8ad91e7f2404830b27500bad98a98e72ba074f9f
796 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Brummel
|
8ad91e7f24 |
iter design-ledger-formal-links.1 (DONE 5/5): clause-5 hard gate + 7 prose-ref conversions + 2 disposition-(b) homeless removals + honesty-rule positive-half (whole milestone in one iter)
Positive-half completion of the DESIGN.md -> design/ split: design/
body cross-references are now formal, file-relative Markdown links
into the durable tier (design/ or source), and a new in-tree hard
gate (design_index_pin.rs clause-5,
design_body_links_are_durable_and_resolve) walks every
design/contracts/*.md + design/models/*.md, strips fenced code
(strip_fences toggles on ```/~~~ lines so a ]( inside a fence is not
treated as a link), extracts every ](path), and asserts the target
resolves file-relative to a real file under design/-or-crates/-or-
runtime/; never docs/, never an in-file #anchor.
RED-first via identity-stubbed strip_fences (four embedded synthetic
vectors -- first one FAILS); replacing the stub with the real
toggle-on-fence impl turns the test GREEN. clause-5 composes with
clause-3 into the complete invariant the milestone establishes:
every contract cross-reference is EITHER a resolving durable
file-link OR clause-3-forbidden decision-record prose.
Conversions (recon-and-corpus-verified closed set):
Task 2 (7 prose refs, 8 link tokens):
float-semantics.md:69 Prelude classes -> [..](typeclasses.md)
float-semantics.md:100 bare-path -> [Str ABI](str-abi.md)
embedding-abi.md:45 "Frozen value layout" -> [..](frozen-value-layout.md) (drop stale "below")
memory-model.md:44 Data model -> [..](data-model.md)
memory-model.md:105-106 Method dispatch -> [..](typeclasses.md) (drop stale "below"; the target heading lives in typeclasses.md:227, not in this file)
scope-boundaries.md:48 Str ABI -> [..](str-abi.md)
scope-boundaries.md:88 mixed split: ailang-core::desugar -> source link + Pipeline -> ../models/pipeline.md (drop stale "above")
Task 3 (2 disposition-(b) homeless removals):
pipeline.md:60-61 (see docs/PROSE_ROUNDTRIP.md) pointer removed, CLI prose preserved
authoring-surface.md:178-181 cross-tier pointer clause removed, ail merge-prose sentence preserved
Task 4: honesty-rule.md positive-half paragraph inserted between L14 and the existing L15-blank-L16; both docs_honesty_pin.rs-pinned phrases byte-identical at L14/L19 (now shifted to L19 -> L25 by the +6 lines).
Out of scope, preserved (asserted independently): every intra-file
"above/below"; embedding-abi.md:51 "frozen value layout below
specifies" (no quoted title, no (see) form); data-model.md
38/66/79/206/226 (in-fence ```jsonc schema annotations -- the inline
analog of the nominal-mention carve-out). INDEX.md and the
decision-records journal byte-unchanged; clauses 1-4 of
design_index_pin.rs source byte-unchanged (the only `-` lines in
the diff are the two-line //! header rewrite Task 1 Step 5 itself
delivers).
Boss-verified independently (not on agent report alone):
cargo test --workspace 647 passed / 0 failed
(+1 vs pre-milestone 646:
the new clause-5)
cargo test --test design_index_pin 5 / 5 passed
cargo test --test docs_honesty_pin 5 / 5 passed (additive
paragraph is pin-safe)
grep ](.../docs/.../) under design/ zero
grep ](#) under design/ zero
](-link count under design/ 8 (closed convert-set)
git diff --quiet design/INDEX.md ok
git diff --quiet decision-records ok
embedding-abi.md:48 pinned phrase byte-identical
One Concerns item: Task-5 Step-7's plan-predicted "`-` line count = 1"
was actually 2 because Task 1 Step 5 rewrote the //! header 5 -> 8
lines (removing the original L4 + L5, not just L5). Planner self-
review-item-8 miss on my part -- a verification-arithmetic error in
the plan, NOT an implementation defect. The substantive assertion
(clauses 1-4 source byte-unchanged) is fully satisfied; the
implementer correctly flagged it and proceeded. The plan stands as
written; the assertion's `1` should have been `2`. Lesson noted for
future header-rewrite tasks.
Spec: docs/specs/2026-05-19-design-ledger-formal-links.md
(grounding-check PASS x3 across two corpus-grounded amendments --
clause-6 + cross-ref definition; clause-5 fence-skip + closed
convert-set enumeration).
Next: mandatory milestone-close audit (no fieldtest -- zero
authoring-surface change, reasoned exclusion).
|
||
|
Brummel
|
36599bedd9 |
plan: design-ledger-formal-links.1 — clause-5 + 7 conversions + 2 disposition-(b) + honesty-rule positive-half
Single iteration covering the whole milestone (same shape as
rolesplit.1; spec is small, no build-atomicity issue — clause-5 is
isolated additive code, prose edits don't affect compilation).
Five tasks, each at task-level review granularity:
Task 1: clause-5 added to design_index_pin.rs RED-first via
identity-stubbed strip_fences (synthetic vector FAILS) →
correct toggle-on-fence impl (GREEN); module //!-header
extended to name clause-5. Test count 4 → 5.
Task 2: 7 prose-ref conversions to file-relative Markdown links
(float-semantics:69/100, embedding-abi:45, memory-model:44/
105, scope-boundaries:48/88 with the source+Pipeline split).
