nomen-lang 0.6.7 → 0.6.8

package/NOMEN_AGENTS.md

@@ -219,9 +219,9 @@ Special function names: `#init` (constructor), `#destroy` (auto-raii destructor)
 
 ```nomen
 if cond { ... }
-switch x {
-	0 { ... }
-	1 { ... }
+switch {
+	case x == 0 { ... }
+	case x == 1 { ... }
 	else { ... }
 }
 for i of 0 .. 10 { ... }       // exclusive range
@@ -280,6 +280,15 @@ const typed = Array<int>(1, 2, 3)
 for n of nums { Console.write("\{n}\n") }
 ```
 
+### Compile-time embedding
+
+```nomen
+const corpus = #embed_file("bench/full-markdown.md")   // string literal of the
+                                                        // file's contents; path
+                                                        // resolves from the
+                                                        // package root
+```
+
 ## Reference
 
 - Full language spec: [SPEC.md](https://github.com/andrewjk/nomen/blob/main/SPEC.md)

package/core/System/Buffer.nm

@@ -510,6 +510,17 @@ pub struct Buffer<T> {
 		```
 	}
 
+	// Move-taking write, mirroring `List.set`: the caller's value is
+	// consumed and an independent copy is installed in the slot (replace
+	// deep-copies owning elements). The owning entry point a caller uses
+	// when it wants to hand over a value — `replace`'s by-value parameter
+	// cannot accept the `move` keyword, so a borrow being transferred
+	// (e.g. a loaded element) must go through here rather than be bound to
+	// a freed local.
+	pub func set = (ref self, int i: i >= 0 && i < self.cap, move T value) {
+		self.replace(i, value)
+	}
+
 	// Move slot src into slot dst: overwrite dst with src's bytes and zero
 	// src, so exactly ONE slot owns the value afterwards. The
 	// ownership-transferring primitive behind backward-shift deletion
@@ -620,6 +631,33 @@ pub struct Buffer<T> {
 		memset(self.data, 0, len * T_SIZE)
 	}
 
+	// An independent copy: fresh slab, per-element deep copies. Each slot
+	// round-trips load→replace through a local, so owning element types get
+	// the same treatment a List<T>.copy slot does (the load materializes an
+	// owned copy, replace gives the destination its own). Class elements
+	// never reach this body (a `Buffer<T>` with T a class monomorphizes to
+	// `ClassBuffer<T>`, which has no copy).
+	pub func copy = (self, out Buffer<T>: out.cap == self.cap) {
+		var dst = Buffer<T>()
+		if self.cap > 0 {
+			dst.alloc(self.cap)
+			var i = 0
+			while i < self.cap {
+				// Bind the loaded element and hand it to `set` (move): for a
+				// string element load returns a BORROW of the source slot, and
+				// the move transfers it into the write without a scope-exit
+				// reclaim (which would free the source's buffer); for an owning
+				// struct element load returns an owned copy that transfers the
+				// same way. Mirrors List.copy's `var T v = self.at(i)` +
+				// `dst.push(v)`.
+				var T v = self.load(i)
+				dst.set(i, v)
+				i += 1
+			}
+		}
+		return dst
+	}
+
 	internal inline func store_or_int = (ref self, int i: i >= 0 && i < self.cap, int val) {
 		```
 		#arch: c

