refactor(tw): extract Tw_section.Encode.ownership; delete orphan tw_ownership_section.ml

[hyperpolymath]

Summary

Establishes lib/tw_section.{ml,mli} as the canonical home for typed-wasm custom-section wire encoders, sized to absorb proposal 0001's two new sections (typedwasm.regions, typedwasm.capabilities) when they land.

Net change: 6 files, +69 / −115 = net −46 LOC.

What changes

File	Change
lib/tw_section.ml	New — Encode.ownership (operates on pre-byte-encoded triples, avoids type cycle with Codegen)
lib/tw_section.mli	New — public interface
lib/dune	tw_section added to modules list
lib/codegen.ml	build_ownership_section body replaced with 6-line wrapper delegating to Tw_section.Encode.ownership (signature unchanged, byte-equal output)
lib/tw_verify.ml:213	Stale doc comment fixed (Tw_ownership_section.build_section → Tw_section.Encode.ownership)
lib/tw_ownership_section.ml	Deleted — was orphan, not in lib/dune, no callers

Rationale

Filed as #444: prevent the 3-sections × 2-copies = 6-encoder fan-out when proposal 0001 (typed-wasm#34 / typed-wasm#76) lands. Sharing the internal LE writers (write_u32_le / write_u8) inside Tw_section.Encode means future Encode.regions / Encode.capabilities land in one place rather than duplicating the buffer plumbing.

Out of scope (deliberately)

• ADR-021 v2-emit flip — Tw_section.Encode.ownership ships v1 unchanged. When cross-repo coordination unblocks the flip, it becomes a localised change to this one module.
• Tea_ hand-rolled fixtures* (lib/tea_bridge.ml, lib/tea_cs_bridge.ml, lib/tea_router.ml) — these hard-code demo bytes for tea demonstrations, separate concern from live producer-side dedup. Can be migrated in a follow-up if/when the tea demos need updating.
• Decode side — tw_interface.ml reads via Tw_verify.parse_ownership_section_payload directly. No change needed; Tw_section.Decode is not introduced because there's no current duplicate to dedup. Can be added if proposal 0002's access-site codec needs symmetric Decode plumbing.

Test plan

• dune build clean.
• dune runtest 352/352 passing.
• Byte-equality verified by the existing ownership round-trip tests (test/test_e2e.ml:1218 test_ownership_roundtrip, :1249 test_ownership_entry_count, :1268 test_ownership_v2_parse_roundtrip, :1296 test_ownership_v2_unknown_version_empty). Any byte divergence would fail the round-trip.

Type cycle avoidance

Codegen → Tw_section → Codegen would cycle if Tw_section referenced Codegen.ownership_kind. Avoided by having Encode.ownership take (int * int list * int) list — already-byte-encoded triples. Codegen does the ownership_kind → byte mapping (via ownership_kind_byte) before calling. Tw_section stays type-clean.

Refs #444
Refs hyperpolymath/typed-wasm#34
Refs hyperpolymath/typed-wasm#76

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 82 issues detected

Severity	Count
🔴 Critical	4
🟠 High	10
🟡 Medium	68

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action ons/checkout@v6\n    needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action land/setup-deno@v2\n    needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affine-vscode-publish.yml",
    "type": "unknown",
    "file": "affine-vscode-publish.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence