AILang

Author SHA1 Message Date

Author	SHA1	Message	Date
Brummel	76b21c00eb	feat(lang): eliminate the Implicit ownership default — totality + the drop-soundness it demasks (#55 ) Deletes `ParamMode::Implicit`. `ParamMode` is now `{Own, Borrow}`: every fn-type slot on every signature carries an explicit `own` or `borrow`, no defaulted position survives anywhere (model 0008 §2, spec 0062). The parser rejects a bare fn-type slot; `borrow-return` and `borrow-over-value` reject at the signature; the corpus is migrated to minimal-ownership modes (consumed ⇒ own, read-only-heap ⇒ borrow, value ⇒ trivial-own). The documented `Implicit`-ret-mode leak is fixed: an owned heap return now drops exactly once (live=0, acceptance criterion 5). This was the easy half. Removing the default ACTIVATED a family of drop paths that `Implicit` had silently skipped — the pre-cutover language was leaking (and in places mis-dropping) here rather than crashing, because an Implicit scrutinee turned the drop off. Making the modes explicit (Own) turned those paths on and exposed two latent-bug clusters, all fixed RED-first as part of this cutover: Drop-soundness family (four legs): A. lit-sub-pattern double-free — the desugar re-matched the same owned scrutinee in the lit fall-through; fixed by grouping consecutive same-ctor arms into one match (bind fields once), in ailang-core desugar. B. Cons-husk leak on non-tail arm bodies — the lit-sub-pattern desugar rebound the owned scrutinee via `Let $mp = xs`, which bumped consume_count and suppressed the existing fn-return partial_drop. Fixed by not rebinding a bare-Var scrutinee (one husk-freeing mechanism, not two). C. polymorphic `drop_<T>` rc_dec'd monomorphised value fields — the per-ADT drop fn was emitted once from the polymorphic TypeDef, defaulting type-var fields to ptr and rc_dec'ing inline Ints (segfault). Fixed with per-monomorph drop functions (new ailang-codegen::dropmono): the drop set is collected from the lowered MIR, value-type fields are skipped, heap fields still freed once; monomorphic-concrete ADTs keep their byte-identical un-suffixed drop symbol. D. static Str literal passed to an `(own Str)` param — the literal lowers to a header-less rodata constant; the callee's now-active rc_dec read its length field as a refcount and freed a static address (segfault). Fixed with the missing fourth StrRep::Static→Heap promotion in lower_to_mir's App arm, gated on Own mode (borrow args stay static, no regression). over-strict-mode lint over-fired: it suggested `(borrow V)` for value-typed params (which `borrow-over-value` rejects — own is the only legal mode there) and fired on `(intrinsic)` bodies (whose consumption the linearity walk cannot observe). Tightened to skip both; contract 0008 updated to the narrowed firing scope. Irreversible step — canonical-form hash reset (model 0008 §6, acceptance criterion 6). Every signature now carries explicit modes, so the hashable canonical JSON changed for every module. RATIFY: the corpus-wide hash-pin reset (hash_pin, prelude_module_hash_pin, mono_hash_stability, eq_ord_e2e, embed_export_hash_stable, the ct4/iter*/loop_recur schema-extension pins) and the list ir_snapshot golden were regenerated once, deliberately, as the intended one-time consequence of removing the mode elision from the canonical form — not a regression. Each regenerated hash verified deterministic across two runs. Also fixes a pre-existing latent failure surfaced by the verification gate, unrelated to this cutover: the `every_contract_names_a_resolvable_ ratifying_test` resolver (design_index_pin) could not resolve the " + " dual-link ratifying-test form (`uniqueness.rs + linearity.rs`) that the #57 audit-close (`dfdc65f`) introduced — it shipped red on that commit. Resolver taught the dual-link form, mirroring its sibling. Verification: cargo test --workspace = 731 passed, 0 failed (twice, stable); e2e 102 passed, no binary exits non-zero (corpus crash-free); grep-clean for Implicit/fn_implicit/mode_eq across crates; every drop fix confirmed via emitted IR + AILANG_RC_STATS balance on the head==K, head!