semantifold 0.3.0 → 0.4.0

package/docs/parser-qualification.md

@@ -16,7 +16,7 @@ The owning task must add a checked-in table row containing all of the following
 | parser behavior | Comment visibility plus explicit missing/error/recovery-node and malformed-input results |
 | Task 001–004 corpus | Every required declaration, block, statement, expression, type, identifier, literal, and call node; complete named/unnamed child traversal |
 | differential result | Official compiler command/version and acceptance comparison for community grammars; discrepancies enumerated |
-| repository audit | Proof that no generated archive, Git URL/tarball dependency, postinstall download, runtime fetch, or vendored parser binary entered the repository |
+| repository audit | Proof that no unqualified archive, mutable Git dependency, postinstall download, runtime fetch, or vendored parser binary entered the repository; an explicit parser-route amendment must identify any immutable source-archive exception |
 
 The record includes the exact corpus commands and hashes/paths, the installed dependency tree, and the tool output needed to reproduce the result. Any failure blocks that language task. It does not permit a source-text fallback, ignored recovery node, unrecorded parser substitution, runtime download, or softened test.
 
@@ -30,14 +30,55 @@ All Tree-sitter languages use the official `tree-sitter` Node binding. The langu
 | 017 | C# | official [`tree-sitter/tree-sitter-c-sharp`](https://github.com/tree-sitter/tree-sitter-c-sharp) grammar package | passed for exact `tree-sitter-c-sharp@0.23.5`; see the checked-in record below |
 | 018 | C | official [`tree-sitter/tree-sitter-c`](https://github.com/tree-sitter/tree-sitter-c) grammar package | legacy pair qualified inside the bundled root distribution below; source/target work remains blocked until that packaging correction is reviewed, green, merged, and verified |
 | 019 | C++ | official [`tree-sitter/tree-sitter-cpp`](https://github.com/tree-sitter/tree-sitter-cpp) grammar package | exact 0.23.4 qualified with the existing isolated 0.21.1 runtime; see Task 019 record below |
-| 020 | Rust | official [`tree-sitter/tree-sitter-rust`](https://github.com/tree-sitter/tree-sitter-rust) grammar package | blocked until the exact release record above passes |
-| 022 | Swift | community [`alex-pinkus/tree-sitter-swift`](https://github.com/alex-pinkus/tree-sitter-swift) candidate plus differential `swiftc` checks | candidate only; blocked until exact release and differential record pass |
-| 023 | Kotlin/JVM | community [`fwcd/tree-sitter-kotlin`](https://github.com/fwcd/tree-sitter-kotlin) candidate plus differential `kotlinc` checks | candidate only; blocked until exact release and differential record pass |
+| 020 | Rust | official [`tree-sitter/tree-sitter-rust`](https://github.com/tree-sitter/tree-sitter-rust) grammar package | exact 0.23.1 grammar qualified below and integrated in the existing private 0.21.1 runtime |
+| 022 | Swift | community grammar through the exact Semantifold packaging fork plus differential `swiftc` checks | Node/package/CST qualification and rebuilt-image Swift 6.3.3 compiler differential passed locally at merge commit `2a4515bb1d2d075c4c72a3466fbccb75f5269caf`; delivery gates remain separate |
+| 023 | Kotlin/JVM | community grammar through the exact Semantifold packaging fork plus differential `kotlinc` checks | passed for immutable tag `v0.4.0-semantifold.1`, commit `57c35ad1a80ccd2a0ebd8fffe852f0d13a20acd0`, ABI 14, Node24, and Kotlin/JVM 2.4.20; see below |
 | 024 | Go | official [`tree-sitter/tree-sitter-go`](https://github.com/tree-sitter/tree-sitter-go) grammar package | passed for exact `tree-sitter-go@0.25.0`; see the checked-in record below |
-| 029 | Dart | candidate selected and qualified by Task 029 | intentionally deferred |
+| 029 | Dart | exact public registry grammar plus differential Dart SDK checks | passed for `tree-sitter-dart-orchard@0.7.0`, Node 24/Tree-sitter 0.25.1, packed consumers, and exact Dart 3.13.3 Linux x64 format/analyze/VM/native acceptance |
 | 031 | Zig | candidate selected and qualified by Task 031 | intentionally deferred |
 
-Swift or Kotlin qualification failure leaves Task 022 or 023 blocked until its roadmap/source decision is explicitly revised. Parser archives produced by CI or release pages are not an alternative dependency route.
+Swift or Kotlin qualification failure leaves Task 022 or 023 blocked until its roadmap/source decision is explicitly revised. Parser archives produced by CI or release pages are not an alternative dependency route. Tasks022 and 023 record narrow amendments: the selected registry packages lack the required install-safe Node24 contract, so Semantifold uses full-SHA GitHub source archives from its public packaging forks rather than generated release assets or mutable Git references.
+
+## Task 029 Dart grammar qualification — 2026-09-15
+
+Task 029 rejects the old unscoped `tree-sitter-dart@1.0.0`: its grammar object is not accepted by the repository's exact `tree-sitter@0.25.1` binding. The first replacement candidate, `@driftlog/tree-sitter-dart@1.0.4`, passes parser API and CST checks but fails the mandatory clean-install dependency-tree gate by creating an extraneous `node_modules/@driftlog/node-addon-api` directory. Kasper authorized a narrow parser-route amendment on 2026-09-15. The selected replacement is exact public registry `tree-sitter-dart-orchard@0.7.0`; no Git/archive dependency, copied grammar, source-text fallback, compiler-output AST, vendored build, cleanup hook, or private package is used.
+
+The amendment considered every relevant public registry result observed on 2026-09-15:
+
+| Candidate | Result |
+| --- | --- |
+| `tree-sitter-dart@1.0.0` | Rejected: `Parser#setLanguage` reports `Invalid language object` with exact root `tree-sitter@0.25.1`. |
+| `@driftlog/tree-sitter-dart@1.0.4` | Rejected: clean install and packed consumer report extraneous generated `@driftlog/node-addon-api` dependency residue. |
+| `@sengac/tree-sitter-dart@1.1.6` | Rejected before install: it peers on `@sengac/tree-sitter@^0.25.10`, not the required root binding, and no immutable `v1.1.6` upstream tag resolves to npm `gitHead`. |
+| `@vokturz/tree-sitter-dart@1.0.0` | Rejected before install: package metadata says it is only for CodeGPT internals, peers on Tree-sitter 0.21, and supplies no verifiable repository/tag identity. |
+| `ast-grep-tree-sitter-dart@0.0.5`, `@ast-grep/lang-dart@0.0.7` | Rejected before install: ast-grep loaders with a `postinstall` setup contract, not native Node language objects for `tree-sitter@0.25.1`. |
+| `@plurnk/plurnk-mimetypes-grammar-dart@1.16.1`, `@lumis-sh/wasm-dart@0.26.3` | Rejected before install: WebAssembly-only packages for web-tree-sitter/host-specific loaders, not the required native Node binding. |
+| `tree-sitter-dart-orchard@0.7.0` | Selected: exact native Node registry package with clean graph, matching immutable annotated tag/commit, Task 001–005 CST coverage, and packed-consumer proof. |
+
+| Evidence | Qualified result |
+| --- | --- |
+| npm distribution | Exact `tree-sitter-dart-orchard@0.7.0`, registry tarball `https://registry.npmjs.org/tree-sitter-dart-orchard/-/tree-sitter-dart-orchard-0.7.0.tgz`, integrity `sha512-dO4hyC6eCz7tnXNWk7ZZ/CVzorvWQKRhxRYUT/uwAnA50m+4Jbogd1Oh33lPcj1/bP9wG1pS3TWQEfs1W3LFbg==`, SHA-1 `eb5c0f0b1d9f784fd292d84e6be6d1b951eab6fa`, 21 files, 424,008 compressed bytes and 8,695,564 unpacked bytes. |
+| upstream identity | [`grammar-orchard/tree-sitter-dart-orchard`](https://codeberg.org/grammar-orchard/tree-sitter-dart-orchard), immutable annotated tag object `v0.7.0` at `97d5d3608db84ee5b5c0efdaa227b62cfb7f9c09`, peeled commit and npm `gitHead` `9322cd5e1266c60983ae0ff921fbb4e77e903781`. Registry grammar, scanner, license, and `tree-sitter.json` match the tag byte-for-byte. Their SHA-256 values are `284c4fad3e9e267fbd593d6befbbbaa9998e90bf60163c241b95597ac5ca5a40`, `f3b455e7ff4f70ec6db93262b660041dc71e465531929354961d0ee56686c447`, `d270cb3a4985d75033bd77d875ccebff1d66e32788a3f727891e28d76132dd46`, and `7bc667f7779553e3a65f70e16e5af857963c2c8faf5891bbc6a2dcf0b1d7be7d`. |
+| generated release inputs | The immutable tag's release workflow pins Tree-sitter CLI `0.26.12`, runs `tree-sitter init`, `tree-sitter generate --abi 14`, tests the grammar, builds its Wasm distribution, and then publishes npm. The resulting registry parser C, Node declaration, and Node loader hashes are `04293ee18d82879f70b21b60632a831547de9b870e9987264bff869bac44af11`, `5a722dbeb8d141e49dbce4b78aee56ad4f552a86dc0b754a1b7f042768095830`, and `901a2db34556336f5ed44ea54bd2d649af1cdaa2bf848a1362f6d4fdeee53005`. Semantifold consumes only the registry package, not the upstream release archive or Wasm file. |
+| legal and registry provenance | Package metadata and the byte-identical shipped/tagged license both identify MIT. `npm audit signatures --json` reports no invalid or missing signatures in the fresh isolated graph. |
+| clean Node 24 install/load | Passed twice in a credential-free temporary package with an empty home, distinct empty user/global npm configuration, fresh caches, explicit public registry, Node 24.18.1, exact `tree-sitter@0.25.1`, and exact Orchard grammar: ordinary `npm install`, clean `npm ci`, and both `npm ls --all --json` results contain no `problems`. The graph contains only the two requested packages plus declared `node-addon-api@8.9.2` and `node-gyp-build@4.8.4`. The explicit shipped Node binding imports without warnings; `new Parser()`, `setLanguage`, parse, and indexed child/field traversal succeed. |
+| ABI, typed API, and lifecycle | The registry parser declares ABI 14, accepted by the root binding's ABI 13–15 range, and exposes 359 typed node descriptions. It ships declarations, `binding.gyp`, generated parser/scanner C source, Tree-sitter headers, and standard local build inputs. Its only install action is `node-gyp-build`; package scripts and load code contain no URL/downloader. No undeclared or extraneous package directory appears after install. |
+| corpus and complete traversal | The six checked-in Dart fixtures cover Tasks 001–005: arbitrary required positional signatures, scalar/void returns, initialized typed mutable and `final` locals, assignment, calls/arguments, print, bare/value returns, all scalar literals/operators, parentheses, nested/fallthrough/else-if conditionals, recursion, zero/one/three-argument calls, and comments. Traversal includes every named and anonymous child plus field names. Fixture hashes are recorded below. |
+| rejection visibility and coordinates | Directives, annotations, nullable/generic/optional/default syntax, inference, null-aware expressions, casts, await/async bodies, classes, constructors, interpolation, raw strings, and multiline strings remain present as CST nodes or exact literal leaves. Malformed braces, parameters, operands, strings, and semicolons propagate error/missing state. Astral text with CRLF and lone CR verifies binding UTF-16 indexes against explicit UTF-8 boundary conversion; source adapters preflight lone surrogates before parsing. |
+| official compiler differential | Exact `Dart SDK version: 3.13.3 (stable) (Tue Sep 1 01:07:17 2026 -0700) on "linux_x64"` passed offline pub restore, formatter verification, fatal-warning/info analysis, VM execution, native executable compilation, and native execution. Six Dart fixtures and representative PHP/Ruby/JavaScript/TypeScript/Java inputs preserve semantic meaning; VM/native outputs match for Unicode, eager call ordering, recursion, void calls, short-circuiting, and safe-integer boundaries. Every run uses fresh absolute HOME, PUB_CACHE, project, output, and TMPDIR paths, deterministic locale/timezone, suppressed analytics, an unreachable package host, and byte checks proving the two manifests and source remain unchanged. Compiler output is never used as an AST. |
+
+The retained corpus SHA-256 values are:
+
+| Corpus path | SHA-256 |
+| --- | --- |
+| `spec/fixtures/program.dart` | `e4e06faab4c539f16bdd712a8be40f53e3f1a4aef430ec021db3a4723762893b` |
+| `spec/fixtures/scalars/program.dart` | `96d02a48ebfc53362da4d963347909471428033164c0356a99fb866824441b5e` |
+| `spec/fixtures/locals/program.dart` | `738a1a8e41a51abc198ddc3978f77ddb784f2c3720e065d28a1d99073c49fc72` |
+| `spec/fixtures/operators/program.dart` | `ef0e6c233730b5776b2484d4abb6d3af6068a27e657933c646b30bba3dac0c04` |
+| `spec/fixtures/statements/program.dart` | `c5edc983553c50ce393563953927d1d18f0b0e33d10f4381f87f1e7645ee84e8` |
+| `spec/fixtures/functions/program.dart` | `64c7eaec72b624781c102a1a6740cbbbc653148f6778f4282e5b3c187ea4bd4c` |
+
+Run `npx velocious-test spec/dart-parser-qualification.spec.js` for retained Node/CST evidence, `npx velocious-test spec/tree-sitter-legacy-packed-consumer.spec.js` for ordinary-install plus clean-`npm ci` packed-consumer proof, and the individual `spec/dart-cross-language-acceptance.spec.js` and `spec/dart-native-execution.spec.js` files for the real SDK differential. All pass in the rebuilt canonical lane; review, exact-head CI, merge, and post-merge verification remain separate delivery gates.
 