Exact verbatim before→after for every line. clause-5 stays
GREEN by construction (every introduced link resolves
durable).
Task 3: 2 disposition-(b) homeless-ref removals (pipeline:60-61
in-fence CLI block + authoring-surface:178-181 prose).
Pointer dropped, behavioural prose preserved.
Task 4: honesty-rule.md pin-safe positive-half paragraph between
L14 and the existing L15-blank (the two docs_honesty_pin
phrases at L14/L19 each stay verbatim on their physical
line; the additive insertion splits neither). The new
paragraph names design_index_pin.rs clause-5 by name
(nominal mention, not a link — consistent with the
existing 'Ratified by:' footer style and with §Scope).
Task 5: Whole-suite gate (646 → 647) + 5 grep+diff verifications
(no docs/ link, no #fragment, link count = 8, in-fence
schema-annotations intact, INDEX.md + decision-records
journal + clauses 1-4 byte-unchanged).
Self-review 8/8: spec coverage complete; zero placeholders; names
consistent; bite-sized; no commit steps; pin contiguity verified
(L14 + L19 stay verbatim on their physical lines, replacement body
shows L14 contiguous); no signature change ⇒ no compile-gate
ordering issue; every cargo-test filter substring is a real test
name + unfiltered runs have explicit count assertions.
|
||
|
Brummel
|
42ff44adf6 |
spec: design-ledger-formal-links — corpus-grounded amendment (clause-5 fence-skip + closed enumeration)
Plan-time corpus verification surfaced a third distinct gap the brainstorm-sample missed: data-model.md:38/66/79/206/226 are 'see §"..."' annotations inside fenced jsonc code blocks (verified: fences at 30-87 and 203-228; the 5 refs fall inside), where a Markdown link is literal text — not a navigable link on any renderer. Per the "two+ surfaced ⇒ ground the spec properly once, don't iter-patch" discipline: amendment 2 is the definitive corpus-grounded pass, not a fourth-patch returning later. Every convert-set ref's prose-vs-fence status + exact bytes personally verified before amending. - clause-5 (Concrete a): adds a strip_fences helper toggling on triple-backtick / tilde lines; the per-file scan runs targets(&strip_fences(&raw)); the RED-first synthetic vector gains two fence-skip assertions (identity-stub of strip_fences ⇒ first assert fails ⇒ genuine RED). Contract grows from 3 to 4 predicates (+ fenced-code-not-scanned). - Scope section: third out-of-scope carve-out — a 'see §"..."' inside a fenced code block is schema-example documentation = the inline- annotation analog of the nominal-mention carve-out (a // comment in a code example is code documentation, not a 'go browse there' pointer). Clean extension of the converged navigational-vs-nominal principle. - Acceptance 3: convert-set CLOSED and exhaustive — 8 prose refs (float-semantics:69/100, embedding-abi:45, memory-model:44/105, scope-boundaries:48/88), 2 disposition-(b) homeless removals (pipeline:61, authoring-surface:180), 6 stay-prose (data-model in-fence x5, embedding-abi:51). Iter-provenance suffixes stripped on conversion. scope-boundaries:88 splits into a source link plus a Pipeline cross-file link. grounding-check third dispatch on the amended bytes: PASS, all 8 assumptions ratified (incl. corpus-state-verified A4-A7 per the rolesplit precedent for text-enumeration claims). |
||
|
Brummel
|
b1a0364bf2 |
spec: design-ledger-formal-links — recon-driven amendment (clause-6 + cross-ref definition)
Planner Step-2 recon (ailang-plan-recon) surfaced two spec defects;
forward-fix amendment (
|
||
|
Brummel
|
63b669fa8f |
spec: design-ledger-formal-links — formal cross-links in the design/ ledger
Positive completion of the DESIGN.md -> design/ split: informal prose cross-references become formal file-relative Markdown links, gated by a new RED-first design_index_pin.rs clause-5 (every design/ body link resolves into the durable tier or fails the build). INDEX spine stays repo-root-relative (registry tier, clause-1 unchanged). No authoring surface. Eight converged commitments + the user-decided INDEX sub-fork; grounding-check PASS 7/7. roadmap [~] in-flight. |
||
|
Brummel
|
2ee408770e | roadmap: close DESIGN.md->design/ ([~]->[x]); WhatsNew: design-spec-restructure done-state | ||
|
Brummel
|
f683f1aec8 |
iter design-md-rolesplit.tidy (DONE 7/7): resolve milestone-close audit drift
Gate-first TDD: widened design_index_pin.rs clause-3 to a hand-rolled
FAITHFUL Sweep-1 superset (case-sensitive digit-anchored line anchors
+ Sweep-1's ^[^/]* path-excluded date + the audit-named
decision-record phrases, case-insensitive); no regex dep; the blanket
iter-detector rejected as unworkable. Sentence-level strip of
faithfully-migrated history/decision-record prose out of 5 contract
files (the audit's 3 spot-checked + roundtrip-invariant.md +
data-model.md the exhaustive scan found) into the decision-record
journal, each replaced by its present-tense contract equivalent;
float-semantics.md stale 'see Str ABI below' -> str-abi.md;
architect_sweeps honesty sweeps re-scoped to design/contracts only
(models/ is the narrative tier) + ailang-architect.md lockstep.
Invariant: clause-3 GREEN => Sweep-1 clean in contracts/.
