rsscript: cross-isolate message channel — Channel.message<T> + payload contract

Implements the message-system core for spec §20.2-3 (the "message is the right
choice for a solo isolate" decision). `Channel.message<T>` creates a channel whose
payload `T` is statically verified cross-isolate-transferable — a self-contained
value with no managed handle (is_cross_isolate_transferable; v1: Copy scalars,
String, Bytes) — rejecting managed/container payloads at check time (RS0036). It
reuses the bounded-channel runtime (VM intrinsic + runtime_abi alias to
channel_bounded), so it runs today at VM<->compiled parity and is the
forward-compatible transport for real isolates: nothing crossing it shares
mutable state. `take` move-in still prevents use-after-send; no reference-capability
machinery.

Regenerated packages/async + packages/async-runtime locks and re-attested the
provider's [implements] interface hash for the new Channel.message declaration.

Tests: parity_message_channel_roundtrip + message-channel-non-transferable.rss
(RS0036). Full sweep green (vm/vm_eval_parity/checker_frontend/checker_lowering/
checker_package/corpus/lib), clippy + fmt clean. Spec §20.1-B / §20.2-3 + spec-todo
updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: olwang

crates/rsscript/src/checks/calls.rs

@@ -1289,6 +1289,14 @@ fn check_call_args(
         &type_param_substitutions,
         call_span,
     );
+    check_message_channel_payload(
+        analyzer,
+        function,
+        &call_name,
+        &signature,
+        &type_param_substitutions,
+        call_span,
+    );
 
     for (index, arg) in args.iter().enumerate() {
         let Some(name) = arg
@@ -1431,6 +1439,62 @@ fn positional_param_name<'a>(
     signature_params.get(index).map(|param| param.name.as_str())
 }
 
+/// Enforce the cross-isolate **message** payload contract on `Channel.message<T>`:
+/// the element type must be cross-isolate-transferable (a self-contained value
+/// with no managed handle), so a message can cross an isolate boundary without
+/// sharing mutable state (spec §20.2-3). Skips a still-generic element (an
+/// enclosing-function type param), which can't be proven here.
+fn check_message_channel_payload(
+    analyzer: &mut Analyzer<'_>,
+    function: &FunctionDecl,
+    call_name: &str,
+    signature: &FunctionSig,
+    substitutions: &HashMap<String, String>,
+    call_span: &Span,
+) {
+    // `call_name` carries explicit type args (e.g. `Channel.message<List<Int>>`);
+    // compare on the root.
+    if call_name.split('<').next() != Some("Channel.message") {
+        return;
+    }
+    let Some(param) = signature.type_params.first() else {
+        return;
+    };
+    let Some(element) = substitutions.get(param) else {
+        return;
+    };
+    // A bare enclosing-function type param can't be checked without a `Sendable`
+    // bound; leave it (a future bound would enforce it at the caller).
+    if function
+        .type_params
+        .iter()
+        .any(|type_param| type_param.name == *element)
+    {
+        return;
+    }
+    if crate::checks::local::is_cross_isolate_transferable(element) {
+        return;
+    }
+    analyzer.diagnostics.push(
+        Diagnostic::error(
+            code::MESSAGE_PAYLOAD_NOT_TRANSFERABLE,
+            format!("message channel payload `{element}` is not cross-isolate-transferable."),
+            call_span.clone(),
+            "non-transferable message payload",
+        )
+        .with_cause(
+            "A message must be self-contained data with no managed handle, so it can cross an isolate boundary without sharing mutable state. v1 allows Copy scalars, `String`, and `Bytes`.",
+        )
+        .with_fix(
+            "use_transferable_message_payload",
+            format!(
+                "Send a transferable value (a Copy scalar, `String`, or `Bytes`) instead of `{element}`, or use `Channel.bounded` for an in-isolate channel."
+            ),
+            "manual",
+        ),
+    );
+}
+
 fn check_generic_call_bounds(
     analyzer: &mut Analyzer<'_>,
     function: &FunctionDecl,
@@ -4509,7 +4573,11 @@ fn callee_display(callee: &Callee) -> String {
             receiver,
             method,
             effect,
-        } => format!("{} {}.{method}", (*effect).unwrap_or(DataEffect::Read).as_str(), call_expr_label(receiver)),
+        } => format!(
+            "{} {}.{method}",
+            (*effect).unwrap_or(DataEffect::Read).as_str(),
+            call_expr_label(receiver)
+        ),
     }
 }
 

