Proposal: Memory Management for Granite

Status: Design (ticket 0011). Not implemented. Related: WISP-RETENTION.md (ticket 0012, PR #80: what the Wisp interpreter keeps alive on purpose), changes/SELF-HOSTED-COMPILER.md ("GC or arena per compilation?"), changes/LIVE-REPL-DYNAMIC-LINKING.md ("Garbage collection").

Summary

Status: implemented. Stages 0-5 shipped and stage 6 cleaned up; §9 says what was built, what it measured, and what is still open. The rest of this document is the design as approved, written before the work.

Granite never frees memory. Every allocation bumps $__heap_ptr, __pack_free is a nop, and the compiled module declares a fixed 2 GiB memory. A Wisp REPL session is a Granite program, so every session grows until it traps.

The decision:

1. The Granite heap is not acyclic today, but one change makes it acyclic. list-push writes the new length and data pointer back into the list it was given. That is the only operation that changes a heap object after it is built, and it can make a list that contains itself (demonstrated in compiled Granite and in a live Wisp session, below). We give list-push value semantics: it returns a list with one more element and does not change its argument. The tree-walking back-end (eval.rs) already does this. After that change, every edge in the heap is written while the object is new and unshared, so no cycle can exist.
2. Reference counting inserted at compile time, in the style of Koka's Perceus. The compiler inserts dup/drop, infers borrowed parameters, and reuses a dying object's memory in place (this is how list-push stays O(1) when the list is unique). There is no tracing, no shadow stack, and no pause. Memory is freed as soon as the last reference goes.
3. A real allocator: size-class free lists for small blocks, power-of-two buckets for large blocks, an 8-byte header, and a memory that starts small and grows.
4. The boundary already works for us: the Pack host calls __pack_free on every input and output buffer. A real __pack_free reclaims them with no host change.
5. Two fixes come before any freeing, and they remove most of the garbage. Measured: one list-push fix takes the self-hosted compiler build from 1408 MiB to 62 MiB allocated and from 0.79 s to 0.05 s. String literals are rebuilt on the heap byte by byte every time they are evaluated, and they are 91% of what a Wisp loop allocates.

What we give up: a future feature that adds a mutable cell (Wisp set!, letrec, a mutable box, a mutable list) can make a cycle, and RC will leak that cycle. Such a feature must refer back by name (as top-level recursion does today), or it must bring its own cycle handling. See What we give up.

1. Inventory

Line numbers are src/compiler/codegen.rs at 9657b59 unless another file is named.

1.1 Two code generators

This design is for generate_wat_pack. The legacy generate_wat path should be retired, not upgraded (see stage 6).

The self-hosted compiler (examples/wisp-compiler.wisp) emits its own runtime (line 2048): heap at 0xC000, (memory (export "memory") 1), and a $__list_push that already doubles capacity but also writes into the list header in place.

1.2 Heap object kinds

type_size (mod.rs:1091) is 4 for every compound type, so a field or element of compound type is always a pointer, never stored inline. There is no alignment padding anywhere.

1.3 Allocation sites

There are two mechanisms:

• Inline bump (global.get $__heap_ptr … global.set $__heap_ptr): no bounds check, no memory.grow, no alignment. Used by string literals, every constructor, list-new, list-push, substring, string-append, string-from-bytes, string-to-bytes, any-s32, any-string, and every CGRF decoder.
• call $__alloc (3391-3443): checks memory.size and calls memory.grow. Used by heap-alloc, raw-invoke, export output buffers, import wrapper buffers, any boundary copies, and primitive-array decode. Because the memory's minimum equals its maximum, the grow can never succeed.

Classes that matter for the design:

1.4 Fixed regions

The host scratch range overlaps the metadata, the encoder stack, and the first 8 heap bytes when a synchronous host return is larger than about 24 KiB. That is a bug today, independent of this design (listed in §8).

2. Can a Granite heap contain a cycle?

2.1 The hypothesis

claude's hypothesis: Granite data is immutable, so each object points only at objects older than itself, so the heap is acyclic, so compile-time RC is complete.

