swiftui_native/

state.rs

//! A Swift view type synthesised at runtime, with real `@State` storage.
//!
//! Everything else in this crate hands SwiftUI an `AnyView`, which erases the
//! identity SwiftUI needs in order to see a *change* rather than a replacement.
//! That is why an external mutation never animated, why `withAnimation` had
//! nothing to interpolate, and why redisplay had to be driven by polling.
//!
//! This module removes that constraint by building an actual Swift struct at
//! runtime:
//!
//! ```text
//!   struct RustView: View {
//!       @State var value: Int
//!       var body: some View { <built by a Rust closure> }
//!   }
//! ```
//!
//! which means synthesising, by hand:
//!
//! * a nominal type descriptor with one field;
//! * **reflection field metadata** — a field descriptor naming the field and its
//!   type as `SwiftUI.State<Swift.Int>`. This is the part that matters: SwiftUI
//!   discovers `DynamicProperty` storage by walking a type's reflection records,
//!   so without it `@State` is simply never initialised;
//! * struct metadata carrying a field offset vector;
//! * a `View` conformance with all seven witnesses, three of which are the
//!   underscored statics that point at SwiftUI's own protocol-extension defaults;
//! * a registered protocol conformance record, so the runtime can find it.
//!
//! The struct has exactly one stored property, so its layout is identical to
//! `State<Int>` — which lets it borrow that type's value witness table instead
//! of needing one synthesised too.
//!
//! This works: SwiftUI installs the `@State` property, evaluates the body, and
//! re-renders when the value changes — dependency tracking, not polling.
//!
//! # Two things that were not obvious
//!
//! **A value witness table cannot be borrowed.** The first attempt reused
//! `State<Int>`'s, reasoning that a single-field struct is layout-identical to
//! its field — which the sizes confirm. But Swift *shares* one value witness
//! table between layout-compatible types, so `State<Int>`'s witnesses are
//! literally `SwiftUI._AnimationView`'s outlined functions. They are written for
//! that type and fault on any other. `value_witness_table` synthesises a
//! correct one instead.
//!
//! **Property accessors take the struct's own metadata.** `State<Value>`'s
//! `wrappedValue` getter wants `State<Int>.Type`, not `Int.Type`. Passing the
//! generic argument instead compiles, runs, and faults inside
//! `State.getValue(forReading:)`.
//!
//! Compare [`crate::views::timeline`], which also lets Rust state drive the
//! interface but re-renders every frame regardless of whether anything changed.

use crate::abi;
use crate::resolve;
use crate::views::ViewHandle;
use core::ffi::c_void;
use crate::mangle;

/// The Rust closure that produces the body, given the current state value.
// The registry is shared, and SwiftUI calls the body from the main thread,
// so the builder has to be `Send`.
type BodyBuilder = Box<dyn Fn(i64) -> ViewHandle + Send>;

/// One entry per synthesised view instance.
struct Instance {
    builder: BodyBuilder,
    /// The live `Binding<Int>` projected out of SwiftUI's own storage, captured
    /// the first time the body runs. Writing through it is what invalidates.
    binding: Option<Vec<u8>>,
}

/// Every live instance, keyed by the id carried in the view's second field.
///
/// The body witness is one `extern "C"` function shared by every instance, so
/// it needs some way to tell them apart. Giving the struct a second stored
/// property — a plain `Int` — and looking the instance up by it is what allows
/// more than one of these to exist at a time.
static INSTANCES: std::sync::Mutex<Option<std::collections::HashMap<i64, Instance>>> =
    std::sync::Mutex::new(None);
static NEXT_ID: std::sync::atomic::AtomicI64 = std::sync::atomic::AtomicI64::new(1);

fn with_instances<R>(f: impl FnOnce(&mut std::collections::HashMap<i64, Instance>) -> R) -> R {
    let mut guard = INSTANCES.lock().expect("instance registry poisoned");
    f(guard.get_or_insert_with(std::collections::HashMap::new))
}

// `View.body`'s witness receives the indirect result in x8 and `self` in x20.
core::arch::global_asm!(
    ".p2align 2",
    ".globl _rswift_view_body_thunk",
    "_rswift_view_body_thunk:",
    "mov x1, x20",
    "mov x0, x8",
    "b _rswift_view_body_getter",
);

unsafe extern "C" {
    #[link_name = "rswift_view_body_thunk"]
    fn view_body_thunk();
}

/// `body` — read the state SwiftUI is holding, then build the tree from Rust.
#[unsafe(no_mangle)]
unsafe extern "C" fn rswift_view_body_getter(out: *mut u8, this: *const u8) {
    unsafe {
        // Field 0 is the `State<Int>`; field 1 is the instance id.
        let id = *(this.add(ID_OFFSET) as *const i64);

        // The location box is live by the time SwiftUI evaluates the body. If it
        // is not, the reflection metadata failed and reading would fault.
        let value = if *(this.add(8) as *const u64) == 0 {
            0
        } else {
            state_wrapped_value(this)
        };

        // Capture the projected Binding once; it is only obtainable from inside
        // a body evaluation, because SwiftUI owns the storage.
        let binding = state_projected_binding(this);
        let view = with_instances(|map| {
            let inst = map.get_mut(&id)?;
            if inst.binding.is_none() {
                inst.binding = Some(binding);
            }
            Some((inst.builder)(value))
        });

        let view = view.unwrap_or_else(crate::views::empty_view);
        *(out as *mut u64) = view.into_anyview_word();
    }
}

/// `State<Int>.wrappedValue` getter.
unsafe fn state_wrapped_value(state: *const u8) -> i64 {
    let mut out: i64 = 0;
    unsafe {
        core::arch::asm!("blr {f}", f = in(reg) resolve::state_wrapped_get(),
            in("x8") &mut out as *mut i64,
            in("x20") state,
            // Property accessors on a generic struct take the *struct's* own
            // metadata, not the generic argument's.
            in("x0") abi::generic_metadata1(resolve::state_ma(), resolve::int_meta()),
            lateout("x1") _, lateout("x2") _, lateout("x3") _, lateout("x4") _,
            lateout("x5") _, lateout("x6") _, lateout("x7") _, lateout("x9") _,
            lateout("x10") _, lateout("x11") _, lateout("x12") _, lateout("x13") _,
            lateout("x14") _, lateout("x15") _, lateout("x16") _, lateout("x17") _,
            lateout("lr") _, lateout("x21") _, clobber_abi("C"),
        );
    }
    out
}

/// `State<Int>.projectedValue` getter, giving a `Binding<Int>`.
unsafe fn state_projected_binding(state: *const u8) -> Vec<u8> {
    unsafe {
        let meta = abi::resolve_type_by_mangled_name(mangle::bound("7SwiftUI7BindingV", &[mangle::INT]).as_bytes());
        assert!(!meta.is_null(), "Binding<Int> metadata");
        let mut out = vec![0u8; abi::type_bytes(meta)];
        core::arch::asm!("blr {f}", f = in(reg) resolve::state_projected_get(),
            in("x8") out.as_mut_ptr(),
            in("x20") state,
            in("x0") abi::generic_metadata1(resolve::state_ma(), resolve::int_meta()),
            lateout("x1") _, lateout("x2") _, lateout("x3") _, lateout("x4") _,
            lateout("x5") _, lateout("x6") _, lateout("x7") _, lateout("x9") _,
            lateout("x10") _, lateout("x11") _, lateout("x12") _, lateout("x13") _,
            lateout("x14") _, lateout("x15") _, lateout("x16") _, lateout("x17") _,
            lateout("lr") _, lateout("x21") _, clobber_abi("C"),
        );
        out
    }
}

/// Write a new value through the captured `Binding`, which is what makes
/// SwiftUI invalidate and re-run the body.
///
/// Returns false if the body has not run yet, so there is nothing to write to.
pub fn set_state(id: i64, value: i64) -> bool {
    let binding = with_instances(|map| map.get(&id).and_then(|i| i.binding.clone()));
    let Some(mut binding) = binding else { return false };
    unsafe {
        let meta = abi::resolve_type_by_mangled_name(mangle::bound("7SwiftUI7BindingV", &[mangle::INT]).as_bytes());
        let mut v = value;
        core::arch::asm!("blr {f}", f = in(reg) resolve::binding_wrapped_set(),
            in("x0") &mut v as *mut i64,
            in("x1") meta,
            in("x20") binding.as_mut_ptr(),
            lateout("x2") _, lateout("x3") _, lateout("x4") _, lateout("x5") _,
            lateout("x6") _, lateout("x7") _, lateout("x8") _, lateout("x9") _,
            lateout("x10") _, lateout("x11") _, lateout("x12") _, lateout("x13") _,
            lateout("x14") _, lateout("x15") _, lateout("x16") _, lateout("x17") _,
            lateout("lr") _, lateout("x21") _, clobber_abi("C"),
        );
    }
    true
}

/// A runtime-built Swift view type with a real `@State`.
///
/// SwiftUI installs the storage itself: it walks the type's reflection field
/// records looking for a stored property whose type conforms to
/// `DynamicProperty`, finds the `State<Int>`, and attaches a location box. That
/// is what makes [`set`](Self::set) invalidate the view and re-run the body,
/// and what lets [`set_animated`](Self::set_animated) interpolate — a `@State`
/// change is a change to a view SwiftUI already knows, unlike a root swap.
///
/// The catch is how quietly that walk fails. If the field's mangled type name
/// does not demangle, the runtime reports the field as an empty tuple, SwiftUI
/// finds no `DynamicProperty`, and everything still *works* — the body runs
/// once, writes report success — except nothing ever updates. See the layout
/// assertions in `build_type`.
///
/// # Several at once
///
/// The body witness is one `extern "C"` function with no room for an instance
/// parameter, so the struct carries a second stored field holding an id. The
/// witness reads it and looks the right builder up, which is what lets more
/// than one `StatefulView` be live at a time.
pub struct StatefulView {
    /// Metadata for the synthesised struct.
    pub metadata: *const c_void,
    /// Its `View` witness table.
    pub witness_table: *const c_void,
    /// An instance, ready to hand to a hosting view.
    value: Vec<u8>,
    /// Identifies this instance to the shared body witness.
    pub id: i64,
}

impl StatefulView {
    /// Build the type and one instance of it.
    ///
    /// `builder` receives the current state value every time SwiftUI evaluates
    /// the body.
    ///
    /// Hosting the result works: `examples/parity`'s `state_rebuild` check
    /// hosts one, writes to it three times, and asserts the body saw each new
    /// value. An earlier note here said it faulted in a value witness — that was
    /// true of the first attempt, which borrowed `State<Int>`'s witness table;
    /// the module docs explain why that cannot work and what replaced it.
    pub fn new(initial: i64, builder: impl Fn(i64) -> ViewHandle + Send + 'static) -> Self {
        unsafe {
            let id = NEXT_ID.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
            with_instances(|map| {
                map.insert(id, Instance { builder: Box::new(builder), binding: None })
            });
            let (metadata, witness_table) = build_type();
            debug_assert_eq!(
                field_offset(metadata, 1),
                ID_OFFSET,
                "the id moved; the body witness reads it at a fixed offset"
            );

            // The instance is a `State<Int>`, since that is the only field.
            //
            // `State<Int>` is the value inline followed by empty storage — the
            // box is created by SwiftUI when it initialises the property, not by
            // us — so it is built directly rather than through
            // `State.init(wrappedValue:)`.
            let mut value = vec![0u8; instance_bytes(metadata)];
            value[..8].copy_from_slice(&initial.to_le_bytes());
            value[ID_OFFSET..ID_OFFSET + 8].copy_from_slice(&id.to_le_bytes());

            Self { metadata, witness_table, value, id }
        }
    }

    /// Write a new value, re-running the body.
    pub fn set(&self, value: i64) -> bool {
        set_state(self.id, value)
    }

    /// Write a new value inside `withAnimation`, so SwiftUI interpolates.
    pub fn set_animated(&self, value: i64) {
        set_state_animated(self.id, value);
    }

    /// As [`set_animated`](Self::set_animated), with the animation spelled out —
    /// `withAnimation(.easeInOut(duration: 1)) { ... }` and the like.
    pub fn set_animated_with(&self, value: i64, animation: u64) {
        set_state_animated_with(self.id, value, animation);
    }

    /// Wrap the instance in an `AnyView` so it can be hosted like any other view.
    pub fn as_view(&self) -> ViewHandle {
        unsafe { copy_as_view(&self.value, self.metadata, self.witness_table) }
    }
}

// ── Value witnesses ──────────────────────────────────────────────────────
//
// The synthesised struct is one `State<Int>`: an `Int` at offset 0 and an
// optional `AnyLocation<Int>` class reference at offset 8. That is enough to
// write the witnesses directly, which is the only correct option — a value
// witness table cannot be borrowed from another type, because Swift shares
// tables between layout-compatible types and the functions in them are outlined
// for whichever type they were emitted from.