=K, and Nil paths. Three BLOCKEDs en route (the unsound first husk-dec attempt, the over-strict derivation premise, the leg-B fix direction) were each treated as a real design/spec gap and rediagnosed, not patched over. Supersedes #54 (return-position-only leak patch). Precondition #57 (linearity hardening) was already met. Spec docs/specs/0062, plan docs/plans/0121. closes #55	2026-06-02 00:03:46 +02:00
Brummel	26fb3459d8	GREEN: io/print_str byte-faithful via @fputs(@stdout) — closes #29 The runtime print path now writes exactly the bytes of its argument with no implicit trailing newline. `io/print_str` is byte-faithful; authors who want a newline emit `(do io/print_str "\n")` themselves. ## Codegen `crates/ailang-codegen/src/lib.rs`: - Module preamble: `@puts(ptr)` → `@fputs(ptr, ptr)` plus `@stdout = external global ptr` (libc's `FILE stdout`). - Effect-op lowering for `io/print_str`: emit `getelementptr +8` then `load ptr, ptr @stdout` then `call/tail call i32 @fputs(ptr bytes, ptr fp)`. Identical bytes-pointer GEP, distinct sink. - The pinned IR-shape test renames from `print_str_calls_puts_with_bytes_pointer` to `print_str_calls_fputs_with_bytes_pointer_and_stdout` and now asserts: bytes-GEP present, stdout-load present, both module- preamble declarations present, and no `@puts(` call anywhere in the emitted IR. ## Why this shape, and not the alternatives - Rename `io/print_str` to `io/println_str` (issue #29 option 2)* — kept the auto-newline, just relabelled it. AILang's design bias is explicit-over-implicit (CLAUDE.md: implicit conversions cut). Auto-newline is a hidden runtime augmentation; the rename would have preserved it. Rejected. - Append `\n` inside the polymorphic `print` (Show-mediated) function in `examples/prelude.ail` — would have been a one-line fix. Rejected: `print` is the Show-mediated formatter, not a newline emitter; baking a newline into it would have re-imposed the same implicit-augmentation problem one layer up, breaking callers that legitimately want pure-bytes output. ## Fixture / test sweep 30 `.ail` fixtures whose owning tests asserted line-separated stdout now emit explicit `(do io/print_str "\n")` after each print. Tests that asserted on multi-line stdout (`show_print_e2e`, `floats_e2e`, `str_concat_e2e`, `eq_ord_e2e`, several `print_*` smoke tests) had their fixtures sweetened the same way; assertions themselves remain the canonical observable output. Fixtures that never relied on the newline (no test ever read the absence of one) were left untouched. ## Migrated metadata - `crates/ailang-core/tests/hash_pin.rs`: the `ordering_match::main` canonical hash is refreshed (`b65a7f834703ffb4` → `8ed47b4062ce00f5`). The comment now names both successive corpus migrations honestly: the per-type-print-retirement (which moved `(do io/print_int x)` to `(app print x)`) AND this fputs swap (which wrapped that with `(seq ... (do io/print_str "\n"))`). - `design/contracts/str-abi.md`: the consumer-ABI table now lists `@fputs` as the print sink. A prose paragraph documents the byte-faithful semantics and references this issue. - `examples/ordering_match.prose.txt`: regenerated