Make callable values Program-owned

Author: fffonion

README.md

@@ -674,7 +674,7 @@ The compiler keeps direct host dispatch separate from script callable dispatch.
    - `ret` completes the active typed continuation: root halt, caller resume, or host return.
 
 At runtime, direct `call` uses `Vm::execute_host_call`, while `callvalue` validates the callable's
-Program instance, prototype, schema, arity, and frame layout before dispatch. VMBC v9 carries the
+prototype, schema, arity, and frame layout before dispatch. VMBC v9 carries the
 script-function, prototype, function-region, and root-binding tables. See
 [`docs/callable-runtime.md`](docs/callable-runtime.md) for the bytecode, lifecycle, callback, and
 optimized-backend contracts.

docs/callable-runtime.md

@@ -9,7 +9,7 @@ RustScript bytecode format version 9 introduces runtime script call frames and f
 - callable environments are bound through the internal builtin call path; callable creation adds no bytecode opcode.
 - `ret` completes the active script frame. A nested frame leaves exactly one result at the caller segment base, using `null` when the body produced no value. Root `ret` keeps the historical program-result stack behavior.
 
-VMBC v9 is a hard format boundary. Decoders reject older versions. The stream includes script-function entry ranges, callable prototypes, function regions, and root callable bindings. PDRC recordings and AOT artifacts use their corresponding bumped format/ABI versions and include callable metadata in cache identity.
+VMBC v9 is a hard format boundary. Decoders reject older versions. The stream includes script-function entry ranges, callable prototypes, function regions, and root callable bindings. PDRC v4 recordings and AOT artifacts use their corresponding bumped format/ABI versions and include callable metadata in cache identity.
 
 ## Runtime model
 
@@ -26,11 +26,11 @@ Branches are restricted to the active function region. Validation rejects cross-
 
 ## Callable identity and lifetime
 
-A callable contains the owning program-instance ID, prototype ID, kind, and optional environment. Capture-free function items compare by program/prototype identity. Closures compare by runtime identity. Callable constants are forbidden; functions are initialized from program metadata and closures are materialized at their declaration site.
+A callable contains its prototype ID, kind, and optional environment. The Program/Store owns the callable lifetime. Capture-free function items compare by prototype identity inside that Program; closures compare by runtime environment identity. Callable constants are forbidden; functions are initialized from Program metadata and closures are materialized at their declaration site.
 
-Resetting or replacing the VM program assigns a new program-instance ID. Calling a value from an older instance reports `StaleCallable`.
+Reset clears Program runtime values and rebinds root function items from Program metadata. Program replacement cancels and releases the old Store callback registry before dropping the old Program. Raw callable values are Program-local and are not portable across Program/Store boundaries.
 
-`Vm::invoke_callable` is the synchronous host-entry API for a callable retained after the root program halts. For resumable work, `Vm::start_callable` returns `VmStatus`; after `Yielded` or `Waiting`, continue with `Vm::resume` and read the completed value with `Vm::take_callable_result`. `ScriptCallback::start` and `Store::take_callback_result` expose the same flow for typed callbacks. `Store::script_callback` validates the Store identity, Program instance, arity, and copied callable schema and returns a typed `ScriptCallback<Args, Ret>`. A callback can invoke directly, create a `Send` queued invocation on another thread, unsubscribe all aliases, or enter the Store FIFO through `enqueue_callback`; queue errors propagate and no implicit coalescing occurs. `Vm::shutdown` clears queued work, runtime values and host resources before invalidating every exported callable.
+`Vm::invoke_callable` is the synchronous host-entry API for a callable retained while the current Program is active. For resumable work, `Vm::start_callable` returns `VmStatus`; after `Yielded` or `Waiting`, continue with `Vm::resume` and read the completed value with `Vm::take_callable_result`. `ScriptCallback::start` and `Store::take_callback_result` expose the same flow for typed callbacks. `Store::script_callback` validates Store ownership, arity, and the copied callable schema and returns a typed `ScriptCallback<Args, Ret>` with no stale identity field. A callback can invoke directly, create a `Send` queued invocation on another thread, unsubscribe all aliases, or enter the Store FIFO through `enqueue_callback`; queue errors propagate and no implicit coalescing occurs. `Vm::shutdown` clears queued work, runtime values and host resources before invalidating every exported callback through the Store registry.
 
