nomen-lang 0.6.2 → 0.6.3

package/dist/index.mjs

@@ -6538,6 +6538,18 @@ var FunctionCallNode = class extends BaseNode {
 	ref_param_indices;
 	move_param_indices;
 	/**
+	* Indices of arguments bound to a `move T` parameter where T is a
+	* pass-by-value owning struct on a registered free function: ownership
+	* TRANSFERS at the boundary (the callee seeds the param's string-field
+	* records and frees them at its exit), so the caller drops its records
+	* instead of freeing them. The plain `move_param_indices` convention
+	* (callee deep-copies, caller frees the originals) still governs
+	* container stores and every non-transfer shape. Stamped by
+	* check_function_call alongside owned_value_param_indices.
+	*/
+	move_owned_param_indices;
+	owned_value_param_indices;
+	/**
 	* Indices of arguments whose corresponding callee parameter is a nullable
 	* struct value type (`T?` where T is a non-class struct). Populated during
 	* the check pass when the callee's signature is resolved. The build uses
@@ -6958,6 +6970,12 @@ var FunctionNode = class extends BaseNode {
 	* are dual-natured: called under their own name AND passed as values).
 	*/
 	is_closure;
+	/** The function's address escapes into a func-typed value (bound to a
+	*  `var func …` variable/field, passed as a func value, …) — so it may be
+	*  invoked through a pointer with a BORROWED argument: pass-by-value
+	*  normalization (owned-param record seeding / call-site shell
+	*  materialization) must not apply. Set during check. */
+	address_escaped;
 	/**
 	* Captured outer locals (CLOSURE.md Phase 2). One entry per variable the
 	* lambda body references from an enclosing function; the backends emit an
@@ -7366,6 +7384,16 @@ var DeclarationNode = class extends BaseNode {
 	*  paths strdup the initializer and free the temp's copy at scope exit.
 	*  Set at build time by hoist_field_overrides. */
 	force_owned_string;
+	/** True for an OWNED value-struct PARAMETER whose string fields the
+	*  callee frees at scope exit: the field accesses (and the record-free
+	*  emitted by free_scoped_declarations) go through the param POINTER
+	*  (`p->field`) instead of value syntax (`p.field`). Set at build time
+	*  when the function builder seeds pass-by-value struct params. */
+	string_fields_via_pointer;
+	/** True alongside string_fields_via_pointer when the caller materialized
+	*  a heap shell for the argument (pass-by-value): the callee frees the
+	*  shell itself at scope exit (`free(p)`) after freeing the fields. */
+	owned_heap_shell;
 	constructor(start, visibility, declaration, name, type, value) {
 		super("declare", start);
 		this.visibility = visibility;
@@ -10913,6 +10941,117 @@ function array_struct_name(type, status) {
 	return status.structs.find((s) => s.name === mono && !s.is_generic) ? mono : void 0;
 }
 //#endregion
+//#region ../src/build_common/destroy_analysis.ts
+/**
+* Whether any field of the struct is an enum-with-data value owning heap
+* payloads (a string payload — always heap, case construction strdups it —
+* or a class/trait reference payload — construction transfers ownership).
+* Such a field must be reclaimed when the struct dies.
+*/
+function struct_has_owning_enum_field(struct, table) {
+	for (const field of struct.fields) {
+		if (field.type.is_ref) continue;
+		const en = table.enums?.find((e) => e.name === field.type.name);
+		if (!en?.has_associated_data) continue;
+		for (const c of en.cases) for (const p of c.params) {
+			if (p.type.name === "string" && !p.type.is_array) return true;
+			if (table.traits?.some((t) => t.name === p.type.name)) return true;
+			if (table.structs.find((s) => s.name === p.type.name)?.is_class) return true;
+		}
+	}
+	return false;
+}
+/**
+* Whether a struct declares its own `#destroy` (user side effects /
+* resource release).
+*/
+function has_destroy(struct) {
+	return !!struct.functions.find((f) => f.name === "#destroy");
+}
+/**
+* Whether any field (recursively) requires destroy handling — a class
+* field (heap instance to reclaim) or a nested struct with its own
+* `#destroy` (or nested fields that do). Deliberately excludes `string`
+* fields: a struct local whose only owning fields are strings is NOT
+* auto-destroyed at scope exit (the strings may be raw rodata arg
+* pointers, not heap) — see `struct_needs_auto_destroy` for the broader
+* form used to decide whether a `<Struct>_destroy` function is generated.
+*/
+function has_struct_fields_with_destroy(struct, table) {
+	for (const field of struct.fields) {
+		if (field.type.is_ref) continue;
+		const field_struct = resolve_struct_type(field.type, table);
+		if (!field_struct) continue;
+		if (field_struct.is_class) return true;
+		if (has_destroy(field_struct)) return true;
+		if (has_struct_fields_with_destroy(field_struct, table)) return true;
+	}
+	return false;
+}
+/**
+* Whether a struct (or any embedded struct field, recursively) needs a
+* destroy call at scope exit — it has a `#destroy`, a class-typed field,
+* or a nested struct field that itself needs destroying. This does NOT
+* count `string` fields (see `has_struct_fields_with_destroy`).
+*/
+function struct_needs_destroy(struct, table) {
+	return has_destroy(struct) || has_struct_fields_with_destroy(struct, table) || struct_has_owning_enum_field(struct, table);
+}
+/**
+* Whether a struct needs an auto-generated `<Struct>_destroy` function.
+* Broader than `struct_needs_destroy`: also returns true for structs with
+* `string` fields, because a Buffer<T> for such a struct deep-copies the
+* strings into slots (strdup on store) and the per-element destroy must
+* free them. The generated destroy frees each string field; it is called
+* from Buffer's specialized #destroy / replace_T, NOT from struct local
+* scope exit (`struct_needs_destroy` governs that path and excludes
+* strings).
+*/
+function struct_needs_auto_destroy(struct, table) {
+	if (struct_needs_destroy(struct, table)) return true;
+	if (struct_has_owning_enum_field(struct, table)) return true;
+	for (const field of struct.fields) {
+		if (field.type.is_ref) continue;
+		if (field.type.is_view) continue;
+		if (field.type.name === "string" && !field.type.is_array) return true;
+		const field_struct = resolve_struct_type(field.type, table);
+		if (field_struct && !field_struct.is_class && struct_needs_auto_destroy(field_struct, table)) return true;
+	}
+	return false;
+}
+//#endregion
+//#region ../src/build_common/has_string_fields.ts
+/**
+* Whether any field (recursively, through nested owning value structs)
+* is an owned `string`. Shared by BOTH backends' owning-Buffer element
+* specialization (the slot deep-copies strdup'd strings, so a
+* string-field element is owning even when `struct_needs_destroy`
+* ignores string-only locals) — the C comment in
+* owning_buffer_specialize records the divergence this once caused.
+* `ref` and `view T` fields are skipped: a ref aliases the caller's
+* storage and a view's byte copy owns nothing.
+*/
+function has_string_fields(node, status) {
+	for (const field of node.fields) {
+		if (field.type.is_ref) continue;
+		if (field.type.is_view) continue;
+		if (field.type.name === "string" && !field.type.is_array) return true;
+		const field_struct = status.structs.find((s) => s.name === field.type.name && !s.is_simple_type && !s.is_generic);
+		if (field_struct && !field_struct.is_class && has_string_fields(field_struct, status)) return true;
+	}
+	return false;
+}
+/**
+* The DIRECT `string` fields of a value struct (nested struct fields are not
+* descended into — nested string fields are outside the per-field ownership
+* tracking everywhere else too). Used by the return-boundary normalization:
+* the returned struct's unrecorded fields are strdup'd so the value the
+* caller receives is uniformly heap-owned.
+*/
+function direct_string_fields(node) {
+	return node.fields.filter((f) => !f.type.is_ref && !f.type.is_view && !f.type.is_array && f.type.name === "string");
+}
+//#endregion
 //#region ../src/build_common/scan_force_heap_strings.ts
 function scan_force_heap_strings(statements, structs) {
 	const result = /* @__PURE__ */ new Set();
@@ -13391,85 +13530,6 @@ function emit_strdup(status) {
 	emit_asm(status, `ldr x1, [sp], #16\n`);
 }
 //#endregion
-//#region ../src/build_common/destroy_analysis.ts
-/**
-* Whether any field of the struct is an enum-with-data value owning heap
-* payloads (a string payload — always heap, case construction strdups it —
-* or a class/trait reference payload — construction transfers ownership).
-* Such a field must be reclaimed when the struct dies.
-*/
-function struct_has_owning_enum_field(struct, table) {
-	for (const field of struct.fields) {
-		if (field.type.is_ref) continue;
-		const en = table.enums?.find((e) => e.name === field.type.name);
-		if (!en?.has_associated_data) continue;
-		for (const c of en.cases) for (const p of c.params) {
-			if (p.type.name === "string" && !p.type.is_array) return true;
-			if (table.traits?.some((t) => t.name === p.type.name)) return true;
-			if (table.structs.find((s) => s.name === p.type.name)?.is_class) return true;
-		}
-	}
-	return false;
-}
-/**
-* Whether a struct declares its own `#destroy` (user side effects /
-* resource release).
-*/
-function has_destroy(struct) {
-	return !!struct.functions.find((f) => f.name === "#destroy");
-}
-/**
-* Whether any field (recursively) requires destroy handling — a class
-* field (heap instance to reclaim) or a nested struct with its own
-* `#destroy` (or nested fields that do). Deliberately excludes `string`
-* fields: a struct local whose only owning fields are strings is NOT
-* auto-destroyed at scope exit (the strings may be raw rodata arg
-* pointers, not heap) — see `struct_needs_auto_destroy` for the broader
-* form used to decide whether a `<Struct>_destroy` function is generated.
-*/
-function has_struct_fields_with_destroy(struct, table) {
-	for (const field of struct.fields) {
-		if (field.type.is_ref) continue;
-		const field_struct = resolve_struct_type(field.type, table);
-		if (!field_struct) continue;
-		if (field_struct.is_class) return true;
-		if (has_destroy(field_struct)) return true;
-		if (has_struct_fields_with_destroy(field_struct, table)) return true;
-	}
-	return false;
-}
-/**
-* Whether a struct (or any embedded struct field, recursively) needs a
-* destroy call at scope exit — it has a `#destroy`, a class-typed field,
-* or a nested struct field that itself needs destroying. This does NOT
-* count `string` fields (see `has_struct_fields_with_destroy`).
-*/
-function struct_needs_destroy(struct, table) {
-	return has_destroy(struct) || has_struct_fields_with_destroy(struct, table) || struct_has_owning_enum_field(struct, table);
-}
-/**
-* Whether a struct needs an auto-generated `<Struct>_destroy` function.
-* Broader than `struct_needs_destroy`: also returns true for structs with
-* `string` fields, because a Buffer<T> for such a struct deep-copies the
-* strings into slots (strdup on store) and the per-element destroy must
-* free them. The generated destroy frees each string field; it is called
-* from Buffer's specialized #destroy / replace_T, NOT from struct local
-* scope exit (`struct_needs_destroy` governs that path and excludes
-* strings).
-*/
-function struct_needs_auto_destroy(struct, table) {
-	if (struct_needs_destroy(struct, table)) return true;
-	if (struct_has_owning_enum_field(struct, table)) return true;
-	for (const field of struct.fields) {
-		if (field.type.is_ref) continue;
-		if (field.type.is_view) continue;
-		if (field.type.name === "string" && !field.type.is_array) return true;
-		const field_struct = resolve_struct_type(field.type, table);
-		if (field_struct && !field_struct.is_class && struct_needs_auto_destroy(field_struct, table)) return true;
-	}
-	return false;
-}
-//#endregion
 //#region ../src/build_common/temp_anchor_consolidation.ts
 /**
 * Shared OWNERSHIP decision for hoisted call-temporary consolidation.
@@ -13504,6 +13564,144 @@ function superseded_param_temp_names(table, call_node, result_type_name) {
 	return names;
 }
 //#endregion
+//#region ../src/build_aarch64/utils/string_pair.ts
+/**
+* Load the string variable `name` into the consecutive register pair
+* (base, base+1) — default x0/x1. Handles the plain slot case; callers
+* that have register-allocated or param forms handle theirs first.
