refactor(tw): extract Tw_section.Encode.ownership; delete orphan tw_ownership_section.ml (#456)

## Summary

Establishes `lib/tw_section.{ml,mli}` as the canonical home for
typed-wasm custom-section wire encoders, sized to absorb proposal 0001's
two new sections (`typedwasm.regions`, `typedwasm.capabilities`) when
they land.

Net change: 6 files, +69 / −115 = **net −46 LOC**.

## What changes

| File | Change |
|---|---|
| `lib/tw_section.ml` | **New** — `Encode.ownership` (operates on
pre-byte-encoded triples, avoids type cycle with Codegen) |
| `lib/tw_section.mli` | **New** — public interface |
| `lib/dune` | `tw_section` added to modules list |
| `lib/codegen.ml` | `build_ownership_section` body replaced with 6-line
wrapper delegating to `Tw_section.Encode.ownership` (signature
unchanged, byte-equal output) |
| `lib/tw_verify.ml:213` | Stale doc comment fixed
(`Tw_ownership_section.build_section` → `Tw_section.Encode.ownership`) |
| `lib/tw_ownership_section.ml` | **Deleted** — was orphan, not in
`lib/dune`, no callers |

## Rationale

Filed as #444: prevent the 3-sections × 2-copies = 6-encoder fan-out
when proposal 0001
([typed-wasm#34](hyperpolymath/typed-wasm#34)
/ [typed-wasm#76](hyperpolymath/typed-wasm#76))
lands. Sharing the internal LE writers (`write_u32_le` / `write_u8`)
inside `Tw_section.Encode` means future `Encode.regions` /
`Encode.capabilities` land in one place rather than duplicating the
buffer plumbing.

## Out of scope (deliberately)

- **ADR-021 v2-emit flip** — `Tw_section.Encode.ownership` ships v1
unchanged. When cross-repo coordination unblocks the flip, it becomes a
localised change to this one module.
- **Tea_* hand-rolled fixtures** (`lib/tea_bridge.ml`,
`lib/tea_cs_bridge.ml`, `lib/tea_router.ml`) — these hard-code demo
bytes for tea demonstrations, separate concern from live producer-side
dedup. Can be migrated in a follow-up if/when the tea demos need
updating.
- **Decode side** — `tw_interface.ml` reads via
`Tw_verify.parse_ownership_section_payload` directly. No change needed;
`Tw_section.Decode` is not introduced because there's no current
duplicate to dedup. Can be added if proposal 0002's access-site codec
needs symmetric Decode plumbing.

## Test plan

- [x] `dune build` clean.
- [x] `dune runtest` 352/352 passing.
- [x] Byte-equality verified by the existing ownership round-trip tests
(`test/test_e2e.ml:1218 test_ownership_roundtrip`, `:1249
test_ownership_entry_count`, `:1268 test_ownership_v2_parse_roundtrip`,
`:1296 test_ownership_v2_unknown_version_empty`). Any byte divergence
would fail the round-trip.

## Type cycle avoidance

`Codegen → Tw_section → Codegen` would cycle if `Tw_section` referenced
`Codegen.ownership_kind`. Avoided by having `Encode.ownership` take
`(int * int list * int) list` — already-byte-encoded triples. Codegen
does the `ownership_kind → byte` mapping (via `ownership_kind_byte`)
before calling. Tw_section stays type-clean.

Refs #444
Refs hyperpolymath/typed-wasm#34
Refs hyperpolymath/typed-wasm#76

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: hyperpolymath

lib/codegen.ml

@@ -157,24 +157,12 @@ let ownership_kind_byte = function
         u8*  param_kind  (one per param, see kind encoding above)
         u8   return_kind *)
 let build_ownership_section (annots : (int * ownership_kind list * ownership_kind) list) : bytes =
-  if annots = [] then Bytes.empty
-  else
-    let buf = Buffer.create 64 in
-    let write_u32_le n =
-      Buffer.add_char buf (Char.chr  (n         land 0xff));
-      Buffer.add_char buf (Char.chr ((n lsr  8) land 0xff));
-      Buffer.add_char buf (Char.chr ((n lsr 16) land 0xff));
-      Buffer.add_char buf (Char.chr ((n lsr 24) land 0xff))
-    in
-    let write_u8 n = Buffer.add_char buf (Char.chr (n land 0xff)) in
-    write_u32_le (List.length annots);
-    List.iter (fun (func_idx, param_kinds, ret_kind) ->
-      write_u32_le func_idx;
-      write_u8 (List.length param_kinds);
-      List.iter (fun k -> write_u8 (ownership_kind_byte k)) param_kinds;
-      write_u8 (ownership_kind_byte ret_kind)
-    ) annots;
-    Buffer.to_bytes buf
+  Tw_section.Encode.ownership
+    (List.map (fun (func_idx, param_kinds, ret_kind) ->
+       (func_idx,
+        List.map ownership_kind_byte param_kinds,
+        ownership_kind_byte ret_kind))
+       annots)
 
