semantifold 0.3.0 → 0.4.0

package/docs/testing.md

@@ -1,5 +1,263 @@
 # Testing
 
+## Task 005 general function signatures and calls
+
+Task 005 stays bounded to PHP, Ruby, JavaScript with JSDoc, TypeScript, and Java. `general-function-signatures-and-calls.spec.js` proves equivalent zero-, one-, and three-parameter signatures, complete signature collection, nested calls, terminating recursion, scalar/void returns, and the stable semantic failures. `general-function-frontend-validation.spec.js` owns the excluded parameter, call, method, receiver, dispatch, annotation, overload, generic, and higher-order source forms. `general-function-backend-validation.spec.js` proves generation/reparse, exact external-IR signature revalidation, target conflicts, the public feature flag, and transactional rejection from every deferred Task 025/Wasm target. `general-function-provenance-and-mapping.spec.js` proves deterministic declaration/resolution identities and exact signature/call mappings. `general-function-runtime-execution.spec.js` invokes real PHP, Ruby, Node, local `tsc` followed by Node, `javac`, and `java`, requiring exact `ready\n6\n` output; a missing command fails.
+
+Run the Task 005 files individually and sequentially:
+
+```sh
+npx velocious-test spec/general-function-signatures-and-calls.spec.js
+npx velocious-test spec/general-function-frontend-validation.spec.js
+npx velocious-test spec/general-function-backend-validation.spec.js
+npx velocious-test spec/general-function-provenance-and-mapping.spec.js
+npx velocious-test spec/general-function-runtime-execution.spec.js
+```
+
+Task 013 is the separate terminal original-five aggregate gate. Task 005 does not expand that matrix or adopt Python, C#, C, C++, Rust, Swift, Kotlin/JVM, Go, or browser Wasm beyond focused capability rejection.
+
+## Task 011 typed errors and handling
+
+Task 011 uses six focused specs. Semantic validation covers exact nominal types, string-only construction, abrupt raise, exact handler consumption, unmatched and handler-originated propagation, immutable scoped catch bindings, catch-entry invalidation of optional-presence facts after protected-body assignments, message-only access, unreachable handlers, and fixed-point direct-call effects without checked signatures. Frontend coverage parses the canonical Ruby, JavaScript/JSDoc, TypeScript, PHP, and Java forms through their real parser nodes and rejects arbitrary throws, broad or unguarded catches, JavaScript-family imported error aliases shadowed by parameter/local/iteration/catch bindings, multiple handlers, checked exceptions, retry/rethrow, resources, and `finally`/`ensure`/`else`. Backend coverage reparses all five generated targets, checks target guard spelling, rejects PHP assigned-only special names in catch bindings, validates caller-authored shapes before allocation, and requires deterministic `UNSUPPORTED_CAPABILITY` from every other registered target. Registry and provenance specs lock the public `typedErrors` flag, error/catch symbols, source roles, and rich/v3 mapping behavior.
+
+The multi-file runtime spec parses five caller-supplied TypeScript modules, preserves both exported `module#error:0` identities plus a transitive two-hop function effect through every generated project and reparse, and executes PHP, Ruby, Node, strict TypeScript through `tsc` plus Node, and Java through `javac` plus `java`. Its exact `ok\nbad\ndeep\n` output proves the non-throw path, one exact catch, and an unmatched error raised by the inner handler propagating to the outer exact handler. Missing commands fail; no test skips, downloads, substitutes, or scans source text.
+
+Run each file individually. Locale normalization is mandatory for the real-toolchain proof:
+
+```sh
+npx velocious-test spec/typed-error-semantic-validation.spec.js
+npx velocious-test spec/typed-error-frontends.spec.js
+npx velocious-test spec/typed-error-backends.spec.js
+npx velocious-test spec/typed-error-language-registry.spec.js
+npx velocious-test spec/typed-error-provenance-and-mapping.spec.js
+LANG=C.UTF-8 LC_ALL=C.UTF-8 npx velocious-test spec/typed-error-multifile-runtime.spec.js
+```
+
+Task 011 adds no checked exceptions/effects, arbitrary thrown values, multiple/union/broad catches, `finally`/`ensure`, async rejection, result types, non-original-five lowering, standard-library portability, pairwise rewrites, publication, or deployment behavior. Task 013 remains the historical Tasks 001–008 compatibility gate.
+
+## Task 012 type parameters and generic declarations
+
+Task 012 uses six focused specs. Semantic validation covers stable declaration-owned identities, duplicate/free variables, exact generic record arity, recursively substituted record fields/returns, two independent parameters, consistent repeated inference, present-optional evidence, order-independent deferred validation of empty and recursively evidence-free list/map arguments, conflicts, missing argument evidence, occurs-check recursion, explicit arguments on non-generic records, and exact resolved type arguments. Frontend coverage parses native TypeScript/Java declarations and exact JavaScript, Ruby, and PHP documentation through their existing parsers; it proves the nested optional-list inference trigger across the original five, closed constructor-field context, recursive optional type-variable and applied-record documentation with exact ranges, whole-optional evidence for direct `T`, conservative instantiated call/construction member classification, presence-proven PHP generic-getter admission, and rejection of property spelling, missing templates, contextual raw Java construction, bounds/defaults/variance/wildcards, casts, reflection, and unsupported type operators. Backend coverage generates and reparses every original-five target, verifies complete dynamic-language documentation, PHP's valid carrier-free `Optional<T>` parameter/getter spelling, present scalar evidence for an `Optional<T>` sibling beside recursive `list<Box<?T>>`, exact nullable scalar constructor/getter carriers, removal/addition of native `?`, wrong scalar carriers, mismatched documentation, native TypeScript/Java syntax, caller-authored parameter/application corruption, sparse inferred type-argument rejection at outer and nested record-identity arrays, and pre-emission rejection of non-generic argument arrays, while locking the exact registry cohort. Provenance coverage resolves type-parameter declarations/references as symbols and requires mapped declaration and use spans.
+
+The program spec proves module-qualified parameter identities and imported generic record/function declarations across all five generated project layouts and reparses each complete project to equivalent semantic meaning. The runtime spec generates from the common TypeScript fixture, reparses every artifact, and invokes real PHP, Ruby, Node, local `tsc` plus Node, and `javac` plus Java. Exact `ready\n2\nleft\n2\n` output covers direct `Box<T>` fields, nested `List<T>`, string and integer instantiations, two independent parameters, and multiple consistent arguments; exact `present\nleading\ntrailing\nlist\nmap\nrecord\n` output covers present optional evidence, both empty-list argument orders, recursively evidence-free collections and records, closed optional record construction/member substitution, valid dynamic documentation, and PHP's private-storage/documented-getter profile. A third `sized\nmaybe\npresent\noptional\n2\n` composition covers instantiated calls whose record field collides with collection-size spelling, PHP's presence-proven optional generic receiver and `Optional<T>` getter, whole-optional direct inference, and optional applied records in lists. A PHP-specific `kept\n` composition proves generated `list<Box<?T>>` documentation reparses and executes after sibling argument evidence closes the nested record application. Missing commands fail; no case skips, installs, downloads, substitutes, or uses a snapshot in place of execution.
+
+Run each focused file individually and sequentially; locale normalization is mandatory for the runtime proof:
+
+```sh
+npx velocious-test spec/type-parameters-and-generics.spec.js
+npx velocious-test spec/type-parameter-frontends.spec.js
+npx velocious-test spec/type-parameter-backends.spec.js
+npx velocious-test spec/type-parameter-provenance-and-mapping.spec.js
+npx velocious-test spec/type-parameter-programs.spec.js
+LANG=C.UTF-8 LC_ALL=C.UTF-8 npx velocious-test spec/type-parameter-runtime-execution.spec.js
+```
+
+Task 012 adds no bounds/defaults/variance/wildcards, higher-kinded or conditional/mapped/indexed types, overload/bidirectional/return-context inference, raw applications, runtime type tests, reflection, casts, wrappers, specialization, non-original-five lowering, standard-library facade/provider behavior, publication, or deployment behavior. Task 013 remains the historical Tasks 001–008 compatibility gate.
+
+## Task 013 five-language compatibility acceptance
+
+`spec/five-language-compatibility-acceptance.spec.js` parses one substantial Tasks 001–008 fixture for each original language and uses `spec/support/semantic-meaning.js`, a spec-only non-serialization comparator, to prove complete location-insensitive equality. It separately asserts exact parser-owned ranges for recursive type constituents, map entries and children, optional tests, loop bindings, and nested call arguments. It then validates, emits, and reparses all 25 source→target routes. Generated bytes must be identical for the five equivalent source modules before execution is deduplicated to one artifact per target. Exact runtime output proves present/absent optionals, nested branches, map lookup/size, list lookup/size, and ordered `continue`/`break` behavior. The original minimal fixtures remain an explicit third assertion.
+
+`spec/five-language-compatibility-diagnostics.spec.js` crosses all five languages with parse, unsupported-form, missing-type, resolution, type, flow, exclusion, malformed external IR, and target preflight cases. `spec/php-parse-diagnostic-location.spec.js` and `spec/javascript-typescript-parse-diagnostic-location.spec.js` protect the parser-derived location correction found by the aggregate gate. Every error must be `SemantifoldDiagnostic` with stable code, language, filename, and useful start; generation APIs must throw before returning any partial artifact.
+
