Decomposes intrinsic-bodies.2 (parent spec § Architecture points 6-8)
into 4 tasks + a final gate:
Task 1 — migrate the 13 authored prelude dummy bodies to (intrinsic):
7 Eq/Ord instance methods (inner (body false)/(body true)/
(body (term-ctor Ordering EQ)) → (intrinsic), Design X lambda-body
placement) + 6 float_* fns ((body false) → (intrinsic)). Gated by
round-trip + the 4 eq/compare/float E2E ratifiers staying green
(behaviour-preserving: the intercepts emit identical IR).
Task 2 — rebaseline the two moving hash pins: prelude_module_hash_pin
(prelude module hash) and mono_hash_stability's 6 eq/compare
def-hashes (capture-from-failure, replace the constant). The 4
show__* pins do NOT move.
Task 3 — replace the one-directional registry_contains_all_legacy_arms
pin with intercepts_bijection_with_intrinsic_markers: an in-source
test that walks prelude + kernel_stub pre-mono for Term::Intrinsic
markers, recovers mangled names (mono_symbol for instance methods,
fn name for top-level), and asserts the bijection over the
intrinsic-backed class (14) with the 5-name *__Int optimisation-only
allowlist. Both directions + a stale-allowlist guard.
Task 4 — confirm no codegen path lowers an intercepted body (already
true post-.1: intercept-by-name precedes lower_term), delete the
stale dummy-body comment at lib.rs:1310-1319, and conditionally edit
0007-honesty-rule.md ONLY if it names the dummies (recon: it does
not — a general rule; no forced edit).
Recon-driven plan decisions:
1. The bijection pin lives in intercepts.rs's in-source #[cfg(test)]
mod tests, NOT a crates/ail/tests integration test. Visibility
forces it: the pin needs INTERCEPTS (pub(crate) in codegen, in-source
only) AND the parse hops (ailang-surface dev-dep). Verified
ailang-surface does not dep ailang-codegen, so there is no
dev-dep cycle blocking the in-source test from calling parse_prelude
(the dev-dep-cycle hazard that bit pd.2.4/pd.3.1 does not apply
here — that was the ailang-core <-> ailang-surface edge).
2. The pin walks PRE-mono (parse_prelude/parse_kernel_stub) and
reconstructs mangled names via mono_symbol, rather than walking
post-mono. Post-mono only synthesises USED mono symbols, so a
post-mono walk would miss any instance method the pin's entry
fixture does not exercise (e.g. eq__Unit). Pre-mono + mono_symbol
sees all 14 markers unconditionally.
3. Task 2's hashes are capture-from-failure, not pre-computed — the new
prelude bytes determine them. The old->new values get recorded in
the iter commit body by the Boss.
All verification filter strings checked against the tree: the 4 E2E
ratifier fn names, the mono pin name, and the prelude pin target all
resolve to ≥1 real test. No ail/ail-json/ll fenced block in the plan
(the migrated-form snippets are scheme fragments — the (intrinsic) form
is already ratified by .1's kernel_intrinsic_smoke.ail), so the
parse-bytes gate is a documented no-op.
Handoff target: skills/implement on docs/plans/0107-intrinsic-bodies.2-migration-lock.md
Decomposes intrinsic-bodies.1 (parent spec docs/specs/0055-intrinsic-bodies.md
§ Architecture points 1-5) into 8 tasks plus a final gate:
Task 1 — Term::Intrinsic unit variant in ast.rs + the in-core
exhaustive-match arms (canonical/hash/visit/pretty), enumerated by
cargo build -p ailang-core (no-wildcard matches break until armed).
Task 2 — surface parse + print: (intrinsic) as a fn body-slot clause
and a lambda positional body, mapped to/from Term::Intrinsic;
round-trip rides the examples/ corpus gate.
Task 3 — cross-crate walker sweep (check + codegen + prose): leaf
arms at the sites that match Term::New today, enumerated by
cargo build --workspace. The two MEANINGFUL arms (codegen lower_term,
checker body-check) are bridged with a temp unreachable! so the gate
is green, then replaced by Tasks 4-5 — no deferred-caller across a
0-error gate.
Task 4 — checker: env.current_module_kernel_tier flag, signature-only
body check for an intrinsic body, intrinsic-outside-kernel-tier
reject (CheckError variant + code() arm). Reject test is subprocess
`ail check --json` on a temp file, modelled exactly on the verified
check_json_unbound_var pattern.
Task 5 — codegen: a Term::Intrinsic body routes through
intercepts::lookup; never reaches lower_term; lower_term's
Term::Intrinsic arm is a codegen-internal error.
Task 6 — `answer` intercept (ret i64 42) + the answer intrinsic in
STUB_AIL + examples/kernel_intrinsic_smoke.ail so the
schema_coverage corpus observes Term::Intrinsic (avoids the
Term::New-in-match-but-not-in-corpus gap).
Task 7 — E2E ratifier examples/kernel_answer.ail (calls
kernel_stub.answer, prints 42); build_and_run("kernel_answer.ail")
asserts stdout 42.
Task 8 — design/contracts/0002-data-model.md gains the
{ "t": "intrinsic" } Term entry; design_schema_drift mirror stays
green.
Three plan-time corrections after plan-recon + harness verification:
1. The reject test was first drafted against an invented ailang_check
API (Workspace::single_with_prelude / check_workspace). Verified
against e2e.rs:1236 that the established reject pattern is
subprocess `ail check --json` + exit-1 + JSON code assertion;
rewrote on a temp file.
