radiance · Radiance self-hosting compiler

compiler/ lib/ examples/ std/ arch/ char/ collections/ graph/ lang/ alloc/ ast/ gen/ il/ module/ parser/ resolver/ tests/ placeholderTests.rad 1.5 KiB regions.rad 148.1 KiB opaqueTests.rad 6.6 KiB printer.rad 25.5 KiB tests.rad 410.1 KiB scanner/ alloc.rad 7.1 KiB ast.rad 26.9 KiB gen.rad 513 B il.rad 20.4 KiB lower.rad 321.7 KiB module.rad 17.3 KiB package.rad 1.3 KiB parser.rad 92.2 KiB resolver.rad 511.1 KiB scanner.rad 17.9 KiB sexpr.rad 6.7 KiB strings.rad 2.2 KiB types.rad 1.6 KiB sys/ arch.rad 68 B char.rad 855 B collections.rad 39 B fmt.rad 8.3 KiB graph.rad 4.3 KiB intrinsics.rad 467 B io.rad 1.7 KiB lang.rad 276 B mem.rad 2.3 KiB sys.rad 179 B testing.rad 2.4 KiB tests.rad 15.7 KiB vec.rad 3.2 KiB std.rad 299 B scripts/ seed/ sublime/ test/ vim/ .gitignore 336 B .gitsigners 112 B CELL_PERMISSIONS 6.8 KiB CONTRIBUTING 2.1 KiB LICENSE 1.1 KiB Makefile 5.4 KiB README 2.5 KiB STYLE 2.5 KiB std.lib 1.5 KiB std.lib.test 808 B
lib/std/lang/resolver/tests/regions.rad 148.1 KiB raw
//! Lexical region resolver tests.

use std::mem;
use std::testing;
use std::lang::types;
use std::lang::resolver;
use std::lang::ast;

/// Call results resolve regional nominal views before type consumers inspect them.
@test unsafe fn testCallResultNominalViews() throws (testing::TestError) {
    let programs = [
        "union R: 'r + Copy { V(&'r u32), E } record M {} fn (m: *M) get 'r(p: &'r u32) -> R 'r { return R::V(p); } fn f 'r(m: *M, p: &'r u32) { let x = m.get 'r(p); match x { case R::V(v) => {}, case R::E => {} } }",
        "union R: 'r + Copy { V(&'r u32), E } trait T { fn (*T) get 'r(p: &'r u32) -> R 'r; } fn f 'r(t: *opaque T, p: &'r u32) { let x = t.get 'r(p); match x { case R::V(v) => {}, case R::E => {} } }",
        "union R: 'r + Copy { V(&'r u32), E } fn get 'r(p: &'r u32) -> ?R 'r { return R::V(p); } fn f 'r(p: &'r u32) { let x = get 'r(p); if let v = x { match v { case R::V(y) => {}, case R::E => {} } } }",
        "union R: 'r + Copy { V(&'r u32), E } fn get 'r(p: &'r u32) -> [R 'r; 1] { return [R::V(p)]; } fn f 'r(p: &'r u32) { let x = get 'r(p); match x[0] { case R::V(y) => {}, case R::E => {} } }",
    ];
    for program in programs {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
        }
    }
}

/// Optional aggregate payloads start at their required alignment after the tag.
@test fn testOptionalPayloadOffsets() throws (testing::TestError) {
    for alignment in [1 as u32, 2, 4, 8, 16] {
        let layout = resolver::Layout { size: 32, alignment };
        assert resolver::getOptionalValOffset(layout) == alignment;
    }
}

/// Each declaration has a distinct identity within its resolver.
@test unsafe fn testSymbolIdentities() throws (testing::TestError) {
    let mut arena = super::testArena();
    let storage: 'test = &mut arena in {
        let mut res = super::testResolver(storage);
        let result = try super::resolveProgramStr(&mut res, "fn f() {} fn g() {}");
        try super::expectNoErrors(&result);
        let case ast::NodeValue::Block(block) = result.root.value else throw testing::TestError::Failed;
        let first = resolver::symbolFor(&res, block.statements[0]) else throw testing::TestError::Failed;
        let second = resolver::symbolFor(&res, block.statements[1]) else throw testing::TestError::Failed;
        assert first.id <> second.id;
        assert first.id < res.symbolCount;
        assert second.id < res.symbolCount;
        let firstBinding = resolver::nodeData(&res, block.statements[0]).binding else throw testing::TestError::Failed;
        let secondBinding = resolver::nodeData(&res, block.statements[1]).binding else throw testing::TestError::Failed;
        assert firstBinding.id == first.id;
        assert secondBinding.id == second.id;
    }
}

/// Trait lookup accepts empty tables from safe code.
@test fn testEmptyTraitMethodLookup() throws (testing::TestError) {
    assert resolver::findTraitMethod(&[], "missing") == nil;
}

/// Trait lookup returns the matching method metadata in declaration order.
@test unsafe fn testTraitMethodLookup() throws (testing::TestError) {
    let mut arena = super::testArena();
    let storage: 'test = &mut arena in {
        let mut res = super::testResolver(storage);
        let result = try super::resolveProgramStr(&mut res, "trait R { fn (&R) first(); fn (&mut R) second(); }");
        try super::expectNoErrors(&result);
        let case ast::NodeValue::Block(block) = result.root.value else throw testing::TestError::Failed;
        let sym = resolver::symbolFor(&res, block.statements[0]) else throw testing::TestError::Failed;
        let case resolver::SymbolData::Trait(info) = sym.data else throw testing::TestError::Failed;
        let first = resolver::findTraitMethod(&info.methods[..], "first") else throw testing::TestError::Failed;
        let last = resolver::findTraitMethod(&info.methods[..], "second") else throw testing::TestError::Failed;
        assert first.index == 0;
        assert not first.mutable;
        assert last.index == 1;
        assert last.mutable;
        assert resolver::findTraitMethod(&info.methods[..], "missing") == nil;
    }
}

/// Standalone method identities select independent registry entries.
@test unsafe fn testStandaloneMethodIdentityLookup() throws (testing::TestError) {
    let mut arena = super::testArena();
    let storage: 'test = &mut arena in {
        let mut res = super::testResolver(storage);
        let result = try super::resolveProgramStr(&mut res, "record R {} fn (r: &R) first() {} fn (r: &mut R) second() {}");
        try super::expectNoErrors(&result);
        let case ast::NodeValue::Block(block) = result.root.value else throw testing::TestError::Failed;
        let firstSymbol = resolver::symbolFor(&res, block.statements[1]) else throw testing::TestError::Failed;
        let lastSymbol = resolver::symbolFor(&res, block.statements[2]) else throw testing::TestError::Failed;
        let first = resolver::findMethodBySymbol(&res, firstSymbol.id) else throw testing::TestError::Failed;
        let last = resolver::findMethodBySymbol(&res, lastSymbol.id) else throw testing::TestError::Failed;
        assert mem::eq(first.name, "first");
        assert not first.mutable;
        assert mem::eq(last.name, "second");
        assert last.mutable;
        assert first.fullFnType.paramTypes.len == 1;
        assert first.fnType.paramTypes.len == 0;
        assert last.fullFnType.paramTypes.len == 1;
        assert last.fnType.paramTypes.len == 0;
        assert resolver::findMethodBySymbol(&res, res.symbolCount) == nil;
    }
}

/// Iteration over raw slices requires permission to read their storage.
@test unsafe fn testRawSliceIterationRequiresUnsafe() throws (testing::TestError) {
    for program in [
        "fn f(p: *unsafe [u32]) { for item in p { assert item == 0; } }",
        "fn f(p: *unsafe mut [u32]) { for item, index in p { assert item == index; } }",
        "record R { items: *unsafe [u32] } fn f(r: &R) { for item in r.items { assert item == 0; } }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectErrorKind(&result, resolver::ErrorKind::UnsafeOperation);
        }
    }
}

/// Checked iteration is safe, and raw iteration accepts explicit permission.
@test unsafe fn testSliceIterationPermissions() throws (testing::TestError) {
    for program in [
        "unsafe fn f(p: *unsafe [u32]) { for item in p { assert item == 0; } }",
        "fn f(p: *unsafe [u32]) { unsafe { for item in p { assert item == 0; } } }",
        "fn f(p: &[u32]) { for item in p { assert item == 0; } }",
        "fn f(p: &mut [u32]) { for item, index in p { assert item == index; } }",
        "fn f(p: [u32; 2]) { for item in p { assert item == 0; } }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
        }
    }
}

/// Short-circuit paths must agree on exact-use regional ownership.
@test unsafe fn testRegionalShortCircuitOwnership() throws (testing::TestError) {
    for program in [
        "union Ticket: 'r + Once { Value(&'r u32) } fn take 'r (t: Ticket 'r) -> bool { match t { case Ticket::Value(p) => return *p == 1, } } fn f 'r (t: Ticket 'r) { let result = false and take(t); }",
        "union Ticket: 'r + Once { Value(&'r u32) } fn take 'r (t: Ticket 'r) -> bool { match t { case Ticket::Value(p) => return *p == 1, } } fn f 'r (t: Ticket 'r) { let result = true or take(t); }",
        "union Ticket: 'r + Once { Value(&'r u32) } fn take 'r (t: Ticket 'r) -> bool { match t { case Ticket::Value(p) => return *p == 1, } } fn f 'r (t: Ticket 'r, flag: bool) { let result = flag and take(t); }",
        "union Ticket: 'r + Once { Value(&'r u32) } fn take 'r (t: Ticket 'r) -> bool { match t { case Ticket::Value(p) => return *p == 1, } } unsafe fn f 'r (t: Ticket 'r, flag: bool) { let result = flag or take(t); }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::LinearBranchMismatch(_) = error.kind
                else throw testing::TestError::Failed;
        }
    }
}

/// The left operand executes on every short-circuit path.
@test unsafe fn testRegionalShortCircuitLeftConsumption() throws (testing::TestError) {
    for program in [
        "union Ticket: 'r + Once { Value(&'r u32) } fn take 'r (t: Ticket 'r) -> bool { match t { case Ticket::Value(p) => return *p == 1, } } fn f 'r (t: Ticket 'r) { let result = take(t) and false; }",
        "union Ticket: 'r + Once { Value(&'r u32) } fn take 'r (t: Ticket 'r) -> bool { match t { case Ticket::Value(p) => return *p == 1, } } fn f 'r (t: Ticket 'r) { let result = take(t) or true; }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
        }
    }
}

/// Earlier reference arguments protect their storage during later arguments.
@test unsafe fn testRegionalCallArgumentLoans() throws (testing::TestError) {
    for program in [
        "fn inner(p: &mut u32) -> u32 { set *p = 2; return 0; } fn outer(p: &mut u32, n: u32) {} fn f 'r (p: &'r mut u32) { outer(&mut *p, inner(p)); }",
        "fn inner(p: &mut u32) -> u32 { set *p = 2; return 0; } fn outer(p: &u32, n: u32) {} fn f 'r (p: &'r mut u32) { outer(&*p, inner(p)); }",
        "fn inner(p: &mut u32) -> u32 { set *p = 2; return 0; } fn outer(p: &mut u32, n: u32) {} unsafe fn f 'r (p: &'r mut u32) { outer(&mut *p, inner(p)); }",
        "record R { n: u32 } fn (r: &mut R) call(n: u32) {} fn inner(p: &mut u32) -> u32 { set *p = 2; return 0; } fn f 'r (r: &'r mut R) { (&mut *r).call(inner(&mut r.n)); }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind
                else throw testing::TestError::Failed;
        }
    }
}

/// Conditional cell creation protects each source from ordinary shared access.
@test unsafe fn testConditionalCellArgumentLoans() throws (testing::TestError) {
    for program in [
        "fn inspect(c: &cell u32, p: &u32) { set *c = 2; } fn f(p: &mut u32, q: &mut u32, flag: bool) { inspect(&cell *p if flag else &cell *q, p); }",
        "fn inspect(c: &cell u32, p: &u32) { set *c = 2; } unsafe fn f(p: &mut u32, q: &mut u32, flag: bool) { inspect(&cell *p if flag else &cell *q, q); }",
        "fn read(p: &u32) -> u32 { return *p; } fn inspect(c: &cell u32, n: u32) {} fn f(p: &mut u32, q: &mut u32, flag: bool) { inspect(&cell *p if flag else &cell *q, read(q)); }",
        "fn inspect(c: &cell u32, p: &u32) {} fn f(p: &mut u32, q: &mut u32, flag: bool) { inspect((&cell *p if flag else &cell *q) as &cell u32, p); }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind
                else throw testing::TestError::Failed;
        }
    }
}

/// Conditional cell loans allow separate storage and shared cell aliases.
@test unsafe fn testConditionalCellArgumentLoanScopes() throws (testing::TestError) {
    for program in [
        "fn inspect(c: &cell u32, p: &u32) {} fn f(p: &mut u32, q: &mut u32, r: &u32, flag: bool) { inspect(&cell *p if flag else &cell *q, r); set *p = 1; set *q = 2; }",
        "record R { a: u32, b: u32, c: u32 } fn inspect(c: &cell u32, p: &u32) {} fn f(r: &mut R, flag: bool) { inspect(&cell r.a if flag else &cell r.b, &r.c); set r.a = 1; }",
        "fn inspect(a: &cell u32, b: &cell u32) {} fn f(a: &cell u32, b: &cell u32, flag: bool) { inspect(a if flag else b, a); }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
        }
    }
}

/// Conditional explicit arguments protect every possible borrowed place.
@test unsafe fn testConditionalCallArgumentLoans() throws (testing::TestError) {
    for program in [
        "fn inner(p: &mut u32) -> u32 { set *p = 2; return 0; } fn outer(p: &u32, n: u32) {} fn f 'r (p: &'r mut u32, q: &'r mut u32, flag: bool) { outer(&*p if flag else &*q, inner(p)); }",
        "fn inner(p: &mut u32) -> u32 { set *p = 2; return 0; } fn outer(p: &u32, n: u32) {} fn f 'r (p: &'r mut u32, q: &'r mut u32, flag: bool) { outer(&*p if flag else &*q, inner(q)); }",
        "fn outer(p: &mut u32, q: &mut u32) {} fn f 'r (p: &'r mut u32, q: &'r mut u32, flag: bool) { outer(&mut *p if flag else &mut *q, &mut *p); }",
        "fn inner(p: &mut u32) -> u32 { set *p = 2; return 0; } fn outer(p: &u32, n: u32) {} unsafe fn f 'r (p: &'r mut u32, q: &'r mut u32, flag: bool) { outer(&*p if flag else &*q, inner(q)); }",
        "fn outer(p: &mut u32, q: &mut u32) {} unsafe fn f 'r (p: &'r mut u32, q: &'r mut u32, flag: bool) { outer(&mut *p if flag else &mut *q, &mut *q); }",
        "fn inner(p: &mut u32) -> u32 { set *p = 2; return 0; } fn outer(p: &u32, n: u32) {} fn f 'r (p: &'r mut u32, q: &'r mut u32, flag: bool) { outer((&*p if flag else &*q) as &u32, inner(p)); }",
        "record R { n: u32 } fn (r: &R) call(n: u32) {} fn inner(p: &mut u32) -> u32 { set *p = 2; return 0; } fn f 'r (p: &'r mut R, q: &'r mut R, flag: bool) { (&*p if flag else &*q).call(inner(&mut q.n)); }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind
                else throw testing::TestError::Failed;
        }
    }
}

/// Conditional argument alternatives cannot overlap another exclusive argument.
@test unsafe fn testConditionalCallArgumentOverlap() throws (testing::TestError) {
    for program in [
        "fn outer(p: &mut u32, q: &mut u32) {} fn f 'r (p: &'r mut u32, q: &'r mut u32, flag: bool) { outer(p if flag else q, p); }",
        "fn outer(p: &mut u32, q: &mut u32) {} fn f 'r (p: &'r mut u32, q: &'r mut u32, flag: bool) { outer(p if flag else q, q); }",
        "fn outer(p: &mut u32, q: &mut u32) {} fn f 'r (p: &'r mut u32, q: &'r mut u32, flag: bool) { outer(p, p if flag else q); }",
        "fn outer(p: &mut u32, q: &mut u32) {} fn f 'r (p: &'r mut u32, q: &'r mut u32, flag: bool) { outer(q, p if flag else q); }",
        "fn outer(p: &mut u32, q: &mut u32) {} unsafe fn f 'r (p: &'r mut u32, q: &'r mut u32, flag: bool) { outer(p if flag else q, p); }",
        "fn outer(p: &u32, q: &mut u32) {} fn f 'r (p: &'r mut u32, q: &'r mut u32, flag: bool) { outer(p if flag else q, q); }",
        "fn outer(p: &mut u32, q: &mut u32) {} fn f 'r (p: &'r mut u32, q: &'r mut u32, flag: bool) { outer(p if flag else q, q if flag else p); }",
        "fn outer(p: &mut u32, q: &mut u32) {} fn f 'r (p: &'r mut u32, q: &'r mut u32, r: &'r mut u32, a: bool, b: bool) { outer((p if a else q) if b else r, q); }",
        "fn outer(p: &u32, q: &mut u32) {} fn f 'r (p: &'r mut u32, q: &'r mut u32, flag: bool) { outer((p if flag else q) as &'r u32, p); }",
        "record R { n: u32 } fn (r: &mut R) call(p: &R) {} fn f 'r (p: &'r mut R, q: &'r mut R, flag: bool) { (p if flag else q).call(p); }",
        "trait R { fn (&mut R) call(p: &opaque R); } fn f 'r (p: &'r mut opaque R, q: &'r mut opaque R, flag: bool) { (p if flag else q).call(q); }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind
                else throw testing::TestError::Failed;
        }
    }
}