+*/
+function emit_string_pair_load(status, name, base = "x0") {
+	const offset = status.stack_offsets?.get(name);
+	if (offset === void 0) return false;
+	const w = base.startsWith("x") ? base : "x0";
+	const n = parseInt(w.substring(1), 10);
+	if (offset + 8 > 504) {
+		emit_asm(status, `ldr ${w}, [x29, #${offset}]\n`);
+		emit_asm(status, `ldr x${n + 1}, [x29, #${offset + 8}]\n`);
+		return true;
+	}
+	emit_asm(status, `ldp ${w}, x${n + 1}, [x29, #${offset}]\n`);
+	return true;
+}
+/** Load the pair at [addr_reg, #offset] into (base, base+1). */
+function emit_string_pair_load_at(status, addr_reg, offset, base = "x0") {
+	const w = base.startsWith("x") ? base : "x0";
+	emit_asm(status, `ldp ${w}, x${parseInt(w.substring(1), 10) + 1}, [${addr_reg}, #${offset}]\n`);
+}
+/**
+* strdup the fat string in (x0=ptr, x1=len): preserve the len half across
+* the call and leave the owned copy's pair in (x0, x1). The caller keeps
+* ownership of the original.
+*/
+function emit_strdup_string(status) {
+	emit_asm(status, `str x1, [sp, #-16]!\n`);
+	emit_asm(status, status.audit ? `bl _nomen_strdup_wrap\n` : `bl _strdup\n`);
+	emit_asm(status, `ldr x1, [sp], #16\n`);
+}
+/**
+* Pair load/store at [x29, #offset] with an arbitrary register pair —
+* splits into two single-word accesses beyond the ldp/stp +504 range.
+*/
+function emit_pair_load_x29(status, offset, a = "x0", b = "x1") {
+	if (offset + 8 > 504) {
+		emit_asm(status, `ldr ${a}, [x29, #${offset}]\n`);
+		emit_asm(status, `ldr ${b}, [x29, #${offset + 8}]\n`);
+		return;
+	}
+	emit_asm(status, `ldp ${a}, ${b}, [x29, #${offset}]\n`);
+}
+function emit_pair_store_x29(status, offset, a = "x0", b = "x1") {
+	if (offset + 8 > 504) {
+		emit_asm(status, `str ${a}, [x29, #${offset}]\n`);
+		emit_asm(status, `str ${b}, [x29, #${offset + 8}]\n`);
+		return;
+	}
+	emit_asm(status, `stp ${a}, ${b}, [x29, #${offset}]\n`);
+}
+/**
+* Owning specializations for Array<string>'s raw T-generic bodies
+* (`with` / `set`), replacing the shared-pointer copies with per-slot deep
+* copies — the aarch64 analog of Array.nm's `#if T_NEEDS_STRDUP` C branch.
+*
+* Conventions (matching Array.nm raw bodies):
+*   - `with`  (static): x0/x1 = value pair, x2 = count. Returns x0 = heap
+*     buffer ([ptr] = length, elements at +8..).
+*   - `set`   (method): x19 = first element, x1 = index, x2/x3 = value pair.
+* Bounds are guaranteed by the Nomen-level constraints.
+*/
+function emit_owning_array_string_specialize(func_name, status, self_reg = "x19") {
+	if (func_name === "with") {
+		emit_asm(status, `stp x19, x20, [sp, #-16]!\n`);
+		emit_asm(status, `stp x21, x22, [sp, #-16]!\n`);
+		emit_asm(status, `stp x24, x25, [sp, #-16]!\n`);
+		emit_asm(status, `mov x19, x0\n`);
+		emit_asm(status, `mov x20, x1\n`);
+		emit_asm(status, `mov x21, x2\n`);
+		emit_asm(status, `add x0, x21, #1\n`);
+		emit_asm(status, `lsl x0, x0, #4\n`);
+		emit_malloc(status);
+		emit_asm(status, `mov x22, x0\n`);
+		emit_asm(status, `str x21, [x22]\n`);
+		emit_asm(status, `mov x23, #8\n`);
+		emit_asm(status, `mov x24, #0\n`);
+		emit_asm(status, `.Larr_str_with_loop:\n`);
+		emit_asm(status, `cmp x24, x21\n`);
+		emit_asm(status, `b.ge .Larr_str_with_done\n`);
+		emit_asm(status, `mov x0, x19\n`);
+		emit_strdup(status);
+		emit_asm(status, `add x25, x22, x23\n`);
+		emit_asm(status, `stp x0, x20, [x25]\n`);
+		emit_asm(status, `add x23, x23, #16\n`);
+		emit_asm(status, `add x24, x24, #1\n`);
+		emit_asm(status, `b .Larr_str_with_loop\n`);
+		emit_asm(status, `.Larr_str_with_done:\n`);
+		emit_asm(status, `mov x0, x22\n`);
+		emit_asm(status, `ldp x24, x25, [sp], #16\n`);
+		emit_asm(status, `ldp x21, x22, [sp], #16\n`);
+		emit_asm(status, `ldp x19, x20, [sp], #16\n`);
+		return true;
+	}
+	if (func_name === "at" || func_name === "first" || func_name === "at_end") {
+		emit_asm(status, `stp x20, x21, [sp, #-16]!\n`);
+		if (func_name === "at") {
+			emit_asm(status, `lsl x9, x1, #4\n`);
+			emit_asm(status, `add x9, ${self_reg}, x9\n`);
+		} else if (func_name === "at_end") {
+			emit_asm(status, `ldr x9, [${self_reg}, #-8]\n`);
+			emit_asm(status, `sub x9, x9, #1\n`);
+			emit_asm(status, `lsl x9, x9, #4\n`);
+			emit_asm(status, `add x9, ${self_reg}, x9\n`);
+		} else emit_asm(status, `add x9, ${self_reg}, #0\n`);
+		emit_asm(status, `ldp x0, x1, [x9]\n`);
+		emit_asm(status, `ldp x20, x21, [sp], #16\n`);
+		return true;
+	}
+	if (func_name === "set") {
+		emit_asm(status, `stp x20, x21, [sp, #-16]!\n`);
+		emit_asm(status, `lsl x9, x1, #4\n`);
+		emit_asm(status, `add x9, ${self_reg}, x9\n`);
+		emit_asm(status, `ldr x0, [x9]\n`);
+		emit_asm(status, `mov x20, x2\n`);
+		emit_asm(status, `mov x21, x3\n`);
+		emit_free(status);
+		emit_asm(status, `mov x0, x20\n`);
+		emit_strdup(status);
+		emit_asm(status, `str x0, [x9]\n`);
+		emit_asm(status, `str x21, [x9, #8]\n`);
+		emit_asm(status, `ldp x20, x21, [sp], #16\n`);
+		return true;
+	}
+	return false;
+}
+/** Pair store to [base_reg, #offset] with stur fallback (misaligned/far). */
+function emit_pair_store_to(status, base_reg, offset, a, b) {
+	if (offset % 8 === 0 && offset + 8 <= 504 && offset >= 0) emit_asm(status, `stp ${a}, ${b}, [${base_reg}, #${offset}]\n`);
+	else {
+		emit_asm(status, `stur ${a}, [${base_reg}, #${offset}]\n`);
+		emit_asm(status, `stur ${b}, [${base_reg}, #${offset + 8}]\n`);
+	}
+}
+//#endregion
 //#region ../src/build_aarch64/utils/auto_destroy.ts
 /**
 * Whether a declaration's initializer is a non-`move` FIELD ACCESS — a shallow
@@ -14346,6 +14544,27 @@ function mark_moved_if_struct(value, status, opts) {
 		status.moved.add(var_name);
 	}
 }
+/**
+* strdup the UNRECORDED direct string fields of a value struct whose base is
+* in `base_reg` (+ base_offset) — the return-boundary normalization: the
+* sret byte-copy transfers the RECORDED (heap) fields raw, but unrecorded
+* fields may hold rodata/borrowed bytes the caller cannot free, so they are
+* deep-copied here and the returned struct is uniformly heap-owned.
+*/
+function emit_string_field_strdups_at(status, struct_name, base_reg, base_offset = 0, skip_fields) {
+	const struct = status.structs.find((s) => s.name === struct_name && !s.is_simple_type && !s.is_class);
+	if (!struct) return;
+	for (const field of direct_string_fields(struct)) {
+		if (skip_fields?.has(field.name)) continue;
+		const off = base_offset + get_field_offset(struct_name, field.name, status);
+		emit_asm(status, `str ${base_reg}, [sp, #-16]!\n`);
+		emit_string_pair_load_at(status, base_reg, off);
+		emit_strdup_string(status);
+		emit_asm(status, `mov x13, x0\n`);
+		emit_asm(status, `ldr ${base_reg}, [sp], #16\n`);
+		emit_pair_store_to(status, base_reg, off, "x13", "x1");
+	}
+}
 //#endregion
 //#region ../src/build_aarch64/utils/closure_a64.ts
 /**
@@ -16823,28 +17042,6 @@ function value_number_loops(body, ast_list, status, mutate_ast) {
 	};
 }
 //#endregion
-//#region ../src/build_common/has_string_fields.ts
-/**
-* Whether any field (recursively, through nested owning value structs)
-* is an owned `string`. Shared by BOTH backends' owning-Buffer element
-* specialization (the slot deep-copies strdup'd strings, so a
-* string-field element is owning even when `struct_needs_destroy`
-* ignores string-only locals) — the C comment in
-* owning_buffer_specialize records the divergence this once caused.
-* `ref` and `view T` fields are skipped: a ref aliases the caller's
-* storage and a view's byte copy owns nothing.
-*/
-function has_string_fields(node, status) {
-	for (const field of node.fields) {
-		if (field.type.is_ref) continue;
-		if (field.type.is_view) continue;
-		if (field.type.name === "string" && !field.type.is_array) return true;
-		const field_struct = status.structs.find((s) => s.name === field.type.name && !s.is_simple_type && !s.is_generic);
-		if (field_struct && !field_struct.is_class && has_string_fields(field_struct, status)) return true;
-	}
-	return false;
-}
-//#endregion
 //#region ../src/build_aarch64/utils/owning_buffer_specialize.ts
 /**
 * Detect whether a monomorphized struct is a `Buffer_<T>` whose element type
@@ -19458,6 +19655,16 @@ function build_function_node$1(node, status) {
 			}
 			param_idx++;
 			if (param.declaration === "var") status.function_param_vars.add(param.name);
+			const is_free_function = (!node.scope || node.scope.node_type === "root" || node.scope.node_type === "func") && !node.params.some((p) => p.is_self_param);
+			const owned_value_param = !param.is_self_param && !param.is_variadic && !param.type.is_ref && !param.type.is_nullable && !param.type.is_view && !param.type.is_array && param.type.name ? status.structs.find((st) => st.name === param.type.name && !st.is_simple_type && !st.is_class) : void 0;
+			if (is_free_function && !node.address_escaped && owned_value_param && direct_string_fields(owned_value_param).length > 0 && !(owned_value_param.traits ?? []).length && !struct_needs_destroy(owned_value_param, status) && (status.normalized_struct_returners?.has(node.name) || status.normalized_struct_returners?.has(label_name)) && !status.func_address_taken?.has(node.name) && !status.func_address_taken?.has(label_name)) {
+				status.function_param_vars.add(param.name);
+				const param_decl = new DeclarationNode(param.start, "private", "var", param.name, param.type);
+				param_decl.string_fields_via_pointer = true;
+				status.scoped_declarations.push(param_decl);
+				if (!status.heap_string_fields) status.heap_string_fields = /* @__PURE__ */ new Set();
+				for (const field of direct_string_fields(owned_value_param)) status.heap_string_fields.add(`${param.name}.${field.name}`);
+			}
 			if (param.type.is_array) {
 				if (!param.is_variadic ? array_struct_name(param.type, status) : void 0) {
 					if (!status.heap_array_vars) status.heap_array_vars = /* @__PURE__ */ new Set();
@@ -19669,144 +19876,6 @@ function build_function_node$1(node, status) {
 	status.function_return_type = void 0;
 }
 //#endregion
-//#region ../src/build_aarch64/utils/string_pair.ts
-/**
-* Load the string variable `name` into the consecutive register pair
-* (base, base+1) — default x0/x1. Handles the plain slot case; callers
-* that have register-allocated or param forms handle theirs first.
