iter remove-mut-var-assign.1: atomic removal of mut/var/assign

mut/var/assign removed from AILang entirely and atomically. Deleted:
Term::Mut/Term::Assign/struct MutVar; the three Form-A keywords +
parse_mut/parse_assign + grammar EBNF; the 4 mut CheckError variants;
the mut_scope_stack synth threading (param dropped from synth + every
internal/external/test caller); the two lower_term arms; and every
exhaustive no-_ Term::Mut/Term::Assign match arm across 17 source
files — cut in lockstep with DESIGN.md, fixtures, the drift trio,
carve-out and roadmap so the schema is honest at every commit. No
catch-all wildcard introduced (verified). loop/recur + let/if are
the surviving forms.

The shared codegen alloca machinery survives (loop reuses it):
mut_var_allocas renamed binder_allocas (representation-only, loop
codegen byte-identical) and the shared Term::Lam escape guard
simplified to !loop_stack.is_empty() with the loop half
(LoopBinderCapturedByLambda) byte-equivalent. Feature-acceptance
applied inverted: the removed feature fails clause 2 (redundant)
and clause 3 (IS the iterated-mutable-state bug class).

Behaviour preservation is executable: mut_counter/mut_sum_floats
still print 55 after the faithful let/if rewrite. The removal is
made executable by the new mut_removed_pin.rs (4 must-fail pins).
Independent verification: cargo test --workspace 605/0, zero
residual mut symbols in any crate source, loop/recur non-regression
all green (55 / 500000500000 / infinite-compiles / the
lambda_capturing_loop_binder pin), roundtrip_cli PASS.

One DONE_WITH_CONCERNS: a 4th recurrence of the recon-undercount
class (in-source mod tests + a drift-pin fn + 5 orphaned mut
.ail.json carve-outs + a non-enumerated E0599); all resolved within
implementer remit, no behaviour change. Milestone-close audit then
fieldtest remain.

