AILang

Author	SHA1	Message	Date
Brummel	ac9171ebf0	refactor: collapse duplicated helpers and drop dead code across check/core/codegen Pure simplification pass, no behaviour change — hashes, canonical forms, diagnostic codes, and emitted IR are byte-identical (hash-pin and IR-pin tests unchanged and green). ailang-check: - strip_forall and collect_pattern_binders were triplicated verbatim across linearity.rs / reuse_shape.rs / uniqueness.rs; hoisted each to a single pub(crate) fn in lib.rs. - mono.rs::pattern_binders was a fourth copy of collect_pattern_binders (iterative style, same result for every Pattern shape); deleted, now calls the shared fn. - maybe_instantiate and expect_eq were single-call wrappers; inlined at their sole call sites and removed. ailang-core: - collect_used_in_pattern was a verbatim duplicate of pattern_binds; deleted, call site repointed. pattern_binds made private (no external callers; the doc-comment's lift_letrecs claim was stale). - is_false serde helper replaced by std::ops::Not::not at the four skip_serializing_if sites (all plain-bool fields); helper removed. - test-only any_nested_ctor / any_let_rec folded into one generic any_term(t, &pred) walker. - removed dead test helpers tmp_dir / examples_dir, orphaned when their tests relocated to tests/workspace_pin.rs. ailang-codegen: - removed the write-only Emitter::types field, its populating loop, and the now-unused CtorInfo struct it fed. - adt_drop_symbol / adt_partial_drop_symbol differed only in a prefix literal; folded into one adt_symbol(prefix, ...). Symbol strings unchanged. Net -180 LOC.	2026-06-02 01:39:35 +02:00
Brummel	19757480b7	audit(0064/cutover): record shipped drop machinery + retire dead desugar arm Cycle-close tidy for the #55 cutover (its audit drift-resolution). Architect drift review found the design ledger out of step with the codegen that the cutover shipped, plus two debt items; regression green (733 passed / 0 failed across the workspace). design/contracts/0008-memory-model.md — the Codegen contract described the drop-emission gates but not the drop machinery the cutover landed. Added three subsections recording the present state (honesty rule): - Per-monomorph drop fns for polymorphic ADTs (crates/ailang-codegen/ src/dropmono.rs: collect_drop_monos / DropAdtMeta, the suffix scheme, value-field-skip on the substituted field type). Ratified by alloc_rc_value_type_field_is_not_rc_dec_dropped. - String-literal rep promotion at owned drop sites (StrRep::Static→Heap on a Str literal flowing into an Own slot the callee drops; gated strictly on Own). Ratified by own_str_literal_arg_is_dropped_exactly_once. - Same-constructor arm grouping in match desugar (build_chain / build_ctor_group bind ctor fields once). Ratified by lit_pat_ctor_tail_drop_single_drop + lit_pat_nil_scrutinee_single_drop. crates/ailang-core/src/desugar.rs — build_chain routes every Ctor-head arm (including a length-1 run) through build_ctor_group, so desugar_one_arm's Pattern::Ctor arm was unreachable dead code duplicating the bind-once lowering. Replaced it with unreachable! naming the invariant, and corrected two stale doc comments (the module-header step 4 and the desugar_one_arm doc still described it as handling ctor arms, and mislabeled the Lit lowering as Term::Match — it is Term::If). Full workspace stayed green, confirming the arm was dead. crates/ailang-check/src/linearity.rs — renamed test implicit_fn_is_exempt → own_param_consumed_once_is_clean. Post-0062 there is no Implicit and no exemption; the test pins the ordinary single-Own-consume clean path. Did the desugar + linearity edits inline rather than via an agent: I had already loaded build_chain/build_ctor_group/desugar_one_arm to prove the arm dead, and a sub-agent would have redone the same reading.	2026-06-02 00:45:06 +02:00
Brummel	76b21c00eb	feat(lang): eliminate the Implicit ownership default — totality + the drop-soundness it demasks (#55 ) Deletes `ParamMode::Implicit`. `ParamMode` is now `{Own, Borrow}`: every fn-type slot on every signature carries an explicit `own` or `borrow`, no defaulted position survives anywhere (model 0008 §2, spec 0062). The parser rejects a bare fn-type slot; `borrow-return` and `borrow-over-value` reject at the signature; the corpus is migrated to minimal-ownership modes (consumed ⇒ own, read-only-heap ⇒ borrow, value ⇒ trivial-own). The documented `Implicit`-ret-mode leak is fixed: an owned heap return now drops exactly once (live=0, acceptance criterion 5). This was the easy half. Removing the default ACTIVATED a family of drop paths that `Implicit` had silently skipped — the pre-cutover language was leaking (and in places mis-dropping) here rather than crashing, because an Implicit scrutinee turned the drop off. Making the modes explicit (Own) turned those paths on and exposed two latent-bug clusters, all fixed RED-first as part of this cutover: Drop-soundness family (four legs): A. lit-sub-pattern double-free — the desugar re-matched the same owned scrutinee in the lit fall-through; fixed by grouping consecutive same-ctor arms into one match (bind fields once), in ailang-core desugar. B. Cons-husk leak on non-tail arm bodies — the lit-sub-pattern desugar rebound the owned scrutinee via `Let $mp = xs`, which bumped consume_count and suppressed the existing fn-return partial_drop. Fixed by not rebinding a bare-Var scrutinee (one husk-freeing mechanism, not two). C. polymorphic `drop_<T>` rc_dec'd monomorphised value fields — the per-ADT drop fn was emitted once from the polymorphic TypeDef, defaulting type-var fields to ptr and rc_dec'ing inline Ints (segfault). Fixed with per-monomorph drop functions (new ailang-codegen::dropmono): the drop set is collected from the lowered MIR, value-type fields are skipped, heap fields still freed once; monomorphic-concrete ADTs keep their byte-identical un-suffixed drop symbol. D. static Str literal passed to an `(own Str)` param — the literal lowers to a header-less rodata constant; the callee's now-active rc_dec read its length field as a refcount and freed a static address (segfault). Fixed with the missing fourth StrRep::Static→Heap promotion in lower_to_mir's App arm, gated on Own mode (borrow args stay static, no regression). over-strict-mode lint over-fired: it suggested `(borrow V)` for value-typed params (which `borrow-over-value` rejects — own is the only legal mode there) and fired on `(intrinsic)` bodies (whose consumption the linearity walk cannot observe). Tightened to skip both; contract 0008 updated to the narrowed firing scope. Irreversible step — canonical-form hash reset (model 0008 §6, acceptance criterion 6). Every signature now carries explicit modes, so the hashable canonical JSON changed for every module. RATIFY: the corpus-wide hash-pin reset (hash_pin, prelude_module_hash_pin, mono_hash_stability, eq_ord_e2e, embed_export_hash_stable, the ct4/iter*/loop_recur schema-extension pins) and the list ir_snapshot golden were regenerated once, deliberately, as the intended one-time consequence of removing the mode elision from the canonical form — not a regression. Each regenerated hash verified deterministic across two runs. Also fixes a pre-existing latent failure surfaced by the verification gate, unrelated to this cutover: the `every_contract_names_a_resolvable_ ratifying_test` resolver (design_index_pin) could not resolve the " + " dual-link ratifying-test form (`uniqueness.rs + linearity.rs`) that the #57 audit-close (`dfdc65f`) introduced — it shipped red on that commit. Resolver taught the dual-link form, mirroring its sibling. Verification: cargo test --workspace = 731 passed, 0 failed (twice, stable); e2e 102 passed, no binary exits non-zero (corpus crash-free); grep-clean for Implicit/fn_implicit/mode_eq across crates; every drop fix confirmed via emitted IR + AILANG_RC_STATS balance on the head==K, head!=K, and Nil paths. Three BLOCKEDs en route (the unsound first husk-dec attempt, the over-strict derivation premise, the leg-B fix direction) were each treated as a real design/spec gap and rediagnosed, not patched over. Supersedes #54 (return-position-only leak patch). Precondition #57 (linearity hardening) was already met. Spec docs/specs/0062, plan docs/plans/0121. closes #55	2026-06-02 00:03:46 +02:00
Brummel	39b674c1ec	chore: throwaway mode-migration tool for the Implicit cutover (#55 , 0121 task 3) Adds `ail migrate-modes <file>` (a throwaway CLI subcommand) and the AST walker `ailang_core::ast::for_each_fn_type_mut` it drives: parse a .ail, map every bare/Implicit fn-type slot to Own, preserve explicit Own/Borrow, print back. Semantically invisible today (PartialEq treats Implicit == Own), but it materialises the modes so the post-cutover parser — which will reject bare slots — accepts the migrated corpus. Both are throwaway: removed in task 4 once ParamMode::Implicit is deleted (the closure references Implicit and would not compile). RED-first: migrate_modes.rs failed to compile (missing walker) before for_each_fn_type_mut was added. Additive; full workspace suite green. refs #55	2026-06-01 16:41:21 +02:00
Brummel	aaa70d4c35	feat(check): harden the ownership analysis for universal activation (0063) The strict linearity check (use-after-consume / consume-while-borrowed, linearity.rs) runs today only on the ~45 of 258 all-explicit-mode fns; its activation gate skips any fn with a bare/Implicit param. Deleting ParamMode::Implicit (#55) would turn it on universally and surface ~21% false positives in two classes. This closes both, making the core ownership analysis sharp across the whole codebase for the first time — the precondition for #55. Diagnostic-only: no schema, no hash, no codegen change; the two existing diagnostic codes simply fire on a smaller, more correct set. Fix 1 — value-type exemption. A new is_value_type predicate (ailang-core::primitives) names the unboxed set {Int,Bool,Float,Unit}; BinderState gains an is_value flag seeded from the binder's locally available type (param signatures, ctor field types for pattern binders, lam typed-params), and use_var short-circuits the Consume arm for it. A value type has no refcount and is never consumed, so multi-read is always legal. Str is deliberately NOT in the value set, though is_primitive_name includes it: drop.rs:490-492 lowers only Int/Bool/Float/Unit to non-ptr; Str is a ptr, RC-dec'd, so a multi-consume of Str without clone is a real use-after-free. is_value_type is the Str-excluding subset of is_primitive_name, pinned by a unit test. is_heap_type and the over-strict-mode lint are left untouched (separate concern). Fix 2 — application is a borrow. Term::App walks its callee in Position::Borrow (was Consume). Applying a function value reads it; it stays live for further applications. Global fn-refs are untracked (no-op); a tracked function-typed binder (a HOF param) is no longer consumed by application. This fixes both the own-f-param use-after-consume and the borrow-f-param consume-while-borrowed in the recursion-passing HOF shape (map_int f t). Passing a function value as an arg is unchanged — it follows the callee param_modes. Scope decision: value-typed let-binders stay conservatively tracked as heap (their type is inferred, not annotated, and the linearity walk does not re-run inference). This is soundness-safe — over-strict, never unsound — and not a measured corpus shape; lifting it would need a full binder->type table out of the type-checker. Verification: all three false-positive classes reproduced today against explicit-mode fns and shipped as RED->GREEN fixtures (examples/fp_{value,hof,map}.ail); examples/real_consume.ail stays RED (heap double-consume still fires) to prove the exemption is type-gated. 715 workspace tests green; bench/check.py 0/34 and bench/compile_check.py 0/24 regressed. merge_states carries is_value so the flag survives branch merges. RED-first verified per task. closes #56	2026-06-01 15:38:32 +02:00
Brummel	ee4107c721	fix(check): honour the written element type-arg on polymorphic (new T …) A `(new RawBuf (con Int) 3)` whose buffer is never observed by a later get/set passed `ail check` but crashed `ail build` with `RawBuf_new__Unit has no registered intercept`, and a forbidden `(new RawBuf (con Unit) 3)` was wrongly accepted at check. Both legs share one root: the `Term::New` desugar discarded the author's written `NewArg::Type` before anything could use it. This was never an inference problem. The element type is EXPLICITLY known — the author wrote `(con Int)`. The defect was that the desugar threw that known type away and relied on re-discovering it from downstream use; with no use (size-only), `RawBuf.new`'s result-only forall var stayed unpinned, mono Unit-defaulted it, and codegen aborted on the unregistered `RawBuf_new__Unit` intercept. The fix USES the written type instead of inferring it. Mechanism: - desugar.rs: a polymorphic `(new T <elem> …)` (carrying a written `NewArg::Type`) now SURVIVES into check instead of being lowered to `(app T.new …)`. A monomorphic `(new Counter 42)` (no type-arg) keeps the raw-buf.4 app-lowering unchanged. - lib.rs synth `Term::New` arm: (a) validates the written element type against the constructed type's `param_in` set via `check_type_well_formed`, firing `ParamNotInRestrictedSet` naming the forbidden element (leg 2) — synth is the correct site because it has Env/registry access, unlike `pre_desugar_validation`; (b) binds the result-only forall var DIRECTLY to the written type (`?a := Int`, a trivial binding, no inference channel) by pushing a `FreeFnCall` whose metas are the written concrete types, so mono mints `RawBuf_new__<elem>` and never `__Unit`. - mono.rs: `rewrite_mono_calls` and `interleave_slots` gain matching `Term::New` arms that each consume exactly one free-fn slot at a type-arg-bearing `Term::New` (mirroring synth's single observation, pushed before the value-args), and `rewrite_mono_calls` reduces the node to `(app <mangled> <value-args>)` so codegen never sees `Term::New` and the lib.rs:2200 `unreachable!` stays valid. The two walkers stay in lockstep. The Unit-default policy in mono stays correct for genuinely-unobservable vars (`is_empty(Nil)` etc.); only the case with a written `NewArg::Type` is changed. Alternatives rejected: an additive `type_args` field on `Term::App` (~100 construction sites across 7 crates — a detour that builds a new transport slot only to copy the already-known type into it); a runtime type-witness parameter on `RawBuf.new` (invents a runtime value for a pure type property); an identity-lambda wrapper carrying the element in its param-type (hides a semantic property in a runtime construct). The written type belongs where the author put it, carried to the one point that consumes it. Verification: both RED legs (committed `61b9d3f`) now green; full check/codegen/core/surface suites green; intercepts bijection and hash-pin tests green; existing raw-buf int/float/bool fixtures still build and run leak-clean (live=0). Out of scope (pre-existing at HEAD, separate issue): a monomorphic `(new Counter 42)` over a user ADT fails with `unknown variable: Counter.new` — unrelated to the type-arg drop fixed here. closes #51	2026-05-31 03:03:14 +02:00
