[Feature]: (Optimizations) Move Checks to Compile Time (Analyzers)

[wallstop]

Feature Description

Currently, we have to do a bunch of bookkeeping and machinery for our disposal leases to ensure that they are not double-disposed (ie, make them copy-safe). This is currently implemented in runtime code.

I believe for this, we could achieve the same effect (make things copy-safe) by moving the checks into an extremely robust analyzer, to prevent copies from even happening in the source. This way, we have the same result (zero-cost disposals), HOWEVER, they are even faster, since they don't need the runtime machinery.

We should investigate/research this approach, and, if it has merit, do a sweep of the code base for where we have similar patterns - runtime machinery/bookkeeping that can be moved to compile time analyzers.

Use Case / Motivation

Faster hot paths, more safety, simpler code.

Proposed Solution

No response

Alternatives Considered

No response

Unity Version

None

Package Version

None

[wallstop]

DISCLOSURE: LLM-GENERATED TEXT

Fix / sweep / rule in PR #925, head 97bd8a1e: WUH022 reports semantic boxing of disposable values (including nullable/generic conversions), with generated-code and required explicit enumerator protocol exemptions. Concrete scope fields remove three avoidable editor-test boxes; intentional heterogeneous cleanup boundaries carry narrow explained suppressions. Null-callback PooledResource wrappers reserve no lease slots, while null resources with callbacks still release once.

Research result: analyzer-only ownership cannot preserve shipped guarantees. Uncopied values can be disposed repeatedly; using disposes again; stale copies can meet reused resources; separately compiled consumers, suppressions, closures and reflection bypass source rules. Runtime generations therefore remain. The analyzer guide records the inventory, counterexamples and limits; no player speed claim is made.

Evidence: 26 focused analyzer cases, disabled-rule mutation failing all 12 positives, complete Debug and Release suites 850/850, native WUH022 compiler canary, native editor AssetDatabaseBatchScopeTests 154/154, AnalyzerPolicyWindowTests 34/34 and native pooled-resource PlayMode 21/21. Null-callback behavior was red before the production change. Clean source variants, documentation and shipped binary verification pass. Retained-boxing allocation calibration failed on this native host; player measurements remain required before stronger optimization claims. PR CI is pending, and full acceptance is not yet claimed.

[wallstop]

DISCLOSURE: LLM-GENERATED TEXT

Follow-up fix / sweep: PR #925 now has head 6cdc90f74142da833b01c399ca7b968e8b343709. CI exposed two intentional boxed enumerator returns in protobuf generator contract fixtures, outside the Unity source matrices. Both compiler errors reproduced locally; narrow explained suppressions preserve their interface contract paths without weakening WUH022. Full actual workflow oracle suites pass v3 946/946 and v2 944/944 with zero skips. Future shared-analyzer policy validation must include both generator test projects. Main CI is green; new-head PR CI is pending.

[wallstop]

DISCLOSURE: LLM-GENERATED TEXT

Fix / sweep in PR #925 head 564981d868e036cf1b190bbbdd42998db971133c: the native matrix exposed one stale negative test that still classified newly registered WUH022 as unknown. CI XML and local native red both show exactly this failure. The negative input is now out-of-catalog WUH999; the catalog-driven positive test still validates WUH022. Full native policy fixtures pass 53/53 with no skips or inconclusive cases, and independent review found no remaining concerns. Related catalog/unknown-ID assumptions were swept.

The preceding head passed all eight non-Unity workflows, shipped binary comparisons, analyzers 850/850 and protobuf oracle suites 946/946 plus 944/944. Current-head CI and feedback acceptance are still pending; this issue is not closed prematurely.

[wallstop]

Owner input: To be clear, the ask was to see if we can systematically prevent copies of our custom disposals to ensure exactly-once disposal via analyzers, and then remove the bookkeeping (ids, removal from a growing pool, pool maintenance, etc).

Is this possible? Is that applicable to any other areas of code?

Doing so would reduce the total amount of work needed at runtime, which would make our fast path buffers and disposals even faster.

We should only pursue this if it is safe.

[wallstop]

DISCLOSURE: LLM-GENERATED TEXT

Answer to the owner clarification: preventing source copies alone cannot safely establish exactly-once disposal or remove the current bookkeeping. Even an un-copied value can be explicitly disposed twice, or disposed inside a using statement and then again by its generated finally. An ownership rule would also need to prove transfers, aliases, captures, exceptional exits and subsequent uses across every caller. Suppression, disabled analyzers and separately compiled consumers still bypass that proof; ref structs restrict escape but do not provide move-only ownership or prevent repeated disposal.

Under the shipped API's guarantees, runtime generation/claim checks therefore remain necessary. WUH022 prevents avoidable boxing; it is not an ownership proof and is not presented as the requested replacement. The safe runtime-work reduction in PR #925 is narrower: a null-callback PooledResource acquires no lease because there is no release operation to protect. The sweep found the equivalent no-work guards already present in DisposableScope, generic scopes, semaphore leases and pooled arrays.

This applies elsewhere only when a guard protects a property fully determined by the compiled program and every relevant producer is under that compilation contract. Allocation-policy diagnostics can prevent specific source patterns; they cannot replace dynamic lifetime, concurrent-claim, resource-validity or untrusted-input checks. I found no other shipped bookkeeping class whose full guarantees can safely be removed this way. The documented research result is to retain runtime safety, with calibrated player measurements tracked separately in #636/#917. Final PR matrix acceptance is still pending.

