Introduce explicit buffer storage policies (the stackalloc/scratch/pool/
native/inline line) as owned resources with a stated storage intent, plus
the three logging surfaces that keep the choice honest.

Language & front-end:
- Buffer.<mode>(size, name = value, ...) intent expressions; `policy { ... }`
  declaration blocks (lexer DOT token + `policy` keyword, parser, AST).
- buffers.py centralizes mode/policy resolution, defaults, and bound validation.

Checker:
- Buffers are ownership-checked like any resource (release-exactly-once,
  borrows, escape). Stack-backed modes (stack/scratch/inline) cannot escape.
- New diagnostics: OWN015 (escape via return), OWN016 (escape via consume),
  OWN019 (inline capacity too large), OWN021 (dynamic stack needs a bound),
  OWN023 (scratch forbids fallback but size may exceed inline).

Codegen:
- Real C# per mode: stackalloc, stack-first/ArrayPool-fallback scratch with a
  try/finally Return, pooled, NativeMemory (unsafe), inline, plus clear-on-release.
- OwnTrace (text) and OwnCounters (metrics) runtime hooks under
  [Conditional("OWNSHARP_TRACE"/"OWNSHARP_COUNTERS")], emitted alongside any
  module that uses buffers.

Logging surfaces:
- report.py + `report` CLI command: compile-time buffer report to stdout and
  .ownreport.json (mode, inline limit, fallback, escape policy, branches, checks).
- Runtime trace + counters (above).

Tests & docs:
- 18 new analysis cases, buffer codegen + report smoke; suite stays green.
- README section documenting the policies, lowering, logging, and example files.

https://claude.ai/code/session_015GuQLyKMRZ23JsXobhn8E7

Address Codex review on PR #2:

- P1: an escaping pooled/native buffer (returned or passed to a `consume`
  call) no longer runs its finally cleanup. Ownership transfers to the new
  owner, so returning the array to ArrayPool / freeing native memory here
  was a use-after-return / double-free. Codegen now detects the escape (no
  matching `release`) and suppresses the cleanup.

- P2: a constant scratch smaller than its inline limit
  (e.g. scratch(64, inline = 1024, fallback = forbidden)) now reserves the
  inline capacity but slices the span to the requested length, instead of
  exposing the full reservation.

- P2: BufferInfo.branches() reports a fallback-forbidden scratch as
  stack-only, so the compile-time report no longer advertises an ArrayPool
  branch that cannot occur.

Adds escape_and_length_smoke regression guards; suite stays green.

https://claude.ai/code/session_015GuQLyKMRZ23JsXobhn8E7

Follow-up to the PR #2 review: suppressing the cleanup on an escaping pooled/
native buffer stopped the double-free but left the other horn — the escaping
value is the Span<byte> while the rented byte[] stays a dead local, so the
caller gets no handle to Return and the `Buffer` return type isn't real C#.
The result was uncompilable-or-leaky.

Per the decision that the checker is the deliverable and codegen should only
prove the model lowers to real .NET (not grow a faithful movable-buffer
representation), reject the escape in the checker instead of faking it:

- New OWN017: a movable (pooled/native) buffer that escapes via return or a
  consume call is rejected. The ownership model still treats pooled/native as
  movable; this is an honest codegen-capability boundary (like OWN020), so the
  PoC never emits broken C#. Faithful movable lowering (byte[]-handle or an
  IMemoryOwner<byte> wrapper) is left as roadmap. Locally-released pooled/native
  buffers still work fully (real ArrayPool.Return / NativeMemory.Free).

- buffer_scratch_program.cs.txt: a runnable golden whose parse() and
  OwnTrace/OwnCounters are emitted verbatim, with a hand-written host + Main,
  proving the buffer model lowers to real, runnable ArrayPool .NET. A drift
  guard in the suite keeps it in sync with the emitter.

- Tests: pooled/native escape now assert OWN017; added a local-pooled clean
  case. README corrected (movable escape rejected in PoC; runnable golden;
  straight-line buffer codegen limitation documented). Suite green (62 cases).

https://claude.ai/code/session_015GuQLyKMRZ23JsXobhn8E7

Three follow-up review fixes:

- Overlapping buffer lifetimes released in non-LIFO order no longer crash
  codegen. The previous "buffer owns the rest of the block, nested try/finally"
  model assumed LIFO; `let a=Buffer.pooled(n); let b=Buffer.pooled(n);
  release a; release b;` (which the checker accepts) raised a spurious
  CodegenError. Codegen now uses the exception-safe try/finally only when a
  buffer nests cleanly (straight-line release here, no other buffer acquired in
  its body); otherwise it uses inline-release (prelude at the let, real cleanup
  at each release site), which also subsumes the branchy case. Native buffers
  are emitted with a method-level `unsafe` instead of per-buffer unsafe blocks,
  so they follow the same lifetime shapes.