from the updated `ordering_match.ail`. - `crates/ail/tests/snapshots/{hello,sum,max3,list,ws_main}.ll`: IR snapshots regenerated via `UPDATE_SNAPSHOTS=1`. - Stale `@puts` comments in `runtime/str.c`, `crates/ail/tests/{e2e,show_print_e2e,print_no_leak_pin}.rs` replaced with `@fputs`. ## Verification - `cargo test -p ail --test print_str_no_auto_newline_e2e` — both RED tests from commit `c8ecfa3` now pass. - `cargo test --workspace` — 90 test groups GREEN, 0 failures. - `cargo build --workspace` — GREEN. - No new clippy lints (24 warnings pre-existing in `crates/ailang-core/src/lib.rs:129`). - Stats: `bench/orchestrator-stats/2026-05-21-iter-bugfix-print- str-fputs.json` — 1/1 tasks, 0 re-loops, 0 review loops. ## Empirical evidence cited Caught in the 2026-05-21 Qwen3-Coder naming-A/B run (`experiments/2026-05-21-naming-ab/runs/r1/`): every cohort wrote `(do io/print_str "...\n")` with explicit `\n` and got doubled newlines, failing the `t3_main_prints` stdout match across all three cohorts. The empirical LLM-natural form already assumes the new (post-this-commit) semantics — confirming the feature-acceptance test in CLAUDE.md. closes #29	2026-05-21 12:22:45 +02:00
Brummel	e7e67e1a40	iter str-concat: heap-Str concatenation primitive in four-site lockstep Closes fieldtest-form-a friction finding #4. `str_concat : (borrow Str, borrow Str) -> Str` ships in the four-site-lockstep pattern established by `str_clone` / `int_to_str` / `bool_to_str` (iter 24.1). The LLM-natural Show-MyType body `(app str_concat "label=" (app int_to_str x))` now parses, checks, builds, and runs end-to-end. Sites touched (lockstep): - runtime/str.c — `ailang_str_concat(a, b)` slab-allocates and memcpys both source payloads into a new heap-Str. - ailang-check/src/builtins.rs — `env.globals.insert("str_concat", Fn { 2x Str borrow, ret Str own, effects [] })` + `list()` row + `install_str_concat_signature` unit test. - ailang-codegen/src/lib.rs — `declare ptr @ailang_str_concat(ptr, ptr)` extern + `lower_app` arm after str_clone + `is_builtin_callable` extension + IR-pin unit test `str_concat_emits_call_to_ailang_str_concat`. - examples/show_user_adt_with_label.ail (new) + crates/ail/tests/ str_concat_e2e.rs (new) — corpus fixture exercising the LLM-natural Show body shape + E2E pin asserting check + build + run produce `Item 42\n`. Lockstep collision repaired: examples/bug_unbound_in_instance_method.ail used `str_concat` as its UNBOUND name (because that was the literal fieldtester repro). Renamed to `format_label` (LLM-author-realistic helper name that will never become a builtin) and updated the pin test `crates/ail/tests/unbound_in_instance_method_pin.rs` accordingly, preserving the regression guard's intent (instance-method-body walked through unbound-var check). DESIGN.md amended: new §"Heap-Str primitives" subsection between the milestone-24 Show-backer enumeration and the existing `Primitive output goes through ...` paragraph, cataloguing all five heap-Str primitives (`int_to_str`, `bool_to_str`, `float_to_str`, `str_clone`, `str_concat`) with signatures, iter origins, and the user-visible-vs-prelude-internal distinction. Show-backer block unchanged. IR snapshots regenerated (hello, list, max3, sum, ws_main) to absorb the new `declare ptr @ailang_str_concat(ptr, ptr)` line in the unconditional extern header — same upkeep pattern as hs.4 which regenerated the same 5 snapshots for the same reason (unconditional declares dead-stripped by clang -O2 when unused). Tests: 559 + 3 = 562 green (E2E pin + builtin-signature test + IR-pin test). Zero re-loops across all 7 tasks.	2026-05-13 12:43:10 +02:00