Brummel	13e590cb46	iter raw-buf.6 kernel-stub-retirement (DONE 5/5): retire the stub, raw_buf is the sole base extension (refs #7 ) Closes the raw-buf milestone. raw_buf (shipped raw-buf.1-.5; the owned-drop resolution landed under bug #42/#43) has subsumed every ratification role kernel_stub held -- Term::New end-to-end, the param-in reject, kernel-tier auto-import, the monomorphic intrinsic path, and the type-scoped polymorphic intrinsic mechanism (RawBuf's four ops). The stub is now redundant; this iteration removes it. Pure removal (-636/+49 across 22 files, 7 deleted): - Rust surface: drop `mod kernel_stub` + `STUB_AIL` re-export (ailang-kernel), `parse_kernel_stub` + its workspace injection (ailang-surface), the `answer` + two `StubT_peek__{Int,Float}` INTERCEPTS entries + their three emit fns (ailang-codegen). The (intrinsic) markers leave with the deleted source, so the marker<->entry bijection holds in lockstep. - Source + tests: delete crates/ailang-kernel/src/kernel_stub/, kernel_stub_module_round_trips, the two stub-consumer e2e tests, and mono_scoped_symbol.rs (its scope-qualified-mono mechanism is now pinned by RawBuf's ops + the intercepts bijection). - Fixtures: delete kernel_answer.ail, new_stubt_smoke.ail, peek_mono_pin_smoke.ail, and fieldtest kem_3_stub_consumer.ail (referenced the deleted StubT; documented a since-fixed bug). - Pins: re-baseline both workspace-count content-pins 5 -> 4 (workspace_pin.rs + the e2e.rs twin) and regenerate all five IR snapshots (400 stub-IR lines removed; no user IR changed -- the stub auto-injected into every build). - Ledger: design/INDEX.md + design/models/0007 to present-state (raw_buf is the live ratifier; raw-buf milestone shipped, series pending), plus architecture-comment sweep across workspace.rs, mono.rs, check/codegen lib.rs, workspace_kernel.rs. Scope decisions (orchestrator, pre-plan): the self-contained inline serde_json check-layer fixtures in ailang-check/src/lib.rs keep their incidental StubT/kernel_stub sample names (they construct what they reference; not stub-ratification) -- the one permitted residual. kem_4 fieldtest kept (uses a user NumBox ADT, comment-only edit). hash.rs `name: "answer"` left (generic serde doc example). Plan-gap caught at implement: the planner's verbatim edit list under-enumerated four honesty sites; one (mono.rs:562) carried a literal `StubT_peek__Int` -- a hard-gate symbol the verbatim list missed, which would have failed Task 4's removal gate. Filled (comment-only, no behaviour). Confirms the planner self-review filter-completeness risk; the implement gate caught it. Verification: full workspace suite green (0 failed); hard symbol gate (STUB_AIL\|parse_kernel_stub\|emit_answer\|emit_stubt_peek\|StubT_peek__) zero matches across crates/ examples/ design/; soft gate residual only the kept inline fixtures; kernel crate is lib.rs + raw_buf/ only. Regression: compile_check 24/24 stable (exit 0; uniform downward check_ms within tol -- stub no longer parsed per compile), cross_lang 25/25, check 34/34 stable (exit 0; an earlier exit-1 on rc_over_bump was machine-load ratio noise -- denominator bump_s got faster, rc_s also improved -- confirmed green on re-run, not baselined).	2026-05-30 16:07:29 +02:00
Brummel	11e4c4624d	feat: reserve `$` in the Form-A lexer (closes #44 ) Enforces the `$`-in-authored-names reservation that fresh_binder (ailang-core::desugar) silently relied on. `fresh_binder` mints shadow-rename binders as <base>$<n>; its collision probe could not see an authored binder literally named <base>$<n> that binds later under the same (def, name) uniqueness key — the exact collapse class #43 closed. The `$`-for-synthetic convention (`$mp_N`, <hint>$lr_N, <base>$<n>) was held by discipline only. This makes it a lexer-enforced invariant: no Form-A identifier token may contain `$`. A one-line guard in tokenize rejects any token run containing `$` before int/float/ident classification, raising the new LexError::ReservedDollar { token, start }. It surfaces through the existing ParseError::Lex -> W::SurfaceParse -> surface-parse-error channel with zero new wiring — no new CheckError, no AST walker, no entry-point threading. Placement rationale (the load-bearing call): the threat vector is Form-A source only. The client LLM author is forbidden from emitting canonical .ail.json directly — it writes Form A exclusively; only the orchestrator hand-authors JSON in rare exceptions. So every authored identifier a hallucinating client could produce flows through the lexer. `$` is a reserved character (like parens) with no legitimate authored use in any position — unlike `.`/`/`, which DO have legitimate uses (std_list.map) and therefore live in the check layer (InvalidDefName) with AST-aware positional logic. No positional split for `$` means no walker; the lexer is the right boundary. An earlier draft put the reject in pre_desugar_validation justified by "a client could build .ail.json directly" — false under the authoring contract, so the simpler lexer reservation replaced it. Exemptions by scan order, not special-case: `$` inside string literals and comments stays legal because both are consumed by earlier branches of the scan loop, before a run is ever sliced. The six checked-in example files mentioning loop$lr_0 in comments keep parsing. Documented non-goals (honesty rule): the .ail.json deserialization path stays unguarded (the orchestrator's self-responsible channel); the fresh_binder probe-body simplification (issue Q4) is not bundled — only its now-false doc-comment is corrected to state the enforced invariant, scoped to Form-A authored identifiers. Verification (all run, all green): - 3 in-source lexer tests: reject on x$1, exemption for $ in string, exemption for $ in comment. RED confirmed pre-guard (tokenize("x$1") returned Ok([Ident]), expect_err panicked); GREEN after. - 2 integration tests (reserved_dollar_pin.rs): the reject reaches the public parse entry as ParseError::Lex(ReservedDollar); string exemption survives at parse level. - cargo test --workspace: green, 0 failed. - CLI: check on the comment-$ example (exit 0) and on the #43 shadow idiom raw_buf_int.ail (exit 0, buf->buf$1 rename minted post-parse, never re-lexed); a fresh $-binder source now rejected with the surface-parse-error diagnostic naming the token and byte offset. Spec: docs/specs/0057-reserved-dollar-in-names.md (grounding-check PASS). Plan: docs/plans/0112-reserved-dollar-in-names.md.	2026-05-30 15:00:17 +02:00
Brummel	b151990028	audit: raw-buf close-fixes — honesty + ledger for the binder-rename (refs #43 ) Architect drift review at raw-buf milestone close (after `55d76ae` closed #43) surfaced three items; this commit clears them. All three lockstep- invariant pairs were confirmed intact and the effective-name keying was confirmed consistent across the desugar→lift boundary (lift_letrecs reads the desugared tree's effective names too). 1. [high] Honesty fix. `fresh_binder`'s doc-comment (and 55d76ae's body) claimed "authored names cannot contain `$` — the lexer reserves it". False: the lexer (ailang-surface) reserves only `.`, not `$`. The `$`-for-synthetic convention is not enforced. So collision-freedom rests solely on the `used` + in-scope-`scope` probe, which does not see an authored `<base>$<n>` that is out of scope at mint time but later binds under the same `(def, name)` key — the very collision class this fix closes. Latent (no fixture uses a `$` binder), but the stated rationale was wrong. Doc-comment now describes the probe honestly and names the gap + its two possible closures (enforce the reservation, or seed `used` with every authored binder name in the def). The enforce-or-retract decision is the next-direction follow-up. 2. [medium] design/models/0003-pipeline.md — "desugar currently only flattens nested constructor patterns" no longer matches the code (it now also alpha-renames shadowing binders). Corrected to current state (honesty-rule). 3. [low] design/contracts/0008-memory-model.md — the three drop gates all key on `(def_name, binder_name)` consume_count, silently relying on per-fn binder-name injectivity, which the ledger never stated. Added that invariant as an explicit precondition of the gates, with the desugar guarantee and its ratifying tests. No code-logic change; doc-comment + ledger only.	2026-05-30 12:50:55 +02:00
Brummel	55d76ae4a1	fix: alpha-rename shadowing binders at desugar — A2b leg (closes #43 ) The last open leg of the RawBuf owned-heap drop-leak cluster #43: the UniquenessTable shadow-name collapse. The side-table keys by (def_name, binder_name); a fn that shadows a binder name — the shipped `(let buf (new…) (let buf (set buf…) … (get buf)))` idiom — collapses every shadow onto one key. The outermost binding records last (on pop) and overwrites the inner ones, so codegen's scope-close drop gates read the collapsed consume_count for the innermost binding, misjudge its ownership, and suppress its drop. The owned slab leaked (live==1). Fix: desugar now alpha-renames any binder whose authored name shadows an enclosing binding to a fresh `<name>$<n>`, making the (def, name) key injective per fn. The rename is on-shadow-only and uniform across binder kinds (Let, flat-Match pattern-binders, Lam params, Loop binders); non-shadowing binders keep their authored name, so every existing fixture's desugared output is byte-identical (evidenced by the full pre-existing desugar suite passing unchanged). IR-neutral: codegen names heap by fresh SSA, never by the source binder name. No consumer of the uniqueness table changes — they all key by name, and the name is now a per-fn injective identity (acceptance criterion 5). The fix is entirely internal to ailang-core::desugar; uniqueness.rs gets only a doc-comment correction (its old text was wrong on two counts: "last = innermost by pop-order" was backwards, and "every shipping fixture has unique binder names" was false). Mechanism (vs. the spec's sketch): the threaded lexical scope became a `Scope` struct carrying `entries` keyed by each binder's EFFECTIVE (post-rename) name and `rename` mapping authored→effective. Keying entries by effective name is load-bearing, not cosmetic: the LetRec capture-detection reads `free_vars_in_term` of the desugared body (effective names) and filters by `scope.contains_key` — had entries stayed keyed by authored name, renaming an enclosing let would have made a captured shadowed binder invisible to capture detection (UnknownVar in the lifted fn). `insert_fixed` records identity renames for never-renamed binders (fn-params, LetRec name/params) so an inner renamable binder that shadows them is still detected. Alternatives rejected: (A) an AST id field and (B) a derived binding-path — both solve the deeper, SEPARATE problem of persistent AST provenance back to the authored form, which is certain to be needed eventually but is not required here; conflating the internal naming collision with provenance is a category error. C′ (this) reuses the existing fresh-name machinery and touches one pass. Verification: the three shipped Let-shadow tests (raw_buf_{int,float,bool}_shadow_rebind_drop_balances_rc_stats) reach live==0 (were RED at live==1); the flat-pattern differential (flat_pat_shadow_binder_does_not_leak_more_than_alpha_renamed) reaches its alpha-renamed control's live count (was 5 vs 3); a new desugar unit test (shadowing_let_is_alpha_renamed) pins the rename + reference resolution; full workspace suite green, no fixture output drift. Both no-change consumers re-verified by hand: match_lower.rs keys by the emitted (renamed) pattern binder, linearity builds table and lookups from the same desugared tree. Spec: docs/specs/0056-unique-binder-names.md. Plan: docs/plans/0111-unique-binder-names.md.	2026-05-30 12:42:44 +02:00
Brummel	8ac8756682	iter raw-buf.4 rawbuf-payload-termnew-desugar (DONE, drop-call deferred to .5): RawBuf works, prints 60 (refs #7 ) Ships RawBuf end-to-end as a consumer of the raw-buf.3 scope-qualified intrinsic mechanism, plus the general Term::New construction sugar. Working subset committed; the drop-CALL ratification (no-leak) is re-carved to raw-buf.5 (see `b49f57d`) — the flat drop FUNCTION ships here, its call-insertion needs a codegen resolution mechanism. What ships (all green): - raw_buf kernel-tier submodule (crates/ailang-kernel/src/raw_buf/): RawBuf TypeDef (param-in {Int,Float,Bool}, ctor B a) + four (intrinsic) ops new/get/set/size. parse_raw_buf + workspace injection (kernel-tier auto-imported); workspace count 4 -> 5. - 12 scope-qualified INTERCEPTS entries RawBuf_{new,get,set,size}__{Int, Float,Bool} + emit fns: new allocs an @ailang_rc_alloc slab (8-byte i64 size header + nwidth element bytes), get/set getelementptr+load/store at offset 8 + iwidth, size loads the header. Mechanical on the raw-buf.3 naming + bijection machinery; bijection green (4 markers -> 12 entries). - Term::New desugar (crates/ailang-core/src/desugar.rs): (new T <types> <values>) -> (app T.new <values>), runs before check so the type-scoped callee flows through the raw-buf.3 scope threading to RawBuf_new__T; drops the NewArg::Type (element type inferred from use). Both codegen Term::New deferral arms removed (replaced with unreachable!). Ratified by new_stubt_builds_and_runs. - Flat intrinsic-storage drop FUNCTION @drop_raw_buf_RawBuf (single @ailang_rc_dec on the slab), emitted for any TypeDef whose new op is (intrinsic)-bodied — distinguishes RawBuf (intrinsic new) from StubT (real-body new -> generic ADT drop). - E2E: raw_buf_int (-> 60), raw_buf_float (-> 4.0), raw_buf_bool (-> 42), raw_buf_param_in_reject (param-not-in-restricted-set). In-scope additions beyond the literal plan (both sound, ratified): - qualify_workspace_term now normalises a monomorphic cross-module type-scoped callee (StubT.new) to <home>.f; without it new_stubt_builds_and_runs cannot build (StubT.new is monomorphic, so the raw-buf.3 poly-mono path mints no symbol). Same-module + polymorphic callees carved out. - diagnostic-behaviour: (new T ..) missing-new-op now surfaces type-scoped-member-not-found (desugar runs before check, bypassing synth's Term::New arm); new-arg-kind-mismatch obsoleted. Two unit tests updated to the new behaviour. param-in reject unaffected. The 5 .ll snapshots gained @drop_raw_buf_RawBuf (+ partial) — injecting raw_buf emits its drop fn into every program; benign, regenerated to the final IR. (The plan's "snapshots stay green" assumption was wrong.) Verification (orchestrator, this session): cargo test --workspace 676 passed / 0 failed / 2 ignored. raw_buf_int_e2e prints 60; bijection, round-trip, new_stubt, float/bool/reject all green. The raw_buf_no_leak test is NOT in this commit — it moves to raw-buf.5 with the drop-call resolution that makes it pass (the slab currently leaks at scope close; tracked, fixed next iter; milestone not released until close).	2026-05-30 00:49:51 +02:00
