konjure_lang/

runtime.rs

//! Persistent, ordered ECS execution with atomic ticks and action calls.
use crate::ast::*;
use crate::data::{self, AxisIndex, DType, Scalar, Tensor};
use crate::native::{
    NativeRegistry, is_builtin, monomorphic_signature, valid_builtin_specialization,
};
use crate::program::{MAIN, Program};
use crate::value::*;
use serde::{Deserialize, Serialize};
use std::collections::{BTreeMap, BTreeSet};

/// Resource bounds apply to each initialization, invocation, and tick.
#[derive(Clone, Debug, Serialize, Deserialize)]
#[serde(default)]
pub struct Limits {
    /// Maximum expression, statement, call, and loop steps per transaction.
    pub fuel_per_operation: usize,
    /// Maximum simultaneous function and constructor calls.
    pub max_call_depth: usize,
    /// Maximum live ECS entities.
    pub max_entities: usize,
    /// Maximum retained log entries; older entries are evicted.
    pub max_logs: usize,
    /// Maximum retained execution trace entries; older entries are evicted.
    pub max_trace: usize,
    /// Maximum list elements or record fields in one value.
    pub max_collection: usize,
    /// Maximum UTF-8 bytes in a string or rendered log entry.
    pub max_string_bytes: usize,
    /// Maximum nested runtime values and expression evaluation depth.
    pub max_value_depth: usize,
    /// Maximum total scalar/container nodes and initialized lifecycle memberships.
    pub max_stored_values: usize,
    /// Conservative payload/container bytes allowed in persistent globals and components.
    pub max_storage_bytes: usize,
    /// Conservative bytes of produced or cloned values across one operation.
    /// This also bounds temporary locals and arguments before they reach persistent state.
    pub max_allocation_bytes: usize,
}
impl Default for Limits {
    fn default() -> Self {
        Self {
            fuel_per_operation: 100_000,
            max_call_depth: 64,
            max_entities: 2048,
            max_logs: 256,
            max_trace: 2048,
            max_collection: 4096,
            max_string_bytes: 65536,
            max_value_depth: 64,
            max_stored_values: 100_000,
            max_storage_bytes: 8 * 1024 * 1024,
            max_allocation_bytes: 32 * 1024 * 1024,
        }
    }
}
/// One stable entity with at most one component of each nominal class.
#[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
pub struct EntitySnapshot {
    /// Stable creation-order entity ID; IDs are never reused.
    #[cfg_attr(feature = "typescript", ts(type = "number"))]
    pub id: u64,
    /// One value per nominal component class, sorted by class key.
    pub components: BTreeMap<String, Value>,
    /// Source span of the spawn call that created this entity.
    pub source: Span,
}
/// A bounded chronological execution record, linked to the exact source expression.
#[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
pub struct TraceEntry {
    /// Executed expression or statement source range.
    pub span: Span,
    /// Execution operation, such as statement, call, system, or spawn.
    pub event: String,
    /// Current system or action entity, if execution has one.
    #[cfg_attr(feature = "typescript", ts(type = "number | null"))]
    pub entity: Option<u64>,
}
/// Immutable inspection output. All maps and entity queries use stable ordering.
#[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
pub struct Snapshot {
    /// Whether final lifecycle callbacks have completed; finished machines are immutable.
    pub finished: bool,
    /// Number of accepted simulation ticks.
    #[cfg_attr(feature = "typescript", ts(type = "number"))]
    pub tick: u64,
    /// Accumulated accepted tick durations in seconds.
    pub time: f64,
    /// Owned global values; imported-module bindings use qualified keys.
    pub globals: BTreeMap<String, Value>,
    /// Live entities in ascending ID order.
    pub entities: Vec<EntitySnapshot>,
    /// Recent print output in chronological order; no external I/O is performed.
    pub logs: Vec<String>,
    /// Recent source-linked operations from the accepted transaction.
    pub trace: Vec<TraceEntry>,
}
#[derive(Clone)]
struct Binding {
    value: Value,
    ty: Type,
    module: String,
    mutable: bool,
}
#[derive(Clone, Default)]
struct State {
    finished: bool,
    // Membership is checkpointed with values so failed callbacks never consume init/done.
    initialized: BTreeSet<(usize, u64, Vec<String>)>,
    initialized_bytes: usize,
    pending_despawns: BTreeSet<u64>,
    tick: u64,
    time: f64,
    next_id: u64,
    globals: BTreeMap<String, Binding>,
    entities: BTreeMap<u64, EntitySnapshot>,
    logs: Vec<String>,
    trace: Vec<TraceEntry>,
}
/// A linked program and its persistent state. Clone creates an independent checkpoint.
#[derive(Clone)]
pub struct Machine {
    program: Program,
    registry: NativeRegistry,
    limits: Limits,
    state: State,
}
impl Machine {
    /// Initialize supplied modules once in dependency order, then the main module.
    /// # Errors
    /// Rejects invalid initializers or resource limits without creating a machine.
    pub fn new(program: Program, limits: Limits) -> Result<Self, Diagnostic> {
        Self::with_registry(program, limits, NativeRegistry::default())
    }
    /// Construct with explicitly registered pure host operations.
    ///
    /// # Errors
    /// Returns initializer/type/resource diagnostics exactly as [`Self::new`].
    pub fn with_registry(
        program: Program,
        limits: Limits,
        registry: NativeRegistry,
    ) -> Result<Self, Diagnostic> {
        if program.native_signatures != registry.signatures() {
            return Err(Diagnostic::new(
                "native_registry_mismatch",
                "machine native signatures must match the registry used to compile the program",
                Span::new(MAIN, 0, 0),
            ));
        }
        let mut machine = Self {
            program,
            limits,
            registry,
            state: State {
                next_id: 1,
                ..State::default()
            },
        };
        let mut evaluator = Evaluator::new(
            &machine.program,
            &machine.registry,
            &machine.limits,
            &mut machine.state,
        );
        for module in &machine.program.order {
            let mut env = Env::default();
            for statement in &machine.program.modules[module].statements {
                let result = evaluator
                    .statement(statement, module, &mut env, true)
                    .map_err(|error| evaluator.host_propagation(error));
                if !matches!(result?, Flow::Next) {
                    return Err(Diagnostic::new(
                        "invalid_control",
                        "ret/break/continue are not allowed at module scope",
                        statement.span.clone(),
                    ));
                }
            }
        }
        evaluator.flush_despawns()?;
        evaluator.check_storage(&Span::new(MAIN, 0, 0))?;
        Ok(machine)
    }
    /// A read-only projection of the accepted state.
    pub fn snapshot(&self) -> Snapshot {
        Snapshot {
            finished: self.state.finished,
            tick: self.state.tick,
            time: self.state.time,
            globals: self
                .state
                .globals
                .iter()
                .map(|(k, b)| (k.clone(), b.value.clone()))
                .collect(),
            entities: self.state.entities.values().cloned().collect(),
            logs: self.state.logs.clone(),
            trace: self.state.trace.clone(),
        }
    }

    /// Returns the current fixed tick and terminal lifecycle state without
    /// cloning entities, logs, traces, or component values.
    #[must_use]
    pub const fn execution_state(&self) -> (u64, bool) {
        (self.state.tick, self.state.finished)
    }
    /// The immutable linked program that defines this machine.
    pub fn program(&self) -> &Program {
        &self.program
    }
    /// The resource limits applied to every accepted transaction.
    pub fn limits(&self) -> &Limits {
        &self.limits
    }
    /// Run all systems in linked source order. A system visits its starting query
    /// in ascending entity-ID order. Spawns are visible to subsequent systems.
    /// New tuples run `init` immediately before their first `frame`. A despawn
    /// request takes effect after the current callback writes its bindings back;
    /// initialized tuples then run `done` before the entity is deleted.
    /// # Errors
    /// Any error rolls back the complete tick, including logs and entity IDs.
    pub fn tick(&mut self, dt: f64) -> Result<Snapshot, Diagnostic> {
        self.ensure_running()?;
        let span = Span::new(MAIN, 0, 0);
        if !dt.is_finite() || dt <= 0.0 {
            return Err(Diagnostic::new(
                "invalid_timestep",
                "dt must be finite and positive",
                span,
            ));
        }
        let mut state = self.state.clone();
        state.trace.clear();
        state.time += dt;
        if !state.time.is_finite() {
            return Err(Diagnostic::new(
                "numeric_overflow",
                "simulation time overflow",
                span,
            ));
        }
        state.tick = state.tick.checked_add(1).ok_or_else(|| {
            Diagnostic::new("tick_overflow", "tick counter exhausted", span.clone())
        })?;
        let mut evaluator = Evaluator::new(&self.program, &self.registry, &self.limits, &mut state);
        for (index, (module, system)) in self.program.systems.iter().enumerate() {
            evaluator.consume(&system.span)?;
            let selectors = system
                .bindings
                .iter()
                .map(|binding| {
                    let Type::Named(name) = &binding.ty else {
                        unreachable!("checked system query")
                    };
                    self.program.query_classes(module, name, &binding.span)
                })
                .collect::<Result<Vec<_>, _>>()?;
            let mut targets = Vec::new();
            let entity_ids: Vec<_> = evaluator.state.entities.keys().copied().collect();
            for id in entity_ids {
                evaluator.consume(&system.span)?;
                let entity = &evaluator.state.entities[&id];
                if selectors.len() == 1 {
                    for key in &selectors[0] {
                        if entity.components.contains_key(key) {
                            targets.push((id, vec![key.clone()]));
                        }
                    }
                } else {
                    let keys: Vec<_> = selectors.iter().map(|keys| keys[0].clone()).collect();
                    if keys.iter().all(|key| entity.components.contains_key(key)) {
                        targets.push((id, keys));
                    }
                }
            }
            for (id, keys) in targets {
                if !evaluator.state.entities.contains_key(&id)
                    || evaluator.state.pending_despawns.contains(&id)
                {
                    continue;
                }
                if evaluator.initialize_membership(index, id, &keys, &system.span)? {
                    evaluator.system_callback(index, id, &keys, "init", dt)?;
                    evaluator.flush_despawns()?;
                }
                if !evaluator.state.entities.contains_key(&id) {
                    continue;
                }
                evaluator.system_callback(index, id, &keys, "frame", dt)?;
                evaluator.flush_despawns()?;
            }
        }
        evaluator.check_storage(&span)?;
        self.state = state;
        Ok(self.snapshot())
    }
    /// Complete initialized system memberships in system/entity/component order.
    /// Repeated calls return the same snapshot. No callback runs for an unvisited tuple.
    /// # Errors
    /// A failed callback rolls back all cleanup and keeps the machine running.
    pub fn finish(&mut self) -> Result<Snapshot, Diagnostic> {
        if self.state.finished {
            return Ok(self.snapshot());
        }
        let mut state = self.state.clone();
        state.trace.clear();
        let mut evaluator = Evaluator::new(&self.program, &self.registry, &self.limits, &mut state);
        while let Some((index, id, keys)) = evaluator.state.initialized.pop_first() {
            evaluator.state.initialized_bytes -= membership_bytes(&keys);
            evaluator.system_callback(index, id, &keys, "done", 0.0)?;
            evaluator.flush_despawns()?;
        }
        evaluator.check_storage(&Span::new(MAIN, 0, 0))?;
        state.finished = true;
        self.state = state;
        Ok(self.snapshot())
    }
    fn ensure_running(&self) -> Result<(), Diagnostic> {
        if self.state.finished {
            Err(Diagnostic::new(
                "machine_finished",
                "finished machines cannot accept state changes; create a new machine to restart",
                Span::new(MAIN, 0, 0),
            ))
        } else {
            Ok(())
        }
    }
    /// Invoke a main or explicitly imported/exported function transactionally.
    /// This is the shared action entry for UI controls, tests, and agent adapters.
    ///
    /// # Errors
    /// Rejects inaccessible/unknown names, invalid arguments or execution, and
    /// exhausted budgets. The previously accepted state remains unchanged.
    pub fn invoke(&mut self, name: &str, arguments: Vec<Value>) -> Result<Value, Diagnostic> {
        self.ensure_running()?;
        let mut state = self.state.clone();
        state.trace.clear();
        let mut evaluator = Evaluator::new(&self.program, &self.registry, &self.limits, &mut state);
        let span = self.program.modules[MAIN]
            .functions
            .get(name)
            .map(|f| f.span.clone())
            .unwrap_or_else(|| Span::new(MAIN, 0, 0));
        for value in &arguments {
            evaluator.validate_external_value(value, &span)?;
        }
        let value = evaluator.call_name(name, arguments, MAIN, &span)?;
        evaluator.flush_despawns()?;
        evaluator.check_storage(&span)?;
        self.state = state;
        Ok(value)
    }
    /// Invoke the typed function stored in an exact component field. The host
    /// supplies no function identity; private callbacks retained by the program
    /// remain callable. Lookup, execution, logs and world edits commit together.
    ///
    /// # Errors
    /// Rejects missing entity/component/field, non-callable fields, mismatched
    /// arguments and exhausted budgets, preserving the accepted state.
    pub fn invoke_component(
        &mut self,
        id: u64,
        component: &str,
        field: &str,
        arguments: Vec<Value>,
    ) -> Result<Value, Diagnostic> {
        self.ensure_running()?;
        let span = Span::new(MAIN, 0, 0);
        let mut state = self.state.clone();
        state.trace.clear();
        let mut evaluator = Evaluator::new(&self.program, &self.registry, &self.limits, &mut state);
        let value = evaluator.component_value(id, component, &span)?;
        let callback = value.field(field).cloned().ok_or_else(|| {
            evaluator.error(
                "unknown_field",
                format!("{component} has no field `{field}`"),
                &span,
            )
        })?;
        for value in &arguments {
            evaluator.validate_external_value(value, &span)?;
        }
        let result = evaluator.call_value(callback, arguments, &span)?;
        evaluator.flush_despawns()?;
        evaluator.check_storage(&span)?;
        self.state = state;
        Ok(result)
    }
    /// Dispatch a method on exactly one component. Multiple matching components
    /// are ambiguous and rejected; mutation and logs commit together on success.
    ///
    /// # Errors
    /// Rejects missing/ambiguous methods, invalid arguments, conflicting component
    /// writes, and execution limits without changing accepted state.
    pub fn invoke_entity(
        &mut self,
        id: u64,
        name: &str,
        arguments: Vec<Value>,
    ) -> Result<Value, Diagnostic> {
        self.ensure_running()?;
        let span = Span::new(MAIN, 0, 0);
        let entity = self.state.entities.get(&id).ok_or_else(|| {
            Diagnostic::new(
                "unknown_entity",
                format!("entity {id} does not exist"),
                span.clone(),
            )
        })?;
        let matches: Vec<_> = entity
            .components
            .iter()
            .filter_map(|(key, value)| {
                self.program
                    .methods
                    .get(key)
                    .and_then(|m| m.get(name))
                    .map(|f| (key.clone(), value.clone(), f.clone()))
            })
            .collect();
        let [(key, original, function)] = matches.as_slice() else {
            return Err(Diagnostic::new(
                if matches.is_empty() {
                    "unknown_method"
                } else {
                    "ambiguous_method"
                },
                format!(
                    "entity {id} has {} components implementing `{name}`; exactly one is required",
                    matches.len()
                ),
                span,
            ));
        };
        let mut state = self.state.clone();
        state.trace.clear();
        let mut evaluator = Evaluator::new(&self.program, &self.registry, &self.limits, &mut state);
        evaluator.entity = Some(id);
        for value in &arguments {
            evaluator.validate_external_value(value, &function.span)?;
        }
        let (result, updated) = evaluator.function(
            function,
            arguments,
            &function.span.module,
            Some(original.clone()),
            &function.span,
        )?;
        if let Some(updated) = updated
            && let Some(entity) = evaluator.state.entities.get_mut(&id)
            && let Some(current) = entity.components.get(key)
        {
            if current != original && updated != *original && current != &updated {
                return Err(Diagnostic::new(
                    "conflicting_component_write",
                    "method changed self and explicitly set the same component",
                    function.span.clone(),
                ));
            }
            if updated != *original {
                entity.components.insert(key.clone(), updated);
            }
        }
        evaluator.flush_despawns()?;
        evaluator.check_storage(&function.span)?;
        self.state = state;
        Ok(result)
    }
    /// Atomically attach or replace validated components from an explicit host
    /// adapter. Existing entity identity and spawn source are preserved.
    ///
    /// # Errors
    /// Rejects unknown entities, malformed records, and storage limit violations.
    pub fn upsert_components(&mut self, patches: &[(u64, Value)]) -> Result<(), Diagnostic> {
        self.ensure_running()?;
        let mut candidate = self.state.clone();
        let evaluator = Evaluator::new(&self.program, &self.registry, &self.limits, &mut candidate);
        for (_, value) in patches {
            evaluator.validate_external_value(value, &Span::new(MAIN, 0, 0))?;
        }
        self.upsert_components_for_adapter(patches)
    }
    pub(crate) fn upsert_components_for_adapter(
        &mut self,
        patches: &[(u64, Value)],
    ) -> Result<(), Diagnostic> {
        let mut state = self.state.clone();
        let span = Span::new("host", 0, 0);
        let mut evaluator = Evaluator::new(&self.program, &self.registry, &self.limits, &mut state);
        for (id, value) in patches {
            let add = evaluator
                .state
                .entities
                .get(id)
                .is_some_and(|e| !e.components.contains_key(value.type_name()));
            evaluator.set_component(*id, value.clone(), add, &span)?;
        }
        evaluator.check_storage(&span)?;
        self.state = state;
        Ok(())
    }
    /// Atomically replace existing components from a host adapter (for example,
    /// a physics solver). Class fields and all storage limits are revalidated.
