WIP-0007: Self-hosting compiler and reproducible bootstrap

Summary

The production Wheeler compiler will be written in Wheeler. All Java source and Gradle files stay under top-level bootstrap/. Those modules are temporary stage-0 tools and conformance oracles. They are not permanent dependencies or a second production implementation.

Stage 1 compiles the compiler into stage 2. A successful bootstrap requires the canonical stage-1 and stage-2 .wbc artifacts to match byte for byte. WIP-0008 then moves normal execution and builds to a native Wheeler toolchain and removes Java.

This goal shapes the language and VM now. A compiler needs typed locals, records, tagged variants, bounded sequences, strings, bytes, deterministic maps, control flow, modules, result values, and explicit file effects. Wheeler must provide those tools without importing the JVM object model or exception rules.

The compiler emits Wheeler's shared typed IR. Classical code keeps inverse, log, and barrier behavior. WIP-0002 quantum regions stay semantic and backend-neutral. OpenQASM, LLVM, native objects, and provider payloads remain derived output. Every new facility must preserve ownership, effects, inverse or adjoint relations, bounds, canonical bytecode, and quantum lowering.

Motivation

A compiler maintained only in Java leaves Wheeler's most important program outside Wheeler. It also lets Java collection order, object behavior, Unicode handling, and exceptions leak into the language by accident.

Self-hosting tests the full system. It shows that Wheeler can express a large deterministic program, produce its own artifacts, and run useful classical workloads. Reproducible stages also expose compiler drift. Matching examples alone is not enough evidence that two compilers agree.

Bootstrap work cannot wait until the end as a source translation. Choices about locals, allocation, effects, modules, diagnostics, and bytecode order determine whether a compiler can be written at all. Wheeler therefore grows its source profile around a real compiler from the start.

Use cases

Cold bootstrap

A clean checkout uses the pinned stage-0 path to compile the Wheeler compiler sources. The resulting stage-1 compiler runs on the Wheeler VM and compiles the same sources. The build compares stage 1 and stage 2 and fails on any byte difference.

Normal development

After the first reproducible bootstrap, ordinary compiler development runs the pinned stage-1 .wbc compiler. During migration, a stage-0 rebuild remains an explicit trust operation. After WIP-0008 cutover, cold builds use the prior native Wheeler recovery release and do not invoke Java.

Cross-runtime validation

The same compiler artifact runs on the reference VM and any conforming independent VM. Both produce identical .wbc output and stable diagnostics for the conformance corpus.

Quantum compilation

The self-hosted compiler emits canonical WIP-0002 region IR. OpenQASM and later target formats remain downstream derivations. The compiler does not need provider SDK objects or network access.

Goals

• Make the production lexer, parser, semantic analysis, lowering, verifier front end, and artifact writer Wheeler code.
• Define a minimal general-purpose classical profile sufficient for compiler construction.
• Make all compiler data structures and iteration orders deterministic and bounded.
• Produce byte-identical stage-1 and stage-2 artifacts from identical inputs and options.
• Keep source diagnostics stable across bootstrap stages.
• Expose source reads and artifact writes as explicit host capabilities instead of ambient Java APIs.
• Retire the Java source compiler after the Wheeler compiler and a recovery seed are proven.
• Keep one source-language authority and one canonical .wbc writer contract throughout migration.

Non-goals

• Reimplement Gradle, Git, Tree-sitter, provider SDKs, or the documentation site in Wheeler.
• Require all compiler operations to be logically reversible.
• Copy the Java class library, garbage collector, reflection, exceptions, or hash collection semantics.
• Make compiler execution depend on quantum hardware.
• Claim a diverse double bootstrap proves the absence of a malicious seed.
• Preserve stage-0 implementation internals as public compiler APIs.

Terms and invariants

Stage 0 is the temporary host implementation used to seed the first Wheeler compiler artifact.

Stage 1 is the compiler artifact produced by stage 0 from the canonical Wheeler compiler sources.

Stage 2 is the artifact produced when stage 1 compiles those same sources with the same declared options.

A bootstrap-fixed point exists when stage 1 and stage 2 are byte-identical. Debug paths, timestamps, map iteration order, host locale, process identity, and filesystem enumeration order cannot enter canonical output.

The recovery seed is a reviewed, content-addressed .wbc compiler artifact plus source and build identity. It permits a cold build after stage 0 is deleted. It is generated, not hand-edited.

The following invariants are mandatory:

1. One canonical source tree produces both bootstrap stages.
2. Stage 0 and the self-hosted compiler consume the same specified language, not overlapping dialects.
3. Stage 0 cannot emit privileged bytecode unavailable to the normal artifact writer.
4. Compiler input order, symbol order, constant order, diagnostics, and artifact bytes are deterministic.
5. A failed or resource-exhausted compilation emits no partial canonical artifact.
6. Unknown bytecode or source constructs fail closed at every stage.
7. Stage-0 Java code and Gradle machinery remain below bootstrap/. Canonical Wheeler packages contain no Java source or build file.
8. Fixed-point equality is reproducibility evidence, not proof that the seed is benign.
9. Recovery-seed promotion requires diverse double-compilation evidence from an independently derived trusted path plus the ordinary fixed point.
10. The candidate seed is not executed in the diverse path before its output has been compared with the trusted derivation.

Bootstrap language profile

The self-hosting profile extends WIP-0005 in complete vertical slices.

Values and types

The required value set is:

• bool, signed fixed-width integers, Unicode scalar values, and finite floating-point values where quantum angles require them.
• immutable String and mutable bounded byte[] or an equivalent byte builder.
• fixed and growable bounded sequences with explicit element types.
• value records for tokens, source spans, declarations, instructions, and diagnostics.
• tagged variants for token, expression, statement, type, opcode, and result alternatives.
• WIP-0041 Slot<T> for explicit presence and Result<T, E> for recoverable failure, with no ambient null or host exceptions.
• deterministic insertion-ordered or sorted maps whose order is specified.

Reference identity is not part of value equality unless a later ownership WIP adds it explicitly. Hash randomization cannot affect semantic iteration.

Functions and control flow

The required executable profile includes typed parameters and returns, local bindings, lexical blocks, if, bounded while and for, exhaustive variant selection, break, continue, and early result return. Recursion is permitted only under configured stack and step limits.

Pure, ordinary, rev, and coherent rev functions remain distinct. Compiler code is primarily ordinary deterministic classical code. Reversible containers and transformations may be used where useful, but allocation, diagnostics, and file effects are not mislabeled as intrinsic inverses.

Storage and ownership

The VM needs typed stack/local slots and a bounded heap or region store. Allocation is an ordinary effect with explicit failure. Immutable values may share storage. Mutable values have statically checked ownership or copying rules. Raw host pointers and JVM objects never enter Wheeler state or .wbc.

The first collector may reclaim an entire compilation region at run completion. General tracing collection is not a prerequisite if region and memory limits make compiler execution practical.

Modules and effects

Compiler sources require modules, imports, private declarations, and explicit exported entry points. Module resolution uses the WIP-0009 canonical package manifest and normalized logical paths. It never depends on directory enumeration order.

The compiler entry receives bounded SourceInput values and CompilerOptions and returns an Artifact or diagnostics. A launcher owns filesystem access. Reads and writes are explicit effects with normalized bytes, declared encoding, size ceilings, and atomic output replacement.