Brummel	52ff8738b8	iter intrinsic-bodies.1-mechanism (DONE 8/8): Term::Intrinsic leaf + cross-crate wiring (refs #9 ) First iteration of the intrinsic-bodies milestone. Introduces the Form-A `(intrinsic)` body marker as a new leaf AST term and wires it through surface, checker, codegen, and a kernel_stub ratifier. The prelude migration + hard-lockstep pin + dead-path removal are .2. What landed (8 tasks): Task 1 — Term::Intrinsic unit variant (ast.rs), tag "t":"intrinsic" via the enum's rename_all=lowercase. Additive: no existing fixture carries it, hashes bit-identical. In-core exhaustive-match arms (canonical/hash/visit/pretty/desugar/workspace) added as leaves. Task 2 — surface parse + print: (intrinsic) as a fn body-slot clause and a lambda positional body, mapped to/from Term::Intrinsic. Task 3 — cross-crate walker sweep (check/codegen/prose/ail-main): leaf no-op/identity arms at every no-wildcard Term match the compiler flagged. Task 4 — checker: new Env.current_module_kernel_tier flag (m.kernel \|\| m.name=="prelude"), set alongside current_module. A def whose body is intrinsic (top-level fn OR instance-method lambda, via the shared is_intrinsic_body helper) is checked signature-only; an intrinsic body outside kernel-tier/prelude is rejected with intrinsic-outside-kernel-tier. Task 5 — codegen: an intrinsic-bodied fn routes through the existing try_emit_primitive_instance_body / intercepts::lookup path; if no intercept fired it is an internal error, never a lower_term fallthrough. lower_term and the synth walker get Term::Intrinsic internal-error arms (an intrinsic body reaching either is an escape bug). Task 6 — answer intercept (ret i64 42) registered in INTERCEPTS; the `answer : () -> Int` intrinsic added to STUB_AIL; examples/kernel_intrinsic_smoke.ail added so schema_coverage observes Term::Intrinsic in the examples/ corpus. Task 7 — E2E ratifier: examples/kernel_answer.ail calls kernel_stub.answer and prints 42; answer_intrinsic_builds_and_runs_printing_42 asserts it end-to-end (source → native). Task 8 — design/contracts/0002-data-model.md gains the { "t": "intrinsic" } Term entry + fn/lam prose; form_a.md grammar note updated. Verification: cargo test --workspace → 669 passed, 0 failed (baseline 667 +2: intrinsic_in_user_module_is_rejected, answer_intrinsic_builds_and_runs_printing_42). bench/check.py + bench/compile_check.py → 0 regressed. Reject E2E (subprocess ail check --json, exit 1, code intrinsic-outside-kernel-tier) GREEN. Round-trip + hash pins GREEN — Term::Intrinsic is additive, no existing fixture carries it, no hash moved. Three implementation completions beyond the plan (all behaviour- preserving, surfaced during execution): 1. The signature-only skip had to apply at the mono pass's two synth-on-body re-entry sites (collect_mono_targets, collect_residuals_ordered), not only check_fn — else an intrinsic body hits synth's Term::Intrinsic internal-error guard. Repaired by extracting the shared crate::is_intrinsic_body helper and applying it at all three synth-on-body paths. Not a representation surprise: the same signature-only treatment, more call sites. 2. The compiler-enumerated exhaustive-match set was broader than the plan's named grep set (the plan anticipated this and made the sweep compile-driven). Extra leaf arms in core desugar/workspace, check reuse-as + qualify_workspace_term, codegen synth_with_extras, ail/src/main.rs, and four test targets. 3. Fixture corrections: emit_answer needed the body-close (block terminator) the plan snippet omitted; kernel_answer.ail's main is (ret Unit)(effects IO) using (app print ...) since io/print_int does not exist (the plan flagged this for the implementer to resolve against real effect-op names). IR snapshots (hello/sum/list/max3/ws_main.ll) refreshed: purely additive @ail_kernel_stub_answer fn+adapter+closure, emitted into every workspace exactly as the pre-existing @ail_kernel_stub_new already was (kernel_stub is auto-injected; confirmed new was present in the pre-iter hello.ll baseline). No user-fn IR changed. The .2 iteration migrates the 18 prelude dummy bodies to (intrinsic), upgrades registry_contains_all_legacy_arms to a source<->registry bijection pin, and removes the dead body-lowering path.	2026-05-29 17:21:32 +02:00
Brummel	9339279181	iter prep.3-kernel-tier-modules (DONE 9/9): kernel-tier modules + param-in + stub crate — closes #33 Terminal iteration of the kernel-extension-mechanics milestone. Ships the four language-level mechanisms named in the spec's § Goal: Module.kernel + TypeDef.param-in schema, their Form-A surface, flag-driven kernel-tier auto-injection, and generic param-in checker enforcement with a new diagnostic. Schema (Tasks 1+2). Module gains a `kernel: bool` field (skip_serializing_if = is_false), TypeDef gains a `param_in: BTreeMap<String, BTreeSet<String>>` field (skip-if-empty, kebab-renamed to "param-in"). Both fields are strictly additive — every pre-existing fixture's canonical-JSON hash is bit-stable except `prelude.ail`, which intentionally gains `(kernel)`. The struct-literal sweep covered ~104 Module sites and ~35 TypeDef sites across the workspace; the additive serde-default covers JSON deserialise paths, only Rust struct literals broke. Form-A surface (Tasks 3+4). `(kernel)` is a bare module-header attribute; `(param-in (a Int Float) (b Str))` is one outer TypeDef-body clause carrying one or more inner var-lists (OQ1 decision — mirrors `(ctors …)`, one parser arm, deterministic BTreeMap iteration). Both round-trip Form-A → JSON → Form-A bit-identical. Workspace-load migration (Task 5). The hardcoded `&["prelude"]` literal at loader.rs:108 became a `modules.values().filter(\|m\| m.kernel)` derivation; `parse_prelude()` injection stays because the prelude has no on-disk manifest in user workspaces. Prelude now carries `(kernel)` in its source, so the new filter picks it up automatically. Code-path migration only — observable behaviour is identical (prelude_free_fns.rs stays green). prelude hash re-pinned (af372f28c726f29f) with Honesty-Rule provenance comment. WorkspaceLoadError::ReservedModuleName diagnostic prose repurposed: any built-in kernel module name is reserved (currently prelude + kernel_stub), not specifically prelude. CLI mapping at main.rs updated in lockstep. Stub crate (Task 6). New `crates/ailang-kernel-stub/` is a zero-dependency leaf crate carrying only `pub const STUB_AIL: &str` with the Form-A source of the kernel_stub module (one parametric TypeDef with param-in, one ctor). The parse hop — `parse_kernel_stub()` — lives in ailang-surface next to parse_prelude, keeping the crate-dependency graph acyclic (`ailang-surface → ailang-kernel-stub → ailang-core`, no back-edge). The stub is injected unconditionally in all builds as the ratifying fixture for the kernel-extension mechanism; future base extensions may add more or retire the stub. Drift-pinned by `kernel_stub_module_round_trips`. Checker (Task 7). New `CheckError::ParamNotInRestrictedSet` variant + code() + ctx() arms + enforcement in `check_type_well_formed`'s Type::Con arm — generic, data-driven from the TypeDef, mentions no specific extension type. Two in-source tests pin both the rejection (`Str` outside `{Int, Float}`) and the acceptance (`Int` inside) paths. Workspace-load integration tests (Task 8). New `workspace_kernel.rs` integration-test crate with three tests: auto-import without explicit `(import …)` declaration, two kernel-tier modules co-load, explicit-import-overrides-auto- import precedence preserved. Loader is import-tree-only so the auto-import tests use a bridge module that brings the kernel module into the workspace via the import graph — docstring captures the reachability nuance for future readers. Doc-state transitions (Task 9). INDEX.md kernel-extensions row annotation transitions from "design accepted 2026-05-28; impl in progress" to "mechanisms milestone closed 2026-05-28; raw-buf and series milestones pending". Whitepaper STATUS + auto-import + param-in sections transitioned forward→present for shipped mechanisms; forward-tense survives only in sections describing the still-pending raw-buf/series milestones (per Honesty-Rule). data-model contract gains anchor blocks for both new schema fields. Side-effect: every binary's IR snapshot now contains ~52 lines for `drop_kernel_stub_StubT` because the stub is auto-injected into every workspace load. Snapshots refreshed; e2e expects 4 modules per workspace (prelude + kernel_stub + entry + zero or more user modules) instead of the previous 3. Plan defects scrubbed in the implementation (folded back into the planner template via the planner's self-review checklist next time): Task 4 sample test src used fictional `(ctors (MkT a))` list form (project grammar is per-`(ctor MkT a)`); Task 6 original wiring would have created a cycle ailang-surface → ailang-kernel-stub → ailang-surface (inverted — stub crate is zero-dep, parse hop lives in surface); Task 7 in- source tests referenced a fictional `check_type_in_module` helper (used the existing Workspace + check_workspace convention); Task 8 first integration test expected loader to auto-load kernel modules from disk (loader is import-tree-only; tests use a bridge module). Concern-5 fix folded in pre-commit: workspace.rs ReservedModuleName doc-prose initially said "in test/dev builds" for kernel_stub — but stub is unconditionally injected in all builds. Doc copy tightened to present-state per Honesty-Rule. Stats: 0 spec-review-loops, 0 quality-review-loops, 2 sweep-script retries on Task 2 (brace-depth bug on nested vec![Ctor{…}], recovered via per-file checkout + rewritten anchor-on-existing- field sweep), 1 e2e-snapshot refresh on Task 6.	2026-05-28 18:43:42 +02:00
Brummel	078c39a76a	iter prep.2-term-new-construct (DONE 4/4): Term::New AST + Form-A surface + checker + drift — closes #32 Second iteration of the kernel-extension-mechanics milestone. Ships the `new` Form-A keyword + `Term::New { type_name, args: Vec<NewArg> }` AST variant + `NewArg::Type\|Value` enum end-to-end through schema / surface / checker, with two new diagnostics (`NewTypeNotConstructible`, `NewArgKindMismatch`), a new arm in prep.1's workspace-wide normalisation pre-pass `qualify_workspace_term` that rewrites bare `Term::New.type_name` to qualified form (symmetric to the existing `Term::Ctor` arm), and the data-model.md + form_a.md anchor additions. Codegen out of scope per spec; codegen sites get `CodegenError::Internal` arms naming the raw-buf milestone as the carrier. Verification: - `cargo test --workspace`: 654 tests passing, 0 failed. - 3 new in-source checker tests pin the elaboration paths: `new_resolves_via_type_scope` (the spec's worked Counter example checks cleanly), `new_type_not_constructible` (missing `new` def in home module fires the new diagnostic), `new_arg_kind_mismatch_value_where_type` (kind-mismatch detection). - 2 new schema-drift pins (`term_new_round_trips`, `term_new_type_arg_round_trips`) ratify the JSON byte shape: `{"t": "new", "type": "<TypeName>", "args": [{"kind": "type"\|"value", "value": ...}]}`. - 1 new surface round-trip pin exercises mixed-kind args through Form-A → JSON → Form-A. - 44+ exhaustive Term-match sites across 24 files extended with `Term::New` arms — workspace-wide cargo build clean. Concerns documented inline: - `crates/ailang-core/tests/schema_coverage.rs` deliberately does NOT register `VariantTag::TermNew` in the `EXPECTED_VARIANTS` set. The coverage test asserts every declared variant is observed in the .ail fixture corpus; no .ail fixture in the current tree emits `"t": "new"` (codegen-runnable Term::New programs require the raw-buf milestone's plugin registry). Registering would fail the coverage check. The `visit_term` arm IS extended (compile-forced); only the enum registration is deferred. Inline rationale in the source. Future milestone that ships a Term::New fixture extends both sides. - `crates/ailang-surface/src/print.rs` `write_term` Term::New arm was added in Task 1 (not Task 2 as planned), because without it ailang-core's tests fail to compile (the surface crate is in the dependency graph of ailang-core's test binaries). Task 2's round-trip pin verified the arm's correctness. - Task 3 (synth elaboration) needed one implementer re-loop: the first attempt over-qualified within-module type-references via `qualify_local_types` on `new`'s signature when the home module was the calling module itself. Fixed by skipping qualification when `home_module == env.current_module`. Architectural composition with prep.1: `Term::New` joins `Term::Ctor` as a `type_name`-bearing site that goes through `qualify_workspace_term`'s bare→qualified rewrite before the checker sees it. The checker's `synth` arm for `Term::New` therefore receives an already-qualified `type_name` (or a local bare name for same-module construction). Milestone status: kernel-extension-mechanics (Gitea #6) advances 2/3 iters. Next: prep.3 (kernel-tier modules + param-in), issue #33.	2026-05-28 15:31:13 +02:00