2. build_and_run takes the fixture filename WITH .ail extension
(verified e2e.rs:13-38, existing calls build_and_run("sum.ail")) —
the ratifier call is build_and_run("kernel_answer.ail").
3. kernel_intrinsic_smoke.ail carries an intrinsic with no registered
intercept; confirmed no gate builds it (compile_check.py uses a
curated list, no test builds all examples/*.ail) — it rides only
the parse-level round-trip + schema-coverage gates, never a build.
Scope guard: .1 does NOT migrate prelude dummies, does NOT upgrade the
registry pin to a bijection, does NOT remove the dead body-lowering
path — all .2. Hashes stay stable in .1 (Term::Intrinsic is additive;
no existing fixture carries it).
Test trajectory: 667 (post-raw-buf.1) → ~669 (+intrinsic_in_user_module_is_rejected,
+answer_intrinsic_builds_and_runs_printing_42; corpus/round-trip
fixtures ride existing dynamic gates).
Handoff target: skills/implement on docs/plans/0106-intrinsic-bodies.1-mechanism.md
Decomposes raw-buf.2 (parent spec docs/specs/0054-raw-buf.md
§ Architecture point 2, § Components row 2, § Testing strategy
"raw-buf.2") into 7 atomic tasks:
Task 1 — crate rename + reshape: crates/ailang-kernel-stub/ →
crates/ailang-kernel/, restructured as a family-crate with
src/kernel_stub/{mod.rs,source.ail}; 13 steps covering 8
compile-checked rename sites plus design/INDEX.md + CLAUDE.md
path updates.
Task 2 — add raw_buf submodule: src/raw_buf/{mod.rs,source.ail}
with the spec's Form-A source (4 fns + 1 TypeDef with
param-in (a Int Float Bool)); RAW_BUF_AIL re-export.
Task 3 — wire raw_buf into ailang-surface: parse_raw_buf fn,
re-export at lib.rs:39, workspace injection alongside the
existing kernel_stub block, workspace_pin count bump 4→5.
Task 4 — round-trip test raw_buf_module_round_trips, verbatim
structural clone of kernel_stub_module_round_trips.
Task 5 — E2E raw_buf_check_e2e: (con RawBuf (con Int)) consumer
checks clean.
Task 6 — E2E raw_buf_param_in_reject_e2e: (con RawBuf (con Str))
consumer rejected at check with param-not-in-restricted-set.
Task 7 — E2E raw_buf_build_intercept_missing_e2e: (new RawBuf …)
consumer accepted at check, rejected at build with the
existing Term::New deferral message.
Three substantive plan-time decisions resolving plan-recon's
open questions:
1. The intercept-not-registered diagnostic is NOT introduced.
The spec hedged ("intercept-not-registered: new__RawBuf__Int
(or the existing Term::New-deferral diagnostic)") between
shipping a fresh diagnostic and reusing the existing deferral
at crates/ailang-codegen/src/lib.rs:2075-2078. Plan picks
reuse: the deferral already names "milestone raw-buf" and is
self-describing; a new diagnostic would exist for ~1 iter
(raw-buf.2 → raw-buf.3) before going away — disposable infra.
Task 7's test asserts on the substring "Term::New requires
the type's" which is stable in the existing message.
2. In-tree references to crates/ailang-kernel-stub/ AFTER the
rename — split-scope between raw-buf.2 and raw-buf.3.
The path changes in raw-buf.2 (the crate moves now), so
path-references in design/INDEX.md:112 and the CLAUDE.md
Code-layout table get updated in Task 1 Steps 10-11. The
retire-language (stub as "ratifying fixture for kernel-
extension-mechanics" → "retired by raw-buf") stays for
raw-buf.3 close, per spec § Components row 3.
3. parse_raw_buf gets a mirror re-export at ailang-surface/
src/lib.rs:39 alongside parse_kernel_stub. Recon's natural
reading; load-bearing because the new round-trip test calls
ailang_surface::parse_raw_buf() directly.
Plan honours the project's compile-gate discipline. Task 1's
13 steps thread all 8 rename sites inside the same task —
no deferred caller across the build gate. Task 3 bundles the
workspace_pin count bump with the loader injection that drives
it; the assertion goes 4→5 in the same task that makes it true.
Test-count trajectory: 667 (post-raw-buf.1 baseline) → 667
(Tasks 1, 2, 3 — refactor + wiring, no new test) → 668 (Task 4
round-trip) → 669 (Task 5 check E2E) → 670 (Task 6 reject E2E)
→ 671 (Task 7 deferral E2E).
Handoff target: skills/implement on docs/plans/0105-raw-buf.2-kernel-manifest.md
Decomposes raw-buf.1 (parent spec docs/specs/0054-raw-buf.md
§ Architecture point 1, § Components row 1) into 5 tasks:
Task 1 — intercepts module skeleton (3 steps)
Task 2 — populate the table: 18 emit fns + visibility bumps (9 steps)
Task 3 — rewire the dispatch site to a thin shim (3 steps)
Task 4 — fold wants_alwaysinline into the registry (4 steps)
Task 5 — registry_contains_all_legacy_arms pin test (3 steps)
Three substantive decisions made at plan time beyond what the spec
dictates, surfaced by the plan-recon report:
1. The match arm count is 18, not the ~8 the spec sentence hand-listed
(eq__Str, compare__Int|Bool|Str, float_*). Five additional arms
(eq__Int, eq__Bool, eq__Unit, plus the lt|le|gt|ge|ne__Int
direct-icmp family) shipped after the spec sentence was written.