76b21c00eb

feat(lang): eliminate the Implicit ownership default — totality + the drop-soundness it demasks (#55 )

Deletes `ParamMode::Implicit`. `ParamMode` is now `{Own, Borrow}`:
every fn-type slot on every signature carries an explicit `own` or
`borrow`, no defaulted position survives anywhere (model 0008 §2,
spec 0062). The parser rejects a bare fn-type slot; `borrow-return`
and `borrow-over-value` reject at the signature; the corpus is
migrated to minimal-ownership modes (consumed ⇒ own, read-only-heap
⇒ borrow, value ⇒ trivial-own). The documented `Implicit`-ret-mode
leak is fixed: an owned heap return now drops exactly once (live=0,
acceptance criterion 5).

This was the easy half. Removing the default ACTIVATED a family of
drop paths that `Implicit` had silently skipped — the pre-cutover
language was leaking (and in places mis-dropping) here rather than
crashing, because an Implicit scrutinee turned the drop off. Making
the modes explicit (Own) turned those paths on and exposed two
latent-bug clusters, all fixed RED-first as part of this cutover:

Drop-soundness family (four legs):
  A. lit-sub-pattern double-free — the desugar re-matched the same
     owned scrutinee in the lit fall-through; fixed by grouping
     consecutive same-ctor arms into one match (bind fields once),
     in ailang-core desugar.
  B. Cons-husk leak on non-tail arm bodies — the lit-sub-pattern
     desugar rebound the owned scrutinee via `Let $mp = xs`, which
     bumped consume_count and suppressed the existing fn-return
     partial_drop. Fixed by not rebinding a bare-Var scrutinee
     (one husk-freeing mechanism, not two).
  C. polymorphic `drop_<T>` rc_dec'd monomorphised value fields —
     the per-ADT drop fn was emitted once from the polymorphic
     TypeDef, defaulting type-var fields to ptr and rc_dec'ing
     inline Ints (segfault). Fixed with per-monomorph drop
     functions (new ailang-codegen::dropmono): the drop set is
     collected from the lowered MIR, value-type fields are skipped,
     heap fields still freed once; monomorphic-concrete ADTs keep
     their byte-identical un-suffixed drop symbol.
  D. static Str literal passed to an `(own Str)` param — the
     literal lowers to a header-less rodata constant; the callee's
     now-active rc_dec read its length field as a refcount and
     freed a static address (segfault). Fixed with the missing
     fourth StrRep::Static→Heap promotion in lower_to_mir's App arm,
     gated on Own mode (borrow args stay static, no regression).

over-strict-mode lint over-fired: it suggested `(borrow V)` for
value-typed params (which `borrow-over-value` rejects — own is the
only legal mode there) and fired on `(intrinsic)` bodies (whose
consumption the linearity walk cannot observe). Tightened to skip
both; contract 0008 updated to the narrowed firing scope.

Irreversible step — canonical-form hash reset (model 0008 §6,
acceptance criterion 6). Every signature now carries explicit modes,
so the hashable canonical JSON changed for every module. RATIFY:
the corpus-wide hash-pin reset (hash_pin, prelude_module_hash_pin,
mono_hash_stability, eq_ord_e2e, embed_export_hash_stable, the
ct4/iter*/loop_recur schema-extension pins) and the list ir_snapshot
golden were regenerated once, deliberately, as the intended one-time
consequence of removing the mode elision from the canonical form —
not a regression. Each regenerated hash verified deterministic across
two runs.

Also fixes a pre-existing latent failure surfaced by the verification
gate, unrelated to this cutover: the `every_contract_names_a_resolvable_
ratifying_test` resolver (design_index_pin) could not resolve the
" + " dual-link ratifying-test form (`uniqueness.rs + linearity.rs`)
that the #57 audit-close (dfdc65f) introduced — it shipped red on that
commit. Resolver taught the dual-link form, mirroring its sibling.

