Problem
AOT code that trusts its types is unsafe if plain JS can call it with anything. Sound mode is only sound at a module boundary if values arriving from untyped code are checked on entry — the gradual-typing approach of Typed Racket and Static TypeScript. Today nothing generates such checks; packages/validation has no connection to types. Without this, AOT output from #800 and #815 cannot safely be exported to JS.
Evidence (origin/main @ d4b219507)
Scope
- For every export of a sound-mode module reachable from non-sound code, generate an entry guard from the parameter types (reusing the
validate<T>generator). - Guard callbacks and objects that flow back in: check function results and wrap mutable objects where needed.
- On failure, throw a
TypeErrorthat names the side that broke the contract (blame): caller module, parameter, expected vs. actual type. - Skip guards on calls from other sound modules (no cost inside the typed world).
Acceptance criteria
- Calling a sound export from plain JS with a wrong-typed argument throws a blame error before any AOT/typed code runs.
- Sound-to-sound calls carry no guard (verified in emitted output).
- Guard overhead is measured on the compute benchmarks.