2.2 The evidence: false today, from one source

list-push changes its argument. Codegen loads the header, builds a new data buffer, then stores the new len and data back into the same header (1350-1362) and returns the same pointer (1364). An object built before the push that holds the list can be pushed into it.

Compiled Granite:

(variant node (leaf s32) (branch (list node)))
(fn depth ((n node) (fuel s32)) s32
  (if (i32.eq fuel 0) 0
    (match n
      ((leaf v) 0)
      ((branch kids) (i32.add 1 (depth (list-get kids 0) (i32.sub fuel 1)))))))
(fn main () s32
  (let (xs (list-new node))
    (let (b (branch xs))
      (begin (list-push xs b) (depth b 1000)))))

granite run-module gives 1000: b → xs → b → … is a cycle. granite eval on the same file fails with "list index 0 out of bounds", because eval.rs:410-414 copies the list before it pushes. The two back-ends disagree, so the in-place write is a codegen defect, not a language rule.

A live Wisp session (the Wisp list-push builtin calls the Granite one on the list inside the value, collections.wisp:98-100):

> (variant node (leaf s32) (branch (list node)))
> (define ns (list-new node))
> (list-push ns (branch ns))
#<list node ((branch #<list node ((branch … #<depth-limit> …
> (define ys (list-new (list s32)))
> (list-push ys (list-new s32))
> ys                       ; changed without a redefine
#<list (list s32) (#<list s32 ()>)>

A second Wisp route makes a cycle through a closure: a closure captures its environment list, the environment binds a list, and the closure is pushed into that list. (Found by the inventory pass: (define mk (lambda (gs) (begin (list-push gs (lambda (n) (list-len gs))) gs))).)

2.3 Everything else was checked and is not a source

2.4 Why value-semantics list-push makes the heap acyclic

Rule: a pointer field is written only while its object is new, that is, after allocation and before the object's own address is stored anywhere a later write could reach it from. With value-semantics list-push, every heap write in typed Granite obeys this rule: constructors, decoders, and the in-place fast path of list-push, which runs only when the list is uniquely owned (§3.4) and so is unreachable from anything else.

Proof sketch. Suppose a cycle o1 → o2 → … → ok → o1 exists. Take the edge in it that was written last, say x → y. When it was written, the rest of the cycle already existed, so y could already reach x, so x was reachable from another heap object, so x was not new. That breaks the rule. A self-edge x → x would require storing x's own address into x during construction; codegen never does that.

2.5 Does the code rely on the in-place write?

Mostly no. Every list-push in the tree uses the returned list, threading an accumulator ((list-push out …)). The places that look like they depend on it:

• evaluator.wisp:57-64 copies the environment because push mutates. With value semantics the copy is no longer needed; removing it is a speed-up.
• types.wisp:73 (publish) does (global.set $bindings (list-push (global.get $bindings) …)). It stores the result, so it works with value semantics. To stay O(1) it needs the global-take rule in §3.5.
• modules.wisp:58 stores $bindings in a module record, but only as a snapshot that is restored whole later, so it works with value semantics.
• syntax-rules.wisp:156 (sr-accumulate) pushes onto an existing sequence's list and wraps the result in a new sequence; it works with value semantics.

The user-visible change: in Wisp, (list-push xs v) no longer changes xs. Only the returned list has v. ticket 0012 (nico) has been told.

2.6 The choice

Decision: compile-time RC. Tracing would buy only cycle collection, and after the list-push change Granite has no cycles to collect.

What we give up

• No mutable cells without a cycle plan. A future Wisp set!, letrec, mutable box or mutable list can form a cycle (closure → env → box → closure), and RC will leak it. The rule for such features: refer back by name through a table owned by a root (as top-level recursion does today), or add a cycle collector scoped to that feature. This constraint goes into the language docs with stage 4.
• Wisp lists stop being shared and mutable. Code that used list-push to change a list in place must use the returned value.
• Time spent counting. §6.2 sets a budget for it.
• Raw memory stays manual. heap-alloc blocks get an explicit heap-free.