package/dist/index.mjs

@@ -6811,6 +6811,27 @@ function find_enum(name, status) {
 }
 //#endregion
 //#region ../src/build_common/mono_name.ts
+/**
+* Whether `name` is a monomorphized owning-container struct whose
+* `<Mono>_copy` is safe to call from the owning-`Buffer.load_T`
+* specialization — `List_<T>` / `Buffer_<T>` (and their bare generics).
+* These own a heap slab their `#destroy` frees unconditionally, and `copy`
+* yields an independent slab, so a returned element's field must be
+* deep-copied or the caller's unconditional container-field teardown
+* double-frees the slot's slab.
+*
+* `Map`/`Set` are deliberately EXCLUDED from the automatic deep copy: their
+* monomorphized `copy` (which composes several `Buffer.copy` calls) is
+* verified standalone on both backends, but invoking it from the load
+* specialization corrupts the returned struct on aarch64 (a codegen
+* interaction still open — see FOLLOWUP.md). A `Map`/`Set` FIELD reached
+* through a container element's `load` therefore stays shallow (the
+* pre-existing bounded gap); an EXPLICIT `.copy()` on the owning struct or
+* the Map/Set itself works on both backends.
+*/
+function is_load_deep_copy_container(name) {
+	return name === "List" || name === "Buffer" || name.startsWith("List_") || name.startsWith("Buffer_");
+}
 function mono_type_name(type_or_name, type_args) {
 	const name = typeof type_or_name === "string" ? type_or_name : type_or_name.name;
 	const args = typeof type_or_name === "string" ? type_args : type_or_name.type_args;
@@ -7676,10 +7697,15 @@ function direct_string_fields(node) {
 * callee's own records are scope-local and die at return, so without the
 * transfer the stored copy leaks.
 *
-* Only DIRECT statements qualify: a store nested in a branch/loop may not
-* execute, and a record over the pre-call value would free it at the caller's
-* scope exit (possibly rodata — an invalid free). Memoized on the function
-* node; forwarding cycles are cut by a visited set (the cycle member's own
+* Only DIRECT statements qualify for the plain transfer: a store nested in a
+* branch/loop may not execute, and a record over the pre-call value would
+* free it at the caller's scope exit (possibly rodata — an invalid free).
+* Those CONDITIONAL stores are reported separately
+* (scan_ref_param_string_field_may_writes): the callee's function builder
+* emits an ENTRY DUP for each of them (`field = strdup(field)` at function
+* entry, recorded), which makes the field heap-owned on EVERY path and the
+* may-store record sound to transfer. Memoized on the function node;
+* forwarding cycles are cut by a visited set (the cycle member's own
 * contribution is skipped, bounded-leak).
 */
 function scan_ref_param_string_field_writes(func, structs) {
@@ -7687,6 +7713,51 @@ function scan_ref_param_string_field_writes(func, structs) {
 	if (stamp._ref_param_string_field_writes) return stamp._ref_param_string_field_writes;
 	const result = /* @__PURE__ */ new Map();
 	stamp._ref_param_string_field_writes = result;
+	const tracked = tracked_ref_params(func, structs);
+	if (tracked.size) scan_top_level(func.statements ?? [], tracked, structs, result);
+	return result;
+}
+/**
+* The CONDITIONAL (`may-executed`) ref-param field stores: direct stores
+* nested in if/else branches, switch cases, and loop bodies. Forwarded
+* calls from a nested position are deliberately EXCLUDED: a helper's store
+* builds with its own (fresh) record set, so it cannot reclaim the
+* displaced entry-dup — dup'ing for a forwarded store would trade the
+* old bounded leak for a new one. Those chains keep the documented
+* bounded-leak posture (the stored copy leaks, never an invalid free).
+* The function builder entry-dups these fields (see
+* ref_param_entry_dup_fields), making the may-store record transferable.
+*/
+function scan_ref_param_string_field_may_writes(func, structs) {
+	const stamp = func;
+	if (stamp._ref_param_string_field_may_writes) return stamp._ref_param_string_field_may_writes;
+	const result = /* @__PURE__ */ new Map();
+	stamp._ref_param_string_field_may_writes = result;
+	const tracked = tracked_ref_params(func, structs);
+	if (tracked.size) scan_nested(func.statements ?? [], tracked, result);
+	return result;
+}
+/**
+* The fields a function's builder must ENTRY DUP: the conditional
+* (may-executed) ref-param string-field stores that are NOT also
+* definitely-executed (a must-store already leaves the field heap-owned on
+* every path — dup'ing it too would just add a pointless strdup per call).
+* The dup runs at callee entry on both backends and records the field, so a
+* call site may transfer these as heap records soundly.
+*/
+function ref_param_entry_dup_fields(func, structs) {
+	const must = scan_ref_param_string_field_writes(func, structs);
+	const may = scan_ref_param_string_field_may_writes(func, structs);
+	const result = /* @__PURE__ */ new Map();
+	for (const [param, fields] of may) {
+		const dup = /* @__PURE__ */ new Set();
+		for (const field of fields) if (!must.get(param)?.has(field)) dup.add(field);
+		if (dup.size) result.set(param, dup);
+	}
+	return result;
+}
+/** The tracked ref params of `func`: name -> writable plain string fields. */
+function tracked_ref_params(func, structs) {
 	const tracked = /* @__PURE__ */ new Map();
 	for (const param of func.params ?? []) {
 		if (param.is_self_param) continue;
@@ -7695,8 +7766,7 @@ function scan_ref_param_string_field_writes(func, structs) {
 		const fields = ref_param_writable_fields(param.type.name, structs);
 		if (fields.size) tracked.set(param.name, fields);
 	}
-	if (tracked.size) scan_function(func, tracked, structs, result, /* @__PURE__ */ new Set());
-	return result;
+	return tracked;
 }
 /** The writable plain string fields of the value struct `type_name` resolves
 *  to, or the empty set (non-struct, class, or no string fields). */
@@ -7706,46 +7776,91 @@ function ref_param_writable_fields(type_name, structs) {
 	if (!struct) return /* @__PURE__ */ new Set();
 	return new Set(direct_string_fields(struct).map((f) => f.name));
 }
-function scan_function(func, tracked, structs, result, visiting) {
-	visiting.add(func);
-	for (const stmt of func.statements ?? []) {
+/**
+* The top-level (definitely-executed) walk: direct `param.field = …`
+* statements and top-level forwarded calls only — nothing nested.
+*/
+function scan_top_level(statements, tracked, structs, result) {
+	for (const stmt of statements) {
 		if (stmt.node_type === "assign") {
-			const lhs = stmt.left_value;