 ## Task 016 Python qualification
 
@@ -96,7 +137,7 @@ npm pack tree-sitter@0.25.1 --dry-run --json
 npm pack tree-sitter-c-sharp@0.23.5 --dry-run --json
 ```
 
-The accepted C# corpus is `spec/fixtures/{Program.cs,scalars/Program.cs,locals/Program.cs,operators/Program.cs,statements/Program.cs}` with SHA-256 values, in that order: `5ca661d09dff2d775094df99b40e5c5604796c9bff4c32c1da11fa1b4c564a00`, `9cefd6d01c5855480629829489945f2f43338b84879c7a26043963151a8439da`, `ee775fea59ee812212ce325152e4e4cb79c20e699aba081bf39cc698b324444d`, `7137f4acc88dbdc1d0bafd6bb8eb57bed9386daf3e6b11c6fbae3831abceae18`, and `ba63cb72490605437e1efaa7d69ce0abdbfbb07c076aec787bc025e7a277468f`.
+The accepted C# corpus is `spec/fixtures/{Program.cs,scalars/Program.cs,locals/Program.cs,operators/Program.cs,statements/Program.cs}` with SHA-256 values, in that order: `a395bda51d7cd7713165da2d4477127f5d9c0b8ceef0cb7094d7baa9c37518b6`, `9cefd6d01c5855480629829489945f2f43338b84879c7a26043963151a8439da`, `ee775fea59ee812212ce325152e4e4cb79c20e699aba081bf39cc698b324444d`, `7137f4acc88dbdc1d0bafd6bb8eb57bed9386daf3e6b11c6fbae3831abceae18`, and `ba63cb72490605437e1efaa7d69ce0abdbfbb07c076aec787bc025e7a277468f`.
 
 ## Task 018 legacy C parser boundary qualification
 
@@ -104,7 +145,7 @@ The C grammar's compatible published runtime line cannot share Semantifold's roo
 
 | Evidence | Qualified boundary result |
 | --- | --- |
-| npm distribution | `tree-sitter@0.21.1`, integrity `sha512-7dxoA6kYvtgWw80265MyqJlkRl4yawIjO7S5MigytjELkX43fV2WsAXzsNfO7sBpPPCF5Gp0+XzHk0DwLCq3xQ==`; `tree-sitter-c@0.23.2`, integrity `sha512-9kADOx31AF94DHcrsMGW0zM/2LS6v7wFkPHPVm7RQU+vYVVZMKZ2FJ9e99pm5feqsAcjUzB9CarqDLgRT1Fe/w==`. npm's supported `file:` dependency plus repository-local `install-links=true` materializes the private internal package, and root `bundleDependencies` includes both that package and modern `tree-sitter`. Root `acceptDependencies` accepts only the exact private `0.1.0` payload already in the bundle, so consumers use ordinary `install-links=false`. No alias, override, forced peer, archive dependency, copied binding, or custom materialization stage is used. |
+| npm distribution | `tree-sitter@0.21.1`, integrity `sha512-7dxoA6kYvtgWw80265MyqJlkRl4yawIjO7S5MigytjELkX43fV2WsAXzsNfO7sBpPPCF5Gp0+XzHk0DwLCq3xQ==`; `tree-sitter-c@0.23.2`, integrity `sha512-9kADOx31AF94DHcrsMGW0zM/2LS6v7wFkPHPVm7RQU+vYVVZMKZ2FJ9e99pm5feqsAcjUzB9CarqDLgRT1Fe/w==`. npm's supported `file:` dependency plus repository-local `install-links=true` materializes the private internal package, and root `bundleDependencies` includes that package and modern `tree-sitter`. Root `acceptDependencies` retains only the exact private `0.1.0` payload; Task023's public Kotlin grammar is an ordinary unbundled full-SHA HTTPS archive dependency and does not change this legacy source or peer graph. No alias, override, forced peer, copied binding, or custom materialization stage is used. |
 | upstream identity | Official [`tree-sitter/node-tree-sitter`](https://github.com/tree-sitter/node-tree-sitter) tag/commit `v0.21.1` / `bbdba663dc0b8487f1212524a83a7c39e8a5c3ca`; official [`tree-sitter/tree-sitter-c`](https://github.com/tree-sitter/tree-sitter-c) tag/commit and npm `gitHead` `v0.23.2` / `6a4ae2e08916fd08e5739250bb64a14392b01c99`. |
 | legal and registry provenance | Both upstream packages declare MIT and publish registry signatures. Their exact registry URLs and integrities are recorded in `package-lock.json`; the repository gate verifies installed-package signatures and audits the ordinary dependency graph. The private internal package uses ISC and has no public registry identity. All three dependency licenses remain in the root tarball. |
 | ABI and API | `tree-sitter-c@0.23.2` declares language ABI 14; `tree-sitter@0.21.1` accepts ABI 13–14 and the grammar's peer is `^0.21.1`. The legacy binding provides `child(index)` and `fieldNameForChild(index)` but not the newer `fieldNameForNamedChild` convenience API. The adapter therefore traverses every ordered named and anonymous child and copies field names without exposing binding types. |
@@ -217,3 +258,75 @@ The initial qualification corpus is now retained verbatim in the repository (the
 | `spec/fixtures/cpp-qualification/corpus-5.cpp` | `a7524580af4881083d2fbf95f9a7b9f940320c2d2c35d3b188094598cca27f59` |
 
 Reproduce exhaustive frozen-edge traversal, coordinate and recovery checks with `npx velocious-test spec/cpp-parser-qualification.spec.js`. The generated Tasks001–004 fixtures are independently accepted by `spec/cpp-cross-language-acceptance.spec.js`; the small grammar probes above qualify CST coverage, not semantic acceptance or native compilation of a complete supported program.
+
+## Task 020 Rust grammar qualification — 2026-09-08
+
+This record precedes all Rust dependency edits. Qualification ran in an isolated scratch package on the canonical Ubuntu 26.04 container as UID/GID 1000:1000, Node v24.18.1 and npm 11.16.0. No repository manifest, lockfile, installed dependency payload, parser boundary or public language registry was changed. That historical grammar gate completed before integration; the subsequent qualified compiler and product contracts are recorded in [Rust](rust.md).
+
+| Evidence | Qualified result |
+| --- | --- |
+| Official registry release | `tree-sitter-rust@0.23.1`, `https://registry.npmjs.org/tree-sitter-rust/-/tree-sitter-rust-0.23.1.tgz`, integrity `sha512-wrMptzUAfbl3DbNrldZveyNM2CWmRw2VvEo2j/855qQbMMz4dlCF+TBwRN/1FL1S6cYvAEAJaCMesGqhocFJhQ==`. The scratch lock matches registry integrity and resolved identity exactly. |
+| Official upstream | [tree-sitter/tree-sitter-rust](https://github.com/tree-sitter/tree-sitter-rust/tree/v0.23.1), lightweight tag `v0.23.1` and npm gitHead both `48eef06e8d806413d9a617f4a3f4d3168c4e5918`. `git ls-remote` returned the tag directly at that commit. Installed LICENSE, grammar, parser/scanner C sources, binding.gyp and Node JavaScript/declaration files matched those seven upstream files byte-for-byte. |
+| License and signatures | MIT, with the license retained in the registry package. Fresh `npm audit signatures` verified six package signatures and one attestation across the installed graph. The Rust grammar advertises a registry signature, no npm attestation; its upstream identity and source bytes were therefore checked independently. |
+| Ordinary isolated graph | Exact Tree-sitter 0.21.1, C 0.23.2, CPP 0.23.4 and Rust 0.23.1 coexist, with node-addon-api 8.9.2 and node-gyp-build 4.8.4. Rust's peer `^0.21.1` is satisfied without override, force, alias, peer bypass or third runtime. Fresh ordinary install and `npm ls --all` passed. Empty user/global configs, fresh cache, public registry and removal of inherited npm configuration/token variables produced default `install-links=false`. |
+| ABI and actual Node API | Grammar ABI 14; the existing binding accepts ABI 13–14. Real ESM import, `setLanguage`, parse, every `child(index)` and `fieldNameForChild(index)` edge passed. Rust provides 273 node-type metadata entries. A strict NodeNext TypeScript consumer passed without casts or skipLibCheck. The binding declaration says absent fields are null, but native calls return undefined; the existing frozen schema already normalizes either absence to null. |
+| Lifecycle and package audit | Native packages declare only `install: node-gyp-build`; the relevant load/install JavaScript has no downloader. npm 11.16.0 reported unapproved install-script notices; actual loading used shipped Linux x64 prebuilds successfully. Source fallback was inspected, not compiled. The dry-run package inventory contains 27 files, 1,295,963 compressed / 14,096,588 unpacked bytes, including MIT license, declarations, native source fallback, platform prebuilds and upstream WASM. No parser archive, binary or vendored source entered this repository. |
+| Complete corpus | The seven checked-in probes below cover Tasks 001–004, all 18 typed operations' source shapes, exact typed free functions and main, initialized mutable/immutable locals, assignment, returns, braced nested/fallthrough/empty branches, direct and nested calls, `String::from`, clones, concatenation borrowing and exact print macro payloads. The support probe includes the candidate overflow methods, tuple/flag locals, exit calls and lint attributes strictly as proposed private support. Those shapes do not authorize arbitrary user tuples, attributes, macros or references. |