3. Reference counting

3.1 Object header

Every heap block gets an 8-byte header before the address the program sees, so all existing field offsets stay the same:

p - 8: rc    : i32   reference count (1 at birth)
p - 4: size  : u32   block size in bytes, header included (the allocator's size class)
p    : payload (unchanged layouts from §1.2)

• The size word makes free(p) independent of the type, keeps payloads 8-aligned, lets the allocator check __pack_free(ptr, len), lets string-append grow a unique string into spare room in its block (§3.4), and makes a heap census possible for leak tests (§7).
• Cost: 8 bytes per object. Koka uses the same size.
• Actors are single-threaded, so counts are plain loads and stores, not atomics.

Static objects. String literals move into data segments (stage 0b) at addresses below $__heap_base, as does any other object built at compile time. dup and drop skip any pointer below $__heap_base, and that one comparison also skips null (the interpreter's globals start at 0). Static objects need no header.

;; dup p
(if (i32.ge_u (local.get $p) (global.get $__heap_base))
  (then (i32.store offset=-8 … (i32.add (i32.load offset=-8 …) (i32.const 1)))))
;; drop p : T
(if (i32.ge_u (local.get $p) (global.get $__heap_base))
  (then (if (i32.eqz (rc-- p)) (then (call $__drop_T (local.get $p))))))

(Wasm has no negative offset=; the emitted code subtracts 8 first. This is a sketch.)

3.2 Per-type drop functions

Generics are monomorphized, so each concrete type T gets one $__drop_T, emitted only if used:

• Record, tuple: drop each compound field, then free(p).
• Variant, option, result: br_table on the tag; drop the compound slots of that case; free(p).
• List: for each element (if the element type is compound) drop it; free(data); free(p).
• String, any: free(p).

Deep structures: the drop of the last compound field is a return_call (Granite already emits tail calls), so a long chain (a variant used as a linked list) drops in constant stack. Trees use stack proportional to their depth, the same as building or walking them.

3.3 Inserting dup and drop (Perceus)

Run on the typed AST after type checking and linearity checking, before codegen. It only adds Dup/Drop nodes and a few rewrites; codegen emits them. For each function:

• Every variable of compound type is owned or borrowed.
• An owned variable is consumed exactly once on every path: passed to an owned position (a constructor field, an owned parameter, a return, a global.set), or dropped right after its last use. If it is used owned more than once, dup it before every owned use except the last.
• A borrowed variable is never dropped. Passing it to an owned position needs a dup.
• match on an owned scrutinee: the arm's bindings are duped if used, then the scrutinee is dropped, unless the arm reuses it (§3.4).
• Drops go as early as possible (right after the last use), so a tail call has no pending drop after it and stays a return_call.
• lin/aff bindings are already proven to be used exactly or at most once. They are never duped; an aff binding not used on a path is dropped there.

Borrowed parameters. A parameter is inferred borrowed when the function only reads it: it reads fields, passes it to borrowed parameters, and never stores, returns, or global.sets it. This is a fixpoint over the call graph (Koka does the same). Export parameters are owned (the export wrapper made them). This is what keeps predicates like (string=? name "+"), lookup-local, and list-get free of any counting.

3.4 Reuse: functional updates in place

• list-push xs v with xs owned and rc == 1: write v into the spare capacity and bump len; grow the data buffer by doubling when full. Otherwise copy the header and the data (with spare capacity) and dup the elements. Threaded accumulators ((f … (list-push out x))), which is nearly all the code, are always unique, so they never copy.
• string-append a b with a owned and rc == 1: if the block's size has room, append in place; otherwise allocate 1.5 times the size. This makes left-fold string building O(n) and removes the reason for the divide-and-conquer workaround in the self-hosted compiler (041feea).
• Drop-guided reuse. When a match arm drops a unique scrutinee and then builds an object of the same size, the arm reuses the block instead of free + alloc. Granite variants have one size for all cases, so any case of the same variant qualifies: (match v ((a x) (b (f x)))) reuses v's block for the b. Records and tuples of the same layout qualify the same way.

