perf(reg-vm): elision Slice 3 — widen read-only-safe set to proven-pure readers (borrow-by-default)

olwang · claude · olwang · commit 1d01975868a0 · 2026-07-01T23:27:49.000-07:00
Promote all proven-pure String.* and Bytes.* intrinsic readers from the
conservative DeepCopy-elision keep-default to PureFreshReader, so a read-only
`read String`/`read Bytes` param no longer forces its prologue DeepCopy to be
kept. Each promoted op was audited against intrinsics/{string,bytes}.rs: borrows
its receiver by &amp; (never borrow_mut), never stores an arg into
streams/channels/resource state, and returns a fresh scalar/Rc&lt;String&gt;/Rc&lt;Vec&gt;/
List that shares no Rc with an arg. MatchMapGet/MatchSortedMapGet rejected (they
alias-return an element and would need a taint-propagation edge this slice does
not touch). Readability refactor makes deepcopy_intrinsic_class /
deepcopy_instr_forces_keep an explicit three-way split (escape / read-only-safe /
unclassified-&gt;keep); the fail-safe catch-all default and the exhaustive
deepcopy_collect_regs are unchanged. Adds a positive elision guard
(deepcopy_elision_fires_for_string_read_param) and a negative over-promotion
guard (deepcopy_elision_kept_for_stored_read_param).

Co-Authored-By: Claude Opus 4.8 &lt;noreply@anthropic.com&gt;
diff --git a/crates/rsscript/src/reg_vm/model.rs b/crates/rsscript/src/reg_vm/model.rs
@@ -2252,8 +2252,15 @@ enum IntrinsicTaintClass {
 /// `deepcopy_instr_forces_keep`/`deepcopy_elidable_param_regs`.
 fn deepcopy_intrinsic_class(intrinsic: RegIntrinsic) -> IntrinsicTaintClass {
     use IntrinsicTaintClass::{AliasReturner, PureFreshReader};
+    // Three-way split, all POSITIVE (an intrinsic is trusted only when named):
+    //   1. PureFreshReader  → READ-ONLY-SAFE, result is fresh (no arg aliasing).
+    //   2. AliasReturner    → READ-ONLY-SAFE args, but result aliases an arg's `Rc`
+    //                          (taint propagates arg→dst in `deepcopy_elidable_param_regs`).
+    //   3. everything else  → UNCLASSIFIED ⇒ `Keep` (the fail-safe default arm; soundness
+    //                          rests on it — Tier-3 IO/channels/streams/tensor/json/… and any
+    //                          not-yet-audited variant conservatively pins the copy).
     match intrinsic {
-        // ---- PureFreshReader: fresh scalar/bool/collection-of-scalars, no arg aliasing. ----
+        // ---- (1) PureFreshReader: fresh scalar/bool/collection-of-scalars, no arg aliasing. ----
         // List
         RegIntrinsic::ListIsEmpty
         | RegIntrinsic::ListContains
@@ -2311,7 +2318,71 @@ fn deepcopy_intrinsic_class(intrinsic: RegIntrinsic) -> IntrinsicTaintClass {
         | RegIntrinsic::CharIsLower
         | RegIntrinsic::CharIsUpper
         | RegIntrinsic::CharIsWhitespace
-        | RegIntrinsic::CharCompare => PureFreshReader,
+        | RegIntrinsic::CharCompare
+        // String — pure readers (Slice 3). Each takes its receiver by `&`
+        // (`expect_string_ref`, never `borrow_mut`), never stores an arg into
+        // `self.streams`/`self.channels`/resource state, and RETURNS a FRESH value:
+        // a scalar (`Int`/`Bool`/`Char`), a brand-new `Rc<String>` (every
+        // `VmValue::string(..)` is `Rc::new(into())`, so even `String.copy`/`slice`/
+        // `trim`/`replace` allocate — the result NEVER aliases the arg's `Rc`), a fresh
+        // `List` (`chars`/`lines`/`split`), or an `Option`/`Result` wrapping one of those.
+        // Verified against `intrinsics/string.rs`: none mutate/store/alias an arg. This
+        // lets the elision pass drop a redundant `read String` prologue DeepCopy whose
+        // only keep-forcing use is one of these read-only string ops (borrow-by-default).
