AILang

Author SHA1 Message Date

Author	SHA1	Message	Date
Brummel	76b21c00eb	feat(lang): eliminate the Implicit ownership default — totality + the drop-soundness it demasks (#55 ) Deletes `ParamMode::Implicit`. `ParamMode` is now `{Own, Borrow}`: every fn-type slot on every signature carries an explicit `own` or `borrow`, no defaulted position survives anywhere (model 0008 §2, spec 0062). The parser rejects a bare fn-type slot; `borrow-return` and `borrow-over-value` reject at the signature; the corpus is migrated to minimal-ownership modes (consumed ⇒ own, read-only-heap ⇒ borrow, value ⇒ trivial-own). The documented `Implicit`-ret-mode leak is fixed: an owned heap return now drops exactly once (live=0, acceptance criterion 5). This was the easy half. Removing the default ACTIVATED a family of drop paths that `Implicit` had silently skipped — the pre-cutover language was leaking (and in places mis-dropping) here rather than crashing, because an Implicit scrutinee turned the drop off. Making the modes explicit (Own) turned those paths on and exposed two latent-bug clusters, all fixed RED-first as part of this cutover: Drop-soundness family (four legs): A. lit-sub-pattern double-free — the desugar re-matched the same owned scrutinee in the lit fall-through; fixed by grouping consecutive same-ctor arms into one match (bind fields once), in ailang-core desugar. B. Cons-husk leak on non-tail arm bodies — the lit-sub-pattern desugar rebound the owned scrutinee via `Let $mp = xs`, which bumped consume_count and suppressed the existing fn-return partial_drop. Fixed by not rebinding a bare-Var scrutinee (one husk-freeing mechanism, not two). C. polymorphic `drop_<T>` rc_dec'd monomorphised value fields — the per-ADT drop fn was emitted once from the polymorphic TypeDef, defaulting type-var fields to ptr and rc_dec'ing inline Ints (segfault). Fixed with per-monomorph drop functions (new ailang-codegen::dropmono): the drop set is collected from the lowered MIR, value-type fields are skipped, heap fields still freed once; monomorphic-concrete ADTs keep their byte-identical un-suffixed drop symbol. D. static Str literal passed to an `(own Str)` param — the literal lowers to a header-less rodata constant; the callee's now-active rc_dec read its length field as a refcount and freed a static address (segfault). Fixed with the missing fourth StrRep::Static→Heap promotion in lower_to_mir's App arm, gated on Own mode (borrow args stay static, no regression). over-strict-mode lint over-fired: it suggested `(borrow V)` for value-typed params (which `borrow-over-value` rejects — own is the only legal mode there) and fired on `(intrinsic)` bodies (whose consumption the linearity walk cannot observe). Tightened to skip both; contract 0008 updated to the narrowed firing scope. Irreversible step — canonical-form hash reset (model 0008 §6, acceptance criterion 6). Every signature now carries explicit modes, so the hashable canonical JSON changed for every module. RATIFY: the corpus-wide hash-pin reset (hash_pin, prelude_module_hash_pin, mono_hash_stability, eq_ord_e2e, embed_export_hash_stable, the ct4/iter*/loop_recur schema-extension pins) and the list ir_snapshot golden were regenerated once, deliberately, as the intended one-time consequence of removing the mode elision from the canonical form — not a regression. Each regenerated hash verified deterministic across two runs. Also fixes a pre-existing latent failure surfaced by the verification gate, unrelated to this cutover: the `every_contract_names_a_resolvable_ ratifying_test` resolver (design_index_pin) could not resolve the " + " dual-link ratifying-test form (`uniqueness.rs + linearity.rs`) that the #57 audit-close (`dfdc65f`) introduced — it shipped red on that commit. Resolver taught the dual-link form, mirroring its sibling. Verification: cargo test --workspace = 731 passed, 0 failed (twice, stable); e2e 102 passed, no binary exits non-zero (corpus crash-free); grep-clean for Implicit/fn_implicit/mode_eq across crates; every drop fix confirmed via emitted IR + AILANG_RC_STATS balance on the head==K, head!=K, and Nil paths. Three BLOCKEDs en route (the unsound first husk-dec attempt, the over-strict derivation premise, the leg-B fix direction) were each treated as a real design/spec gap and rediagnosed, not patched over. Supersedes #54 (return-position-only leak patch). Precondition #57 (linearity hardening) was already met. Spec docs/specs/0062, plan docs/plans/0121. closes #55	2026-06-02 00:03:46 +02:00