-			if (lhs?.node_type === "access") {
-				const access = lhs;
-				if (access.access.node_type === "access_field" && access.target.node_type === "value") {
-					const name = access.target.value ?? "";
-					const fields = tracked.get(name);
-					const field = access.access.name ?? "";
-					if (fields?.has(field)) {
-						if (!result.has(name)) result.set(name, /* @__PURE__ */ new Set());
-						result.get(name).add(field);
-					}
-				}
-			}
+			record_direct_store(stmt, tracked, result);
 			continue;
 		}
 		const call = ref_forward_call(stmt);
-		if (!call) continue;
-		const [callee, args] = call;
-		const non_self_params = (callee.params ?? []).filter((p) => !p.is_self_param);
-		for (let i = 0; i < args.length && i < non_self_params.length; i++) {
-			const arg = args[i];
-			if (arg?.node_type !== "value") continue;
-			const arg_name = arg.value ?? "";
-			const my_fields = tracked.get(arg_name);
-			if (!my_fields) continue;
-			const callee_param = non_self_params[i];
-			if (!(callee_param.is_ref || callee_param.type.is_ref)) continue;
-			if (visiting.has(callee)) continue;
-			const callee_writes = scan_ref_param_string_field_writes(callee, structs).get(callee_param.name);
-			if (!callee_writes?.size) continue;
-			if (!result.has(arg_name)) result.set(arg_name, /* @__PURE__ */ new Set());
-			const mine = result.get(arg_name);
-			for (const field of callee_writes) if (my_fields.has(field)) mine.add(field);
-		}
-	}
-	visiting.delete(func);
+		if (call) merge_forwarded(call, tracked, structs, result);
+	}
+}
+/**
+* The nested walk: direct stores at ANY depth below the top level are
+* may-stores. Forwarded calls are skipped everywhere (their contributions
+* would need cross-function displaced-value knowledge the callee's fresh
+* record set cannot carry — see the may-scan doc).
+*/
+function scan_nested(statements, tracked, result) {
+	for (const stmt of statements) {
+		if (stmt.node_type === "assign") {
+			record_direct_store(stmt, tracked, result);
+			continue;
+		}
+		for (const nested of nested_statement_lists(stmt)) scan_nested(nested, tracked, result);
+	}
+}
+/** Record a direct `param.<field> = …` store into `result`. */
+function record_direct_store(stmt, tracked, result) {
+	const lhs = stmt.left_value;
+	if (lhs?.node_type !== "access") return;
+	const access = lhs;
+	if (access.access.node_type !== "access_field" || access.target.node_type !== "value") return;
+	const name = access.target.value ?? "";
+	const fields = tracked.get(name);
+	const field = access.access.name ?? "";
+	if (!fields?.has(field)) return;
+	if (!result.has(name)) result.set(name, /* @__PURE__ */ new Set());
+	result.get(name).add(field);
+}
+/** Merge a forwarded call's callee stores for the forwarded param: the
+*  callee's MUST stores at a top-level position. */
+function merge_forwarded(call, tracked, structs, result) {
+	const [callee, args] = call;
+	const non_self_params = (callee.params ?? []).filter((p) => !p.is_self_param);
+	for (let i = 0; i < args.length && i < non_self_params.length; i++) {
+		const arg = args[i];
+		if (arg?.node_type !== "value") continue;
+		const arg_name = arg.value ?? "";
+		const my_fields = tracked.get(arg_name);
+		if (!my_fields) continue;
+		const callee_param = non_self_params[i];
+		if (!(callee_param.is_ref || callee_param.type.is_ref)) continue;
+		const source = scan_ref_param_string_field_writes(callee, structs).get(callee_param.name);
+		if (!source?.size) continue;
+		if (!result.has(arg_name)) result.set(arg_name, /* @__PURE__ */ new Set());
+		const mine = result.get(arg_name);
+		for (const field of source) if (my_fields.has(field)) mine.add(field);
+	}
+}
+/** The statement lists nested inside `stmt` (branch bodies, loop bodies) —
+*  the same walk scan_reassigned_vars uses. */
+function nested_statement_lists(stmt) {
+	const branch_of = (b) => b?.statements ?? [];
+	const lists = [];
+	if (stmt.node_type === "while" || stmt.node_type === "for") {
+		const nested = stmt.statements;
+		if (nested) lists.push(nested);
+		return lists;
+	}
+	if (stmt.node_type === "if") {
+		const n = stmt;
+		if (n.if_branch) lists.push(branch_of(n.if_branch));
+		if (n.else_branch) lists.push(branch_of(n.else_branch));
+		return lists;
+	}
+	if (stmt.node_type === "switch" || stmt.node_type === "match") {
+		const n = stmt;
+		for (const c of n.cases ?? []) if (c.branch) lists.push(branch_of(c.branch));
+		if (n.else_branch) lists.push(branch_of(n.else_branch));
+		return lists;
+	}
+	return lists;
 }
 /**
 * The forwarded-call shape of a top-level statement: a resolved free-function
@@ -7776,6 +7891,12 @@ function ref_forward_call(stmt) {
 * stores (scan_ref_param_string_field_writes) onto the caller's records for
 * the argument variable, making the caller's scope exit free them.
 *
+* The callee's CONDITIONAL stores transfer too
+* (ref_param_entry_dup_fields): the callee's builder entry-dups those
+* fields (`field = strdup(field)` at entry, recorded), so the field is
+* heap-owned on EVERY path out of the call — the not-taken path holds the
+* dup — and a caller-side record is sound.
+*
 * `arg_is_trackable_local` must report true only for variables whose storage
 * THIS function's scope exit owns — a plain local. A `ref` param of the
 * enclosing function forwards caller storage, so a record here would free the
@@ -7783,19 +7904,22 @@ function ref_forward_call(stmt) {
 */
 function transfer_ref_param_field_records(callee, args, status, arg_is_trackable_local) {
 	const writes = scan_ref_param_string_field_writes(callee, status.structs);
-	if (!writes.size) return;
+	const dups = ref_param_entry_dup_fields(callee, status.structs);
+	if (!writes.size && !dups.size) return;
 	const non_self_params = (callee.params ?? []).filter((p) => !p.is_self_param);
 	for (let i = 0; i < args.length && i < non_self_params.length; i++) {
 		const param = non_self_params[i];
 		if (!(param.is_ref || param.type.is_ref)) continue;
 		const fields = writes.get(param.name);
-		if (!fields?.size) continue;
+		const dup_fields = dups.get(param.name);
+		if (!fields?.size && !dup_fields?.size) continue;
 		const arg = args[i];
 		if (arg?.node_type !== "value") continue;
 		const name = arg.value;
 		if (!name || !arg_is_trackable_local(name)) continue;
 		if (!status.heap_string_fields) status.heap_string_fields = /* @__PURE__ */ new Set();
-		for (const field of fields) status.heap_string_fields.add(`${name}.${field}`);
+		for (const field of fields ?? []) status.heap_string_fields.add(`${name}.${field}`);