crates/rsscript/src/checks/local.rs

@@ -4,8 +4,8 @@ use std::collections::{HashMap, HashSet, VecDeque};
 use crate::diagnostic::Span;
 use crate::hir::{
     CallResolution, HirBinding, HirBindingKind, HirBlock, HirCallArg, HirEffectEvent,
-    HirEffectEventKind, HirExpr, HirFunctionBody, HirReturnProof, HirStmt, HirTypeKind, ParamEffect,
-    ResolvedCalleeKind,
+    HirEffectEventKind, HirExpr, HirFunctionBody, HirReturnProof, HirStmt, HirTypeKind,
+    ParamEffect, ResolvedCalleeKind,
 };
 use crate::syntax::ast::{Callee, Expr};
 
@@ -2608,7 +2608,7 @@ fn collect_select_local_flow(
                 value_handle_field: None,
                 fresh_from_local_source: None,
                 fresh_from_scrutinee: false,
-            fresh_from_fresh_value: false,
+                fresh_from_fresh_value: false,
             };
             let binding_node = push_pattern_binding_flow_step(steps, &arm.span, binding);
             if let Some(body_entry) = arm_flow.entry {
@@ -3238,7 +3238,9 @@ fn hir_expr_is_fresh_value(value: &HirExpr) -> bool {
             CallResolution::Resolved { signature, .. } => signature.returns_fresh,
             _ => false,
         },
-        HirExpr::Try { value, .. } | HirExpr::Effect { value, .. } => hir_expr_is_fresh_value(value),
+        HirExpr::Try { value, .. } | HirExpr::Effect { value, .. } => {
+            hir_expr_is_fresh_value(value)
+        }
         _ => false,
     }
 }
@@ -3565,6 +3567,24 @@ impl BodyState {
     }
 }
 
+/// Whether a value of `type_name` may be sent as a cross-isolate **message**
+/// (spec §20.2-3): a self-contained value carrying no managed (`Rc`) handle, so it
+/// can cross an isolate boundary without sharing mutable state. v1 allows Copy
+/// scalars plus the immutable owned-data types `String` and `Bytes` (value
+/// semantics; safe to transfer/share). Mutable/managed containers (`List`, `Map`,
+/// `Buffer`), structs/sums, handles, closures, and generics are conservatively
+/// rejected for now — broadening to data-only structs/containers is a follow-up.
+pub(crate) fn is_cross_isolate_transferable(type_name: &str) -> bool {
+    let type_name = type_name.trim();
+    if is_copy_type_name(type_name) {
+        return true;
+    }
+    matches!(
+        type_name.strip_prefix("fresh ").unwrap_or(type_name),
+        "String" | "Bytes"
+    )
+}
+
 pub(crate) fn is_copy_type_name(type_name: &str) -> bool {
     let type_name = type_name.trim();
     !type_name.contains('<')

crates/rsscript/src/diagnostic.rs

@@ -39,6 +39,7 @@ pub mod code {
     pub const INTEGER_LITERAL_OUT_OF_RANGE: &str = "RS0033";
     pub const UNINFERABLE_BINDING_TYPE: &str = "RS0034";
     pub const LOWER_NAME_CONFLICT: &str = "RS0035";
+    pub const MESSAGE_PAYLOAD_NOT_TRANSFERABLE: &str = "RS0036";
     pub const FEATURE_VIOLATION: &str = "RS0101";
     pub const UNNAMED_ARGUMENT: &str = "RS0201";
     pub const MISSING_DATA_EFFECT: &str = "RS0202";