Compiler architecture

The self-hosted compiler is split by semantic ownership:

1. The source stage decodes UTF-8, records scalar offsets, and produces source spans.
2. The lex stage produces a bounded token stream without semantic name lookup.
3. The parse stage builds the accepted syntax tree and recovers only at specified synchronization tokens.
4. The resolve stage constructs deterministic symbol tables and module identities.
5. The check stage enforces types, effects, reversibility, affine resources, and target-independent quantum rules.
6. The lower stage emits canonical classical bodies, quantum regions, and hybrid workflows.
7. The verify stage checks the in-memory artifact before serialization.
8. The encode stage writes WIP-0001 .wbc sections in canonical order.
9. The driver stage owns options, diagnostics, limits, and all-or-nothing output.

These are Wheeler modules, not host extension points. Stage 0 follows the same boundaries while it exists so each module can be replaced and compared independently.

The parser remains hand-written and deterministic unless another implementation proves simpler. Tree-sitter is editor tooling and a differential syntax oracle. It is not linked into the production compiler.

Incubation and promotion

wheeler-examples is the executable incubator for the first Wheeler-written compiler slices. Stage 0 can compile, package-select, run, rewind, and compare those modules there. They move out once they meet the promotion rules, so incomplete compiler code does not become the build authority.

Promotion starts when the modules expose one bounded source-set, options, and result API. They must own stable diagnostics, compile the Counter.w milestone, pass Wheeler verification, and execute successfully. They also need an explicit package target with no example-only dependency.

The accepted source set then moves into the canonical compiler tool package as one change. Manifests, tests, documentation links, and bootstrap scripts move with it. The old example targets and module paths are deleted. After that, checked-in examples use the pinned compiler package like any other client.

Later phases follow the same rule. A lexer, verifier, interpreter, or encoder may begin as an independent example module. Once its package boundary is accepted, only one implementation remains authoritative.

Reversibility and effects

Self-hosting does not imply that compilation is physically or logically reversible. Parsing allocates, diagnostics observe malformed input, and artifact writing is external I/O. These operations use ordinary, checked, logged, or barrier semantics as appropriate.

Reversible compiler functions still obey WIP-0001. A data transformation marked rev must have a generated or checked inverse. Dropping an arena, reporting a diagnostic, or replacing an output file cannot appear inside such a function only because the whole compiler can be rerun.

A compilation transaction writes output only after parse, check, lower, verify, and encoding succeed. Abort discards the private output buffer and arena. Replacing a prior filesystem artifact is an explicit atomic host effect, not VM rewind.

WIP-0032 exclusively owns the launcher's I/O request and completion API. The compiler library continues to consume bounded owned inputs and produce an owned artifact or diagnostics. It does not discover files or grow a compiler-specific stream/future family. Atomic output replacement establishes no data or namespace durability without an exact receipt.

Determinism and canonical output

Canonical compilation fixes:

• UTF-8 decoding and malformed-input behavior.
• line, column, and scalar-offset accounting.
• module and source ordering.
• symbol, function, region, constant, and section ordering.
• integer and floating-point literal conversion.
• diagnostic ordering and stable codes.
• compiler options and feature profile identity.
• .wbc reserved bytes, padding, and checksums.

Parallel analysis may be added later, but task completion order cannot affect diagnostics or output. The fixed-point comparison excludes no canonical section. If source maps include logical source identities, those identities must also match.

Bootstrap procedure

The build executes these steps:

1. Compile the canonical Wheeler compiler source set with stage 0 to compiler-stage1.wbc.
2. Run stage 1 on the same source manifest and options to produce compiler-stage2.wbc.
3. Compare complete artifacts byte for byte and report the first differing section on failure.
4. Compile the conformance examples with both stages and compare artifacts and diagnostics.
5. Run the stage-2 artifact through the compiler acceptance suite.
6. Rebuild the stage-0 seed or stage-1 compiler through an independently derived trusted path and perform diverse double compilation of the canonical Wheeler compiler sources.
7. Compare the complete diverse output with the ordinary stage-1 artifact before executing the candidate output.
8. Publish the stage-2 content identity, diverse evidence, and build manifest as the next recovery-seed candidate.

wheeler bootstrap-manifest implements the final fail-closed comparison and evidence codec. It reads only bounded physical files. It requires a canonical source archive, lock, stage artifacts, and closed acceptance artifacts. It compares stage 1, stage 2, diverse output, and diagnostics before publication. It then emits schema-2 wheeler.bootstrap.yaml atomically. The exact schema and command contract live in the bootstrap evidence reference. The command never executes the candidate. CI must still order candidate acceptance after diverse comparison. The YAML file records evidence, but it does not prove that CI ran the steps in the required order.

A seed update is reviewed like source code. CI rebuilds from the prior seed, proves the new fixed point, and verifies diverse evidence before accepting it.

Trusting trust and diverse bootstrap

A stage-1/stage-2 fixed point answers one question: does this compiler reproduce itself from the declared inputs? It does not show that the seed matches the source. A compromised seed could insert hidden behavior and reproduce it in later stages.

Recovery-seed promotion therefore follows diverse double compilation:

1. choose a trusted compiler derivation independent of the candidate seed. An earlier independently reproduced Wheeler seed, a separately reviewed stage-0 implementation, or a separately sourced host toolchain capable of rebuilding the Java seed.
2. bind that toolchain, its complete inputs, verifier, options, and limits into the bootstrap manifest.
3. compile the canonical source without first executing candidate-produced code.
4. compare complete canonical artifacts and diagnostics against the ordinary bootstrap path.
5. only after equality may the candidate execute the acceptance suite and become a seed candidate.

Two vendor labels on binaries built from one opaque lineage do not constitute diversity. The evidence records hashes and provenance instead of a reassuring string such as different=true. Diverse agreement still leaves hardware, firmware, the chosen trusted path, and review in the trusted computing base. This WIP makes that trust inspectable and smaller instead of claiming its abolition.

The strict independent bytecode verifier is part of both paths. It prevents either compiler from granting itself malformed or privileged opcodes, but it cannot prove source correspondence. Fixed point, differential conformance, verifier acceptance, source review, reproducible host builds, and diverse double compilation are complementary gates.

Safety and limits

Every compiler phase has declared source-byte, token, nesting, declaration, symbol, instruction, diagnostic, heap-byte, stack-depth, and step limits. Arithmetic used for sizes and offsets is checked. Decoders reject overlong, truncated, duplicate, cyclic, and unknown required records.

The launcher grants read-only source inputs and one atomic artifact destination. Compiler code receives no credentials, network capability, ambient environment map, clock, random source, or unrestricted filesystem path.

Migration and deletion

1. Freeze the current Java stage-0 profile and document its accepted grammar as the bootstrap baseline.
2. Add typed parameters, returns, locals, conditionals, bounded loops, records, variants, strings, bytes, and deterministic collections in vertical parser-to-VM slices.
3. Add module manifests and explicit source/artifact effects.
4. Implement .wbc and proof-certificate decoding and encoding in Wheeler and compare them against stage 0.
5. Port lexer and parser, then resolution, checking, lowering, verification, and the driver in executable example slices.
6. Promote the accepted source set by moving it into the canonical compiler tool package. Move manifests, tests, and documentation and delete the superseded targets from the example package in the same series.
7. Produce stage 1 and stage 2. Require fixed-point and differential conformance tests in CI.
8. Switch ordinary builds to the Wheeler compiler artifact.
9. Delete the Java lexer, parser, source model, lowerers, and artifact-generation path as part of the WIP-0008 no-Java cutover.
10. Retain only the pinned .wbc recovery seed, native Wheeler launcher, and generation provenance. Do not retain a parallel Java compiler or VM.