+		for (const field of dup_fields ?? []) status.heap_string_fields.add(`${name}.${field}`);
 	}
 }
 //#endregion
@@ -8288,7 +8412,7 @@ function is_container_borrow_accessor_name(name) {
 * site (see build_return_node), so it counts as owned for classification.
 */
 function is_call_site_borrow_accessor(fn_name) {
-	return fn_name === "at" || fn_name === "first";
+	return fn_name === "at" || fn_name === "first" || fn_name === "load";
 }
 /**
 * Whether `node` is a container/buffer borrow accessor CALL (an
@@ -17957,7 +18081,7 @@ function emit_load_deep_copy_fields$1(elem, status, sret, slot) {
 		const size = get_type_size(field.type, status);
 		if (!field.type.is_ref && !field.type.is_view && !field.type.is_array && !field.type.is_nullable && field.type.name !== "string") {
 			const field_struct = resolve_struct_type(field.type, status);
-			if (field_struct && !field_struct.is_class && field_struct.name.startsWith("List_") && struct_needs_destroy(field_struct, status) && field_struct.functions.find((f) => f.name === "copy")) {
+			if (field_struct && !field_struct.is_class && is_load_deep_copy_container(field_struct.name) && struct_needs_destroy(field_struct, status) && field_struct.functions.find((f) => f.name === "copy")) {
 				emit_asm(status, `add x8, ${sret}, #${offset}\n`);
 				emit_asm(status, `add x0, ${slot}, #${offset}\n`);
 				emit_asm(status, `bl ${field_struct.name}_copy\n`);
@@ -20611,6 +20735,7 @@ function build_function_node$1(node, status) {
 	} else status.nir_emit_ctx = void 0;
 	const old_raw_param_reloads = status.raw_param_reloads;
 	install_raw_reload_plan(status, raw_reload_plan_lines);
+	emit_ref_param_entry_dups$1(node, status);
 	try {
 		build_block_node$1(node, status);
 	} finally {
@@ -20756,6 +20881,49 @@ function build_function_node$1(node, status) {
 	status.return_buffer_stack_offset = void 0;
 	status.function_return_type = void 0;
 }
+/**
+* Entry-dup the ref-param string fields the body stores through
+* CONDITIONALLY (see ref_param_entry_dup_fields): load the field pair's
+* ptr half, strdup it, store the fresh pointer back — with the field
+* recorded in heap_string_fields — so the field is heap-owned on every
+* path out of the function and the call-site record transfer is sound.
+* Mirrors the C backend's emit_ref_param_entry_dups; the len half is
+* unchanged by a dup, so only the ptr half is rewritten. A nullable
+* string field guards the dup (strdup(NULL) traps; a null pair stores as
+* null and every reclaim path no-ops on free(NULL)).
+*/
+function emit_ref_param_entry_dups$1(node, status) {
+	const dups = ref_param_entry_dup_fields(node, status.structs);
+	if (!dups.size) return;
+	for (const param of node.params ?? []) {
+		if (param.is_self_param) continue;
+		if (!(param.is_ref || param.type.is_ref)) continue;
+		const fields = dups.get(param.name);
+		if (!fields?.size) continue;
+		const struct = status.structs.find((s) => s.name === param.type.name && !s.is_simple_type && !s.is_class);
+		for (const field of fields) {
+			const offset = get_field_offset(param.type.name, field, status);
+			const paramReg = status.function_param_regs?.get(param.name);
+			if (paramReg) emit_asm(status, `mov x0, ${paramReg}\n`);
+			else if (is_local_ref_var(param.name, status)) emit_deref_var_address(status, "x0", param.name);
+			else emit_var_address(status, "x0", param.name);
+			emit_asm(status, `str x0, [sp, #-16]!\n`);
+			emit_asm(status, `ldr x0, [x0, #${offset}]\n`);
+			const nullable = !!struct?.fields.find((f) => f.name === field)?.type.is_nullable;
+			let skip_label;
+			if (nullable) {
+				skip_label = `.Lentry_dup_${status.label_counter = (status.label_counter ?? 0) + 1}`;
+				emit_asm(status, `cbz x0, ${skip_label}\n`);
+			}
+			emit_strdup(status);
+			if (skip_label) emit_asm(status, `${skip_label}:\n`);
+			emit_asm(status, `ldr x1, [sp], #16\n`);
+			emit_asm(status, `str x0, [x1, #${offset}]\n`);
+			if (!status.heap_string_fields) status.heap_string_fields = /* @__PURE__ */ new Set();
+			status.heap_string_fields.add(`${param.name}.${field}`);
+		}
+	}
+}
 //#endregion
 //#region ../src/build_aarch64/build_struct_node.ts
 let field_strdup_guard_counter = 0;
@@ -23997,6 +24165,14 @@ function build_declaration_node$1(node, status, nir_init, nir_swap) {
 						if (element_size === 1) emit_asm(status, `strb w0, [x9, #${slot}]\n`);
 						else if (element_size === 4) emit_asm(status, `str w0, [x9, #${slot}]\n`);
 						else emit_asm(status, `str x0, [x9, #${slot}]\n`);
+					} else if (element_size > 8 && struct_element && !struct_element.is_class) {
+						emit_struct_address_param(value, status);
+						ensure_newline(status);
+						emit_asm(status, `ldr x9, [x29, #${offset}]\n`);
+						emit_asm(status, `mov x1, x0\n`);
+						emit_asm(status, `add x0, x9, #${slot}\n`);
+						emit_asm(status, `mov x2, #${element_size}\n`);
+						emit_asm(status, `bl _memcpy\n`);
 					} else {
 						emit_init_value$1(value, nir_array_element(nir_init, array_literal_node, i), status);
 						ensure_newline(status);
@@ -24036,6 +24212,14 @@ function build_declaration_node$1(node, status, nir_init, nir_swap) {
 						if (element_size === 1) emit_asm(status, `strb w0, [x9, #${slot}]\n`);
 						else if (element_size === 4) emit_asm(status, `str w0, [x9, #${slot}]\n`);
 						else emit_asm(status, `str x0, [x9, #${slot}]\n`);
+					} else if (element_size > 8 && struct_element && !struct_element.is_class) {
+						emit_struct_address_param(value, status);
+						ensure_newline(status);
+						emit_asm(status, `ldr x9, [${node.name}]\n`);
+						emit_asm(status, `mov x1, x0\n`);
+						emit_asm(status, `add x0, x9, #${slot}\n`);
+						emit_asm(status, `mov x2, #${element_size}\n`);
+						emit_asm(status, `bl _memcpy\n`);
 					} else {
 						emit_init_value$1(value, nir_array_element(nir_init, array_literal_node, i), status);
 						ensure_newline(status);
@@ -24142,6 +24326,13 @@ function build_declaration_node$1(node, status, nir_init, nir_swap) {
 								if (element_size === 1) emit_asm(status, `strb w0, [x29, #${slot_offset}]\n`);
 								else if (element_size === 4) emit_asm(status, `str w0, [x29, #${slot_offset}]\n`);
 								else emit_asm(status, `str x0, [x29, #${slot_offset}]\n`);
+							} else if (element_size > 8 && struct_element && !struct_element.is_class) {
+								emit_struct_address_param(value, status);
+								ensure_newline(status);
+								emit_asm(status, `mov x1, x0\n`);