All 18 are absorbed by the registry; the pin test enumerates all 18.
2. The `intercept_emit_wants_alwaysinline` predicate at lib.rs:1172 is
a separate hardcoded name-list that mirrors the dispatch arms.
This is a silent-drift class (regression seen earlier in the cycle
on compare__Int perf at +29-47% when the lists diverged). The plan
folds wants_alwaysinline into the Intercept entry as a per-row bool
and rewrites the predicate to consult the registry — one source of
truth instead of two.
3. The wrapper fn `try_emit_primitive_instance_body` survives as a
thin shim (`match intercepts::lookup(name) { Some(i) => ..., None
=> Ok(false) }`) rather than being deleted. Trade-off: a 6-line
wrapper vs. a 14-file comment-ref churn. The wrapper wins —
landmark name preserved, all in-source doc comments stay valid.
Plan honours the project's compile-gate discipline: fn signatures
stay stable throughout (only bodies change), no caller-threading is
deferred across a build gate. Visibility bumps in Task 2
(pub(crate) on three Emitter fields and four helper methods) are
additive and do not change any caller's signature.
Verification commands in each Run step name actual test fns the
plan-recon confirmed exist at specific lines; no filter-zero-match
risk. Pre-flight workspace baseline: 668 tests; post-iter:
669 (the new pin).
Handoff target: skills/implement on docs/plans/0104-raw-buf.1-intercept-registry.md
Terminal iteration of the kernel-extension-mechanics milestone.
Carves the spec's § Iteration prep.3 into nine bite-sized tasks:
1. Module.kernel field + ~130-site struct-literal sweep + drift
round-trip + data-model anchor.
2. TypeDef.param_in field + ~30-site sweep + drift round-trip +
anchor (BTreeMap<String, BTreeSet<String>>, kebab-cased
`param-in`, skip-if-empty for hash stability).
3. Form-A (kernel) module-header attribute — parse + print +
round-trip.
4. Form-A (param-in (a Int Float) (b Str)) TypeDef attribute —
one outer clause, multiple inner var-lists (OQ1 decision).
5. Prelude becomes kernel-tier + loader generalisation: the
hardcoded `&["prelude"]` literal at loader.rs:108 migrates to
a `modules.values().filter(|m| m.kernel)` derivation;
ReservedModuleName diagnostic repurposed; CLI mapping +
hash-pin refresh in lockstep.
6. New crate `crates/ailang-kernel-stub/` — programmatic stub
module via parse_kernel_stub() mirroring parse_prelude
(OQ2 decision); wired into the loader; basic stub round-trip
drift test ratifies the end-to-end mechanism.
7. CheckError::ParamNotInRestrictedSet variant + code() + ctx() +
enforcement in check_type_well_formed's Type::Con arm +
in-source RED/GREEN tests.
8. New workspace_kernel.rs integration tests — auto-import without
explicit (import …), two kernel-tier modules co-load,
explicit-import-overrides-auto-import precedence.
9. design/INDEX.md + design/models/0007-kernel-extensions.md
STATUS + forward→present transitions for the now-shipped
mechanisms.
The four open questions raised by plan-recon are resolved up front
in the "Open-question decisions" block so no task carries a TBD.
ReservedModuleName variant shape stays `{ name: String }` (OQ3);
workspace.rs:2655 stays a test-site literal (OQ4).
The Module struct-literal sweep is the largest single mechanical
edit (~130 sites; the additive #[serde(default)] covers JSON
deserialise paths, only Rust struct literals break) — handled as
a compiler-driven sweep inside Task 1, with the workspace-build
gate validating no caller is deferred. TypeDef has ~30 sites.
Compile-gate-vs-deferred-caller and pin/replacement-substring
contiguity rules from planner self-review Step 5 are scrubbed:
no signature change defers a caller past its own compile gate,
no verbatim text edit pairs with a soft-wrappable presence pin.
Recon report received DONE_WITH_CONCERNS — concerns were the
four OQs, all decided in this plan.
Second iteration of the kernel-extension-mechanics milestone. The
plan ships the `new` Form-A keyword + Term::New AST variant + NewArg
enum + checker elaboration + two diagnostics, plus the schema-drift
pin and the data-model.md / form_a.md anchor additions.
Decomposition:
- Task 1 (large mechanical): AST variant declaration + workspace-wide
compile-forced arms across 24 files (44+ exhaustive Term-match
sites). Six arm patterns inlined; per-site table assigns one
pattern per site. Includes the prep.1 pre-pass partner — the
`qualify_workspace_term` arm that rewrites bare Term::New.type_name
to qualified form, mirroring the existing Term::Ctor arm. Synth
gets a Pattern-E stub here; Task 3 replaces with real logic.
- Task 2: Form-A lex/parse/print + round-trip fixture. New
`parse_new` method with Type-vs-Term arg disambiguation by
syntactic form (head keyword = Type-production heads
`con`/`fn-type`/`borrow`/`own` → NewArg::Type; else NewArg::Value).
- Task 3: Checker synth real-logic + 2 new CheckError variants
(NewTypeNotConstructible, NewArgKindMismatch) + 3 RED-first
in-source tests covering the spec's worked example, the missing-
`new`-def case, and the kind-mismatch case.
