radiance · commit

module: (WIP) Associate updates with authority

413073d6c84f35132b0beba62a1a6121ee9d112e1b21c9990dcc42ffb541c512

Store module update payloads in permission-associated cells and keep immutable module identities separate from their mutable state. The module graph retains the external authority used by its update table.

This checkpoint does not compile yet: shared update access still needs a matching authority binding derived from the graph-owned permission reference.

Next, preserve that permission identity across graph access, pass the focused module and compiler checks, then reduce any remaining lifetime plumbing before running the full suite.

Assisted-by: Codex:gpt-5.6-sol

Alexis Sellier committed 4 days ago 1 parent d1a3f60b

compiler/radiance.rad +141 -127

    /// Whether to emit debug info (.debug file).
    debug: bool,
}

/// Compilation context.
record CompileContext {
record CompileContext: 'permission {
    /// Array of packages to compile.
    packages: [package::Package; MAX_PACKAGES],
    /// Driver inputs for each package slot.
    inputs: [PackageInput; MAX_PACKAGES],
    /// Number of packages.
    packageCount: u32,
    /// Index of entry package.
    entryPkgIdx: ?u32,
    /// Global module graph shared by all packages.
    graph: module::ModuleGraph,
    graph: module::ModuleGraph 'permission,
    /// Resolver configuration.
    config: resolver::Config,
    /// What to dump during compilation.
    dump: Dump,
    /// Output path for binary.

        asmPathCount: 0,
    };
}

/// Register, load, and parse `path` within `pkg`.
unsafe fn processModule(
unsafe fn processModule 'permission (
    pkg: *unsafe mut package::Package,
    graph: &mut module::ModuleGraph,
    graph: &mut module::ModuleGraph 'permission,
    path: *[u8],
    nodeArena: &mut ast::NodeArena,
    sourceArena: &mut alloc::Arena
) throws (Error) {
    pkgLog(pkg, &["parsing", "(", path, ")", ".."]);

        debug: debugEnabled,
    };
}

/// Parse CLI arguments and return compilation context.
unsafe fn processCommand(
unsafe fn processCommand 'permission (
    args: *[*[u8]],
    arena: &mut ast::NodeArena
) -> CompileContext throws (Error) {
    arena: &mut ast::NodeArena,
    permission: &'permission mut module::Permission
) -> CompileContext 'permission throws (Error) {
    let mut inputs = [packageInput(""); MAX_PACKAGES];
    let command = try parseCommand(args, &mut inputs[..]);
    let graph = module::moduleGraph(&mut MODULE_ENTRIES[..], arena);
    let mut ctx = CompileContext {
    let graph = module::moduleGraph(&mut MODULE_ENTRIES[..], arena, permission);
    let mut ctx = CompileContext 'permission {
        packages: undefined,
        inputs,
        packageCount: command.packageCount,
        entryPkgIdx: command.entryPkgIdx,
        graph,

    }
    return ctx;
}

/// Get the entry package from the context.
fn getEntryPackage(ctx: &CompileContext) -> package::Package throws (Error) {
fn getEntryPackage 'permission (ctx: &CompileContext 'permission) -> package::Package throws (Error) {
    let entryIdx = ctx.entryPkgIdx else {
        throw error(&["no entry package specified"]);
    };
    return ctx.packages[entryIdx];
}

/// Return the startup assembly path for the entry package, if one was supplied.
fn getEntryStartupPath(ctx: &CompileContext) -> ?*[u8] {
fn getEntryStartupPath 'permission (ctx: &CompileContext 'permission) -> ?*[u8] {
    let entryIdx = ctx.entryPkgIdx else {
        panic "getEntryStartupPath: no entry package";
    };
    return ctx.inputs[entryIdx].startupPath;
}

/// Get root module info from a package.
fn getRootModule(pkg: &package::Package, graph: &module::ModuleGraph) -> RootModule throws (Error) {
fn getRootModule 'permission (pkg: &package::Package, graph: &module::ModuleGraph 'permission) -> RootModule throws (Error) {
    let rootId = pkg.rootModuleId else {
        throw error(&["no root module found"]);
    };
    let rootEntry = module::get(graph, rootId) else {
        throw error(&["root module entry not found"]);
    };
    let rootAst = module::astFor(rootEntry) else {
    let rootAst = module::astFor(graph, rootEntry) else {
        throw error(&["root module has no AST"]);
    };
    return RootModule { entry: rootEntry, ast: rootAst };
}

/// Dump the module graph.
unsafe fn dumpGraph(ctx: &CompileContext) {
unsafe fn dumpGraph 'permission (ctx: &CompileContext 'permission) {
    let mut arena = alloc::new(&mut MAIN_ARENA[..]);
    module::printer::printGraph(&ctx.graph, &mut arena);
}

/// Dump the parsed AST.
unsafe fn dumpAst(ctx: &CompileContext) throws (Error) {
unsafe fn dumpAst 'permission (ctx: &CompileContext 'permission) throws (Error) {
    let pkg = try getEntryPackage(ctx);
    let root = try getRootModule(&pkg, &ctx.graph);
    let mut arena = alloc::new(&mut MAIN_ARENA[..]);

    ast::printer::printTree(root.ast, &mut arena);
}

/// Lower all packages into a single IL program.
/// Dependencies are lowered first, then the entry package.
unsafe fn lowerAllPackages 'arena (
    ctx: &CompileContext,
unsafe fn lowerAllPackages 'arena 'permission (
    ctx: &CompileContext 'permission,
    res: *unsafe mut resolver::Resolver 'arena
) -> il::Program throws (Error) {
    let entryIdx = ctx.entryPkgIdx else {
        panic "lowerAllPackages: no entry package";
    };
    let entryPkg = &ctx.packages[entryIdx];

    // Create the lowerer accumulator using entry package's name.
    let options = lower::LowerOptions { debug: ctx.debug, buildTest: ctx.config.buildTest };
    let arena = (&mut *res.arena) as *unsafe mut alloc::Arena;
    let resolved: 'phase = &*res, graph = &ctx.graph where 'arena: 'phase in {
        let mut low = lower::lowerer(
            resolved, graph, entryPkg.name, arena, options
        );
    let resolved: 'phase = &*res where 'arena: 'phase in {
        let mut low = lower::lowerer(resolved, entryPkg.name, arena, options);
        try lowerAllPackagesInto(ctx, &mut low, &mut *arena);

        // Finalize and return the unified program.
        return lower::finalize(low);
    }
}

/// Lower all packages into an existing lowerer.
unsafe fn lowerAllPackagesInto 'arena 'phase (
    ctx: &CompileContext,
unsafe fn lowerAllPackagesInto 'arena 'phase 'permission (
    ctx: &CompileContext 'permission,
    low: &mut lower::Lowerer 'arena 'phase,
    functionArena: &mut alloc::Arena
) throws (Error) where 'arena: 'phase {
    let entryIdx = ctx.entryPkgIdx else {
        panic "lowerAllPackagesInto: no entry package";

    // Lower entry package.
    try lowerPackage(ctx, low, &ctx.packages[entryIdx], true, functionArena);
}

/// Lower all modules in a package into the lowerer accumulator.
unsafe fn lowerPackage 'arena 'phase (
    ctx: &CompileContext,
unsafe fn lowerPackage 'arena 'phase 'permission (
    ctx: &CompileContext 'permission,
    low: &mut lower::Lowerer 'arena 'phase,
    pkg: &package::Package,
    isEntry: bool,
    functionArena: &mut alloc::Arena
) throws (Error) where 'arena: 'phase {

    };
    // Set lowerer's package context for qualified name generation.
    // TODO: We shouldn't have to call this manually.
    lower::setPackage(low, pkg.name);

    try lowerModuleTreeInto(ctx, low, &ctx.graph, rootId, isEntry, pkg, functionArena);
    try lowerModuleTreeInto(low, &ctx.graph, rootId, isEntry, pkg, functionArena);
}

/// Recursively lower a module and all its children into the accumulator.
unsafe fn lowerModuleTreeInto 'arena 'phase (
    ctx: &CompileContext,
unsafe fn lowerModuleTreeInto 'arena 'phase 'permission (
    low: &mut lower::Lowerer 'arena 'phase,
    graph: &module::ModuleGraph,
    graph: &module::ModuleGraph 'permission,
    modId: u16,
    isRoot: bool,
    pkg: &package::Package,
    functionArena: &mut alloc::Arena
) throws (Error) where 'arena: 'phase {
    let entry = module::get(graph, modId) else {
        throw error(&["module entry not found"]);
    };
    let modAst = module::astFor(entry) else {
    let modAst = module::astFor(graph, entry) else {
        throw error(&["module has no AST"]);
    };
    pkgLog(pkg, &["lowering", "(", entry.filePath, ")", ".."]);

    try lower::lowerModule(low, modId, modAst, isRoot, functionArena) catch err {

        io::printError("\n");

        throw Error::Other;
    };
    // Recurse into children.
    for i in 0..module::childCount(entry) {
        let childId = module::childAt(entry, i);
        try lowerModuleTreeInto(ctx, low, graph, childId, false, pkg, functionArena);
    for i in 0..module::childCount(graph, entry) {
        let childId = module::childAt(graph, entry, i);
        try lowerModuleTreeInto(low, graph, childId, false, pkg, functionArena);
    }
}

/// Build a scope access chain: a::b::c from a slice of identifiers.
unsafe fn synthScopeAccess(arena: &mut ast::NodeArena, path: &[*[u8]]) -> *ast::Node {


    return name;
}

/// Scan a single module's AST for `@test` functions and append them to `tests`.
fn collectModuleTests(
    entry: *module::ModuleEntry,
    tests: &mut [?TestDesc],
    testCount: &mut u32
) {
    let modAst = module::astFor(entry) else {
fn collectModuleTests 'permission (graph: &module::ModuleGraph 'permission, entry: *module::ModuleEntry, tests: &mut [?TestDesc], testCount: &mut u32) {
    let modAst = module::astFor(graph, entry) else {
        return;
    };
    let case ast::NodeValue::Block(block) = modAst.value else {
        return;
    };

        }
    }
}

/// Collect initialized test descriptors from one package in module order.
fn collectPackageTests(graph: &module::ModuleGraph, packageId: u16, tests: &mut [?TestDesc]) -> u32 {
fn collectPackageTests 'permission (graph: &module::ModuleGraph 'permission, packageId: u16, tests: &mut [?TestDesc]) -> u32 {
    let mut count: u32 = 0;
    for modIdx in 0..graph.entriesLen {
    for modIdx in 0..module::entryCount(graph) {
        if let entry = module::get(graph, modIdx as u16) {
            if entry.packageId == packageId {
                collectModuleTests(entry, tests, &mut count);
                collectModuleTests(graph, entry, tests, &mut count);
            }
        }
    }
    return count;
}

///     ]);
/// }
/// ```
///
/// Uses `#`-prefixed names to avoid conflicts with user code.
unsafe fn generateTestRunner(
    ctx: *unsafe mut CompileContext,
    arena: &mut ast::NodeArena
) throws (Error) {
unsafe fn generateTestRunner 'permission (ctx: *unsafe mut CompileContext 'permission, arena: &mut ast::NodeArena) throws (Error) {
    let entryPkg = try getEntryPackage(ctx);
    let root = try getRootModule(&entryPkg, &ctx.graph);

    // Collect test functions from the entry package's modules.
    let mut tests: [?TestDesc; MAX_TESTS] = [nil; MAX_TESTS];

}

/// Serialize debug entries and write the `.debug` file.
/// Resolves module IDs to file paths via the module graph.
/// Format per entry is `{pc: u32,  offset: u32, filePath: [u8], NULL}`.
fn writeDebugInfo(
fn writeDebugInfo 'permission (
    entries: &[types::DebugEntry],
    graph: &module::ModuleGraph,
    graph: &module::ModuleGraph 'permission,
    basePath: *[u8],
    buf: &mut [u8]
) throws (Error) {
    if entries.len == 0 {
        return;

    }
    try writeDataWithExt(&buf[..pos], basePath, DEBUG_EXT);
}

/// Run the resolver on the parsed modules.
unsafe fn runResolver 'arena (ctx: &CompileContext, mainArena: &'arena mut alloc::Arena, nodeCount: u32) -> resolver::Resolver 'arena throws (Error) {
unsafe fn runResolver 'arena 'permission (
    ctx: &CompileContext 'permission,
    mainArena: &'arena mut alloc::Arena,
    nodeCount: u32
) -> resolver::Resolver 'arena throws (Error) {
    let entryPkg = try getEntryPackage(ctx);

    pkgLog(&entryPkg, &["resolving", ".."]);

    let nodeDataSize = nodeCount * @sizeOf(resolver::NodeData);


    // Resolve all packages.
    // TODO: Fix this error printing dance.
    let diags = try resolver::resolve(&mut res, &ctx.graph, &resolverPkgs[..resolverPackageCount]) catch {
        let diags = resolver::diagnostics(&mut res);
        resolver::printer::printDiagnostics(&diags, &res);
        resolver::printer::printDiagnostics(&diags, &res, &ctx.graph);
        throw Error::Other;
    };
    if not resolver::success(&diags) {
        resolver::printer::printDiagnostics(&diags, &res);
        resolver::printer::printDiagnostics(&diags, &res, &ctx.graph);
        let mut countBuf: [u8; 10] = undefined;
        let start = fmt::formatU32(diags.errors.len, &mut countBuf[..]);
        io::printError("radiance: failed: ");
        io::printError(&countBuf[start..]);
        io::printError(" errors\n");


    rv64::addAssembly(generator, program);
}

/// Assemble all inputs collected in the package inputs.
unsafe fn assembleAsmInputs(
    ctx: &CompileContext,
unsafe fn assembleAsmInputs 'permission (
    ctx: &CompileContext 'permission,
    generator: &mut rv64::Generator,
    asmDataLen: &mut u32,
    arena: &mut alloc::Arena
) -> *[u8] throws (Error) {
    for i in 0..ctx.packageCount {

    }
    return &ASM_RO_DATA_BUF[..*asmDataLen];
}

/// Generate dependency packages before the entry package.
unsafe fn generateAllPackagesInto 'arena 'phase (
    ctx: &CompileContext, low: &mut lower::Lowerer 'arena 'phase,
    generator: &mut rv64::Generator, fnArena: &mut alloc::Arena
unsafe fn generateAllPackagesInto 'arena 'phase 'permission (
    ctx: &CompileContext 'permission,
    low: &mut lower::Lowerer 'arena 'phase,
    generator: &mut rv64::Generator,
    fnArena: &mut alloc::Arena
) throws (Error) where 'arena: 'phase {
    let entryIdx = ctx.entryPkgIdx else panic "generateAllPackagesInto: no entry package";
    for i in 0..ctx.packageCount {
        if i <> entryIdx {
            try generatePackageInto(ctx, low, &ctx.packages[i], false, generator, fnArena);

    }
    try generatePackageInto(ctx, low, &ctx.packages[entryIdx], true, generator, fnArena);
}

/// Generate all functions in one package.
unsafe fn generatePackageInto 'arena 'phase (
    ctx: &CompileContext, low: &mut lower::Lowerer 'arena 'phase,
    pkg: &package::Package, isEntry: bool,
    generator: &mut rv64::Generator, fnArena: &mut alloc::Arena
unsafe fn generatePackageInto 'arena 'phase 'permission (
    ctx: &CompileContext 'permission,
    low: &mut lower::Lowerer 'arena 'phase,
    pkg: &package::Package,
    isEntry: bool,
    generator: &mut rv64::Generator,
    fnArena: &mut alloc::Arena
) throws (Error) where 'arena: 'phase {
    let rootId = pkg.rootModuleId else throw error(&["no root module found"]);
    lower::setPackage(low, pkg.name);
    try generateModuleTree(ctx, low, rootId, isEntry, pkg, generator, fnArena);
}