+        | RegIntrinsic::StringAfter
+        | RegIntrinsic::StringBefore
+        | RegIntrinsic::StringBuilderNew
+        | RegIntrinsic::StringCharAt
+        | RegIntrinsic::StringChars
+        | RegIntrinsic::StringContains
+        | RegIntrinsic::StringCount
+        | RegIntrinsic::StringCopy
+        | RegIntrinsic::StringEndsWith
+        | RegIntrinsic::StringFormat
+        | RegIntrinsic::StringFromBool
+        | RegIntrinsic::StringFromFloat
+        | RegIntrinsic::StringFromInt
+        | RegIntrinsic::StringIndexOf
+        | RegIntrinsic::StringIsEmpty
+        | RegIntrinsic::StringJoin
+        | RegIntrinsic::StringLines
+        | RegIntrinsic::StringLen
+        | RegIntrinsic::StringPadLeft
+        | RegIntrinsic::StringPadRight
+        | RegIntrinsic::StringParseFloat
+        | RegIntrinsic::StringParseInt
+        | RegIntrinsic::StringRepeat
+        | RegIntrinsic::StringReplace
+        | RegIntrinsic::StringReplaceFirst
+        | RegIntrinsic::StringReverse
+        | RegIntrinsic::StringSlice
+        | RegIntrinsic::StringSplit
+        | RegIntrinsic::StringStartsWith
+        | RegIntrinsic::StringStripPrefix
+        | RegIntrinsic::StringToLowercase
+        | RegIntrinsic::StringToUppercase
+        | RegIntrinsic::StringTrim
+        | RegIntrinsic::StringTrimEnd
+        | RegIntrinsic::StringTrimStart
+        // Bytes — pure readers (Slice 3). Each takes its receiver by `&`
+        // (`expect_bytes_ref`, never `borrow_mut`), never stores an arg, and returns a
+        // FRESH value: a scalar (`BytesLen`→`Int`, `BytesIsEmpty`/`BytesViewStartsWith`→
+        // `Bool`), a freshly-allocated `Rc<Vec<u8>>` (`concat`/`slice`/`from_string`/
+        // `from_uints`/`view_to_bytes` all `Rc::new` a new `Vec`), a fresh `Rc<String>`
+        // (`to_string`), or a fresh `List` (`to_uints`). Verified against
+        // `intrinsics/bytes.rs`: none mutate/store/alias an arg (`BytesConsume` merely
+        // reads and returns `Unit`).
+        | RegIntrinsic::BytesConcat
+        | RegIntrinsic::BytesConsume
+        | RegIntrinsic::BytesFromString
+        | RegIntrinsic::BytesFromUints
+        | RegIntrinsic::BytesIsEmpty
+        | RegIntrinsic::BytesLen
+        | RegIntrinsic::BytesSlice
+        | RegIntrinsic::BytesToString
+        | RegIntrinsic::BytesToUints
+        | RegIntrinsic::BytesViewStartsWith
+        | RegIntrinsic::BytesViewToBytes => PureFreshReader,
 
         // ---- AliasReturner: result shares an arg's inner `Rc`; propagate taint arg→dst. ----
         // List
@@ -2348,7 +2419,7 @@ fn deepcopy_intrinsic_class(intrinsic: RegIntrinsic) -> IntrinsicTaintClass {
         // Deque
         | RegIntrinsic::DequeToList => AliasReturner,
 
-        // Everything else (Tier-3 and any unclassified variant): conservative keep.
+        // ---- (3) UNCLASSIFIED → KEEP (fail-safe default; Tier-3 + any un-audited variant). ----
         _ => IntrinsicTaintClass::Keep,
     }
 }
@@ -2379,12 +2450,16 @@ fn deepcopy_intrinsic_class(intrinsic: RegIntrinsic) -> IntrinsicTaintClass {
 ///   explicitly classified read-only-safe above.
 fn deepcopy_instr_forces_keep(instr: &RegInstr, tainted: &[bool], n_regs: usize) -> bool {
     let is_t = |r: Reg| r < n_regs && tainted[r];
-    // In-place mutation of a tainted heap receiver — the direct leak.