 PDRC recordings preserve full execution-frame metadata. Callable environments use identity-table encoding, so aliases still share one environment after decode.
 

pd-vm-nostd/src/error.rs

@@ -13,7 +13,6 @@ pub enum VmError {
     InvalidLocal(u8),
     InvalidCall(u16),
     InvalidCallable,
-    StaleCallable,
     InvalidCallablePrototype(u32),
     CallStackOverflow,
     InvalidCallArity {
@@ -49,7 +48,6 @@ impl fmt::Display for VmError {
             Self::InvalidLocal(index) => write!(f, "invalid local index: {index}"),
             Self::InvalidCall(index) => write!(f, "invalid call index: {index}"),
             Self::InvalidCallable => f.write_str("callvalue operand is not callable"),
-            Self::StaleCallable => f.write_str("callable belongs to another program instance"),
             Self::InvalidCallablePrototype(index) => {
                 write!(f, "invalid callable prototype: {index}")
             }

pd-vm-nostd/src/lib.rs

@@ -20,7 +20,7 @@ pub use program::{
     CallablePrototype, CallableTarget, FunctionRegion, HostImport, OpCode, Program,
     RootCallableBinding, ScriptFunction, ValueType,
 };
-pub use value::{CallableEnvironment, CallableKind, CallableValue, ProgramInstanceId, Value};
+pub use value::{CallableEnvironment, CallableKind, CallableValue, Value};
 pub use vm::{Vm, VmResult, VmStatus};
 pub use vmbc::decode_program;
 

pd-vm-nostd/src/value.rs

@@ -7,7 +7,6 @@ pub type SharedString = Rc<String>;
 pub type SharedBytes = Rc<Vec<u8>>;
 pub type SharedArray = Rc<Vec<Value>>;
 pub type SharedMap = Rc<Vec<(Value, Value)>>;
-pub type ProgramInstanceId = u64;
 pub type SharedCallable = Rc<CallableValue>;
 pub type CallableEnvironment = Rc<RefCell<Vec<Value>>>;
 
@@ -20,7 +19,6 @@ pub enum CallableKind {
 
 #[derive(Clone, Debug)]
 pub struct CallableValue {
-    pub program_instance: ProgramInstanceId,
     pub prototype_id: u32,
     pub kind: CallableKind,
     pub env: Option<CallableEnvironment>,
@@ -52,9 +50,7 @@ impl PartialEq for Value {
             (Self::Map(lhs), Self::Map(rhs)) => lhs == rhs,
             (Self::Callable(lhs), Self::Callable(rhs)) => {
                 if lhs.env.is_none() && rhs.env.is_none() {
-                    lhs.program_instance == rhs.program_instance
-                        && lhs.prototype_id == rhs.prototype_id
-                        && lhs.kind == rhs.kind
+                    lhs.prototype_id == rhs.prototype_id && lhs.kind == rhs.kind
                 } else {
                     Rc::ptr_eq(lhs, rhs)
                 }

pd-vm-nostd/src/vm.rs

@@ -42,7 +42,6 @@ pub struct Vm<C = ()> {
     host_dispatcher: Option<HostDispatcher<C>>,
     context: C,
     fuel: Option<u64>,
-    program_instance: u64,
     frames: Vec<ExecutionFrame>,
 }
 