/// Field 1: the instance id, so one shared body witness can tell instances apart.
const ID_OFFSET: usize = 16;


/// Emit the descriptors, reflection metadata, conformance and witness table.
///
/// One allocation holds everything, so every 32-bit self-relative offset is
/// trivially in range./// One stored property of a synthesised struct.
struct FieldSpec {
    /// The field's type, mangled and spelled out rather than given as a
    /// symbolic reference — there is no image for the runtime to resolve a
    /// reference against, and a name that fails to demangle is reported as an
    /// empty tuple rather than as an error.
    mangled_type: &'static [u8],
    name: &'static [u8],
    /// The field type's metadata.
    ///
    /// Offsets are computed from this rather than written out by the caller,
    /// and so are the struct's value witnesses: each one dispatches to *this*
    /// type's own witnesses for its slice of the value. That is what lets a
    /// field be something other than a single refcounted word — an
    /// `Environment<T>` is nine bytes with an enum inside it, and no
    /// hand-written retain/release describes that correctly.
    meta: *const c_void,
}

/// What [`emit_type`] worked out about a synthesised struct, kept so the value
/// witnesses can find it again.
struct TypeLayout {
    /// `(field metadata, byte offset)`, in declaration order. The metadata is
    /// held as a `usize` so the registry is `Send`; these point into the
    /// Swift runtime and outlive everything here.
    fields: Vec<(usize, usize)>,
    size: usize,
}

// The metadata pointer is the key; the witnesses receive it as their last
// argument. Registered after `emit_type` returns, which is safe because nothing
// can copy a value of the type before it exists.
static LAYOUTS: std::sync::Mutex<Option<std::collections::HashMap<usize, TypeLayout>>> =
    std::sync::Mutex::new(None);

fn with_layouts<R>(f: impl FnOnce(&mut std::collections::HashMap<usize, TypeLayout>) -> R) -> R {
    let mut g = LAYOUTS.lock().expect("layout registry poisoned");
    f(g.get_or_insert_with(std::collections::HashMap::new))
}

unsafe fn field_vwt(
    meta: *const c_void,
) -> *const swift_runtime_sys::SwiftABI::ValueWitnessTable {
    unsafe { swift_runtime_sys::SwiftABI::get_value_witness_table(meta) }
}

/// Run `op` for every field of the type `meta` describes.
///
/// Returns false when the layout is unknown, which should not happen and means
/// the caller must not touch the bytes.
unsafe fn for_each_field(
    meta: *const c_void,
    mut op: impl FnMut(*const c_void, usize),
) -> bool {
    let fields = with_layouts(|m| m.get(&(meta as usize)).map(|l| l.fields.clone()));
    match fields {
        Some(fields) => {
            for (fm, off) in fields {
                op(fm as *const c_void, off);
            }
            true
        }
        None => false,
    }
}

/// How many bytes an instance of the synthesised type takes, as laid out.
unsafe fn instance_bytes(meta: *const c_void) -> usize {
    let n = with_layouts(|m| m.get(&(meta as usize)).map_or(0, |l| l.size));
    assert!(n > 0, "no layout registered for this synthesised type");
    n
}

// Each witness walks the fields and calls that field type's own witness on its
// slice. Swift shares one value witness table between layout-compatible types,
// so these functions may well be outlined for some unrelated type — which is
// fine here and was not when the whole struct borrowed one, because each is now
// applied to exactly the type it was written for.

unsafe extern "C" fn fw_destroy(value: *mut u8, meta: *const c_void) {
    unsafe {
        for_each_field(meta, |fm, off| {
            ((*field_vwt(fm)).destroy)(value.add(off) as *mut c_void, fm);
        });
    }
}

unsafe extern "C" fn fw_init_with_copy(
    dest: *mut u8,
    src: *mut u8,
    meta: *const c_void,
) -> *mut u8 {
    unsafe {
        for_each_field(meta, |fm, off| {
            ((*field_vwt(fm)).initialize_with_copy)(
                dest.add(off) as *mut c_void,
                src.add(off) as *mut c_void,
                fm,
            );
        });
    }
    dest
}

unsafe extern "C" fn fw_assign_with_copy(
    dest: *mut u8,
    src: *mut u8,
    meta: *const c_void,
) -> *mut u8 {
    unsafe {
        for_each_field(meta, |fm, off| {
            ((*field_vwt(fm)).assign_with_copy)(
                dest.add(off) as *mut c_void,
                src.add(off) as *mut c_void,
                fm,
            );
        });
    }
    dest
}

unsafe extern "C" fn fw_init_with_take(
    dest: *mut u8,
    src: *mut u8,
    meta: *const c_void,
) -> *mut u8 {
    unsafe {
        for_each_field(meta, |fm, off| {
            ((*field_vwt(fm)).initialize_with_take)(
                dest.add(off) as *mut c_void,
                src.add(off) as *mut c_void,
                fm,
            );
        });
    }
    dest
}

unsafe extern "C" fn fw_assign_with_take(
    dest: *mut u8,
    src: *mut u8,
    meta: *const c_void,
) -> *mut u8 {
    unsafe {
        for_each_field(meta, |fm, off| {
            ((*field_vwt(fm)).assign_with_take)(
                dest.add(off) as *mut c_void,
                src.add(off) as *mut c_void,
                fm,
            );
        });
    }
    dest
}

/// The struct is larger than the three-word inline buffer in every case built
/// here, so a buffer copy is a value copy.
unsafe extern "C" fn fw_init_buffer(dest: *mut u8, src: *mut u8, meta: *const c_void) -> *mut u8 {
    unsafe { fw_init_with_copy(dest, src, meta) }
}

/// No extra inhabitants are advertised, so there is never a spare case to read.
unsafe extern "C" fn fw_get_tag(_v: *const u8, _n: u32, _m: *const c_void) -> u32 {
    0
}

unsafe extern "C" fn fw_store_tag(_v: *mut u8, _w: u32, _n: u32, _m: *const c_void) {}

/// A value witness table for a struct of `size` bytes at `align`, dispatching
/// per field through [`LAYOUTS`].
fn delegating_vwt(size: usize, align: usize) -> *const c_void {
    unsafe {
        let vwt = libc::malloc(96) as *mut u8;
        assert!(!vwt.is_null());
        core::ptr::write_bytes(vwt, 0, 96);
        let f = vwt as *mut *const c_void;
        *f.add(0) = fw_init_buffer as *const c_void;
        *f.add(1) = fw_destroy as *const c_void;
        *f.add(2) = fw_init_with_copy as *const c_void;
        *f.add(3) = fw_assign_with_copy as *const c_void;
        *f.add(4) = fw_init_with_take as *const c_void;
        *f.add(5) = fw_assign_with_take as *const c_void;
        *f.add(6) = fw_get_tag as *const c_void;
        *f.add(7) = fw_store_tag as *const c_void;
        *(vwt.add(64) as *mut usize) = size;
        *(vwt.add(72) as *mut usize) = size;
        // alignment mask | IsNonPOD — a synthesised view always holds storage
        // SwiftUI installed, so it is never plain data.
        *(vwt.add(80) as *mut u32) = 0x0001_0000 | (align as u32 - 1);
        *(vwt.add(84) as *mut u32) = 0; // no extra inhabitants
        vwt as *const c_void
    }
}

/// Hand out a `+1` copy of a synthesised instance, for hosting.
///
/// [`ViewHandle::wrap`] takes ownership of a value the caller has just built,
/// and destroys it when the handle drops. A bitwise copy of a value the owning
/// struct still holds is therefore not a view to hand out: the handle's destroy
/// releases fields that are still in use, and the next read of one faults
/// somewhere else entirely. `@State` hid this for a long time, because SwiftUI
/// installs its box in its *own* copy and ours stays null, so destroying it
/// does nothing; an `@AppStorage` or `@Environment` field holds a real
/// reference from the moment it is built.
///
/// So make a real copy first — through the type's own witnesses, which retain
/// each field — and hand that over. `wrap`'s memcpy of an owned value into its
/// own buffer is then a move, which is what the plain `Vec` being dropped
/// without a destroy amounts to.
unsafe fn copy_as_view(
    value: &[u8],
    metadata: *const c_void,
    witness_table: *const c_void,
) -> ViewHandle {
    unsafe {
        let vwt = &*swift_runtime_sys::SwiftABI::get_value_witness_table(metadata);
        let mut owned = vec![0u8; abi::type_bytes(metadata)];
        (vwt.initialize_with_copy)(
            owned.as_mut_ptr() as *mut c_void,
            value.as_ptr() as *mut c_void,
            metadata,
        );
        ViewHandle::wrap(owned.as_ptr() as *const c_void, metadata, witness_table)
    }
}

/// Release what a synthesised instance holds, when its owner goes away.
unsafe fn destroy_instance(value: &mut [u8], metadata: *const c_void) {
    unsafe {
        let vwt = &*swift_runtime_sys::SwiftABI::get_value_witness_table(metadata);
        if vwt.size > 0 {
            (vwt.destroy)(value.as_mut_ptr() as *mut c_void, metadata);
        }
    }
}

/// The byte offset of field `i`, read back out of the metadata.
///
/// The body witnesses reach the instance id at a fixed offset, because a
/// protocol witness gets `self` and nothing else. This is what lets that
/// constant be checked against the layout rather than assumed.
unsafe fn field_offset(metadata: *const c_void, i: usize) -> usize {
    unsafe { *((metadata as *const u8).add(16 + 4 * i) as *const u32) as usize }
}

/// Emit the descriptors, reflection metadata, conformance and witness table for
/// a struct with `fields`, and register the conformance.
///
/// Both synthesised types come through here. They differ only in their fields,
/// their value witnesses and which `body` they point at — everything else about
/// a minimal `View` conformance is the same, and having written it twice is how
/// the two would drift.
///
/// One allocation holds everything, so every 32-bit self-relative offset is in
/// range. That also means a slot starting too early silently overwrites the
/// string before it, and that failure is close to invisible: the runtime
/// reports the field as an empty tuple, SwiftUI finds no `DynamicProperty`, and
/// everything still *works* except that nothing ever updates. Hence the
/// assertions rather than trust.
unsafe fn emit_type(
    type_name: &[u8],
    self_mangled: &[u8],
    fields: &[FieldSpec],
    body: *const c_void,
) -> (*const c_void, *const c_void) {
    const MODULE_NAME: &[u8] = b"rswift\0";
    const MODULE: usize = 0;
    const MODULE_NAME_OFF: usize = 16;
    const STRUCT: usize = 32;
    const TYPE_NAME_OFF: usize = 64;
    // 128, not 80. The type name lives between `TYPE_NAME_OFF` and here, and
    // sixteen bytes was enough for `RustLayout` and `RustApp` and not for
    // `RustContainerKey0` — a synthesised name long enough to be descriptive is
    // not an unreasonable thing to ask for, and everything after this offset is
    // computed from it, so widening costs sixty-four unused bytes per type and
    // nothing else.
    const FIELD_DESC: usize = 128;

    let n = fields.len();
    assert!(n > 0, "a synthesised struct needs at least one field");

    // Lay the fields out the way Swift would: each at its own alignment, the
    // struct at the widest of them. Computing this beats writing offsets out
    // by hand, which is how a field type of a different size silently
    // overlaps its neighbour.
    let mut offsets = Vec::with_capacity(n);
    let mut at = 0usize;
    let mut align = 1usize;
    for f in fields {
        let vw = unsafe { &*field_vwt(f.meta) };
        let a = vw.flags.alignment().max(1);
        align = align.max(a);
        at = (at + a - 1) & !(a - 1);
        offsets.push(at);
        at += vw.stride.max(vw.size).max(1);
    }
    let size = ((at + align - 1) & !(align - 1)).max(1);
    let vwt = delegating_vwt(size, align);
    assert!(MODULE_NAME_OFF + MODULE_NAME.len() <= STRUCT);
    assert!(
        TYPE_NAME_OFF + type_name.len() <= FIELD_DESC,
        "the synthesised type name {:?} needs {} bytes and there are {}",
        core::str::from_utf8(type_name).unwrap_or("<not utf-8>"),
        type_name.len(),
        FIELD_DESC - TYPE_NAME_OFF
    );

    // Strings go end to end after the field records.
    let field_desc_end = FIELD_DESC + 16 + 12 * n;
    let mut strings: Vec<(usize, &[u8])> = Vec::with_capacity(2 * n + 3);
    strings.push((MODULE_NAME_OFF, MODULE_NAME));
    strings.push((TYPE_NAME_OFF, type_name));
    let mut at = field_desc_end;
    let mut field_string_offsets = Vec::with_capacity(n);
    for f in fields {
        let t = at;
        strings.push((at, f.mangled_type));
        at += f.mangled_type.len();
        let name = at;
        strings.push((at, f.name));
        at += f.name.len();
        field_string_offsets.push((t, name));
    }
    let self_mangled_off = at;
    strings.push((at, self_mangled));
    at += self_mangled.len();

    let align8 = |x: usize| (x + 7) & !7;
    let proto_slot = align8(at);
    let conf = proto_slot + 16;
    let record = conf + 24;
    let witness = record + 8;
    let total = witness + 7 * 8 + 8;

    let block = unsafe { libc::malloc(total) } as *mut u8;
    assert!(!block.is_null());
    unsafe {
        core::ptr::write_bytes(block, 0, total);
        for (off, bytes) in strings {
            core::ptr::copy_nonoverlapping(bytes.as_ptr(), block.add(off), bytes.len());
        }
    }

    unsafe fn rel(field: *const u8, target: *const u8) -> i32 {
        i32::try_from(target as isize - field as isize).expect("relative pointer out of range")
    }

    unsafe {
        // Module context descriptor.
        let m = block.add(MODULE);
        *(m as *mut u32) = 0x40; // Kind = Module, IsUnique
        *(m.add(4) as *mut i32) = 0;
        *(m.add(8) as *mut i32) = rel(m.add(8), block.add(MODULE_NAME_OFF));