/// Conditional argument alternatives permit shared access and disjoint places.
@test unsafe fn testConditionalCallArgumentSeparation() throws (testing::TestError) {
    for program in [
        "fn outer(p: &u32, q: &u32) {} fn f 'r (p: &'r u32, q: &'r u32, flag: bool) { outer(p if flag else q, p); }",
        "fn outer(p: &mut u32, q: &mut u32) {} fn f 'r (p: &'r mut u32, q: &'r mut u32, r: &'r mut u32, flag: bool) { outer(p if flag else q, r); }",
        "record R: 'r { a: &'r mut u32, b: &'r mut u32, c: &'r mut u32 } fn outer(p: &mut u32, q: &mut u32) {} fn f 'r (r: &mut R 'r, flag: bool) { outer(r.a if flag else r.b, r.c); }",
        "record R { n: u32 } fn (r: &mut R) call(p: &R) {} fn f 'r (p: &'r mut R, q: &'r mut R, r: &'r R, flag: bool) { (p if flag else q).call(r); }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
        }
    }
}

/// Call loans allow shared reads, separate fields, and access after the call.
@test unsafe fn testRegionalCallArgumentLoanScopes() throws (testing::TestError) {
    for program in [
        "fn read(p: &u32) -> u32 { return *p; } fn outer(p: &u32, n: u32) {} fn f 'r (p: &'r mut u32, q: &'r mut u32, flag: bool) { outer(&*p if flag else &*q, read(p)); set *p = 3; set *q = 4; }",
        "record R { a: u32, b: u32, c: u32 } fn inner(p: &mut u32) -> u32 { set *p = 2; return 0; } fn outer(p: &mut u32, n: u32) {} fn f 'r (r: &'r mut R, flag: bool) { outer(&mut r.a if flag else &mut r.b, inner(&mut r.c)); set r.a = 3; }",
        "fn outer(p: &mut u32, n: u32) {} fn f 'r (p: &'r mut u32, flag: bool) { outer(&mut *p if flag else &mut *p, 0); set *p = 3; }",
        "fn read(p: &u32) -> u32 { return *p; } fn outer(p: &u32, n: u32) {} fn f 'r (p: &'r mut u32) { outer(&*p, read(p)); set *p = 3; }",
        "record R { a: u32, b: u32 } fn inner(p: &mut u32) -> u32 { set *p = 2; return 0; } fn outer(p: &mut u32, n: u32) {} fn f 'r (r: &'r mut R) { outer(&mut r.a, inner(&mut r.b)); set r.a = 3; }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
        }
    }
}

/// Equal region spellings in separate functions have distinct identities.
@test unsafe fn testRegionIdentities() throws (testing::TestError) {
    let mut testArena1 = super::testArena();
    let testStorage1: 'test1 = &mut testArena1 in {
        let mut res = super::testResolver(testStorage1);
        let result = try super::resolveProgramStr(&mut res,
            "fn first 'r (p: &'r u8) -> u8 { return *p; }\nfn second 'r (p: &'r u8) -> u8 { return *p; }"
        );
        try super::expectNoErrors(&result);
        let first = try super::getBlockStmt(result.root, 0);
        let second = try super::getBlockStmt(result.root, 1);
        let firstType = resolver::typeFor(&res, first) else throw testing::TestError::Failed;
        let secondType = resolver::typeFor(&res, second) else throw testing::TestError::Failed;
        let case resolver::Type::Fn(a) = firstType else throw testing::TestError::Failed;
        let case resolver::Type::Fn(b) = secondType else throw testing::TestError::Failed;
        let case resolver::Type::Pointer { class: types::PointerClass::Region(ar), .. } = *a.paramTypes[0]
            else throw testing::TestError::Failed;
        let case resolver::Type::Pointer { class: types::PointerClass::Region(br), .. } = *b.paramTypes[0]
            else throw testing::TestError::Failed;
        try testing::expect(mem::eq(ar.name, br.name));
        try testing::expect(ar.id <> br.id);
        try testing::expect(not resolver::typesEqual(*a.paramTypes[0], *b.paramTypes[0]));
        try testing::expect(resolver::getTypeLayout(*a.paramTypes[0]).size == 8);
    }
}

/// Parent links resolve forward declarations and preserve transitive ancestry.
@test unsafe fn testRegionParents() throws (testing::TestError) {
    let mut testArena2 = super::testArena();
    let testStorage2: 'test2 = &mut testArena2 in {
        let mut res = super::testResolver(testStorage2);
        let result = try super::resolveProgramStr(&mut res,
            "fn read 'child 'middle 'root (p: &'child u8, q: &'root u8) where 'middle: 'child, 'root: 'middle {}"
        );
        try super::expectNoErrors(&result);
        let func = try super::getBlockStmt(result.root, 0);
        let ty = resolver::typeFor(&res, func) else throw testing::TestError::Failed;
        let case resolver::Type::Fn(info) = ty else throw testing::TestError::Failed;
        let case resolver::Type::Pointer { class: types::PointerClass::Region(child), .. } = *info.paramTypes[0]
            else throw testing::TestError::Failed;
        let case resolver::Type::Pointer { class: types::PointerClass::Region(root), .. } = *info.paramTypes[1]
            else throw testing::TestError::Failed;
        try testing::expect(types::regionContains(root, child));
        try testing::expect(types::regionContains(child, child));
        try testing::expect(not types::regionContains(child, root));
    }
}

/// Region declarations reject duplicate names, missing parents, and cycles.
@test unsafe fn testInvalidRegionDeclarations() throws (testing::TestError) {
    for program in [
        "fn f 'r 'r () {}",
        "fn f 'r () where 'missing: 'r {}",
        "fn f 'r () where 'r: 'r {}",
        "fn f 'a 'b 'c () where 'b: 'a, 'c: 'b, 'a: 'c {}",
    ] {
        let mut testArena3 = super::testArena();
        let testStorage3: 'test3 = &mut testArena3 in {
            let mut res = super::testResolver(testStorage3);
            let result = try super::resolveProgramStr(&mut res, program);
            let _ = try super::expectError(&result);
        }
    }
}

/// Regions from another declaration cannot enter a function signature or body.
@test unsafe fn testUnknownRegionNames() throws (testing::TestError) {
    for program in [
        "fn f(p: &'missing u8) {}",
        "fn f 'r (p: &'r u8) {} fn g(p: &'r u8) {}",
        "unsafe fn f(p: &'missing u8) {}",
        "fn f 'r (p: &'r u8) { let q: &'missing u8 = p; }",
    ] {
        let mut testArena4 = super::testArena();
        let testStorage4: 'test4 = &mut testArena4 in {
            let mut res = super::testResolver(testStorage4);
            let result = try super::resolveProgramStr(&mut res, program);
            let err = try super::expectError(&result);
            let case resolver::ErrorKind::UnknownRegion(_) = err.kind
                else throw testing::TestError::Failed;
        }
    }
}

/// An ancestor relation does not make distinct reference regions assignable.
@test unsafe fn testRegionInvariance() throws (testing::TestError) {
    for program in [
        "fn f 'a 'b (p: &'a u8) where 'a: 'b { let q: &'b u8 = p; }",
        "unsafe fn f 'a 'b (p: &'b u8) where 'a: 'b { let q: &'a u8 = p; }",
    ] {
        let mut testArena5 = super::testArena();
        let testStorage5: 'test5 = &mut testArena5 in {
            let mut res = super::testResolver(testStorage5);
            let result = try super::resolveProgramStr(&mut res, program);
            let err = try super::expectError(&result);
            let case resolver::ErrorKind::TypeMismatch(_) = err.kind
                else throw testing::TestError::Failed;
        }
    }
}

/// Nominal region environments diagnose their own invalid parent relations.
@test unsafe fn testNominalRegionNames() throws (testing::TestError) {
    for program in [
        "record R: 'r where 'missing: 'r { value: u8 }",
        "union U: 'r where 'missing: 'r { Empty }",
        "record R: 'r { value: &'other u8 }",
        "union U: 'r { Value(&'other u8) }",
    ] {
        let mut testArena6 = super::testArena();
        let testStorage6: 'test6 = &mut testArena6 in {
            let mut res = super::testResolver(testStorage6);
            let result = try super::resolveProgramStr(&mut res, program);
            let err = try super::expectError(&result);
            let case resolver::ErrorKind::UnknownRegion(_) = err.kind
                else throw testing::TestError::Failed;
        }
    }
    for program in [
        "record R: 'r + 'r { value: u8 }",
        "union U: 'r + 'r { Empty }",
    ] {
        let mut testArena7 = super::testArena();
        let testStorage7: 'test7 = &mut testArena7 in {
            let mut res = super::testResolver(testStorage7);
            let result = try super::resolveProgramStr(&mut res, program);
            let _ = try super::expectErrorKind(&result, resolver::ErrorKind::DuplicateBinding("'r"));
        }
    }
}

/// Region declarations restore their environment after a signature error.
@test unsafe fn testRegionErrorScopeRestoration() throws (testing::TestError) {
    let mut testArena8 = super::testArena();
    let testStorage8: 'test8 = &mut testArena8 in {
        let mut res = super::testResolver(testStorage8);
        let result = try super::resolveProgramStr(&mut res,
            "fn f 'r (p: &'missing u8) {} fn g 'other (p: &'r u8) {}"
        );
        let err = try super::expectError(&result);
        let case resolver::ErrorKind::UnknownRegion(name) = err.kind
            else throw testing::TestError::Failed;
        try testing::expect(mem::eq(name, "'missing"));
        try testing::expect(res.regionScope == nil);
        try testing::expect(res.currentFn == nil);
        try testing::expect(res.currentFnNode == nil);
    }
}

/// Regional exclusive references retain affine ownership and arithmetic checks.
@test unsafe fn testRegionExclusiveOwnership() throws (testing::TestError) {
    for program in [
        "fn f 'r (p: &'r mut u8) { let q: &'r mut u8 = p; set *p = 3; }",
        "unsafe fn f 'r (p: &'r mut u8) { let q: &'r mut u8 = p; set *p = 3; }",
        "unsafe fn f 'r (p: &'r mut u8) { let q = p + 1; }",
        "unsafe fn f 'r (p: &'r mut u8) { let q = p as *mut u8; }",
    ] {
        let mut testArena9 = super::testArena();
        let testStorage9: 'test9 = &mut testArena9 in {
            let mut res = super::testResolver(testStorage9);
            let result = try super::resolveProgramStr(&mut res, program);
            let _ = try super::expectError(&result);
        }
    }
}

/// Callback signatures preserve the same region substitution as data arguments.
@test unsafe fn testRegionCallbackSubstitution() throws (testing::TestError) {
    let mut testArena10 = super::testArena();
    let testStorage10: 'test10 = &mut testArena10 in {
        let mut res = super::testResolver(testStorage10);
        let result = try super::resolveProgramStr(&mut res, "fn read 'r (p: &'r u32) -> u32 { return *p; } fn useOp 'r (p: &'r u32, op: fn(&'r u32) -> u32) -> u32 { return op(p); } fn relay 'a 'b (p: &'a u32) -> u32 { return useOp(p, read 'b); }");
        let err = try super::expectError(&result);
        let case resolver::ErrorKind::RegionInference(_) = err.kind else throw testing::TestError::Failed;
    }
}

/// A single region parameter requires one consistent named argument.
@test unsafe fn testRegionCallInferenceFailures() throws (testing::TestError) {
    for program in [
        "fn pair 'r (a: &'r u32, b: &'r u32) {} fn relay 'a 'b (a: &'a u32, b: &'b u32) { pair(a, b); }",
        "fn read 'r (p: &'r u32) {} fn relay(p: &u32) { read(p); }",
        "unsafe fn read 'r (p: &'r u32) {} unsafe fn relay(p: *unsafe u32) { read(p); }",
        "fn answer 'r () -> u32 { return 42; } fn relay() -> u32 { return answer(); }",
        "fn read 'r (p: ?&'r u32) {} fn relay() { read(nil); }",
        "unsafe fn read 'r (p: ?&'r u32) {} unsafe fn relay() { read(nil); }",
    ] {
        let mut testArena11 = super::testArena();
        let testStorage11: 'test11 = &mut testArena11 in {
            let mut res = super::testResolver(testStorage11);
            let result = try super::resolveProgramStr(&mut res, program);
            let err = try super::expectError(&result);
            let case resolver::ErrorKind::RegionInference(_) = err.kind else throw testing::TestError::Failed;
        }
    }
}

/// Inferred and explicit region arguments must satisfy declared parent relations.
@test unsafe fn testRegionCallParents() throws (testing::TestError) {
    for program in [
        "fn pair 'p 'c (p: &'p u32, c: &'c u32) where 'p: 'c {} fn relay 'a 'b (a: &'a u32, b: &'b u32) { pair(a, b); }",
        "fn pair 'p 'c (p: &'p u32, c: &'c u32) where 'p: 'c {} unsafe fn relay 'a 'b (a: &'a u32, b: &'b u32) where 'a: 'b { pair 'b 'a (b, a); }",
    ] {
        let mut testArena12 = super::testArena();
        let testStorage12: 'test12 = &mut testArena12 in {
            let mut res = super::testResolver(testStorage12);
            let result = try super::resolveProgramStr(&mut res, program);
            let err = try super::expectError(&result);
            let case resolver::ErrorKind::RegionParent(_) = err.kind else throw testing::TestError::Failed;
        }
    }
}

/// Region applications require the declared arity and accessible names.
@test unsafe fn testExplicitRegionApplicationErrors() throws (testing::TestError) {
    for program in [
        "fn read 'r (p: &'r u32) {} fn relay 'a 'b (p: &'a u32) { read 'a 'b (p); }",
        "fn read(p: &u32) {} fn relay 'a (p: &'a u32) { read 'a (p); }",
    ] {
        let mut testArena13 = super::testArena();
        let testStorage13: 'test13 = &mut testArena13 in {
            let mut res = super::testResolver(testStorage13);
            let result = try super::resolveProgramStr(&mut res, program);
            let err = try super::expectError(&result);
            let case resolver::ErrorKind::RegionArgumentCount(_) = err.kind else throw testing::TestError::Failed;
        }
    }
    let mut testArena14 = super::testArena();
    let testStorage14: 'test14 = &mut testArena14 in {
        let mut res = super::testResolver(testStorage14);
        let result = try super::resolveProgramStr(&mut res, "fn read 'r (p: &'r u32) {} fn relay 'a (p: &'a u32) { read 'missing (p); }");
        let err = try super::expectError(&result);
        let case resolver::ErrorKind::UnknownRegion(_) = err.kind else throw testing::TestError::Failed;
    }
}

/// Region header loans stay active through moves and nested exclusive reborrows.
@test unsafe fn testConcreteBorrowConflicts() throws (testing::TestError) {
    for program in [
        "fn run() { let mut x: u32 = 1; let p: 'r = &mut x in { set x = 2; } }",
        "unsafe fn run() { let mut x: u32 = 1; let p: 'r = &mut x in { set x = 2; } }",
        "fn run() { let mut x: u32 = 1; let p: 'r = &mut x, q = &mut x in {} }",
        "fn run() { let mut x: u32 = 1; let p: 'r = &x, q = &mut x in {} }",
        "fn run() { let mut x: u32 = 1; let p: 'r = &mut x in { { let q = p; set *q = 2; } set x = 3; } }",
        "fn run() { let mut x: u32 = 1; let p: 'a = &mut x in { let q: 'b = &mut *p in { set *p = 3; } } }",
        "fn run(i: u32, j: u32) { let mut x: [u32; 2] = [1, 2]; let p: 'r = &mut x[i], q = &mut x[j] in {} }",
    ] {
        let mut testArena15 = super::testArena();
        let testStorage15: 'test15 = &mut testArena15 in {
            let mut res = super::testResolver(testStorage15);
            let result = try super::resolveProgramStr(&mut res, program);
            let err = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = err.kind else throw testing::TestError::Failed;
        }
    }
}