-*/
-function emit_string_pair_load(status, name, base = "x0") {
-	const offset = status.stack_offsets?.get(name);
-	if (offset === void 0) return false;
-	const w = base.startsWith("x") ? base : "x0";
-	const n = parseInt(w.substring(1), 10);
-	if (offset + 8 > 504) {
-		emit_asm(status, `ldr ${w}, [x29, #${offset}]\n`);
-		emit_asm(status, `ldr x${n + 1}, [x29, #${offset + 8}]\n`);
-		return true;
-	}
-	emit_asm(status, `ldp ${w}, x${n + 1}, [x29, #${offset}]\n`);
-	return true;
-}
-/** Load the pair at [addr_reg, #offset] into (base, base+1). */
-function emit_string_pair_load_at(status, addr_reg, offset, base = "x0") {
-	const w = base.startsWith("x") ? base : "x0";
-	emit_asm(status, `ldp ${w}, x${parseInt(w.substring(1), 10) + 1}, [${addr_reg}, #${offset}]\n`);
-}
-/**
-* strdup the fat string in (x0=ptr, x1=len): preserve the len half across
-* the call and leave the owned copy's pair in (x0, x1). The caller keeps
-* ownership of the original.
-*/
-function emit_strdup_string(status) {
-	emit_asm(status, `str x1, [sp, #-16]!\n`);
-	emit_asm(status, status.audit ? `bl _nomen_strdup_wrap\n` : `bl _strdup\n`);
-	emit_asm(status, `ldr x1, [sp], #16\n`);
-}
-/**
-* Pair load/store at [x29, #offset] with an arbitrary register pair —
-* splits into two single-word accesses beyond the ldp/stp +504 range.
-*/
-function emit_pair_load_x29(status, offset, a = "x0", b = "x1") {
-	if (offset + 8 > 504) {
-		emit_asm(status, `ldr ${a}, [x29, #${offset}]\n`);
-		emit_asm(status, `ldr ${b}, [x29, #${offset + 8}]\n`);
-		return;
-	}
-	emit_asm(status, `ldp ${a}, ${b}, [x29, #${offset}]\n`);
-}
-function emit_pair_store_x29(status, offset, a = "x0", b = "x1") {
-	if (offset + 8 > 504) {
-		emit_asm(status, `str ${a}, [x29, #${offset}]\n`);
-		emit_asm(status, `str ${b}, [x29, #${offset + 8}]\n`);
-		return;
-	}
-	emit_asm(status, `stp ${a}, ${b}, [x29, #${offset}]\n`);
-}
-/**
-* Owning specializations for Array<string>'s raw T-generic bodies
-* (`with` / `set`), replacing the shared-pointer copies with per-slot deep
-* copies — the aarch64 analog of Array.nm's `#if T_NEEDS_STRDUP` C branch.
-*
-* Conventions (matching Array.nm raw bodies):
-*   - `with`  (static): x0/x1 = value pair, x2 = count. Returns x0 = heap
-*     buffer ([ptr] = length, elements at +8..).
-*   - `set`   (method): x19 = first element, x1 = index, x2/x3 = value pair.
-* Bounds are guaranteed by the Nomen-level constraints.
-*/
-function emit_owning_array_string_specialize(func_name, status, self_reg = "x19") {
-	if (func_name === "with") {
-		emit_asm(status, `stp x19, x20, [sp, #-16]!\n`);
-		emit_asm(status, `stp x21, x22, [sp, #-16]!\n`);
-		emit_asm(status, `stp x24, x25, [sp, #-16]!\n`);
-		emit_asm(status, `mov x19, x0\n`);
-		emit_asm(status, `mov x20, x1\n`);
-		emit_asm(status, `mov x21, x2\n`);
-		emit_asm(status, `add x0, x21, #1\n`);
-		emit_asm(status, `lsl x0, x0, #4\n`);
-		emit_malloc(status);
-		emit_asm(status, `mov x22, x0\n`);
-		emit_asm(status, `str x21, [x22]\n`);
-		emit_asm(status, `mov x23, #8\n`);
-		emit_asm(status, `mov x24, #0\n`);
-		emit_asm(status, `.Larr_str_with_loop:\n`);
-		emit_asm(status, `cmp x24, x21\n`);
-		emit_asm(status, `b.ge .Larr_str_with_done\n`);
-		emit_asm(status, `mov x0, x19\n`);
-		emit_strdup(status);
-		emit_asm(status, `add x25, x22, x23\n`);
-		emit_asm(status, `stp x0, x20, [x25]\n`);
-		emit_asm(status, `add x23, x23, #16\n`);
-		emit_asm(status, `add x24, x24, #1\n`);
-		emit_asm(status, `b .Larr_str_with_loop\n`);
-		emit_asm(status, `.Larr_str_with_done:\n`);
-		emit_asm(status, `mov x0, x22\n`);
-		emit_asm(status, `ldp x24, x25, [sp], #16\n`);
-		emit_asm(status, `ldp x21, x22, [sp], #16\n`);
-		emit_asm(status, `ldp x19, x20, [sp], #16\n`);
-		return true;
-	}
-	if (func_name === "at" || func_name === "first" || func_name === "at_end") {
-		emit_asm(status, `stp x20, x21, [sp, #-16]!\n`);
-		if (func_name === "at") {
-			emit_asm(status, `lsl x9, x1, #4\n`);
-			emit_asm(status, `add x9, ${self_reg}, x9\n`);
-		} else if (func_name === "at_end") {
-			emit_asm(status, `ldr x9, [${self_reg}, #-8]\n`);
-			emit_asm(status, `sub x9, x9, #1\n`);
-			emit_asm(status, `lsl x9, x9, #4\n`);
-			emit_asm(status, `add x9, ${self_reg}, x9\n`);
-		} else emit_asm(status, `add x9, ${self_reg}, #0\n`);
-		emit_asm(status, `ldp x0, x1, [x9]\n`);
-		emit_asm(status, `ldp x20, x21, [sp], #16\n`);
-		return true;
-	}
-	if (func_name === "set") {
-		emit_asm(status, `stp x20, x21, [sp, #-16]!\n`);
-		emit_asm(status, `lsl x9, x1, #4\n`);
-		emit_asm(status, `add x9, ${self_reg}, x9\n`);
-		emit_asm(status, `ldr x0, [x9]\n`);
-		emit_asm(status, `mov x20, x2\n`);
-		emit_asm(status, `mov x21, x3\n`);
-		emit_free(status);
-		emit_asm(status, `mov x0, x20\n`);
-		emit_strdup(status);
-		emit_asm(status, `str x0, [x9]\n`);
-		emit_asm(status, `str x21, [x9, #8]\n`);
-		emit_asm(status, `ldp x20, x21, [sp], #16\n`);
-		return true;
-	}
-	return false;
-}
-/** Pair store to [base_reg, #offset] with stur fallback (misaligned/far). */
-function emit_pair_store_to(status, base_reg, offset, a, b) {
-	if (offset % 8 === 0 && offset + 8 <= 504 && offset >= 0) emit_asm(status, `stp ${a}, ${b}, [${base_reg}, #${offset}]\n`);
-	else {
-		emit_asm(status, `stur ${a}, [${base_reg}, #${offset}]\n`);
-		emit_asm(status, `stur ${b}, [${base_reg}, #${offset + 8}]\n`);
-	}
-}
-//#endregion
 //#region ../src/build_aarch64/build_struct_node.ts
 let field_strdup_guard_counter = 0;
 function emit_typed_store(status, src_reg, dst_base, offset, size) {
@@ -21327,7 +21396,7 @@ function build_block_node$1(node, status) {
 		heap_slots: [],
 		struct_decls: []
 	});
-	const declarations_before = status.scoped_declarations.length;
+	const declarations_before = node.node_type === "func" ? 0 : status.scoped_declarations.length;
 	for (let child of node.statements) if (is_struct_node(child)) {
 		if (!should_emit_definition(child, status.emit_mode, status.structs, status.system_struct_names)) continue;
 		build_struct_node$1(child, status);
@@ -21421,6 +21490,69 @@ function call_in_set(set, call) {
 	return set.has(call.name.replace(/#/g, ""));
 }
 //#endregion
+//#region ../src/build_common/call_init_string_fields.ts
+/**
+* Whether a declaration-initializer expression is a value the callee's
+* return-boundary normalization made UNIFORMLY heap-owned, so the fresh
+* binding records every string field and frees them at scope exit:
+*
+*   - a plain function call registered as a normalized struct returner
+*     (the registry is populated at the callee's return sites — a callee
+*     built later, or one that returns slot borrows, is not registered and
+*     the binding keeps the pre-existing borrow behavior);
+*   - an owned accessor (`pop`/`move_T`/`copy`) — move-out semantics
+*     transfer slot-owned heap buffers to the binding.
+*
+* NOT normalized (never recorded): struct constructions (`Info(...)` — its
+* `#init` leaves rodata borrows and bypasses the return path) and container
+* BORROW accessors (`.at`/`.first`/`.slice`/`load` — the slot keeps
+* ownership; recording would free the container's storage).
+*/
+function is_normalized_struct_call(value, status) {
+	if (!value) return false;
+	if (value.node_type === "func_call") {
+		const call = value;
+		return !!status.normalized_struct_returners?.has(call.name);
+	}
+	if (value.node_type === "access") {
+		const access = value.access;
+		if (access?.node_type !== "access_func") return false;
+		const name = access.name ?? "";
+		if (is_container_borrow_accessor_name(name)) return false;
+		if (status.normalized_struct_returners?.has(name)) return true;
+		const target = value.target;
+		const receiver_type = target ? target.type ?? void 0 : void 0;
+		if (receiver_type?.name) {
+			const label = `${mono_type_name(receiver_type)}_${name}`;
+			if (status.normalized_struct_returners?.has(label)) return true;
+		}
+		return false;
+	}
+	return false;
+}
+/**
+* Record every direct string field of a call-initialized value-struct
+* binding (`var Info i = make()`) as heap-owned: the callee's return
+* normalization guarantees each field is a heap buffer, so scope-exit
+* auto_free must free them, and a later `i.field = …` write sees
+* old_was_heap and reclaims the displaced buffer instead of leaking it.
+* No-op for non-struct, class, view, and array types, for structs without
+* direct string fields, and for non-call initializers.
+*/
+function record_call_init_string_fields(node, status) {
+	if (!is_normalized_struct_call(node.value, status)) return;
+	const type = node.type;
+	if (!type?.name) return;
+	const mono_name = mono_type_name(type);
+	if (mono_name.startsWith("_Tuple_")) return;
+	const struct = status.structs.find((s) => s.name === mono_name && !s.is_simple_type);
+	if (!struct || struct.is_class) return;
+	const fields = direct_string_fields(struct);
+	if (!fields.length) return;
+	if (!status.heap_string_fields) status.heap_string_fields = /* @__PURE__ */ new Set();
+	for (const field of fields) status.heap_string_fields.add(`${node.name}.${field.name}`);
+}
+//#endregion
 //#region ../src/build_common/fold_string_const.ts
 /**
 * Fold a top-level `const`'s string `+` chain into a single string literal.