+Run the Task 013 focused files individually and sequentially before the aggregate suite. Missing runtime/compiler commands fail; no case skips or installs a replacement. These commands supplement rather than replace mandatory local suite discovery:
+
+```sh
+npx velocious-test spec/php-parse-diagnostic-location.spec.js
+npx velocious-test spec/javascript-typescript-parse-diagnostic-location.spec.js
+npx velocious-test spec/five-language-compatibility-diagnostics.spec.js
+npx velocious-test spec/five-language-compatibility-acceptance.spec.js
+npx velocious-test spec/public-api.spec.js
+npx velocious-test spec/tree-sitter-legacy-packed-consumer.spec.js
+```
+
+After the focused files pass, run the mandatory local aggregate handoff gate:
+
+```sh
+LANG=C.UTF-8 LC_ALL=C.UTF-8 npm test
+```
+
+Task 013 adds no stdlib, pairwise adapter, source-to-target call rewrite, map iteration, Phase 2/3 syntax, expanded-language matrix, application lane, release, or deployment behavior. TensorBuzz repeats the aggregate coverage after the required local handoff gate; it does not replace that local proof.
+
+## Task 014 ordered map iteration
+
+Task 014 uses six focused specs plus the existing public registry/API and packaging regressions. Frontend coverage parses equivalent Ruby, JavaScript/JSDoc, TypeScript, PHP, and Java fixtures; proves empty, singleton, and non-lexically ordered multi-entry construction; preserves lookup and size; and rejects ordinary maps, duplicate/numeric-string keys, heterogeneous values, mutation/alias escape, malformed pair bindings, and every prohibited Java map/backing family. Semantic validation locks the distinct homogeneous `OrderedMapType`, insertion order, immutable exact key/value bindings, body-only scope, and ordinary-map rejection. Backend and provenance coverage require semantic round-trip, one-time loop operand spelling, collision-safe Java lowering, safe Java expression positions, complete mappings, and transactional rejection from every non-cohort target. Runtime coverage generates, reparses, and executes all five targets with real PHP, Ruby, Node, local TypeScript, and Java toolchains; exact `3\n2\nb\n2\nc\n3\n` output proves size, lookup, pair values, first-insertion order, `continue`, and `break`.
+
+Run every file individually and sequentially; do not replace these commands with suite or directory discovery:
+
+```sh
+npx velocious-test spec/ordered-map-iteration-validation.spec.js
+npx velocious-test spec/ordered-map-iteration-frontends.spec.js
+npx velocious-test spec/ordered-map-iteration-backends.spec.js
+npx velocious-test spec/ordered-map-iteration-provenance-and-mapping.spec.js
+npx velocious-test spec/ordered-map-iteration-language-registry.spec.js
+LANG=C.UTF-8 LC_ALL=C.UTF-8 npx velocious-test spec/ordered-map-iteration-runtime-execution.spec.js
+npx velocious-test spec/public-api.spec.js
+```
+
+This capability remains original-five-only. It does not assign iteration order to Task 006 `MapType`, widen Task 008, add sorting or arbitrary iterators, or introduce a standard-library contract, compatibility facade, host provider, pairwise adapter, publication, or deployment behavior.
+
+## Task 032 condition-controlled loops and break
+
+Task 032 uses six focused specs. Frontend coverage parses each original-five ordinary block-form `while` and rejects post-condition, modifier, alternate-syntax, unbraced, labeled, leveled, and valued variants. Semantic coverage locks exact Boolean conditions, precondition fallthrough, conservative repeated-condition facts, body scope, unreachable code, nested nearest-loop identity, and function-boundary legality. Backend coverage proves native generation/reparse for all five targets, mixed nested-loop control, exact caller-IR identity validation, and transactional rejection from every non-cohort target. Registry coverage locks the independent public capability flag.
+
+The runtime spec generates, reparses, and executes PHP, Ruby, JavaScript with Node, TypeScript through local `tsc` plus Node, and Java through `javac` plus `java`. Its exact output proves zero iterations, repeated condition effects, `continue` returning to the next condition evaluation, nearest nested `break`, and return from inside a condition-controlled loop. Missing commands fail.
+
+Run every file individually and sequentially; locale normalization is mandatory for the real-toolchain proof:
+
+```sh
+npx velocious-test spec/condition-controlled-loop-frontends.spec.js
+npx velocious-test spec/condition-controlled-loop-validation.spec.js
+npx velocious-test spec/condition-controlled-loop-backend-validation.spec.js
+npx velocious-test spec/condition-controlled-loop-backends.spec.js
+npx velocious-test spec/condition-controlled-loop-language-registry.spec.js
+LANG=C.UTF-8 LC_ALL=C.UTF-8 npx velocious-test spec/condition-controlled-loop-runtime-execution.spec.js
+```
+
+This capability remains original-five-only. It adds no post-condition, infinite-shorthand, basic, range, iterator, or async loop; no labels, numeric levels, valued control, or loop `else`; and no stdlib-specific recognition, compatibility facade, canonical capability, provider, pairwise adapter, publication, or deployment behavior.
+
+## Task 033 reference classes, methods, and constructors
+
+Task 033 uses eight focused specs plus the changed registry contract spec. They cover parser-neutral nominal identities and exact resolutions, all five canonical source and target profiles, complete initialization and declaring-receiver privacy, target preflight and reserved protocol hooks, deterministic provenance/mappings/artifacts, fail-loud non-cohort routing, and native execution. The runtime fixture proves fresh independent state, reference aliasing and passage, void and value methods, receiver-before-argument order, and left-to-right constructor arguments through real `php`, `ruby`, `node`, `tsc`, `javac`, and `java` commands. Missing tools fail.
+
+Run each file individually and sequentially; locale normalization is mandatory for the real-toolchain proof:
+
+```sh
+npx velocious-test spec/reference-classes-methods-and-constructors.spec.js
+npx velocious-test spec/reference-class-frontends.spec.js
+npx velocious-test spec/reference-class-semantic-validation.spec.js
+npx velocious-test spec/reference-class-backends.spec.js
+npx velocious-test spec/reference-class-backend-validation.spec.js
+npx velocious-test spec/reference-class-language-registry.spec.js
+npx velocious-test spec/reference-class-provenance-and-mapping.spec.js
+LANG=C.UTF-8 LC_ALL=C.UTF-8 npx velocious-test spec/reference-class-runtime-execution.spec.js
+npx velocious-test spec/language-registry.spec.js
+```
+
+The adopted cohort is PHP, Ruby, JavaScript/JSDoc, TypeScript, and Java. Task 033 is single-module and does not add inheritance, open or virtual classes, arbitrary host objects, identity operators, escaping unchecked-error effects, resources, standard-library contracts, facades, providers, publication, or deployment behavior.
+
+## Task 034 effectful capabilities and resource lifetime
+
+Task 034 uses six dedicated focused specs plus the changed public API and language-registry contracts. They cover frozen explicit authority, deterministic capability/resource/failure/operation/effect identities, same-named ordinary source functions, exact typed failure boundaries, linear moves and immediate borrows, every-path close or transfer, terminal close failures, absence/failure separation, all five parser profiles, transactional target preflight, left-to-right exactly-once lowering, provenance/mappings, and the Task 010/non-cohort boundary.
+
+Run every file individually and sequentially. The runtime spec discovers and invokes real `php`, `ruby`, `node`, local `tsc`, `javac`, and `java`; a missing tool fails. Its fixture proves effectful receiver-before-argument order and nested single evaluation, acquisition/read/close failure normalization, clean EOF as optional absence, transfer through functions and constructors, explicit branch/catch/loop discharge, terminal repeated-close and read-after-close behavior without another native operation, deterministic generation, generated-source reparse under the same authority, compilation, execution, and absence of implicit cleanup events.
+
+```sh
+npx velocious-test spec/effectful-capability-contract.spec.js
+npx velocious-test spec/resource-lifetime-validation.spec.js
+npx velocious-test spec/effectful-capability-frontends.spec.js
+npx velocious-test spec/effectful-capability-backends.spec.js
+npx velocious-test spec/effectful-capability-provenance-and-mapping.spec.js
+LANG=C.UTF-8 LC_ALL=C.UTF-8 npx velocious-test spec/effectful-capability-runtime-execution.spec.js
+npx velocious-test spec/public-api.spec.js
+npx velocious-test spec/language-registry.spec.js
+```
+
+For the Task 034 local handoff, do not run `npm test`, a whole spec directory, or another aggregate. TensorBuzz owns clean aggregate discovery. Task 034 remains an unversioned single-module foundation with one fixed protected conformance binding; Task 035 owns canonical contract versions, provider registries, negotiation, linking, and protected native provider artifacts. Task 036 owns the source-language facade layer that consumes those contracts.
+
+## Task 035 versioned standard-library contracts and provider linking
+
+Task 035 uses six dedicated focused specs plus the changed public API, language-registry, and registry toolchain contracts. They cover versioned canonical contract records, exact `X.Y.Z` versions with half-open reference ranges, unknown/malformed/incompatible contract failures, the target host provider registry and its derived protected native entries, transitive capability negotiation with stable order-independent selection, canonical call parsing under authority, protected-binding rejection, module path collisions, tree-shaken provider linking artifacts, byte-stable repeated generation, and real-toolchain execution of linked programs.
+
+Run every file individually and sequentially. The runtime spec discovers and invokes real `php`, `ruby`, `node`, local `tsc`, `javac`, and `java`; a missing tool fails. Its fixture executes the linked program artifact set through the provider boundary and proves identical deterministic probe output on every target, including effect order, typed failures, clean EOF presence, and every-path close.
+
+```sh
+npx velocious-test spec/stdlib-contract-registry.spec.js
+npx velocious-test spec/stdlib-capability-negotiation.spec.js
+npx velocious-test spec/stdlib-provider-registry.spec.js