/// Borrow headers require existing places and accessible, distinct region names.
@test unsafe fn testConcreteRegionNamesAndSources() throws (testing::TestError) {
    for program in [
        "fn run() { let p: 'r = &1 in {} }",
        "fn value() -> u32 { return 1; } fn run() { let p: 'r = &value() in {} }",
        "fn run() { let x: u32 = 1; let p: 'r = &x in { let q: 'r = &x in {} } }",
        "fn run() { let x: u32 = 1; let p: 'r = &x in {} let q: &'r u32 = &x; }",
        "fn run 'a (p: &'a mut u32) { let q: 'b = &mut *p in {} }",
    ] {
        let mut testArena16 = super::testArena();
        let testStorage16: 'test16 = &mut testArena16 in {
            let mut res = super::testResolver(testStorage16);
            let result = try super::resolveProgramStr(&mut res, program);
            let _ = try super::expectError(&result);
        }
    }

}

/// A block-local value cannot supply storage for the whole enclosing region.
@test unsafe fn testRegionLocalStorageBoundary() throws (testing::TestError) {
    for program in [
        "fn run() { let a: u32 = 1; let p: 'outer = &a in { let mut cursor = p; let b: u32 = 2; let q: 'inner = &b where 'outer: 'inner in { set cursor = q; } } }",
        "unsafe fn run() { let a: u32 = 1; let p: 'outer = &a in { let mut cursor = p; let b: u32 = 2; let q: 'inner = &b where 'outer: 'inner in { set cursor = q; } } }",
        "fn run() { let x: u32 = 1; let p: 'r = &x in { let y: u32 = 2; let q: &'r u32 = &y; } }",
        "unsafe fn run() { let x: u32 = 1; let p: 'r = &x in { let y: u32 = 2; let q: &'r u32 = &y; } }",
        "fn run() { let mut x: u32 = 1; let p: 'a = &mut x in { let q: 'b = &mut *p in { let outer: &'a mut u32 = q; } } }",
    ] {
        let mut testArena17 = super::testArena();
        let testStorage17: 'test17 = &mut testArena17 in {
            let mut res = super::testResolver(testStorage17);
            let result = try super::resolveProgramStr(&mut res, program);
            let err = try super::expectError(&result);
            let case resolver::ErrorKind::TypeMismatch(_) = err.kind else throw testing::TestError::Failed;
        }
    }

}

/// Generic calls keep the exclusive-argument overlap check after substitution.
@test unsafe fn testRegionCallBorrowOverlap() throws (testing::TestError) {
    let mut testArena18 = super::testArena();
    let testStorage18: 'test18 = &mut testArena18 in {
        let mut res = super::testResolver(testStorage18);
        let result = try super::resolveProgramStr(&mut res, "fn pair 'r (a: &'r mut u32, b: &'r mut u32) {} fn run() { let mut x: u32 = 1; let p: 'r = &mut x in { pair(p, p); } }");
        let err = try super::expectError(&result);
        let case resolver::ErrorKind::BorrowConflict(_) = err.kind else throw testing::TestError::Failed;
    }
}

/// Ownership markers do not change the positions of nominal region arguments.
@test unsafe fn testNominalRegionParameterOrder() throws (testing::TestError) {
    for program in [
        "record Pair: Copy + 'a + 'b { left: &'a u32, right: &'b u32 } fn f 'x 'y (left: &'x u32, right: &'y u32) -> Pair 'x 'y { return Pair 'x 'y { left, right }; }",
        "record Pair: 'a + Copy + 'b { left: &'a u32, right: &'b u32 } fn f 'x 'y (left: &'x u32, right: &'y u32) -> Pair 'x 'y { return Pair 'x 'y { left, right }; }",
        "record Pair: 'a + 'b + Copy { left: &'a u32, right: &'b u32 } fn f 'x 'y (left: &'x u32, right: &'y u32) -> Pair 'x 'y { return Pair 'x 'y { left, right }; }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
        }
    }
}

/// Exact application keys include the base and the ordered region arguments.
@test unsafe fn testNominalApplicationKeys() throws (testing::TestError) {
    let mut arena = super::testArena();
    let storage: 'test = &mut arena in {
        let mut res = super::testResolver(storage);
        let result = try super::resolveProgramStr(&mut res,
            "record N: 'r + 's + Copy { value: u32 } record M: 'r + 's + Copy { value: u32 } fn f 'a 'b (x: N 'a 'b, y: N 'a 'b, z: N 'b 'a, w: N 'a 'a, v: M 'a 'b) {}"
        );
        try super::expectNoErrors(&result);
        let func = try super::getBlockStmt(result.root, 2);
        let ty = resolver::typeFor(&res, func) else throw testing::TestError::Failed;
        let case resolver::Type::Fn(info) = ty else throw testing::TestError::Failed;
        for param, i in info.paramTypes {
            for other, j in info.paramTypes {
                assert (param == other) == (i == j or (i < 2 and j < 2));
            }
        }
        let mut count: u32 = 0;
        let mut cursor = res.applications;
        while let entry = cursor {
            assert entry.arguments.len == 2;
            assert resolver::nominalApplication(entry.view) == entry;
            set count += 1;
            set cursor = entry.next;
        }
        assert count == 4;
    }
}

/// Exact arguments share one descriptor and all applications share the source layout.
@test unsafe fn testNominalRegionApplications() throws (testing::TestError) {
    let mut testArena19 = super::testArena();
    let testStorage19: 'test19 = &mut testArena19 in {
        let mut res = super::testResolver(testStorage19);
        let result = try super::resolveProgramStr(&mut res,
            "record N: 'r + Copy { value: u32 } fn f 'a 'b (x: N 'a, y: N 'a, z: N 'b) {}"
        );
        try super::expectNoErrors(&result);
        let func = try super::getBlockStmt(result.root, 1);
        let fnType = resolver::typeFor(&res, func) else throw testing::TestError::Failed;
        let case resolver::Type::Fn(info) = fnType else throw testing::TestError::Failed;
        let case resolver::Type::Nominal(x) = *info.paramTypes[0] else throw testing::TestError::Failed;
        let case resolver::Type::Nominal(y) = *info.paramTypes[1] else throw testing::TestError::Failed;
        let case resolver::Type::Nominal(z) = *info.paramTypes[2] else throw testing::TestError::Failed;
        try testing::expect(x == y);
        try testing::expect(x <> z);
        try testing::expect(not resolver::typesEqual(*info.paramTypes[0], *info.paramTypes[2]));
        let a = resolver::nominalApplication(x) else throw testing::TestError::Failed;
        let b = resolver::nominalApplication(z) else throw testing::TestError::Failed;
        try testing::expect(a.base == b.base);
        try testing::expect(a.arguments[0].id <> b.arguments[0].id);
        let case resolver::NominalType::Record(base) = *a.base else throw testing::TestError::Failed;
        let case resolver::NominalType::Record(first) = *x else throw testing::TestError::Failed;
        let case resolver::NominalType::Record(second) = *z else throw testing::TestError::Failed;
        try testing::expect(base.layout == first.layout);
        try testing::expect(first.layout == second.layout);
        try testing::expect(first.layout.size == 4);
    }
}


/// Applications introduced in successive function bodies are fully resolved.
@test unsafe fn testNominalCompletionAcrossBodies() throws (testing::TestError) {
    let mut arena = super::testArena();
    let storage: 'test = &mut arena in {
        let mut res = super::testResolver(storage);
        let result = try super::resolveProgramStr(&mut res,
            "record N: 'r + Copy { value: &'r u32 } fn f 'a (x: &'a u32) { let n = N 'a { value: x }; } fn g 'b (x: &'b u32) { let n = N 'b { value: x }; }"
        );
        try super::expectNoErrors(&result);
        let mut count: u32 = 0;
        let mut cursor = res.applications;
        while let applied = cursor {
            let case resolver::NominalType::Record(body) = *applied.view else throw testing::TestError::Failed;
            assert body.application == applied;
            assert body.fields.len == 1;
            set count += 1;
            set cursor = applied.next;
        }
        assert count == 2;
    }
}

/// Recursive fields refer to their own exact applied descriptor.
@test unsafe fn testRecursiveNominalApplications() throws (testing::TestError) {
    let mut testArena20 = super::testArena();
    let testStorage20: 'test20 = &mut testArena20 in {
        let mut res = super::testResolver(testStorage20);
        let result = try super::resolveProgramStr(&mut res,
            "record N: 'r + Copy { next: ?*N 'r } fn f 'a 'b (x: N 'a, y: N 'b) {}"
        );
        try super::expectNoErrors(&result);
        let func = try super::getBlockStmt(result.root, 1);
        let fnType = resolver::typeFor(&res, func) else throw testing::TestError::Failed;
        let case resolver::Type::Fn(info) = fnType else throw testing::TestError::Failed;
        for parameter in info.paramTypes {
            let case resolver::Type::Nominal(descriptor) = *parameter else throw testing::TestError::Failed;
            let case resolver::NominalType::Record(body) = *descriptor else throw testing::TestError::Failed;
            let case resolver::Type::Optional(inner) = body.fields[0].fieldType else throw testing::TestError::Failed;
            let case resolver::Type::Pointer { target, .. } = *inner else throw testing::TestError::Failed;
            try testing::expect(resolver::typesEqual(*target, *parameter));
            try testing::expect(body.layout.size == 8);
        }
    }
}

/// An inline union payload retains its enclosing application's region arguments.
@test unsafe fn testNominalPayloadRegionCapture() throws (testing::TestError) {
    let mut testArena21 = super::testArena();
    let testStorage21: 'test21 = &mut testArena21 in {
        let mut res = super::testResolver(testStorage21);
        let result = try super::resolveProgramStr(&mut res,
            "record N: 'r + Copy { value: u32 } union U: 'r + Copy { Link { node: *N 'r }, Empty } fn f 'a (u: U 'a, n: N 'a) {}"
        );
        try super::expectNoErrors(&result);
        let func = try super::getBlockStmt(result.root, 2);
        let fnType = resolver::typeFor(&res, func) else throw testing::TestError::Failed;
        let case resolver::Type::Fn(info) = fnType else throw testing::TestError::Failed;
        let case resolver::Type::Nominal(resolver::NominalType::Union(body)) = *info.paramTypes[0]
            else throw testing::TestError::Failed;
        let case resolver::Type::Nominal(resolver::NominalType::Record(payload)) = body.variants[0].valueType
            else throw testing::TestError::Failed;
        let case resolver::Type::Pointer { target, .. } = payload.fields[0].fieldType
            else throw testing::TestError::Failed;
        try testing::expect(resolver::typesEqual(*target, *info.paramTypes[1]));
        let applied = body.application else throw testing::TestError::Failed;
        let case resolver::NominalType::Union(base) = *applied.base else throw testing::TestError::Failed;
        try testing::expect(body.layout == base.layout);
    }
}

/// Nominal applications require exactly the declared number of region arguments.
@test unsafe fn testNominalRegionArgumentCount() throws (testing::TestError) {
    for program in [
        "record N: 'r { value: u32 } fn f(n: N) {}",
        "record N { value: u32 } fn f 'r (n: N 'r) {}",
        "record N: 'r + 's { value: u32 } fn f 'a (n: N 'a) {}",
        "record N: 'r { value: u32 } fn f 'a 'b (n: N 'a 'b) {}",
        "record N: 'r { value: u32 } fn f() { let n = N { value: 1 }; }",
        "union U: 'r { Empty } fn f() { let u = U::Empty; }",
    ] {
        let mut testArena22 = super::testArena();
        let testStorage22: 'test22 = &mut testArena22 in {
            let mut res = super::testResolver(testStorage22);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::RegionArgumentCount(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Type arguments are invariant in values, constructor hints, and patterns.
@test unsafe fn testNominalRegionInvariance() throws (testing::TestError) {
    for program in [
        "record N: 'r + Copy { value: u32 } fn f 'a 'b (n: N 'a) { let x: N 'b = n; }",
        "record N: 'r + Copy { value: u32 } unsafe fn f 'a 'b (n: N 'a) { let x: N 'b = n; }",
        "record N: 'r + Copy { value: u32 } fn f 'a 'b () { let n: N 'a = N 'b { value: 1 }; }",
        "record N: 'r + Copy { value: u32 } fn f 'a 'b (n: N 'a) { let case N 'b { value } = n else panic; }",
        "record N: 'r + Copy (u32); fn f 'a 'b (n: N 'a) { let case N 'b (value) = n else panic; }",
        "record N: 'r + Copy { value: u32 } record M: 'r + Copy { value: u32 } fn f 'a (n: N 'a) { let case M 'a { value } = n else panic; }",
    ] {
        let mut testArena23 = super::testArena();
        let testStorage23: 'test23 = &mut testArena23 in {
            let mut res = super::testResolver(testStorage23);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::TypeMismatch(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Region inference must agree between an outer reference and its embedded nominal type.
@test unsafe fn testNominalRegionInferenceConflict() throws (testing::TestError) {
    for program in [
        "record N: 'r + Copy { value: u32 } fn take 'r (n: &'r N 'r) {} fn f 'a 'b (n: &'a N 'b) { take(n); }",
        "record N: 'r + Copy { value: u32 } fn take 'r (n: N 'r, m: N 'r) {} fn f 'a 'b (n: N 'a, m: N 'b) { take(n, m); }",
    ] {
        let mut testArena24 = super::testArena();
        let testStorage24: 'test24 = &mut testArena24 in {
            let mut res = super::testResolver(testStorage24);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::RegionInference(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Applications must satisfy the source declaration's explicit parent relations.
@test unsafe fn testNominalRegionParentConstraint() throws (testing::TestError) {
    let mut testArena25 = super::testArena();
    let testStorage25: 'test25 = &mut testArena25 in {
        let mut res = super::testResolver(testStorage25);
        let result = try super::resolveProgramStr(&mut res,
            "record N: 'r + 's where 'r: 's { value: u32 } fn f 'a 'b (n: N 'a 'b) {}"
        );
        let error = try super::expectError(&result);
        let case resolver::ErrorKind::RegionParent(_) = error.kind else throw testing::TestError::Failed;
    }
}

/// An applied affine type retains the source declaration's move rule.
@test unsafe fn testNominalRegionMoveRule() throws (testing::TestError) {
    let mut testArena26 = super::testArena();
    let testStorage26: 'test26 = &mut testArena26 in {
        let mut res = super::testResolver(testStorage26);
        let result = try super::resolveProgramStr(&mut res,
            "record N: 'r { value: u32 } fn f 'a (n: N 'a) { let first = n; let second = n; }"
        );
        let error = try super::expectError(&result);
        let case resolver::ErrorKind::AffineUseAfterMove(_) = error.kind else throw testing::TestError::Failed;
    }
}

/// By-value cycles have no layout, including cycles through exact applications.
@test unsafe fn testNominalRegionValueCycle() throws (testing::TestError) {
    for program in [
        "record N: 'r { next: N 'r }",
        "record N: 'r { next: ?N 'r }",
        "union U: 'r { More(U 'r), Empty }",
        "record N: 'r { m: M 'r } record M: 'r { n: N 'r }",
    ] {
        let mut testArena27 = super::testArena();
        let testStorage27: 'test27 = &mut testArena27 in {
            let mut res = super::testResolver(testStorage27);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::RecursiveType = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Recursive substitutions can permute arguments without expanding the type graph.
@test unsafe fn testNominalRegionPermutation() throws (testing::TestError) {
    let mut testArena28 = super::testArena();
    let testStorage28: 'test28 = &mut testArena28 in {
        let mut res = super::testResolver(testStorage28);
        let result = try super::resolveProgramStr(&mut res,
            "record N: 'r + 's + Copy { next: ?*N 's 'r } fn f 'a 'b (x: N 'a 'b, y: N 'b 'a) {}"
        );
        try super::expectNoErrors(&result);
        let func = try super::getBlockStmt(result.root, 1);
        let fnType = resolver::typeFor(&res, func) else throw testing::TestError::Failed;
        let case resolver::Type::Fn(info) = fnType else throw testing::TestError::Failed;
        for parameter, i in info.paramTypes {
            let case resolver::Type::Nominal(resolver::NominalType::Record(body)) = *parameter
                else throw testing::TestError::Failed;
            let case resolver::Type::Optional(inner) = body.fields[0].fieldType else throw testing::TestError::Failed;
            let case resolver::Type::Pointer { target, .. } = *inner else throw testing::TestError::Failed;
            try testing::expect(resolver::typesEqual(*target, *info.paramTypes[1 - i]));
        }
    }
}