+| Traversal and rejection visibility | The accepted probes, six malformed samples and 15 excluded-syntax samples traversed 2,638 nodes (1,450 named / 1,188 anonymous), six extras, three ERROR nodes and three missing nodes. Every ordered child, field, token, node text and index boundary was recorded, including every nested macro token tree. The excluded samples retain references/lifetimes/pointers, patterns, traits/impl/types, modules/use, unsafe/extern, async/closures, const/static, match/loops/ranges/casts/indexing, turbofish, Result/Option/question-mark, panic/assert/unwrap/expect and custom macros for later fail-closed frontend validation. |
+| Coordinates and bounds | Every node boundary round-tripped through the existing UTF-8-byte-to-UTF-16 converter and independently matched native UTF-16 row/column coordinates. `/* 😀 */` plus CRLF places the next definition at UTF-16 10, UTF-8 12, native row 1 / column 0, semantic line 2 / column 1. Raw astral/BMP text, NUL/control/Unicode escapes and nested comments remain visible. Parsing succeeds at 32,767 UTF-16 units and throws `Invalid argument` at 32,768. |
+| Isolation and compiler status | One Node process parsed legacy Rust/C/CPP alongside modern Tree-sitter 0.25.1 / Go successfully. This is an official grammar, so no community-grammar compiler exception applies. At the initial grammar gate rustc/Cargo were absent. Subsequent coordinator no-cache builds qualified Rust/Cargo 1.98.1 on Ubuntu 26.04 and actual TensorBuzz Ubuntu 24.04 (11 crates/93 commands each, network disabled). Public integration now uses that pair and the exact Cargo-generated manifest/lock bytes; focused source/target, compiler differential and local cold-package tests are recorded in [Rust](rust.md). |
+
+| Corpus path | SHA-256 |
+| --- | --- |
+| `spec/fixtures/rust-qualification/base.rs` | `2388b7b1829e00300a7052141936800e5267cb61dba4ca910322434085618236` |
+| `spec/fixtures/rust-qualification/scalars.rs` | `690c59fec3f1f89b1c9ead6698b4395f87a062b98ed5ba4bfa5cc43b212254bb` |
+| `spec/fixtures/rust-qualification/locals.rs` | `9a7c52db338d0edaba8ecdc533c219b04dcbd05eb330c8e4c3c5ab822c788f2b` |
+| `spec/fixtures/rust-qualification/operators.rs` | `f039dc4c11a9f443dacd4a97d877411c49aaf3d7ff88d44147da3ae03fa899f2` |
+| `spec/fixtures/rust-qualification/statements.rs` | `415ef2ea7504108b518483e5c488ffc6c2f71b37bbc5da5e7058f5462f2a7743` |
+| `spec/fixtures/rust-qualification/scaffolds.rs` | `c4b71afd1cb30ec44161cea0dacfa74933110951096a24ac02e7978077e07dd4` |
+| `spec/fixtures/rust-qualification/coordinates.rs` | `57b2a3d893b987c9ca1751f56380039e20f6ca79880c364172dc4f56c5f66822` |
+
+Reproduce the supply-chain gate in an empty scratch package with credential-free public npm configuration:
+
+```sh
+npm install --save-exact tree-sitter@0.21.1 tree-sitter-c@0.23.2 tree-sitter-cpp@0.23.4 tree-sitter-rust@0.23.1
+npm config get install-links
+npm ls --all
+npm audit signatures
+npm pack tree-sitter-rust@0.23.1 --dry-run --json
+git ls-remote https://github.com/tree-sitter/tree-sitter-rust.git refs/tags/v0.23.1 'refs/tags/v0.23.1^{}'
+```
+
+The complete reproducible probe, typed consumer, fresh npm configuration, source comparisons, tree inventories and raw command results are retained under `/home/dev/.threadwire/semantifold/task020-20260908T091900Z-evidence/parser-probe` and its parent evidence directory. `probe.mjs`, `supply-chain.mjs` and `typed-api.mts` are qualification programs outside the shipped package. The first probe correctly failed its assumption that the native field API returned null; the corrected probe records the actual undefined result and the existing schema normalization. That investigation failure is not a production RED test. Focused public Rust specs subsequently recorded RED before runtime integration, source/backend behavior, ownership, tool discovery and generated-depth fixes. The original probe inventories remain unchanged; public integration preserves the same frozen schema and typed Node boundary.
+
+## Task 022 Swift grammar qualification — 2026-09-09
+
+The upstream community 0.7.1 grammar was retained, but its registry artifact did not provide the complete install-safe modern Node binding required by this repository. The parser route was therefore amended to the public Semantifold packaging fork at one immutable merge commit. This is a source archive identified by full SHA, not a mutable Git dependency, CI artifact, release-page archive, vendored parser, or runtime download.
+
+| Evidence | Qualified result |
+| --- | --- |
+| Distribution and integrity | Manifest URL `https://github.com/kaspernj/tree-sitter-swift/archive/2a4515bb1d2d075c4c72a3466fbccb75f5269caf.tar.gz`; root lock integrity `sha512-MoaFzZrwF8mYIiKbTcU4lUpIOXLz9NAuKZKUcM4xOYOgGIbQuP+jdeX5428pz0l7p8ggfiDeoY+yAv2krt4MRg==`. The installed package retains name/version `tree-sitter-swift@0.7.1`. |
+| Upstream and fork identity | Community upstream `alex-pinkus/tree-sitter-swift` 0.7.1 grammar; public packaging fork `kaspernj/tree-sitter-swift`, merge commit `2a4515bb1d2d075c4c72a3466fbccb75f5269caf`, human tag `v0.7.1-semantifold.1`. The full-SHA archive is the sole installation identity. |
+| License and lifecycle | MIT license retained. The package uses only `node-gyp-build`; package scripts contain no URL, fetch, curl, or wget route. No parser archive, generated source, native module, or `node_modules` payload is checked into Semantifold. |
+| ABI, payload, and typing | Grammar ABI 14 with peer `tree-sitter@^0.25.1`, satisfied by exact root 0.25.1. The package exposes `bindings/node/index.d.ts` and `nodeTypeInfo`; shipped inputs include `src/parser.c` (18,224,272 bytes), `src/scanner.c` (29,892 bytes), declaration (452 bytes), and loaded Linux x64 native binding (3,370,896 bytes). |
+| Node24 loading and CST | On Node24, ESM import, `Parser#setLanguage`, and deterministic exhaustive `child(index)` traversal pass. The five fixtures cover functions, unlabeled parameters, scalar annotations/literals, initialized `let`/`var`, assignment, calls, print, returns, every typed operator, and nested/one-armed/fallthrough conditionals. |
+| Recovery and coordinates | Malformed operands, braces, parameters, and strings expose propagated error, explicit error, or missing nodes. Conditional compilation and directive-bearing comments remain visible. Astral/CRLF probes distinguish UTF-8 bytes from binding indexes; every boundary is verified through the shared converter before one-based UTF-16 locations are emitted. Lone surrogates reject before parser adaptation. |
+| Compiler differential | Exact Swift 6.3.3 release for target `x86_64-unknown-linux-gnu` typechecked the original and generated five-profile corpus and ran generated artifacts in debug and `-O` modes after the canonical-image rebuild. |
+
+The accepted fixture hashes, in base/scalars/locals/operators/statements order, are `6b5548a722da3a94a7f26bf0590e6a7811c8b13b242dae328007471eac2fa075`, `5bc1fd210fb93ebf26abc7ed9d10c9d5c531d3d1c94e134b4215afa0ebc88a45`, `86bf2e710b19c1aeee55a65004e05af8cfde93fa4431408a606b30a22ed4d9f8`, `98a757c6c97a319e4a340beda099a826d3da6dda75917deb17a2dedc2224bb63`, and `abbf5a47fbebf3bee95fbdc06de23d22ca910cc3db5d423cd5fd556ceab2e936`. Run `npx velocious-test spec/swift-parser-qualification.spec.js` for the retained package/CST proof and `npx velocious-test spec/swift-native-execution.spec.js` for the compiler boundary.
+
+## Task 023 Kotlin/JVM grammar qualification - 2026-09-09
+
+The community grammar required an install-safe modern Node package boundary, so qualification selected the public Semantifold packaging fork at one immutable annotated tag. The dependency is a normal Git dependency over HTTPS, not a source archive, mutable branch, vendored parser, CI artifact, or runtime download.
+
+| Evidence | Qualified result |
+| --- | --- |
+| Distribution and immutable identity | Manifest and lock use the full-SHA HTTPS source archive `https://github.com/kaspernj/tree-sitter-kotlin/archive/57c35ad1a80ccd2a0ebd8fffe852f0d13a20acd0.tar.gz` with SHA-512 integrity. The same commit has annotated tag object `d3ad223359b8258294a5b3981f7e730d1d674210` for tag `v0.4.0-semantifold.1`; no Git or SSH resolution entry remains. |
+| License, package, and lifecycle | Installed `tree-sitter-kotlin@0.4.0` retains MIT. Its sole install action is `node-gyp-build`; package scripts contain no URL/curl/wget/fetch route. It ships `binding.gyp`, typed Node binding, `src/parser.c`, `src/scanner.c`, queries, and grammar metadata. No parser source, archive, native binary, or tool payload is checked into Semantifold. |
+| ABI and Node24 API | Grammar ABI 14 and optional peer `tree-sitter@^0.25.1` match exact root binding 0.25.1. ESM import, `Parser#setLanguage`, the real native binding, typed `nodeTypeInfo`, deterministic parse, and exhaustive `child(index)` traversal pass on Node 24.18.1. |