Progress

• [x] Every Java source, Java test, Gradle module, wrapper, and Gradle build file lives below top-level bootstrap/. Canonical Wheeler package roots contain only Wheeler sources and package metadata. Host code can no longer pass as compiler source by sharing the directory.
• [x] bootstrap/stage0 owns the disposable Java compiler seed, while wheeler-compiler owns the exact Wheeler package compiled into later stages.
• [x] CI builds the full canonical workspace under independently distributed Temurin and Zulu JDK 26 toolchains and compares every output byte. Hosted run 29669052893 passed for commit 8527b18. This is host-diversity evidence, not yet diverse double compilation.
• [x] Each CI producer emits the same canonical verified artifact-set manifest before comparison. Hosted Temurin/Zulu run 29670968056 verified and byte-compared the complete trees for 2dea61e. NativeArtifactSetIdentity.w now independently parses the bounded canonical manifest and reproduces its domain-separated identity for up to eight safe ASCII paths. Physical tree traversal and artifact verification remain stage-0 boundaries. A digest of claims is not yet a witness of bytes.
• [x] Canonical .wbc and a deterministic stage-0 compiler exist.
• [x] Schema-2 wheeler.bootstrap.yaml binds canonical compiler source/archive/lock/profile/feature/module/options/limits identities, both complete compiler/runtime/verifier/toolchain derivations, stage 1, stage 2, diverse output, diagnostics, and the closed acceptance artifact set. Its executable codec rejects unknown fields, false fixed points, diagnostic drift, identical alleged diverse compilers/toolchains, malformed artifacts, stale artifact sets, links, changing inputs, and partial publication. NativeBootstrapFeaturesIdentity.w reconstructs the sole complete seventeen-feature vocabulary, NativeBootstrapModulesIdentity.w validates rooted acyclic closures through binary lookup for 256 local modules, sixty-four externals, and 1,024 edges, and reproduces the current 206-module compiler graph's stage-0 identity. NativeCompilerOptionsIdentity.w validates exact schema-1 option bytes, NativeCompilerLimitsIdentity.w checks all ten canonical positive ceilings, and NativeToolchainIdentity.w validates every derivation kind and provenance digest. NativeBootstrapManifestIdentity.w then checks the complete twenty-one-identity fixed-point and diverse-evidence closure. Each reproduces its stage-0 identity for the bounded bootstrap profile. No manifest is checked in because no complete fixed point or diverse derivation exists yet.
• [x] The accepted source grammar is formatting-independent and covered by Tree-sitter tooling.
• [x] Bootstrap feature and module manifests are executable canonical-YAML schemas. wheeler.bootstrap-features.yaml binds a sorted, versioned, closed semantic vocabulary. wheeler.bootstrap-modules.yaml binds a sorted rooted module graph, explicit externals, direct imports, unique source paths, and exact source identities. The decoder rejects unknown fields, duplicate names, dangling imports, local/external overlap, cycles, unreachable modules, stale archive bytes, noncanonical ordering, graphs above 10,000 modules, and graphs above 100,000 imports. wheeler bootstrap-features emits the sole seventeen-feature bootstrap-1 contract and rejects unknown profiles. wheeler bootstrap-modules derives the target-selected graph and source identities directly from the canonical compiler archive. The evidence gate derives it again before accepting the file. Bootstrap evidence schema 2 binds both manifest identities alongside the source archive, schema-3 lock, options, and limits. A path list with a checksum is not a module graph. It is a ransom note with stationery.
• [ ] The executable compiler substrate now covers signed and Boolean parameters, results, typed frames, static calls, aggregate values, and bounded control flow. It also covers affine regions, word and byte buffers, validated UTF-8 owners, signed maps, and nested borrows. Primitive region, word, byte, UTF-8, and map owners move through typed parameters and results and rewind across frames. OwnedReturns.w checks all five owner kinds in both interpreters. Direct VM fixtures also return an owner through a typed result. Returned loans, compiler-scale arenas, generic collections, class evidence, typed callables, library strings, exported collection APIs, and package aliases remain.
• [ ] Stage 0 links bounded classical modules from exact manifest source sets. Imports are sorted, visibility is direct, inputs form a closed DAG, and names follow dependency order. Public records, closed variants, fixed arrays, and slices work across module boundaries. Importers can use qualified calls and nominal values, then match imported variants exhaustively. A bounded FIFO composes those APIs through an exclusive word-buffer borrow and explicit result variants. Locked library targets include only modules reachable from the consuming root. Entryless roots use a verified inert-entry artifact. The full compiler module surface remains.
• [x] The accepted Wheeler compiler, verifier, and scanner sources live only in wheeler.compiler. The bounded interpreter lives in wheeler.runtime, and shared binary codecs live in wheeler.core. Their entryless libraries compile from exact manifest source sets and locks. Examples consume exact vendored archives, while the workspace, formatter, documentation checker, Tree-sitter corpus, and differential fixtures follow each canonical root. No example-side compiler copy exists, so a build cannot link one by mistake.
• [ ] The bounded Wheeler compiler slice now covers these cases:
• compiler/Core.w, compiler/Graphs.w, compiler/GraphFour.w, compiler/GraphFourBranches.w, compiler/GraphFourDag.w, compiler/GraphFourMixed.w, compiler/GraphFourNested.w, compiler/GraphFive.w, compiler/graphs/Plans.w, compiler/graphs/five/FiveFork.w, compiler/graphs/five/FiveBranches.w, compiler/graphs/five/FiveMixed.w, compiler/graphs/five/FiveForkMixed.w, compiler/graphs/five/FivePairs.w, compiler/graphs/five/FiveLongMixed.w, compiler/graphs/five/FiveDeepMixed.w, compiler/graphs/five/FiveNestedMixed.w, compiler/graphs/five/FiveNestedFork.w, compiler/graphs/five/FiveDag.w, compiler/Driver.w, compiler/{backend,frontend,ir,verification}, and the scanner modules parse a bounded Wheeler source file, sort source identifiers, derive aligned sections, and emit a complete canonical .wbc. The core owns one linked source. The graph compilers own bounded source graphs. The driver keeps the public facade boring. MinimalCompiler.w remains the thin executable wrapper. Identity and bootstrap consumers import the stateless driver instead of growing a second compiler with suspiciously familiar bugs.
• For LongClass with state long value = 7 and value += 5, all 504 bytes match stage 0. Strict decoding, canonical re-encoding, direct VM execution, and wheeler run also succeed after trimming a 512-byte output capacity.
• Alternate names and numeric operands match stage 0 across empty and one- through sixty-four-statement entry bodies. Public, explicit-private, and unqualified helpers independently admit zero through sixty-four statements. Ordinary helpers work with or without class state. Empty reversible helpers and their generated-inverse theorems also need no dummy global. Nonempty reversible helpers retain the bounded state-update contract. Duplicate visibility is rejected instead of being treated as emphasis. An entryless library with zero or one general helper emits the canonical unqualified $library halt entry. frontend/helpers/ScalarHelperTables.w owns bounded helper lookup, duplicate checks, and call resolution. ScalarHelperLibraries.w parses one member at a time. ScalarHelperParsing.w assembles the bounded declaration table. ScalarHelperCallResolution.w resolves one member, ScalarHelperResolution.w validates the complete resolved table, and ScalarHelperPrograms.w constructs the IR. A bounded helper table now plans two through twenty-three explicitly public or private zero- through sixteen-parameter scalar helpers, up to twenty-five canonical strings, twenty-four function descriptors, complete local signatures, exact code offsets, and the same halt entry. The native compiler now compiles its checked-in compiler/backend/EncodingWidths.w, compiler/graphs/kinds/FivePlanKinds.w, compiler/graphs/kinds/SixGraphKinds.w, compiler/graphs/kinds/SevenPlanKinds.w, compiler/ir/Opcodes.w, compiler/ir/ProofRules.w, compiler/ir/ResolvedStatements.w, compiler/ir/StatementKinds.w, compiler/ir/StorageOpcodes.w, compiler/ir/TypeCodes.w, compiler/ir/limits/CompilerProgramLimits.w, imported-constant compiler/resolution/returns/ReturnOpcodeKinds.w, imported-constant compiler/syntax/assignments/NamedLocalAssignmentKinds.w, imported-constant compiler/syntax/assignments/ResolvedLocalAssignments.w, imported-constant compiler/syntax/assertions/ResolvedBooleanLiteralAssertions.w, imported-constant compiler/syntax/assertions/ResolvedLessThanAssertions.w, imported-constant compiler/syntax/assertions/ResolvedLocalPairAssertions.w, compiler/syntax/booleans/BooleanTokens.w, imported-constant compiler/syntax/booleans/ResolvedBooleanLiteralComparisons.w, imported-constant compiler/syntax/comparisons/NamedComparisonKinds.w, imported-constant compiler/syntax/conditionals/LiteralComparisonOperations.w, imported-constant compiler/syntax/conditionals/NamedConditionalBases.w, imported-constant compiler/syntax/conditionals/NamedLiteralComparisonKinds.w, imported-constant