Inspecting frozen ZLM2 wire layouts

Evidence correction: historical kill counts from the native Core-1 mutation runner before 9a63b70ff4 are withdrawn pending fresh replay. Stale binaries could produce false kills. This qualifies all such counts below; see docs/mutation-evidence.md. Test inventories are not execution evidence.

zlc zlm2-schema prints a read-only zerglang.zlm2.wire-schema/1 JSON descriptor for the outer envelope of ZLM2 2.13–2.20. It defaults to 2.20; the selected minor is explicit in the result. This command describes a format, not a supplied artifact, and does not compile, admit, execute or promote code.

Explicit --minor=21 additionally describes the separately versioned Dynamic matching extension, paired with ZLA2 1.13. It is generated from spec/extensions/core1-dynamic-match.json, which pins the unchanged frozen registry; check it with python -m tools.zlm2_dynamic_layout --check.

build/zlc zlm2-schema
build/zlc zlm2-schema --minor=13
build/zlc zlm2-schema --minor=20 --diagnostics=json
python tools/zlm2_layout.py --check

The descriptor is built into the compiler. An installed executable does not need a source checkout, Python, a registry file or a tool capability to print it. Unknown, repeated or malformed options, noncanonical minor spellings, unsupported minors, source paths and output-file options reject with ZL-OPTIONS-0001 and exit status 1. --diagnostics=json selects structured failure output; successful output is always JSON on stdout.

The public C function zl_zlm2_wire_schema_v2 in zerglang/core1.h returns the same length-framed JSON in a caller-owned zl_buffer. Its bytes do not promise a trailing NUL. Release the buffer with zl_buffer_destroy. Separate responses do not alias. A missing output buffer or unsupported minor rejects; a supplied output is cleared on failure. The diagnostic argument is optional. Allocation failure is ZL_STATUS_OUT_OF_MEMORY.

zl_zlm2_wire_schema_v3 extends the same owned-buffer contract to minor 21 and returns byte-identical v2 descriptors for minors 13–20. The v2 API’s accepted minor range is unchanged.

The additive zl_zlm2_wire_schema_v4 through v7 APIs cover the compute, numeric-policy, State graph and topic extensions through minor 25. Schema 2.26 adds source Flow compensation, described by zl_zlm2_wire_schema_v8 and --minor=26. It uses ZLA2 1.18, semantic kind 34, and 72-byte FlowIR rows; its first 40 row bytes and all other outer record layouts are unchanged. Older APIs keep their ranges and descriptor bytes.

Schema 2.27 adds owned source checkpoints, described by zl_zlm2_wire_schema_v9 and --minor=27. It uses ZLA2 1.19, semantic kind 35 and the same 72-byte FlowIR rows, including when compensation is absent. Snapshot IDs and schemas are canonical carrier metadata. The v9 API returns byte-identical v8 descriptors for minors 13–26; older APIs keep their ranges.

Schema 2.28 adds ordered finite Optimize sets, described by zl_zlm2_wire_schema_v10 and --minor=28. Its ZLA2 1.20 payload retains the ordered literal carrier. Optimize rows grow from 32 to 1064 bytes with an explicit set kind/count and 256 bounded Int32 slots. Empty sets remain distinct from host-supplied spaces. The v10 API preserves earlier descriptors; v9 and older APIs keep their closed ranges.

Schema 2.29 adds the bounded two-factor product profile, described by zl_zlm2_wire_schema_v11 and --minor=29. Its ZLA2 1.21 payload admits ordered product carriers. Optimize rows grow to 3152 bytes, preserving the prior 1064 bytes and adding a product tag, dimension count and two bounded factor records. Earlier spaces have zero product tails. Prior descriptors and the CLI default remain unchanged; v10 still rejects minor 29.