+    // ---- POSITIVE ESCAPE (keep): in-place mutation of a tainted heap receiver — the direct
+    // leak. This is the one escape we detect structurally rather than via the default arm. ----
     if let Some(recv) = deepcopy_heap_mutation_receiver(instr) {
         if is_t(recv) {
             return true;
         }
     }
+    // ---- POSITIVE READ-ONLY-SAFE (elide): the arms below return `false` (or key only off a
+    // tainted `mut`-arg / classified-`Keep` intrinsic). Anything not matched here falls through
+    // to the UNCLASSIFIED → KEEP fail-safe default at the bottom. ----
     match instr {
         // Alias propagation: `dst` aliases `src`'s inner `Rc` (already tainted by the closure);
         // the op only READS `src`, so it never leaks by itself.
@@ -2464,8 +2539,11 @@ fn deepcopy_instr_forces_keep(instr: &RegInstr, tainted: &[bool], n_regs: usize)
         | RegInstr::LoadNone { .. }
         | RegInstr::RuntimeError { .. } => false,
 
-        // Everything else (stores, returns, captures, spawns, `Manage`, intrinsics, and every
-        // unlisted mutator): conservatively keep the copy if a tainted register is involved.
+        // ---- UNCLASSIFIED → KEEP (fail-safe default; SOUNDNESS BACKBONE — DO NOT WEAKEN). ----
+        // Everything else (stores, returns, captures, spawns, `Manage`, `Match*MapGet` extractions,
+        // and every unlisted mutator): conservatively keep the copy if a tainted register is
+        // involved. `deepcopy_collect_regs` is exhaustive (no wildcard) so a new `RegInstr` variant
+        // lands here by default rather than silently escaping the analysis.
         other => {
             let mut regs = Vec::new();
             deepcopy_collect_regs(other, &mut regs);
diff --git a/crates/rsscript/src/reg_vm/tests.rs b/crates/rsscript/src/reg_vm/tests.rs
@@ -825,6 +825,143 @@ fn main() -> Unit {
         assert_eq!(output.stdout, "42\n");
     }
 
+    /// Slice 3 (borrow-by-default): a `read String` param whose only use is a
+    /// proven-pure reader (`String.len`, now classified `PureFreshReader`) must have
+    /// its prologue `DeepCopy` ELIDED. Before Slice 3 every `String.*` intrinsic hit
+    /// the conservative `Keep` arm, so `String.len(read s)` pinned the copy and each
+    /// call deep-copied the whole string. `String.len` returns a fresh `Int` and never
+    /// mutates/stores/aliases its arg, so sharing the caller's `Rc` is sound.
+    #[test]
+    fn deepcopy_elision_fires_for_string_read_param() {
+        let source = r#"
+fn measure(s: read String) -> Int {
+    return String.len(value: read s)
+}
+
+fn main() -> Unit {
+    Log.write(message: read String.from_int(value: measure(s: read "hello")))
+    return Unit
+}
+"#;
+        let executable = reg_vm_compile_source("deepcopy-elision-string.rss", source)
+            .expect("lowering succeeds");
+
+        let measure_id = executable.unit.function_ids["measure"];
+        let measure = executable.unit.functions[measure_id].as_ref();
+        let elided = measure
+            .code
+            .iter()
+            .filter(|instr| matches!(instr, RegInstr::DeepCopyElided { .. }))
+            .count();
+        let eager = measure
+            .code
+            .iter()
+            .filter(|instr| matches!(instr, RegInstr::DeepCopy { .. }))
+            .count();
+        if crate::reg_vm::model::elide_deepcopy_enabled_for_test() {
+            assert!(
+                elided >= 1 && eager == 0,
+                "elision ON: `read String` param whose only use is the pure reader \
+                 `String.len` must be elided, got {elided} elided / {eager} eager: {:#?}",
+                measure.code,
+            );
+        } else {
+            assert!(
+                eager >= 1 && elided == 0,
+                "elision OFF: eager DeepCopy must be retained: got {elided} elided / \
+                 {eager} eager: {:#?}",
+                measure.code,
+            );
+        }
+
+        // Elision must not change behavior: len("hello") == 5.
