AILang

Author SHA1 Message Date

Author	SHA1	Message	Date
Brummel	76b21c00eb	feat(lang): eliminate the Implicit ownership default — totality + the drop-soundness it demasks (#55 ) Deletes `ParamMode::Implicit`. `ParamMode` is now `{Own, Borrow}`: every fn-type slot on every signature carries an explicit `own` or `borrow`, no defaulted position survives anywhere (model 0008 §2, spec 0062). The parser rejects a bare fn-type slot; `borrow-return` and `borrow-over-value` reject at the signature; the corpus is migrated to minimal-ownership modes (consumed ⇒ own, read-only-heap ⇒ borrow, value ⇒ trivial-own). The documented `Implicit`-ret-mode leak is fixed: an owned heap return now drops exactly once (live=0, acceptance criterion 5). This was the easy half. Removing the default ACTIVATED a family of drop paths that `Implicit` had silently skipped — the pre-cutover language was leaking (and in places mis-dropping) here rather than crashing, because an Implicit scrutinee turned the drop off. Making the modes explicit (Own) turned those paths on and exposed two latent-bug clusters, all fixed RED-first as part of this cutover: Drop-soundness family (four legs): A. lit-sub-pattern double-free — the desugar re-matched the same owned scrutinee in the lit fall-through; fixed by grouping consecutive same-ctor arms into one match (bind fields once), in ailang-core desugar. B. Cons-husk leak on non-tail arm bodies — the lit-sub-pattern desugar rebound the owned scrutinee via `Let $mp = xs`, which bumped consume_count and suppressed the existing fn-return partial_drop. Fixed by not rebinding a bare-Var scrutinee (one husk-freeing mechanism, not two). C. polymorphic `drop_<T>` rc_dec'd monomorphised value fields — the per-ADT drop fn was emitted once from the polymorphic TypeDef, defaulting type-var fields to ptr and rc_dec'ing inline Ints (segfault). Fixed with per-monomorph drop functions (new ailang-codegen::dropmono): the drop set is collected from the lowered MIR, value-type fields are skipped, heap fields still freed once; monomorphic-concrete ADTs keep their byte-identical un-suffixed drop symbol. D. static Str literal passed to an `(own Str)` param — the literal lowers to a header-less rodata constant; the callee's now-active rc_dec read its length field as a refcount and freed a static address (segfault). Fixed with the missing fourth StrRep::Static→Heap promotion in lower_to_mir's App arm, gated on Own mode (borrow args stay static, no regression). over-strict-mode lint over-fired: it suggested `(borrow V)` for value-typed params (which `borrow-over-value` rejects — own is the only legal mode there) and fired on `(intrinsic)` bodies (whose consumption the linearity walk cannot observe). Tightened to skip both; contract 0008 updated to the narrowed firing scope. Irreversible step — canonical-form hash reset (model 0008 §6, acceptance criterion 6). Every signature now carries explicit modes, so the hashable canonical JSON changed for every module. RATIFY: the corpus-wide hash-pin reset (hash_pin, prelude_module_hash_pin, mono_hash_stability, eq_ord_e2e, embed_export_hash_stable, the ct4/iter*/loop_recur schema-extension pins) and the list ir_snapshot golden were regenerated once, deliberately, as the intended one-time consequence of removing the mode elision from the canonical form — not a regression. Each regenerated hash verified deterministic across two runs. Also fixes a pre-existing latent failure surfaced by the verification gate, unrelated to this cutover: the `every_contract_names_a_resolvable_ ratifying_test` resolver (design_index_pin) could not resolve the " + " dual-link ratifying-test form (`uniqueness.rs + linearity.rs`) that the #57 audit-close (`dfdc65f`) introduced — it shipped red on that commit. Resolver taught the dual-link form, mirroring its sibling. Verification: cargo test --workspace = 731 passed, 0 failed (twice, stable); e2e 102 passed, no binary exits non-zero (corpus crash-free); grep-clean for Implicit/fn_implicit/mode_eq across crates; every drop fix confirmed via emitted IR + AILANG_RC_STATS balance on the head==K, head!=K, and Nil paths. Three BLOCKEDs en route (the unsound first husk-dec attempt, the over-strict derivation premise, the leg-B fix direction) were each treated as a real design/spec gap and rediagnosed, not patched over. Supersedes #54 (return-position-only leak patch). Precondition #57 (linearity hardening) was already met. Spec docs/specs/0062, plan docs/plans/0121. closes #55	2026-06-02 00:03:46 +02:00