@@ -86,7 +85,6 @@ impl<C> Vm<C> {
             host_dispatcher,
             context,
             fuel: None,
-            program_instance: 1,
             frames: Vec::new(),
         };
         vm.initialize_root_callables();
@@ -105,7 +103,6 @@ impl<C> Vm<C> {
             let slot = binding.local_slot as usize;
             if let Some(local) = self.locals.get_mut(slot) {
                 *local = Value::Callable(Rc::new(CallableValue {
-                    program_instance: self.program_instance,
                     prototype_id: binding.prototype_id,
                     kind: prototype.kind,
                     env: None,
@@ -136,7 +133,6 @@ impl<C> Vm<C> {
         }
         let env: CallableEnvironment = Rc::new(RefCell::new(captures));
         Ok(Value::Callable(Rc::new(CallableValue {
-            program_instance: self.program_instance,
             prototype_id,
             kind: prototype.kind,
             env: Some(env),
@@ -157,9 +153,6 @@ impl<C> Vm<C> {
             Value::Callable(callable) => callable,
             _ => return Err(VmError::InvalidCallable),
         };
-        if callable.program_instance != self.program_instance {
-            return Err(VmError::StaleCallable);
-        }
         let prototype = self
             .program
             .callable_prototypes()
@@ -215,7 +208,6 @@ impl<C> Vm<C> {
                         if slot < prototype.frame_local_count {
                             self.locals[local_base + slot] =
                                 Value::Callable(Rc::new(CallableValue {
-                                    program_instance: self.program_instance,
                                     prototype_id: binding.prototype_id,
                                     kind: binding_prototype.kind,
                                     env: None,

plans/function_as_value_plan.md

@@ -23,14 +23,14 @@
 **Complete:**
 
 - Add Program-owned callable prototypes, script entry points, parameter/local layouts, capture layouts, source metadata, and instantiated generic signatures.
-- Add `Value::Callable { program_instance, prototype_id, kind, env }`; it must not own `Arc<Program>`.
+- Add Program-owned `Value::Callable { prototype_id, kind, env }`. Callable values follow their Program/Store lifetime and never retain an old `Program`.
 - Add frame-relative locals, a real execution-frame stack, and one `Ret` rule: complete the active frame and follow its typed continuation. Root execution uses an explicit `Halt` continuation; nested RSS calls use `ResumeBytecode`; Rust invocation uses `ReturnToHost`. Never infer return meaning from an empty call stack.
 - Add `CallValue(argc)` as the common RSS function-item/closure invocation path; retain existing `Call` for direct host/builtin imports.
 - Initialize capture-free named bindings from Program metadata.
 - Add one shared environment-binding path for every capture-bearing callable. Introduce a dedicated runtime operation only if existing VM operations cannot bind captures.
-- Validate `ProgramInstanceId` before prototype lookup; replaced/reset Program handles return `StaleCallable`.
+- Keep callable values inside their owning Program/Store. Program replacement and reset invalidate the old callable registry as a lifecycle operation; callable dispatch does not compare stale identities.
 
-**Acceptance:** Named calls, recursion, closure calls, arity failures, stale handles, return values, yield/pending, and resume all use real frames.
+**Acceptance:** Named calls, recursion, closure calls, arity failures, return values, yield/pending, and resume all use real frames.
 
 ## 3. Integrate captures, types, and generics
 
@@ -59,7 +59,7 @@
 - Release environments correctly on clone, overwrite, `Drop`, unwind, collection removal, return, cancellation, and reset; reject ownership cycles until cycle collection exists.
 - On Program replacement, REPL installation, or reuse reset: cancel callback work, remove listeners, clear callable roots/persisted callables, drop the old Program, and invalidate all external old handles.
 - Add Rust APIs to resolve exported RSS functions and invoke function items or closures through one resumable path.
-- Add typed `ScriptCallback<Args, Ret>` with Store identity, Program instance ID, and copied callable schema.
+- Add typed `ScriptCallback<Args, Ret>` with Store ownership and copied callable schema. It follows the Program registry and stores no stale Program identity.
 - Serialize callbacks through the Store queue; define FIFO/coalescing, cross-thread enqueue, unsubscribe, teardown, error, and return-value policies.
 - Verify that the final Rust-held callback releases captures exactly once.
 