The prior dispatch correctly BLOCKED on a real plan defect (iso_date
lacked Sweep-1's path-exclusion, over-firing on legit
docs/specs/2026-.. citations); per the two+-defects-in-one-iteration
discipline the audit Resolution mechanism+scope were corrected
upstream in lockstep (
|
||
|
Brummel
|
f2cdd67e69 |
plan+audit: design-md-rolesplit.tidy re-derived on planning-time evidence (mechanism + scope corrected)
The tidy's gate-first Task 1 RED-verification + Boss independent
verification surfaced two defects in the audit Resolution as first
written — caught exactly where the planner->Boss loop is designed to,
before any contract byte moved. Per the 'two+ defects in one
iteration => fix the upstream artifact, do not patch a third time'
discipline, the audit Resolution is corrected in lockstep with the
plan re-derivation:
- Mechanism (Resolution-4): the 'case-insensitive iter-code regex'
clause-3 design is REJECTED as unworkable — a blanket
iter/milestone detector conflates the memory-model rule-names
'Iter A'/'Iter B' and ordinary words 'pre-existing'/'pre-set'/
'pre-Boehm' with provenance, over-firing on legit present-tense
contract prose (4 no-strip files). Replaced by a FAITHFUL Sweep-1
superset: case-sensitive digit-anchored Sweep-1 line anchors
(confirmed ZERO across all contracts) + Sweep-1's ^[^/]*
path-excluded date (so docs/specs/2026-.. citations are not
flagged — repairs the iso_date over-fire the implement
orchestrator correctly BLOCKED on) + the audit-named
decision-record phrases (case-insensitive). No regex dep. The
load-bearing invariant (clause-3 GREEN => Sweep-1 clean) is
preserved; it never required the blanket detector.
- Scope (Resolution-1): the architect's [medium] was a 3-file
spot-check; the exhaustive scan found roundtrip-invariant.md:73
('at iter form-a.1') and data-model.md:149,161 ('loop-recur iter
1:') also carry lowercase provenance. True strip set = 5 files;
plan Task 5b adds the 2 (spirit-cleanup, not gate-blocking).
Plan self-review 8/8 re-run; clause-3 = hand-rolled faithful Sweep-1
superset, no regex dep, no blanket iter detector.
|
||
|
Brummel
|
4f61a7aa4f |
plan: design-md-rolesplit.tidy — audit drift fix (history->journal, sweep re-scope, clause-3 widen)
7 tasks executing the audit Resolution's 5 points: (1) gate-first RED — widen design_index_pin.rs clause-3 to a hand-rolled PROVABLE SUPERSET of architect_sweeps Sweep-1 over design/contracts/ (no regex dep; subsumption proof inline), verify RED vs the un-stripped tree; (2-4) sentence-level strip the faithfully-migrated history/decision-record prose out of typeclasses.md / str-abi.md / scope-boundaries.md into the decision-record journal, per recon's per-sentence contract-residue map, each docs_honesty_pin pinned run guarded contiguous; (5) fix float-semantics.md stale 'see Str ABI below' -> str-abi.md; (6) re-scope architect_sweeps DESIGN_GLOB to design/contracts only (models/ is the narrative tier) + lockstep ailang-architect.md; (7) whole-tree GREEN gate (clause-3 RED->GREEN, 4/4, sweep exit 0, suite >=646/0, acceptance grep CLEAN). Self-review 8/8. |
||
|
Brummel
|
2ba5e16806 |
audit design-md-rolesplit (milestone close): DRIFT (one tidy iter) + bench causally-exonerated (baseline pristine)
Architect: relocation byte-faithful; one [medium] spirit-finding —
faithfully-migrated decision-record/history prose in
design/contracts/{typeclasses,str-abi,scope-boundaries}.md dodges the
6 literal clause-3 markers but is the relitigation content the
split's spirit sends to journals; [low] float-semantics.md
stale-direction 'see Str ABI below'. Both routed items: tidy not
ratify (the str-abi.md:23 advisory Sweep-1 exit-1 correctly
diagnoses real pre-existing history residue, byte-identical
DESIGN.md@deeffb1 — faithfully migrated, not split-introduced).
Bencher: causally-exonerated, DECISIVE on byte-evidence — emitted IR
AND final -O2 binaries byte-identical
|
||
|
Brummel
|
176821c2e7 |
iter design-md-rolesplit.1 (DONE 9/9): DESIGN.md -> design/ ledger role-split
The 3020-line docs/DESIGN.md is replaced by the design/ ledger:
design/INDEX.md (sole addressable spine, typed Contracts+Models tables,
polymorphic links — prose file OR authoritative source //!), 14
design/contracts/*.md test-linked invariants + 3 source-link-only
contracts (mangling/env-construction/qualified-xref, no prose file —
code is SoT), 5 design/models/*.md whitepapers, and
docs/journals/2026-05-19-design-decision-records.md (the
relitigation-guard archive — every why/rejected/does-not-do/rollback/
empirical ### moved out at ###-granularity). Clean cut: git rm
docs/DESIGN.md, no stub.
RED-first crates/ailang-core/tests/design_index_pin.rs — the 4-clause
anti-regrowth spine (DESIGN.md-gone / every-INDEX-link-resolves /
every-contract-names-a-resolvable-ratifier /
contracts-carry-no-decision-record-prose) — demonstrably RED before,
GREEN after. Build-atomic by task ordering: design_schema_drift.rs's
include_str! (the only compile-time consumer) retargeted to
design/contracts/data-model.md BEFORE the deletion; its
## Data model/## Pipeline slicer dropped (a simplification the split
enables). 2 NoInstance diagnostics + 2 lockstep E2Es retargeted to
design/contracts/{float-semantics,typeclasses}.md. ~12 agent reading
lists + 5 SKILL bodies + CLAUDE.md + skills/README.md + ~25
code/C/.ail/spec comment xrefs retargeted; OQ7 dangling 'Iter 13b'
cite deleted (no forward target — a pointer would be fiction).
honesty-rule.md rewritten so the rule names the new home
(rationale->journals), resolving the recon-found internal
contradiction; the two docs_honesty_pin.rs:70,72 pinned phrases kept
verbatim+contiguous.