Brummel	13e590cb46	iter raw-buf.6 kernel-stub-retirement (DONE 5/5): retire the stub, raw_buf is the sole base extension (refs #7 ) Closes the raw-buf milestone. raw_buf (shipped raw-buf.1-.5; the owned-drop resolution landed under bug #42/#43) has subsumed every ratification role kernel_stub held -- Term::New end-to-end, the param-in reject, kernel-tier auto-import, the monomorphic intrinsic path, and the type-scoped polymorphic intrinsic mechanism (RawBuf's four ops). The stub is now redundant; this iteration removes it. Pure removal (-636/+49 across 22 files, 7 deleted): - Rust surface: drop `mod kernel_stub` + `STUB_AIL` re-export (ailang-kernel), `parse_kernel_stub` + its workspace injection (ailang-surface), the `answer` + two `StubT_peek__{Int,Float}` INTERCEPTS entries + their three emit fns (ailang-codegen). The (intrinsic) markers leave with the deleted source, so the marker<->entry bijection holds in lockstep. - Source + tests: delete crates/ailang-kernel/src/kernel_stub/, kernel_stub_module_round_trips, the two stub-consumer e2e tests, and mono_scoped_symbol.rs (its scope-qualified-mono mechanism is now pinned by RawBuf's ops + the intercepts bijection). - Fixtures: delete kernel_answer.ail, new_stubt_smoke.ail, peek_mono_pin_smoke.ail, and fieldtest kem_3_stub_consumer.ail (referenced the deleted StubT; documented a since-fixed bug). - Pins: re-baseline both workspace-count content-pins 5 -> 4 (workspace_pin.rs + the e2e.rs twin) and regenerate all five IR snapshots (400 stub-IR lines removed; no user IR changed -- the stub auto-injected into every build). - Ledger: design/INDEX.md + design/models/0007 to present-state (raw_buf is the live ratifier; raw-buf milestone shipped, series pending), plus architecture-comment sweep across workspace.rs, mono.rs, check/codegen lib.rs, workspace_kernel.rs. Scope decisions (orchestrator, pre-plan): the self-contained inline serde_json check-layer fixtures in ailang-check/src/lib.rs keep their incidental StubT/kernel_stub sample names (they construct what they reference; not stub-ratification) -- the one permitted residual. kem_4 fieldtest kept (uses a user NumBox ADT, comment-only edit). hash.rs `name: "answer"` left (generic serde doc example). Plan-gap caught at implement: the planner's verbatim edit list under-enumerated four honesty sites; one (mono.rs:562) carried a literal `StubT_peek__Int` -- a hard-gate symbol the verbatim list missed, which would have failed Task 4's removal gate. Filled (comment-only, no behaviour). Confirms the planner self-review filter-completeness risk; the implement gate caught it. Verification: full workspace suite green (0 failed); hard symbol gate (STUB_AIL\|parse_kernel_stub\|emit_answer\|emit_stubt_peek\|StubT_peek__) zero matches across crates/ examples/ design/; soft gate residual only the kept inline fixtures; kernel crate is lib.rs + raw_buf/ only. Regression: compile_check 24/24 stable (exit 0; uniform downward check_ms within tol -- stub no longer parsed per compile), cross_lang 25/25, check 34/34 stable (exit 0; an earlier exit-1 on rc_over_bump was machine-load ratio noise -- denominator bump_s got faster, rc_s also improved -- confirmed green on re-run, not baselined).	2026-05-30 16:07:29 +02:00
Brummel	9339279181	iter prep.3-kernel-tier-modules (DONE 9/9): kernel-tier modules + param-in + stub crate — closes #33 Terminal iteration of the kernel-extension-mechanics milestone. Ships the four language-level mechanisms named in the spec's § Goal: Module.kernel + TypeDef.param-in schema, their Form-A surface, flag-driven kernel-tier auto-injection, and generic param-in checker enforcement with a new diagnostic. Schema (Tasks 1+2). Module gains a `kernel: bool` field (skip_serializing_if = is_false), TypeDef gains a `param_in: BTreeMap<String, BTreeSet<String>>` field (skip-if-empty, kebab-renamed to "param-in"). Both fields are strictly additive — every pre-existing fixture's canonical-JSON hash is bit-stable except `prelude.ail`, which intentionally gains `(kernel)`. The struct-literal sweep covered ~104 Module sites and ~35 TypeDef sites across the workspace; the additive serde-default covers JSON deserialise paths, only Rust struct literals broke. Form-A surface (Tasks 3+4). `(kernel)` is a bare module-header attribute; `(param-in (a