Brummel	b586999e81	iter prep.1-type-scoped-namespacing (DONE 5/5): TypeDef-first resolution + workspace pre-pass — closes #31 First iteration of the kernel-extension-mechanics milestone. Ships the type-scoped `<TypeName>.<member>` resolution path as the canonical form for type-associated operations, narrows the `BareCrossModuleTypeRef` / `BadCrossModuleTypeRef` diagnostics from "bare = strictly local" to "bare = in-scope by any path", migrates 12 std-library example fixtures, and introduces a workspace-wide normalisation pre-pass `prepare_workspace_for_check` shared between `check_workspace` and `monomorphise_workspace`. Architectural discovery during implementation: the plan covered the `Term::Var` dot-qualified resolver layer plus the workspace validator's bare-name acceptance, but the migration of bare-form fixtures exposed five sites where bare vs. qualified type-names needed symmetric treatment — `Term::Ctor` resolution, `Type::Con` well-formedness, mono's poly-free-fn name/constraint-count enumeration, codegen's `lookup_ctor_by_type` bare-name path, and the upstream desugar-then-qualify composition. Rather than scattering TypeDef-first ladders across each site, the implementer centralised the work into one pre-pass that walks every consumer module's `Type::Con.name` and `Term::Ctor.type_name`, rewriting bare cross-module references to their qualified `<home>.<Type>` form. This is symmetric to the pre-existing `qualify_local_types` (owner-side); the new pre-pass is the consumer-side mirror. Downstream passes see qualified Types regardless of authoring form. The TypeDef-first ladder still lives in `synth`'s `Term::Var` arm because `<TypeName>.<member>` is term-position-only — `Maybe.from_maybe` is a Var, not a Type expression, and the pre-pass does not rewrite Var names. Alternatives considered: (a) Add TypeDef-first ladder at every resolution site separately (the plan's implicit assumption). Rejected: O(N) extension sites, each carrying the same workspace-walking logic; the pre-pass version is O(1) — one pass, every downstream consumer benefits. (b) BLOCKED + spec re-brainstorm. Rejected: the architecture extension is consistent with prep.1's thesis (bare type-name resolves to the workspace-wide TypeDef) and forward-compatible with prep.2 (Term::New.type_name falls under the same rewrite) and prep.3 (kernel-tier TypeDefs enter the workspace map automatically). No design regression to bounce back over. Spec updated to document the realisation mechanism honestly: the "Realisation mechanism — workspace pre-pass" subsection clarifies that the resolver-level semantics described in "Implementation shape" are the user-facing contract, and the actual code path is the pre-pass. Verification: - `cargo test --workspace`: ALL GREEN. 87 e2e + every crate's unit + integration tests pass with no regressions. - Three NEW in-source tests pin Task 1's resolver paths: `type_scoped_member_resolves`, `type_scoped_member_not_found`, `type_scoped_receiver_not_a_type`. - One NEW workspace test pins the narrowed validator: `ct1_validator_accepts_bare_with_explicit_import`. - One renamed-and-flipped existing test: `ct1_validator_rejects_bare_xmod_with_import_candidate` → `ct1_validator_accepts_bare_xmod_with_import_candidate` (the bare-with-import path is now ACCEPTED). - One NEW companion test for the workspace-wide ctor lookup: `ct2_term_ctor_bare_cross_module_via_workspace_resolves`. - Two pre-existing tests' assertions updated for the new error wording: `ct1_check_cli::check_human_mode_emits_actionable_message_to_stderr` and `crates/ailang-check/tests/workspace.rs::unknown_module_prefix_is_reported`. - 12 migrated `.ail` fixtures verified via the existing e2e suite (each fixture is the test runner's target for an existing `build_and_run` assertion). - Negative fixture `ct_2_bare_cross_module.ail` semantically preserved: dropped its `(import std_maybe)` so bare `Maybe` is out-of-scope under the narrowed rule and still fires `BareCrossModuleTypeRef`. Concerns: - The pre-pass introduces a new architectural layer (consumer-side qualification) that the spec did not originally anticipate. Spec amendment in this commit documents the layer. Future iterations reference `prepare_workspace_for_check` as established infrastructure. - `examples/test_ct1_bare_xmod_rejected.ail.json` switched its offending name from bare `Ordering` (which under the prep.1 semantics may now resolve via implicit prelude) to a still- unresolvable `Mystery_Type`. The CLI test's intent (assert that a human-mode `ail check` exits non-zero on a still-RED case) is preserved. Milestone status: kernel-extension-mechanics (Gitea #6) advances 1/3 iters. Next: prep.2 (`Term::New` construct) issue #32.	2026-05-28 14:43:03 +02:00
Brummel	832375f2ac	convention: counter-prefix file naming across docs/specs/, docs/plans/, design/contracts/, design/models/ All 176 files in the four accumulating directories now use a zero-padded 4-digit counter prefix that reflects creation order (`NNNN-slug.md`). The counter is assigned per directory in strict git-log creation order; ties broken alphabetically by original name. The old `YYYY-MM-DD-` prefix on docs/specs/ and docs/plans/ files is dropped — the date is recoverable from git log and the counter carries the ordering. A file's counter is stable for the life of the file: never reassigned, never reused, never compacted. Deleted files retire their counter; subsequent files do not fill the gap. This is the property that lets cross-references stay literal — refs use the full filename including the counter (`design/contracts/0007-honesty-rule.md`) so they grep cleanly and resolve directly without a glob step. 313 cross-references updated across .md/.rs/.toml/.c/.json files (test pins, include_str! paths, design-INDEX entries, baseline notes, runtime C comments, inter-contract markdown links incl. bare basename and `../models/foo.md` forms). CLAUDE.md gets a new "File-naming convention" section spelling out the rule and rationale. skills/brainstorm/SKILL.md and skills/planner/SKILL.md updated so new spec/plan creation produces counter-prefixed names from the start. The full test suite (cargo test --workspace) passes.	2026-05-28 13:31:31 +02:00
Brummel	4fc65ccb99	iter schema-camelcase-fix.1 (DONE 4/4): paramTypes/retType → param-types/ret-type — closes #30 `Term::Lam`'s two camelCase JSON tags become kebab-case, matching the convention every other compound-key tag in the AST schema already follows. After this iter the canonical JSON has zero camelCase outliers. ## Schema swap (atomic, Task 2) - `crates/ailang-core/src/ast.rs:492,494` — two `#[serde(rename)]` strings: `"paramTypes" → "param-types"`, `"retType" → "ret-type"`. Rust field names unchanged. - `crates/ailang-core/src/workspace.rs:1925-1926` — in-source JSON literal in the `ct1_validator_walks_lam_embedded_types` test. - `design/contracts/data-model.md:142-147` — fenced JSON block in the canonical data-model contract. Honesty-Rule touch-point: the contract document must describe the actual present-state schema. - `examples/test_loop_binder_captured_by_lambda.ail.json` and `experiments/2026-05-12-cross-model-authoring/master/examples/fn_with_lambda.ail.json` — the two `.ail.json` fixtures whose canonical-JSON embeds the renamed tags. The five files moved together within one task because `Term::Lam` has no `#[serde(default)]` on `param_tys` / `ret_ty` — a renamed-away key is a hard deserialise error. Splitting the swap would have left the workspace untestable mid-step. ## RED → GREEN pin (Tasks 1, 2) `crates/ailang-core/tests/design_schema_drift.rs` gains `lam_serialises_with_kebab_keys`: pins that `serde_json::to_value(&Term::Lam{...})` emits `"param-types"` / `"ret-type"` AND does not emit the old camelCase keys. Companion: the existing `design_md_anchors_every_term_variant` test now also asserts the kebab anchors appear inside `data-model.md`'s `lam` fenced block. Both confirmed RED on entry, GREEN after Task 2. ## Rustdoc honesty pass (Task 3) Three pure-prose edits keep production rustdoc consistent with the new schema vocabulary: `crates/ailang-core/src/ast.rs:8` (the module-level rename enumeration), `crates/ailang-surface/src/parse.rs:81` (prose mention of `lam`'s carry), `crates/ailang-check/src/lib.rs:1707` (InstanceMethod routing helper rustdoc). No compile or test consequence — Honesty-Rule maintenance. ## Plan-pseudo-vs-reality finding: under-audited hash blast radius The brainstorm spec audited `crates/ailang-core/tests/hash_pin.rs` exhaustively (5 pinned modules, zero `(lam ...)` occurrences, "no hash refresh required"). It missed `crates/ailang-surface/tests/prelude_module_hash_pin.rs` — a separate hash-pin file in a different crate that pins `prelude.ail`, which contains 11 `(lam ...)` forms. The prelude module hash drifted (`6d0577ff0d4e50ac` → `562a03fc57e7e017`); the implementer refreshed it with a Honesty-Rule provenance comment matching the precedent set in commit `26fb345`. Form-A is unchanged — only the canonical-JSON byte stream differs, which is exactly what the rename targets. The spec-side learning is: schema-rename brainstorms must walk every test crate for hash-pin files, not just the home crate of the AST. ## Why this shape, and not the alternatives - `params-ty` / `ret-ty` (Rust-field-name vibe) — rejected. The AST JSON schema follows its own kebab/single-word convention, not Rust field names. The other multi-word tag (`reuse-as`) is kebab; abbreviating `params-ty` mixes singular+plural and has no precedent. - Inline typed params as a sub-tag (e.g. `params: [{name, type}, ...]`) — rejected. Stronger semantic locality, but it changes schema topology rather than tag spelling. Out of scope for a camelCase correction; would have re-pinned far more than this milestone. - Bundle with #27 (arith-rename) — rejected. #27 carries four open brainstorm questions (mod vs rem, neg vs sub 0, Num class, deprecation window) and is structurally a separate milestone. Each gets one re-pin wave with its own rationale; no churn saving from bundling. ## Honest call on the feature-acceptance gate Clause 1 (LLM author naturally uses the new form) is the weakest of the three. Direct empirical evidence is absent — the 2026-05-21 naming-A/B run measured a different axis. The argument is indirect: a future LLM author generalises from the rest of the schema ("compound keys are kebab"), and the two camelCase outliers are precisely the sites where that generalisation diverged from reality. Clause 2 (redundancy reduction) and Clause 3 (no semantic surface touched) are direct. ## Forbidden touches verified untouched `docs/plans/.md` historic plans (which embed old tag names in example JSON), `experiments/2026-05-12-cross-model-authoring/master/spec.md`, `experiments/.../rendered/.md`, and `experiments/.../runs/**` — all left as frozen historical artefacts per Honesty-Rule analogue (describe state at time of writing, not present state). Verified via `git diff --name-only HEAD` (Task 4 Step 4). ## Verification - `cargo test --workspace`: all test groups OK, 0 failed, 2 ignored (pre-existing). - `cargo test -p ailang-surface --test round_trip`: GREEN (Form-A unchanged invariant). - New schema-shape pin and the extended data-model anchor walk: GREEN after Task 2. - Negative grep across `crates/`, `examples/`, `design/`, `runtime/`: the only remaining `paramTypes` / `retType` occurrences in checked-in code are the load-bearing negative-assertion strings inside the new pin (intentional — they are what makes the pin RED-able on regression). - Stats: `bench/orchestrator-stats/2026-05-21-iter-schema-camelcase-fix.json` — 4/4 tasks DONE, no re-loops, no review-loops. closes #30	2026-05-21 12:57:06 +02:00
Brummel	5170b6abd1	iter operator-routing-eq-ord.1 (DONE 13/13): drop comparator builtins, route through Eq/Ord Closes Gitea #1. Realises the "P2 follow-up" called out in examples/prelude.ail:9 — removes the surface comparator names `==` / `!=` / `<` / `<=` / `>` / `>=` from the language entirely, routes the LLM-author's `(app eq …)` / `(app compare …)` / `(app ne\|lt\|le\|gt\|ge …)` through prelude.Eq / prelude.Ord class- dispatch, ships six named Float-comparison fns (`float_eq`/`float_ne`/`float_lt`/`float_le`/`float_gt`/`float_ge`) so Float keeps comparability without an Eq/Ord instance, and emits primitive instance bodies with `alwaysinline` so the -O0 IR shape stays at one instruction per comparison. Plan-task journal (13 tasks, single atomic iter per Approach A): Task 1 — Bootstrap: 4 new fixtures (eq_user_adt_smoke.ail, eq_float_must_fail.ail, float_compare_smoke.ail, operator_unbound_check.ail) + 5 new E2E/pin tests as RED starting state. All 5 confirmed RED at start: north-star fixed `NoInstance Eq Unit` (preserved by Unit-eq opening line intentionally added in plan-self-review); float_compare unknown `float_eq`; operator-name typechecked (== still polymorphic); must-fail diagnostic lacked `float_eq`; alwaysinline absent from IR. Task 2 — Codegen alwaysinline + intercept arms: introduced `intercept_emit_wants_alwaysinline` allowlist + appended ` alwaysinline` between `)` and `{` of the `define` line in `emit_fn`; added 9 new intercept arms to `try_emit_primitive_instance_body` — `eq__Int`/`eq__Bool`/ `eq__Unit` + the six `float_` arms. Task 3 — Prelude reshape: `instance Eq Unit` added; Eq Int/Bool bodies become placeholder-`false` (intercept overrides); six `float_` free fns added; line-9 P2-follow-up comment removed. Lockstep hash re-pins: prelude_module_hash_pin (3abe0d3fa3c11c99 → new), mono_hash_stability six body-hash literals (eq__Int/Bool/Str + compare__Int/Bool/Str all shifted because placeholder body changes the canonical hash). IR-snapshot regen (hello/list/max3/sum/ws_main) rolled forward into this task at orchestrator's pragmatic call — prelude shift forces the snapshots immediately. Task 4 — Fixture migration: 58 .ail fixtures rewritten (`(app == …)` → `(app eq …)`, etc.; Float-typed operand sites to `(app float_eq …)` / `(app float_lt …)`). eq_ord_user_adt.ail:21 inner `==` → `eq` migration with lockstep eq_ord_e2e.rs:134 body-hash re-pin (3c4cf040cb4e8bb2 → new). Two prose snapshots accepted; deps test + 5 hash_pin literals updated as cascading consequences. Task 5 — Test-scaffold migration: all 8 in-source `#[cfg(test)] mod tests` AST-literal sites threaded (desugar.rs:2414, check/lib.rs:5656/6092/6220, codegen/lib.rs sites). 7 obsolete in-source tests deleted (5 eq_typechecks + 2 lower_eq ADT/Fn rejection — coverage moves to E2E eq_user_adt_smoke + eq_float_must_fail). 2 additional letrec tests deleted (single-module check env can't resolve eq/ge without prelude auto-import; covered by workspace E2E). Task 6 — Lit-pattern desugar: build_eq emits `Term::Var { name: "eq" }` instead of `"=="` at desugar.rs:1109; doc-comment rewritten to describe class-dispatch. Task 7 — Dead-machinery deletion sweep (compile-gated): typchecker builtins (install + list comparator entries deleted); codegen builtin_binop_typed (10 comparator arms deleted from synth.rs, table reduced to arithmetic core); lower_eq fn entirely deleted; `==` short-circuit in lower_app deleted; `is_static_callee` `==` clause deleted; `is_arithmetic_or_comparison_op` renamed to `is_arithmetic_op` + caller-update at codegen/lib.rs:2152 + :2529. Dead `poly_a_a_to_bool` helpers also removed. Workspace build green after compile gate — every caller of the deleted surface was migrated by Tasks 4-6. Task 8 — Float-aware NoInstance diagnostic: check/lib.rs:856-880 addendum extended to name `float_eq` / `float_lt` as the explicit alternative for Eq/Ord at Float; eq_float_noinstance.rs:32-44 assertion extended. Task 9 — IR snapshot regen: subsumed by Task 3 (prelude shift forced immediate snapshot regen; deferring to Task 9 would have left the workspace red between tasks). Task 10 — Prose-projection cleanup: 6 comparator arms deleted from binop_info; 3 in-source mod-tests updated/deleted (comparator-infix rendering would be dishonest now that the operators are no longer language identifiers). Task 11 — Contract updates: 5 design files rewritten to the class-dispatch present — float-semantics.md (arithmetic guarantees retained on +/-//; comparison guarantees transferred from ==/!