+        let output = executable
+            .eval_main_with_args(Vec::<String>::new())
+            .expect("program should still run");
+        assert_eq!(output.stdout, "5\n");
+    }
+
+    /// Slice 3 NEGATIVE guard (over-promotion): a `read List<Int>` param that IS STORED
+    /// into a struct (then reloaded and mutated in a loop) must KEEP its prologue
+    /// `DeepCopy`, even though a promoted pure reader (`String.len` on a fresh string
+    /// derived from it) is also called. Storing lowers to `MakeStruct`, an UNCLASSIFIED
+    /// instruction that references the tainted param register and so hits the fail-safe
+    /// `Keep` default — the param stays tainted and the copy is retained. This proves
+    /// Slice 3 widened only the READ-ONLY-SAFE set, not the ESCAPE set: a storing op is
+    /// still caught, and behavior is byte-for-byte unchanged (caller's `xs[0]` stays 7,
+    /// the callee mutated only its own deep copy). Mirrors the shape of the native
+    /// `native_store_reload_mutate_non_mut_heap_param_does_not_leak` leak guard.
+    #[test]
+    fn deepcopy_elision_kept_for_stored_read_param() {
+        let source = r#"
+features: local
+
+struct Box {
+    items: List<Int>
+}
+
+fn stash(xs: read List<Int>, n: Int) -> Int {
+    let probe = String.len(value: read String.from_int(value: List.get<Int>(list: read xs, index: 0)))
+    let b = Box(items: read xs)
+    let mut i = 0
+    while i < n {
+        let mut inner = b.items
+        List.set<Int>(list: mut inner, index: 0, value: read i)
+        i = i + 1
+    }
+    return List.get<Int>(list: read xs, index: 0) + probe
+}
+
+fn main() -> Unit {
+    local xs = List.new<Int>()
+    List.push<Int>(list: mut xs, value: read 7)
+    let r = stash(xs: read xs, n: read 3)
+    Log.write(message: read String.from_int(value: List.get<Int>(list: read xs, index: 0)))
+    Log.write(message: read String.from_int(value: r))
+    return Unit
+}
+"#;
+        let executable =
+            reg_vm_compile_source("deepcopy-elision-store.rss", source).expect("lowering succeeds");
+
+        let stash_id = executable.unit.function_ids["stash"];
+        let stash = executable.unit.functions[stash_id].as_ref();
+        let elided = stash
+            .code
+            .iter()
+            .filter(|instr| matches!(instr, RegInstr::DeepCopyElided { .. }))
+            .count();
+        let eager = stash
+            .code
+            .iter()
+            .filter(|instr| matches!(instr, RegInstr::DeepCopy { .. }))
+            .count();
+        // The store forces the copy to be kept regardless of the elision gate: with the
+        // gate ON the DeepCopy must NOT be neutralized (elided == 0); with it OFF the eager
+        // DeepCopy is likewise retained. Either way, no elision for the stored param.
+        assert_eq!(
+            elided, 0,
+            "over-promotion guard: a `read Map` param stored into a struct must KEEP its \
+             copy (no DeepCopyElided), got {elided} elided / {eager} eager: {:#?}",
+            stash.code,
+        );
+        assert!(
+            eager >= 1,
+            "over-promotion guard: the eager DeepCopy of the stored `read Map` param must \
+             be retained, got {elided} elided / {eager} eager: {:#?}",
+            stash.code,
+        );
+
+        // Soundness check — elision must not leak to the caller: the caller's xs[0] stays 7
+        // (line 1), proving the prologue copy was KEPT. The callee's own xs is a separate deep
+        // copy; via the stored `b.items` alias the loop drives it to 2 (last i in 0..3), so
+        // `xs[0] + probe == 2 + len("7") == 3` (line 2). Deterministic either way.
+        let output = executable
+            .eval_main_with_args(Vec::<String>::new())
+            .expect("program should still run");
+        assert_eq!(output.stdout, "7\n3\n");
+    }
+
     #[test]
     fn jit_runs_scalar_self_recursion_on_flat_executor() {
         let source = r#"
diff --git a/docs/ledgers/rss-selfhost-ledger.md b/docs/ledgers/rss-selfhost-ledger.md
@@ -707,6 +707,47 @@ gap is VM value-representation / intrinsic-dispatch cost (the next big lever).
   mismatches; lexer perf holds (~46× ratio, rss/VM time ~700 ms stable — the ratio's
   jitter is the tiny Rust denominator, not the VM). New guard:
   `reg_vm::tests::…::deepcopy_elision_fires_for_option_scalar_pattern_bind`.
