nomen-lang 0.6.9 → 0.6.10

package/audit_runtime.c

@@ -2,44 +2,164 @@
 #include <stdlib.h>
 #include <string.h>
 
+// The allocation ledger behind `--audit` (`nomen test --audit`,
+// `Tester.audit_count`, and the generated harness's per-test attribution).
+//
+// Every wrapped block carries a 16-byte header (magic, size, state) in front of
+// the payload the program sees, so every wrapped free can be matched against a
+// LIVE block. The header is the whole point: a bare counter cannot tell a
+// correct free from an incorrect one, and both failures it used to absorb are
+// ownership bugs the generated code cannot prove away.
+//
+//   - free of a pointer this runtime never handed out (a pool/BSS/rodata
+//     address, a libc allocation, a stale pointer kept across a realloc) used
+//     to decrement the counter like any other free. That silently hid the exact
+//     failure the allmark aarch64 sanitize runs hit — `free()` of a non-heap
+//     address aborting in libmalloc with no audit-level diagnosis — and it let
+//     the reported count drift away from the allocator's real state, so a
+//     genuine leak count and a phantom one were indistinguishable.
+//   - a second free of the SAME block (a double free, or a stale pointer whose
+//     memory the allocator already recycled) decremented a second time.
+//   - `realloc(p, 0)` frees `p`; the old counter kept it live, so every such
+//     call read as one phantom allocation.
+//
+// A stale free no longer decrements and no longer reaches libc `free` (it may
+// not be ours to free at all): it is counted in `nomen_stale_frees` and
+// reported by `nomen_audit_check`, so the run fails with a diagnosis instead of
+// dying inside the allocator. The allocation count itself is unchanged — one
+// increment per wrapped block, one decrement per reclaimed block — so it stays
+// exactly as before: the audit test contract.
+
 // Atomic: worker threads from the pool malloc/free concurrently, and a
 // plain `long` would lose updates under that contention (showing up as
 // spurious LEAK/negative-count failures in tests that use spawns).
 static volatile long nomen_malloc_count = 0;
 
-void *nomen_malloc_wrap(unsigned long size) {
-	void *ptr = malloc(size);
+// Frees that did not match a live wrapped block (foreign pointer, double
+// free, realloc of a stale pointer). Reported at exit; never affects the
+// allocation count.
+static volatile long nomen_stale_frees = 0;
+
+#define NOMEN_AUDIT_MAGIC 0x6e6f6d656e415531UL // "nomenAU1"
+#define NOMEN_AUDIT_LIVE 1UL
+#define NOMEN_AUDIT_DEAD 2UL
+
+typedef struct {
+	unsigned long magic;
+	unsigned long size;
+	unsigned long state;
+	unsigned long pad; // keeps the payload 16-byte aligned
+} nomen_audit_header;
+
+static void *audit_alloc(unsigned long size) {
+	nomen_audit_header *header = (nomen_audit_header *)malloc(size + sizeof(nomen_audit_header));
+	if (!header) return 0;
+	header->magic = NOMEN_AUDIT_MAGIC;
+	header->size = size;
+	header->state = NOMEN_AUDIT_LIVE;
 	__atomic_add_fetch(&nomen_malloc_count, 1, __ATOMIC_SEQ_CST);
-	return ptr;
+	return (void *)(header + 1);
+}
+
+// The header in front of `ptr`, or 0 when `ptr` is not one of ours (a libc
+// allocation, a static/BSS address, or already-freed memory whose header was
+// cleared).
+static nomen_audit_header *audit_header(void *ptr) {
+	nomen_audit_header *header = (nomen_audit_header *)ptr - 1;
+	if (header->magic != NOMEN_AUDIT_MAGIC) return 0;
+	return header;
+}
+
+// Retire a block: poison the header first so a second free of the same pointer
+// is recognized as stale, then hand the memory back and drop the count.
+static void audit_release(nomen_audit_header *header) {
+	header->magic = 0;
+	header->state = NOMEN_AUDIT_DEAD;
+	__atomic_sub_fetch(&nomen_malloc_count, 1, __ATOMIC_SEQ_CST);
+	free(header);
+}
+
+static long audit_record_stale(void) {
+	return __atomic_add_fetch(&nomen_stale_frees, 1, __ATOMIC_SEQ_CST);
+}
+
+// Diagnose each KIND once: a shape that double-frees per iteration would
+// otherwise print thousands of identical lines. The exit-time
+// AUDIT-STALE-FREE count carries the total.
+static void audit_report_stale(int kind) {
+	static volatile int reported[2] = {0, 0};
+	static const char *const messages[2] = {
+		"audit: free of a pointer that is not a live audit allocation "
+		"(a foreign address, or one already freed)",
+		"audit: realloc of a pointer that is not a live audit allocation",
+	};
+	if (kind < 0 || kind > 1) return;
+	if (__atomic_exchange_n(&reported[kind], 1, __ATOMIC_SEQ_CST)) return;
+	fprintf(stderr, "%s\n", messages[kind]);
+}
+
+void *nomen_malloc_wrap(unsigned long size) {
+	return audit_alloc(size);
 }
 
 void *nomen_calloc_wrap(unsigned long count, unsigned long size) {
-	void *ptr = calloc(count, size);
-	__atomic_add_fetch(&nomen_malloc_count, 1, __ATOMIC_SEQ_CST);
+	unsigned long total = count * size;
+	void *ptr = audit_alloc(total);
+	if (ptr) memset(ptr, 0, total);
 	return ptr;
 }
 
+void *nomen_strdup_wrap(const char *s) {
+	unsigned long len = strlen(s) + 1;
+	void *ptr = audit_alloc(len);
+	if (ptr) memcpy(ptr, s, len);
+	return ptr;
+}
+
+// realloc: the count is unchanged (one block in, one block out) — the block is
+// only RETIRED, which is what fixes `realloc(p, 0)`: C lets it free `p` and
+// return NULL, and the old counter left `p` live, reading as a phantom
+// allocation. This implementation always returns the fresh block (a valid
+// unique pointer, the other conforming option), so callers that treat a NULL
+// result as "the buffer is gone" keep working.
+//
+// A stale or foreign `old_ptr` reallocates to NULL (realloc's failure mode)
+// and is counted as a stale free: the pointer is left untouched rather than
+// memcpy'd out of memory that isn't ours.
 void *nomen_realloc_wrap(void *old_ptr, unsigned long size) {
-	if (!old_ptr) {
-		__atomic_add_fetch(&nomen_malloc_count, 1, __ATOMIC_SEQ_CST);
+	if (!old_ptr) return audit_alloc(size);
+	nomen_audit_header *header = audit_header(old_ptr);
+	if (!header || header->state != NOMEN_AUDIT_LIVE) {
+		audit_record_stale();
+		audit_report_stale(1);
+		return 0;
 	}
-	void *ptr = realloc(old_ptr, size);
+	unsigned long old_size = header->size;
+	void *ptr = audit_alloc(size);
+	// An allocation failure keeps the old block live (realloc's contract).
+	if (!ptr) return 0;
+	memcpy(ptr, old_ptr, old_size < size ? old_size : size);
+	audit_release(header);
 	return ptr;
 }
 