Brummel	26fb3459d8	GREEN: io/print_str byte-faithful via @fputs(@stdout) — closes #29 The runtime print path now writes exactly the bytes of its argument with no implicit trailing newline. `io/print_str` is byte-faithful; authors who want a newline emit `(do io/print_str "\n")` themselves. ## Codegen `crates/ailang-codegen/src/lib.rs`: - Module preamble: `@puts(ptr)` → `@fputs(ptr, ptr)` plus `@stdout = external global ptr` (libc's `FILE stdout`). - Effect-op lowering for `io/print_str`: emit `getelementptr +8` then `load ptr, ptr @stdout` then `call/tail call i32 @fputs(ptr bytes, ptr fp)`. Identical bytes-pointer GEP, distinct sink. - The pinned IR-shape test renames from `print_str_calls_puts_with_bytes_pointer` to `print_str_calls_fputs_with_bytes_pointer_and_stdout` and now asserts: bytes-GEP present, stdout-load present, both module- preamble declarations present, and no `@puts(` call anywhere in the emitted IR. ## Why this shape, and not the alternatives - Rename `io/print_str` to `io/println_str` (issue #29 option 2)* — kept the auto-newline, just relabelled it. AILang's design bias is explicit-over-implicit (CLAUDE.md: implicit conversions cut). Auto-newline is a hidden runtime augmentation; the rename would have preserved it. Rejected. - Append `\n` inside the polymorphic `print` (Show-mediated) function in `examples/prelude.ail` — would have been a one-line fix. Rejected: `print` is the Show-mediated formatter, not a newline emitter; baking a newline into it would have re-imposed the same implicit-augmentation problem one layer up, breaking callers that legitimately want pure-bytes output. ## Fixture / test sweep 30 `.ail` fixtures whose owning tests asserted line-separated stdout now emit explicit `(do io/print_str "\n")` after each print. Tests that asserted on multi-line stdout (`show_print_e2e`, `floats_e2e`, `str_concat_e2e`, `eq_ord_e2e`, several `print_*` smoke tests) had their fixtures sweetened the same way; assertions themselves remain the canonical observable output. Fixtures that never relied on the newline (no test ever read the absence of one) were left untouched. ## Migrated metadata - `crates/ailang-core/tests/hash_pin.rs`: the `ordering_match::main` canonical hash is refreshed (`b65a7f834703ffb4` → `8ed47b4062ce00f5`). The comment now names both successive corpus migrations honestly: the per-type-print-retirement (which moved `(do io/print_int x)` to `(app print x)`) AND this fputs swap (which wrapped that with `(seq ... (do io/print_str "\n"))`). - `design/contracts/str-abi.md`: the consumer-ABI table now lists `@fputs` as the print sink. A prose paragraph documents the byte-faithful semantics and references this issue. - `examples/ordering_match.prose.txt`: regenerated from the updated `ordering_match.ail`. - `crates/ail/tests/snapshots/{hello,sum,max3,list,ws_main}.ll`: IR snapshots regenerated via `UPDATE_SNAPSHOTS=1`. - Stale `@puts` comments in `runtime/str.c`, `crates/ail/tests/{e2e,show_print_e2e,print_no_leak_pin}.rs` replaced with `@fputs`. ## Verification - `cargo test -p ail --test print_str_no_auto_newline_e2e` — both RED tests from commit `c8ecfa3` now pass. - `cargo test --workspace` — 90 test groups GREEN, 0 failures. - `cargo build --workspace` — GREEN. - No new clippy lints (24 warnings pre-existing in `crates/ailang-core/src/lib.rs:129`). - Stats: `bench/orchestrator-stats/2026-05-21-iter-bugfix-print- str-fputs.json` — 1/1 tasks, 0 re-loops, 0 review loops. ## Empirical evidence cited Caught in the 2026-05-21 Qwen3-Coder naming-A/B run (`experiments/2026-05-21-naming-ab/runs/r1/`): every cohort wrote `(do io/print_str "...\n")` with explicit `\n` and got doubled newlines, failing the `t3_main_prints` stdout match across all three cohorts. The empirical LLM-natural form already assumes the new (post-this-commit) semantics — confirming the feature-acceptance test in CLAUDE.md. closes #29	2026-05-21 12:22:45 +02:00
Brummel	f19b0dd860	test(runtime): RED — whole-valued Float must render with `.0` suffix Adds `examples/print_float_whole_smoke.ail` (single `(app print 2.0)`) and `crates/ail/tests/print_float_whole_e2e.rs`. The test builds and runs the fixture through the public `ail build` CLI and asserts stdout is `"2.0\n"`. Currently FAILS with `left: "2\n"`, `right: "2.0\n"` — runtime `ailang_float_to_str` uses libc `snprintf("%g", x)` which strips trailing zeros, so a whole-valued Float prints as Int-shaped text. The surface printer at `crates/ailang-surface/src/print.rs::write_float_lit` (lines 624-637) already enforces the `.0`-fallback property; the runtime drifts. This RED pins the desired symmetry. The GREEN side will mirror the surface fallback in `runtime/str.c::ailang_float_to_str` and update the `floats_e2e.rs` golden (`"4\n42\n-1.5\n"` → `"4.0\n42.0\n-1.5\n"`) plus the doc comments at `crates/ail/tests/e2e.rs` and in the runtime/example files that documented the previous `%g`-without- fallback contract. The alternative (document `%g`-behaviour in design/ ledger §Float semantics as a deliberate human-friendly contract) was rejected: the language's stated ethos is machine-readability + round-trip identity (CLAUDE.md §"AILang — a language for LLM authors"); the surface printer is the reference, runtime drift from it is a defect not a feature. refs #7	2026-05-20 18:19:46 +02:00

