Pin the elision attack programs as tests, plan the dynamic-loading melding

Distill the adversarial review's attack programs into five permanent runtime
regressions using the printing-finalizer oracle (a double-free prints twice, a
leak prints zero, the print position pins when elided ownership ends): the
conditional move at a join, two calls with the retain kept at the first, a value
returned and passed, a spawned value used by the spawner after, and a
200-iteration move-heavy loop asserting 600 finalizations and a bounded heap.

Record in RC_ELISION.md how elision melds with dynamically loaded modules, in
three layers: a hard border (boundary calls keep the fixed callee-owns
convention, so each side is correct regardless of the other and hot reload is
safe by construction), move elision unaffected (caller-local against the
universal convention), and summaries as an opt-in ABI section with dual entry
points bound by the load-time linker, so a summary mismatch costs performance,
never correctness.

Author: Axmouth

plans/RC_ELISION.md

@@ -129,7 +129,8 @@ everywhere else the borrow wins, so the composition is strictly better and never
   mode. One summary map drives both sides in one compilation, and `--rc-report` should print each
   function's modes so tests can pin them (the same oracle pattern the move elision used).
 - **Separate compilation later.** Bytecode-level linking (IMPORT.md) must serialize summaries into
-  the module format, or boundaries fall back to all-Owned. Whole-program holds today.
+  the module format, or boundaries fall back to all-Owned. Whole-program holds today. The fuller
+  melding is its own section below.
 - **Multicore later.** A borrow is valid only within the frame-synchronous world. Cross-core sends
   are moves of `Owned<T>` (DESIGN_NOTES), and a send is an escape, so the models compose.
 - **Closures later.** If first-class functions ever land, a capture is an escape. The static call
@@ -141,6 +142,26 @@ everywhere else the borrow wins, so the composition is strictly better and never
   per-mode tests: a read-only param is Borrowed, a stored or returned or reassigned param is Owned, a
   spawn target is all-Owned.
 
+## Dynamic loading and module boundaries (how elision melds with IMPORT.md)
+
+Dynamically loaded bytecode modules (load-time linking, hot reload) break the whole-program
+assumption, and the melding is three layers, from safest to most optimized:
+
+1. **The hard border.** Module-boundary calls use the fixed callee-owns convention, always. Inside a
+   module, full elision applies and is invisible from outside, so each side is correct regardless of
+   what the other side does. This is the safest assumption made structural rather than assumed, and
+   it makes hot reload safe by construction: a reloaded module can change its internals freely while
+   its exports keep the fixed convention. No metadata is needed for correctness.
+2. **Move elision needs nothing.** It is caller-local against the universal callee-owns convention,
+   so it survives dynamic loading and reload untouched.
+3. **Metadata as the opt-in optimization layer.** Cross-border borrows need to know the other side,
+   so per-function parameter-mode summaries ship in the bytecode module format
+   (BYTECODE_FILE_FORMAT.md) as a versioned ABI section. The safe realization: an exported function
+   carries two entry points, the conventional one and a borrowed-convention fast path, and the
+   load-time linker binds a caller to the fast path only when the summaries verify. A reload whose
+   summaries changed re-binds affected callers to the conventional entry. A mismatch therefore costs
+   performance, never correctness, which extends the oracle-not-gate rule to the linker.
+
 ## Order of execution
 
 1. **Summaries plus report, no codegen change.** Compute per-function parameter modes with the