Boss-verified independently: cargo test --workspace 646 passed /
0 failed; design_index_pin 4/4; acceptance grep CLEAN of live
DESIGN.md refs (residuals = only the spec-mandated clause-4
deletion-enforcer). 2 DONE_WITH_CONCERNS routed to the mandatory
milestone-close audit: (a) str-abi.md:23 '(iter str-concat,
2026-05-13)' provenance stamp trips advisory architect_sweeps Sweep-1
— Boss-confirmed byte-identical to DESIGN.md@deeffb1:2062-2065, a
faithfully-migrated PRE-EXISTING anchor (regexes verbatim, only path
retargeted), NOT split-introduced — RATIFY-or-tidy at audit; (b) a
now stale-direction intra-prose 'see Str ABI below' cross-ref in
float-semantics.md — audit-adjudication candidate. Plan defect noted:
Task 9 Step 4's verbatim acceptance grep used a ^./ anchor not
matching the system's grep -rIn output; substance re-verified CLEAN.
Spec grounding-check PASS x2. Journals INDEX + decision-records
pointer appended (Boss-only).
|
||
|
Brummel
|
deeffb1872 |
plan: design-md-rolesplit.1 — the whole milestone, build-atomic by task ordering
9 tasks: (1) RED-first design_index_pin.rs 4-clause guard; (2) design/INDEX.md + 14 prose contracts; (3) 5 model whitepapers; (4) decision-record journal + INDEX pointer; (5) retarget the 3 doc-reading tests GREEN vs design/; (6) 2 diagnostics + 2 E2Es lockstep; (7) architect_sweeps.sh spine repoint; (8) ~12 agent lists + 5 SKILL bodies + CLAUDE.md + README + bucket-(e) comment xrefs + OQ7 cite deletion; (9) clean cut (git rm DESIGN.md) + whole-tree gate + acceptance grep. Build-atomicity by construction: include_str! retarget (Task 5) precedes DESIGN.md deletion (Task 9), data-model.md exists from Task 2 — every intermediate cargo build is green, no monster task. Self-review 8/8 (contiguity + compile-gate-ordering + filter-resolution scrubbed). |
||
|
Brummel
|
314e5e4920 |
spec: design-md-rolesplit — Boss-adjudicated relocation appendix (planner recon resolution)
plan-recon surfaced 7 open questions (genuine Boss design judgement, not architectural forks). Adjudicated and folded into the spec as an authoritative placeholder-free Appendix relocation map (every ##/### of DESIGN.md -> exactly one destination): - design_index_pin.rs clause-2 widened to accept crates/**/src/*.rs in-source #[cfg(test)] mod tests as first-class ratifiers. - INDEX ratifier tokens resolved to recon-verified paths; memory-model -> uniqueness.rs (in-source), tail-calls -> lib.rs:5044 tail_call_in_non_tail_position_is_rejected (NOT loop_recur — different construct), env-construction path corrected to ailang-check/tests. - 3 ledger additions the 12-list under-counted: qualified-xref (source-link only), str-abi (prose+source; the one sanctioned sentence-level move, 2802 bold para), scope-boundaries (present-tense honesty-pinned). Net 15 contracts / 5 models / 1 decision-record journal. - OQ7: lib.rs:103 dangling 'Iter 13b' cite is deleted not retargeted (no forward target exists; a pointer would be fiction). grounding-check re-dispatched after the material edit: PASS, all 6 changed/new ratifiers resolve to named currently-green tests. |
||
|
Brummel
|
a64b2ccb2a |
spec: design-md-rolesplit — DESIGN.md role-split into design/ contracts+models ledger
Role-split the 3020-line docs/DESIGN.md into design/contracts/ (the hot, test-linked invariant set), design/models/ (one whitepaper per model), and design/INDEX.md as the sole addressable spine; decision- records rehomed to docs/journals/. Clean cut (DESIGN.md deleted, no stub), ###-subsection relocation granularity, build-atomic landing (design_schema_drift.rs include_str! forces one commit), polymorphic INDEX links (code-SoT contracts point at source //!, no prose dup), typed-INDEX anti-regrowth pin (design_index_pin.rs). grounding-check PASS 13/13 after one re-dispatch (commitment-4 pin-status claim corrected: Decision-6 :242 audit-trail sentence is pinned by no test, retired to the decision-record journal, no successor pin by design). roadmap: DESIGN.md->design/ marked [~] in flight (spec landed). |
||
|
Brummel
|
dd5b18378f |
docs: DESIGN.md §Embedding ABI — current-state honesty (no general-ABI claim)