+								emit_asm(status, `add x0, x29, #${slot_offset}\n`);
+								emit_asm(status, `mov x2, #${element_size}\n`);
+								emit_asm(status, `bl _memcpy\n`);
 							} else {
 								emit_init_value$1(value, nir_array_element(nir_init, array_values, i), status);
 								ensure_newline(status);
@@ -24167,6 +24358,13 @@ function build_declaration_node$1(node, status, nir_init, nir_swap) {
 								if (element_size === 1) emit_asm(status, `strb w0, [${node.name} + ${i * element_size}]\n`);
 								else if (element_size === 4) emit_asm(status, `str w0, [${node.name} + ${i * element_size}]\n`);
 								else emit_asm(status, `str x0, [${node.name} + ${i * element_size}]\n`);
+							} else if (element_size > 8 && struct_element && !struct_element.is_class) {
+								emit_struct_address_param(value, status);
+								ensure_newline(status);
+								emit_asm(status, `mov x1, x0\n`);
+								emit_global_slot_addr(status, node.name, i * element_size);
+								emit_asm(status, `mov x2, #${element_size}\n`);
+								emit_asm(status, `bl _memcpy\n`);
 							} else {
 								emit_init_value$1(value, nir_array_element(nir_init, array_values, i), status);
 								ensure_newline(status);
@@ -34953,6 +35151,7 @@ function build_if_else_node(node, status, nir) {
 	status.code += `) {\n`;
 	let then_fields;
 	if (node.if_branch) {
+		status.heap_string_fields = new Set(pre_heap_string_fields ?? []);
 		build_block_with_cursor(node.if_branch, nir?.then_branch, status);
 		build_auto_free(status);
 	}
@@ -34961,7 +35160,7 @@ function build_if_else_node(node, status, nir) {
 	if (node.else_branch) {
 		status.scoped_declarations = enter_c_scope(status);
 		status.deferred_frees = [];
-		status.heap_string_fields = pre_heap_string_fields;
+		status.heap_string_fields = new Set(pre_heap_string_fields ?? []);
 		status.code += `} else {\n`;
 		build_block_with_cursor(node.else_branch, nir?.else_branch, status);
 		build_auto_free(status);
@@ -35395,7 +35594,7 @@ function build_switch_node(node, status, nir) {
 	for (let i = 0; i < node.cases.length; i++) {
 		const c = node.cases[i];
 		status.scoped_declarations = enter_c_scope(status);
-		status.heap_string_fields = pre_heap_string_fields;
+		status.heap_string_fields = new Set(pre_heap_string_fields ?? []);
 		const saved_code = begin_code_scratch(status);
 		build_node$1(c.condition, status);
 		let cond_code = end_code_scratch(status, saved_code);
@@ -35441,7 +35640,7 @@ function build_switch_node(node, status, nir) {
 	if (node.else_branch) {
 		status.code += "} else ";
 		status.scoped_declarations = enter_c_scope(status);
-		status.heap_string_fields = pre_heap_string_fields;
+		status.heap_string_fields = new Set(pre_heap_string_fields ?? []);
 		status.code += `{\n`;
 		build_block_with_cursor(node.else_branch, nir?.otherwise ?? void 0, status);
 		build_auto_free(status);
@@ -35864,11 +36063,13 @@ function emit_transfer_owning_fields(elem, src, status, prefix = "") {
 /**
 * Emit the deep-copy half of owning load_T: for each field whose type has a
 * monomorphized `copy` helper that yields an independent value (a `List<T>`
-* field — `<List_T>_copy` deep-copies slots per the owning store contract —
-* or an enum-with-data field whose string payloads `<E>_copy` duplicates),
-* overwrite the shallow-copied bytes with an owned copy. Fields without a
-* copyable shape (nested owning user structs, class fields) stay shallow —
-* recorded in FOLLOWUP.md ("remaining shallow container-field shapes").
+* /`Buffer<T>`/`Map`/`Set` field — `<Mono>_copy` deep-copies the slots or
+* member buffers — or an enum-with-data field whose string payloads
+* `<E>_copy` duplicates), overwrite the shallow-copied bytes with an owned
+* copy. A struct local's CONTAINER fields are reclaimed unconditionally at
+* scope exit, so a shallow return would double-free the slot's slab. Fields
+* without a copyable shape (class fields, nested owning user structs without
+* a synthesized copy) stay shallow — recorded in FOLLOWUP.md.
 */
 function emit_load_deep_copy_fields(elem, dst, status) {
 	for (const field of elem.fields) {
@@ -35876,7 +36077,7 @@ function emit_load_deep_copy_fields(elem, dst, status) {
 		if (field.type.is_nullable) continue;
 		if (field.type.name === "string") continue;
 		const field_struct = resolve_struct_type(field.type, status);
-		if (field_struct && !field_struct.is_class && field_struct.name.startsWith("List_") && struct_needs_destroy(field_struct, status) && field_struct.functions.find((f) => f.name === "copy")) {
+		if (field_struct && !field_struct.is_class && is_load_deep_copy_container(field_struct.name) && struct_needs_destroy(field_struct, status) && field_struct.functions.find((f) => f.name === "copy")) {
 			status.code += `${dst}.${field.name} = ${field_struct.name}_copy(&${dst}.${field.name});\n`;
 			continue;
 		}
@@ -37470,6 +37671,7 @@ function build_function_node(node, status) {
 		stmts: nir.body,
 		ast: node.statements
 	} : void 0;
+	emit_ref_param_entry_dups(node, status);
 	build_block_node(node, status, false);
 	status.nir_emit_ctx = old_nir_ctx;
 	status.function_ref_params = old_ref_params;
@@ -37515,6 +37717,37 @@ function build_function_node(node, status) {
 	status.stack_array_lengths = old_stack_array_lengths;
 	status.moved = old_moved;
 }
+/**
+* Emit the entry-dup for every `ref` value-struct param string field the
+* body stores through CONDITIONALLY (see ref_param_entry_dup_fields):
+* `{ field = nomen_str_dup(field) }` at function entry, recorded in
+* heap_string_fields, so the field is heap-owned on every path out of the
+* function and the call-site record transfer is sound. Nullable string
+* fields guard the dup (a null pair stores as null — free(NULL) is a
+* no-op on every reclaim path).
+*/
+function emit_ref_param_entry_dups(node, status) {
+	const dups = ref_param_entry_dup_fields(node, status.structs);
+	if (!dups.size) return;
+	for (const param of node.params ?? []) {
+		if (param.is_self_param) continue;
+		if (!(param.is_ref || param.type.is_ref)) continue;
+		const fields = dups.get(param.name);
+		if (!fields?.size) continue;
+		const struct = status.structs.find((s) => s.name === param.type.name && !s.is_simple_type && !s.is_class);
+		const base = c_function_name(param.name);
+		for (const field of fields) {
+			const nullable = !!struct?.fields.find((f) => f.name === field)?.type.is_nullable;
+			if (nullable) status.code += `if (${base}->${field}.ptr) {\n`;
+			const temp = `_dup_t_${status.label_counter = (status.label_counter ?? 0) + 1}`;