Verification: cargo test --workspace = 731 passed, 0 failed (twice,
stable); e2e 102 passed, no binary exits non-zero (corpus crash-free);
grep-clean for Implicit/fn_implicit/mode_eq across crates; every drop
fix confirmed via emitted IR + AILANG_RC_STATS balance on the head==K,
head!=K, and Nil paths. Three BLOCKEDs en route (the unsound first
husk-dec attempt, the over-strict derivation premise, the leg-B fix
direction) were each treated as a real design/spec gap and rediagnosed,
not patched over.

Supersedes #54 (return-position-only leak patch). Precondition #57
(linearity hardening) was already met. Spec docs/specs/0062, plan
docs/plans/0121.

closes #55

2026-06-02 00:03:46 +02:00

Brummel

26fb3459d8

GREEN: io/print_str byte-faithful via @fputs(@stdout) — closes #29

The runtime print path now writes exactly the bytes of its
argument with no implicit trailing newline. `io/print_str` is
byte-faithful; authors who want a newline emit `(do io/print_str
"\n")` themselves.

## Codegen

`crates/ailang-codegen/src/lib.rs`:
- Module preamble: `@puts(ptr)` → `@fputs(ptr, ptr)` plus
  `@stdout = external global ptr` (libc's `FILE *stdout`).
- Effect-op lowering for `io/print_str`: emit
  `getelementptr +8` then `load ptr, ptr @stdout` then
  `call/tail call i32 @fputs(ptr bytes, ptr fp)`. Identical
  bytes-pointer GEP, distinct sink.
- The pinned IR-shape test renames from
  `print_str_calls_puts_with_bytes_pointer` to
  `print_str_calls_fputs_with_bytes_pointer_and_stdout` and now
  asserts: bytes-GEP present, stdout-load present, both module-
  preamble declarations present, and no `@puts(` call anywhere
  in the emitted IR.

## Why this shape, and not the alternatives

- *Rename `io/print_str` to `io/println_str` (issue #29 option 2)*
  — kept the auto-newline, just relabelled it. AILang's design
  bias is explicit-over-implicit (CLAUDE.md: implicit conversions
  cut). Auto-newline is a hidden runtime augmentation; the rename
  would have preserved it. Rejected.
- *Append `\n` inside the polymorphic `print` (Show-mediated)
  function in `examples/prelude.ail`* — would have been a one-line
  fix. Rejected: `print` is the Show-mediated formatter, not a
  newline emitter; baking a newline into it would have re-imposed
  the same implicit-augmentation problem one layer up, breaking
  callers that legitimately want pure-bytes output.

## Fixture / test sweep

30 `.ail` fixtures whose owning tests asserted line-separated
stdout now emit explicit `(do io/print_str "\n")` after each
print. Tests that asserted on multi-line stdout (`show_print_e2e`,
`floats_e2e`, `str_concat_e2e`, `eq_ord_e2e`, several `print_*`
smoke tests) had their fixtures sweetened the same way; assertions
themselves remain the canonical observable output. Fixtures that
never relied on the newline (no test ever read the absence of one)
were left untouched.

## Migrated metadata

- `crates/ailang-core/tests/hash_pin.rs`: the `ordering_match::main`
  canonical hash is refreshed (`b65a7f834703ffb4` →
  `8ed47b4062ce00f5`). The comment now names both successive
  corpus migrations honestly: the per-type-print-retirement (which
  moved `(do io/print_int x)` to `(app print x)`) AND this
  fputs swap (which wrapped that with `(seq ... (do io/print_str
  "\n"))`).
- `design/contracts/str-abi.md`: the consumer-ABI table now lists
  `@fputs` as the print sink. A prose paragraph documents the
  byte-faithful semantics and references this issue.
- `examples/ordering_match.prose.txt`: regenerated from the
  updated `ordering_match.ail`.
- `crates/ail/tests/snapshots/{hello,sum,max3,list,ws_main}.ll`:
  IR snapshots regenerated via `UPDATE_SNAPSHOTS=1`.
- Stale `@puts` comments in `runtime/str.c`,
  `crates/ail/tests/{e2e,show_print_e2e,print_no_leak_pin}.rs`
  replaced with `@fputs`.