76b21c00eb

feat(lang): eliminate the Implicit ownership default — totality + the drop-soundness it demasks (#55 )

Deletes `ParamMode::Implicit`. `ParamMode` is now `{Own, Borrow}`:
every fn-type slot on every signature carries an explicit `own` or
`borrow`, no defaulted position survives anywhere (model 0008 §2,
spec 0062). The parser rejects a bare fn-type slot; `borrow-return`
and `borrow-over-value` reject at the signature; the corpus is
migrated to minimal-ownership modes (consumed ⇒ own, read-only-heap
⇒ borrow, value ⇒ trivial-own). The documented `Implicit`-ret-mode
leak is fixed: an owned heap return now drops exactly once (live=0,
acceptance criterion 5).

This was the easy half. Removing the default ACTIVATED a family of
drop paths that `Implicit` had silently skipped — the pre-cutover
language was leaking (and in places mis-dropping) here rather than
crashing, because an Implicit scrutinee turned the drop off. Making
the modes explicit (Own) turned those paths on and exposed two
latent-bug clusters, all fixed RED-first as part of this cutover:

Drop-soundness family (four legs):
  A. lit-sub-pattern double-free — the desugar re-matched the same
     owned scrutinee in the lit fall-through; fixed by grouping
     consecutive same-ctor arms into one match (bind fields once),
     in ailang-core desugar.
  B. Cons-husk leak on non-tail arm bodies — the lit-sub-pattern
     desugar rebound the owned scrutinee via `Let $mp = xs`, which
     bumped consume_count and suppressed the existing fn-return
     partial_drop. Fixed by not rebinding a bare-Var scrutinee
     (one husk-freeing mechanism, not two).
  C. polymorphic `drop_<T>` rc_dec'd monomorphised value fields —
     the per-ADT drop fn was emitted once from the polymorphic
     TypeDef, defaulting type-var fields to ptr and rc_dec'ing
     inline Ints (segfault). Fixed with per-monomorph drop
     functions (new ailang-codegen::dropmono): the drop set is
     collected from the lowered MIR, value-type fields are skipped,
     heap fields still freed once; monomorphic-concrete ADTs keep
     their byte-identical un-suffixed drop symbol.
  D. static Str literal passed to an `(own Str)` param — the
     literal lowers to a header-less rodata constant; the callee's
     now-active rc_dec read its length field as a refcount and
     freed a static address (segfault). Fixed with the missing
     fourth StrRep::Static→Heap promotion in lower_to_mir's App arm,
     gated on Own mode (borrow args stay static, no regression).

over-strict-mode lint over-fired: it suggested `(borrow V)` for
value-typed params (which `borrow-over-value` rejects — own is the
only legal mode there) and fired on `(intrinsic)` bodies (whose
consumption the linearity walk cannot observe). Tightened to skip
both; contract 0008 updated to the narrowed firing scope.