+			status.code += `nomen_string ${temp} = nomen_str_dup(${base}->${field});\n`;
+			status.code += `${base}->${field} = ${temp};\n`;
+			if (nullable) status.code += `}\n`;
+			if (!status.heap_string_fields) status.heap_string_fields = /* @__PURE__ */ new Set();
+			status.heap_string_fields.add(`${param.name}.${field}`);
+		}
+	}
+}
 function emit_nested_declarations(node, status) {
 	const block = node;
 	for (let child of block.statements) switch (child.node_type) {
@@ -37805,6 +38038,17 @@ function build_function_call_node(node, status) {
 	status.code += `${func_name}(${is_closure_callee ? "NULL" : ""}`;
 	if (is_closure_callee && node.params.length > 0) status.code += ", ";
 	const variadic_idx = node.variadic_param_name ? node.params.findIndex((p) => p.node_type === "array") : -1;
+	if (!node.variadic_param_name) {
+		const resolved = node.resolved_function ?? (is_struct ? status.structs.find((s) => s.name === node.name)?.functions.find((f) => f.name === "#init") : void 0);
+		const variadic_param = resolved?.params?.find((p) => p.is_variadic);
+		if (resolved && variadic_param) {
+			if (node.params.length === 1 && node.params[0].node_type === "array") node.variadic_param_name = variadic_param.name;
+			else if (node.params.length === 0 && resolved.params.filter((p) => !p.is_self_param && !p.is_variadic).length === 0) {
+				const elem_c = c_type(variadic_param.type.name);
+				status.code += `0, (${elem_c}[]){ }`;
+			}
+		}
+	}
 	for (let i = 0; i < node.params.length; i++) {
 		if (i > 0) status.code += ", ";
 		if (i === variadic_idx && node.params[i].node_type === "array") {
@@ -41412,7 +41656,11 @@ function build_assignment_node(node, status, nir_rhs, nir_swap) {
 				if (name === "self" && status.current_struct) target_type = new Type(status.current_struct.name);
 				else if (status.variable_types?.has(name)) target_type = status.variable_types.get(name);
 			}
-			const field_type = access.access.type;
+			let field_type = access.access.type;
+			if (!field_type?.name && target_type?.name) {
+				const tf = status.structs.find((s) => s.name === target_type.name)?.fields.find((f) => f.name === field_name);
+				if (tf) field_type = tf.type;
+			}
 			const field_is_struct = is_struct_type$2(field_type, status);
 			if (access.target.node_type === "value") {
 				const name = access.target.value;
@@ -56114,6 +56362,14 @@ function check_function_call(node, status, func, target_type, self_value, self_p
 	}
 	node.type = func.return_type;
 	node.is_static = func.is_static;
+	if (target_type?.type_args?.length && node.type?.type_args?.length) {
+		const owner = func.scope;
+		if (owner && owner.node_type === "struct" && owner.is_generic && owner.type_params.length === target_type.type_args.length) {
+			const rebind = /* @__PURE__ */ new Map();
+			owner.type_params.forEach((tp, i) => rebind.set(tp, target_type.type_args[i].name));
+			node.type = substitute_type(node.type, rebind);
+		}
+	}
 	if (node.type?.type_args?.length) instantiate_generic_type(node.type, status);
 	if (node.type && node.type.name && self_value && is_class_type$1(node.type.name, status) && receiver_is_const(target_type, self_value, status)) {
 		node.type = clone_type$2(node.type);
@@ -56297,7 +56553,10 @@ function check_function_call(node, status, func, target_type, self_value, self_p
 			else {
 				const stamped = String(func_param.type.length.value);
 				const incoming = String(param_type.length.value);
-				if (stamped !== incoming) add_error(status, `Call passes ${incoming} elements to array parameter '${func_param.name}' whose compile-time length is ${stamped} — the raw array ABI carries no runtime length, so one parameter serves one compile-time length; use Array<${func_param.type.name}> for varying lengths`, param.start);
+				if (stamped !== incoming) {
+					if (is_heap_array_type(func_param.type)) func_param.type.length = void 0;
+					else add_error(status, `Call passes ${incoming} elements to array parameter '${func_param.name}' whose compile-time length is ${stamped} — the raw array ABI carries no runtime length, so one parameter serves one compile-time length; use Array<${func_param.type.name}> for varying lengths`, param.start);
+				}
 			}
 		}
 		let arg_value;
@@ -56528,6 +56787,13 @@ function check_function_call(node, status, func, target_type, self_value, self_p
 			if (typeof size_val === "number" && size_val > 0) record_buffer_cap(self_path, size_val, status);
 		}
 	}
+	if (self_path && self_path !== "?" && is_bufferish && func.name === "copy") {
+		const source_cap = lookup_buffer_cap(self_path, status);
+		if (source_cap !== void 0) {
+			const lhs_name = find_lhs_var_name(status);
+			if (lhs_name) record_buffer_cap(lhs_name, source_cap, status);
+		}
+	}
 	if (func.return_constraint) {
 		const param_to_arg = /* @__PURE__ */ new Map();
 		if (self_path && self_path !== "?") param_to_arg.set("self", path_to_node(self_path));
@@ -60581,6 +60847,68 @@ function parse_case_branch(status) {
 	return null;
 }
 //#endregion
+//#region ../src/parse/utils/parse_embed_file.ts
+/**
+* `#embed_file("relative/path")` — a compile-time string literal whose value
+* is the contents of the file at parse time. The path resolves against the
+* package root (the directory containing package.jsonc, found by climbing
+* from the entry file), falling back to the entry file's folder; with no
+* known base it resolves against the process CWD.
+*
+* The parsed form is a plain string-literal ValueNode: escapes are encoded
+* with the source-level escape set (`\\`, `\"`, `\n`, `\r`, `\t`, and
+* three-digit octal for other control bytes — self-terminating, matching the
+* escape scanner), so every downstream consumer (length counting, C/asm
+* emission) treats it exactly like a hand-written literal.
+*/
+function parse_embed_file(status) {
+	const start = get_index(status);
+	consume(status);
+	const name = consume(status);
+	if (name !== "embed_file") {
+		add_error(status, `Unknown compiler directive '#${name}' — did you mean '#embed_file'?`, start);
+		return new ValueNode(start, "\"\"");
+	}
+	if (!expect("(", status)) return new ValueNode(start, "\"\"");
+	const path_token = status.tokens[status.i];
+	if (!path_token || !path_token.value.startsWith("\"")) {
+		add_error(status, "Expected a string literal path in #embed_file", start);
+		return new ValueNode(start, "\"\"");
+	}
+	status.i += 1;
+	const rel_path = path_token.value.slice(1, -1);
+	if (!expect(")", status)) return new ValueNode(start, "\"\"");
