nomen-lang 0.9.0 → 0.10.0

package/core/System/Controls/Spinner.nm

@@ -92,7 +92,7 @@ pub mv struct Spinner: Control {
 		```
 	}
 
-	pub func set_frame = (ref self, int x, int y, int width, int height) {
+	pub func set_frame = (ref self {}, int x, int y, int width, int height) {
 		```
 		#arch: c
 		#platform: macos
@@ -123,7 +123,7 @@ pub mv struct Spinner: Control {
 		```
 	}
 
-	pub func start = (ref self) {
+	pub func start = (ref self {}) {
 		```
 		#arch: c
 		#platform: macos
@@ -154,7 +154,7 @@ pub mv struct Spinner: Control {
 		```
 	}
 
-	pub func stop = (ref self) {
+	pub func stop = (ref self {}) {
 		```
 		#arch: c
 		#platform: macos

package/core/System/Controls/SplitView.nm

@@ -334,7 +334,7 @@ pub mv struct SplitView: Control {
 
 	// Move divider `index`. For a vertical split the position is the left
 	// edge of the pane after the divider, in points from the left.
-	pub func set_position = (ref self, float position, int divider) {
+	pub func set_position = (ref self {}, float position, int divider) {
 		```
 		#arch: c
 		#platform: macos
@@ -424,7 +424,7 @@ pub mv struct SplitView: Control {
 	}
 
 	// ── Control trait conformance ──
-	pub func set_frame = (ref self, int x, int y, int width, int height) {
+	pub func set_frame = (ref self {}, int x, int y, int width, int height) {
 		```
 		#arch: c
 		#platform: macos

package/core/System/Controls/Stepper.nm

@@ -87,7 +87,7 @@ pub mv struct Stepper: Control {
 		```
 	}
 
-	pub func set_frame = (ref self, int x, int y, int width, int height) {
+	pub func set_frame = (ref self {}, int x, int y, int width, int height) {
 		```
 		#arch: c
 		#platform: macos

package/core/System/Controls/Switch.nm

@@ -74,7 +74,7 @@ pub mv struct Switch: Control {
 		```
 	}
 
-	pub func set_frame = (ref self, int x, int y, int width, int height) {
+	pub func set_frame = (ref self {}, int x, int y, int width, int height) {
 		```
 		#arch: c
 		#platform: macos

package/core/System/Controls/Table.nm

@@ -744,7 +744,7 @@ pub mv struct Table: Control {
 	}
 
 	// ── Control trait conformance ──
-	pub func set_frame = (ref self, int x, int y, int width, int height) {
+	pub func set_frame = (ref self {}, int x, int y, int width, int height) {
 		```
 		#arch: c
 		#platform: macos

package/core/System/Controls/Tabs.nm

@@ -415,7 +415,7 @@ pub mv struct Tabs: Control {
 	}
 
 	// ── Control trait conformance ──
-	pub func set_frame = (ref self, int x, int y, int width, int height) {
+	pub func set_frame = (ref self {}, int x, int y, int width, int height) {
 		```
 		#arch: c
 		#platform: macos

package/core/System/Controls/Text.nm

@@ -249,7 +249,7 @@ pub mv struct Text: Control {
 		return s
 	}
 
-	pub func set_frame = (ref self, int x, int y, int width, int height) {
+	pub func set_frame = (ref self {}, int x, int y, int width, int height) {
 		```
 		#arch: c
 		#platform: macos

package/core/System/Controls/TextBox.nm

@@ -111,7 +111,7 @@ pub mv struct TextBox: Control {
 		```
 	}
 
-	pub func set_frame = (ref self, int x, int y, int width, int height) {
+	pub func set_frame = (ref self {}, int x, int y, int width, int height) {
 		```
 		#arch: c
 		#platform: macos

package/core/System/Controls/TextView.nm

@@ -116,7 +116,7 @@ pub mv struct TextView: Control {
 		```
 	}
 