/// Lower and consume each function before visiting the next declaration.
unsafe fn generateModuleTree 'arena 'phase (
    ctx: &CompileContext, low: &mut lower::Lowerer 'arena 'phase,
    modId: u16, isRoot: bool, pkg: &package::Package,
    generator: &mut rv64::Generator, fnArena: &mut alloc::Arena
unsafe fn generateModuleTree 'arena 'phase 'permission (
    ctx: &CompileContext 'permission,
    low: &mut lower::Lowerer 'arena 'phase,
    modId: u16,
    isRoot: bool,
    pkg: &package::Package,
    generator: &mut rv64::Generator,
    fnArena: &mut alloc::Arena
) throws (Error) where 'arena: 'phase {
    let entry = module::get(&ctx.graph, modId) else throw error(&["module entry not found"]);
    let modAst = module::astFor(entry) else throw error(&["module has no AST"]);
    let entry = module::get(&ctx.graph, modId)
        else throw error(&["module entry not found"]);
    let modAst = module::astFor(&ctx.graph, entry)
        else throw error(&["module has no AST"]);
    pkgLog(pkg, &["lowering", "(", entry.filePath, ")", ".."]);
    set low.currentMod = modId;
    let mut cursor = try lower::moduleCursor(modAst, isRoot) catch err {
        io::printError("radiance: internal error during lowering: ");
        lower::printError(err);

            throw Error::Other;
        };
        let next = result else break;
        codegen::emit(generator, fnArena, &*next.function, next.role);
    }
    for i in 0..module::childCount(entry) {
        let childId = module::childAt(entry, i);
    for i in 0..module::childCount(&ctx.graph, entry) {
        let childId = module::childAt(&ctx.graph, entry, i);
        try generateModuleTree(ctx, low, childId, false, pkg, generator, fnArena);
    }
}

/// Lower all packages while streaming each lowered function into RV64 codegen.
unsafe fn lowerAndGenerateAllPackages 'arena (
    ctx: &CompileContext,
unsafe fn lowerAndGenerateAllPackages 'arena 'permission (
    ctx: &CompileContext 'permission,
    res: *unsafe mut resolver::Resolver 'arena,
    fnArena: &mut alloc::Arena,
    codegenOptions: CodegenOptions
) -> rv64::Program throws (Error) {
    let entryIdx = ctx.entryPkgIdx else {

            placement: rv64::image::Placement::Hosted,
        },
        emitterStorage
    );
    let arena = (&mut *res.arena) as *unsafe mut alloc::Arena;
    let resolved: 'phase = &*res, graph = &ctx.graph where 'arena: 'phase in {
        let mut low = lower::lowerer(
            resolved, graph, entryPkg.name, arena, options
        );
    let resolved: 'phase = &*res where 'arena: 'phase in {
        let mut low = lower::lowerer(resolved, entryPkg.name, arena, options);
        let mut asmDataLen: u32 = 0;
        if let path = startupPath {
            try assembleAsmModule(&mut generator, entryPkg, path, &mut asmDataLen, arena);
        }
        try generateAllPackagesInto(ctx, &mut low, &mut generator, fnArena);
        try generateAllPackagesInto(
            ctx, &mut low, &mut generator, fnArena
        );
        let asmData = try assembleAsmInputs(ctx, &mut generator, &mut asmDataLen, arena);

        match generator.entryPatch {
            case rv64::EntryPatch::Reserved(targetName) => {
                if targetName == nil {
                    throw error(&["fatal:", "no default function found"]);
                }

    /// Default function entry.
    entry: ?*[u8],
}

/// Collect exported definitions and the default entry from a package's source modules.
unsafe fn packageExports(
    ctx: &CompileContext,
unsafe fn packageExports 'permission (
    ctx: &CompileContext 'permission,
    pkg: &package::Package,
    ilProgram: &il::Program,
    exports: &mut [binary::Export],
    arena: &mut alloc::Arena
) -> PackageExports throws (Error) {
    let mut count: u32 = 0;
    let mut entryName: ?*[u8] = nil;
    for i in 0..ctx.graph.entriesLen {
    for i in 0..module::entryCount(&ctx.graph) {
        let modEntry = module::get(&ctx.graph, i as u16) else continue;
        if modEntry.packageId <> pkg.id {
            continue;
        }
        let root = module::astFor(modEntry) else continue;
        let root = module::astFor(&ctx.graph, modEntry) else continue;
        let case ast::NodeValue::Block(block) = root.value else continue;
        for node in block.statements {
            let mut ident: ?*ast::Node = nil;
            let mut attrs: ?ast::Attributes = nil;
            let mut kind = binary::ExportKind::Function;

        throw error(&["cannot write binary RIL package", name]);
    }
}

/// Emit one binary RIL file per package into an existing directory.
unsafe fn emitPackages 'arena (
    ctx: &CompileContext,
unsafe fn emitPackages 'arena 'permission (
    ctx: &CompileContext 'permission,
    res: *unsafe mut resolver::Resolver 'arena,
    directory: *[u8]
) throws (Error) {
    for i in 0..ctx.packageCount {
        if ctx.inputs[i].asmPathCount > 0 or ctx.inputs[i].startupPath <> nil {

    let suffix = mem::stripPrefix(owner, name) else return false;
    return suffix.len > 2 and suffix[0] == ':' and suffix[1] == ':';
}

/// Lower, optionally dump, and optionally generate binary output.
unsafe fn compile 'arena (
    ctx: &CompileContext,
unsafe fn compile 'arena 'permission (
    ctx: &CompileContext 'permission,
    res: *unsafe mut resolver::Resolver 'arena,
    fnArena: &mut alloc::Arena
) throws (Error) {
    let entryPkg = try getEntryPackage(ctx);
    if let directory = ctx.rilDirectory {

        il::printer::printProgram(&mut out, &program);
        io::print("\n");
        return;
    }
    if ctx.dump == Dump::Asm {
        let result = try lowerAndGenerateAllPackages(ctx, res, fnArena, CodegenOptions {
            logPath: nil,
            debug: false,
            entryMode: CodegenEntryMode::None,
        });
        let result = try lowerAndGenerateAllPackages(
            ctx, res, fnArena, CodegenOptions {
                logPath: nil,
                debug: false,
                entryMode: CodegenEntryMode::None,
            }
        );
        printer::printCodeTo(&mut out, entryPkg.name, result.code, result.funcs);
        io::print("\n");

        return;
    }

    let outPath = ctx.outputPath else {
        try lowerAllPackages(ctx, res);
        return;
    };
    let startupPath = getEntryStartupPath(ctx);
    let result = try lowerAndGenerateAllPackages(ctx, res, fnArena, CodegenOptions {
        logPath: outPath,
        debug: ctx.debug,
        entryMode: CodegenEntryMode::None
            if startupPath <> nil
            else CodegenEntryMode::DefaultEntry,
    });
    let result = try lowerAndGenerateAllPackages(
        ctx, res, fnArena, CodegenOptions {
            logPath: outPath,
            debug: ctx.debug,
            entryMode: CodegenEntryMode::None
                if startupPath <> nil
                else CodegenEntryMode::DefaultEntry,
        }
    );

    let codeBytes = @sliceOf(result.code.ptr as *u8, result.code.len * rv64::INSTR_SIZE as u32);
    if not writeImage(
        codeBytes,
        &RO_DATA_BUF[..result.roDataSize],

    }
    pkgLog(&entryPkg, &["ok", "(", outPath, ")"]);
}

@default unsafe fn main(env: *sys::Env) -> i32 {
    let mut arena = ast::nodeArena(&mut TEMP_ARENA[..]);
    let mut ctx = try processCommand(env.args, &mut arena) catch {
        return 1;
    };
    match ctx.dump {
        case Dump::Ast => {
            try dumpAst(&ctx) catch {
    let mut owner = module::Permission {};
    let permission: 'permission = &mut owner in {
        let mut arena = ast::nodeArena(&mut TEMP_ARENA[..]);
        let mut ctx = try processCommand(env.args, &mut arena, permission) catch {
            return 1;
        };
        match ctx.dump {
            case Dump::Ast => {
                try dumpAst(&ctx) catch {
                    return 1;
                };
                return 0;
            }
            case Dump::Graph => {
                dumpGraph(&ctx);
                return 0;
            }
            else => {}
        }
        // Generate test runner if in test mode.
        if ctx.config.buildTest {
            try generateTestRunner(&mut ctx, &mut arena) catch {
                return 1;
            };
            return 0;
        }
        case Dump::Graph => {
            dumpGraph(&ctx);
        // Run resolution phase.
        let mut mainArena = alloc::new(&mut MAIN_ARENA[..]);
        let arenaRef: 'arena = &mut mainArena, context = &ctx in {
            let mut res = try runResolver(
                context, arenaRef, arena.nextId
            ) catch {
                return 1;
            };
            let mut fnArena = alloc::new(&mut FN_ARENA[..]);

            // Lower, dump, and/or generate output.
            try compile(context, &mut res, &mut fnArena) catch {
                return 1;
            };
            return 0;
        }
        else => {}
    }
    // Generate test runner if in test mode.
    if ctx.config.buildTest {
        try generateTestRunner(&mut ctx, &mut arena) catch {
            return 1;
        };
    }
    // Run resolution phase.
    let mut mainArena = alloc::new(&mut MAIN_ARENA[..]);
    let arenaRef: 'arena = &mut mainArena, context = &ctx in {
        let mut res = try runResolver(context, arenaRef, arena.nextId) catch {
            return 1;
        };
        let mut fnArena = alloc::new(&mut FN_ARENA[..]);

        // Lower, dump, and/or generate output.
        try compile(context, &mut res, &mut fnArena) catch {
            return 1;
        };
        return 0;
    }
}

lib/std/lang/lower.rad +6 -14

    /// Arena for persistent lowering state, including data and symbol names.
    arena: *unsafe mut alloc::Arena,
    /// Resolver for type information. Used to query types, symbols, and
    /// compile-time constant values during lowering.
    resolver: &'phase resolver::Resolver 'arena,
    /// Module graph for cross-module symbol resolution.
    moduleGraph: ?&'phase module::ModuleGraph,
    /// Package name for qualified symbol names.
    pkgName: *[u8],
    /// Current module being lowered.
    currentMod: ?u16,
    /// Global data items (string literals, constants, static arrays).

    pkgName: *[u8],
    arena: &mut alloc::Arena
) -> il::Program throws (LowerError) {
    let functionArena = (&mut *arena) as *unsafe mut alloc::Arena;
    let resolved: 'phase = &*res where 'arena: 'phase in {
        let mut low = lowererState(resolved, nil, pkgName, functionArena,
        let mut low = lowererState(resolved, pkgName, functionArena,
            LowerOptions { debug: false, buildTest: false });
        try lowerDecls(&mut low, root, true, functionArena);

        return finalize(low);
    }

/////////////////////////////////
// Multi-Module Lowering API   //
/////////////////////////////////

/// Create a lowerer for multi-module compilation.
/// The resolver, graph, and persistent arena must outlive the returned lowerer.
/// The resolver and persistent arena must outlive the returned lowerer.
export unsafe fn lowerer 'arena 'phase (
    res: &'phase resolver::Resolver 'arena,
    graph: &'phase module::ModuleGraph,
    pkgName: *[u8],
    arena: *unsafe mut alloc::Arena,
    options: LowerOptions
) -> Lowerer 'arena 'phase where 'arena: 'phase {
    return lowererState(res, graph, pkgName, arena, options);
    return lowererState(res, pkgName, arena, options);
}

/// Initialize lowering state with empty owned collections and borrowed metadata.
fn lowererState 'arena 'phase (
    res: &'phase resolver::Resolver 'arena,
    graph: ?&'phase module::ModuleGraph,
    pkgName: *[u8],
    arena: *unsafe mut alloc::Arena,
    options: LowerOptions
) -> Lowerer 'arena 'phase where 'arena: 'phase {
    return Lowerer 'arena 'phase {
        arena,
        resolver: res,
        moduleGraph: graph,
        pkgName,
        currentMod: nil,
        data: &mut [],
        packageDataStart: 0,
        functions: &mut [],


/////////////////////////////////
// Qualified Name Construction //
/////////////////////////////////

/// Get module path segments for the current or specified module.
/// Returns empty slice if no module graph or module not found.
/// Return the qualified path for a module from retained resolver identities.
/// Returns an empty slice if no module is active or its identity is missing.
fn getModulePath 'arena 'phase (self: &Lowerer 'arena 'phase, modId: ?u16) -> *[*[u8]] where 'arena: 'phase {
    let graph = self.moduleGraph else {
        return &[];
    };
    let mut id = modId;
    if id == nil {
        set id = self.currentMod;
    }
    let actualId = id else {
        return &[];
    };
    let entry = module::get(graph, actualId) else {
    let entry = resolver::moduleFor(self.resolver, actualId) else {
        return &[];
    };
    return module::moduleQualifiedPath(entry);
}


lib/std/lang/module.rad +106 -63

    PathTooDeep,
    /// Attempt to register a module before its parent.
    MissingParent,
}

/// Zero-state owner for authority over one module graph's mutable state.
export record Permission {}

/// Module metadata recorded inside the dependency graph.
export record ModuleEntry: Copy {
    /// Numeric identifier for the slot (index in the graph array).
    id: u16,
    /// Package identifier this module belongs to.

    name: *[u8],
    /// Logical path from the root module to this module.
    path: [*[u8]; MAX_MODULE_PATH_DEPTH],
    /// Number of segments inside `path`.
    pathDepth: u32,
    /// Mutable module state shared by all entry views.
    updates: *cell ModuleUpdates,
}

/// Copyable state stored in a module entry's cell.
/// Copyable state stored in a module graph update cell.
export record ModuleUpdates: Copy {
    /// Current lifecycle state.
    state: ModuleState,
    /// Child module identifiers declared directly inside this module.
    children: [u16; MAX_MODULES],

    /// Source text for this module (for error reporting).
    source: ?*[u8],
}

/// Dense storage for all modules referenced by the compilation unit.
export record ModuleGraph {
export opaque record ModuleGraph: 'permission {
    /// Entry identities indexed by module identifier.
    entries: *mut [?*ModuleEntry],
    /// Permission-associated updates indexed by module identifier.
    updates: [?*cell 'permission ModuleUpdates; MAX_MODULES],
    /// External authority for the update cells in this graph.
    permission: &'permission mut Permission,
    /// Number of initialized entries.
    entriesLen: u32,
    /// Arena for AST nodes and stable entry allocations.
    arena: ?*unsafe mut ast::NodeArena,
}

/// Initialize an empty module graph backed by the provided storage.
/// The AST arena must outlive the graph and all retained entry views.
/// Entry allocation must occur outside speculative parser allocations.
export unsafe fn moduleGraph(
export unsafe fn moduleGraph 'permission (
    storage: *mut [?*ModuleEntry],
    arena: &mut ast::NodeArena
) -> ModuleGraph {
    arena: &mut ast::NodeArena,
    permission: &'permission mut Permission
) -> ModuleGraph 'permission {
    for i in 0..storage.len {
        set storage[i] = nil;
    }
    return ModuleGraph {
    return ModuleGraph 'permission {
        entries: storage,
        updates: [nil; MAX_MODULES],
        permission,
        entriesLen: 0,
        arena: arena as *unsafe mut ast::NodeArena,
    };
}

/// Register a root module residing at `path` for a package.
export unsafe fn registerRoot(graph: &mut ModuleGraph, pool: &mut strings::Pool, packageId: u16, filePath: *[u8]) -> u16 throws (ModuleError) {
export unsafe fn registerRoot 'permission (graph: &mut ModuleGraph 'permission, pool: &mut strings::Pool, packageId: u16, filePath: *[u8]) -> u16 throws (ModuleError) {
    let name = try basenameSlice(filePath);
    return try registerRootWithName(graph, pool, packageId, name, filePath);
}

/// Register a root module with an explicit name and file path for a package.
export unsafe fn registerRootWithName(
    graph: &mut ModuleGraph, pool: &mut strings::Pool,
export unsafe fn registerRootWithName 'permission (
    graph: &mut ModuleGraph 'permission, pool: &mut strings::Pool,
    packageId: u16,
    name: *[u8],
    filePath: *[u8]
) -> u16 throws (ModuleError) {
    let m = try allocModule(graph, pool, packageId, name, filePath);

    return id;
}

/// Register a child module.
/// Returns the module identifier.
export unsafe fn registerChild(
    graph: &mut ModuleGraph, pool: &mut strings::Pool,
export unsafe fn registerChild 'permission (
    graph: &mut ModuleGraph 'permission, pool: &mut strings::Pool,
    parentId: u16,
    name: *[u8],
    filePath: *[u8]
) -> u16 throws (ModuleError) {
    assert name.len > 0, "registerChild: name must not be empty";

    for p in moduleQualifiedPath(parent) {
        try appendPathSegment(m, p);
    }
    try appendPathSegment(m, name);

    let id = try addChild(parent, m.id);
    let id = try addChild(graph, parent, m.id);
    publish(graph, m);
    return id;
}