 void nomen_free_wrap(void *ptr) {
-	if (ptr) {
-		free(ptr);
-		__atomic_sub_fetch(&nomen_malloc_count, 1, __ATOMIC_SEQ_CST);
+	if (!ptr) return;
+	nomen_audit_header *header = audit_header(ptr);
+	// Not a live wrapped block: a libc allocation, a static/BSS/rodata
+	// address, a pointer the allocator already recycled, or a block this
+	// runtime already freed (the double-free case — the header is poisoned on
+	// release, so a stale pointer can never look live). Freeing it would be an
+	// invalid free, and libmalloc aborts INSIDE free() with no context, which
+	// is exactly how the allmark aarch64 sanitize run died. Report it instead
+	// of passing it on, and leave the count alone: an unmatched free is not
+	// evidence that a live block was reclaimed.
+	if (!header || header->state != NOMEN_AUDIT_LIVE) {
+		audit_record_stale();
+		audit_report_stale(0);
+		return;
 	}
-}
-
-void *nomen_strdup_wrap(const char *s) {
-	unsigned long len = strlen(s) + 1;
-	void *ptr = malloc(len);
-	if (ptr) memcpy(ptr, s, len);
-	__atomic_add_fetch(&nomen_malloc_count, 1, __ATOMIC_SEQ_CST);
-	return ptr;
+	audit_release(header);
 }
 
 void nomen_audit_check(void) {
@@ -47,4 +167,22 @@ void nomen_audit_check(void) {
 	if (count != 0) {
 		printf("LEAK: %ld allocation(s)\n", count);
 	}
+	long stale = __atomic_load_n(&nomen_stale_frees, __ATOMIC_SEQ_CST);
+	if (stale != 0) {
+		printf("AUDIT-STALE-FREE: %ld pointer(s) freed that were not live audit allocations\n",
+			   stale);
+	}
+}
+
+// Per-test leak attribution (`nomen test`): the generated harness snapshots
+// the counter before every test and diffs it after, so a leaking test is
+// named instead of a whole file aggregating into one exit-time count.
+long nomen_audit_count(void) {
+	return __atomic_load_n(&nomen_malloc_count, __ATOMIC_SEQ_CST);
 }
+
+// Frees that matched no live block (foreign pointer / double free). Polled the
+// same way as the count so a run can attribute them like leaks.
+long nomen_audit_stale_frees(void) {
+	return __atomic_load_n(&nomen_stale_frees, __ATOMIC_SEQ_CST);
+}

package/core/System/Test.nm

@@ -11,6 +11,7 @@
 //
 //	\nomen|start|<test>
 //	\nomen|fail|<test>|<message>
+//	\nomen|leaks|<test>|<n>
 //	\nomen|done|<test>|<passed>|<failed>|<ns>
 //	\nomen|bench|<label>|<n>|<min>|<median>|<max>|<mean>|<stddev>
 //
@@ -70,6 +71,23 @@ pub class Tester {
 	var bench_label = ""
 	var bench_samples = 1000
 
+	// (audit) The process's current malloc/free balance — allocations made
+	// but not yet freed. `nomen test --audit` snapshots this around every
+	// test so a leak is attributed to the test that leaked instead of one
+	// file-level exit-time count. The audit runtime is linked into every
+	// test build; in other binaries the counter simply never moves.
+	pub func audit_count = (out int64) {
+		```
+		#arch: c
+		extern long nomen_audit_count(void);
+		return (long long)nomen_audit_count();
+		```
+		```
+		#arch: aarch64
+		bl _nomen_audit_count
+		```
+	}
+
 	// (harness) Start timing `name` and clear the per-test state. Called by
 	// the `main` that `nomen test` generates — not by test code.
 	pub func begin_test = (ref self, string name) {