-	pub func set_frame = (ref self, int x, int y, int width, int height) {
+	pub func set_frame = (ref self {}, int x, int y, int width, int height) {
 		```
 		#arch: c
 		#platform: macos

package/core/System/Controls/Toggle.nm

@@ -109,7 +109,7 @@ pub mv struct Toggle: Control {
 		```
 	}
 
-	pub func set_frame = (ref self, int x, int y, int width, int height) {
+	pub func set_frame = (ref self {}, int x, int y, int width, int height) {
 		```
 		#arch: c
 		#platform: macos

package/core/System/Controls/Toolbar.nm

@@ -456,7 +456,7 @@ pub mv struct Toolbar: Control {
 	// ── Control trait conformance ──
 	// A toolbar is window chrome: the layout engine never frames it (AppKit
 	// owns the layout rect and shrinks the contentView itself).
-	pub func set_frame = (ref self, int x, int y, int width, int height) {
+	pub func set_frame = (ref self {}, int x, int y, int width, int height) {
 		// No-op: the NSWindow carries the toolbar's geometry.
 	}
 

package/core/System/Controls/Window.nm

@@ -1190,7 +1190,7 @@ pub mv struct Window: Control {
 	// frame where the content rect changed. The grid must outlive the run
 	// (an app field — registration stores its address). Call from
 	// App.start; also arms the resize delegate's target pair.
-	pub func set_content = (ref self, ref Container grid) {
+	pub func set_content = (ref self {}, ref Container grid { aligns, cols, dirty, dirty_idx, gaps, grows, h_kinds, h_vals, handles, kinds, measured_count, mh, mw, pads, pars, prh, prw, prx, pry, rh, rw, rx, ry, shrinks, spans, w_kinds, w_vals }) {
 		```
 		#arch: c
 		#platform: macos
@@ -1307,6 +1307,12 @@ pub mv struct Window: Control {
 	// FORCED: it bypasses the close_requested interception (the delegate's
 	// windowShouldClose: sees nomen_close_forced and allows). Only the red
 	// button routes through `close_requested`.
+	//
+	// The forced latch is one-shot: it is armed immediately before
+	// performClose: (which dispatches windowShouldClose: synchronously) and
+	// disarmed right after. Left armed it is process-global — every LATER
+	// red-button close (another window, a later run loop) would silently
+	// bypass App.close_requested forever.
 	pub func close = (self) {
 		```
 		#arch: c
@@ -1314,6 +1320,7 @@ pub mv struct Window: Control {
 		extern int nomen_close_forced;
 		nomen_close_forced = 1;
 		((void(*)(id, SEL, id))objc_msgSend)((id)self->handle, sel_registerName("performClose:"), (id)0);
+		nomen_close_forced = 0;
 		```
 		```
 		#arch: aarch64_use_c
@@ -1321,6 +1328,7 @@ pub mv struct Window: Control {
 		extern int nomen_close_forced;
 		nomen_close_forced = 1;
 		((void(*)(id, SEL, id))objc_msgSend)((id)self->handle, sel_registerName("performClose:"), (id)0);
+		nomen_close_forced = 0;
 		```
 		```
 		#arch: c
@@ -1345,7 +1353,7 @@ pub mv struct Window: Control {
 	// a FrameEvents each frame.
 	// The app is consumed: it is destroyed when the loop exits (controls
 	// release, buffers free).
-	pub func run = (ref self, mv App app) {
+	pub func run = (ref self {}, mv App app) {
 		app.start(ref self)
 		Container.arm_resize_delegate(self)
 		self.arm_mouse_moves()
@@ -1432,7 +1440,7 @@ pub mv struct Window: Control {
 		return s
 	}
 
-	pub func set_frame = (ref self, int x, int y, int width, int height) {
+	pub func set_frame = (ref self {}, int x, int y, int width, int height) {
 		```
 		#arch: c
 		#platform: macos