+- **Slice 3 of borrow-by-default (2026-07-01):** widened the READ-ONLY-SAFE
+  intrinsic set — a SOUND whitelist widening, NOT a default flip. Slices 1–2
+  stopped scalar EXTRACTIONS from tainting; Slice 3 stops proven-pure READERS of a
+  `read String`/`Bytes` param from pinning the copy. Previously every `String.*`
+  and `Bytes.*` intrinsic fell through to the conservative `Keep` arm of
+  `deepcopy_intrinsic_class`, so `String.len(read s)` (or any read-only string/bytes
+  op) forced the prologue `DeepCopy` to be kept — a `read String`/`read Bytes` param
+  used only in read-only ways was still deep-copied per call. **Audit + promotion:**
+  every intrinsic in `intrinsics/string.rs` and `intrinsics/bytes.rs` was verified to
+  (a) borrow its receiver by `&` (`expect_string_ref`/`expect_bytes_ref`, never
+  `borrow_mut`), (b) never store an arg into `self.streams`/`self.channels`/resource
+  state, and (c) return a FRESH value — a scalar, a brand-new `Rc<String>`
+  (`VmValue::string` is always `Rc::new(into())`, so even `copy`/`slice`/`trim`/
+  `replace` allocate and NEVER alias the arg's `Rc`), a freshly-`Rc::new`'d
+  `Vec<u8>`, or a fresh `List`. All were promoted to `PureFreshReader`: the 35
+  `String.*` readers (`StringAfter/Before/BuilderNew/CharAt/Chars/Contains/Count/
+  Copy/EndsWith/Format/FromBool/FromFloat/FromInt/IndexOf/IsEmpty/Join/Lines/Len/
+  PadLeft/PadRight/ParseFloat/ParseInt/Repeat/Replace/ReplaceFirst/Reverse/Slice/
+  Split/StartsWith/StripPrefix/ToLowercase/ToUppercase/Trim/TrimEnd/TrimStart`) and
+  the 11 `Bytes.*` readers (`BytesConcat/Consume/FromString/FromUints/IsEmpty/Len/
+  Slice/ToString/ToUints/ViewStartsWith/ViewToBytes`). **Rejected (left in the
+  keep-default, conservatism over completeness):** `MatchMapGet`/`MatchSortedMapGet`
+  — these are alias-RETURNING extractions (`map.borrow().get(&key).cloned()` shares
+  the element's `Rc` into `value_dst`), so promoting them read-only-safe would need a
+  `map→value_dst` edge in the taint-propagation closure, which this slice does not
+  touch; without it a later mutation of the extracted heap value would leak, so they
+  stay in the fail-safe default. The model is now **"keep only on PROVEN escape
+  (store / mutate-through-alias / retain / return / unclassified)"**; borrow-by-default
+  now covers read-only `String`/`Bytes` params (and, via Slices 1–2, `Map`/`List`/
+  scalar reads). Also a readability refactor (no behavior change):
+  `deepcopy_intrinsic_class` / `deepcopy_instr_forces_keep` now read as an explicit
+  three-way split — POSITIVE ESCAPE (keep) / POSITIVE READ-ONLY-SAFE (elide) /
+  UNCLASSIFIED → KEEP (the fail-safe default arm, UNCHANGED — soundness backbone;
+  `deepcopy_collect_regs` stays exhaustive/no-wildcard). Soundness: catch-all default
+  unchanged; the new negative guard proves a stored `read` param still keeps its copy
+  (no over-promotion). Full suite (628 lib + 456 runtime incl. all three
+  `does_not_leak` guards + 35 differential + 628 static) green; parity 556/556 × 3, 0
+  mismatches; lexer perf holds (rss/VM ~53× ratio under host load, no regression —
+  the change only ADDS elisions). New guards:
+  `reg_vm::tests::…::deepcopy_elision_fires_for_string_read_param` (positive) and
+  `…::deepcopy_elision_kept_for_stored_read_param` (negative / over-promotion).
 
 ### SH-023 — self-hosted checker reaches RS0005 parity at declaration level; the merged callable namespace is the load-bearing rule
 