compiler/syntax/conditionals/NamedLocalConditionalKinds.w, imported-constant compiler/syntax/conditionals/NamedLocalConditionalValues.w, imported-constant compiler/syntax/conditionals/ResolvedLiteralComparisonKinds.w, imported-constant compiler/syntax/conditionals/ResolvedLocalConditionalKinds.w, imported-constant compiler/syntax/conditionals/ResolvedLocalConditionalOperands.w, imported-constant compiler/syntax/conditionals/ResolvedLocalConditionalSources.w, imported-constant compiler/syntax/locals/NamedLongOperations.w, imported-constant compiler/syntax/locals/ResolvedLocalCopyKinds.w, imported-constant compiler/syntax/locals/ResolvedLocalEqualityKinds.w, imported-constant compiler/syntax/locals/ResolvedLocalInequalityKinds.w, imported-constant compiler/syntax/locals/ResolvedLocalLessThanKinds.w, imported-constant compiler/syntax/locals/ResolvedLocalLiteralComparisons.w, imported-constant compiler/syntax/locals/ResolvedLocalLiteralComparisonSources.w, imported-constant compiler/syntax/locals/ResolvedLongOperations.w, imported-constant compiler/syntax/loops/ResolvedLocalLoopForms.w, imported-constant compiler/syntax/loops/ResolvedLocalLoopKinds.w, imported-constant compiler/syntax/loops/ResolvedLocalLoopOperands.w, imported-constant compiler/syntax/updates/NamedLocalUpdateKinds.w, imported-constant compiler/syntax/updates/ResolvedLocalUpdates.w, imported-constant compiler/ir/OpcodeKinds.w, imported-constant compiler/ir/TypeKinds.w, imported-constant compiler/ir/InstructionForms.w, imported-constant compiler/syntax/BooleanDeclarationKinds.w, compiler/syntax/IdentifierStarts.w, compiler/syntax/tokens/CompilerTokenLimits.w, compiler/syntax/tokens/KeywordTokens.w, compiler/syntax/tokens/SourceScalars.w, compiler/syntax/helpers/HelperAbi.w, imported-constant compiler/syntax/helpers/HelperSignatures.w, imported-constant compiler/syntax/helpers/HelperValueKinds.w, compiler/syntax/intrinsics/BorrowedIntrinsicKinds.w, imported-constant compiler/syntax/EarlyReturnKinds.w, imported-constant compiler/syntax/EarlyReturnResultKinds.w, compiler/syntax/LoopKinds.w, imported-constant compiler/syntax/calls/CallArgumentSources.w, imported-constant compiler/syntax/calls/OneArgumentCalls.w, imported-constant compiler/syntax/calls/TwoArgumentCallKinds.w, imported-constant compiler/syntax/returns/EarlyReturnSources.w, imported-constant compiler/syntax/returns/NamedBooleanReturnKinds.w, imported-constant compiler/syntax/returns/NamedReturnArithmeticKinds.w, imported-constant compiler/syntax/returns/NamedReturnComparisonOperands.w, imported-constant compiler/syntax/returns/NamedSignedReturnKinds.w, imported-constant compiler/syntax/returns/ResolvedEarlyComparisonKinds.w, imported-constant compiler/syntax/returns/ResolvedEarlyResultKinds.w, imported-function compiler/syntax/returns/EarlyComparisonForms.w, compiler/syntax/returns/ResolvedLocalReturns.w, and imported-constant compiler/syntax/returns/ResolvedReturnCallKinds.w sources byte for byte with stage 0. StatementKinds.w owns exactly 129 unresolved statement identities. LoopKinds.w owns six loop-form identities. ResolvedStatements.w owns eighty resolved opcode columns. Tokens.w has returned to lexical work and may stop pretending that every integer is a token. HelperAbi.w now owns the forty-one helper kinds, result-slot widths, total scalar table capacity, and direct imported-helper capacity instead of lending them to the general IR. HelperBody carries its validated parameter count. HelperSignatures.w retains result kinds, reversibility, and result-slot selection for the remaining closed scalar forms. CompilerProgramLimits.w owns the statement and resolution-table capacities. EncodingWidths.w owns the three canonical integer field widths. FivePlanKinds.w owns the twelve five-module topology identities instead of storing them beside the plan record. SixGraphKinds.w does the same for fourteen structure identities and fifteen plan bounds. SevenPlanKinds.w owns the twenty-eight admitted seven-module forms. graphs/seven/PlanShapes.w assigns mixed and nested source roles after graph validation. graphs/seven/shapes/Chains.w assigns long-chain roles. graphs/seven/shapes/Forks.w assigns wide-fork roles. graphs/seven/shapes/Nested.w assigns nested-fork roles without swelling the general shape owner. graphs/seven/Linking.w applies validated edges, while Mixed.w, Nested.w, Separate.w, executors/Asymmetric.w, executors/Dags.w, executors/ExtendedFork.w, executors/LongChains.w, executors/NestedBranches.w, executors/SeparateBranches.w, executors/SerialDags.w, and WideFork.w keep connected, nested, uniform, uneven, and wide-fork branches in their own lanes. A record is not a registry merely because both can occupy a file. The IR may now describe records without also moonlighting as a filing cabinet. A twenty-fourth helper still fails before publication. One through seven direct executable dependencies may jointly supply one through twenty-two helpers while the root supplies the remainder of the twenty-three-helper table, with exact private visibility and owner-qualified function names. A twenty-third dependency helper fails before publication. backend/HelperOwners.w owns one validated seven-slot owner table, and compiler/Core.w accepts that table through one entry point instead of an arity staircase. The staircase was removed before anyone filed a preservation order. frontend/modules/MultipleImportedHelpers.w links up to four direct owner groups in canonical root-import order. All six three-owner source orders reproduce stage 0 at the eight-plus-seven-plus-seven boundary, and eight forward/reverse rotations do the same for a six-plus-six-plus-five-plus-five split. frontend/modules/WideImportedHelpers.w covers five owners with ten rotations at the five-plus-five-plus-four-plus-four-plus-four boundary. HelperSourceOrder.w and SixImportedHelpers.w cover six owners with twelve rotations at 4+4+4+4+3+3. HelperSourceOrder.w and SevenImportedHelpers.w fill the framed bound with fourteen rotations at 4+3+3+3+3+3+3. Arrival order has now lost seven consecutive elections. The frame is transport, not a ballot box. The binary wrapper now accepts zero through seven imported source frames. Zero dispatches directly to compileMinimal and matches stage 0 for a physical compiler module. Empty dependency sets no longer need a ceremonial plus-one. An eighth executable dependency owner remains outside this path. Signed-parameter Boolean and signed helpers now lower bounded equality or less-than guards, computed signed-local preludes, and up to sixty-four same-module or direct imported Boolean calls with typed literal or constant early returns through exact local, call-target, branch, result, and jump tables. A seven-owner differential distributes sixty-four calls across all twenty-two imported helpers, reaches the 256-local window, and remains byte-identical in forward and reverse frame order. A sixty-fifth call still fails before publication. The call table does not care which module supplied the callee. This is a linker, not a seating chart. A ceiling without a test is just a rumour with capital letters. A final Boolean return may forward one zero-argument helper call through one local and two instructions, a one-argument call through three locals and four instructions, or a two-argument call through five locals and six instructions. A Boolean helper-call guard may now return another one-argument helper call over the same or a different prior signed local. Thirty-two guarded pairs fill all sixty-four call slots. Pair thirty-three is shown the door before publication. Two calls in one statement are still two calls, despite what expense reports suggest. frontend/statements/EarlyResolution.w now owns early-guard local-index resolution, pulling LocalStatements.w back below 900 lines. The old monolith has one fewer drawer marked “misc”. HelperBody now carries its parsed parameter count, and descriptors, local bases, type offsets, code generation, and call checks consume that field instead of reverse-engineering arity from a helper-kind number. A kind is a kind, not a small database with ambitions. HelperBody.parameterTypes now carries a bounded sixteen-slot canonical type column, and type-table emission consumes it directly. frontend/helpers/HelperParameterTypes.w now fills that column for signed values, shared UTF-8 and byte-view loans, and mutable byte, word, region, and signed-map loans. Mixed signatures emit stage-0-identical descriptors and local types. Final calls may forward one or two signed and loan parameters to same-module or direct imported helpers. Call resolution checks every argument type, and code generation emits the canonical UTF-8, buffer, map, or region borrow instead of laundering a loan through LOCAL_MOVE. A signed helper may return bufferLength directly through the exact two-local, three-instruction form or bind its result to a signed local before returning it. UTF-8, byte-view, byte, and word loans are admitted. It may also bind utf8Scalar or utf8Width from a UTF-8 loan and signed index through the exact four-local, four-instruction form, or read one indexed byte or word from a byte-view, byte, or word loan through the same shape. Mutable word and byte loans admit set and setByte through the exact three-local, four-instruction form. Entryless void helpers accept zero through sixteen primitive parameters and either an empty body or those writes; no result type is invented to keep the offset arithmetic entertained. Void and scalar-result helpers may issue