package/core/System/Fiber.nm

@@ -71,9 +71,13 @@ pub mv struct Fiber<T> : Spawnable<T> {
 	// out of the instance (started; #destroy no-ops), return the handle.
 	// While the fiber waits, it parks and frees its worker instead of
 	// blocking it.
-	pub func start = (ref self, mv out Task<T>) {
+	pub func start = (ref self {}, mv out Task<T>) {
 		```
 		#arch: c
+		// Single-launch contract: a consumed construction (started) owns
+		// nothing — the handles below are zeroed, and writing the ref count
+		// through the null future would fault. Abort with the reason.
+		if (self->started) __nomen_spawn_double_start_abort();
 		struct nomen_future *_f = (struct nomen_future *)self->future;
 		_f->refs = self->nursery_futures ? 3 : 2;
 		__nomen_fiber_spawn((struct nomen_closure *)self->task, _f);
@@ -83,7 +87,12 @@ pub mv struct Fiber<T> : Spawnable<T> {
 		```
 		```
 		#arch: aarch64
-		// x19 = self. f = self->future (#32); nursery_futures at #48.
+		// x19 = self. started at #40; f = self->future (#32); nursery_futures
+		// at #48. Single-launch contract first: a consumed construction has
+		// zeroed handles, and the ref-store below would write through null.
+		ldrb w9, [x19, #40]
+		cbnz w9, .Lnomen_fstart_double
+		// f = self->future (#32); nursery_futures at #48.
 		ldr x0, [x19, #32]
 		ldr x1, [x19, #48]
 		mov w2, #2
@@ -103,6 +112,10 @@ pub mv struct Fiber<T> : Spawnable<T> {
 		ldr x3, [x19, #32]
 		bl ___nomen_nursery_track
 		.Lnomen_fstart_notrack:
+		b .Lnomen_fstart_done
+		.Lnomen_fstart_double:
+		bl ___nomen_spawn_double_start_abort
+		.Lnomen_fstart_done:
 		```
 		var t = Task<T>()
 		t.result_slot = self.result_slot
@@ -122,7 +135,7 @@ pub mv struct Fiber<T> : Spawnable<T> {
 	// The fiber is launched exactly like start, but the handle is dropped
 	// immediately: the future's refs are released as the discarded Task is
 	// reclaimed, and the fiber completes into the void — nothing joins it.
-	pub func detach = (ref self) {
+	pub func detach = (ref self {}) {
 		self.start()
 	}
 

package/core/System/Graph.nm

@@ -14,7 +14,7 @@ pub mv struct Graph<T>: Enumerable {
 	var node_count = 0
 	var edge_count = 0
 
-	pub func add_node = (ref self, mv T value) {
+	pub func add_node = (ref self { head_edge, values }, mv T value) {
 		var int idx = self.node_count
 		self.values.grow(idx + 1)
 		self.values.store(idx, value)
@@ -23,7 +23,7 @@ pub mv struct Graph<T>: Enumerable {
 		self.node_count = self.node_count + 1
 	}
 
-	pub func add_edge = (ref self, int from, int to) {
+	pub func add_edge = (ref self { edge_next, edge_target, head_edge }, int from, int to) {
 		var int e = self.edge_count
 		self.edge_target.grow_int(e + 1)
 		self.edge_target.store_int(e, to)

package/core/System/LinkedList.nm

@@ -13,13 +13,15 @@ pub mv struct LinkedList<T>: Enumerable {
 	var int head = -1
 	var count = 0
 
-	pub func add = (ref self, mv T value) {
+	pub func add = (ref self { nexts, prevs, values }, mv T value) {
 		var int idx = self.count
 		self.values.grow(idx + 1)
 		// The value arrives owned (`mv T value`): move a value-struct element
-		// into the fresh slot (the caller's storage zeroes, no deep copy);
-		// strings keep the deep-copying store (their pair arrives by value).
-		if T_IS_VALUE_STRUCT {
+		// that OWNS resources into the fresh slot (the caller's storage
+		// zeroes, no deep copy). A non-owning value struct is a legal bare
+		// argument, so it keeps the copying store; strings keep the
+		// deep-copying store too (their pair arrives by value).
+		if T_TAKES_OWNERSHIP {
 			self.values.store_take(idx, value)
 		} else {
 			self.values.store(idx, value)
@@ -34,14 +36,14 @@ pub mv struct LinkedList<T>: Enumerable {
 		}
 	}
 