@@ -22554,12 +22686,15 @@ function build_declaration_node$1(node, status, nir_init, nir_swap) {
 				build_swap_params(func_call, status);
 			} else {
 				const old_buffer = status.struct_return_buffer;
+				const old_buffer_var = status.struct_return_buffer_var;
 				const old_preset = status.call_x8_preset;
 				emit_var_address(status, "x8", node.name);
+				status.struct_return_buffer_var = node.name;
 				status.struct_return_buffer = "x8";
 				status.call_x8_preset = true;
 				emit_init_value$1(node.value, nir_init, status);
 				status.struct_return_buffer = old_buffer;
+				status.struct_return_buffer_var = old_buffer_var;
 				status.call_x8_preset = old_preset;
 			}
 			return;
@@ -23085,14 +23220,18 @@ function build_declaration_node$1(node, status, nir_init, nir_swap) {
 					build_swap_params(func_call, status);
 				} else if (status.structs.find((s) => s.name === (func_call.type?.name ?? func_call.name) && !s.is_simple_type && !s.is_class) && status.function_return_label) {
 					const old_buffer = status.struct_return_buffer;
+					const old_buffer_var = status.struct_return_buffer_var;
 					const old_preset = status.call_x8_preset;
 					emit_var_address(status, "x8", node.name);
+					status.struct_return_buffer_var = node.name;
 					status.struct_return_buffer = "x8";
 					status.call_x8_preset = true;
 					emit_init_value$1(node.value, nir_init, status);
 					status.struct_return_buffer = old_buffer;
+					status.struct_return_buffer_var = old_buffer_var;
 					status.call_x8_preset = old_preset;
 					emit_var_address(status, "x0", node.name);
+					record_call_init_string_fields(node, status);
 				} else {
 					emit_init_value$1(node.value, nir_init, status);
 					emit_var_store(status, "x0", node.name, struct_size);
@@ -23128,6 +23267,7 @@ function build_declaration_node$1(node, status, nir_init, nir_swap) {
 					const field_type = (target_type.name ? status.structs.find((s) => s.name === target_type.name) : void 0)?.fields.find((f) => f.name === field_name)?.type ?? type_from_value_node$1(access.access);
 					emit_struct_copy("x1", "x0", get_field_offset(target_type.name, field_name, status), get_struct_size(field_type.name, status), status);
 				}
+				record_call_init_string_fields(node, status);
 			}
 		}
 	} else if (node.value) {
@@ -24967,6 +25107,18 @@ function build_return_node$1(node, status, nir_value) {
 				const field_off = get_field_offset(ret_struct.name, field.name, status);
 				emit_enum_payload_strdups_at(status, field_enum.name, "x8", field_off);
 			}
+			if (ret_struct && !returns_nullable_struct) {
+				const returned_var = node.value.node_type === "value" ? node.value.value : "";
+				if (returned_var !== "" && returned_var !== "0" && returned_var !== "null" && all_scope_frames(status).flat().some((d) => d.name === returned_var)) {
+					let skip_fields;
+					const prefix = `${node.value.value}.`;
+					for (const key of status.heap_string_fields ?? []) if (key.startsWith(prefix)) {
+						skip_fields ??= /* @__PURE__ */ new Set();
+						skip_fields.add(key.slice(prefix.length));
+					}
+					emit_string_field_strdups_at(status, ret_struct.name, "x8", 0, skip_fields);
+				}
+			}
 		}
 	}
 	if (status.return_assign) {
@@ -28596,8 +28748,39 @@ function build_function_call_node$1(node, status) {
 						emit_asm(status, `str x9, [x29, #${off + struct_size}]\n`);
 						emit_asm(status, `add x0, x29, #${off}\n`);
 					}
-				} else if (is_struct_type$3(param_type, status) || is_enum_with_data_type$2(param_type, status)) emit_struct_address(node.params[i], status);
-				else if (arg_deferrable(i)) {
+				} else if (is_struct_type$3(param_type, status) || is_enum_with_data_type$2(param_type, status)) {
+					if (node.move_owned_param_indices?.includes(i) && node.params[i].node_type === "value") {
+						const transfer_struct = status.structs.find((st) => st.name === resolve_struct_name(param_type, param.type?.type_args, status) && !st.is_simple_type && !st.is_class && !st.is_generic);
+						const transfer_var = node.params[i].value;
+						if (transfer_struct && direct_string_fields(transfer_struct).length > 0 && transfer_var) {
+							const recorded = /* @__PURE__ */ new Set();
+							for (const key of status.heap_string_fields ?? []) if (key.startsWith(`${transfer_var}.`)) recorded.add(key.slice(transfer_var.length + 1));
+							if (direct_string_fields(transfer_struct).filter((f) => !recorded.has(f.name)).length > 0) {
+								emit_struct_address(node.params[i], status);
+								ensure_newline(status);
+								emit_string_field_strdups_at(status, transfer_struct.name, "x0", 0, recorded);
+								if (status.call_x8_preset && status.struct_return_buffer_var) emit_var_address(status, "x8", status.struct_return_buffer_var);
+							}
+						}
+					}
+					const arg_struct = status.structs.find((st) => st.name === resolve_struct_name(param_type, param.type?.type_args, status) && !st.is_simple_type && !st.is_class && !st.is_generic);
+					if (node.owned_value_param_indices?.includes(i) && arg_struct && !(arg_struct.traits ?? []).length && direct_string_fields(arg_struct).length > 0 && status.normalized_struct_returners?.has(func_name) && !status.func_address_taken?.has(func_name)) {
+						const mono_name = arg_struct.name;
+						const struct_size = get_struct_size(mono_name, status);
+						const off = allocate_stack_space(status, struct_size);
+						emit_struct_address(node.params[i], status);
+						ensure_newline(status);
+						emit_asm(status, `mov x1, x0\n`);
+						emit_asm(status, `add x0, x29, #${off}\n`);
+						for (let b = 0; b < struct_size; b += 8) {
+							emit_asm(status, `ldr x2, [x1, #${b}]\n`);
+							emit_asm(status, `str x2, [x0, #${b}]\n`);
+						}
+						emit_asm(status, `add x0, x29, #${off}\n`);
+						emit_string_field_strdups_at(status, mono_name, "x0");
+						if (status.call_x8_preset && status.struct_return_buffer_var) emit_var_address(status, "x8", status.struct_return_buffer_var);
+					} else emit_struct_address(node.params[i], status);
+				} else if (arg_deferrable(i)) {
 					deferred_args.push({
 						param: node.params[i],
 						slot: arg_slot[i]
@@ -28729,6 +28912,7 @@ function build_function_call_node$1(node, status) {
 			const tname = all_scope_frames(status).flat().find((d) => d.name === vname)?.type?.name ?? param.type?.name;
 			if (tname === "string") continue;
 			if (tname && status.enums.find((e) => e.name === tname && e.has_associated_data)) continue;
+			if (vname !== void 0 && (node.move_owned_param_indices?.includes(idx) ?? false)) clear_heap_string_fields(status, vname);
 		}
 		if (param) mark_moved_if_struct(param, status);
 	}
@@ -31057,11 +31241,23 @@ function free_scoped_declarations(status, decls, persist_string_field_records =
 				commented = true;
 			}
 			const dot = key.indexOf(".");
-			status.code += `free(${c_function_name(key.substring(0, dot))}${key.substring(dot)}.ptr);\n`;
+			const base = c_function_name(key.substring(0, dot));
+			const arrow = dec.string_fields_via_pointer ? "->" : ".";
+			const field = key.substring(dot + 1);
+			const free_fn = status.audit ? "nomen_free_wrap" : "free";
+			status.code += `${free_fn}(${base}${arrow}${field}.ptr);\n`;
 			if (!persist_string_field_records) status.heap_string_fields.delete(key);
 		}
 	}
 	for (const dec of decls) {
+		if (dec.owned_heap_shell) {
+			if (!commented) {
+				status.code += "\n// Auto-free\n";
+				commented = true;
+			}
+			status.code += `${status.audit ? "nomen_free_wrap" : "free"}(${c_function_name(dec.name)});\n`;
+			continue;
+		}
 		if (persist_string_field_records && dec.force_owned_string === true) continue;
 		if (status.moved?.has(dec.name)) continue;
 		const cname = c_function_name(dec.name);
@@ -31659,7 +31855,8 @@ function build_assignment_node$1(node, status, nir_rhs, nir_swap) {
 			status.init_assigned_fields.add(tracked_key);
 		}
 		const old_was_heap = !!target_struct?.is_class && !first_init_write || !!status.heap_string_fields?.has(tracked_key);
-		if (target_struct && target_var && (!self_target || target_struct.is_class)) {
+		const is_class_target = !!target_struct?.is_class;
+		if (target_struct && (target_var || is_class_target) && (!self_target || is_class_target)) {
 			const fresh_heap = is_owned_heap_temp$1(node.right_value, status);
 			const rhs_is_null_value = node.right_value.node_type === "value" && node.right_value.value === "null";
 			const saved_len = begin_code_scratch(status);
@@ -32741,6 +32938,7 @@ function build_declaration_node(node, status, nir_init, nir_swap) {
 				emit_swap_value$1(node.swap, nir_swap, status);
 			}
 			if (has_field_overrides(node.value)) emit_field_overrides(safe_name, node.value, build_node$1, status, ";\n", ";\n");
+			record_call_init_string_fields(node, status);
 		}
 	}
 }
@@ -33256,6 +33454,7 @@ function build_return_node(node, status, nir_value) {
 		}
 	}
 	let returned_value_decl;
+	let returned_recorded_string_fields;
 	if (node.value.node_type === "value") {
 		const value = node.value.value;
 		returned_value_decl = find_decl_across_scopes(value, status);
@@ -33269,7 +33468,11 @@ function build_return_node(node, status, nir_value) {
 		}
 		if (status.heap_string_fields?.size) {
 			const prefix = `${value}.`;
-			for (const key of Array.from(status.heap_string_fields)) if (key.startsWith(prefix)) status.heap_string_fields.delete(key);
+			for (const key of Array.from(status.heap_string_fields)) if (key.startsWith(prefix)) {
+				returned_recorded_string_fields ??= /* @__PURE__ */ new Set();
+				returned_recorded_string_fields.add(key.slice(prefix.length));
+				status.heap_string_fields.delete(key);
+			}
 		}
 	}
 	if (ret_type?.is_array && return_array_var && return_array_len > 0) {
@@ -33378,6 +33581,11 @@ function build_return_node(node, status, nir_value) {
 		status.code += `;\n`;
 		if (node.value.node_type === "access" && node.value.access?.node_type === "access_field" && !returns_string_zero && !returns_struct_zero && !returns_view_value && ret_type.name !== "string" && !ret_type.is_view && !ret_type.is_array && status.enums.find((e) => e.name === ret_type.name && e.has_associated_data)) status.code += `_return_val = ${ret_type.name}_copy(_return_val);\n`;
 		if (has_field_overrides(node.value)) emit_field_overrides("_return_val", node.value, build_node$1, status, "", ";\n");
+		const bare_local_return = node.value.node_type === "value" && node.value.value !== "0" && node.value.value !== "null" && !!returned_value_decl;
+		if (is_struct && !return_is_class && !ret_type.is_view && !ret_type.is_array && return_struct && !returns_struct_zero && bare_local_return) for (const field of direct_string_fields(return_struct)) {
+			if (returned_recorded_string_fields?.has(field.name)) continue;
+			status.code += `_return_val.${field.name} = nomen_str_dup(_return_val.${field.name});\n`;
+		}
 		emit_nursery_joins_on_return_c(status);
 		reclaim_all_c_scopes(status);
 		status.code += `return _return_val;\n`;
@@ -35328,6 +35536,18 @@ function build_function_node(node, status) {
 				if (param_trait && !param_struct?.is_class) decl.trait_class_trait = param.type.name;
 				status.scoped_declarations.push(decl);
 			}
+			const is_free_function = (!node.scope || node.scope.node_type === "root" || node.scope.node_type === "func") && !node.params.some((p) => p.is_self_param);
+			const fn_name = node.name;
+			const fn_label = emission_label(node);