+npx velocious-test spec/stdlib-canonical-calls.spec.js
+npx velocious-test spec/stdlib-linking-artifacts.spec.js
+LANG=C.UTF-8 LC_ALL=C.UTF-8 npx velocious-test spec/stdlib-provider-runtime-execution.spec.js
+npx velocious-test spec/public-api.spec.js
+npx velocious-test spec/language-registry.spec.js
+```
+
+Task 035 remains the delivered provider foundation from PR #45: compatibility facades and the concrete TCP slice belong to Tasks 036–037. Provider artifacts are compiler-owned synthetic provenance, and the protected native binding is invisible to source and ordinary portable module resolution.
+
+## Task 036 language compatibility stdlib facades
+
+Task 036 adds four dedicated focused specs plus the changed public API and affected Task 010/035 boundaries. The registry spec covers detached immutable versioned executable definitions, matching public declarations, exact native module/symbol lookup, highest compatible selection, canonical-only dependencies, malformed definitions, and unused fixture registration. Resolution coverage runs each original-five parser, proves native identity substitution and transitive-only facade compilation, preserves import/symbol provenance, and rejects same-spelling user code, unsupported members/forms, dynamic imports/requires, reflection, shadowing/mutation, reopening, native extensions, forged authority, and compiler-owned module collisions.
+
+The linking spec checks collision-safe compatibility paths, facade `support` roles, mapped facade provenance, complete `SemantifoldStdlibLink` facade metadata, target syntax conversion, unused elimination, deterministic complete artifacts, and transactional rejection of forged versions. The runtime spec invokes real `php`, `ruby`, `node`, local `tsc`, `javac`, and `java`; missing commands fail. It executes all 25 original-five source-to-target combinations and the five same-language lanes, proving executable facade behavior and isolation from the protected provider binding.
+
+Run every file individually and sequentially; do not replace the real-tool coverage with snapshots or source-only assertions:
+
+```sh
+npx velocious-test spec/stdlib-facade-registry.spec.js
+npx velocious-test spec/stdlib-facade-resolution.spec.js
+npx velocious-test spec/stdlib-facade-linking-artifacts.spec.js
+LANG=C.UTF-8 LC_ALL=C.UTF-8 npx velocious-test spec/stdlib-facade-runtime-execution.spec.js
+npx velocious-test spec/stdlib-contract-registry.spec.js
+npx velocious-test spec/stdlib-capability-negotiation.spec.js
+npx velocious-test spec/stdlib-provider-registry.spec.js
+npx velocious-test spec/stdlib-canonical-calls.spec.js
+npx velocious-test spec/stdlib-linking-artifacts.spec.js
+LANG=C.UTF-8 LC_ALL=C.UTF-8 npx velocious-test spec/stdlib-provider-runtime-execution.spec.js
+npx velocious-test spec/multifile-program.spec.js
+npx velocious-test spec/multifile-profile-diagnostics.spec.js
+npx velocious-test spec/public-api.spec.js
+```
+
+This remains a bounded neutral qualification corpus by itself; the Task 037 network slice has separate acceptance below.
+
+## Task 037 blocking TCP stdlib vertical slice
+
+Task 037 uses focused registry, Ruby facade, PHP provider/linking, artifact, diagnostic, and runtime specs. The source suite proves exact literal `require "socket"`, genuine `TCPSocket.new(host, port)`, receiver `gets`/`close`, and exactly one-string unqualified `puts` or `Kernel.puts`; it rejects shadowing, reopening, dynamic forms, unsupported members/options/arity/output shapes, protected access, capability/version gaps, path/namespace collisions, and late transactional failure. Existing Ruby program-mode `puts` outside the proved socket profile remains a legacy print statement.
+
+The runtime suite first discovers the canonical `php82` profile and then real `ruby`, `node`, local `tsc`, `javac`, and `java`; a missing declared command fails. It starts event-driven Node servers on `127.0.0.1` port `0`, runs the Ruby reference and generated PHP against separate fresh instances, and uses explicit deadlines plus `finally` cleanup instead of sleeps. Exact raw bytes cover LF, CRLF, a final unterminated Unicode line with one appended LF, and no output at subsequent EOF. A genuine refused connection and real successful `fclose` are required. Generator-only protected PHP seams execute with real PHP to force split UTF-8 chunks, false/non-EOF reads, close warnings/failures, and short/zero/false stdout writes. Generated portable PHP is reparsed where supported, every provider artifact passes real `php -l`, and two generations must match completely.
+
+Run the focused groups sequentially:
+
+```sh
+npx velocious-test spec/blocking-tcp-stdlib-contract.spec.js
+npx velocious-test spec/blocking-tcp-ruby-facade.spec.js
+npx velocious-test spec/blocking-tcp-stdlib-linking.spec.js
+npx velocious-test spec/blocking-tcp-php-provider.spec.js
+LANG=C.UTF-8 LC_ALL=C.UTF-8 npx velocious-test spec/blocking-tcp-runtime-execution.spec.js
+npx velocious-test spec/generated-artifact-set.spec.js spec/multifile-program-diagnostics.spec.js spec/multifile-roundtrip-and-provenance.spec.js spec/reference-class-provenance-and-mapping.spec.js
+```
+
+This acceptance authorizes no external network, server API, TLS, UDP, async I/O, configurable timeout, arbitrary Ruby socket/output behavior, other source facade, other target provider, publication, or deployment.
+
+## Task 025 core expanded-language acceptance
+
+Task 025 uses two data-driven focused specs instead of duplicating the eight owning language suites. `spec/core-language-baseline-acceptance.spec.js` normalizes all five Tasks 001–004 profiles for Python, C#, C, C++, Rust, Swift, Kotlin/JVM, and Go; generates, reparses, and really executes one operator round trip per language; runs the eleven-path spanning matrix documented in [language support](language-support.md#task-025-core-expanded-language-acceptance); checks deterministic artifact bytes/mappings/provenance; and asserts the public registry contract. Its ordered program checks eager left-before-right calls and both short-circuit sides. C and C++ run the exact ordered-region source at O0/O2 with and without sanitizers, Rust runs debug/release, and Swift runs debug/`-O`.
+
+`spec/core-language-baseline-diagnostics.spec.js` is the shared fail-loud corpus. It checks located frontend rejection for parser recovery, missing types, truthiness, mixed numeric/Boolean equality, overflow, dynamic calls, reflection, exceptions, and concurrency. Every expanded backend rejects illegal names, malformed Tasks 001–004 IR, Task 005 arity, and unsupported roles; every bounded expanded backend also rejects compile-time-known overflow transactionally. Unknown IDs remain `UNSUPPORTED_LANGUAGE`. The focused Swift frontend spec separately locks the parser-backed trailing-call additive normalization found by this acceptance gate.
+
+Run these files one at a time. Tool discovery must resolve the exact identities documented by the owning language tasks; overrides name existing executables and never install or download a compiler:
+
+```sh
+export LANG=C.UTF-8 LC_ALL=C.UTF-8
+export SEMANTIFOLD_CLANG=/usr/bin/clang-21
+export SEMANTIFOLD_CLANGPP=/usr/bin/clang++-21
+export SEMANTIFOLD_KOTLINC=/opt/kotlinc/bin/kotlinc
+npx velocious-test spec/core-language-baseline-diagnostics.spec.js
+npx velocious-test spec/core-language-baseline-acceptance.spec.js
+npx velocious-test spec/swift-frontend-validation.spec.js
+```
+
+The required real tools are Python 3.14.x, .NET SDK 10, Clang/Clang++ 21.1.8 for x86_64 Linux, Rust/Cargo 1.98.1, Swift 6.3.3 for x86_64 Linux, Kotlin 2.4.20 with OpenJDK 25.0.4, and Go 1.26.x for Linux/amd64. Generated inputs are dependency-free and use isolated temporary directories and offline/local modes where the owning toolchain requires them. Missing, mismatched, non-executable, or unavailable commands fail; no test skips or fetches a replacement. Task 025 does not run Wasm, mobile, Objective-C, Dart/Flutter, Zig, Tasks 005+, benchmarks, or an all-pairs matrix.
+
+## Task 021 browser WebAssembly qualification
+
+Browser Wasm has three mandatory real execution lanes. Every canonical Tasks 001–004 fixture is encoded directly, validated by WABT `wasm-validate` 1.0.36, instantiated/executed by the configured Node 24 command using the standard WebAssembly API, and loaded by Chrome/Chromium 152.0.7977.82 from a materialized loopback HTTP directory. Missing tools, unsupported versions, bad MIME, CSP failure, browser timeout, nonzero exit, or output mismatch fail without a skip. The production backend never invokes WABT and the tests never compile WAT.
+
+The Ubuntu 26.04 development image installs signed repository package `wabt=1.0.36+dfsg+~cs1.0.36-2ubuntu1`. TensorBuzz's Ubuntu 24.04 base installs checksum-qualified Ubuntu package `wabt_1.0.36+dfsg+~cs1.0.36-2ubuntu1_amd64.deb` (SHA-256 `febaa4935e2982d83b21c75938773f226fa8bf22145f6a3bee25da9e98b0273b`). Both download exact `google-chrome-stable_152.0.7977.82-1_amd64.deb`, verify SHA-256 `4d25e4a028c78a7ae910683551c2f234792cc5595e7e3e34939f599342ada446`, and expose it as `/usr/local/bin/chromium`. Canonical overrides are `SEMANTIFOLD_WASM_VALIDATE` and `SEMANTIFOLD_CHROMIUM`.
+
+`spec/webassembly-runtime.spec.js` binds its server only to `127.0.0.1`, whitelists generated paths, emits exact media types with `nosniff`, no-store and strict CSP, and closes all connections in `finally`. The CSP grants same-origin scripts and Chromium's narrow `'wasm-unsafe-eval'` source while retaining the ban on JavaScript `'unsafe-eval'`, inline scripts, and external connections. Chromium receives a fresh explicit profile, fixed locale/timezone and virtual-time budget, disabled background/external network routes, a bounded four-MiB output capture, and a 20-second owned process-group deadline. It must return the pass sentinel and the exact UTF-8 output hex from the DOM. Run the focused files sequentially after rebuilding the canonical image:
+
+```sh
+npx velocious-test spec/webassembly-target.spec.js
+npx velocious-test spec/webassembly-runtime.spec.js
+npx velocious-test spec/language-registry.spec.js
+npx velocious-test spec/binary-provenance.spec.js
+npx velocious-test spec/generated-artifact-set.spec.js
+npx velocious-test spec/source-mapping.spec.js
+npx velocious-test spec/toolchain-acceptance.spec.js
+npx velocious-test spec/repository-contract.spec.js
+```
+
 ## Task 018 C operational qualification
 