=/< to float_eq/float_ne/float_lt/etc.); prelude-classes.md (Eq Unit added to instance list; new paragraph on six float_ fns; Float-no-Eq/Ord clause gains `→ use float_eq` cross-reference); str-abi.md (clause "REMAIN primitive operators" rewritten to describe class-method dispatch); scope-boundaries.md (multiple operator-name and Pattern::Lit-desugar clauses rewritten); authoring-surface.md (==, <= dropped from operator-example list). Task 12 — Initial acceptance gate: workspace 638/0 GREEN; bench/compile_check + cross_lang 0 regressed; bench/check.py flagged 4 regressions on bench_closure_chain (+29% bump_s, +47% rc_s, +29% bump_rss_kb, +48% rc_rss_kb). Orchestrator initially classified as DONE-with-concerns; Boss reclassified as PARTIAL-via-acceptance-#8-fail after independent re-run, extended iter scope to Task 13. Task 13 — Direct icmp intercept arms (Boss-extension): try_emit_primitive_instance_body gains direct-icmp arms for lt__Int / le__Int / gt__Int / ge__Int / ne__Int, bypassing the compare__Int → Ordering → match indirection that allocated one Ordering ctor per call in tight loops. Each new arm inherits `alwaysinline` via the existing allowlist (extended accordingly). New IR pin test `ord_int_intercept_ir_pin.rs` + smoke fixture `ord_int_intercept_smoke.ail` ratify the optimization — opt -O2 -S confirms zero `call @ail_prelude_lt__Int` in optimized IR; the icmp folds directly at every use site. Bool variants (lt__Bool/etc.) deliberately NOT added — no bench/example calls Ord at Bool; spec-extension permits skipping if unreachable at bench level. Family can be extended symmetrically when first Bool-ordered perf workload appears. Bench-gate post-Task-13: bench_closure_chain bump_s -6.05%, rc_s -2.67%, bump_rss_kb -0.77%, rc_rss_kb +0.46% — all four previously-regressed metrics back inside tolerance. Full bench corpus: 36 metrics, 0 regressed, 0 improved beyond tolerance, 36 stable. bench/check.py exit 0 ✓; bench/compile_check.py exit 0 ✓; bench/cross_lang.py exit 0 ✓. Workspace: 640 passed, 0 failed across all binaries (delta vs. milestone start: +5 new E2E/pin tests added in Task 1 + 1 IR pin added in Task 13 − 9 in-source mod tests deleted as obsolete net ≈ −3). The eq_user_adt_smoke fixture's Unit-opening line was the deliberate RED-first device added in planner self-review so the north-star wouldn't accidentally GREEN at start (user-ADT-Eq on Point with hand-written instance was already operable today; the milestone's actual delivery is operator-name death + Eq Unit + Float-named-fns + cleanup of the two-pathy primitive comparator machinery). Net delta: 96 files changed, 1760 insertions, 1101 deletions; 12 net-new files (6 new fixtures, 5 new E2E/pin tests, 1 stats file). main passes-test-count: 640 (was 633 pre-iter, accounting for the deletions). Spec-vs-acceptance addendum: spec §Testing strategy anticipated the bench-gate-regression case with two recovery paths (`alwaysinline` investigation or "spec needs revisiting toward α"). Task 13 is the third path — direct intercept arms for `lt`/etc. that bypass the compare→match path entirely. The spec's contingency clause was thus generous enough to absorb Task 13 without spec revision, but a future iter that hits a class-method primitive where the body shape introduces a similar codegen cost (Ordering allocation, RC tax, deferred-init) should expect a parallel extension. The pattern is "primitive instance whose canonical body indirects through other class methods that allocate" → add a direct-emit intercept arm + alwaysinline + IR-shape pin. Concerns absorbed: - Codegen lower_app / resolve_top_level_fn gained a prelude-fallback lookup so bare monomorphic prelude fns (`float_eq` etc.) resolve from non-prelude modules without explicit `prelude.float_eq` qualifier. Mirrors the typechecker's implicit prelude import — not in plan but necessary infra for the named-fn surface to be callable. - Recon's "≈10 fixtures" estimate was 6× too low — 58 actual. Mechanical migration; no design impact. - Recon caught 4 in-source AST-literal sites the spec missed (lib.rs:5656 `>=` site + three codegen/lib.rs sites); Task 5 covered all. - Recon caught 2 contract files outside the spec's update set that directly contradicted the milestone (str-abi.md + scope-boundaries.md "REMAIN primitive operators" / "Pattern::Lit desugar to ==" clauses); Task 11 covered all 5. Stats file: `bench/orchestrator-stats/2026-05-21-iter-operator-routing-eq-ord.1.json`. closes #1	2026-05-21 01:16:21 +02:00
Brummel	7a42989b34	iter nullary-app.1 (DONE 5/5): accept `(app f)` as canonical zero-arg call Resolves Gitea #12 — the design fork from the 2026-05-20 /boss session, surfaced independently by two prior fieldtests (mut-local F3 + loop-recur `run_forever`). Mechanics, layer by layer: Parser — `crates/ailang-surface/src/parse.rs:1322-1331` drops the 4-line `expected at least one argument` guard in `parse_app_body`. Grammar comments at file top change `term+` to `term` on both `app-term` and `tail-app-term`; doc comment on `parse_app_body` changes `1+ args` to `0+ args`. Inline comment cites #12 and notes which layers below already accept empty args. Serde — `crates/ailang-core/src/ast.rs:419-425` annotates `Term::App.args` with `#[serde(default)]`, mirroring `Term::Ctor.args`'s actual* attrs verbatim (no `skip_serializing_if`). Write behaviour unchanged — canonical JSON still emits `"args":[]` for nullary calls; only read behaviour gains tolerance for the `args` key being absent. Verified hash-impact-free at plan time: `grep -rn '"args":\[\]' examples/*.ail.json` returns zero matches, so no existing fixture's canonical bytes shift. Doc-honesty — `design/contracts/data-model.md`: (a) the `app` jsonc shape gains an explicit "args may be empty / read-tolerant" note; (b) the existing `ctor` comment claiming "args omitted when empty" was factually false (Ctor.args has no `skip_serializing_if`; a serde probe at plan time confirmed writes always emit `"args":[]`). Rewritten to describe the actual write/read asymmetry, with a cross-reference to the new `app` note. E2E pin — `crates/ail/tests/nullary_app_e2e.rs` + `examples/nullary_app_smoke.ail`. Defines `greet : fn() -> Unit !IO` and calls it as `(app greet)`; asserts stdout `"hello\n"`. RED→GREEN pin for the parser change AND the milestone-protecting E2E for nullary call surface going forward. Fixture literal is `"hello"` (no `\n`) because `io/print_str` lowers via `puts` which appends a newline — the plan body had a `"hello\n"` literal which would have yielded `"hello\n\n"`; the implementer caught and aligned to the canonical pattern in `examples/hello.ail` while writing the fixture, fix scoped to that single file. Layers below parser untouched: typechecker's arity check at `crates/ailang-check/src/lib.rs:3300` is `args.len() != params.len()` which is `0 != 0 → false` for nullary; codegen's `args.iter().zip(sig.params.iter())` at `crates/ailang-codegen/src/lib.rs:2410` is an empty loop; LLVM `call @ail_<mod>_<name>()` with empty arglist is valid; surface printer's arg-emit loop at `crates/ailang-surface/src/print.rs:430-434` writes nothing for empty args, producing exactly `(app f)`. Verification: full workspace `cargo test --workspace --quiet` green (0 failed across all crates); drift pins `design_index_pin 5/5` + `design_schema_drift 8/8`; round-trip `2/2`; new `nullary_app_e2e 1/1`. Stats file: `bench/orchestrator-stats/2026-05-20-iter-nullary-app.1.json`. closes #12	2026-05-20 18:57:14 +02:00
Brummel	8e586f493f	workflow: replace per-iter journal system with git log + BLOCKED.md The per-iter journal under docs/journals/ duplicated the iter commit body's substance and accumulated as Verlauf-Doku with no Future-Use. Sweep across all live control documents: CLAUDE.md, the 7 SKILL.md files, the 11 agent files, design/INDEX.md and the contracts/models that referenced journals, docs/roadmap.md, and the handful of source comments + tests that pointed at journal files for rationale. Mechanism changes: - Standing-reading-lists in every agent now read `git log -N --format=full` for recent project state, never per-iter journal files. The architect reads `git log <prev-milestone-close>..HEAD --format=full` for audit scope. - implement-orchestrator no longer writes a journal file. DONE outcomes emit just code + stats; the end-report is the per-task summary the Boss uses to write the commit body. PARTIAL/BLOCKED outcomes emit BLOCKED.md at the repo root — uncommitted by convention, Boss removes on repair or discard. New iron-law line + four-rationalisation row + red-flag bullet codify it. - audit ratify mechanic: --update-baseline is now paired with an explicit ratify paragraph in the audit-close commit body, not a separate JOURNAL ratify entry. - design/contracts/honesty-rule.md: "history and rationale lives in docs/journals/" → "lives in git log (iter and audit commit bodies)". Pinned phrase preserved verbatim. - CLAUDE.md "Roles of …" section reframed: design/, git log, journal-archive.md (content-frozen), roadmap.md, specs/, plans/. No docs/journals/ slot anymore. - roadmap.md context-lines that pointed at per-iter journals are dropped where the spec/commit already carries the rationale, or rephrased to "shipped in the <iter> iter commit" / "docs/journal- archive.md (<date> entry)" for pre-2026-05-11 references. What stays (this commit): - docs/journals/ directory and contents are NOT touched. Removing the contents is a separate follow-up. - docs/journals/2026-05-19-design-decision-records.md still has live readers (docs_honesty_pin.rs Z 108 + parse.rs + duplicate_ctor_pin.rs + 3 roadmap mentions) — also follow-up. - docs/journal-archive.md still exists; its self-pointer header has been updated to drop the "see docs/journals/INDEX.md" mention. Workspace builds, full test suite green.	2026-05-20 11:21:37 +02:00
Brummel	ac4d545570	source: scrub iter-code / Decision-N residue from inline comments Follow-up to `bcd4181`: the remaining ~530 inline `//` and `///` comments still carrying opaque shorthand are now reformulated to their content phrases. The only surviving `iter-<code>` reference in source is the literal filename `docs/journals/2026-05-13-iter-mq.3.md` (a real journal file). Sweep covered: - `// Iter X.Y: <text>` prefixes (Iter 13a / 14a / 14e / 15g-aux / 16b.x / 16d / 16e / 18b / 18c.x / 18d.x / 18e / 18g.x / 19a / 19a.1 / 19b / 20a / 20f / 22-floats.x / 22b.x / 22c / 23.x / 24.1 / cli-diag-human / hs.x / str-concat / etc.) — fully removed; the descriptive text that followed each prefix stays. - `// (Decision N)` and `per Decision N` and `Decision N axis 3` — replaced with the content phrase plus the relevant contract file (`design/contracts/tail-calls.md` for Decision 8, `design/contracts/memory-model.md` for Decision 10, `design/contracts/typeclasses.md` and `design/models/typeclasses.md` for Decision 11, `design/contracts/authoring-surface.md` for Decision 6, "the transitional dual-allocator" for Decision 9, "Effect prose" for Decision 3). - `// mq.X / mq.X (Task N) / mq.X journal / mq.X invariant` -> "the canonical-class-form rule / Class-class repurpose / method-dispatch-refactor journal / canonical-class-form invariant". - `// ct.X / ct.X (canonical-type-names) / ct.1.5a + ctt.2 / ct.2 Task N` -> "the canonical-form rule for type references / the canonical-form normalisation step / canonical-type-lookup refactor". - `// eob.X` -> "heap-Str-ABI" / "the Str carve-out". - `// rpe.X` -> "the per-type-print-op retirement". - `// post-mq.X / Pre-ct.X / pre-mq.X` -> "post-canonical-class-form" / "Pre-canonical-type-form" etc. - `/// Iter X regression: / /// Iter X.Y: / /// Iter A arm-close / /// Iter ct.4 (...): / /// Iter rpe.1 ...` -> descriptive phrases. The journal filename in `crates/ailang-core/src/workspace.rs:573` stays verbatim because it points at an actual file under `docs/journals/`. Tests: full `cargo test --workspace` green (80/80 test-result blocks clean, no FAILED line). design_index_pin 5/5 + docs_honesty_pin 5/5 gating tests pass.	2026-05-20 09:58:04 +02:00
Brummel	bcd41810f4	design/ + source rustdoc: replace opaque shorthand with content phrases + links Reader-facing prose and rustdoc carried opaque shorthand like "Decision 10", "clause-5", "mq.1", "ct.1", "eob.1", "rpe.1", "post-mq.3", and "Iter 22b.1:" with no in-repo definition the reader could follow. This commit replaces every such occurrence in the durable tier the reader is most likely to land on (design/ ledger + source //! module headers + the central /// public-item rustdoc) with an inline content phrase plus, where applicable, a Markdown link to the file that defines the referenced concept. design/ ledger — 16 files: Definition-site headings demoted from "Decision N: <title>" to "<title>": authoring-surface, tail-calls, memory-model section in rc-uniqueness.md, dual-allocator section, typeclass design, effects "pure core + algebraic effects". Cross-reference sites: "Decision 1" -> canonical-schema principle (data-model); "Decision 3/4" -> effects + scope-boundaries; "Decision 6" -> authoring-surface; "Decision 8" -> tail-calls; "Decision 9" -> rc-uniqueness (dual-allocator); "Decision 10" -> memory-model; "Decision 11" -> typeclasses (model). "clause-5" -> body-link durability gate. "clause-3" (in language-constraints) -> bug-class-reintroduction discriminator. "mq.1/2/3", "ct.1/4", "eob.1", "rpe.1" -> the canonical-form rule / the type-driven dispatch / the Str carve-out / etc. "post-mq.3" -> "type-driven". design/contracts/feature-acceptance.md: file-local "clauses 1/2/3" -> "criteria 1/2/3" (sprachliche Kohärenz mit der File-Überschrift "Feature-acceptance criterion"); "the clause-3 mechanism" -> "the bug-class-reintroduction discriminator". Source //! module headers — 24 files: Stripped "Iter X.Y:" prefixes and "(Decision N)" / "(mq.X)" tags from spec_drift, uniqueness, reuse_shape, migrate_canonical_types, typeclass_22b{2,3,c}, suppress_filter, lift, mono, linearity, diagnostic, method_dispatch_pin, method_collision_pin, no_per_type_print_ops, mq3_multi_class_e2e, print_mono_body_shape, print_no_leak_pin, cli_diag_human_workspace_load_error, ct1_check_cli, prose snapshot, unbound_in_instance_method_pin, mono_xmod_ctor_pattern, desugar. Central /// public-item rustdoc: ast.rs (full sweep — every "Iter X" + "Decision N" prefix reformulated; mode/Type::Fn rustdoc now points at memory-model.md; Constraint / SuperclassRef / InstanceDef / ClassDef rustdoc points at typeclasses contract). diagnostic.rs (all "(Iter X)" / "(mq.X)" tags on diagnostic codes removed). lib.rs (FORM_A_SPEC rustdoc points at authoring-surface.md instead of "Decision 6"). canonical.rs (type_hash + Float-literal rustdoc). Still outstanding (for a follow-up commit): ~500 inline `//` code-body comments with `Iter X.Y` markers across the workspace, and a handful of `///` rustdoc items in hash_pin / workspace_pin / lift / mono / suppress_filter test-pin and internal-function bodies. Code identifiers (test filenames like `mq3_multi_class_e2e.rs`, function names like `iter18e_drop_iterative_default_preserves_hashes`) stay verbatim per the user's "code identifiers stay verbatim" rule. Tests: design_index_pin 5/5 + docs_honesty_pin 5/5; workspace builds clean; full `cargo test --workspace` previously green (every `test result: ok` line, no FAILED line).	2026-05-20 09:47:33 +02:00
Brummel	176821c2e7	iter design-md-rolesplit.1 (DONE 9/9): DESIGN.md -> design/ ledger role-split The 3020-line docs/DESIGN.md is replaced by the design/ ledger: design/INDEX.md (sole addressable spine, typed Contracts+Models tables, polymorphic links — prose file OR authoritative source //!), 14 design/contracts/.md test-linked invariants + 3 source-link-only contracts (mangling/env-construction/qualified-xref, no prose file — code is SoT), 5 design/models/.md whitepapers, and docs/journals/2026-05-19-design-decision-records.md (the relitigation-guard archive — every why/rejected/does-not-do/rollback/ empirical ### moved out at ###-granularity). Clean cut: git rm docs/DESIGN.md, no stub. RED-first crates/ailang-core/tests/design_index_pin.rs — the 4-clause anti-regrowth spine (DESIGN.md-gone / every-INDEX-link-resolves / every-contract-names-a-resolvable-ratifier / contracts-carry-no-decision-record-prose) — demonstrably RED before, GREEN after. Build-atomic by task ordering: design_schema_drift.rs's include_str! (the only compile-time consumer) retargeted to design/contracts/data-model.md BEFORE the deletion; its ## Data model/## Pipeline slicer dropped (a simplification the split enables). 2 NoInstance diagnostics + 2 lockstep E2Es retargeted to design/contracts/{float-semantics,typeclasses}.md. ~12 agent reading lists + 5 SKILL bodies + CLAUDE.md + skills/README.md + ~25 code/C/.ail/spec comment xrefs retargeted; OQ7 dangling 'Iter 13b' cite deleted (no forward target — a pointer would be fiction). honesty-rule.md rewritten so the rule names the new home (rationale->journals), resolving the recon-found internal contradiction; the two docs_honesty_pin.rs:70,72 pinned phrases kept verbatim+contiguous. Boss-verified independently: cargo test --workspace 646 passed / 0 failed; design_index_pin 4/4; acceptance grep CLEAN of live DESIGN.md refs (residuals = only the spec-mandated clause-4 deletion-enforcer). 2 DONE_WITH_CONCERNS routed to the mandatory milestone-close audit: (a) str-abi.md:23 '(iter str-concat, 2026-05-13)' provenance stamp trips advisory architect_sweeps Sweep-1 — Boss-confirmed byte-identical to DESIGN.md@deeffb1:2062-2065, a faithfully-migrated PRE-EXISTING anchor (regexes verbatim, only path retargeted), NOT split-introduced — RATIFY-or-tidy at audit; (b) a now stale-direction intra-prose 'see Str ABI below' cross-ref in float-semantics.md — audit-adjudication candidate. Plan defect noted: Task 9 Step 4's verbatim acceptance grep used a ^./ anchor not matching the system's grep -rIn output; substance re-verified CLEAN. Spec grounding-check PASS x2. Journals INDEX + decision-records pointer appended (Boss-only).	2026-05-19 13:04:22 +02:00
Brummel	4ea8bc5faf	iter embedding-abi-m3.1 (DONE 6-7): freeze the value layout — DESIGN.md frozen-layout SSOT + lockstep pointers + enforceable byte-pin Tasks 6-7 of the Boss-repaired split dispatch (Tasks 1-5 committed `d5c565d`). Task 6: DESIGN.md §"Embedding ABI" gains the `### Frozen value layout (M3 — one-way commitment)` SSOT subsection; both "provisional until M3" sentences rewritten to one-way-freeze wording (docs_honesty_pin-safe — the pinned "written bare" sentence stayed byte-verbatim, :2297->:2299 content-asserted); // FROZEN ABI lockstep pointers at runtime/rc.c + match_lower.rs lower_ctor + drop.rs; 3 plan-named stale rustdocs fixed + the Boss-caught stale // gate-comment block (check/lib.rs:1917-1922, M1/scalar-only -> M1/M2/M3/C-ABI-permitted-incl-record); byte-pin enforceability demonstrated (RED on a local offset perturbation, GREEN on git-checkout restore — the only legitimate git op, working-tree only). Task 7: milestone-close verification gate. Boss-verified independently (agent report = intent, not outcome): workspace 639 passed / 0 failed; embed_record_e2e 2/2 (own+borrow, global leak-freedom model); byte-pin 1/1; gate 10/10; forwarder 3/3; docs_honesty_pin 5/5 pin-safe; design_schema_drift + embed_export_hash_stable + embed_e2e + M2 swarm regression-green-unmodified. INDEX.md line added (deferred from the PARTIAL — one line per iter, final title). Milestone-close audit next (architect Invariant 1 + bench trio, spec Testing items 8/9 — audit-owned, not the implement run's job).	2026-05-18 21:29:50 +02:00
Brummel	818177d835	iter embedding-abi-m1.1 (PARTIAL 3/7): schema + surface + baseline prerequisites; plan Repair Tasks 1-3 of docs/plans/embedding-abi-m1.1.md, a verified known-good subset (cargo build --workspace exit 0; full workspace green; the roundtrip_cli all-examples gate green): - Task 1: CLI build-path MissingEntryMain baseline pin (examples/embed_noentry_baseline.ail + embed_missing_main_baseline.rs; triple-assertion, layered on the green codegen-unit pin lib.rs:3314). - Task 2: additive FnDef.export: Option<String> (serde default + skip_serializing_if, modelled on FnDef.doc); compile-driven thread of export: None across ~85 FnDef/AstFnDef literals / 18 files incl. all in-source #[cfg(test)] mod tests + drift/hash/spec-drift literals + the codegen lib.rs:3320 in-source pin; hash-stability golden pin; DESIGN.md fn-JSON "export" line. DONE_WITH_CONCERNS (plan symbol content_hash_fn -> def_hash per hash_pin.rs, plan- pseudo-vs-reality class, plan corrected). - Task 3: Form-A (export "<sym>") modifier — parse_export + parse_fn thread + write_fn_def emission + form_a.md grammar; byte-identical round-trip. Task 4 BLOCKED (Boss plan-defect: fixtures declared module != file stem; AILang's loader hard-enforces module==stem at workspace.rs:438, so ail check panicked on load before the gate). Boss resolution (Option 2, overriding the orchestrator's Option 1, rationale in the journal + plan Design-decision 6): keep descriptive embed_* filenames, rename fixture MODULES to their stems — the C symbol backtest_step stays via (export ...), demonstrating spec Decision 2's mangling- decoupling rather than violating it; archive becomes libembed_backtest_step.a, internal symbol @ail_embed_backtest_step_step, host.c unchanged. Plan fixed (Design-decision 6 + Task-4 module==stem + Task-5/6/7 dependent strings + the no-*. Float-head + content_hash_fn concerns folded). Headline fixture corrected; blocked-Task-4 WIP discarded (recreated by the [4,7] re-dispatch from the fixed plan). PARTIAL commit (not the iter's final commit): the implement Repair path mandates committing the known-good subset so the [4,7] re-dispatch starts from a clean tree that includes Tasks 1-3 (Tasks 4-7 structurally depend on the schema field + surface). INDEX line added when the full iter lands post-re-dispatch.	2026-05-18 14:32:39 +02:00
Brummel	07f080256c	iter remove-mut-var-assign.1: atomic removal of mut/var/assign mut/var/assign removed from AILang entirely and atomically. Deleted: Term::Mut/Term::Assign/struct MutVar; the three Form-A keywords + parse_mut/parse_assign + grammar EBNF; the 4 mut CheckError variants; the mut_scope_stack synth threading (param dropped from synth + every internal/external/test caller); the two lower_term arms; and every exhaustive no-_ Term::Mut/Term::Assign match arm across 17 source files — cut in lockstep with DESIGN.md, fixtures, the drift trio, carve-out and roadmap so the schema is honest at every commit. No catch-all wildcard introduced (verified). loop/recur + let/if are the surviving forms. The shared codegen alloca machinery survives (loop reuses it): mut_var_allocas renamed binder_allocas (representation-only, loop codegen byte-identical) and the shared Term::Lam escape guard simplified to !loop_stack.is_empty() with the loop half (LoopBinderCapturedByLambda) byte-equivalent. Feature-acceptance applied inverted: the removed feature fails clause 2 (redundant) and clause 3 (IS the iterated-mutable-state bug class). Behaviour preservation is executable: mut_counter/mut_sum_floats still print 55 after the faithful let/if rewrite. The removal is made executable by the new mut_removed_pin.rs (4 must-fail pins). Independent verification: cargo test --workspace 605/0, zero residual mut symbols in any crate source, loop/recur non-regression all green (55 / 500000500000 / infinite-compiles / the lambda_capturing_loop_binder pin), roundtrip_cli PASS. One DONE_WITH_CONCERNS: a 4th recurrence of the recon-undercount class (in-source mod tests + a drift-pin fn + 5 orphaned mut .ail.json carve-outs + a non-enumerated E0599); all resolved within implementer remit, no behaviour change. Milestone-close audit then fieldtest remain. spec docs/specs/2026-05-18-remove-mut-var-assign.md (grounding PASS) plan docs/plans/remove-mut-var-assign.1.md	2026-05-18 11:06:17 +02:00
Brummel	2ee97943bd	iter loop-recur.tidy GREEN: reject lambda-captures-loop-binder at check + milestone-close audit resolution GREEN side of the RED audit-trail commit `39380d3`. The loop/recur milestone-close audit found a [high] correctness defect — a lambda capturing a loop binder passed `ail check` then panicked unreachable!() at codegen (crates/ailang-codegen/src/lambda.rs:102) on type-correct input. Fixed symmetrically to mut.4-tidy: new CheckError::LoopBinderCapturedByLambda (code loop-binder-captured-by-lambda, bracket-free F2 Display), the Term::Lam escape guard gained a parallel loop_stack pass. Minimal mechanism: loop_stack element Vec<Type> -> Vec<(String,Type)> so the already-threaded per-loop frame carries binder names; recur still reads .1 by position (Boss-call-2 positional invariant preserved verbatim — the name is a second field for the escape guard only, a consumer iter-2 did not anticipate). Codegen byte-unchanged (typecheck-only fix). carve_out 17->18 + ct1-F2 + DESIGN.md note lockstep. Folded in (Boss-side, audit resolution): the two [medium] doc-honesty edits the audit surfaced (mut_var_allocas rustdoc now states its mut-var+loop-binder dual use; Term::Loop doc-comment now describes the real shipped state, not iter-1's stale "per-binder phi" forward-look) + a [low] P2 roadmap todo (plan-recon undercount countermeasure, pairs with planner Step-5 items 7+8). Bench gate: all 3 scripts exit 0, 25 metrics 0 regressed — pristine, carry-on (no baseline/ratify). cargo test --workspace 619 -> 622 / 0 red (Boss-reran independently, hash_pin 11/0). The loop/recur milestone is audit-clean; fieldtest is the only remaining step before close.	2026-05-18 00:21:06 +02:00
Brummel	a179ec30a0	iter loop-recur.1: additive Term::Loop / Term::Recur / LoopBinder foundation First of three iterations of the standalone loop/recur milestone (spec `97c1ed1`). loop/recur become real parseable / printable / round-trippable / hash-stable strictly-additive AST nodes across every no-wildcard exhaustive Term match in all six crates, plus parse/print, prose arms, DESIGN.md + form_a.md schema blocks, drift/coverage/hash anchors, and the spec's worked sum_to program as a green round-trip fixture. NO typecheck semantics and NO real codegen this iter by design: synth and lower_term are stubbed CheckError::Internal / CodegenError::Internal exactly as mut.1 (real typecheck = iter 2, real loop-header/phi/back-edge = iter 3). Two binding Boss design calls recorded in the plan header and the journal: (1) verify_tail_positions "byte-unchanged" = its tail-app verification role is unchanged, not its source — it is an exhaustive no-wildcard match so two descent-only arms are mandatory; acceptance evidence is the tail-app non-regression test. (2) codegen is in iter-1 scope as stubs/pass-throughs because the workspace must compile for cargo test --workspace. Three plan-pseudo-vs-reality substitutions (serde Type::Con literal, bare Int -> (con Int), unqualified LoopBinder) and one recon-undercount integration-test site, all intent-preserving and journalled. Boss forward-fix folded in: the committed specs themselves wrote bare Int in the loop-binder snippets (parses as Type::Var) — corrected the three headline snippets to (con Int) for doc-honesty (no design/schema change). cargo test --workspace 600 -> 608 / 0 red (Boss-reran independently); iter13a + new loop_recur hash pins green.	2026-05-17 23:00:15 +02:00
Brummel	a29700cc9e	iter effect-doc-honesty: make the effect-system documentation true Standalone documentation-honesty tidy (no language/checker/codegen change; `ail check`/`run` byte-unchanged by construction). Corrects three false effect-system claims the effect-subsystem recon surfaced, plus two satellite mentions, guarded by a new doc-presence pin: - DESIGN.md Decision 3: removed the "row-polymorphic (`![IO \| r]`)" claim (no EffectRow / row variable exists in any crate — effect sets are a flat, unordered, closed set unified by set-equality); reconciled "`IO` and `Diverge` are wired up" to IO-only + `Diverge` reserved/unimplemented (zero code in any crate), modelled on Decision 4's reserved-refinements precedent. - DESIGN.md "What is not (yet) supported": "IO and Diverge ops" bullet -> IO-only + Diverge-reserved. - ast.rs Term::Do doc-comment: "resolved against the effect-handler table at link time" -> the real mechanism (typecheck lookup in Env::effect_ops + literal lower_effect_op codegen match; no handler table, no link-time resolution). - form_a.md:226 + rule 3, and main.rs merge-prose CONTRACT example: Diverge mentions reconciled in lockstep. - new crates/ailang-core/tests/effect_doc_honesty_pin.rs: 4 tests, fiction-absent + corrected-anchor-present, single-line wrap-robust substrings. cargo test --workspace 600 -> 604 (4 new pin tests, 0 regressions); design_schema_drift / spec_drift / schema_coverage stay green, empirically confirming none scans the effect-prose region.	2026-05-16 13:25:49 +02:00