Irreversible step — canonical-form hash reset (model 0008 §6,
acceptance criterion 6). Every signature now carries explicit modes,
so the hashable canonical JSON changed for every module. RATIFY:
the corpus-wide hash-pin reset (hash_pin, prelude_module_hash_pin,
mono_hash_stability, eq_ord_e2e, embed_export_hash_stable, the
ct4/iter*/loop_recur schema-extension pins) and the list ir_snapshot
golden were regenerated once, deliberately, as the intended one-time
consequence of removing the mode elision from the canonical form —
not a regression. Each regenerated hash verified deterministic across
two runs.

Also fixes a pre-existing latent failure surfaced by the verification
gate, unrelated to this cutover: the `every_contract_names_a_resolvable_
ratifying_test` resolver (design_index_pin) could not resolve the
" + " dual-link ratifying-test form (`uniqueness.rs + linearity.rs`)
that the #57 audit-close (dfdc65f) introduced — it shipped red on that
commit. Resolver taught the dual-link form, mirroring its sibling.

Verification: cargo test --workspace = 731 passed, 0 failed (twice,
stable); e2e 102 passed, no binary exits non-zero (corpus crash-free);
grep-clean for Implicit/fn_implicit/mode_eq across crates; every drop
fix confirmed via emitted IR + AILANG_RC_STATS balance on the head==K,
head!=K, and Nil paths. Three BLOCKEDs en route (the unsound first
husk-dec attempt, the over-strict derivation premise, the leg-B fix
direction) were each treated as a real design/spec gap and rediagnosed,
not patched over.

Supersedes #54 (return-position-only leak patch). Precondition #57
(linearity hardening) was already met. Spec docs/specs/0062, plan
docs/plans/0121.

closes #55

2026-06-02 00:03:46 +02:00

Brummel

26fb3459d8

GREEN: io/print_str byte-faithful via @fputs(@stdout) — closes #29

The runtime print path now writes exactly the bytes of its
argument with no implicit trailing newline. `io/print_str` is
byte-faithful; authors who want a newline emit `(do io/print_str
"\n")` themselves.

## Codegen

`crates/ailang-codegen/src/lib.rs`:
- Module preamble: `@puts(ptr)` → `@fputs(ptr, ptr)` plus
  `@stdout = external global ptr` (libc's `FILE *stdout`).
- Effect-op lowering for `io/print_str`: emit
  `getelementptr +8` then `load ptr, ptr @stdout` then
  `call/tail call i32 @fputs(ptr bytes, ptr fp)`. Identical
  bytes-pointer GEP, distinct sink.
- The pinned IR-shape test renames from
  `print_str_calls_puts_with_bytes_pointer` to
  `print_str_calls_fputs_with_bytes_pointer_and_stdout` and now
  asserts: bytes-GEP present, stdout-load present, both module-
  preamble declarations present, and no `@puts(` call anywhere
  in the emitted IR.

## Why this shape, and not the alternatives

- *Rename `io/print_str` to `io/println_str` (issue #29 option 2)*
  — kept the auto-newline, just relabelled it. AILang's design
  bias is explicit-over-implicit (CLAUDE.md: implicit conversions
  cut). Auto-newline is a hidden runtime augmentation; the rename
  would have preserved it. Rejected.
- *Append `\n` inside the polymorphic `print` (Show-mediated)
  function in `examples/prelude.ail`* — would have been a one-line
  fix. Rejected: `print` is the Show-mediated formatter, not a
  newline emitter; baking a newline into it would have re-imposed
  the same implicit-augmentation problem one layer up, breaking
  callers that legitimately want pure-bytes output.