/// Calls transfer named exclusive references on normal and error paths.
@test unsafe fn testRegionalCallOwnershipTransfer() throws (testing::TestError) {
    for program in [
        "fn take 'r (p: &'r mut u32) {} fn run 'r (p: &'r mut u32) { take(p); take(p); }",
        "fn take 'r (p: &'r mut u32) {} unsafe fn run 'r (p: &'r mut u32) { take(p); set *p = 1; }",
        "fn take 'r (p: &'r mut [u32]) {} fn run 'r (p: &'r mut [u32]) { take(p); p[0]; }",
        "fn take 'r (p: &'r mut u32) {} fn run 'r (p: &'r mut u32) { let f = take 'r; f(p); set *p = 1; }",
        "union E { Bad } fn take 'r (p: &'r mut u32) throws (E) { throw E::Bad; } fn run 'r (p: &'r mut u32) { try take(p) catch {}; set *p = 1; }",
        "fn take 'r (p: &'r mut u32) {} fn run 'r (p: &'r mut u32, c: bool) { if c { take(p); } set *p = 1; }",
    ] {
        let mut testArena29 = super::testArena();
        let testStorage29: 'test29 = &mut testArena29 in {
            let mut res = super::testResolver(testStorage29);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::AffineUseAfterMove(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Full-region projections protect their source after a local binding leaves scope.
@test unsafe fn testRegionalProjectionLifetime() throws (testing::TestError) {
    for program in [
        "fn f 'r (p: &'r mut u32) { let shared = &*p; let copy = shared; set *p = 1; }",
        "unsafe fn f 'r (p: &'r mut u32) { let shared = &*p; let copy = shared; set *p = 1; }",
        "fn f 'r (p: &'r mut u32, q: &'r u32) { let mut cursor = q; set cursor = &*p; set *p = 1; }",
        "unsafe fn f 'r (p: &'r mut u32, q: &'r u32) { let mut cursor = q; set cursor = &*p; set *p = 1; }",
        "fn f 'r (p: &'r mut u32) { { let q = &mut *p; set *q = 1; } set *p = 2; }",
        "fn f 'r (p: &'r mut u32) { { let q = &*p; } set *p = 2; }",
        "unsafe fn f 'r (p: &'r mut u32) { { let q = &*p; } set *p = 2; }",
        "fn f 'r (p: &'r mut u32) { { let q = &mut *p; let moved = q; } *p; }",
        "record P { a: u32, b: u32 } fn f 'r (p: &'r mut P) { { let q = &mut p.a; } p.a; }",
        "record P { a: u32, b: u32 } fn f 'r (p: &'r mut P) { { let q = &p.a; } set p.a = 2; }",
    ] {
        let mut testArena30 = super::testArena();
        let testStorage30: 'test30 = &mut testArena30 in {
            let mut res = super::testResolver(testStorage30);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// A regional loan on any live branch remains active at the branch join.
@test unsafe fn testRegionalProjectionBranchJoin() throws (testing::TestError) {
    for program in [
        "fn f 'r (p: &'r mut u32, c: bool) { if c { let q = &mut *p; } set *p = 2; }",
        "fn f 'r (p: &'r mut u32, c: bool) { if c {} else { let q = &*p; } set *p = 2; }",
        "fn f 'r (p: &'r mut u32, c: bool) { match c { case true => { let q = &mut *p; } else => {} } *p; }",
        "fn f 'r (p: &'r mut u32, c: ?u32) { if let n = c { let q = &*p; } set *p = 2; }",
    ] {
        let mut testArena31 = super::testArena();
        let testStorage31: 'test31 = &mut testArena31 in {
            let mut res = super::testResolver(testStorage31);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Loop back edges carry regional loans into later iterations.
@test unsafe fn testRegionalProjectionLoopBackEdge() throws (testing::TestError) {
    for program in [
        "fn f 'r (p: &'r mut u32) { for i in 0..2 { let q = &mut *p; } }",
        "fn f 'r (p: &'r mut u32) { for i in 0..2 { set *p = 1; let q = &*p; } }",
        "fn f 'r (p: &'r mut u32) { for i in 0..2 { set *p = 1; let q = &*p; continue; } }",
        "fn f 'r (p: &'r mut u32, c: bool) { while c { let q = &mut *p; } }",
        "fn f 'r (p: &'r mut u32, c: ?u32) { while let n = c { let q = &mut *p; } }",
        "fn f 'r (p: &'r mut u32) { loop { let q = &mut *p; } }",
        "fn f 'r (p: &'r mut u32, c: bool) { loop { if c { set *p = 1; break; } let q = &*p; } }",
    ] {
        let mut testArena32 = super::testArena();
        let testStorage32: 'test32 = &mut testArena32 in {
            let mut res = super::testResolver(testStorage32);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Loans in caller-supplied regions survive loop and nested-region exits.
@test unsafe fn testRegionalProjectionLoopExit() throws (testing::TestError) {
    for program in [
        "fn f 'r (p: &'r mut u32) { loop { let q = &mut *p; break; } set *p = 2; }",
        "fn f 'r (p: &'r mut u32, c: bool) { while c { let q = &*p; break; } else {} set *p = 2; }",
        "fn f 'r (p: &'r mut u32) { for i in 0..2 { let q = &*p; break; } else {} set *p = 2; }",
        "fn f 'r (p: &'r mut u32) { let x: u32 = 0; let v: 'child = &x where 'r: 'child in { let q = &*p; } set *p = 2; }",
    ] {
        let mut testArena33 = super::testArena();
        let testStorage33: 'test33 = &mut testArena33 in {
            let mut res = super::testResolver(testStorage33);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Region erasure cannot merge distinct error alternatives in one signature.
@test unsafe fn testRegionalErrorAmbiguity() throws (testing::TestError) {
    for program in [
        "record E: 'r + Copy {} fn f 'a 'b () throws (E 'a, E 'b) {}",
        "record E: 'r + Copy {} unsafe fn f 'a 'b () throws (E 'a, E 'b) {}",
        "record E: 'r + Copy {} record Callback: 'a + 'b { f: fn() throws (E 'a, E 'b) }",
        "fn f 'a 'b () throws (&'a u32, &'b u32) {}",
    ] {
        let mut testArena34 = super::testArena();
        let testStorage34: 'test34 = &mut testArena34 in {
            let mut res = super::testResolver(testStorage34);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectErrorKind(&result, resolver::ErrorKind::AmbiguousRegionalError);
        }
    }
}

/// Moving an exclusive reference into an aggregate transfers its ownership.
@test unsafe fn testRegionalAggregateMove() throws (testing::TestError) {
    for program in [
        "record W: 'r { p: &'r mut u32 } fn f 'r (p: &'r mut u32) { let w = W 'r { p }; set *p = 1; }",
        "record W: 'r { p: &'r mut u32 } unsafe fn f 'r (p: &'r mut u32) { let w = W 'r { p }; set *p = 1; }",
        "record W: 'r { p: &'r mut u32 } fn f 'r (w: W 'r) { let case W { p } = w else panic; let again = w; }",
        "union W: 'r { P { p: &'r mut u32 } } fn f 'r (p: &'r mut u32) { let w = W 'r::P { p }; set *p = 1; }",
        "fn f 'r (p: &'r mut u32) { let a: [&'r mut u32; 1] = [p]; set *p = 1; }",
        "fn f 'r (p: &'r mut u32) { let a: ?&'r mut u32 = p; set *p = 1; }",
    ] {
        let mut testArena35 = super::testArena();
        let testStorage35: 'test35 = &mut testArena35 in {
            let mut res = super::testResolver(testStorage35);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::AffineUseAfterMove(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Aggregate transfers do not end a projection loan on its source.
@test unsafe fn testRegionalAggregateLoan() throws (testing::TestError) {
    for program in [
        "record W: 'r { p: &'r mut u32 } fn f 'r (p: &'r mut u32) { { let w = W 'r { p: &mut *p }; } set *p = 1; }",
        "record R: 'r + Copy { p: &'r u32 } fn f 'r (p: &'r mut u32) { { let r = R 'r { p: &*p }; } set *p = 1; }",
        "record R: 'r + Copy { p: &'r u32 } fn take 'r (r: R 'r) {} fn f 'r (p: &'r mut u32) { take(R 'r { p: &*p }); set *p = 1; }",
        "fn id 'r (p: &'r mut u32) -> &'r mut u32 { return p; } fn f 'r (p: &'r mut u32) { let q = id(p); { let other = &mut *q; } set *q = 1; }",
    ] {
        let mut testArena36 = super::testArena();
        let testStorage36: 'test36 = &mut testArena36 in {
            let mut res = super::testResolver(testStorage36);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Local storage cannot acquire a caller region through returns or aggregate hints.
@test unsafe fn testRegionalStorageEscape() throws (testing::TestError) {
    for program in [
        "fn f 'r () -> &'r u32 { let x: u32 = 1; return &x; }",
        "unsafe fn f 'r () -> &'r u32 { let x: u32 = 1; return &x; }",
        "record R: 'r + Copy { p: &'r u32 } fn f 'r () -> R 'r { let x: u32 = 1; return R 'r { p: &x }; }",
        "record R: 'r + Copy { p: &'r u32 } fn f 'r () -> R 'r { let x: u32 = 1; let p: 'short = &x in { return R 'short { p }; } }",
        "record R: 'r + Copy { p: &'r u32 } fn f 'r (p: &'r u32) -> &'r R 'r { let r = R 'r { p }; return &r; }",
        "record R: 'r + Copy { p: &'r u32 } fn f 'r (p: &'r u32) { let mut outer = R 'r { p }; let x: u32 = 1; let q: 'short = &x in { set outer = R 'short { p: q }; } }",
    ] {
        let mut testArena37 = super::testArena();
        let testStorage37: 'test37 = &mut testArena37 in {
            let mut res = super::testResolver(testStorage37);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::TypeMismatch(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Reference fields retain their ownership and storage restrictions.
@test unsafe fn testRegionalFieldRestrictions() throws (testing::TestError) {
    {
        let mut testArena38 = super::testArena();
        let testStorage38: 'test38 = &mut testArena38 in {
            let mut res = super::testResolver(testStorage38);
            let result = try super::resolveProgramStr(&mut res, "record W: 'r { p: &'r mut u32 } fn f 'r (w: W 'r) { let p = w.p; }");
            try super::expectErrorKind(&result, resolver::ErrorKind::LinearPartialMove);
        }
    }
    {
        let mut testArena39 = super::testArena();
        let testStorage39: 'test39 = &mut testArena39 in {
            let mut res = super::testResolver(testStorage39);
            let result = try super::resolveProgramStr(&mut res, "record R: 'r { p: &u32 }");
            try super::expectErrorKind(&result, resolver::ErrorKind::InvalidRefPosition);
        }
    }
    {
        let mut testArena40 = super::testArena();
        let testStorage40: 'test40 = &mut testArena40 in {
            let mut res = super::testResolver(testStorage40);
            let result = try super::resolveProgramStr(&mut res, "fn f 'r (p: &'r u32) { static r: &'r u32 = undefined; }");
            try super::expectErrorKind(&result, resolver::ErrorKind::InvalidRefPosition);
        }
    }
}

/// Call tracking includes all explicit arguments and the implicit receiver.
@test unsafe fn testCallLoanScratchCapacity() throws (testing::TestError) {
    let mut arena = super::testArena();
    let storage: 'test = &mut arena in {
        let mut res = super::testResolver(storage);
        let result = try super::resolveProgramStr(&mut res,
            "record R: Copy { value: u32 } fn (r: &mut R) take(a: u32, b: u32, c: u32, d: u32, e: u32, f: u32, g: u32, h: &mut u32) {} fn run() { let mut r = R { value: 0 }; let mut other: u32 = 0; r.take(0, 0, 0, 0, 0, 0, 0, &mut other); set r.value = 1; set other = 2; }"
        );
        try super::expectNoErrors(&result);
    }
    for program in [
        "record R: Copy { value: u32 } fn (r: &mut R) take(a: u32, b: u32, c: u32, d: u32, e: u32, f: u32, g: u32, h: &mut u32) {} fn run() { let mut r = R { value: 0 }; r.take(0, 0, 0, 0, 0, 0, 0, &mut r.value); }",
        "fn take(a: &mut u32, b: u32, c: u32, d: u32, e: u32, f: u32, g: u32, h: &mut u32) {} fn run() { let mut value: u32 = 0; take(&mut value, 0, 0, 0, 0, 0, 0, &mut value); }",
    ] {
        let mut errorArena = super::testArena();
        let errorStorage: 'error = &mut errorArena in {
            let mut res = super::testResolver(errorStorage);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Loan compaction preserves outer-region conflicts after child slots expire.
@test unsafe fn testRegionalLoanCompactionConflict() throws (testing::TestError) {
    for program in [
        "fn f 'r (p: &'r mut u32) { let value: u32 = 0; let child: 'child = &value where 'r: 'child in { let local = &*child; let retained = &*p; } set *p = 1; }",
        "fn f 'r (p: &'r mut u32) { let value: u32 = 0; loop { let child: 'child = &value where 'r: 'child in { let local = &*child; let retained = &*p; } break; } set *p = 1; }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Regional projection tracking limits simultaneous live projections.
@test unsafe fn testRegionalLoanCapacity() throws (testing::TestError) {
    let mut reuseArena = super::testArena();
    let reuseStorage: 'reuse = &mut reuseArena in {
        let mut res = super::testResolver(reuseStorage);
        let result = try super::resolveProgramStr(&mut res, "fn f 'r (p: &'r u32) { let outer: 'outer = &*p where 'r: 'outer in { let q: 'x = &*outer in { &*q; } let q: 'x = &*outer in { &*q; } let q: 'x = &*outer in { &*q; } let q: 'x = &*outer in { &*q; } let q: 'x = &*outer in { &*q; } let q: 'x = &*outer in { &*q; } let q: 'x = &*outer in { &*q; } let q: 'x = &*outer in { &*q; } let q: 'x = &*outer in { &*q; } let q: 'x = &*outer in { &*q; } let q: 'x = &*outer in { &*q; } let q: 'x = &*outer in { &*q; } let q: 'x = &*outer in { &*q; } let q: 'x = &*outer in { &*q; } let q: 'x = &*outer in { &*q; } let q: 'x = &*outer in { &*q; } let q: 'x = &*outer in { &*q; } } }");
        try super::expectNoErrors(&result);
    }
    let mut testArena41 = super::testArena();
    let testStorage41: 'test41 = &mut testArena41 in {
        let mut res = super::testResolver(testStorage41);
        let result = try super::resolveProgramStr(&mut res, "fn f 'r (p: &'r u32) { [&*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p, &*p]; }");
        try super::expectErrorKind(&result, resolver::ErrorKind::RegionalLoanOverflow);
    }
}

/// Shared regional parameters consume exclusive arguments that can be retained.
@test unsafe fn testRegionalSharedCallTransfer() throws (testing::TestError) {
    for program in [
        "fn read 'r (p: &'r u32) -> &'r u32 { return p; } fn f 'r (p: &'r mut u32) -> u32 { let q = read(p); set *p = 2; return *q; }",
        "fn read 'r (p: &'r u32) -> &'r u32 { return p; } unsafe fn f 'r (p: &'r mut u32) { let q = read(p); set *p = 2; }",
        "fn read 'r (p: &'r [u32]) -> &'r [u32] { return p; } fn f 'r (p: &'r mut [u32]) { let q = read(p); set p[0] = 2; }",
        "fn read 'r (p: &'r u32) -> &'r u32 { return p; } fn f 'r (p: &'r mut u32) { let callback = read 'r; let q = callback(p); set *p = 2; }",
    ] {
        let mut testArena42 = super::testArena();
        let testStorage42: 'test42 = &mut testArena42 in {
            let mut res = super::testResolver(testStorage42);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::AffineUseAfterMove(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Values stored in a regional destination must cover its full lifetime.
@test unsafe fn testRegionalStoreLifetime() throws (testing::TestError) {
    for program in [
        "fn f 'a 'b (dst: &'a mut ?&'b u32, p: &'b u32) { set *dst = p; }",
        "unsafe fn f 'a 'b (dst: &'a mut ?&'b u32, p: &'b u32) { set *dst = p; }",
        "fn f 'a 'b (dst: &'a mut ?&'b u32, p: &'b u32) where 'a: 'b { set *dst = p; }",
        "record R: 'r + Copy { p: &'r u32 } fn f 'a 'b (dst: &'a mut R 'b, p: &'b u32) { set *dst = R 'b { p }; }",
        "fn f 'a 'b (dst: &'a mut [&'b u32], p: &'b u32) { set dst[0] = p; }",
        "fn f 'a 'b (dst: &'a mut [&'b u32], p: &'b u32) { set dst[..] = p; }",
        "fn f 'a 'b (dst: &'a mut fn(&'b u32), callback: fn(&'b u32)) { set *dst = callback; }",
    ] {
        let mut testArena43 = super::testArena();
        let testStorage43: 'test43 = &mut testArena43 in {
            let mut res = super::testResolver(testStorage43);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::RegionEscape(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// A session holds the arena loan after the interface is moved or discarded.
@test unsafe fn testSessionArenaLoan() throws (testing::TestError) {
    for program in [
        "use std::lang::alloc; fn f(arena: &mut alloc::Arena) { use *arena as s in { alloc::reset(arena); } }",
        "use std::lang::alloc; unsafe fn f(arena: &mut alloc::Arena) { use *arena as s in { alloc::reset(arena); } }",
        "use std::lang::alloc; fn f(arena: &mut alloc::Arena) { use *arena as s in { let moved = s; alloc::reset(arena); } }",
        "use std::lang::alloc; fn f(arena: &mut alloc::Arena) { use *arena as s in { let _ = s; set arena.offset = 0; } }",
        "use std::lang::alloc; fn f(arena: &mut alloc::Arena) { use *arena as s in { use *arena as t in {} } }",
    ] {
        let mut testArena44 = super::testArena();
        let testStorage44: 'test44 = &mut testArena44 in {
            let mut res = super::testResolver(testStorage44);
            let result = try super::resolveSessionProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Session interfaces have affine ownership and invariant region arguments.
@test unsafe fn testSessionOwnership() throws (testing::TestError) {
    for program in [
        "fn f 'r (s: Session 'r) { let moved = s; let again = s; }",
        "unsafe fn f 'r (s: Session 'r) { let moved = s; let again = s; }",
        "fn take 'r (s: Session 'r) {} fn f 'r (s: Session 'r) { take(s); take(s); }",
    ] {
        let mut testArena45 = super::testArena();
        let testStorage45: 'test45 = &mut testArena45 in {
            let mut res = super::testResolver(testStorage45);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::AffineUseAfterMove(_) = error.kind else throw testing::TestError::Failed;
        }
    }
    {
        let mut testArena46 = super::testArena();
        let testStorage46: 'test46 = &mut testArena46 in {
            let mut res = super::testResolver(testStorage46);
            let result = try super::resolveProgramStr(&mut res,
                "fn f 'r 's (s: Session 's) -> Session 'r where 'r: 's { return s; }");
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::TypeMismatch(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Regional `use` blocks require a mutable allocation trait implementer.
@test unsafe fn testSessionSource() throws (testing::TestError) {
    for program in [
        "record Arena { data: *mut [u8], offset: u32 } fn f(arena: &mut Arena) { use *arena as s in {} }",
        "fn f(value: &mut u32) { use *value as s in {} }",
    ] {
        let mut testArena47 = super::testArena();
        let testStorage47: 'test47 = &mut testArena47 in {
            let mut res = super::testResolver(testStorage47);
            let result = try super::resolveSessionProgramStr(&mut res, program);
            try super::expectErrorKind(&result, resolver::ErrorKind::InvalidSessionSource);
        }
    }
    let mut customArena = super::testArena();
    let customStorage: 'custom = &mut customArena in {
        let mut res = super::testResolver(customStorage);
        let result = try super::resolveSessionProgramStr(&mut res,
            "use std::lang::alloc; record Wrapper: 'r { arena: &'r mut alloc::Arena } instance alloc::Alloc for Wrapper 'r { unsafe fn (wrapper: &mut Wrapper 'r) reserve(size: u32, alignment: u32) -> *unsafe mut opaque throws (alloc::AllocError) { panic; } unsafe fn (wrapper: &mut Wrapper 'r) reserveSlice(size: u32, alignment: u32, count: u32) -> *unsafe mut [opaque] throws (alloc::AllocError) { panic; } } fn f 'r (wrapper: &'r mut Wrapper 'r) { use *wrapper as session in { try! session.new(1 as u32); } }");
        try super::expectNoErrors(&result);
    }
}