The §"Embedding ABI" prose presented the M3 contract as "the embedding ABI" — a general boundary — and justified the layout freeze with "this is what codegen emits today". Both overclaim: - The accepted set (bare scalar | single-ctor all-scalar record) is the *whole* contract, narrow by construction. The host hand-constructs and hand-reads the box layout directly; there is no general value-marshalling layer. The text now says this plainly instead of framing the set as a subset of a wider ABI. - The freeze is reframed as the consequence of that direct layout exposure (the host is the contract surface), not as "frozen because that is what lower_ctor emits". - "MUST NOT move these offsets" is corrected to "for an exported type" — the prior wording overclaimed the freeze as binding every record layout; the commitment binds exported types and thereby constrains codegen repacking of exported records. Present-tense Ist-state mirror only: no lockstep/wire-contract design, no post-mortem, no aspirational "should become". Schema section untouched. Verified green: design_schema_drift (8), docs_honesty_pin (5), effect_doc_honesty_pin (4), embed_record_layout_pin (1), embed_staticlib_lowering (3). |
||
|
Brummel
|
d160f2c977 |
roadmap: close Embedding ABI — M5 ([~]->[x]) — M1–M5 arc complete, audited+ratified+doc-honest; WhatsNew + P2 reframed
M5 done 2026-05-19: real backtest over real Pepperstone tick data
through the real external data-server into the shipped M3-frozen
kernel, across a per-thread-ctx thread swarm; symbol-fan (headline
existence proof) + time-shard (first actual proof of chunk-boundary
invisibility); globally leak-free, deterministic. Zero
language/compiler change; one runtime change (
|
||
|
Brummel
|
70f2a318e0 |
iter embedding-abi-m5.tidy (DONE 3/3): milestone-close doc-honesty drift — pin-safe, doc/comment-only
Resolves the M5 milestone-close audit DRIFT (audit journal |
||
|
Brummel
|
e81fb90d88 |
plan: embedding-abi-m5.tidy — milestone-close doc-honesty drift (pin-safe, doc/comment-only)
Resolves the M5 milestone-close audit DRIFT (audit journal |
||
|
Brummel
|
28ab56af7e |
audit embedding-abi-m5: milestone close — RATIFY gc_rss trio (evidenced) + DRIFT (one doc-honesty tidy); P2 bench noise causally exonerated, baseline pristine for it
Architect: Invariant 1 PASS (zero data-server in any compiler
crate/runtime; ail-embed its own workspace root); M3 frozen-layout
SSOT unmoved (the lone rc.c change
|
||
|
Brummel
|
0900f3f413 |
iter embedding-abi-m5.3 (DONE 3/3): time-shard boundary-invisibility proof + friction harvest
Final functional M5 iteration (spec |
||
|
Brummel
|
67027ab0f9 |
plan: embedding-abi-m5.3 — time-shard boundary-invisibility proof + friction harvest
Final functional M5 iteration (spec ae905de; builds on green m5.1 |
||
|
Brummel
|
dbd76e5503 |
fix(ail-embed): GREEN — build.rs tracks runtime/ as rerun-if-changed; M5 swarm leak-proof armed & deterministic
bugfix-swarm-rc-alloc-undercount, GREEN stage. RED is the separate audit-trail commit |
||
|
Brummel
|
483117d39b |
test(ail-embed): RED — build.rs links a stale libailang_rt.a (missing rerun-if-changed on runtime sources)
bugfix-swarm-rc-alloc-undercount, RED stage (audit trail; GREEN follows separately via implement mini-mode). Root cause of the m5.2-resume-attempt residual (the M5 swarm leak-proof still non-deterministic after the atomic-counter fix |
||
|
Brummel
|
6500ca0493 |
ail-embed: re-quarantine symbol_fan_swarm_leak_free — atomic-global fix necessary but insufficient (doc-honesty + finding record)
Attempted to un-#[ignore] the M5 swarm leak-proof as the integration-level acceptance of bugfix-rc-global-stats-race ( |
||
|
Brummel
|
7bfa11e838 |
fix(rc): GREEN — atomic global g_rc_* stats fallback counters (swarm-safe)
bugfix-rc-global-stats-race, GREEN stage. RED is the separate
audit-trail commit
|
||
|
Brummel
|
427b687b95 |
test(rc): RED — non-atomic global g_rc_* stats counters race under a multi-threaded host
bugfix-rc-global-stats-race, RED stage (audit trail; GREEN follows
separately via implement mini-mode).
`g_rc_alloc_count`/`g_rc_free_count` (runtime/rc.c:90-91) are plain
`static uint64_t`; the `__ail_tls_ctx == NULL` fallback at rc.c:161
and rc.c:212 does a non-atomic `++`. Concurrent host-side
ailang_rc_alloc/ailang_rc_dec outside a bound ctx race the
read-modify-write and silently drop updates. New C host (8 threads
x 2_000_000 alloc-then-dec, no ailang_ctx_new so the global path is
taken, no box crosses a thread) + integration test asserting the
atexit Σ is exact. Boss-verified RED: allocs=2141382 expected
16000000, live=-131242 (deterministic-fail under this contention,
not flaky).