    ///
    /// # Errors
    /// Rejects missing entities/components, malformed records, and storage limits;
    /// either the complete patch is accepted or none of it is applied.
    pub fn patch_components(&mut self, patches: &[(u64, Value)]) -> Result<(), Diagnostic> {
        self.ensure_running()?;
        let mut candidate = self.state.clone();
        let evaluator = Evaluator::new(&self.program, &self.registry, &self.limits, &mut candidate);
        for (_, value) in patches {
            evaluator.validate_external_value(value, &Span::new(MAIN, 0, 0))?;
        }
        self.patch_components_for_adapter(patches)
    }
    pub(crate) fn patch_components_for_adapter(
        &mut self,
        patches: &[(u64, Value)],
    ) -> Result<(), Diagnostic> {
        let mut state = self.state.clone();
        let mut evaluator = Evaluator::new(&self.program, &self.registry, &self.limits, &mut state);
        let span = Span::new("host", 0, 0);
        for (id, value) in patches {
            evaluator.set_component(*id, value.clone(), false, &span)?;
        }
        evaluator.check_storage(&span)?;
        self.state = state;
        Ok(())
    }
    /// Roll back this machine when a composed operation fails.
    ///
    /// # Errors
    /// Propagates the closure diagnostic without replacing this machine. The
    /// closure must include any adapter state in its own transaction; this method
    /// cannot undo external I/O, global Rust state, or effects on other objects.
    pub fn transaction<T>(
        &mut self,
        operation: impl FnOnce(&mut Self) -> Result<T, Diagnostic>,
    ) -> Result<T, Diagnostic> {
        let mut candidate = self.clone();
        let result = operation(&mut candidate)?;
        *self = candidate;
        Ok(result)
    }
}
#[derive(Clone)]
struct Env {
    scopes: Vec<BTreeMap<String, Binding>>,
}
impl Default for Env {
    fn default() -> Self {
        Self {
            scopes: vec![BTreeMap::new()],
        }
    }
}
impl Env {
    fn bind(&mut self, name: &str, value: Value, mutable: bool, module: &str) {
        let ty = infer_type(&value);
        self.scopes.last_mut().expect("scope exists").insert(
            name.into(),
            Binding {
                value,
                ty,
                module: module.into(),
                mutable,
            },
        );
    }
    fn get(&self, name: &str) -> Option<&Binding> {
        self.scopes.iter().rev().find_map(|s| s.get(name))
    }
    fn get_mut(&mut self, name: &str) -> Option<&mut Binding> {
        self.scopes.iter_mut().rev().find_map(|s| s.get_mut(name))
    }
}
fn expression_path(expr: &Expr) -> Option<String> {
    match &expr.kind {
        ExprKind::Name(n) => Some(n.clone()),
        ExprKind::Field { object, field } => {
            Some(format!("{}.{}", expression_path(object)?, field))
        }
        _ => None,
    }
}
fn value_bytes(value: &Value) -> usize {
    let base = std::mem::size_of::<Value>();
    match value {
        Value::Enum(value) => value.payload.iter().fold(
            base.saturating_add(type_bytes(&value.ty))
                .saturating_add(value.case.len())
                .saturating_add(value.origin.as_ref().map_or(0, |origin| {
                    std::mem::size_of::<Span>().saturating_add(origin.module.len())
                })),
            |size, value| size.saturating_add(value_bytes(value)),
        ),
        Value::Text(s) => base.saturating_add(s.len()),
        Value::Bin(b) => base.saturating_add(b.byte_len()),
        Value::Tensor(t) => base
            .saturating_add(t.storage_byte_len())
            .saturating_add(t.shape().len().saturating_mul(16)),
        Value::ComponentReference(reference) => base.saturating_add(reference.class.len()),
        Value::Function(function) => {
            let target = match &function.target {
                FunctionTarget::DataMethod {
                    receiver_type,
                    method,
                    type_argument,
                    receiver,
                } => type_bytes(receiver_type)
                    .saturating_add(method.len())
                    .saturating_add(type_argument.as_deref().map_or(0, type_bytes))
                    .saturating_add(value_bytes(receiver)),
                FunctionTarget::EnumConstructor { ty, case } => {
                    type_bytes(ty).saturating_add(case.len())
                }
                FunctionTarget::Named { module, name } => module.len().saturating_add(name.len()),
                FunctionTarget::Native { name } => name.len(),
                FunctionTarget::Builtin {
                    name,
                    type_argument,
                } => name
                    .len()
                    .saturating_add(type_argument.as_deref().map_or(0, type_bytes)),
                FunctionTarget::BoundMethod {
                    class,
                    method,
                    receiver,
                } => class
                    .len()
                    .saturating_add(method.len())
                    .saturating_add(value_bytes(receiver)),
                FunctionTarget::EntityMethod { class, method, .. } => {
                    class.len().saturating_add(method.len())
                }
            };
            base.saturating_add(target)
                .saturating_add(type_bytes(&function.signature))
        }
        Value::List(values) => values
            .iter()
            .fold(base, |n, v| n.saturating_add(value_bytes(v))),
        Value::Record(record) => {
            record
                .fields
                .iter()
                .fold(base.saturating_add(record.class.len()), |n, (k, v)| {
                    n.saturating_add(k.len() + 64)
                        .saturating_add(value_bytes(v))
                })
        }
        _ => base,
    }
}
fn type_bytes(ty: &Type) -> usize {
    let base = std::mem::size_of::<Type>();
    match ty {
        Type::Applied { name, arguments } => arguments
            .iter()
            .fold(base.saturating_add(name.len()), |size, ty| {
                size.saturating_add(type_bytes(ty))
            }),
        Type::Named(name) => base.saturating_add(name.len()),
        Type::List(inner) | Type::Tensor(inner) | Type::ComponentReference(inner) => {
            base.saturating_add(type_bytes(inner))
        }
        Type::Function {
            parameters,
            returns,
        } => parameters
            .iter()
            .fold(base.saturating_add(type_bytes(returns)), |size, ty| {
                size.saturating_add(type_bytes(ty))
            }),
    }
}
fn membership_bytes(keys: &[String]) -> usize {
    keys.iter()
        .fold(96usize, |total, key| total.saturating_add(key.len() + 32))
}
fn canonical_type_scope(ty: &Type) -> &str {
    match ty {
        Type::List(inner) | Type::Tensor(inner) | Type::ComponentReference(inner) => {
            canonical_type_scope(inner)
        }
        Type::Function { .. } | Type::Applied { .. } => MAIN,
        Type::Named(name) => name.rsplit_once('.').map_or(MAIN, |(module, _)| module),
    }
}
fn infer_type(value: &Value) -> Type {
    match value {
        Value::Enum(value) => value.ty.clone(),
        Value::Tensor(t) => data::tensor_type(Type::named(data::dtype_name(t.dtype()))),
        Value::List(v) => Type::List(Box::new(
            v.first()
                .map(infer_type)
                .unwrap_or_else(|| Type::named("Any")),
        )),
        Value::Function(function) => function.signature.clone(),
        Value::ComponentReference(reference) => {
            Type::ComponentReference(Box::new(Type::named(&reference.class)))
        }
        _ => Type::named(value.type_name()),
    }
}
enum Flow {
    Next,
    Return(Value),
    Break,
    Continue,
}
struct Evaluator<'a> {
    program: &'a Program,
    registry: &'a NativeRegistry,
    limits: &'a Limits,
    state: &'a mut State,
    fuel: usize,
    depth: usize,
    expression_depth: usize,
    allocated_bytes: usize,
    entity: Option<u64>,
    // A private nonlocal-return slot. The sentinel diagnostic only unwinds Rust
    // evaluation frames; a checked function boundary consumes it as ordinary data.
    propagated: Option<Value>,
}
impl<'a> Evaluator<'a> {
    fn new(
        program: &'a Program,
        registry: &'a NativeRegistry,
        limits: &'a Limits,
        state: &'a mut State,
    ) -> Self {
        Self {
            propagated: None,
            program,
            registry,
            limits,
            state,
            fuel: limits.fuel_per_operation,
            depth: 0,
            expression_depth: 0,
            allocated_bytes: 0,
            entity: None,
        }
    }
    fn initialize_membership(
        &mut self,
        index: usize,
        id: u64,
        keys: &[String],
        span: &Span,
    ) -> Result<bool, Diagnostic> {
        let membership = (index, id, keys.to_vec());
        if self.state.initialized.contains(&membership) {
            return Ok(false);
        }
        let bytes = self
            .state
            .initialized_bytes
            .saturating_add(membership_bytes(keys));
        if self.state.initialized.len() >= self.limits.max_stored_values
            || bytes > self.limits.max_storage_bytes
        {
            return Err(self.error(
                "storage_limit",
                "system lifecycle membership exceeds storage budget",
                span,
            ));
        }
        self.state.initialized.insert(membership);
        self.state.initialized_bytes = bytes;
        Ok(true)
    }
    fn system_callback(
        &mut self,
        index: usize,
        id: u64,
        keys: &[String],
        name: &str,
        dt: f64,
    ) -> Result<(), Diagnostic> {
        let (module, system) = &self.program.systems[index];
        let Some(callback) = system
            .callbacks
            .iter()
            .find(|callback| callback.name == name)
        else {
            return Ok(());
        };
        self.consume(&callback.span)?;
        let Some(entity) = self.state.entities.get(&id) else {
            return Ok(());
        };
        let mut originals = Vec::new();
        let mut env = Env::default();
        for (binding, key) in system.bindings.iter().zip(keys) {
            let Some(value) = entity.components.get(key).cloned() else {
                return Ok(());
            };
            originals.push(value.clone());
            // The selected concrete class is the value identity even for a trait query.
            let class_module = self
                .program
                .class_by_key(key)
                .map(|(m, _)| m)
                .ok_or_else(|| {
                    self.error(
                        "unknown_class",
                        "query component has no declaration",
                        &binding.span,
                    )
                })?;
            env.scopes[0].insert(
                binding.name.clone(),
                Binding {
                    value,
                    ty: Type::named(key.clone()),
                    module: class_module.into(),
                    mutable: true,
                },
            );
        }
        env.bind("entity", Value::Entity(id), false, module);
        env.bind("time", Value::Number(self.state.time), false, module);
        env.bind("tick", Value::Number(self.state.tick as f64), false, module);
        if let Some(parameter) = callback.parameters.first() {
            env.bind(&parameter.name, Value::Number(dt), false, module);
        }
        let previous_entity = self.entity.replace(id);
        self.record(&callback.span, format!("system {}.{name}", system.name));
        if self.depth >= self.limits.max_call_depth {
            return Err(self.error(
                "call_depth",
                "lifecycle callback exceeds call-depth limit",
                &callback.span,
            ));
        }
        self.depth += 1;
        let result = self.block(&callback.body, module, &mut env);
        self.depth -= 1;
        self.entity = previous_entity;
        let result = result.map_err(|error| self.host_propagation(error));
        match result? {
            Flow::Next | Flow::Return(Value::Unit) => {}
            Flow::Return(value) => self.accept_lifecycle_result(value, &callback.span)?,
            _ => {
                return Err(self.error(
                    "invalid_control",
                    "system callback must return Unit",
                    &callback.span,
                ));
            }
        }
        for ((binding, key), original) in system.bindings.iter().zip(keys).zip(originals) {
            let updated = &env.scopes[0][&binding.name].value;
            if let Some(entity) = self.state.entities.get_mut(&id)
                && let Some(current) = entity.components.get(key)
            {
                if current != &original && updated != &original && current != updated {
                    return Err(self.error(
                        "conflicting_component_write",
                        "callback changed a bound component and explicitly set the same component",
                        &callback.span,
                    ));
                }
                if updated != &original {
                    entity.components.insert(key.clone(), updated.clone());
                }
            }
        }
        Ok(())
    }
    // Despawn is deferred until the enclosing callback/action has written its bound values
    // back. Cleanup therefore observes the latest component state, and can fail atomically.
    fn flush_despawns(&mut self) -> Result<(), Diagnostic> {
        while let Some(id) = self.state.pending_despawns.pop_first() {
            let memberships: Vec<_> = self
                .state
                .initialized
                .iter()
                .filter(|(_, member_id, _)| *member_id == id)
                .cloned()
                .collect();
            for (index, member_id, keys) in memberships {
                // Remove before entering user cleanup, preventing repeated done on recursion.
                if self
                    .state
                    .initialized
                    .remove(&(index, member_id, keys.clone()))
                {
                    self.state.initialized_bytes -= membership_bytes(&keys);
                }
                self.system_callback(index, id, &keys, "done", 0.0)?;
            }
            self.state.entities.remove(&id);
            self.state.pending_despawns.remove(&id);
        }
        Ok(())
    }
    fn error(&self, code: &str, message: impl Into<String>, span: &Span) -> Diagnostic {
        Diagnostic::new(code, message, span.clone())
    }
    fn consume(&mut self, span: &Span) -> Result<(), Diagnostic> {
        if self.fuel == 0 {
            return Err(self.error(
                "fuel_exhausted",
                "execution exceeded its instruction budget",
                span,
            ));
        }
        self.fuel -= 1;
        Ok(())
    }
    fn record(&mut self, span: &Span, event: String) {
        if self.limits.max_trace == 0 {
            return;
        }
        if self.state.trace.len() >= self.limits.max_trace {
            self.state.trace.remove(0);
        }
        self.state.trace.push(TraceEntry {
            span: span.clone(),
            event,
            entity: self.entity,
        });
    }
    fn check_value(&self, value: &Value, span: &Span) -> Result<usize, Diagnostic> {
        fn visit(v: &Value, depth: usize, limits: &Limits) -> Result<usize, &'static str> {
            if depth > limits.max_value_depth {
                return Err("value nesting limit exceeded");
            }
            match v {
                Value::Enum(value) => {
                    if value
                        .origin
                        .as_ref()
                        .is_some_and(|origin| origin.module.len() > limits.max_string_bytes)
                    {
                        return Err("enum origin size limit exceeded");
                    }
                    let mut pending = vec![(&value.ty, depth + 1)];
                    let mut count = 1;
                    while let Some((ty, level)) = pending.pop() {
                        if level > limits.max_value_depth {
                            return Err("enum type nesting limit exceeded");
                        }
                        count += 1;
                        match ty {
                            Type::Applied { name, arguments } => {
                                if name.len() > limits.max_string_bytes
                                    || arguments.len() > limits.max_collection
                                {
                                    return Err("enum type size limit exceeded");
                                }
                                pending.extend(arguments.iter().map(|ty| (ty, level + 1)));
                            }
                            Type::Named(name) => {
                                if name.len() > limits.max_string_bytes {
                                    return Err("enum type name limit exceeded");
                                }
                            }
                            Type::List(inner)
                            | Type::Tensor(inner)
                            | Type::ComponentReference(inner) => pending.push((inner, level + 1)),
                            Type::Function {
                                parameters,
                                returns,
                            } => {
                                if parameters.len() > limits.max_collection {
                                    return Err("function arity limit exceeded");
                                }
                                pending.push((returns, level + 1));
                                pending.extend(parameters.iter().map(|ty| (ty, level + 1)));
                            }
                        }
                        if count > limits.max_stored_values {
                            return Err("enum type size limit exceeded");
                        }
                    }
                    if value.payload.len() > limits.max_collection
                        || value.case.len() > limits.max_string_bytes
                    {
                        return Err("enum payload limit exceeded");
                    }
                    for item in &value.payload {
                        count += visit(item, depth + 1, limits)?;
                        if count > limits.max_stored_values {
                            return Err("enum value limit exceeded");
                        }
                    }
                    Ok(count)
                }
                Value::Number(n) if !n.is_finite() => Err("numbers must be finite"),
                Value::Text(s) if s.len() > limits.max_string_bytes => {
                    Err("string byte limit exceeded")
                }
                Value::Bin(b) if b.byte_len() > limits.max_storage_bytes => {
                    Err("binary byte limit exceeded")
                }
                Value::Tensor(t)
                    if t.storage_byte_len() > limits.max_storage_bytes
                        || t.shape().len() > limits.max_value_depth =>
                {
                    Err("tensor byte or rank limit exceeded")
                }
                Value::Function(function) => {
                    fn check_type(
                        ty: &Type,
                        depth: usize,
                        limits: &Limits,
                    ) -> Result<usize, &'static str> {
                        if depth > limits.max_value_depth {
                            return Err("function type nesting limit exceeded");
                        }
                        match ty {
                            Type::Applied { name, arguments } => {
                                if name.len() > limits.max_string_bytes
                                    || arguments.len() > limits.max_collection
                                {
                                    return Err("applied type size limit exceeded");
                                }
                                let mut count = 1;
                                for ty in arguments {
                                    count += check_type(ty, depth + 1, limits)?;
                                }
                                Ok(count)
                            }
                            Type::Named(name) => {
                                if name.len() > limits.max_string_bytes {
                                    return Err("type name byte limit exceeded");
                                }
                                Ok(1)
                            }
                            Type::List(inner)
                            | Type::Tensor(inner)
                            | Type::ComponentReference(inner) => {
                                Ok(1 + check_type(inner, depth + 1, limits)?)