- Task 4: Schema-drift pin (term_new_round_trips +
term_new_type_arg_round_trips) + spec_drift exemplar + form_a.md
keyword cheatsheet + design/contracts/0002-data-model.md JSON-tag
block.
Spec is already correct on prep.2 scope; the recon surfaced one
design decision the plan resolves inline: NewArg uses
`#[serde(tag = "kind", content = "value", rename_all = "lowercase")]`
to land the spec's exact JSON byte shape. Codegen remains explicitly
out of scope per the milestone spec; Task 1's codegen sites get
Pattern-D error-arms ("Term::New requires desugar first; codegen
support lands in the raw-buf milestone").
Forward-reference: Task 1's Pattern-C arm in `qualify_workspace_term`
extends prep.1's workspace-wide normalisation pre-pass — Term::New
joins Term::Ctor and Type::Con as a type_name-bearing site that
gets bare→qualified normalised before the checker sees it.
The plan covers the first iteration of the kernel-extension-mechanics
milestone: type-scoped `<TypeName>.<member>` resolution in
`ailang-check`, narrowed `BareCrossModuleTypeRef` /
`BadCrossModuleTypeRef` diagnostics in `ailang-core::workspace`,
two new `CheckError` variants, CLI diagnostic-message rewording,
and atomic rewrite of 12 `.ail` example fixtures from `std_X.Y` to
the type-scoped form. Five tasks, each unit-of-review.
Includes a spec correction (same commit because plan recon
surfaced it): the prep.1 Blast Radius previously claimed
`hash_pin.rs` + `prelude_module_hash_pin.rs` refreshes and a
`design_schema_drift.rs` pin addition. Plan-recon walked every
test crate (per the schema-camelcase-fix hash-pin-blast-radius
lesson) and found:
* neither hash-pin file pins any fixture in prep.1's migration
set — refresh is empty;
* type-scoped resolution is a checker-only change (no new JSON
tags, no AST shape change) — the drift pin belongs to prep.2
(`Term::New`) and prep.3 (`kernel: true` + `param-in`), not
prep.1.
Spec section 'Blast radius' and the 'Iteration scope' summary now
reflect the recon-cleared reality.
All 176 files in the four accumulating directories now use a
zero-padded 4-digit counter prefix that reflects creation order
(`NNNN-slug.md`). The counter is assigned per directory in strict
git-log creation order; ties broken alphabetically by original name.
The old `YYYY-MM-DD-` prefix on docs/specs/ and docs/plans/ files is
dropped — the date is recoverable from git log and the counter
carries the ordering.
A file's counter is stable for the life of the file: never reassigned,
never reused, never compacted. Deleted files retire their counter;
subsequent files do not fill the gap. This is the property that lets
cross-references stay literal — refs use the full filename including
the counter (`design/contracts/0007-honesty-rule.md`) so they grep
cleanly and resolve directly without a glob step.
313 cross-references updated across .md/.rs/.toml/.c/.json files
(test pins, include_str! paths, design-INDEX entries, baseline notes,
runtime C comments, inter-contract markdown links incl. bare basename
and `../models/foo.md` forms).
CLAUDE.md gets a new "File-naming convention" section spelling out
the rule and rationale. skills/brainstorm/SKILL.md and
skills/planner/SKILL.md updated so new spec/plan creation produces
counter-prefixed names from the start.
The full test suite (cargo test --workspace) passes.
Iteration plan derived from `docs/specs/2026-05-21-schema-camelcase-fix.md`
(commit 55ce6d0, amended). Single-iteration milestone, four tasks:
- **Task 1 (RED)**: add `lam_serialises_with_kebab_keys` pin to
`design_schema_drift.rs` + extend `anchor_in_jsonc_block` walk
to require the new tag spellings inside `data-model.md`'s `lam`
fenced block. Verifies pin fires RED on current state.
- **Task 2 (GREEN atomic schema swap)**: 10-step coupled
migration of `ast.rs:492,494` + `workspace.rs:1925-1926` +
`examples/test_loop_binder_captured_by_lambda.ail.json` +
`experiments/.../master/examples/fn_with_lambda.ail.json` +
`design/contracts/data-model.md:142-147`. All five files MUST
move together — changing only `ast.rs` makes the JSON literals
undeserialisable (no `#[serde(default)]` on `param_tys`/`ret_ty`,
so the renamed-away key is a hard error).
- **Task 3 (GREEN-2 rustdoc honesty)**: three pure-prose edits in
`ast.rs:8`, `parse.rs:81`, `check/lib.rs:1707`. Decoupled from
the schema swap — no compile or test consequence.
- **Task 4 (Verify)**: exhaustive negative grep, full workspace
test suite, round-trip invariance, forbidden-files check.
Plan pre-recon by `ailang-plan-recon` (DONE_WITH_CONCERNS) caught
the data-model.md + rustdoc layer the brainstorm initially missed
— spec was amended in commit 55ce6d0 + re-grounding-check PASS
(9 claims ratified, 2 of them via exhaustive negative grep as
"no-test-pins-this" Boss-overrideable shape).
Self-review: 8/8 (spec coverage, no placeholders, name consistency,
step granularity 2-5 min, no commit steps, pin/replacement
contiguity, compile-gate threading complete within Task 2,
verification filters all resolve to named real tests).
Decomposes the operator-routing-eq-ord spec (a68d7b6) into 12
bite-sized tasks. Task 1 bootstraps all 5 RED tests + 4 new
fixtures (TDD). Tasks 2-3 ship the load-bearing additions
(codegen alwaysinline mechanism + new intercept arms; prelude
reshape with Eq Unit + six float_* fns + body-hash re-pins).
