P1-06: land typed MIR foundation on master

ROADMAP.md

@@ -430,7 +430,7 @@ publish warnings and no cleanup diagnostic. Both CoreCLR and Native AOT print
 | P1-03 | ✅ Complete | Lower AST to HIR and implement the declared safe-core modules, namespaces, visibility, imports, name resolution, and Cargo package entry point. | P1-02 | `dotnet run --project tools/RustSharp.Conformance -c Release --no-restore -- --profile safe-core-name-resolution`<br>`dotnet run --project tests/RustSharp.Tests/RustSharp.Tests.csproj -c Release --no-restore`<br>`rsc check tests/workspaces/basic/Cargo.toml --profile safe-core-primitives-v1` | The acceptance manifest and executable harness pass 25/25 and 190/190. HIR preserves const-function qualifiers and deterministic declaration/reference bindings. Grouped/glob/self/anonymous imports, restricted visibility, source documentation, bounded file modules, original-file diagnostics and PDB mappings are integrated. `Cargo.toml` is accepted by `check`, `build`/`compile`, `run` and `publish`; package metadata, deterministic local `path` dependencies, source discovery, cycle/limit checks and explicit registry-dependency diagnostics are implemented. Leading `::`, unevaluated attributes, registry packages, Cargo features/lockfiles and macro expansion remain explicit profile boundaries for later milestones. |
 | P1-04 | ✅ Complete | Implement primitive, tuple, array, slice, reference, function, ADT, and never types with inference/coercion rules. | P1-03 | `dotnet run --project tests/RustSharp.Tests/RustSharp.Tests.csproj -c Release --no-restore`<br>`dotnet run --project tools/RustSharp.Conformance -c Release --no-build --no-restore -- --profile safe-core-types-v1 --oracle rustc-1.98` | The monomorphic check-only contract includes primitive numeric types, aggregates, references, function pointers, nongeneric ADTs, aliases, patterns/match, closures, bounded const evaluation, inference and directional coercions. All 265/265 regressions and 96/96 version 2 differential cases across sixteen required categories pass, with zero failures/skips and no cleanup diagnostic. File/Cargo checking is integrated; executable commands reject with RSC0009 before output. Generic/trait, MIR, ownership and executable-lowering gates remain separate. |
 | P1-05 | 🚧 In progress | Implement generic substitution, monomorphization, impl coherence, and the versioned trait-solver subset. | P0-14, P1-04 | `dotnet run --project tests/RustSharp.Tests -c Release --no-build --no-restore` | The first PR adds bounded structural substitution, trait obligations/coherence and deterministic closed-instance planning; see the [generic foundation contract](docs/generic-profile.md). Generic source/HIR integration, body specialization and AOT-reachable emission remain required for the full gate. |
-| P1-06 | ⏳ Planned | Define typed MIR, CFG validation, desugaring, and source mapping. | P1-04 | `dotnet test RustSharp.slnx -c Release --filter Mir` | MIR snapshots are deterministic; invalid edges/types are rejected; diagnostics map back to `.rs` spans. |
