConstraints)` measures the whole subtree,
  * `set_frame` arranges it into a rectangle, and `intrinsic_size` reports the
  * unbounded-content size. The handle-based `add` API and the SoA engine are
@@ -248,7 +251,7 @@ pub func native_intrinsic = (uint64 handle, out [int, int]) {
  * so a `Container` can also be driven polymorphically as a `Control` (passed to
  * a `Control`-taking function, stored in a `ClassBuffer<Control>`, etc.).
  **/
-pub class Container: Control {
+pub mv struct Container : Control {
 	var kinds = Buffer<int>()
 	// Per-leaf requested size, stored as a (kind, value) pair per axis. The
 	// kind is one of LEN_* (auto/fixed/percent/fill); the value is the pixel
@@ -1454,10 +1457,12 @@ pub class Container: Control {
 		// nomen_layout_thunk is a free function (defined in Nomen below) that
 		// forwards to Container.layout — exported for C linkage on both
 		// backends, unlike the layout method itself. It takes the Container by
-		// `ref` (mutable reference): as a `class`, `ref Container` lowers to
-		// `struct Container **` (reference to the instance pointer), so the
-		// callback passes the address of the stored instance pointer.
-		extern void nomen_layout_thunk(struct Container**, struct Window*);
+		// `ref` (mutable reference): as a mv struct, `ref Container` lowers
+		// to `struct Container *` (the address of the value), so the callback
+		// passes the stored instance address directly. The address must stay
+		// valid for as long as the delegate is installed — an app-lifetime
+		// Container binding (or a Box<Container>).
+		extern void nomen_layout_thunk(struct Container*, struct Window*);
 		static void *g_resize_grid = 0;
 		static void *g_resize_win = 0;
 		void nomen_set_resize_target(void *grid, void *win) {
@@ -1467,7 +1472,7 @@ pub class Container: Control {
 		void nomen_window_did_resize(id self, SEL cmd, id notification) {
 			(void)self; (void)cmd; (void)notification;
 			if (g_resize_grid && g_resize_win) {
-				nomen_layout_thunk((struct Container**)&g_resize_grid, (struct Window*)g_resize_win);
+				nomen_layout_thunk((struct Container*)g_resize_grid, (struct Window*)g_resize_win);
 			}
 		}
 		```
@@ -1480,10 +1485,12 @@ pub class Container: Control {
 		// nomen_layout_thunk is a free function (defined in Nomen below) that
 		// forwards to Container.layout — exported for C linkage on both
 		// backends, unlike the layout method itself. It takes the Container by
-		// `ref` (mutable reference): as a `class`, `ref Container` lowers to
-		// `struct Container **` (reference to the instance pointer), so the
-		// callback passes the address of the stored instance pointer.
-		extern void nomen_layout_thunk(struct Container**, struct Window*);
+		// `ref` (mutable reference): as a mv struct, `ref Container` lowers
+		// to `struct Container *` (the address of the value), so the callback
+		// passes the stored instance address directly. The address must stay
+		// valid for as long as the delegate is installed — an app-lifetime
+		// Container binding (or a Box<Container>).
+		extern void nomen_layout_thunk(struct Container*, struct Window*);
 		static void *g_resize_grid = 0;
 		static void *g_resize_win = 0;
 		void nomen_set_resize_target(void *grid, void *win) {
@@ -1493,7 +1500,7 @@ pub class Container: Control {
 		void nomen_window_did_resize(id self, SEL cmd, id notification) {
 			(void)self; (void)cmd; (void)notification;
 			if (g_resize_grid && g_resize_win) {
-				nomen_layout_thunk((struct Container**)&g_resize_grid, (struct Window*)g_resize_win);
+				nomen_layout_thunk((struct Container*)g_resize_grid, (struct Window*)g_resize_win);
 			}
 		}
 		```

package/core/System/Controls/Layout.nm

@@ -4,7 +4,7 @@
 /**
  * A flat, buffer-backed layout tree — nodes stored in parallel arrays for the layout engine
  **/
-pub struct Layout {
+pub mv struct Layout {
 	var kinds = Buffer<int>() // 0=leaf, 1=vstack, 2=hstack
 	var ws = Buffer<int>() // intrinsic width (leaf) or 0
 	var hs = Buffer<int>() // intrinsic height (leaf) or 0

package/core/System/Controls/Text.nm

@@ -1,7 +1,12 @@
 /**
  * A read-only text label control
+ *
+ * An OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 4 — the shape menu): the
+ * AppKit handle plus the cached label text mv with the value, and the
+ * `#destroy` releases what the handle names. The constructor's `self` is
+ * the inline instance (the `.` accessor); methods keep the pointer form.
  **/
-pub class Text: Control {
+pub mv struct Text : Control {
 	var uint64 handle = 0
 	var text = ""
 