Brummel	37ac704bf3	iter revert: back out the Iteration-discipline milestone (it.1 + it.2) One forward iteration; main never rewound. `1ff7e81` (the pre-9973546 commit) is the per-region byte oracle — every reverted source/test file is byte-identical to it; crates/ailang-check/src/lib.rs fully so. Root cause being corrected: the Iteration-discipline milestone was an over-escalation of fieldtest finding F1 (a [friction] item whose own minimal recommendation was a DESIGN.md note). Its totality dichotomy made the maximally-LLM-natural build(d:Int)=Node(1,build(d-1), build(d-1)) inexpressible (it.3 BLOCKED); the only in-thesis escape (A1/it.2b) conceded the language's first documented-unenforced totality precondition — a purity-pillar dilution the user rejected in favour of a full revert + rebuild. Removed: Term::Loop/Term::Recur/LoopBinder; the verify_structural_ recursion guardedness pass + term_contains_loop + Diverge-injection + the transitively-it.2 module_fns plumbing; the five Recur*/ NonStructuralRecursion CheckError variants (+ code() + the 3 dedicated ctx() arms); the it.1 codegen loop-header/phi/back-edge + parallel block_terminated setter; all Loop/Recur walker arms; 16 it.1/it.2 fixtures; 2 pin files; bench/it3-oracle/. Restored: 2 RC fixtures to `1ff7e81` content. Surgically kept (not in `1ff7e81`, landed with the milestone but independently sound): feature-acceptance clause 3 in DESIGN.md and skills/brainstorm/SKILL.md, with its worked example de-claimed from "shipped" to hypothetical-illustration form; the F3 P2 todo. bench/orchestrator-stats/2026-05-15-iter-it.{1,2,3}.json kept as historical record (like journals/plans). Sole net addition: an honest F1/F4 documented-idiom note in DESIGN.md (the tail-recursive accumulator fallback; examples/mut_counter.ail), guarded by a doc-presence test — "a documentation note is not a reshape", asserts nothing at the typecheck level. Roadmap: the Iteration-discipline block + blocking-fork section removed; the genuine total-Int-recursion ambition preserved as a deferred P2 milestone sequenced behind a future Nat/refinement-types milestone (not abandoned — correctly sequenced after the type machinery it needs). 2026-05-15-iteration-discipline.md carries a superseded header; it.1/it.2/it.3 journals + plans stay as history. Correctness gate PRISTINE: 164 surviving 1ff7e81-era fixtures ail check/ail run byte-identical to pre-milestone behaviour (verified against a `1ff7e81` worktree reference compiler, zero drift); cargo test --workspace 600/0; zero residual it.1/it.2 production surface. Spec docs/specs/2026-05-16-iteration-discipline-revert.md (`b3853bf`), plan docs/plans/2026-05-16-iter-revert.md (`abf0013`).	2026-05-16 01:28:47 +02:00
Brummel	96db54d15d	iter it.1: loop/recur additive — Term::Loop/Term::Recur/LoopBinder end-to-end Iteration-discipline milestone, 1 of 3. Adds named loop + recur as strictly-additive first-class AST nodes: parse/print/prose/serde/ round-trip/schema lockstep, typecheck (binder typing + recur arity/type unification via loop_stack threaded as mut.2's mut_scope_stack; recur-tail-position via verify_loop_body), codegen (loop-header + one phi per binder; recur back-edge br with a NEW parallel block_terminated setter; lambda-boundary loop_frames save/restore). Four Recur* CheckError variants. Strictly additive: zero deletions touch tail-app/tail-do or the seven existing block_terminated sites — this is what makes the destructive it.3 safe. recur synth = fresh metavar (resolves the plan's flagged Type::unit() risk). loop_counter->55, loop_in_lambda->49, four negatives fire, tail-app byte-identical, cargo test --workspace green. Spec `fda9b78`, plan `7381a42`.	2026-05-15 14:38:55 +02:00
Brummel	7b92719244	iter mut.1: AST extension + Form A surface for local mutable state First iteration of the mut-local milestone (foundation step on the Stateful-islands roadmap path). Lands the schema + surface tier: Term::Mut, Term::Assign, and the nested MutVar struct become first-class AST nodes that round-trip cleanly through Form A. Typecheck and codegen recognition are deferred to mut.2 and mut.3 per the spec's out-of-iteration boundary; reaching either dispatch entry point with these variants produces CheckError::Internal / CodegenError::Internal with a 'deferred to iter mut.{2,3}' message. Concretely: - crates/ailang-core/src/ast.rs: two new Term variants behind #[serde(tag = 't')]; pub struct MutVar { name, ty, init } adjacent to Arm. Two canonical-bytes pin tests for the explicit-empty-vars serialisation and the assign round-trip. - ~25 substantive Term-walker arms across ailang-core/desugar, ailang-core/workspace, ailang-check (lib + lift + linearity + mono + pre_desugar_validation + reuse_shape + uniqueness), ailang-codegen (escape + lambda + lib), ailang-prose, and crates/ail/src/main.rs. Universal policy: substantive recurse-into- children at every site; only the two dispatch entry points (synth in ailang-check, lower_term in ailang-codegen) stub with Internal-error. One test-side walker arm in crates/ail/tests/codegen_import_map_fallback_pin.rs not enumerated by the plan was added as well (defensive recursion). - ailang-surface: parse_mut + parse_assign helpers; Term::Mut body desugared from a flat statement sequence into a right-folded Term::Seq chain inside the JSON-AST. Print arms in print.rs match the parser convention. EBNF prologue + crates/ailang-core/specs/ form_a.md productions updated. Four new parser pin tests cover the empty-mut, single-var, body-required, and vars-only-no-body cases. - Drift + coverage tests extended: design_schema_drift.rs adds two exemplars + match arms; schema_coverage.rs adds two VariantTag entries + EXPECTED_VARIANTS + visit_term arms; spec_drift.rs adds two exemplars + match arms. DESIGN.md §'Term (expression)' gets jsonc-blocked schemas for the two new variants. - examples/mut.ail: six-fn round-trip fixture exercising empty mut, single-var, two-var, nested-shadow, and the four supported scalar return types (Int, Float, Bool, Unit). The round_trip auto-glob and schema_coverage corpus walker both pick it up. Plan deviation: the plan named lib.rs:2572 as the typecheck dispatch stub site, but that line is actually verify_tail_positions (substantive walker). The real dispatch is synth (3403-area, stub at 3489); the orchestrator routed correctly. Tests: 564 → 579 green; cargo build green; round-trip green for the new fixture; all drift + coverage tests green. Journal: docs/journals/2026-05-15-iter-mut.1.md. Refs: docs/specs/2026-05-15-mut-local.md, docs/plans/2026-05-15-iter-mut.1.md.	2026-05-15 01:10:56 +02:00
Brummel	9a8d3850e7	iter pd.3: prelude.ail.json retired — milestone prelude-decouple closed Deleted examples/prelude.ail.json (-559 lines). The cross-form-identity preflight test that ratified pd.3's load-bearing assumption at module hash 3abe0d3fa3c11c99 has discharged its purpose and was removed along with its supporting bytes; the long-term prelude_parse_yields_canonical_hash anchor stays. The ail-CLI migrate-bare-cross-module-refs subcommand's defensive include + lockstep skip-branch removed; the rewrite logic's prelude-fallback capability silently retired with the synthetic insert (known debt, doc-comment updated to reflect). One in-mod core test relocated to crates/ailang-core/tests/workspace_pin.rs (pd.2.4 dev-dep cycle precedent — in-mod call to ailang_surface still structurally impossible). carve_out_inventory.rs: 8 → 7 carve-outs, §C4(b) row dropped, header sentence updated. form-a-default-authoring.md §C4(b) gets a "RETIRED 2026-05-14 by milestone prelude-decouple" status marker; original historical text preserved. New prelude_decouple_carve_out_pin.rs asserts examples/prelude.ail.json does NOT exist. Milestone prelude-decouple closed: prelude exists on disk only as examples/prelude.ail; ailang-core embeds zero prelude bytes; CLAUDE.md "authors write .ail" doctrine holds without exception. cargo test --workspace 573 green; bench/cross_lang.py + bench/compile_check.py exit 0; bench/check.py exit 1 with the established noise envelope (14th observation of bench_list_sum.bump_s since audit-cma; pd.3 is filesystem + spec text + test deletion only, no codegen / runtime / typecheck path edited — baseline pristine). Folds in the orphan pd.2 INDEX entry that was left uncommitted in the working tree.	2026-05-14 13:24:40 +02:00
Brummel	008d18bb18	iter pd.2: surface owns prelude embed; pd.1 shim retired Moved PRELUDE_AIL const + parse_prelude fn to ailang-surface; re-exported from surface's lib.rs. surface::load_workspace rewritten 3-line shim-call → 7-line composition: load_modules_with → reserved-name check → inject parse_prelude → build_workspace(&["prelude"]). Five deletions in core: PRELUDE_JSON, load_prelude, load_workspace_with (the pd.1 shim), the top-level cfg(test) load_one fn, and the cfg(test) crate::load_module import. Production literal-"prelude" count in crates/ailang-core/src/ is now zero. Cross-form-identity preflight PASSED at module_hash 3abe0d3fa3c11c99 — parse(prelude.ail) ≡ deserialize(prelude.ail.json), so pd.3's deletion of the JSON is safe. Three new pin tests in ailang-surface/tests/: prelude_parse_pin (succeeds + min defs); prelude_module_hash_pin (cross-form-identity + literal-hex anchor); prelude_injection_pin (inject + reservation). Plan deviations (recorded in journal): switched the regression-pin fixture from non-existent examples/hello.ail.json to hello.ail; relocated 10 in-mod core tests to crates/ailang-core/tests/workspace_pin.rs because the dev-dep cycle (core ↔ surface) prevents in-mod aliasing in the lib-test target (form-a.1 T5 precedent); preserved load_one production-symbol-deletion by adding a test-mod-private load_one helper in core's mod tests for the 2 pd.1-introduced tests still consuming it. cargo test --workspace 573 green (+9 net from pd.1 baseline). bench/cross_lang.py + bench/compile_check.py exit 0; bench/check.py exit 1 with established noise envelope (bench_list_sum.bump_s, 13th consecutive observation; pd.2 is workspace-loader-only, no codegen touch — baseline pristine).	2026-05-14 12:57:27 +02:00
Brummel	ffa80326a3	iter pd.1: core API split — load_modules_with + build_workspace + implicit_imports threading Carved load_workspace_with's inline DFS+inject+validate block into two new public fns: load_modules_with (DFS only) and build_workspace (validation + registry, takes implicit_imports: &[&str]). Threaded the new parameter through validate_canonical_type_names + check_class_ref + check_type_con_name; the four hardcoded literal-"prelude" fallback blocks in the diagnostic helpers became iter-loops over implicit_imports. load_workspace_with survives as a 3-line shim composing the new fns + the still-in-place prelude inject, so surface (ailang-surface) and all downstream crates compile + test unchanged. Retired pub fn load_workspace (zero production callers; 9 in-mod test callers migrated to load_workspace_with(&entry, load_one); load_one + the load_module import gated under cfg(test) since they're now test-only). Production literal-"prelude" count in workspace.rs dropped 8 -> 4 (all 4 in the shim's inject path; none in the diagnostic helpers, which was the spec's pd.1 target). pd.2 will move the prelude embed + the inject step into ailang-surface and retire the shim; pd.3 will delete examples/prelude.ail.json. cargo test --workspace green; bench/check.py + compile_check.py + cross_lang.py all exit 0.	2026-05-14 12:25:12 +02:00
Brummel	abcdd05991	iter clippy-sweep: clear all 61 cargo clippy warnings Hygiene sweep across the workspace under `cargo clippy --workspace --all-targets`. Before: 61 warnings. After: zero. Tests stay 563 green, `cargo doc` stays at zero warnings, and all three bench scripts exit 0 against existing baselines. Twelve lint classes, three fix shapes: - Documentation hygiene (~32 hits): `doc_lazy_continuation` resolved by adding blank lines before continuation paragraphs or rephrasing the offending line; plus four `empty_line_after_doc_comments` hits in workspace.rs where eight `///` blocks left orphan by form-a.1 T5 test relocation were converted to plain `//`. - Idiomatic refactors (~16 hits): `.err().expect()` → `.expect_err()`, redundant `.into_iter()` and `.into()` removed, `\|f\| g(f)` → `g`, `.trim().split_whitespace()` → `.split_whitespace()`, `push_str("x")` → `push('x')`, two manual `impl Default` flipped to `#[derive(Default)]` + `#[default]`, two nested `if let Some(_) = …` collapsed. - Block extraction (1 hit): a 13-line block inside an `else if` condition in synth's Var-arm extracted to a new helper `is_class_method_dispatch(name, env)` next to `qualifier_is_class_shape`. Three `#[allow]`s with inline rationale where clippy's suggestion would lose meaning: `only_used_in_recursion` on walk_pattern (the parameter preserves the five-fn walker-framework signature uniformity), 2× `if_same_then_else` on qualify_local_types shapes (two branches encode semantically distinct disqualification reasons), `too_many_arguments` on `Emitter::new` (8 workspace-flat tables; bundling would just rename boilerplate).	2026-05-14 00:48:17 +02:00
Brummel	b638abf1e2	tidy: rustdoc-sweep + drift-test-narrowing — autonomous batch Two unrelated hygiene iters bundled because they shipped together in one autonomous-while-Boss-away batch: - iter rustdoc-sweep: cleared all 23 `cargo doc --workspace --no-deps` warnings (17 in ailang-check + 4 in ailang-core + 2 in ailang-surface). Two warning classes: pub-doc-comment links to pub(crate)/private items (15 hits — replaced with plain backtick-code-spans), and unresolved/ambiguous links (8 hits — fully-qualified, disambiguated to fn-form, or escaped). No behaviour change; tests 562 → 562. - iter drift-test-narrowing: design_schema_drift.rs now scans §"Data model" only via new helper data_model_section(), instead of full DESIGN.md. Closes the audit-form-a-precursor [high] "anchor-elsewhere-passes-silently" failure mode. All 38 anchors verified pre-edit to live in §"Data model" so the tightening doesn't regress to red. New pin data_model_section_is_bounded guards the extractor against silent regression. Tests 562 → 563.	2026-05-13 13:22:37 +02:00