Tasks 4-6 migrate everything that references the dying surface
(60 fixtures, 8 in-source test scaffolds, lit-pattern desugar).
Task 7 deletes the now-dead operator machinery (typchecker
builtin entries + codegen lower_eq + comparator arms + `==`-
short-circuits) in one cohesive sweep behind a compile-gate.
Task 8 extends the Float-aware NoInstance diagnostic. Tasks
9-11 are mechanical follow (IR snapshot regen, prose-projection
cleanup, 5-contract-file honesty-rule updates). Task 12 is the
acceptance gate.
Plan-recon (DONE_WITH_CONCERNS) surfaced 4 substantive spec
gaps; the plan absorbs all 4:
- Fixture-migration scope is 60 files / 76 occurrences, not
the spec's "~10". Task 4 is correspondingly large but the
work is mechanical.
- The spec named 3 in-source `#[cfg(test)] mod tests` AST-
literal sites that need migration; recon enumerated 8
(incl. `>=` at lib.rs:5656, three `==` sites in codegen/
lib.rs at 3371/3419/4354, two `cmp("==", …)` Float-arith
tests at codegen/lib.rs:3729-3734). Task 5 covers the
full 8.
- The spec named 3 contract files for honesty-rule update;
recon flagged 2 additional load-bearing files where the
dying surface is described present-tense — `str-abi.md:40-42`
("REMAIN primitive operators" — directly contradicts the
milestone) and `scope-boundaries.md:42-96` (multiple
operator + Pattern::Lit-desugar clauses) — plus a model
file `authoring-surface.md:58` (operator-example list).
Task 11 covers all 5.
- `alwaysinline` codegen attribute machinery does not exist
in the codebase today (no `attributes #N = { … }` group
emission, no inline-attribute on any `define` line — recon
verified). Task 2 introduces it as inline-attribute-on-
define (LLVM-13+ permits attribute-name directly between
`)` and `{`), keyed by a new `intercept_emit_wants_alwaysinline`
allowlist that mirrors the intercept-arm symbol set in
`try_emit_primitive_instance_body`.
Plan self-review caught two plan-grade items that recon did not
flag, both absorbed:
- North-star test (`eq_user_adt_smoke_e2e`) would have been
structurally GREEN at start-of-iter because today's
`(app eq …)` on user-ADT-with-instance already works (the
`eq_ord_user_adt.ail` fixture has shipped since 23.5). To
hold the TDD-RED-first discipline, the north-star fixture
adds an opening `(app print (app eq () ()))` line which
fires `NoInstance Eq Unit` today; the new `instance Eq Unit`
in Task 3 turns this from RED to GREEN. The expected
stdout becomes `"true\ntrue\nfalse\n"` (Unit-eq, then
Point-eq, then Point-neq).
- `is_arithmetic_or_comparison_op` rename + the `name == "=="`
clause deletion at codegen/lib.rs:2529 both touch the same
line; the plan explicitly notes both edits land at this
site in lockstep (Task 7 step 3 + step 5).
Per-task expected-state map names which RED-test flips GREEN at
which task; the workspace test-suite goes through known partial-
pass states between tasks but Task 12 is the only "all green"
gate. The four code-path-deletion tasks (Tasks 4-7) each end
with `cargo test --workspace --quiet` returning `0 failed`
because all callers of the about-to-delete surface are migrated
in earlier tasks — the compile-gate at Task 7 step 7 is
satisfiable by construction (recurring "compile-gate-vs-deferred-
caller" defect family, explicitly scrubbed in self-review #7).
All `cargo test --…<filter>` Run steps use filter substrings
verified to resolve to a real named test or test binary in the
current tree (recurring "verification-filter doesn't resolve"
defect family, scrubbed in self-review #8).
Net delta on landing: 9 new files (4 fixtures + 5 tests), ~30
.rs files modified across `ailang-check` / `ailang-codegen` /
`ailang-core` / `ailang-prose`, 60 .ail fixture migrations,
2 IR snapshots regenerated, 5 design contract / model files
updated, 8 hash-pin literals re-pinned across 3 pin-files.
Workspace pass-count delta: +5 (new tests) − 3-to-5 (test-
scaffold deletions in Tasks 5+10) ≈ +0 to +2 net.
refs #1
Decomposes the Boehm-retirement spec (50dc478) into 10 bite-sized
tasks. Task 1 ships the RED milestone-pin first (TDD); Task 2 is
the compile-gated atomic core (drops `AllocStrategy::Gc` variant +
the `Default` derive + threads every caller in codegen + main.rs in
one cohesive task, so the workspace-build gate at the end is
satisfiable). Tasks 3-9 cover the scrub work that cascades off the
core (e2e suite, doc-comments, bench harness, design ledger,
honesty-pin inversion, example fixtures + agent prompts, IR
snapshots). Task 10 is the acceptance gate.