+			const owned_value_struct = is_free_function && !node.address_escaped && !param.is_self_param && !param.is_variadic && !param.type.is_ref && !param.type.is_nullable && !param.type.is_view && !param.type.is_array && param.type.name ? status.structs.find((st) => st.name === param.type.name && !st.is_simple_type && !st.is_class) : void 0;
+			if (owned_value_struct && !(owned_value_struct.traits ?? []).length && direct_string_fields(owned_value_struct).length > 0 && !struct_needs_destroy(owned_value_struct, status) && (status.normalized_struct_returners?.has(fn_name) || status.normalized_struct_returners?.has(fn_label)) && !status.func_address_taken?.has(fn_name) && !status.func_address_taken?.has(fn_label)) {
+				const decl = new DeclarationNode(param.start, "private", "var", pname, param.type);
+				decl.string_fields_via_pointer = true;
+				decl.owned_heap_shell = !param.is_moved;
+				status.scoped_declarations.push(decl);
+				if (!status.heap_string_fields) status.heap_string_fields = /* @__PURE__ */ new Set();
+				for (const field of direct_string_fields(owned_value_struct)) status.heap_string_fields.add(`${pname}.${field.name}`);
+			}
 		}
 	}
 	const nir = node.statements?.length ? lower_function(node) : void 0;
@@ -36568,6 +36788,27 @@ function build_function_call_node(node, status) {
 			continue;
 		}
 		const param_type = type_from_value_node$1(node.params[i]);
+		if (node.move_owned_param_indices?.includes(i) && node.params[i].node_type === "value") {
+			const transfer_struct = status.structs.find((st) => st.name === mono_type_name(param_type) && !st.is_simple_type && !st.is_class && !st.is_generic);
+			const transfer_var = node.params[i].value;
+			if (transfer_struct && direct_string_fields(transfer_struct).length > 0 && transfer_var) {
+				const recorded = /* @__PURE__ */ new Set();
+				for (const key of status.heap_string_fields ?? []) if (key.startsWith(`${transfer_var}.`)) recorded.add(key.slice(transfer_var.length + 1));
+				const unrecorded = direct_string_fields(transfer_struct).filter((f) => !recorded.has(f.name));
+				if (unrecorded.length > 0) {
+					const saved_arg = begin_code_scratch(status);
+					status.code += `(void *)&`;
+					status.suppress_dereference = true;
+					build_node$1(node.params[i], status);
+					status.suppress_dereference = false;
+					const addr_text = end_code_scratch(status, saved_arg);
+					status.code += `(void *)({ struct ${transfer_struct.name} *_t = (struct ${transfer_struct.name} *)${addr_text}; `;
+					for (const f of unrecorded) status.code += `_t->${f.name} = nomen_str_dup(_t->${f.name}); `;
+					status.code += `(void *)_t; })`;
+					continue;
+				}
+			}
+		}
 		if (node.nullable_param_indices?.includes(i) && node.params[i].node_type === "value" && node.params[i].value === "null") {
 			status.code += `(void *)&(struct ${param_type.name}){0}, 0`;
 			continue;
@@ -36614,6 +36855,23 @@ function build_function_call_node(node, status) {
 			status.suppress_dereference = false;
 			continue;
 		}
+		const arg_struct = status.structs.find((st) => st.name === mono_type_name(param_type) && !st.is_simple_type && !st.is_class && !st.is_generic);
+		if (node.owned_value_param_indices?.includes(i) && !param_is_class && arg_struct && !(arg_struct.traits ?? []).length && direct_string_fields(arg_struct).length > 0 && status.normalized_struct_returners?.has(func_name) && !status.func_address_taken?.has(func_name)) {
+			const struct_name = arg_struct.name;
+			const fields = direct_string_fields(arg_struct);
+			const saved_arg = begin_code_scratch(status);
+			status.code += `(void *)&`;
+			status.suppress_dereference = true;
+			build_node$1(node.params[i], status);
+			status.suppress_dereference = false;
+			const addr_text = end_code_scratch(status, saved_arg);
+			status.code += `(void *)({ struct ${struct_name} *_src = (struct ${struct_name} *)${addr_text}; `;
+			status.code += `struct ${struct_name} *_own = (struct ${struct_name} *)malloc(sizeof(struct ${struct_name})); `;
+			status.code += `*_own = *_src; `;
+			for (const field of fields) status.code += `_own->${field.name} = nomen_str_dup(_own->${field.name}); `;
+			status.code += `_own; })`;
+			continue;
+		}
 		if (!param_is_class && !!status.structs.find((s) => s.name === param_type.name && !s.is_simple_type) || !!status.traits.find((t) => t.name === param_type.name) || is_ref_param) {
 			if (node.params[i].node_type === "value" && (status.function_ref_params?.has(node.params[i].value) || status.class_vars?.has(node.params[i].value))) status.suppress_dereference = true;
 			else if (is_ref_param) status.code += `&`;
@@ -36690,9 +36948,12 @@ function build_function_call_node(node, status) {
 			if (decl_hit) decl_hit.frame.splice(decl_hit.index, 1);
 			if (is_value_struct) {
 				const prefix = `${vname}.`;
+				const transfer = node.move_owned_param_indices?.includes(idx) ?? false;
 				for (const key of Array.from(status.heap_string_fields ?? [])) if (key.startsWith(prefix)) {
-					if (!status.pending_string_releases) status.pending_string_releases = [];
-					status.pending_string_releases.push(`free(${key}.ptr);`);
+					if (!transfer) {
+						if (!status.pending_string_releases) status.pending_string_releases = [];
+						status.pending_string_releases.push(`free(${key}.ptr);`);
+					}
 					status.heap_string_fields.delete(key);
 				}
 			}
@@ -38353,6 +38614,10 @@ function get_base_address(access, status, reg) {
 			if (paramReg !== reg) emit_asm(status, `mov ${reg}, ${paramReg}\n`);
 		} else if (is_local_ref_var(name, status)) emit_deref_var_address(status, reg, name);
 		else emit_var_address(status, reg, name);
+	} else if (access_chain_crosses_class(access, status)) {
+		build_node(access.target, status);
+		ensure_newline(status);
+		if (reg !== "x0") emit_asm(status, `mov ${reg}, x0\n`);
 	} else {
 		emit_address_of(access.target, status);
 		ensure_newline(status);
@@ -41871,6 +42136,9 @@ function emit_address_of(node, status) {
 					if (paramReg !== "x0") emit_asm(status, `mov x0, ${paramReg}\n`);
 				} else if (is_local_ref_var(name, status)) emit_deref_var_address(status, "x0", name);
 				else emit_var_address(status, "x0", name);
+			} else if (access_chain_crosses_class(access, status)) {
+				build_node(access.target, status);
+				ensure_newline(status);
 			} else {
 				emit_address_of(access.target, status);
 				ensure_newline(status);
@@ -44254,6 +44522,195 @@ function scan_func(func, struct_name, result, class_type_names) {
 	}
 }
 //#endregion
+//#region ../src/build_common/struct_return_classification.ts
+/**
+* Pre-build classification of which functions return value structs whose
+* string fields are UNIFORMLY heap-owned via return-boundary normalization.
+* Populates `status.normalized_struct_returners`; a caller binding a call
+* result of a registered function records the struct's string fields and
+* frees them at scope exit, while bindings of unregistered callees keep the
+* pre-existing borrow behavior (never recorded, never freed — sound, though
+* it may leak on slot overwrites, which is the documented status quo).
+*
+* The rule is deliberately narrow: a function normalizes iff EVERY
+* struct-return statement returns a BARE VARIABLE (a local or parameter).
+* That is the transfer shape — the returned variable dies at the return, so
+* the boundary normalization (transfer recorded heap fields, strdup the
+* rest) is sound and leak-free. Every other shape keeps the status quo:
+*
+*   - container borrow accessors (`at`/`first`/`slice`/`load` — e.g.
+*     `Map.get`'s `return self.values.load_T(idx)`) yield SLOT-owned bytes;
+*     normalizing them would leak in expression-temp consumers
+*     (`m.get(k).field`) that nobody records or frees;
+*   - owned accessors (`pop`/`move_T`/`copy`) transfer slot-owned heap
+*     buffers — the caller's recording is sound WITHOUT normalization, so
+*     they record via the owned-accessor rule (see
+*     call_init_string_fields.ts) and the callee skips the copy;
+*   - forwarded calls (`return make()`) are skipped when the callee is
+*     registered (its result is already uniformly owned — copying it would
+*     leak the inner buffers) and keep the status quo when it is not.
+*
+* This runs as a WHOLE-PROGRAM AST PRE-PASS (before any function body is
+* built) because a build-order-sensitive registry cannot work: nested
+* functions are built after their enclosing function's body, so a runtime
+* registration would be invisible to the caller's earlier lookup.
+*/
+/** Collect every function and struct declaration under the AST (including
+*  nested functions, struct methods, and function bodies at any depth). */
+function collect(node, fns, structs, seen) {
+	if (!node || typeof node !== "object" || seen.has(node)) return;
+	seen.add(node);
+	if (node.node_type === "func") fns.push(node);
+	if (node.node_type === "struct") structs.push(node);
+	for (const key of Object.keys(node)) {
+		if (key === "parent" || key === "scope") continue;
+		const value = node[key];
+		if (Array.isArray(value)) {
+			for (const item of value) if (item && typeof item === "object" && "node_type" in item) collect(item, fns, structs, seen);
+		} else if (value && typeof value === "object" && "node_type" in value) collect(value, fns, structs, seen);
+	}
+}
+/** The DIRECT `return <expr>` statements of a function body (nested function
+*  declarations are not descended into — their returns belong to them). */
+function direct_returns(fn) {
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node) => {
+		if (!node || typeof node !== "object" || seen.has(node)) return;
+		seen.add(node);
+		if (node.node_type === "func" && node !== fn) return;
+		if (node.node_type === "return") out.push(node);
+		for (const key of Object.keys(node)) {
+			if (key === "parent" || key === "scope") continue;
+			const value = node[key];
+			if (Array.isArray(value)) {
+				for (const item of value) if (item && typeof item === "object" && "node_type" in item) walk(item);
+			} else if (value && typeof value === "object" && "node_type" in value) walk(value);
+		}
+	};
+	for (const statement of fn.statements ?? []) walk(statement);
+	return out;
+}
+/** Whether the function is a FREE function: not a method of a struct (whose
+*  element/slot params are passed by address for in-place access) and not a
+*  monomorphized container clone. */
+function is_free_function_node(fn) {
+	const scope = fn.scope;
+	return !scope || scope.node_type === "root" || scope.node_type === "func";
+}
+/**
+* Whole-program pre-pass: classify free functions that take an OWNING value
+* struct parameter (string fields) — those get pass-by-value semantics:
+*
+*   - the CALL SITE materializes a uniformly heap-owned shell (struct-copy
+*     + per-string-field strdup) and passes its address;
+*   - the CALLEE seeds the param's string-field records at entry and frees
+*     the surviving fields (and the shell) at scope exit.
+*
+* Writes through the param then stay local to the callee; the caller's
+* variable is never aliased or mutated. Functions whose address escapes
+* into a func-typed value (`var f = g`, `apply(g, …)`, `b.modify(0, touch)`)
+* are EXCLUDED: they may be invoked through a pointer with a borrowed
+* argument, and keep the status quo (borrow + the documented write leak).
+*
+* Populates `status.normalized_struct_returners` (the materializing set) and
+* `status.func_address_taken` (the excluded set) for the call-site and
+* function-definition builders.
