senline-service-dogfood: merge main (post-TLS) with honest residuals

.gitattributes

@@ -1,13 +1,17 @@
-.gitattributes text eol=lf
+# Auto detect text files and perform LF normalization
+* text=auto
+
+# Source and docs
+*.md text eol=lf
 *.sg text eol=lf
-Sengoo.toml text eol=lf
-Sengoo.lock text eol=lf
-sgpm-index.toml text eol=lf
-*.yaml text eol=lf
+*.rs text eol=lf
+*.toml text eol=lf
 *.yml text eol=lf
-*.md text eol=lf
+*.yaml text eol=lf
+*.json text eol=lf
+*.raw text eol=lf
+*.ps1 text eol=lf
 
 # Performance evidence: pin byte-identical SHA-256 across hosts
 bench/results/**/*.json -text
 bench/frontend-memory-baseline.json text eol=lf
-

.github/workflows/senline-installed-packages.yml

@@ -0,0 +1,204 @@
+name: senline-installed-packages
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - ".github/workflows/senline-installed-packages.yml"
+      - "scripts/package-toolchain.ps1"
+      - "scripts/package-senline-worker.ps1"
+      - "scripts/package-senline-http.ps1"
+      - "scripts/compare-senline-package-manifests.ps1"
+      - "scripts/install.ps1"
+      - "scripts/install.sh"
+      - "examples/realworld/senline-domain-worker/**"
+      - "examples/realworld/senline-http-dogfood/**"
+
+jobs:
+  installed-worker-http:
+    name: installed worker/HTTP (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            artifact: linux-x86_64
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            artifact: windows-x86_64
+    env:
+      LLVM_VERSION: "19"
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.94.0
+
+      - name: Install pinned LLVM toolchain (Ubuntu)
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y clang-${LLVM_VERSION} lld-${LLVM_VERSION}
+          sudo update-alternatives --install /usr/bin/clang clang /usr/bin/clang-${LLVM_VERSION} 100
+
+      - name: Require clang
+        shell: pwsh
+        run: |
+          $clang = Get-Command clang -ErrorAction Stop
+          & $clang.Source --version
+          if ($LASTEXITCODE -ne 0) {
+            throw "clang probe failed with exit code $LASTEXITCODE"
+          }
+
+      - name: Build release tools
+        shell: pwsh
+        run: cargo build -p sgc -p sgpm -p sgfmt -p sglsp --release
+
+      - name: Package installed toolchain
+        shell: pwsh
+        env:
+          SENGOO_DIST_TARGET: ${{ matrix.target }}
+        run: |
+          $version = "0.1.0-ci"
+          $cargoTarget = Join-Path $env:RUNNER_TEMP "sengoo-cargo-package-${{ matrix.artifact }}"
+          Remove-Item -LiteralPath "target/dist" -Recurse -Force -ErrorAction SilentlyContinue
+          Remove-Item -LiteralPath $cargoTarget -Recurse -Force -ErrorAction SilentlyContinue
+          Remove-Item Env:CARGO_ENCODED_RUSTFLAGS -ErrorAction SilentlyContinue
+          Remove-Item Env:RUSTFLAGS -ErrorAction SilentlyContinue
+          ./scripts/package-toolchain.ps1 `
+            -Version $version `
+            -OutputDir "target/dist" `
+            -CargoTargetDir $cargoTarget `
+            -SmokeEvidence "senline-installed-packages ${{ matrix.os }} ${{ github.sha }}"
+
+      - name: Install toolchain outside product workspace
+        shell: pwsh
+        run: |
+          $version = "0.1.0-ci"
+          $archiveDir = "target/dist"
+          $latest = Get-Content (Join-Path $archiveDir "latest-archive.txt") -ErrorAction SilentlyContinue
+          if (-not $latest) {
+            $zip = Get-ChildItem $archiveDir -Filter "*.zip" | Select-Object -First 1
+            if (-not $zip) { throw "missing packaged archive under $archiveDir" }
+            $latest = $zip.FullName
+          } else {
+            if (-not [IO.Path]::IsPathRooted($latest)) {
+              $latest = Join-Path $archiveDir $latest
+            }
+          }
+          $installDir = Join-Path $env:RUNNER_TEMP "sengoo-install-${{ matrix.artifact }}"
+          Remove-Item -LiteralPath $installDir -Recurse -Force -ErrorAction SilentlyContinue
+          if ($IsWindows -or $PSVersionTable.PSEdition -eq "Desktop") {
+            ./scripts/install.ps1 -Archive $latest -InstallDir $installDir
+          } else {
+            sh scripts/install.sh "$latest" "$installDir"
+          }
+          Write-Host "install_dir=$installDir"
+
+      - name: Fake cargo + installed worker/HTTP dual package loop
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+          $version = "0.1.0-ci"
+          $installDir = Join-Path $env:RUNNER_TEMP "sengoo-install-${{ matrix.artifact }}"
+          $bin = Join-Path $installDir "bin"
+          $suffix = ""
+          if ($IsWindows -or $PSVersionTable.PSEdition -eq "Desktop") {
+            $suffix = ".exe"
+          }
+          $sgc = Join-Path $bin "sgc$suffix"
+          $sgpm = Join-Path $bin "sgpm$suffix"