3.5 Globals

• A global owns its value. (global.set $g e): evaluate e (owned), store it, drop the old value. GlobalSet returns its value today (441-452), so a used result is a dup.
• (global.get $g) is a borrow when the value is only read before the next point that could global.set $g (borrow inference treats it like a borrowed parameter). Otherwise it is a dup.
• The take rule. (global.set $g (list-push (global.get $g) x)) is how the interpreter grows $bindings, $modules, $events and others. If global.get were a dup, rc would be 2 and every push would copy the whole list. Rule: when the list operand of list-push (or the left operand of string-append) is (global.get $g) and the whole expression is the value of (global.set $g …), codegen evaluates the other operand first, then moves the value out of $g (reads it and stores 0), then pushes, then stores the result. This is valid only when the other operand cannot write or read $g. A small effect analysis (which functions transitively touch which globals) decides that; if it fails, the code falls back to dup (correct, but it copies).

3.6 Raw memory and interior pointers

The escape hatches stay, with rules RC can live with:

The interpreter's call sites change with stage 4: reader.wisp:73-77 and primitives.wisp:138-142 build a string in a raw block, copy it, and free the block; marshal.wisp frees its 16 KiB scratch buffer after any-from-addr, or keeps one reusable buffer in a global.

4. The component boundary

The packr host's protocol (~/work/pack/src/runtime/mod.rs:641-740, host.rs:503-566):

1. The host calls __pack_alloc(in_len), writes the CGRF input, and calls the export with out_ptr_ptr = 0x4000, out_len_ptr = 0x4004.
2. After the call it calls __pack_free(in_ptr, in_len).
3. It reads the output and calls __pack_free(out_ptr, out_len).
4. For an async host import, the host gets the result buffer from the guest's __pack_alloc and says so in the status code: the guest owns it and must free it. For a synchronous one, the result is in the host's fixed scratch at 0x4008, and the guest must not free it.

So there is no cabi_realloc and no post-return function in the Pack path; __pack_free plays both roles. The design:

Theater state (option<list<u8>> threaded through init and handlers) is an ordinary argument and result, so the same rules cover it.

Re-entrancy: an async host import re-enters the guest through __pack_alloc in the middle of a call. The allocator is a plain function with no state held across calls, so this is safe; RC state is consistent at every call site.

5. The allocator and memory growth

5.1 Layout

0 … user data segments, host slots, scratch, metadata, encoder stack   (as today, fixed)
… static objects (string literals, compile-time constants)          (new, stage 0b)
$__heap_base: free-list table, then the heap, growing upward

$__heap_base is a compile-time constant computed after placing static data. User (data OFFSET …) segments get an overlap check against the fixed regions at compile time.

5.2 Small blocks (block size ≤ 1 KiB, header included)

• Size classes with at most 25% waste: 16, 24, 32, 40, 48, 56, 64, 80, 96, 112, 128, 160, 192, 224, 256, 320, 384, 448, 512, 640, 768, 896, 1024.
• One singly linked free list per class; the heads live in a table at $__heap_base. Allocation pops the head; free pushes the block. Both are O(1).
• An empty list carves a new block from the frontier (the old bump pointer).
• The class index comes from a 128-entry lookup table indexed by size / 8, so the hot path has no loop.
• Allocation sites with a size known at compile time (all constructors) get the class index as a constant and call $__alloc_class(k) directly.

5.3 Large blocks (> 1 KiB)

List data buffers and long strings. Power-of-two buckets from 2 KiB up, with free lists and no coalescing. Doubling growth of lists and strings asks for these sizes exactly, so the waste is small. If measurements show fragmentation, replace this with TLSF (two-level segregated fit, O(1), with coalescing) without changing any interface.

5.4 Memory growth

• Declare (memory (export "memory") N) with no maximum. N covers the fixed regions, the static data, and a first heap chunk (about 1 MiB).
• When the frontier reaches the end, memory.grow by max(needed, current / 4) pages, so growth is geometric. If the grow fails, trap with a clear message (today: an out-of-bounds trap far from the cause).
• Wasm memory cannot shrink. A peak stays committed; freed blocks are reused. This is acceptable for actors whose live set is stable, and stage 5 measures it.
• So a REPL session's committed memory is set by its largest single evaluation (for example a big require), not by its steady state.

5.5 Debug support (the same code with a flag)

• free fills the block with 0xDD and sets rc to a poison value; dup/drop of a poisoned header traps (use-after-free and double free detection).
• __granite_heap_stats export: live bytes, live objects per size class, frontier, memory pages. Leak tests read it.
• __granite_heap_verify export: walks every object reachable from the globals, counts references, and checks that each rc equals the count it found and that the census has no extra live objects. Exact, because the heap is acyclic and every type is known.