                            }
                            Type::Function {
                                parameters,
                                returns,
                            } => {
                                if parameters.len() > limits.max_collection {
                                    return Err("function arity limit exceeded");
                                }
                                let mut count = 1 + check_type(returns, depth + 1, limits)?;
                                for ty in parameters {
                                    count += check_type(ty, depth + 1, limits)?;
                                }
                                Ok(count)
                            }
                        }
                    }
                    let mut count = check_type(&function.signature, depth + 1, limits)?;
                    if let FunctionTarget::Builtin {
                        type_argument: Some(ty),
                        ..
                    } = &function.target
                    {
                        count += check_type(ty, depth + 1, limits)?;
                    }
                    if let FunctionTarget::BoundMethod { receiver, .. }
                    | FunctionTarget::DataMethod { receiver, .. } = &function.target
                    {
                        count += visit(receiver, depth + 1, limits)?;
                    }
                    match &function.target {
                        FunctionTarget::DataMethod {
                            receiver_type,
                            type_argument,
                            ..
                        } => {
                            count += check_type(receiver_type, depth + 1, limits)?;
                            if let Some(ty) = type_argument {
                                count += check_type(ty, depth + 1, limits)?;
                            }
                        }
                        FunctionTarget::EnumConstructor { ty, .. } => {
                            count += check_type(ty, depth + 1, limits)?
                        }
                        _ => {}
                    }
                    if count > limits.max_stored_values {
                        return Err("function value size limit exceeded");
                    }
                    Ok(count)
                }
                Value::List(values) => {
                    if values.len() > limits.max_collection {
                        return Err("collection length limit exceeded");
                    }
                    let mut count = 1;
                    for v in values {
                        count += visit(v, depth + 1, limits)?;
                        if count > limits.max_stored_values {
                            return Err("value size limit exceeded");
                        }
                    }
                    Ok(count)
                }
                Value::Record(r) => {
                    if r.fields.len() > limits.max_collection {
                        return Err("record field limit exceeded");
                    }
                    let mut count = 1;
                    for v in r.fields.values() {
                        count += visit(v, depth + 1, limits)?;
                        if count > limits.max_stored_values {
                            return Err("value size limit exceeded");
                        }
                    }
                    Ok(count)
                }
                _ => Ok(1),
            }
        }
        let nodes = visit(value, 0, self.limits).map_err(|e| self.error("value_limit", e, span))?;
        fn validate_media(value: &Value) -> Result<(), String> {
            match value {
                Value::Enum(value) => {
                    for value in &value.payload {
                        validate_media(value)?;
                    }
                }
                Value::Record(record) => {
                    for field in record.fields.values() {
                        validate_media(field)?;
                    }
                    crate::media_values::validate(value)?;
                }
                Value::List(values) => {
                    for value in values {
                        validate_media(value)?;
                    }
                }
                Value::Function(function) => {
                    if let FunctionTarget::BoundMethod { receiver, .. }
                    | FunctionTarget::DataMethod { receiver, .. } = &function.target
                    {
                        validate_media(receiver)?;
                    }
                }
                _ => {}
            }
            Ok(())
        }
        validate_media(value).map_err(|message| self.error("invalid_media", message, span))?;
        if value_bytes(value) > self.limits.max_allocation_bytes {
            return Err(self.error(
                "allocation_limit",
                "single value exceeds operation byte budget",
                span,
            ));
        }
        Ok(nodes)
    }
    fn check_storage(&self, span: &Span) -> Result<(), Diagnostic> {
        let mut count = self.state.initialized.len();
        let mut bytes = self.state.initialized_bytes;
        if count > self.limits.max_stored_values || bytes > self.limits.max_storage_bytes {
            return Err(self.error(
                "storage_limit",
                "system lifecycle membership exceeds storage budget",
                span,
            ));
        }
        for value in self.state.globals.values().map(|b| &b.value).chain(
            self.state
                .entities
                .values()
                .flat_map(|e| e.components.values()),
        ) {
            count += self.check_value(value, span)?;
            bytes = bytes.saturating_add(value_bytes(value));
            if bytes > self.limits.max_storage_bytes {
                return Err(self.error("storage_limit", "stored value byte budget exceeded", span));
            }
            if count > self.limits.max_stored_values {
                return Err(self.error(
                    "storage_limit",
                    "total stored value budget exceeded",
                    span,
                ));
            }
        }
        Ok(())
    }
    fn matches_type(
        &self,
        value: &Value,
        ty: &Type,
        module: &str,
        span: &Span,
    ) -> Result<bool, Diagnostic> {
        match ty {
            Type::Applied { .. } => {
                let Value::Enum(value) = value else {
                    return Ok(false);
                };
                let expected = self.program.canonical_type(module, ty, span)?;
                Ok(enum_type_compatible(&value.ty, &expected))
            }
            Type::Function { .. } => {
                let Value::Function(function) = value else {
                    return Ok(false);
                };
                let expected = self.program.canonical_type(module, ty, span)?;
                Ok(function.signature == expected)
            }
            Type::ComponentReference(inner) => {
                let Value::ComponentReference(reference) = value else {
                    return Ok(false);
                };
                Ok(Type::named(&reference.class)
                    == self.program.canonical_type(module, inner, span)?)
            }
            Type::Tensor(inner) => {
                Ok(matches!(value,Value::Tensor(t) if data::dtype(inner)==Some(t.dtype())))
            }
            Type::List(inner) => {
                if let Value::List(values) = value {
                    for value in values {
                        if !self.matches_type(value, inner, module, span)? {
                            return Ok(false);
                        }
                    }
                    Ok(true)
                } else {
                    Ok(false)
                }
            }
            Type::Named(name) => {
                if name == "Any" {
                    return Ok(true);
                }
                if name == "List" {
                    return Ok(matches!(value, Value::List(_)));
                }
                if data::is_primitive(name) {
                    return Ok(value.type_name() == name);
                }
                let (m, n) = self.program.resolve(module, name, span)?;
                let key = Program::key(&m, &n);
                if let Value::Enum(value) = value {
                    return Ok(value.ty == Type::named(&key));
                }
                if let Value::Record(record) = value {
                    Ok(record.class == key
                        || self
                            .program
                            .implementations
                            .contains(&(record.class.clone(), key)))
                } else {
                    Ok(false)
                }
            }
        }
    }
    fn expect_type(
        &self,
        value: &Value,
        ty: &Type,
        module: &str,
        span: &Span,
    ) -> Result<(), Diagnostic> {
        if !self.matches_type(value, ty, module, span)? {
            return Err(self.error(
                "type_mismatch",
                format!("expected {ty:?}, got {}", value.type_name()),
                span,
            ));
        }
        Ok(())
    }
    fn validate_external_value(&self, value: &Value, span: &Span) -> Result<(), Diagnostic> {
        self.validate_value(value, span, true)
    }
    fn validate_value(&self, value: &Value, span: &Span, external: bool) -> Result<(), Diagnostic> {
        self.check_value(value, span)?;
        match value {
            Value::Enum(value) => {
                let payload = self.enum_payload(&value.ty, &value.case, span)?;
                if payload.len() != value.payload.len() {
                    return Err(self.error(
                        "invalid_enum",
                        "enum payload arity differs from declaration",
                        span,
                    ));
                }
                if external {
                    self.program.has_type(MAIN, &value.ty, span)?;
                    if value.origin.is_some() {
                        return Err(self.error(
                            "invalid_enum",
                            "external enum values cannot claim compiler source attribution",
                            span,
                        ));
                    }
                }
                for (item, ty) in value.payload.iter().zip(payload) {
                    self.expect_type(item, &ty, canonical_type_scope(&ty), span)?;
                    self.validate_value(item, span, external)?;
                }
                Ok(())
            }
            Value::Record(record) => {
                self.validate_record(value, span)?;
                if external {
                    for value in record.fields.values() {
                        self.validate_value(value, span, true)?;
                    }
                }
                Ok(())
            }
            Value::Function(function) => self.validate_function(function, span, external),
            Value::ComponentReference(reference) => {
                if self.program.class_by_key(&reference.class).is_none() {
                    return Err(self.error(
                        "unknown_class",
                        "unknown component reference class",
                        span,
                    ));
                }
                if external {
                    self.program.class(MAIN, &reference.class, span)?;
                }
                Ok(())
            }
            Value::List(values) => {
                for value in values {
                    self.validate_value(value, span, external)?;
                }
                Ok(())
            }
            _ => Ok(()),
        }
    }
    fn validate_record(&self, value: &Value, span: &Span) -> Result<(), Diagnostic> {
        self.check_value(value, span)?;
        let Value::Record(record) = value else {
            return Err(self.error(
                "expected_component",
                "components must be class records",
                span,
            ));
        };
        let Some((module, class)) = self.program.class_by_key(&record.class) else {
            return Err(self.error(
                "unknown_class",
                format!("unknown class `{}`", record.class),
                span,
            ));
        };
        if record.fields.len() != class.fields.len() {
            return Err(self.error(
                "invalid_record",
                "record fields do not match class declaration",
                span,
            ));
        }
        for field in &class.fields {
            let value = record.fields.get(&field.name).ok_or_else(|| {
                self.error(
                    "missing_field",
                    format!("missing field `{}`", field.name),
                    span,
                )
            })?;
            self.expect_type(value, &field.ty, module, span)?;
            self.validate_value(value, span, false)?;
        }
        Ok(())
    }
    fn block(
        &mut self,
        statements: &[Stmt],
        module: &str,
        env: &mut Env,
    ) -> Result<Flow, Diagnostic> {
        env.scopes.push(BTreeMap::new());
        let result = (|| {
            for statement in statements {
                let flow = self.statement(statement, module, env, false)?;
                if !matches!(flow, Flow::Next) {
                    return Ok(flow);
                }
            }
            Ok(Flow::Next)
        })();
        env.scopes.pop();
        result
    }
    fn statement(
        &mut self,
        statement: &Stmt,
        module: &str,
        env: &mut Env,
        global: bool,
    ) -> Result<Flow, Diagnostic> {
        self.consume(&statement.span)?;
        self.record(&statement.span, "statement".into());
        // Keep the recursive expression/return path in a small frame. Large
        // binding and loop temporaries must not consume every callback's stack.
        match &statement.kind {
            StmtKind::Expr(expr) => {
                self.eval(expr, module, env)?;
                Ok(Flow::Next)
            }
            StmtKind::Return(expr) => Ok(Flow::Return(match expr {
                Some(expr) => self.eval(expr, module, env)?,
                None => Value::Unit,
            })),
            StmtKind::Let { .. } => self.statement_let(statement, module, env, global),
            StmtKind::Assign { .. } => self.statement_assign(statement, module, env, global),
            StmtKind::If { .. } => self.statement_if(statement, module, env, global),
            StmtKind::While { .. } => self.statement_while(statement, module, env, global),
            StmtKind::For { .. } => self.statement_for(statement, module, env, global),
            StmtKind::Break => Ok(Flow::Break),
            StmtKind::Continue => Ok(Flow::Continue),
        }
    }
    fn statement_let(
        &mut self,
        statement: &Stmt,
        module: &str,
        env: &mut Env,
        global: bool,
    ) -> Result<Flow, Diagnostic> {
        match &statement.kind {
            StmtKind::Let {
                name,
                ty,
                mutable,
                value,
            } => {
                let value = self.eval(value, module, env)?;
                let annotated = ty.is_some();
                let (ty, type_module) = if let Some(ty) = ty {
                    (ty.clone(), module.to_owned())
                } else {
                    let span = &statement.span;
                    let ty = self
                        .program
                        .binding_types
                        .get(&(span.module.clone(), span.start, span.end))
                        .ok_or_else(|| {
                            self.error("missing_checked_type", "binding has no compiled type", span)
                        })?
                        .clone();
                    // Canonical imported types are interpreted in their own defining module,
                    // including private types returned through a public function signature.
                    let scope = canonical_type_scope(&ty).to_owned();
                    (ty, scope)
                };
                if annotated {
                    self.program.has_type(&type_module, &ty, &statement.span)?;
                }
                self.expect_type(&value, &ty, &type_module, &statement.span)?;
                let binding = Binding {
                    value,
                    ty,
                    module: type_module,
                    mutable: *mutable,
                };
                let bindings = if global {
                    &mut self.state.globals
                } else {
                    env.scopes.last_mut().expect("scope exists")
                };
                let key = if global {
                    Program::key(module, name)
                } else {
                    name.clone()
                };
                if bindings.contains_key(&key) {
                    return Err(Diagnostic::new(
                        "duplicate_binding",
                        format!("`{name}` is already bound in this scope"),
                        statement.span.clone(),
                    ));
                }
                bindings.insert(key, binding);
            }
            _ => unreachable!("statement dispatcher preserves the variant"),
        }
        Ok(Flow::Next)
    }
    fn statement_assign(
        &mut self,
        statement: &Stmt,
        module: &str,
        env: &mut Env,
        _global: bool,
    ) -> Result<Flow, Diagnostic> {
        match &statement.kind {
            StmtKind::Assign { target, value } => {
                let target = self.freeze_location(target, module, env)?;
                let value = self.eval(value, module, env)?;
                self.assign(&target, value, module, env)?;
            }
            _ => unreachable!("statement dispatcher preserves the variant"),
        }
        Ok(Flow::Next)
    }
    fn statement_if(
        &mut self,
        statement: &Stmt,
        module: &str,
        env: &mut Env,
        _global: bool,
    ) -> Result<Flow, Diagnostic> {
        match &statement.kind {
            StmtKind::If {
                condition,
                then_body,
                else_body,
            } => {
                let condition = self.eval(condition, module, env)?;
                let Value::Bool(condition) = condition else {
                    return Err(self.error(
                        "type_mismatch",
                        "if condition requires Bool",
                        &statement.span,
                    ));
                };
                self.block(if condition { then_body } else { else_body }, module, env)
            }
            _ => unreachable!("statement dispatcher preserves the variant"),
        }
    }
    fn statement_while(
        &mut self,
        statement: &Stmt,
        module: &str,
        env: &mut Env,
        _global: bool,
    ) -> Result<Flow, Diagnostic> {
        match &statement.kind {
            StmtKind::While { condition, body } => loop {
                self.consume(&statement.span)?;
                let value = self.eval(condition, module, env)?;
                let Value::Bool(value) = value else {
                    return Err(self.error(
                        "type_mismatch",
                        "while condition requires Bool",
                        &condition.span,
                    ));
                };
                if !value {
                    break;
                }
                match self.block(body, module, env)? {
                    Flow::Return(value) => return Ok(Flow::Return(value)),
                    Flow::Break => break,
                    Flow::Next | Flow::Continue => (),
                }
            },
            _ => unreachable!("statement dispatcher preserves the variant"),
        }
        Ok(Flow::Next)
    }
    fn statement_for(
        &mut self,
        statement: &Stmt,
        module: &str,
        env: &mut Env,
        _global: bool,
    ) -> Result<Flow, Diagnostic> {
        match &statement.kind {
            StmtKind::For {
                name,
                collection,
                body,
            } => {
                let collection = self.eval(collection, module, env)?;
                let Value::List(values) = collection else {
                    return Err(self.error(
                        "type_mismatch",
                        "for-in requires a List",
                        &statement.span,
                    ));
                };
                for value in values {
                    self.consume(&statement.span)?;
                    env.scopes.push(BTreeMap::new());
                    env.bind(name, value, false, module);
                    let flow = self.block(body, module, env);
                    env.scopes.pop();
                    match flow? {
                        Flow::Return(value) => return Ok(Flow::Return(value)),
                        Flow::Break => break,
                        Flow::Next | Flow::Continue => (),
                    }
                }
            }
            _ => unreachable!("statement dispatcher preserves the variant"),
        }
        Ok(Flow::Next)
    }
    fn lookup(
        &self,
        name: &str,
        module: &str,
        env: &Env,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        if let Some(binding) = env.get(name) {
            return Ok(binding.value.clone());
        }
        if name == "pi" {
            return Ok(Value::Number(std::f64::consts::PI));
        }
        let key = Program::key(module, name);
        if let Some(binding) = self.state.globals.get(&key) {
            return Ok(binding.value.clone());
        }
        self.named_function_value(name, module, span)
    }
    fn namespace(&self, expr: &Expr, module: &str) -> Option<String> {
        let name = expression_path(expr)?;
        (self.program.modules[module].imports.contains(&name) || name == "builtin").then_some(name)
    }
    fn freeze_location(
        &mut self,
        expr: &Expr,
        module: &str,
        env: &mut Env,
    ) -> Result<Expr, Diagnostic> {
        let kind = match &expr.kind {
            ExprKind::Propagate(value) => {
                ExprKind::Propagate(Box::new(self.freeze_location(value, module, env)?))
            }
            ExprKind::Field { object, field } => ExprKind::Field {
                object: Box::new(self.freeze_location(object, module, env)?),
                field: field.clone(),
            },
            ExprKind::Index { object, indices } => {
                let object = self.freeze_location(object, module, env)?;
                let mut frozen = Vec::with_capacity(indices.len());
                for index in indices {
                    frozen.push(match index {
                        IndexExpr::Index(index) => {
                            IndexExpr::Index(self.freeze_index(index, module, env)?)