@@ -25,7 +30,7 @@ pub class Text: Control {
 			(id)window->handle, sel_registerName("contentView"));
 		((void(*)(id, SEL, id))objc_msgSend)(
 			contentView, sel_registerName("addSubview:"), label);
-		self->handle = (uint64_t)label;
+		self.handle = (uint64_t)label;
 		```
 		```
 		#arch: aarch64_use_c
@@ -67,7 +72,7 @@ pub class Text: Control {
 			sel_registerName("view"));
 		((void(*)(id, SEL, id))objc_msgSend)(
 			parentView, sel_registerName("addSubview:"), label);
-		self->handle = (uint64_t)label;
+		self.handle = (uint64_t)label;
 		```
 		```
 		#arch: aarch64_use_c
@@ -93,7 +98,7 @@ pub class Text: Control {
 	}
 
 	pub func set_text = (ref self, string text) {
-		self.text = text
+		self.text = text.copy()
 		```
 		#arch: c
 		#platform: macos

package/core/System/Controls/TextBox.nm

@@ -1,7 +1,12 @@
 /**
  * An editable single-line text input control
+ *
+ * An OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 4 — the shape menu): the
+ * single field is an AppKit handle, so the value is movable and its
+ * `#destroy` releases what the handle names. The constructor's `self` is
+ * the inline instance (the `.` accessor); methods keep the pointer form.
  **/
-pub class TextBox: Control {
+pub mv struct TextBox : Control {
 	var uint64 handle = 0
 
 	pub func #init = (self, Window window) {
@@ -30,7 +35,7 @@ pub class TextBox: Control {
 			(id)window->handle, sel_registerName("contentView"));
 		((void(*)(id, SEL, id))objc_msgSend)(
 			contentView, sel_registerName("addSubview:"), field);
-		self->handle = (uint64_t)field;
+		self.handle = (uint64_t)field;
 		```
 		```
 		#arch: aarch64_use_c
@@ -74,7 +79,7 @@ pub class TextBox: Control {
 			sel_registerName("view"));
 		((void(*)(id, SEL, id))objc_msgSend)(
 			parentView, sel_registerName("addSubview:"), field);
-		self->handle = (uint64_t)field;
+		self.handle = (uint64_t)field;
 		```
 		```
 		#arch: aarch64_use_c

package/core/System/Controls/Window.nm

@@ -1,7 +1,14 @@
 /**
  * A top-level native window that hosts controls and dispatches events
+ *
+ * An OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 4 — the shape menu): the
+ * single field is an AppKit handle, so the value is movable and its
+ * `#destroy` releases what the handle names. The methods take the receiver
+ * bare (struct receivers travel by address — the raw bodies keep the
+ * pointer form); the constructor's `self` is the inline instance (the `.`
+ * accessor).
  **/
-pub class Window: Control {
+pub mv struct Window : Control {
 	var uint64 handle = 0
 
 	pub func #init = (self, string title, int width, int height) {
@@ -32,7 +39,7 @@ pub class Window: Control {
 		id cv = ((id(*)(id, SEL))objc_msgSend)(win, sel_registerName("contentView"));
 		((void(*)(id, SEL, unsigned long))objc_msgSend)(cv, sel_registerName("setAutoresizingMask:"), 18UL);
 		((void(*)(id, SEL, BOOL))objc_msgSend)(cv, sel_registerName("setAutoresizesSubviews:"), 1);
-		self->handle = (uint64_t)win;
+		self.handle = (uint64_t)win;
 		```
 		```
 		#arch: aarch64_use_c
@@ -71,7 +78,7 @@ pub class Window: Control {
 			sel_registerName("initWithFrame:"),
 			((CGRect(*)(double, double, double, double))CGRectMake)(0, 0, (double)width, (double)height));
 		((void(*)(id, SEL))objc_msgSend)(win, sel_registerName("makeKeyAndVisible"));
-		self->handle = (uint64_t)win;
+		self.handle = (uint64_t)win;
 		```
 		```
 		#arch: aarch64_use_c

package/core/System/Fiber.nm

@@ -29,6 +29,10 @@
 // reads the packed handles from the instance's fields and drives the
 // scheduler. The runtime (scheduler, context switch) lives in the build's
 // emitted companion C — see build_fiber_spawn.
+//
+// Fiber is an OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 2 — the shape
+// menu), exactly like Thread: handle fields only, movable, `#destroy`
+// enforces must-start.
 
 // The launch surface's return type (ASYNC.md: the dependency is
 // declared by the library file, not inferred from user-source tokens).
@@ -37,7 +41,7 @@ import Task
 /**
  * A stackful coroutine: lightweight, cooperatively scheduled, parks instead of blocking
  **/
-pub class Fiber<T> : Sendable, Spawnable<T> {
+pub mv struct Fiber<T> : Spawnable<T> {
 	// The construction hook (see Thread.nm): the deferred-call special form.
 	#spawn = () {
 	}
@@ -67,7 +71,7 @@ pub class Fiber<T> : Sendable, Spawnable<T> {
 	// out of the instance (started; #destroy no-ops), return the handle.
 	// While the fiber waits, it parks and frees its worker instead of
 	// blocking it.
-	pub func start = (ref self, move out Task<T>) {
+	pub func start = (ref self, mv out Task<T>) {
 		```
 		#arch: c
 		struct nomen_future *_f = (struct nomen_future *)self->future;