crates/rsscript/src/reg_vm/mod.rs

@@ -3998,6 +3998,9 @@ impl RegLowerer<'_> {
                         RegIntrinsic::CancellationTokenIsCancelled
                     }
                     ("Channel", "bounded") => RegIntrinsic::ChannelBounded,
+                    // A message channel reuses the bounded-channel runtime; the
+                    // cross-isolate payload contract is enforced at check time.
+                    ("Channel", "message") => RegIntrinsic::ChannelBounded,
                     ("Channel", "receiver") => RegIntrinsic::ChannelReceiver,
                     ("Channel", "sender") => RegIntrinsic::ChannelSender,
                     ("ChannelError", "message") => RegIntrinsic::ChannelErrorMessage,

crates/rsscript/src/runtime_abi.rs

@@ -310,6 +310,9 @@ const RUNTIME_INTRINSICS: &[RuntimeIntrinsic] = &[
         "rsscript_runtime::cancellation_token_is_cancelled",
     ),
     runtime_intrinsic("Channel", "bounded", "rsscript_runtime::channel_bounded"),
+    // Message channel: same runtime as `bounded`; the cross-isolate payload
+    // contract is a compile-time check, not a runtime difference.
+    runtime_intrinsic("Channel", "message", "rsscript_runtime::channel_bounded"),
     runtime_intrinsic("Channel", "sender", "rsscript_runtime::channel_sender"),
     runtime_intrinsic("Channel", "receiver", "rsscript_runtime::channel_receiver"),
     runtime_intrinsic("Sender", "send", "rsscript_runtime::sender_send"),

crates/rsscript/tests/fixtures/fail/message-channel-non-transferable.rss

@@ -0,0 +1,11 @@
+// expect: RS0036
+// A `Channel.message<T>` payload must be cross-isolate-transferable — a
+// self-contained value with no managed handle (spec §20.2-3). A `List<Int>` is a
+// managed container, so it cannot be a message; this must be rejected at check
+// time. (Use `Channel.bounded` for an in-isolate channel.)
+features: async, native, local
+
+async fn main() -> Result<Unit, ChannelError> {
+    let channel = Channel.message<List<Int>>(capacity: 4)?
+    return Ok(Unit)
+}

crates/rsscript/tests/vm_eval_parity/async_concurrency.rs

@@ -232,3 +232,38 @@ async fn main() -> Result<Unit, String> {
         source,
     );
 }
+
+#[test]
+fn parity_message_channel_roundtrip() {
+    // Cross-isolate message channel (spec §20.2-3): `Channel.message<T>` requires a
+    // cross-isolate-transferable payload and reuses the bounded-channel runtime, so
+    // send/recv must behave identically across backends.
+    let source = r#"
+features: async, native, local
+
+async fn main() -> Result<Unit, ChannelError> {
+    let mut channel: Channel<Int> = Channel.message<Int>(capacity: 1)?
+    let mut sender: Sender<Int> = Channel.sender<Int>(channel: read channel)
+    let receiver: Receiver<Int> = Channel.receiver<Int>(channel: mut channel)?
+    local first = 7
+    await Sender.send<Int>(sender: read sender, value: take first)?
+    Sender.close<Int>(sender: mut sender)
+    match await Receiver.recv<Int>(receiver: read receiver)? {
+        Some(value) => {
+            Log.write(message: read String.from_int(value: value))
+        }
+        None => {
+            Log.write(message: read "recv-none")
+        }
+    }
+    return Ok(Unit)
+}
+"#;
+    common::assert_vm_eval_matches_backend_with_distinct_args_allowing_unused_mut_warning(
+        "parity-message-channel.rss",
+        "rsscript_parity_message_channel",
+        source,
+        &[],
+        &[],
+    );
+}

docs/RSScript_v0.7_Spec.md

@@ -5276,7 +5276,14 @@ A. Extended async surface beyond the v0.7 MVP
    - must not expose Future / Pin / Poll / Waker to RSScript users (section 14.4).
 
