[ASDAlexander77]

What this adds

-mm=own is a fourth memory model beside gc, rc and none. Each heap block has exactly one owner, inferred at compile time, and there is no reference counting at run time. If a program's ownership can't be proven, it is a compile error at the source location. The design is in docs/superpowers/specs/2026-09-24-own-memory-model-design.md, and phase-0 results are in §11 of that file. The plan is in docs/superpowers/plans/2026-09-28-own-phase-0.md.

Phase 0 (this PR):

• Model and flag. MemoryModelOwn, the -mm=own flag, the test-runner variant, and tracksOwnership() next to isRefCounted(). All 21 isRefCounted() sites were audited; MLIRGen emits exactly what it emits under rc.
• Lowering under own. A release loads the block header and checks for immortal, then destroys; nothing is counted. No __tslang_inc_ref or __tslang_dec_ref is ever referenced. Type descriptors and interface tags carry no retain routine. Any retain that reaches LLVM lowering is an error, never silently erased.
• OwnershipInferencePass, at the affine level, runs under own only. It counts the uses that take a value: an owning declaration, a store, an array insertion, a return, or any use not on a short borrow list. It also counts the temporary when rc releases it.
  • A fresh value may have at most one owner.
  • That owner must be in the block that made the value, and nothing may use the value after it. This one check covers loops, branches and use after move.
  • When the rule holds, rc's retains for that value are erased. Anything else is an error: aliases, unknown producers, delete, closures, and interface or any boxing.
• Verifier order. Under own, --verify-ownership runs before inference, so it checks rc's pairing on the IR as MLIRGen produced it.

Measured

test/tester/tools/measure.ps1 builds each program ahead of time at -O3 and reads its peak working set:

Program	rc	none	own
1M fresh strings	4.2 MB	80.9 MB	4.2 MB
1M instances from a factory	4.2 MB	50.2 MB	4.2 MB

Tests

• Programs that must compile and run: 6, each under JIT and ahead of time. Each is also checked for no counting routines in its LLVM output.
• Programs that must be rejected: 13, each with its expected error text. They include the review's double-free reproductions, for example a push inside a loop, push-then-let, two lets of one new, and delete.
• Teeth:
  • With every retain kept, all positive checks fail at the lowering backstop.
  • With the owner count loosened to two, a two-owner program compiles and segfaults under own, while rc runs it correctly. That program is now a negative test.
• Suites:
  • Full Release suite on Windows: 3096/3096.
  • Debug: every own test passes. 47 Debug-only failures also fail on main: LLVM asserts in the throw-f32, cast-to-f32, throw-bool-bigint and linkname tests; hangs in two async JIT tests (00async-await, 00async-gc-threading); and output mismatches.
  • Linux was not run.

Also in this PR

• An error a pass reports fails the compile, even when the pass succeeds #398's Debug fix. An error a pass reports fails the compile, even when the pass succeeds #398 merged before this follow-up landed. Its message test used an input that hits llvm_unreachable at CastLogicHelper.h:856 in a Debug build before reporting anything. The test now uses an input that reports the same error in both builds.

Known limits (input to phase 1)

These are rejected in phase 0:

• closures of any kind;
• interface and any boxing;
• delete;
• owned locals declared inside a try body;
• callees that keep a parameter;
• a move out of the block that made the value.

The review also found latent over-releases in rc itself, reachable through consumption: push inside a loop, two lets of one new, and use of a folded const after an inner let. They are not fixed here.

🤖 Generated with Claude Code