solid-snake-compiler/src/bytecode_gen.rs

@@ -2001,6 +2001,71 @@ mod codegen_tests {
         );
     }
 
+    // Runtime elision regressions distilled from the adversarial memory-safety review's attack
+    // programs. Each uses a printing Delete finalizer as the oracle: a double-free prints twice, a
+    // leak prints zero times, and the print position pins when the elided ownership actually ends.
+    const RES_TYPE: &str =
+        "type Res(Delete):\n    id: Int\n    def delete(self):\n        print(\"D\", self.id)\n\n";
+
+    #[test]
+    fn rc_conditional_move_at_join_frees_exactly_once() {
+        // The value is passed on one branch only and its drop sits after the join, so the
+        // control-flow guard must keep the counting. One finalizer per run, on both branch outcomes.
+        let (_, out) = run_src(&format!(
+            "{RES_TYPE}def take(r: Res) -> Int:\n    return r.id\n\ndef run(flag: Bool) -> Int:\n    let a = Res(5)\n    let x = 0\n    if flag:\n        x = take(a)\n    return x\n\nprint(\"t\", run(true))\nprint(\"f\", run(false))\n"
+        ));
+        assert_eq!(out, "t D 5\n5\nf D 5\n0\n");
+    }
+
+    #[test]
+    fn rc_two_calls_retain_stays_at_the_first() {
+        // Passed to two calls: the retain must stay at the first (the value is still live), and only
+        // the second is a move. The finalizer fires once, at the consuming call, before the print
+        // that follows it.
+        let (_, out) = run_src(&format!(
+            "{RES_TYPE}def peek(r: Res) -> Int:\n    return r.id\n\ndef consume(r: Res) -> Int:\n    return r.id\n\nlet r = Res(5)\nlet a = peek(r)\nlet b = consume(r)\nprint(\"ab\", a, b)\n"
+        ));
+        assert_eq!(out, "D 5\nab 5 5\n");
+    }
+
+    #[test]
+    fn rc_returned_and_passed_value_stays_live() {
+        // The callee both reads its parameter and returns it, so ownership rides out on the return
+        // and the caller's binding stays valid after.
+        let (_, out) = run_src(&format!(
+            "{RES_TYPE}def peek(r: Res) -> Int:\n    return r.id\n\ndef wrap(r: Res) -> Res:\n    let x = peek(r)\n    return r\n\nlet r = wrap(Res(6))\nprint(\"id\", r.id)\n"
+        ));
+        assert_eq!(out, "id 6\nD 6\n");
+    }
+
+    #[test]
+    fn rc_spawned_value_usable_by_spawner_and_freed_once() {
+        // Spawn takes its own reference, the spawner keeps using the value after, and exactly one
+        // finalizer fires once both are done.
+        let (_, out) = run_src(&format!(
+            "{RES_TYPE}def worker(r: Res):\n    print(\"worker\", r.id)\n\nlet r = Res(8)\nspawn worker(r)\nprint(\"main sees\", r.id)\nscheduler_run()\n"
+        ));
+        assert_eq!(out, "main sees 8\nworker 8\nD 8\n");
+    }
+
+    #[test]
+    fn rc_move_heavy_loop_frees_all_and_stays_bounded() {
+        // Per-iteration temporaries moved through aliases and calls, 200 iterations: every resource's
+        // finalizer fires exactly once and the heap stays bounded, so the elision leaks nothing and
+        // frees nothing twice under sustained reuse.
+        let (vm, out) = run_src(&format!(
+            "{RES_TYPE}def take(r: Res) -> Int:\n    return r.id\n\ndef combine(a: Res, b: Res) -> Int:\n    return a.id + b.id\n\nlet i = 0\nlet acc = 0\nwhile i < 200:\n    let r = Res(i)\n    let q = r\n    acc = acc + take(q)\n    let x = Res(i)\n    let y = Res(i)\n    acc = acc + combine(x, y)\n    i = i + 1\nprint(\"acc\", acc)\n"
+        ));
+        let finalized = out.lines().filter(|l| l.starts_with("D ")).count();
+        assert_eq!(finalized, 600, "600 resources must each finalize exactly once");
+        assert!(out.ends_with("acc 59700\n"), "unexpected tail: {out:?}");
+        assert!(
+            vm.heap_section_count() < 40,
+            "heap should stay bounded under reuse, got {}",
+            vm.heap_section_count()
+        );
+    }
+
     #[test]
     fn rc_aliasing_last_use_is_movable() {
         // `let b = a` with `a` dead afterward is a move of the reference into `b`. `a` is a parameter