+| P1-06 | 🚧 In progress | Define typed MIR, CFG validation, desugaring, and source mapping. | P1-04 | `dotnet run --project tests/RustSharp.Tests -c Release --no-build --no-restore` | The first PR adds immutable typed MIR, bounded CFG/type validation, deterministic snapshots and scalar HIR lowering with source spans; see the [typed MIR contract](docs/typed-mir-profile.md). Aggregate/pattern/closure lowering, ownership integration and backend consumption remain subsequent batches. |
 | P1-07 | ⏳ Planned | Implement move paths, borrow checking, non-lexical lifetimes, reborrowing, and escape analysis for the profile. | P0-13, P1-06 | `dotnet run --project tools/RustSharp.Conformance -- --profile safe-core-borrow` | All declared borrow compile-pass/fail cases match rustc outcome and no rejected construct is silently accepted under CLR rules. |
 | P1-08 | ⏳ Planned | Implement scope cleanup, deterministic `Drop`, unwind/abort profile behavior, and panic boundaries. | P1-06, P1-07 | `dotnet test RustSharp.slnx -c Release --filter DropAndPanic` | Normal/early-return/branch/panic paths run destructors once in specified order on CoreCLR and AOT. |
 | P1-09 | 🚧 In progress | Emit safe-core programs through CLR LIR with Rust# cross-package metadata. | P0-07, P1-05, P1-08 | `rsc build tests/programs/safe-core/Cargo.toml` (future full gate; current primitive commands above) | Primitive multi-function IL/PDB emission is integrated. Generic/ownership lowering, cross-package metadata and separate consumer compilation remain open. |

ROADMAP_zh.md

@@ -355,7 +355,7 @@ AOT 探测器。这些工作流修改需要新的 CI 运行。此配置的 Linux
 | P1-03 | ✅ 已完成 | 将 AST 降低为 HIR，并实现声明的安全核心模块、命名空间、可见性、导入、名称解析和 Cargo 包入口。 | P1-02 | `dotnet run --project tools/RustSharp.Conformance -c Release --no-restore -- --profile safe-core-name-resolution`<br>`dotnet run --project tests/RustSharp.Tests/RustSharp.Tests.csproj -c Release --no-restore`<br>`rsc check tests/workspaces/basic/Cargo.toml --profile safe-core-primitives-v1` | 名称解析清单和可执行测试分别通过 25/25、190/190。HIR 保留 const 函数限定符，并确定性绑定声明和引用。分组/glob/self/匿名导入、受限可见性、源码文档、有界文件模块、原文件诊断和 PDB 映射已接入。`Cargo.toml` 已接入 `check`、`build`/`compile`、`run` 和 `publish`；已实现包元数据、确定性的本地 `path` 依赖、源码发现、循环/限制检查及对注册表依赖的明确诊断。前导 `::`、未求值属性、注册表包、Cargo feature/锁文件和宏展开仍作为后续里程碑的明确配置档边界。 |
 | P1-04 | ✅ 已完成 | 实现原始类型、元组、数组、切片、引用、函数、ADT 和 never 类型，以及推断/强制转换规则。 | P1-03 | `dotnet run --project tests/RustSharp.Tests/RustSharp.Tests.csproj -c Release --no-restore`<br>`dotnet run --project tools/RustSharp.Conformance -c Release --no-build --no-restore -- --profile safe-core-types-v1 --oracle rustc-1.98` | 单态的仅检查类型契约覆盖基础数值类型、聚合、引用、函数指针、非泛型 ADT、别名、模式/match、闭包、有界 const 求值、推断和有方向的强制转换。265/265 项回归及十六个必需类别中的 96/96 项第 2 版差分用例全部通过，失败和跳过均为零，无清理诊断。已接入文件/Cargo 检查；可执行命令在输出前以 RSC0009 拒绝。泛型/trait、MIR、所有权及可执行降低仍属于独立门槛。 |
 | P1-05 | 🚧 进行中 | 实现泛型替换、单态化、impl 一致性和版本化 trait 求解器子集。 | P0-14, P1-04 | `dotnet run --project tests/RustSharp.Tests -c Release --no-build --no-restore` | 首个 PR 增加有界结构替换、trait 约束/一致性和确定性的封闭实例规划；见[泛型基础契约](docs/generic-profile.md)。完整门槛仍要求泛型源码/HIR 接入、主体特化以及 AOT 可达的代码生成。 |
-| P1-06 | ⏳ 计划中 | 定义类型化 MIR、CFG 验证、脱糖和源码映射。 | P1-04 | `dotnet test RustSharp.slnx -c Release --filter Mir` | MIR 快照具有确定性；无效边/类型被拒绝；诊断映射回 `.rs` 范围。 |