package/dist/index.mjs

@@ -2122,8 +2122,40 @@ function try_parse_operands(parts) {
 * is not an instruction — label, directive, comment, blank, OR an
 * instruction outside the contract table). Shared by the validator and the
 * phase-2 optimizer so both see identical shapes.
-*/
+*
+* Memoized by raw text: the post-processing pipeline (frame slots, coalesce,
+* loop promote, if-convert, float forwarding, widen masks, …) plus the
+* validators each re-parse the SAME instruction texts — prologue/epilogue
+* lines repeat across every function, so the hit rate is very high. Every
+* call returns a PRIVATE deep copy (the passes treat parsed instructions as
+* mutable IR — coalesce renames operands in place — so sharing a parsed
+* object would corrupt the memo and cross-pass state).
+*/
+const parse_memo = /* @__PURE__ */ new Map();
+const PARSE_MEMO_CAP = 2e5;
+function clone_parsed(c, line) {
+	return {
+		text: c.text,
+		op: c.op,
+		setsFlags: c.setsFlags,
+		readsFlags: c.readsFlags,
+		operands: c.operands.map((o) => {
+			const copy = { ...o };
+			if (copy.kind === "mem" && copy.offset) copy.offset = { ...copy.offset };
+			return copy;
+		}),
+		line
+	};
+}
 function parse_asm_instruction(text, line) {
+	const cached = parse_memo.get(text);
+	if (cached !== void 0) return cached === null ? null : clone_parsed(cached, line);
+	const parsed = parse_asm_instruction_uncached(text, line);
+	if (parse_memo.size >= PARSE_MEMO_CAP) parse_memo.clear();
+	parse_memo.set(text, parsed ? clone_parsed(parsed, 0) : null);
+	return parsed;
+}
+function parse_asm_instruction_uncached(text, line) {
 	const t = strip_comment$1(text).trim();
 	const m = /^([a-z][a-z0-9.]*)\s*(.*)$/.exec(t);
 	if (!m) return null;
@@ -2407,34 +2439,13 @@ function validate_asm(code) {
 	}
 	return errors;
 }
-/**
-* The deferred phase-1 check: every function's sp must return to its entry
-* value at each `ret`. A LINEAR scan double-counts across diamond control
-* flow (`b .epilogue` skipping the sibling path's `add sp` — the classic
-* false positive on bool_to_string), so this runs a per-block dataflow over
-* the lifted function bodies:
-*
-* - Block splitting: labels and branch/terminator instructions bound blocks,
-*   exactly like the CFG the emitters produce.
-* - Per-instruction sp effects: pre-indexed `stp/str [sp, #-N]!` subtracts,
-*   post-indexed `ldp/ldr [sp], #N` adds, `sub/add sp, sp, #imm` adjusts;
-*   any other sp write (`mov sp, xN`, register-scaled adds, `ldr sp, …`)
-*   is UNKNOWN and conservatively poisons downstream deltas.
-* - Join = require equal deltas or unknown: a label reached by paths with
-*   differing deltas becomes unknown; only a KNOWN non-zero delta at a
-*   `ret` is reported. Unknown never errors — the check is conservative by
-*   construction (no false positives, only silence).
-* - `bl`/`blr` preserve sp (the callee rebalances under the ABI) and do not
-*   terminate blocks; `br xN` (tail-jump) ends propagation with no check;
-*   `svc` continues (the kernel preserves sp).
-* - Branch targets resolve within the function, including the numeric local
-*   form raw `#arch` blocks use (`1:` / `b.hs 1f` — forward/backward by
-*   suffix); an unresolvable target makes downstream deltas unknown.
-*/
-function validate_stack_balance(code) {
-	const { result } = lift_functions(code);
-	if (!result.ok) return [];
+/** Stack-balance check over an ALREADY-lifted result — lets the build
+*  pipeline lift+validate once and share the structured functions between
+*  the shape/branch validation and the balance pass (lift_functions runs
+*  validate_asm internally, so re-lifting per check doubled the cost). */
+function stack_balance_errors_from_lift(result) {
 	const errors = [];
+	if (!result.ok) return [];
 	for (const fn of result.functions) check_function_balance(fn, errors);
 	return errors;
 }
@@ -2562,37 +2573,37 @@ function line_effect(text) {
 	};
 }
 /** Resolve a branch target token to a body line index, or null when the
-*  target is outside this function / unresolved (numeric f/b forms scan
-*  linearly, matching the assembler's semantics). */
-function resolve_target(token, from, body) {
+*  target is outside this function. Backed by the per-function label maps
+*  built once in check_function_balance — a linear rescan of the body per
+*  pending branch used to be the single hottest spot in large builds
+*  (branches × body-length re-stripping + regex). Numeric `Nf`/`Nb` forms
+*  resolve directionally against the (possibly redefined) definitions,
+*  matching the assembler's semantics; a named label resolves to its FIRST
+*  definition (the old body scan returned the first match too). */
+function resolve_target(token, from, named_labels, numeric_labels) {
 	const numeric = /^(\d+)([fb])$/.exec(token);
 	if (numeric) {
-		const n = numeric[1];
+		const defs = numeric_labels.get(numeric[1]);
+		if (!defs) return null;
 		if (numeric[2] === "f") {
-			for (let i = from + 1; i < body.length; i++) {
-				const lm = /^(\d+):/.exec(strip_comment$1(body[i].text).trim());
-				if (lm && lm[1] === n) return i;
-			}
+			for (let k = 0; k < defs.length; k++) if (defs[k] > from) return defs[k];
 			return null;
 		}
-		for (let i = from - 1; i >= 0; i--) {
-			const lm = /^(\d+):/.exec(strip_comment$1(body[i].text).trim());
-			if (lm && lm[1] === n) return i;
-		}
+		for (let k = defs.length - 1; k >= 0; k--) if (defs[k] < from) return defs[k];
 		return null;
 	}
-	for (let i = 0; i < body.length; i++) {
-		const lm = LABEL_RE.exec(strip_comment$1(body[i].text).trim());
-		if (lm && lm[1] === token) return i;
-	}
-	return null;
+	return named_labels.get(token) ?? null;
 }
 function check_function_balance(fn, errors) {
 	const body = fn.body;
+	const stripped_text = [];
 	const effects = [];
 	const is_code = [];
+	const named_labels = /* @__PURE__ */ new Map();
+	const numeric_labels = /* @__PURE__ */ new Map();
 	for (let i = 0; i < body.length; i++) {
 		const t = strip_comment$1(body[i].text).trim();
+		stripped_text.push(t);
 		effects.push({
 			delta: null,
 			branch: null,
@@ -2601,8 +2612,15 @@ function check_function_balance(fn, errors) {
 			unknown_jump: false
 		});
 		is_code.push(false);
-		if (!t) continue;
 		const lm = LABEL_RE.exec(t);
+		if (lm) {
+			if (/^\d+$/.test(lm[1])) {
+				const defs = numeric_labels.get(lm[1]);
+				if (defs) defs.push(i);
+				else numeric_labels.set(lm[1], [i]);
+			} else if (!named_labels.has(lm[1])) named_labels.set(lm[1], i);
+		}
+		if (!t) continue;
 		const rest = lm ? lm[2].trim() : t;
 		if (rest.startsWith(".") || /^[\w.$]+\s*=\s*[\w.$]+$/.test(rest) || !rest) continue;
 		is_code[i] = true;
@@ -2614,7 +2632,7 @@ function check_function_balance(fn, errors) {
 	let cur = -1;
 	let terminated = true;
 	for (let i = 0; i < body.length; i++) {
-		const t = strip_comment$1(body[i].text).trim();
+		const t = stripped_text[i];
 		if (!t) continue;
 		if (LABEL_RE.test(t)) {
 			cur++;
@@ -2662,7 +2680,7 @@ function check_function_balance(fn, errors) {
 		}
 	}
 	for (const p of pending) {
-		const line = resolve_target(p.token, p.from, body);
+		const line = resolve_target(p.token, p.from, named_labels, numeric_labels);
 		blocks[p.block].targets.push(line === null ? null : line_block.get(line) ?? null);
 	}
 	const preds = Array.from({ length: blocks.length }, () => []);
@@ -8972,6 +8990,85 @@ function record_ctor_heap_default_fields(var_name, struct_node, status, is_owned
 	}
 }
 //#endregion
+//#region ../src/build_common/destroy_analysis.ts
+/**
+* Whether any field of the struct is an enum-with-data value owning heap
+* payloads (a string payload — always heap, case construction strdups it —
+* or a class/trait reference payload — construction transfers ownership).
+* Such a field must be reclaimed when the struct dies.
+*/
+function struct_has_owning_enum_field(struct, table) {
+	for (const field of struct.fields) {
+		if (field.type.is_ref) continue;
+		const en = table.enums?.find((e) => e.name === field.type.name);