Plan-recon (DONE_WITH_CONCERNS) surfaced 9 spec gaps; the plan
absorbs all 9:
- `runtime_alloc_fn` → actual identifier `fn_name` (no rename)
- 5 checked-in IR snapshots (`hello.ll`, `list.ll`, `max3.ll`,
`sum.ll`, `ws_main.ll`) regenerate via `UPDATE_SNAPSHOTS=1`
- `design/contracts/scope-boundaries.md:67,114-127` Boehm block
+ `examples/gc_stress.ail.json` dead-reference
- `design/contracts/memory-model.md:232` "pre-Boehm era" phrase
- `bench/check.py:91,94` `implicit @ gc` arm label map
- `crates/ailang-codegen/src/match_lower.rs:40,113`
`@GC_malloc` doc-comments
- `skills/implement/agents/ailang-implementer.md:95,185` Decision
10/Boehm references
- `AllocStrategy`'s `Default` derive (no callers — strip)
- e2e.rs spec line numbers refer to gc-call lines, not test-fn
header lines
Plan self-review caught a planner-grade defect that recon had
not flagged: `bench/check.py:62` hardcodes `"gc(s)" in line` as
the throughput-table header sentinel and `:72` hardcodes the
9-column count — both must shift in lockstep with the
`bench/run.sh` 9→6 column compaction; without the pair-edit,
`parse_throughput_table` silently returns an empty dict and the
"green" check pins nothing. Task 5 now carries Steps 4a-4c (header
+ count + field-set) as a coherent unit, plus the explicit pin in
the rationale.
Net delta on landing: 1 new test, ~30 modified files, 5
regenerated IR snapshots, 1 deleted fixture. Workspace passing-
test count shifts by `-3` (4 deletions − 1 new). The iter commit
will close Gitea #4 via the trailer.
refs #4
Resolves the design fork in Gitea #12 (the bounce-back from the
2026-05-20 /boss session). User accepted both half-decisions:
(a) the surface form `(app f)` becomes the canonical nullary
call shape, dropping the "expected at least one argument"
parser guard in `parse_app_body`;
(b) `Term::App.args` mirrors the *actual* serde attrs of
`Term::Ctor.args` — `#[serde(default)]` for read-tolerance,
no `skip_serializing_if`, so writes always emit
`"args":[]`.
The plan covers five small tasks: a RED→GREEN E2E (nullary user fn
called as `(app greet)`), the four-line parser-guard removal, the
one-attribute serde edit, and a doc-honesty fix on
`design/contracts/data-model.md` — the current "args omitted when
empty" comment on `Term::Ctor` is factually false relative to the
code (verified by a serde probe at plan time) and gets rewritten to
describe actual write/read behaviour while we are in the same jsonc
block. `design/contracts/honesty-rule.md` enforcement folded into
the same iter because leaving a stale comment behind in the block
we're modifying would be the exact failure mode the rule names.
Hash-impact verified at plan time: `grep -rn '"args":\[\]'
examples/*.ail.json` returns zero matches, so the new
`#[serde(default)]` on `App.args` is read-only behaviour change —
write side is unchanged, no existing fixture hash mutates. The
plan documents this explicitly under Task 3.2.
Two prior fieldtest specs already supplied the LLM-natural shape
evidence — `docs/specs/2026-05-15-fieldtest-mut-local.md` F3
(mut-local) and `docs/specs/2026-05-18-fieldtest-loop-recur.md`
spec_gap (`run_forever`) — so the feature-acceptance gate in
`design/contracts/feature-acceptance.md` is already passed; no
brainstorm phase needed for this iter.
refs #12
One terminal iteration covering the whole spec. Four tasks, all on
`bench/baseline.json`:
- Task 1: pre-recapture JSON edit — drop `max_us` + `p99_9_us` × 3
latency arms (6 entries) and rewrite the `note` field forward-
looking. The 6 entries must go before `--update-baseline` runs
because `write_new_baseline` faithfully re-baselines anything
left in the file (recon Open Q). The note rewrite is folded in
here because `--update-baseline` preserves the existing note as-
is, so any change has to happen before recapture (or as a
separate post-recapture edit; one-edit is cleaner).
- Task 2: `bench/check.py --update-baseline` regenerates every
remaining `baseline` value from a fresh `bench/run.sh -n 5`,
updating `captured` → 2026-05-20 and `captured_via`.
- Task 3: acceptance §1 — fresh-HEAD replay → exit 0, 0 regressed,
57 metrics in summary (= pre-edit 63 minus the 6 drops).
- Task 4: acceptance §2 — synthetic injection (halve
`bench_list_sum.bump_s.baseline` via `jq`) → exit 1 + REGRESSION
row on that metric, then restore via `jq` and confirm a final
exit-0 replay.
Recon adjudications:
- Replay-source (recon Open Q1): fresh `bench/run.sh -n 5` for
replay, not the same output that produced the recapture.
Realistic acceptance scenario; with 10% throughput tolerance vs.
~1-2% measured run-to-run variance on the affected metrics
(run-1 / run-2 reproduction data in spec body), there is ample
margin.
- Note rewrite (recon Open Q2): forward-looking — drop stale
refs (JOURNAL workflow retired 8e586f4; the `*.max_us`
tolerance convention is now moot since the metric is gone),
replace with pointer to docs/specs/2026-05-20-bench-harness-
recalibration.md + closed issues #15 / #16. Spec lives where
the rationale lives; the note carries the gate-policy
one-liner only.
No Rust crate touched. `bench/check.py` / `bench/run.sh` /
`bench/latency_harness.py` unmodified.
Plan self-review (all 8 checklist items): clean. Step granularity
checked; Task 3 collapsed from two `bench/check.py` runs to one
(single 3-minute run captures both summary and exit code).
Ready for handoff to `skills/implement`.