Int Float) (b Str))` is one outer TypeDef-body clause carrying one or more inner var-lists (OQ1 decision — mirrors `(ctors …)`, one parser arm, deterministic BTreeMap iteration). Both round-trip Form-A → JSON → Form-A bit-identical. Workspace-load migration (Task 5). The hardcoded `&["prelude"]` literal at loader.rs:108 became a `modules.values().filter(\|m\| m.kernel)` derivation; `parse_prelude()` injection stays because the prelude has no on-disk manifest in user workspaces. Prelude now carries `(kernel)` in its source, so the new filter picks it up automatically. Code-path migration only — observable behaviour is identical (prelude_free_fns.rs stays green). prelude hash re-pinned (af372f28c726f29f) with Honesty-Rule provenance comment. WorkspaceLoadError::ReservedModuleName diagnostic prose repurposed: any built-in kernel module name is reserved (currently prelude + kernel_stub), not specifically prelude. CLI mapping at main.rs updated in lockstep. Stub crate (Task 6). New `crates/ailang-kernel-stub/` is a zero-dependency leaf crate carrying only `pub const STUB_AIL: &str` with the Form-A source of the kernel_stub module (one parametric TypeDef with param-in, one ctor). The parse hop — `parse_kernel_stub()` — lives in ailang-surface next to parse_prelude, keeping the crate-dependency graph acyclic (`ailang-surface → ailang-kernel-stub → ailang-core`, no back-edge). The stub is injected unconditionally in all builds as the ratifying fixture for the kernel-extension mechanism; future base extensions may add more or retire the stub. Drift-pinned by `kernel_stub_module_round_trips`. Checker (Task 7). New `CheckError::ParamNotInRestrictedSet` variant + code() + ctx() arms + enforcement in `check_type_well_formed`'s Type::Con arm — generic, data-driven from the TypeDef, mentions no specific extension type. Two in-source tests pin both the rejection (`Str` outside `{Int, Float}`) and the acceptance (`Int` inside) paths. Workspace-load integration tests (Task 8). New `workspace_kernel.rs` integration-test crate with three tests: auto-import without explicit `(import …)` declaration, two kernel-tier modules co-load, explicit-import-overrides-auto- import precedence preserved. Loader is import-tree-only so the auto-import tests use a bridge module that brings the kernel module into the workspace via the import graph — docstring captures the reachability nuance for future readers. Doc-state transitions (Task 9). INDEX.md kernel-extensions row annotation transitions from "design accepted 2026-05-28; impl in progress" to "mechanisms milestone closed 2026-05-28; raw-buf and series milestones pending". Whitepaper STATUS + auto-import + param-in sections transitioned forward→present for shipped mechanisms; forward-tense survives only in sections describing the still-pending raw-buf/series milestones (per Honesty-Rule). data-model contract gains anchor blocks for both new schema fields. Side-effect: every binary's IR snapshot now contains ~52 lines for `drop_kernel_stub_StubT` because the stub is auto-injected into every workspace load. Snapshots refreshed; e2e expects 4 modules per workspace (prelude + kernel_stub + entry + zero or more user modules) instead of the previous 3. Plan defects scrubbed in the implementation (folded back into the planner template via the planner's self-review checklist next time): Task 4 sample test src used fictional `(ctors (MkT a))` list form (project grammar is per-`(ctor MkT a)`); Task 6 original wiring would have created a cycle ailang-surface → ailang-kernel-stub → ailang-surface (inverted — stub crate is zero-dep, parse hop lives in surface); Task 7 in- source tests referenced a fictional `check_type_in_module` helper (used the existing Workspace + check_workspace convention); Task 8 first integration test expected loader to auto-load kernel modules from disk (loader is import-tree-only; tests use a bridge module). Concern-5 fix folded in pre-commit: workspace.rs ReservedModuleName doc-prose initially said "in test/dev builds" for kernel_stub — but stub is unconditionally injected in all builds. Doc copy tightened to present-state per Honesty-Rule. Stats: 0 spec-review-loops, 0 quality-review-loops, 2 sweep-script retries on Task 2 (brace-depth bug on nested vec![Ctor{…}], recovered via per-file checkout + rewritten anchor-on-existing- field sweep), 1 e2e-snapshot refresh on Task 6.	2026-05-28 18:43:42 +02:00