+| P1-06 | 🚧 进行中 | 定义类型化 MIR、CFG 验证、脱糖和源码映射。 | P1-04 | `dotnet run --project tests/RustSharp.Tests -c Release --no-build --no-restore` | 首个 PR 增加不可变类型化 MIR、有界 CFG/类型验证、确定性快照以及带源码范围的标量 HIR 降低；见[类型化 MIR 契约](docs/typed-mir-profile.md)。聚合/模式/闭包降低、所有权接入和后端消费保留为后续批次。 |
 | P1-07 | ⏳ 计划中 | 为该配置档实现移动路径、借用检查、非词法生命周期、再借用和逃逸分析。 | P0-13, P1-06 | `dotnet run --project tools/RustSharp.Conformance -- --profile safe-core-borrow` | 所有已声明的借用编译通过/失败用例都与 rustc 结果匹配，且不会在 CLR 规则下静默接受被拒绝的构造。 |
 | P1-08 | ⏳ 计划中 | 实现作用域清理、确定性 `Drop`、展开/中止配置档行为和 panic 边界。 | P1-06, P1-07 | `dotnet test RustSharp.slnx -c Release --filter DropAndPanic` | 正常/提前返回/分支/panic 路径在 CoreCLR 和 AOT 上按指定顺序恰好运行一次析构函数。 |
 | P1-09 | 🚧 进行中 | 通过 CLR LIR 发出带有 Rust# 跨包元数据的安全核心程序。 | P0-07, P1-05, P1-08 | `rsc build tests/programs/safe-core/Cargo.toml`（未来完整门槛；当前基础类型命令见上文） | 基础类型多函数 IL/PDB 发射已接入。泛型/所有权降低、跨包元数据和独立消费者编译仍未完成。 |

docs/typed-mir-profile.md

@@ -0,0 +1,116 @@
+# Typed MIR: first P1-06 pull request
+
+Status: 🚧 In progress. The opt-in `safe-core-mir-v1` API establishes the scalar
+HIR-to-MIR boundary. P1-06 remains open for aggregate, reference, closure, match,
+const, move, and drop lowering and for later ownership and backend integration.
+
+This profile consumes successful `SafeCoreTypeAnalysisProgram` evidence from
+P1-04. It does not change the existing primitive executable profile, the CLI,
+or the IL emitter, and it does not make type-only programs executable.
+
+## Supported source subset
+
+Functions have unit, bool, char, integer, or floating-point parameters and return
+values. A function may also return never (`!`). Scalar aliases, modules, and
+resolved imports keep their existing HIR meaning. Calls resolve directly to a
+function item in the same HIR document, including forward and recursive calls.
+Function IDs follow declaration order; the function name is the type checker's
+canonical item identity, including the `#value` namespace discriminator.
+
+Bodies support initialized identifier/wildcard bindings, shadowing, scalar local
+assignment and compound assignment, unary numeric/boolean operators, binary
+arithmetic/bitwise/comparison operators, scalar casts, blocks, return, `if` and
+`else`, `loop`, `while`, unlabeled `break` and `continue`, loop values,
+and short-circuit `&&`/`||`. Every local read is captured before evaluation of
+subsequent operands, so `x + { x = 2; x }` and multi-argument calls preserve source
+evaluation order. Compound assignment evaluates its right operand before reading
+the destination scalar place.
+
+Aggregates, references, function-pointer values/indirect calls, closures,
+`match`, destructuring, `let-else`, const items, and inline const blocks produce
+`RSM2002` at the unsupported construct. Unreachable source tails after an
+unconditional transfer are omitted after P1-04 has checked their types; they are
+not represented as executable MIR or independently checked against this subset.
+No unsupported construct is translated into a dummy value.
+
+Loop/control-flow labels remain outside the upstream P1-04 HIR gate and receive
+`RSN1007` before MIR lowering. Internal loop contexts retain label information,
+but this first source profile makes no labeled-control-flow support claim.