/// Return the number of registered module identities.
export fn entryCount 'permission (graph: &ModuleGraph 'permission) -> u32 {
    return graph.entriesLen;
}

/// Fetch a read-only view of the module identified by `id`.
export fn get(graph: &ModuleGraph, id: u16) -> ?*ModuleEntry {
export fn get 'permission (graph: &ModuleGraph 'permission, id: u16) -> ?*ModuleEntry {
    if not isValidId(graph, id) {
        return nil;
    }
    return graph.entries[id as u32];
}

/// Return the identifier of the child stored at `index`.
export fn childAt(m: *ModuleEntry, index: u32) -> u16 {
    let updates = *m.updates;
    assert index < updates.childrenLen, "childAt: index must be valid";
    return updates.children[index];
export fn childAt 'permission (graph: &ModuleGraph 'permission, m: *ModuleEntry, index: u32) -> u16 {
    let cell = updatesFor(graph, m.id);
    let authority: 'loan = &*graph.permission, updates = &*cell in {
        assert index < updates.childrenLen, "childAt: index must be valid";
        return updates.children[index];
    }
}

/// Public accessor for a module's directory prefix.
export fn moduleDir(m: *ModuleEntry) -> *[u8] {
    return &m.filePath[..m.dirLen];

    assert m.pathDepth > 0, "moduleQualifiedPath: path must not be empty";
    return &m.path[..m.pathDepth];
}

/// Retrieve the lifecycle state for `id`.
export fn state(graph: &ModuleGraph, id: u16) -> ModuleState throws (ModuleError) {
export fn state 'permission (graph: &ModuleGraph 'permission, id: u16) -> ModuleState throws (ModuleError) {
    let m = get(graph, id) else {
        throw ModuleError::NotFound(id);
    };
    return (*m.updates).state;
    let cell = updatesFor(graph, m.id);
    let authority: 'loan = &*graph.permission, updates = &*cell in {
        return updates.state;
    }
}

/// Record the parsed AST root for `id`.
export fn setAst(graph: &mut ModuleGraph, id: u16, root: *ast::Node) throws (ModuleError) {
export fn setAst 'permission (graph: &mut ModuleGraph 'permission, id: u16, root: *ast::Node) throws (ModuleError) {
    let m = get(graph, id) else throw ModuleError::NotFound(id);
    let mut updates = *m.updates;
    set updates.ast = root;
    set updates.state = ModuleState::Parsed;
    set *m.updates = updates;
    let cell = updatesFor(graph, m.id);
    let authority: 'loan = &mut *graph.permission, updates = &mut *cell in {
        set updates.ast = root;
        set updates.state = ModuleState::Parsed;
    }
}

/// Set the source text for a module.
export fn setSource(graph: &mut ModuleGraph, id: u16, source: *[u8]) throws (ModuleError) {
export fn setSource 'permission (graph: &mut ModuleGraph 'permission, id: u16, source: *[u8]) throws (ModuleError) {
    let m = get(graph, id) else throw ModuleError::NotFound(id);
    let mut updates = *m.updates;
    set updates.source = source;
    set *m.updates = updates;
    let cell = updatesFor(graph, m.id);
    let authority: 'loan = &mut *graph.permission, updates = &mut *cell in {
        set updates.source = source;
    }
}

/// Look up a child module by name under the given parent.
export fn findChild(graph: &ModuleGraph, name: *[u8], parentId: u16) -> ?*ModuleEntry {
export fn findChild 'permission (graph: &ModuleGraph 'permission, name: *[u8], parentId: u16) -> ?*ModuleEntry {
    assert isValidId(graph, parentId), "findChild: parent identifier is valid";

    let parent = get(graph, parentId) else panic;
    let updates = *parent.updates;
    for i in 0..updates.childrenLen {
        let childId = updates.children[i];
        let child = get(graph, childId) else panic;
        if mem::eq(child.name, name) {
            return child;
    let cell = updatesFor(graph, parent.id);
    let authority: 'loan = &*graph.permission, updates = &*cell in {
        for i in 0..updates.childrenLen {
            let childId = updates.children[i];
            let child = get(graph, childId) else panic;
            if mem::eq(child.name, name) {
                return child;
            }
        }
    }
    return nil;
}



/// Register a module from a file path, creating the full hierarchy as needed.
/// The path is split into components and the module hierarchy is built accordingly.
/// If `rootId` is `nil`, registers a new root for the given package.
/// Returns the module ID of the last component.
export unsafe fn registerFromPath(graph: &mut ModuleGraph, pool: &mut strings::Pool, packageId: u16, rootId: ?u16, filePath: *[u8]) -> u16 throws (ModuleError) {
export unsafe fn registerFromPath 'permission (graph: &mut ModuleGraph 'permission, pool: &mut strings::Pool, packageId: u16, rootId: ?u16, filePath: *[u8]) -> u16 throws (ModuleError) {
    let root = rootId else {
        return try registerRoot(graph, pool, packageId, filePath);
    };
    let rootEntry = get(graph, root) else {
        panic "registerFromPath: root is missing from storage";

    }
    return try registerChild(graph, pool, parentId, childName, filePath);
}

/// Allocate a fresh entry in the graph.
unsafe fn allocModule(graph: &mut ModuleGraph, pool: &mut strings::Pool, packageId: u16, name: *[u8], filePath: *[u8]) -> *mut ModuleEntry throws (ModuleError) {
unsafe fn allocModule 'permission (graph: &mut ModuleGraph 'permission, pool: &mut strings::Pool, packageId: u16, name: *[u8], filePath: *[u8]) -> *mut ModuleEntry throws (ModuleError) {
    if graph.entriesLen >= graph.entries.len {
        throw ModuleError::CapacityExceeded;
    }
    let idx = graph.entriesLen;
    let arena = graph.arena else panic;
    let state = try! alloc::alloc(&mut arena.arena, @sizeOf(ModuleUpdates), @alignOf(ModuleUpdates)) as *mut ModuleUpdates;
    set *state = ModuleUpdates {
        state: ModuleState::Registered,
        children: [0; MAX_MODULES],
        childrenLen: 0,
        ast: nil,
        source: nil,
    };
    let updates = &cell *state;
    let updates: *cell 'permission ModuleUpdates = &cell 'permission *state;
    let authority: 'loan = &mut *graph.permission, value = &mut *updates in {
        set *value = ModuleUpdates {
            state: ModuleState::Registered,
            children: [0; MAX_MODULES],
            childrenLen: 0,
            ast: nil,
            source: nil,
        };
    }
    set graph.updates[idx] = updates;

    // TODO: This is a common pattern that needs better syntax.
    let m = try! alloc::alloc(&mut arena.arena, @sizeOf(ModuleEntry), @alignOf(ModuleEntry)) as *mut ModuleEntry;
    set *m = ModuleEntry {
        id: idx as u16,

        filePath,
        dirLen: dirLength(filePath),
        name: strings::intern(pool, name),
        path: [""; MAX_MODULE_PATH_DEPTH],
        pathDepth: 0,
        updates,
    };

    return m;
}


    set entry.path[entry.pathDepth] = segment;
    set entry.pathDepth += 1;
}

/// Append a child identifier to the parent's child list.
fn addChild(parent: *ModuleEntry, childId: u16) -> u16 throws (ModuleError) {
    let mut updates = *parent.updates;
    if updates.childrenLen >= updates.children.len {
        throw ModuleError::CapacityExceeded;
fn addChild 'permission (graph: &mut ModuleGraph 'permission, parent: *ModuleEntry, childId: u16) -> u16 throws (ModuleError) {
    let cell = updatesFor(graph, parent.id);
    let authority: 'loan = &mut *graph.permission, updates = &mut *cell in {
        if updates.childrenLen >= updates.children.len {
            throw ModuleError::CapacityExceeded;
        }
        set updates.children[updates.childrenLen] = childId;
        set updates.childrenLen += 1;
    }
    set updates.children[updates.childrenLen] = childId;
    set updates.childrenLen += 1;
    set *parent.updates = updates;

    return childId;
}

/// Publish a fully initialized module entry in identifier order.
fn publish(graph: &mut ModuleGraph, entry: *ModuleEntry) {
fn publish 'permission (graph: &mut ModuleGraph 'permission, entry: *ModuleEntry) {
    assert entry.id as u32 == graph.entriesLen;
    set graph.entries[graph.entriesLen] = entry;
    set graph.entriesLen += 1;
}

/// Return the number of registered children.
export fn childCount(entry: *ModuleEntry) -> u32 {
    return (*entry.updates).childrenLen;
export fn childCount 'permission (graph: &ModuleGraph 'permission, entry: *ModuleEntry) -> u32 {
    let cell = updatesFor(graph, entry.id);
    let authority: 'loan = &*graph.permission, updates = &*cell in {
        return updates.childrenLen;
    }
}

/// Return the current parsed root for an entry.
export fn astFor(entry: *ModuleEntry) -> ?*ast::Node {
    return (*entry.updates).ast;
export fn astFor 'permission (graph: &ModuleGraph 'permission, entry: *ModuleEntry) -> ?*ast::Node {
    let cell = updatesFor(graph, entry.id);
    let authority: 'loan = &*graph.permission, updates = &*cell in {
        return updates.ast;
    }
}

/// Return the current source text for an entry.
export fn sourceFor(entry: *ModuleEntry) -> ?*[u8] {
    return (*entry.updates).source;
export fn sourceFor 'permission (graph: &ModuleGraph 'permission, entry: *ModuleEntry) -> ?*[u8] {
    let cell = updatesFor(graph, entry.id);
    let authority: 'loan = &*graph.permission, updates = &*cell in {
        return updates.source;
    }
}

/// Return the permission-associated update cell for `id`.
fn updatesFor 'permission (graph: &ModuleGraph 'permission, id: u16) -> *cell 'permission ModuleUpdates {
    assert isValidId(graph, id), "updatesFor: module identifier is valid";
    let cell = graph.updates[id as u32] else {
        panic "updatesFor: missing update cell";
    };
    return cell;
}

/// Check if `id` points at an allocated entry.
fn isValidId(graph: &ModuleGraph, id: u16) -> bool {
fn isValidId 'permission (graph: &ModuleGraph 'permission, id: u16) -> bool {
    return (id as u32) < graph.entriesLen;
}

/// Return the length of the directory prefix for `path`.
/// Return zero if the path has no separator.

lib/std/lang/module/printer.rad +8 -7

        case super::ModuleState::Ready => return sexpr::sym("ready"),
    }
}

/// Recursively convert a module entry and its descendants to an S-expression.
unsafe fn subtreeToExpr(
unsafe fn subtreeToExpr 'permission (
    a: &mut alloc::Arena,
    graph: &super::ModuleGraph,
    graph: &super::ModuleGraph 'permission,
    entry: *super::ModuleEntry
) -> sexpr::Expr {
    let idText = formatId(a, entry.id as u32);
    let path = super::moduleQualifiedPath(entry);
    let mut pathBuf: *[sexpr::Expr] = &[];

        for seg, i in path { set buf[i] = sexpr::sym(seg); }
        set pathBuf = buf;
    }

    let mut childBuf: *[sexpr::Expr] = &[];
    let childCount = super::childCount(entry);
    let childCount = super::childCount(graph, entry);
    if childCount > 0 {
        let buf = try! sexpr::allocExprs(a, childCount);
        for i in 0..childCount {
            if let child = super::get(graph, super::childAt(entry, i)) {
            if let child = super::get(graph, super::childAt(graph, entry, i)) {
                set buf[i] = subtreeToExpr(a, graph, child);
            }
        }
        set childBuf = buf;
    }

    let state = try! super::state(graph, entry.id);
    return sexpr::block(a, "module", &[
        sexpr::sym(entry.name),
        sexpr::list(a, "id", &[sexpr::sym(idText)]),
        sexpr::list(a, "state", &[stateToExpr((*entry.updates).state)]),
        sexpr::list(a, "state", &[stateToExpr(state)]),
        sexpr::Expr::Str(entry.filePath),
        sexpr::Expr::List { head: "::", tail: pathBuf, multiline: false }
    ], childBuf);
}

/// Print the entire module graph in S-expression format.
export unsafe fn printGraph(graph: &super::ModuleGraph, arena: &mut alloc::Arena) {
export unsafe fn printGraph 'permission (graph: &super::ModuleGraph 'permission, arena: &mut alloc::Arena) {
    // Print all root modules.
    for i in 0..graph.entriesLen {
    for i in 0..super::entryCount(graph) {
        let entry = super::get(graph, i as u16) else panic;
        if entry.parent == nil {
            sexpr::print(subtreeToExpr(arena, graph, entry), 0);
            io::print("\n");
        }

lib/std/lang/module/tests.rad +224 -191

}

@test unsafe fn testRegisterChildren() throws (testing::TestError) {
    static storage: [?*super::ModuleEntry; 4] = [nil; 4];
    let mut arena = ast::nodeArena(&mut TEST_ARENA[..]);
    let mut graph = super::moduleGraph(&mut storage[..], &mut arena);

    let rootId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, nil, "src/root.rad") catch {
        throw testing::TestError::Failed;
    };
    let root = super::get(&graph, rootId) else {
        throw testing::TestError::Failed;
    };
    try expectPathSegments(root, &["root"]);

    // First child.
    let firstId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, rootId, "src/root/first.rad") catch {
        throw testing::TestError::Failed;
    };
    let first = super::get(&graph, firstId) else {
        throw testing::TestError::Failed;
    };
    try expectSliceEq(first.filePath, "src/root/first.rad");
    try expectSliceEq(first.name, "first");
    try expectPathSegments(first, &["root", "first"]);

    // Second child.
    let secondId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, rootId, "src/root/second.rad") catch {
        throw testing::TestError::Failed;
    };
    let second = super::get(&graph, secondId) else {
        throw testing::TestError::Failed;
    };
    try expectSliceEq(second.filePath, "src/root/second.rad");
    try expectSliceEq(second.name, "second");
    try expectPathSegments(second, &["root", "second"]);

    let parent = super::get(&graph, rootId) else {
        throw testing::TestError::Failed;
    };
    try testing::expect(graph.entriesLen == 3);
    try testing::expect(super::childCount(parent) == 2);
    try testing::expect(super::childAt(parent, 0) == firstId);
    try testing::expect(super::childAt(parent, 1) == secondId);
    let mut owner = super::Permission {};
    let permission: 'permission = &mut owner in {
        let mut graph = super::moduleGraph(&mut storage[..], &mut arena, permission);

        let rootId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, nil, "src/root.rad") catch {
            throw testing::TestError::Failed;
        };
        let root = super::get(&graph, rootId) else {
            throw testing::TestError::Failed;
        };
        try expectPathSegments(root, &["root"]);

        // First child.
        let firstId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, rootId, "src/root/first.rad") catch {
            throw testing::TestError::Failed;
        };
        let first = super::get(&graph, firstId) else {
            throw testing::TestError::Failed;
        };
        try expectSliceEq(first.filePath, "src/root/first.rad");
        try expectSliceEq(first.name, "first");
        try expectPathSegments(first, &["root", "first"]);

        // Second child.
        let secondId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, rootId, "src/root/second.rad") catch {
            throw testing::TestError::Failed;
        };
        let second = super::get(&graph, secondId) else {
            throw testing::TestError::Failed;
        };
        try expectSliceEq(second.filePath, "src/root/second.rad");
        try expectSliceEq(second.name, "second");
        try expectPathSegments(second, &["root", "second"]);

        let parent = super::get(&graph, rootId) else {
            throw testing::TestError::Failed;
        };
        try testing::expect(super::entryCount(&graph) == 3);
        try testing::expect(super::childCount(&graph, parent) == 2);
        try testing::expect(super::childAt(&graph, parent, 0) == firstId);
        try testing::expect(super::childAt(&graph, parent, 1) == secondId);
    }
}