- A misspelled/unsupported scratch fallback (e.g. `fallback = forbiden`, in
  source or a policy) is now diagnosed (OWN030) and fails safe, instead of
  silently falling through to enable the ArrayPool heap fallback — which would
  quietly break the explicit storage guarantee.

- The report's noEscape check now includes OWN017, so the machine-readable
  surface no longer claims noEscape:true for a buffer the checker rejected for
  escaping.

Tests: non-LIFO + LIFO overlap cases, misspelled-fallback case, and smoke
guards for FIFO codegen / fallback typo / report-noEscape agreement. README
updated. Suite green (66 cases).

https://claude.ai/code/session_015GuQLyKMRZ23JsXobhn8E7

Three follow-up review fixes around buffer aliasing:

- A buffer released through a moved alias now lowers correctly. The codegen
  release-scan only matched the declaration name, so
  `let a = Buffer.pooled(n); let b = move a; release b;` (accepted by the
  checker) raised a spurious CodegenError. Codegen now follows the move chain:
  the release-detection guard is alias-aware, and a `move` transfers the pending
  cleanup to the new owner so `release <new>` returns/frees the original backing.

- A wrong namespace is diagnosed. The namespace token was discarded, so
  `Foo.stack(n, max = 1024)` silently became a stack buffer. The documented
  syntax is `Buffer.<mode>(...)`; the AST now carries the namespace and the
  checker rejects anything but `Buffer` with OWN030.

- The report attributes diagnostics through move-aliases. For
  `let a = ...; let b = move a; return b;` the escape is reported on 'b', but
  the report entry is for 'a'; the name-only filter missed it and claimed
  noEscape:true. build_report now matches diagnostics against the buffer's
  move-alias set (and skips bad-namespace intents like it skips bad modes).

Tests: move-release clean case, bad-namespace case, moved-escape case, plus
codegen/report alias smoke guards. README updated. Suite green (69 cases).

https://claude.ai/code/session_015GuQLyKMRZ23JsXobhn8E7

A scratch fallback spelled with a non-identifier value (e.g. `fallback = 0`,
in source or a policy) made _as_ident return None, which was indistinguishable
from an omitted option and defaulted to enabling the ArrayPool heap fallback —
so a malformed attempt to forbid/override the fallback silently heap-allocated
instead of failing safe like the string-typo path.

resolve() now distinguishes "absent" (default pool) from "present but
malformed". A present-but-invalid value — string typo or non-identifier — is
diagnosed (OWN030) and fails safe (forbidden, never silently pooled), for both
the inline option and a policy-supplied value.

Tests: non-identifier fallback analysis case + a resolve smoke asserting OWN030
and fallback_pool == False. Suite green (70 cases).

https://claude.ai/code/session_015GuQLyKMRZ23JsXobhn8E7

… trace

Three follow-up review fixes:

- Ordinary resources keep their own finally when a buffer is present. A buffer
  no longer forces the whole function onto the inline path; a straight-line
  function uses the try/finally hoist, extended to nest buffers AND ordinary
  resources, each in its own finally (LIFO release order). Previously
  `let b = Buffer.scratch(n); let c = acquire Conn(); Work(b); release c;
  release b;` emitted c.close() inside the buffer's try body, so an exception
  from Work returned the buffer but leaked Conn. Now Conn gets its own nested
  finally. (Branchy functions still use inline-release, unchanged.)

- Buffer.native(n) with a dynamic size guards against a negative request
  (`if (n < 0) throw ...`) before NativeMemory.Alloc, so a negative int can't
  wrap to a huge nuint and request an enormous unmanaged allocation. Constant
  sizes (never negative in this grammar) emit no guard.

- A policy `trace = false` is honored. _trace_flag ignored boolean policy
  values and fell through to the default (true), so `policy P { trace = false; }`
  still emitted OwnTrace and reported trace:true. It now respects bool/string
  policy values, matching inline `trace = false`.

Tests: nesting_native_trace_smoke covers all three. README updated. Golden
unchanged. Suite green (70 cases).

https://claude.ai/code/session_015GuQLyKMRZ23JsXobhn8E7

…de ordering

Three follow-up review fixes:

- A `move` no longer destroys the original buffer's cleanup for sibling
  branches. The move handler popped buffer_cleanup[a] when emitting one branch,
  so for `if (c) { let b = move a; release b; } else { release a; }` the else
  branch fell back to a.Dispose() on a Span instead of returning a_array. It now
  copies (non-destructive) the cleanup to the new alias; keeping the original
  registered is safe because releasing it after a move is use-after-move
  (rejected upstream), so both branches return to the pool.

- The Scratch.* counters (StackHit / PoolFallback / Release) are emitted only
  for scratch buffers. Pooled emitted PoolFallback, and pooled/native/stack
  emitted Release/StackHit, polluting the metric that answers "do scratch
  requests hit the stack?". Non-scratch buffers are still traced, just not
  counted.