package/core/System/Graph.nm

@@ -6,7 +6,7 @@
 /**
  * A graph of values connected by edges
  **/
-pub struct Graph<T>: Enumerable {
+pub mv struct Graph<T>: Enumerable {
 	var values = Buffer<T>()
 	var head_edge = Buffer<int>()
 	var edge_target = Buffer<int>()
@@ -14,7 +14,7 @@ pub struct Graph<T>: Enumerable {
 	var node_count = 0
 	var edge_count = 0
 
-	pub func add_node = (ref self, move T value) {
+	pub func add_node = (ref self, mv T value) {
 		var int idx = self.node_count
 		self.values.grow(idx + 1)
 		self.values.store(idx, value)

package/core/System/Init.nm

@@ -2,14 +2,14 @@
  * Program startup state — the argument count and argument list passed to `main`,
  * plus whether stdout is a terminal (for renderer selection).
  **/
-pub struct Init {
+pub mv struct Init {
 	var int argc
 	var string[16] args
 	var bool is_tty
 }
 
 // FFI: the C library's decimal-string parser (stdlib.h).
-extern func atoi = (string s, out int)
+foreign func atoi = (string s, out int)
 
 /**
  * Parses a decimal string into an int

package/core/System/LinkedList.nm

@@ -6,14 +6,14 @@
 /**
  * A doubly-linked list of values
  **/
-pub struct LinkedList<T>: Enumerable {
+pub mv struct LinkedList<T>: Enumerable {
 	var values = Buffer<T>()
 	var nexts = Buffer<int>()
 	var prevs = Buffer<int>()
 	var int head = -1
 	var count = 0
 
-	pub func add = (ref self, move T value) {
+	pub func add = (ref self, mv T value) {
 		var int idx = self.count
 		self.values.grow(idx + 1)
 		self.values.store(idx, value)

package/core/System/List.nm

@@ -1,11 +1,11 @@
 /**
  * A growable, ordered list of values (`push`/`pop`/`at`)
  **/
-pub struct List<T>: Viewable {
+pub mv struct List<T>: Viewable {
 	var length = 0
 	var items = Buffer<T>()
 
-	pub func push = (ref self, move T value) {
+	pub func push = (ref self, mv T value) {
 		if self.length >= self.items.cap {
 			var new_cap = 4
 			var int old_cap = self.items.cap
@@ -18,7 +18,7 @@ pub struct List<T>: Viewable {
 		self.length += 1
 	}
 
-	pub func pop = (ref self, move out T) {
+	pub func pop = (ref self, mv out T) {
 		if self.length <= 0 {
 			return self.items.move(0)
 		}
@@ -51,13 +51,13 @@ pub struct List<T>: Viewable {
 		panic("index out of range")
 	}
 