+| Coordinates and recovery | The binding reports UTF-16 code-unit indexes for JavaScript strings. Astral/CRLF probes distinguish them from UTF-8 bytes; the adapter verifies every boundary through the shared converter. Malformed operands and strings expose propagated error/missing nodes. Package headers and file annotations remain visible. Lone surrogates reject before adaptation. |
+| Tasks001-004 CST corpus | Five fixtures cover top-level functions/main, parameters and explicit scalar types, `val`/`var`, assignment, calls/arguments/printing, returns, all scalar literals/operators, nested/one-armed/fallthrough conditionals, comments, and named/anonymous leaves. Every modeled shape and every excluded child is consumed or rejected; no source scan supplies missing structure. |
+| Compiler differential | Exact development identity `info: kotlinc-jvm 2.4.20 (JRE 25.0.4+7-1-26.04-Ubuntu)` compiled original and regenerated fixtures with `-language-version 2.4 -api-version 2.4 -jvm-target 25 -Werror -include-runtime`, and OpenJDK 25.0.4+7 executed every JAR with exact output. The bootstrap admits only the qualified Ubuntu 24.04 or 26.04 compiler-reported suffix because it reflects the active image release, while TensorBuzz retains its exact Noble JDK package pin and exact `openjdk version "25.0.4" 2026-07-21` runtime assertion. Valid Kotlin outside the profile is deliberately rejected by the adapter. |
+| Packed consumer | The root tarball leaves the grammar unbundled and root `acceptDependencies` restricted to the exact private runtime. A fresh credential-free consumer resolves the full-SHA archive with lock integrity and passes install, full listing, clean `npm ci`, strict API typing, grammar loading, Kotlin round trip, and real JAR execution with no Git or SSH lock entry. |
+
+The accepted base/scalars/locals/operators/statements hashes are `b843c4672a3175fe75297f3692003cec0131eaee39e65ba1867f61e6184b0f05`, `42fd2c427a31d3d0b9427faf7781a7e7604399c370701203d06d2d54ceaea7f5`, `52b74e0e8dcca0f2baff9cddf1b035b0e31afa85edd5b7bf1e2dfb220967d615`, `90def0da9e20025e079d72b50722533d1f7223b1ba3cdbffa630b41c5fc9bc72`, and `bf4b05a00eafb1dbeaaabf7c2e7fea0cd8e034f4d3ff3b6e9fea177c31162aeb`. Run `npx velocious-test spec/kotlin-parser-qualification.spec.js`, `npx velocious-test spec/kotlin-native-execution.spec.js`, and the packed-consumer spec for the retained proof.

package/docs/plans/2026-09-05-standard-library-portability.md

@@ -2,7 +2,7 @@
 
 Date: 2026-09-05
 
-Status: dependency-ordered future plan; no implementation is claimed.
+Status: dependency-ordered plan; Tasks 032–036 are delivered, with Task 035 merged through PR #45 as `a2aad9d4932bfc6087adc4ff8bca43678c92413c` and Task 036 through PR #46 as `9aba48f9d48bcef4fd4c9275aec14bfcc4f0904c`. Task 037 implements its bounded Ruby-to-PHP TCP slice on the current topic branch; review, exact-head CI, and merge remain.
 
 ## Goal and architecture reference
 
@@ -10,18 +10,18 @@ Deliver the first bounded proof of the [standard-library portability architectur
 
 ## Why semantic prerequisites come first
 
-The current `semantifold@0.2.0` IR cannot express imports, general signatures, receiver calls, classes, loops, optional EOF, typed failures, resource identities, ownership, or close effects. Encoding a socket facade before those meanings exist would push language behavior into parser adapters, emitters, or handwritten source-to-target bridges. That would make evaluation order, EOF, failure, and lifetime accidental and prevent other facades/providers from sharing the work.
+The published `semantifold@0.3.0` package cannot express the full set of imports, receiver calls, reference classes, condition-controlled loops, optional EOF, typed failures, resource identities, ownership, and close effects required by this plan. The current source tree has since delivered Task 032's general loop/control foundation, Task 033's bounded single-module reference classes and receiver calls, Task 034's compiler-authorized effect/resource foundation, Task 035's versioned canonical contracts, target provider registry, negotiation, protected linking, and tree-shaken artifacts, and Task 036's generic facade-resolution layer with neutral test definitions. Task 037 now implements the concrete bounded socket behavior on its topic branch.
 
 The sequence therefore establishes general language semantics first, then defines capability/provider infrastructure, and only then adds a facade and concrete network slice. Numerical task order records this dependency flow; it is not a promise that the work is complete or immediately scheduled.
 
 ## Dependency-ordered sequence
 
-1. Complete existing prerequisites [Task 004](../../todo/004-statement-sequencing-and-conditionals.md) and [Task 005](../../todo/005-general-function-signatures-and-calls.md), then add [Task 032 — condition-controlled loops and break/continue](../../todo/032-condition-controlled-loops-and-break.md). This supplies a general strict-Boolean loop model without recognizing stdlib-specific read-loop idioms.
-2. Complete [Task 009](../../todo/009-closed-records-and-member-access.md), then add [Task 033 — reference classes, methods, and constructors](../../todo/033-reference-classes-methods-and-constructors.md). Executable facades need bounded nominal reference identity, private state, construction, and receiver calls; immutable records alone are insufficient.
-3. Build on optionals, typed failures, and reference classes with [Task 034 — effectful capabilities and resource lifetime](../../todo/034-effectful-capabilities-and-resource-lifetime.md). It defines explicit host effects, resource ownership, deterministic close, and typed failure boundaries without claiming async, concurrency, `finally`, or RAII.
-4. Build project/module and effect foundations into [Task 035 — versioned standard-library contracts and provider linking](../../todo/035-versioned-standard-library-contracts-and-provider-linking.md). This owns canonical capability modules, provider registry/negotiation, protected native bindings, transactional linking, and tree-shaking.
-5. Add [Task 036 — language compatibility stdlib/facades](../../todo/036-language-compatibility-stdlib-facades.md). It owns proved stdlib identity, executable source-language facades, collision-safe target names, and same-language recursion isolation.
-6. Combine the loop and facade branches in [Task 037 — blocking TCP client stdlib vertical slice](../../todo/037-blocking-tcp-client-stdlib-vertical-slice.md). This is the first concrete proof, not a general networking or all-language milestone.
+1. [Task 004](../../todo/004-statement-sequencing-and-conditionals.md), [Task 005](../../todo/005-general-function-signatures-and-calls.md), and [Task 032 — condition-controlled loops and break/continue](../../todo/032-condition-controlled-loops-and-break.md) are delivered. Task 032 supplies a general strict-Boolean loop model without recognizing stdlib-specific read-loop idioms.
+2. [Task 009](../../todo/009-closed-records-and-member-access.md) is delivered. Task 033 was delivered through PR #43 at exact head `98a9fa5bb1048fbe44e798acdefd65b9d6d2560e` and merge commit `f2e7f44aa8065f785c314b66e1f1d55992b7c998`. Its bounded nominal reference identity, private state, construction, and receiver calls are single-module semantics; immutable records alone are insufficient for executable facades.
+3. [Task 034 — effectful capabilities and resource lifetime](../../todo/034-effectful-capabilities-and-resource-lifetime.md) is delivered through PR #44, merged as `c15e0874c054b6c462304eb29538d72ed43829d6`. It defines explicit compiler-authorized host effects, resource ownership, deterministic close, and typed failure boundaries without claiming async, concurrency, `finally`, RAII, versioned canonical contracts, or provider linking.
+4. [Task 035 — versioned standard-library contracts and provider linking](../../todo/035-versioned-standard-library-contracts-and-provider-linking.md) is delivered through PR #45 and merge `a2aad9d4932bfc6087adc4ff8bca43678c92413c`. It owns canonical capability modules, the provider registry, negotiation, protected native bindings, transactional linking, and tree-shaking.
+5. [Task 036 — language compatibility stdlib/facades](../../todo/036-language-compatibility-stdlib-facades.md) is delivered through PR #46 and merge `9aba48f9d48bcef4fd4c9275aec14bfcc4f0904c` with a bounded neutral original-five qualification corpus. It owns proved stdlib identity, executable source-language facades, collision-safe target names, and same-language recursion isolation without taking Task 037 behavior.