+*/
+function gather_normalized_struct_returners(root, status) {
+	const fns = [];
+	const structs = [];
+	collect(root, fns, structs, /* @__PURE__ */ new Set());
+	const address_taken = /* @__PURE__ */ new Set();
+	const value_walk = (node) => {
+		if (!node || typeof node !== "object") return;
+		if (node.node_type === "value") {
+			const v = node;
+			if (typeof v.value === "string" && v.type?.name === "func" && /^[A-Za-z_]/.test(v.value)) address_taken.add(v.value);
+		}
+		for (const key of Object.keys(node)) {
+			if (key === "parent" || key === "scope") continue;
+			const child = node[key];
+			if (Array.isArray(child)) {
+				for (const item of child) if (item && typeof item === "object" && "node_type" in item) value_walk(item);
+			} else if (child && typeof child === "object" && "node_type" in child) value_walk(child);
+		}
+	};
+	value_walk(root);
+	const decl_walk = (node) => {
+		if (!node || typeof node !== "object") return;
+		const d = node;
+		if (d.node_type === "declaration" && typeof d.name === "string" && d.type?.name === "func") address_taken.add(d.name);
+		for (const key of Object.keys(node)) {
+			if (key === "parent" || key === "scope") continue;
+			const child = node[key];
+			if (Array.isArray(child)) {
+				for (const item of child) if (item && typeof item === "object" && "node_type" in item) decl_walk(item);
+			} else if (child && typeof child === "object" && "node_type" in child) decl_walk(child);
+		}
+	};
+	decl_walk(root);
+	const return_candidates = [];
+	for (const fn of fns) {
+		if (!is_free_function_node(fn)) continue;
+		if (address_taken.has(fn.name)) continue;
+		const ret = fn.return_type;
+		if (!ret || ret.is_array || ret.is_view) continue;
+		const ret_struct = structs.find((st) => st.name === ret.name && !st.is_simple_type && !st.is_class);
+		if (!ret_struct || direct_string_fields(ret_struct).length === 0) continue;
+		return_candidates.push(fn);
+	}
+	const return_normalizing = new Set(return_candidates.map((c) => c.name));
+	let changed = true;
+	while (changed) {
+		changed = false;
+		for (const fn of return_candidates) {
+			if (!return_normalizing.has(fn.name)) continue;
+			for (const ret of direct_returns(fn)) {
+				const value = ret.value ?? void 0;
+				if (value && value.node_type === "value") continue;
+				if (value && value.node_type === "func_call" && return_normalizing.has(value.name ?? "")) continue;
+				return_normalizing.delete(fn.name);
+				changed = true;
+				break;
+			}
+		}
+	}
+	for (const fn of fns) {
+		if (!is_free_function_node(fn)) continue;
+		if (address_taken.has(fn.name)) continue;
+		if (fn.params.some((p) => p.is_self_param)) continue;
+		if (fn.address_escaped) continue;
+		if (!fn.has_body) continue;
+		for (const param of fn.params ?? []) {
+			if (param.is_self_param || param.is_variadic) continue;
+			if (param.type.is_ref || param.type.is_nullable || param.type.is_view || param.type.is_array) continue;
+			const struct = param.type.name ? structs.find((st) => st.name === param.type.name && !st.is_simple_type && !st.is_class) : void 0;
+			if (!struct) continue;
+			if (direct_string_fields(struct).length > 0 && !(struct.traits ?? []).length && !struct_needs_destroy(struct, status)) {
+				if (!status.normalized_struct_returners) status.normalized_struct_returners = /* @__PURE__ */ new Set();
+				status.normalized_struct_returners.add(fn.name);
+				status.normalized_struct_returners.add(emission_label(fn));
+				break;
+			}
+		}
+		if (return_normalizing.has(fn.name)) {
+			if (!status.normalized_struct_returners) status.normalized_struct_returners = /* @__PURE__ */ new Set();
+			status.normalized_struct_returners.add(fn.name);
+			status.normalized_struct_returners.add(emission_label(fn));
+		}
+	}
+	for (const struct of structs) {
+		if (struct.is_class || struct.is_generic || struct.is_simple_type) continue;
+		if (!struct.functions.some((f) => f.name === "copy" && f.has_body)) continue;
+		if (direct_string_fields(struct).length === 0) continue;
+		if (!status.normalized_struct_returners) status.normalized_struct_returners = /* @__PURE__ */ new Set();
+		status.normalized_struct_returners.add(`${struct.name}_copy`);
+	}
+	if (!status.func_address_taken) status.func_address_taken = /* @__PURE__ */ new Set();
+	for (const name of address_taken) status.func_address_taken.add(name);
+}
+//#endregion
 //#region ../src/build.ts
 function build(root, options = {}) {
 	let status = {
@@ -44287,6 +44744,7 @@ function build(root, options = {}) {
 	reset_match_temp_counter();
 	reset_ns_tmp_counter();
 	stamp_last_use_moves(root);
+	gather_normalized_struct_returners(root, status);
 	if (options.arch === "aarch64") {
 		install_asm_code_buffer(status);
 		reset_string_counter$1();
@@ -46510,6 +46968,23 @@ function is_owning_struct_type_requiring_move(type, status) {
 	if (!s || s.is_class) return false;
 	return struct_owns_non_string_heap(s, status, /* @__PURE__ */ new Set());
 }
+/**
+* Whether `type` is a concrete value struct with direct string fields whose
+* only ownership those strings — the pass-by-value convention's domain: a
+* parameter of this type is fully owned by the callee (the call boundary
+* materializes a uniformly heap-owned copy), so `var` field writes inside
+* the body stay local and no call-site acknowledgment is needed. Excludes
+* structs that own non-string heap (those keep `move ... swap` / `ref`
+* semantics) and structs conforming to traits (trait dispatch aliases).
+*/
+function is_pass_by_value_owning_struct(type, status) {
+	const s = resolve_struct$1(type, status);
+	if (!s || s.is_class || s.is_generic || s.is_simple_type) return false;
+	if ((s.traits ?? []).length > 0) return false;
+	if (direct_string_fields(s).length === 0) return false;
+	if (struct_owns_non_string_heap(s, status, /* @__PURE__ */ new Set())) return false;
+	return true;
+}
 function struct_owns_non_string_heap(s, status, visited) {
 	if (visited.has(s.name)) return false;
 	visited.add(s.name);
@@ -49150,6 +49625,12 @@ function check_declaration_node(decl, status) {
 	if (is_view_keyword && decl.type_start !== void 0) decl.type.is_view = true;
 	if (decl.func_params) {
 		if (is_view_keyword) add_error(status, `'view' cannot declare a function-typed binding`, decl.start);
+		if (decl.value?.node_type === "func") decl.value.address_escaped = true;
+		else if (decl.value?.node_type === "value") {
+			const fn = status.functions.findLast((f) => f.name === decl.value.value);
+			if (fn) fn.address_escaped = true;
+		}
+		if (decl.value?.node_type === "value" && decl.value.value === "null" && !(decl.type.name === "func" && decl.type.is_nullable)) add_error(status, `cannot assign null to a non-nullable func — declare it 'func?' (or 'Func<...>?')`, decl.value.start);
 		if (decl.func_return_type) {
 			check_type_exists(decl.func_return_type, status, -1);
 			const materialized = materialize_type(decl.func_return_type, status);
@@ -49214,7 +49695,7 @@ function check_declaration_node(decl, status) {
 		status.values.push({
 			declaration,
 			name: decl.name,
-			type: decl.func_return_type || decl.type,
+			type: decl.type.name === "func" && decl.type.is_nullable ? decl.type : decl.func_return_type || decl.type,
 			is_set: !!decl.value,
 			start: decl.start,
 			is_null: decl.value?.node_type === "value" && decl.value.value === "null",
@@ -49712,7 +50193,7 @@ function check_struct_node(struct, status) {
 			continue;
 		}
 		if (decl.func_params) {
-			decl.type = new Type("func");
+			if (decl.type.name !== "func") decl.type = new Type("func");
 			check_declaration_node(decl, status);
 			continue;
 		}
@@ -50020,6 +50501,7 @@ function synthesize_for_struct(struct, status) {
 	if (struct.traits.includes("Stringable") && !struct_has_function(struct, "to_string") && fields.every((f) => field_is_stringable(f, status, /* @__PURE__ */ new Set()))) struct.functions.push(build_to_string(struct, fields));
 	if (struct.traits.includes("Equatable") && !struct_has_function(struct, "eq") && !struct_has_function(struct, "ne") && fields.every((f) => field_is_equatable(f, status, /* @__PURE__ */ new Set()))) struct.functions.push(build_eq(struct, fields));
 	if (struct.traits.includes("Hashable") && !struct_has_function(struct, "hash") && fields.every((f) => field_is_hashable(f, status, /* @__PURE__ */ new Set()))) struct.functions.push(build_hash(struct, fields));
+	synthesize_copy_method(struct, status);
 }
 function build_to_string(struct, fields) {
 	const parts = [string_literal(`${struct.name}(`)];
@@ -50051,6 +50533,81 @@ function build_hash(struct, fields) {
 	const ret = new ReturnNode(-1, expr);
 	return new FunctionNode(-1, "pub", "hash", new Type("uint"), [self_param(struct)], [ret]);
 }
+/**
+* Whether `struct` is eligible for a synthesized `copy` method: a value
+* struct whose only ownership is its DIRECT string fields — the same set
+* the pass-by-value argument convention covers. A struct that additionally
+* owns non-string heap (a resource-releasing `#destroy`, a class field, a
+* nested requiring-move struct) cannot be deep-copied by "byte copy +
+* strdup the strings" — its copy stays unwritten (move/swap remains the
+* escape hatch) — and a struct with no string fields is already soundly
+* byte-copyable, so it needs no method.
+*/
+function struct_is_copyable(struct, status) {
+	if (struct.is_class || struct.is_generic || struct.is_simple_type) return false;
+	if (direct_string_fields(struct).length === 0) return false;
+	if (struct_owns_non_string_heap(struct, status, /* @__PURE__ */ new Set())) return false;
+	return struct_copy_ctor_args(struct) !== null;
+}
+/**
+* How a synthesized `copy` constructs the fresh value: the zero-argument
+* `#init` overload when one exists (auto or user), else the bodyless AUTO
+* `#init` whose params map 1:1 onto non-defaulted fields (pass
+* `self.<param>` for each). Null when neither shape exists — a user #init
+* with params only cannot be invoked without re-running its custom logic,
+* so no `copy` is synthesized.
+*/
+function struct_copy_ctor_args(struct) {
+	const inits = struct.functions.filter((f) => f.name === "#init");
+	if (inits.some((f) => f.params.filter((p) => !p.is_self_param).length === 0)) return [];
+	const auto = inits.find((f) => !f.has_body);
+	if (!auto) return null;
+	return auto.params.filter((p) => !p.is_self_param).map((p) => p.name);
+}
+/** Whether `type` names a struct that has (or will get) a `copy` method.
+*  Order-independent: it re-evaluates the eligibility predicate instead of
+*  looking for an already-synthesized method, so an outer struct nested in
+*  the same pre-pass resolves a later-declared field struct. */
+function field_type_is_copyable(type, status) {
+	if (!type.name || type.is_array || type.is_ref || type.is_view || type.is_nullable) return false;
+	const nested = status.structs.find((s) => s.name === type.name);
+	return !!nested && struct_is_copyable(nested, status);
+}
+/**
+* Synthesize `pub func copy(self) -> Struct` for owning value structs: a
+* fresh `Struct()` whose every field is rewritten from `self` — string
+* field writes strdup the source (the backends' field-write path), nested
+* copyable structs recurse through their own `copy`, everything else byte
+* copies. `return c` hits the return-boundary normalization (all fields
+* recorded → transfer raw), so the caller receives a uniformly heap-owned
+* value with no extra copies.
+*/
+function build_copy(struct, status) {
+	const ctor_args = struct_copy_ctor_args(struct) ?? [];
+	const ctor = new FunctionCallNode(-1, struct.name, new Type(struct.name), ctor_args.map((name) => field_access("self", name)));
+	const statements = [new DeclarationNode(-1, "private", "var", "c", new Type(struct.name), ctor)];
+	for (const field of struct.fields) {
+		const right = field_type_is_copyable(field.type, status) ? method_call(field_access("self", field.name), "copy") : field_access("self", field.name);
+		statements.push(new AssignmentNode(-1, field_access("c", field.name), right, "="));
+	}
+	statements.push(new ReturnNode(-1, new ValueNode(-1, "c")));
+	return new FunctionNode(-1, "pub", "copy", new Type(struct.name), [self_param(struct)], statements);
+}
+/**
+* Synthesize the `copy` method on `struct` when eligible and not already
+* present. Called from the block-level derive pre-pass (which runs before
+* the struct is checked, so the method's body is checked with it) AND from
+* `monomorphize` — a mono struct materializes mid-check, after that pre-pass
+* ran, so without this hook `Box<string>.copy()` — advertised by the
+* copy-discipline error messages — would resolve to "Function not found".
+* The caller is responsible for checking the synthesized body when no later
+* struct check will (see monomorphize).