NOT a memory bug — Ctx:!Send keeps every box on one thread, the
per-object refcount header op is correct, programs are bit-exact;
the only defect is the under-counted statistics Σ (the M5 iter 2
symbol-fan leak-proof finding,
|
||
|
Brummel
|
b724cd17a1 |
iter embedding-abi-m5.2 (PARTIAL 2/3): data-server adapter + symbol-fan swarm; leak-proof surfaced a non-atomic global g_rc_* stats race
M5 iteration 2 (spec |
||
|
Brummel
|
9cc9d9c517 |
plan: embedding-abi-m5.2 — data-server adapter + symbol-fan swarm + leak-proof
M5 iteration 2 (spec ae905de; builds on m5.1
|
||
|
Brummel
|
204c171e60 |
iter embedding-abi-m5.1 (DONE 3/3): lean ail-embed core + build.rs + hermetic smoke
M5 iteration 1 (spec |
||
|
Brummel
|
22f02aa26b |
plan: embedding-abi-m5.1 — lean ail-embed core + build.rs + hermetic smoke
First iteration of M5 (spec
|
||
|
Brummel
|
ae905de00c |
spec: embedding-abi-m5 — ail-embed adapter + data-server wiring + thread-swarm backtest
User-approved 2026-05-19; grounding-check PASS (all load-bearing
assumptions are already-shipped M3 ABI behaviour, each pinned by a
green non-ignored integration test: embed_tick_e2e own+borrow,
embed/tick_roundtrip.c, embed_staticlib_cli, embed_swarm_tsan,
embed_staticlib_alloc_guard). Terminal embedding milestone, zero
language/compiler/runtime change — ail-embed is a lean reusable
embedding module (Rust port of the audited tick_roundtrip.c) + the
real E2E; in-repo, [workspace]-excluded so the compiler workspace
owes nothing to ../libs/data-server or /mnt (Invariant 1 in the
dependency graph, not just on paper). Real data-server + real
Pepperstone ticks; symbol-fan headline + time-shard
boundary-invisibility proof (per-shard bit-exact; whole-window only
within f64-reassociation tolerance — self-review fix).
roadmap: M5 [ ]->[~] open in-flight, spec pointer added, dangling
"todo above" dependency reconciled to shipped 170464f; M4-retired
and Tick-coverage struck/done entries pruned (their own text
scheduled deletion at next-milestone-start; permanent rationale
survives in 2026-05-18-brainstorm-embedding-abi-m4-retired.md, still
pointed to by M5's context line). Mirrors the M3
|
||
|
Brummel
|
208d7095bc |
fix(check): GREEN — over-strict-mode recognises ctor-rebuild-from-primitive-fields as a consume
Drives the RED test from
|
||
|
Brummel
|
a11cb7cc9f |
test(check): RED — over-strict-mode false-positive on ctor-rebuild consume
RED-first audit trail (debug skill; fix follows as a separate GREEN commit). Test-only, +97 lines in the linearity in-source test module, no production change. Bug: the [over-strict-mode] lint emits a conservative false-positive. The consume-detection (any_sub_binder_consumed_for / pattern_has_consumed_heap_binder, crates/ailang-check/src/linearity.rs :853,942) only recognises a consume of an (own (con T)) param when a heap-typed pattern-binder is moved out of `match p`. When p is destructured into purely primitive fields (e.g. Float/Int) that are fed into a Term::Ctor rebuilding p's own ctor, that rebuild's re-consumption of the dismantled allocation is invisible, so the lint wrongly tells the author `(borrow ...)` would suffice. It is over-strict, never under-strict (exit 0; codegen/ABI unaffected) — but an LLM author "fixing" the spurious warning by flipping an export's declared mode own->borrow would silently invert the ABI ownership contract, which is why a low-severity advisory FP gets a real RED-first fix. The carrier's initial hypothesis (nested inner `match` is the discriminator) was disproved during diagnosis: the M3 embed_backtest_step_record.ail is silent only because its implicit-mode scalar Float param disables the lint via the activation gate (linearity.rs:327), not because it handles the rebuild; the defect reproduces with a single param and no nesting. The RED unit is therefore the general synthetic shape — an (own (con T)) param consumed by a term-ctor rebuild of its own ctor — not the embed fixtures. RED test (fails now, goes GREEN when consume-detection sees the ctor-rebuild re-consumption): crates/ailang-check/src/linearity.rs :: linearity::tests::over_strict_mode_silent_when_ctor_rebuilt_from_primitive_fields |
||
|
Brummel
|
32e59766f9 |
roadmap: Tick-coverage on M3 [todo] -> [x] (170464f) — keep one cycle for context
|
||
|
Brummel
|
170464fca8 |
test(embed): pin two-record-param per-tick (State, Tick) -> State on the shipped M3 ABI
Coverage backfill for an already-shipped capability — NO language / checker / codegen / schema / runtime change (4 new files, all under examples/ and crates/ail/tests/). Property protected: the M3 export gate is_c_abi_type runs as a per-parameter loop, accepting a single-ctor all-scalar record independently per param; the staticlib forwarder maps every non-scalar Type::Con to a bare ptr (M3-frozen). So a kernel (State, Tick) -> State with BOTH params single-ctor all-scalar records is callable from C today — a record Tick pushed per call, not just a scalar sample. Every shipped M3 fixture pushes a scalar Float; none pinned the two-record-param shape (the actual minimal data-server binding). This is the residual of the retired M4. Added: - examples/embed_backtest_step_tick.ail (own Tick) - examples/embed_backtest_step_tick_borrow.ail (borrow Tick) - crates/ail/tests/embed/tick_roundtrip.c (C host, -DBORROW) - crates/ail/tests/embed_tick_e2e.rs (2 E2E tests) Both E2E tests pass on HEAD (Boss-verified, not just agent-claimed): own + borrow, globally leak-free (Sigma allocs == Sigma frees across the ctx readback + g_rc atexit lines, the M3 dual-stat-line model), acc/n value-correct, exit 0. Independently re-confirms the M4 retirement reasoning: the capability is genuinely present in M3. Honest, deliberately NOT silenced: the new fixtures emit an advisory [over-strict-mode] warning (ail check still exits 0, non-gating) that the M3 scalar-sample original does not. Root cause characterized: a conservative over-strict-mode false-positive whose discriminator is the nested second (match tick ...) — structurally identical `st` handling warns when its term-ctor rebuild is nested inside an inner match. It is advisory only and does not affect codegen, the ABI, or the proven property. The fixture is kept in its LLM-natural form (dont-adapt-tests-to-bugs); the lint precision wart is surfaced as a separate finding, not papered over. |
||
|
Brummel
|
38150ae923 |
roadmap: retire Embedding ABI — M4 (never speced) — speculative infra by feature-acceptance clause 2
M4 (sequence crossing via the List ADT) was struck during its own /boss brainstorm, in the Step-2/3 Q&A, before any spec — the "problem mis-framed -> don't ratify a known-unneeded shape into the roadmap" brainstorm path. No spec, no grounding-check, no planner handoff. Why: held against DESIGN.md feature-acceptance criterion clause 2, M4 removes no redundancy. The shipped M3 export gate is_c_abi_type (crates/ailang-check/src/lib.rs:1934-1953) is a per-parameter loop accepting a C scalar OR a single-ctor all-scalar record independently per param; the forwarder's llvm_scalar maps every non-scalar Type::Con to ptr (M3-frozen). So (State, Tick) -> State with both as single-ctor all-scalar records is already gate-accepted and forwarder-supported today. The minimal data-server binding is M3 (shipped) + a host-side per-tick loop; cons-list crossing would add a 2N+1-box-per-chunk host builder and the deferred flat-array perf debt, with no named consumer (M5's adapter unrolls each chunk host-side; whole-chunk in-kernel visibility is semantically void — State threads across calls regardless of chunk boundaries). Outcome: M4 retired in docs/roadmap.md (struck entry kept one cycle for context, never [x] — never shipped); M5 reconciled (depends on M4 -> M3 + the Tick-coverage todo; adapter unrolls host-side; friction feeds the host-per-tick-FFI vs. batch-crossing P2 perf decision); residual recorded as a new [todo] Tick-coverage on M3 — an E2E + fixture pinning the two-record-param per-tick (State, Tick) -> State shape (test backfill, no brainstorm). Rationale + the honest mid-Q&A correction (I had wrongly asserted M5 needs M4) in docs/journals/2026-05-18-brainstorm-embedding-abi-m4-retired.md; INDEX.md mirrors it. |
||
|
Brummel
|
c75fb805a6 | roadmap: close Embedding ABI — M3 ([~]->[x]) — milestone substantively closed + sound (record crosses C ABI in/out, ownership follows declared mode, value layout frozen+byte-pin-enforced, all invariants held, Invariant 1 clean, bench causally exonerated NO-ratify); no WhatsNew (next item M4 is a new milestone — a /boss bounce-back, not done-state) | ||
|
Brummel
|
63d7d60dd1 |
iter embedding-abi-m3.tidy (DONE 3/3): close M3 audit [medium]+[low] doc-honesty drift, pin-safe
[medium] DESIGN.md §"Embedding ABI": surgically replaced ONLY the contradicted M1-era parenthetical (asserted the export boundary is scalar-only — false post-M3, a single-ctor record is an accepted export type) with the present-tense truth pointing at the frozen-layout SSOT + the own/borrow mode contract. The parenthetical shared physical line :2300 with the docs_honesty_pin:135 pinned bare-scalar sentence; the edit kept every pinned word (planner Step-5 item-6 pin-safety, the M2.tidy precedent — docs_honesty_pin stayed 5/5 green, RED-restore path never triggered). [low] codegen forwarder-body comment honesty fix (comment-only; the IR byte-pins assert generated code not comments — byte-identical before/after). Boss-verified: both stale fragments grep-absent; 4 standing pins green at the recon baseline; workspace 639/77 byte-unchanged; diff exactly 2 files. No behaviour change; the pins are the coverage (M2.tidy precedent, no audit/fieldtest gate). bench already carry-on/NO-ratify at the M3 audit (causally exonerated). One non-gating planner-quality grep defect recorded in the journal Concerns (orchestrator handled it correctly, no code bent). |
||
|
Brummel
|
4fc3470552 | gitignore: .claude/scheduled_tasks.lock (Claude Code harness runtime artefact; the tracked .claude/ skill+agent symlinks are unaffected) | ||
|
Brummel
|
44ced513dc | plan: embedding-abi-m3.tidy — reconcile M3-audit [medium]+[low] doc-honesty drift (3 tasks, pin-safe parenthetical-only edit + comment-only fix, M2.tidy precedent) | ||
|
Brummel
|
b8a60b1ec7 |
audit embedding-abi-m3: milestone close — DRIFT (1 [medium]+[low] doc-honesty -> one tidy); bench check.py exit 1 decisively causally exonerated (byte-identical generated IR HEAD vs pre-M3 9a609ae), NO ratify; architect Invariant 1 + M1/M2 byte-invariant + frozen-SSOT consistency all clean