                        }
                        IndexExpr::Slice { start, stop, step } => IndexExpr::Slice {
                            start: start
                                .as_ref()
                                .map(|expr| self.freeze_index(expr, module, env).map(Box::new))
                                .transpose()?,
                            stop: stop
                                .as_ref()
                                .map(|expr| self.freeze_index(expr, module, env).map(Box::new))
                                .transpose()?,
                            step: step
                                .as_ref()
                                .map(|expr| self.freeze_index(expr, module, env).map(Box::new))
                                .transpose()?,
                        },
                        IndexExpr::NewAxis => IndexExpr::NewAxis,
                        IndexExpr::Ellipsis => IndexExpr::Ellipsis,
                    });
                }
                ExprKind::Index {
                    object: Box::new(object),
                    indices: frozen,
                }
            }
            _ => return Ok(expr.clone()),
        };
        Ok(Expr {
            kind,
            span: expr.span.clone(),
        })
    }
    fn freeze_index(
        &mut self,
        index: &Expr,
        module: &str,
        env: &mut Env,
    ) -> Result<Expr, Diagnostic> {
        let number = self.index(index, module, env)?;
        Ok(Expr {
            kind: ExprKind::Number(number.to_string()),
            span: index.span.clone(),
        })
    }
    fn eval(&mut self, expr: &Expr, module: &str, env: &mut Env) -> Result<Value, Diagnostic> {
        if self.expression_depth >= self.limits.max_value_depth {
            return Err(self.error(
                "expression_depth",
                "expression nesting limit exceeded",
                &expr.span,
            ));
        }
        self.expression_depth += 1;
        let result = self.eval_inner(expr, module, env);
        self.expression_depth -= 1;
        result
    }
    // Keep dispatch frames small: the interpreter's configured recursion limits
    // must fire before the native stack, including in unoptimized host builds.
    fn eval_inner(
        &mut self,
        expr: &Expr,
        module: &str,
        env: &mut Env,
    ) -> Result<Value, Diagnostic> {
        self.consume(&expr.span)?;
        if let Some(name) = expression_path(expr) {
            let unbound = !matches!(&expr.kind,ExprKind::Name(name) if env.get(name).is_some()||self.state.globals.contains_key(&Program::key(module,name)));
            if unbound && let Some(value) = self.case_expression(&name, None, module, &expr.span)? {
                return self.complete_expression(value, &expr.span);
            }
        }
        // Return one Result from the dispatch instead of allocating a separate
        // error-unwind temporary for every arm. Recursive calls must fit the
        // configured language depth on the native test thread's normal stack.
        let result = match &expr.kind {
            ExprKind::TypedLiteral { value, .. } => self.eval(value, module, env),
            ExprKind::Assign { target, value } => {
                self.eval_assignment(target, value, module, env, &expr.span)
            }
            ExprKind::TensorLiteral { values, dtype } => {
                self.eval_tensor_literal(values, dtype, module, env, &expr.span)
            }
            ExprKind::Match { value, arms } => {
                self.eval_match(value, arms, module, env, &expr.span)
            }
            ExprKind::Propagate(value) => self.eval_propagate(value, module, env, &expr.span),
            ExprKind::TypedMethod { object, method, ty } => {
                self.eval_typed_method(object, method, ty, module, env, &expr.span)
            }
            ExprKind::Number(raw) => self.literal(raw, &expr.span),
            ExprKind::Bool(value) => Ok(Value::Bool(*value)),
            ExprKind::Text(value) => Ok(Value::Text(value.clone().into())),
            ExprKind::Unit => Ok(Value::Unit),
            ExprKind::Name(name) => self.lookup(name, module, env, &expr.span),
            ExprKind::List(values) => self.eval_list(values, module, env, &expr.span),
            ExprKind::Record { class, fields } => {
                self.construct(class, fields, module, env, &expr.span)
            }
            ExprKind::Unary { op, value } => self.eval_unary(op, value, module, env, &expr.span),
            ExprKind::Binary { op, left, right } => {
                self.eval_binary(op, left, right, module, env, &expr.span)
            }
            ExprKind::Field { object, field } => {
                self.eval_field(object, field, module, env, &expr.span)
            }
            ExprKind::Index { object, indices } => {
                self.eval_checked_index(object, indices, module, env, &expr.span)
            }
            ExprKind::TypedFunction { name, ty } => {
                self.typed_function_value(name, ty, module, &expr.span)
            }
            ExprKind::TypedCall {
                name,
                ty,
                arguments,
            } => self.eval_typed_call(name, ty, arguments, module, env, &expr.span),
            ExprKind::Call { callee, arguments } => {
                self.eval_call(callee, arguments, module, env, &expr.span)
            }
        };
        self.complete_expression(result?, &expr.span)
    }
    fn eval_typed_method(
        &mut self,
        object: &Expr,
        method: &str,
        ty: &Type,
        module: &str,
        env: &mut Env,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        let value = self.eval(object, module, env)?;
        self.data_method_value(value, method, Some(ty), span)
    }
    fn eval_checked_index(
        &mut self,
        object: &Expr,
        indices: &[IndexExpr],
        module: &str,
        env: &mut Env,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        let result = self.eval_index(object, indices, module, env, span);
        self.data_result(result, span)
    }
    fn eval_assignment(
        &mut self,
        target: &Expr,
        value: &Expr,
        module: &str,
        env: &mut Env,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        let result = (|| {
            let location = self.freeze_location(target, module, env)?;
            let replacement = self.eval(value, module, env)?;
            self.assign(&location, replacement, module, env)
                .map(|()| Value::Unit)
        })();
        self.data_result(result, span)
    }
    fn eval_match(
        &mut self,
        input: &Expr,
        arms: &[MatchArm],
        module: &str,
        env: &mut Env,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        let value = self.eval(input, module, env)?;
        for arm in arms {
            let mut bindings = Vec::new();
            if self.pattern_matches(&arm.pattern, &value, &mut bindings, &arm.span)? {
                env.scopes.push(BTreeMap::new());
                for (name, value) in bindings {
                    env.bind(&name, value, false, module);
                }
                let result = self.eval(&arm.value, module, env);
                env.scopes.pop();
                return result;
            }
        }
        Err(self.error(
            "invalid_match",
            "checked exhaustive match found no case",
            span,
        ))
    }
    fn eval_propagate(
        &mut self,
        expr: &Expr,
        module: &str,
        env: &mut Env,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        let Value::Enum(mut value) = self.eval(expr, module, env)? else {
            return Err(self.error(
                "invalid_propagation",
                "expected checked algebraic value",
                span,
            ));
        };
        if matches!(value.case.as_str(), "Ok" | "Some") {
            Ok(value.payload.remove(0))
        } else {
            self.propagated = Some(Value::Enum(value));
            Err(self.error("__return_algebraic", "internal checked propagation", span))
        }
    }
    fn complete_expression(&mut self, value: Value, span: &Span) -> Result<Value, Diagnostic> {
        self.check_value(&value, span)?;
        if let Some(ty) =
            self.program
                .expression_types
                .get(&(span.module.clone(), span.start, span.end))
        {
            self.expect_type(&value, ty, canonical_type_scope(ty), span)?;
        }
        self.allocated_bytes = self.allocated_bytes.saturating_add(value_bytes(&value));
        if self.allocated_bytes > self.limits.max_allocation_bytes {
            return Err(self.error(
                "allocation_limit",
                "operation value allocation budget exceeded",
                span,
            ));
        }
        Ok(value)
    }
    fn eval_list(
        &mut self,
        expressions: &[Expr],
        module: &str,
        env: &mut Env,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        if expressions.len() > self.limits.max_collection {
            return Err(self.error("collection_limit", "list exceeds collection limit", span));
        }
        self.arguments(expressions, module, env).map(Value::List)
    }
    fn eval_unary(
        &mut self,
        op: &str,
        expr: &Expr,
        module: &str,
        env: &mut Env,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        if op == "-"
            && let ExprKind::Number(raw) = &expr.kind
        {
            return self.literal(&format!("-{raw}"), span);
        }
        let value = self.eval(expr, module, env)?;
        let result = match (op, value) {
            ("-", Value::Number(n)) => Ok(Value::Number(-n)),
            ("-", Value::Scalar(n)) => n
                .neg()
                .map(data::scalar_value)
                .map_err(|e| self.data_error(e, span)),
            ("-", Value::Tensor(t)) => {
                self.data_budget(t.len(), t.len(), span)?;
                t.neg()
                    .map(|t| Value::Tensor(Box::new(t)))
                    .map_err(|e| self.data_error(e, span))
            }
            ("!", Value::Bool(b)) => Ok(Value::Bool(!b)),
            _ => Err(self.error("type_mismatch", format!("invalid operand for `{op}`"), span)),
        };
        if op == "-" {
            self.data_result(result, span)
        } else {
            result
        }
    }
    fn eval_binary(
        &mut self,
        op: &str,
        left: &Expr,
        right: &Expr,
        module: &str,
        env: &mut Env,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        let left = self.eval(left, module, env)?;
        if op == "and" && left == Value::Bool(false) {
            return Ok(Value::Bool(false));
        }
        if op == "or" && left == Value::Bool(true) {
            return Ok(Value::Bool(true));
        }
        let right = self.eval(right, module, env)?;
        let algebraic = matches!(op, "+" | "-" | "*" | "/" | "%" | "@")
            && (data::as_scalar(&left).is_some() || matches!(left, Value::Tensor(_)));
        let result = self.binary(op, left, right, span);
        if algebraic {
            self.data_result(result, span)
        } else {
            result
        }
    }
    fn eval_field(
        &mut self,
        object: &Expr,
        field: &str,
        module: &str,
        env: &mut Env,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        if let Some(prefix) = self.namespace(object, module) {
            let (m, n) = self
                .program
                .resolve(module, &format!("{prefix}.{field}"), span)?;
            if let Some(binding) = self.state.globals.get(&Program::key(&m, &n)) {
                Ok(binding.value.clone())
            } else {
                self.named_function_value(&format!("{prefix}.{field}"), module, span)
            }
        } else {
            self.field(object, field, module, env, span)
        }
    }
    fn eval_index(
        &mut self,
        object: &Expr,
        indices: &[IndexExpr],
        module: &str,
        env: &mut Env,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        let value = self.eval(object, module, env)?;
        let selectors = self.selectors(indices, module, env)?;
        self.index_value(value, &selectors, span)
    }
    fn eval_typed_call(
        &mut self,
        name: &str,
        ty: &Type,
        arguments: &[Expr],
        module: &str,
        env: &mut Env,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        let selected = self.program.canonical_type(module, ty, span)?;
        let args = self.arguments(arguments, module, env)?;
        self.call_builtin_value(
            name.strip_prefix("builtin.").unwrap_or(name),
            Some(&selected),
            args,
            span,
        )
    }
    fn typed_function_value(
        &self,
        name: &str,
        ty: &Type,
        module: &str,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        let name = name.strip_prefix("builtin.").unwrap_or(name);
        let selected = self.program.canonical_type(module, ty, span)?;
        let signature = if name == "convert" {
            self.program
                .expression_types
                .get(&(span.module.clone(), span.start, span.end))
                .cloned()
                .ok_or_else(|| {
                    self.error(
                        "invalid_function",
                        "missing checked conversion signature",
                        span,
                    )
                })?
        } else {
            self.program
                .typed_builtin_signature(name, &selected, span)?
        };
        Ok(Value::Function(Box::new(FunctionValue {
            target: FunctionTarget::Builtin {
                name: name.into(),
                type_argument: Some(Box::new(selected)),
            },
            signature,
        })))
    }
    fn eval_call(
        &mut self,
        callee: &Expr,
        arguments: &[Expr],
        module: &str,
        env: &mut Env,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        if let Some(name) = expression_path(callee) {
            let unbound = !matches!(&callee.kind,ExprKind::Name(name) if env.get(name).is_some()||self.state.globals.contains_key(&Program::key(module,name)));
            if unbound
                && (matches!(name.as_str(), "Ok" | "Err" | "Some" | "None")
                    || self
                        .program
                        .variant(module, &name, span)
                        .ok()
                        .flatten()
                        .is_some())
            {
                let args = self.arguments(arguments, module, env)?;
                if let Some(value) = self.case_expression(&name, Some(args), module, span)? {
                    return Ok(value);
                }
            }
        }
        // The checker records a type for first-class callees; legacy direct
        // intrinsics, constructors, and immediate methods have no callee type.
        let result = if self.program.expression_types.contains_key(&(
            callee.span.module.clone(),
            callee.span.start,
            callee.span.end,
        )) {
            let callback = self.eval(callee, module, env)?;
            let args = self.arguments(arguments, module, env)?;
            self.call_value(callback, args, span)?
        } else {
            match &callee.kind {
                ExprKind::Name(name) => {
                    let args = self.arguments(arguments, module, env)?;
                    self.call_name(name, args, module, span)?
                }
                ExprKind::Field { object, field } => {
                    if let Some(prefix) = self.namespace(object, module) {
                        let args = self.arguments(arguments, module, env)?;
                        self.call_name(&format!("{prefix}.{field}"), args, module, span)?
                    } else {
                        self.method(object, field, arguments, module, env, span)?
                    }
                }
                _ => {
                    return Err(self.error(
                        "invalid_call",
                        "callee must have a function type",
                        span,
                    ));
                }
            }
        };
        Ok(result)
    }
    fn field(
        &mut self,
        object: &Expr,
        field: &str,
        module: &str,
        env: &mut Env,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        let value = self.eval(object, module, env)?;
        if !crate::methods::signatures(&infer_type(&value), field, None).is_empty() {
            return self.data_method_value(value, field, None, span);
        }
        if let Some(value) = value.field(field) {
            return Ok(value.clone());
        }
        let (class, target) = match value {
            Value::Record(record) => {
                let class = record.class.clone();
                (
                    class.clone(),
                    FunctionTarget::BoundMethod {
                        class,
                        method: field.into(),
                        receiver: Box::new(Value::Record(record)),
                    },
                )
            }
            Value::ComponentReference(reference) => (
                reference.class.clone(),
                FunctionTarget::EntityMethod {
                    class: reference.class,
                    method: field.into(),
                    entity: reference.entity,
                },
            ),
            _ => {
                return Err(self.error(
                    "unknown_field",
                    "method capture requires a class or bound component",
                    span,
                ));
            }
        };
        let function = self
            .program
            .methods
            .get(&class)
            .and_then(|methods| methods.get(field))
            .ok_or_else(|| {
                self.error(
                    "unknown_method",
                    format!("{class} has no method `{field}`"),
                    span,
                )
            })?;
        Ok(Value::Function(Box::new(FunctionValue {
            target,
            signature: self.function_signature(function)?,
        })))
    }

    fn index(&mut self, index: &Expr, module: &str, env: &mut Env) -> Result<isize, Diagnostic> {
        let value = self.eval(index, module, env)?;
        self.signed_index_value(&value, &index.span)
    }
    fn binary(
        &mut self,
        op: &str,
        left: Value,
        right: Value,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        if op == "==" || op == "!=" {
            self.data_budget(
                0,
                display_work(&left).saturating_add(display_work(&right)),
                span,
            )?;
            let equal =
                if let (Some(a), Some(b)) = (data::as_scalar(&left), data::as_scalar(&right)) {
                    a.compare(b).map_err(|e| self.data_error(e, span))?.is_eq()
                } else {
                    left == right
                };
            return Ok(Value::Bool(if op == "==" { equal } else { !equal }));
        }
        if let (Some(a), Some(b)) = (data::as_scalar(&left), data::as_scalar(&right)) {
            if let Some(operation) = data::binary_op(op) {
                return a
                    .binary(operation, b)
                    .map(data::scalar_value)
                    .map_err(|e| self.data_error(e, span));
            }
            let order = a.compare(b).map_err(|e| self.data_error(e, span))?;
            return Ok(Value::Bool(match op {
                "<" => order.is_lt(),
                "<=" => order.is_le(),
                ">" => order.is_gt(),
                ">=" => order.is_ge(),
                _ => return Err(self.error("unknown_operator", "invalid numeric operator", span)),
            }));
        }
        if matches!(&left, Value::Tensor(_)) || matches!(&right, Value::Tensor(_)) {
            return self.tensor_binary(op, left, right, span);
        }
        match (left, right) {
            (Value::Number(a), Value::Number(b)) => Ok(match op {
                "+" => Value::Number(a + b),
                "-" => Value::Number(a - b),
                "*" => Value::Number(a * b),
                "/" => {
                    if b == 0.0 {
                        return Err(self.error("division_by_zero", "division by zero", span));
                    }
                    Value::Number(a / b)
                }
                "%" => {
                    if b == 0.0 {
                        return Err(self.error("division_by_zero", "remainder by zero", span));
                    }
                    Value::Number(a % b)
                }
                "<" => Value::Bool(a < b),
                "<=" => Value::Bool(a <= b),
                ">" => Value::Bool(a > b),
                ">=" => Value::Bool(a >= b),
                _ => {
                    return Err(self.error(
                        "type_mismatch",
                        format!("invalid numeric operator `{op}`"),
                        span,
                    ));
                }
            }),
            (Value::Bool(a), Value::Bool(b)) => match op {
                "and" => Ok(Value::Bool(a && b)),
                "or" => Ok(Value::Bool(a || b)),
                _ => Err(self.error(
                    "type_mismatch",
                    format!("invalid Bool operator `{op}`"),
                    span,
                )),
            },
            (Value::Text(a), Value::Text(b)) if op == "+" => {
                if a.len().saturating_add(b.len()) > self.limits.max_string_bytes {
                    return Err(self.error("value_limit", "string byte limit exceeded", span));
                }
                Ok(Value::Text(format!("{a}{b}").into()))
            }
            (Value::Bin(a), Value::Bin(b)) if op == "+" => {
                let size = a.byte_len().saturating_add(b.byte_len());
                self.data_budget(size, size, span)?;
                let mut bytes = Vec::with_capacity(size);
                bytes.extend_from_slice(a.as_bytes());
                bytes.extend_from_slice(b.as_bytes());
                Ok(Value::Bin(bytes.into()))
            }
            _ => Err(self.error(
                "type_mismatch",
                format!("incompatible operands for `{op}`"),
                span,
            )),
        }
    }
    fn construct(
        &mut self,
        name: &str,
        fields: &BTreeMap<String, Expr>,
        module: &str,
        env: &mut Env,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        if self.depth >= self.limits.max_call_depth {
            return Err(self.error(
                "call_depth",
                "constructor nesting exceeds call-depth limit",
                span,
            ));
        }
        let (class_module, class) = self.program.class(module, name, span)?;
        let class = class.clone();
        for name in fields.keys() {
            if !class.fields.iter().any(|f| &f.name == name) {
                return Err(self.error(
                    "unknown_field",
                    format!("{} has no field `{name}`", class.name),
                    span,
                ));
            }
        }
        self.depth += 1;
        let result = (|| {
            let mut supplied = BTreeMap::new();
            let mut ordered: Vec<_> = fields.iter().collect();
            ordered.sort_by_key(|(_, expr)| expr.span.start);
            for (name, expr) in ordered {
                supplied.insert(name.clone(), self.eval(expr, module, env)?);
            }
            self.construct_values(&class_module, &class, supplied, span)
        })();
        self.depth -= 1;
        result
    }
    fn construct_values(
        &mut self,
        class_module: &str,
        class: &Class,
        mut supplied: BTreeMap<String, Value>,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        let mut values = BTreeMap::new();
        for field in &class.fields {
            let value = if let Some(value) = supplied.remove(&field.name) {
                value
            } else if let Some(default) = &field.default {
                self.eval(default, class_module, &mut Env::default())?