+          if (-not (Test-Path -LiteralPath $sgc)) { throw "missing installed sgc: $sgc" }
+          if (-not (Test-Path -LiteralPath $sgpm)) { throw "missing installed sgpm: $sgpm" }
+
+          # Fail if any real cargo would be required by the package loop.
+          $fakeCargoDir = Join-Path $env:RUNNER_TEMP "fake-cargo-fail"
+          Remove-Item -LiteralPath $fakeCargoDir -Recurse -Force -ErrorAction SilentlyContinue
+          New-Item -ItemType Directory -Force -Path $fakeCargoDir | Out-Null
+          $fakeCargo = Join-Path $fakeCargoDir "cargo$suffix"
+          if ($suffix -eq ".exe") {
+            @'
+          @echo off
+          echo fake-cargo: cargo must not be invoked by installed senline package loops 1>&2
+          exit /b 97
+          '@ | Set-Content -LiteralPath $fakeCargo -Encoding ASCII
+          } else {
+            @'
+          #!/bin/sh
+          echo "fake-cargo: cargo must not be invoked by installed senline package loops" >&2
+          exit 97
+          '@ | Set-Content -LiteralPath $fakeCargo -Encoding UTF8
+            & chmod +x $fakeCargo
+          }
+          $pathSep = [IO.Path]::PathSeparator
+          $env:PATH = "$fakeCargoDir$pathSep$bin$pathSep" + $env:PATH
+          $env:SGPM_SGC = $sgc
+          $env:SGPM_SGFMT = Join-Path $bin "sgfmt$suffix"
+          Remove-Item Env:SENGOO_ROOT -ErrorAction SilentlyContinue
+          Remove-Item Env:SENGOO_STDLIB -ErrorAction SilentlyContinue
+          Remove-Item Env:SENGOO_RUNTIME -ErrorAction SilentlyContinue
+
+          Write-Host "sgc: $(& $sgc --version) path=$sgc"
+          Write-Host "sgpm: $(& $sgpm --version) path=$sgpm"
+          Write-Host "SGPM_SGC=$env:SGPM_SGC"
+
+          Push-Location examples/realworld/senline-domain-worker
+          try {
+            & $sgpm --runtime-mode installed check --locked
+            if ($LASTEXITCODE -ne 0) { throw "worker sgpm installed check --locked failed" }
+            & $sgpm --runtime-mode installed test --locked
+            if ($LASTEXITCODE -ne 0) { throw "worker sgpm installed test --locked failed" }
+            & $sgpm --runtime-mode installed build --locked --release
+            if ($LASTEXITCODE -ne 0) { throw "worker sgpm installed build --locked --release failed" }
+          } finally {
+            Pop-Location
+          }
+
+          Push-Location examples/realworld/senline-http-dogfood
+          try {
+            & $sgpm --runtime-mode installed check --locked
+            if ($LASTEXITCODE -ne 0) { throw "http sgpm installed check --locked failed" }
+            & $sgpm --runtime-mode installed test --locked
+            if ($LASTEXITCODE -ne 0) { throw "http sgpm installed test --locked failed" }
+            & $sgpm --runtime-mode installed build --locked --release
+            if ($LASTEXITCODE -ne 0) { throw "http sgpm installed build --locked --release failed" }
+          } finally {
+            Pop-Location
+          }
+
+          $pkgRoot = Join-Path $env:RUNNER_TEMP "senline-pkg-${{ matrix.artifact }}"
+          Remove-Item -LiteralPath $pkgRoot -Recurse -Force -ErrorAction SilentlyContinue
+          New-Item -ItemType Directory -Force -Path $pkgRoot | Out-Null
+
+          ./scripts/package-senline-worker.ps1 -SgcPath $sgc -SgpmPath $sgpm -OutputDir (Join-Path $pkgRoot "worker-a")
+          ./scripts/package-senline-worker.ps1 -SgcPath $sgc -SgpmPath $sgpm -OutputDir (Join-Path $pkgRoot "worker-b")
+          ./scripts/compare-senline-package-manifests.ps1 `
+            -LeftManifest (Join-Path $pkgRoot "worker-a/worker-manifest.json") `
+            -RightManifest (Join-Path $pkgRoot "worker-b/worker-manifest.json") `
+            -OutputDir (Join-Path $pkgRoot "worker-compare") `
+            -AllowExecutableHashDrift
+
+          ./scripts/package-senline-http.ps1 -SgcPath $sgc -SgpmPath $sgpm -OutputDir (Join-Path $pkgRoot "http-a")
+          ./scripts/package-senline-http.ps1 -SgcPath $sgc -SgpmPath $sgpm -OutputDir (Join-Path $pkgRoot "http-b")
+          ./scripts/compare-senline-package-manifests.ps1 `
+            -LeftManifest (Join-Path $pkgRoot "http-a/http-manifest.json") `
+            -RightManifest (Join-Path $pkgRoot "http-b/http-manifest.json") `
+            -OutputDir (Join-Path $pkgRoot "http-compare") `
+            -AllowExecutableHashDrift
+
+          Write-Host "senline installed worker/HTTP dual package loop green on ${{ matrix.os }}"
+
+      - name: Upload package compare evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: senline-installed-packages-${{ matrix.artifact }}
+          path: |
+            ${{ runner.temp }}/senline-pkg-${{ matrix.artifact }}/**/comparison.json
+            ${{ runner.temp }}/senline-pkg-${{ matrix.artifact }}/**/*-manifest.json
+          if-no-files-found: warn