        // Struct descriptor.
        let d = block.add(STRUCT);
        *(d as *mut u32) = 0x51; // Kind = Struct, IsUnique
        *(d.add(4) as *mut i32) = rel(d.add(4), m);
        *(d.add(8) as *mut i32) = rel(d.add(8), block.add(TYPE_NAME_OFF));
        *(d.add(12) as *mut i32) = 0; // no metadata access function
        *(d.add(16) as *mut i32) = rel(d.add(16), block.add(FIELD_DESC));
        *(d.add(20) as *mut u32) = n as u32; // NumFields
        *(d.add(24) as *mut u32) = 2; // FieldOffsetVectorOffset, in words

        // Field descriptor. This is what SwiftUI walks to find the
        // `DynamicProperty` storage it has to install.
        let f = block.add(FIELD_DESC);
        *(f as *mut i32) = rel(f, block.add(self_mangled_off));
        *(f.add(4) as *mut i32) = 0; // no superclass
        *(f.add(8) as *mut u16) = 0; // Kind = Struct
        *(f.add(10) as *mut u16) = 12; // FieldRecordSize
        *(f.add(12) as *mut u32) = n as u32;
        for (i, (type_off, name_off)) in field_string_offsets.iter().enumerate() {
            let r = f.add(16 + 12 * i);
            *(r as *mut u32) = 0x2; // IsVar
            *(r.add(4) as *mut i32) = rel(r.add(4), block.add(*type_off));
            *(r.add(8) as *mut i32) = rel(r.add(8), block.add(*name_off));
        }

        // Metadata: [VWT][Kind][Descriptor][field offsets], one u32 per field.
        let meta_bytes = 24 + 4 * n;
        let meta = libc::malloc(meta_bytes) as *mut *const c_void;
        assert!(!meta.is_null());
        core::ptr::write_bytes(meta as *mut u8, 0, meta_bytes);
        *meta.add(0) = vwt;
        *(meta.add(1) as *mut usize) = 0x200; // Kind = Struct
        *meta.add(2) = d as *const c_void;
        for (i, off) in offsets.iter().enumerate() {
            *((meta as *mut u8).add(24 + 4 * i) as *mut u32) = *off as u32;
        }
        let metadata = (meta as *const u8).add(8) as *const c_void;

        // The witnesses find the layout by metadata pointer. Registered before
        // the type escapes, so nothing can copy a value of it first.
        with_layouts(|m| {
            m.insert(
                metadata as usize,
                TypeLayout {
                    fields: fields
                        .iter()
                        .zip(&offsets)
                        .map(|(f, off)| (f.meta as usize, *off))
                        .collect(),
                    size,
                },
            )
        });

        // View witness table, in the order a real conformance uses:
        //   [0] conformance descriptor
        //   [1] associated conformance  Body: View
        //   [2] associated type         Body
        //   [3] _makeView          (SwiftUI's default)
        //   [4] _makeViewList      (SwiftUI's default)
        //   [5] _viewListCount     (SwiftUI's default)
        //   [6] body getter
        let wt = block.add(witness) as *mut *const c_void;
        *wt.add(0) = block.add(conf) as *const c_void;
        *wt.add(1) = resolve::anyview_wt();
        *wt.add(2) = resolve::anyview_meta();
        *wt.add(3) = resolve::view_make_view_default();
        *wt.add(4) = resolve::view_make_view_list_default();
        *wt.add(5) = resolve::view_list_count_default();
        *wt.add(6) = body;

        // Protocol conformance descriptor, in the simple form: a direct witness
        // table pattern, no conditional requirements, no resilient witnesses.
        *(block.add(proto_slot) as *mut *const c_void) = resolve::view_proto();
        let c = block.add(conf);
        *(c as *mut i32) = rel(c, block.add(proto_slot)) | 1; // indirectable
        *(c.add(4) as *mut i32) = rel(c.add(4), d);
        *(c.add(8) as *mut i32) = rel(c.add(8), block.add(witness));
        *(c.add(12) as *mut u32) = 0;

        let rec = block.add(record);
        *(rec as *mut i32) = rel(rec, c);
        type Register = unsafe extern "C" fn(*const u8, *const u8);
        let reg = libc::dlsym(
            (-2isize) as *mut c_void,
            c"swift_registerProtocolConformances".as_ptr(),
        );
        assert!(!reg.is_null(), "swift_registerProtocolConformances not found");
        let reg: Register = core::mem::transmute(reg);
        reg(rec, rec.add(4));

        (metadata, wt as *const c_void)
    }
}

/// A nominal struct with one `Int` field, and nothing else.
///
/// [`emit_type`] also builds a `View` conformance, because everything it was
/// written for is a view. A `Layout` is not: what it needs is a *named type*
/// to be the `Self` of its own conformance, so that `_LayoutRoot<Self>` reads
/// as something rather than as a borrowed `Spacer`.
///
/// Returns the type's nominal descriptor and its metadata. The `View`
/// conformance the emitter registers alongside is unused and harmless — it
/// describes a type nothing ever asks to render.
///
/// # Safety
/// `type_name` and `self_mangled` must agree, and must not collide with
/// another synthesised type.
pub(crate) unsafe fn emit_int_carrier(
    type_name: &'static [u8],
    self_mangled: &'static [u8],
) -> (*const c_void, *const c_void) {
    unsafe {
        let (metadata, _) = emit_type(
            type_name,
            self_mangled,
            &[FieldSpec { mangled_type: b"Si\0", name: b"index\0", meta: resolve::int_meta() }],
            stub_body as *const c_void,
        );
        let descriptor = *(metadata as *const *const c_void).add(1);
        (descriptor, metadata)
    }
}

/// A `body` that produces nothing, for a synthesised type that is not a view.
unsafe extern "C" fn stub_body(out: *mut u8, _payload: *mut c_void) {
    unsafe { *(out as *mut u64) = 0 };
}

/// The `@State` type: `struct RustView { @State var value: Int; var id: Int }`.
unsafe fn build_type() -> (*const c_void, *const c_void) {
    unsafe {
        emit_type(
            b"RustView\0",
            b"6rswift8RustViewV\0",
            &[
                FieldSpec {
                    mangled_type: b"7SwiftUI5StateVySiG\0",
                    name: b"_value\0",
                    meta: abi::generic_metadata1(resolve::state_ma(), resolve::int_meta()),
                },
                FieldSpec { mangled_type: b"Si\0", name: b"id\0", meta: resolve::int_meta() },
            ],
            view_body_thunk as *const c_void,
        )
    }
}

// `withAnimation` is not yet wired.
//
// The blocker it used to have is gone: a `@State` change on this type *is* a
// change to a view SwiftUI already knows, so a transaction would apply and the
// value would interpolate — unlike a root-view swap, which had nothing to
// interpolate between. What remains is only the calling convention of
// `withAnimation<R>(_: Animation?, _ body: () throws -> R) rethrows -> R`,
// whose generic return and `swifterror` register my first attempt got wrong.

/// The value a pending animated write should install.
static PENDING_WRITE: std::sync::Mutex<(i64, i64)> = std::sync::Mutex::new((0, 0));

/// The `() throws -> ()` body handed to `withAnimation`.
unsafe extern "C" fn animated_write(_out: *mut u8, _payload: *mut c_void) {
    let (id, value) = *PENDING_WRITE.lock().expect("pending write poisoned");
    set_state(id, value);
}

/// Write a new value inside `withAnimation`, so SwiftUI interpolates.
///
/// This is what a stable view identity buys. Replacing a hosting view's root
/// handed SwiftUI a new tree with nothing to interpolate between; a `@State`
/// change on a type SwiftUI already knows is a change to an *existing* view, so
/// the transaction applies.
/// The application's root `@State`, built once and redrawn on demand.
///
/// Every application that owns its state in Rust needs the same three things: a
/// `StatefulView` at the root, a way to rebuild from current state, and a way to
/// ask for that from whatever thread a callback happens to run on. [`StatefulView`]
/// itself holds raw metadata pointers and so is neither `Send` nor `Sync` — it is
/// main-thread-only, correctly — which would otherwise push every caller into the
/// same `thread_local` dance.
///
/// The view lives on the thread that first asked for it. The `id` is a number,
/// and that is all [`refresh`] and [`refresh_animated`] need.
mod root {
    use super::{set_state_animated_with, StatefulView};
    use crate::views::ViewHandle;
    use std::sync::atomic::{AtomicI64, Ordering};

    pub(super) static ID: AtomicI64 = AtomicI64::new(-1);
    static GENERATION: AtomicI64 = AtomicI64::new(1);

    thread_local! {
        static VIEW: std::cell::OnceCell<StatefulView> = const { std::cell::OnceCell::new() };
    }

    pub(super) fn view(builder: fn(i64) -> ViewHandle) -> ViewHandle {
        VIEW.with(|cell| {
            let sv = cell.get_or_init(|| {
                let sv = StatefulView::new(GENERATION.load(Ordering::Relaxed), builder);
                ID.store(sv.id, Ordering::Release);
                sv
            });
            sv.as_view()
        })
    }

    pub(super) fn bump(animation: Option<u64>) {
        let id = ID.load(Ordering::Acquire);
        if id < 0 {
            return;
        }
        let n = GENERATION.fetch_add(1, Ordering::Relaxed) + 1;
        match animation {
            Some(a) => set_state_animated_with(id, n, a),
            None => {
                super::set_state(id, n);
            }
        }
    }
}

/// Build the application's root view, or return the one already built.
///
/// `builder` receives the current generation, which most callers ignore: the
/// point is that it runs again whenever [`refresh`] is called, and reads
/// whatever Rust state holds at that moment.
///
/// Must be called on the main thread.
pub fn root_view(builder: fn(i64) -> ViewHandle) -> ViewHandle {
    root::view(builder)
}

/// Re-run the root's body, so the interface reflects current Rust state.
///
/// Safe to call from any thread; SwiftUI cannot observe a Rust value on its own,
/// so this is how it is told that one changed.
pub fn refresh() {
    root::bump(None);
}

/// As [`refresh`], inside `withAnimation` — see [`ease_in_out`].
pub fn refresh_animated(animation: u64) {
    root::bump(Some(animation));
}

/// `Animation.easeInOut(duration:)`, as one reference.
///
/// An `Animation` is a single class reference, so it comes back in x0 rather
/// than through a buffer — which is what lets it be passed around as a `u64`.
pub fn ease_in_out(duration: f64) -> u64 {
    unsafe {
        let meta = abi::metadata0(resolve::animation_ma());
        let out: u64;
        core::arch::asm!("blr {f}", f = in(reg) resolve::animation_ease_in_out(),
            in("d0") duration,
            in("x20") meta,
            lateout("x0") out,
            lateout("x1") _, lateout("x2") _, lateout("x3") _, lateout("x4") _,
            lateout("x5") _, lateout("x6") _, lateout("x7") _, lateout("x8") _,
            lateout("x9") _, lateout("x10") _, lateout("x11") _, lateout("x12") _,
            lateout("x13") _, lateout("x14") _, lateout("x15") _, lateout("x16") _,
            lateout("x17") _, lateout("lr") _, lateout("x21") _, clobber_abi("C"),
        );
        out
    }
}

/// As [`set_state_animated`], with the animation spelled out.
pub fn set_state_animated_with(id: i64, value: i64, animation: u64) {
    set_animated_inner(id, value, Some(animation))
}

pub fn set_state_animated(id: i64, value: i64) {
    set_animated_inner(id, value, None)
}

fn set_animated_inner(id: i64, value: i64, animation: Option<u64>) {
    *PENDING_WRITE.lock().expect("pending write poisoned") = (id, value);
    unsafe {
        // `Animation?` is eight bytes — a single reference — so it goes in a
        // register by value, not through a buffer.
        let anim_meta = abi::metadata0(resolve::animation_ma());
        let anim = if let Some(a) = animation { a } else {
            let out: u64;
            core::arch::asm!("blr {f}", f = in(reg) resolve::animation_default(),
                in("x20") anim_meta,
                lateout("x0") out,
                lateout("x1") _, lateout("x2") _, lateout("x3") _, lateout("x4") _,
                lateout("x5") _, lateout("x6") _, lateout("x7") _, lateout("x8") _,
                lateout("x9") _, lateout("x10") _, lateout("x11") _, lateout("x12") _,
                lateout("x13") _, lateout("x14") _, lateout("x15") _, lateout("x16") _,
                lateout("x17") _, lateout("lr") _, lateout("x21") _, clobber_abi("C"),
            );
            out
        };

        let ctx = Box::leak(Box::new(abi::ClosureCtx::new(
            animated_write,
            core::ptr::null_mut(),
        ))) as *mut abi::ClosureCtx;

        // withAnimation<R>(_: Animation?, _ body: () throws -> R) rethrows -> R
        //   x0 = Animation? by value, x1 = closure fn, x2 = closure ctx,
        //   x3 = R.Type, x8 = @out R, x21 = swifterror
        let mut out = [0u8; 8];
        core::arch::asm!("blr {f}", f = in(reg) resolve::with_animation(),
            in("x0") anim,
            in("x1") abi::swift_closure_thunk as *const c_void,
            in("x2") ctx,
            in("x3") resolve::sym(c"$sytN"),
            in("x8") out.as_mut_ptr(),
            inout("x21") 0u64 => _,
            lateout("x4") _, lateout("x5") _, lateout("x6") _, lateout("x7") _,
            lateout("x9") _, lateout("x10") _, lateout("x11") _, lateout("x12") _,
            lateout("x13") _, lateout("x14") _, lateout("x15") _, lateout("x16") _,
            lateout("x17") _, lateout("lr") _, lateout("x20") _,
            clobber_abi("C"),
        );
    }
}