6. Performance

6.1 Today (measured)

Release build, wasmtime 21, this machine. Harness: tests/memory_baseline.rs (run with cargo test --release --test memory_baseline -- --ignored --nocapture). Allocation profiles came from instrumenting every global.set $__heap_ptr in the emitted WAT with a per-site byte counter.

Self-hosted compiler build (gen-1 = the Rust-compiled examples/wisp-compiler.wisp compiling its own 151 KB source into 1.0 MB of WAT):

The fixed 2 GiB memory exists only because of the O(n²) push.

Wisp interpreter (wisp/interpreter/evaluator.wisp, the core of every REPL session; bytes allocated per evaluate call):

Profile of (count 1000): 500 allocations per iteration, and 90.6% of the bytes are string literals rebuilt on every evaluation ("f32" in float-type?, the names in host-builtin?, quotation-prefix?, …). The other 9.4% are variants, lists and strings that are garbage the moment the iteration ends. At 6.1 KB per iteration a session fills its 2 GiB after about 330,000 loop iterations in total, over its whole life.

6.2 Expected after each stage

The budget in stage 5 is a gate: if the self-compile is more than 1.25 times slower than after stage 0, stage 5 does not ship until it is. The numbers come from the same harness, run before and after each stage and recorded in the PR.

Why RC stays cheap here: most of the interpreter's work is predicates and lookups over borrowed data (string=?, lookup-local, list-get), which borrow inference makes free of counting. The rest is accumulator threading, which reuse runs in place. The remaining cost is one compare and an increment or decrement per owned pointer copy.

7. Staged plan

Every stage ships on its own and keeps cargo test --workspace and the theater-repl suite green. "Leak test" means: instantiate the module, run a workload N times after a warm-up, and assert that __granite_heap_stats().live_bytes (and the memory page count) is the same after N and 2N runs. The interpreter leak tests use the actor workloads from §6.1: a Wisp loop, repeated define, a trigger handler called 10,000 times.

The changes go in the Rust compiler (it builds the actor and the self-hosted compiler). The self-hosted compiler's emitted runtime takes the same changes as part of the parity work (docs/changes/SELF-HOSTED-PARITY.md); it is not on any session's path.

Stage 0a: amortized list-push. Use the cap field: grow by doubling, store into spare capacity. Semantics unchanged (still in place). Tests: existing suites; a new test pushes 100,000 elements and checks total allocation is O(n) via __pack_alloc(0) before and after. Ship the 2 GiB → smaller memory change only after stage 1.

Stage 0b: static string literals. Emit each distinct literal once in a data segment below the heap; a literal evaluates to its address. Nothing writes into strings today, so sharing them is safe. Tests: string suites; a test that a literal evaluated in a loop allocates nothing.

Stage 0c: the interpreter's own cheap wins (Wisp side, ticket 0012). marshal.wisp allocates a fresh 16,388-byte buffer for every marshal (marshal.wisp:299, 319), about 16 KB of a host call's 22-33 KB. Keep one buffer in a global and reuse it. The other interpreter-side fixes are in WISP-RETENTION.md: §2.1 ($bindings and $session-macros upsert on redefine, so they are bounded by distinct names) and §2.3 ($events becomes a bounded buffer with a drop counter). They need no compiler change and can land any time. The combined order is stages 0a, 0b, 0c, then 1. Tests: the host-call bytes in memory_baseline drop by about 16 KB per call.

Stage 1: the allocator and growable memory. §5: header, size classes, large buckets, frontier, memory.grow without a maximum, a real __pack_free, stats export, debug poisoning. Nothing in compiled code frees yet except __pack_free. Tests: allocator unit tests (alloc/free patterns, every class, large blocks, growth past the initial memory); an export called 10,000 times keeps flat memory (input and output buffers are now reclaimed by the host's __pack_free); the actor no longer declares 2 GiB.