-	pub func set_next = (ref self, int idx, int next) {
+	pub func set_next = (ref self { nexts, prevs }, int idx, int next) {
 		self.nexts.store_int(idx, next)
 		if next >= 0 && next < self.prevs.cap {
 			self.prevs.store_int(next, idx)
 		}
 	}
 
-	pub func set_previous = (ref self, int idx, int prev) {
+	pub func set_previous = (ref self { nexts, prevs }, int idx, int prev) {
 		self.prevs.store_int(idx, prev)
 		if prev >= 0 && prev < self.nexts.cap {
 			self.nexts.store_int(prev, idx)

package/core/System/List.nm

@@ -5,13 +5,16 @@ pub mv struct List<T>: Viewable {
 	var length = 0
 	var items = Buffer<T>()
 
-	pub func push = (ref self, mv T value) {
+	pub func push = (ref self { items }, mv T value) {
 		if self.length < self.items.cap {
 			// The value arrives owned (`mv T value`): a value-struct element
-			// moves into the fresh slot (store_take — the caller's storage
-			// zeroes, no deep copy); strings and scalars keep the
-			// deep-copying store.
-			if T_IS_VALUE_STRUCT {
+			// that OWNS resources moves into the fresh slot (store_take — the
+			// caller's storage zeroes, no deep copy). A non-owning value
+			// struct (a handle pair) is a legal bare argument (the checker
+			// does not demand `mv`), so taking it would silently zero the
+			// caller's copy — it keeps the copying store, like strings and
+			// scalars.
+			if T_TAKES_OWNERSHIP {
 				self.items.store_take(self.length, value)
 			} else {
 				self.items.store(self.length, value)
@@ -20,7 +23,7 @@ pub mv struct List<T>: Viewable {
 			return
 		}
 		self.reserve(1)
-		if T_IS_VALUE_STRUCT {
+		if T_TAKES_OWNERSHIP {
 			self.items.store_take(self.length, value)
 		} else {
 			self.items.store(self.length, value)
@@ -38,7 +41,7 @@ pub mv struct List<T>: Viewable {
 	// #4). Sound for extra=1 by the same proof as push's old inline growth:
 	// length + 1 > cap grows to exactly the capacity push would have grown
 	// to.
-	internal func reserve = (ref self, int extra: extra >= 0, out int) {
+	internal func reserve = (ref self { items }, int extra: extra >= 0, out int) {
 		if self.length + extra <= self.items.cap {
 			return self.items.cap
 		}
@@ -52,7 +55,7 @@ pub mv struct List<T>: Viewable {
 		return self.items.cap
 	}
 
-	pub func pop = (ref self, mv out T) {
+	pub func pop = (ref self { items }, mv out T) {
 		if self.length <= 0 {
 			return self.items.move(0)
 		}
@@ -91,7 +94,7 @@ pub mv struct List<T>: Viewable {
 		return self.items.slice(start, end)
 	}
 
-	pub func set = (ref self, int i: i >= 0 && i < self.length, mv T value) {
+	pub func set = (ref self { items }, int i: i >= 0 && i < self.length, mv T value) {
 		self.items.replace(i, value)
 	}
 