spec docs/specs/2026-05-18-remove-mut-var-assign.md (grounding PASS)
plan docs/plans/remove-mut-var-assign.1.md
This commit is contained in:
2026-05-18 11:06:17 +02:00
parent f355899fdf
commit 07f080256c
48 changed files with 331 additions and 2523 deletions
+20 -59
View File
@@ -85,12 +85,11 @@ impl<'a> Emitter<'a> {
// hard internal error is right.
// Tuple: (name, outer_ssa, llvm_type, ail_type, optional_fn_sig).
//
// Iter mut.4-tidy: post-Task-2 the typechecker rejects
// lambda-captures-of-mut-var via
// `CheckError::MutVarCapturedByLambda`. Reaching the `None`
// arm below means typecheck was skipped or a bug let the AST
// through — both are bugs in upstream layers, so panic rather
// than return an Internal error.
// The typechecker rejects lambda-captures-of-loop-binder via
// `CheckError::LoopBinderCapturedByLambda`. Reaching the
// `None` arm below means typecheck was skipped or a bug let
// the AST through — both are bugs in upstream layers, so
// panic rather than return an Internal error.
let mut cap_meta: Vec<(String, String, String, Type, Option<FnSig>)> = Vec::new();
for c in &captures {
let (_, outer_ssa, lty, ail_ty) = self
@@ -100,7 +99,7 @@ impl<'a> Emitter<'a> {
.find(|(n, _, _, _)| n == c)
.unwrap_or_else(|| {
unreachable!(
"lambda capture `{c}` not in locals — typecheck should have rejected via MutVarCapturedByLambda",
"lambda capture `{c}` not in locals — typecheck should have rejected via LoopBinderCapturedByLambda",
)
})
.clone();
@@ -135,19 +134,19 @@ impl<'a> Emitter<'a> {
let saved_moved = std::mem::take(&mut self.moved_slots);
// Iter mut.3: a lambda thunk is its own fn frame for the
// mut-var bookkeeping introduced in iter mut.3 — the outer
// fn's mut-vars are not in scope inside the thunk (a lambda
// body cannot reference enclosing mut-vars; the spec
// disallows capture of mut-vars by lambdas via the
// `mut_var_allocas` map being thunk-local). Save and reset
// the three fields so the thunk emits its own hoisted-
// alloca block at the thunk's entry, not the outer fn's.
let saved_mut_allocas = std::mem::take(&mut self.mut_var_allocas);
// fn's loop binders are not in scope inside the thunk (a
// lambda body cannot reference enclosing loop binders; the
// typechecker rejects such captures, and the
// `binder_allocas` map is thunk-local). Save and reset the
// three fields so the thunk emits its own hoisted-alloca
// block at the thunk's entry, not the outer fn's.
let saved_binder_allocas = std::mem::take(&mut self.binder_allocas);
// loop-recur iter 3: a lambda thunk is its own fn frame —
// a `recur` cannot target a loop enclosing the lambda
// (iter-2 typecheck already rejects it; codegen resets so
// the thunk's own loops work and the outer frames cannot
// leak in). Save + reset (mem::take empties the Vec),
// restored below alongside the mut.3 triple.
// restored below alongside the binder-alloca map.
let saved_loop_frames = std::mem::take(&mut self.loop_frames);
let saved_pending_allocas = std::mem::take(&mut self.pending_entry_allocas);
let saved_entry_marker = self.entry_block_end_marker.take();
@@ -233,10 +232,10 @@ impl<'a> Emitter<'a> {
self.body.push_str("}\n\n");
}
// Iter mut.3: splice any hoisted mut-var allocas into the
// thunk's entry block at the marker captured during the
// thunk's `start_block("entry")` above. Empty `pending` is
// a no-op (the thunk had no `Term::Mut` in its body).
// Splice any hoisted loop-binder allocas into the thunk's
// entry block at the marker captured during the thunk's
// `start_block("entry")` above. Empty `pending` is a no-op
// (the thunk had no `Term::Loop` in its body).
if !self.pending_entry_allocas.is_empty() {
let marker = self.entry_block_end_marker.ok_or_else(|| {
CodegenError::Internal(
@@ -261,8 +260,8 @@ impl<'a> Emitter<'a> {
self.non_escape = saved_non_escape;
self.moved_slots = saved_moved;
self.current_param_modes = saved_param_modes;
// Iter mut.3: restore outer fn's mut-var bookkeeping.
self.mut_var_allocas = saved_mut_allocas;
// Restore outer fn's loop-binder bookkeeping.
self.binder_allocas = saved_binder_allocas;
self.loop_frames = saved_loop_frames;
self.pending_entry_allocas = saved_pending_allocas;
self.entry_block_end_marker = saved_entry_marker;
@@ -475,44 +474,6 @@ impl<'a> Emitter<'a> {
Self::collect_captures(source, bound, captures, captures_set, builtins, top_level);
Self::collect_captures(body, bound, captures, captures_set, builtins, top_level);
}
// Iter mut.1: a mut-var name binds inside the block. Var
// inits before the binding see the outer scope; later
// inits and the body see the var as bound. Mut-vars
// cannot be captured by an inner lambda — the typecheck
// pass rejects this via `CheckError::MutVarCapturedByLambda`
// (added in mut.4-tidy). For the capture-collection scan
// the var bindings are tracked identically to let-bound
// names.
Term::Mut { vars, body } => {
let mut newly_bound: Vec<String> = Vec::new();
for v in vars {
Self::collect_captures(&v.init, bound, captures, captures_set, builtins, top_level);
if bound.insert(v.name.clone()) {
newly_bound.push(v.name.clone());
}
}
Self::collect_captures(body, bound, captures, captures_set, builtins, top_level);
for n in newly_bound {
bound.remove(&n);
}
}
Term::Assign { name, value, .. } => {
// The assigned `name` is a use of a mut-var binding.
// If it is bound in scope (it should be, by spec), it
// is not a capture. Otherwise — well-formed inputs do
// not produce this case (the typecheck pass at mut.2
// rejects it via `MutAssignOutOfScope`); we
// conservatively treat it as a possible capture so an
// ill-formed input still flows through codegen.
if !bound.contains(name)
&& !builtins.contains(name.as_str())
&& !top_level.contains(name)
&& captures_set.insert(name.clone())
{
captures.push(name.clone());
}
Self::collect_captures(value, bound, captures, captures_set, builtins, top_level);
}
Term::Loop { binders, body } => {
let mut newly_bound: Vec<String> = Vec::new();
for b in binders {