@test unsafe fn testRegisterChildReusesExisting() throws (testing::TestError) {
    static storage: [?*super::ModuleEntry; 4] = [nil; 4];
    let mut arena = ast::nodeArena(&mut TEST_ARENA[..]);
    let mut graph = super::moduleGraph(&mut storage[..], &mut arena);

    let rootId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, nil, "src/main.rad") catch {
        throw testing::TestError::Failed;
    };
    let firstId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, rootId, "src/main/util.rad") catch {
        throw testing::TestError::Failed;
    };
    let secondId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, rootId, "src/main/util.rad") catch {
        throw testing::TestError::Failed;
    };
    try testing::expect(firstId == secondId);

    let parent = super::get(&graph, rootId) else {
        throw testing::TestError::Failed;
    };
    try testing::expect(graph.entriesLen == 2);
    try testing::expect(super::childCount(parent) == 1);
    let mut owner = super::Permission {};
    let permission: 'permission = &mut owner in {
        let mut graph = super::moduleGraph(&mut storage[..], &mut arena, permission);

        let rootId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, nil, "src/main.rad") catch {
            throw testing::TestError::Failed;
        };
        let firstId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, rootId, "src/main/util.rad") catch {
            throw testing::TestError::Failed;
        };
        let secondId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, rootId, "src/main/util.rad") catch {
            throw testing::TestError::Failed;
        };
        try testing::expect(firstId == secondId);

        let parent = super::get(&graph, rootId) else {
            throw testing::TestError::Failed;
        };
        try testing::expect(super::entryCount(&graph) == 2);
        try testing::expect(super::childCount(&graph, parent) == 1);
    }
}

@test fn testTrimExtensionWithRadExtension() throws (testing::TestError) {
    let input = "parser.rad";
    let result = super::trimExtension(input)

}

@test unsafe fn testRegisterFromPathHierarchy() throws (testing::TestError) {
    static storage: [?*super::ModuleEntry; 8] = [nil; 8];
    let mut arena = ast::nodeArena(&mut TEST_ARENA[..]);
    let mut graph = super::moduleGraph(&mut storage[..], &mut arena);

    // Register root module.
    let stdId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, nil, "lib/std.rad") catch {
        throw testing::TestError::Failed;
    };
    let std = super::get(&graph, stdId) else {
        throw testing::TestError::Failed;
    };
    try expectSliceEq(std.filePath, "lib/std.rad");
    try expectSliceEq(super::moduleDir(std), "lib/");
    try expectPathSegments(std, &["std"]);

    // Register child of root.
    let langId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, stdId, "lib/std/lang.rad") catch {
        throw testing::TestError::Failed;
    };
    let lang = super::get(&graph, langId) else {
        throw testing::TestError::Failed;
    };
    try expectSliceEq(lang.filePath, "lib/std/lang.rad");
    try expectSliceEq(lang.name, "lang");
    try expectSliceEq(super::moduleDir(lang), "lib/std/");
    try expectPathSegments(lang, &["std", "lang"]);

    // Register grandchild.
    let parserId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, stdId, "lib/std/lang/parser.rad") catch {
        throw testing::TestError::Failed;
    };
    let parser = super::get(&graph, parserId) else {
        throw testing::TestError::Failed;
    };
    try expectSliceEq(parser.filePath, "lib/std/lang/parser.rad");
    try expectSliceEq(parser.name, "parser");
    try expectSliceEq(super::moduleDir(parser), "lib/std/lang/");
    try expectPathSegments(parser, &["std", "lang", "parser"]);

    // Verify parent-child relationships.
    try testing::expect(graph.entriesLen == 3);
    try testing::expect(super::childCount(std) == 1);
    try testing::expect(super::childAt(std, 0) == langId);
    try testing::expect(super::childCount(lang) == 1);
    try testing::expect(super::childAt(lang, 0) == parserId);
    try testing::expect(super::childCount(parser) == 0);
    let mut owner = super::Permission {};
    let permission: 'permission = &mut owner in {
        let mut graph = super::moduleGraph(&mut storage[..], &mut arena, permission);

        // Register root module.
        let stdId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, nil, "lib/std.rad") catch {
            throw testing::TestError::Failed;
        };
        let std = super::get(&graph, stdId) else {
            throw testing::TestError::Failed;
        };
        try expectSliceEq(std.filePath, "lib/std.rad");
        try expectSliceEq(super::moduleDir(std), "lib/");
        try expectPathSegments(std, &["std"]);

        // Register child of root.
        let langId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, stdId, "lib/std/lang.rad") catch {
            throw testing::TestError::Failed;
        };
        let lang = super::get(&graph, langId) else {
            throw testing::TestError::Failed;
        };
        try expectSliceEq(lang.filePath, "lib/std/lang.rad");
        try expectSliceEq(lang.name, "lang");
        try expectSliceEq(super::moduleDir(lang), "lib/std/");
        try expectPathSegments(lang, &["std", "lang"]);

        // Register grandchild.
        let parserId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, stdId, "lib/std/lang/parser.rad") catch {
            throw testing::TestError::Failed;
        };
        let parser = super::get(&graph, parserId) else {
            throw testing::TestError::Failed;
        };
        try expectSliceEq(parser.filePath, "lib/std/lang/parser.rad");
        try expectSliceEq(parser.name, "parser");
        try expectSliceEq(super::moduleDir(parser), "lib/std/lang/");
        try expectPathSegments(parser, &["std", "lang", "parser"]);

        // Verify parent-child relationships.
        try testing::expect(super::entryCount(&graph) == 3);
        try testing::expect(super::childCount(&graph, std) == 1);
        try testing::expect(super::childAt(&graph, std, 0) == langId);
        try testing::expect(super::childCount(&graph, lang) == 1);
        try testing::expect(super::childAt(&graph, lang, 0) == parserId);
        try testing::expect(super::childCount(&graph, parser) == 0);
    }
}

@test unsafe fn testRegisterFromPathMissingParent() throws (testing::TestError) {
    static storage: [?*super::ModuleEntry; 8] = [nil; 8];
    let mut arena = ast::nodeArena(&mut TEST_ARENA[..]);
    let mut graph = super::moduleGraph(&mut storage[..], &mut arena);

    let rootId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, nil, "std.rad") catch {
    let mut owner = super::Permission {};
    let permission: 'permission = &mut owner in {
        let mut graph = super::moduleGraph(&mut storage[..], &mut arena, permission);

        let rootId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, nil, "std.rad") catch {
            throw testing::TestError::Failed;
        };
        let _ = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, rootId, "std/lang/parser.rad") catch {
            // Expected to fail due to missing intermediate parent.
            return;
        };
        throw testing::TestError::Failed;
    };
    let _ = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, rootId, "std/lang/parser.rad") catch {
        // Expected to fail due to missing intermediate parent.
        return;
    };
    throw testing::TestError::Failed;
    }
}

@test unsafe fn testRegisterFromPathDuplicateRoot() throws (testing::TestError) {
    static storage: [?*super::ModuleEntry; 8] = [nil; 8];
    let mut arena = ast::nodeArena(&mut TEST_ARENA[..]);
    let mut graph = super::moduleGraph(&mut storage[..], &mut arena);

    let rootId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, nil, "std.rad") catch {
    let mut owner = super::Permission {};
    let permission: 'permission = &mut owner in {
        let mut graph = super::moduleGraph(&mut storage[..], &mut arena, permission);

        let rootId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, nil, "std.rad") catch {
            throw testing::TestError::Failed;
        };
        let _ = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, rootId, "parser.rad") catch {
            // Expected to fail due to missing intermediate parent.
            return;
        };
        throw testing::TestError::Failed;
    };
    let _ = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, rootId, "parser.rad") catch {
        // Expected to fail due to missing intermediate parent.
        return;
    };
    throw testing::TestError::Failed;
    }
}

@test unsafe fn testRegisterFromPathRegistersRoot() throws (testing::TestError) {
    static storage: [?*super::ModuleEntry; 8] = [nil; 8];
    let mut arena = ast::nodeArena(&mut TEST_ARENA[..]);
    let mut graph = super::moduleGraph(&mut storage[..], &mut arena);

    let rootId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, nil, "lib/std.rad") catch {
        throw testing::TestError::Failed;
    };
    // Verify root module was registered with correct ID.
    try testing::expect(rootId == 0);

    let root = super::get(&graph, rootId) else {
        throw testing::TestError::Failed;
    };
    try expectSliceEq(root.name, "std");
    try expectSliceEq(root.filePath, "lib/std.rad");
    try expectPathSegments(root, &["std"]);
    let mut owner = super::Permission {};
    let permission: 'permission = &mut owner in {
        let mut graph = super::moduleGraph(&mut storage[..], &mut arena, permission);

        let rootId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, nil, "lib/std.rad") catch {
            throw testing::TestError::Failed;
        };
        // Verify root module was registered with correct ID.
        try testing::expect(rootId == 0);

        let root = super::get(&graph, rootId) else {
            throw testing::TestError::Failed;
        };
        try expectSliceEq(root.name, "std");
        try expectSliceEq(root.filePath, "lib/std.rad");
        try expectPathSegments(root, &["std"]);
    }
}

@test unsafe fn testRegisterFromPathIgnoresLeadingDirectories() throws (testing::TestError) {
    static storage: [?*super::ModuleEntry; 8] = [nil; 8];
    let mut arena = ast::nodeArena(&mut TEST_ARENA[..]);
    let mut graph = super::moduleGraph(&mut storage[..], &mut arena);

    let rootId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, nil, "src/pkg/root.rad") catch {
        throw testing::TestError::Failed;
    };
    // Verify root module was registered with correct ID.
    try testing::expect(rootId == 0);

    let langId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, rootId, "src/pkg/root/lang.rad") catch {
        throw testing::TestError::Failed;
    };
    let lang = super::get(&graph, langId) else {
        throw testing::TestError::Failed;
    };
    try expectSliceEq(lang.name, "lang");
    try expectPathSegments(lang, &["root", "lang"]);

    let parserId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, rootId, "src/pkg/root/lang/parser.rad") catch {
        throw testing::TestError::Failed;
    };
    let parser = super::get(&graph, parserId) else {
        throw testing::TestError::Failed;
    };
    try expectSliceEq(parser.name, "parser");
    try expectPathSegments(parser, &["root", "lang", "parser"]);
    let mut owner = super::Permission {};
    let permission: 'permission = &mut owner in {
        let mut graph = super::moduleGraph(&mut storage[..], &mut arena, permission);

        let rootId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, nil, "src/pkg/root.rad") catch {
            throw testing::TestError::Failed;
        };
        // Verify root module was registered with correct ID.
        try testing::expect(rootId == 0);

        let langId = try super::registerFromPath(&mut graph, &mut STRING_POOL, 0, rootId, "src/pkg/root/lang.rad") catch {
            throw testing::TestError::Failed;
        };
        let lang = super::get(&graph, langId) else {
            throw testing::TestError::Failed;
        };
        try expectSliceEq(lang.name, "lang");
        try expectPathSegments(lang, &["root", "lang"]);

        let parserId = try super::registerFromPath(
            &mut graph, &mut STRING_POOL, 0, rootId, "src/pkg/root/lang/parser.rad"
        ) catch {
            throw testing::TestError::Failed;
        };
        let parser = super::get(&graph, parserId) else {
            throw testing::TestError::Failed;
        };
        try expectSliceEq(parser.name, "parser");
        try expectPathSegments(parser, &["root", "lang", "parser"]);
    }
}

/// Move the graph owner while its published entries retain their identities.
fn relocate(graph: super::ModuleGraph) -> super::ModuleGraph {
fn relocate 'permission (
    graph: super::ModuleGraph 'permission
) -> super::ModuleGraph 'permission {
    return graph;
}

@test unsafe fn testGraphRelocation() throws (testing::TestError) {
    static DATA: [u8; 16384] = [0; 16384];
    static ENTRIES: [?*super::ModuleEntry; 2] = [nil; 2];
    static POOL: strings::Pool = strings::Pool { table: undefined, count: 0 };
    let mut arena = ast::nodeArena(&mut DATA[..]);
    let mut original = super::moduleGraph(&mut ENTRIES[..], &mut arena);
    let rootId = try! super::registerRoot(&mut original, &mut POOL, 0, "root.rad");
    let root = super::get(&original, rootId) else panic;
    let alias = root;
    let mut graph = relocate(original);
    let child = try! super::registerChild(&mut graph, &mut POOL, rootId, "child", "root/child.rad");
    try testing::expect(super::childCount(root) == 1);
    try testing::expect(super::childAt(alias, 0) == child);
    let published = super::get(&graph, rootId) else panic;
    try testing::expect(published as u64 == root as u64);
    let saved = alloc::used(&arena.arena);
    let reused = try! super::registerChild(&mut graph, &mut POOL, rootId, "child", "root/child.rad");
    try testing::expect(reused == child);
    try testing::expect(alloc::used(&arena.arena) == saved);
    let mut failed = false;
    try super::registerChild(&mut graph, &mut POOL, rootId, "full", "root/full.rad") catch {
        set failed = true;
    };
    try testing::expect(failed);
    try testing::expect(graph.entriesLen == 2);
    try testing::expect(super::childCount(alias) == 1);
    try testing::expect(alloc::used(&arena.arena) == saved);
    let source = "fn answer() -> u32 { return 42; }";
    let parsed: *ast::Node = try! parser::parse(scanner::SourceLoc::String, source, &mut arena, &mut POOL);
    try! super::setAst(&mut graph, rootId, parsed);
    try! super::setSource(&mut graph, rootId, source);
    let retainedAst = super::astFor(alias) else panic;
    try testing::expect(retainedAst as u64 == parsed as u64);
    let retainedSource = super::sourceFor(root) else panic;
    try testing::expect(mem::eq(retainedSource, source));
    try testing::expect(try! super::state(&graph, rootId) == super::ModuleState::Parsed);

    let mut owner = super::Permission {};
    let permission: 'permission = &mut owner in {
        let mut original = super::moduleGraph(&mut ENTRIES[..], &mut arena, permission);
        let rootId = try! super::registerRoot(&mut original, &mut POOL, 0, "root.rad");
        let root = super::get(&original, rootId) else panic;
        let alias = root;
        let mut graph = relocate(original);
        let child = try! super::registerChild(&mut graph, &mut POOL, rootId, "child", "root/child.rad");
        try testing::expect(super::childCount(&graph, root) == 1);
        try testing::expect(super::childAt(&graph, alias, 0) == child);
        let published = super::get(&graph, rootId) else panic;
        try testing::expect(published as u64 == root as u64);
        let saved = alloc::used(&arena.arena);
        let reused = try! super::registerChild(&mut graph, &mut POOL, rootId, "child", "root/child.rad");
        try testing::expect(reused == child);
        try testing::expect(alloc::used(&arena.arena) == saved);
        let mut failed = false;
        try super::registerChild(&mut graph, &mut POOL, rootId, "full", "root/full.rad") catch {
            set failed = true;
        };
        try testing::expect(failed);
        try testing::expect(super::entryCount(&graph) == 2);
        try testing::expect(super::childCount(&graph, alias) == 1);
        try testing::expect(alloc::used(&arena.arena) == saved);
        let source = "fn answer() -> u32 { return 42; }";
        let parsed: *ast::Node = try! parser::parse(
            scanner::SourceLoc::String, source, &mut arena, &mut POOL
        );
        try! super::setAst(&mut graph, rootId, parsed);
        try! super::setSource(&mut graph, rootId, source);
        let retainedAst = super::astFor(&graph, alias) else panic;
        try testing::expect(retainedAst as u64 == parsed as u64);
        let retainedSource = super::sourceFor(&graph, root) else panic;
        try testing::expect(mem::eq(retainedSource, source));
        try testing::expect(
            try! super::state(&graph, rootId) == super::ModuleState::Parsed
        );
    }
}

lib/std/lang/package.rad +1 -1

    set pkg.rootModuleId = nil;

}

/// Register a module described by the file path.
export unsafe fn registerModule(pkg: &mut Package, graph: &mut module::ModuleGraph, pool: &mut strings::Pool, filePath: *[u8]) -> u16
export unsafe fn registerModule 'permission (pkg: &mut Package, graph: &mut module::ModuleGraph 'permission, pool: &mut strings::Pool, filePath: *[u8]) -> u16
    throws (module::ModuleError)
{
    let modId = try module::registerFromPath(graph, pool, pkg.id, pkg.rootModuleId, filePath);
    // First registered module becomes the root.
    if pkg.rootModuleId == nil {

lib/std/lang/resolver.rad +18 -10

    types: *unsafe mut [?*TypeNode],
    /// Diagnostics recorded so far.
    errors: DiagnosticBuffer,
    /// Stable module identities indexed by module ID.
    moduleEntries: [?*module::ModuleEntry; module::MAX_MODULES],
    /// Parsed roots captured while module update authority is available.
    moduleRoots: [?*ast::Node; module::MAX_MODULES],
    /// Cache of module scopes indexed by module ID.
    moduleScopes: [?*unsafe mut Scope; module::MAX_MODULES],
    /// Trait instance registry.
    instances: [InstanceEntry; MAX_INSTANCES],
    /// Number of registered instances.