            } else {
                return Err(self.error(
                    "missing_field",
                    format!("missing field `{}` for `{}`", field.name, class.name),
                    span,
                ));
            };
            self.expect_type(&value, &field.ty, class_module, span)?;
            values.insert(field.name.clone(), value);
        }
        Ok(Value::Record(RecordValue {
            class: Program::key(class_module, &class.name),
            fields: values,
        }))
    }
    fn function_signature(&self, function: &Function) -> Result<Type, Diagnostic> {
        self.program.canonical_type(
            &function.span.module,
            &Type::function(
                function.parameters.iter().map(|p| p.ty.clone()).collect(),
                function.returns.clone(),
            ),
            &function.span,
        )
    }
    fn named_function_value(
        &self,
        name: &str,
        module: &str,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        let native_name = name.strip_prefix("builtin.").unwrap_or(name);
        let (target, signature) = if is_builtin(native_name) {
            let signature = monomorphic_signature(native_name)
                .or_else(|| {
                    self.program
                        .expression_types
                        .get(&(span.module.clone(), span.start, span.end))
                        .cloned()
                })
                .ok_or_else(|| {
                    self.error(
                        "function_specialization",
                        "builtin function value requires a concrete signature",
                        span,
                    )
                })?;
            let type_argument = match (&signature, native_name) {
                (Type::Function { returns, .. }, "get") => Some(returns.clone()),
                (Type::Function { returns, .. }, "bind") => match returns.as_ref() {
                    Type::ComponentReference(inner) => Some(inner.clone()),
                    _ => None,
                },
                _ => None,
            };
            (
                FunctionTarget::Builtin {
                    name: native_name.into(),
                    type_argument,
                },
                signature,
            )
        } else if let Some(native) = self.registry.functions.get(native_name) {
            (
                FunctionTarget::Native {
                    name: native_name.into(),
                },
                self.program.canonical_type(
                    MAIN,
                    &Type::function(native.parameters.clone(), native.returns.clone()),
                    span,
                )?,
            )
        } else {
            let (target, local) = self.program.resolve(module, name, span)?;
            let function = self.program.modules[&target]
                .functions
                .get(&local)
                .ok_or_else(|| {
                    self.error(
                        "unknown_name",
                        format!("unknown function value `{name}`"),
                        span,
                    )
                })?;
            (
                FunctionTarget::Named {
                    module: target,
                    name: local,
                },
                self.function_signature(function)?,
            )
        };
        Ok(Value::Function(Box::new(FunctionValue {
            target,
            signature,
        })))
    }
    fn valid_signature_type(&self, ty: &Type) -> bool {
        match ty {
            Type::Applied { name, arguments } => {
                matches!((name.as_str(), arguments.len()), ("Res", 2) | ("Opt", 1))
                    && arguments.iter().all(|ty| self.valid_signature_type(ty))
            }
            Type::Named(name) => {
                data::is_primitive(name)
                    || self.program.enum_by_key(name).is_some()
                    || self.program.class_by_key(name).is_some()
                    || self.program.modules.iter().any(|(module, declarations)| {
                        declarations
                            .traits
                            .keys()
                            .any(|local| Program::key(module, local) == *name)
                    })
            }
            Type::Tensor(inner) => data::dtype(inner).is_some(),
            Type::List(inner) => self.valid_signature_type(inner),
            Type::ComponentReference(inner) => {
                matches!(inner.as_ref(), Type::Named(name) if self.program.class_by_key(name).is_some())
            }
            Type::Function {
                parameters,
                returns,
            } => {
                parameters.iter().all(|ty| self.valid_signature_type(ty))
                    && self.valid_signature_type(returns)
            }
        }
    }
    fn validate_function(
        &self,
        value: &FunctionValue,
        span: &Span,
        external: bool,
    ) -> Result<(), Diagnostic> {
        if !self.valid_signature_type(&value.signature) {
            return Err(self.error(
                "invalid_function",
                "function signatures require known concrete types",
                span,
            ));
        }
        let known = match &value.target {
            FunctionTarget::EnumConstructor { ty, case } => {
                if external {
                    self.program.has_type(MAIN, ty, span)?;
                }
                Type::function(self.enum_payload(ty, case, span)?, ty.clone())
            }
            FunctionTarget::DataMethod {
                receiver_type,
                method,
                type_argument,
                receiver,
            } => {
                self.validate_value(receiver, span, external)?;
                self.expect_type(
                    receiver,
                    receiver_type,
                    canonical_type_scope(receiver_type),
                    span,
                )?;
                if !crate::methods::signatures(receiver_type, method, type_argument.as_deref())
                    .contains(&value.signature)
                {
                    return Err(self.error(
                        "invalid_function",
                        "invalid data method signature or identity",
                        span,
                    ));
                }
                value.signature.clone()
            }
            FunctionTarget::Named { module, name } => {
                if external {
                    self.program
                        .resolve(MAIN, &format!("{module}.{name}"), span)?;
                }
                let function = self
                    .program
                    .modules
                    .get(module)
                    .and_then(|m| m.functions.get(name))
                    .ok_or_else(|| {
                        self.error("invalid_function", "unknown function identity", span)
                    })?;
                self.function_signature(function)?
            }
            FunctionTarget::Native { name } => {
                let native = self.registry.functions.get(name).ok_or_else(|| {
                    self.error("invalid_function", "unknown native function identity", span)
                })?;
                self.program.canonical_type(
                    MAIN,
                    &Type::function(native.parameters.clone(), native.returns.clone()),
                    span,
                )?
            }
            FunctionTarget::Builtin {
                name,
                type_argument,
            } => {
                if let Some(selected) = type_argument {
                    if !self.valid_signature_type(selected) {
                        return Err(self.error(
                            "invalid_function",
                            "invalid builtin type argument",
                            span,
                        ));
                    }
                    if external {
                        self.program.has_type(MAIN, selected, span)?;
                    }
                    if name == "convert" {
                        if !data::valid_convert_signature(selected, &value.signature) {
                            return Err(self.error(
                                "invalid_function",
                                "invalid conversion signature",
                                span,
                            ));
                        }
                        value.signature.clone()
                    } else {
                        self.program
                            .typed_builtin_signature(name, selected, span)
                            .map_err(|diagnostic| {
                                self.error("invalid_function", diagnostic.message, span)
                            })?
                    }
                } else {
                    if !valid_builtin_specialization(name, &value.signature, |class| {
                        self.program.class_by_key(class).is_some()
                    }) {
                        return Err(self.error(
                            "invalid_function",
                            "invalid builtin specialization",
                            span,
                        ));
                    }
                    value.signature.clone()
                }
            }
            FunctionTarget::BoundMethod {
                class,
                method,
                receiver,
            } => {
                if self
                    .program
                    .mutating_methods
                    .contains(&(class.clone(), method.clone()))
                {
                    return Err(self.error(
                        "mutating_method_capture",
                        "mutating callbacks must bind an entity component",
                        span,
                    ));
                }
                if receiver.type_name() != class {
                    return Err(self.error(
                        "invalid_function",
                        "bound method receiver has the wrong class",
                        span,
                    ));
                }
                self.validate_value(receiver, span, external)?;
                if external {
                    self.program.class(MAIN, class, span)?;
                }
                let function = self
                    .program
                    .methods
                    .get(class)
                    .and_then(|m| m.get(method))
                    .ok_or_else(|| {
                        self.error("invalid_function", "unknown bound method identity", span)
                    })?;
                self.function_signature(function)?
            }
            FunctionTarget::EntityMethod { class, method, .. } => {
                if external {
                    self.program.class(MAIN, class, span)?;
                }
                let function = self
                    .program
                    .methods
                    .get(class)
                    .and_then(|m| m.get(method))
                    .ok_or_else(|| {
                        self.error("invalid_function", "unknown entity method identity", span)
                    })?;
                self.function_signature(function)?
            }
        };
        if known != value.signature {
            return Err(self.error(
                "invalid_function",
                "function signature does not match its declared identity",
                span,
            ));
        }
        Ok(())
    }
    fn component_value(&self, id: u64, class: &str, span: &Span) -> Result<Value, Diagnostic> {
        if self.state.pending_despawns.contains(&id) {
            return Err(self.error("unknown_entity", "callback entity is pending despawn", span));
        }
        let entity = self.state.entities.get(&id).ok_or_else(|| {
            self.error(
                "unknown_entity",
                format!("entity {id} does not exist"),
                span,
            )
        })?;
        entity.components.get(class).cloned().ok_or_else(|| {
            self.error(
                "missing_component",
                format!("entity {id} has no `{class}`"),
                span,
            )
        })
    }
    fn call_value(
        &mut self,
        value: Value,
        args: Vec<Value>,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        self.consume(span)?;
        let Value::Function(function) = value else {
            return Err(self.error("invalid_call", "callee is not a function", span));
        };
        self.validate_function(&function, span, false)?;
        let Type::Function {
            parameters,
            returns,
        } = &function.signature
        else {
            return Err(self.error("invalid_function", "missing function signature", span));
        };
        if args.len() != parameters.len() {
            return Err(self.error(
                "arity",
                format!(
                    "callback expects {} arguments, got {}",
                    parameters.len(),
                    args.len()
                ),
                span,
            ));
        }
        for (value, ty) in args.iter().zip(parameters) {
            self.expect_type(value, ty, canonical_type_scope(ty), span)?;
        }
        let result = match &function.target {
            FunctionTarget::EnumConstructor { ty, case } => Value::algebraic(crate::EnumValue {
                origin: None,
                ty: ty.clone(),
                case: case.clone(),
                payload: args,
            }),
            FunctionTarget::DataMethod {
                receiver,
                method,
                type_argument,
                ..
            } => self.call_data_method(
                receiver.as_ref().clone(),
                method,
                type_argument.as_deref(),
                args,
                returns,
                span,
            )?,
            FunctionTarget::Named { module, name } => {
                let program = self.program;
                let declaration = &program.modules[module].functions[name];
                self.function(declaration, args, module, None, span)?.0
            }
            FunctionTarget::Native { name } => self.call_name(name, args, MAIN, span)?,
            FunctionTarget::Builtin {
                name,
                type_argument,
            } => self.call_builtin_value(name, type_argument.as_deref(), args, span)?,
            FunctionTarget::BoundMethod {
                class,
                method,
                receiver,
            } => {
                let program = self.program;
                let declaration = &program.methods[class][method];
                self.function(
                    declaration,
                    args,
                    &declaration.span.module,
                    Some(receiver.as_ref().clone()),
                    span,
                )?