 The canonical Ubuntu 26.04 development image installs `clang=1:21.1.6-71`, `clang-21=1:21.1.8-6ubuntu1`, and `libclang-rt-21-dev=1:21.1.8-6ubuntu1`. These exact installed versions were read with `dpkg-query -W clang clang-21 libclang-rt-21-dev`. The `clang` metapackage version differs from the compiler version; the discovered executable is Ubuntu Clang 21.1.8 at `/usr/lib/llvm-21/bin/clang`, target `x86_64-pc-linux-gnu`. Compiler-rt is required for ASan/UBSan and leak detection. Missing tools or runtime libraries fail the C lane; sanitizer coverage is mandatory on this qualified Linux platform.
@@ -68,15 +326,15 @@ The unchanged legacy parser has a measured 32,767-UTF-16-code-unit source limit
 
 The five C Tasks 001–004 fixtures generate/reparse/execute all original-five targets using real PHP, Ruby, Node, TypeScript/Node and Java compiler/runtime commands. One original-five source rotates through each C profile. Rich/v3 tests verify token origins, synthetic context, shared occurrences, stale metadata and UTF-16 coordinates. Negative corpora cover parser recovery, preprocessing/declarators, ownership/pointers, collisions, malformed IR and every ordered-region boundary. [The C profile](c.md) specifies the exact source, memory and overflow contracts.
 
-For this delivery, local testing is restricted to explicitly named changed/affected files. Aggregate `npm test`, directories and shards run only in TensorBuzz, whose end-to-end label includes ten languages and mandatory C/CPP O0/O2 sanitizers. Existing generic aggregate examples below describe that CI gate. Coordinator-owned independent review, exact-head CI and merge remain separate from local implementation delivery; publication/version/tag/release is not part of Tasks 018–019.
+For these deliveries, local testing is restricted to explicitly named changed/affected files. Aggregate `npm test`, directories and shards run only in TensorBuzz, whose end-to-end label includes fourteen source languages, Kotlin/JVM, Dart VM/native, Rust debug/release and mandatory C/CPP O0/O2 sanitizers. Existing generic aggregate examples below describe that CI gate. Coordinator-owned independent review, exact-head CI and merge remain separate from local implementation delivery; publication/version/tag/release is not part of the language candidates.
 
 Specs use the released `@velocious/testing@0.0.0` framework and standalone `velocious-test` runner with one top-level `describe` per file. Direct value checks use the framework's `expect` API where it improves clarity; predicate-rich diagnostic assertions retain `node:assert/strict`. Frontend tests load real fixtures through Babel, php-parser, Prism, Lezer, and the qualified official Tree-sitter Python/C#/Go routes and compare modeled meaning after removing source locations and the separately tested provenance index. They separately assert normalized annotations, complete named/anonymous/comment/directive traversal, parser recovery rejection, and exact UTF-16 locations.
 
-The private `packages/tree-sitter-legacy` workspace owns source checking and parser-neutral declaration generation for the internal legacy runtime; neither package is independently publishable. Its direct spec asserts the versioned frozen plain-data C CST, ordered field-bearing children, error/missing/extra state, UTF-16 indices and positions, and a declaration surface without native types. Its distribution spec runs the root package's real `prepack`, checks that the root tarball physically contains root `tree-sitter@0.25.1` and the internal package's isolated `tree-sitter@0.21.1` plus `tree-sitter-c@0.23.2` subtree, including licenses, platform prebuilds, and source fallbacks. It installs only that root tarball into a credential-free consumer with a fresh npm cache, verifies the installed lock and full npm tree, compiles a root API type consumer, and runs modern Go beside legacy C in one Node 24 process. The temporary tarball, cache, lockfile, dependencies, and consumer are always removed; no packed archive or dependency build is committed.
+The private `packages/tree-sitter-legacy` workspace owns source checking and parser-neutral declaration generation for the internal legacy runtime; neither package is independently publishable. Its direct spec asserts the versioned frozen plain-data C/CPP/Rust CST, ordered field-bearing children, error/missing/extra state, UTF-16 indices and positions, and a declaration surface without native types. Its distribution spec runs the root package's real `prepack` from a disposable copy of the package inputs and installed dependencies, so its clean build cannot replace shared workspace declarations while another spec reads them. It checks that the root tarball physically contains root `tree-sitter@0.25.1` and the internal package's isolated `tree-sitter@0.21.1` plus `tree-sitter-c@0.23.2`, `tree-sitter-cpp@0.23.4` and `tree-sitter-rust@0.23.1` subtree, including licenses, platform prebuilds, and source fallbacks. It installs only that root tarball into a consumer with cleaned npm configuration and a fresh npm cache, resolves exact `tree-sitter-kotlin@0.4.0` from its integrity-locked full-SHA HTTPS archive, verifies the installed lock and full npm tree, compiles a root API type consumer, and runs modern Kotlin/Go beside legacy C/CPP/Rust in one Node24 process. The temporary package copy, tarball, cache, lockfile, dependencies, and consumer are always removed; no packed archive or dependency build is committed.
 