 (** Map AffineScript type to WASM value type *)
 let type_to_wasm (ty : type_expr) : value_type result =

lib/dune

@@ -82,6 +82,7 @@
   token
   trait
   tw_interface
+  tw_section
   tw_verify
   typecheck
   types

lib/tw_ownership_section.ml

@@ -0,0 +1,25 @@
+(* SPDX-License-Identifier: MPL-2.0 *)
+(* SPDX-FileCopyrightText: 2026 hyperpolymath *)
+
+module Encode = struct
+  let write_u32_le buf n =
+    Buffer.add_char buf (Char.chr  (n         land 0xff));
+    Buffer.add_char buf (Char.chr ((n lsr  8) land 0xff));
+    Buffer.add_char buf (Char.chr ((n lsr 16) land 0xff));
+    Buffer.add_char buf (Char.chr ((n lsr 24) land 0xff))
+
+  let write_u8 buf n = Buffer.add_char buf (Char.chr (n land 0xff))
+
+  let ownership (annots : (int * int list * int) list) : bytes =
+    if annots = [] then Bytes.empty
+    else
+      let buf = Buffer.create 64 in
+      write_u32_le buf (List.length annots);
+      List.iter (fun (func_idx, param_kind_bytes, ret_kind_byte) ->
+        write_u32_le buf func_idx;
+        write_u8 buf (List.length param_kind_bytes);
+        List.iter (fun b -> write_u8 buf b) param_kind_bytes;
+        write_u8 buf ret_kind_byte
+      ) annots;
+      Buffer.to_bytes buf
+end

lib/tw_section.ml

@@ -0,0 +1,36 @@
+(* SPDX-License-Identifier: MPL-2.0 *)
+(* SPDX-FileCopyrightText: 2026 hyperpolymath *)
+
+(** Canonical home for typed-wasm custom-section encoders.
+
+    Wire encoders operate on pre-byte-encoded triples to keep this
+    module free of any dependency on producer-side ownership types
+    (avoiding a cycle with [Codegen]). Callers map their domain
+    types to bytes before invoking.
+
+    Forward-compatibility slot for typed-wasm proposal 0001 (issue
+    hyperpolymath/typed-wasm#34): [Encode.regions] and
+    [Encode.capabilities] land here when the proposal promotes to
+    [accepted]. Sharing the internal LE writers (u8 / u32le / leb128)
+    inside this module prevents the 3-sections × 2-copies = 6-encoder
+    fan-out flagged by hyperpolymath/affinescript#444. *)
+
+module Encode : sig
+  (** v1 wire format for [typedwasm.ownership]:
+        u32le  entry_count
+        per entry:
+          u32le  func_index
+          u8     param_count
+          u8*    param_kind  (one per param)
+          u8     return_kind
+
+      Caller responsibilities:
+      - Map domain ownership type → byte before calling
+        (see [Codegen.ownership_kind_byte]).
+      - Empty input → [Bytes.empty]; caller omits the section.
+
+      Producer-emit is v1 per ADR-021. Parser-side v2 support lives in
+      [Tw_verify.parse_ownership_section_payload]; emit-side flip is
+      cross-repo-coordinated, not local to this function. *)
+  val ownership : (int * int list * int) list -> bytes
+end

lib/tw_section.mli

@@ -210,7 +210,7 @@ let verify_module
 
     Per ADR-021's coordinated landing protocol, this verifier ships
     parse-support FIRST.  AffineScript's emitter ([Codegen.build_ownership_
-    section] / [Tw_ownership_section.build_section]) stays on v1 until
+    section] / [Tw_section.Encode.ownership]) stays on v1 until
     [hyperpolymath/typed-wasm]'s Rust verifier + [hyperpolymath/ephapax]'s
     OCaml verifier also ship parse-support; then all producers flip to v2
     emit together.  See [docs/specs/TYPED-WASM-COORDINATION-LEDGER.adoc]