Stage 2: frees at sites with an obvious owner. No counting yet:

• the import wrapper frees its argument buffer and slots, and frees a guest-owned result buffer after decoding (read the status);
• raw-invoke the same;
• list-push frees the old data buffer when it grows (a header is never copied, so the old buffer has no other owner);
• heap-free added; marshal.wisp frees its scratch buffer.

Tests: a leak test that calls a host import 10,000 times; the Wisp (sessions) or (now) verb in a loop with flat memory.

Stage 3: value-semantics groundwork. Behind a compiler flag, list-push copies when it cannot prove the list is unique (no RC yet, so: copies unless the list operand is a local's last use, a simple syntactic check). Run the whole suite and the interpreter with the flag on to find any code that depends on the in-place write; fix those sites. Performance with the flag on: every push that is not a last use copies the whole list, O(n) per push, so loops over lists held in globals ($bindings, $events) go back to O(n²). The flag is for finding dependencies only. It must stay off by default until stage 4 gives it a uniqueness test. Tests: a new codegen test that (list-push xs v) leaves xs unchanged, matching granite eval (the back-ends agree for the first time).

Stage 4: RC, correct before fast. Headers carry counts; the dup/drop pass (§3.3) with every parameter owned; per-type drop functions; global.set drops the old value; list-push value semantics with the rc == 1 fast path; raw-memory rules (§3.6) with the interpreter call sites updated; __granite_heap_verify in debug builds. Behind a flag until the leak tests pass, then on by default. Tests: run every test with the verifier after each export call (exact counts, no extra live objects); leak tests for a Wisp loop, repeated define, repeated require, 10,000 trigger firings; a use-after-free test suite (debug poisoning traps); the cycle program from §2.2 now returns 1 (no cycle).

As built (ticket 0026, src/compiler/rc.rs):

• Ownership is decided in codegen, not in a separate pass over the AST: gen_expr already knows every expression's type. An expression of a counted type leaves an owned reference; a variable's last use on its path moves it (a backward liveness pass), earlier uses dup it; a binding that dies on a path unused is dropped at the start of that path (after its let or parameter, or at the start of the if branch or match arm), so no drop follows a tail call. Every primitive that reads a counted operand drops it after reading, and dups any child it hands out.
• expand_match_wildcard clones every arm. The pass is keyed by node, so codegen uses the source arms as they are and analyses only the arms a _ expands to, from the live-after set of the match.
• string-addr/any-addr keep their object alive to the end of the innermost enclosing let (or the function body); only that scope loses its tail call. string-from-addr, any-from-addr and any-as-string copy with RC on or off, since the interpreter now frees its raw buffers after the copy.
• The verifier walks from the globals, taking one off each object's count per reference and marking it; then every block from the heap start to the frontier must be free (poisoned), raw (marked at heap-alloc, __pack_alloc and the export output buffer), or reached with a count of exactly 0; a second walk restores the counts. Debug builds run it at the end of every export call.
• Measured (release, tests/memory_baseline.rs): every Wisp evaluation retains 0 bytes; the evaluator ends at 19 pages instead of 1165, the self-compile peaks at 120 pages instead of 1378 at the same time. The interpreter is 2-3.7 times slower: (count 1000) does about 764 dups and 1290 drops per loop iteration, only 24 of which free anything, and no list copies. That is counting on borrowed reads, what borrow inference removes in stage 5.

Stage 5: make it cheap. Borrowed-parameter inference, drop-guided reuse, string-append in place, the global take rule, early drops before tail calls. Remove copy-env/copy-list from the interpreter. Tests: the performance gate in §6.2; the verifier still passes; a test that a threaded list-push accumulator of 100,000 elements does not copy (allocation count).