        arena,
        nodeData: NodeDataTable { entries: nodeData },
        types,
        errors: DiagnosticBuffer { entries: errors, len: 0 },
        moduleEntries: [nil; module::MAX_MODULES],
        moduleRoots: [nil; module::MAX_MODULES],
        moduleScopes,
        instances: undefined,
        instancesLen: 0,
        methods: undefined,
        methodsLen: 0,


/// Enter a sub-module. Changes the current scope into that of the sub-module.
unsafe fn enterSubModule 'arena (self: &mut Resolver 'arena, name: *[u8], node: *ast::Node) -> ModuleScope throws (ResolveError) {
    let modEntry = findChildModule(self, name, self.currentMod)
        else throw emitError(self, node, ErrorKind::UnresolvedSymbol(name));
    let modRoot = module::astFor(modEntry)
    let modRoot = self.moduleRoots[modEntry.id as u32]
        else panic "enterSubModule: analyzing module that wasn't parsed";

    return enterModuleScope(self, modRoot, modEntry);
}


    return self.moduleEntries[id as u32];
}

/// Find a retained child identity by its parent and name.
fn findChildModule 'arena (self: &Resolver 'arena, name: *[u8], parentId: u16) -> ?*module::ModuleEntry {
    let parent = moduleFor(self, parentId) else return nil;
    for i in 0..module::childCount(parent) {
        let child = moduleFor(self, module::childAt(parent, i))
            else panic "findChildModule: missing child identity";
        if mem::eq(child.name, name) {
            return child;
    for child in self.moduleEntries {
        if let entry = child {
            if entry.parent == parentId and mem::eq(entry.name, name) {
                return entry;
            }
        }
    }
    return nil;
}


    }
}

/// Resolve all packages.
/// Module entries retain their identity throughout resolution and diagnostics.
export unsafe fn resolve 'arena (self: &mut Resolver 'arena, graph: &module::ModuleGraph, packages: &[Pkg]) -> Diagnostics throws (ResolveError) {
    assert graph.entriesLen <= self.moduleEntries.len, "resolve: module registry capacity exceeded";
export unsafe fn resolve 'arena 'permission (self: &mut Resolver 'arena, graph: &module::ModuleGraph 'permission, packages: &[Pkg]) -> Diagnostics throws (ResolveError) {
    assert module::entryCount(graph) <= self.moduleEntries.len, "resolve: module registry capacity exceeded";
    for i in 0..self.moduleEntries.len {
        set self.moduleEntries[i] = module::get(graph, i as u16);
        let entry = module::get(graph, i as u16);
        set self.moduleEntries[i] = entry;
        if let present = entry {
            set self.moduleRoots[i] = module::astFor(graph, present);
        } else {
            set self.moduleRoots[i] = nil;
        }
    }

    // 1. Bind all package roots to enable cross-package references.
    for i in 0..packages.len {
        let pkg = packages[i];

lib/std/lang/resolver/opaqueTests.rad +3 -3

            let model = try tests::registerModule(&mut tests::MODULE_GRAPH, root, "model", OPAQUE_RECORD_MODEL, &mut arena);
            let result = try tests::resolveModuleTree(&mut res, root);
            try tests::expectErrorKind(&result, resolver::ErrorKind::OpaqueRecordAccess) catch error {
                io::print(program);
                io::print("\n");
                resolver::printer::printDiagnostics(&result.diagnostics, &res);
                tests::printDiagnostics(&result.diagnostics, &res);
                throw error;
            };
        }
    }
}

            let program = "use root::model; fn f(p: model::Value) -> u32 { return p.number; }";
            let nested = try tests::registerModule(&mut tests::MODULE_GRAPH, model, "child", program if child else "", &mut arena);
            let client = try tests::registerModule(&mut tests::MODULE_GRAPH, root, "client", "" if child else program, &mut arena);
            let result = try tests::resolveModuleTree(&mut res, root);
            try tests::expectErrorKind(&result, resolver::ErrorKind::OpaqueRecordAccess) catch error {
                resolver::printer::printDiagnostics(&result.diagnostics, &res);
                tests::printDiagnostics(&result.diagnostics, &res);
                throw error;
            };
        }
    }
}

        let mut res = tests::testResolver(memory);
        let result = try tests::resolveProgramStr(&mut res,
            "opaque record Value: Copy { number: u32 } opaque record Word: Copy(u32); opaque record View: 'r + Copy { number: &'r cell u32 } fn f() { let mut p = Value { number: 1 }; set p.number += 2; let q: Value = { number: p.number }; let r: ?Value = { number: 4 }; let case Value { number } = q else panic; if let case Value { number: n } = p; n > 0 {} while let case Value { number: n } = p { break; } match p { case Value { number: n } => {} else => {} } let mut w = Word(1); set *w = 2; { let field = &mut *w; set *field = 3; } let case Word(n) = w else panic; } fn g 'r (number: &'r cell u32) -> View 'r { let p = View 'r { number }; set *p.number = 42; let case View 'r { number: value } = p else panic; return { number: value }; }"
        );
        try tests::expectNoErrors(&result) catch error {
            resolver::printer::printDiagnostics(&result.diagnostics, &res);
            tests::printDiagnostics(&result.diagnostics, &res);
            throw error;
        };
    }
}

lib/std/lang/resolver/printer.rad +4 -5

        printNominalArguments(applied);
    }
}

/// Print a single diagnostic entry.
unsafe fn printError 'arena (err: &super::Error, res: &super::Resolver 'arena) {
unsafe fn printError 'arena 'permission (err: &super::Error, res: &super::Resolver 'arena, graph: &module::ModuleGraph 'permission) {
    if let node = err.node {
        // Find the module containing this error.
        if let moduleEntry = super::moduleFor(res, err.moduleId) {
            // Get the source text if available.
            if let source = module::sourceFor(moduleEntry) {
            if let source = module::sourceFor(graph, moduleEntry) {
                // Convert offset to location.
                if let loc = scanner::getLocation(scanner::SourceLoc::File(moduleEntry.filePath), source, node.span.offset) {
                    // Print: filename:line:col: error: message
                    if let case scanner::SourceLoc::File(path) = loc.source {
                        io::print(path);

            }
        }
    } else {
        io::print("error: ");
    }

    // Print the error message.
    match err.kind {
        case super::ErrorKind::TypeMismatch(mismatch) => {
            io::print("type mismatch: expected ");
            printType(mismatch.expected);

    }
    io::print("\n");
}

/// Entry point for printing resolver diagnostics in vim quickfix format.
export unsafe fn printDiagnostics 'arena (diag: &super::Diagnostics, res: &super::Resolver 'arena) {
export unsafe fn printDiagnostics 'arena 'permission (diag: &super::Diagnostics, res: &super::Resolver 'arena, graph: &module::ModuleGraph 'permission) {
    for i in 0..diag.errors.len {
        printError(&diag.errors[i], res);
        printError(&diag.errors[i], res, graph);
    }
}

/// Print an applied nominal type's explicit region arguments.
unsafe fn printNominalArguments(applied: *unsafe super::NominalApplication) {

lib/std/lang/resolver/tests.rad +148 -53

unsafe static ERROR_STORAGE: [super::Error; 16] = undefined;

/// Package scope used by resolver tests.
unsafe static PKG_SCOPE: super::Scope = undefined;

/// Module entries used by resolver tests.
/// One parsed module staged for permission-checked graph construction.
record TestModule: Copy {
    /// Parent identity, or nil for a package root.
    parentId: ?u16,
    /// Source module name.
    name: *[u8],
    /// Parsed module root.
    root: *ast::Node,
    /// Source text used to parse the root.
    source: *[u8],
}

/// Permission-independent module fixture populated by resolver tests.
export opaque record TestModuleGraph {
    /// Staged modules in identifier order.
    entries: [?TestModule; 8],
    /// Number of initialized staged modules.
    entriesLen: u32,
}

/// Module entries used when materializing resolver test graphs.
unsafe static MODULE_ENTRIES: [?*module::ModuleEntry; 8] = [nil; 8];

/// Module graph used by resolver tests.
export unsafe static MODULE_GRAPH: module::ModuleGraph = undefined;
/// Staged module graph used by resolver tests.
export unsafe static MODULE_GRAPH: TestModuleGraph = TestModuleGraph {
    entries: [nil; 8],
    entriesLen: 0,
};

/// Module AST arena storage used by resolver tests.
static MODULE_ARENA_STORAGE: [u8; 16384] = [0; 16384];

/// Module AST arena used by resolver tests.

/// Create an arena owner for one resolver test scope.
export unsafe fn testArena() -> alloc::Arena {
    return alloc::new(&mut ARENA_STORAGE[..]);
}

/// Construct a resolver backed by test storage and a synthetic module graph.
/// Construct a resolver backed by test storage.
export unsafe fn testResolver 'arena (arena: &'arena mut alloc::Arena) -> super::Resolver 'arena {
    // TODO: This should be initialized only once.
    for i in 0..LITERALS.len {
        strings::intern(&mut STRING_POOL, LITERALS[i]);
    }
    // TODO: Use local static for this.
    // Reset the module graph for each test.
    set MODULE_ARENA = ast::nodeArena(&mut MODULE_ARENA_STORAGE[..]);
    set MODULE_GRAPH = module::moduleGraph(&mut MODULE_ENTRIES[..], &mut MODULE_ARENA);
    set MODULE_GRAPH.entriesLen = 0;
    let config = super::Config { buildTest: true };
    let res = super::resolver(arena, testStorage(), config);

    return res;
}

    };
    return TestResult { diagnostics, root: stmt };
}

/// Resolve session diagnostics against the standard allocator declaration contract.
export unsafe fn resolveSessionProgramStr 'arena (self: &mut super::Resolver 'arena, program: *[u8]) -> TestResult
    throws (testing::TestError)
{
export unsafe fn resolveSessionProgramStr 'arena (
    self: &mut super::Resolver 'arena,
    program: *[u8]
) -> TestResult throws (testing::TestError) {
    let mut arena = ast::nodeArena(&mut AST_ARENA[..]);
    let root = try registerModule(&mut MODULE_GRAPH, nil, "std", "export mod lang; mod app;", &mut arena);
    let lang = try registerModule(&mut MODULE_GRAPH, root, "lang", "export mod alloc;", &mut arena);
    let root = try registerModule(
        &mut MODULE_GRAPH, nil, "std", "export mod lang; mod app;", &mut arena
    );
    let lang = try registerModule(
        &mut MODULE_GRAPH, root, "lang", "export mod alloc;", &mut arena
    );
    let allocator = try registerModule(&mut MODULE_GRAPH, lang, "alloc",
        "export record Arena { data: *mut [u8], offset: u32 } export fn reset(arena: &mut Arena) { set arena.offset = 0; } export union AllocError: Copy { OutOfMemory } export trait Alloc { unsafe fn (&mut Alloc) reserve(size: u32, alignment: u32) -> *unsafe mut opaque throws (AllocError); unsafe fn (&mut Alloc) reserveSlice(itemSize: u32, itemAlignment: u32, count: u32) -> *unsafe mut [opaque] throws (AllocError); } instance Alloc for Arena { unsafe fn (arena: &mut Arena) reserve(size: u32, alignment: u32) -> *unsafe mut opaque throws (AllocError) { panic; } unsafe fn (arena: &mut Arena) reserveSlice(size: u32, alignment: u32, count: u32) -> *unsafe mut [opaque] throws (AllocError) { panic; } }",
        &mut arena);
    let app = try registerModule(&mut MODULE_GRAPH, root, "app", program, &mut arena);
    return try resolveModuleTree(self, root);

        diagnostics: analysis.diagnostics,
        root: analysis.root,
    };
}

/// Resolve a module with the full resolution process.
/// Materialize staged modules under one externally owned permission.
unsafe fn materializeModuleGraph 'permission (
    fixture: &TestModuleGraph,
    permission: &'permission mut module::Permission
) -> module::ModuleGraph 'permission throws (testing::TestError) {
    set MODULE_ARENA = ast::nodeArena(&mut MODULE_ARENA_STORAGE[..]);
    let mut graph = module::moduleGraph(
        &mut MODULE_ENTRIES[..], &mut MODULE_ARENA, permission
    );
    for i in 0..fixture.entriesLen {
        let staged = fixture.entries[i] else throw testing::TestError::Failed;
        let id = if let parentId = staged.parentId {
            try module::registerChild(
                &mut graph, &mut STRING_POOL, parentId, staged.name, "<test>"
            ) catch {
                throw testing::TestError::Failed;
            }
        } else {
            try module::registerRootWithName(
                &mut graph, &mut STRING_POOL, 0, staged.name, "<test>"
            ) catch {
                throw testing::TestError::Failed;
            }
        };
        if id as u32 != i {
            throw testing::TestError::Failed;
        }
        try module::setAst(&mut graph, id, staged.root) catch {
            throw testing::TestError::Failed;
        };
        try module::setSource(&mut graph, id, staged.source) catch {
            throw testing::TestError::Failed;
        };
    }
    return graph;
}

/// Print module diagnostics using a freshly materialized permission-checked graph.
export unsafe fn printDiagnostics 'arena (
    diagnostics: &super::Diagnostics,
    res: &super::Resolver 'arena
) {
    let mut owner = module::Permission {};
    let permission: 'permission = &mut owner in {
        let graph = try! materializeModuleGraph(&MODULE_GRAPH, permission);
        super::printer::printDiagnostics(diagnostics, res, &graph);
    }
}

/// Resolve a staged module tree with the full resolution process.
export unsafe fn resolveModuleTree 'arena (
    res: &mut super::Resolver 'arena,
    rootId: u16
) -> TestResult throws (testing::TestError) {
    let root = module::get(&MODULE_GRAPH, rootId)
        else throw testing::TestError::Failed;
    let rootAst = module::astFor(root)
        else throw testing::TestError::Failed;
    let packages = [super::Pkg {
        rootEntry: root,
        rootAst,
    }];
    let diagnostics = try super::resolve(res, &MODULE_GRAPH, &packages[..]) catch {
        throw testing::TestError::Failed;
    };
    return TestResult { diagnostics, root: rootAst };
    let mut owner = module::Permission {};
    let permission: 'permission = &mut owner in {
        let graph = try materializeModuleGraph(&MODULE_GRAPH, permission);
        let root = module::get(&graph, rootId)
            else throw testing::TestError::Failed;
        let rootAst = module::astFor(&graph, root)
            else throw testing::TestError::Failed;
        let packages = [super::Pkg {
            rootEntry: root,
            rootAst,
        }];
        let diagnostics = try super::resolve(
            res, &graph, &packages[..]
        ) catch {
            throw testing::TestError::Failed;
        };
        return TestResult { diagnostics, root: rootAst };
    }
}

/// Register a module in the graph and attach a parsed AST to it.
/// If parentId is nil, registers as a root module.
/// Register a parsed module in the permission-independent test fixture.
/// If `parentId` is nil, registers a root module.
export unsafe fn registerModule(
    graph: &mut module::ModuleGraph,
    graph: &mut TestModuleGraph,
    parentId: ?u16,
    name: *[u8],
    code: *[u8],
    arena: &mut ast::NodeArena
) -> u16 throws (testing::TestError) {
    let filePath = "<test>";
    let mut modId: u16 = undefined;
    if let parent = parentId {
        set modId = try module::registerChild(graph, &mut STRING_POOL, parent, name, filePath) catch {
            throw testing::TestError::Failed;
        };
    } else {
        set modId = try module::registerRootWithName(graph, &mut STRING_POOL, 0, name, filePath) catch {
            throw testing::TestError::Failed;
        };
    if graph.entriesLen >= graph.entries.len {
        throw testing::TestError::Failed;
    }
    let root = try parser::parse(scanner::SourceLoc::String, code, arena, &mut STRING_POOL) catch {
    let root = try parser::parse(
        scanner::SourceLoc::String, code, arena, &mut STRING_POOL
    ) catch {
        panic "registerModule: parsing failed";
    };
    try module::setAst(graph, modId, root) catch {
        panic "registerModule: module not found";
    let id = graph.entriesLen as u16;
    set graph.entries[graph.entriesLen] = TestModule {
        parentId,
        name,
        root,
        source: code,
    };
    return modId;
    set graph.entriesLen += 1;
    return id;
}