/// Region-dependent values cannot be manufactured from uninitialized storage.
@test unsafe fn testRegionalUndefined() throws (testing::TestError) {
    for program in [
        "unsafe fn f 'r () -> Session 'r { return undefined; }",
        "record R: 'r { s: Session 'r } unsafe fn f 'r () -> R 'r { return undefined; }",
        "unsafe fn f 'r () -> *unsafe Session 'r { return undefined; }",
        "unsafe fn f 'r () -> &'r u32 { return undefined; }",
    ] {
        let mut testArena48 = super::testArena();
        let testStorage48: 'test48 = &mut testArena48 in {
            let mut res = super::testResolver(testStorage48);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::TypeMismatch(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Pointer casts cannot introduce session or aggregate region dependencies.
@test unsafe fn testRegionalCastForgery() throws (testing::TestError) {
    for program in [
        "unsafe fn f 'r (p: *unsafe opaque) -> *unsafe Session 'r { return p as *unsafe Session 'r; }",
        "unsafe fn f 'r (p: *unsafe [opaque]) -> *unsafe [Session 'r] { return p as *unsafe [Session 'r]; }",
        "record R: 'r { s: Session 'r } unsafe fn f 'r (p: *unsafe opaque) -> *unsafe R 'r { return p as *unsafe R 'r; }",
        "record R: 'r + Copy { p: &'r u32 } unsafe fn f 'r 's (p: *unsafe R 'r) -> *unsafe R 's { return p as *unsafe R 's; }",
    ] {
        let mut testArena49 = super::testArena();
        let testStorage49: 'test49 = &mut testArena49 in {
            let mut res = super::testResolver(testStorage49);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::InvalidAsCast(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Bulk allocation rejects resources and values that need ownership cleanup.
@test unsafe fn testSessionAllocationValue() throws (testing::TestError) {
    for program in [
        "record R: Once { n: u32 } fn f 'r (s: &Session 'r, value: R) { try! s.new(value); }",
        "record R: Once { n: u32 } unsafe fn f 'r (s: &Session 'r, value: R) { try! s.new(value); }",
        "record R: Once { n: u32 } record Outer { value: R } fn f 'r (s: &Session 'r, value: Outer) { try! s.new(value); }",
        "record R: Once { n: u32 } fn f 'r (s: &Session 'r, value: ?R) { try! s.new(value); }",
        "fn f 'r (s: &Session 'r, value: Session 'r) { try! s.new(value); }",
        "record R: Once { n: u32 } fn f 'r (s: &Session 'r, value: [R; 1]) { try! s.new(value); }",
        "fn f 'r (s: &Session 'r, value: &'r mut u32) { try! s.fill(value, 2); }",
        "fn f 'r (s: &Session 'r, value: &[&'r mut u32]) { try! s.copy(value); }",
    ] {
        let mut testArena50 = super::testArena();
        let testStorage50: 'test50 = &mut testArena50 in {
            let mut res = super::testResolver(testStorage50);
            let result = try super::resolveSessionProgramStr(&mut res, program);
            try super::expectErrorKind(&result, resolver::ErrorKind::InvalidAllocationValue);
        }
    }
}

/// Allocated values must retain dependencies that cover the destination session.
@test unsafe fn testSessionAllocationDependency() throws (testing::TestError) {
    for program in [
        "fn f 'r 's (a: &Session 'r, p: &'s u32) where 'r: 's { try! a.new(p); }",
        "unsafe fn f 'r 's (a: &Session 'r, p: &'s u32) where 'r: 's { try! a.new(p); }",
        "record R: 's + Copy { p: &'s u32 } fn f 'r 's (a: &Session 'r, p: R 's) where 'r: 's { try! a.new(p); }",
        "fn f 'r 's (a: &Session 'r, p: &[&'s u32]) where 'r: 's { try! a.copy(p); }",
    ] {
        let mut testArena51 = super::testArena();
        let testStorage51: 'test51 = &mut testArena51 in {
            let mut res = super::testResolver(testStorage51);
            let result = try super::resolveSessionProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::RegionEscape(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Allocation operations require error handling and exact source region results.
@test unsafe fn testSessionAllocationContract() throws (testing::TestError) {
    {
        let mut testArena52 = super::testArena();
        let testStorage52: 'test52 = &mut testArena52 in {
            let mut res = super::testResolver(testStorage52);
            let result = try super::resolveSessionProgramStr(&mut res,
                "fn f 'r (s: &Session 'r) { s.new(1 as u32); }");
            try super::expectErrorKind(&result, resolver::ErrorKind::MissingTry);
        }
    }
    {
        let mut testArena53 = super::testArena();
        let testStorage53: 'test53 = &mut testArena53 in {
            let mut res = super::testResolver(testStorage53);
            let result = try super::resolveSessionProgramStr(&mut res,
                "fn f 'r 's (a: &Session 'r) -> &'s mut u32 { return try! a.new(1 as u32); }");
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::TypeMismatch(_) = error.kind else throw testing::TestError::Failed;
        }
    }
    {
        let mut testArena54 = super::testArena();
        let testStorage54: 'test54 = &mut testArena54 in {
            let mut res = super::testResolver(testStorage54);
            let result = try super::resolveSessionProgramStr(&mut res,
                "fn f 'r (a: &Session 'r, p: &u32) { try! a.new(p); }");
            try super::expectErrorKind(&result, resolver::ErrorKind::InvalidRefPosition);
        }
    }
}

/// Typed reservations reject array products, aggregate sums, and field-offset overflow.
@test unsafe fn testSessionAllocationLayout() throws (testing::TestError) {
    for program in [
        "fn f 'r (s: &Session 'r, value: [u64; 536870913]) { try! s.new(value); }",
        "unsafe fn f 'r (s: &Session 'r, value: [u64; 536870913]) { try! s.new(value); }",
        "record R { a: [u8; 4294967290], b: u64 } fn f 'r (s: &Session 'r, value: R) { try! s.new(value); }",
        "record R { a: [u8; 2147483648], b: u8 } fn f 'r (s: &Session 'r, value: R) { try! s.new(value); }",
        "fn f 'r (s: &Session 'r, value: ?[u8; 4294967295]) { try! s.new(value); }",
        "union R { Data([u8; 4294967295]) } fn f 'r (s: &Session 'r, value: R) { try! s.new(value); }",
    ] {
        let mut testArena55 = super::testArena();
        let testStorage55: 'test55 = &mut testArena55 in {
            let mut res = super::testResolver(testStorage55);
            let result = try super::resolveSessionProgramStr(&mut res, program);
            try super::expectErrorKind(&result, resolver::ErrorKind::InvalidAllocationLayout);
        }
    }
}

/// Conditional bindings enforce moves through bodies and guards.
@test unsafe fn testConditionalBindingMoves() throws (testing::TestError) {
    for program in [
        "record Token {} fn take(value: Token) {} fn f(value: ?Token) { if let item = value { take(item); take(item); } }",
        "record Token {} fn take(value: Token) {} fn f(value: ?Token) { let item = value else return; take(item); take(item); }",
        "record Token {} fn take(value: Token) {} fn next() -> ?Token { return Token {}; } fn f() { while let item = next() { take(item); take(item); } }",
        "record Token {} fn take(value: Token) -> bool { return true; } fn f(value: ?Token) { if let item = value; take(item) { take(item); } }",
        "record Token {} fn take(value: Token) {} unsafe fn f(value: ?Token) { if let item = value { take(item); take(item); } }",
        "record Token {} record Box { item: Token } fn take(item: Token) -> bool { return true; } fn f(box: Box) { let case Box { item } = box if take(item) else return; take(item); }",
        "record Token {} record Box { item: Token } fn take(item: Token) -> bool { return true; } unsafe fn f(box: Box) { let case Box { item } = box if take(item) else return; take(item); }",
        "record Token {} union Box { Full(Token), Empty } fn take(item: Token) -> bool { return true; } fn f(box: Box) { let case Box::Full(item) = box if take(item) else return; take(item); }",
    ] {
        let mut storage = super::testArena();
        let memory: 'test = &mut storage in {
            let mut res = super::testResolver(memory);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectErrorKind(&result, resolver::ErrorKind::AffineUseAfterMove("item"));
        }
    }
}

/// Guard ownership distinguishes consumed fields, borrowed fields, and failure paths.
@test unsafe fn testLetElseGuardOwnership() throws (testing::TestError) {
    for program in [
        "record Token {} record Box { item: Token } fn take(item: Token) -> bool { return true; } fn f(box: Box) { let case Box { item } = box if take(item) else return; }",
        "record Token {} record Box { item: Token } fn read(item: &Token) -> bool { return true; } fn take(item: Token) {} fn f(box: Box) { let case Box { item } = box if read(&item) else return; take(item); }",
        "union Box { Full(u32), Empty } fn f(box: Box) -> u32 { let case Box::Full(item) = box if item > 0 else return 0; return item; }",
    ] {
        let mut storage = super::testArena();
        let memory: 'test = &mut storage in {
            let mut res = super::testResolver(memory);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
        }
    }
    let mut storage = super::testArena();
    let memory: 'test = &mut storage in {
        let mut res = super::testResolver(memory);
        let result = try super::resolveProgramStr(&mut res,
            "record Token {} record Box { item: u32 } fn take(outer: Token) -> bool { return false; } fn f(box: Box, outer: Token) { let case Box { item } = box if take(outer) else { take(outer); return; }; }");
        try super::expectErrorKind(&result, resolver::ErrorKind::AffineUseAfterMove("outer"));
    }
}

/// Fallback expressions cannot access their new binding before initialization.
@test unsafe fn testLetElseFallbackBinding() throws (testing::TestError) {
    for program in [
        "fn f(input: ?u32) -> u32 { let value = input else value; return value; }",
        "unsafe fn f(input: ?u32) -> u32 { let value = input else value; return value; }",
        "fn f(input: ?u32) -> u32 { let mut value = input else { value }; return value; }",
    ] {
        let mut storage = super::testArena();
        let memory: 'test = &mut storage in {
            let mut res = super::testResolver(memory);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectErrorKind(&result, resolver::ErrorKind::UnresolvedSymbol("value"));
        }
    }
}

/// Each successful session allocation has distinct storage across loop iterations.
@test unsafe fn testFreshAllocationLoopLoan() throws (testing::TestError) {
    for program in [
        "fn f 'r (s: &Session 'r) { for i in 0..3 { let p = try! s.fill(0 as u32, 2); set p[0] = i; let view: &'r [u32] = &p[..]; } }",
        "fn f 'r (s: &Session 'r) { let mut i: u32 = 0; while i < 3 { let p = try! s.new(0 as u32); set *p = i; let view: &'r u32 = &*p; set i += 1; } }",
        "fn f 'r (s: &Session 'r) { for i in 0..3 { if let p = try? s.fill(0 as u32, 2); p.len == 2 { set p[0] = i; let view: &'r [u32] = &p[..]; } } }",
        "fn f 'r (s: &Session 'r) { while let p = try? s.new(0 as u32) { set *p = 1; let view: &'r u32 = &*p; } }",
        "fn f 'r (s: &Session 'r) { loop { let p = try? s.new(0 as u32) else break; set *p = 1; let view: &'r u32 = &*p; } }",
        "fn f 'r (s: &Session 'r) { for i in 0..3 { if let _ = try? s.new(0 as u32) {} let _ = try! s.new(0 as u32); } }",
    ] {
        let mut storage = super::testArena();
        let memory: 'test = &mut storage in {
            let mut res = super::testResolver(memory);
            let result = try super::resolveSessionProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
        }
    }
}

/// Fresh allocations preserve loans on aliases and existing storage.
@test unsafe fn testFreshAllocationRetainsOtherLoans() throws (testing::TestError) {
    for program in [
        "fn f 'r (s: &Session 'r) { for i in 0..3 { let p = try! s.fill(0 as u32, 2); let view: &'r [u32] = &p[..]; set p[0] = i; } }",
        "fn f 'r (s: &Session 'r) { let p = try! s.fill(0 as u32, 2); for i in 0..3 { set p[0] = i; let view: &'r [u32] = &p[..]; } }",
        "fn f 'r (s: &Session 'r, p: &'r mut u32) { for i in 0..3 { let view: &'r u32 = &*p; let fresh = try! s.new(0 as u32); set *p = i; } }",
        "fn f 'r (s: &Session 'r, p: &'r mut u32) { for i in 0..3 { let fresh = try! s.new(&*p); set *p = i; } }",
        "fn f 'r (s: &Session 'r) { while let p = try? s.new(0 as u32) { let view: &'r u32 = &*p; set *p = 1; } }",
        "fn f 'r (s: &Session 'r) { for i in 0..3 { if let p = try? s.new(0 as u32) { let view: &'r u32 = &*p; set *p = i; } } }",
        "fn f 'r (s: &Session 'r) { loop { let p = try? s.new(0 as u32) else break; let view: &'r u32 = &*p; set *p = 1; } }",
        "fn check 'r (p: &'r u32) -> bool { return *p == 0; } fn f 'r (s: &Session 'r) { while let p = try? s.new(0 as u32); check(&*p) { set *p = 1; } }",
    ] {
        let mut storage = super::testArena();
        let memory: 'test = &mut storage in {
            let mut res = super::testResolver(memory);
            let result = try super::resolveSessionProgramStr(&mut res, program);
            try super::expectErrorKind(&result, resolver::ErrorKind::BorrowConflict("p"));
        }
    }
}

/// Cell references give indirect cycles finite layouts in each declaration order.
@test unsafe fn testRecursiveCellLayout() throws (testing::TestError) {
    for program in [
        "record V: 'r + Copy { n: N 'r } record N: 'r + Copy { s: &'r cell S 'r } union S: 'r + Copy { Ready(V 'r), Pending }",
        "union S: 'r + Copy { Ready(V 'r), Pending } record V: 'r + Copy { n: N 'r } record N: 'r + Copy { s: &'r cell S 'r }",
        "record N: 'r + Copy { s: &'r cell S 'r } union S: 'r + Copy { Ready(V 'r), Pending } record V: 'r + Copy { n: N 'r }",
        "record V: Copy { n: N } record N: Copy { s: *cell S } union S: Copy { Ready(V), Pending }",
    ] {
        let mut storage = super::testArena();
        let memory: 'test = &mut storage in {
            let mut res = super::testResolver(memory);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
        }
    }
}