// ═══════════════════════════════════════════════════════════════════════════
// `@AppStorage`: read the compiler, not the crash
// ═══════════════════════════════════════════════════════════════════════════
//
// This was blocked for a long time on a wrong diagnosis. Calling
// `AppStorage.wrappedValue` faulted inside
// `UserDefaultLocation.canonicalLocation`, which reads like a property that was
// never installed, so the hunt went after installation: a real `App` and
// `Scene` instead of a hosting view, `.defaultAppStorage(.standard)` supplying
// the store, raising the write on the main run loop rather than a spawned
// thread, checking that `swift_conformsToProtocol` finds a `DynamicProperty`
// witness. All of it came back negative, because none of it was the problem.
//
// The answer was in one line of LLVM IR from `swiftc -emit-ir` on a four-line
// Swift view:
//
// ```llvm
//   declare swiftcc void @"…AppStorageV12wrappedValuexvg"(
//       ptr noalias sret, ptr, ptr)                    ; x8 = out, x0 = self, x1 = Value.Type
//   declare swiftcc void @"…StateV12wrappedValuexvg"(
//       ptr noalias sret, ptr, ptr noalias swiftself)  ; x8 = out, x0 = Value.Type, x20 = self
// ```
//
// `State`'s accessor takes `swiftself`; `AppStorage`'s does not. So its `self`
// is the eight-byte wrapper passed *by value in x0* — the `UserDefaultLocation`
// reference itself, not a pointer to the field — and the metadata in x1 is the
// *wrapped* type's, `Bool.Type`, not `AppStorage<Bool>.Type`. Modelling it on
// `State` gets both wrong at once, and the fault it produces points at
// SwiftUI's internals rather than at the call.
//
// The setter is `(value @in, self, Value.Type)` in x0/x1/x2, and Swift retains
// `self` around each call, which [`app_storage_get`] and [`app_storage_set`]
// below do too.
//
// The lesson is cheap to state: four conventions guessed and measured cost far
// more than one `-emit-ir` would have. Reflection was never wrong — plain
// spelled-out field type names work where Swift emits symbolic references, and
// SwiftUI installs the property either way.

// ── `@AppStorage` ────────────────────────────────────────────────────────

/// Field 0 is the `AppStorage<T>` — one `UserDefaultLocation` reference,
/// whatever `T` is, so the struct's layout does not depend on the value type.
/// Checked against the computed layout in [`StoredView::new`].
const STORED_ID_OFFSET: usize = 8;

/// A type `@AppStorage` can hold.
///
/// The four `AppStorage` takes without a `RawRepresentable` detour. The
/// accessors are generic over `Value` and so are shared — only the initialiser
/// differs per type, and it differs in ways worth having read rather than
/// guessed. From `swiftc -emit-ir`:
///
/// ```llvm
///   AppStorage<Bool>.init   (i1,     i64, ptr, i64)        ; x0=value, x1/x2=key, x3=store
///   AppStorage<Int>.init    (i64,    i64, ptr, i64)        ; x0=value, x1/x2=key, x3=store
///   AppStorage<Double>.init (double, i64, ptr, i64)        ; d0=value, x0/x1=key, x2=store
///   AppStorage<String>.init (i64, ptr, i64, ptr, i64)      ; x0/x1=value, x2/x3=key, x4=store
/// ```
///
/// `Double` is the one that breaks the pattern: its value travels in a *float*
/// register, so the key and the store shift down one.
pub trait StoredValue: Clone + Send + 'static {
    /// `Value.Type` — what the accessors want in x1, not `AppStorage<Value>`'s.
    fn metadata() -> *const c_void;
    /// The mangled `AppStorage<Self>`, NUL-terminated, for the field record.
    fn field_type() -> &'static [u8];
    /// `Self`'s own mangling, for naming `Binding<Self>`.
    fn mangled() -> &'static str;
    /// How many bytes the accessors read and write.
    fn buffer_bytes() -> usize;
    /// Build the wrapper, returning its `UserDefaultLocation`.
    ///
    /// # Safety
    /// Calls into SwiftUI; `key` must be a valid string.
    unsafe fn init_storage(&self, key: &str) -> u64;
    /// Read `Self` out of an accessor's `@out` buffer, consuming whatever the
    /// getter handed over.
    ///
    /// # Safety
    /// `buf` must be exactly [`buffer_bytes`](Self::buffer_bytes) of a valid
    /// `Self`, owned at +1.
    unsafe fn decode(buf: &[u8]) -> Self;
    /// Lay `Self` out for the setter's `@in` argument.
    fn encode(&self) -> Vec<u8>;
}

impl StoredValue for bool {
    fn metadata() -> *const c_void {
        resolve::bool_meta()
    }
    fn field_type() -> &'static [u8] {
        b"7SwiftUI10AppStorageVySbG\0"
    }
    fn mangled() -> &'static str {
        mangle::BOOL
    }
    fn buffer_bytes() -> usize {
        1
    }
    unsafe fn init_storage(&self, key: &str) -> u64 {
        unsafe { app_storage_init_word(resolve::app_storage_bool_init(), u64::from(*self), key) }
    }
    unsafe fn decode(buf: &[u8]) -> Self {
        buf[0] != 0
    }
    fn encode(&self) -> Vec<u8> {
        vec![u8::from(*self)]
    }
}

impl StoredValue for i64 {
    fn metadata() -> *const c_void {
        resolve::int_meta()
    }
    fn field_type() -> &'static [u8] {
        b"7SwiftUI10AppStorageVySiG\0"
    }
    fn mangled() -> &'static str {
        mangle::INT
    }
    fn buffer_bytes() -> usize {
        8
    }
    unsafe fn init_storage(&self, key: &str) -> u64 {
        unsafe { app_storage_init_word(resolve::app_storage_int_init(), *self as u64, key) }
    }
    unsafe fn decode(buf: &[u8]) -> Self {
        i64::from_le_bytes(buf[..8].try_into().expect("Int"))
    }
    fn encode(&self) -> Vec<u8> {
        self.to_le_bytes().to_vec()
    }
}

impl StoredValue for f64 {
    fn metadata() -> *const c_void {
        resolve::double_meta()
    }
    fn field_type() -> &'static [u8] {
        b"7SwiftUI10AppStorageVySdG\0"
    }
    fn mangled() -> &'static str {
        mangle::DOUBLE
    }
    fn buffer_bytes() -> usize {
        8
    }
    unsafe fn init_storage(&self, key: &str) -> u64 {
        unsafe {
            // The value is in d0, so the key starts at x0 rather than x1.
            let k = abi::swift_string(key);
            let out: u64;
            core::arch::asm!("blr {f}", f = in(reg) resolve::app_storage_double_init(),
                in("d0") *self,
                inlateout("x0") u64::from_le_bytes(k[..8].try_into().expect("key lo")) => out,
                in("x1") u64::from_le_bytes(k[8..].try_into().expect("key hi")),
                in("x2") 0u64, // store: nil
                lateout("x3") _, lateout("x4") _, lateout("x5") _, lateout("x6") _,
                lateout("x7") _, lateout("x8") _, lateout("x9") _, lateout("x10") _,
                lateout("x11") _, lateout("x12") _, lateout("x13") _, lateout("x14") _,
                lateout("x15") _, lateout("x16") _, lateout("x17") _, lateout("lr") _,
                lateout("x20") _, lateout("x21") _, clobber_abi("C"),
            );
            assert!(out != 0, "AppStorage<Double>.init returned nothing");
            out
        }
    }
    unsafe fn decode(buf: &[u8]) -> Self {
        f64::from_le_bytes(buf[..8].try_into().expect("Double"))
    }
    fn encode(&self) -> Vec<u8> {
        self.to_le_bytes().to_vec()
    }
}

impl StoredValue for String {
    fn metadata() -> *const c_void {
        resolve::string_meta()
    }
    fn field_type() -> &'static [u8] {
        b"7SwiftUI10AppStorageVySSG\0"
    }
    fn mangled() -> &'static str {
        mangle::STRING
    }
    fn buffer_bytes() -> usize {
        16
    }
    unsafe fn init_storage(&self, key: &str) -> u64 {
        unsafe {
            let v = abi::swift_string(self);
            let k = abi::swift_string(key);
            let out: u64;
            core::arch::asm!("blr {f}", f = in(reg) resolve::app_storage_string_init(),
                inlateout("x0") u64::from_le_bytes(v[..8].try_into().expect("v lo")) => out,
                in("x1") u64::from_le_bytes(v[8..].try_into().expect("v hi")),
                in("x2") u64::from_le_bytes(k[..8].try_into().expect("k lo")),
                in("x3") u64::from_le_bytes(k[8..].try_into().expect("k hi")),
                in("x4") 0u64, // store: nil
                lateout("x5") _, lateout("x6") _, lateout("x7") _, lateout("x8") _,
                lateout("x9") _, lateout("x10") _, lateout("x11") _, lateout("x12") _,
                lateout("x13") _, lateout("x14") _, lateout("x15") _, lateout("x16") _,
                lateout("x17") _, lateout("lr") _, lateout("x20") _, lateout("x21") _,
                clobber_abi("C"),
            );
            assert!(out != 0, "AppStorage<String>.init returned nothing");
            out
        }
    }
    unsafe fn decode(buf: &[u8]) -> Self {
        unsafe {
            let bytes: [u8; 16] = buf[..16].try_into().expect("String");
            let s = abi::read_swift_string(bytes);
            // The getter handed over an owned `String`. Small ones are inline
            // and this is a no-op on the tagged word; a long one's storage
            // would otherwise leak.
            swift_runtime_sys::BridgeObject::swift_bridgeObjectRelease(
                u64::from_le_bytes(bytes[8..].try_into().expect("bridge word")) as *mut c_void,
            );
            s
        }
    }
    fn encode(&self) -> Vec<u8> {
        unsafe { abi::swift_string(self).to_vec() }
    }
}

/// The three initialisers whose value is one integer-shaped word: x0 = value,
/// x1/x2 = key, x3 = store.
unsafe fn app_storage_init_word(func: *const c_void, value: u64, key: &str) -> u64 {
    unsafe {
        let k = abi::swift_string(key);
        let out: u64;
        core::arch::asm!("blr {f}", f = in(reg) func,
            inlateout("x0") value => out,
            in("x1") u64::from_le_bytes(k[..8].try_into().expect("key lo")),
            in("x2") u64::from_le_bytes(k[8..].try_into().expect("key hi")),
            in("x3") 0u64, // store: nil — UserDefaults.standard
            lateout("x4") _, lateout("x5") _, lateout("x6") _, lateout("x7") _,
            lateout("x8") _, lateout("x9") _, lateout("x10") _, lateout("x11") _,
            lateout("x12") _, lateout("x13") _, lateout("x14") _, lateout("x15") _,
            lateout("x16") _, lateout("x17") _, lateout("lr") _, lateout("x20") _,
            lateout("x21") _, clobber_abi("C"),
        );
        assert!(out != 0, "AppStorage.init returned nothing");
        out
    }
}

// `AppStorage`'s accessors do *not* take `swiftself`, which is what separates
// them from `State`'s and what made every earlier attempt fault. Swift emits:
//
// ```llvm
//   declare swiftcc void @AppStorage.wrappedValue.getter(
//       ptr noalias sret, ptr, ptr)                   ; x8 = out, x0 = self, x1 = Value.Type
//   declare swiftcc void @State.wrappedValue.getter(
//       ptr noalias sret, ptr, ptr noalias swiftself) ; x8 = out, x0 = Value.Type, x20 = self
// ```
//
// So `self` is the eight-byte wrapper passed *by value* in x0 — the
// `UserDefaultLocation` reference itself, not a pointer to the field — and the
// metadata is the *wrapped* type's, not `AppStorage<Value>`'s.