plans/real_script_call_frames_plan.md

@@ -29,7 +29,7 @@ First-class value typing, generic schemas, lifecycle, and retained callback APIs
 - Apply a hard internal format break; no backward decoder, migration, opcode reinterpretation, or compatibility branch is required:
   - bump VMBC `ENCODE_VERSION` from 8 to 9 and accept only version 9;
   - bump AOT artifact `VERSION` from 2 to 3 and native `ABI_VERSION` from 1 to 2 because Program/VM/native layouts and return control flow change;
-  - bump debugger recording `PDRC` from 2 to 3, accept only version 3, and remove legacy version-1 recording acceptance;
+  - bump debugger recording `PDRC` from 2 to 4, accept only version 4, and reject legacy versions 1 through 3;
   - add the bytecode ABI revision to Program/native trace cache keys together with callable tables, function regions, and slot layouts so old in-memory entries cannot match;
   - regenerate internal fixtures/artifacts and make every old format fail with its existing unsupported-version error.
 
@@ -42,8 +42,8 @@ First-class value typing, generic schemas, lifecycle, and retained callback APIs
 **Complete:**
 
 - Add `Program.script_functions` and `Program.callable_prototypes` containing entry IP, arity, frame-local count, parameter slots, slot-location layout, capture layout, source metadata, and instantiated generic signature.
-- Add `Value::Callable { program_instance, prototype_id, kind, env }`; it stores no `Arc<Program>`.
-- Assign a fresh `ProgramInstanceId` on Program installation/replacement/reset. `CallValue` validates it before prototype lookup and returns `StaleCallable` for old handles.
+- Add Program-owned `Value::Callable { prototype_id, kind, env }`; it stores no `Arc<Program>` and never outlives the owning Program/Store registry.
+- On Program installation/replacement/reset, clear runtime callable values and invalidate external callbacks through the owning Store registry. Callable dispatch does not compare stale identities.
 - Add an execution-frame stack. Each frame records:
   - typed continuation (`Halt`, `ResumeBytecode`, or `ReturnToHost`);
   - prototype/function identity;
@@ -52,7 +52,7 @@ First-class value typing, generic schemas, lifecycle, and retained callback APIs
   - active callable/environment root;
   - recursion, fuel/epoch, suspension, and debug state required for exact resume.
 - Resolve logical locals through metadata such as `SlotLocation::Frame(offset)` or `SlotLocation::Capture(cell)`. A logical slot must map to exactly one storage class in each prototype.
-- On `CallValue`, validate value kind, Program instance, arity, and recursion limit; preserve caller state; allocate callee locals; bind arguments/self/environment; then enter the target.
+- On `CallValue`, validate value kind, prototype, arity, and recursion limit; preserve caller state; allocate callee locals; bind arguments/self/environment; then enter the target.
 - On `Ret`, normalize the result, release callee roots/locals, restore the typed continuation, and either resume bytecode, return to Rust, or report halt.
 - Emit root code and every RSS function body once in one code blob, with explicit root/function regions.
 - Validate `Br` and `Brfalse` targets remain inside their current root/function region; cross-function control flow is valid only through `CallValue` and `Ret`.
@@ -93,7 +93,7 @@ First-class value typing, generic schemas, lifecycle, and retained callback APIs
   - `Br`/`Brfalse` cannot cross root/function regions;
   - `Ldc` cannot deserialize Program-bound callable constants;
   - `Pop` and `Dup` apply normal callable/environment clone/drop ownership;
-  - `Ceq` compares function items by Program instance/prototype identity and closure aliases by callable/environment identity; separate closure evaluations compare unequal;
+  - `Ceq` compares function items by prototype identity inside their owning Program and closure aliases by callable/environment identity; separate closure evaluations compare unequal;
   - arithmetic, bitwise, ordering, and shift opcodes reject callable operands through existing type-error paths.
 - Remove or redesign the current interpreter `Call + Ret` fusion. It may run only when typed continuation/frame semantics, fuel ticks, epoch checks, result normalization, and lifecycle behavior remain identical to unfused execution.
 - Change the current interpreter mapping from unconditional `Ret -> Halted` to frame completion.
@@ -112,7 +112,7 @@ First-class value typing, generic schemas, lifecycle, and retained callback APIs
 