 `tree-sitter-legacy-install-consistency.spec.js` reproduces source edits after `npm ci` in unique isolated npm fixtures, using the real pretest/prepack hooks and a semantic change to the serializer. Each shipped file must cause a stale-payload rejection until ordinary `npm ci` refreshes the installed copy; real tar extraction proves that subsequent packs contain the edited bytes. The shared gate uses npm's source pack inventory, checks the complete installed payload except its dependency subtree, and compares bytes before runtime specs, lint, and packing. The consumer spec independently compares every bundled internal file with source. Its configuration regression uses only synthetic registry and credential settings, removes all inherited `npm_config_*` inputs and token/module-path variables case-insensitively, isolates both user and global configuration files, and checks npm's effective public registry/config/cache settings before the real fresh-cache installation.
 
-The consumer environment must assert npm's ordinary `install-links=false` default without setting it. Root `acceptDependencies` accepts the exact private package already supplied by the bundle while retaining the local `file:` installation source. The spec runs ordinary `npm install`, full `npm ls --all`, and then clean `npm ci` from the generated consumer lock, repeating dependency, simultaneous Go/C runtime, frozen-data, and TypeScript consumer checks. Bundled lock entries have neither links nor external resolutions; real paths must remain inside the consumer. The fresh cache must contain public dependency requests but no internal or retired adapter lookup. No consumer flags, project configuration, workspace fallback, or registry release of the private name are required.
+The consumer environment must assert npm's ordinary `install-links=false` default without setting it. Root `acceptDependencies` accepts only the exact private package already supplied by the bundle while retaining the local `file:` source; Kotlin installs from its immutable full-SHA HTTPS archive with lock integrity. The spec runs ordinary `npm install`, full `npm ls --all`, and then clean `npm ci` from the generated consumer lock, repeating dependency, simultaneous Kotlin/Go/C/CPP/Rust runtime, frozen-data, TypeScript consumer, native Rust, and Kotlin/JVM checks. Bundled lock entries have neither links nor external resolutions, while the unbundled Kotlin entry retains its HTTPS resolution and integrity; real paths must remain inside the consumer. The fresh cache must contain public dependency requests but no internal or retired adapter lookup. No consumer flags, project configuration, workspace fallback, registry release of the private name, SSH, or credentials are required.
 
 Task 015 has separate focused specs for immutable registry-derived discovery, role-specific diagnostics, safe transactional artifact sets, byte-coordinate provenance, exact tool discovery, and staged acceptance. Every caller-supplied ordered array in these contracts must be dense before element validation or iteration; each field independently retains its documented empty/non-empty rule. Error-path discovery uses controlled local fake executables. Positive runner coverage discovers and invokes real `php`, `ruby`, `node`, the lockfile-installed `tsc`, `javac`, `java`, and `go`; a missing or unsupported tool is a failure, never a skip. Runner assertions cover isolated directory cleanup, fixed `C.UTF-8` locale and UTC timezone, absence of undeclared ambient variables, exact argument arrays, and distinct invalid-input, missing, ambiguous, version, setup/materialization, launch, output-limit, nonzero-stage, signal, and timeout diagnostics. `ACCEPTANCE_LAUNCH_FAILURE` is restricted to explicit operating-system spawn errors. `ACCEPTANCE_OUTPUT_LIMIT` identifies a child that launched but exceeded the fixed 16 MiB capture limit; its diagnostic retains stage/tool/version and the deterministic limit evidence while omitting the oversized streams and child error object.
 
@@ -88,19 +346,33 @@ Task 017 adds the distinct ordered `restore` stage and configured .NET SDK 10 di
 
 Task 024 adds configured Go 1.26.x discovery restricted to Linux/amd64; the patch release is read from the discovered toolchain rather than fixed by runtime tests. Acceptance obtains `GOROOT` from that exact `go`, requires the companion `gofmt` beside the configured or discovered executable to resolve to the same `GOROOT/bin/gofmt`, and checks `gofmt -d` before native execution. Each dependency-free generated module is run with `GOTOOLCHAIN=local`, `GOPROXY=off`, `GOSUMDB=off`, `GOVCS=off`, `CGO_ENABLED=0`, `GOENV=off`, `GOWORK=off`, `GOOS=linux`, `GOARCH=amd64`, and isolated HOME/GOPATH/build/module caches. The short-lived discovery fixture also writes exact `off` mode into its isolated Go telemetry directory before invoking the tool, then asserts that the mode file is the only telemetry state: Go 1.26 otherwise starts an unawaited uploader sidecar even in default `local` mode, which can recreate `upload/` while the fixture root is being removed. Cleanup errors remain fatal. Stages run offline `go build`, mandatory `go vet`, and `go run`, while compiler-only differential cases use the matching `go tool compile`. Tests require exact status/stdout, unchanged `go.mod`/`main.go`, no `go.sum`/`go.work`/vendor tree, and byte-identical binaries and output in two fresh directories. Missing, wrong-minor, wrong-architecture, mismatched-gofmt, download, cgo, workspace, vet, formatting, nondeterminism, telemetry leakage, or cleanup evidence fails without a skip.
 
+Task 023 adds exact Kotlin/JVM 2.4.20 discovery on the pinned OpenJDK 25.0.4+7 Ubuntu runtime. Ubuntu26.04 development and Ubuntu24.04 TensorBuzz use their exact `25.0.4+7-1~26.04` and `25.0.4+7-1~24.04` package builds. Bootstrap and discovery accept only their two qualified compiler-reported distribution suffixes, never arbitrary output. Original and generated `Program.kt` files compile with `-language-version 2.4 -api-version 2.4 -jvm-target 25 -Werror -include-runtime` into runnable `Program.jar` files, then execute through the exact `java25` discovery contract. Every process uses a fresh directory and exact status/stderr/UTF-8 stdout assertions; no test downloads a compiler or dependency.
+
 | Tool ID | Canonical command | Absolute-path override | Accepted canonical version |
 | --- | --- | --- | --- |
 | `php` | `php` | `SEMANTIFOLD_PHP` | PHP 8.x |
+| `php82` | `php` | `SEMANTIFOLD_PHP` | PHP 8.2 or newer for closed-record execution |
 | `ruby` | `ruby` | `SEMANTIFOLD_RUBY` | Ruby 3.x |
 | `node` | `node` | `SEMANTIFOLD_NODE` | Node 24.x |
 | `tsc` | `tsc` | `SEMANTIFOLD_TSC` | TypeScript 7.x |
 | `javac` | `javac` | `SEMANTIFOLD_JAVAC` | JDK 17–29 |
 | `java` | `java` | `SEMANTIFOLD_JAVA` | JRE 17–29 |
+| `java25` | `java` | `SEMANTIFOLD_JAVA` | exact OpenJDK 25.0.4+7 Ubuntu runtime for JVM25 artifacts |
+| `kotlinc` | `kotlinc` | `SEMANTIFOLD_KOTLINC` | exact Kotlin/JVM 2.4.20 on JRE 25.0.4+7 Ubuntu |
 | `python` | `python3` | `SEMANTIFOLD_PYTHON` | Python 3.x |
 | `dotnet` | `dotnet` | `SEMANTIFOLD_DOTNET` | .NET SDK 10.x |
 | `go` | `go` | `SEMANTIFOLD_GO` | Go 1.26.x, Linux/amd64 |
+| `rustc` | `rustc` | `SEMANTIFOLD_RUSTC` | exact 1.98.1 compiler commit, Linux x86-64 |
+| `cargo` | `cargo` | `SEMANTIFOLD_CARGO` | exact matching 1.98.1 Cargo commit, Linux x86-64 |
+| `swiftc` | `swiftc` | `SEMANTIFOLD_SWIFTC` | exact Swift 6.3.3 release, x86_64-unknown-linux-gnu |
 | `clangpp` | `clang++` | `SEMANTIFOLD_CLANGPP` | Ubuntu Clang 21.1.8, x86_64-pc-linux-gnu, C++20/libstdc++ ABI1 |
 | `clang` | `clang` | `SEMANTIFOLD_CLANG` | Ubuntu Clang 21.1.8, x86_64-pc-linux-gnu |
+| `wasm-validate` | `wasm-validate` | `SEMANTIFOLD_WASM_VALIDATE` | WABT 1.0.36 |
+| `chromium` | `chromium` | `SEMANTIFOLD_CHROMIUM` | Google Chrome 152.0.7977.82 |
+
+Successful version discovery normalizes and selects non-empty stdout, falling back to normalized stderr only when stdout is empty. Raw streams remain separate on failure diagnostics; incidental launcher stderr therefore cannot alter an exact stdout version contract.
+
+Closed-record runtime acceptance discovers `php82` before executing generated `final readonly class` syntax. Focused qualification rejects PHP 8.1, accepts PHP 8.2, and accepts later major versions; the generic `php` profile remains available for non-record PHP 8.x behavior.
 