                .0
            }
            FunctionTarget::EntityMethod {
                class,
                method,
                entity,
            } => self.call_entity_method(*entity, class, method, args, span)?,
        };
        self.expect_type(&result, returns, canonical_type_scope(returns), span)?;
        Ok(result)
    }
    fn call_builtin_value(
        &mut self,
        name: &str,
        type_argument: Option<&Type>,
        mut args: Vec<Value>,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        if let Some(selected) = type_argument {
            if matches!(name, "tensor" | "convert") {
                let result = self.typed_data_builtin(name, selected, args, span);
                return if name == "tensor" {
                    self.result_with_type(
                        result,
                        &data::result_type(data::tensor_type(selected.clone())),
                        span,
                    )
                } else {
                    result
                };
            }
            let Type::Named(key) = selected else {
                return Err(self.error(
                    "invalid_function",
                    "typed builtin requires a nominal type argument",
                    span,
                ));
            };
            args.push(Value::Text(key.clone().into()));
            self.builtin(name, args, canonical_type_scope(selected), span)
        } else {
            self.builtin(name, args, MAIN, span)
        }
    }
    fn call_entity_method(
        &mut self,
        id: u64,
        class: &str,
        method: &str,
        args: Vec<Value>,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        let original = self.component_value(id, class, span)?;
        let declaration = self
            .program
            .methods
            .get(class)
            .and_then(|m| m.get(method))
            .cloned()
            .ok_or_else(|| {
                self.error("unknown_method", "component has no callback method", span)
            })?;
        let prior_entity = self.entity.replace(id);
        let outcome = self.function(
            &declaration,
            args,
            &declaration.span.module,
            Some(original.clone()),
            span,
        );
        self.entity = prior_entity;
        let (result, updated) = outcome?;
        if let Some(updated) = updated
            && let Some(entity) = self.state.entities.get_mut(&id)
            && let Some(current) = entity.components.get(class)
        {
            if current != &original && updated != original && current != &updated {
                return Err(self.error(
                    "conflicting_component_write",
                    "method changed self and explicitly set the same component",
                    span,
                ));
            }
            if updated != original {
                entity.components.insert(class.into(), updated);
            }
        }
        Ok(result)
    }
    fn call_name(
        &mut self,
        name: &str,
        args: Vec<Value>,
        module: &str,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        self.consume(span)?;
        let native_name = name.strip_prefix("builtin.").unwrap_or(name);
        if is_builtin(native_name) {
            return self.builtin(native_name, args, module, span);
        }
        if let Some(native) = self.registry.functions.get(native_name) {
            if args.len() != native.parameters.len() {
                return Err(self.error(
                    "arity",
                    format!(
                        "`{name}` expects {} arguments, got {}",
                        native.parameters.len(),
                        args.len()
                    ),
                    span,
                ));
            }
            for (value, ty) in args.iter().zip(&native.parameters) {
                self.expect_type(value, ty, MAIN, span)?;
            }
            let result = (native.call)(&args)
                .map_err(|message| self.error("native_error", message, span))?;
            self.validate_external_value(&result, span)?;
            self.expect_type(&result, &native.returns, MAIN, span)?;
            return Ok(result);
        }
        let (target, local) = self.program.resolve(module, name, span)?;
        if let Some(function) = self.program.modules[&target].functions.get(&local).cloned() {
            return self
                .function(&function, args, &target, None, span)
                .map(|(value, _)| value);
        }
        if let Some(class) = self.program.modules[&target].classes.get(&local).cloned() {
            if args.len() > class.fields.len() {
                return Err(self.error(
                    "arity",
                    format!("class `{name}` has {} fields", class.fields.len()),
                    span,
                ));
            }
            let fields = args
                .into_iter()
                .zip(class.fields.iter())
                .map(|(value, field)| (field.name.clone(), value))
                .collect::<BTreeMap<_, _>>();
            if self.depth >= self.limits.max_call_depth {
                return Err(self.error(
                    "call_depth",
                    "constructor nesting exceeds call-depth limit",
                    span,
                ));
            }
            self.depth += 1;
            let result = self.construct_values(&target, &class, fields, span);
            self.depth -= 1;
            return result;
        }
        Err(self.error(
            "unknown_function",
            format!("unknown function `{name}`"),
            span,
        ))
    }
    fn function(
        &mut self,
        function: &Function,
        args: Vec<Value>,
        module: &str,
        self_value: Option<Value>,
        span: &Span,
    ) -> Result<(Value, Option<Value>), Diagnostic> {
        if self.depth >= self.limits.max_call_depth {
            return Err(self.error(
                "call_depth",
                "function nesting exceeds call-depth limit",
                span,
            ));
        }
        if args.len() != function.parameters.len() {
            return Err(self.error(
                "arity",
                format!(
                    "`{}` expects {} arguments, got {}",
                    function.name,
                    function.parameters.len(),
                    args.len()
                ),
                span,
            ));
        }
        let mut env = Env::default();
        for (parameter, value) in function.parameters.iter().zip(args) {
            self.expect_type(&value, &parameter.ty, module, span)?;
            env.scopes[0].insert(
                parameter.name.clone(),
                Binding {
                    value,
                    ty: parameter.ty.clone(),
                    module: module.into(),
                    mutable: false,
                },
            );
        }
        if let Some(value) = self_value {
            env.bind("self", value, true, module);
        }
        self.record(span, format!("call {}", function.name));
        self.depth += 1;
        let result = self.block(&function.body, module, &mut env);
        self.depth -= 1;
        let result = match result {
            Err(error) if error.code == "__return_algebraic" => {
                let mut value = self.propagated.take().expect("propagation owns its value");
                if let Value::Enum(value) = &mut value {
                    value.ty =
                        self.program
                            .canonical_type(module, &function.returns, &function.span)?;
                }
                Ok(Flow::Return(value))
            }
            other => other,
        };
        let value = match result? {
            Flow::Return(value) => value,
            Flow::Next => Value::Unit,
            _ => {
                return Err(self.error(
                    "invalid_control",
                    "break/continue require a loop",
                    &function.span,
                ));
            }
        };
        self.expect_type(&value, &function.returns, module, &function.span)?;
        Ok((value, env.get("self").map(|b| b.value.clone())))
    }
    fn arguments(
        &mut self,
        arguments: &[Expr],
        module: &str,
        env: &mut Env,
    ) -> Result<Vec<Value>, Diagnostic> {
        let mut args = Vec::new();
        for argument in arguments {
            args.push(self.eval(argument, module, env)?);
        }
        Ok(args)
    }
    fn method(
        &mut self,
        object: &Expr,
        name: &str,
        arguments: &[Expr],
        module: &str,
        env: &mut Env,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        let location = self.freeze_location(object, module, env)?;
        let value = self.eval(&location, module, env)?;
        let args = self.arguments(arguments, module, env)?;
        let Value::Record(record) = &value else {
            return Err(self.error("unknown_method", "methods require a class value", span));
        };
        let function = self
            .program
            .methods
            .get(&record.class)
            .and_then(|methods| methods.get(name))
            .cloned()
            .ok_or_else(|| {
                self.error(
                    "unknown_method",
                    format!("{} has no method `{name}`", record.class),
                    span,
                )
            })?;
        let method_module = function.span.module.clone();
        let (result, updated) =
            self.function(&function, args, &method_module, Some(value.clone()), span)?;
        if let Some(updated) = updated
            && updated != value
        {
            let current = self.eval(&location, module, env)?;
            if current != value && current != updated {
                return Err(self.error(
                    "conflicting_receiver_write",
                    "method arguments or body changed the receiver through another binding",
                    span,
                ));
            }
            self.assign(&location, updated, module, env)?;
        }
        Ok(result)
    }
    fn assign(
        &mut self,
        target: &Expr,
        value: Value,
        module: &str,
        env: &mut Env,
    ) -> Result<(), Diagnostic> {
        enum Part {
            Field(String),
            Index(Vec<AxisIndex>),
        }
        fn decompose(expr: &Expr) -> Option<(&str, Vec<&Expr>)> {
            match &expr.kind {
                ExprKind::Propagate(value) => decompose(value),
                ExprKind::Name(n) => Some((n, Vec::new())),
                ExprKind::Field { object, .. } | ExprKind::Index { object, .. } => {
                    let (name, mut path) = decompose(object)?;
                    path.push(expr);
                    Some((name, path))
                }
                _ => None,
            }
        }
        let (name, path) = decompose(target).ok_or_else(|| {
            self.error(
                "invalid_assignment",
                "assignment requires a variable, field, or list element",
                &target.span,
            )
        })?;
        let mut parts = Vec::new();
        for expr in path {
            match &expr.kind {
                ExprKind::Field { field, .. } => parts.push(Part::Field(field.clone())),
                ExprKind::Index { indices, .. } => {
                    parts.push(Part::Index(self.selectors(indices, module, env)?))
                }
                _ => unreachable!(),
            }
        }
        let key = Program::key(module, name);
        let binding = env
            .get(name)
            .or_else(|| self.state.globals.get(&key))
            .cloned()
            .ok_or_else(|| {
                self.error(
                    "unknown_name",
                    format!("unknown variable `{name}`"),
                    &target.span,
                )
            })?;
        if !binding.mutable {
            return Err(self.error(
                "immutable_binding",
                format!("`{name}` is immutable; declare it with `let mut`"),
                &target.span,
            ));
        }
        let mut replacement = binding.value.clone();
        let mut destination = &mut replacement;
        let mut parts = parts.into_iter().peekable();
        let mut value = Some(value);
        while let Some(part) = parts.next() {
            if let Part::Index(indices) = &part
                && let Value::Tensor(tensor) = &*destination
            {
                let mut selections = vec![indices.clone()];
                for part in parts.by_ref() {
                    let Part::Index(indices) = part else {
                        return Err(self.error(
                            "invalid_assignment",
                            "tensor elements have no assignable fields",
                            &target.span,
                        ));
                    };
                    selections.push(indices);
                }
                let assigned = value.take().expect("assignment consumes its value once");
                let updated = self.assign_tensor(tensor, &selections, assigned, &target.span)?;
                *destination = Value::Tensor(Box::new(updated));
                break;
            }
            destination = match (part, destination) {
                (Part::Field(field), Value::Record(record)) => {
                    record.fields.get_mut(&field).ok_or_else(|| {
                        self.error(
                            "unknown_field",
                            format!("unknown field `{field}`"),
                            &target.span,
                        )
                    })?
                }
                (Part::Index(indices), Value::List(values)) => {
                    let [AxisIndex::Index(index)] = indices.as_slice() else {
                        return Err(self.error(
                            "invalid_index",
                            "List assignment requires one scalar index",
                            &target.span,
                        ));
                    };
                    let index = normalize_index(*index, values.len()).ok_or_else(|| {
                        self.error(
                            "index_out_of_bounds",
                            "list index is out of bounds",
                            &target.span,
                        )
                    })?;
                    &mut values[index]
                }
                _ => {
                    return Err(self.error(
                        "invalid_assignment",
                        "assignment path does not match value shape",
                        &target.span,
                    ));
                }
            };
        }
        if let Some(value) = value {
            *destination = value;
        }
        self.check_value(&replacement, &target.span)?;
        self.expect_type(&replacement, &binding.ty, &binding.module, &target.span)?;
        self.validate_value(&replacement, &target.span, false)?;
        if let Some(binding) = env.get_mut(name) {
            binding.value = replacement;
        } else if let Some(binding) = self.state.globals.get_mut(&key) {
            binding.value = replacement;
        }
        Ok(())
    }
    fn assign_tensor(
        &mut self,
        tensor: &Tensor,
        selections: &[Vec<AxisIndex>],
        value: Value,
        span: &Span,
    ) -> Result<Tensor, Diagnostic> {
        let mut selected = tensor.clone();
        for indices in selections {
            if indices
                .iter()
                .all(|index| matches!(index, AxisIndex::Index(_)))
            {
                let indices = indices
                    .iter()
                    .map(|index| {
                        if let AxisIndex::Index(index) = index {
                            *index
                        } else {
                            unreachable!()
                        }
                    })
                    .collect::<Vec<_>>();
                // Scalar indexing has the same full-rank contract for reading and writing.
                selected
                    .get(&indices)
                    .map_err(|e| self.data_error(e, span))?;
            }
            selected = selected
                .slice(indices)
                .map_err(|e| self.data_error(e, span))?;
        }
        let (replacement_dtype, replacement_shape) = match &value {
            Value::Tensor(replacement) => (replacement.dtype(), replacement.shape()),
            value => {
                let scalar = data::as_scalar(value).ok_or_else(|| {
                    self.error(
                        "type_mismatch",
                        "tensor assignment requires matching numeric data",
                        span,
                    )
                })?;
                (scalar.dtype(), &[][..])
            }
        };
        if replacement_dtype != tensor.dtype() {
            return Err(self.error("type_mismatch", "tensor assignment dtypes must match", span));
        }
        if broadcast_shape(replacement_shape, selected.shape()).as_deref() != Some(selected.shape())
        {
            return Err(self.error(
                "shape_mismatch",
                "replacement cannot broadcast into the selected tensor shape",
                span,
            ));
        }
        let work = tensor.len().saturating_add(selected.len());
        // The SDK copies logical source bytes once and creates one independent packed
        // result. Account Vec-to-Arc transfer peak before either allocation occurs.
        let bytes = tensor.byte_len();
        let transient = bytes.saturating_mul(2).saturating_add(16);
        if bytes > self.limits.max_storage_bytes
            || transient
                > self
                    .limits
                    .max_allocation_bytes
                    .saturating_sub(self.allocated_bytes)
        {
            return Err(self.error(
                "allocation_limit",
                "tensor assignment exceeds packed copy budget",
                span,
            ));
        }
        self.data_budget(0, work, span)?;
        let rhs = match value {
            Value::Tensor(tensor) => *tensor,
            value => {
                let scalar = data::as_scalar(&value).expect("replacement checked above");
                Tensor::from_scalars(scalar.dtype(), vec![], vec![scalar])
                    .map_err(|e| self.data_error(e, span))?
            }
        };
        let updated = tensor
            .with_index_path(selections, &rhs)
            .map_err(|e| self.data_error(e, span))?;
        self.allocated_bytes = self.allocated_bytes.saturating_add(updated.byte_len());
        Ok(updated)
    }
    fn set_component(
        &mut self,
        id: u64,
        value: Value,
        add: bool,
        span: &Span,
    ) -> Result<(), Diagnostic> {
        self.validate_record(&value, span)?;
        let class = value.type_name().to_owned();
        let entity = self.state.entities.get_mut(&id).ok_or_else(|| {
            Diagnostic::new(
                "unknown_entity",
                format!("entity {id} does not exist"),
                span.clone(),
            )
        })?;
        if entity.components.contains_key(&class) == add {
            return Err(Diagnostic::new(
                if add {
                    "duplicate_component"
                } else {
                    "missing_component"
                },
                format!(
                    "entity {id} {} component `{class}`",
                    if add { "already has" } else { "does not have" }
                ),
                span.clone(),
            ));
        }
        entity.components.insert(class, value);
        Ok(())
    }
    fn range_values(&self, args: &[Value], span: &Span) -> Result<Value, Diagnostic> {
        let bounds = match args {
            [Value::Number(end)] => (0.0, *end),
            [Value::Number(start), Value::Number(end)] => (*start, *end),
            _ => return Err(self.error("arity", "range expects one or two numeric bounds", span)),
        };
        let (start, end) = bounds;
        if start.fract() != 0.0
            || end.fract() != 0.0
            || !start.is_finite()
            || !end.is_finite()
            || start.abs() > 9_007_199_254_740_991.0
            || end.abs() > 9_007_199_254_740_991.0
        {
            return Err(self.data_error(konjure_sdk::data::DataError::Bounds, span));
        }
        let length = (end - start).max(0.0);
        if length > self.limits.max_collection as f64 {
            return Err(self.error("collection_limit", "range exceeds collection limit", span));
        }
        Ok(Value::List(
            (0..length as usize)
                .map(|index| Value::Number(start + index as f64))
                .collect(),
        ))
    }
    fn builtin(
        &mut self,
        name: &str,
        args: Vec<Value>,
        module: &str,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        if name == "range" {
            let result = self.range_values(&args, span);
            return self.result_with_type(
                result,
                &data::result_type(Type::List(Box::new(Type::named("f64")))),
                span,
            );
        }

        if matches!(
            name,
            "shape" | "reshape" | "transpose" | "sum" | "matmul" | "utf8" | "bytes" | "decode"
        ) {
            return self.data_builtin(name, args, span);
        }
        let arity = match name {
            "add" | "get" | "set" | "has" | "bind" | "min" | "max" | "pow" | "append" => 2,
            "clamp" => 3,
            "noop" => 0,
            "range" => args.len(),
            _ => 1,
        };
        if args.len() != arity {
            return Err(self.error(
                "arity",
                format!("`{name}` expects {arity} arguments, got {}", args.len()),
                span,
            ));
        }
        let entity_id = |value: &Value| {
            if let Value::Entity(id) = value {
                Ok(*id)
            } else {
                Err(Diagnostic::new(
                    "type_mismatch",
                    "expected Entity",
                    span.clone(),
                ))
            }
        };
        let number = |value: &Value| {
            if let Value::Number(n) = value {
                Ok(*n)
            } else {
                Err(Diagnostic::new(
                    "type_mismatch",
                    "expected Number",
                    span.clone(),
                ))
            }
        };
        let class_key = |value: &Value| -> Result<String, Diagnostic> {
            let Value::Text(name) = value else {
                return Err(Diagnostic::new(
                    "type_mismatch",
                    "component name requires String",
                    span.clone(),
                ));
            };
            let (m, c) = self.program.class(module, name, span)?;
            Ok(Program::key(&m, &c.name))
        };
        let value = match name {
            "noop" => Value::algebraic(crate::EnumValue {
                origin: None,
                ty: data::result_type(Type::named("Unit")),
                case: "Ok".into(),
                payload: vec![Value::Unit],
            }),
            "ignore_number" => {
                number(&args[0])?;
                Value::algebraic(crate::EnumValue {
                    origin: None,
                    ty: data::result_type(Type::named("Unit")),
                    case: "Ok".into(),
                    payload: vec![Value::Unit],
                })
            }
            "bind" => {
                let entity = entity_id(&args[0])?;
                let class = class_key(&args[1])?;
                self.component_value(entity, &class, span)?;
                Value::ComponentReference(ComponentReference { entity, class })
            }
            "spawn" => {
                self.validate_record(&args[0], span)?;
                if self.state.entities.len() >= self.limits.max_entities {
                    return Err(self.error("entity_limit", "entity capacity exceeded", span));
                }
                let id = self.state.next_id;
                self.state.next_id = id
                    .checked_add(1)
                    .ok_or_else(|| self.error("entity_limit", "entity IDs exhausted", span))?;
                self.state.entities.insert(
                    id,
                    EntitySnapshot {
                        id,
                        components: BTreeMap::from([(
                            args[0].type_name().to_owned(),
                            args[0].clone(),
                        )]),
                        source: span.clone(),
                    },
                );
                self.record(span, format!("spawn {id}"));
                Value::Entity(id)
            }
            "add" | "set" => {
                self.set_component(entity_id(&args[0])?, args[1].clone(), name == "add", span)?;
                Value::Unit
            }
            "get" | "has" => {
                let id = entity_id(&args[0])?;
                let class = class_key(&args[1])?;
                let entity = self.state.entities.get(&id).ok_or_else(|| {
                    self.error(
                        "unknown_entity",
                        format!("entity {id} does not exist"),
                        span,
                    )
                })?;
                if name == "has" {
                    Value::Bool(entity.components.contains_key(&class))
                } else {
                    entity.components.get(&class).cloned().ok_or_else(|| {
                        self.error(
                            "missing_component",
                            format!("entity {id} has no `{class}`"),
                            span,
                        )
                    })?