+		if (!en?.has_associated_data) continue;
+		for (const c of en.cases) for (const p of c.params) {
+			if (p.type.name === "string" && !p.type.is_array) return true;
+			if (table.traits?.some((t) => t.name === p.type.name)) return true;
+			if (table.structs.find((s) => s.name === p.type.name)?.is_class) return true;
+		}
+	}
+	return false;
+}
+/**
+* Whether a struct declares its own `#destroy` (user side effects /
+* resource release).
+*/
+function has_destroy(struct) {
+	return !!struct.functions.find((f) => f.name === "#destroy");
+}
+/**
+* Whether any field (recursively) requires destroy handling — a class
+* field (heap instance to reclaim) or a nested struct with its own
+* `#destroy` (or nested fields that do). Deliberately excludes `string`
+* fields: a struct local whose only owning fields are strings is NOT
+* auto-destroyed at scope exit (the strings may be raw rodata arg
+* pointers, not heap) — see `struct_needs_auto_destroy` for the broader
+* form used to decide whether a `<Struct>_destroy` function is generated.
+*/
+function has_struct_fields_with_destroy(struct, table) {
+	for (const field of struct.fields) {
+		if (field.type.is_ref) continue;
+		const field_struct = resolve_struct_type(field.type, table);
+		if (!field_struct) continue;
+		if (field_struct.is_class) return true;
+		if (has_destroy(field_struct)) return true;
+		if (has_struct_fields_with_destroy(field_struct, table)) return true;
+	}
+	return false;
+}
+/**
+* Whether a struct (or any embedded struct field, recursively) needs a
+* destroy call at scope exit — it has a `#destroy`, a class-typed field,
+* or a nested struct field that itself needs destroying. This does NOT
+* count `string` fields (see `has_struct_fields_with_destroy`).
+*/
+function struct_needs_destroy(struct, table) {
+	return has_destroy(struct) || has_struct_fields_with_destroy(struct, table) || struct_has_owning_enum_field(struct, table);
+}
+/**
+* Whether a struct needs an auto-generated `<Struct>_destroy` function.
+* Broader than `struct_needs_destroy`: also returns true for structs with
+* `string` fields, because a Buffer<T> for such a struct deep-copies the
+* strings into slots (strdup on store) and the per-element destroy must
+* free them. The generated destroy frees each string field; it is called
+* from Buffer's specialized #destroy / replace_T, NOT from struct local
+* scope exit (`struct_needs_destroy` governs that path and excludes
+* strings).
+*/
+function struct_needs_auto_destroy(struct, table) {
+	if (struct_needs_destroy(struct, table)) return true;
+	if (struct_has_owning_enum_field(struct, table)) return true;
+	for (const field of struct.fields) {
+		if (field.type.is_ref) continue;
+		if (field.type.is_view) continue;
+		if (field.type.name === "string" && !field.type.is_array) return true;
+		const field_struct = resolve_struct_type(field.type, table);
+		if (field_struct && !field_struct.is_class && struct_needs_auto_destroy(field_struct, table)) return true;
+	}
+	return false;
+}
+//#endregion
 //#region ../src/nodes/child_nodes.ts
 /** Whether `value` is an AST node (carries a string `node_type`). */
 function is_ast_node(value) {
@@ -11648,85 +11745,6 @@ function array_struct_name(type, status) {
 	return status.structs.find((s) => s.name === mono && !s.is_generic) ? mono : void 0;
 }
 //#endregion
-//#region ../src/build_common/destroy_analysis.ts
-/**
-* Whether any field of the struct is an enum-with-data value owning heap
-* payloads (a string payload — always heap, case construction strdups it —
-* or a class/trait reference payload — construction transfers ownership).
-* Such a field must be reclaimed when the struct dies.
-*/
-function struct_has_owning_enum_field(struct, table) {
-	for (const field of struct.fields) {
-		if (field.type.is_ref) continue;
-		const en = table.enums?.find((e) => e.name === field.type.name);
-		if (!en?.has_associated_data) continue;
-		for (const c of en.cases) for (const p of c.params) {
-			if (p.type.name === "string" && !p.type.is_array) return true;
-			if (table.traits?.some((t) => t.name === p.type.name)) return true;
-			if (table.structs.find((s) => s.name === p.type.name)?.is_class) return true;
-		}
-	}
-	return false;
-}
-/**
-* Whether a struct declares its own `#destroy` (user side effects /
-* resource release).
-*/
-function has_destroy(struct) {
-	return !!struct.functions.find((f) => f.name === "#destroy");
-}
-/**
-* Whether any field (recursively) requires destroy handling — a class
-* field (heap instance to reclaim) or a nested struct with its own
-* `#destroy` (or nested fields that do). Deliberately excludes `string`
-* fields: a struct local whose only owning fields are strings is NOT
-* auto-destroyed at scope exit (the strings may be raw rodata arg
-* pointers, not heap) — see `struct_needs_auto_destroy` for the broader
-* form used to decide whether a `<Struct>_destroy` function is generated.
-*/
-function has_struct_fields_with_destroy(struct, table) {
-	for (const field of struct.fields) {
-		if (field.type.is_ref) continue;
-		const field_struct = resolve_struct_type(field.type, table);
-		if (!field_struct) continue;
-		if (field_struct.is_class) return true;
-		if (has_destroy(field_struct)) return true;
-		if (has_struct_fields_with_destroy(field_struct, table)) return true;
-	}
-	return false;
-}
-/**
-* Whether a struct (or any embedded struct field, recursively) needs a
-* destroy call at scope exit — it has a `#destroy`, a class-typed field,
-* or a nested struct field that itself needs destroying. This does NOT
-* count `string` fields (see `has_struct_fields_with_destroy`).
-*/
-function struct_needs_destroy(struct, table) {
-	return has_destroy(struct) || has_struct_fields_with_destroy(struct, table) || struct_has_owning_enum_field(struct, table);
-}
-/**
-* Whether a struct needs an auto-generated `<Struct>_destroy` function.
-* Broader than `struct_needs_destroy`: also returns true for structs with
-* `string` fields, because a Buffer<T> for such a struct deep-copies the
-* strings into slots (strdup on store) and the per-element destroy must
-* free them. The generated destroy frees each string field; it is called
-* from Buffer's specialized #destroy / replace_T, NOT from struct local
-* scope exit (`struct_needs_destroy` governs that path and excludes
-* strings).
-*/
-function struct_needs_auto_destroy(struct, table) {
-	if (struct_needs_destroy(struct, table)) return true;
-	if (struct_has_owning_enum_field(struct, table)) return true;
-	for (const field of struct.fields) {
-		if (field.type.is_ref) continue;
-		if (field.type.is_view) continue;
-		if (field.type.name === "string" && !field.type.is_array) return true;
-		const field_struct = resolve_struct_type(field.type, table);
-		if (field_struct && !field_struct.is_class && struct_needs_auto_destroy(field_struct, table)) return true;
-	}
-	return false;
-}
-//#endregion
 //#region ../src/build_common/scan_force_heap_strings.ts
 function scan_force_heap_strings(statements, structs) {
 	const result = /* @__PURE__ */ new Set();
@@ -14909,7 +14927,33 @@ function emit_base_ptr(status, decl_name, is_class_parent) {
 	if (is_class_parent) emit_var_load(status, "x0", decl_name, 8);
 	else emit_var_address(status, "x0", decl_name);
 }
-function emit_field_destroys(status, struct_type, decl_name, base_offset, is_class_parent, free_strings = true) {
+/**
+* Reclaim a struct's owning fields in place (base + every nested owning field).
+*
+* `base_offset` (added to each field offset) and `is_class_parent` (a class's
+* base is a pointer LOADED from the slot; a value struct is inline AT it)
+* locate `decl_name`'s storage.
+*
+* `free_strings` is REQUIRED — it is a per-call-site OWNOWNITY fact, not a
+* per-type one, so it deliberately has no default:
+* - `true` from a DESTROY function (`<T>_destroy`), which only ever runs on
+*   heap-owned storage: a class's plain string fields are always heap-owned