README-dist.md

@@ -7,14 +7,107 @@ This archive contains the Sengoo command-line tools:
 - `bin/sgfmt`
 - `bin/sglsp`
 
-It also includes the standard library and C runtime bridge under
-`share/sengoo/`, so `sgc` can resolve `std::*` imports without a source
-checkout or `SENGOO_ROOT`.
+It also includes the standard library, C runtime bridge, and target-native
+runtime under `share/sengoo/`, so `sgc` can resolve `std::*` imports and link
+native programs without a source checkout, `SENGOO_ROOT`, or Cargo.
+
+## Installed Runtime Layout
+
+The archive root uses manifest schema 2:
+
+```text
+manifest.json
+payloads.sha256
+bin/sgc[.exe]
+share/sengoo/stdlib/runtime.c
+share/sengoo/stdlib/runtime_*.c
+share/sengoo/stdlib/runtime_shared.h
+share/sengoo/runtime/<target>/sengoo_runtime.lib     # Windows
+share/sengoo/runtime/<target>/libsengoo_runtime.a    # Unix
+```
+
+`manifest.json.native_runtime` binds runtime ABI 1 to the exact target,
+relative library path, SHA-256, ordered platform link arguments, and declared
+dynamic dependencies. `build_manifest_id` is the SHA-256 of the normalized
+`payloads.sha256` file. Installers verify the archive checksum, every listed
+payload, and that no unlisted payload file is present before copying files.
+
+`source_revision`, `source_dirty`, `artifact_provenance`, and
+`release_eligible` distinguish clean packager-built archives from local
+`-NoBuild` development bundles. A dirty or `-NoBuild` bundle is useful for
+local smoke testing but is not release or Senline pin evidence.
+
+Installed native build/run validates the manifest and runtime before cache
+reuse. Missing, relocated-without-manifest, wrong-target, wrong-ABI, tampered,
+or incomplete installations fail without consulting Cargo or a compiled-in
+source checkout.
+
+## Reproducible Distribution Gate
+
+Windows x64 and Linux x64 CI package the same clean Git revision twice in
+sequence. Build A and build B use separate empty Cargo target directories.
+Each target directory is remapped to the common virtual
+`/sengoo-build/target` prefix so runner-local build paths cannot affect shipped
+payloads. Both manifests must report `source_dirty=false` and
+`release_eligible=true`, and both checksum-verifying installers must accept the
+resulting archives.
+
+`scripts/compare-distribution-manifests.ps1` validates the complete schema 2
+shape before comparing it. Normalization is deliberately narrow:
+
+- `tools`, `stdlib_modules`, `runtime_sources`, and
+  `native_runtime.dynamic_dependencies` are compared as sorted unique sets.
+- `tool_versions` is ordered by its exact tool keys.
+- `payloads` is ordered by normalized relative path; paths must also be unique
+  under case-insensitive comparison.
+- `native_runtime.link_args` retains order because linker argument order is
+  part of the installed runtime contract.
+
+Only `generated_at_utc`, `runner_os`, `runner_image`, and the run-specific
+`smoke_evidence` provenance note are excluded. GitHub provenance attestation
+signatures are external to manifest schema 2 and may differ without weakening
+the payload comparison. `artifact_provenance`, release eligibility, source
+revision and dirtiness, build identity, tool versions, payload sizes and
+hashes, runtime ABI/library/hash, ordered link arguments, dynamic dependency
+identities, archive/checksum names, and license presence must match exactly.