Single iteration covering the whole milestone (same shape as
rolesplit.1; spec is small, no build-atomicity issue — clause-5 is
isolated additive code, prose edits don't affect compilation).
Five tasks, each at task-level review granularity:
Task 1: clause-5 added to design_index_pin.rs RED-first via
identity-stubbed strip_fences (synthetic vector FAILS) →
correct toggle-on-fence impl (GREEN); module //!-header
extended to name clause-5. Test count 4 → 5.
Task 2: 7 prose-ref conversions to file-relative Markdown links
(float-semantics:69/100, embedding-abi:45, memory-model:44/
105, scope-boundaries:48/88 with the source+Pipeline split).
Exact verbatim before→after for every line. clause-5 stays
GREEN by construction (every introduced link resolves
durable).
Task 3: 2 disposition-(b) homeless-ref removals (pipeline:60-61
in-fence CLI block + authoring-surface:178-181 prose).
Pointer dropped, behavioural prose preserved.
Task 4: honesty-rule.md pin-safe positive-half paragraph between
L14 and the existing L15-blank (the two docs_honesty_pin
phrases at L14/L19 each stay verbatim on their physical
line; the additive insertion splits neither). The new
paragraph names design_index_pin.rs clause-5 by name
(nominal mention, not a link — consistent with the
existing 'Ratified by:' footer style and with §Scope).
Task 5: Whole-suite gate (646 → 647) + 5 grep+diff verifications
(no docs/ link, no #fragment, link count = 8, in-fence
schema-annotations intact, INDEX.md + decision-records
journal + clauses 1-4 byte-unchanged).
Self-review 8/8: spec coverage complete; zero placeholders; names
consistent; bite-sized; no commit steps; pin contiguity verified
(L14 + L19 stay verbatim on their physical lines, replacement body
shows L14 contiguous); no signature change ⇒ no compile-gate
ordering issue; every cargo-test filter substring is a real test
name + unfiltered runs have explicit count assertions.
The tidy's gate-first Task 1 RED-verification + Boss independent
verification surfaced two defects in the audit Resolution as first
written — caught exactly where the planner->Boss loop is designed to,
before any contract byte moved. Per the 'two+ defects in one
iteration => fix the upstream artifact, do not patch a third time'
discipline, the audit Resolution is corrected in lockstep with the
plan re-derivation:
- Mechanism (Resolution-4): the 'case-insensitive iter-code regex'
clause-3 design is REJECTED as unworkable — a blanket
iter/milestone detector conflates the memory-model rule-names
'Iter A'/'Iter B' and ordinary words 'pre-existing'/'pre-set'/
'pre-Boehm' with provenance, over-firing on legit present-tense
contract prose (4 no-strip files). Replaced by a FAITHFUL Sweep-1
superset: case-sensitive digit-anchored Sweep-1 line anchors
(confirmed ZERO across all contracts) + Sweep-1's ^[^/]*
path-excluded date (so docs/specs/2026-.. citations are not
flagged — repairs the iso_date over-fire the implement
orchestrator correctly BLOCKED on) + the audit-named
decision-record phrases (case-insensitive). No regex dep. The
load-bearing invariant (clause-3 GREEN => Sweep-1 clean) is
preserved; it never required the blanket detector.
- Scope (Resolution-1): the architect's [medium] was a 3-file
spot-check; the exhaustive scan found roundtrip-invariant.md:73
('at iter form-a.1') and data-model.md:149,161 ('loop-recur iter
1:') also carry lowercase provenance. True strip set = 5 files;
plan Task 5b adds the 2 (spirit-cleanup, not gate-blocking).
Plan self-review 8/8 re-run; clause-3 = hand-rolled faithful Sweep-1
superset, no regex dep, no blanket iter detector.
7 tasks executing the audit Resolution's 5 points: (1) gate-first
RED — widen design_index_pin.rs clause-3 to a hand-rolled PROVABLE
SUPERSET of architect_sweeps Sweep-1 over design/contracts/ (no
regex dep; subsumption proof inline), verify RED vs the un-stripped
tree; (2-4) sentence-level strip the faithfully-migrated
history/decision-record prose out of typeclasses.md / str-abi.md /
scope-boundaries.md into the decision-record journal, per recon's
per-sentence contract-residue map, each docs_honesty_pin pinned run
guarded contiguous; (5) fix float-semantics.md stale 'see Str ABI
below' -> str-abi.md; (6) re-scope architect_sweeps DESIGN_GLOB to
design/contracts only (models/ is the narrative tier) + lockstep
ailang-architect.md; (7) whole-tree GREEN gate (clause-3 RED->GREEN,
4/4, sweep exit 0, suite >=646/0, acceptance grep CLEAN).
Self-review 8/8.
Resolves the M5 milestone-close audit DRIFT (audit journal
28ab56a). 3 tasks, doc/comment-only, recon-verified pin-safe:
T1 docs/DESIGN.md — drop the retired-M4 forward-reference
(§"Free (host side)" ~:2354-2360) + reconcile the "no shared
mutable runtime state … data-race-free" claim with the now-atomic
global RC-stats fallback (§"Embedding ABI" ~:2287-2298, must not
disturb the adjacent line-2299 pinned bare-scalar sentence);
T2 runtime/rc.c:88 — comment-only fix of the stale "two
unconditional ++" performance aside (consistent with the adjacent
already-corrected :93-106 atomic block); T3 consolidated
doc-only/pin-safe/scope gate. All 3 sites recon-verified OUTSIDE
every pinned/hashed region (design_schema_drift scans only the
post-line-2362 data-model slice; docs_honesty_pin:135 pins the
distinct line-2299 sentence; the IR-byte pin asserts generated IR
not rc.c comments). Pins green before+after = the mechanical
pin-safety proof; no RED, no audit/fieldtest gate — mirrors the
M2.tidy a80d495 / M3.tidy 63d7d60 precedent (single cohesive
commit, pins are the coverage). Last step before M5 fully closes.