/// `AppStorage<T>.wrappedValue` getter.
unsafe fn app_storage_get<T: StoredValue>(location: u64) -> T {
    unsafe {
        let mut buf = vec![0u8; T::buffer_bytes()];
        // Swift retains around the call, `self` being `@guaranteed`.
        swift_runtime_sys::RuntimeRaw::swift_retain(location as *mut c_void);
        core::arch::asm!("blr {f}", f = in(reg) resolve::app_storage_wrapped_get(),
            in("x8") buf.as_mut_ptr(),
            in("x0") location,
            in("x1") T::metadata(),
            lateout("x2") _, lateout("x3") _, lateout("x4") _, lateout("x5") _,
            lateout("x6") _, lateout("x7") _, lateout("x9") _, lateout("x10") _,
            lateout("x11") _, lateout("x12") _, lateout("x13") _, lateout("x14") _,
            lateout("x15") _, lateout("x16") _, lateout("x17") _, lateout("lr") _,
            lateout("x20") _, lateout("x21") _, clobber_abi("C"),
        );
        swift_runtime_sys::RuntimeRaw::swift_release(location as *mut c_void);
        T::decode(&buf)
    }
}

/// `AppStorage<T>.wrappedValue` setter — `(value @in, self, Value.Type)`.
unsafe fn app_storage_set<T: StoredValue>(location: u64, value: &T) {
    unsafe {
        let mut v = value.encode();
        swift_runtime_sys::RuntimeRaw::swift_retain(location as *mut c_void);
        core::arch::asm!("blr {f}", f = in(reg) resolve::app_storage_wrapped_set(),
            in("x0") v.as_mut_ptr(),
            in("x1") location,
            in("x2") T::metadata(),
            lateout("x3") _, lateout("x4") _, lateout("x5") _, lateout("x6") _,
            lateout("x7") _, lateout("x8") _, lateout("x9") _, lateout("x10") _,
            lateout("x11") _, lateout("x12") _, lateout("x13") _, lateout("x14") _,
            lateout("x15") _, lateout("x16") _, lateout("x17") _, lateout("lr") _,
            lateout("x20") _, lateout("x21") _, clobber_abi("C"),
        );
        swift_runtime_sys::RuntimeRaw::swift_release(location as *mut c_void);
    }
}

/// `AppStorage<T>.projectedValue` — the `Binding<T>` Swift writes as `$flag`.
/// Same shape as the getter.
unsafe fn app_storage_projected<T: StoredValue>(location: u64) -> Vec<u8> {
    unsafe {
        let meta = abi::resolve_type_by_mangled_name(
            mangle::bound("7SwiftUI7BindingV", &[T::mangled()]).as_bytes(),
        );
        assert!(!meta.is_null(), "Binding metadata");
        let mut out = vec![0u8; abi::type_bytes(meta)];
        swift_runtime_sys::RuntimeRaw::swift_retain(location as *mut c_void);
        core::arch::asm!("blr {f}", f = in(reg) resolve::app_storage_projected_get(),
            in("x8") out.as_mut_ptr(),
            in("x0") location,
            in("x1") T::metadata(),
            lateout("x2") _, lateout("x3") _, lateout("x4") _, lateout("x5") _,
            lateout("x6") _, lateout("x7") _, lateout("x9") _, lateout("x10") _,
            lateout("x11") _, lateout("x12") _, lateout("x13") _, lateout("x14") _,
            lateout("x15") _, lateout("x16") _, lateout("x17") _, lateout("lr") _,
            lateout("x20") _, lateout("x21") _, clobber_abi("C"),
        );
        swift_runtime_sys::RuntimeRaw::swift_release(location as *mut c_void);
        out
    }
}

// ── The synthesised type ─────────────────────────────────────────────────

struct StoredInstance {
    /// Takes the location and produces the body. The value type is closed over
    /// here rather than carried, so one registry serves every `T`.
    render: Box<dyn Fn(u64) -> ViewHandle + Send>,
    runs: usize,
}

static STORED: std::sync::Mutex<Option<std::collections::HashMap<i64, StoredInstance>>> =
    std::sync::Mutex::new(None);

fn with_stored<R>(f: impl FnOnce(&mut std::collections::HashMap<i64, StoredInstance>) -> R) -> R {
    let mut g = STORED.lock().expect("stored registry poisoned");
    f(g.get_or_insert_with(std::collections::HashMap::new))
}

core::arch::global_asm!(
    ".p2align 2",
    ".globl _rswift_stored_body_thunk",
    "_rswift_stored_body_thunk:",
    "mov x1, x20",
    "mov x0, x8",
    "b _rswift_stored_body_getter",
);

unsafe extern "C" {
    #[link_name = "rswift_stored_body_thunk"]
    fn stored_body_thunk();
}

#[unsafe(no_mangle)]
unsafe extern "C" fn rswift_stored_body_getter(out: *mut u8, this: *const u8) {
    unsafe {
        let id = *(this.add(STORED_ID_OFFSET) as *const i64);
        let location = *(this as *const u64);
        let view = with_stored(|m| {
            let inst = m.get_mut(&id)?;
            inst.runs += 1;
            Some((inst.render)(location))
        });
        *(out as *mut u64) = view.unwrap_or_else(crate::views::empty_view).into_anyview_word();
    }
}


/// A runtime-built Swift view type with a real `@AppStorage`.
///
/// ```text
///   struct RustStored: View {
///       @AppStorage("key") var flag: T
///       var id: Int
///       var body: some View { <built by a Rust closure> }
///   }
/// ```
///
/// SwiftUI installs the property itself, by walking the reflection field
/// records — the same route `@State` takes in [`StatefulView`]. The body reads
/// the value *through the wrapper*, which is what records the dependency, so a
/// later [`set`](Self::set) both persists to `UserDefaults` and re-runs the
/// body.
///
/// `T` is one of [`StoredValue`]: `bool`, `i64`, `f64` or `String`.
///
/// Compare [`crate::views::BoundState::persistent`], which reaches the same
/// store without SwiftUI's involvement — the right tool when the state is
/// Rust's rather than a view's.
pub struct StoredView<T: StoredValue> {
    pub metadata: *const c_void,
    pub witness_table: *const c_void,
    value: Vec<u8>,
    pub id: i64,
    key: String,
    marker: core::marker::PhantomData<fn() -> T>,
}

impl<T: StoredValue> StoredView<T> {
    /// Build the type and one instance, backed by `key` in `UserDefaults`.
    pub fn new(key: &str, default: T, builder: impl Fn(T) -> ViewHandle + Send + 'static) -> Self {
        unsafe {
            let id = NEXT_ID.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
            with_stored(|m| {
                m.insert(
                    id,
                    StoredInstance {
                        render: Box::new(move |loc| builder(app_storage_get::<T>(loc))),
                        runs: 0,
                    },
                )
            });
            let (metadata, witness_table) = emit_type(
                b"RustStored\0",
                b"6rswift10RustStoredV\0",
                &[
                    FieldSpec {
                        mangled_type: T::field_type(),
                        name: b"_flag\0",
                        meta: abi::resolve_type_by_mangled_name(
                            &T::field_type()[..T::field_type().len() - 1],
                        ),
                    },
                    FieldSpec { mangled_type: b"Si\0", name: b"id\0", meta: resolve::int_meta() },
                ],
                stored_body_thunk as *const c_void,
            );
            debug_assert_eq!(
                field_offset(metadata, 1),
                STORED_ID_OFFSET,
                "the id moved; the body witness reads it at a fixed offset"
            );
            // Unlike `@State`, the field cannot start as zero: the wrapper
            // carries the key, and only its initialiser builds the
            // `UserDefaultLocation` that holds it.
            let mut value = vec![0u8; instance_bytes(metadata)];
            value[..8].copy_from_slice(&default.init_storage(key).to_le_bytes());
            value[STORED_ID_OFFSET..STORED_ID_OFFSET + 8].copy_from_slice(&id.to_le_bytes());
            Self {
                metadata,
                witness_table,
                value,
                id,
                key: key.to_owned(),
                marker: core::marker::PhantomData,
            }
        }
    }

    fn location(&self) -> u64 {
        u64::from_le_bytes(self.value[..8].try_into().expect("location"))
    }

    /// The key this is stored under.
    pub fn key(&self) -> &str {
        &self.key
    }

    /// The current value, read through the wrapper.
    pub fn get(&self) -> T {
        unsafe { app_storage_get::<T>(self.location()) }
    }

    /// Write, which persists and re-runs the body.
    pub fn set(&self, value: T) {
        unsafe { app_storage_set::<T>(self.location(), &value) }
    }

    /// How many times SwiftUI has evaluated the body.
    pub fn runs(&self) -> usize {
        with_stored(|m| m.get(&self.id).map_or(0, |i| i.runs))
    }

    /// The `Binding<T>` that Swift spells `$flag`.
    ///
    /// Hand this to a control and the control *is* the stored value: changing
    /// it writes through `UserDefaults` and re-runs the body, with no Rust
    /// state in between. See [`crate::views::toggle_app_storage`] and
    /// [`crate::views::slider_app_storage`].
    pub fn binding(&self) -> Vec<u8> {
        unsafe { app_storage_projected::<T>(self.location()) }
    }

    /// Wrap the instance so it can be hosted like any other view.
    pub fn as_view(&self) -> ViewHandle {
        unsafe { copy_as_view(&self.value, self.metadata, self.witness_table) }
    }
}

// ── `@Environment` ───────────────────────────────────────────────────────
//
// The other half of the environment: `.environment(_:_:)` writes a value into
// scope, and this reads one back out, from Rust, inside the body.
//
// Shaped unlike `@AppStorage` in two ways that matter. Its `wrappedValue`
// getter *does* take `swiftself` and wants the wrapper's own metadata —
// `(x8 = out, x0 = Environment<V>.Type, x20 = self by address)` — and
// `Environment<V>` is not one word: `Environment<Bool>` is nine bytes, a
// `Content` enum plus a tag. That second point is why the value witnesses had
// to stop assuming a single refcounted field before this could work at all.
//
// Its initialiser takes only the key path, `(x8 = out, x0 = KeyPath)`,
// recovering `V` from the path at run time.

/// One `\EnvironmentValues` property, as a type.
///
/// Each implementation names a property and says how to read its value back.
/// Adding another is three resolve entries and one impl.
pub trait EnvKey: Copy + 'static {
    /// What the property holds.
    type Value: Clone + Send + 'static;
    /// The mangled `Environment<Value>`, NUL-terminated, for the field record.
    fn field_type() -> &'static [u8];
    /// The mangled `Value` on its own.
    ///
    /// `field_type` is what the reflection record needs; this is what a
    /// modifier generic over `V` needs, and the two are different manglings of
    /// different types.
    fn value_type() -> &'static [u8];
    /// `\EnvironmentValues.<property>`, built once.
    fn key_path() -> u64;
    /// How many bytes the getter writes.
    fn buffer_bytes() -> usize;
    /// Read `Value` out of the getter's `@out` buffer.
    ///
    /// # Safety
    /// `buf` must be [`buffer_bytes`](Self::buffer_bytes) of a valid `Value`.
    unsafe fn decode(buf: &[u8]) -> Self::Value;
    /// The tag a `Value` is stored as — `decode`'s inverse.
    ///
    /// Reading the environment only ever needed one direction. Writing one —
    /// `transformEnvironment` hands a handler the current value and stores
    /// whatever it returns — needs the other, and a key that can do one but
    /// not the other is half a key.
    fn encode(value: &Self::Value) -> u8;
}

/// Declare an `@Environment` property.
///
/// Everything a property needs is the same shape every time: a marker type, the
/// mangled `Environment<V>` for the field record, the three symbols behind
/// `\EnvironmentValues.<name>`, and how to read `V` back out of a buffer. This
/// says it once, so adding a property is the eight lines below rather than
/// fifty.
macro_rules! env_key {
    ($(
        $(#[$meta:meta])*
        $name:ident {
            value: $value:ty,
            field: $field:expr,
            value_type: $value_type:expr,
            symbols: ($getter:ident, $setter:ident, $descriptor:ident),
            bytes: $bytes:expr,
            decode: |$buf:ident| $decode:expr,
            encode: |$enc:ident| $encode:expr,
        }
    )*) => {$(
        $(#[$meta])*
        #[derive(Clone, Copy)]
        pub struct $name;

        impl EnvKey for $name {
            type Value = $value;
            fn field_type() -> &'static [u8] {
                $field
            }
            fn value_type() -> &'static [u8] {
                $value_type
            }
            fn key_path() -> u64 {
                use std::sync::atomic::{AtomicU64, Ordering};
                static CACHE: AtomicU64 = AtomicU64::new(0);
                static mut SLOT: crate::keypath::Slot = crate::keypath::Slot::new();
                let hit = CACHE.load(Ordering::Relaxed);
                if hit != 0 {
                    return hit;
                }
                unsafe {
                    let kp = crate::keypath::build(
                        &mut *(&raw mut SLOT),
                        crate::keypath::Property {
                            getter: resolve::$getter(),
                            setter: resolve::$setter(),
                            descriptor: resolve::$descriptor(),
                            root: b"7SwiftUI17EnvironmentValuesV",
                            value: $value_type,
                        },
                        crate::keypath::next_thunks(),
                    );
                    CACHE.store(kp, Ordering::Relaxed);
                    kp
                }
            }
            fn buffer_bytes() -> usize {
                $bytes
            }
            unsafe fn decode($buf: &[u8]) -> Self::Value {
                $decode
            }
            fn encode($enc: &Self::Value) -> u8 {
                $encode
            }
        }
    )*};
}

env_key! {
    /// `\EnvironmentValues.colorScheme` — whether the interface is light or dark.
    ColorSchemeKey {
        value: crate::views::ColorScheme,
        field: b"7SwiftUI11EnvironmentVyAA11ColorSchemeOG\0",
        value_type: b"7SwiftUI11ColorSchemeO",
        symbols: (env_color_scheme_getter, env_color_scheme_setter, env_color_scheme_descriptor),
        bytes: 1,
        decode: |b| match b[0] {
            0 => crate::views::ColorScheme::Light,
            _ => crate::views::ColorScheme::Dark,
        },
        encode: |v| match v {
            crate::views::ColorScheme::Light => 0,
            crate::views::ColorScheme::Dark => 1,
        },
    }

    /// `\EnvironmentValues.isEnabled` — whether controls in scope accept input.
    IsEnabledKey {
        value: bool,
        field: b"7SwiftUI11EnvironmentVySbG\0",
        value_type: b"Sb",
        symbols: (env_is_enabled_getter, env_is_enabled_setter, env_is_enabled_descriptor),
        bytes: 1,
        decode: |b| b[0] != 0,
        encode: |v| u8::from(*v),
    }

    /// `\EnvironmentValues.layoutDirection` — which way text and layout run.
    LayoutDirectionKey {
        value: crate::views::LayoutDirection,
        field: b"7SwiftUI11EnvironmentVyAA15LayoutDirectionOG\0",
        value_type: b"7SwiftUI15LayoutDirectionO",
        symbols: (
            env_layout_direction_getter,
            env_layout_direction_setter,
            env_layout_direction_descriptor
        ),
        bytes: 1,
        decode: |b| match b[0] {
            0 => crate::views::LayoutDirection::LeftToRight,
            _ => crate::views::LayoutDirection::RightToLeft,
        },
        encode: |v| match v {
            crate::views::LayoutDirection::LeftToRight => 0,
            crate::views::LayoutDirection::RightToLeft => 1,
        },
    }