76b21c00eb

feat(lang): eliminate the Implicit ownership default — totality + the drop-soundness it demasks (#55 )

Deletes `ParamMode::Implicit`. `ParamMode` is now `{Own, Borrow}`:
every fn-type slot on every signature carries an explicit `own` or
`borrow`, no defaulted position survives anywhere (model 0008 §2,
spec 0062). The parser rejects a bare fn-type slot; `borrow-return`
and `borrow-over-value` reject at the signature; the corpus is
migrated to minimal-ownership modes (consumed ⇒ own, read-only-heap
⇒ borrow, value ⇒ trivial-own). The documented `Implicit`-ret-mode
leak is fixed: an owned heap return now drops exactly once (live=0,
acceptance criterion 5).

This was the easy half. Removing the default ACTIVATED a family of
drop paths that `Implicit` had silently skipped — the pre-cutover
language was leaking (and in places mis-dropping) here rather than
crashing, because an Implicit scrutinee turned the drop off. Making
the modes explicit (Own) turned those paths on and exposed two
latent-bug clusters, all fixed RED-first as part of this cutover:

Drop-soundness family (four legs):
  A. lit-sub-pattern double-free — the desugar re-matched the same
     owned scrutinee in the lit fall-through; fixed by grouping
     consecutive same-ctor arms into one match (bind fields once),
     in ailang-core desugar.
  B. Cons-husk leak on non-tail arm bodies — the lit-sub-pattern
     desugar rebound the owned scrutinee via `Let $mp = xs`, which
     bumped consume_count and suppressed the existing fn-return
     partial_drop. Fixed by not rebinding a bare-Var scrutinee
     (one husk-freeing mechanism, not two).
  C. polymorphic `drop_<T>` rc_dec'd monomorphised value fields —
     the per-ADT drop fn was emitted once from the polymorphic
     TypeDef, defaulting type-var fields to ptr and rc_dec'ing
     inline Ints (segfault). Fixed with per-monomorph drop
     functions (new ailang-codegen::dropmono): the drop set is
     collected from the lowered MIR, value-type fields are skipped,
     heap fields still freed once; monomorphic-concrete ADTs keep
     their byte-identical un-suffixed drop symbol.
  D. static Str literal passed to an `(own Str)` param — the
     literal lowers to a header-less rodata constant; the callee's
     now-active rc_dec read its length field as a refcount and
     freed a static address (segfault). Fixed with the missing
     fourth StrRep::Static→Heap promotion in lower_to_mir's App arm,
     gated on Own mode (borrow args stay static, no regression).