zero-, one-, or two-argument calls to same-module or direct imported void helpers. Exact primitive types select the reborrow opcode; LOCAL_MOVE is not witness protection for an affine owner. Mismatched owner, index, and value types fail before publication. Other intrinsic reads and writes remain unfinished, so the affine war has not been won merely because the courier can now read the label. A signed less-than guard may return its parameter minus or modulo one literal or constant through six locals and nine instructions. The linked source and graph arenas now admit 32,768 bytes. A four-helper differential crosses the former 16 KiB line, while two padded imports pin fail-closed rejection beyond the new ceiling. Canonical module a.b; headers produce the same qualified a.b::main and helper strings as stage 0 while retaining unqualified theorem names. Malformed or noncanonical headers fail before output. The native driver now accepts up to sixty-four sorted unique direct import declarations and rejects malformed, duplicate, unsorted, or excess imports before publication. Separate native APIs link every rooted tree topology over one through four imported scalar-constant modules, one four-module shared-dependency diamond, and the five-module direct star, chain, four-leaf fork, three-leaf fork beside a direct import, one chain edge beside three direct imports, a two-leaf fork beside two direct imports, two independent chains beside a direct import, a three-module chain beside two direct imports, a four-module chain beside a direct import, a nested two-leaf fork beside a direct import, two nested fork levels, and a shared diamond with a side leaf, plus the six-module direct star, full chain, five-leaf fork, one three-leaf fork beside two direct imports, one nested two-leaf fork beside two direct imports, one uneven two-branch tree beside two direct imports, one fork beside one chain and one direct import, three independent chains, one three-module chain beside one two-module chain and one direct import, one chain edge beside four direct imports, one two-leaf fork beside three direct imports, one three-module chain beside three direct imports, one four-module chain beside two direct imports, and two independent chains beside two direct imports, plus the seven-module direct star, full chain, six-leaf fork, one chain edge beside five direct imports, one two-leaf fork beside four direct imports, two independent chains beside three direct imports, three independent chains beside one direct import, one three-module chain beside four direct imports, one four-module chain beside three direct imports, one five-module chain beside two direct imports, one six-module chain beside one direct import, one three-module chain beside one two-module chain and two direct imports, two three-module chains beside one direct import, one two-leaf fork beside one two-module chain and two direct imports, one nested two-leaf fork beside three direct imports, one nested three-leaf fork beside two direct imports, one deep nested two-leaf fork beside two direct imports, one uneven nested fork beside two direct imports, two paired nested chains joined below two direct imports, one extended three-branch fork beside two direct imports, one long branch joined with one leaf beside two direct imports, one asymmetric nested fork beside two direct imports, one shared diamond beside three direct imports, one shared diamond with a side leaf beside two direct imports, two serial shared diamonds, one three-leaf fork beside three direct imports, one four-leaf fork beside two direct imports, and one five-leaf fork beside one direct import, for unqualified or canonical owner-qualified public use and match stage 0 byte for byte. Differential fixtures exhaust all 720 orders of each six-module graph. A closed six-module plan checks exact header edges and rooted reachability before a separate structure owner assigns topology and role order. A detached cycle still cannot dress as a chain. Every two- through seven-module planner records exact edges, roots, topological order, private visibility, and shared-dependency facts before topology dispatch. The same bounded matrix writes canonical chain and fork orders, which those executors consume instead of probing permutations. Every admitted four- and five-module form and the six-module root-branch forms consume exact topology-specific role order. Fourteen orders of each seven-module graph cover every source in every frame position in forward and reverse rings. Private constants may feed public exports. A leaf export becomes private in its dependent, so the root receives no implicit transitive export. Any private name in the root fails before caller output changes. The conservative check also rejects a root-local collision for now. One through seven direct edges link helper dependencies to their root. One three-module chain first resolves statement constants into such a dependency. Both paths preserve dependency function owners and private visibility. Other executable imported members, mismatched names, unsupported four-module DAGs, unsupported five-module graphs, other six- and seven-module graphs, eight or more root imports, and non-ASCII linked sources fail closed. General imported declaration resolution and multi-file linking remain outside this bounded slice. Reversible signed-result helpers may select any one of several independent checked preludes over preserved parameters. Chained local relations remain rejected. The tests cover signed and Boolean locals, prior signed- and Boolean-local copies, prior-Boolean negation, typed equality and inequality declarations over prior locals, signed locals and literals, or signed and Boolean locals and class constants, direct assertions over prior Boolean or signed locals, Boolean equality assertions against class constants, signed local or state equality assertions against literals or class constants, signed-local less-than declarations over prior locals or literal right operands, and signed ordering assertions against prior locals or class constants, one-arm positive or negated prior-Boolean if guards and signed-local equality and less-than guards against literals or class constants over global assignment and checked updates from literals, class constants, or prior locals, checked signed-local +, -, ^, &, *, /, and % expressions plus equality, inequality, ordering, and in-place +=, -=, and ^= updates over literal, class-constant, or prior-local right operands, bounded signed-local less-than while loops with explicit literal, class-constant, or prior-local conditions and limits and one checked unit update, resolved signed-local and Boolean-local assertions, typed signed- and Boolean-local assignment, one global, literal and prior-local assignment, checked add or subtract over literals or prior locals, literal or prior-local XOR, void helper calls, zero-argument Boolean result helpers with bounded local preludes, one- and two-argument Boolean helpers with Boolean literal or prior-local arguments, bounded parameter-aware local preludes, and direct negated, equality, or inequality results over literal, class-constant, or prior-local right operands, Boolean-result helpers with one through sixteen signed parameters, signed literal or prior-local calls to one- and two-parameter forms, direct signed equality, inequality, or ordering results over literal, class-constant, or prior-local right operands, zero-argument signed result helpers with bounded local preludes, one-argument signed helpers with literal, class-constant, or prior-local arguments and bounded parameter-aware local preludes, two-argument scalar calls and three- through sixteen-parameter scalar helpers over literals, class constants, or prior entry locals with bounded parameter-aware local preludes, and direct or checked arithmetic results plus bitwise XOR and AND over literals, class constants, or parameters, reverse blocks, and an optional inverse theorem.
• The native compiler lowers the first reversible signed-result profile byte for byte with stage 0. A rev long helper with up to two signed parameters returns one signed literal, evaluated constant, preserved signed parameter, checked operation over either signed parameter and a constant, or checked operation over two signed parameters through an adjacent result slot. The emitter derives flag 0xd, both slot local types, identical constant, preserved-source, or computed bodies, CALL_RESULT_SLOT, and the optional generated-inverse proof. The bounded entry interleaves one or more result calls with signed checks against constants or results already produced. One checked operation may bind an exact signed result local before return. Boolean results, chained preludes, a mismatched return, or state mutation publish nothing.
• Signed-result entry bodies admit one through sixty-four statements with one or more helper calls anywhere in the sequence. Later calls may consume prior results. The IR derives exact local slots and code lengths. Repeated ordinary helper calls produce repeated CALL_VALUE sites, while statements around a void reversible block get distinct local and type windows.
• Two-function artifacts derive four-way string order, descriptor and type offsets, RETURN, and CALL.
• Reversible helpers derive inverse code for checked global add or subtract and self-inverse XOR in reverse source order. Plain assignment is rejected, inverse ranges and UNCALL are derived, and restored-state assertions are checked.