+
+## Representation and invariants
+
+`SafeCoreMirProgram` owns functions. A function owns typed locals and basic
+blocks. Function, local, and block IDs are their stable collection indices.
+Parameters precede other locals; user names and mutability are preserved and
+temporary names are deterministic `tmpN` values. Constants store invariant
+decimal integers, round-trip float text, bool words, decimal Unicode scalars for
+char, or `()` for unit. Signed minimum literals, including grouped operands, are
+represented as one negative constant instead of an out-of-range positive value.
+
+Statements assign an explicit typed rvalue to a local slot. Every block has
+exactly one terminator: return, goto, boolean branch, direct call, or unreachable.
+Calls have explicit result destinations and continuations. A diverging call has
+no result and an unreachable continuation. Branch and loop results are assigned
+on their incoming paths to a shared temporary. Short-circuit operators branch
+before entering the right operand's block. Empty unreachable join blocks have
+an explicit unreachable terminator.
+
+Each element carries `SafeCoreMirSource`: original source path, span, HIR node
+ID, and HIR document extent (`Hir.Root.Span.End`). The extent can exclude trailing
+trivia; it is not claimed to be the original text buffer length. Introduced
+temporaries and control-flow blocks refer to the HIR expression that caused
+their creation.
+
+`SafeCoreMirValidation.Validate` checks IDs, targets, source bounds, operand and
+rvalue types, supported operations, function/call signatures, and return types.
+It checks unreachable blocks too and reports reachable block IDs separately.
+Its structural validation does not prove ownership, definite initialization,
+termination, panic behavior, or executable backend correctness. Those properties
+must not be inferred from a successful result.
+
+## Opt-in API
+
+```csharp
+SafeCoreTypeAnalysisResult types = SafeCoreTypeAnalysis.Check(hir,
+    cancellationToken: cancellationToken);
+if (!types.IsSuccessful)
+    return;
+
+SafeCoreMirLoweringResult lowered = SafeCoreMirLowering.Lower(types.Program!,
+    new SafeCoreMirLoweringOptions { Timeout = TimeSpan.FromSeconds(10) },
+    cancellationToken);
+if (lowered.IsSuccessful)
+{
+    // Every published program includes successful structural validation evidence.
+    string text = SafeCoreMirFormatting.Format(lowered.Program!);
+}
+```
+
+`Lower` returns no partial program when lowering or validation fails. Stable
+lowering diagnostics distinguish incomplete input evidence (`RSM2001`),
+unsupported syntax (`RSM2002`), and exceeded bounds (`RSM2003`). Validation errors
+retain their `RSM000x`/`RSM100x` codes and are also available in `Validation`.
+Caller cancellation throws `OperationCanceledException`; invalid option values
+throw `ArgumentOutOfRangeException`.
+
+The default lowering budget is ten seconds and one million operations, shared
+with final validation. Independent size caps cover functions, per-function
+blocks and locals, and nesting. MIR collection construction, validation, and
+formatting also impose bounded size/time limits and accept cancellation. A
+small configured limit rejects deterministically instead of publishing an
+incomplete graph.
+
+## Verification
+
+`SafeCoreMirLoweringTests` parses real sources through HIR and P1-04 type analysis.
+It checks deterministic typed snapshots, constants and HIR provenance, exact
+unsupported spans, and work/depth/size/time/cancellation failures. A small,
+independent test interpreter runs scalar control-flow graphs with a maximum of
+4,096 total steps, 32 call levels, a five-second deadline, and cancellation. It
+checks evaluation order, shadowing, direct calls, nested loops, branch joins,
+early returns, and short-circuit behavior.
+
+`SafeCoreMirValidationTests` exercises constructed malformed MIR independently
+of source lowering. Both test classes run with the repository test harness.
+This first pull request provides no runtime or rustc differential conformance
+claim for the new MIR representation.