- Simple-mode codegen emits in source order. It previously hoisted every
  buffer/acquire prelude above the whole body, so `let n = 64; let b =
  Buffer.pooled(n); ...` emitted Rent(n) before `var n = 64;` (and setup calls
  landed after the allocation). The hoist is now recursive: leading plain
  statements stay before a scope's prelude, the scope's try wraps the rest, and
  releases still run LIFO.

Tests: sibling-move analysis case + ordering_counters_smoke covering all three.
README/golden unchanged. Suite green (71 cases).

https://claude.ai/code/session_015GuQLyKMRZ23JsXobhn8E7

…olicy ref

Three follow-up review fixes:

- Simple-mode now splits each scope at its `release`: statements during the
  lifetime go in the try, statements after the release are emitted after the
  finally. Previously every following statement was wrapped in the same try, so
  `let a = Buffer.pooled(n); release a; let b = Buffer.pooled(n); ...` rented b
  before returning a, extending pool/native lifetimes and delaying
  clear_on_release. Disjoint sequential resources now stay disjoint; overlapping
  ones still nest LIFO.

- A non-identifier policy reference (e.g. `policy = 0`) is now diagnosed
  (OWN030), instead of silently using default settings and bypassing an intended
  policy such as clear_on_release = true.

- A dynamic scratch size is guarded against a negative request before any
  trace/counter runs. Previously `scratch(n)` with negative n took the stack arm
  (n <= limit), logged ScratchSelected/StackHit, then the [..n] slice threw
  before the try could balance Release — corrupting the counters/trace. Matches
  the existing stack/native guards.

Tests: disjoint-sequential + bad-policy analysis cases, plus smoke guards for
disjoint ordering and the scratch negative guard. README updated. Golden
unchanged. Suite green (73 cases).

https://claude.ai/code/session_015GuQLyKMRZ23JsXobhn8E7

Three follow-up review fixes:

- Buffer cleanup aliases no longer leak across scopes. A `move` registered the
  moved-to name in the function-wide buffer_cleanup map and never cleared it, so
  after `if (c) { let b = move a; release b; } ...` a later unrelated
  `let b = acquire Conn(); release b;` emitted a second
  ArrayPool.Return(a_array) (double-return + Conn leak) instead of b.close().
  A (re)declaration of a name now clears any stale cleanup alias for it
  (in _stmt_inline and _buffer_lowering), so the later b is closed correctly and
  a_array is returned exactly once per branch.

- Non-integer buffer bounds are diagnosed. `inline = bogus` / `inline_bytes` /
  `max = bogus` / policy `max_bytes` that are present but not integers now emit
  OWN030 instead of silently falling through to the default and changing the
  storage policy.

- The runnable scratch golden is regenerated to include the negative-size guard
  the emitter now writes before the rent/backing declarations, so parse(-1)
  throws before any trace/counter instead of corrupting the demo metrics. The
  drift guard now also checks the guard line and its ordering.

Tests: alias-redeclaration, bad-inline-bound and bad-max-bound analysis cases,
plus codegen smoke for the redeclaration and a tightened golden drift guard.
Suite green (76 cases).

https://claude.ai/code/session_015GuQLyKMRZ23JsXobhn8E7

A repeated named option (e.g. Buffer.scratch(n, fallback = forbidden,
fallback = pool)) silently overwrote the earlier value in the options dict, so a
conflicting storage promise was accepted and lowered/reported as the last value
won — defeating the storage-policy checks on copy/paste mistakes. The same held
for repeated keys in a policy block.

The parser now records duplicate keys (before the dict collapses them) on the
AST; resolve rejects duplicate buffer options and validate_policies rejects
duplicate policy settings, both with OWN030.

Tests: duplicate-option and duplicate-policy-setting analysis cases. README
updated. Suite green (93 cases).

https://claude.ai/code/session_015GuQLyKMRZ23JsXobhn8E7

…ase in scope

Two review fixes:

- A plain temporary of unknown type (type_name None) was accepted as a buffer
  size. A copy of a borrow, e.g. `let n = x;` for `x: &Buffer`, made n a plain
  value with no known type, so `Buffer.pooled(n)` checked clean and lowered to
  Rent(span)/AsSpan(0, span). The size now must be exactly `int`; an
  unknown-typed plain is OWN018.

- A plain local declared between a buffer/resource acquire and its release was
  emitted inside the hoisted try, so a later `let y = x;` after the finally
  referenced an out-of-scope x and did not compile. _is_simple no longer hoists
  when a scope's body declares a plain local (and the inline path likewise uses
  inline-release rather than a wrapping try), so the local stays at function
  scope. Bodies without such locals (the golden, mixed LIFO, disjoint) still get
  the exception-safe hoist.

Tests: borrow-temp-size and local-after-release analysis cases + a smoke
asserting the buffer is not hoisted and x precedes y. README updated. Suite
green (95 cases).

https://claude.ai/code/session_015GuQLyKMRZ23JsXobhn8E7