    /// `\EnvironmentValues.dynamicTypeSize` — the reader's chosen text size.
    DynamicTypeSizeKey {
        value: crate::views::DynamicTypeSize,
        field: b"7SwiftUI11EnvironmentVyAA15DynamicTypeSizeOG\0",
        value_type: b"7SwiftUI15DynamicTypeSizeO",
        symbols: (
            env_dynamic_type_size_getter,
            env_dynamic_type_size_setter,
            env_dynamic_type_size_descriptor
        ),
        bytes: 1,
        decode: |b| {
            use crate::views::DynamicTypeSize::*;
            [
                XSmall, Small, Medium, Large, XLarge, XxLarge, XxxLarge,
                Accessibility1, Accessibility2, Accessibility3, Accessibility4,
                Accessibility5,
            ][(b[0] as usize).min(11)]
        },
        encode: |v| {
            use crate::views::DynamicTypeSize::*;
            [
                XSmall, Small, Medium, Large, XLarge, XxLarge, XxxLarge,
                Accessibility1, Accessibility2, Accessibility3, Accessibility4,
                Accessibility5,
            ]
            .iter()
            .position(|c| c == v)
            .expect("every DynamicTypeSize is in the table") as u8
        },
    }

    /// `\EnvironmentValues.controlSize` — how large controls in scope draw.
    ControlSizeKey {
        value: crate::views::ControlSize,
        field: b"7SwiftUI11EnvironmentVyAA11ControlSizeOG\0",
        value_type: b"7SwiftUI11ControlSizeO",
        symbols: (env_control_size_getter, env_control_size_setter, env_control_size_descriptor),
        bytes: 1,
        decode: |b| {
            use crate::views::ControlSize::*;
            [Mini, Small, Regular, Large, ExtraLarge][(b[0] as usize).min(4)]
        },
        encode: |v| {
            use crate::views::ControlSize::*;
            [Mini, Small, Regular, Large, ExtraLarge]
                .iter()
                .position(|c| c == v)
                .expect("every ControlSize is in the table") as u8
        },
    }

    /// `\EnvironmentValues.isLuminanceReduced` — whether the display is dimmed,
    /// as on an always-on screen.
    IsLuminanceReducedKey {
        value: bool,
        field: b"7SwiftUI11EnvironmentVySbG\0",
        value_type: b"Sb",
        symbols: (
            env_luminance_reduced_getter,
            env_luminance_reduced_setter,
            env_luminance_reduced_descriptor
        ),
        bytes: 1,
        decode: |b| b[0] != 0,
        encode: |v| u8::from(*v),
    }
}

/// `Environment<V>.init(_ keyPath:)` — `(x8 = out, x0 = KeyPath)`.
///
/// The initialiser *consumes* the key path. Swift's own call site pairs it with
/// a fresh `swift_getKeyPath`, which returns `+1`, and never releases
/// afterwards. The key path here is built once and cached, so every call after
/// the first was spending a reference it did not own — which showed up not as a
/// crash at the call but as a trap inside `Environment.init` much later, once
/// the count reached zero and the object had been freed. Retaining first is
/// what keeps the cached one alive.
unsafe fn environment_init(key_path: u64, bytes: usize) -> Vec<u8> {
    unsafe {
        swift_runtime_sys::RuntimeRaw::swift_retain(key_path as *mut c_void);
        let mut out = vec![0u8; bytes];
        core::arch::asm!("blr {f}", f = in(reg) resolve::environment_init(),
            in("x8") out.as_mut_ptr(),
            in("x0") key_path,
            lateout("x1") _, lateout("x2") _, lateout("x3") _, lateout("x4") _,
            lateout("x5") _, lateout("x6") _, lateout("x7") _, lateout("x9") _,
            lateout("x10") _, lateout("x11") _, lateout("x12") _, lateout("x13") _,
            lateout("x14") _, lateout("x15") _, lateout("x16") _, lateout("x17") _,
            lateout("lr") _, lateout("x20") _, lateout("x21") _, clobber_abi("C"),
        );
        out
    }
}

/// `Environment<V>.wrappedValue` getter — takes `swiftself` and the wrapper's
/// own metadata, unlike `AppStorage`'s.
unsafe fn environment_get<K: EnvKey>(field: *const u8, env_meta: *const c_void) -> K::Value {
    unsafe {
        let mut buf = vec![0u8; K::buffer_bytes()];
        core::arch::asm!("blr {f}", f = in(reg) resolve::environment_wrapped_get(),
            in("x8") buf.as_mut_ptr(),
            in("x0") env_meta,
            in("x20") field,
            lateout("x1") _, lateout("x2") _, lateout("x3") _, lateout("x4") _,
            lateout("x5") _, lateout("x6") _, lateout("x7") _, lateout("x9") _,
            lateout("x10") _, lateout("x11") _, lateout("x12") _, lateout("x13") _,
            lateout("x14") _, lateout("x15") _, lateout("x16") _, lateout("x17") _,
            lateout("lr") _, lateout("x21") _, clobber_abi("C"),
        );
        K::decode(&buf)
    }
}

struct EnvInstance {
    render: Box<dyn Fn(*const u8, *const c_void) -> ViewHandle + Send>,
    /// Where this view's `Environment<V>` sits, and the metadata its getter
    /// wants. Per instance, because `Environment<V>` is not the same width for
    /// every `V` — holding either globally would make two live views of
    /// different key types read each other's layout.
    env_offset: usize,
    env_meta: usize,
    runs: usize,
}

static ENVS: std::sync::Mutex<Option<std::collections::HashMap<i64, EnvInstance>>> =
    std::sync::Mutex::new(None);

fn with_envs<R>(f: impl FnOnce(&mut std::collections::HashMap<i64, EnvInstance>) -> R) -> R {
    let mut g = ENVS.lock().expect("environment registry poisoned");
    f(g.get_or_insert_with(std::collections::HashMap::new))
}

core::arch::global_asm!(
    ".p2align 2",
    ".globl _rswift_env_body_thunk",
    "_rswift_env_body_thunk:",
    "mov x1, x20",
    "mov x0, x8",
    "b _rswift_env_body_getter",
);

unsafe extern "C" {
    #[link_name = "rswift_env_body_thunk"]
    fn env_body_thunk();
}

#[unsafe(no_mangle)]
unsafe extern "C" fn rswift_env_body_getter(out: *mut u8, this: *const u8) {
    unsafe {
        // The id is field 0, so it is at offset 0 whatever `V` is — which is
        // the point of putting it first here rather than last as the other two
        // synthesised types do. Everything width-dependent is then looked up
        // per instance.
        let id = *(this as *const i64);
        let view = with_envs(|m| {
            let inst = m.get_mut(&id)?;
            inst.runs += 1;
            let (off, meta) = (inst.env_offset, inst.env_meta as *const c_void);
            Some((inst.render)(this.add(off), meta))
        });
        *(out as *mut u64) = view.unwrap_or_else(crate::views::empty_view).into_anyview_word();
    }
}

/// A runtime-built Swift view type with a real `@Environment`.
///
/// ```text
///   struct RustEnv: View {
///       @Environment(\.colorScheme) var value
///       var id: Int
///       var body: some View { <built by a Rust closure> }
///   }
/// ```
///
/// The body receives whatever SwiftUI has in scope — so a view built this way
/// follows the system appearance, or the nearest `.environment(...)`, without
/// Rust being told about the change.
pub struct EnvironmentView<K: EnvKey> {
    pub metadata: *const c_void,
    pub witness_table: *const c_void,
    value: Vec<u8>,
    pub id: i64,
    marker: core::marker::PhantomData<fn() -> K>,
}

impl<K: EnvKey> EnvironmentView<K> {
    /// Build the type and one instance.
    pub fn new(builder: impl Fn(K::Value) -> ViewHandle + Send + 'static) -> Self {
        unsafe {
            let id = NEXT_ID.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
            with_envs(|m| {
                m.insert(
                    id,
                    EnvInstance {
                        render: Box::new(move |field, meta| {
                            builder(environment_get::<K>(field, meta))
                        }),
                        env_offset: 0,
                        env_meta: 0,
                        runs: 0,
                    },
                )
            });
            let field_meta = abi::resolve_type_by_mangled_name(
                &K::field_type()[..K::field_type().len() - 1],
            );
            assert!(!field_meta.is_null(), "Environment<V> metadata");
            let (metadata, witness_table) = emit_type(
                b"RustEnv\0",
                b"6rswift7RustEnvV\0",
                &[
                    FieldSpec { mangled_type: b"Si\0", name: b"id\0", meta: resolve::int_meta() },
                    FieldSpec {
                        mangled_type: K::field_type(),
                        name: b"_value\0",
                        meta: field_meta,
                    },
                ],
                env_body_thunk as *const c_void,
            );
            let env_off = field_offset(metadata, 1);
            debug_assert_eq!(field_offset(metadata, 0), 0, "the id must be field 0");
            with_envs(|m| {
                if let Some(inst) = m.get_mut(&id) {
                    inst.env_offset = env_off;
                    inst.env_meta = field_meta as usize;
                }
            });

            // The field has to start as a real `Environment` built from the key
            // path — that is where the property learns which value to read.
            let mut value = vec![0u8; instance_bytes(metadata)];
            let env = environment_init(K::key_path(), abi::type_bytes(field_meta));
            value[..8].copy_from_slice(&id.to_le_bytes());
            value[env_off..env_off + env.len()].copy_from_slice(&env);
            Self { metadata, witness_table, value, id, marker: core::marker::PhantomData }
        }
    }

    /// How many times SwiftUI has evaluated the body.
    pub fn runs(&self) -> usize {
        with_envs(|m| m.get(&self.id).map_or(0, |i| i.runs))
    }

    /// Wrap the instance so it can be hosted like any other view.
    pub fn as_view(&self) -> ViewHandle {
        unsafe { copy_as_view(&self.value, self.metadata, self.witness_table) }
    }
}

/// A type `@State` can hold.
///
/// `State<V>` is the value followed by the location box SwiftUI installs, so
/// its width follows `V`: sixteen bytes for the three scalars, twenty-four for
/// a `String`. The box is therefore the *last* word rather than the one at
/// offset eight, which is what an earlier `Int`-only reading of it assumed.
pub trait StateValue: StoredValue {
    /// The mangled `State<Self>`, NUL-terminated, for the field record.
    fn state_field_type() -> &'static [u8];
}

impl StateValue for bool {
    fn state_field_type() -> &'static [u8] {
        b"7SwiftUI5StateVySbG\0"
    }
}
impl StateValue for i64 {
    fn state_field_type() -> &'static [u8] {
        b"7SwiftUI5StateVySiG\0"
    }
}
impl StateValue for f64 {
    fn state_field_type() -> &'static [u8] {
        b"7SwiftUI5StateVySdG\0"
    }
}
impl StateValue for String {
    fn state_field_type() -> &'static [u8] {
        b"7SwiftUI5StateVySSG\0"
    }
}

/// Where the location box sits inside a `State<V>`: the last word.
unsafe fn state_box_offset(state_meta: *const c_void) -> usize {
    unsafe { abi::type_size(state_meta).saturating_sub(8) }
}

/// `State<V>.wrappedValue` getter — `(x8 = out, x0 = State<V>.Type,
/// x20 = self by address)`.
unsafe fn state_value_of<T: StateValue>(field: *const u8, state_meta: *const c_void) -> T {
    unsafe {
        let mut buf = vec![0u8; T::buffer_bytes()];
        core::arch::asm!("blr {f}", f = in(reg) resolve::state_wrapped_get(),
            in("x8") buf.as_mut_ptr(),
            in("x0") state_meta,
            in("x20") field,
            lateout("x1") _, lateout("x2") _, lateout("x3") _, lateout("x4") _,
            lateout("x5") _, lateout("x6") _, lateout("x7") _, lateout("x9") _,
            lateout("x10") _, lateout("x11") _, lateout("x12") _, lateout("x13") _,
            lateout("x14") _, lateout("x15") _, lateout("x16") _, lateout("x17") _,
            lateout("lr") _, lateout("x21") _, clobber_abi("C"),
        );
        T::decode(&buf)
    }
}


/// The `Binding<V>` bytes a `State<V>` projects, without needing `V` at the
/// call site — the body witness iterates slots and has only metadata.
unsafe fn state_binding_bytes(
    field: *const u8,
    state_meta: *const c_void,
    bytes: usize,
) -> Vec<u8> {
    unsafe {
        let mut out = vec![0u8; bytes];
        core::arch::asm!("blr {f}", f = in(reg) resolve::state_projected_get(),
            in("x8") out.as_mut_ptr(),
            in("x0") state_meta,
            in("x20") field,
            lateout("x1") _, lateout("x2") _, lateout("x3") _, lateout("x4") _,
            lateout("x5") _, lateout("x6") _, lateout("x7") _, lateout("x9") _,
            lateout("x10") _, lateout("x11") _, lateout("x12") _, lateout("x13") _,
            lateout("x14") _, lateout("x15") _, lateout("x16") _, lateout("x17") _,
            lateout("lr") _, lateout("x21") _, clobber_abi("C"),
        );
        out
    }
}

unsafe fn binding_meta<T: StoredValue>() -> *const c_void {
    unsafe {
        let m = abi::resolve_type_by_mangled_name(
            mangle::bound("7SwiftUI7BindingV", &[T::mangled()]).as_bytes(),
        );
        assert!(!m.is_null(), "Binding metadata");
        m
    }
}

/// `Binding<V>.wrappedValue` setter — `(x0 = value @in, x1 = Binding<V>.Type,
/// x20 = self by address)`.
unsafe fn binding_set_of<T: StoredValue>(binding: &mut [u8], value: &T) {
    unsafe {
        let mut v = value.encode();
        core::arch::asm!("blr {f}", f = in(reg) resolve::binding_wrapped_set(),
            in("x0") v.as_mut_ptr(),
            in("x1") binding_meta::<T>(),
            in("x20") binding.as_mut_ptr(),
            lateout("x2") _, lateout("x3") _, lateout("x4") _, lateout("x5") _,
            lateout("x6") _, lateout("x7") _, lateout("x8") _, lateout("x9") _,
            lateout("x10") _, lateout("x11") _, lateout("x12") _, lateout("x13") _,
            lateout("x14") _, lateout("x15") _, lateout("x16") _, lateout("x17") _,
            lateout("lr") _, lateout("x21") _, clobber_abi("C"),
        );
    }
}

// ── Composing property wrappers ──────────────────────────────────────────
//
// [`StatefulView`], [`StoredView`] and [`EnvironmentView`] each synthesise a
// type with exactly one wrapper in it, which is enough to prove each one works
// and not enough to write a screen with. A real view wants `@State` *and*
// `@Environment` *and* whatever it persists, in the same struct.
//
// Nothing in the machinery objected — [`emit_type`] has laid out arbitrary
// fields and delegated their value witnesses since the layout work — so what
// was missing was only a way to say it. This is that: build the field list,
// and read the values back by index inside the body.

