Merge defect fixes: tuple typed facts, tuple arity, RS0401 wording, .rssi signature checks

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DSzo4WPJ7WyKhhCsaAXUXB

Author: olwang

crates/rsscript-diagnostics/src/implementation.rs

@@ -673,8 +673,8 @@ static DIAGNOSTIC_EXPLANATIONS: &[DiagnosticExplanation] = &[
     },
     DiagnosticExplanation {
         code: code::USE_AFTER_MANAGE,
-        title: "use after manage",
-        explanation: "`manage value` moves a local value into the managed runtime. The original local binding cannot be used afterwards on any reachable path.",
+        title: "use after move",
+        explanation: "A local value can be moved out of its binding two ways: `manage value` hands it to the managed runtime, and `take value` hands it to a callee (or to a `match take value` scrutinee). Either way the original binding cannot be used afterwards on any reachable path. The diagnostic names the move that happened and points at it.",
     },
     DiagnosticExplanation {
         code: code::LOCAL_VALUE_RETAINED,

crates/rsscript-lowering/src/mir.rs

@@ -1098,6 +1098,32 @@ struct LoopTargets {
     break_target: BlockId,
     cleanup_depth: usize,
 }
+/// Replace a signature's own type parameters with the concrete type arguments
+/// the checker inferred for one call site.
+///
+/// Substitution is keyed by the **declared parameter name**, never by spelling
+/// or position within a rendered type, so a generic record whose parameters are
+/// `A`, `B`, … (the synthetic `__TupleN` structs) and one whose parameters are
+/// `T`, `Key`, … behave identically. With no inferred arguments — a
+/// non-generic record, or a call site the checker could not fully solve — the
+/// declared type is returned unchanged.
+fn substitute_signature_type_params(
+    ty: &ResolvedType,
+    signature: &checked::FunctionSig,
+    type_arguments: &[ResolvedType],
+) -> ResolvedType {
+    if type_arguments.is_empty() || signature.type_params.is_empty() {
+        return ty.clone();
+    }
+    let substitutions = signature
+        .type_params
+        .iter()
+        .cloned()
+        .zip(type_arguments.iter().cloned())
+        .collect::<BTreeMap<String, ResolvedType>>();
+    ty.substitute(&substitutions)
+}
+
 /// Convert semantic type facts into the provider-neutral wire representation
 /// without round-tripping through a rendered type string. This keeps source
 /// spelling and formatting changes out of MIR identity. Function values are

crates/rsscript-lowering/src/mir/lowerer.rs

@@ -619,7 +619,7 @@ impl<'source, 'types, 'closures> CheckedHirLowerer<'source, 'types, 'closures> {
                 type_kind: checked::HirTypeKind::Struct | checked::HirTypeKind::Class,
             }
         ) {
-            return self.lower_record_constructor(signature, args);
+            return self.lower_record_constructor(signature, args, type_arguments);
         }
         if matches!(kind, checked::ResolvedCalleeKind::Constructor { .. }) {
             return self.unsupported("non-record checked HIR constructor");
@@ -779,13 +779,35 @@ impl<'source, 'types, 'closures> CheckedHirLowerer<'source, 'types, 'closures> {
     /// Materialize a resolved struct/class constructor directly from checked
     /// signature facts. Arguments still evaluate in source order, while the
     /// resulting layout fields use declaration/parameter order.
+    ///
+    /// A generic record's declared result names its own type parameters
+    /// (`__Tuple2<A, B>`, `Box<T>`). The constructed value's type is that
+    /// result with the call site's inferred type arguments substituted in, so
+    /// the typed executable facts record `__Tuple2<Int, String>` rather than
+    /// the declaration's parameter names — which no downstream consumer can
+    /// resolve, and which the bytecode verifier rejects against the concrete
+    /// return type of the enclosing function.
     pub(super) fn lower_record_constructor(
         &mut self,
         signature: &checked::FunctionSig,
         args: &[checked::HirCallArg],
+        type_arguments: &[ResolvedType],
     ) -> Result<ValueId, MirLoweringError> {
-        let wire_type = signature
+        if !signature.type_params.is_empty() && type_arguments.is_empty() {
+            // The checker proves a generic call site's type arguments all at
+            // once or not at all. With no proof, the declared result still
+            // names the record's own parameters, and emitting that would put
+            // `__Tuple2<A, B>` into the typed executable facts: a type no
+            // consumer can resolve, which the bytecode verifier then rejects
+            // against the concrete result of the enclosing function. Refusing
+            // here reports the gap at build time instead.
+            return self.unsupported("generic record constructor without a proved type instance");
+        }
+        let return_ty = signature
             .return_ty
+            .as_ref()
+            .map(|ty| substitute_signature_type_params(ty, signature, type_arguments));
+        let wire_type = return_ty
             .as_ref()
             .map(|ty| checked_type_to_wire(ty, &self.function_name))
             .transpose()?

crates/rsscript-sdk/src/tests.rs

@@ -1243,3 +1243,116 @@ fn provider_host_context_and_trace_reach_the_execution_report() {
     assert_eq!(summary.response_bytes, 0);
     assert_eq!(summary.total_duration_ns, summary.max_duration_ns);
 }
+
+/// A tuple is a synthetic `__TupleN<A, B, ..>` generic struct, so every tuple
+/// value is a generic instance whose type arguments have to be substituted
+/// before they reach the typed executable facts. Until they were, a program
+/// that returned a tuple compiled and then failed bytecode verification with
+/// `__Tuple2<A, B>` — the declaration's parameter names — where the concrete
+/// element types belonged. The same fixture is checked by
+/// `tests/fixtures/pass/tuple-values-round-trip.rss`; this runs it.
+#[test]
+fn tuple_values_survive_verification_and_execute() {
+    const SOURCE: &str = r#"
+struct Point {
+    location: (Int, Int)
+}
+
+fn labelled() -> (Int, String) {
+    return (1, "one")
+}
+
+fn widened(value: Int) -> (Int, Int, Bool) {
+    return (value, value * 2, true)
+}
+
+fn sum(pair: read (Int, Int)) -> Int {
+    return pair.item0 + pair.item1
+}
+
+fn picked(values: read List<Int>) -> (Int, Int) {
+    return (values[0], values[1] + 1)
+}
+
+fn main() -> String {
+    local pair = labelled()
+    let (base, doubled, flag) = widened(value: pair.item0)
+    local point = Point(location: (base, doubled))
+    let total = sum(pair: point.location)
+    local values = [4, 5]
+    let (head, next) = picked(values: values)
+    return String.concat(
+        left: pair.item1,
+        right: Int.to_string(value: total + head + next),
+    )
+}
+"#;
+
+    let built = Compiler
+        .compile("tuples.rss", SOURCE)
+        .expect("a tuple-returning program compiles");
+    let admitted = ArtifactVerifier
+        .verify(built)
+        .expect("substituted tuple type arguments pass bytecode verification")
+        .admit_trusted_input();
+    let report = Runtime::default()
+        .link(&admitted)
+        .expect("link tuple program")
+        .execute(ExecutionRequest::default());
+
+    assert_eq!(report.termination_reason(), TerminationReason::Completed);
+    // `labelled()` is `(1, "one")`; `widened(value: 1)` is `(1, 2, true)`, so
+    // the stored `Point.location` is `(1, 2)` and `sum` is 3; `picked` reads
+    // `(4, 6)` off the list. 3 + 4 + 6 = 13.
+    assert_eq!(report.value(), Some("one13"));
+}
+
+/// Tuple arity is not capped by the generated type-parameter names: the
+/// synthetic parameters are unique for any arity, and substitution is keyed by
+/// declared name rather than by spelling, so a wide tuple resolves its
+/// elements and runs like a narrow one.
+#[test]
+fn wide_tuples_keep_distinct_type_parameters_and_execute() {
+    const ARITY: usize = 30;
+    let element_types = std::iter::repeat_n("Int", ARITY - 1)
+        .chain(std::iter::once("String"))
+        .collect::<Vec<_>>()
+        .join(", ");
+    let values = (0..ARITY - 1)
+        .map(|index| index.to_string())
+        .collect::<Vec<_>>()
+        .join(", ");
+    let source = format!(
+        r#"
+fn wide() -> ({element_types}) {{
+    return ({values}, "last")
+}}
+
+fn main() -> String {{
+    local tuple = wide()
+    return String.concat(
+        left: Int.to_string(value: tuple.item0 + tuple.item{last}),
+        right: tuple.item{tail},
+    )
+}}
+"#,
+        last = ARITY - 2,
+        tail = ARITY - 1,
+    );
+
+    let built = Compiler
+        .compile("wide-tuple.rss", &source)
+        .expect("an arity-30 tuple compiles");
+    let admitted = ArtifactVerifier
+        .verify(built)
+        .expect("an arity-30 tuple passes bytecode verification")
+        .admit_trusted_input();
+    let report = Runtime::default()
+        .link(&admitted)
+        .expect("link wide tuple program")
+        .execute(ExecutionRequest::default());
+
+    assert_eq!(report.termination_reason(), TerminationReason::Completed);
+    // `item0` is 0 and `item28` is 28.
+    assert_eq!(report.value(), Some("28last"));
+}