over-strict-mode lint over-fired: it suggested `(borrow V)` for
value-typed params (which `borrow-over-value` rejects — own is the
only legal mode there) and fired on `(intrinsic)` bodies (whose
consumption the linearity walk cannot observe). Tightened to skip
both; contract 0008 updated to the narrowed firing scope.

Irreversible step — canonical-form hash reset (model 0008 §6,
acceptance criterion 6). Every signature now carries explicit modes,
so the hashable canonical JSON changed for every module. RATIFY:
the corpus-wide hash-pin reset (hash_pin, prelude_module_hash_pin,
mono_hash_stability, eq_ord_e2e, embed_export_hash_stable, the
ct4/iter*/loop_recur schema-extension pins) and the list ir_snapshot
golden were regenerated once, deliberately, as the intended one-time
consequence of removing the mode elision from the canonical form —
not a regression. Each regenerated hash verified deterministic across
two runs.

Also fixes a pre-existing latent failure surfaced by the verification
gate, unrelated to this cutover: the `every_contract_names_a_resolvable_
ratifying_test` resolver (design_index_pin) could not resolve the
" + " dual-link ratifying-test form (`uniqueness.rs + linearity.rs`)
that the #57 audit-close (dfdc65f) introduced — it shipped red on that
commit. Resolver taught the dual-link form, mirroring its sibling.

Verification: cargo test --workspace = 731 passed, 0 failed (twice,
stable); e2e 102 passed, no binary exits non-zero (corpus crash-free);
grep-clean for Implicit/fn_implicit/mode_eq across crates; every drop
fix confirmed via emitted IR + AILANG_RC_STATS balance on the head==K,
head!=K, and Nil paths. Three BLOCKEDs en route (the unsound first
husk-dec attempt, the over-strict derivation premise, the leg-B fix
direction) were each treated as a real design/spec gap and rediagnosed,
not patched over.

Supersedes #54 (return-position-only leak patch). Precondition #57
(linearity hardening) was already met. Spec docs/specs/0062, plan
docs/plans/0121.

closes #55

2026-06-02 00:03:46 +02:00

Brummel

13e590cb46

iter raw-buf.6 kernel-stub-retirement (DONE 5/5): retire the stub, raw_buf is the sole base extension (refs #7 )

Closes the raw-buf milestone. raw_buf (shipped raw-buf.1-.5; the
owned-drop resolution landed under bug #42/#43) has subsumed every
ratification role kernel_stub held -- Term::New end-to-end, the
param-in reject, kernel-tier auto-import, the monomorphic intrinsic
path, and the type-scoped polymorphic intrinsic mechanism (RawBuf's
four ops). The stub is now redundant; this iteration removes it.

Pure removal (-636/+49 across 22 files, 7 deleted):
- Rust surface: drop `mod kernel_stub` + `STUB_AIL` re-export
  (ailang-kernel), `parse_kernel_stub` + its workspace injection
  (ailang-surface), the `answer` + two `StubT_peek__{Int,Float}`
  INTERCEPTS entries + their three emit fns (ailang-codegen). The
  (intrinsic) markers leave with the deleted source, so the
  marker<->entry bijection holds in lockstep.
- Source + tests: delete crates/ailang-kernel/src/kernel_stub/,
  kernel_stub_module_round_trips, the two stub-consumer e2e tests,
  and mono_scoped_symbol.rs (its scope-qualified-mono mechanism is
  now pinned by RawBuf's ops + the intercepts bijection).
- Fixtures: delete kernel_answer.ail, new_stubt_smoke.ail,
  peek_mono_pin_smoke.ail, and fieldtest kem_3_stub_consumer.ail
  (referenced the deleted StubT; documented a since-fixed bug).
- Pins: re-baseline both workspace-count content-pins 5 -> 4
  (workspace_pin.rs + the e2e.rs twin) and regenerate all five IR
  snapshots (400 stub-IR lines removed; no user IR changed -- the
  stub auto-injected into every build).
- Ledger: design/INDEX.md + design/models/0007 to present-state
  (raw_buf is the live ratifier; raw-buf milestone shipped, series
  pending), plus architecture-comment sweep across workspace.rs,
  mono.rs, check/codegen lib.rs, workspace_kernel.rs.