+*   (`_init` strdup's defaults, assignments strdup a non-heap RHS), and a
+*   VALUE struct arrives with the per-slot copies `store_T`/`_copy` strdup'd
+*   (Buffer per-element teardown, the displaced-field reclaim, the
+*   anchor-slot walk). Matches C's build_auto_destroy, which frees string
+*   fields unconditionally.
+* - `false` from struct-LOCAL scope exit, where a string field may still hold
+*   a rodata literal (aarch64 constructors don't strdup) and freeing it would
+*   `free` rodata (SIGABRT).
+*
+* A default (`= true`) previously stood in for the `true` arm while
+* `node.is_class` (undefined on plain parsed structs) was passed as if it
+* selected between the arms — so the day `is_class` becomes explicitly false,
+* value-struct slot strings would silently stop being reclaimed. Passing the
+* boolean at every call site makes both arms visible.
+*/
+function emit_field_destroys(status, struct_type, decl_name, base_offset, is_class_parent, free_strings) {
 	const destroy_fields = struct_type.is_class ? layout_fields(struct_type, status) : struct_type.fields;
 	for (const field of destroy_fields) {
 		const offset = get_field_offset_of_fields(destroy_fields, field.name, status);
@@ -21215,7 +21259,7 @@ function build_destroy_function(node, func, status) {
 			status.code = status.code.slice(0, after_prologue) + saves + status.code.slice(after_prologue);
 		}
 	}
-	if (node.is_class) emit_field_destroys(status, node, "self", void 0, false);
+	if (node.is_class) emit_field_destroys(status, node, "self", void 0, false, true);
 	emit_asm(status, `${return_label}:\n`);
 	const total_stack = Math.ceil((status.stack_size || 0) / 16) * 16;
 	status.code = status.code.replace(`sub sp, sp, #${stack_placeholder}`, total_stack > 0 ? `sub sp, sp, #${total_stack}` : `// no stack needed`);
@@ -21272,7 +21316,7 @@ function build_auto_destroy_function(node, status) {
 	status.function_param_regs.set("self", "x19");
 	emit_asm(status, `sub sp, sp, #${stack_placeholder}\n`);
 	emit_asm(status, `mov x29, sp\n`);
-	emit_field_destroys(status, node, "self", void 0, false, node.is_class);
+	emit_field_destroys(status, node, "self", void 0, false, true);
 	emit_asm(status, `${return_label}:\n`);
 	const total_stack = Math.ceil((status.stack_size || 0) / 16) * 16;
 	status.code = status.code.replace(`sub sp, sp, #${stack_placeholder}`, total_stack > 0 ? `sub sp, sp, #${total_stack}` : `// no stack needed`);
@@ -24988,6 +25032,17 @@ function build_declaration_node$1(node, status, nir_init, nir_swap) {
 				check_heap();
 				return;
 			}
+			const decl_string_field_read = node.type.name === "string" && !node.type.is_view && !node.type.is_array && size === 16 && node.value.node_type === "access" && node.value.access.node_type === "access_field";
+			if (decl_string_field_read && !!status.force_heap_strings?.has(node.name)) {
+				emit_init_value$1(node.value, nir_init, status);
+				ensure_newline(status);
+				emit_strdup_string(status);
+				emit_var_store(status, "x0", node.name, size);
+				mark_heap_string(status, node.name);
+				status.last_result_is_heap = false;
+				return;
+			}
+			if (decl_string_field_read) status.last_result_is_heap = false;
 			emit_init_value$1(node.value, nir_init, status);
 			emit_var_store(status, "x0", node.name, size);
 			check_heap();
@@ -41684,7 +41739,9 @@ function build_assignment_node(node, status, nir_rhs, nir_swap) {
 			const rhs_is_string_var = !node.swap && !!rhs_value && typeof rhs_value.value === "string" && /^[A-Za-z_][A-Za-z0-9_]*$/.test(rhs_value.value) && rhs_value.value !== "true" && rhs_value.value !== "false" && rhs_value.value !== "null" && !rhs_value.is_moved && size === 16 && rhs_value.type?.name === "string" && !rhs_value.type?.is_view;
 			const move_source = rhs_is_string_var && node.last_use_move && move_on_last_use_enabled() ? rhs_value.value : void 0;
 			const explicit_move_source = !node.swap && !!rhs_value && rhs_value.is_moved && size === 16 && rhs_value.type?.name === "string" && !rhs_value.type?.is_view ? rhs_value.value : void 0;
-			const borrow_needs_dup = !node.swap && size === 16 && is_string_borrow(node.right_value) && !!status.force_heap_strings?.has(name);
+			const rhs_is_borrow_reception = !node.swap && size === 16 && is_string_borrow(node.right_value);
+			const rhs_is_field_read = !node.swap && size === 16 && node.right_value.node_type === "access" && node.right_value.access.node_type === "access_field";
+			const borrow_needs_dup = (rhs_is_borrow_reception || rhs_is_field_read) && !!status.force_heap_strings?.has(name);
 			const move_source_owns_heap = move_source !== void 0 && !!status.heap_strings?.has(move_source);
 			if (rhs_is_view_into_owned) {
 				if (!status.heap_strings) status.heap_strings = /* @__PURE__ */ new Set();
@@ -41694,7 +41751,8 @@ function build_assignment_node(node, status, nir_rhs, nir_swap) {
 				if (move_source !== void 0 && move_source_owns_heap) status.heap_strings?.delete(move_source);
 				if (!status.heap_strings) status.heap_strings = /* @__PURE__ */ new Set();
 				status.heap_strings.add(name);
-			} else if (status.last_result_is_heap) {
+			} else if (rhs_is_field_read) status.last_result_is_heap = false;
+			else if (status.last_result_is_heap) {
 				if (!status.heap_strings) status.heap_strings = /* @__PURE__ */ new Set();
 				status.heap_strings.add(name);
 			} else if (explicit_move_source !== void 0 && status.heap_strings?.delete(explicit_move_source)) status.heap_strings.add(name);
@@ -41911,6 +41969,22 @@ function build_assignment_node(node, status, nir_rhs, nir_swap) {
 						get_base_address(access, status, "x0");
 						emit_asm(status, `str x0, [sp, #-16]!\n`);
 					}
+					if (!node.operator && node.right_value.node_type === "value" && node.right_value.is_moved) {
+						const field_resolved = resolve_struct_type(field_type, status);
+						const field_target_var = access.target.node_type === "value" ? access.target.value : "";
+						const first_init_write = is_first_init_field_write(field_target_var, field_name, status);
+						mark_init_field_write(field_target_var, field_name, status);
+						if (field_resolved && !field_resolved.is_class && !first_init_write && struct_needs_auto_destroy(field_resolved, status)) {
+							if (base_reg !== void 0) {
+								if (offset !== 0) emit_asm(status, `add x0, ${base_reg}, #${offset}\n`);
+								else emit_asm(status, `mov x0, ${base_reg}\n`);
+							} else {
+								emit_asm(status, `ldr x0, [sp]\n`);
+								if (offset !== 0) emit_asm(status, `add x0, x0, #${offset}\n`);
+							}
+							emit_asm(status, `bl ${field_resolved.name}_destroy\n`);
+						}
+					}
 					get_source_address(node.right_value, status, nir_rhs);
 					ensure_newline(status);
 					emit_asm(status, `mov x1, x0\n`);
@@ -47312,7 +47386,8 @@ function build(root, options = {}) {
 			status.code = status.code.replaceAll("bl _strdup\n", "bl _nomen_strdup_wrap\n");
 			status.code = status.code.replaceAll("bl _free\n", "bl _nomen_free_wrap\n");
 		}
-		const lift_errors = validate_asm(status.code);
+		const { result: lifted } = lift_functions(status.code);
+		const lift_errors = lifted.errors;
 		if (lift_errors.length > 0) {
 			if (!status.build_errors) status.build_errors = [];
 			for (const e of lift_errors.slice(0, 20)) status.build_errors.push({
@@ -47320,7 +47395,7 @@ function build(root, options = {}) {
 				start: 0
 			});
 		}
-		const balance_errors = validate_stack_balance(status.code);
+		const balance_errors = stack_balance_errors_from_lift(lifted);
 		if (balance_errors.length > 0) {
 			if (!status.build_errors) status.build_errors = [];
 			for (const e of balance_errors.slice(0, 20)) status.build_errors.push({
@@ -63125,11 +63200,19 @@ function generate_harness(tests, benches) {
 		const n = Math.min(raw, 4096);
 		return template.replace(/__NAME__/g, b.name).replace(/__TARGET__/g, b.target).replace(/__N__/g, String(n));
 	}).join("\n");
-	let main = "\nimport System\nimport System::Test\n\npub func main = () {\n";