@@ -99,7 +102,7 @@ pub mv struct List<T>: Viewable {
 	// for indices that can't be proven at compile time (cross-module calls
 	// can never discharge `set`'s parameter constraint) and out-of-range is
 	// a bug, not a case.
-	pub func set_or_panic = (ref self, int i, mv T value) {
+	pub func set_or_panic = (ref self { items }, int i, mv T value) {
 		if i >= 0 && i < self.length {
 			self.set(i, value)
 			return
@@ -111,7 +114,7 @@ pub mv struct List<T>: Viewable {
 	// lowering's destination primitive, the in-place push contract). reserve must have
 	// run, so the slot exists. Offsets mirror the mono layout: length @8,
 	// items.data @24 (the Buffer mono is {_vt, data, cap} = 24 bytes).
-	internal func append_slot_ptr = (ref self, out ptr T) {
+	internal func append_slot_ptr = (ref self { items }, out ptr T) {
 		```
 		#arch: c
 		// Byte math + void* — the body must compile for EVERY element kind
@@ -139,7 +142,7 @@ pub mv struct List<T>: Viewable {
 	// rules. The length constraint is the caller's proof obligation — the
 	// handler desugar's synthesized loops satisfy it from the loop
 	// condition, exactly like `.at`.
-	internal func slot_ptr = (ref self, int i: i >= 0 && i < self.length, out ptr T) {
+	internal func slot_ptr = (ref self { items }, int i: i >= 0 && i < self.length, out ptr T) {
 		return self.items.slot_ptr(i)
 	}
 
@@ -150,7 +153,7 @@ pub mv struct List<T>: Viewable {
 	// resources are reclaimed when the binding's scope ends — binding the
 	// result in a nested block is the way to free an owning element at a
 	// chosen point (its #destroy runs at the block's closing brace).
-	pub func remove_at_or_panic = (ref self, int i, mv out T) {
+	pub func remove_at_or_panic = (ref self { items }, int i, mv out T) {
 		if i < 0 || i >= self.length {
 			panic("index out of range")
 		}

package/core/System/Map.nm

@@ -39,7 +39,7 @@ pub mv struct Map<TK: Hashable + Equatable, TV> {
 		}
 	}
 
-	pub func set = (ref self, mv TK key, mv TV value) {
+	pub func set = (ref self { hashes, keys, used, values }, mv TK key, mv TV value) {
 		var int cap = self.keys.cap
 		if cap == 0 {
 			// alloc_T: for Buffer<TK> it is T_SIZE-aware (string keys are
@@ -59,15 +59,17 @@ pub mv struct Map<TK: Hashable + Equatable, TV> {
 		if self.used.load_u32(idx) == 0 {
 			self.used.store_u32(idx, 1)
 			// Both arrive owned (`mv TK key, mv TV value`): a value-struct
-			// key/value moves into its fresh slot (the caller's storage
-			// zeroes, no deep copy); strings keep the deep-copying store
-			// (their pair arrives by value).
-			if TK_IS_VALUE_STRUCT {
+			// key/value that OWNS resources moves into its fresh slot
+			// (store_take — the caller's storage zeroes, no deep copy). A
+			// non-owning value struct is a legal bare argument and keeps the
+			// copying store; strings keep the deep-copying store too (their
+			// pair arrives by value).
+			if TK_TAKES_OWNERSHIP {
 				self.keys.store_take(idx, key)
 			} else {
 				self.keys.store(idx, key)
 			}
-			if TV_IS_VALUE_STRUCT {
+			if TV_TAKES_OWNERSHIP {
 				self.values.store_take(idx, value)
 			} else {
 				self.values.store(idx, value)
@@ -92,7 +94,7 @@ pub mv struct Map<TK: Hashable + Equatable, TV> {
 	// primitive: the raw pointer must not cross the library boundary, and
 	// the caller must overwrite the slot before it is read or destroyed
 	// again (both paths leave it owning nothing).
-	internal func set_slot_ptr = (ref self, TK key, out ptr TV) {