+6. [Task 037 — blocking TCP client stdlib vertical slice](../../todo/037-blocking-tcp-client-stdlib-vertical-slice.md) implements the first concrete Ruby-source-to-PHP-target proof on its topic branch. It is not a general networking or all-language milestone.
 
 The direct dependency chain is also recorded in the [roadmap graph and task index](../../todo/README.md). Phase S stays non-blocking until its prerequisite tasks are delivered; it must not distort the existing language/platform lanes.
 
@@ -39,8 +39,8 @@ Acceptance starts a real local ephemeral TCP server controlled by the test. Gene
 
 Negative acceptance covers unresolved or shadowed `TCPSocket` or `puts`, monkey-patching/reopening, dynamic require/lookup, unsupported APIs/options, excluded multi-argument/array/coercive/custom-separator `puts` behavior, missing provider capabilities, namespace collisions, version mismatch, and late provider/link failure. Every failure occurs before partial artifact exposure.
 
-## Delivery discipline for future implementation
+## Delivery discipline
 
 Each behavior task must add focused specs, exact public contracts, documentation, and a changelog fragment. Runtime-generation coverage must invoke the real required tools and a real local socket; source snapshots are insufficient. Implementations must validate and return deterministic complete artifact sets, retain semantic/synthetic provenance, and fail if a required tool is unavailable.
 
-This planning change itself adds no compiler/runtime behavior, dependency, generated output, spec, or changelog fragment. It does not trigger release, CI topology, external task mutation, or implementation of the listed tasks.
+The plan itself adds no compiler/runtime behavior or implementation authority. Tasks 032–036 are delivered, and Task 037's implementation candidate is recorded by its owning task and documentation. Neither this plan nor those implementations trigger release, CI-topology changes, external task mutation, or expansion beyond the bounded TCP slice.

package/docs/rust.md

@@ -0,0 +1,88 @@
+# Rust source and Cargo target
+
+Task020 registers `rust` as a frontend and a three-artifact native text backend for Tasks001–004. The official grammar passed [isolated qualification](parser-qualification.md#task-020-rust-grammar-qualification--2026-09-08) before dependency integration. The compiler pair subsequently passed real offline qualification on both the canonical development image and TensorBuzz's actual Linux base. Local product acceptance is recorded separately below; review, exact-head TensorBuzz CI, merge and post-merge verification remain coordinator-owned delivery gates.
+
+## Qualified build-time toolchain
+
+The repository Dockerfile and TensorBuzz setup select the official Rust **1.98.1** distribution dated **2026-09-03**, host **x86_64-unknown-linux-gnu**, installed under `/opt/rust-1.98.1`. They install only the compiler, host standard library and matching Cargo components using the upstream standalone installers. `/usr/local/bin/rustc` and `/usr/local/bin/cargo` point into that prefix. There is no rustup, home installation, automatic toolchain selection, project dependency installation or runtime download.
+
+| Component | Official distribution SHA-256 |
+| --- | --- |
+| `rustc-1.98.1-x86_64-unknown-linux-gnu.tar.xz` | `e974f036b28565f37c0f3bd92ddefa809bee16c04f9dcf07b9ed96e05aaaf7c4` |
+| `rust-std-1.98.1-x86_64-unknown-linux-gnu.tar.xz` | `fa3ff450172a16c026944030230c5069947af93c728d9179971d44e5e0cfb561` |
+| `cargo-1.98.1-x86_64-unknown-linux-gnu.tar.xz` | `ea1de9f9e23107d97ee2b41a72c552f34064a593da503789218387aee59f3ba4` |
+
+All URLs use `https://static.rust-lang.org/dist/2026-09-03/` followed by the filename above. Hashes agree between the official component sidecars and [versioned channel manifest](https://static.rust-lang.org/dist/channel-rust-1.98.1.toml). The manifest SHA-256 is `a7c8774a5fd8441c997d94c029776cbc5eb111e9d72ab5d256fa69866644347e`, independently checked against its official sidecar. Image setup checks archive bytes before extraction and requires the exact executable identities below.
+
+| Identity | Observed qualified identity |
+| --- | --- |
+| rustc | `rustc 1.98.1 (48a229cea 2026-09-01)`; full commit `48a229ceaefd4985c50990b14116b6d856af0985` |
+| Cargo | `cargo 1.98.1 (797e8a9bc 2026-08-05)`; full commit `797e8a9bca276c1c9f9f738d2a20f484fa4eea9d` |
+| host | Both verbose version reports must identify `x86_64-unknown-linux-gnu` |
+| sysroot | `/opt/rust-1.98.1` |
+
+The Rust annotated tag `1.98.1` is object `18ed059b1465ce6195154de3250a668f1dd3b1fa`, peeled to the compiler commit above. Its Cargo submodule points to the Cargo commit above. The channel manifest's Cargo library version `0.99.0` is not the executable version: [Cargo's version implementation](https://github.com/rust-lang/cargo/blob/797e8a9bca276c1c9f9f738d2a20f484fa4eea9d/src/cargo/version.rs) uses the bootstrap release identity for the CLI. Both image probes confirmed these actual executable versions and commits.
+
+Rust and Cargo are distributed under `MIT OR Apache-2.0`, with third-party notices described by the [Rust COPYRIGHT record](https://github.com/rust-lang/rust/blob/1.98.1/COPYRIGHT). Upstream installers retain their distribution license files. Only checked-in configuration and evidence text enter Semantifold; compiler distributions are image build inputs, never npm dependencies or repository archives. See [official standalone installation guidance](https://forge.rust-lang.org/infra/other-installation-methods.html).
+
+The development base remains the existing pinned Ubuntu 26.04 image. The retained actual TensorBuzz qualification identifies `peakflow/base-ubuntu-24-04@sha256:9b23d3d5f82a8babb312b7ce549e02d60a6f32344b0088b90d3f486a9d8207a5` (Ubuntu 24.04 Noble). The coordinator verified that actual base and completed no-cache builds on both bases, followed by 11 fresh crates and 93 commands per base with networking disabled. All qualified source/manifest/lock bytes and executable hashes matched across bases; Cargo's verbose OS line was checked separately for Ubuntu 24.04 and 26.04. The same canonical development lane was then replaced reversibly, preserving its full home and task-owned source. No runtime tool installation occurred.
+
+## Fixed Cargo contract
+
+The generated crate uses edition **2021**, `rust-version = "1.98.1"`, a fixed dependency-free package, and identical `overflow-checks = true` / `panic = "abort"` settings in dev and release. There is no claim of an earlier minimum supported compiler. Cargo 1.98.1 generated the qualified format-4 lockfile. The 242-byte manifest SHA-256 is `1355468ebe077f03f1de9f990f243721c0e426a4448d6205ab3540cb2d2f7265`; the 165-byte lock SHA-256 is `185a41f6648ef49c8e7721f3321604abf05fae11c7007f823121c17fe48eec64`. Both include a final LF. These exact bytes are emitted without invoking Cargo during generation.
+
+Each accepted fresh crate passes `cargo check --offline --locked`, debug and release builds, and `cargo run --offline --locked --quiet` in both modes. Separate direct binary execution distinguishes compiler diagnostics from runtime stdout/stderr/status. Input source, manifest and lockfile hashes must remain unchanged. An empty isolated Cargo home and explicit compiler path prevent ambient Cargo/Rust configuration from selecting another toolchain; qualification runs with Docker networking disabled after image construction. A dependency requiring network resolution must fail. See [Cargo's offline and locked contract](https://doc.rust-lang.org/cargo/commands/cargo-run.html) and [profile settings](https://doc.rust-lang.org/cargo/reference/profiles.html).
+
+The narrow semantic profile remains Tasks 001–004: `i64`, `bool`, owned UTF-8 `String`, two explicitly typed by-value parameters, explicit returns, initialized typed locals, assignment and braced conditionals. Generated clones preserve scalar value copies; source move validation independently rejects later reads of moved values. Borrow, clone, print, string and overflow support collapse only after exact complete CST/token validation. Marker comments confer no authority. There are no semantic ownership/reference/Result/exception nodes.
+
+Rust's [left-to-right operand evaluation](https://doc.rust-lang.org/reference/expressions.html#evaluation-order-of-operands) permits direct emission for ordinary operands and calls; Boolean operators retain native short-circuiting. Checked arithmetic uses `i64::overflowing_add/sub/mul/neg`, a private overflow flag and process exit 70 with exactly `semantifold: integer overflow\n` on stderr, matching the existing C/CPP boundary. Known out-of-range operations reject before emission. Safe-integer source literals remain unchanged. Host allocation, stack and output failures remain host failures, not portable exceptions; panic abort prevents unwinding and must never approximate semantic control flow.