## Verification

- `cargo test -p ail --test print_str_no_auto_newline_e2e` — both
  RED tests from commit c8ecfa3 now pass.
- `cargo test --workspace` — 90 test groups GREEN, 0 failures.
- `cargo build --workspace` — GREEN.
- No new clippy lints (24 warnings pre-existing in
  `crates/ailang-core/src/lib.rs:129`).
- Stats: `bench/orchestrator-stats/2026-05-21-iter-bugfix-print-
  str-fputs.json` — 1/1 tasks, 0 re-loops, 0 review loops.

## Empirical evidence cited

Caught in the 2026-05-21 Qwen3-Coder naming-A/B run
(`experiments/2026-05-21-naming-ab/runs/r1/`): every cohort wrote
`(do io/print_str "...\n")` with explicit `\n` and got doubled
newlines, failing the `t3_main_prints` stdout match across all
three cohorts. The empirical LLM-natural form already assumes the
new (post-this-commit) semantics — confirming the
feature-acceptance test in CLAUDE.md.

closes #29

2026-05-21 12:22:45 +02:00

Brummel

e7e67e1a40

iter str-concat: heap-Str concatenation primitive in four-site lockstep

Closes fieldtest-form-a friction finding #4. `str_concat : (borrow Str,
borrow Str) -> Str` ships in the four-site-lockstep pattern established
by `str_clone` / `int_to_str` / `bool_to_str` (iter 24.1). The
LLM-natural Show-MyType body
`(app str_concat "label=" (app int_to_str x))` now parses, checks,
builds, and runs end-to-end.

Sites touched (lockstep):
- runtime/str.c — `ailang_str_concat(a, b)` slab-allocates and
  memcpys both source payloads into a new heap-Str.
- ailang-check/src/builtins.rs — `env.globals.insert("str_concat",
  Fn { 2x Str borrow, ret Str own, effects [] })` + `list()` row +
  `install_str_concat_signature` unit test.
- ailang-codegen/src/lib.rs — `declare ptr @ailang_str_concat(ptr,
  ptr)` extern + `lower_app` arm after str_clone + `is_builtin_callable`
  extension + IR-pin unit test `str_concat_emits_call_to_ailang_str_concat`.
- examples/show_user_adt_with_label.ail (new) + crates/ail/tests/
  str_concat_e2e.rs (new) — corpus fixture exercising the LLM-natural
  Show body shape + E2E pin asserting check + build + run produce
  `Item 42\n`.

Lockstep collision repaired: examples/bug_unbound_in_instance_method.ail
used `str_concat` as its UNBOUND name (because that was the literal
fieldtester repro). Renamed to `format_label` (LLM-author-realistic
helper name that will never become a builtin) and updated the pin test
`crates/ail/tests/unbound_in_instance_method_pin.rs` accordingly,
preserving the regression guard's intent (instance-method-body walked
through unbound-var check).

DESIGN.md amended: new §"Heap-Str primitives" subsection between the
milestone-24 Show-backer enumeration and the existing
`Primitive output goes through ...` paragraph, cataloguing all five
heap-Str primitives (`int_to_str`, `bool_to_str`, `float_to_str`,
`str_clone`, `str_concat`) with signatures, iter origins, and the
user-visible-vs-prelude-internal distinction. Show-backer block
unchanged.

IR snapshots regenerated (hello, list, max3, sum, ws_main) to absorb
the new `declare ptr @ailang_str_concat(ptr, ptr)` line in the
unconditional extern header — same upkeep pattern as hs.4 which
regenerated the same 5 snapshots for the same reason
(unconditional declares dead-stripped by clang -O2 when unused).

Tests: 559 + 3 = 562 green (E2E pin + builtin-signature test + IR-pin
test). Zero re-loops across all 7 tasks.

2026-05-13 12:43:10 +02:00

3 Commits