                }
            }
            "query" => {
                let Value::Text(name) = &args[0] else {
                    return Err(self.error(
                        "type_mismatch",
                        "query requires a class or trait name String",
                        span,
                    ));
                };
                let classes = self.program.query_classes(module, name, span)?;
                Value::List(
                    self.state
                        .entities
                        .values()
                        .filter(|e| classes.iter().any(|c| e.components.contains_key(c)))
                        .map(|e| Value::Entity(e.id))
                        .collect(),
                )
            }
            "despawn" => {
                let id = entity_id(&args[0])?;
                if !self.state.entities.contains_key(&id) {
                    return Err(self.error(
                        "unknown_entity",
                        format!("entity {id} does not exist"),
                        span,
                    ));
                }
                self.state.pending_despawns.insert(id);
                Value::Unit
            }
            "print" => {
                self.data_budget(0, display_work(&args[0]), span)?;
                let available = self
                    .limits
                    .max_allocation_bytes
                    .saturating_sub(self.allocated_bytes);
                let mut text = BoundedText {
                    value: String::new(),
                    limit: self.limits.max_string_bytes.min(available),
                };
                std::fmt::write(&mut text, format_args!("{}", args[0])).map_err(|_| {
                    self.error(
                        if available < self.limits.max_string_bytes {
                            "allocation_limit"
                        } else {
                            "value_limit"
                        },
                        "printed value exceeds string or allocation budget",
                        span,
                    )
                })?;
                let text = text.value;
                self.allocated_bytes = self.allocated_bytes.saturating_add(text.len());
                if self.limits.max_logs > 0 {
                    if self.state.logs.len() >= self.limits.max_logs {
                        self.state.logs.remove(0);
                    }
                    self.state.logs.push(text);
                }
                Value::Unit
            }
            "len" => match &args[0] {
                Value::List(v) => Value::Number(v.len() as f64),
                Value::Text(s) => Value::Number(s.chars().count() as f64),
                Value::Bin(b) => Value::Number(b.byte_len() as f64),
                Value::Tensor(t) => Value::Number(t.len() as f64),
                _ => return Err(self.error("type_mismatch", "len requires List or String", span)),
            },
            "append" => {
                let Value::List(mut values) = args[0].clone() else {
                    return Err(self.error(
                        "type_mismatch",
                        "append requires List as first argument",
                        span,
                    ));
                };
                if !self.program.expression_types.contains_key(&(
                    span.module.clone(),
                    span.start,
                    span.end,
                )) && let Some(first) = values.first()
                    && infer_type(first) != infer_type(&args[1])
                {
                    return Err(self.error(
                        "type_mismatch",
                        "appended value has a different element type",
                        span,
                    ));
                }
                if values.len() >= self.limits.max_collection {
                    return Err(self.error(
                        "collection_limit",
                        "append exceeds collection limit",
                        span,
                    ));
                }
                values.push(args[1].clone());
                Value::List(values)
            }
            "sin" => Value::Number(libm::sin(number(&args[0])?)),
            "cos" => Value::Number(libm::cos(number(&args[0])?)),
            "sqrt" => Value::Number(libm::sqrt(number(&args[0])?)),
            "abs" => Value::Number(libm::fabs(number(&args[0])?)),
            "floor" => Value::Number(libm::floor(number(&args[0])?)),
            "ceil" => Value::Number(libm::ceil(number(&args[0])?)),
            "min" => Value::Number(number(&args[0])?.min(number(&args[1])?)),
            "max" => Value::Number(number(&args[0])?.max(number(&args[1])?)),
            "pow" => Value::Number(libm::pow(number(&args[0])?, number(&args[1])?)),
            "clamp" => {
                let (n, min, max) = (number(&args[0])?, number(&args[1])?, number(&args[2])?);
                if min > max {
                    return Err(self.error(
                        "invalid_bounds",
                        "clamp minimum exceeds maximum",
                        span,
                    ));
                }
                Value::Number(n.clamp(min, max))
            }
            _ => {
                return Err(self.error(
                    "unknown_function",
                    format!("unknown builtin `{name}`"),
                    span,
                ));
            }
        };
        if matches!(&value,Value::Number(value) if !value.is_finite()) {
            return Err(self.data_error(konjure_sdk::data::DataError::NonFinite, span));
        }
        self.check_value(&value, span)?;
        Ok(value)
    }
}

impl Evaluator<'_> {
    fn data_error(&self, error: konjure_sdk::data::DataError, span: &Span) -> Diagnostic {
        use konjure_sdk::data::DataError;
        let code = match error {
            DataError::Overflow => "numeric_overflow",
            DataError::DivisionByZero => "division_by_zero",
            DataError::InexactConversion => "inexact_conversion",
            DataError::Bounds => "index_out_of_bounds",
            DataError::InvalidSlice => "invalid_slice",
            DataError::ShapeMismatch | DataError::InvalidShape => "shape_mismatch",
            DataError::AllocationLimit => "allocation_limit",
            _ => "invalid_data",
        };
        let mut diagnostic = self.error(code, error.to_string(), span);
        diagnostic.data_error = Some(error.name().into());
        diagnostic
    }
    fn literal(&self, raw: &str, span: &Span) -> Result<Value, Diagnostic> {
        let dtype = self
            .program
            .expression_types
            .get(&(span.module.clone(), span.start, span.end))
            .and_then(data::dtype)
            .unwrap_or(DType::F64);
        Scalar::parse(dtype, raw)
            .map(data::scalar_value)
            .map_err(|e| self.data_error(e, span))
    }
    /// Preflight allocation and arithmetic work before invoking an allocating SDK operation.
    fn data_budget(&mut self, elements: usize, work: usize, span: &Span) -> Result<(), Diagnostic> {
        let bytes = elements
            .checked_mul(16)
            .ok_or_else(|| self.error("allocation_limit", "data size overflow", span))?;
        if bytes > self.limits.max_storage_bytes
            || bytes
                > self
                    .limits
                    .max_allocation_bytes
                    .saturating_sub(self.allocated_bytes)
        {
            return Err(self.error(
                "allocation_limit",
                "data operation exceeds byte budget",
                span,
            ));
        }
        if work > self.fuel {
            return Err(self.error(
                "fuel_exhausted",
                "data operation exceeds remaining operation work budget",
                span,
            ));
        }
        self.fuel -= work;
        Ok(())
    }
    fn signed_index_value(&self, value: &Value, span: &Span) -> Result<isize, Diagnostic> {
        let scalar = data::as_scalar(value)
            .ok_or_else(|| self.error("invalid_index", "index requires an integer", span))?;
        scalar
            .convert(DType::I128)
            .ok()
            .and_then(|s| s.to_string().parse::<i32>().ok())
            .map(|index| index as isize)
            .ok_or_else(|| {
                self.error(
                    "invalid_index",
                    "index must be an exact integer in the portable signed 32-bit index range",
                    span,
                )
            })
    }
    fn dimensions(&self, value: &Value, span: &Span) -> Result<Vec<usize>, Diagnostic> {
        let Value::List(values) = value else {
            return Err(self.error("type_mismatch", "shape requires List[f64]", span));
        };
        if values.len() > self.limits.max_value_depth {
            return Err(self.error("value_limit", "tensor rank limit exceeded", span));
        }
        values
            .iter()
            .map(|value| {
                let n = self.signed_index_value(value, span).map_err(|_| {
                    self.data_error(konjure_sdk::data::DataError::InvalidShape, span)
                })?;
                usize::try_from(n).map_err(|_| {
                    self.error(
                        "invalid_shape",
                        "shape dimensions and axis permutations must be nonnegative",
                        span,
                    )
                })
            })
            .collect()
    }
    fn selectors(
        &mut self,
        indices: &[IndexExpr],
        module: &str,
        env: &mut Env,
    ) -> Result<Vec<AxisIndex>, Diagnostic> {
        let mut result = Vec::with_capacity(indices.len());
        for index in indices {
            result.push(match index {
                IndexExpr::Index(expr) => {
                    let value = self.eval(expr, module, env)?;
                    AxisIndex::Index(self.signed_index_value(&value, &expr.span)?)
                }
                IndexExpr::Slice { start, stop, step } => {
                    let mut eval_bound =
                        |expr: &Option<Box<Expr>>| -> Result<Option<isize>, Diagnostic> {
                            expr.as_ref()
                                .map(|expr| {
                                    let value = self.eval(expr, module, env)?;
                                    self.signed_index_value(&value, &expr.span)
                                })
                                .transpose()
                        };
                    let start = eval_bound(start)?;
                    let stop = eval_bound(stop)?;
                    let step = eval_bound(step)?.unwrap_or(1);
                    AxisIndex::Slice { start, stop, step }
                }
                IndexExpr::NewAxis => AxisIndex::NewAxis,
                IndexExpr::Ellipsis => AxisIndex::Ellipsis,
            });
        }
        Ok(result)
    }
    fn index_value(
        &mut self,
        value: Value,
        indices: &[AxisIndex],
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        match value {
            Value::Tensor(t) => {
                if indices.iter().all(|i| matches!(i, AxisIndex::Index(_))) {
                    let indices = indices
                        .iter()
                        .map(|i| {
                            if let AxisIndex::Index(n) = i {
                                *n
                            } else {
                                unreachable!()
                            }
                        })
                        .collect::<Vec<_>>();
                    t.get(&indices)
                        .map(data::scalar_value)
                        .map_err(|e| self.data_error(e, span))
                } else {
                    t.slice(indices)
                        .map(|tensor| Value::Tensor(Box::new(tensor)))
                        .map_err(|e| self.data_error(e, span))
                }
            }
            Value::List(values) => {
                let [AxisIndex::Index(index)] = indices else {
                    return Err(self.error(
                        "invalid_index",
                        "Lists require one scalar index",
                        span,
                    ));
                };
                let index = normalize_index(*index, values.len()).ok_or_else(|| {
                    self.error("index_out_of_bounds", "list index out of bounds", span)
                })?;
                Ok(values[index].clone())
            }
            Value::Bin(bytes) => {
                let [selector] = indices else {
                    return Err(self.error(
                        "invalid_index",
                        "Bin requires one index or slice",
                        span,
                    ));
                };
                if let AxisIndex::Index(index) = selector {
                    let index = normalize_index(*index, bytes.byte_len()).ok_or_else(|| {
                        self.error("index_out_of_bounds", "byte index out of bounds", span)
                    })?;
                    return Scalar::from_bits(DType::U8, bytes.as_bytes()[index] as u128)
                        .map(data::scalar_value)
                        .map_err(|e| self.data_error(e, span));
                }
                self.data_budget(bytes.byte_len(), bytes.byte_len(), span)?;
                let selected = sequence_indices(selector, bytes.byte_len())
                    .map_err(|e| self.error("invalid_slice", e, span))?;
                Ok(Value::Bin(
                    selected
                        .into_iter()
                        .map(|i| bytes.as_bytes()[i])
                        .collect::<Vec<_>>()
                        .into(),
                ))
            }
            Value::Text(text) => {
                let [selector] = indices else {
                    return Err(self.error(
                        "invalid_index",
                        "Str requires one index or slice",
                        span,
                    ));
                };
                self.data_budget(text.len(), text.chars().count(), span)?;
                let chars = text.chars().collect::<Vec<_>>();
                let selected = sequence_indices(selector, chars.len())
                    .map_err(|e| self.error("invalid_slice", e, span))?;
                Ok(Value::Text(
                    selected
                        .into_iter()
                        .map(|i| chars[i])
                        .collect::<String>()
                        .into(),
                ))
            }
            _ => Err(self.error(
                "type_mismatch",
                "indexing requires Tensor, List, Str or Bin",
                span,
            )),
        }
    }
    fn typed_data_builtin(
        &mut self,
        name: &str,
        target: &Type,
        args: Vec<Value>,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        let dtype = data::dtype(target)
            .ok_or_else(|| self.error("invalid_dtype", "type argument must be numeric", span))?;
        match (name, args.as_slice()) {
            ("tensor", [Value::List(values), shape]) => {
                let shape = self.dimensions(shape, span)?;
                let elements = shape
                    .iter()
                    .try_fold(1usize, |a, b| a.checked_mul(*b))
                    .ok_or_else(|| {
                        self.error("allocation_limit", "tensor shape product overflow", span)
                    })?;
                if elements != values.len() {
                    return Err(self.error(
                        "shape_mismatch",
                        "shape product must equal element count",
                        span,
                    ));
                }
                self.data_budget(elements, elements, span)?;
                let values = values
                    .iter()
                    .map(|value| {
                        data::as_scalar(value)
                            .filter(|s| s.dtype() == dtype)
                            .ok_or_else(|| {
                                self.error(
                                    "type_mismatch",
                                    "tensor element dtype must match T",
                                    span,
                                )
                            })
                    })
                    .collect::<Result<Vec<_>, _>>()?;
                Tensor::from_scalars(dtype, shape, values)
                    .map(|tensor| Value::Tensor(Box::new(tensor)))
                    .map_err(|e| self.data_error(e, span))
            }
            ("convert", [Value::Tensor(t)]) => {
                self.data_budget(t.len(), t.len(), span)?;
                t.convert(dtype)
                    .map(|tensor| Value::Tensor(Box::new(tensor)))
                    .map_err(|e| self.data_error(e, span))
            }
            ("convert", [value]) => data::as_scalar(value)
                .ok_or_else(|| self.error("type_mismatch", "convert requires numeric data", span))?
                .convert(dtype)
                .map(data::scalar_value)
                .map_err(|e| self.data_error(e, span)),
            _ => Err(self.error("arity", format!("invalid arguments for {name}[T]"), span)),
        }
    }
    fn tensor_binary(
        &mut self,
        op: &str,
        left: Value,
        right: Value,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        let scalar_tensor = |value: Value| -> Result<Tensor, Diagnostic> {
            match value {
                Value::Tensor(t) => Ok(*t),
                value => {
                    let s = data::as_scalar(&value).ok_or_else(|| {
                        self.error(
                            "type_mismatch",
                            "tensor arithmetic requires numeric operands",
                            span,
                        )
                    })?;
                    Tensor::from_scalars(s.dtype(), vec![], vec![s])
                        .map_err(|e| self.data_error(e, span))
                }
            }
        };
        let left = scalar_tensor(left)?;
        let right = scalar_tensor(right)?;
        let (elements, work) = tensor_work(&left, &right, op == "@").ok_or_else(|| {
            self.error(
                "shape_mismatch",
                "incompatible tensor shapes or shape product overflow",
                span,
            )
        })?;
        self.data_budget(elements, work, span)?;
        let result = if op == "@" {
            left.matmul(&right)
        } else {
            let operation = data::binary_op(op).ok_or_else(|| {
                self.error("unknown_operator", "unsupported tensor operator", span)
            })?;
            left.binary(operation, &right)
        };
        result
            .map(|tensor| Value::Tensor(Box::new(tensor)))
            .map_err(|e| self.data_error(e, span))
    }
    fn data_builtin(
        &mut self,
        name: &str,
        args: Vec<Value>,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        match (name, args.as_slice()) {
            ("utf8", [Value::Text(text)]) => {
                self.data_budget(text.len(), text.len(), span)?;
                Ok(Value::Bin(text.as_bytes().into()))
            }
            ("decode", [Value::Bin(bytes)]) => {
                self.data_budget(bytes.byte_len(), bytes.byte_len(), span)?;
                std::str::from_utf8(bytes.as_bytes())
                    .map(|s| Value::Text(s.into()))
                    .map_err(|_| self.error("invalid_utf8", "Bin contains invalid UTF-8", span))
            }
            ("bytes", [Value::List(values)]) => {
                self.data_budget(values.len(), values.len(), span)?;
                let bytes = values
                    .iter()
                    .map(|v| {
                        data::as_scalar(v)
                            .filter(|s| s.dtype() == DType::U8)
                            .map(|s| s.bits() as u8)
                            .ok_or_else(|| {
                                self.error("type_mismatch", "bytes requires List[u8]", span)
                            })
                    })
                    .collect::<Result<Vec<_>, _>>()?;
                Ok(Value::Bin(bytes.into()))
            }
            ("shape", [Value::Tensor(t)]) => Ok(Value::List(
                t.shape().iter().map(|d| Value::Number(*d as f64)).collect(),
            )),
            ("reshape", [Value::Tensor(t), shape]) => {
                let shape = self.dimensions(shape, span)?;
                self.data_budget(t.len(), t.len(), span)?;
                t.reshape(shape)
                    .map(|tensor| Value::Tensor(Box::new(tensor)))
                    .map_err(|e| self.data_error(e, span))
            }
            ("transpose", [Value::Tensor(t)]) => {
                let axes = (0..t.shape().len()).rev().collect::<Vec<_>>();
                t.transpose(&axes)
                    .map(|tensor| Value::Tensor(Box::new(tensor)))
                    .map_err(|e| self.data_error(e, span))
            }
            ("transpose", [Value::Tensor(t), axes]) => {
                let axes = self.dimensions(axes, span)?;
                t.transpose(&axes)
                    .map(|tensor| Value::Tensor(Box::new(tensor)))
                    .map_err(|e| self.data_error(e, span))
            }
            ("sum", [Value::Tensor(t)]) => {
                self.data_budget(1, t.len(), span)?;
                t.sum()
                    .map(data::scalar_value)
                    .map_err(|e| self.data_error(e, span))
            }
            ("matmul", [Value::Tensor(a), Value::Tensor(b)]) => self.tensor_binary(
                "@",
                Value::Tensor(a.clone()),
                Value::Tensor(b.clone()),
                span,
            ),
            _ => Err(self.error(
                "type_mismatch",
                format!("invalid arguments for {name}"),
                span,
            )),
        }
    }
}
fn enum_type_compatible(actual: &Type, expected: &Type) -> bool {
    actual == expected
        || *actual == Type::named("Never")
        || match (actual, expected) {
            (