+	let main = "\nimport System\nimport System::Test\n";
+	main += "\npub func main = () {\n";
 	main += "	var Tester t = Tester()\n";
+	main += "	var int64 audit_mark = 0\n";
+	main += "	var int64 audit_leaked = 0\n";
 	for (const test of tests) {
+		main += `\taudit_mark = Tester.audit_count()\n`;
 		main += `\tt.begin_test("${escape_nm_string(test.name)}")\n`;
 		main += `\t${test.name}(ref t)\n`;
+		main += `\taudit_leaked = Tester.audit_count() - audit_mark\n`;
+		main += `\tif audit_leaked > 0 {\n`;
+		main += `\t\tConsole.write_line("\\\\nomen|leaks|" + "${escape_nm_string(test.name)}" + "|\\{audit_leaked}")\n`;
+		main += `\t}\n`;
 		main += `\tt.end_test()\n`;
 	}
 	for (const bench of benches) {
@@ -63148,6 +63231,7 @@ function parse_records(stdout) {
 	const tests = [];
 	const fails = [];
 	const benches = [];
+	const leaks = [];
 	const other = [];
 	for (const line of stdout.split("\n")) {
 		if (!line.startsWith(RECORD_PREFIX)) {
@@ -63166,6 +63250,10 @@ function parse_records(stdout) {
 			test: parts[1],
 			message: parts.slice(2).join("|")
 		});
+		else if (kind === "leaks") leaks.push({
+			test: parts[1],
+			count: parseInt(parts[2] || "0", 10)
+		});
 		else if (kind === "bench") benches.push({
 			label: parts[1],
 			n: parseInt(parts[2] || "0", 10),
@@ -63180,12 +63268,19 @@ function parse_records(stdout) {
 		tests,
 		fails,
 		benches,
+		leaks,
 		other
 	};
 }
-/** Pull the exit-time audit "LEAK: N allocation(s)" lines out of stdout. */
+/**
+* Pull the exit-time audit lines out of stdout: "LEAK: N allocation(s)" (a
+* nonzero malloc/free balance) and "AUDIT-STALE-FREE: N pointer(s) freed that
+* were not live audit allocations" (a free that matched no live block — a
+* foreign pointer or a double free; the runtime no longer passes those to
+* libc free, so this is the only record they leave). Both fail the file.
+*/
 function extract_leaks(stdout) {
-	return stdout.split("\n").map((l) => l.trim()).filter((l) => l.startsWith("LEAK:"));
+	return stdout.split("\n").map((l) => l.trim()).filter((l) => l.startsWith("LEAK:") || l.startsWith("AUDIT-STALE-FREE:"));
 }
 /**
 * Compile one `*.test.nm` file (with the generated harness) and run it,
@@ -63201,8 +63296,9 @@ async function run_test_file(entry_path, lib_path, arch, audit = false, audit_ru
 		tests: [],
 		fails: [],
 		benches: [],
-		other: [],
 		leaks: [],
+		leaking_tests: [],
+		other: [],
 		ms: 0
 	};
 	const resolved = path.resolve(entry_path);
@@ -63230,24 +63326,21 @@ async function run_test_file(entry_path, lib_path, arch, audit = false, audit_ru
 	}
 	const buildDir = build_dir_for(resolved, true);
 	if (!fs.existsSync(buildDir)) fs.mkdirSync(buildDir, { recursive: true });
-	let audit_obj;
-	if (audit) {
-		const runtime_src = audit_runtime ? path.resolve(audit_runtime) : find_audit_runtime(path.dirname(resolved)) ?? find_bundled_audit_runtime();
-		if (!runtime_src || !fs.existsSync(runtime_src)) {
-			result.ok = false;
-			result.phase = "setup";
-			result.crashed = "Audit enabled but audit_runtime.c was not found. Pass --audit-runtime <path>.";
-			result.ms = performance.now() - start;
-			return result;
-		}
-		audit_obj = path.join(buildDir, "audit_runtime.o");
-		await execFile_async("clang", [
-			"-c",
-			runtime_src,
-			"-o",
-			audit_obj
-		]);
+	const runtime_src = audit_runtime ? path.resolve(audit_runtime) : find_audit_runtime(path.dirname(resolved)) ?? find_bundled_audit_runtime();
+	if (!runtime_src || !fs.existsSync(runtime_src)) {
+		result.ok = false;
+		result.phase = "setup";
+		result.crashed = "audit_runtime.c was not found. Pass --audit-runtime <path>.";
+		result.ms = performance.now() - start;
+		return result;
 	}
+	const audit_obj = path.join(buildDir, "audit_runtime.o");
+	await execFile_async("clang", [
+		"-c",
+		runtime_src,
+		"-o",
+		audit_obj
+	]);
 	const platform = default_platform();
 	const ext = arch === "aarch64" ? ".s" : platform === "macos" || platform === "ios" ? ".m" : ".c";
 	const codefile = path.join(buildDir, path.basename(entry_path, ".nm") + ext);
@@ -63297,9 +63390,10 @@ async function run_test_file(entry_path, lib_path, arch, audit = false, audit_ru
 	result.tests = records.tests;
 	result.fails = records.fails;
 	result.benches = records.benches;
+	result.leaking_tests = records.leaks;
 	result.other = records.other;
 	result.leaks = audit ? extract_leaks(runStdout) : [];
-	if (result.leaks.length) result.other = result.other.filter((l) => !l.trim().startsWith("LEAK:"));
+	if (result.leaks.length) result.other = result.other.filter((l) => !l.trim().startsWith("LEAK:") && !l.trim().startsWith("AUDIT-STALE-FREE:"));
 	result.crashed = crashed;
 	if (crashed) result.phase = "run";
 	result.ok = !(result.fails.length > 0 || result.tests.some((t) => t.failed > 0)) && crashed === void 0 && result.leaks.length === 0;
@@ -63340,6 +63434,10 @@ function report_file(result) {
 	if (result.crashed) console.log(C.red(`   ${result.crashed}`));
 	for (const f of result.fails) console.log(`   ${C.red("✗")} ${f.test} ${C.dim(">")} ${f.message}`);
 	for (const leak of result.leaks) console.log(`   ${C.yellow("⚠")} ${C.yellow(leak)}`);
+	if (result.leaks.length) {
+		for (const lt of result.leaking_tests) console.log(`   ${C.yellow("⚠")} ${lt.test} ${C.dim(`leaked ${lt.count} allocation(s)`)}`);
+		if (!result.leaking_tests.length) console.log(`   ${C.yellow("⚠")} ${C.yellow("LEAK: no per-test attribution — leaked outside a test (harness/setup/teardown) or crashed mid-test")}`);
+	}
 	for (const b of result.benches) console.log(`   ${C.cyan("⏱")} ${b.label} ${C.dim(`(n=${b.n})`)} ${C.dim("min")} ${fmt_ns(b.min)} ${C.dim("median")} ${fmt_ns(b.median)} ${C.dim("mean")} ${fmt_ns(Math.round(b.mean))} ${C.dim("max")} ${fmt_ns(b.max)} ${C.dim("±")} ${fmt_ns(Math.round(b.stddev))}`);
 	if (result.other.length) {
 		console.log(C.dim("   --- test stdout ---"));
@@ -63395,11 +63493,12 @@ async function runTests(root, options = {}) {
 	const totalFailed = results.reduce((a, r) => a + r.tests.reduce((x, t) => x + t.failed, 0), 0);
 	const totalPassed = totalTests - totalFailed;
 	const totalLeaks = results.reduce((a, r) => a + r.leaks.length, 0);
+	const totalLeakingTests = results.reduce((a, r) => a + r.leaking_tests.length, 0);
 	const anyFailed = results.some((r) => !r.ok);
 	console.log("");
 	console.log(` ${C.dim("Files ")} ${C.green(`${totalFilesPassed} passed`)}` + (totalFilesFailed ? ` ${C.dim("|")} ${C.red(`${totalFilesFailed} failed`)}` : "") + C.dim(` (${totalFiles})`));
 	console.log(` ${C.dim("Tests ")} ${C.green(`${totalPassed} passed`)}` + (totalFailed ? ` ${C.dim("|")} ${C.red(`${totalFailed} failed`)}` : "") + C.dim(` (${totalTests})`));
-	if (totalLeaks) console.log(` ${C.dim("Leaks ")} ${C.yellow(`${totalLeaks} reported`)}` + C.dim(" (--audit; leaked files count as failures)"));
+	if (totalLeaks) console.log(` ${C.dim("Leaks ")} ${C.yellow(`${totalLeakingTests} leaking test(s)`)}` + (totalLeakingTests !== totalLeaks ? C.dim(` (${totalLeaks} leaked file(s))`) : "") + C.dim(" (--audit; leaking tests fail their file)"));
 	console.log(` ${C.dim(" Time ")} ${format_duration(elapsed)}`);
 	console.log("");
 	return !anyFailed;
@@ -63681,7 +63780,7 @@ function processFile(filename, config, mode, program_args) {
 	console.log(`Created ${codefile} in ${(compileTime - startTime).toFixed(2)}ms`);
 	console.log("");
 	startTime = performance.now();
-	const audit_obj = config.audit ? compile_audit_runtime(config, resolved, buildDir) : void 0;
+	const audit_obj = config.audit || result.code.includes("nomen_audit_count") ? compile_audit_runtime(config, resolved, buildDir) : void 0;
 	let link_inputs = codefile;
 	if (companionfile) link_inputs += ` ${companionfile}`;
 	if (audit_obj) link_inputs += ` ${audit_obj}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nomen-lang",
-  "version": "0.6.9",
+  "version": "0.6.10",
   "description": "The CLI for the Nomen programming language.",
   "keywords": [],
   "license": "ISC",