• Certified forms add a fifth canonical string, a seventh directory entry, and a GENERATED_INVERSE proof payload accepted by the kernel.
• Signed and Boolean literals, unary negation, literal assertions, and earlier Boolean locals compose with later state operations. They lower through LOCAL_CONST, LOCAL_XOR, LOCAL_MOVE, and EXPECT_TRUE with exact type windows.
• Tokens.w owns token hashing and scalar decoding. CompilerTokenLimits.w owns token-table and qualified-name bounds. KeywordTokens.w owns source keyword identities. SourceScalars.w owns ASCII digit and punctuation identities. It hashes up to 256 token scalars with a named fifty-eight-bit multiplication input mask, so long legal identifiers remain deterministic without asking checked multiplication to pretend it wraps. StatementKinds.w owns unresolved statement identities. LoopKinds.w owns resolved loop forms. ResolvedStatements.w owns resolved opcode columns. StatementOpcodes.w owns statement-token classification. HelperValueKinds.w owns the closed scalar helper-value ranges. syntax/intrinsics/BorrowedIntrinsicKinds.w owns the source and resolved bufferLength, utf8Scalar, utf8Width, indexed-buffer, and mutable-buffer statement identities instead of squatting in the general registries. frontend/intrinsics/BorrowedIntrinsicSyntax.w validates their closed syntax, BorrowedIntrinsicResolution.w resolves their typed source locals, and backend/intrinsics/BorrowedIntrinsicCodegen.w owns their instruction shapes. BooleanTokens.w owns the closed literal-token pair. IdentifierStarts.w owns bounded ASCII identifier starts. syntax/calls/OneArgumentCalls.w owns one-argument scalar call families. syntax/calls/TwoArgumentCallKinds.w owns two-argument parameter and result families. syntax/calls/CallArgumentSources.w owns their local-source classification. CallForms.w owns call-argument token layout and aggregate scalar-result recognition. EarlyReturnKinds.w owns unresolved guard-return families. syntax/returns/ResolvedEarlyComparisonKinds.w and ResolvedEarlyResultKinds.w own resolved guard columns. EarlyComparisonForms.w combines equality and ordering families. EarlyReturnSources.w decodes their source locals. NamedComparisonKinds.w owns aggregate direct comparison families. Focused named-return modules own unresolved Boolean, signed, arithmetic, and right-local operand families. BooleanDeclarationKinds.w owns Boolean declaration classification. BooleanDeclarationWidths.w owns Boolean and signed-comparison declaration widths. Focused assignment, assertion, Boolean, local, loop, and update modules own scalar opcode classification and decoding. The old ScalarOpcodes.w grab bag is gone. Conditionals.w owns condition syntax, resolved families, and source-local recovery. LocalOpcodes.w keeps the remaining local register shapes. Global assertions use local-free EXPECT_EQ, signed values use checked two's-complement encoding, overlong magnitudes fail before output, duplicate string identities fail before publication, and exact file length must fit caller capacity before the first header byte is written.
• The checked-in Counter.w, including comments, forward calls, inverse calls, both assertions, and its theorem, matches stage 0 through direct and package-selected compiler paths. It executes back to count = 0. Thirty-two deterministic pseudo-random whitespace, line-comment, and block-comment layouts of the minimal seed also emit the same bytes in stage 0 and Wheeler. Compiler metadata now admits 2,048 pre-compaction tokens: 1,000 comments preserve the artifact, while 2,048 comments exhaust the bound before publication. The teaching scanner still reports comment tokens, while the compiler parser discards them by policy.
• A Wheeler-native verifier reads private compiler output through byteview or an exact host artifact through NativeVerifier.w.
• compiler/verification/Verifier.w, FunctionVerifier.w, InstructionVerifier.w, and ProofVerifier.w check framing, descriptors, instruction lengths, opcode and operand domains, local type windows, branch targets, proof references, and terminal-only HALT rules. They now accept canonical 0xd reversible signed-result descriptors and the four WIP-0038 result-slot forms. Stage 0 emits return -1; through that ABI, the Java VM executes its generated inverse after history commit, and the Wheeler verifier independently accepts the artifact and proof. Wheeler-native lowering and execution of the forms remain.
• Verification finishes before setOutputLength publishes the result.
• Binary and hex corpora accept canonical artifacts and reject forged indices, types, calls, and proofs.
• General multi-function, local, type, and control-flow IR still remains. Signed-global IR, assignment, and checked arithmetic updates are available.
• Fixed signed/Boolean arrays may now live in record fields and variant payloads. MinimalProgram uses sixty-four-slot opcode and operand columns instead of ordinal fields. BodyParser.w scans entry and helper bodies once into a caller-owned start table. Conditionals.w owns positive and negated local guards, so the main statement parser does not become a hedge maze. The two grammar owners no longer carry matching hand-unrolled ladders. One sequence resolver owns bounded table traversal. Operands.w owns operand decoding and typed local-name lookup. HelperCalls.w owns helper-call recognition. LocalStatements.w owns opcode selection and duplicate rejection. ReturnCodegen.w owns typed helper-return encoding. Bounded loops derive local windows, code lengths, type rows, forward helper bodies, and reverse-order inverse bodies. The sixty-fifth statement fails before publication. The corresponding verified execution window is 256 typed locals and 512 instructions, enough for sixty-three checked updates plus a final expectation without lying about the lowered cost. Empty columns come from one IR owner rather than four copied literals. If raising a table bound requires another thicket of if statements, the table has already won.
• StringTable.w owns canonical string planning and emission. Its three-way stateless-helper plan compares the fully qualified helper and entry strings rather than comparing an unqualified apple with a qualified ioctl. Module and nonmodule artifacts match stage 0. Core.w coordinates sections and returns exact verified artifact/code bounds. Graphs.w, GraphFour.w, GraphFourBranches.w, GraphFourDag.w, GraphFourMixed.w, GraphFourNested.w, GraphFive.w, graphs/SmallStructures.w, graphs/FourStructures.w, graphs/FiveStructures.w, graphs/Matrix.w, graphs/Sources.w, graphs/FiveChain.w, graphs/Plans.w, graphs/five/FiveFork.w, graphs/five/FiveBranches.w, graphs/five/FiveMixed.w, graphs/five/FiveForkMixed.w, graphs/five/FivePairs.w, graphs/five/FiveLongMixed.w, graphs/five/FiveDeepMixed.w, graphs/five/FiveNestedMixed.w, graphs/five/FiveNestedFork.w, and graphs/five/FiveDag.w own graph linking. graphs/SmallStructures.w, graphs/FourStructures.w, and graphs/FiveStructures.w select exact topologies before any executor starts rebuilding source text. Their chain and fork paths consume canonical source order instead of trying permutations until one stops complaining. frontend/modules/SharedDeclarations.w deduplicates a shared private declaration only after its canonical token sequence matches exactly. Driver.w preserves the public compile API. MinimalCompiler.w only publishes that range for the package tool. Bootstrap closure and seed-writer fixtures now expand the canonical compiler target selectors instead of carrying private source lists. A module addition has one manifest owner, which is already one owner more than most build systems manage before lunch.
• The grammar is still small, but the slice performs real parsing, lowering, verification, encoding, and execution.
• [x] Wheeler's canonical .wbc identity codec passes stage-0 differential tests. compiler/verification/Codec.w performs complete native typed structural verification before copying into caller-owned output. NativeBytecodeCodec.w reproduces every canonical input byte, publishes only after success, rewinds exactly, and leaves output untouched for malformed input. NativeBytecodeIdentity.w hashes the private verified re-encoding. NativeCompilerIdentity.w goes one step earlier: it invokes the importable Wheeler driver, keeps the generated artifact private, and reproduces the SHA-256 of stage 0's byte-identical output. Malformed or oversized source publishes no compiler output identity. Since .wbc 1.0 has one canonical byte representation, a verified identity encoder is the reversible codec for accepted artifacts. General semantic editing still belongs to the compiler IR. Blessing a second binary spelling would be standards work in the same sense that dropping a piano is music.
• [ ] The manifest-bound Utf8Lexer.w, lexer/Parser.w, and lexer/Scanner.w graph reads explicit bounded UTF-8 source input. Its scanner handles identifiers with digit continuations, checked decimal, hexadecimal, and binary integers through Long.MAX_VALUE, punctuation, whitespace, printable ASCII literals, and terminated line or block comments. Token buffers record kind, start, and length. Diagnostics include a stable code, byte offset, line, and column for malformed comments, literals, or capacity limits. A dependency parser checks one long local declaration and returns a closed value-or-error result. The entry then publishes the accepted decimal token through bounded output. Complete token schemas, decoded values, streaming effects, full parsing, recovery sets, and corpus parity remain.

