Core‑Direct in-proc (opt-in) + negative canaries

- Runner: add HAKO_CORE_DIRECT_INPROC=1 to run MIR(JSON v0) directly in-proc (avoid child Hako wrapper); fallback preserved
- Update core_direct_string_bounds_rc_vm to enable in-proc toggle
- Add Bridge v1 negatives (Method/ModuleFunction/Constructor via Closure variants already added)
- Stage‑B alias table fail-fast tag in resolver; quick remains green

src/runner/core_executor.rs

@@ -21,12 +21,19 @@ pub(crate) fn run_json_v0(runner: &NyashRunner, json: &str) -> i32 {
     let core_direct = std::env::var("HAKO_CORE_DIRECT").ok().as_deref() == Some("1")
         || std::env::var("NYASH_CORE_DIRECT").ok().as_deref() == Some("1");
     if core_direct {
-        // Only attempt Hako Core dispatcher when payload already looks like MIR(JSON v0)
+        // Only attempt Core-Direct when payload already looks like MIR(JSON v0)
         // i.e., has functions/blocks keys. Stage‑B Program(JSON v0) must go through bridge first.
         let looks_like_mir = json.contains("\"functions\"") && json.contains("\"blocks\"");
         if looks_like_mir {
+            // In-proc prototype (opt-in): HAKO_CORE_DIRECT_INPROC=1 (alias NYASH_CORE_DIRECT_INPROC)
+            let core_direct_inproc = std::env::var("HAKO_CORE_DIRECT_INPROC").ok().as_deref() == Some("1")
+                || std::env::var("NYASH_CORE_DIRECT_INPROC").ok().as_deref() == Some("1");
+            if core_direct_inproc {
+                if let Some(rc) = try_run_core_direct_inproc(runner, json) { return rc; }
+                eprintln!("[core-exec] direct Core (inproc) failed; trying child wrapper");
+            }
             if let Some(rc) = try_run_core_direct(json) { return rc; }
-            eprintln!("[core-exec] direct Core failed; falling back to VM interpreter");
+            eprintln!("[core-exec] direct Core (child) failed; falling back to VM interpreter");
         }
         // else: skip direct Core and continue to bridge/VM path
     }
@@ -112,3 +119,20 @@ fn try_run_core_direct(json: &str) -> Option<i32> {
     let rc = out.status.code().unwrap_or(1);
     Some(rc)
 }
+
+fn try_run_core_direct_inproc(runner: &NyashRunner, json: &str) -> Option<i32> {
+    // Parse MIR(JSON v0) in-proc and execute via MIR Interpreter quietly.
+    // This bypasses the child Hako wrapper and reduces latency/recursion risks.
+    match crate::runner::json_v0_bridge::parse_json_v0_to_module(json) {
+        Ok(module) => {
+            crate::runner::child_env::pre_run_reset_oob_if_strict();
+            let rc = runner.execute_mir_module_quiet_exit(&module);
+            if crate::config::env::oob_strict_fail() && crate::runtime::observe::oob_seen() {
+                eprintln!("[gate-c][oob-strict] Out-of-bounds observed → exit(1)");
+                return Some(1);
+            }
+            Some(rc)
+        }
+        Err(_) => None,
+    }
+}

tools/smokes/v2/profiles/quick/core/core_direct_string_bounds_rc_vm.sh

@@ -20,7 +20,7 @@ code='static box Main { method main(args) { local s="abc"; local t=s.substring(-
 json=$(stageb_compile_to_json "$code") || { echo "[FAIL] core_direct_string_bounds_rc_vm (emit failed)" >&2; exit 1; }
 
 set +e
-NYASH_GATE_C_CORE=1 HAKO_GATE_C_CORE=1 HAKO_CORE_DIRECT=1 \
+NYASH_GATE_C_CORE=1 HAKO_GATE_C_CORE=1 HAKO_CORE_DIRECT=1 HAKO_CORE_DIRECT_INPROC=1 \
   NYASH_QUIET=1 HAKO_QUIET=1 NYASH_CLI_VERBOSE=0 NYASH_NYRT_SILENT_RESULT=1 \
   "$NYASH_BIN" --json-file "$json" >/dev/null 2>&1
 rc=$?