+*/
+function synthesize_copy_method(struct, status) {
+	if (struct_has_function(struct, "copy")) return;
+	if (!struct_is_copyable(struct, status)) return;
+	struct.functions.push(build_copy(struct, status));
+}
 //#endregion
 //#region ../src/check/check_block_node.ts
 function check_block_node(node, status) {
@@ -50502,8 +51059,8 @@ function check_function_parameter_node(param, status, is_library_scope = false)
 		if (param.type.is_pointer && !is_library_scope) add_error(status, `'ptr' parameters are reserved for the System library — raw pointer manipulation is not available to user code`, param.type_start ?? param.start);
 		instantiate_generic_type(param.type, status);
 	}
-	if (param.declaration === "var" && !param.is_moved && !param.is_self_param && !param.type.is_ref) add_error(status, `'var' parameters are not allowed — use 'ref' to mutate the caller's value (with 'ref' at the call site), or take it read-only and make a local 'var' copy`, param.start);
-	if (param.is_moved && param.type.name && !is_class_type$1(param.type.name, status) && !is_trait_type(param.type.name, status) && !is_owning_struct_type_requiring_move(param.type, status) && !status.type_params.includes(param.type.name) && !status.structs.some((s) => s.type_params.includes(param.type.name))) add_error(status, `move is only allowed for class, trait, or owning struct types, not '${param.type.name}'`, param.start);
+	if (param.declaration === "var" && !param.is_moved && !param.is_self_param && !param.type.is_ref && !is_pass_by_value_owning_struct(param.type, status)) add_error(status, `'var' parameters are not allowed — use 'ref' to mutate the caller's value (with 'ref' at the call site), or take it read-only and make a local 'var' copy`, param.start);
+	if (param.is_moved && param.type.name && !is_class_type$1(param.type.name, status) && !is_trait_type(param.type.name, status) && !is_owning_struct_type_requiring_move(param.type, status) && !is_pass_by_value_owning_struct(param.type, status) && !status.type_params.includes(param.type.name) && !status.structs.some((s) => s.type_params.includes(param.type.name))) add_error(status, `move is only allowed for class, trait, or owning struct types, not '${param.type.name}'`, param.start);
 	if (param.is_variadic && param.default_value) {
 		add_error(status, `Variadic parameter cannot have a default value`, param.start);
 		return;
@@ -50515,7 +51072,7 @@ function check_function_parameter_node(param, status, is_library_scope = false)
 	}
 	if (status.values.some((v) => v.name === param.name && v.declaration !== "const" && !(is_library_scope && v.is_global))) add_error(status, `Parameter already declared: ${param.name}`, param.start);
 	status.values.push({
-		declaration: param.declaration,
+		declaration: param.declaration === "var" || is_pass_by_value_owning_struct(param.type, status) ? "var" : param.declaration,
 		name: param.name,
 		type: param.type,
 		is_set: true,
@@ -50932,7 +51489,7 @@ function check_function_call_node(node, status) {
 		return false;
 	}
 	if (magic_ctor && spawn_ctor_shape) return check_magic_ctor(node, status, magic_ctor);
-	let func = find_free_function(status, node.name);
+	let func = status.values.findLast((v) => v.name === node.name && v.func_params !== void 0) ? void 0 : find_free_function(status, node.name);
 	if (func?.is_closure && func.captures?.length) func = void 0;
 	if (!func) {
 		const struct = resolve_declared_struct(node.name, status);
@@ -51001,6 +51558,10 @@ function check_function_call_node(node, status) {
 		const param_index = status.values.findLastIndex((v) => v.name === node.name);
 		const param_value = param_index >= 0 ? status.values[param_index] : void 0;
 		if (!!param_value && (param_value.type.name === "func" || param_value.func_params !== void 0 || param_value.func_return_type !== void 0) && param_value) {
+			if (param_value.is_null && !status.allow_null_value) {
+				add_error(status, `Variable '${node.name}' may be null`, node.start);
+				return false;
+			}
 			if (status.moved_variables?.has(node.name)) {
 				add_error(status, `Variable '${node.name}' used after move`, node.start);
 				return false;
@@ -51229,6 +51790,30 @@ function monomorphize(generic_struct, type_args, status) {
 		const init_func = new FunctionNode(generic_struct.start, "pub", "#init", init_return_type, init_params);
 		mono_struct.functions.push(init_func);
 	}
+	synthesize_copy_method(mono_struct, status);
+	const mono_copy = mono_struct.functions.find((f) => f.name === "copy");
+	if (mono_copy && !mono_copy.checked) {
+		mono_copy.scope = mono_struct;
+		check_function_node(mono_copy, {
+			stack: status.stack,
+			scope_depth: status.scope_depth,
+			types: status.types,
+			values: [],
+			function_value_base: 0,
+			structs: status.structs,
+			traits: status.traits,
+			enums: status.enums,
+			bitsets: status.bitsets,
+			functions: status.functions,
+			allocations: [],
+			var_name_counter: status.var_name_counter,
+			type_params: [],
+			errors: status.errors,
+			function_emission_names: status.function_emission_names,
+			allow_internal: status.allow_internal,
+			library_boundary: status.library_boundary
+		});
+	}
 	const root = status.stack[0];
 	if (!root.statements.some((s) => s.node_type === "struct" && s.name === mono_name)) root.statements.push(mono_struct);
 	return mono_struct;
@@ -51732,6 +52317,8 @@ function check_magic_ctor(node, status, name) {
 		add_error(status, `Spawned call '${call.name}' did not resolve`, node.start);
 		return false;
 	}
+	const spawned = call.resolved_function;
+	if (spawned) spawned.address_escaped = true;
 	validate_spawn_args_sendable(call, status);
 	stamp_spawn_ctor(node, name);
 	const return_type = call.type;
@@ -53318,6 +53905,13 @@ function check_function_call(node, status, func, target_type, self_value, self_p
 		const param_type = type_from_value_node(param, status);
 		const param_value = value_from_value_node(param);
 		const has_ref_keyword = node.ref_param_indices?.includes(i) ?? false;
+		if (func && func_param && func.has_body && (!func.scope || func.scope.node_type !== "struct") && !func.params.some((p) => p.is_self_param) && !func.address_escaped && !func_param.is_self_param && !func_param.is_variadic && !func_param.type.is_ref && !func_param.type.is_nullable && func_param.type.name && !is_owning_struct_type_requiring_move(func_param.type, status)) {
+			const owned_struct = status.structs.find((st) => st.name === func_param.type.name && !st.is_simple_type && !st.is_class);
+			if (owned_struct && !(owned_struct.traits ?? []).length && direct_string_fields(owned_struct).length > 0 && !struct_needs_destroy(owned_struct, status)) {
+				const indices = func_param.is_moved ? node.move_owned_param_indices ??= [] : node.owned_value_param_indices ??= [];
+				if (!indices.includes(i)) indices.push(i);
+			}
+		}
 		const has_mov_keyword = node.move_param_indices?.includes(i) ?? false;
 		if (func_param && func_param.type.name === "string" && !func_param.type.is_view && !func_param.type.is_array && param_type.name === "string" && param_type.is_view) add_error(status, `cannot pass a 'view string' to string parameter '${func_param.name}' — call .to_string() to materialize an owned copy`, param.start);
 		if (func_param.type.is_ref && !has_ref_keyword) add_error(status, `Missing 'ref' keyword for ref parameter '${func_param.name}'`, param.start);
@@ -53342,12 +53936,13 @@ function check_function_call(node, status, func, target_type, self_value, self_p
 			else if (!func_param.type.is_ref && (arg_is_stack_array_var || arg_is_literal) && elem_struct && !elem_struct.is_simple_type && !elem_struct.is_class && struct_has_string_fields(elem_struct, status)) add_error(status, `Cannot pass an array of owning value struct '${param_type.name}' (string fields) to 'Array<${param_type.name}>' parameter '${func_param.name}' — the materialised heap copy would share the element strings. Use 'List<${param_type.name}>' instead: its Buffer deep-copies owning elements soundly`, param.start);
 		}
 		const param_is_class = func_param.type.name && is_class_type$1(func_param.type.name, status);
-		const param_is_owning_struct = func_param.is_moved && !func_param.type.is_nullable && !!func_param.type.name && is_owning_struct_type_requiring_move(func_param.type, status);
+		const param_transfers = !!node.move_owned_param_indices?.includes(i);
+		const param_is_owning_struct = func_param.is_moved && !func_param.type.is_nullable && !!func_param.type.name && (is_owning_struct_type_requiring_move(func_param.type, status) || param_transfers);
 		const arg_is_owned_value = param.node_type === "value" && borrow_depth_of(param, status) === void 0;
 		if (func_param.is_moved && !has_mov_keyword && (param_is_class || param_is_owning_struct) && arg_is_owned_value) add_error(status, `Missing 'move' keyword for move parameter '${func_param.name}'`, param.start);
 		else if (!func_param.is_moved && has_mov_keyword) add_error(status, `Unexpected 'move' keyword for non-move parameter '${func_param.name}'`, param.start);
 		if (has_mov_keyword && param_value && !node.swap_params?.has(i)) {
-			if (func_param.type.name && (is_class_type$1(func_param.type.name, status) || func_param.is_moved && is_owning_struct_type_requiring_move(func_param.type, status))) {
+			if (func_param.type.name && (is_class_type$1(func_param.type.name, status) || func_param.is_moved && is_owning_struct_type(func_param.type, status))) {
 				if (!status.moved_variables) status.moved_variables = /* @__PURE__ */ new Set();
 				status.moved_variables.add(param_value);
 			}
@@ -53358,7 +53953,7 @@ function check_function_call(node, status, func, target_type, self_value, self_p
 			if (field_type.name && is_class_type$1(field_type.name, status)) {
 				const field_name = access.access.name;
 				add_error(status, `cannot move '${field_name}' out of struct — struct owns its class fields`, param.start);
-			} else if (field_type.name && !field_type.is_nullable && is_owning_struct_type_requiring_move(field_type, status)) {
+			} else if (field_type.name && !field_type.is_nullable && (is_owning_struct_type_requiring_move(field_type, status) || param_transfers && is_pass_by_value_owning_struct(field_type, status))) {
 				const field_name = access.access.name;
 				add_error(status, `cannot move '${field_name}' out of struct by value — it owns heap resources; use 'move ... swap <replacement>' to revalidate the field`, param.start);
 			}
@@ -54731,14 +55326,17 @@ function check_assignment_node(assign, status) {
 				return_type: fd?.func_return_type
 			};
 		}
-	} else if (lhs_value?.func_params?.length) lambda_signature = {
+	} else if (lhs_value?.func_params !== void 0) lambda_signature = {
 		params: lhs_value.func_params,
 		return_type: lhs_value.func_return_type
 	};
-	if (assign.right_value.node_type === "func" && lambda_signature.params && lambda_signature.params.length) {
+	if (assign.right_value.node_type === "func" && Array.isArray(lambda_signature.params)) {
+		if (!lhs_value && assign.left_value.node_type === "value") {
+			add_error(status, `cannot assign a lambda to '${lhs_value_name}' — the binding was initialized with a capture-free lambda and has no reassignable slot; declare it with '= null' (or from a named function) to reassign`, assign.right_value.start);
+			return false;
+		}
 		const rhs_func = assign.right_value;
-		if (assign.left_value.node_type === "value") rhs_func.name = lhs_value_name;
-		else if (!rhs_func.name) synthesize_lambda_name(rhs_func, status);
+		if (!rhs_func.name || assign.left_value.node_type === "value") synthesize_lambda_name(rhs_func, status);
 		if (rhs_func.params.length === lambda_signature.params.length) {
 			for (let i = 0; i < rhs_func.params.length; i++) if (!rhs_func.params[i].type.name && lambda_signature.params[i].type.name) rhs_func.params[i].type = lambda_signature.params[i].type;
 		}
@@ -55970,6 +56568,8 @@ function check_spawn_node(node, status) {
 		add_error(status, "Spawned call did not resolve", node.start);
 		return false;
 	}
+	const spawned = node.call.resolved_function;
+	if (spawned) spawned.address_escaped = true;
 	for (const param of node.call.params) {
 		let arg_type = type_from_value_node(param, status);
 		const stamped = param.type;
@@ -56787,13 +57387,14 @@ function parse_type(status) {
 		type.type_args = void 0;
 	}
 	if (type.name === "Func" && type.type_args?.length) {
-		if (type.is_nullable || type.is_array || type.is_pointer || type.is_view || type.is_ref) {
-			add_error(status, `Func<...> cannot be combined with '?'/'[]'/'ptr'/'view'/'ref'`, start);
+		if (type.is_array || type.is_pointer || type.is_view || type.is_ref) {
+			add_error(status, `Func<...> cannot be combined with '[]'/'ptr'/'view'/'ref'`, start);
 			return type;
 		}
 		const args = type.type_args;
 		const func_type = new Type("func");
 		func_type.start = type.start;
+		if (type.is_nullable) func_type.is_nullable = true;
 		func_type.func_params = [];
 		for (let i = 0; i < args.length - 1; i++) {
 			if (args[i].name === "void") {
@@ -56906,10 +57507,14 @@ function default_visibility(status) {
 *   - a func RETURN carries its signature on the Type
 *     (`type.func_params` / `type.func_return_type`).