/// Deferred cell checks reject invalid payloads without a payload access.
@test unsafe fn testDeferredCellPayload() throws (testing::TestError) {
    for program in [
        "record N: 'r + Copy { s: &'r cell S 'r } union S: 'r { Ready(N 'r), Pending }",
        "record N: Copy { s: *cell S } record S { value: u32 }",
    ] {
        let mut storage = super::testArena();
        let memory: 'test = &mut storage in {
            let mut res = super::testResolver(memory);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectErrorKind(&result, resolver::ErrorKind::InvalidCellPayload);
        }
    }
    let mut storage = super::testArena();
    let memory: 'test = &mut storage in {
        let mut res = super::testResolver(memory);
        let result = try super::resolveProgramStr(&mut res,
            "record N: Copy { s: *cell S } record S: Copy { bytes: [u64; 536870913] }");
        try super::expectErrorKind(&result, resolver::ErrorKind::InvalidAllocationLayout);
    }
}

/// Cell payloads must permit plain value copies.
@test unsafe fn testCellPointerPayload() throws (testing::TestError) {
    for program in [
        "union State: 'r { Next(&'r cell State 'r) }",
        "union State: 'r { Ready(&'r u32) } fn f 'r (state: &'r cell State 'r) {}",
        "union State: 'r { Ready(&'r u32) } unsafe fn f 'r (state: &'r cell State 'r) {}",
        "fn f(p: *cell *mut u32) {}",
        "unsafe fn f(p: *cell *mut u32) {}",
        "record R: Once { n: u32 } fn f(p: *cell R) {}",
        "record R { n: u32 } fn f(p: *cell R) {}",
        "fn f 'r (p: &'r cell &'r mut u32) {}",
    ] {
        let mut testArena56 = super::testArena();
        let testStorage56: 'test56 = &mut testArena56 in {
            let mut res = super::testResolver(testStorage56);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectErrorKind(&result, resolver::ErrorKind::InvalidCellPayload);
        }
    }
}

/// Direct cell borrows support Copy values, scoped loans, and call arguments.
@test unsafe fn testCellBorrow() throws (testing::TestError) {
    for program in [
        "fn f() -> u32 { let mut n: u32 = 0; { let c = &cell n; let alias = c; set *c = 1; set *alias += 1; } return n; }",
        "fn read(c: &cell u32) { set *c = 1; } fn f(p: &mut u32) { read(&cell *p); set *p = 2; }",
        "fn f() { let mut n: u32 = 0; let c: 'r = &cell n in { let alias = c; set *alias = 1; } set n = 2; }",
        "record R: Copy { a: u32, b: u32 } fn f() { let mut r = R { a: 0, b: 0 }; let a = &cell r.a; let b = &cell r.b; set *a = 1; set *b = 2; }",
        "fn f() { let mut a: [u32; 2] = [0, 0]; let c = &cell a; set *c = [1, 2]; let snapshot = *c; }",
        "fn forward(p: *mut u32) -> *mut u32 { return p; } fn f(p: *mut u32) -> *cell u32 { return &cell *forward(p); }",
        "record R: Copy { n: u32 } fn f(p: *mut R) -> *cell u32 { return &cell p.n; }",
        "fn f(p: *mut [u32]) -> *cell u32 { return &cell p[0]; }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
        }
    }
}

/// Permission-associated cells support construction, direct access, and sequential mutation.
@test unsafe fn testPermissionCellConstruction() throws (testing::TestError) {
    for program in [
        // Initialized exclusive Copy storage construction.
        "record Permit {} fn f() { let mut owner = Permit {}; let permission: 'permission = &mut owner in { let mut value: u32 = 0; let cell: &cell 'permission u32 = &cell 'permission value; set *cell = 1; let copy = *cell; } }",
        // Sequential mutation after each previous access has ended.
        "record Permit {} fn f 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) { set *cell = 1; let first = *cell; set *cell = first + 1; let second = *cell; }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
        }
    }
}

/// Associated cell construction requires active authority for its permission region.
@test unsafe fn testPermissionCellConstructionAuthority() throws (testing::TestError) {
    let mut arena = super::testArena();
    let storage: 'test = &mut arena in {
        let mut res = super::testResolver(storage);
        let result = try super::resolveProgramStr(&mut res,
            "record Permit {} fn f 'permission (place: &mut u32, owner: Permit) { let cell: &cell 'permission u32 = &cell 'permission *place; }");
        let error = try super::expectError(&result);
        let case resolver::ErrorKind::CellPermissionRequired(_) = error.kind
            else throw testing::TestError::Failed;
    }
}

/// Matching authority permits shared and mutable payload loans and ordinary helper calls.
@test unsafe fn testPermissionCellPayloadLoans() throws (testing::TestError) {
    for program in [
        // A shared payload reference can be passed to an ordinary helper.
        "record Permit {} fn observe(value: &u32) {} fn f 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) { let authority: 'loan = &*permission, payload = &*cell in { observe(payload); } }",
        // A mutable payload reference can be passed to an ordinary `&mut` helper.
        "record Permit {} fn increment(value: &mut u32) { set *value += 1; } fn f 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) { let authority: 'loan = &mut *permission, payload = &mut *cell in { increment(payload); } }",
        // Cell aliases retain authority and may create multiple simultaneous readers.
        "record Permit {} fn observe(value: &u32) {} fn f 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) { let alias = cell; let authority: 'loan = &*permission, first = &*cell, second = &*alias in { observe(first); observe(second); } }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
        }
    }
}

/// Aliasing, generic substitution, and storage shortening preserve the permission association.
@test unsafe fn testPermissionCellSubstitution() throws (testing::TestError) {
    for program in [
        // An inferred generic call substitutes both storage and permission regions.
        "record Permit {} fn identity 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) -> &'storage cell 'permission u32 { return cell; } fn f 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) { let alias = cell; let instantiated = identity(alias, permission); }",
        // Shortening storage leaves the independent permission region unchanged.
        "record Permit {} fn shorten 'storage 'short 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) -> &'short cell 'permission u32 where 'storage: 'short { return cell; }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
        }
    }
}

/// Calls may reuse authority when a helper's permission contract does not return it.
@test unsafe fn testPermissionCellAuthorityCallReuse() throws (testing::TestError) {
    {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res,
                "record Permit {} fn inspect 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) -> u32 { return *cell; } fn f 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) { let first = inspect(cell, permission); let second = inspect(cell, permission); }");
            try super::expectNoErrors(&result);
        }
    }
    {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res,
                "record Permit {} fn retain 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) -> &'permission mut Permit { let value = *cell; return permission; } fn f 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) { let retained = retain(cell, permission); retain(cell, permission); }");
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::AffineUseAfterMove(_) = error.kind
                else throw testing::TestError::Failed;
        }
    }
    {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res,
                "record Permit {} fn retainIn 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit, out: &mut ?&'permission mut Permit) { let value = *cell; set *out = permission; } fn f 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit, firstOut: &mut ?&'permission mut Permit, secondOut: &mut ?&'permission mut Permit) { retainIn(cell, permission, firstOut); retainIn(cell, permission, secondOut); }");
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::AffineUseAfterMove(_) = error.kind
                else throw testing::TestError::Failed;
        }
    }
    {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res,
                "record Permit {} fn inspect 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) -> u32 { return *cell; } fn retainIn 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit, storage: &'permission mut ?&'permission mut Permit) { let value = *cell; set *storage = permission; } fn f 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit, authorityStorage: &'permission mut ?&'permission mut Permit) { retainIn(cell, permission, authorityStorage); inspect(cell, permission); }");
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::AffineUseAfterMove(_) = error.kind
                else throw testing::TestError::Failed;
        }
    }
}

/// Fresh allocation does not reclaim storage and remains valid during a shared payload loan.
@test unsafe fn testPermissionCellFreshAllocation() throws (testing::TestError) {
    let mut arena = super::testArena();
    let storage: 'test = &mut arena in {
        let mut res = super::testResolver(storage);
        let result = try super::resolveSessionProgramStr(&mut res,
            "record Permit {} fn f 'storage 'permission (session: &Session 'storage, cell: &'storage cell 'permission u32, permission: &'permission mut Permit) { let authority: 'loan = &*permission, payload = &*cell in { let fresh = try! session.new(2 as u32); set *fresh = *payload; } }");
        try super::expectNoErrors(&result);
    }
}

/// Cell permission metadata does not make a session allocation depend on shorter authority.
@test unsafe fn testPermissionCellSessionNominalDependency() throws (testing::TestError) {
    let mut arena = super::testArena();
    let storage: 'test = &mut arena in {
        let mut res = super::testResolver(storage);
        let result = try super::resolveSessionProgramStr(&mut res,
            "record Permit {} record Block: 'storage + 'permission + Copy { cell: &'storage cell 'permission u32 } fn f 'storage (session: &Session 'storage) { let mut owner = Permit {}; let permission: 'permission = &mut owner in { let place = try! session.new(1 as u32); let cell: &'storage cell 'permission u32 = &cell 'permission *place; let block = try! session.new(Block 'storage 'permission { cell }); } }");
        try super::expectNoErrors(&result);
    }
}

/// Associated Copy cells can form finite-layout cycles under one permission.
@test unsafe fn testPermissionCellCycles() throws (testing::TestError) {
    let mut arena = super::testArena();
    let storage: 'test = &mut arena in {
        let mut res = super::testResolver(storage);
        let result = try super::resolveProgramStr(&mut res,
            "record Left: 'storage + 'permission + Copy { right: &'storage cell 'permission Right 'storage 'permission } record Right: 'storage + 'permission + Copy { left: &'storage cell 'permission Left 'storage 'permission }");
        try super::expectNoErrors(&result);
    }
}

/// Owned cell payloads ignore nested permission-only metadata but retain storage dependencies.
@test unsafe fn testPermissionCellOwnedNestedPayloadRegions() throws (testing::TestError) {
    {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res,
                "record Permit {} record Payload: 'permission + Copy { nested: *cell 'permission u32 } fn f 'permission (place: *mut Payload 'permission, permission: &'permission mut Permit) -> *cell Payload 'permission { return &cell *place; }");
            try super::expectNoErrors(&result);
        }
    }
    {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res,
                "record Payload: 'storage + Copy { nested: &'storage cell u32 } fn f 'storage (place: *mut Payload 'storage) -> *cell Payload 'storage { return &cell *place; }");
            try super::expectErrorKind(&result, resolver::ErrorKind::InvalidCellPayload);
        }
    }
}

/// Resolved cell metadata keeps storage and permission identities distinct through substitution.
@test unsafe fn testPermissionCellTypeMetadata() throws (testing::TestError) {
    let mut arena = super::testArena();
    let storage: 'test = &mut arena in {
        let mut res = super::testResolver(storage);
        let result = try super::resolveProgramStr(&mut res,
            "record Permit {} fn identity 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) -> &'storage cell 'permission u32 { return cell; } fn inspect 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) { let alias = cell; let instantiated = identity(alias, permission); }");
        try super::expectNoErrors(&result);

        let inspect = try super::getBlockStmt(result.root, 2);
        let inspectType = resolver::typeFor(&res, inspect) else throw testing::TestError::Failed;
        let case resolver::Type::Fn(info) = inspectType else throw testing::TestError::Failed;
        let case resolver::Type::Cell {
            class: types::PointerClass::Region(storageRegion),
            permission: declaredPermission,
            payload: declaredPayload,
        } = *info.paramTypes[0] else throw testing::TestError::Failed;
        let permissionRegion = declaredPermission else throw testing::TestError::Failed;
        let case resolver::Type::Pointer {
            class: types::PointerClass::Region(authorityRegion),
            target: _,
            mutable: true,
        } = *info.paramTypes[1] else throw testing::TestError::Failed;
        try testing::expect(storageRegion.id <> permissionRegion.id);
        try testing::expect(authorityRegion.id == permissionRegion.id);
        try testing::expect(*declaredPayload == resolver::Type::U32);

        let case ast::NodeValue::FnDecl(decl) = inspect.value else throw testing::TestError::Failed;
        let body = decl.body else throw testing::TestError::Failed;
        let case ast::NodeValue::Let(aliasDecl) =
            (try super::getBlockStmt(body, 0)).value else throw testing::TestError::Failed;
        let case ast::NodeValue::Let(instantiatedDecl) =
            (try super::getBlockStmt(body, 1)).value else throw testing::TestError::Failed;
        let aliasType = resolver::typeFor(&res, aliasDecl.value) else throw testing::TestError::Failed;
        let instantiatedType = resolver::typeFor(&res, instantiatedDecl.value)
            else throw testing::TestError::Failed;
        let case resolver::Type::Cell {
            class: types::PointerClass::Region(aliasStorage),
            permission: aliasPermission,
            ..
        } = aliasType else throw testing::TestError::Failed;
        let case resolver::Type::Cell {
            class: types::PointerClass::Region(instantiatedStorage),
            permission: instantiatedPermission,
            ..
        } = instantiatedType else throw testing::TestError::Failed;
        let aliasPermissionRegion = aliasPermission else throw testing::TestError::Failed;
        let instantiatedPermissionRegion = instantiatedPermission else throw testing::TestError::Failed;
        try testing::expect(aliasStorage.id == storageRegion.id);
        try testing::expect(instantiatedStorage.id == storageRegion.id);
        try testing::expect(aliasPermissionRegion.id == permissionRegion.id);
        try testing::expect(instantiatedPermissionRegion.id == permissionRegion.id);
    }
}

/// Permission-wide loans reject conflicting accesses through every cell alias.
@test unsafe fn testPermissionCellAliasConflicts() throws (testing::TestError) {
    for program in [
        // Two aliases cannot produce overlapping mutable payload references.
        "record Permit {} fn f 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) { let alias = cell; let authority: 'loan = &mut *permission, first = &mut *cell, second = &mut *alias in {} }",
        // A shared payload loan suspends mutation through another alias.
        "record Permit {} fn f 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) { let alias = cell; let authority: 'loan = &*permission, payload = &*cell in { set *alias = 1; let value = *payload; } }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind
                else throw testing::TestError::Failed;
        }
    }
}
/// Call argument loans preserve permission identity across distinct cell handles.
@test unsafe fn testPermissionCellCallArgumentAliasConflict() throws (testing::TestError) {
    let mut arena = super::testArena();
    let storage: 'test = &mut arena in {
        let mut res = super::testResolver(storage);
        let result = try super::resolveProgramStr(&mut res,
            "record Permit {} fn both(first: &u32, second: &mut u32) {} fn f 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) { let alias = cell; let authority: 'loan = &mut *permission where 'permission: 'loan in { both(&*cell, &mut *alias); } }");
        try super::expectErrorKind(&result, resolver::ErrorKind::BorrowConflict("alias"));
    }
}

/// Wrapped local payload loans preserve permission identity.
@test unsafe fn testPermissionCellWrappedLocalLoanConflict() throws (testing::TestError) {
    let mut arena = super::testArena();
    let storage: 'test = &mut arena in {
        let mut res = super::testResolver(storage);
        let result = try super::resolveProgramStr(&mut res,
            "record Permit {} fn f 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) { let alias = cell; let authority: 'loan = &*permission where 'permission: 'loan in { let payload = &*cell as &u32; set *alias = 1; let value = *payload; } }");
        let error = try super::expectError(&result);
        let case resolver::ErrorKind::BorrowConflict(_) = error.kind
            else throw testing::TestError::Failed;
    }
}
/// Sessions nested in cell payloads retain consumed permission authority.
@test unsafe fn testPermissionCellNestedSessionRetention() throws (testing::TestError) {
    let mut arena = super::testArena();
    let storage: 'test = &mut arena in {
        let mut res = super::testResolver(storage);
        let result = try super::resolveSessionProgramStr(&mut res,
            "record Permit {} fn retain 'storage 'session 'permission (holder: &'storage cell 'permission &'session mut Session 'permission, permission: &'permission mut Permit) { let stored = try! (*holder).new(permission); } fn f 'storage 'session 'permission (holder: &'storage cell 'permission &'session mut Session 'permission, permission: &'permission mut Permit) { retain(holder, permission); retain(holder, permission); }");
        try super::expectErrorKind(
            &result, resolver::ErrorKind::AffineUseAfterMove("permission"),
        );
    }
}


/// Associated cell projections support replacement under matching authority.
@test unsafe fn testPermissionCellProjectedReplacement() throws (testing::TestError) {
    for program in [
        "record Permit {} record Payload { value: u32 } fn f 'storage 'permission (cell: &'storage cell 'permission Payload, permission: &'permission mut Permit) { set (*cell).value = 1; }",
        "record Permit {} fn f 'storage 'permission (cell: &'storage cell 'permission [u32; 2], permission: &'permission mut Permit) { set (*cell)[0] = 1; }",
        "record Permit {} fn f 'storage 'permission (cell: &'storage cell 'permission [u32; 2], permission: &'permission mut Permit) { set (*cell)[0..1] = 0; }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
        }
    }
}


