Guarantee distinct Box.box allocations per runtime evaluation (fixes #10171)

[lukewilliamboswell]

Fixes #10171.

Implements Position B from the issue discussion: Box is a heap cell whose address is its identity — each runtime evaluation of Box.box whose result escapes yields a distinct allocation. Roc is strict, so evaluation count is operationally defined and the guarantee is crisp. This lands the guarantee as a durable axiom rather than a spot fix.

Root cause

The checker's hoisted-roots mechanism compile-time-evaluates closed, pure, effect-free expressions in function bodies and rematerializes them as shared static data. Box.box results passed every gate, so a zero-arg helper fresh = || Box.box(0) compiled to "return one static box" — every runtime call, across all specializations and all backends (dev/LLVM/interpreter), returned one allocation. Hosts receive a box's payload pointer as the value's representation and refcount it (roc-signals keys graph tokens on it), so allocation identity is observable at the host ABI. Full mechanism trace with permalinks: #10171 (comment)

Design — four layers, one per commit

1. Checker keep-gate (primary). varMayContainBoxAllocation in Check.zig, consulted by hoistedRootIsIntrinsicallyKept (the single prune choke point every kept root passes). A root whose settled value type may contain a Box stays runtime code. The walk pierces opaque nominal backings (wrapping a box in an opaque type does not hide its identity — the roc-signals Node.Token shape) and treats function types as conservatively box-bearing, because stored function constants carry capture values that types cannot see. Boxes remain hoistable as compile-time intermediates when the stored result is box-free; top-level bindings are untouched (one binding = one value; its single shared static allocation is the declared semantics).
2. Finalization backstop. finishConstRoot walks the stored value tree (constNodeContainsBox, including closure captures) before upgrading a hoisted template to stored_const. Debug builds panic — the test corpus is the tripwire proving the checker gate is total. Release builds skip the upgrade for expr-shaped roots (falls back to the existing .eval_template per-use inline re-evaluation, which preserves freshness); binding-shaped roots keep the stored const because per-read re-evaluation would break local binding sharing.
3. The written axiom. LowLevel.resultIdentityObservable (true for box_box, box_alloc_zeroed, box_prepare_update) documents the rule for any future CSE/GVN or transparent-allocation lowering; no merging pass exists today. box_reuse.zig documents why its dead-box recycling is legal under the axiom. Dead selection_algorithm_version removed.
4. Docs. Box.box's builtin doc states the guarantee; glue/README.md states the host-ABI contract (live RocBox addresses are stable identities; Str/List addresses carry no such guarantee).

Behavior after this PR

Shape	Allocation identity
fresh() called twice (any context, incl. generic methods, across specializations)	distinct
Inline Box.box(0) per call site execution	distinct
Box captured by a closure behind an opaque nominal, two instances	distinct
Two textually identical top-level bindings	distinct
One top-level binding referenced twice	same (one binding is one value; static, refcount-pinned)

Verification

• Issue repro and all variants wired into test/fx with a new same_box_u64! hosted function; specs assert the table above on both --opt=interpreter and --opt=dev.
• Tripwire verified by temporarily disabling the checker gate: Debug panic fires in both the test harness and a real roc build; with the panic also disabled, the Release fallback alone restores distinct allocations. (Both temporary edits reverted; this is recorded here in lieu of an un-writable test for an intentionally unreachable branch.)
• Full gate tally: run-test-zig 3532/3532 · lir-inline 119/119 · run-test-cli 692 run / 0 failed (238 platform specs) · run-test-eval 1588/1588 (interpreter/dev/wasm) · snapshots zero diffs · fx coverage and Builtin format checks green.

Notes for reviewers

• Harness finding: the eval test harness never published hoisted compile-time roots (the publication option silently defaulted to empty, unlike the production drivers) — which is why this bug class was invisible to the entire eval suite. It is now an explicit HoistedRootPublication choice in test_helpers.zig: .omit default preserves the 13 lir-inline structural tests whose deliberately-closed programs would fold away entirely under faithful publication; .publish opts in and is used by a new integration test asserting no published hoisted template stores a box. Flipping the default (and rewriting those 13 closed programs to take runtime inputs) is a candidate follow-up.
• Known minor conservatism: a zero-arg function whose direct body block contains an internal box binding loses hoisting via the dependency cascade even when its result is box-free (the internal binding's root is pruned; the body root's dependency check follows it). The binding-RHS variant stays hoisted and is test-pinned. Safe direction — strictly less compile-time folding, never wrong values.
• The CGlue golden header (test/glue/fx_platform_cglue_expected.h) is regenerated because the fx platform gained the same_box_u64! hosted function.
• Even with this fix, pure fresh() calls are only protected from this compiler's merging by the layered guards plus the written axiom; the durable design guidance for identity tokens (documented in the issue thread) remains an effectful constructor or host-minted handles if the language ever wants to relax the axiom.

🤖 Generated with Claude Code

[lukewilliamboswell]

Richard suggested an alternative approach so this change is likely no longer required.