 Canonical toolchain IDs must be non-empty primitive strings and are validated before property lookup or diagnostic formatting; malformed values normalize to `INVALID_TOOLCHAIN`, while an unknown valid string retains that string as its diagnostic identity. Discovery records the complete version output and first version line. Optional discovery and runner configuration defaults only when a field is `undefined`; explicit `null`, including in an environment entry, is invalid before lookup, setup, or launch. Explicit timeouts must be positive integers no greater than Node's exact timer ceiling of 2,147,483,647 milliseconds; larger values are rejected before lookup, setup, or launch rather than being clamped to one millisecond. Explicit environments must be ordinary or null-prototype records containing only enumerable own data properties with string or `undefined` values; inherited fields, accessors, symbol keys, collection/class instances, and other object shapes are rejected. Accepted environment values are synchronously detached before override lookup, setup, or launch. An override must be an executable absolute path resolving to a regular file; directories and other invalid file types report `TOOL_NOT_FOUND`. Canonical lookup examines the explicit PATH, accepts only executable regular files, resolves symlinks to exact paths, deduplicates aliases of the same executable, and rejects zero or multiple distinct matches. Version arguments and the accepted non-global/non-sticky version-policy expression are validated and detached before asynchronous executable lookup; the immutable discovery result retains the exact argument array that was executed, and caller mutation cannot change the pending version decision. TensorBuzz installs its pinned Node archive at `/usr/local/bin/node` and binds that exact executable through `SEMANTIFOLD_NODE`; a distinct host `/usr/bin/node` therefore cannot make the real-runtime lane ambiguous. This does not weaken canonical ambiguity detection when no override is configured. The runner inherits no ambient variables other than PATH unless the caller explicitly supplies them; locale and timezone are always normalized. Stage executable and version fields are copied and frozen before setup yields, embedded NUL is rejected before temporary-directory setup, and each completed stage returns a frozen copy of its executed argument array, so caller mutation cannot change execution or its audit record. On POSIX, version probes and acceptance stages spawn into one distinct owned process group: the configured deadline signals that exact group with `SIGTERM`, a fixed 250ms grace escalates the still-open group to `SIGKILL`, and a second fixed 250ms grace closes only the owned capture-pipe readers if an escaped descendant still retains their writers. The API then settles on the direct child's `close` event without claiming that an escaped process was terminated; captured output and timer-owned timeout classification remain unchanged. Platforms without this process-group contract fail with normalized unsupported launch/version diagnostics before spawning rather than claiming descendant cleanup. Timeout diagnostics derive from timer ownership rather than a subprocess signal, so spontaneous signals remain `TOOL_VERSION_FAILURE` or `ACCEPTANCE_SIGNAL` with their exact evidence. If a stage and isolated-directory cleanup both fail, the stage diagnostic remains primary with its exact stage, exit, signal, and bounded output fields; a bounded `ACCEPTANCE_CLEANUP_FAILURE` diagnostic is retained in its cause chain. Cleanup failure after successful stages remains `ACCEPTANCE_CLEANUP_FAILURE`.
 
@@ -113,6 +385,7 @@ Backend tests start from one parsed semantic module, generate every target, pars
 - `node program.js`
 - local lockfile-installed `tsc program.ts`, then `node program.js`
 - `javac Main.java`, then `java -cp … Main`
+- `kotlinc -language-version 2.4 -api-version 2.4 -jvm-target 25 -Werror -include-runtime Program.kt -d Program.jar`, then `java -jar Program.jar`
 - `python3 -m py_compile program.py`, then `python3 program.py` with `PYTHONUTF8=1` and `PYTHONIOENCODING=utf-8`
 - C#'s separate local-only `dotnet restore`, `dotnet build --no-restore`, and `dotnet exec` commands above
 - matching-GOROOT `gofmt -d`, then isolated offline `go build`, `go vet`, and `go run`
@@ -135,7 +408,7 @@ Run `npx velocious-test spec/repository-contract.spec.js` for the focused reposi
 
