Module owned 

OwnedCore — the one canonical Core-ownership keystone (D246 rule 4).

The actor-model Core is move-only and single-owner (D221/D223). Every embedder — the napi/pyo3/wasm bindings, every test harness, an application embedding GraphReFly — needs the same three things:

1. own the relocatable Core by value,
2. track the subscriptions it opens, and
3. tear them down on the owner thread when it goes away.

Before D246 this keystone was triplicated as TestRuntime / StructuresRuntime / the operators harness runtime (plus the napi CURRENT_CORE hack). OwnedCore is the single abstraction they all compose. RAII teardown lives here, at the embedder boundary — never below it (D246 rule 3: subscribe → id + core.unsubscribe; no parameterless Drop reaching Core anywhere in the substrate). The Drop here is sound because OwnedCore owns the Core by value: it is on the dropping thread’s stack, alive, no relocation (this is exactly the D225 owner-invoked-synchronous-unsubscribe shape, not the retired core RAII).

Producer build/teardown (D231/D245) is just “the owner calls owned.core() synchronously” — OwnedCore is the canonical producer-build site; no per-binding “how do I reach Core” remains.

D246/S2c: single-owner ⇒ the sub-tracking vecs are plain RefCell (the prior Mutex was shared-Core-era legacy — an OwnedCore is touched by exactly one thread, the one that owns the Core). A re-entrant double-borrow on the cold teardown path panics loudly rather than corrupting state.

Structs

OwnedCore

Owns a Core, tracks the subscriptions opened through it, and tears them down on the owner thread in Drop. Construct with OwnedCore::new (fresh Core) or OwnedCore::with_core (adopt a Core the caller already built).