Scope decisions (orchestrator, pre-plan): the self-contained inline
serde_json check-layer fixtures in ailang-check/src/lib.rs keep their
incidental StubT/kernel_stub sample names (they construct what they
reference; not stub-ratification) -- the one permitted residual.
kem_4 fieldtest kept (uses a user NumBox ADT, comment-only edit).
hash.rs `name: "answer"` left (generic serde doc example).

Plan-gap caught at implement: the planner's verbatim edit list
under-enumerated four honesty sites; one (mono.rs:562) carried a
literal `StubT_peek__Int` -- a hard-gate symbol the verbatim list
missed, which would have failed Task 4's removal gate. Filled
(comment-only, no behaviour). Confirms the planner self-review
filter-completeness risk; the implement gate caught it.

Verification: full workspace suite green (0 failed); hard symbol gate
(STUB_AIL|parse_kernel_stub|emit_answer|emit_stubt_peek|StubT_peek__)
zero matches across crates/ examples/ design/; soft gate residual only
the kept inline fixtures; kernel crate is lib.rs + raw_buf/ only.
Regression: compile_check 24/24 stable (exit 0; uniform downward
check_ms within tol -- stub no longer parsed per compile), cross_lang
25/25, check 34/34 stable (exit 0; an earlier exit-1 on
rc_over_bump was machine-load ratio noise -- denominator bump_s got
faster, rc_s also improved -- confirmed green on re-run, not
baselined).

2026-05-30 16:07:29 +02:00

Brummel

9339279181

iter prep.3-kernel-tier-modules (DONE 9/9): kernel-tier modules + param-in + stub crate — closes #33

Terminal iteration of the kernel-extension-mechanics milestone. Ships
the four language-level mechanisms named in the spec's § Goal:
Module.kernel + TypeDef.param-in schema, their Form-A surface,
flag-driven kernel-tier auto-injection, and generic param-in checker
enforcement with a new diagnostic.

Schema (Tasks 1+2). Module gains a `kernel: bool` field
(skip_serializing_if = is_false), TypeDef gains a
`param_in: BTreeMap<String, BTreeSet<String>>` field
(skip-if-empty, kebab-renamed to "param-in"). Both fields are
strictly additive — every pre-existing fixture's canonical-JSON hash
is bit-stable except `prelude.ail`, which intentionally gains
`(kernel)`. The struct-literal sweep covered ~104 Module sites and
~35 TypeDef sites across the workspace; the additive serde-default
covers JSON deserialise paths, only Rust struct literals broke.

Form-A surface (Tasks 3+4). `(kernel)` is a bare module-header
attribute; `(param-in (a Int Float) (b Str))` is one outer
TypeDef-body clause carrying one or more inner var-lists (OQ1
decision — mirrors `(ctors …)`, one parser arm, deterministic
BTreeMap iteration). Both round-trip Form-A → JSON → Form-A
bit-identical.