 B. Cross-isolate message API with zero-copy transfer
-   - now in scope: committed roadmap (§20.2).
+   - partially implemented (§20.2-3): the **message payload contract** is enforced.
+     `Channel.message<T>` creates a channel whose payload `T` is statically verified
+     cross-isolate-transferable (a self-contained value with no managed handle; v1:
+     Copy scalars, `String`, `Bytes`), rejecting managed/container payloads with
+     `RS0036`. It reuses the bounded-channel runtime, so it runs today at parity and
+     is the forward-compatible transport for real isolates. Remaining: broaden the
+     contract to data-only structs/containers, and a structured isolate-spawn with
+     disjoint heaps.
    - explicit typed send/receive channels between isolates.
    - cross-isolate payloads are owned/Copy data or values moved with take.
    - take-based move across an isolate boundary is the no-shared-alias transfer

docs/spec-todo.md

@@ -45,20 +45,23 @@ model without reversing a review-first tenet. Ordered by readiness/value.
   dispatch. Verified at parity (`parity_capability_dynamic_dispatch`, two impls). The
   review map already flags dynamic dispatch (`has_dynamic_protocol_dispatch`).
 
-- [ ] **Cross-isolate message API (zero-copy transfer)** (§20.1-B, §20.2-3) —
-  _blocked on foundational runtime work; design recorded._ Unlike the other three
-  roadmap items (which were largely already built), this has **no foundation**: the
-  runtime is strictly single-isolate (one cooperative-task heap; the channel is an
-  explicit single-isolate `Rc<RefCell>` MPSC), so "managed handles never cross
-  isolates" has no boundary to be enforced at yet — exactly why the spec gates it on
-  "the isolate model maturing first." Faking it (cooperative tasks sharing a heap)
-  would not be a real isolate boundary, so it is **not** implemented here.
-  The smallest *sound* slice and the full feasibility analysis are recorded in
-  [cross-isolate-design.md](cross-isolate-design.md): a static
-  `is_cross_isolate_safe(T)` payload rule (Copy/owned, no managed handles) + a
-  distinct `Mailbox<T>` surface over the cooperative scheduler (~1–2 weeks, holds
-  parity). True multi-thread/multi-heap isolates are a separate multi-quarter
-  refactor. Pick up when the mailbox surface is prioritized.
+- [~] **Cross-isolate message API (zero-copy transfer)** (§20.1-B, §20.2-3) —
+  _message contract landed; multi-isolate execution still future._ The reviewable
+  core — the **message payload contract** — is implemented: `Channel.message<T>`
+  creates a channel whose payload `T` is statically verified
+  **cross-isolate-transferable** (`is_cross_isolate_transferable`: a self-contained
+  value with no managed handle — v1 allows Copy scalars, `String`, `Bytes`),
+  rejecting managed/container payloads at check time (`RS0036`). It reuses the
+  bounded-channel runtime, so it runs today at VM↔compiled parity
+  (`parity_message_channel_roundtrip`) and is the forward-compatible transport for
+  real isolates: nothing crossing it ever shares mutable state. This realizes the
+  "message is the right choice for a solo isolate" decision — message semantics +
+  `take` move-in, no reference-capability machinery.
+  _Remaining (future):_ (a) broaden the payload contract to data-only structs/sums
+  and owned containers via deep-snapshot; (b) a structured isolate-spawn so two
+  isolates actually run with disjoint heaps. True multi-thread/multi-heap isolates
+  are a separate multi-quarter refactor. Full plan in
+  [cross-isolate-design.md](cross-isolate-design.md).
 
 ## Removed — non-goals (not deferred; deleted from the roadmap)
 

packages/async-runtime/rsspkg.lock

@@ -4,9 +4,9 @@ version = 1
 name = "rss-async-runtime"
 version = "0.1.0"
 source = "path+packages/async-runtime"
-checksum = "sha256:ef2db23f07d3b0d04a351db0503214732227add443067bff3c3b6355bb2cb7b9"
+checksum = "sha256:2483b7a760be54a48fdfab90a53bfda1514447fe59ceb1b18bb6964e829324f0"
 interface_hash = "sha256:36e6897d97ac40f70744171504605f1905c435cb09b5957a6dbd3b3f47852a13"
-review_hash = "sha256:bbd78c597740f5e9eb2c0ba82244e8d9ce9ef5e1522131eeb3e4efd1a541cc59"
+review_hash = "sha256:5583274ea0013bc488504659a062fdf99330af2a84a247fb2f5694bbe8f2d9b2"
 features = []
 
 [metadata]