Brummel	e809f45e67	iter form-a.tidy: form_a.md class/instance/constraints + 3 documentary drift items Six-task post-fieldtest documentary tidy. No production-code behaviour changes; 559 tests green at every per-task gate. T1-T3: form_a.md additions - §Definitions intro "Three kinds" -> "Five kinds". - New `### Class — (class ...)` subsection: EBNF carries optional superclass (0 or 1 per ClassDef.superclass schema), method signatures with optional defaults; anchored to examples/test_22c_user_class_e2e.ail (ok 24/2). - New `### Instance — (instance ...)` subsection: EBNF carries the (method NAME (body LAM-TERM))* shape; canonical-form CLASS-REF rule explicitly stated (bare same-module / qualified cross-module); two examples — same-module abbreviated from mq3_class_eq_vs_fn_eq_classmod.ail and cross-module qualified from show_user_adt.ail; bare-cross-module-class-ref diagnostic named inline. - §Types `(forall ...)` line extended with optional `(constraints (constraint CLASS-REF TYPE)+)?` clause; explanatory paragraph added with no-instance diagnostic anchor; fifth example added to the Examples block anchored to cmp_max_smoke.ail. T4: docs/specs/2026-05-13-form-a-default-authoring.md "seven carve-outs" → "eight carve-outs" at 6 sites contradicting the §C4(b) compile-time-embed amendment (commit `9fcda8b`). Sites: preamble line 11, §C1 line 170, §C2 line 191, §C3 line 218, §"Data flow" lines 363 + 374. Post-edit grep returns 4 surviving "seven" lines (233, 238, 463, 469), all correctly §C4(a)-scope or arithmetic/future-state. T5: crates/ailang-core/src/hash.rs:50-57 — delete empty `#[cfg(test)] mod tests {}` placeholder + 6-line relocation comment. Tests live in crates/ailang-core/tests/hash_pin.rs since form-a.1 T5; placeholder served no purpose. hash_pin.rs still 10/10 passing. T6: crates/ailang-surface/tests/round_trip.rs — module-level `//!` and inner `///` docstrings rewritten to the post-T10 four-property framing (parse-determinism / idempotency / CLI-pipeline-idempotency / carve-out-anchor) instead of the retired Direction-1/Direction-2 language. Sibling-crate breadcrumbs added pointing at the other two enforcement points (roundtrip_cli.rs, carve_out_inventory.rs). Drift item B2 (audit-form-a "plan file two sites") dropped per recon verification: docs/plans/2026-05-13-iter-form-a.1.md contains zero defective "seven" sites; all four hits are internally scoped to §C4(a), arithmetic, or future-state. Decision recorded in the journal. Closes 2 of 3 fieldtest-form-a spec_gap findings (#2 form_a.md typeclass surface + #3 form_a.md class-qualifier rule for instance) and 3 of 4 audit-form-a drift items.	2026-05-13 12:25:12 +02:00
Brummel	77b28ad64d	iter form-a.1 (Tasks 1-5): additive phase + relocation First half of the form-a-default-authoring milestone-close iter (Boss-decided strategy C, big-bang). All five tasks DONE; cargo test --workspace green at every per-task boundary. T1 — Add three new tests: - parse_is_deterministic_over_every_ail_fixture (round_trip.rs) - cli_parse_then_render_then_parse_is_idempotent (roundtrip_cli.rs) - carve_out_inventory.rs (new file; #[ignore]'d until T8 deletion) T2 — Bulk-render the 99 missing examples/<stem>.ail files via `ail render`. Corpus 58 .ail (pre-iter) -> 157 .ail. Eight .ail.json carve-outs (7 §C4(a) subject-matter + 1 §C4(b) prelude) preserved. One re-loop triggered: load_workspace prefers .ail siblings since ext-cli.1, so the newly-rendered imports broke seven Group-A entries whose JSON entry-paths now resolved imports to fresh .ail. Repair: pre-emptive forward-pull of five T3 migrations + 4 transient #[ignore]s on workspace.rs mod tests (cleanly relocated in T5). T3 — 14 Group-A test files migrated from ailang_core::load_workspace to ailang_surface::load_workspace + .ail paths. Carve-out lines preserved verbatim (7 sites in typeclass_22b2.rs / typeclass_22b3.rs). T4 — 12 Group-B test files: bulk regex flip on build_and_run / build_and_run_with_alloc / build_and_run_with_rc_stats call sites (~70 e2e.rs invocations + 11 subprocess sites). Four files mis-classified Group-A as Group-B in plan recon (mono_hash_stability, prelude_free_fns, print_mono_body_shape, show_mono_synthesis); two files mis-classified Group-B as Group-A (mono_recursive_fn, mono_xmod_qualified_ref). Migrated per actual shape, not plan label. T5 — Relocated #[cfg(test)] mod tests from production source to integration test crates with ailang-surface dev-dependency: - crates/ailang-core/tests/hash_pin.rs (10 tests from hash.rs) - crates/ailang-core/tests/workspace_pin.rs (10 non-carve-out tests from workspace.rs) - crates/ailang-codegen/tests/eq_primitives_pin.rs (3 tests from codegen/src/lib.rs:3717-3799) - ailang-prose/tests/snapshot.rs migrated (helper + 8 fixtures) to .ail + ailang_surface::load_module Carve-out tests in workspace.rs mod tests preserved in-place (3× 22b2 + 3× ct1 = 6 tests). Tempdir-based loader-mechanism tests (3 sites) also preserved — they don't consume examples/. Tests: 560 passed, 0 failed, 4 ignored (was 558 + 3 T1 new - 1 transit carve_out_inventory #[ignore] = 560 active). Tasks 6-12 (bench-driver suffix flips, e2e diff-test rewrite + 4 additional raw-JSON-inspect handlers, .ail.json deletion, retiring obsolete roundtrip tests + schema_coverage corpus flip, §C3 DESIGN.md restatement, §A4 doctrine edits, WhatsNew + roadmap strike) ship in the next dispatch on this iter ID. Known debt inherited to T6-12: 4 raw-JSON-inspect tests in e2e.rs (borrow_own_demo / reuse_as_demo / render_parse_round_trip_canonical / ail_run_accepts_ail_source_with_same_stdout_as_ail_json dual-form smoke) need rewrite or #[ignore] before T8 deletion; recorded in journal Concerns + Known debt sections.	2026-05-13 11:12:48 +02:00
Brummel	3286117605	iter 24.2: class Show + 4 primitive instances + 22b TShow migration Ships class Show a where show : (a borrow) -> Str in the prelude plus primitive Show Int / Bool / Str / Float instances. Each instance body is a single-application lambda invoking the corresponding runtime primitive (int_to_str, bool_to_str, str_clone, float_to_str) — first prelude instance bodies to call runtime primitives directly. Float is included in Show (unlike Eq/Ord) because textual representation is well-defined modulo the NaN-spelling caveat at DESIGN.md §Float semantics. The 22b typeclass test corpus is migrated preemptively: 21 fixture files and 6 consumer files (typeclass_22b{2,3}.rs + hash.rs ct4 pin + workspace.rs iter22b1 tests + the instance_present.prose.txt snapshot) rename class Show / show to class TShow / tshow, analogous to the existing TEq/TOrd convention. Migration runs before the prelude additions so the workspace stays green throughout. Three new tests pin the post-mono shape: show_mono_synthesis.rs (existence of show__Int/Bool/Str/Float as Def::Fn entries in the prelude post-mono module), show_dispatch_pin.rs (bare show and tshow both Step-2 singletons workspace-globally), mono_hash_stability.rs::primitive_show_mono_symbol_hashes_stay_bit_identical (body hashes pinned for the 4 new mono symbols). DESIGN.md §Prelude (built-in) classes drops Show from the deferred-features list and appends a milestone-24 paragraph naming the class signature + the 4 instances + the body shape. print rewire stays deferred to iter 24.3. Tests: 552 passed (was 548 + 4 new). bench/compile_check + bench/cross_lang exit 0. bench/check exits 1 on the recurring noise envelope per the conservative-call lineage.	2026-05-13 03:31:40 +02:00
Brummel	99d3968656	iter mq.3: retire MethodNameCollision + multi-class E2E + DESIGN.md sync Closes the module-qualified-class-names milestone. Deletes the workspace-load workaround; the two-libraries case now resolves via type-driven dispatch at the call site with explicit qualifier as the LLM-author's disambiguation tool. Resolves both mq.2 known-debt items (active_declared_constraints plumbing, (class,method) re-key). New synth warnings channel emits class-method-shadowed-by-fn at all three fn-precedence branches per spec section Class-fn collisions. Three new E2E fixtures + integration tests cover the ambiguous, qualified, and class-fn-shadow trajectories. DESIGN.md class-names paragraph rewritten, new section Method dispatch added. Roadmap P2 marked done, milestone-24 unblocked for re-brainstorm. 9/9 tasks. 545 tests green. bench/compile_check.py + cross_lang.py exit 0; bench/check.py exit 1 (2 noise-class regressions, runtime uncoupled to typecheck iter).	2026-05-13 02:19:21 +02:00
Brummel	0eb33235eb	iter mq.1: class-ref canonical-form extension + workspace-internal class-name qualification Three schema fields move bare → canonical (bare for same-module, <module>.<Class> for cross-module): InstanceDef.class, Constraint.class, SuperclassRef.class. Symmetric to ct.1's Type::Con.name rule. ClassDef.name stays bare. validate_canonical_type_names gains three field-walks via new check_class_ref helper + two sibling diagnostics BareCrossModuleClassRef / BadCrossModuleClassRef. check_class_name_fields narrowed to ClassDef.name-only. Workspace-internal class-name keys all qualified: class_def_module, class_by_name, registry entries.0, ClassMethodEntry.class_name, class_superclasses, mono's class_index, Origin::Class.class_name. New qualify_class_ref helper at workspace.rs scope plus sibling qualify_class_ref_in_check in ailang-check. Two new positive on-disk fixtures (mq1_xmod_constraint_class{,_dep}) exercise the qualified Constraint.class shape. Recon claim that all existing fixtures' class-refs are intra-module was empirically wrong — 10 fixtures required minimal canonical-form migration. Duplicate-instance test architecturally restructured: post-mq.1 orphan-freedom makes two-modules-on-same-(class,type) structurally impossible; new test_22b1_dup_same_module fixture lands both instances in the class's module. Plan defects fixed inline: Origin::Class.class_name single construction site (plan recon off-by-one); build_class_index in mono.rs needed qualifying; build_module_globals needed Def::Instance carve-out; check_fn declared-constraint matching needed inline canonical-form lifting; NoInstance Float-aware message arm needed prelude.Eq/prelude.Ord match; coherence type-leg needed qualified- head split-and-lookup. Tasks 3-6 ran as one coherent fix. 7/7 tasks, 520 tests green. bench/compile_check.py + cross_lang.py exit 0; bench/check.py exit 1 (4 improvements-beyond-tolerance, audit-ratifiable, not a regression). MethodNameCollision + dispatch path unchanged; iters mq.2 + mq.3 land them.	2026-05-13 01:11:56 +02:00
Brummel	0d3f44bee1	iter ctt.3: KindMismatch retire	2026-05-12 22:31:57 +02:00
Brummel	9d01d0884c	iter ctt.2: Registry.type_def_module re-key to (owning_module, bare_name)	2026-05-12 22:23:46 +02:00
Brummel	79cc78507b	iter ext-cli.1: CLI accepts .ail (Form A) sources alongside .ail.json Closes the loop opened by this morning's .ailx → .ail rename. Every path-taking ail subcommand (check, build, run, manifest, render, prose, merge-prose, describe, emit-ir, diff, workspace, deps) now accepts a .ail (Form A) input as well as .ail.json (Form B). For .ail paths the subcommand parses through ailang_surface::parse in-line and proceeds with the same loaded Module value .ail.json would have produced; binary semantics are extension-agnostic. Architecture: a new ailang_surface::{load_module, load_workspace} pair dispatches on file extension. A new injection point ailang_core::workspace::load_workspace_with<F> lets the surface crate plug in an extension-aware loader without core having to import surface (which would close a crate cycle). Import resolution in workspace::visit now prefers a .ail sibling over a .ail.json sibling. The CLI binary's 18 callsites switched to the surface loaders. Surface parse failures route through workspace_error_to_diagnostic as a new SurfaceParse variant of WorkspaceLoadError, so `ail check --json foo.ail` on a malformed .ail returns a parseable JSON diagnostic with code surface-parse-error instead of the misleading `json: expected value at line 1 column 1` fall-through. Boss pre-commit correction: the implementer followed the plan verbatim and used snake_case `surface_parse_error`, but every existing diagnostic code in the codebase is kebab-case (verified via `git grep` over crates/ailang-check/src and crates/ail/src); realigned to `surface-parse-error` at three sites (the diagnostic arm + two ct1 test strings). Journal Concerns section records the correction. Tests: cargo test --workspace 487 green (+7 from this iter: 1 core unit, 4 surface integration, 1 ail E2E pair, 1 ct1 CLI diagnostic-shape). bench/check.py, compile_check.py, cross_lang.py clean on re-run; the latency.{explicit,implicit}_at_rc tail cluster occasionally flagged on first runs is the same nondeterministic cluster the previous two audits documented; baseline left pristine for the third consecutive iter. Roadmap follow-up "ail check/build/run accept .ail extension" (P2) removed. DESIGN.md §Decision 6 / "CLI" bullet gained the symmetric upward sentence: both .ail and .ail.json are first-class CLI inputs.	2026-05-12 14:45:03 +02:00
Brummel	92e830e6c2	iter 23.5: prelude free fns + E2E — Eq/Ord milestone close Five polymorphic prelude free fns (ne/lt/le/gt/ge) plus three E2E fixtures: positive composition over Int/Bool/Str, user-ADT with user-written Eq/Ord on IntBox, and Float-NoInstance with a Float-aware diagnostic addendum cross-referencing DESIGN.md §"Float semantics". Two checker-side fixes were needed alongside the prelude additions, both symmetric to the iter 23.4-prep visibility fix: - linearity::check_module_with_visible — workspace-aware callee-mode resolution so a Borrow-mode user fn forwarding into a prelude poly fn (e.g. `at_most x y = not (gt x y)`) doesn't false-fire consume-while-borrowed. - mono::collect_mono_targets — distinguish rigid forall vars from unbound metavars; rigid-bearing free-fn targets skip (they get re-collected with concrete subst when the enclosing fn itself monomorphises). Without this, a polymorphic body calling another polymorphic free fn produced a spurious __Unit specialisation whose body referenced compare at Unit. Roadmap split: shipped Eq/Ord half checked, Show + print-rewire half remains pending behind the heap-Str ABI prerequisite. DESIGN.md §"Prelude classes" amended. One pre-existing fixture (test_22b1_missing_method) renamed its class method ne → tne to avoid collision with the new prelude `ne`. Bench: check.py + cross_lang.py exit 0; compile_check.py exits 1 with one sub-ms check_ms.local_rec_capture at +26% (tolerance 25%) — prelude-growth-related noise-band fluctuation, ratifiable per spec §248-249 and journal Concerns.	2026-05-12 00:38:52 +02:00
Brummel	1d039b782e	iter ct.4.2: pin canonical-form hashes for migrated fixtures + unmigrated sanity	2026-05-11 09:51:19 +02:00
Brummel	f22f88b547	iter ct.1.7: on-disk fixture tests for canonical-form diagnostics	2026-05-11 01:46:58 +02:00
Brummel	727d2c13ec	iter ct.1.6: wire validator into load_workspace; refresh kind-mismatch test	2026-05-11 01:42:45 +02:00
Brummel	5e653ff536	iter ct.1.5a-followup: forall-constraints recursion + docstring + drop iteration-tag comments Three Minor items from the ct.1.5a quality review: 1. normalize_type_for_registry now recurses into Type::Forall.constraints[].type_, symmetric to walk_type. Closes a latent gap: a Forall with bare cross-module constraint types reaching the registry would have produced a key disagreeing with the qualified form. RED test: ct1_5a_normalize_recurses_into_forall_constraints. 2. Documented the bare-name limitation on Registry::type_def_module: two modules each defining 'type Foo' collide at insert; the proper fix (re-key as (owning_module, bare_name)) is out of ct.1's scope. 3. Removed the four iter-tag explanatory paragraphs at the normalize_type_for_lookup call sites (check/lib.rs check_fn, mono.rs three sites). Replaced each with a one-line pointer to the helper's docstring per project comment policy.	2026-05-11 01:39:26 +02:00

1 2 3

114 Commits