[wallstop]

DISCLOSURE: LLM-GENERATED TEXT

Investigation acceptance is complete in PR #925, head 564981d868e036cf1b190bbbdd42998db971133c: all nine current-head workflows passed, including Unity run 37049024440 across 2021.3, 2022.3, 6000.5, 6000.6 and SINGLE_THREADED modes, export and cleanup gates. All 15 mode XML artifacts have zero failures; affected functional tests pass. Existing ignored extraction cases and pre-Unity-6 IL2CPP allocation skips remain explicitly excluded from proof. The changed sprite-fixture scope lifecycle was separately exercised through its actual native setup/teardown (batching depth 0 -> 1 -> 0). Final review threads, submissions, conversation comments and failing-check scans are empty; local preflight and documentation checks pass.

Closing the requested research as completed: replacing shipped exactly-once/copy-safety bookkeeping with analyzer-only ownership is unsafe under the current API guarantees, so runtime generations remain. WUH022 and no-work lease elision are useful, narrower improvements; this closure does not claim move-only C#, zero-cost ownership, player speed gains or a merged PR. Allocation calibration/player measurements remain tracked in #636/#917.

[wallstop]

Owner: Can we change the API guarantees?

[wallstop]

DISCLOSURE: LLM-GENERATED TEXT

Yes. Changing the ownership shape can safely remove bookkeeping for a narrower API. I recommend keeping existing leases and adding synchronous operations that own acquisition and cleanup internally. An array operation can give a callback only a borrowed Span, then return the private array in finally. It exposes no disposable handle or raw array. This gives up retained buffers, async use and caller-controlled release. The compiler's span/ref-struct restrictions protect that scoped view in safe managed code; Unity-floor compatibility, callback costs and exception behavior still need tests.

There is also a concrete internal subset requiring no public contract change: the four numeric List scratch branches in WallMath.Sum. Their array stays private, and only a scalar leaves the method. A private rent/finally-return can remove disposal-lease acquisition there. I am preparing native controls for this subset; no timing improvement is claimed.

A fresh sealed reference lease could preserve shared, idempotent disposal without the central slot table, but it needs an allocation and shared atomic claim per rental. Reusing that lifetime object recreates stale-alias hazards. A value lease whose contract merely says 'do not copy; dispose once' could remove checks, but analyzer suppression or compiled callers can still corrupt a reused resource. I would not call that option safe.

The same scoped-ownership approach could cover immediate partition processing, but retained partitions and lazy enumeration would need the existing leases. Global restoration scopes need a separate nesting/concurrency proof. An additive API lets us test these tradeoffs first; replacing existing signatures or weakening their documented guarantees would require a breaking release. This issue remains open for the changed-contract design and its evidence.

[wallstop]

DISCLOSURE: LLM-GENERATED TEXT

The private numeric subset is implemented in local commit 6828e24, pending publication in PR #927 after its active verification work. Each of the four List Mean paths now owns its BCL scratch rental and returns it in finally. No disposal handle leaves the operation; public lease guarantees remain intact.

Native red-green evidence: the complete statistics fixture was 139/143 before the change, with exactly four lease-work controls failing. Each observed a generation advance of two. After the change, all 143 pass with zero skips; a separate positive control still observes real acquire/claim work. The 25 added cases also preserve numeric extremes, NaN/infinity behavior, rounding, source contents, alternating sizes and null/empty validation.

All four Runtime and four Test compiler variants, both assembly-reference probes, scoped formatting/spelling/test checks, whole-tree ordering/syntax controls, strict docs and independent review pass. This demonstrates one avoided lease acquisition and claim per affected call, not a measured speed or allocation gain. Other scratch leases and the public borrowed-span design remain separate acceptance work; this issue stays open.

[wallstop]

DISCLOSURE: LLM-GENERATED TEXT

The proposed changed contract now has an executable prototype: TryWithBuffer action/result overloads own the rental and cleanup internally; a callback receives only a synchronous Span of the logical length plus explicit state. Zero length invokes once without renting. Negative length and null callback fail before acquisition. Ordinary rent/callback/return errors are reported, failed results reset to default, and a combined callback/return failure preserves both errors. Cleanup makes one return attempt; side effects are not rolled back on failure.

Adversarial testing found an important qualification to the earlier Span proposal: a previous legitimate renter can store the backing array in a reference element and return it dirty. Reading that element then exposes the array without unsafe code. Two actual controls failed on this counterexample. The corrected prototype always clears reference-bearing logical prefixes before invoking callbacks, including structs containing references; return clearing covers the physical reference-bearing array. Numeric input clearing is optional. This cost belongs in the contract and measurements.

Evidence so far: 16 isolated controls and 16 native Unity 6000.4.6f1 controls pass; disabling the return path produces 11 native failures. Six compiler controls reject heap storage, capture, async retention, Span results/state and boxing. C# 9/netstandard2.1 with Unity 2021.3 references compiles, but this is not actual floor editor/player acceptance. These guarantees concern borrowed backing storage under ordinary span operations and compliant pool use; they do not establish deep ownership of element objects, exclude owned copies, or protect against low-level reference/bounds bypass APIs.

The prototype remains ignored scratch code. Final adversarial review, tracked implementation/docs, actual floor/IL2CPP acceptance and whole-call callback measurements remain required. Existing copy-safe leases retain runtime generations; no performance improvement or issue completion is claimed.