crates/rsscript-sdk/tests/fixture_corpus.rs

@@ -221,3 +221,156 @@ fn fail_fixtures_emit_exactly_their_expected_codes() {
         failures.join("\n")
     );
 }
+
+/// The workspace root, from this crate's manifest directory.
+fn workspace_root() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("../..")
+        .canonicalize()
+        .expect("workspace root should exist")
+}
+
+/// Every `.rssi` under `directory`, recursively, sorted so failures report
+/// stably.
+fn interface_files(directory: &Path, found: &mut Vec<PathBuf>) {
+    let mut entries = fs::read_dir(directory)
+        .unwrap_or_else(|error| panic!("read {}: {error}", directory.display()))
+        .map(|entry| entry.expect("directory entry").path())
+        .collect::<Vec<_>>();
+    entries.sort();
+    for path in entries {
+        if path.is_dir() {
+            interface_files(&path, found);
+        } else if path
+            .extension()
+            .is_some_and(|extension| extension == "rssi")
+        {
+            found.push(path);
+        }
+    }
+}
+
+/// A signature-level rule holds wherever the signature is written. An `.rssi`
+/// declaration has no body, but it has a contract, and an interface that
+/// escaped the rule could export one the language does not have — `pub fn
+/// make_default<T>() -> fresh T` was accepted in an interface while the same
+/// signature in a `.rss` file was `RS0603`.
+///
+/// The diagnostic must also land on the interface, not on the source that
+/// supplied it: the reader has to be sent to the file they can fix.
+#[test]
+fn invalid_interface_signatures_are_diagnosed_against_the_interface_file() {
+    const SOURCE: &str = "fn main() -> Unit {\n    return Unit\n}\n";
+    const INTERFACE: &str = "pub fn make_default<T>() -> fresh T\n";
+
+    let mut interfaces = standard_package_interfaces().to_vec();
+    interfaces.push(("host/defaults.rssi", INTERFACE));
+    let diagnostics = analyze_sources_with_interfaces(&[("main.rss", SOURCE)], &interfaces);
+
+    let invalid_fresh = diagnostics
+        .iter()
+        .find(|diagnostic| diagnostic.code == "RS0603")
+        .unwrap_or_else(|| {
+            panic!(
+                "an invalid `.rssi` signature must be diagnosed; got {:?}",
+                diagnostics
+                    .iter()
+                    .map(|diagnostic| diagnostic.code.as_str())
+                    .collect::<Vec<_>>()
+            )
+        });
+    assert_eq!(
+        invalid_fresh.span.file, "host/defaults.rssi",
+        "the diagnostic must point at the interface that declares the signature"
+    );
+    assert!(
+        invalid_fresh.summary.contains("make_default"),
+        "the diagnostic must name the interface declaration: {}",
+        invalid_fresh.summary
+    );
+
+    // The bounded form of the same signature is clean, so the rule is not
+    // rejecting every generic `fresh` return in an interface.
+    let mut bounded = standard_package_interfaces().to_vec();
+    bounded.push((
+        "host/defaults.rssi",
+        "pub fn make_default<T: Struct>() -> fresh T\n",
+    ));
+    assert!(
+        analyze_sources_with_interfaces(&[("main.rss", SOURCE)], &bounded).is_empty(),
+        "a correctly bounded interface signature must stay clean"
+    );
+}
+
+/// The prelude is the one interface set every program sees, so a regression in