Schema 2.30 adds bounded tagged scalar sums, described by zl_zlm2_wire_schema_v12 and --minor=30. Its ZLA2 1.22 payload admits sum carriers. Physical records remain unchanged from 2.29; the legacy product_kind field adds value 2 for a disjoint sum, with the two factor slots retaining its ordered branches. Earlier minor decoders reject that tag. The v12 API returns byte-identical v11 descriptors for minors 13–29; v11 remains closed to minor 30. The CLI default, frozen edition registry and prior descriptors are unchanged.

Schema 2.31 adds checked proposal order, described by zl_zlm2_wire_schema_v13 and --minor=31. Its ZLA2 1.23 payload admits the optional proposal suffix on existing finite-space carriers. Optimize rows grow from 3152 to 4184 bytes: presence, count and 256 little-endian ordinal slots. Non-proposal rows require a zero tail. Earlier API ranges and descriptor bytes remain unchanged, and v12 still rejects minor 31. The checked decoder compares proposal metadata with the canonical carrier and binds it into body identity, independently of the outer checksum.

Schema 2.32 adds scalar Decision<T> locals inside compiled Optimize bodies, described by zl_zlm2_wire_schema_v14 and --minor=32. ZLA2 1.24 admits the distinct Decision local type and unary capture/readout instructions. Physical record sizes remain unchanged. Decoder admission repeats exact-type and confinement checks and reconstructs scalar regions from the checked tree. v13 still rejects minor 32, and all earlier descriptors remain byte-identical. This scalar allocation does not yet admit nominal Decision readouts or promote the decision-nonescape fixture.

Schema 2.33 adds named finite enum and record spaces, described by zl_zlm2_wire_schema_v15 and --minor=33. The ZLA2 1.25 payload retains exact nominal signal arguments and adds lossless scalar projection opcode 45. Optimize rows grow to 4192 bytes, appending nominal kind and descriptor reference; the descriptor identity binds declaration order and exact field types. Decoding reconstructs the typed space and executable scalar graphs. v14 remains closed through minor 32, and prior descriptors are byte-identical. See named finite spaces for the bounded source profile.

What the descriptor covers

Records specify packed little-endian widths, offsets, field types, reserved zeros, fixed values and relevant tag vocabularies. Sections specify wire order, record binding, count relationships and variable tails:

1. Header and embedded structural payload.
2. Typed messages and retained semantic nodes.
3. Compute, durable Flow, Optimize and scalar-region rows.
4. Operand header and edges, when present.
5. Length-framed callable origins and the final SHA-256 digest.

The 24-byte header, 96-byte messages, 32-byte semantic nodes and the dedicated 20/40/32/32-byte region rows are described independently. Empty regions are not promises of an executable domain body. Region starts are relative to the corresponding table; region counts and definition flags determine its length. The message’s contract-facts digest is not the public contract identity. Effects and required-capability masks record requirements, not live authority.

Minor 2.13 has no operand table. Minor 2.14 introduces operand framing and Flow predecessor inputs. Minor 2.15 admits source-owned Optimize ranges. Earlier reserved fields remain explicitly zero in their selected projection. Minors 2.16–2.20 pair with ZLA2 inner layouts 1.8–1.12 respectively. Earlier canonical writers use ZLM1 inner layouts 1.2–1.8. The payload list identifies canonical writer output, not all historical inputs accepted by an inner decoder.

Tag vocabularies describe allocated outer values. They do not admit every operation in every payload, preview or minor. Semantic-node operation is kind-dependent, not a single interchangeable opcode space. The existing checked decoder remains responsible for semantic, type, graph, preview, capability, reserved-field and digest validation.

Checked source and remaining scope

Retained checked-AST output

build --emit=checked-ast projects the existing zerglang.checked-ast/4 representation from checked Core-1 source or a decoded ZLM2 artifact:

build/zlc build --edition=core-1 --preview=optimize --emit=checked-ast --output=tree.json source.zl
build/zlc build --emit=checked-ast --output=decoded.json module.zlm
build/zlc package-source-build --edition=core-1 --preview=optimize --entry=app.main --source=app/main.zl app/main.zl --emit=checked-ast --output=linked.json

The normal interface/4 sidecar is emitted alongside the JSON. For a package, the selected root includes its linked callable closure, with relocated targets and retained domain-specific operations. The compiler uses zl_module_emit_checked_ast_json_v2, not a second source parser or a dump of lowered machine instructions. Source locations and trivia are absent; ordered operands and logical short-circuit distinctions are retained.