/// Permission identities are invariant across access, relabeling, and storage shortening.
@test unsafe fn testPermissionCellAssociationMismatch() throws (testing::TestError) {
    {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            // Cross-permission access fails generic region inference.
            let result = try super::resolveProgramStr(&mut res,
                "record Permit {} fn access 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) -> u32 { return *cell; } fn cross 'storage 'first 'second (cell: &'storage cell 'first u32, first: &'first mut Permit, second: &'second mut Permit) { access(cell, second); }");
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::RegionInference(_) = error.kind
                else throw testing::TestError::Failed;
        }
    }
    for program in [
        // An explicit annotation cannot relabel a permission.
        "record Permit {} fn f 'storage 'first 'second (cell: &'storage cell 'first u32, first: &'first mut Permit, second: &'second mut Permit) { let relabeled: &'storage cell 'second u32 = cell; }",
        // Storage shortening cannot change the permission association.
        "record Permit {} fn f 'storage 'short 'first 'second (cell: &'storage cell 'first u32, first: &'first mut Permit, second: &'second mut Permit) where 'storage: 'short { let relabeled: &'short cell 'second u32 = cell; }",
        // Storage shortening cannot drop the permission association.
        "record Permit {} fn f 'storage 'short 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) where 'storage: 'short { let unassociated: &'short cell u32 = cell; }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::TypeMismatch(_) = error.kind
                else throw testing::TestError::Failed;
        }
    }
}

/// Distinct formal permissions cannot substitute the same actual permission identity.
@test unsafe fn testPermissionCellDistinctGenericArguments() throws (testing::TestError) {
    let mut arena = super::testArena();
    let storage: 'test = &mut arena in {
        let mut res = super::testResolver(storage);
        let result = try super::resolveProgramStr(&mut res,
            "record Permit {} fn separate 'storage 'left 'right (first: &'storage cell 'left u32, left: &'left mut Permit, second: &'storage cell 'right u32, right: &'right mut Permit) {} fn f 'storage 'permission (first: &'storage cell 'permission u32, second: &'storage cell 'permission u32, permission: &'permission mut Permit) { separate 'storage 'permission 'permission(first, permission, second, permission); }");
        let error = try super::expectError(&result);
        let case resolver::ErrorKind::RegionInference(_) = error.kind
            else throw testing::TestError::Failed;
    }
}

/// Applied nominal fields preserve distinct formal permission identities at calls.
@test unsafe fn testPermissionCellNominalGenericArguments() throws (testing::TestError) {
    {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res,
                "record Permit {} record Wrapper: 'storage + 'permission + Copy { cell: &'storage cell 'permission u32 } fn separate 'storage 'left 'right (first: Wrapper 'storage 'left, left: &'left mut Permit, second: Wrapper 'storage 'right, right: &'right mut Permit) {} fn f 'storage 'left 'right (first: Wrapper 'storage 'left, left: &'left mut Permit, second: Wrapper 'storage 'right, right: &'right mut Permit) { separate(first, left, second, right); }");
            try super::expectNoErrors(&result);
        }
    }
    {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res,
                "record Permit {} record Wrapper: 'storage + 'permission + Copy { cell: &'storage cell 'permission u32 } fn separate 'storage 'left 'right (first: Wrapper 'storage 'left, left: &'left mut Permit, second: Wrapper 'storage 'right, right: &'right mut Permit) {} fn f 'storage 'permission (first: Wrapper 'storage 'permission, second: Wrapper 'storage 'permission, permission: &'permission mut Permit) { separate(first, permission, second, permission); }");
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::RegionInference(_) = error.kind
                else throw testing::TestError::Failed;
        }
    }
}

/// Direct and callback cell accesses cannot conflict with a live payload loan.
@test unsafe fn testPermissionCellCallConflicts() throws (testing::TestError) {
    for program in [
        // Direct call.
        "record Permit {} fn mutate 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) { set *cell = 1; } fn f 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) { let authority: 'loan = &*permission, payload = &*cell in { mutate(cell, permission); let value = *payload; } }",
        // Region-instantiated callback.
        "record Permit {} fn mutate 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) { set *cell = 1; } fn f 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) { let callback = mutate 'storage 'permission; let authority: 'loan = &*permission, payload = &*cell in { callback(cell, permission); let value = *payload; } }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind
                else throw testing::TestError::Failed;
        }
    }
}

/// Payload references cannot escape their matching permission loan.
@test unsafe fn testPermissionCellLoanEscape() throws (testing::TestError) {
    let mut arena = super::testArena();
    let storage: 'test = &mut arena in {
        let mut res = super::testResolver(storage);
        let result = try super::resolveProgramStr(&mut res,
            "record Permit {} fn escape 'storage 'permission (cell: &'storage cell 'permission u32, permission: &'permission mut Permit) -> &'storage u32 { let authority: 'loan = &*permission, payload = &*cell in { return payload; } }");
        let error = try super::expectError(&result);
        let case resolver::ErrorKind::RegionEscape(_) = error.kind
            else throw testing::TestError::Failed;
    }
}

/// Allocation-session escape and reset remain invalid while an associated payload reference is live.
@test unsafe fn testPermissionCellStorageLiveness() throws (testing::TestError) {
    {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            // A payload reference cannot escape the allocation session that owns its cell storage.
            let result = try super::resolveSessionProgramStr(&mut res,
                "use std::lang::alloc; record Permit {} fn escape 'arena (arena: &'arena mut alloc::Arena) -> &'arena u32 { let mut owner = Permit {}; let permission: 'permission = &mut owner in { use *arena as session in { let place = try! session.new(1 as u32); let cell = &cell 'permission *place; let authority: 'loan = &*permission, payload = &*cell in { return payload; } } } }");
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::RegionEscape(_) = error.kind
                else throw testing::TestError::Failed;
        }
    }
    {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            // Reset cannot reclaim a cell's storage while its payload reference is live.
            let result = try super::resolveSessionProgramStr(&mut res,
                "use std::lang::alloc; record Permit {} fn reset 'storage 'permission (arena: &'storage mut alloc::Arena, cell: &'storage cell 'permission u32, permission: &'permission mut Permit) { let authority: 'loan = &*permission, payload = &*cell in { alloc::reset(arena); let value = *payload; } }");
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind
                else throw testing::TestError::Failed;
        }
    }
}

/// Permission-associated cells admit affine values that are safe for bulk reclamation.
@test unsafe fn testPermissionCellAffinePayload() throws (testing::TestError) {
    for program in [
        // Construction accepts an affine, bulk-discardable record.
        "record Permit {} record Payload { value: u32 } fn f 'permission (place: &mut Payload, permission: &'permission mut Permit) { let cell: &cell 'permission Payload = &cell 'permission *place; }",
        // Matching shared authority permits an ordinary shared payload loan.
        "record Permit {} record Payload { value: u32 } fn observe(value: &Payload) {} fn f 'storage 'permission (cell: &'storage cell 'permission Payload, permission: &'permission mut Permit) { let authority: 'loan = &*permission, payload = &*cell in { observe(payload); } }",
        // Matching mutable authority permits an ordinary mutable helper call.
        "record Permit {} record Payload { value: u32 } fn increment(value: &mut Payload) { set value.value += 1; } fn f 'storage 'permission (cell: &'storage cell 'permission Payload, permission: &'permission mut Permit) { let authority: 'loan = &mut *permission, payload = &mut *cell in { increment(payload); } }",
        // Replacement evaluates the new value from the old payload before overwriting it.
        "record Permit {} record Payload { value: u32 } fn replacement(value: &Payload) -> Payload { return Payload { value: value.value + 1 }; } fn f 'storage 'permission (cell: &'storage cell 'permission Payload, permission: &'permission mut Permit) { set *cell = replacement(&*cell); }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
        }
    }
}

/// Cell payload eligibility remains narrow without a bulk-discardable permission association.
@test unsafe fn testPermissionCellAffinePayloadEligibility() throws (testing::TestError) {
    for program in [
        // An unassociated cell still requires a Copy payload.
        "record Payload { value: u32 } fn f(place: &mut Payload) { let cell = &cell *place; }",
        // A linear payload cannot be discarded by replacement or arena reclamation.
        "record Permit {} record Payload: Once { value: u32 } fn f 'permission (place: &mut Payload, permission: &'permission mut Permit) { let cell: &cell 'permission Payload = &cell 'permission *place; }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectErrorKind(&result, resolver::ErrorKind::InvalidCellPayload);
        }
    }
}

/// Affine associated payloads can only be accessed through explicit borrows or replacement.
@test unsafe fn testPermissionCellAffinePayloadMoves() throws (testing::TestError) {
    for program in [
        // A value-context dereference cannot move the whole payload out of shared storage.
        "record Permit {} record Payload { value: u32 } fn f 'storage 'permission (cell: &'storage cell 'permission Payload, permission: &'permission mut Permit) { let moved = *cell; }",
        // A shared payload loan cannot move an affine field out of the stored value.
        "record Permit {} record Item { value: u32 } record Payload { item: Item } fn f 'storage 'permission (cell: &'storage cell 'permission Payload, permission: &'permission mut Permit) { let authority: 'loan = &*permission, payload = &*cell in { let moved = payload.item; } }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectErrorKind(&result, resolver::ErrorKind::LinearPartialMove);
        }
    }
}

/// Observing an affine payload value still requires an explicit shared reference.
@test unsafe fn testPermissionCellAffinePayloadObserve() throws (testing::TestError) {
    {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res,
                "record Permit {} record Payload { value: u32 } fn f 'storage 'permission (cell: &'storage cell 'permission Payload, permission: &'permission mut Permit) { let equal = *cell == *cell; }");
            try super::expectErrorKind(&result, resolver::ErrorKind::LinearPartialMove);
        }
    }
    {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res,
                "record Permit {} record Payload { value: u32 } fn f 'storage 'permission (cell: &'storage cell 'permission Payload, permission: &'permission mut Permit) { let authority: 'loan = &*permission, left = &*cell, right = &*cell in { let sameReference = left == right; let sameValue = left.value == right.value; } }");
            try super::expectNoErrors(&result);
        }
    }
}

/// Cell creation requires exclusive access for the full borrow duration.
@test unsafe fn testCellBorrowConflicts() throws (testing::TestError) {
    for program in [
        "fn f() { let mut n: u32 = 0; let c = &cell n; let r = &n; }",
        "unsafe fn f() { let mut n: u32 = 0; let c = &cell n; let r = &n; }",
        "fn f() { let mut n: u32 = 0; let r = &n; let c = &cell n; }",
        "fn f() { let mut n: u32 = 0; let c = &cell n; set n = 1; }",
        "fn f() { let mut n: u32 = 0; let c = &cell n; let other = &cell n; }",
        "fn f() { let mut n: u32 = 0; let c = &cell n as &cell u32; let r = &n; }",
        "fn inspect(c: &cell u32, r: &u32) {} fn f() { let mut n: u32 = 0; inspect(&cell n, &n); }",
        "fn inspect(r: &u32, c: &cell u32) {} fn f() { let mut n: u32 = 0; inspect(&n, &cell n); }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Cell creation requires an exclusive initialized place.
@test unsafe fn testCellBorrowPayload() throws (testing::TestError) {
    for program in [
        "fn f() { let n: u32 = 0; let c = &cell n; }",
        "fn f(p: &u32) { let c = &cell *p; }",
        "unsafe fn f(p: &u32) { let c = &cell *p; }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectErrorKind(&result, resolver::ErrorKind::ImmutableBinding);
        }
    }
    for program in [
        "record R { n: u32 } fn f() { let mut r = R { n: 0 }; let c = &cell r; }",
        "fn f(p: &mut *mut u32) { let c = &cell *p; }",
        "fn f(p: &mut [u32]) { let c = &cell p[..]; }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectErrorKind(&result, resolver::ErrorKind::InvalidCellPayload);
        }
    }
}

/// Cell access cannot expose payload references or restore exclusive pointers.
@test unsafe fn testCellPointerAccess() throws (testing::TestError) {
    for program in [
        "fn f(p: *cell u32) { let r = &*p; }",
        "unsafe fn f(p: *cell u32) { let r = &*p; }",
        "record R: Copy { n: u32 } fn f(p: *cell R) { let r = &(*p).n; }",
        "fn f(p: *cell [u32; 2]) { let r = &(*p)[0]; }",
    ] {
        let mut testArena57 = super::testArena();
        let testStorage57: 'test57 = &mut testArena57 in {
            let mut res = super::testResolver(testStorage57);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectErrorKind(&result, resolver::ErrorKind::ImmutableBinding);
        }
    }
    for program in [
        "fn f(p: *cell u32) -> *mut u32 { return p as *mut u32; }",
        "unsafe fn f(p: *cell u32) -> *unsafe mut u32 { return p as *unsafe mut u32; }",
        "fn f(p: *u32) -> *cell u32 { return p as *cell u32; }",
        "unsafe fn f(p: *unsafe mut u32) -> *cell u32 { return p as *cell u32; }",
        "fn f(p: *mut u64) -> *cell u32 { return p as *cell u32; }",
        "fn f 'r (p: &'r mut u32) -> *cell u32 { return p as *cell u32; }",
    ] {
        let mut testArena58 = super::testArena();
        let testStorage58: 'test58 = &mut testArena58 in {
            let mut res = super::testResolver(testStorage58);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::InvalidAsCast(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// An exclusive payload borrow cannot be made from shared cell access.
@test unsafe fn testCellPointerMutablePayload() throws (testing::TestError) {
    let mut testArena59 = super::testArena();
    let testStorage59: 'test59 = &mut testArena59 in {
        let mut res = super::testResolver(testStorage59);
        let result = try super::resolveProgramStr(&mut res,
            "fn f(p: *cell u32) { let r = &mut *p; }");
        try super::expectErrorKind(&result, resolver::ErrorKind::ImmutableBinding);
    }
}

/// Cell conversion consumes exclusive access, including call arguments.
@test unsafe fn testCellPointerOwnership() throws (testing::TestError) {
    for program in [
        "fn f(p: *mut u32) { let c = &cell *p; set *p = 1; }",
        "unsafe fn f(p: *mut u32) { let c = &cell *p; set *p = 1; }",
        "record R: Copy { n: u32 } fn f(p: *mut R) { let c = &cell p.n; set p.n = 1; }",
        "fn f(p: *mut [u32]) { let c = &cell p[0]; set p[0] = 1; }",
        "fn f(p: *mut u32) { let c = p as *cell u32; set *p = 1; }",
        "unsafe fn f(p: *mut u32) { let c = p as *cell u32; set *p = 1; }",
        "fn read(p: &cell u32) {} fn f(p: &mut u32) { read(p as &cell u32); set *p = 1; }",
    ] {
        let mut testArena60 = super::testArena();
        let testStorage60: 'test60 = &mut testArena60 in {
            let mut res = super::testResolver(testStorage60);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::AffineUseAfterMove(_) = error.kind else throw testing::TestError::Failed;
        }
    }
    for program in [
        "fn f() { let mut n: u32 = 0; let c = &mut n as &cell u32; let r = &n; set *c = 1; }",
        "unsafe fn f() { let mut n: u32 = 0; let c = &mut n as &cell u32; let r = &n; set *c = 1; }",
    ] {
        let mut testArena61 = super::testArena();
        let testStorage61: 'test61 = &mut testArena61 in {
            let mut res = super::testResolver(testStorage61);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Cell writes preserve exact payload regions and destination lifetimes.
@test unsafe fn testCellPointerRegion() throws (testing::TestError) {
    for program in [
        "fn f 'r 's (p: &'r cell &'r u32, value: &'s u32) { set *p = value; }",
        "unsafe fn f 'r 's (p: &'r cell &'r u32, value: &'s u32) { set *p = value; }",
        "fn f 'r 's (p: &'r cell u32) -> &'s cell u32 { return p; }",
    ] {
        let mut testArena62 = super::testArena();
        let testStorage62: 'test62 = &mut testArena62 in {
            let mut res = super::testResolver(testStorage62);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::TypeMismatch(_) = error.kind else throw testing::TestError::Failed;
        }
    }
    for program in [
        "fn f 'r 's (p: &'r cell &'s u32, value: &'s u32) where 'r: 's { set *p = value; }",
        "unsafe fn f 'r 's (p: &'r cell &'s u32, value: &'s u32) where 'r: 's { set *p = value; }",
    ] {
        let mut testArena63 = super::testArena();
        let testStorage63: 'test63 = &mut testArena63 in {
            let mut res = super::testResolver(testStorage63);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::RegionEscape(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// Raw cell operations require an unsafe execution context.
@test unsafe fn testCellPointerRawAccess() throws (testing::TestError) {
    for program in [
        "fn f(p: *unsafe cell u32) -> u32 { return *p; }",
        "fn f(p: *unsafe cell u32) { set *p = 1; }",
        "fn f(p: &*unsafe cell u32) { set **p = 1; }",
    ] {
        let mut testArena64 = super::testArena();
        let testStorage64: 'test64 = &mut testArena64 in {
            let mut res = super::testResolver(testStorage64);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectErrorKind(&result, resolver::ErrorKind::UnsafeOperation);
        }
    }
}