+
+The native qualification probe covered all task profiles, owned Unicode/NUL values, repeated reads and mutation, order and short-circuiting, signed extrema, each overflow exit in both modes, compiler rejection of an illegal move, and offline rejection of an uncached dependency. Raw per-base results are retained under `/home/dev/.threadwire/semantifold/task020-20260908T091900Z-evidence/toolchain-{resolute,noble}/results.json`; `toolchain-both-bases.json` reconciles identities and all 186 commands. The qualified executable SHA-256 values are rustc `859254978c0a0402c32f949f6de0d99aee73be8d15f45aac00ae1448aac51e74` and Cargo `da77c8b33849312255ccde3179198ada4c8deb370488d050286146b1d1b27e14`.
+
+## API and exact source spelling
+
+```js
+import {generateArtifactSet, parse} from "semantifold"
+
+const module = parse({language: "rust", filename: "input.rs", source: `
+fn semantifold_print_string(value: String) { println!("{}", value); }
+fn join(left: String, right: String) -> String {
+    let saved: String = left.clone();
+    return saved + &right;
+}
+fn main() { semantifold_print_string(join(String::from("é"), String::from("😀"))); }
+`})
+const crate = generateArtifactSet({language: "rust", module})
+```
+
+The ordered paths are always `Cargo.toml`, `Cargo.lock`, `src/main.rs`; roles are `manifest`, `support`, `entry`. The synthetic package is `semantifold-generated` version `0.0.0`, `publish = false`, `build = false`. It has no dependency, feature, workspace, build script or proc macro. Manifest and lock have synthetic provenance related to the module. The entry has rich range mappings and a Source Map v3 with original source content. Single-text APIs fail with `UNSUPPORTED_ROLE`. The only accepted filename override is `src/main.rs`; map directives and map filenames are unsupported. Generation validates the entire IR and all target collisions before returning any artifact and performs no filesystem or compiler work.
+
+Only ASCII ordinary identifiers are supported. Edition-2021 keywords, `_`, `main`, `String`, `std`, `i64`, `bool`, and the `semantifold_` namespace are protected in all user declaration/reference positions. Names such as `gen` and `macro_rules` remain legal ordinary bindings in this fixed edition and are tested with the actual compiler. Raw identifiers and user dispatch are outside the profile.
+
+Integers use canonical unsigned decimal spelling with the exact `i64` suffix, up to the existing safe-integer literal bound; negatives use unary `-`. Hex/octal/binary forms, digit separators, inferred or alternative suffixes are rejected. Booleans use `true` and `false`. Strings use exact `String::from("…")`, with Unicode scalar text and checked `\0`, `\n`, `\r`, `\t`, escaped slash/quotes, ASCII-only two-digit `\xNN`, or scalar `\u{hex}` escapes. Raw/byte strings, multiline content, continuation escapes and lone surrogates are unsupported. Generated controls, NUL, DEL and U+2028/U+2029 use canonical Unicode escapes; native stdout preserves UTF-8 bytes and appends one LF.
+
+Crate-root free functions have exactly two required explicitly typed by-value scalar parameters, explicit scalar return types and explicit return statements. Parameters are semantically immutable. Locals require an initializer and explicit type; `let` is immutable and `let mut` mutable. Simple assignment, every existing scalar unary/binary operator, braced `if`/`else if`/`else`, and parameterless `fn main()` are supported. Tail returns, destructuring, inferred types, references/raw pointers/lifetimes, traits/generics/user types/modules/use/impl/type items, unsafe/extern, closures/async, const/static, match/loops/ranges/casts/indexing, custom dispatch, turbofish, arbitrary macros/attributes, Result/Option/question-mark, panic/assert/unwrap/expect/catch_unwind and main returning Result are rejected.
+
+Only exact `.clone()` on a supported String expression and `+ &` borrowing for a String concatenation operand are source scaffold exceptions. String comparisons borrow operands implicitly. Calls consume String arguments left-to-right; copying a local requires its explicit source clone when later use would otherwise be invalid. Returning a final owned value may move it. Validation tracks moves, temporary comparison borrows, conditional evaluation and continuing branch states separately from IR. For example, moving `left` into a call and later reading it, or `left == take(left, right)` while the left comparison borrow remains active, is rejected at the original use. Reassignment can restore a mutable moved binding. Generated clones preserve value copies without changing these source rules.
+
+Prints call exact private scalar helpers. Those definitions contain one fixed `println!("{}", value)` token shape. Overflow helpers use exact `overflowing_*`, tuple flag checks and fixed exit behavior. Every named/anonymous/extra/error/missing child and macro token is accounted for; altered helpers, doc attributes, duplicate helpers, lookalikes and marker-only comments fail. Ordinary inert comments, including nested block comments, may be omitted after traversal. Generated lint support permits only exact benign unused/dead-code/parenthesis, unconditional-recursion and mixed-case-name warnings; this prevents Cargo warning replay from contaminating otherwise valid runtime output. It does not allow unsafe code or catch failures.
+
+## Limits and acceptance
+
+The qualified legacy parser accepts at most 32767 UTF-16 code units, including generated support. Exhaustive CST traversal is bounded to 512 levels. The backend measures the actual emitted syntax depth as well as byte-independent UTF-16 length, so nested clone/borrow/call wrappers cannot produce a source file outside that contract. Cycles, malformed late nodes, excessive expanded occurrences, impossible known string allocations and known out-of-range integer operations reject transactionally. Host allocation/stack exhaustion and stdout/stderr failures remain host failures; the exact print macro can abort on a host output failure. No panic, Result or exception represents semantic control flow.
+
+With the generated artifacts materialized in a fresh directory, acceptance runs:
+
+```sh
+cargo check --offline --locked
+cargo build --offline --locked
+cargo run --offline --locked --quiet
+cargo build --offline --locked --release
+cargo run --offline --locked --quiet --release
+```
+
+Tests also execute each built binary directly, distinguish build diagnostics from runtime output, require exact stdout/stderr/status and compare all artifact hashes before and after. `SEMANTIFOLD_RUSTC` and `SEMANTIFOLD_CARGO` select absolute discovery overrides. Discovery rejects absent/swapped/unsupported tools, wrong commits and foreign hosts. Test commands use an empty isolated Cargo home, explicit discovered compiler and `CARGO_NET_OFFLINE=true`; a fresh uncached dependency fails without resolving a network package.
+
+Focused product specs cover Tasks001–004 round trips, all 18 operations, strings and ownership, branch/order/divergence behavior, both build modes and every overflow, real rustc E0382/E0505 source rejection, native execution at the generated nesting boundary, malformed IR/helper adversaries, deterministic artifacts and rich/V3 forward/reverse mappings around Unicode. Rust fixtures execute in all original-five native targets, and one original-five source per profile executes in Rust in both modes. Task025 owns the expanded-cohort matrix.
+
+The root packed-consumer proof repeats ordinary npm install and clean npm ci with separate fresh caches, empty configuration files, default install-links=false, isolated modern/legacy runtimes, strict TypeScript and native offline Rust in both modes. The local lane still has the complete home mounted: this proves cleaned-environment behavior, not the external source/home/auth-free boundary. Disposable acceptance inputs and exact local evidence are prepared for the coordinator to run across that boundary before delivery. Local testing uses individual focused files sequentially; TensorBuzz owns full/native aggregate acceptance.

package/docs/source-maps.md

@@ -8,11 +8,11 @@ Semantifold keeps one authoritative, language-neutral provenance chain:
 generated UTF-16 range -> semantic node/symbol -> original UTF-16 range
 ```
 