This is inspection, not execution or authority: it needs no live Device, Store, FlowEngine or Optimizer capability. Artifact admission still happens before projection. Core-0 input rejects with ZL-AST-0001; malformed ZLM2 rejects before producing JSON or its interface. The mode applies only to build commands, does not accept an entry selector or execution tier, and cannot be combined with another output format. Existing default checked-artifact output and reflection modes are unchanged. cli.checked_ast_output and its property suite check source/artifact/package agreement against actual wire records, operand order, domain facts, and identity-preserving trivia.

Layout registry and conformance scope

The declarative source is spec/editions/core-1/zlm2-wire-layout.json, with registry identity zerglang.zlm2.wire-layout/1. tools/zlm2_layout.py rejects duplicate keys, open shapes, out-of-bounds values, invalid field partitions, unknown references and noncanonical section bindings. It deterministically generates src/zlm2_layout.inc; --check fails on drift. Change the source registry, then regenerate without --check; do not hand-edit the generated file.

This is not a complete description of embedded ZLM1/ZLA2 function, instruction, type, ownership or descriptor layouts. It also does not replace interface/4, semantic/4, checked-AST/4, cross-region identity proofs or promotion evidence. The companion structural payload reference describes those inner records and historical normalization separately. ZER5-30 tracks the remaining cross-region conformance and promotion work. No ZLM1, ZLM2, ZLM3, frozen benchmark, preview-activation or runtime/ZDE-state semantics change through inspection.

frontend.zlm2_schema, cli.zlm2_schema and core1.zlm2_layout cover owned API buffers, strict options, installed-binary independence and generated drift. An independent descriptor consumer walks real compiled scalar, imported-domain and borrowed-value artifacts, including origins and digests. Legacy 2.13 and current scalar/borrow layouts re-encode byte-for-byte; positive and negative registry cases are supplemented by key-order, invalid-offset and real-artifact properties. Behavior-mapped mutations check the API, CLI and generator. These are development checks, not automatic benchmark-support promotion.

Mixed-domain admission evidence

runtime.core1_region_admission supplies one all-five-domain closure to an external consumer built only against installed public C headers. It compares source and decoded contract/body/implementation identities for every public message, including the historical semantic_id alias. The same checks run on every accepted outer minor, 2.13–2.20. Matching typed scalar boundaries execute their checked regions with both reference and materialized evaluators; matching Compute execution uses a live reference Device and includes zero-extent tensors. Generic Algorithm entry and sibling-domain APIs reject mismatched entries. An empty Compute region never becomes a scalar fallback. These scalar seams do not stand in for Store commits, durable Flow runs or Optimizer evidence reports.

The CLI matrix recomputes digests after violating message counts, closed tags, region ownership/outputs/inputs, dedicated rows, semantic kinds, operand order and references, or origin framing. Rejection must precede checked-artifact, checked-AST and reflection output, including their interface sidecars. Property tests vary layouts and scalar bodies, check exact encoding and trivia invariance, and distinguish preserved contracts from changed behavior and implementation. Behavior-mapped mutations exercise domain admission and canonical outer records. An all-five-domain imported closure checks input-order/trivia invariance, source/decoded projections and relocated target identities. Changing only a dependency origin, Flow activity selector, Optimize hard gate or preference selector leaves the root contract unchanged but changes the affected body’s identity and its implementation identity.

This evidence does not promote the frozen ZL256 software tasks, change the ZL512 baseline import, allocate target/device/solver lineage to ZLM2, or activate a stable edition. Adaptive lineage, execution-target provenance and versioned corpus publication remain separately tracked by ZER5-30 and its downstream work.