/// The field name for composed property `i`.
///
/// Reflection field names have to outlive the type, and the type outlives
/// everything here, so the name is leaked rather than drawn from a fixed table
/// — which is what capped composition at eight properties for no reason beyond
/// how many names had been written out.
fn prop_name(i: usize) -> &'static [u8] {
    // A property wrapper's stored property is spelled with a leading
    // underscore, as `_flag` is for `@AppStorage("…") var flag`.
    Box::leak(format!("_p{i}\0").into_bytes().into_boxed_slice())
}

#[derive(Clone, Copy, PartialEq, Eq)]
enum PropKind {
    State,
    Stored,
    Env,
    Focus,
}

struct PropSpec {
    field_type: &'static [u8],
    meta: *const c_void,
    /// For a `@State`, how wide its `Binding<V>` projection is. The builder
    /// knows `V`; the body witness, which captures the projection, does not.
    binding_bytes: usize,
    /// The field's initial bytes. `@State` starts zeroed and SwiftUI fills it
    /// in; the other two carry what they were built from.
    init: Vec<u8>,
    kind: PropKind,
}

/// Where a property ended up, and what is needed to read it.
#[derive(Clone, Copy)]
struct PropSlot {
    offset: usize,
    meta: usize,
    binding_bytes: usize,
    kind: PropKind,
}

/// A `@State` property of a composed view.
///
/// Handed out by [`ComposedBuilder::state`] and passed back to read or write
/// it. Carrying the type makes the index unspellable and the kind a matter for
/// the compiler: `p.state(count)` cannot name a property that is not there,
/// cannot read an `@AppStorage` as `@State`, and cannot read an `i64` one as a
/// `String`. All three were runtime assertions when properties were addressed
/// by number.
#[derive(Debug)]
pub struct StateProp<T> {
    index: usize,
    marker: core::marker::PhantomData<fn() -> T>,
}

/// An `@AppStorage` property of a composed view.
#[derive(Debug)]
pub struct StoredProp<T> {
    index: usize,
    marker: core::marker::PhantomData<fn() -> T>,
}

/// An `@Environment` property of a composed view.
#[derive(Debug)]
pub struct EnvProp<K> {
    index: usize,
    marker: core::marker::PhantomData<fn() -> K>,
}

/// A `@FocusState` property of a composed view.
#[derive(Clone, Copy, Debug)]
pub struct FocusProp {
    index: usize,
}

/// The properties of a composed view, read inside its body.
///
/// Indices are the order the properties were added. Reading the wrong type at
/// an index is a programming error the same way an out-of-range index is, and
/// is caught the same way — by an assertion, not by a fault inside SwiftUI.
pub struct Props {
    this: *const u8,
    slots: Vec<PropSlot>,
}

impl Props {
    fn slot(&self, i: usize, want: PropKind, what: &str) -> PropSlot {
        let s = *self.slots.get(i).unwrap_or_else(|| {
            panic!("no property at index {i}; the view has {}", self.slots.len())
        });
        assert!(s.kind == want, "property {i} is not {what}");
        s
    }

    /// The `@State` at index `i`.
    ///
    /// Returns `T`'s default before SwiftUI has installed the property — the
    /// box is the last word of a `State<V>`, and a zero one means reading
    /// would fault rather than answer.
    pub fn state<T: StateValue + Default>(&self, prop: StateProp<T>) -> T {
        let s = self.slot(prop.index, PropKind::State, "@State");
        unsafe {
            let meta = s.meta as *const c_void;
            if *(self.this.add(s.offset + state_box_offset(meta)) as *const u64) == 0 {
                T::default()
            } else {
                state_value_of::<T>(self.this.add(s.offset), meta)
            }
        }
    }

    /// The `@AppStorage` at index `i`.
    pub fn stored<T: StoredValue>(&self, prop: StoredProp<T>) -> T {
        let s = self.slot(prop.index, PropKind::Stored, "@AppStorage");
        unsafe { app_storage_get::<T>(*(self.this.add(s.offset) as *const u64)) }
    }

    /// Whether the `@FocusState` at index `i` currently has focus.
    pub fn focus(&self, prop: FocusProp) -> bool {
        let s = self.slot(prop.index, PropKind::Focus, "@FocusState");
        unsafe { focus_get(self.this.add(s.offset), s.meta as *const c_void) }
    }

    /// The three words `.focused(_:)` wants, for the `@FocusState` at index
    /// `i`. Pass it to [`crate::views::focused_on`] on the field it belongs to.
    pub fn focus_projection(&self, prop: FocusProp) -> [u64; 3] {
        let s = self.slot(prop.index, PropKind::Focus, "@FocusState");
        unsafe { focus_projection(self.this.add(s.offset), s.meta as *const c_void) }
    }

    /// The `@Environment` value at index `i`.
    pub fn env<K: EnvKey>(&self, prop: EnvProp<K>) -> K::Value {
        let s = self.slot(prop.index, PropKind::Env, "@Environment");
        unsafe { environment_get::<K>(self.this.add(s.offset), s.meta as *const c_void) }
    }
}

struct ComposedInstance {
    body: Box<dyn Fn(&Props) -> ViewHandle + Send>,
    slots: Vec<PropSlot>,
    /// One captured `Binding<Int>` per `@State`, by property index. Only
    /// obtainable from inside a body evaluation, as in [`StatefulView`].
    bindings: std::collections::HashMap<usize, Vec<u8>>,
    /// One captured `FocusState.Binding` per `@FocusState`, by property index.
    /// As with the state bindings, only obtainable while the body runs.
    focus: std::collections::HashMap<usize, [u64; 3]>,
    runs: usize,
}

static COMPOSED: std::sync::Mutex<Option<std::collections::HashMap<i64, ComposedInstance>>> =
    std::sync::Mutex::new(None);

fn with_composed<R>(
    f: impl FnOnce(&mut std::collections::HashMap<i64, ComposedInstance>) -> R,
) -> R {
    let mut g = COMPOSED.lock().expect("composed registry poisoned");
    f(g.get_or_insert_with(std::collections::HashMap::new))
}

core::arch::global_asm!(
    ".p2align 2",
    ".globl _rswift_composed_body_thunk",
    "_rswift_composed_body_thunk:",
    "mov x1, x20",
    "mov x0, x8",
    "b _rswift_composed_body_getter",
);

unsafe extern "C" {
    #[link_name = "rswift_composed_body_thunk"]
    fn composed_body_thunk();
}

#[unsafe(no_mangle)]
unsafe extern "C" fn rswift_composed_body_getter(out: *mut u8, this: *const u8) {
    unsafe {
        // The id is field 0, so it is at offset 0 whatever the properties are.
        let id = *(this as *const i64);
        let view = with_composed(|m| {
            let inst = m.get_mut(&id)?;
            inst.runs += 1;
            // Capture each `@State`'s binding the first time through; there is
            // nowhere else it can be had.
            for (i, s) in inst.slots.iter().enumerate() {
                if s.kind == PropKind::State && !inst.bindings.contains_key(&i) {
                    let meta = s.meta as *const c_void;
                    if *(this.add(s.offset + state_box_offset(meta)) as *const u64) != 0 {
                        // The projection is `Binding<V>`, whose width follows
                        // `V`; taking it generically is why the slot carries
                        // the field's metadata.
                        inst.bindings
                            .insert(i, state_binding_bytes(this.add(s.offset), meta, s.binding_bytes));
                    }
                }
            }
            for (i, s) in inst.slots.iter().enumerate() {
                if s.kind == PropKind::Focus && !inst.focus.contains_key(&i) {
                    inst.focus
                        .insert(i, focus_projection(this.add(s.offset), s.meta as *const c_void));
                }
            }
            let props = Props { this, slots: inst.slots.clone() };
            Some((inst.body)(&props))
        });
        *(out as *mut u64) = view.unwrap_or_else(crate::views::empty_view).into_anyview_word();
    }
}

/// Collects the properties a composed view will have.
///
/// See [`ComposedView`].
pub struct ComposedBuilder {
    specs: Vec<PropSpec>,
}

impl Default for ComposedBuilder {
    fn default() -> Self {
        Self::new()
    }
}

impl ComposedBuilder {
    pub fn new() -> Self {
        Self { specs: Vec::new() }
    }

    /// Add a `@State var: T`, starting at `initial`.
    ///
    /// `T` is one of [`StateValue`]: `bool`, `i64`, `f64` or `String`.
    pub fn state<T: StateValue>(&mut self, initial: T) -> StateProp<T> {
        unsafe {
            let ft = T::state_field_type();
            let meta = abi::resolve_type_by_mangled_name(&ft[..ft.len() - 1]);
            assert!(!meta.is_null(), "State<T> metadata");
            // The value inline, then the location box SwiftUI installs.
            let mut init = vec![0u8; abi::type_bytes(meta)];
            let bytes = initial.encode();
            init[..bytes.len()].copy_from_slice(&bytes);
            self.specs.push(PropSpec {
                field_type: ft,
                meta,
                binding_bytes: abi::type_bytes(binding_meta::<T>()),
                init,
                kind: PropKind::State,
            });
            StateProp { index: self.specs.len() - 1, marker: core::marker::PhantomData }
        }
    }

    /// Add an `@AppStorage(key) var: T`.
    pub fn app_storage<T: StoredValue>(&mut self, key: &str, default: T) -> StoredProp<T> {
        unsafe {
            let ft = T::field_type();
            let meta = abi::resolve_type_by_mangled_name(&ft[..ft.len() - 1]);
            assert!(!meta.is_null(), "AppStorage<T> metadata");
            self.specs.push(PropSpec {
                field_type: ft,
                meta,
                binding_bytes: 0,
                init: default.init_storage(key).to_le_bytes().to_vec(),
                kind: PropKind::Stored,
            });
            StoredProp { index: self.specs.len() - 1, marker: core::marker::PhantomData }
        }
    }

    /// Add a `@FocusState var: Bool`.
    ///
    /// Attach it to a field with [`crate::views::focused_on`]; then
    /// [`Props::focus`] reports whether that field has focus and
    /// [`ComposedView::set_focus`] moves it.
    pub fn focus_state(&mut self) -> FocusProp {
        unsafe {
            let meta = focus_state_meta();
            self.specs.push(PropSpec {
                field_type: FOCUS_STATE_BOOL,
                meta,
                binding_bytes: 0,
                init: focus_state_init(meta),
                kind: PropKind::Focus,
            });
            FocusProp { index: self.specs.len() - 1 }
        }
    }

    /// Add an `@Environment(\.…) var`.
    pub fn environment<K: EnvKey>(&mut self) -> EnvProp<K> {
        unsafe {
            let ft = K::field_type();
            let meta = abi::resolve_type_by_mangled_name(&ft[..ft.len() - 1]);
            assert!(!meta.is_null(), "Environment<V> metadata");
            self.specs.push(PropSpec {
                field_type: ft,
                meta,
                binding_bytes: 0,
                init: environment_init(K::key_path(), abi::type_bytes(meta)),
                kind: PropKind::Env,
            });
            EnvProp { index: self.specs.len() - 1, marker: core::marker::PhantomData }
        }
    }

    /// Synthesise the type and one instance, with `body` as its `body`.
    pub fn build(self, body: impl Fn(&Props) -> ViewHandle + Send + 'static) -> ComposedView {
        assert!(!self.specs.is_empty(), "a composed view needs at least one property");
        unsafe {
            let id = NEXT_ID.fetch_add(1, std::sync::atomic::Ordering::Relaxed);