+	internal func set_slot_ptr = (ref self { hashes, keys, used, values }, TK key, out ptr TV) {
 		var int cap = self.keys.cap
 		if cap == 0 {
 			// alloc_T: for Buffer<TK> it is T_SIZE-aware (string keys are
@@ -195,7 +197,7 @@ pub mv struct Map<TK: Hashable + Equatable, TV> {
 		return self.used.load_u32(idx) != 0
 	}
 
-	pub func remove = (ref self, TK key) {
+	pub func remove = (ref self { hashes, keys, used, values }, TK key) {
 		var int cap = self.keys.cap
 		if cap == 0 {
 			return
@@ -330,7 +332,7 @@ pub mv struct Map<TK: Hashable + Equatable, TV> {
 	// the other half of the Swiss-table trick; the old form re-inserted via
 	// `self.set(mv k, mv v)`, re-hashing every key and re-comparing keys on
 	// every probed slot.
-	func rehash = (ref self, int new_cap) {
+	func rehash = (ref self { hashes, keys, used, values }, int new_cap) {
 		var Buffer<TK> old_keys = mv self.keys swap Buffer<TK>()
 		var Buffer<TV> old_values = mv self.values swap Buffer<TV>()
 		var Buffer<int> old_used = mv self.used swap Buffer<int>()

package/core/System/Random.nm

@@ -44,7 +44,7 @@ pub mv struct Random {
 	// operators, and hex literals all lower directly; the aarch64 64-bit
 	// arithmetic folds (PERF_PLAN item 15) keep the emission within a few
 	// instructions of a hand-written `#arch` body.
-	pub func next = (ref self, out uint64) {
+	pub func next = (ref self {}, out uint64) {
 		self.state = self.state + 0x9E3779B97F4A7C15
 		var uint64 z = self.state
 		z = (z ^ (z >> 30)) * 0xBF58476D1CE4E5B9
@@ -54,7 +54,7 @@ pub mv struct Random {
 
 	// The next value in [0, bound). A bound of 0 returns 0. Slight modulo
 	// bias for very large bounds — irrelevant at demo scale.
-	pub func below = (ref self, uint64 bound, out uint64) {
+	pub func below = (ref self {}, uint64 bound, out uint64) {
 		if bound == 0 {
 			return 0
 		}
@@ -63,7 +63,7 @@ pub mv struct Random {
 
 	// The next value in [lo, hi], both ends inclusive. A hi <= lo
 	// returns lo.
-	pub func range = (ref self, uint64 lo, uint64 hi, out uint64) {
+	pub func range = (ref self {}, uint64 lo, uint64 hi, out uint64) {
 		if hi <= lo {
 			return lo
 		}

package/core/System/Set.nm

@@ -20,7 +20,7 @@ pub mv struct Set<T: Hashable + Equatable> {
 	var used = Buffer<int>()
 	var hashes = Buffer<int>()
 
-	pub func add = (ref self, mv T value) {
+	pub func add = (ref self { hashes, slots, used }, mv T value) {
 		var int cap = self.slots.cap
 		if cap == 0 {
 			cap = self.slots.alloc(8)
@@ -37,10 +37,12 @@ pub mv struct Set<T: Hashable + Equatable> {
 			self.used.store_u32(idx, 1)
 			// The value arrives owned (`mv T value`): a value-struct element
 			// moves into the fresh slot (store_take — the caller's storage is
-			// zeroed, no deep copy); a string's by-value pair keeps the
-			// deep-copying store (the caller still owns its buffer), and a
-			// class/trait handle is a pointer store either way.
-			if T_IS_VALUE_STRUCT {
+			// zeroed, no deep copy) when it OWNS resources; a non-owning value
+			// struct is a legal bare argument and keeps the copying store, a
+			// string's by-value pair keeps the deep-copying store (the caller
+			// still owns its buffer), and a class/trait handle is a pointer
+			// store either way.
+			if T_TAKES_OWNERSHIP {
 				self.slots.store_take(idx, value)
 			} else {
 				self.slots.store(idx, value)
@@ -98,7 +100,7 @@ pub mv struct Set<T: Hashable + Equatable> {
 		return self.slots.load(idx)
 	}
 
-	pub func remove = (ref self, T value) {
+	pub func remove = (ref self { hashes, slots, used }, T value) {