package/src/index.ts

@@ -409,7 +409,14 @@ function processFile(filename: string, config: Config, mode: Mode, program_args:
 	// `build` links the executable but does not run it; `run` links and runs.
 	startTime = performance.now();
 
-	const audit_obj = config.audit ? compile_audit_runtime(config, resolved, buildDir) : undefined;
+	// The audit runtime is linked under --audit, and also whenever the
+	// program references it: `Tester.audit_count` (System::Test) has a raw
+	// body calling `nomen_audit_count`, so a Tester-using program run without
+	// --audit still needs the (inert) counter object at link time.
+	const needs_audit_runtime = config.audit || result.code.includes("nomen_audit_count");
+	const audit_obj = needs_audit_runtime
+		? compile_audit_runtime(config, resolved, buildDir)
+		: undefined;
 	let link_inputs = codefile;
 	if (companionfile) link_inputs += ` ${companionfile}`;
 	if (audit_obj) link_inputs += ` ${audit_obj}`;

package/src/test.ts

@@ -49,6 +49,10 @@ export interface TestFileResult {
 	// "LEAK: N allocation(s)" lines the audits runtime printed at exit. Empty
 	// unless the file was run with --audit; a non-empty list fails the file.
 	leaks: string[];
+	// Per-test leak attribution (from the harness's `\nomen|leaks` records):
+	// the tests whose allocation balance grew while they ran. Collected in
+	// every run; only --audit fails the file on them.
+	leaking_tests: LeakRecord[];
 	// Set when the compiled binary crashed before finishing (e.g. a segfault
 	// in a test). We still surface whatever records it managed to emit.
 	crashed?: string;
@@ -83,6 +87,13 @@ interface BenchRecord {
 	stddev: number;
 }
 
+// A `\nomen|leaks|<test>|<n>` record: the test's allocation balance grew by
+// `n` between the harness's counter snapshot and the test's end.
+interface LeakRecord {
+	test: string;
+	count: number;
+}
+
 /** Recursively collect `*.test.nm` files under `root`, skipping build output. */
 export function collect_test_files(root: string): string[] {
 	const out: string[] = [];
@@ -201,11 +212,25 @@ export function generate_harness(tests: TestFunction[], benches: BenchFunction[]
 		})
 		.join("\n");
 
-	let main = "\nimport System\nimport System::Test\n\npub func main = () {\n";
+	let main = "\nimport System\nimport System::Test\n";
+	// Per-test leak attribution: the harness snapshots the audit counter
+	// (Tester.audit_count — the audit runtime is linked into every test
+	// build, see run_test_file) before every test and diffs it after. A
+	// positive delta emits a `\nomen|leaks|<test>|<n>` record, which the CLI
+	// reports as a leaking test instead of leaving the file's exit-time
+	// total unattributed.
+	main += "\npub func main = () {\n";
 	main += "\tvar Tester t = Tester()\n";
+	main += "\tvar int64 audit_mark = 0\n";
+	main += "\tvar int64 audit_leaked = 0\n";
 	for (const test of tests) {
+		main += `\taudit_mark = Tester.audit_count()\n`;
 		main += `\tt.begin_test("${escape_nm_string(test.name)}")\n`;
 		main += `\t${test.name}(ref t)\n`;
+		main += `\taudit_leaked = Tester.audit_count() - audit_mark\n`;
+		main += `\tif audit_leaked > 0 {\n`;
+		main += `\t\tConsole.write_line("\\\\nomen|leaks|" + "${escape_nm_string(test.name)}" + "|\\{audit_leaked}")\n`;
+		main += `\t}\n`;
 		main += `\tt.end_test()\n`;
 	}
 	for (const bench of benches) {
@@ -227,6 +252,7 @@ interface RunRecord {
 	tests: TestRecord[];
 	fails: FailRecord[];
 	benches: BenchRecord[];
+	leaks: LeakRecord[];
 	other: string[];
 }
 
@@ -235,6 +261,7 @@ export function parse_records(stdout: string): RunRecord {
 	const tests: TestRecord[] = [];
 	const fails: FailRecord[] = [];
 	const benches: BenchRecord[] = [];
+	const leaks: LeakRecord[] = [];
 	const other: string[] = [];
 	for (const line of stdout.split("\n")) {
 		if (!line.startsWith(RECORD_PREFIX)) {
@@ -254,6 +281,8 @@ export function parse_records(stdout: string): RunRecord {
 			});
 		} else if (kind === "fail") {
 			fails.push({ test: parts[1], message: parts.slice(2).join("|") });
+		} else if (kind === "leaks") {
+			leaks.push({ test: parts[1], count: parseInt(parts[2] || "0", 10) });
 		} else if (kind === "bench") {
 			benches.push({
 				label: parts[1],
@@ -266,15 +295,21 @@ export function parse_records(stdout: string): RunRecord {
 			});
 		}
 	}
-	return { tests, fails, benches, other };
+	return { tests, fails, benches, leaks, other };
 }
 
-/** Pull the exit-time audit "LEAK: N allocation(s)" lines out of stdout. */
+/**
+ * Pull the exit-time audit lines out of stdout: "LEAK: N allocation(s)" (a
+ * nonzero malloc/free balance) and "AUDIT-STALE-FREE: N pointer(s) freed that
+ * were not live audit allocations" (a free that matched no live block — a
+ * foreign pointer or a double free; the runtime no longer passes those to
+ * libc free, so this is the only record they leave). Both fail the file.
+ */
 export function extract_leaks(stdout: string): string[] {
 	return stdout
 		.split("\n")
 		.map((l) => l.trim())
-		.filter((l) => l.startsWith("LEAK:"));
+		.filter((l) => l.startsWith("LEAK:") || l.startsWith("AUDIT-STALE-FREE:"));
 }
 