-This works for PHP, Ruby, JavaScript, TypeScript, Java, Python, C#, and Go inputs and mapped text outputs. It is not limited to JavaScript `sourceMappingURL` comments. `SemantifoldMapping` v1 is the authoritative range model; every generated program artifact also includes an ECMA-426/Source Map v3 projection for existing tooling.
+This works for every supported source language and mapped text output. It is not limited to JavaScript `sourceMappingURL` comments. `SemantifoldMapping` v1 is the authoritative text range model; mapped text artifacts also include an ECMA-426/Source Map v3 projection. Binary outputs use the separate byte mapping below.
 
 ## Parsing and semantic provenance
 
-`parse()` preserves the existing `location.filename/start/end` shape. Lines and columns are one-based, ranges are half-open, and offsets and columns count UTF-16 code units. CRLF is one line break, a lone CR is one line break, and astral characters occupy two columns and offsets. A CRLF start-of-line coordinate resolves after both code units; the interior offset remains a unique position on the preceding line rather than aliasing the next line. Source content and its original newlines are preserved exactly.
+`parse()` preserves the existing `location.filename/start/end` shape. Lines and columns are one-based, ranges are half-open, and offsets and columns count UTF-16 code units. CRLF is one line break, a lone CR is one line break, and astral characters occupy two columns and offsets. A CRLF start-of-line coordinate resolves after both code units; the interior offset remains a unique position on the preceding line rather than aliasing the next line. Source content and its original newlines are preserved exactly. Function, record, and field symbol records additionally expose `semanticDeclarationId`, matching their `function:N`, `record:N`, or `record:N:field:N` semantic identity; generated reference spans continue to use the ordinary canonical symbol ID.
 
 Parsed modules additionally have a JSON-safe `provenance` value:
 
@@ -33,10 +33,12 @@ module.provenance // {
 // }
 ```
 
-Node IDs follow deterministic semantic occurrence order, node paths are JSON Pointers, and symbol IDs identify validated function, parameter, and local bindings. Reusing one caller-assembled semantic object at multiple paths produces one record and identity per occurrence rather than overwriting earlier paths; generation selects shared signature and local type occurrences by their current path in every backend. Object-only provenance queries remain intentionally unambiguous and require an ID when the object occurs more than once. Declaration records and resolved identifier/call records share a symbol ID. `ranges` contains parser-owned semantic tokens such as `name`, `type`, `callee`, `literal`, and `operator`. Babel identifier ranges use token offsets, including the complete source spelling of escaped identifiers while excluding TypeScript annotations. Parser AST/CST values never enter the public object.
+Node IDs follow deterministic semantic occurrence order, node paths are JSON Pointers, and symbol IDs identify validated record, field, function, parameter, and local bindings. Reusing one caller-assembled semantic object at multiple paths produces one record and identity per occurrence rather than overwriting earlier paths; generation selects shared signature and local type occurrences by their current path in every backend. Object-only provenance queries remain intentionally unambiguous and require an ID when the object occurs more than once. Declaration records share a symbol ID with resolved type/construction references, member reads, identifier reads/writes, or calls as applicable. `ranges` contains parser-owned semantic tokens such as `name`, `type`, `record`, `member`, `callee`, `literal`, and `operator`. Babel identifier ranges use token offsets, including the complete source spelling of escaped identifiers while excluding TypeScript annotations. Parser AST/CST values never enter the public object.
 
 Each semantic node also carries its own JSON-safe `sourceProvenance` record. That object association—not an array position, old JSON Pointer, or caller-controlled ID—is the source of provenance after a semantic transformation. Reordering, inserting, deleting, serializing, or cloning nodes therefore moves their source ranges with them. Generation rebuilds current paths and registry-local node/symbol IDs; cloned nodes receive distinct generated identities even when they intentionally share one original origin.
 
+`parseProgram()` rebases every module onto one complete caller-order source registry. Program import/export nodes retain their parser declaration origin plus available `declaration`, `path`, `importedName`, `localName`, and `exportedName` token roles. Each generated module artifact rebuilds occurrence paths including `/imports/N` and `/exports/N`; target-native import names and paths therefore map back to the correct original header tokens even when the target uses a different qualified spelling. Synthetic module/package wrappers remain explicitly synthetic with related module context.
+
 Origins are a closed union:
 
 ```js
@@ -68,7 +70,7 @@ artifact.sourceMap     // encoded Source Map v3 object
 artifact.sourceMapFilename
 ```
 
-Default filenames for single-text targets are `program.php`, `program.rb`, `program.js`, `program.ts`, `Main.java`, and `program.py`. Defaults apply only when `filename` or `sourceMapFilename` is omitted (`undefined`); an explicitly supplied `null` remains invalid. Java artifacts may include directories but must retain the basename `Main.java`, matching the generated public class and making the returned filename directly compilable; any other basename is a located `UNSUPPORTED_CAPABILITY` diagnostic for the Java backend. Python artifacts likewise may include directories but retain the deterministic basename `program.py`; Python adds no package, environment, requirements, or dependency metadata. C# is available only through `generateArtifactSet()`: `filename` must be omitted or exact `Program.cs`, and `mapDirective`/`sourceMapFilename` must be omitted. It returns mapped `Program.cs` first and a fixed synthetic `Semantifold.csproj` manifest second. Go also requires `generateArtifactSet()`: `filename` must be omitted or exact `main.go`, mapping options must be omitted, and generation returns fixed synthetic `go.mod` first followed by mapped `main.go`. `sources` may supply exact content for legacy or caller-assembled multi-source IR:
+Default filenames for single-text targets include `program.php`, `program.rb`, `program.js`, `program.ts`, `Main.java`, `Program.kt`, `program.py`, `program.cpp`, and `program.swift`. Defaults apply only when `filename` or `sourceMapFilename` is omitted (`undefined`); an explicitly supplied `null` remains invalid. Java artifacts may include directories but must retain the basename `Main.java`. Kotlin is stricter: its only accepted path is exact `Program.kt`, matching the runnable-JAR recipe; alternate filenames, map directives, and alternate map names are located `UNSUPPORTED_CAPABILITY` diagnostics. Python artifacts may include directories but retain `program.py`. C# is available only through `generateArtifactSet()`: `filename` must be omitted or exact `Program.cs`, and `mapDirective`/`sourceMapFilename` must be omitted. It returns mapped `Program.cs` first and fixed synthetic `Semantifold.csproj` second. Go likewise returns fixed synthetic `go.mod` before mapped `main.go`. Dart returns fixed synthetic `pubspec.yaml` and `pubspec.lock` before mapped `bin/program.dart`; it accepts only that exact entry path and no map-directive or map-filename override. `sources` may supply exact content for legacy or caller-assembled multi-source IR:
 