+/// it would be invisible in ordinary fixtures until it reached users. Check
+/// every `.rssi` that ships, read from disk rather than from the embedded
+/// catalog, so an interface added to `stdlib/` or `packages/` is covered the
+/// day it lands.
+#[test]
+fn every_shipped_interface_passes_the_signature_checks() {
+    const SOURCE: &str = "fn main() -> Unit {\n    return Unit\n}\n";
+
+    let root = workspace_root();
+    let mut paths = Vec::new();
+    interface_files(&root.join("stdlib"), &mut paths);
+    for package in {
+        let mut packages = fs::read_dir(root.join("packages"))
+            .expect("packages directory should exist")
+            .map(|entry| entry.expect("packages entry").path())
+            .collect::<Vec<_>>();
+        packages.sort();
+        packages
+    } {
+        let interface = package.join("interface");
+        if interface.is_dir() {
+            interface_files(&interface, &mut paths);
+        }
+    }
+    assert!(
+        paths.len() >= 30,
+        "the shipped interface set should not have shrunk to {} files",
+        paths.len()
+    );
+
+    // Supply the whole set at once: the interfaces reference each other's
+    // protocols (`Ord`, `Eq`, `Hashable`), so checking one in isolation would
+    // report a missing protocol that the prelude does in fact declare. Each
+    // diagnostic still carries its own interface's path, so a failure names
+    // the file to fix.
+    let sources = paths
+        .iter()
+        .map(|path| {
+            let relative = path
+                .strip_prefix(&root)
+                .unwrap_or(path)
+                .to_string_lossy()
+                .into_owned();
+            let text = fs::read_to_string(path)
+                .unwrap_or_else(|error| panic!("read {}: {error}", path.display()));
+            (relative, text)
+        })
+        .collect::<Vec<_>>();
+    let interfaces = sources
+        .iter()
+        .map(|(file, text)| (file.as_str(), text.as_str()))
+        .collect::<Vec<_>>();
+
+    let failures = analyze_sources_with_interfaces(&[("main.rss", SOURCE)], &interfaces)
+        .into_iter()
+        .map(|diagnostic| {
+            format!(
+                "{}:{}:{}: {}",
+                diagnostic.span.file, diagnostic.span.line, diagnostic.span.column, diagnostic.code
+            )
+        })
+        .collect::<Vec<_>>();
+
+    assert!(
+        failures.is_empty(),
+        "{} diagnostics across the {} shipped interfaces:\n{}",
+        failures.len(),
+        paths.len(),
+        failures.join("\n")
+    );
+}

crates/rsscript-sdk/tests/fixtures/fail/interface-invalid-fresh-generic.rss

@@ -0,0 +1,11 @@
+// expect: RS0603
+
+// interface: interface-invalid-fresh-generic.rssi
+
+// The source file is clean. The diagnostic comes from the supplied interface:
+// signature-level checks run over `.rssi` declarations too, so an interface
+// cannot export a contract the language does not have.
+
+fn main() -> Unit {
+    return Unit
+}

crates/rsscript-sdk/tests/fixtures/fail/interface-invalid-fresh-generic.rssi

@@ -0,0 +1,5 @@
+// A signature-level rule is as true of a bodyless `.rssi` declaration as of a
+// `.rss` one: `fresh T` needs `T: Struct` for freshness to hold at every
+// instantiation. `pass/interface-fresh-generic-bounded.rss` shows the same
+// signature written correctly.
+pub fn make_default<T>() -> fresh T