 - Update assembler/disassembler, operand decoding, VMBC validation, no-std execution, AOT bundles, REPL replacement, recording/replay, formatter output, and source diagnostics.
 - Add function-region/prototype/frame data to debug info, stack traces, current-frame local inspection, and Rust invocation status.
-- Add focused tests for root `Ret`, nested `Ret`, Rust-root `Ret`, `CallValue` stack shape, stale handles, arity/type errors, region-confined branches, slot-location validation, callable equality, `Pop`/`Dup` lifecycle, and rewritten `Call + Ret` optimization.
+- Add focused tests for root `Ret`, nested `Ret`, Rust-root `Ret`, `CallValue` stack shape, Program-owned callback invalidation, arity/type errors, region-confined branches, slot-location validation, callable equality, `Pop`/`Dup` lifecycle, and rewritten `Call + Ret` optimization.
 - Add interpreter/JIT/AOT parity tests for direct/dynamic calls, recursion, captures, host calls, errors, yield/pending/resume, cancellation, reset, and exact drop counts.
 - Instrument native tests to assert zero callable-induced side exits, trace breaks, interpreter handoffs, and rejected valid AOT Programs.
 - Run focused suites during implementation, then formatting, workspace tests, Clippy with `-D warnings`, and release builds.

src/builtins/runtime/core.rs

@@ -940,7 +940,6 @@ mod tests {
     #[test]
     fn callable_map_keys_are_rejected() {
         let callable = Value::Callable(Arc::new(crate::CallableValue {
-            program_instance: 1,
             prototype_id: 0,
             kind: crate::CallableKind::FunctionItem,
             env: None,

src/bytecode.rs

@@ -12,7 +12,6 @@ pub type SharedBytes = Arc<Vec<u8>>;
 pub type SharedArray = Arc<Vec<Value>>;
 pub type SharedMap = Arc<VmMap>;
 pub type SharedCallable = Arc<CallableValue>;
-pub type ProgramInstanceId = u64;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
 pub enum CallableKind {
@@ -65,7 +64,6 @@ pub struct CallableEnvironment {
 
 #[derive(Clone, Debug)]
 pub struct CallableValue {
-    pub program_instance: ProgramInstanceId,
     pub prototype_id: u32,
     pub kind: CallableKind,
     pub env: Option<Arc<CallableEnvironment>>,
@@ -296,7 +294,6 @@ fn hash_map_key(value: &Value, state: &mut impl Hasher) {
         }
         Value::Callable(callable) => {
             7u8.hash(state);
-            callable.program_instance.hash(state);
             callable.prototype_id.hash(state);
             callable.kind.hash(state);
             callable.env.as_ref().map(Arc::as_ptr).hash(state);
@@ -378,7 +375,6 @@ pub(crate) fn hash_value(value: &Value, state: &mut impl Hasher) {
         }
         Value::Callable(callable) => {
             7u8.hash(state);
-            callable.program_instance.hash(state);
             callable.prototype_id.hash(state);
             callable.kind.hash(state);
             callable.env.as_ref().map(Arc::as_ptr).hash(state);
@@ -503,10 +499,7 @@ impl PartialEq for Value {
 }
 
 fn callable_value_eq(lhs: &CallableValue, rhs: &CallableValue) -> bool {
-    if lhs.program_instance != rhs.program_instance
-        || lhs.prototype_id != rhs.prototype_id
-        || lhs.kind != rhs.kind
-    {
+    if lhs.prototype_id != rhs.prototype_id || lhs.kind != rhs.kind {
         return false;
     }
     match (&lhs.env, &rhs.env) {