 */
-/** Whether the current token starts a nested func type: `func` immediately
-*  followed by `(` (the bare word `func` alone is the plain marker type). */
+/** Whether the current token starts a nested func type: `func` (optionally
+*  nullable, `func?`) immediately followed by `(` (the bare word `func` alone
+*  is the plain marker type). */
 function at_func_type(status) {
-	return peek_current(status) === "func" && status.tokens[status.i + 1]?.value === "(";
+	if (peek_current(status) !== "func") return false;
+	const next = status.tokens[status.i + 1]?.value;
+	if (next === "(") return true;
+	return next === "?" && status.tokens[status.i + 2]?.value === "(";
 }
 /**
 * Reject `void` where it has no meaning. Only the last type argument of
@@ -56930,6 +57535,7 @@ function reject_void_type(type, status, at) {
 function adopt_func_param_type(param, type) {
 	if (type.name !== "func") return false;
 	param.type = new Type("func");
+	param.type.is_nullable = type.is_nullable;
 	param.func_params = type.func_params;
 	param.func_return_type = type.func_return_type;
 	return true;
@@ -56952,11 +57558,13 @@ function parse_func_type_signature(param, status) {
 }
 /**
 * Parse a full nested func type — the `func` word is consumed by the caller
-* (at_func_type confirmed the `(` follows) — and return it as a Type whose
-* func_params/func_return_type carry the signature.
+* (at_func_type confirmed the `(` follows, possibly after a `?`) — and return
+* it as a Type whose func_params/func_return_type carry the signature. A
+* `func?` spelling marks the type nullable (it may hold `null`).
 */
 function parse_func_type(status) {
 	const type = new Type("func");
+	if (accept("?", status)) type.is_nullable = true;
 	const param = new ParameterNode(get_index(status), "");
 	parse_func_type_signature(param, status);
 	type.func_params = param.func_params;
@@ -56996,6 +57604,7 @@ function parse_signature_params(params, status) {
 		if (at_func_type(status)) {
 			consume(status);
 			param.type = new Type("func");
+			if (accept("?", status)) param.type.is_nullable = true;
 			parse_func_type_signature(param, status);
 		} else {
 			param.type = parse_type(status);
@@ -57036,7 +57645,11 @@ function parse_declaration(visibility, declaration, status, is_readonly = false)
 		if (is_func_alias) {
 			decl.func_params = decl.type.func_params ?? [];
 			decl.func_return_type = decl.type.func_return_type;
-			decl.type = new Type("");
+			if (decl.type.is_nullable) {
+				const nullable_marker = new Type("func");
+				nullable_marker.is_nullable = true;
+				decl.type = nullable_marker;
+			} else decl.type = new Type("");
 		}
 		if (peek_current(status) === "=" || status.i >= status.tokens.length) {
 			const modifier = status.tokens[saved_i]?.value;
@@ -57098,6 +57711,7 @@ function parse_declaration(visibility, declaration, status, is_readonly = false)
 }
 function parse_function_type_declaration(decl, status) {
 	accept("func", status);
+	const func_nullable = accept("?", status);
 	if (expect("(", status)) {
 		const params = [];
 		let return_type;
@@ -57110,6 +57724,10 @@ function parse_function_type_declaration(decl, status) {
 			decl.name = consume_name(status);
 			decl.func_params = params.filter((p) => !p.type.is_return_type);
 			decl.func_return_type = return_type;
+			if (func_nullable) {
+				decl.type = new Type("func");
+				decl.type.is_nullable = true;
+			}
 			const has_equals = accept("=", status);
 			if (peek_current(status) === "{") {
 				const func = new FunctionNode(get_index(status), default_visibility(status), decl.name, new Type(""));
@@ -57209,6 +57827,7 @@ function parse_anon_function_parameter(func, status) {
 	if (at_func_type(status)) {
 		consume(status);
 		param.type = new Type("func");
+		if (accept("?", status)) param.type.is_nullable = true;
 		parse_func_type_signature(param, status);
 		param.name_start = get_index(status);
 		param.name = consume_name(status);
@@ -58142,6 +58761,7 @@ function parse_function_parameter(parent, func, status) {
 		if (at_func_type(status)) {
 			consume(status);
 			param.type = new Type("func");
+			if (accept("?", status)) param.type.is_nullable = true;
 			parse_func_type_signature(param, status);
 			param.name_start = get_index(status);
 			param.name = consume_name(status);
@@ -59500,7 +60120,8 @@ nomen test
 function find_bundled(filename) {
 	const here = path.dirname(fileURLToPath(import.meta.url));
 	const cli_root = path.dirname(here);
-	const candidates = [path.join(cli_root, filename), path.join(cli_root, "..", filename)];
+	const repo_root = path.join(cli_root, "..");
+	const candidates = !cli_root.includes("node_modules") ? [path.join(repo_root, filename), path.join(cli_root, filename)] : [path.join(cli_root, filename), path.join(repo_root, filename)];
 	for (const c of candidates) if (fs.existsSync(c)) return path.resolve(c);
 }
 /**
@@ -59722,6 +60343,10 @@ function parse_records(stdout) {
 		other
 	};
 }
+/** Pull the exit-time audit "LEAK: N allocation(s)" lines out of stdout. */
+function extract_leaks(stdout) {
+	return stdout.split("\n").map((l) => l.trim()).filter((l) => l.startsWith("LEAK:"));
+}
 /**
 * Compile one `*.test.nm` file (with the generated harness) and run it,
 * returning its parsed records and any crash info.
@@ -59737,6 +60362,7 @@ function run_test_file(entry_path, lib_path, arch, audit = false, audit_runtime)
 		fails: [],
 		benches: [],
 		other: [],
+		leaks: [],
 		ms: 0
 	};
 	const resolved = path.resolve(entry_path);
@@ -59834,9 +60460,11 @@ function run_test_file(entry_path, lib_path, arch, audit = false, audit_runtime)
 	result.fails = records.fails;
 	result.benches = records.benches;
 	result.other = records.other;
+	result.leaks = audit ? extract_leaks(runStdout) : [];
+	if (result.leaks.length) result.other = result.other.filter((l) => !l.trim().startsWith("LEAK:"));
 	result.crashed = crashed;
 	if (crashed) result.phase = "run";
-	result.ok = !(result.fails.length > 0 || result.tests.some((t) => t.failed > 0)) && crashed === void 0;
+	result.ok = !(result.fails.length > 0 || result.tests.some((t) => t.failed > 0)) && crashed === void 0 && result.leaks.length === 0;
 	result.ms = performance.now() - start;
 	return result;
 }
@@ -59873,6 +60501,7 @@ function report_file(result) {
 	console.log(` ${mark} ${rel} ${C.dim(`(${totalTests} tests)`)} ${C.dim(format_duration(result.ms))}`);
 	if (result.crashed) console.log(C.red(`   ${result.crashed}`));
 	for (const f of result.fails) console.log(`   ${C.red("✗")} ${f.test} ${C.dim(">")} ${f.message}`);
+	for (const leak of result.leaks) console.log(`   ${C.yellow("⚠")} ${C.yellow(leak)}`);
 	for (const b of result.benches) console.log(`   ${C.cyan("⏱")} ${b.label} ${C.dim(`(n=${b.n})`)} ${C.dim("min")} ${fmt_ns(b.min)} ${C.dim("median")} ${fmt_ns(b.median)} ${C.dim("mean")} ${fmt_ns(Math.round(b.mean))} ${C.dim("max")} ${fmt_ns(b.max)} ${C.dim("±")} ${fmt_ns(Math.round(b.stddev))}`);
 	if (result.other.length) {
 		console.log(C.dim("   --- test stdout ---"));
@@ -59914,10 +60543,12 @@ function runTests(root, options = {}) {
 	const totalTests = results.reduce((a, r) => a + r.tests.length, 0);
 	const totalFailed = results.reduce((a, r) => a + r.tests.reduce((x, t) => x + t.failed, 0), 0);
 	const totalPassed = totalTests - totalFailed;
+	const totalLeaks = results.reduce((a, r) => a + r.leaks.length, 0);
 	const anyFailed = results.some((r) => !r.ok);
 	console.log("");
 	console.log(` ${C.dim("Files ")} ${C.green(`${totalFilesPassed} passed`)}` + (totalFilesFailed ? ` ${C.dim("|")} ${C.red(`${totalFilesFailed} failed`)}` : "") + C.dim(` (${totalFiles})`));
 	console.log(` ${C.dim("Tests ")} ${C.green(`${totalPassed} passed`)}` + (totalFailed ? ` ${C.dim("|")} ${C.red(`${totalFailed} failed`)}` : "") + C.dim(` (${totalTests})`));
+	if (totalLeaks) console.log(` ${C.dim("Leaks ")} ${C.yellow(`${totalLeaks} reported`)}` + C.dim(" (--audit; leaked files count as failures)"));
 	console.log(` ${C.dim(" Time ")} ${format_duration(elapsed)}`);
 	console.log("");
 	return !anyFailed;
@@ -60137,7 +60768,7 @@ function processFolder(folder, config, mode, program_args) {
 	const dir = fs.opendirSync(folder);
 	let dirent;
 	while ((dirent = dir.readSync()) !== null) if (shouldProcessFile(dirent.name)) {
-		processFile(path.join(folder, dirent.name), config, mode, program_args, false);
+		processFile(path.join(folder, dirent.name), config, mode, program_args);
 		fs.watch;
 	}
 	dir.closeSync();
@@ -60145,45 +60776,15 @@ function processFolder(folder, config, mode, program_args) {
 function shouldProcessFile(filename) {
 	return path.extname(filename) === SUPPORTED_EXTENSION;
 }
-/**
-* The project's entry file for `file_path`: walk up to the nearest
-* `package.jsonc` and resolve its `entry` field, so any file inside a project
-* is checked with the entry's import context (`import types` resolves
-* against the project's `src/`, not the file's own folder). Returns
-* undefined when the file is standalone, IS the entry, sits in an
-* entry-less project (e.g. a library checkout), or the config is malformed.
-*/
-function project_entry_for(file_path) {
-	let dir = path.dirname(file_path);
-	for (let i = 0; i < 20; i++) {
-		const config_path = path.join(dir, "package.jsonc");
-		if (fs.existsSync(config_path)) {
-			try {
-				const json = fs.readFileSync(config_path, "utf8").replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "");
-				const parsed = JSON.parse(json);
-				if (parsed.entry) {
-					const entry = path.resolve(dir, parsed.entry);
-					if (entry !== file_path && fs.existsSync(entry)) return entry;
-				}
-			} catch {}
-			return;
-		}
-		const parent = path.dirname(dir);
-		if (parent === dir) return void 0;
-		dir = parent;
-	}
-}
-function processFile(filename, config, mode, program_args, anchor_to_project = true) {
+function processFile(filename, config, mode, program_args) {
 	console.log("Processing", filename);
 	const arch = config.arch || "aarch64";
 	const platform = config.platform || default_platform();
 	const resolved = path.resolve(filename);
 	if (!config.lib) config.lib = resolve_lib(resolved);
-	const anchor = anchor_to_project && !resolved.endsWith(".test.nm") ? project_entry_for(resolved) ?? resolved : resolved;
-	if (anchor !== resolved) console.log("Anchored to project entry", anchor);
 	let startTime = performance.now();
-	const input = join$1(anchor, config.lib);
-	const parsed = parse(input, config.lib ? get_library(config.lib) : void 0, anchor);
+	const input = join$1(resolved, config.lib);
+	const parsed = parse(input, config.lib ? get_library(config.lib) : void 0, resolved);
 	let errors = parsed.errors;
 	if (errors.length) {
 		console.log(render_errors(input, errors));