/// Ensure an expression statement produces the expected type and return the expression node.
fn expectExprStmtType 'arena (self: &super::Resolver 'arena, node: *ast::Node, expected: super::Type) -> *ast::Node
    throws (testing::TestError)

    let storage: 'test = &mut arena in {
        let mut res = testResolver(storage);
        if let _ = super::moduleFor(&res, 0) {
            throw testing::TestError::Failed;
        }
        let root = try! module::registerRootWithName(&mut MODULE_GRAPH, &mut STRING_POOL, 0, "root", "/root.rad");
        let child = try! module::registerChild(&mut MODULE_GRAPH, &mut STRING_POOL, root, "child", "/child.rad");
        let diagnostics = try! super::resolve(&mut res, &MODULE_GRAPH, &[]);
        assert super::success(&diagnostics);
        set MODULE_GRAPH.entriesLen = 0;
        set MODULE_ENTRIES[root as u32] = nil;
        set MODULE_ENTRIES[child as u32] = nil;
        try checkModuleQueries(&res, root, child);
        let empty = try! super::resolve(&mut res, &MODULE_GRAPH, &[]);
        assert super::success(&empty);
        set MODULE_ARENA = ast::nodeArena(&mut MODULE_ARENA_STORAGE[..]);
        let mut root: u16 = 0;
        let mut child: u16 = 0;
        let mut owner = module::Permission {};
        let permission: 'permission = &mut owner in {
            let mut graph = module::moduleGraph(
                &mut MODULE_ENTRIES[..], &mut MODULE_ARENA, permission
            );
            set root = try! module::registerRootWithName(
                &mut graph, &mut STRING_POOL, 0, "root", "/root.rad"
            );
            set child = try! module::registerChild(
                &mut graph, &mut STRING_POOL, root, "child", "/child.rad"
            );
            let diagnostics = try! super::resolve(&mut res, &graph, &[]);
            assert super::success(&diagnostics);
        }
        let mut emptyOwner = module::Permission {};
        let emptyPermission: 'empty = &mut emptyOwner in {
            let graph = module::moduleGraph(
                &mut MODULE_ENTRIES[..], &mut MODULE_ARENA, emptyPermission
            );
            try checkModuleQueries(&res, root, child);
            let empty = try! super::resolve(&mut res, &graph, &[]);
            assert super::success(&empty);
        }
        if let _ = super::moduleFor(&res, root) {
            throw testing::TestError::Failed;
        }
    }
}

193	193		/// Whether to emit debug info (.debug file).
194	194		debug: bool,
195	195		}
196	196
197	197		/// Compilation context.
198		-	record CompileContext {
	198	+	record CompileContext: 'permission {
199	199		/// Array of packages to compile.
200	200		packages: [package::Package; MAX_PACKAGES],
201	201		/// Driver inputs for each package slot.
202	202		inputs: [PackageInput; MAX_PACKAGES],
203	203		/// Number of packages.
204	204		packageCount: u32,
205	205		/// Index of entry package.
206	206		entryPkgIdx: ?u32,
207	207		/// Global module graph shared by all packages.
208		-	graph: module::ModuleGraph,
	208	+	graph: module::ModuleGraph 'permission,
209	209		/// Resolver configuration.
210	210		config: resolver::Config,
211	211		/// What to dump during compilation.
212	212		dump: Dump,
213	213		/// Output path for binary.

291	291		asmPathCount: 0,
292	292		};
293	293		}
294	294
295	295		/// Register, load, and parse `path` within `pkg`.
296		-	unsafe fn processModule(
	296	+	unsafe fn processModule 'permission (
297	297		pkg: *unsafe mut package::Package,
298		-	graph: &mut module::ModuleGraph,
	298	+	graph: &mut module::ModuleGraph 'permission,
299	299		path: *[u8],
300	300		nodeArena: &mut ast::NodeArena,
301	301		sourceArena: &mut alloc::Arena
302	302		) throws (Error) {
303	303		pkgLog(pkg, &["parsing", "(", path, ")", ".."]);

486	486		debug: debugEnabled,
487	487		};
488	488		}
489	489
490	490		/// Parse CLI arguments and return compilation context.
491		-	unsafe fn processCommand(
	491	+	unsafe fn processCommand 'permission (
492	492		args: [[u8]],
493		-	arena: &mut ast::NodeArena
494		-	) -> CompileContext throws (Error) {
	493	+	arena: &mut ast::NodeArena,
	494	+	permission: &'permission mut module::Permission
	495	+	) -> CompileContext 'permission throws (Error) {
495	496		let mut inputs = [packageInput(""); MAX_PACKAGES];
496	497		let command = try parseCommand(args, &mut inputs[..]);
497		-	let graph = module::moduleGraph(&mut MODULE_ENTRIES[..], arena);
498		-	let mut ctx = CompileContext {
	498	+	let graph = module::moduleGraph(&mut MODULE_ENTRIES[..], arena, permission);
	499	+	let mut ctx = CompileContext 'permission {
499	500		packages: undefined,
500	501		inputs,
501	502		packageCount: command.packageCount,
502	503		entryPkgIdx: command.entryPkgIdx,
503	504		graph,

520	521		}
521	522		return ctx;
522	523		}
523	524
524	525		/// Get the entry package from the context.
525		-	fn getEntryPackage(ctx: &CompileContext) -> package::Package throws (Error) {
	526	+	fn getEntryPackage 'permission (ctx: &CompileContext 'permission) -> package::Package throws (Error) {
526	527		let entryIdx = ctx.entryPkgIdx else {
527	528		throw error(&["no entry package specified"]);
528	529		};
529	530		return ctx.packages[entryIdx];
530	531		}
531	532
532	533		/// Return the startup assembly path for the entry package, if one was supplied.
533		-	fn getEntryStartupPath(ctx: &CompileContext) -> ?*[u8] {
	534	+	fn getEntryStartupPath 'permission (ctx: &CompileContext 'permission) -> ?*[u8] {
534	535		let entryIdx = ctx.entryPkgIdx else {
535	536		panic "getEntryStartupPath: no entry package";
536	537		};
537	538		return ctx.inputs[entryIdx].startupPath;
538	539		}
539	540
540	541		/// Get root module info from a package.
541		-	fn getRootModule(pkg: &package::Package, graph: &module::ModuleGraph) -> RootModule throws (Error) {
	542	+	fn getRootModule 'permission (pkg: &package::Package, graph: &module::ModuleGraph 'permission) -> RootModule throws (Error) {
542	543		let rootId = pkg.rootModuleId else {
543	544		throw error(&["no root module found"]);
544	545		};
545	546		let rootEntry = module::get(graph, rootId) else {
546	547		throw error(&["root module entry not found"]);
547	548		};
548		-	let rootAst = module::astFor(rootEntry) else {
	549	+	let rootAst = module::astFor(graph, rootEntry) else {
549	550		throw error(&["root module has no AST"]);
550	551		};
551	552		return RootModule { entry: rootEntry, ast: rootAst };
552	553		}
553	554
554	555		/// Dump the module graph.
555		-	unsafe fn dumpGraph(ctx: &CompileContext) {
	556	+	unsafe fn dumpGraph 'permission (ctx: &CompileContext 'permission) {
556	557		let mut arena = alloc::new(&mut MAIN_ARENA[..]);
557	558		module::printer::printGraph(&ctx.graph, &mut arena);
558	559		}
559	560
560	561		/// Dump the parsed AST.
561		-	unsafe fn dumpAst(ctx: &CompileContext) throws (Error) {
	562	+	unsafe fn dumpAst 'permission (ctx: &CompileContext 'permission) throws (Error) {
562	563		let pkg = try getEntryPackage(ctx);
563	564		let root = try getRootModule(&pkg, &ctx.graph);
564	565		let mut arena = alloc::new(&mut MAIN_ARENA[..]);
565	566
566	567		ast::printer::printTree(root.ast, &mut arena);
567	568		}
568	569
569	570		/// Lower all packages into a single IL program.
570	571		/// Dependencies are lowered first, then the entry package.
571		-	unsafe fn lowerAllPackages 'arena (
572		-	ctx: &CompileContext,
	572	+	unsafe fn lowerAllPackages 'arena 'permission (
	573	+	ctx: &CompileContext 'permission,
573	574		res: *unsafe mut resolver::Resolver 'arena
574	575		) -> il::Program throws (Error) {
575	576		let entryIdx = ctx.entryPkgIdx else {
576	577		panic "lowerAllPackages: no entry package";
577	578		};
578	579		let entryPkg = &ctx.packages[entryIdx];
579	580
580	581		// Create the lowerer accumulator using entry package's name.
581	582		let options = lower::LowerOptions { debug: ctx.debug, buildTest: ctx.config.buildTest };
582	583		let arena = (&mut res.arena) as unsafe mut alloc::Arena;
583		-	let resolved: 'phase = &*res, graph = &ctx.graph where 'arena: 'phase in {
584		-	let mut low = lower::lowerer(
585		-	resolved, graph, entryPkg.name, arena, options
586		-	);
	584	+	let resolved: 'phase = &*res where 'arena: 'phase in {
	585	+	let mut low = lower::lowerer(resolved, entryPkg.name, arena, options);
587	586		try lowerAllPackagesInto(ctx, &mut low, &mut *arena);
588	587
589	588		// Finalize and return the unified program.
590	589		return lower::finalize(low);
591	590		}
592	591		}
593	592
594	593		/// Lower all packages into an existing lowerer.
595		-	unsafe fn lowerAllPackagesInto 'arena 'phase (
596		-	ctx: &CompileContext,
	594	+	unsafe fn lowerAllPackagesInto 'arena 'phase 'permission (
	595	+	ctx: &CompileContext 'permission,
597	596		low: &mut lower::Lowerer 'arena 'phase,
598	597		functionArena: &mut alloc::Arena
599	598		) throws (Error) where 'arena: 'phase {
600	599		let entryIdx = ctx.entryPkgIdx else {
601	600		panic "lowerAllPackagesInto: no entry package";

609	608		// Lower entry package.
610	609		try lowerPackage(ctx, low, &ctx.packages[entryIdx], true, functionArena);
611	610		}
612	611
613	612		/// Lower all modules in a package into the lowerer accumulator.
614		-	unsafe fn lowerPackage 'arena 'phase (
615		-	ctx: &CompileContext,
	613	+	unsafe fn lowerPackage 'arena 'phase 'permission (
	614	+	ctx: &CompileContext 'permission,
616	615		low: &mut lower::Lowerer 'arena 'phase,
617	616		pkg: &package::Package,
618	617		isEntry: bool,
619	618		functionArena: &mut alloc::Arena
620	619		) throws (Error) where 'arena: 'phase {

623	622		};
624	623		// Set lowerer's package context for qualified name generation.
625	624		// TODO: We shouldn't have to call this manually.
626	625		lower::setPackage(low, pkg.name);
627	626
628		-	try lowerModuleTreeInto(ctx, low, &ctx.graph, rootId, isEntry, pkg, functionArena);
	627	+	try lowerModuleTreeInto(low, &ctx.graph, rootId, isEntry, pkg, functionArena);
629	628		}
630	629
631	630		/// Recursively lower a module and all its children into the accumulator.
632		-	unsafe fn lowerModuleTreeInto 'arena 'phase (
633		-	ctx: &CompileContext,
	631	+	unsafe fn lowerModuleTreeInto 'arena 'phase 'permission (
634	632		low: &mut lower::Lowerer 'arena 'phase,
635		-	graph: &module::ModuleGraph,
	633	+	graph: &module::ModuleGraph 'permission,
636	634		modId: u16,
637	635		isRoot: bool,
638	636		pkg: &package::Package,
639	637		functionArena: &mut alloc::Arena
640	638		) throws (Error) where 'arena: 'phase {
641	639		let entry = module::get(graph, modId) else {
642	640		throw error(&["module entry not found"]);
643	641		};
644		-	let modAst = module::astFor(entry) else {
	642	+	let modAst = module::astFor(graph, entry) else {
645	643		throw error(&["module has no AST"]);
646	644		};
647	645		pkgLog(pkg, &["lowering", "(", entry.filePath, ")", ".."]);
648	646
649	647		try lower::lowerModule(low, modId, modAst, isRoot, functionArena) catch err {

653	651		io::printError("\n");
654	652
655	653		throw Error::Other;
656	654		};
657	655		// Recurse into children.
658		-	for i in 0..module::childCount(entry) {
659		-	let childId = module::childAt(entry, i);
660		-	try lowerModuleTreeInto(ctx, low, graph, childId, false, pkg, functionArena);
	656	+	for i in 0..module::childCount(graph, entry) {
	657	+	let childId = module::childAt(graph, entry, i);
	658	+	try lowerModuleTreeInto(low, graph, childId, false, pkg, functionArena);
661	659		}
662	660		}
663	661
664	662		/// Build a scope access chain: a::b::c from a slice of identifiers.
665	663		unsafe fn synthScopeAccess(arena: &mut ast::NodeArena, path: &[[u8]]) -> ast::Node {

690	688
691	689		return name;
692	690		}
693	691
694	692		/// Scan a single module's AST for `@test` functions and append them to `tests`.
695		-	fn collectModuleTests(
696		-	entry: *module::ModuleEntry,
697		-	tests: &mut [?TestDesc],
698		-	testCount: &mut u32
699		-	) {
700		-	let modAst = module::astFor(entry) else {
	693	+	fn collectModuleTests 'permission (graph: &module::ModuleGraph 'permission, entry: *module::ModuleEntry, tests: &mut [?TestDesc], testCount: &mut u32) {
	694	+	let modAst = module::astFor(graph, entry) else {
701	695		return;
702	696		};
703	697		let case ast::NodeValue::Block(block) = modAst.value else {
704	698		return;
705	699		};

718	712		}
719	713		}
720	714		}
721	715
722	716		/// Collect initialized test descriptors from one package in module order.
723		-	fn collectPackageTests(graph: &module::ModuleGraph, packageId: u16, tests: &mut [?TestDesc]) -> u32 {
	717	+	fn collectPackageTests 'permission (graph: &module::ModuleGraph 'permission, packageId: u16, tests: &mut [?TestDesc]) -> u32 {
724	718		let mut count: u32 = 0;
725		-	for modIdx in 0..graph.entriesLen {
	719	+	for modIdx in 0..module::entryCount(graph) {
726	720		if let entry = module::get(graph, modIdx as u16) {
727	721		if entry.packageId == packageId {
728		-	collectModuleTests(entry, tests, &mut count);
	722	+	collectModuleTests(graph, entry, tests, &mut count);
729	723		}
730	724		}
731	725		}
732	726		return count;
733	727		}

773	767		/// ]);
774	768		/// }
775	769		/// ```
776	770		///
777	771		/// Uses `#`-prefixed names to avoid conflicts with user code.
778		-	unsafe fn generateTestRunner(
779		-	ctx: *unsafe mut CompileContext,
780		-	arena: &mut ast::NodeArena
781		-	) throws (Error) {
	772	+	unsafe fn generateTestRunner 'permission (ctx: *unsafe mut CompileContext 'permission, arena: &mut ast::NodeArena) throws (Error) {
782	773		let entryPkg = try getEntryPackage(ctx);
783	774		let root = try getRootModule(&entryPkg, &ctx.graph);
784	775
785	776		// Collect test functions from the entry package's modules.
786	777		let mut tests: [?TestDesc; MAX_TESTS] = [nil; MAX_TESTS];

921	912		}
922	913
923	914		/// Serialize debug entries and write the `.debug` file.
924	915		/// Resolves module IDs to file paths via the module graph.
925	916		/// Format per entry is `{pc: u32, offset: u32, filePath: [u8], NULL}`.
926		-	fn writeDebugInfo(
	917	+	fn writeDebugInfo 'permission (
927	918		entries: &[types::DebugEntry],
928		-	graph: &module::ModuleGraph,
	919	+	graph: &module::ModuleGraph 'permission,
929	920		basePath: *[u8],
930	921		buf: &mut [u8]
931	922		) throws (Error) {
932	923		if entries.len == 0 {
933	924		return;