 ## Task019 CPP acceptance
 
-The CPP lane selects `/usr/bin/clang++-21` through `SEMANTIFOLD_CLANGPP`; C retains `SEMANTIFOLD_CLANG`. The development image pins libstdc++-15-dev 15.2.0-16ubuntu1 and already obtains clang++ from the exact clang-21 package. Noble TensorBuzz reuses the signed LLVM21 setup above, explicitly installs g++-13/libstdc++ headers, probes clang++ and libstdc++, and runs framework-native discovery of all ten languages. [The CPP profile](cpp.md) lists every compile/link, encoding, warning, exception/RTTI and sanitizer flag. Local validation uses explicit named spec files only; full-suite discovery belongs to TensorBuzz.
+The CPP lane selects `/usr/bin/clang++-21` through `SEMANTIFOLD_CLANGPP`; C retains `SEMANTIFOLD_CLANG`. The development image pins libstdc++-15-dev 15.2.0-16ubuntu1 and already obtains clang++ from the exact clang-21 package. Noble TensorBuzz reuses the signed LLVM21 setup above, explicitly installs g++-13/libstdc++ headers, probes clang++ and libstdc++, and runs framework-native discovery of all fourteen source languages. [The CPP profile](cpp.md) lists every compile/link, encoding, warning, exception/RTTI and sanitizer flag. Local validation uses explicit named spec files only; full-suite discovery belongs to TensorBuzz.
 
 ```sh
 export SEMANTIFOLD_CLANG=/usr/bin/clang-21
@@ -151,3 +424,92 @@ Each native spec executes O0/O2, ordinary and ASan/UBSan/leak profiles, with byt
 ## Release-version package verification
 
 Repository delivery checks validate a stable SemVer root version and require both lockfile version entries to match it. Packed-consumer checks compare the packed and installed package versions with the source manifest, rather than pinning a historical release. When validating a release candidate, run `npx velocious-test spec/repository-contract.spec.js spec/tree-sitter-legacy-packed-consumer.spec.js` on the actual candidate version; all existing runtime isolation, ordinary install/ci, and strict TypeScript checks remain mandatory.
+
+## Task020 Rust acceptance
+
+The checksum-pinned standalone Rust/Cargo 1.98.1 components are installed at image build time on both canonical Ubuntu26.04 and TensorBuzz’s actual Ubuntu24.04 base. Both bases passed 11 offline fresh crates and 93 commands before public implementation. Discovery checks full compiler/Cargo commits and the host, never installs tools, and fails for absent, swapped, unsupported or foreign-host executables. [Rust](rust.md) records the exact edition-2021 manifest, Cargo-generated format-4 lock and toolchain identities.
+
+Run individual changed/adjacent files sequentially; do not run a local suite, group, shard or spec directory. Rust-focused commands are:
+
+```sh
+npx velocious-test spec/rust-parser-qualification.spec.js
+npx velocious-test spec/rust-registry-toolchain.spec.js
+npx velocious-test spec/rust-frontend-validation.spec.js
+npx velocious-test spec/rust-ownership.spec.js
+npx velocious-test spec/rust-backend-validation.spec.js
+npx velocious-test spec/rust-adversarial.spec.js
+npx velocious-test spec/rust-native-execution.spec.js
+npx velocious-test spec/rust-provenance.spec.js
+npx velocious-test spec/rust-cross-language-acceptance.spec.js
+npx velocious-test spec/tree-sitter-legacy-packed-consumer.spec.js
+```
+
+Native tests materialize fresh Cargo crates and empty Cargo homes, use the discovered compiler, and run `cargo check --offline --locked`, separate debug/release builds, direct binaries and `cargo run --offline --locked --quiet` in both modes. Every original artifact/lock hash must remain unchanged. They compare exact byte output, build/runtime diagnostics and statuses; overflow must emit only `semantifold: integer overflow\n` on stderr and exit70 in either mode. Compiler rejection of generated code is a backend defect. Original illegal source moves and overlapping comparison borrows are separately proved with actual E0382/E0505 diagnostics. Uncached dependency demand fails offline. No test/discovery downloads a Rust tool or dependency.
+
+`SEMANTIFOLD_RUST_EVIDENCE` optionally preserves each native input, exact tool identity, command/status/stdout/stderr and stable hashes as JSON, and the provenance spec records two complete deterministic artifact/map sets there. `SEMANTIFOLD_PACK_EVIDENCE` optionally preserves the actual root tarball, pack inventory, consumer/type programs, npm command log and native results after install and ci. These directories are external evidence destinations, never shipped dependencies or generated source edits.
+
+The packed-consumer test installs the single root tarball, retains only plain frozen native-boundary data, checks all three private grammars alongside modern Go, and repeats strict public TypeScript and offline Rust execution after ordinary install and clean ci. Each phase uses a separate fresh npm cache, empty user/global configs, explicit public registry, and removal of inherited npm configuration/token variables case-insensitively; default install-links remains false. Running inside the canonical lane proves cleaned-environment behavior only. The coordinator must exercise the prepared consumer inputs in a disposable environment with no source/home/auth mounts for external credential-free acceptance.
+
+Required local gates remain runtime consistency, focused named specs, lint, root/workspace strict typecheck and build, high-severity audit, production/all dependency listings, pack dry-run and diff check. TensorBuzz alone owns full/native aggregate discovery for the exact candidate head. Review, external package boundary, CI, merge and post-merge evidence remain coordinator-owned.
+
+## Task026 iOS application generation acceptance
+
+Task 026's implemented Linux generation/provenance scope is kept in two focused files. Run them individually and sequentially; do not replace them with local spec-directory discovery or a broad suite:
+
+```sh
+npx velocious-test spec/ios-application.spec.js
+npx velocious-test spec/ios-packed-consumer.spec.js
+```
+
+`ios-application.spec.js` validates the complete Task 010 graph, closed configuration/assets, the portable ASCII artifact/resource path boundary, deterministic project/SwiftUI artifacts, renderer-owned configuration ranges, stable semantic-program manifest identities/linkage, Xcode-ID collision handling, and byte-identical double generation. Its Linux execution case discovers the real canonical Ruby and Swift 6.3.3 commands, runs the original Ruby modules, combines only the generated semantic Swift/runtime with a test harness, then typechecks, compiles, and executes debug and `-O` binaries. Exact Unicode `[String]` output/order must match; an absent Ruby or Swift command fails.
+
+`ios-packed-consumer.spec.js` runs the real root packing lifecycle, proves the package contains no materializer implementation or declarations, then uses empty user/global npm configurations, an explicit public registry, default `install-links=false`, and case-insensitive removal of inherited npm config/token variables. Separate fresh caches cover ordinary `npm install` and clean `npm ci`; each phase runs production/all dependency listings, deterministic public iOS generation with manifest identity checks, and strict TypeScript consumption.
+
+Transactional create-only directory materialization is deferred. Node's public filesystem API cannot provide both genuine atomic no-replace publication of a complete directory and descriptor-relative no-follow staging/publication/cleanup. No best-effort materializer test or package surface substitutes for a separately authorized native boundary.
+
+These are not Apple platform acceptance. Per the 2026-09-14 owner direction to defer OSX work, no local or TensorBuzz command runs `xcodebuild`, downloads an Apple runtime, boots/installs/launches an iOS Simulator, configures signing, or executes XCTest/XCUIAutomation. AC07 and AC12–AC14 remain deferred, missing prerequisites may not be skipped to green, and no fake acceptance spec or manufactured TensorBuzz lane is permitted. The [iOS application target](ios.md) records the precise partial status.
+
+## Task022 Swift acceptance
+
+Swift generation returns exactly one mapped `program.swift`. Focused frontend/backend specs cover all five Tasks001–004 fixtures, parser recovery, excluded syntax, malformed IR, target identifiers, compile-time-known signed-64-bit overflow, deterministic artifacts, rich/V3 provenance, exact helper validation, generated reparse, every Swift-to-original-five runtime route, and one original-five-to-Swift route per profile. Original-five execution invokes real PHP, Ruby, Node, TypeScript/Node, and Java compiler/runtime commands; unavailable tools fail.
+
+The compiler lane discovers only exact Swift 6.3.3 release for `x86_64-unknown-linux-gnu`. For every differential fixture it independently materializes the original and regenerated `program.swift`, runs `swiftc -warnings-as-errors -typecheck program.swift`, then separately compiles and executes debug and `-O` binaries. Both modes require status zero, empty stderr, exact decoded stdout and exact UTF-8 bytes; source bytes must remain unchanged and cleanup is mandatory. Exact Unicode-scalar string comparison is exercised with canonically equivalent but scalar-distinct text. No test installs or downloads Swift.
+
+Run the changed Swift files individually:
+
+```sh
+npx velocious-test spec/swift-parser-qualification.spec.js
+npx velocious-test spec/swift-frontend-validation.spec.js
+npx velocious-test spec/swift-backend-validation.spec.js
+npx velocious-test spec/swift-cross-language-acceptance.spec.js
+npx velocious-test spec/swift-registry-toolchain.spec.js
+npx velocious-test spec/swift-docker-contract.spec.js
+npx velocious-test spec/swift-native-execution.spec.js
+npx velocious-test spec/language-registry.spec.js
+npx velocious-test spec/repository-contract.spec.js
+```
+
+The Dockerfile selects `swift:6.3.3-noble@sha256:56ef1be2c1ca36f4c52440357dc1fcdfdb5e113587134fcadeef57c225c71b54` (Linux/amd64 child `sha256:4e0fc24f0f93a5cf9a91bfcf182534bbc0571d70d757389c04ff1f616c1c460f`) as an immutable extraction stage and preserves the final pinned Ubuntu26.04 base. A no-cache image build passed after adding `libncurses6` and `libxml2-dev`; exact Swift 6.3.3 x86_64 typechecked original and generated five-profile artifacts and `spec/swift-native-execution.spec.js` passed 6/6 in debug and `-O`. TensorBuzz now provisions the same signed Swift archive and sets `SEMANTIFOLD_SWIFTC=/opt/swift-6.3.3-RELEASE-ubuntu24.04/usr/bin/swiftc`. The independent review completed with this bounded correction; exact-head TensorBuzz CI, merge, and post-merge verification remain coordinator-owned delivery gates.
+
+## Task023 Kotlin/JVM acceptance
+