EOF does not close a block comment or literal. The scanner reports that error immediately.

• [x] Stage 0 accepts checked scalar const declarations with public import and canonical qualification. It also accepts finite enum declarations lowered to payload-free variants. Constants emit no globals, and enum case order is canonical. compiler/ir/Opcodes.w, compiler/ir/StorageOpcodes.w, and compiler/ir/TypeCodes.w own opcode and type identities. compiler/ir/OpcodeKinds.w owns opcode family checks, so verifier and interpreter dispatch no longer use raw numeric literals. The constant graph supports forward references and canonical cycle diagnostics. The Wheeler recovery compiler now evaluates the same decimal, hexadecimal, binary, Boolean, arithmetic, bitwise, comparison, checked rotateRight32, parenthesized, and forward-reference forms within one bounded class. One contiguous constant block may sit before or after optional signed state, and a signed result may initialize that state. It rejects split blocks, cycles, and traps before publication, then differentially substitutes the result through its existing scalar uses, including generated reversible helper updates and their exact inverse bodies. Direct import header syntax, one- through four-module direct scalar constant graphs with private dependencies, the six-module direct star, full chain, five-leaf fork, one three-leaf fork beside two direct imports, one nested two-leaf fork beside two direct imports, one uneven two-branch tree beside two direct imports, one fork beside one chain and one direct import, three independent chains, one three-module chain beside one two-module chain and one direct import, one chain edge beside four direct imports, one two-leaf fork beside three direct imports, one three-module chain beside three direct imports, one four-module chain beside two direct imports, and two independent chains beside two direct imports, and the seven-module direct star, full chain, six-leaf fork, one chain edge beside five direct imports, one two-leaf fork beside four direct imports, two independent chains beside three direct imports, three independent chains beside one direct import, one three-module chain beside four direct imports, one four-module chain beside three direct imports, one five-module chain beside two direct imports, one six-module chain beside one direct import, one three-module chain beside one two-module chain and two direct imports, two three-module chains beside one direct import, one two-leaf fork beside one two-module chain and two direct imports, one nested two-leaf fork beside three direct imports, one nested three-leaf fork beside two direct imports, one deep nested two-leaf fork beside two direct imports, one uneven nested fork beside two direct imports, two paired nested chains joined below two direct imports, one extended three-branch fork beside two direct imports, one long branch joined with one leaf beside two direct imports, one asymmetric nested fork beside two direct imports, one shared diamond beside three direct imports, one shared diamond with a side leaf beside two direct imports, two serial shared diamonds, one three-leaf fork beside three direct imports, one four-leaf fork beside two direct imports, and one five-leaf fork beside one direct import now have bounded native coverage. Separate private/root symbol tables, colliding exports, other six-module graphs, other seven-module graphs, eight or more imported modules, unrelated qualifiers, and general multi-file linking still need native graph and linker coverage. Reversible finite permutations and coherent enum lowering remain under WIP-0017.
• [x] NativeVm.w and runtime/Interpreter.w execute the verified bounded compiler profile inside Wheeler.
• They agree with stage 0 on local and global updates, signed and Boolean branches, a bounded loop, typed value and void calls, and the four-function FunctionValues.w graph.
• The suite covers a 35-local frame, an 80-expectation code window, six levels of RecursiveValue.w, and LoopControl.w with early return, break, and continue.
• Aggregate fixtures include nested Records.w, payload-free FiniteEnums.w, payload-carrying Variants.w, fixed arrays, slices, and fixed signed/Boolean arrays embedded in records and variant payloads. The native verifier rejects a forged aggregate-element array before interpretation.
• Storage fixtures cover regions, word and byte buffers, nested mutable borrows, valid and malformed UTF-8, FrozenUtf8.w, signed maps, and owner-returning calls.
• The proof-bearing Counter.w also executes under the Wheeler verifier and interpreter.
• ReversibleResult.w executes CALL_RESULT_SLOT forward and UNCALL_RESULT_SLOT backward through the same Wheeler verifier and interpreter. A direct artifact checks restored vacancy before publishing success. Its globals agree with the Java VM.
• Every declared global, up to eight, must match stage 0.
• Forged branch or call targets fail before interpretation. Multiple reversible helpers use their canonical code-section-relative inverse offsets, including a nonzero second-helper offset.
• Forged record-field, variant-tag, array-index-local, slice-index-local, word-index-local, byte-index-local, UTF-8-index-local, and map-key-local operands fail at the same boundary.
• Bad static bounds, wrong generated inverses, and malformed artifacts also fail closed.
• The outer execution rewinds exactly. Wider bytecode coverage and native code remain WIP-0008 work.
• [x] NativeSha256.w and crypto/Sha256.w compute bounded, provider-free SHA-256 from immutable binary input into caller-owned output. The implementation uses 1,088 bytes across three explicit scratch buffers. Checked signed & and bounded rotateRight32 lower to canonical LOCAL_AND and LOCAL_ROTR32. Empty input, abc, the 55-, 56-, and 64-byte padding boundaries, and arbitrary two-block input match the independent stage-0 result. crypto/ContentIdentity.w now centralizes bounded ownership and all-or-nothing digest publication for canonical textual metadata. Rewind restores the empty-input baseline. This code provides portable content identity. It is not a password-hashing API.
• [x] A classical entry may receive strict UTF-8 or immutable binary byteview input. It may also receive a bounded mutable byte-output borrow with a rewindable published length. Type code 13 allows checked byte reads and length queries, but not writes, ownership, results, or aggregates. VM and runtime APIs enforce the declared input kind, defensive copies, a 16 MiB bound, physical nonsymlink input, and no ambient lookup. wheeler run --input and --input-bytes are mutually exclusive. Output is published atomically after success, and rewind returns to the external-effect baseline.
• [ ] Wheeler semantic analysis and lowering compile all examples.
• [ ] Stage 1 and stage 2 reach a byte-identical fixed point.
• [ ] Ordinary builds use the Wheeler compiler and the Java compiler path is deleted.