953	944		}
954	945		try writeDataWithExt(&buf[..pos], basePath, DEBUG_EXT);
955	946		}
956	947
957	948		/// Run the resolver on the parsed modules.
958		-	unsafe fn runResolver 'arena (ctx: &CompileContext, mainArena: &'arena mut alloc::Arena, nodeCount: u32) -> resolver::Resolver 'arena throws (Error) {
	949	+	unsafe fn runResolver 'arena 'permission (
	950	+	ctx: &CompileContext 'permission,
	951	+	mainArena: &'arena mut alloc::Arena,
	952	+	nodeCount: u32
	953	+	) -> resolver::Resolver 'arena throws (Error) {
959	954		let entryPkg = try getEntryPackage(ctx);
960	955
961	956		pkgLog(&entryPkg, &["resolving", ".."]);
962	957
963	958		let nodeDataSize = nodeCount * @sizeOf(resolver::NodeData);

986	981
987	982		// Resolve all packages.
988	983		// TODO: Fix this error printing dance.
989	984		let diags = try resolver::resolve(&mut res, &ctx.graph, &resolverPkgs[..resolverPackageCount]) catch {
990	985		let diags = resolver::diagnostics(&mut res);
991		-	resolver::printer::printDiagnostics(&diags, &res);
	986	+	resolver::printer::printDiagnostics(&diags, &res, &ctx.graph);
992	987		throw Error::Other;
993	988		};
994	989		if not resolver::success(&diags) {
995		-	resolver::printer::printDiagnostics(&diags, &res);
	990	+	resolver::printer::printDiagnostics(&diags, &res, &ctx.graph);
996	991		let mut countBuf: [u8; 10] = undefined;
997	992		let start = fmt::formatU32(diags.errors.len, &mut countBuf[..]);
998	993		io::printError("radiance: failed: ");
999	994		io::printError(&countBuf[start..]);
1000	995		io::printError(" errors\n");

1049	1044
1050	1045		rv64::addAssembly(generator, program);
1051	1046		}
1052	1047
1053	1048		/// Assemble all inputs collected in the package inputs.
1054		-	unsafe fn assembleAsmInputs(
1055		-	ctx: &CompileContext,
	1049	+	unsafe fn assembleAsmInputs 'permission (
	1050	+	ctx: &CompileContext 'permission,
1056	1051		generator: &mut rv64::Generator,
1057	1052		asmDataLen: &mut u32,
1058	1053		arena: &mut alloc::Arena
1059	1054		) -> *[u8] throws (Error) {
1060	1055		for i in 0..ctx.packageCount {

1070	1065		}
1071	1066		return &ASM_RO_DATA_BUF[..*asmDataLen];
1072	1067		}
1073	1068
1074	1069		/// Generate dependency packages before the entry package.
1075		-	unsafe fn generateAllPackagesInto 'arena 'phase (
1076		-	ctx: &CompileContext, low: &mut lower::Lowerer 'arena 'phase,
1077		-	generator: &mut rv64::Generator, fnArena: &mut alloc::Arena
	1070	+	unsafe fn generateAllPackagesInto 'arena 'phase 'permission (
	1071	+	ctx: &CompileContext 'permission,
	1072	+	low: &mut lower::Lowerer 'arena 'phase,
	1073	+	generator: &mut rv64::Generator,
	1074	+	fnArena: &mut alloc::Arena
1078	1075		) throws (Error) where 'arena: 'phase {
1079	1076		let entryIdx = ctx.entryPkgIdx else panic "generateAllPackagesInto: no entry package";
1080	1077		for i in 0..ctx.packageCount {
1081	1078		if i <> entryIdx {
1082	1079		try generatePackageInto(ctx, low, &ctx.packages[i], false, generator, fnArena);

347	372		filePath,
348	373		dirLen: dirLength(filePath),
349	374		name: strings::intern(pool, name),
350	375		path: [""; MAX_MODULE_PATH_DEPTH],
351	376		pathDepth: 0,
352		-	updates,
353	377		};
354	378
355	379		return m;
356	380		}
357	381

1084	1081		}
1085	1082		try generatePackageInto(ctx, low, &ctx.packages[entryIdx], true, generator, fnArena);
1086	1083		}
1087	1084
1088	1085		/// Generate all functions in one package.
1089		-	unsafe fn generatePackageInto 'arena 'phase (
1090		-	ctx: &CompileContext, low: &mut lower::Lowerer 'arena 'phase,
1091		-	pkg: &package::Package, isEntry: bool,
1092		-	generator: &mut rv64::Generator, fnArena: &mut alloc::Arena
	1086	+	unsafe fn generatePackageInto 'arena 'phase 'permission (
	1087	+	ctx: &CompileContext 'permission,
	1088	+	low: &mut lower::Lowerer 'arena 'phase,
	1089	+	pkg: &package::Package,
	1090	+	isEntry: bool,
	1091	+	generator: &mut rv64::Generator,
	1092	+	fnArena: &mut alloc::Arena
1093	1093		) throws (Error) where 'arena: 'phase {
1094	1094		let rootId = pkg.rootModuleId else throw error(&["no root module found"]);
1095	1095		lower::setPackage(low, pkg.name);
1096	1096		try generateModuleTree(ctx, low, rootId, isEntry, pkg, generator, fnArena);
1097	1097		}
1098	1098
1099	1099		/// Lower and consume each function before visiting the next declaration.
1100		-	unsafe fn generateModuleTree 'arena 'phase (
1101		-	ctx: &CompileContext, low: &mut lower::Lowerer 'arena 'phase,
1102		-	modId: u16, isRoot: bool, pkg: &package::Package,
1103		-	generator: &mut rv64::Generator, fnArena: &mut alloc::Arena
	1100	+	unsafe fn generateModuleTree 'arena 'phase 'permission (
	1101	+	ctx: &CompileContext 'permission,
	1102	+	low: &mut lower::Lowerer 'arena 'phase,
	1103	+	modId: u16,
	1104	+	isRoot: bool,
	1105	+	pkg: &package::Package,
	1106	+	generator: &mut rv64::Generator,
	1107	+	fnArena: &mut alloc::Arena
1104	1108		) throws (Error) where 'arena: 'phase {
1105		-	let entry = module::get(&ctx.graph, modId) else throw error(&["module entry not found"]);
1106		-	let modAst = module::astFor(entry) else throw error(&["module has no AST"]);
	1109	+	let entry = module::get(&ctx.graph, modId)
	1110	+	else throw error(&["module entry not found"]);
	1111	+	let modAst = module::astFor(&ctx.graph, entry)
	1112	+	else throw error(&["module has no AST"]);
1107	1113		pkgLog(pkg, &["lowering", "(", entry.filePath, ")", ".."]);
1108	1114		set low.currentMod = modId;
1109	1115		let mut cursor = try lower::moduleCursor(modAst, isRoot) catch err {
1110	1116		io::printError("radiance: internal error during lowering: ");
1111	1117		lower::printError(err);

1120	1126		throw Error::Other;
1121	1127		};
1122	1128		let next = result else break;
1123	1129		codegen::emit(generator, fnArena, &*next.function, next.role);
1124	1130		}
1125		-	for i in 0..module::childCount(entry) {
1126		-	let childId = module::childAt(entry, i);
	1131	+	for i in 0..module::childCount(&ctx.graph, entry) {
	1132	+	let childId = module::childAt(&ctx.graph, entry, i);
1127	1133		try generateModuleTree(ctx, low, childId, false, pkg, generator, fnArena);
1128	1134		}
1129	1135		}
1130	1136
1131	1137		/// Lower all packages while streaming each lowered function into RV64 codegen.
1132		-	unsafe fn lowerAndGenerateAllPackages 'arena (
1133		-	ctx: &CompileContext,
	1138	+	unsafe fn lowerAndGenerateAllPackages 'arena 'permission (
	1139	+	ctx: &CompileContext 'permission,
1134	1140		res: *unsafe mut resolver::Resolver 'arena,
1135	1141		fnArena: &mut alloc::Arena,
1136	1142		codegenOptions: CodegenOptions
1137	1143		) -> rv64::Program throws (Error) {
1138	1144		let entryIdx = ctx.entryPkgIdx else {

1170	1176		placement: rv64::image::Placement::Hosted,
1171	1177		},
1172	1178		emitterStorage
1173	1179		);
1174	1180		let arena = (&mut res.arena) as unsafe mut alloc::Arena;
1175		-	let resolved: 'phase = &*res, graph = &ctx.graph where 'arena: 'phase in {
1176		-	let mut low = lower::lowerer(
1177		-	resolved, graph, entryPkg.name, arena, options
1178		-	);
	1181	+	let resolved: 'phase = &*res where 'arena: 'phase in {
	1182	+	let mut low = lower::lowerer(resolved, entryPkg.name, arena, options);
1179	1183		let mut asmDataLen: u32 = 0;
1180	1184		if let path = startupPath {
1181	1185		try assembleAsmModule(&mut generator, entryPkg, path, &mut asmDataLen, arena);
1182	1186		}
1183		-	try generateAllPackagesInto(ctx, &mut low, &mut generator, fnArena);
	1187	+	try generateAllPackagesInto(
	1188	+	ctx, &mut low, &mut generator, fnArena
	1189	+	);
1184	1190		let asmData = try assembleAsmInputs(ctx, &mut generator, &mut asmDataLen, arena);
1185		-
1186	1191		match generator.entryPatch {
1187	1192		case rv64::EntryPatch::Reserved(targetName) => {
1188	1193		if targetName == nil {
1189	1194		throw error(&["fatal:", "no default function found"]);
1190	1195		}

1218	1223		/// Default function entry.
1219	1224		entry: ?*[u8],
1220	1225		}
1221	1226
1222	1227		/// Collect exported definitions and the default entry from a package's source modules.
1223		-	unsafe fn packageExports(
1224		-	ctx: &CompileContext,
	1228	+	unsafe fn packageExports 'permission (
	1229	+	ctx: &CompileContext 'permission,
1225	1230		pkg: &package::Package,
1226	1231		ilProgram: &il::Program,
1227	1232		exports: &mut [binary::Export],
1228	1233		arena: &mut alloc::Arena
1229	1234		) -> PackageExports throws (Error) {
1230	1235		let mut count: u32 = 0;
1231	1236		let mut entryName: ?*[u8] = nil;
1232		-	for i in 0..ctx.graph.entriesLen {
	1237	+	for i in 0..module::entryCount(&ctx.graph) {
1233	1238		let modEntry = module::get(&ctx.graph, i as u16) else continue;
1234	1239		if modEntry.packageId <> pkg.id {
1235	1240		continue;
1236	1241		}
1237		-	let root = module::astFor(modEntry) else continue;
	1242	+	let root = module::astFor(&ctx.graph, modEntry) else continue;
1238	1243		let case ast::NodeValue::Block(block) = root.value else continue;
1239	1244		for node in block.statements {
1240	1245		let mut ident: ?*ast::Node = nil;
1241	1246		let mut attrs: ?ast::Attributes = nil;
1242	1247		let mut kind = binary::ExportKind::Function;

1312	1317		throw error(&["cannot write binary RIL package", name]);
1313	1318		}
1314	1319		}
1315	1320
1316	1321		/// Emit one binary RIL file per package into an existing directory.
1317		-	unsafe fn emitPackages 'arena (
1318		-	ctx: &CompileContext,
	1322	+	unsafe fn emitPackages 'arena 'permission (
	1323	+	ctx: &CompileContext 'permission,
1319	1324		res: *unsafe mut resolver::Resolver 'arena,
1320	1325		directory: *[u8]
1321	1326		) throws (Error) {
1322	1327		for i in 0..ctx.packageCount {
1323	1328		if ctx.inputs[i].asmPathCount > 0 or ctx.inputs[i].startupPath <> nil {

1361	1366		let suffix = mem::stripPrefix(owner, name) else return false;
1362	1367		return suffix.len > 2 and suffix[0] == ':' and suffix[1] == ':';
1363	1368		}
1364	1369
1365	1370		/// Lower, optionally dump, and optionally generate binary output.
1366		-	unsafe fn compile 'arena (
1367		-	ctx: &CompileContext,
	1371	+	unsafe fn compile 'arena 'permission (
	1372	+	ctx: &CompileContext 'permission,
1368	1373		res: *unsafe mut resolver::Resolver 'arena,
1369	1374		fnArena: &mut alloc::Arena
1370	1375		) throws (Error) {
1371	1376		let entryPkg = try getEntryPackage(ctx);
1372	1377		if let directory = ctx.rilDirectory {

1381	1386		il::printer::printProgram(&mut out, &program);
1382	1387		io::print("\n");
1383	1388		return;
1384	1389		}
1385	1390		if ctx.dump == Dump::Asm {
1386		-	let result = try lowerAndGenerateAllPackages(ctx, res, fnArena, CodegenOptions {
1387		-	logPath: nil,
1388		-	debug: false,
1389		-	entryMode: CodegenEntryMode::None,
1390		-	});
	1391	+	let result = try lowerAndGenerateAllPackages(
	1392	+	ctx, res, fnArena, CodegenOptions {
	1393	+	logPath: nil,
	1394	+	debug: false,
	1395	+	entryMode: CodegenEntryMode::None,
	1396	+	}
	1397	+	);
1391	1398		printer::printCodeTo(&mut out, entryPkg.name, result.code, result.funcs);
1392	1399		io::print("\n");
1393	1400
1394	1401		return;
1395	1402		}

1397	1404		let outPath = ctx.outputPath else {
1398	1405		try lowerAllPackages(ctx, res);
1399	1406		return;
1400	1407		};
1401	1408		let startupPath = getEntryStartupPath(ctx);
1402		-	let result = try lowerAndGenerateAllPackages(ctx, res, fnArena, CodegenOptions {
1403		-	logPath: outPath,
1404		-	debug: ctx.debug,
1405		-	entryMode: CodegenEntryMode::None
1406		-	if startupPath <> nil
1407		-	else CodegenEntryMode::DefaultEntry,
1408		-	});
	1409	+	let result = try lowerAndGenerateAllPackages(
	1410	+	ctx, res, fnArena, CodegenOptions {
	1411	+	logPath: outPath,
	1412	+	debug: ctx.debug,
	1413	+	entryMode: CodegenEntryMode::None
	1414	+	if startupPath <> nil
	1415	+	else CodegenEntryMode::DefaultEntry,
	1416	+	}
	1417	+	);
1409	1418
1410	1419		let codeBytes = @sliceOf(result.code.ptr as u8, result.code.len rv64::INSTR_SIZE as u32);
1411	1420		if not writeImage(
1412	1421		codeBytes,
1413	1422		&RO_DATA_BUF[..result.roDataSize],

1424	1433		}
1425	1434		pkgLog(&entryPkg, &["ok", "(", outPath, ")"]);
1426	1435		}
1427	1436
1428	1437		@default unsafe fn main(env: *sys::Env) -> i32 {
1429		-	let mut arena = ast::nodeArena(&mut TEMP_ARENA[..]);
1430		-	let mut ctx = try processCommand(env.args, &mut arena) catch {
1431		-	return 1;
1432		-	};
1433		-	match ctx.dump {
1434		-	case Dump::Ast => {
1435		-	try dumpAst(&ctx) catch {
	1438	+	let mut owner = module::Permission {};
	1439	+	let permission: 'permission = &mut owner in {
	1440	+	let mut arena = ast::nodeArena(&mut TEMP_ARENA[..]);
	1441	+	let mut ctx = try processCommand(env.args, &mut arena, permission) catch {
	1442	+	return 1;
	1443	+	};
	1444	+	match ctx.dump {
	1445	+	case Dump::Ast => {
	1446	+	try dumpAst(&ctx) catch {
	1447	+	return 1;
	1448	+	};
	1449	+	return 0;
	1450	+	}
	1451	+	case Dump::Graph => {
	1452	+	dumpGraph(&ctx);
	1453	+	return 0;
	1454	+	}
	1455	+	else => {}
	1456	+	}
	1457	+	// Generate test runner if in test mode.
	1458	+	if ctx.config.buildTest {
	1459	+	try generateTestRunner(&mut ctx, &mut arena) catch {
1436	1460		return 1;
1437	1461		};
1438		-	return 0;
1439	1462		}
1440		-	case Dump::Graph => {
1441		-	dumpGraph(&ctx);
	1463	+	// Run resolution phase.
	1464	+	let mut mainArena = alloc::new(&mut MAIN_ARENA[..]);
	1465	+	let arenaRef: 'arena = &mut mainArena, context = &ctx in {
	1466	+	let mut res = try runResolver(
	1467	+	context, arenaRef, arena.nextId
	1468	+	) catch {
	1469	+	return 1;
	1470	+	};
	1471	+	let mut fnArena = alloc::new(&mut FN_ARENA[..]);
	1472	+
	1473	+	// Lower, dump, and/or generate output.
	1474	+	try compile(context, &mut res, &mut fnArena) catch {
	1475	+	return 1;
	1476	+	};
1442	1477		return 0;
1443	1478		}
1444		-	else => {}
1445		-	}
1446		-	// Generate test runner if in test mode.
1447		-	if ctx.config.buildTest {
1448		-	try generateTestRunner(&mut ctx, &mut arena) catch {
1449		-	return 1;
1450		-	};
1451		-	}
1452		-	// Run resolution phase.
1453		-	let mut mainArena = alloc::new(&mut MAIN_ARENA[..]);
1454		-	let arenaRef: 'arena = &mut mainArena, context = &ctx in {
1455		-	let mut res = try runResolver(context, arenaRef, arena.nextId) catch {
1456		-	return 1;
1457		-	};
1458		-	let mut fnArena = alloc::new(&mut FN_ARENA[..]);
1459		-
1460		-	// Lower, dump, and/or generate output.
1461		-	try compile(context, &mut res, &mut fnArena) catch {
1462		-	return 1;
1463		-	};
1464		-	return 0;
1465	1479		}
1466	1480		}

310	310		/// Arena for persistent lowering state, including data and symbol names.
311	311		arena: *unsafe mut alloc::Arena,
312	312		/// Resolver for type information. Used to query types, symbols, and
313	313		/// compile-time constant values during lowering.
314	314		resolver: &'phase resolver::Resolver 'arena,
315		-	/// Module graph for cross-module symbol resolution.
316		-	moduleGraph: ?&'phase module::ModuleGraph,
317	315		/// Package name for qualified symbol names.
318	316		pkgName: *[u8],
319	317		/// Current module being lowered.
320	318		currentMod: ?u16,
321	319		/// Global data items (string literals, constants, static arrays).