+Kotlin generation returns one mapped `Program.kt` plus detached immutable runnable-JAR metadata. Focused source/backend specs cover the five Tasks001-004 fixtures, every scalar and operation, local mutability, nested flow, parser recovery and exclusions, target names, known/dynamic safe-integer overflow, mappings, generated reparse, every Kotlin-to-original-five route, and one original-five-to-Kotlin route per profile.
+
+Run changed Kotlin files individually with the exact compiler override when it is outside `PATH`:
+
+```sh
+export SEMANTIFOLD_KOTLINC=/opt/kotlinc/bin/kotlinc
+npx velocious-test spec/kotlin-parser-qualification.spec.js
+npx velocious-test spec/kotlin-frontend-validation.spec.js
+npx velocious-test spec/kotlin-backend-validation.spec.js
+npx velocious-test spec/kotlin-cross-language-acceptance.spec.js
+npx velocious-test spec/kotlin-registry-toolchain.spec.js
+npx velocious-test spec/kotlin-docker-contract.spec.js
+npx velocious-test spec/kotlin-native-execution.spec.js
+npx velocious-test spec/tree-sitter-legacy-packed-consumer.spec.js
+npx velocious-test spec/language-registry.spec.js
+npx velocious-test spec/public-api.spec.js
+npx velocious-test spec/repository-contract.spec.js
+```
+
+The Dockerfile and TensorBuzz fetch only the official Kotlin compiler 2.4.20 ZIP, verify SHA-256 `59e9ca74c7904ef2c122b12114937673ccce68de820a663f0ed66ccf8799e0b7`, converge the dedicated `/opt/kotlinc` destination before moving the verified extraction into place, restore mode `0755` on the launcher after `jar` extraction, and probe its exact identity on OpenJDK25 while admitting only the qualified Ubuntu 24.04 or 26.04 packaging suffix. The focused container contract executes this install lifecycle from a non-executable launcher against a stale destination and runs both canonical GNU grep probes over accepted and rejected identities. The npm tarball leaves the exact qualified grammar as an integrity-locked full-SHA HTTPS dependency, and the packed-consumer proof repeats grammar loading, strict public typing, Kotlin round trip, and real JAR execution after ordinary install and clean `npm ci`. Exact-head TensorBuzz CI, merge, and post-merge verification remain coordinator-owned delivery gates.

package/docs/webassembly.md

@@ -0,0 +1,52 @@
+# Browser WebAssembly target
+
+The registered `wasm` ID is a target only. It has binary and browser-application backend roles, but no frontend, text backend, ordinary source-language status, or round trip. Use `generateArtifactSet({language: "wasm", module, role: "binary"})` or role `application`; both roles produce the same deterministic browser artifact set. `parse({language: "wasm", ...})` fails with `UNSUPPORTED_ROLE` for `frontend`, while an unknown ID still uses `UNSUPPORTED_LANGUAGE`. The filename is fixed to `program.wasm`; alternate filenames and explicit map directive/filename options fail instead of being ignored. WAT input, Wasm input, WASI, components, reference types, tables, shared memory, threads, SIMD, exceptions, memory growth, DOM imports, and general browser application generation are excluded.
+
+## Artifact set
+
+Generation returns these artifacts in order:
+
+| Path | Media type | Role | Provenance |
+| --- | --- | --- | --- |
+| `program.wasm` | `application/wasm` | resource | `SemantifoldByteMapping` v1 |
+| `program.wasm.map` | `application/json` | mapping | Source Map v3 projection |
+| `semantifold-loader.mjs` | `text/javascript` | loader | rich JavaScript text mapping |
+| `index.html` | `text/html` | entry | rich HTML text mapping |
+
+The encoder writes the portable core binary format directly from the validated Tasks 001–004 semantic module. Production generation does not emit WAT, invoke a compiler, access the filesystem, or return a partial set. A bounded graph pass rejects cyclic or excessively nested caller IR before recursive shared validation. Node's standard WebAssembly validator checks the completed bytes before artifact construction; repository acceptance independently invokes WABT's real `wasm-validate` command.
+
+The entry HTML is a strict-CSP acceptance harness with only same-origin module and Wasm loading. Serve all four files over HTTP, preserving `application/wasm` for `program.wasm`; opening the HTML from `file:` or serving the module as a generic binary type is unsupported. The loader exports `loadSemantifold(url, {sink, fetch, timeoutMs})`. `sink` receives exact LF-terminated scalar lines. `fetch` is an optional explicit fetch implementation for controlled hosts/tests, and `timeoutMs` is an integer from 1 through 2,147,483,647. There is no semantic JavaScript fallback.
+
+## ABI
+
+Artifact-set `metadata` carries the deeply frozen JSON contract `SemantifoldBrowserWasmABI` version 1 and ABI identity `semantifold.browser.v1`. The module imports only:
+
+```text
+semantifold.print_i64(i64) -> ()
+semantifold.print_bool(i32) -> ()
+semantifold.print_string(i32 pointer, i32 length) -> ()
+```
+
+It exports exactly one fixed-size `memory` and a zero-parameter `run() -> ()`. Semantic functions and helpers remain internal. Instantiation has no start section and no semantic side effects; one explicit non-reentrant loader `run()` call invokes the semantic entry point exactly once.
+
+Semantic integers lower to signed `i64`. Safe integer literals remain the source contract; compile-time-known i64 overflow rejects generation in every function and branch, including unused functions and statically unreachable branches, while dynamic add, subtract, multiply, and negate overflow traps. Scratch analysis remains entry-reachable and path-sensitive. The loader receives integers as JavaScript `bigint` and renders exact base-10 text. Booleans lower only to canonical `i32` zero or one; any other imported print value is rejected rather than treated as truthy. Wasm name validation accepts the JavaScript/TypeScript `$` identifier character while retaining invalid, duplicate, and reserved-name rejection.
+
+Strings are immutable UTF-8 byte sequences represented by `(i32 pointer, i32 length)` without terminators. Address zero is reserved. Deduplicated literal bytes occupy deterministic data segments, followed by a 16-byte-aligned private 1,048,576-byte scratch arena. Initial and maximum memory page counts are equal and `memory.grow` is absent. Every concatenation uses an overflow-checked private bump allocation and copies left bytes before right bytes. The loader checks pointer/length arithmetic and memory bounds, decodes with fatal UTF-8 while preserving a leading U+FEFF byte-order mark as data, and never exposes an allocator.
+
+Generation performs path-sensitive worst-case scratch analysis from `run`, substitutes computed call-argument bounds, adds sequential demand, takes reachable conditional alternatives, and unrolls recursion through the published maximum of 64 active semantic calls. Unknown bounds, arithmetic overflow, more than 1,048,576 scratch bytes, or a possible 65th active call fail with a located `UNSUPPORTED_CAPABILITY`. Each run starts with a clean cursor/depth state. Successful repeated runs are deterministic; reentrant calls are rejected, and a trapped loader instance is poisoned permanently.
+
+## Failures and security
+
+The loader validates the module's import signatures, fixed memory, absent start section, exact export set, and zero-parameter `run` signature before returning an instance. Its `SemantifoldBrowserError.stage` distinguishes `fetch/MIME`, `compile`, `instantiate/import`, `memory bounds/UTF-8`, `invocation/trap`, and `timeout`. Malformed bytes are `compile`; a structurally valid module with an unsupported ABI value type is `instantiate/import`. Deadline-triggered aborts remain `timeout` during fetch, body reads, streaming instantiation, and compatibility instantiation, while unrelated abort-like failures retain their phase. The original error is retained as `cause` when safe.
+
+Bad MIME never selects the non-streaming path. When `WebAssembly.instantiateStreaming` exists, the loader starts it immediately and reads a cloned response in parallel for ABI inspection instead of requiring the full body first. Host import behavior remains locked until that inspection succeeds, so a forbidden start section cannot reach the sink. The original response is read into an `arrayBuffer` and passed to `WebAssembly.instantiate` only in the compatibility path when streaming is unavailable.
+
+The checked-in browser acceptance server binds only `127.0.0.1`, serves only generated paths with `nosniff`, no-store, strict CSP, and exact media types, and owns a bounded shutdown. The CSP permits same-origin modules and the narrow `'wasm-unsafe-eval'` source required by Chromium for WebAssembly compilation; it does not permit JavaScript `'unsafe-eval'`, inline scripts, or external connections. Chromium runs headlessly with a fresh explicit profile, `en-US`, `C.UTF-8`, UTC, a fixed virtual-time budget, external hostname resolution disabled, bounded output, and process-group timeout cleanup. The DOM exposes pass/fail and exact UTF-8 output-hex sentinels so Unicode and embedded NUL output remain unambiguous.
+
+## Provenance
+
+`program.wasm` has contiguous rich half-open byte ranges for its header, section IDs and lengths, types, imports, functions, memory, globals, exports, bodies, instructions, immediates, data, names, and custom sections. Semantic opcode/immediate, literal-data, identifier, callee, operator, and function-name bytes use the exact parser-owned `literal`, `name`, `callee`, or `operator` range when available. Name-length LEB128 prefixes, section framing, temporary locals, and encoder/ABI scaffolding have explicit synthetic origins. `program.wasm.map` follows the WebAssembly Source Map convention: every generated position is line zero and its column is the corresponding module byte offset. Synthetic regions remain unmapped. The binary contains a `sourceMappingURL` custom section whose payload is the relative URL `program.wasm.map`. See [source provenance and mappings](source-maps.md).
+
+## Qualified tools
+
+The canonical validator is WABT `wasm-validate` 1.0.36, overridable with `SEMANTIFOLD_WASM_VALIDATE`. The canonical browser command is `chromium`, backed by Google Chrome Stable 152.0.7977.82 and overridable with `SEMANTIFOLD_CHROMIUM`. The Ubuntu 26.04 development image pins WABT package `1.0.36+dfsg+~cs1.0.36-2ubuntu1`; Ubuntu 24.04 TensorBuzz uses the checksum-qualified Ubuntu revision `1.0.36+dfsg+~cs1.0.36-2ubuntu1`. Both install the exact Chrome `152.0.7977.82-1` amd64 package with SHA-256 `4d25e4a028c78a7ae910683551c2f234792cc5595e7e3e34939f599342ada446` and expose `/usr/local/bin/chromium`. The image probes remove only the package's observed single trailing ASCII space before exact version equality. Toolchain discovery likewise trims Chrome's non-empty stdout before the same anchored version policy and keeps package-launcher stderr separate rather than treating it as version text. Missing or mismatched tools fail acceptance; tests never download them.