## Fixture / test sweep

30 `.ail` fixtures whose owning tests asserted line-separated
stdout now emit explicit `(do io/print_str "\n")` after each
print. Tests that asserted on multi-line stdout (`show_print_e2e`,
`floats_e2e`, `str_concat_e2e`, `eq_ord_e2e`, several `print_*`
smoke tests) had their fixtures sweetened the same way; assertions
themselves remain the canonical observable output. Fixtures that
never relied on the newline (no test ever read the absence of one)
were left untouched.

## Migrated metadata

- `crates/ailang-core/tests/hash_pin.rs`: the `ordering_match::main`
  canonical hash is refreshed (`b65a7f834703ffb4` →
  `8ed47b4062ce00f5`). The comment now names both successive
  corpus migrations honestly: the per-type-print-retirement (which
  moved `(do io/print_int x)` to `(app print x)`) AND this
  fputs swap (which wrapped that with `(seq ... (do io/print_str
  "\n"))`).
- `design/contracts/str-abi.md`: the consumer-ABI table now lists
  `@fputs` as the print sink. A prose paragraph documents the
  byte-faithful semantics and references this issue.
- `examples/ordering_match.prose.txt`: regenerated from the
  updated `ordering_match.ail`.
- `crates/ail/tests/snapshots/{hello,sum,max3,list,ws_main}.ll`:
  IR snapshots regenerated via `UPDATE_SNAPSHOTS=1`.
- Stale `@puts` comments in `runtime/str.c`,
  `crates/ail/tests/{e2e,show_print_e2e,print_no_leak_pin}.rs`
  replaced with `@fputs`.

## Verification

- `cargo test -p ail --test print_str_no_auto_newline_e2e` — both
  RED tests from commit c8ecfa3 now pass.
- `cargo test --workspace` — 90 test groups GREEN, 0 failures.
- `cargo build --workspace` — GREEN.
- No new clippy lints (24 warnings pre-existing in
  `crates/ailang-core/src/lib.rs:129`).
- Stats: `bench/orchestrator-stats/2026-05-21-iter-bugfix-print-
  str-fputs.json` — 1/1 tasks, 0 re-loops, 0 review loops.

## Empirical evidence cited

Caught in the 2026-05-21 Qwen3-Coder naming-A/B run
(`experiments/2026-05-21-naming-ab/runs/r1/`): every cohort wrote
`(do io/print_str "...\n")` with explicit `\n` and got doubled
newlines, failing the `t3_main_prints` stdout match across all
three cohorts. The empirical LLM-natural form already assumes the
new (post-this-commit) semantics — confirming the
feature-acceptance test in CLAUDE.md.

closes #29

2026-05-21 12:22:45 +02:00

Brummel

f19b0dd860

test(runtime): RED — whole-valued Float must render with .0 suffix

Adds `examples/print_float_whole_smoke.ail` (single `(app print
2.0)`) and `crates/ail/tests/print_float_whole_e2e.rs`. The test
builds and runs the fixture through the public `ail build` CLI
and asserts stdout is `"2.0\n"`.

Currently FAILS with `left: "2\n"`, `right: "2.0\n"` — runtime
`ailang_float_to_str` uses libc `snprintf("%g", x)` which strips
trailing zeros, so a whole-valued Float prints as Int-shaped
text. The surface printer at
`crates/ailang-surface/src/print.rs::write_float_lit` (lines
624-637) already enforces the `.0`-fallback property; the runtime
drifts. This RED pins the desired symmetry.

The GREEN side will mirror the surface fallback in
`runtime/str.c::ailang_float_to_str` and update the
`floats_e2e.rs` golden (`"4\n42\n-1.5\n"` → `"4.0\n42.0\n-1.5\n"`)
plus the doc comments at `crates/ail/tests/e2e.rs` and in the
runtime/example files that documented the previous `%g`-without-
fallback contract.

The alternative (document `%g`-behaviour in design/ ledger §Float
semantics as a deliberate human-friendly contract) was rejected:
the language's stated ethos is machine-readability + round-trip
identity (CLAUDE.md §"AILang — a language for LLM authors"); the
surface printer is the reference, runtime drift from it is a
defect not a feature.

refs #7

2026-05-20 18:19:46 +02:00

3 Commits