As built (ticket 0027, src/compiler/rc.rs), in the order measured:

1. Borrowed reads. An operation that only reads its operand (list-len, list-get, a field, the string operations, any-as-*, a match scrutinee) takes no reference when the operand outlives it: a variable used again later and not by a later operand, a field or element of one, a string literal (static: never counted), or a global nothing later can set.
2. Inline dups, calls for drops: inlining drops too made the interpreter 45% larger for no measured gain once literals are not dropped at all.
3. Borrowed parameters (§3.3), a fixpoint over the call graph, with one addition: a parameter that some tail call passes something it would have to drop after the call is owned instead, so loops stay return_call. A parameter matched by an arm that rebuilds the same variant is owned too (Koka does the same), so its block can be reused.
4. Borrowed bindings: a let of a field or element of something that outlives the body, and match bindings of such a scrutinee, hold borrowed references (no dup, no drop). This is what made sessions with many bindings cheap: lookup-local takes no count per entry it scans.
5. The take rule (§3.5), for list-push and for a call passing the global to an owned parameter, with an effect analysis (which globals each function may read or set, transitively).
6. string-append in place when the left string's count is 1 and its block has room; otherwise the new string gets half again the room it needs.
7. Drop-guided reuse for variant matches: an owned scrutinee is specialized on its count; unique, its bindings take the children's references and an arm that directly builds the same variant reuses the block.

Measured (release, min of 30 runs, interpreter RC on vs off): a session with 300 bindings 0.99-1.16x; a fresh session 1.15x on loops, 1.19-1.28x on single short evaluations. Not done: removing copy-env/copy-list, which is only correct once RC is on by default (stage 4 PR B); with RC off those copies are what keep in-place pushes from changing shared environments.

Stage 6: clean up. Remove the inline bump code and the 2 GiB comment; retire generate_wat (the non-Pack REPL path) or port it; mirror the runtime changes in the self-hosted compiler; document the "no mutable cells without a cycle plan" rule in the language docs.

8. Problems found on the way (not fixed here)

• The host scratch buffer (0x4008-0xC008) overlaps the metadata, the encoder stack, and the heap start if a synchronous host return is larger than about 24 KiB.
• string-to-bytes and string-from-bytes (1904-2003) use a [len][bytes] layout that is not the list layout, and string-from-bytes reads bytes from the cap field. Nothing uses them yet.
• A u64 payload in some/ok/err, and a u64 list element, are written with i32.store (upper half lost).
• The export output buffer is a fixed 16 KiB for most types, and the encoder cursor is not checked; the import argument buffer is a fixed 4 or 16 KiB, also unchecked. marshal.wisp uses a fixed 16,388-byte buffer with no bounds check.
• The import wrappers ignore the host's ownership status (4534, 1704). Fixed in stage 2 (#90).
• The recursive CGRF encoder and decoder have TODO arms for records, variants and any (5554, 6094).
• The legacy generate_wat starts the heap at 0, on top of user data segments, and its ABI wrapper allocates 4 bytes for a record parameter and writes all its fields. generate_wat is retired (stage 6).
• granite eval and compiled code disagree on list-push (§2.2). They agree with reference counting on (stage 4).
• The export output buffer overflow is issue #89.

9. As built (stages 0-6)

Measured (release, tests/memory_baseline.rs and a min-of-30 benchmark):

• A Wisp evaluation retains 0 bytes with RC (1.1 KB to 794 KB without). The evaluator ends at 2,304 live bytes in 19 pages (67.6 MB, 1,165 pages without). A private-daemon session of 120 rounds (loops, defines, requires, reloads, messages) holds exactly 80,216 live bytes from round 52 on.
• The self-compile went from 1408 MiB and 0.79 s (before stage 0) to 80 MiB and 0.04 s (after stage 1), and with RC peaks at 187 pages in 0.02 s.
• Interpreter time, RC on vs off: 1.9-3.7x after stage 4; after stage 5 a session with 300 bindings is 0.99-1.16x, a fresh session 1.15x on loops and 1.19-1.28x on single short evaluations; after #95 loops are faster than without RC ((count 1000) 3474 µs against 3964 µs).
• Pushing 20,000 items onto a global: 1.19 GB without the take rule, under 270 KB with it.

Open:

• #89: the export output buffer is a fixed 16 KiB with no bounds check (also the import argument buffers, §8).
• Borrowed returns: a getter such as symbol-name dups the field it returns and its caller drops it; only borrowed returns would remove that pair.
• Drop-guided reuse covers variant matches whose arm builds the same variant directly; options, results and records are not covered.
• The self-hosted compiler has the header and growth but no free lists and no RC (ticket 0029, with a size estimate).
• string-to-bytes/string-from-bytes layouts and u64 payload stores (§8).