 		var int cap = self.slots.cap
 		if cap == 0 {
 			return
@@ -222,7 +224,7 @@ pub mv struct Set<T: Hashable + Equatable> {
 	// compares (values arrive unique — they came from a valid set). The old
 	// form re-inserted via `self.add(mv v)`, re-hashing every value and
 	// re-comparing values on every probed slot.
-	func rehash = (ref self, int new_cap) {
+	func rehash = (ref self { hashes, slots, used }, int new_cap) {
 		var Buffer<T> old_slots = mv self.slots swap Buffer<T>()
 		var Buffer<int> old_used = mv self.used swap Buffer<int>()
 		var Buffer<int> old_hashes = mv self.hashes swap Buffer<int>()

package/core/System/StableList.nm

@@ -40,7 +40,7 @@ pub mv struct StableList<T> {
 	// slab is always null, so its field destroy reclaims nothing.
 	var stage = Buffer<T>()
 
-	pub func push = (ref self, mv T value) {
+	pub func push = (ref self { chunks, items, stage }, mv T value) {
 		if self.items.cap == 0 {
 			self.items.alloc(256)
 		}
@@ -75,7 +75,7 @@ pub mv struct StableList<T> {
 	// and constructs the callee's result directly into the append slot
 	// (the in-place push contract). Byte-identical policy for extra=1: the same
 	// alloc/dir-grow/first-touch sequence push's inline branches performed.
-	internal func reserve = (ref self, int extra: extra >= 0, out int) {
+	internal func reserve = (ref self { chunks, items, stage }, int extra: extra >= 0, out int) {
 		if self.items.cap == 0 {
 			self.items.alloc(256)
 		}
@@ -93,7 +93,7 @@ pub mv struct StableList<T> {
 	// Calloc the directory chunk's slab on first touch (zero words mark
 	// empty chunks) — push's tail store and the in-place append both rely on
 	// the slab existing before a slot address is taken from it.
-	internal func ensure_chunk = (ref self, int dir_index) {
+	internal func ensure_chunk = (ref self { chunks, items, stage }, int dir_index) {
 		```
 		#arch: c
 		if (((unsigned long long*)self->chunks.data)[dir_index] == 0) {
@@ -130,7 +130,7 @@ pub mv struct StableList<T> {
 	// call's result straight through this address (sole ownership transfers
 	// into the slot — the chunk slab is calloc'd on first touch by
 	// `reserve`'s `ensure_chunk` before the slot address is taken).
-	internal func append_slot_ptr = (ref self, out ptr T) {
+	internal func append_slot_ptr = (ref self { chunks, items, stage }, out ptr T) {
 		```
 		#arch: c
 		unsigned long long idx = (unsigned long long)self->length;
@@ -236,7 +236,7 @@ pub mv struct StableList<T> {
 	// invalidation for this type, so the alias stays live and writes through
 	// it land in the list. The length constraint is the caller's proof
 	// obligation, exactly like `.at`.
-	internal func slot_ptr = (ref self, int i: i >= 0 && i < self.length, out ptr T) {
+	internal func slot_ptr = (ref self { items }, int i: i >= 0 && i < self.length, out ptr T) {
 		if i < self.items.cap {
 			return self.items.slot_ptr(i)
 		}
@@ -303,13 +303,13 @@ pub mv struct StableList<T> {
 	// nothing.
 	// (The old `stage` relay field is gone — push's tail path stores into
 	// the chunk through a `Buffer.init_view` view.)
-	func #destroy = (ref self) {
+	func #destroy = (ref self { chunks, items, stage }) {
 		self.destroy_tails()
 	}
 
 	// Raw: destroy directory chunks 1.. — per chunk, `filled` slots + the
 	// slab, via `T_buffer_destroy` on a cap=filled view.
-	internal func destroy_tails = (ref self) {
+	internal func destroy_tails = (ref self { chunks, items, stage }) {
 		```
 		#arch: c
 		long n_dir = (self->length - 1L) / 256L;