            // Field 0 is the id, so the body witness can find it without
            // knowing the shape of anything after it.
            let mut fields = vec![FieldSpec {
                mangled_type: b"Si\0",
                name: b"id\0",
                meta: resolve::int_meta(),
            }];
            for (i, spec) in self.specs.iter().enumerate() {
                fields.push(FieldSpec {
                    mangled_type: spec.field_type,
                    name: prop_name(i),
                    meta: spec.meta,
                });
            }
            let (metadata, witness_table) = emit_type(
                b"RustComposed\0",
                b"6rswift12RustComposedV\0",
                &fields,
                composed_body_thunk as *const c_void,
            );
            debug_assert_eq!(field_offset(metadata, 0), 0, "the id must be field 0");

            let mut value = vec![0u8; instance_bytes(metadata)];
            value[..8].copy_from_slice(&id.to_le_bytes());
            let mut slots = Vec::with_capacity(self.specs.len());
            for (i, spec) in self.specs.iter().enumerate() {
                let off = field_offset(metadata, i + 1);
                value[off..off + spec.init.len()].copy_from_slice(&spec.init);
                slots.push(PropSlot {
                    offset: off,
                    meta: spec.meta as usize,
                    binding_bytes: spec.binding_bytes,
                    kind: spec.kind,
                });
            }

            with_composed(|m| {
                m.insert(
                    id,
                    ComposedInstance {
                        body: Box::new(body),
                        slots: slots.clone(),
                        bindings: std::collections::HashMap::new(),
                        focus: std::collections::HashMap::new(),
                        runs: 0,
                    },
                )
            });
            ComposedView { metadata, witness_table, value, id, slots }
        }
    }
}

/// A runtime-built Swift view type with any mix of property wrappers.
///
/// ```no_run
/// use swiftui_native::state::{ComposedBuilder, ColorSchemeKey};
/// use swiftui_native::views;
///
/// let mut b = ComposedBuilder::new();
/// let count = b.state(0_i64);
/// let dark = b.app_storage::<bool>("dark", false);
/// let scheme = b.environment::<ColorSchemeKey>();
/// let v = b.build(move |p| {
///     views::text(&format!("{} {} {:?}", p.state(count), p.stored(dark), p.env(scheme)))
/// });
/// v.set_state(count, 1);
/// ```
///
/// Reading a property as the wrong kind, or at the wrong type, does not
/// compile — which is what the handles buy over addressing properties by
/// number:
///
/// ```compile_fail
/// use swiftui_native::state::ComposedBuilder;
/// use swiftui_native::views;
///
/// let mut b = ComposedBuilder::new();
/// let count = b.state(0_i64);
/// let v = b.build(|_| views::text("x"));
/// let _: bool = v.stored(count); // a `@State` is not a `StoredProp`
/// ```
///
/// Each of [`StatefulView`], [`StoredView`] and [`EnvironmentView`] is the
/// one-property case of this; they are kept because they are simpler to use
/// when one is all that is wanted.
pub struct ComposedView {
    pub metadata: *const c_void,
    pub witness_table: *const c_void,
    value: Vec<u8>,
    pub id: i64,
    slots: Vec<PropSlot>,
}

impl ComposedView {
    /// Write the `@State` at index `i`, re-running the body.
    ///
    /// Returns false before the first body evaluation, when there is no
    /// binding to write through yet — the same contract as
    /// [`StatefulView::set`].
    pub fn set_state<T: StateValue>(&self, prop: StateProp<T>, value: T) -> bool {
        let i = prop.index;
        let binding = with_composed(|m| m.get(&self.id).and_then(|c| c.bindings.get(&i).cloned()));
        let Some(mut binding) = binding else { return false };
        unsafe { binding_set_of::<T>(&mut binding, &value) };
        true
    }

    fn stored_location(&self, i: usize) -> u64 {
        let s = self.slots[i];
        u64::from_le_bytes(self.value[s.offset..s.offset + 8].try_into().expect("location"))
    }

    /// Read an `@AppStorage` from outside the body.
    pub fn stored<T: StoredValue>(&self, prop: StoredProp<T>) -> T {
        unsafe { app_storage_get::<T>(self.stored_location(prop.index)) }
    }

    /// Write an `@AppStorage`, which persists and re-runs the body.
    pub fn set_stored<T: StoredValue>(&self, prop: StoredProp<T>, value: T) {
        unsafe { app_storage_set::<T>(self.stored_location(prop.index), &value) }
    }

    /// Move focus to — or away from — the `@FocusState` at index `i`.
    ///
    /// Writing `true` focuses the field the property is attached to, which is
    /// what `@FocusState var focused: Bool; focused = true` does in Swift.
    /// Returns false before the first body evaluation, when there is no
    /// installed property to write to yet.
    pub fn set_focus(&self, prop: FocusProp, value: bool) -> bool {
        let i = prop.index;
        let proj = with_composed(|m| m.get(&self.id).and_then(|c| c.focus.get(&i).copied()));
        let Some(mut proj) = proj else { return false };
        unsafe { focus_binding_set(&mut proj, value) };
        true
    }

    /// Whether the `@FocusState` at index `i` has focus, read from outside the
    /// body.
    pub fn focus(&self, prop: FocusProp) -> bool {
        let i = prop.index;
        let proj = with_composed(|m| m.get(&self.id).and_then(|c| c.focus.get(&i).copied()));
        match proj {
            Some(p) => unsafe { focus_binding_get(&p) },
            None => false,
        }
    }



    /// How many times SwiftUI has evaluated the body.
    pub fn runs(&self) -> usize {
        with_composed(|m| m.get(&self.id).map_or(0, |c| c.runs))
    }

    /// Wrap the instance so it can be hosted like any other view.
    pub fn as_view(&self) -> ViewHandle {
        unsafe { copy_as_view(&self.value, self.metadata, self.witness_table) }
    }
}

impl Drop for StatefulView {
    fn drop(&mut self) {
        unsafe { destroy_instance(&mut self.value, self.metadata) };
    }
}

impl<T: StoredValue> Drop for StoredView<T> {
    fn drop(&mut self) {
        unsafe { destroy_instance(&mut self.value, self.metadata) };
    }
}

impl<K: EnvKey> Drop for EnvironmentView<K> {
    fn drop(&mut self) {
        unsafe { destroy_instance(&mut self.value, self.metadata) };
    }
}

impl Drop for ComposedView {
    fn drop(&mut self) {
        unsafe { destroy_instance(&mut self.value, self.metadata) };
    }
}

// ── `@FocusState` ────────────────────────────────────────────────────────
//
// [`crate::views::focused`] already applies `.focused(_:)`, but with a
// `FocusState` built on the spot and thrown away: the modifier is there and
// nothing can read or move focus through it. Installed as a property it
// becomes real — Rust can ask whether the field is focused and put focus into
// it.
//
// Its accessors take `swiftself` and the wrapper's own metadata, like
// `@State`'s and unlike `@AppStorage`'s:
//
// ```llvm
//   declare swiftcc void @FocusState.wrappedValue.getter(
//       ptr noalias sret, ptr, ptr noalias swiftself)   ; x8=out, x0=FocusState<V>.Type, x20=self
// ```
//
// `FocusState<Bool>` is seventeen bytes at a stride of twenty-four, and the
// `Binding` it projects is the same — three words once exploded, which is how
// `.focused(_:)` takes it.

/// The mangled `FocusState<Bool>`, NUL-terminated.
const FOCUS_STATE_BOOL: &[u8] = b"7SwiftUI10FocusStateVySbG\0";

unsafe fn focus_state_meta() -> *const c_void {
    unsafe {
        let m = abi::resolve_type_by_mangled_name(&FOCUS_STATE_BOOL[..FOCUS_STATE_BOOL.len() - 1]);
        assert!(!m.is_null(), "FocusState<Bool> metadata");
        m
    }
}

/// `FocusState<Bool>.init()`.
///
/// Written through x8 with the metadata in x20, not returned in registers —
/// see [`crate::views::focus_binding`], which found that out the hard way.
unsafe fn focus_state_init(meta: *const c_void) -> Vec<u8> {
    unsafe {
        let mut out = vec![0u8; abi::type_bytes(meta)];
        core::arch::asm!("blr {f}", f = in(reg) resolve::focus_state_bool_init(),
            in("x8") out.as_mut_ptr(),
            in("x20") meta,
            lateout("x0") _, lateout("x1") _, lateout("x2") _, lateout("x3") _,
            lateout("x4") _, lateout("x5") _, lateout("x6") _, lateout("x7") _,
            lateout("x9") _, lateout("x10") _, lateout("x11") _, lateout("x12") _,
            lateout("x13") _, lateout("x14") _, lateout("x15") _, lateout("x16") _,
            lateout("x17") _, lateout("lr") _, lateout("x21") _, clobber_abi("C"),
        );
        out
    }
}

/// `FocusState<Bool>.wrappedValue` getter.
unsafe fn focus_get(field: *const u8, meta: *const c_void) -> bool {
    let mut out: u8 = 0;
    unsafe {
        core::arch::asm!("blr {f}", f = in(reg) resolve::focus_state_wrapped_get(),
            in("x8") &mut out as *mut u8,
            in("x0") meta,
            in("x20") field,
            lateout("x1") _, lateout("x2") _, lateout("x3") _, lateout("x4") _,
            lateout("x5") _, lateout("x6") _, lateout("x7") _, lateout("x9") _,
            lateout("x10") _, lateout("x11") _, lateout("x12") _, lateout("x13") _,
            lateout("x14") _, lateout("x15") _, lateout("x16") _, lateout("x17") _,
            lateout("lr") _, lateout("x21") _, clobber_abi("C"),
        );
    }
    out != 0
}


unsafe fn focus_binding_meta() -> *const c_void {
    unsafe {
        let m = abi::resolve_type_by_mangled_name(b"7SwiftUI10FocusStateV7BindingVySb_G");
        assert!(!m.is_null(), "FocusState<Bool>.Binding metadata");
        m
    }
}

/// `FocusState<Bool>.Binding.wrappedValue` setter — `(x0 = value @in,
/// x1 = Binding.Type, x20 = self by address)`.
///
/// Writing the *property* only touches this process's copy; SwiftUI installs
/// its own and never looks at ours. The projection captured while the body ran
/// is the handle on the installed one, which is the same arrangement `@State`
/// uses.
unsafe fn focus_binding_set(projection: &mut [u64; 3], value: bool) {
    unsafe {
        let mut v = u8::from(value);
        core::arch::asm!("blr {f}", f = in(reg) resolve::focus_binding_wrapped_set(),
            in("x0") &mut v as *mut u8,
            in("x1") focus_binding_meta(),
            in("x20") projection.as_mut_ptr(),
            lateout("x2") _, lateout("x3") _, lateout("x4") _, lateout("x5") _,
            lateout("x6") _, lateout("x7") _, lateout("x8") _, lateout("x9") _,
            lateout("x10") _, lateout("x11") _, lateout("x12") _, lateout("x13") _,
            lateout("x14") _, lateout("x15") _, lateout("x16") _, lateout("x17") _,
            lateout("lr") _, lateout("x21") _, clobber_abi("C"),
        );
    }
}

/// `FocusState<Bool>.Binding.wrappedValue` getter.
unsafe fn focus_binding_get(projection: &[u64; 3]) -> bool {
    let mut out: u8 = 0;
    unsafe {
        core::arch::asm!("blr {f}", f = in(reg) resolve::focus_binding_wrapped_get(),
            in("x8") &mut out as *mut u8,
            in("x0") focus_binding_meta(),
            in("x20") projection.as_ptr(),
            lateout("x1") _, lateout("x2") _, lateout("x3") _, lateout("x4") _,
            lateout("x5") _, lateout("x6") _, lateout("x7") _, lateout("x9") _,
            lateout("x10") _, lateout("x11") _, lateout("x12") _, lateout("x13") _,
            lateout("x14") _, lateout("x15") _, lateout("x16") _, lateout("x17") _,
            lateout("lr") _, lateout("x21") _, clobber_abi("C"),
        );
    }
    out != 0
}

/// `FocusState<Bool>.projectedValue`, as the three words `.focused(_:)` wants.
unsafe fn focus_projection(field: *const u8, meta: *const c_void) -> [u64; 3] {
    unsafe {
        let mut out = [0u64; 3];
        core::arch::asm!("blr {f}", f = in(reg) resolve::focus_state_projected(),
            in("x8") out.as_mut_ptr(),
            in("x0") meta,
            in("x20") field,
            lateout("x1") _, lateout("x2") _, lateout("x3") _, lateout("x4") _,
            lateout("x5") _, lateout("x6") _, lateout("x7") _, lateout("x9") _,
            lateout("x10") _, lateout("x11") _, lateout("x12") _, lateout("x13") _,
            lateout("x14") _, lateout("x15") _, lateout("x16") _, lateout("x17") _,
            lateout("lr") _, lateout("x21") _, clobber_abi("C"),
        );
        out
    }
}

// A handle is an index and a marker; `PhantomData<fn() -> T>` is `Copy`
// whatever `T` is. `#[derive(Copy)]` would add a `T: Copy` bound that nothing
// needs, which is what stopped a `StateProp<String>` being read twice inside a
// `Fn` body.
impl<T> Clone for StateProp<T> {
    fn clone(&self) -> Self {
        *self
    }
}
impl<T> Copy for StateProp<T> {}
impl<T> Clone for StoredProp<T> {
    fn clone(&self) -> Self {
        *self
    }
}
impl<T> Copy for StoredProp<T> {}
impl<K> Clone for EnvProp<K> {
    fn clone(&self) -> Self {
        *self
    }
}
impl<K> Copy for EnvProp<K> {}