Workspace-load migration (Task 5). The hardcoded `&["prelude"]`
literal at loader.rs:108 became a `modules.values().filter(|m|
m.kernel)` derivation; `parse_prelude()` injection stays because
the prelude has no on-disk manifest in user workspaces. Prelude
now carries `(kernel)` in its source, so the new filter picks it
up automatically. Code-path migration only — observable behaviour
is identical (prelude_free_fns.rs stays green). prelude hash
re-pinned (af372f28c726f29f) with Honesty-Rule provenance comment.
WorkspaceLoadError::ReservedModuleName diagnostic prose
repurposed: any built-in kernel module name is reserved
(currently prelude + kernel_stub), not specifically prelude. CLI
mapping at main.rs updated in lockstep.

Stub crate (Task 6). New `crates/ailang-kernel-stub/` is a
zero-dependency leaf crate carrying only `pub const STUB_AIL:
&str` with the Form-A source of the kernel_stub module (one
parametric TypeDef with param-in, one ctor). The parse hop —
`parse_kernel_stub()` — lives in ailang-surface next to
parse_prelude, keeping the crate-dependency graph acyclic
(`ailang-surface → ailang-kernel-stub → ailang-core`, no
back-edge). The stub is injected unconditionally in all builds as
the ratifying fixture for the kernel-extension mechanism; future
base extensions may add more or retire the stub. Drift-pinned by
`kernel_stub_module_round_trips`.

Checker (Task 7). New `CheckError::ParamNotInRestrictedSet`
variant + code() + ctx() arms + enforcement in
`check_type_well_formed`'s Type::Con arm — generic, data-driven
from the TypeDef, mentions no specific extension type. Two
in-source tests pin both the rejection (`Str` outside `{Int,
Float}`) and the acceptance (`Int` inside) paths.

Workspace-load integration tests (Task 8). New
`workspace_kernel.rs` integration-test crate with three tests:
auto-import without explicit `(import …)` declaration, two
kernel-tier modules co-load, explicit-import-overrides-auto-
import precedence preserved. Loader is import-tree-only so the
auto-import tests use a bridge module that brings the kernel
module into the workspace via the import graph — docstring
captures the reachability nuance for future readers.

Doc-state transitions (Task 9). INDEX.md kernel-extensions row
annotation transitions from "design accepted 2026-05-28; impl in
progress" to "mechanisms milestone closed 2026-05-28; raw-buf and
series milestones pending". Whitepaper STATUS + auto-import +
param-in sections transitioned forward→present for shipped
mechanisms; forward-tense survives only in sections describing
the still-pending raw-buf/series milestones (per Honesty-Rule).
data-model contract gains anchor blocks for both new schema
fields.

Side-effect: every binary's IR snapshot now contains ~52 lines
for `drop_kernel_stub_StubT` because the stub is auto-injected
into every workspace load. Snapshots refreshed; e2e expects 4
modules per workspace (prelude + kernel_stub + entry + zero or
more user modules) instead of the previous 3.

Plan defects scrubbed in the implementation (folded back into
the planner template via the planner's self-review checklist
next time): Task 4 sample test src used fictional
`(ctors (MkT a))` list form (project grammar is per-`(ctor MkT
a)`); Task 6 original wiring would have created a cycle
ailang-surface → ailang-kernel-stub → ailang-surface (inverted —
stub crate is zero-dep, parse hop lives in surface); Task 7 in-
source tests referenced a fictional `check_type_in_module`
helper (used the existing Workspace + check_workspace
convention); Task 8 first integration test expected loader to
auto-load kernel modules from disk (loader is import-tree-only;
tests use a bridge module).

Concern-5 fix folded in pre-commit: workspace.rs ReservedModuleName
doc-prose initially said "in test/dev builds" for kernel_stub —
but stub is unconditionally injected in all builds. Doc copy
tightened to present-state per Honesty-Rule.

Stats: 0 spec-review-loops, 0 quality-review-loops, 2 sweep-script
retries on Task 2 (brace-depth bug on nested vec![Ctor{…}],
recovered via per-file checkout + rewritten anchor-on-existing-
field sweep), 1 e2e-snapshot refresh on Task 6.

2026-05-28 18:43:42 +02:00

3 Commits