 ```js
 generateArtifact({
@@ -81,7 +83,7 @@ generateArtifact({
 })
 ```
 
-`generateArtifactSet()` wraps this exact result for the six single-text targets and supplies one generated entry artifact, plus the referenced serialized mapping artifact when an external JavaScript-family directive is requested. For C#, it transactionally returns exactly `Program.cs` (role `entry`, `text/x-csharp`, rich/v3 text provenance) and `Semantifold.csproj` (role `manifest`, `application/xml`, synthetic provenance with the module's canonical root origin as a related origin). For Go it transactionally returns `go.mod` (role `manifest`, `text/plain`) before `main.go` (role `entry`, `text/x-go`, rich/v3 text provenance). The manifest is the exact LF-terminated module `example.com/semantifold/generated` with `go 1.26.0`; its source-free configuration provenance relates back to the module root, and the dependency-free module needs and produces no `go.sum`. `createGeneratedArtifactSet()` validates these and other single-module target shapes without introducing Task 010's source-project semantics. Its dense artifact array preserves caller/backend order and requires unique safe relative POSIX paths without file/directory prefix collisions, non-empty text or bytes, media types, one of `entry`/`source`/`manifest`/`support`/`mapping`/`resource`/`loader`, generated ownership, provenance, and exactly one entry. Binary storage remains private and every `content` read returns a detached `Uint8Array`, so mutations cannot alter the validated artifact or drift from byte provenance. Backends return no iterable or partial files: the complete set is validated before it becomes observable. Generation and set construction never write files.
+`generateArtifactSet()` wraps every single-text result in one generated entry artifact, plus the referenced serialized mapping artifact when an external JavaScript-family directive is requested. Kotlin's set additionally carries deeply frozen compiler/run metadata for exact Kotlin 2.4, API 2.4, JVM target 25, `-Werror`, runnable `Program.jar`, and `java -jar`; the metadata is configuration, not another generated file. For C#, the set contains mapped `Program.cs` and synthetic `Semantifold.csproj`; Go returns `go.mod` before `main.go`; Dart returns its two manifests before `bin/program.dart`. `createGeneratedArtifactSet()` validates these and other single-module target shapes without introducing Task 010's source-project semantics. Its dense artifact array preserves caller/backend order and requires unique safe relative POSIX paths without file/directory prefix collisions, non-empty text or bytes, media types, one of `entry`/`source`/`manifest`/`support`/`mapping`/`resource`/`loader`, generated ownership, provenance, and exactly one entry. Binary storage remains private and every `content` read returns a detached `Uint8Array`, so mutations cannot alter the validated artifact or drift from byte provenance. Backends return no iterable or partial files: the complete set is validated before it becomes observable. Generation and set construction never write files.
 
 All outputs have deterministic LF newlines. Returned rich mappings are detached from caller-owned semantic locations and provenance before they are deeply frozen and internally indexed after trust-boundary validation. Freezing an artifact mapping therefore never freezes the mutable semantic module used to generate it. The rich map's `generated.content` is the exact returned code and its ordered, non-empty spans cover every UTF-16 code unit without gaps or overlaps:
 
@@ -116,11 +118,17 @@ const mapping = createByteMapping({
 
 The discriminator is `SemantifoldByteMapping`, version is `1`, and `coordinateSystem` is exactly `bytes`. The range array and every nested provenance-origin array are dense; ranges contain non-negative safe-integer half-open offsets, are non-empty, ordered, non-overlapping, and bounded by `generated.byteLength`. Source/derived origins retain ordinary UTF-16 original `SourceLocation` values; only the generated side is in bytes. Every source location has nondecreasing offsets and lexicographically ordered `(line, column)` endpoints; equal endpoints remain valid for zero-width origins. Synthetic regions require a non-empty reason. Optional `nodeId`, `symbolId`, and `role` fields are omitted only by `undefined`; any present value must be a non-empty string. These identities associate encoded regions without fabricating source positions. `parseByteMapping()` validates serialized input and `stringifyByteMapping()` emits canonical key-sorted JSON with one LF.
 
+Browser Wasm applies this contract contiguously across all of `program.wasm`: magic/version header, section IDs and lengths, function/type indexes, bodies, instructions, immediates, literal data, names, and custom sections each have explicit ranges. Semantic bytes use exact parser-owned `operator`, `name`, `callee`, and `literal` ranges when available; function-name content is mapped separately from its synthetic length prefix. Section framing, temporary locals, and ABI machinery remain synthetic even when they carry related context. Its external `program.wasm.map` follows the WebAssembly convention rather than text coordinates: generated line is zero and generated column is the exact zero-based module byte offset. Synthetic ranges are emitted as unmapped points/transitions, and symbol-bearing points use semantic names rather than registry-local IDs. A final `sourceMappingURL` custom section contains the relative UTF-8 payload `program.wasm.map`. The richer byte mapping remains authoritative because Source Map v3 cannot retain range ends, semantic roles, or closed synthetic/derived origins.
+
 Text artifact provenance embeds the validated rich mapping and Source Map v3 projection. Its optional `sourceMapFilename` may be omitted, but when present must be a non-empty single-line string; optional Source Map arrays must likewise be omitted rather than set to `null`. Malformed values are rejected as `INVALID_ARTIFACT_SET`. Binary artifact provenance must embed a matching byte map whose path and byte length equal its artifact. Manifest, support, loader, and other source-free text/resources may instead carry an explicit artifact-level synthetic reason and related source origins. Optional related-origin identities follow the same `undefined`-only omission rule. Artifact-set construction detaches and deeply freezes every such related origin, including its location and start/end points.
 
+Dart's `bin/program.dart` maps function names, parameter and local types/names, assignments, operators, calls/arguments, print, literals, returns, and entry statements through the same exact/anchor/synthetic span model. The complete safe-integer and analyzer-stability runtime prefix plus fixed `main` shell are synthetic with related semantic origins. Both manifest artifacts use artifact-level synthetic configuration provenance. The embedded Source Map v3 `file` is `bin/program.dart`; no `.map` artifact or Dart source directive is emitted.
+
+The iOS project manifest adds an application-specific provenance index without widening the generic mapping schemas. Mapped per-module semantic Swift retains the ordinary rich/v3 chain to its original Task 010 sources, including Ruby. Synthetic project, SwiftUI, runtime, test, configuration, and base asset-catalog files carry explicit source-free reasons. `SemantifoldIosProject` version 1 records renderer-owned configuration-field citations by manifest pointer and causal output ranges, exact caller asset representation/media type/SHA-256, source hashes and participating Swift artifacts, complete ordered owned paths, and exclusions. Its nested `SemantifoldIosSemanticProgram` version 1 section preserves caller-order source identities/ownership/hashes, dependency-order module IDs and dependencies, generated namespaces/artifacts, and the selected entry module/function linkage. Binary assets retain byte provenance across their exact full content. See [iOS application target](ios.md).
+
 ## Source Map v3 and directives
 
-`artifact.sourceMap` exists for all six single-text target artifacts, C#'s `Program.cs`, and Go's `main.go`; it is generated with `@jridgewell/gen-mapping`. Lookup, import, and artifact-set validation use `@jridgewell/trace-mapping`. Semantifold does not hand-code VLQ or tracing. Artifact-set validation requires dense `sources`, `names`, and optional `sourcesContent` arrays, decodes and canonically re-encodes the mapping payload, requires standard one-, four-, or five-field segments, rejects source or name indices outside their declared arrays, and requires the complete v3 value to equal the existing `toSourceMapV3()` projection of the accepted rich mapping. That projection comparison covers generated and original positions, source and name indexes, content, and the documented trailing unmapped directive span without a second encoder. The v3 map contains deterministic `file`, `sources`, `sourcesContent`, `names`, and `mappings` fields.
+`artifact.sourceMap` exists for all single-text target artifacts and mapped multi-artifact text outputs; browser Wasm additionally has the external binary projection described above. Maps are generated with `@jridgewell/gen-mapping`, while lookup, import, artifact validation, and independent test decoding use `@jridgewell/trace-mapping`. Semantifold does not hand-code VLQ or tracing. Text artifact validation requires dense `sources`, `names`, and optional `sourcesContent` arrays, canonical standard segments, valid indexes, and equality with the authoritative rich mapping projection. The v3 map contains deterministic `file`, `sources`, `sourcesContent`, `names`, and `mappings` fields.
 
 Directives are opt-in and only valid for JavaScript and TypeScript:
 
@@ -129,7 +137,7 @@ generateArtifact({language: "javascript", module, mapDirective: "external"})
 generateArtifact({language: "typescript", module, mapDirective: "inline"})
 ```
 
-`external` appends `//# sourceMappingURL=<relative-map-url>`. `artifact.sourceMapFilename` remains the map artifact's literal logical filename, while the directive is relative to `artifact.filename`'s directory and URL-encodes each filesystem path segment without encoding structural slashes. Both logical paths resolve against one synthetic artifact root before relativization, so mixed leading-parent depths do not become false common segments; for example, generated `../../dist/out.js` and map `../maps/out.js.map` emit `../maps/out.js.map`. `dist/program.js` still advertises `dist/program.js.map` and emits `sourceMappingURL=program.js.map`; a literal `#` or `?` in the sidecar filename is emitted as `%23` or `%3F`. Names containing any ECMAScript line terminator—LF, CR, U+2028, or U+2029—are rejected before emission. `generateArtifactSet()` makes that reference materializable by adding the LF-terminated deterministic JSON serialization of `artifact.sourceMap` at the advertised safe path with role `mapping`; `generateArtifact()` retains its existing sidecar-object contract. `inline` appends a UTF-8 base64 data URL. The default is `none`. PHP, Ruby, Java, and Python still receive sidecar map objects but never receive non-native map comments. C# and Go reject even an explicitly supplied `none`, because multi-backend options must not be silently consumed and their fixed multi-artifact projects have no source-map directive contract. Native Java debugger mapping, C# portable-PDB integration, and Go compiler source-map integration would require compiler-artifact integration and are not part of v1.
+`external` appends `//# sourceMappingURL=<relative-map-url>`. `artifact.sourceMapFilename` remains the map artifact's literal logical filename, while the directive is relative to `artifact.filename`'s directory and URL-encodes each filesystem path segment without encoding structural slashes. Both logical paths resolve against one synthetic artifact root before relativization, so mixed leading-parent depths do not become false common segments; for example, generated `../../dist/out.js` and map `../maps/out.js.map` emit `../maps/out.js.map`. `dist/program.js` still advertises `dist/program.js.map` and emits `sourceMappingURL=program.js.map`; a literal `#` or `?` in the sidecar filename is emitted as `%23` or `%3F`. Names containing any ECMAScript line terminator—LF, CR, U+2028, or U+2029—are rejected before emission. `generateArtifactSet()` makes that reference materializable by adding the LF-terminated deterministic JSON serialization of `artifact.sourceMap` at the advertised safe path with role `mapping`; `generateArtifact()` retains its existing sidecar-object contract. `inline` appends a UTF-8 base64 data URL. The default is `none`. PHP, Ruby, Java, and Python still receive sidecar map objects but never receive non-native map comments. C#, Go, and Dart reject even an explicitly supplied `none`, because multi-backend options must not be silently consumed and their fixed multi-artifact projects have no source-map directive contract. Native Java debugger mapping, C# portable-PDB integration, Go compiler source-map integration, and Dart VM service mapping would require compiler-artifact integration and are not part of v1.
 
 The directive itself is an unmapped synthetic rich-map span. `artifact.sourceMap` is computed for the program before that self-referential comment is appended; this is required for a stable inline data URL and is the conventional v3 behavior. Use the rich mapping when the directive span itself matters. Rich registries may distinguish same-named sources by `sourceId`; Source Map v3 identifies sources by filename, so callers should use unique filenames when exporting such an assembled registry to v3.