 /**
@@ -302,8 +337,9 @@ export async function run_test_file(
 		tests: [],
 		fails: [],
 		benches: [],
-		other: [],
 		leaks: [],
+		leaking_tests: [],
+		other: [],
 		ms: 0,
 	};
 
@@ -343,29 +379,27 @@ export async function run_test_file(
 
 	const buildDir = build_dir_for(resolved, true);
 	if (!fs.existsSync(buildDir)) fs.mkdirSync(buildDir, { recursive: true });
-	// With --audit, compile the audit runtime (malloc/free counting) and link
-	// it in; the generated main calls nomen_audit_check() at exit, printing
-	// "LEAK: N allocation(s)" when the balance is nonzero.
-	let audit_obj: string | undefined;
-	if (audit) {
-		// Explicit flag wins; else walk up from the test file (a nomen
-		// checkout's src/audit_runtime.c); else the runtime bundled with the
-		// CLI (live repo copy in the dev tree, shipped copy when published)
-		// so `--audit` works outside the nomen checkout with no flag.
-		const runtime_src = audit_runtime
-			? path.resolve(audit_runtime)
-			: (find_audit_runtime(path.dirname(resolved)) ?? find_bundled_audit_runtime());
-		if (!runtime_src || !fs.existsSync(runtime_src)) {
-			result.ok = false;
-			result.phase = "setup";
-			result.crashed =
-				"Audit enabled but audit_runtime.c was not found. Pass --audit-runtime <path>.";
-			result.ms = performance.now() - start;
-			return result;
-		}
-		audit_obj = path.join(buildDir, "audit_runtime.o");
-		await execFile_async("clang", ["-c", runtime_src, "-o", audit_obj]);
+	// The audit runtime is linked into EVERY test build: the generated
+	// harness polls nomen_audit_count() around every test for per-test leak
+	// attribution, and under --audit the generated main additionally calls
+	// nomen_audit_check() at exit, printing "LEAK: N allocation(s)" when the
+	// balance is nonzero.
+	// Runtime discovery: explicit flag wins; else walk up from the test file
+	// (a nomen checkout's src/audit_runtime.c); else the runtime bundled with
+	// the CLI (live repo copy in the dev tree, shipped copy when published)
+	// so it works outside the nomen checkout with no flag.
+	const runtime_src = audit_runtime
+		? path.resolve(audit_runtime)
+		: (find_audit_runtime(path.dirname(resolved)) ?? find_bundled_audit_runtime());
+	if (!runtime_src || !fs.existsSync(runtime_src)) {
+		result.ok = false;
+		result.phase = "setup";
+		result.crashed = "audit_runtime.c was not found. Pass --audit-runtime <path>.";
+		result.ms = performance.now() - start;
+		return result;
 	}
+	const audit_obj = path.join(buildDir, "audit_runtime.o");
+	await execFile_async("clang", ["-c", runtime_src, "-o", audit_obj]);
 	const platform = default_platform();
 	// Match the run/build command's emission: ObjC-bearing sources (GUI code
 	// pulled in through the library graph) must land in a `.m` TU on Apple
@@ -454,15 +488,22 @@ export async function run_test_file(
 	result.tests = records.tests;
 	result.fails = records.fails;
 	result.benches = records.benches;
+	result.leaking_tests = records.leaks;
 	result.other = records.other;
 	// Under --audit the exit-time audit check prints "LEAK: N allocation(s)"
-	// to stdout when the malloc/free balance is nonzero. Treat any such line
-	// as a failure so a leaked test file cannot stay green.
+	// to stdout when the malloc/free balance is nonzero, and
+	// "AUDIT-STALE-FREE: N ..." for frees that matched no live block. Treat
+	// any such line as a failure so a leaked (or double-freeing) test file
+	// cannot stay green. (The per-test `leaks` records are collected always —
+	// they name the leaking tests — but only --audit makes them fail the
+	// file.)
 	result.leaks = audit ? extract_leaks(runStdout) : [];
-	// Leak lines are surfaced explicitly above; drop them from the generic
+	// Audit lines are surfaced explicitly above; drop them from the generic
 	// stdout dump so they are not printed twice.
 	if (result.leaks.length) {
-		result.other = result.other.filter((l) => !l.trim().startsWith("LEAK:"));
+		result.other = result.other.filter(
+			(l) => !l.trim().startsWith("LEAK:") && !l.trim().startsWith("AUDIT-STALE-FREE:"),
+		);
 	}
 	result.crashed = crashed;
 	if (crashed) result.phase = "run";
@@ -535,6 +576,20 @@ export function report_file(result: TestFileResult): void {
 	for (const leak of result.leaks) {
 		console.log(`   ${C.yellow("⚠")} ${C.yellow(leak)}`);
 	}
+	// Per-test attribution: which tests leaked (the exit-time LEAK line above
+	// is the file total; these name the culprits). Shown under --audit only —
+	// without it the file cannot fail on leaks, so the warning would be noise
+	// on every run.
+	if (result.leaks.length) {
+		for (const lt of result.leaking_tests) {
+			console.log(`   ${C.yellow("⚠")} ${lt.test} ${C.dim(`leaked ${lt.count} allocation(s)`)}`);
+		}
+		if (!result.leaking_tests.length) {
+			console.log(
+				`   ${C.yellow("⚠")} ${C.yellow("LEAK: no per-test attribution — leaked outside a test (harness/setup/teardown) or crashed mid-test")}`,
+			);
+		}
+	}
 	for (const b of result.benches) {
 		console.log(
 			`   ${C.cyan("⏱")} ${b.label} ${C.dim(`(n=${b.n})`)} ` +
@@ -641,6 +696,12 @@ export async function runTests(root: string, options: RunTestsOptions = {}): Pro
 	const totalFailed = results.reduce((a, r) => a + r.tests.reduce((x, t) => x + t.failed, 0), 0);
 	const totalPassed = totalTests - totalFailed;
 	const totalLeaks = results.reduce((a, r) => a + r.leaks.length, 0);
+	// Leak attribution: the count of TESTS that leaked (the old summary
+	// counted FILES — one aggregate LEAK line per file told you nothing about
+	// which test to blame). The per-file report lists the leaking tests; the
+	// files' exit-time totals can exceed the per-test sum when allocations
+	// leak outside any test (harness/setup/teardown).
+	const totalLeakingTests = results.reduce((a, r) => a + r.leaking_tests.length, 0);
 	const anyFailed = results.some((r) => !r.ok);
 
 	console.log("");
@@ -659,8 +720,9 @@ export async function runTests(root: string, options: RunTestsOptions = {}): Pro
 	);
 	if (totalLeaks) {
 		console.log(
-			` ${C.dim("Leaks ")} ${C.yellow(`${totalLeaks} reported`)}` +
-				C.dim(" (--audit; leaked files count as failures)"),
+			` ${C.dim("Leaks ")} ${C.yellow(`${totalLeakingTests} leaking test(s)`)}` +
+				(totalLeakingTests !== totalLeaks ? C.dim(` (${totalLeaks} leaked file(s))`) : "") +
+				C.dim(" (--audit; leaking tests fail their file)"),
 		);
 	}
 	console.log(` ${C.dim(" Time ")} ${format_duration(elapsed)}`);