-mm=own, phase 4: function signatures and any

[ASDAlexander77]

Phase 4 of -mm=own (spec §7): function signatures and any. Plan: docs/superpowers/plans/2026-09-29-own-phase-4.md. Results: spec §15.

What changes

• OwnershipSignaturePass (new module pass, own only, just before inference). It resolves each call it can: direct calls, virtual calls whose family is all private and defined here, and the .instanceOf slot. It computes three facts per function and pins on each call the facts its candidates agree on:
  • __own_no_drops: the callee destroys nothing its caller can reach.
  • __own_result_borrows = K: the result is a borrow of argument K. Getters, return this.c, a returned parameter, ___unbox.
  • __own_params: parameters the callee keeps, by storing or pushing them.
• Closed world. A caller that doesn't know a borrowed result or a kept parameter would double-free. So only a private function whose every use is a call this pass resolves (or a class vtable entry), in families that agree, gets those two facts. Otherwise its body keeps rc's convention, and its error gets a note saying why.
• Inference:
  • a call drops a borrow only if its callee may drop, so `${this.color} area=${this.area()}` compiles;
  • a call whose result borrows is a borrow read, with its temporary release and a consuming let's releases erased;
  • a kept argument moves into the call; the callee's move must reach every return.
• Soundness fix: a call given a borrow now uses it for as long as the callee runs. Phase 3 compiled f(h.c) where f resets h.c through a global, then reads its parameter.
• any (this touches MLIRGen, so it changes rc and gc too):
  • the boxing cast now carries its birth reference, as a printed number does. This is rc's §14.5 leak fix: a box held by a folded const, or passed straight to a call, was never released;
  • the catch copy thunk's store takes that reference over;
  • under own, a copy thunk's read out of the exception object is a move (nothing gives it back), and <C>a borrows the payload through ___unbox.

Verification

• Release suite 3229/3229, after merging main (JIT cache: each .ts file is compiled into an object kept in __jit #405).
• Debug own tests 327/330. All three failures are known Debug-only ones:
  • test-jit-rc-owned-async and test-jit-none-owned-async: the ~AsyncToken assert;
  • ownership-verifier-4: the linkname DictionaryAttr assert, which also fires under gc.
• Memory, AOT, identical at -O3 and -O1: own is flat at 4.8 MB on all four new positives, where none reaches 559–1658 MB. rc reads 12.6 MB on own_getter_borrow (see below).
• Teeth, with the erasures for each verdict kept:
  • owned arguments: own_param_kept fails;
  • borrowed results: own_getter_borrow and own_any_box fail.
• Corpus under own: 272 → 303 of 564. None lost. "Takes a second reference" fell from 189 to 149 files.
• 4 new positives and 14 new negatives. Every positive runs under JIT and AOT, reads through a churn(), and was checked under gc first.

Rulings

• A returned parameter is a borrowed result, not an owned parameter (Rust's elision). §2.4 read it the other way, which would make every <C>u move u.
• A parameter kept on some paths only is an error. The fix, drop elaboration, is not in scope.
• Export and import of facts is deferred. Exported functions get no owned or borrowed facts, which is sound. The three export_class_abstract* files from §14.4 therefore stay rejected: their class is exported, so area may be overridden elsewhere.

Found, not fixed here

• rc never releases a getter's result used as a temporary (h.cc.x): 12.6 MB against own's 4.8 MB.
• Every model: <B>anyValue segfaults when B implements an interface. mlirGenInstanceOfOpaque calls vtable slot 0 as .instanceOf, but such a class keeps the interface's vtable there. The fix changes the vtable layout.

🤖 Generated with Claude Code