|
||
|
Brummel
|
4ea8bc5faf |
iter embedding-abi-m3.1 (DONE 6-7): freeze the value layout — DESIGN.md frozen-layout SSOT + lockstep pointers + enforceable byte-pin
Tasks 6-7 of the Boss-repaired split dispatch (Tasks 1-5 committed
|
||
|
Brummel
|
d5c565d48d |
iter embedding-abi-m3.1 (PARTIAL 5/7 + Boss spec-defect repair): single-ctor scalar record crosses the C ABI, ownership follows declared mode
Tasks 1-5 GREEN. T1 baseline pins (re-point annotation + @ailang_rc_alloc heap-box byte-pin: size=8+n*8, tag@0, fields@8/16). T2 export gate widened (is_c_scalar -> two-level is_c_abi_type: single-ctor all-Int/Float record; multi-ctor/Str/List/nested still RED; gate suite 10/10; M1 adt-ret must-fail re-pointed to multi-ctor+Str Reading). T3 codegen forwarder widened (llvm_scalar record Type::Con -> ptr; M2 forwarder body byte-unchanged; 3/3 staticlib pins). T4/T5 E2E record round-trip own+borrow, global leak-freedom. Boss spec-consistency repair (M2.1-precedent class): orchestrator correctly BLOCKED Task 5 on a genuine spec defect -- the single-ctx-readback allocs==frees proof model is unsatisfiable for borrow (and only coincidentally passes for own) because M2's TLS-ctx is bound only during the synchronous forwarder call, so host-side decs land on g_rc_*, not ctx. Boss-verified globally leak-free + value-correct both modes. Spec + plan + harness amended to the stronger global model (sum all ailang_rc_stats: lines; the M2-TLS cross-attribution documented as correct behaviour). No fresh grounding-check (removes an over-strong measurement assumption). Tasks 6 (DESIGN.md frozen-layout SSOT + lockstep pointers + freeze wording + enforceability demo) and 7 (workspace-green gate) re-dispatched on the amended plan. Bench/architect milestone-close is audit-owned. iter embedding-abi-m3.1 (PARTIAL); INDEX.md line deferred to the DONE commit |
||
|
Brummel
|
15ee3c5c8f | plan: embedding-abi-m3.1 — frozen value layout + single-ctor record crossing + RC ownership contract (7 tasks, RED-first, task 1 fixed-first baseline pins per spec sequencing) | ||
|
Brummel
|
1fbb9c433b | spec: embedding-abi-m3 — frozen value layout + single ADT/record crossing + RC ownership contract (user-approved, grounding-check PASS 8/8); open in-flight [~] | ||
|
Brummel
|
9a609aecc7 |
roadmap: close Embedding ABI — M2 ([~]->[x]); WhatsNew
M2 (per-thread runtime context + concurrency safety) fully closed: spec |
||
|
Brummel
|
a80d495ab3 |
iter embedding-abi-m2.tidy: '## Embedding ABI (M1)' -> '## Embedding ABI' lockstep rename (M2 audit doc-honesty fix)
Resolves the M2 milestone-close audit's only actionable drift item (architect [medium] DESIGN.md:2266 stale (M1) header vs its now-M2 present-tense body + coupled [low] :2354 xref). Current-state-mirror: the section describes the current embedding ABI (M1+M2), so the milestone tag is internal history, not current state. 5 live-coupling sites renamed in lockstep, 3 files: - docs/DESIGN.md:2266 header '## Embedding ABI (M1)' -> '## Embedding ABI' - docs/DESIGN.md:2354 schema-block xref 'see §"Embedding ABI"' - docs_honesty_pin.rs:134 test comment + :136 assert-message - crates/ailang-core/specs/form_a.md:89 live forward-xref (Boss-added 5th site: plan-recon-undercount countermeasure surfaced a live dangling-xref the architect's 3-site scope missed; folded in on the merits — a half-rename contradicts the tidy's own thesis) docs_honesty_pin.rs:135 asserted substring (the rename-immune DESIGN.md body sentence) byte-verbatim untouched. Committed append-only history NOT falsified (Boss-verified diff = 3 content files + journal + stats only). Pins green before AND after (docs_honesty_pin 5/0, design_schema_drift 8/0). Zero language/checker/codegen/schema change. |
||
|
Brummel
|
d1241b12c7 | plan: embedding-abi-m2.tidy — DESIGN.md '(M1)'->'Embedding ABI' lockstep rename (5 live sites: header+:2354 xref+pin comment/msg+form_a.md:89; pinned :135 substring rename-immune, untouched) | ||
|
Brummel
|
ad88dec3d8 |
audit embedding-abi-m2: milestone close — DRIFT (1 [medium]+[low] doc-honesty -> tidy); bench exit 1 causally exonerated, NO ratify
Architect drift_found: the only actionable item is the stale '## Embedding ABI (M1)' DESIGN.md header (:2266) vs its now-M2 body + coupled :2354 xref — a current-state-mirror honesty desync the iter journal flagged truthfully (Task-7-scope-deferred to preserve the docs_honesty_pin:135 verbatim sentence). Everything substantive holds (Invariant 1, internal-convention byte-invariance, Decision-10 note present-tense-correct, lockstep, no unrequested extras). Bench check.py exit 1 (bump_s + 2x rc-latency max_us). M2 changed the benched runtime path so byte-identical exoneration did not apply -> ailang-bencher localised: H0 refuted, all 3 firings are the two tracked roadmap-P2 noise families (bump_s causally impossible from M2's diff; rc.c hunk branchless+free; max_us median/p99 flat + non-reproducible). NO baseline ratified; not M2 artefacts. Resolution: doc-honesty drift -> tidy iter embedding-abi-m2.tidy; bench -> carry-on. Roadmap [~]->[x] after the tidy lands clean. |
||
|
Brummel
|
fbeeadeba5 |
iter embedding-abi-m2.1 (DONE 5-9): swarm-safe ctx ABI complete + sanitiser-verified
Completes Embedding ABI — M2.1 (Tasks 1-4 committed
|