+	if (!rel_path) {
+		add_error(status, "#embed_file path is empty", start);
+		return new ValueNode(start, "\"\"");
+	}
+	const base = status.embed_root ?? process.cwd();
+	const full = path.isAbsolute(rel_path) ? rel_path : path.join(base, rel_path);
+	let content;
+	try {
+		content = fs.readFileSync(full, "utf8");
+	} catch {
+		add_error(status, `#embed_file could not read '${rel_path}' (resolved '${full}')`, start);
+		return new ValueNode(start, "\"\"");
+	}
+	return new ValueNode(start, `"${escape_embedded(content)}"`);
+}
+/** Encode file contents as a source-level string literal body. */
+function escape_embedded(content) {
+	let out = "";
+	for (const ch of content) {
+		const code = ch.charCodeAt(0);
+		if (ch === "\\") out += "\\\\";
+		else if (ch === "\"") out += "\\\"";
+		else if (ch === "\n") out += "\\n";
+		else if (ch === "\r") out += "\\r";
+		else if (ch === "	") out += "\\t";
+		else if (code < 32 || code === 127) out += `\\${code.toString(8).padStart(3, "0")}`;
+		else out += ch;
+	}
+	return out;
+}
+//#endregion
 //#region ../src/parse/parse_expression.ts
 function restructure_op(start, current_op, current_prec, current_node, expression) {
 	if (current_prec <= operator_precedence(expression.op)) {
@@ -60720,6 +61048,7 @@ function parse_primary(status, value) {
 			expect(")", status);
 			return node;
 		}
+		case "#": return parse_embed_file(status);
 		case "if": return parse_if_else(status);
 		case "match": return parse_match(status);
 		case "switch": return parse_switch(status);
@@ -61862,7 +62191,8 @@ function parse(source, library, file_path, options) {
 		qualified_paths: [],
 		library,
 		errors: [],
-		allow_user_raw: options?.allow_user_raw
+		allow_user_raw: options?.allow_user_raw,
+		embed_root: embed_root_for(file_path)
 	};
 	if (library) status.unsafe_boundary = user_source_length;
 	parse_statement(status);
@@ -61939,6 +62269,23 @@ function mark_library_nodes(root, boundary) {
 	walk(root);
 }
 /**
+* The base directory for `#embed_file` paths: the package root (the nearest
+* enclosing directory with a package.jsonc), falling back to the entry
+* file's folder. No file path — undefined, so `#embed_file` resolves
+* against the process CWD.
+*/
+function embed_root_for(file_path) {
+	if (!file_path) return void 0;
+	let dir = path.dirname(path.resolve(file_path));
+	for (let i = 0; i < 32; i++) {
+		if (fs.existsSync(path.join(dir, "package.jsonc"))) return dir;
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return path.dirname(path.resolve(file_path));
+}
+/**
 * Append the library source that `source` needs, exactly as `parse` does.
 * Exported so tooling (e.g. the editor extension) can reproduce the combined
 * source that node offsets refer to.
@@ -62192,7 +62539,7 @@ function print_help() {
 		"  nomen check --in [file/folder]    Parse and check only",
 		"  nomen format [--in folder]        Reformat every .nm file",
 		"  nomen docs [--in file]            Generate markdown documentation",
-		"  nomen test [--in folder]          Discover and run *.test.nm files",
+		"  nomen test [--in folder]          Discover and run *.test.nm files (binary CWD = --in folder)",
 		"  nomen init <name>                 Scaffold a new project in ./<name>",
 		"  nomen lib-path                    Print the bundled System library path",
 		"",
@@ -62782,7 +63129,7 @@ function extract_leaks(stdout) {
 * Compile one `*.test.nm` file (with the generated harness) and run it,
 * returning its parsed records and any crash info.
 */
-function run_test_file(entry_path, lib_path, arch, audit = false, audit_runtime) {
+function run_test_file(entry_path, lib_path, arch, audit = false, audit_runtime, release = false, cwd) {
 	const start = performance.now();
 	const source_text = fs.readFileSync(entry_path, "utf8");
 	const harness = generate_harness(extract_test_functions(source_text), extract_bench_functions(source_text));
@@ -62809,7 +63156,8 @@ function run_test_file(entry_path, lib_path, arch, audit = false, audit_runtime)
 	}
 	const buildResult = build(parsed.root, {
 		arch,
-		audit
+		audit,
+		optimize: release
 	});
 	if (buildResult.errors && buildResult.errors.length) {
 		result.ok = false;
@@ -62844,11 +63192,19 @@ function run_test_file(entry_path, lib_path, arch, audit = false, audit_runtime)
 	const outfile = path.join(buildDir, path.basename(entry_path, ".nm"));
 	fs.writeFileSync(path.join(buildDir, "main.h"), buildResult.headers ?? "");
 	fs.writeFileSync(codefile, buildResult.code);
+	let companionfile;
+	if (buildResult.companion) {
+		const comp_ext = platform === "macos" || platform === "ios" ? ".m" : ".c";
+		companionfile = path.join(buildDir, path.basename(entry_path, ".nm") + "_companion" + comp_ext);
+		fs.writeFileSync(companionfile, buildResult.companion);
+	}
 	const link_args = [
 		"-o",
 		outfile,
 		codefile
 	];
+	if (companionfile) link_args.push(companionfile);
+	if (release) link_args.unshift("-O2");
 	if (audit_obj) link_args.push(audit_obj);
 	if (platform === "macos" || platform === "ios") link_args.push("-framework", "CoreGraphics", "-framework", "Foundation", "-framework", "AppKit", "-lobjc");
 	try {
@@ -62879,7 +63235,8 @@ function run_test_file(entry_path, lib_path, arch, audit = false, audit_runtime)
 				"pipe"
 			],
 			timeout: 3e4,
-			maxBuffer: 16777216
+			maxBuffer: 16777216,
+			cwd: cwd ?? process.cwd()
 		});
 	} catch (err) {
 		runStdout = err.stdout ? err.stdout.toString() : "";
@@ -62961,9 +63318,10 @@ function runTests(root, options = {}) {
 	const files = collect_test_files(root).filter((f) => !options.filter || options.filter.test(f));
 	console.log(`Found ${files.length} test file(s)\n`);
 	const startTime = performance.now();
+	const binary_cwd = path.resolve(root);
 	const results = [];
 	for (const file of files) {
-		const result = run_test_file(file, lib, arch, options.audit, options.audit_runtime);
+		const result = run_test_file(file, lib, arch, options.audit, options.audit_runtime, options.release, binary_cwd);
 		report_file(result);
 		results.push(result);
 	}
@@ -63071,7 +63429,8 @@ try {
 			arch: args.arch ?? "aarch64",
 			filter,
 			audit: args.audit,
-			audit_runtime: args.audit_runtime
+			audit_runtime: args.audit_runtime,
+			release: args.release
 		});
 		process.exit(ok ? 0 : 1);
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nomen-lang",
-  "version": "0.6.7",
+  "version": "0.6.8",
   "description": "The CLI for the Nomen programming language.",
   "keywords": [],
   "license": "ISC",