-	// A non-owning `view T` over [start, end). Delegates to the backing Buffer's
+	// A non-mv `view T` over [start, end). Delegates to the backing Buffer's
 	// #arch slice primitive — no #arch code here. Borrows from self.
 	pub func slice = (self, int start: start >= 0, int end: end >= start, out view T) {
 		return self.items.slice(start, end)
 	}
 
-	pub func set = (ref self, int i: i >= 0 && i < self.length, move T value) {
+	pub func set = (ref self, int i: i >= 0 && i < self.length, mv T value) {
 		self.items.replace(i, value)
 	}
 
@@ -65,7 +65,7 @@ pub struct List<T>: Viewable {
 	// for indices that can't be proven at compile time (cross-module calls
 	// can never discharge `set`'s parameter constraint) and out-of-range is
 	// a bug, not a case.
-	pub func set_or_panic = (ref self, int i, move T value) {
+	pub func set_or_panic = (ref self, int i, mv T value) {
 		if i >= 0 && i < self.length {
 			self.set(i, value)
 			return
@@ -74,7 +74,7 @@ pub struct List<T>: Viewable {
 	}
 
 	// A deep copy: a fresh List<T> with an independent copy of every element.
-	// For owning element types (strings, owning value structs) each slot in the
+	// For mv element types (strings, mv value structs) each slot in the
 	// copy owns its own heap data (Buffer deep-copies on store), so the source
 	// and the copy share nothing. Not available for class/trait element types
 	// (the copy would share the stored instances — the checker rejects it).

package/core/System/Map.nm

@@ -8,7 +8,7 @@
  * it is correct for negative hashes too: two's-complement `&` already lands
  * in `[0, cap)`, which is why no negative adjustment is needed.
  **/
-pub struct Map<TK: Hashable + Equatable, TV> {
+pub mv struct Map<TK: Hashable + Equatable, TV> {
 	var length = 0
 	var keys = Buffer<TK>()
 	var values = Buffer<TV>()
@@ -17,6 +17,9 @@ pub struct Map<TK: Hashable + Equatable, TV> {
 	// Variadic-tuple constructor: Map<string, int>(["a", 1], ["b", 2]) or
 	// Map(["a", 1], ["b", 2]) (type args inferred from the first pair).
 	// Zero pairs yields an empty Map, so this also covers Map<K, V>().
+	// The pair reads are temp-rooted (`pairs.at(i)` is a statement temp):
+	// the element transfer is absorbed by set's mv store (store_T
+	// deep-copies string-field elements), so no explicit mv is spelled.
 	pub func #init = (self, ...[TK, TV] pairs) {
 		var i = 0
 		while i < pairs.length; i += 1 {
@@ -24,7 +27,7 @@ pub struct Map<TK: Hashable + Equatable, TV> {
 		}
 	}
 
-	pub func set = (ref self, move TK key, move TV value) {
+	pub func set = (ref self, mv TK key, mv TV value) {
 		var int cap = self.keys.cap
 		if cap == 0 {
 			// alloc_T: for Buffer<TK> it is T_SIZE-aware (string keys are
@@ -169,9 +172,9 @@ pub struct Map<TK: Hashable + Equatable, TV> {
 	}
 
 	func rehash = (ref self, int new_cap) {
-		var Buffer<TK> old_keys = move self.keys swap Buffer<TK>()
-		var Buffer<TV> old_values = move self.values swap Buffer<TV>()
-		var Buffer<int> old_used = move self.used swap Buffer<int>()
+		var Buffer<TK> old_keys = mv self.keys swap Buffer<TK>()
+		var Buffer<TV> old_values = mv self.values swap Buffer<TV>()
+		var Buffer<int> old_used = mv self.used swap Buffer<int>()
 		var int old_cap = old_keys.cap
 
 		self.keys.alloc(new_cap)
@@ -187,13 +190,13 @@ pub struct Map<TK: Hashable + Equatable, TV> {
 				// afterwards. load_T would leave the old slot referencing
 				// the same class pointer — a double-free when old_keys is
 				// destroyed. The results are bound to locals so an
-				// owning-element copy (e.g. a `Buffer<string>` slot, which
+				// mv-element copy (e.g. a `Buffer<string>` slot, which
 				// store_T strdup's) is freed here once the new buffer has
 				// made its own copy — passing them inline would orphan the
 				// move_T results.
 				var TK k = old_keys.move(i)
 				var TV v = old_values.move(i)
-				self.set(move k, move v)
+				self.set(mv k, mv v)
 			}
 		}
 	}