/// A checked buffer context cannot be copied while its exclusive storage is live.
@test unsafe fn testCheckedBufferOwnership() throws (testing::TestError) {
    for program in [
        "record Buffer: 'r { words: &'r mut [u32] } fn observe 'r (b: &Buffer 'r) {} fn f 'r (b: Buffer 'r) { let moved = b; observe(&b); }",
        "record Buffer: 'r { words: &'r mut [u32] } unsafe fn observe 'r (b: &Buffer 'r) {} unsafe fn f 'r (b: Buffer 'r) { let moved = b; observe(&b); }",
    ] {
        let mut testArena65 = super::testArena();
        let testStorage65: 'test65 = &mut testArena65 in {
            let mut res = super::testResolver(testStorage65);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::AffineUseAfterMove(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// An iterator's stored shared borrow excludes writes through the buffer owner.
@test unsafe fn testCheckedIteratorLoan() throws (testing::TestError) {
    for program in [
        "record Buffer: 'r { words: &'r mut [u32] } record Iter: 'r + 'v + Copy where 'r: 'v { source: &'v Buffer 'r } fn f 'r (b: Buffer 'r) { let mut owner = b; let view: 'scan = &owner where 'r: 'scan in { let iterator: Iter 'r 'scan = Iter { source: view }; set owner.words[0] = 1; } }",
        "record Buffer: 'r { words: &'r mut [u32] } record Iter: 'r + 'v + Copy where 'r: 'v { source: &'v Buffer 'r } unsafe fn f 'r (b: Buffer 'r) { let mut owner = b; let view: 'scan = &owner where 'r: 'scan in { let iterator: Iter 'r 'scan = Iter { source: view }; set owner.words[0] = 1; } }",
    ] {
        let mut testArena66 = super::testArena();
        let testStorage66: 'test66 = &mut testArena66 in {
            let mut res = super::testResolver(testStorage66);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// An inferred raw pointer argument requires an unsafe address operation.
@test unsafe fn testRegionCallRawAddress() throws (testing::TestError) {
    let mut arena = super::testArena();
    let storage: 'arena = &mut arena in {
        let mut res = super::testResolver(storage);
        let result = try super::resolveProgramStr(&mut res,
            "record View: 'r + Copy { value: &'r u32 } fn read 'r (view: *unsafe View 'r) {} fn f 'r (view: View 'r) { read(&view); }");
        try super::expectErrorKind(&result, resolver::ErrorKind::UnsafeOperation);
    }
}

/// Shared aggregate access cannot expose mutable access to an exclusive field.
@test unsafe fn testSharedExclusiveFieldAccess() throws (testing::TestError) {
    for program in [
        "record H: 'r { items: &'r mut [u32] } fn f 'r (h: &H 'r) { set h.items[0] = 42; }",
        "record H: 'r { items: &'r mut [u32] } unsafe fn f 'r (h: &H 'r) { set h.items[0] = 42; }",
        "record H: 'r { items: &'r mut [u32] } fn f 'r (h: &'r H 'r) { let p = &mut h.items[0]; }",
        "record H: 'r { items: &'r mut [u32] } unsafe fn f 'r (h: &'r H 'r) { let p = &mut h.items[0]; }",
        "record H: 'r { items: &'r mut [u32] } fn write(p: &mut [u32]) {} fn f 'r (h: &H 'r) { write(h.items); }",
        "record H: 'r { items: &'r mut [u32] } fn write(p: &mut [u32]) {} unsafe fn f 'r (h: &H 'r) { write(h.items); }",
        "record H: 'r { item: &'r mut u32 } fn f 'r (h: &H 'r) { let p: &mut u32 = h.item; }",
        "record H: 'r { item: &'r mut u32 } unsafe fn f 'r (h: &H 'r) { let p: &mut u32 = h.item; }",
        "record H { item: *mut u32 } fn f(h: &H) { set *h.item = 42; }",
        "record H { item: *mut u32 } unsafe fn f(h: &H) { set *h.item = 42; }",
        "record H: 'r { items: [&'r mut u32; 1] } fn f 'r (h: &H 'r) { set *h.items[0] = 42; }",
        "record H: 'r { items: [&'r mut u32; 1] } unsafe fn f 'r (h: &H 'r) { set *h.items[0] = 42; }",
        "fn f 'r (items: &'r [&'r mut u32]) { set *items[0] = 42; }",
        "unsafe fn f 'r (items: &'r [&'r mut u32]) { set *items[0] = 42; }",
        "fn f 'r (p: &'r &'r mut u32) { set **p = 42; }",
        "unsafe fn f 'r (p: &'r &'r mut u32) { set **p = 42; }",
        "record H: 'r { item: &'r mut u32 } fn write(p: &mut u32) {} fn f 'r (h: &H 'r, flag: bool) { write(h.item if flag else h.item); }",
        "record H: 'r { item: &'r mut u32 } fn write(p: &mut u32) {} unsafe fn f 'r (h: &H 'r, flag: bool) { write(h.item if flag else h.item); }",
        "record V { n: u32 } record H { item: *mut V } fn (v: &mut V) write() { set v.n = 42; } fn f(h: &H) { h.item.write(); }",
        "record V { n: u32 } record H { item: *mut V } fn (v: &mut V) write() { set v.n = 42; } unsafe fn f(h: &H) { h.item.write(); }",
        "trait W { fn (&mut W) write(); } record H: 'r { object: &'r mut opaque W } fn f 'r (h: &H 'r) { h.object.write(); }",
        "trait W { fn (&mut W) write(); } record H: 'r { object: &'r mut opaque W } unsafe fn f 'r (h: &H 'r) { h.object.write(); }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectErrorKind(&result, resolver::ErrorKind::ImmutableBinding);
        }
    }
}

/// Named shared pattern bindings retain the subject reference region.
@test unsafe fn testNamedPatternBorrowRegions() throws (testing::TestError) {
    for program in [
        "record B: 'r { values: &'r mut [u32] } fn f 'r (b: &'r B 'r) -> &'r [u32] { return &b.values[..]; }",
        "record B: 'r { values: &'r mut [u32] } union U: 'r { Some(B 'r), None } fn f 'r (u: &'r U 'r) -> &'r [u32] { match u { case U::Some(b) => return &b.values[..], else => panic, } }",
        "record B: 'r { values: &'r mut [u32] } record S: 'r { items: [?B 'r; 1] } fn f 'r (s: &'r S 'r) -> &'r [u32] { match &s.items[0] { case nil => panic, b => return &b.values[..], } }",
        "record B: 'r { values: &'r mut [u32] } union U: 'r { Some(B 'r), None } fn values 'r (b: &'r B 'r) -> &'r [u32] { return &b.values[..]; } fn f 'r (u: &'r U 'r) -> &'r [u32] { match u { case U::Some(b) => return values(b), else => panic, } }",
        "record B: 'r { values: &'r mut [u32] } record S: 'r { items: [?B 'r; 1] } fn values 'r (b: &'r B 'r) -> &'r [u32] { return &b.values[..]; } fn f 'r (s: &'r S 'r) -> &'r [u32] { let mut found: ?&'r B 'r = nil; match &s.items[0] { case nil => panic, b => set found = b, } let b = found else panic; return values(b); }",
        "record B: 'r { values: &'r mut [u32] } union U: 'r { Some(B 'r), None } fn f 'r (u: &'r U 'r) -> &'r [u32] { if let case U::Some(b) = u { return &b.values[..]; } panic; }",
        "record B: 'r { values: &'r mut [u32] } union U: 'r { Some(B 'r), None } fn f 'r (u: &'r U 'r) -> &'r [u32] { let case U::Some(b) = u else panic; return &b.values[..]; }",
        "record B: 'r { values: &'r mut [u32] } union U: 'r { Some(B 'r), None } fn f 'r (u: &'r U 'r) -> &'r [u32] { while let case U::Some(b) = u { return &b.values[..]; } panic; }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
        }
    }
}

/// Owned and raw pattern subjects produce ordinary shared bindings.
@test unsafe fn testPointerPatternBindingClasses() throws (testing::TestError) {
    for program in [
        "record B { value: u32 } union U { Some(B), None } fn f(u: *U) { match u { case U::Some(b) => { assert b.value == 0; }, else => {}, } }",
        "record B { value: u32 } union U { Some(B), None } unsafe fn f(u: *unsafe U) { match u { case U::Some(b) => { assert b.value == 0; }, else => {}, } }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
            let func = try super::getBlockStmt(result.root, 2);
            let fnType = resolver::typeFor(&res, func) else throw testing::TestError::Failed;
            let case resolver::Type::Fn(info) = fnType else throw testing::TestError::Failed;
            let subject = resolver::unwrapMatchSubject(*info.paramTypes[0]);
            let case resolver::MatchBy::Ref(types::PointerClass::Ref) = subject.by
                else throw testing::TestError::Failed;
            let case ast::NodeValue::FnDecl(decl) = func.value else throw testing::TestError::Failed;
            let body = decl.body else throw testing::TestError::Failed;
            let statement = try super::getBlockStmt(body, 0);
            let case ast::NodeValue::Match(matchStmt) = statement.value else throw testing::TestError::Failed;
            let case ast::NodeValue::MatchProng(prong) = matchStmt.prongs[0].value
                else throw testing::TestError::Failed;
            let case ast::ProngArm::Case(patterns) = prong.arm else throw testing::TestError::Failed;
            let case ast::NodeValue::Call(call) = patterns[0].value else throw testing::TestError::Failed;
            let bindingType = resolver::typeFor(&res, call.args[0]) else throw testing::TestError::Failed;
            let case resolver::Type::Pointer { class: types::PointerClass::Ref, .. } = bindingType
                else throw testing::TestError::Failed;
        }
    }
}

/// Mutable pattern payload bindings cannot escape or overlap source mutation.
@test unsafe fn testMutablePatternBindingEscape() throws (testing::TestError) {
    let programs = [
        "record B: 'r { values: &'r mut [u32] } union U: 'r { Some(B 'r), None } fn f 'r (u: &'r mut U 'r) -> &'r [u32] { match u { case U::Some(b) => return &b.values[..], else => panic, } }",
    ];
    for program in programs {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::TypeMismatch(_) = error.kind
                else throw testing::TestError::Failed;
        }
    }
    for program in [
        "record B: 'r { values: &'r mut [u32] } union U: 'r { Some(B 'r), None } fn f 'r (u: &'r mut U 'r) { match u { case U::Some(b) => { let held = &b.values[..]; set *u = U::None; assert held.len == 0; }, else => {}, } }",
        "record B: 'r { values: &'r mut [u32] } union U: 'r { Some(B 'r), None } fn f 'r (u: &'r mut U 'r) { let mut held: ?&'r B 'r = nil; match &*u { case U::Some(b) => set held = b, else => {}, } set *u = U::None; let b = held else return; assert b.values.len == 0; }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::BorrowConflict(_) = error.kind
                else throw testing::TestError::Failed;
        }
    }
}

/// Named shared pattern bindings cannot outlive a shorter subject reference.
@test unsafe fn testNamedPatternBorrowRejectsShortOwner() throws (testing::TestError) {
    for program in [
        "record B: 'r { values: &'r mut [u32] } union U: 'r { Some(B 'r), None } fn f 'r 's (u: &'s U 'r) -> &'r [u32] where 'r: 's { match u { case U::Some(b) => return &b.values[..], else => panic, } }",
        "record B: 'r { values: &'r mut [u32] } record S: 'r { items: [?B 'r; 1] } fn f 'r 's (s: &'s S 'r) -> &'r [u32] where 'r: 's { match &s.items[0] { case nil => panic, b => return &b.values[..], } }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::TypeMismatch(_) = error.kind
                else throw testing::TestError::Failed;
        }
    }
}

/// A reference through an exclusive field cannot outlive the owner's borrow.
@test unsafe fn testExclusiveOwnerBorrowLifetimes() throws (testing::TestError) {
    for program in [
        "record H: 'r { item: &'r mut u32 } fn f 'r 's (h: &'s H 'r) -> &'r u32 where 'r: 's { let p: &'r u32 = h.item; return p; }",
        "record H: 'r { item: ?&'r mut u32 } fn f 'r 's (h: &'s H 'r) -> ?&'r u32 where 'r: 's { let p: ?&'r u32 = h.item; return p; }",
        "record H: 'r { item: &'r mut [u32] } fn f 'r 's (h: &'s H 'r) -> &'r [u32] where 'r: 's { let p: &'r [u32] = h.item; return p; }",
        "record H: 'r { item: &'r mut u32 } unsafe fn f 'r 's (h: &'s H 'r) -> &'r u32 where 'r: 's { let p: &'r u32 = h.item; return p; }",
        "record H: 'r { item: ?&'r mut u32 } unsafe fn f 'r 's (h: &'s H 'r) -> ?&'r u32 where 'r: 's { let p: ?&'r u32 = h.item; return p; }",
        "record H: 'r { item: &'r mut [u32] } unsafe fn f 'r 's (h: &'s H 'r) -> &'r [u32] where 'r: 's { let p: &'r [u32] = h.item; return p; }",
        "record H: 'r { item: &'r mut u32 } fn f 'r 's (h: &'s H 'r) -> &'r u32 where 'r: 's { return &*h.item; }",
        "record H: 'r { item: &'r mut u32 } unsafe fn f 'r 's (h: &'s H 'r) -> &'r u32 where 'r: 's { return &*h.item; }",
        "record H: 'r { items: &'r mut [u32] } fn f 'r 's (h: &'s H 'r) -> &'r u32 where 'r: 's { return &h.items[0]; }",
        "record H: 'r { items: &'r mut [u32] } unsafe fn f 'r 's (h: &'s H 'r) -> &'r u32 where 'r: 's { return &h.items[0]; }",
        "record H: 'r { item: &'r mut u32 } fn f 'r 's (h: &'s mut H 'r) -> &'r mut u32 where 'r: 's { return &mut *h.item; }",
        "record H: 'r { item: &'r mut u32 } unsafe fn f 'r 's (h: &'s mut H 'r) -> &'r mut u32 where 'r: 's { return &mut *h.item; }",
        "record H { item: *mut u32 } fn f(h: &H) -> *u32 { return &*h.item; }",
        "record H { item: *mut u32 } unsafe fn f(h: &H) -> *u32 { return &*h.item; }",
        "record H: 'r { items: &'r mut [u32] } fn f 'r 's (h: &'s H 'r) -> &'r [u32] where 'r: 's { return &h.items[..]; }",
        "record H: 'r { items: &'r mut [u32] } unsafe fn f 'r 's (h: &'s H 'r) -> &'r [u32] where 'r: 's { return &h.items[..]; }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            let error = try super::expectError(&result);
            let case resolver::ErrorKind::TypeMismatch(_) = error.kind else throw testing::TestError::Failed;
        }
    }
}

/// A shared binding cannot hide a move from an exclusive field.
@test unsafe fn testSharedBindingPreservesSourceOwnership() throws (testing::TestError) {
    for program in [
        "record H { item: *mut u32 } fn f(h: H) -> *u32 { let p: *u32 = h.item; return p; }",
        "record H { item: ?*mut u32 } fn f(h: H) -> ?*u32 { let p: ?*u32 = h.item; return p; }",
        "record H: 'r { item: &'r mut u32 } fn f 'r (h: &'r H 'r) -> &'r u32 { let p: &'r u32 = h.item; return p; }",
        "record H { item: *mut u32 } unsafe fn f(h: H) -> *u32 { let p: *u32 = h.item; return p; }",
        "record H { item: ?*mut u32 } unsafe fn f(h: H) -> ?*u32 { let p: ?*u32 = h.item; return p; }",
        "record H: 'r { item: &'r mut u32 } unsafe fn f 'r (h: &'r H 'r) -> &'r u32 { let p: &'r u32 = h.item; return p; }",
    ] {
        let mut arena = super::testArena();
        let storage: 'test = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectErrorKind(&result, resolver::ErrorKind::LinearPartialMove);
        }
    }
}

/// Methods and trait instances resolve declaration region parameters.
@test unsafe fn testRegionalMethods() throws (testing::TestError) {
    for program in [
        "record View: 'r { value: &'r u32 } fn (view: &View 'r) get 'r () -> &'r u32 { return view.value; } fn read 'x (view: &View 'x) -> u32 { return *view.get(); }",
        "trait Pick { fn (&Pick) pick 'r (value: &'r u32) -> &'r u32; } record Picker {} instance Pick for Picker { fn (picker: &Picker) pick 'r (value: &'r u32) -> &'r u32 { return value; } } fn choose 'x (picker: &opaque Pick, value: &'x u32) -> &'x u32 { return picker.pick(value); }",
        "trait Read { fn (&Read) read() -> u32; } record Regional: 'r { value: &'r u32 } instance Read for Regional 'r { fn (value: &Regional 'r) read() -> u32 { return *value.value; } } fn inspect(value: &opaque Read) -> u32 { return value.read(); } fn call 'x (value: &Regional 'x) -> u32 { return inspect(value); }",
    ] {
        let mut arena = super::testArena();
        let storage: 'method = &mut arena in {
            let mut res = super::testResolver(storage);
            let result = try super::resolveProgramStr(&mut res, program);
            try super::expectNoErrors(&result);
        }
    }
}