                Type::Applied {
                    name: a,
                    arguments: av,
                },
                Type::Applied {
                    name: b,
                    arguments: bv,
                },
            ) => {
                a == b
                    && av.len() == bv.len()
                    && av.iter().zip(bv).all(|(a, b)| enum_type_compatible(a, b))
            }
            _ => false,
        }
}
impl Evaluator<'_> {
    fn host_propagation(&mut self, error: Diagnostic) -> Diagnostic {
        if error.code != "__return_algebraic" {
            return error;
        }
        match self.propagated.take() {
            Some(value) => self.algebraic_error(&value, &error.span),
            None => self.error("invalid_control", "missing propagated value", &error.span),
        }
    }
    fn algebraic_error(&self, value: &Value, span: &Span) -> Diagnostic {
        let case = match value {
            Value::Enum(value) if value.case == "Err" => value
                .payload
                .first()
                .map(ToString::to_string)
                .unwrap_or_else(|| "Unknown".into()),
            _ => "Absent".into(),
        };
        let code = match case.as_str() {
            "Overflow" => "numeric_overflow",
            "DivisionByZero" => "division_by_zero",
            "InexactConversion" => "inexact_conversion",
            "Bounds" => "index_out_of_bounds",
            "InvalidUtf8" => "invalid_utf8",
            "InvalidShape" | "ShapeMismatch" => "shape_mismatch",
            "InvalidSlice" => "invalid_slice",
            _ => "data_error",
        };
        let origin = match value {
            Value::Enum(value) => value.origin.as_ref().unwrap_or(span),
            _ => span,
        };
        let mut diagnostic =
            self.error(code, format!("operation returned DataError.{case}"), origin);
        diagnostic.data_error = Some(case);
        diagnostic
    }
    fn accept_lifecycle_result(&self, value: Value, span: &Span) -> Result<(), Diagnostic> {
        if let Value::Enum(result) = &value {
            if result.case == "Ok" && result.payload == vec![Value::Unit] {
                return Ok(());
            }
            if result.case == "Err" {
                return Err(self.algebraic_error(&value, span));
            }
        }
        Err(self.error(
            "invalid_control",
            "lifecycle must return Unit or Res[Unit,DataError]",
            span,
        ))
    }
    fn enum_payload(&self, ty: &Type, case: &str, span: &Span) -> Result<Vec<Type>, Diagnostic> {
        if let Some(payload) = data::enum_payload(ty, case) {
            return Ok(payload);
        }
        let Type::Named(key) = ty else {
            return Err(self.error("invalid_enum", "unknown applied enum case", span));
        };
        let (module, declaration) = self
            .program
            .enum_by_key(key)
            .ok_or_else(|| self.error("invalid_enum", "unknown enum identity", span))?;
        let variant = declaration
            .cases
            .iter()
            .find(|variant| variant.name == case)
            .ok_or_else(|| self.error("invalid_enum", "unknown enum case", span))?;
        variant
            .payload
            .iter()
            .map(|ty| self.program.canonical_type(module, ty, span))
            .collect()
    }
    fn case_expression(
        &self,
        name: &str,
        args: Option<Vec<Value>>,
        module: &str,
        span: &Span,
    ) -> Result<Option<Value>, Diagnostic> {
        let resolved = if matches!(name, "Ok" | "Err" | "Some" | "None") {
            None
        } else {
            match self.program.variant(module, name, span) {
                Ok(value) => value,
                Err(error) if error.code == "unknown_module" || error.code == "private_name" => {
                    return Ok(None);
                }
                Err(error) => return Err(error),
            }
        };
        if resolved.is_none() && !matches!(name, "Ok" | "Err" | "Some" | "None") {
            return Ok(None);
        }
        let checked = self
            .program
            .expression_types
            .get(&(span.module.clone(), span.start, span.end))
            .ok_or_else(|| self.error("invalid_enum", "missing checked enum type", span))?;
        let (owner, payload) = match checked {
            Type::Function {
                parameters,
                returns,
            } => (returns.as_ref().clone(), parameters.clone()),
            ty => (ty.clone(), vec![]),
        };
        let case = resolved
            .map(|(_, case, _)| case)
            .unwrap_or_else(|| name.into());
        if let Some(args) = args {
            return Ok(Some(Value::algebraic(crate::EnumValue {
                origin: None,
                ty: owner,
                case,
                payload: args,
            })));
        }
        if payload.is_empty() {
            Ok(Some(Value::algebraic(crate::EnumValue {
                origin: None,
                ty: owner,
                case,
                payload: vec![],
            })))
        } else {
            Ok(Some(Value::Function(Box::new(FunctionValue {
                target: FunctionTarget::EnumConstructor { ty: owner, case },
                signature: checked.clone(),
            }))))
        }
    }
    fn data_method_value(
        &self,
        receiver: Value,
        method: &str,
        argument: Option<&Type>,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        let receiver_type = self
            .program
            .method_receivers
            .get(&(span.module.clone(), span.start, span.end))
            .cloned()
            .unwrap_or_else(|| infer_type(&receiver));
        let checked =
            self.program
                .expression_types
                .get(&(span.module.clone(), span.start, span.end));
        let signatures = crate::methods::signatures(&receiver_type, method, argument);
        let signature = checked
            .filter(|ty| signatures.contains(ty))
            .cloned()
            .or_else(|| (signatures.len() == 1).then(|| signatures[0].clone()))
            .ok_or_else(|| {
                self.error(
                    "invalid_function",
                    "missing checked data method signature",
                    span,
                )
            })?;
        Ok(Value::Function(Box::new(FunctionValue {
            target: FunctionTarget::DataMethod {
                receiver_type,
                method: method.into(),
                type_argument: argument.cloned().map(Box::new),
                receiver: Box::new(receiver),
            },
            signature,
        })))
    }
    fn data_result(
        &self,
        result: Result<Value, Diagnostic>,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        let ty = self
            .program
            .expression_types
            .get(&(span.module.clone(), span.start, span.end))
            .cloned()
            .ok_or_else(|| self.error("invalid_enum", "missing checked result type", span))?;
        self.result_with_type(result, &ty, span)
    }
    fn result_with_type(
        &self,
        result: Result<Value, Diagnostic>,
        ty: &Type,
        _span: &Span,
    ) -> Result<Value, Diagnostic> {
        let (case, payload, origin) = match result {
            Ok(value) => ("Ok", value, None),
            Err(error) => {
                let case = if let Some(case) = error.data_error.as_deref() {
                    case
                } else {
                    match error.code.as_str() {
                        "numeric_overflow" => "Overflow",
                        "division_by_zero" => "DivisionByZero",
                        "inexact_conversion" => "InexactConversion",
                        "index_out_of_bounds" => "Bounds",
                        "invalid_index" => "Bounds",
                        "invalid_bounds" => "Bounds",
                        "invalid_slice" => "InvalidSlice",
                        "shape_mismatch" => "ShapeMismatch",
                        "invalid_shape" => "InvalidShape",
                        "invalid_utf8" => "InvalidUtf8",
                        "non_finite" => "NonFinite",
                        "invalid_data" => "InvalidLiteral",
                        _ => return Err(error),
                    }
                };
                (
                    "Err",
                    Value::algebraic(crate::EnumValue {
                        origin: None,
                        ty: Type::named("DataError"),
                        case: case.into(),
                        payload: vec![],
                    }),
                    Some(error.span.clone()),
                )
            }
        };
        Ok(Value::algebraic(crate::EnumValue {
            origin,
            ty: ty.clone(),
            case: case.into(),
            payload: vec![payload],
        }))
    }
    fn call_data_method(
        &mut self,
        receiver: Value,
        method: &str,
        argument: Option<&Type>,
        args: Vec<Value>,
        returns: &Type,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        if method == "get" {
            let result = match (&receiver, args.as_slice()) {
                (Value::Tensor(t), [Value::List(indices)]) => {
                    let indices = indices
                        .iter()
                        .map(|value| self.signed_index_value(value, span))
                        .collect::<Result<Vec<_>, _>>();
                    indices.and_then(|indices| {
                        t.get(&indices)
                            .map(data::scalar_value)
                            .map_err(|e| self.data_error(e, span))
                    })
                }
                (Value::List(values), [index]) => {
                    self.signed_index_value(index, span).and_then(|index| {
                        normalize_index(index, values.len())
                            .map(|index| values[index].clone())
                            .ok_or_else(|| {
                                self.error("index_out_of_bounds", "list index out of bounds", span)
                            })
                    })
                }
                (Value::Text(text), [index]) => {
                    self.signed_index_value(index, span).and_then(|index| {
                        normalize_index(index, text.as_str().chars().count())
                            .and_then(|index| text.as_str().chars().nth(index))
                            .map(|ch| Value::Text(ch.to_string().into()))
                            .ok_or_else(|| {
                                self.error("index_out_of_bounds", "text index out of bounds", span)
                            })
                    })
                }
                (Value::Bin(bytes), [index]) => {
                    self.signed_index_value(index, span).and_then(|index| {
                        normalize_index(index, bytes.byte_len())
                            .map(|index| {
                                data::scalar_value(
                                    Scalar::from_bits(DType::U8, bytes.as_bytes()[index] as u128)
                                        .expect("u8 byte"),
                                )
                            })
                            .ok_or_else(|| {
                                self.error("index_out_of_bounds", "byte index out of bounds", span)
                            })
                    })
                }
                _ => return Err(self.error("type_mismatch", "invalid get method arguments", span)),
            };
            return match result {
                Ok(value) => Ok(Value::algebraic(crate::EnumValue {
                    origin: None,
                    ty: returns.clone(),
                    case: "Some".into(),
                    payload: vec![value],
                })),
                Err(error)
                    if matches!(
                        error.code.as_str(),
                        "index_out_of_bounds"
                            | "shape_mismatch"
                            | "invalid_shape"
                            | "invalid_index"
                    ) =>
                {
                    Ok(Value::algebraic(crate::EnumValue {
                        origin: None,
                        ty: returns.clone(),
                        case: "None".into(),
                        payload: vec![],
                    }))
                }
                Err(error) => Err(error),
            };
        }
        let mut all = vec![receiver];
        all.extend(args);
        let result = if method == "convert" {
            self.typed_data_builtin(
                "convert",
                argument.expect("checked conversion target"),
                all,
                span,
            )
        } else if matches!(
            method,
            "utf8" | "decode" | "shape" | "reshape" | "transpose" | "sum" | "matmul"
        ) {
            self.data_builtin(method, all, span)
        } else {
            self.builtin(method, all, MAIN, span)
        };
        if matches!(returns,Type::Applied{name,..}if name=="Res") {
            self.result_with_type(result, returns, span)
        } else {
            result
        }
    }
    fn eval_tensor_literal(
        &mut self,
        values: &[Expr],
        dtype: &Type,
        module: &str,
        env: &mut Env,
        span: &Span,
    ) -> Result<Value, Diagnostic> {
        fn dimensions(values: &[Expr]) -> Vec<usize> {
            let mut shape = vec![values.len()];
            if let Some(Expr {
                kind: ExprKind::List(children),
                ..
            }) = values.first()
            {
                shape.extend(dimensions(children));
            }
            shape
        }
        fn count(values: &[Expr]) -> usize {
            values
                .iter()
                .map(|value| {
                    if let ExprKind::List(children) = &value.kind {
                        count(children)
                    } else {
                        1
                    }
                })
                .sum()
        }
        fn collect(
            evaluator: &mut Evaluator<'_>,
            values: &[Expr],
            module: &str,
            env: &mut Env,
            output: &mut Vec<Scalar>,
        ) -> Result<(), Diagnostic> {
            for value in values {
                if let ExprKind::List(children) = &value.kind {
                    collect(evaluator, children, module, env, output)?;
                } else {
                    let scalar = evaluator.eval(value, module, env)?;
                    output.push(data::as_scalar(&scalar).expect("checked numeric tensor element"));
                }
            }
            Ok(())
        }
        let elements = count(values);
        self.data_budget(elements, elements, span)?;
        let mut packed = Vec::with_capacity(elements);
        collect(self, values, module, env, &mut packed)?;
        Tensor::from_scalars(
            data::dtype(dtype).expect("checked tensor dtype"),
            dimensions(values),
            packed,
        )
        .map(|tensor| Value::Tensor(Box::new(tensor)))
        .map_err(|error| self.data_error(error, span))
    }
    fn pattern_matches(
        &self,
        pattern: &Pattern,
        value: &Value,
        bindings: &mut Vec<(String, Value)>,
        _span: &Span,
    ) -> Result<bool, Diagnostic> {
        Ok(match pattern {
            Pattern::Wildcard => true,
            Pattern::Binding(name) => {
                bindings.push((name.clone(), value.clone()));
                true
            }
            Pattern::Case { name, payload } => {
                if let Value::Enum(value) = value {
                    if name.rsplit('.').next() != Some(value.case.as_str())
                        || payload.len() != value.payload.len()
                    {
                        false
                    } else {
                        let mut matched = true;
                        for (pattern, value) in payload.iter().zip(&value.payload) {
                            if !self.pattern_matches(pattern, value, bindings, _span)? {
                                matched = false;
                                break;
                            }
                        }
                        matched
                    }
                } else {
                    false
                }
            }
            Pattern::Record { fields, .. } => {
                if let Value::Record(value) = value {
                    let mut matched = true;
                    for (name, pattern) in fields {
                        if !self.pattern_matches(pattern, &value.fields[name], bindings, _span)? {
                            matched = false;
                            break;
                        }
                    }
                    matched
                } else {
                    false
                }
            }
            Pattern::Literal(expr) => match &expr.kind {
                ExprKind::Number(raw) => data::as_scalar(value)
                    .is_some_and(|value| Scalar::parse(value.dtype(), raw) == Ok(value)),
                ExprKind::Unary { op, value: expr } if op == "-" => {
                    if let ExprKind::Number(raw) = &expr.kind {
                        data::as_scalar(value).is_some_and(|value| {
                            Scalar::parse(value.dtype(), &format!("-{raw}")) == Ok(value)
                        })
                    } else {
                        false
                    }
                }
                ExprKind::Bool(expected) => value == &Value::Bool(*expected),
                ExprKind::Text(expected) => {
                    matches!(value,Value::Text(value)if value.as_str()==expected)
                }
                ExprKind::Unit => value == &Value::Unit,
                _ => false,
            },
        })
    }
}
fn normalize_index(index: isize, length: usize) -> Option<usize> {
    let length = isize::try_from(length).ok()?;
    let index = if index < 0 {
        length.checked_add(index)?
    } else {
        index
    };
    if index >= 0 && index < length {
        usize::try_from(index).ok()
    } else {
        None
    }
}
fn sequence_indices(selector: &AxisIndex, length: usize) -> Result<Vec<usize>, &'static str> {
    match selector {
        AxisIndex::Index(index) => normalize_index(*index, length)
            .map(|i| vec![i])
            .ok_or("index out of bounds"),
        AxisIndex::Slice { start, stop, step } => {
            if *step == 0 {
                return Err("slice step cannot be zero");
            }
            let length = isize::try_from(length).map_err(|_| "sequence too long")?;
            let bound = |value: Option<isize>, default: isize| -> isize {
                value
                    .map(|v| {
                        let v = if v < 0 { length.saturating_add(v) } else { v };
                        if *step > 0 {
                            v.clamp(0, length)
                        } else {
                            v.clamp(-1, length - 1)
                        }
                    })
                    .unwrap_or(default)
            };
            let mut current = bound(*start, if *step > 0 { 0 } else { length - 1 });
            let stop = bound(*stop, if *step > 0 { length } else { -1 });
            let mut selected = Vec::new();
            while if *step > 0 {
                current < stop
            } else {
                current > stop
            } {
                selected.push(current as usize);
                let Some(next) = current.checked_add(*step) else {
                    break;
                };
                current = next;
            }
            Ok(selected)
        }
        _ => Err("Str and Bin slices do not accept new axes or ellipsis"),
    }
}
fn broadcast_shape(left: &[usize], right: &[usize]) -> Option<Vec<usize>> {
    let rank = left.len().max(right.len());
    let mut shape = vec![1; rank];
    for (axis, out) in shape.iter_mut().enumerate() {
        let a = left.len().checked_sub(rank - axis).map_or(1, |i| left[i]);
        let b = right.len().checked_sub(rank - axis).map_or(1, |i| right[i]);
        if a != b && a != 1 && b != 1 {
            return None;
        }
        *out = if a == 1 { b } else { a };
    }
    Some(shape)
}
fn tensor_work(a: &Tensor, b: &Tensor, matmul: bool) -> Option<(usize, usize)> {
    if matmul {
        let aa = a.shape();
        let bb = b.shape();
        if aa.len() < 2 || bb.len() < 2 || aa[aa.len() - 1] != bb[bb.len() - 2] {
            return None;
        }
        let batch = broadcast_shape(&aa[..aa.len() - 2], &bb[..bb.len() - 2])?;
        let batches = batch.iter().try_fold(1usize, |n, d| n.checked_mul(*d))?;
        let output = batches
            .checked_mul(aa[aa.len() - 2])?
            .checked_mul(bb[bb.len() - 1])?;
        Some((
            output,
            output.checked_mul(aa[aa.len() - 1])?.checked_mul(2)?,
        ))
    } else {
        let shape = broadcast_shape(a.shape(), b.shape())?;
        let count = shape.iter().try_fold(1usize, |n, d| n.checked_mul(*d))?;
        Some((count, count))
    }
}

struct BoundedText {
    value: String,
    limit: usize,
}
impl std::fmt::Write for BoundedText {
    fn write_str(&mut self, text: &str) -> std::fmt::Result {
        if text.len() > self.limit.saturating_sub(self.value.len()) {
            return Err(std::fmt::Error);
        }
        self.value.push_str(text);
        Ok(())
    }
}
fn display_work(value: &Value) -> usize {
    match value {
        Value::Enum(value) => value.payload.iter().fold(1usize, |work, value| {
            work.saturating_add(display_work(value))
        }),
        Value::Tensor(t) => t.len(),
        Value::Text(s) => s.len(),
        Value::Bin(b) => b.byte_len(),
        Value::Record(r) => r
            .fields
            .values()
            .fold(1usize, |n, v| n.saturating_add(display_work(v))),
        Value::List(values) => values
            .iter()
            .fold(1usize, |n, v| n.saturating_add(display_work(v))),
        _ => 1,
    }
}