+Unknown or missing fields fail validation rather than disappearing during
+normalization.
+
+The gate retains `normalized-a.json`, `normalized-b.json`, and
+`comparison.json`, including both normalized SHA-256 values and any excluded
+provenance differences. A mismatch blocks the target before publication.
+
+## Source Runtime Development Mode
+
+`sgc` defaults to `--runtime-mode installed`. Contributors who intentionally
+build the native Rust runtime through Cargo must use a compiler executable
+inside the Sengoo workspace and opt in explicitly:
+
+```sh
+target/debug/sgc --runtime-mode source-development build path/to/main.sg
+```
+
+Locked package loops use the same explicit policy at the `sgpm` boundary; the
+selected mode is forwarded to every delegated `sgc` command:
+
+```sh
+target/debug/sgpm --runtime-mode source-development check --locked
+target/debug/sgpm --runtime-mode source-development test --locked
+```
+
+This mode emits the stable `toolchain::source_runtime_development` diagnostic
+and records `artifact_provenance=source-cargo-development`,
+`release_eligible=false`, and `senline_pin_evidence=false` in build/run cache
+metadata. It cannot start or dispatch through the compiler daemon. Moving the
+compiler outside its source workspace does not carry this authority with it.
+Artifacts produced in this mode are development outputs only and are never
+installed-distribution, publication, or Senline pin evidence.
 
 ## Requirements
 
-Native builds require LLVM/Clang 15 or newer on `PATH`. `sgc build
---emit-llvm` and stdlib import expansion work without native linking.
+Native builds require LLVM/Clang 15 or newer on `PATH`. Windows builds also
+require the supported MSVC linker/SDK. `sgc build --emit-llvm` and stdlib
+import expansion work without native linking.
 
 ## Quickstart
 

compiler/src/codegen/instruction_helpers.rs

@@ -699,11 +699,27 @@ impl Codegen {
             } => {
                 let dest = self.local_name(*destination);
 
-                let src = self.local_name(*source);
                 let dest_ty = self.get_local_type(mir_fn, *destination).clone();
                 let source_ty = self.get_local_type(mir_fn, *source).clone();
-                let source_ptr_ty = format!("{}*", self.mir_type_to_llvm_cached(&source_ty));
+                let source_llvm = self.mir_type_to_llvm_cached(&source_ty);
+                let source_ptr_ty = format!("{}*", source_llvm);
                 let dest_llvm = self.mir_type_to_llvm_cached(&dest_ty);
+                let src = if self.local_uses_stack_slot(*source, mir_fn) {
+                    self.local_name(*source)
+                } else {
+                    // Parameters and temporaries are SSA values; spill before taking their address.
+                    let source_value = self.operand_value(*source, mir_fn);
+                    let slot = format!("{}.slot", dest);
+                    self.emit_indent();
+                    self.ir
+                        .push_str(&format!("{} = alloca {}\n", slot, source_llvm));
+                    self.emit_indent();
+                    self.ir.push_str(&format!(
+                        "store {} {}, {} {}\n",
+                        source_llvm, source_value, source_ptr_ty, slot
+                    ));
+                    slot
+                };
 
                 self.emit_indent();