859	857		pkgName: *[u8],
860	858		arena: &mut alloc::Arena
861	859		) -> il::Program throws (LowerError) {
862	860		let functionArena = (&mut arena) as unsafe mut alloc::Arena;
863	861		let resolved: 'phase = &*res where 'arena: 'phase in {
864		-	let mut low = lowererState(resolved, nil, pkgName, functionArena,
	862	+	let mut low = lowererState(resolved, pkgName, functionArena,
865	863		LowerOptions { debug: false, buildTest: false });
866	864		try lowerDecls(&mut low, root, true, functionArena);
867	865
868	866		return finalize(low);
869	867		}

872	870		/////////////////////////////////
873	871		// Multi-Module Lowering API //
874	872		/////////////////////////////////
875	873
876	874		/// Create a lowerer for multi-module compilation.
877		-	/// The resolver, graph, and persistent arena must outlive the returned lowerer.
	875	+	/// The resolver and persistent arena must outlive the returned lowerer.
878	876		export unsafe fn lowerer 'arena 'phase (
879	877		res: &'phase resolver::Resolver 'arena,
880		-	graph: &'phase module::ModuleGraph,
881	878		pkgName: *[u8],
882	879		arena: *unsafe mut alloc::Arena,
883	880		options: LowerOptions
884	881		) -> Lowerer 'arena 'phase where 'arena: 'phase {
885		-	return lowererState(res, graph, pkgName, arena, options);
	882	+	return lowererState(res, pkgName, arena, options);
886	883		}
887	884
888	885		/// Initialize lowering state with empty owned collections and borrowed metadata.
889	886		fn lowererState 'arena 'phase (
890	887		res: &'phase resolver::Resolver 'arena,
891		-	graph: ?&'phase module::ModuleGraph,
892	888		pkgName: *[u8],
893	889		arena: *unsafe mut alloc::Arena,
894	890		options: LowerOptions
895	891		) -> Lowerer 'arena 'phase where 'arena: 'phase {
896	892		return Lowerer 'arena 'phase {
897	893		arena,
898	894		resolver: res,
899		-	moduleGraph: graph,
900	895		pkgName,
901	896		currentMod: nil,
902	897		data: &mut [],
903	898		packageDataStart: 0,
904	899		functions: &mut [],

1002	997
1003	998		/////////////////////////////////
1004	999		// Qualified Name Construction //
1005	1000		/////////////////////////////////
1006	1001
1007		-	/// Get module path segments for the current or specified module.
1008		-	/// Returns empty slice if no module graph or module not found.
	1002	+	/// Return the qualified path for a module from retained resolver identities.
	1003	+	/// Returns an empty slice if no module is active or its identity is missing.
1009	1004		fn getModulePath 'arena 'phase (self: &Lowerer 'arena 'phase, modId: ?u16) -> [[u8]] where 'arena: 'phase {
1010		-	let graph = self.moduleGraph else {
1011		-	return &[];
1012		-	};
1013	1005		let mut id = modId;
1014	1006		if id == nil {
1015	1007		set id = self.currentMod;
1016	1008		}
1017	1009		let actualId = id else {
1018	1010		return &[];
1019	1011		};
1020		-	let entry = module::get(graph, actualId) else {
	1012	+	let entry = resolver::moduleFor(self.resolver, actualId) else {
1021	1013		return &[];
1022	1014		};
1023	1015		return module::moduleQualifiedPath(entry);
1024	1016		}
1025	1017

52	52		PathTooDeep,
53	53		/// Attempt to register a module before its parent.
54	54		MissingParent,
55	55		}
56	56
	57	+	/// Zero-state owner for authority over one module graph's mutable state.
	58	+	export record Permission {}
	59	+
57	60		/// Module metadata recorded inside the dependency graph.
58	61		export record ModuleEntry: Copy {
59	62		/// Numeric identifier for the slot (index in the graph array).
60	63		id: u16,
61	64		/// Package identifier this module belongs to.

70	73		name: *[u8],
71	74		/// Logical path from the root module to this module.
72	75		path: [*[u8]; MAX_MODULE_PATH_DEPTH],
73	76		/// Number of segments inside `path`.
74	77		pathDepth: u32,
75		-	/// Mutable module state shared by all entry views.
76		-	updates: *cell ModuleUpdates,
77	78		}
78	79
79		-	/// Copyable state stored in a module entry's cell.
	80	+	/// Copyable state stored in a module graph update cell.
80	81		export record ModuleUpdates: Copy {
81	82		/// Current lifecycle state.
82	83		state: ModuleState,
83	84		/// Child module identifiers declared directly inside this module.
84	85		children: [u16; MAX_MODULES],

89	90		/// Source text for this module (for error reporting).
90	91		source: ?*[u8],
91	92		}
92	93
93	94		/// Dense storage for all modules referenced by the compilation unit.
94		-	export record ModuleGraph {
	95	+	export opaque record ModuleGraph: 'permission {
95	96		/// Entry identities indexed by module identifier.
96	97		entries: mut [?ModuleEntry],
	98	+	/// Permission-associated updates indexed by module identifier.
	99	+	updates: [?*cell 'permission ModuleUpdates; MAX_MODULES],
	100	+	/// External authority for the update cells in this graph.
	101	+	permission: &'permission mut Permission,
97	102		/// Number of initialized entries.
98	103		entriesLen: u32,
99	104		/// Arena for AST nodes and stable entry allocations.
100	105		arena: ?*unsafe mut ast::NodeArena,
101	106		}
102	107
103	108		/// Initialize an empty module graph backed by the provided storage.
104	109		/// The AST arena must outlive the graph and all retained entry views.
105	110		/// Entry allocation must occur outside speculative parser allocations.
106		-	export unsafe fn moduleGraph(
	111	+	export unsafe fn moduleGraph 'permission (
107	112		storage: mut [?ModuleEntry],
108		-	arena: &mut ast::NodeArena
109		-	) -> ModuleGraph {
	113	+	arena: &mut ast::NodeArena,
	114	+	permission: &'permission mut Permission
	115	+	) -> ModuleGraph 'permission {
110	116		for i in 0..storage.len {
111	117		set storage[i] = nil;
112	118		}
113		-	return ModuleGraph {
	119	+	return ModuleGraph 'permission {
114	120		entries: storage,
	121	+	updates: [nil; MAX_MODULES],
	122	+	permission,
115	123		entriesLen: 0,
116	124		arena: arena as *unsafe mut ast::NodeArena,
117	125		};
118	126		}
119	127
120	128		/// Register a root module residing at `path` for a package.
121		-	export unsafe fn registerRoot(graph: &mut ModuleGraph, pool: &mut strings::Pool, packageId: u16, filePath: *[u8]) -> u16 throws (ModuleError) {
	129	+	export unsafe fn registerRoot 'permission (graph: &mut ModuleGraph 'permission, pool: &mut strings::Pool, packageId: u16, filePath: *[u8]) -> u16 throws (ModuleError) {
122	130		let name = try basenameSlice(filePath);
123	131		return try registerRootWithName(graph, pool, packageId, name, filePath);
124	132		}
125	133
126	134		/// Register a root module with an explicit name and file path for a package.
127		-	export unsafe fn registerRootWithName(
128		-	graph: &mut ModuleGraph, pool: &mut strings::Pool,
	135	+	export unsafe fn registerRootWithName 'permission (
	136	+	graph: &mut ModuleGraph 'permission, pool: &mut strings::Pool,
129	137		packageId: u16,
130	138		name: *[u8],
131	139		filePath: *[u8]
132	140		) -> u16 throws (ModuleError) {
133	141		let m = try allocModule(graph, pool, packageId, name, filePath);

138	146		return id;
139	147		}
140	148
141	149		/// Register a child module.
142	150		/// Returns the module identifier.
143		-	export unsafe fn registerChild(
144		-	graph: &mut ModuleGraph, pool: &mut strings::Pool,
	151	+	export unsafe fn registerChild 'permission (
	152	+	graph: &mut ModuleGraph 'permission, pool: &mut strings::Pool,
145	153		parentId: u16,
146	154		name: *[u8],
147	155		filePath: *[u8]
148	156		) -> u16 throws (ModuleError) {
149	157		assert name.len > 0, "registerChild: name must not be empty";

165	173		for p in moduleQualifiedPath(parent) {
166	174		try appendPathSegment(m, p);
167	175		}
168	176		try appendPathSegment(m, name);
169	177
170		-	let id = try addChild(parent, m.id);
	178	+	let id = try addChild(graph, parent, m.id);
171	179		publish(graph, m);
172	180		return id;
173	181		}
174	182
	183	+	/// Return the number of registered module identities.
	184	+	export fn entryCount 'permission (graph: &ModuleGraph 'permission) -> u32 {
	185	+	return graph.entriesLen;
	186	+	}
	187	+
175	188		/// Fetch a read-only view of the module identified by `id`.
176		-	export fn get(graph: &ModuleGraph, id: u16) -> ?*ModuleEntry {
	189	+	export fn get 'permission (graph: &ModuleGraph 'permission, id: u16) -> ?*ModuleEntry {
177	190		if not isValidId(graph, id) {
178	191		return nil;
179	192		}
180	193		return graph.entries[id as u32];
181	194		}
182	195
183	196		/// Return the identifier of the child stored at `index`.
184		-	export fn childAt(m: *ModuleEntry, index: u32) -> u16 {
185		-	let updates = *m.updates;
186		-	assert index < updates.childrenLen, "childAt: index must be valid";
187		-	return updates.children[index];
	197	+	export fn childAt 'permission (graph: &ModuleGraph 'permission, m: *ModuleEntry, index: u32) -> u16 {
	198	+	let cell = updatesFor(graph, m.id);
	199	+	let authority: 'loan = &graph.permission, updates = &cell in {
	200	+	assert index < updates.childrenLen, "childAt: index must be valid";
	201	+	return updates.children[index];
	202	+	}
188	203		}
189	204
190	205		/// Public accessor for a module's directory prefix.
191	206		export fn moduleDir(m: ModuleEntry) -> [u8] {
192	207		return &m.filePath[..m.dirLen];

197	212		assert m.pathDepth > 0, "moduleQualifiedPath: path must not be empty";
198	213		return &m.path[..m.pathDepth];
199	214		}
200	215
201	216		/// Retrieve the lifecycle state for `id`.
202		-	export fn state(graph: &ModuleGraph, id: u16) -> ModuleState throws (ModuleError) {
	217	+	export fn state 'permission (graph: &ModuleGraph 'permission, id: u16) -> ModuleState throws (ModuleError) {
203	218		let m = get(graph, id) else {
204	219		throw ModuleError::NotFound(id);
205	220		};
206		-	return (*m.updates).state;
	221	+	let cell = updatesFor(graph, m.id);
	222	+	let authority: 'loan = &graph.permission, updates = &cell in {
	223	+	return updates.state;
	224	+	}
207	225		}
208	226
209	227		/// Record the parsed AST root for `id`.
210		-	export fn setAst(graph: &mut ModuleGraph, id: u16, root: *ast::Node) throws (ModuleError) {
	228	+	export fn setAst 'permission (graph: &mut ModuleGraph 'permission, id: u16, root: *ast::Node) throws (ModuleError) {
211	229		let m = get(graph, id) else throw ModuleError::NotFound(id);
212		-	let mut updates = *m.updates;
213		-	set updates.ast = root;
214		-	set updates.state = ModuleState::Parsed;
215		-	set *m.updates = updates;
	230	+	let cell = updatesFor(graph, m.id);
	231	+	let authority: 'loan = &mut graph.permission, updates = &mut cell in {
	232	+	set updates.ast = root;
	233	+	set updates.state = ModuleState::Parsed;
	234	+	}
216	235		}
217	236
218	237		/// Set the source text for a module.
219		-	export fn setSource(graph: &mut ModuleGraph, id: u16, source: *[u8]) throws (ModuleError) {
	238	+	export fn setSource 'permission (graph: &mut ModuleGraph 'permission, id: u16, source: *[u8]) throws (ModuleError) {
220	239		let m = get(graph, id) else throw ModuleError::NotFound(id);
221		-	let mut updates = *m.updates;
222		-	set updates.source = source;
223		-	set *m.updates = updates;
	240	+	let cell = updatesFor(graph, m.id);
	241	+	let authority: 'loan = &mut graph.permission, updates = &mut cell in {
	242	+	set updates.source = source;
	243	+	}
224	244		}
225	245
226	246		/// Look up a child module by name under the given parent.
227		-	export fn findChild(graph: &ModuleGraph, name: [u8], parentId: u16) -> ?ModuleEntry {
	247	+	export fn findChild 'permission (graph: &ModuleGraph 'permission, name: [u8], parentId: u16) -> ?ModuleEntry {
228	248		assert isValidId(graph, parentId), "findChild: parent identifier is valid";
229	249
230	250		let parent = get(graph, parentId) else panic;
231		-	let updates = *parent.updates;
232		-	for i in 0..updates.childrenLen {
233		-	let childId = updates.children[i];
234		-	let child = get(graph, childId) else panic;
235		-	if mem::eq(child.name, name) {
236		-	return child;
	251	+	let cell = updatesFor(graph, parent.id);
	252	+	let authority: 'loan = &graph.permission, updates = &cell in {
	253	+	for i in 0..updates.childrenLen {
	254	+	let childId = updates.children[i];
	255	+	let child = get(graph, childId) else panic;
	256	+	if mem::eq(child.name, name) {
	257	+	return child;
	258	+	}
237	259		}
238	260		}
239	261		return nil;
240	262		}
241	263

275	297
276	298		/// Register a module from a file path, creating the full hierarchy as needed.
277	299		/// The path is split into components and the module hierarchy is built accordingly.
278	300		/// If `rootId` is `nil`, registers a new root for the given package.
279	301		/// Returns the module ID of the last component.
280		-	export unsafe fn registerFromPath(graph: &mut ModuleGraph, pool: &mut strings::Pool, packageId: u16, rootId: ?u16, filePath: *[u8]) -> u16 throws (ModuleError) {
	302	+	export unsafe fn registerFromPath 'permission (graph: &mut ModuleGraph 'permission, pool: &mut strings::Pool, packageId: u16, rootId: ?u16, filePath: *[u8]) -> u16 throws (ModuleError) {
281	303		let root = rootId else {
282	304		return try registerRoot(graph, pool, packageId, filePath);
283	305		};
284	306		let rootEntry = get(graph, root) else {
285	307		panic "registerFromPath: root is missing from storage";