Testing and acceptance

• [ ] Stage 1 and stage 2 .wbc artifacts are byte-identical in clean CI.
• [ ] Stage 0, stage 1, and stage 2 produce identical artifacts for every accepted example.
• [ ] All stages produce the same stable diagnostics for the negative corpus.
• [ ] Bootstrap succeeds under at least two supported host JDKs and clean environments without path-dependent output.
• [ ] Randomized source whitespace and comment placement preserve artifact bytes where source maps are disabled.
• [ ] Deterministic collection tests vary insertion history and host hash seeds.
• [ ] Compiler memory, stack, token, diagnostic, and step limits fail before partial output.
• [ ] Malformed UTF-8, literal overflow, deep nesting, cyclic imports, duplicate symbols, and malformed bytecode fail identically.
• [ ] The self-hosted compiler emits classical, coherent, quantum, and hybrid examples accepted by the independent verifier.
• [ ] The recovery seed can rebuild its successor from a clean checkout.
• [ ] Diverse double compilation reproduces the candidate artifact without executing candidate-produced code before comparison.
• [ ] The bootstrap manifest binds both derivation paths, source trees, tools, options, limits, verifiers, and complete output identities.
• [ ] No Java parser, lowerer, or .wbc writer remains on the normal compiler path after cutover.
• [ ] Current compiler documentation explains the trust chain, fixed-point test, limits, and seed update procedure.

Alternatives

Keep the compiler in Java

Rejected. It leaves Wheeler unable to express its defining systems program and makes JVM behavior part of the practical language contract.

Translate the Java compiler mechanically at the end

Rejected. The resulting Wheeler program would inherit Java-shaped APIs and force late changes to values, storage, effects, and modules. Bootstrap requirements guide those contracts now.

Keep Java and Wheeler compilers indefinitely

Rejected. Parallel authorities drift. Differential operation is a migration phase with a deletion gate, not a compatibility policy.

Use Tree-sitter as the production parser

Rejected for the bootstrap baseline. It adds a native generated runtime to the trusted path and does not own Wheeler semantic diagnostics. Tree-sitter remains required editor tooling and a differential grammar test.

Check in only generated Java or native code

Rejected. The canonical executable is .wbc. Provider formats and host-native images are derived caches.

Open questions

• Which ownership rule and region representation provide the smallest sufficient bootstrap heap (owner: VM and language maintainers. Decision point: before aggregate bytecode is accepted)?
• Which prior seed and independent implementation should be used for a later diverse double bootstrap (owner: release maintainers. Decision point: before the first stable release)?

References

• WIP-0001
• WIP-0005
• WIP-0006
• WIP-0008
• WIP-0009
• WIP-0010
• WIP-0011
• WIP-0012
• WIP-0013
• WIP-0016
• WIP-0017
• WIP-0023
• WIP-0026
• WIP-0028
• WIP-0029
• WIP-0030
• WIP-0031
• WIP-0032
• Wheeler source language profile
• Ken Thompson, "Reflections on Trusting Trust"