package/src/args.ts

@@ -160,7 +160,7 @@ export function print_help(): void {
 			"  nomen check --in [file/folder]    Parse and check only",
 			"  nomen format [--in folder]        Reformat every .nm file",
 			"  nomen docs [--in file]            Generate markdown documentation",
-			"  nomen test [--in folder]          Discover and run *.test.nm files",
+			"  nomen test [--in folder]          Discover and run *.test.nm files (binary CWD = --in folder)",
 			"  nomen init <name>                 Scaffold a new project in ./<name>",
 			"  nomen lib-path                    Print the bundled System library path",
 			"",

package/src/index.ts

@@ -109,6 +109,7 @@ try {
 			filter,
 			audit: args.audit,
 			audit_runtime: args.audit_runtime,
+			release: args.release,
 		});
 		process.exit(ok ? 0 : 1);
 	}

package/src/test.ts

@@ -278,6 +278,8 @@ export function run_test_file(
 	arch: string,
 	audit = false,
 	audit_runtime?: string,
+	release = false,
+	cwd?: string,
 ): TestFileResult {
 	const start = performance.now();
 	const source_text = fs.readFileSync(entry_path, "utf8");
@@ -318,6 +320,7 @@ export function run_test_file(
 	const buildResult = build(parsed.root, {
 		arch: arch as "aarch64" | "c",
 		audit,
+		optimize: release,
 	});
 	if (buildResult.errors && buildResult.errors.length) {
 		result.ok = false;
@@ -363,11 +366,28 @@ export function run_test_file(
 	fs.writeFileSync(path.join(buildDir, "main.h"), buildResult.headers ?? "");
 	fs.writeFileSync(codefile, buildResult.code);
 
+	// Companion C (raw-block functions + the pool/fiber/file-scope C infra):
+	// `run`/`build` compile and link it next to the main TU. The aarch64 .s
+	// references its symbols via `bl` (spawn machinery), so dropping it makes
+	// companion-bearing test files fail to link. Same .m/.c rule as the
+	// run/build command's companion emission.
+	let companionfile: string | undefined;
+	if (buildResult.companion) {
+		const comp_ext = platform === "macos" || platform === "ios" ? ".m" : ".c";
+		companionfile = path.join(buildDir, path.basename(entry_path, ".nm") + "_companion" + comp_ext);
+		fs.writeFileSync(companionfile, buildResult.companion);
+	}
+
 	// Link the harness binary. Frameworks are passed on Apple platforms for
 	// the same reason as the run/build command: the joined source may reference
 	// ObjC runtime symbols even when the test body doesn't, and unused
-	// frameworks cost nothing at link time.
+	// frameworks cost nothing at link time. Release mode compiles the C (and
+	// companion C) with -O2, matching the run/build command; the aarch64 .s is
+	// assembled verbatim — its optimizations are the passes enabled via
+	// `optimize` above.
 	const link_args = ["-o", outfile, codefile];
+	if (companionfile) link_args.push(companionfile);
+	if (release) link_args.unshift("-O2");
 	if (audit_obj) link_args.push(audit_obj);
 	if (platform === "macos" || platform === "ios") {
 		link_args.push(
@@ -396,7 +416,11 @@ export function run_test_file(
 
 	// Run the binary and collect the records it streams over stdout. A
 	// non-zero exit (crash, abort) still surfaces whatever records were
-	// emitted before the crash; a timeout is treated as a crash.
+	// emitted before the crash; a timeout is treated as a crash. The
+	// documented CWD contract: the binary runs in the `--in` root (the
+	// folder `nomen test` scanned for *.test.nm files), so fixture paths in
+	// tests resolve against that folder regardless of where the CLI was
+	// invoked from.
 	let runStdout = "";
 	let crashed: string | undefined;
 	try {
@@ -405,6 +429,7 @@ export function run_test_file(
 			stdio: ["ignore", "pipe", "pipe"],
 			timeout: 30_000,
 			maxBuffer: 16 * 1024 * 1024,
+			cwd: cwd ?? process.cwd(),
 		});
 	} catch (err: any) {
 		runStdout = err.stdout ? err.stdout.toString() : "";
@@ -519,6 +544,7 @@ export interface RunTestsOptions {
 	filter?: RegExp;
 	audit?: boolean;
 	audit_runtime?: string;
+	release?: boolean;
 }
 
 /**
@@ -547,10 +573,21 @@ export function runTests(root: string, options: RunTestsOptions = {}): boolean {
 	console.log(`Found ${files.length} test file(s)\n`);
 
 	const startTime = performance.now();
+	// The CWD contract: test binaries run in the --in root, so relative
+	// fixture paths resolve there no matter where the CLI was invoked from.
+	const binary_cwd = path.resolve(root);
 
 	const results: TestFileResult[] = [];
 	for (const file of files) {
-		const result = run_test_file(file, lib, arch, options.audit, options.audit_runtime);
+		const result = run_test_file(
+			file,
+			lib,
+			arch,
+			options.audit,
+			options.audit_runtime,
+			options.release,
+			binary_cwd,
+		);
 		report_file(result);
 		results.push(result);
 	}