Final functional M5 iteration (spec ae905de; builds on green
m5.1 204c171 + m5.2 b724cd1 whose leak-proof is resolved through
dbd76e5). 3 tasks: (1) additive adapter::fold_window (windowed
sibling of fold_symbol) + chrono dev-dep + a second
[[bin]] timeshard_runner declaration; (2) tests/timeshard.rs
written FIRST — RED is the deterministic `env!(CARGO_BIN_EXE_
timeshard_runner) not defined` compile failure (bin absent); (3)
the timeshard_runner bin → GREEN, with the spec §3 strength-ordered
assertions (a) per-shard bit-exact vs single-thread windowed host
fold (THE boundary-invisibility proof), (b) Σ bit-exact by
construction, (c) whole-window within REL_TOL=1e-6 (derived from
the recursive-summation error bound, never bit-exact — spec
explicit), plus the now-deterministic leak-Σ and a journal-only
friction-timing capture.
Boss decisions in-plan: new bin not an arg-mode (shipped symbol-fan
path byte-untouched, no regression surface); chrono dev-only (date
math in the test, bin date-math-free; Invariant 1 unaffected);
concrete pin EURUSD 2017_03/04/05 (recon-verified present, no
gaps; data-server has no month-listing API); friction is a journal
observation, no bench gate, no timing assertion (flake-free);
pre-existing DESIGN.md:2358-2360 M4-drift explicitly out of scope.
Milestone close + mandatory audit run after Boss-verification.
M5 iteration 2 (spec ae905de; builds on m5.1 204c171). 3 tasks:
(1) promote data-server dev-dep -> real dep + additive `adapter`
module (tick_to_px / MidPriceStream lazy Iterator / fold_symbol),
RED-first on tick_to_px; (2) `swarm_runner` [[bin]] — one thread per
symbol, each owning its Kernel (Ctx: !Send makes one-ctx-per-thread
a compile-time guarantee), prints RESULT <sym> <acc_bits> <n>;
(3) integration test spawning that bin as a subprocess under
AILANG_RC_STATS=1 (atexit stat line is unobservable in-process —
runtime/rc.c:132-138), asserting per-symbol bit-exact vs an
independent same-order host reference + Σallocs==Σfrees (ported from
embed_tick_e2e.rs:84-104), skip-if-absent mirroring data-server's
own precedent.
Boss decisions recorded in-plan for the audit: TSan needs NO new
nightly harness — per-thread-ctx race-freedom is compile-time
enforced by Ctx:!Send AND already green-tested by the C-host
embed_swarm_tsan.rs (same pattern); m5.2 adds no new AILang-side
concurrency primitive. data-server dev->real dep is Invariant-1
sanctioned (compiler crates untouched; gate shifts to "AILang
workspace graph data-server count == 0" + zero compiler-surface
diff). Time-shard + friction-harvest deferred to m5.3.
First iteration of M5 (spec ae905de). 3 tasks, RED-first on the
core: (1) scaffold the workspace-EXCLUDED ail-embed crate +
build.rs (de-risks the no-in-repo-precedent ail-binary resolution
in isolation with a stub lib), (2) the lean embedding core
(Ctx/Kernel/frozen-layout helpers, Rust port of the audited
tick_roundtrip.c:31-75, zero data_server use) with an in-source
data-server-free RED unit test, (3) hermetic data-server smoke
(synthetic Pepperstone-format ZIP fixture via the public
RawTickRecord type → real DataServer → Kernel, bit-exact vs host
reference).
Boss decomposition calls recorded in-plan: data-server is dev-only
(iter-1 library has ZERO deps — Invariant 1 maximally honest);
build.rs resolves ail via AIL_BIN-else-cargo-build-parent-workspace
(separate target dir, no nested-cargo lock); fixture writer mirrors
data-server/src/loader.rs:110-124. Invariant-1/no-language-change
mechanically gated (cargo metadata graph check + git status path
check). Adapter + swarm explicitly deferred to iter 2+.
Tasks 1-5 GREEN. T1 baseline pins (re-point annotation + @ailang_rc_alloc
heap-box byte-pin: size=8+n*8, tag@0, fields@8/16). T2 export gate widened
(is_c_scalar -> two-level is_c_abi_type: single-ctor all-Int/Float record;
multi-ctor/Str/List/nested still RED; gate suite 10/10; M1 adt-ret must-fail
re-pointed to multi-ctor+Str Reading). T3 codegen forwarder widened
(llvm_scalar record Type::Con -> ptr; M2 forwarder body byte-unchanged;
3/3 staticlib pins). T4/T5 E2E record round-trip own+borrow, global
leak-freedom.
Boss spec-consistency repair (M2.1-precedent class): orchestrator
correctly BLOCKED Task 5 on a genuine spec defect -- the single-ctx-readback
allocs==frees proof model is unsatisfiable for borrow (and only
coincidentally passes for own) because M2's TLS-ctx is bound only during
the synchronous forwarder call, so host-side decs land on g_rc_*, not ctx.
Boss-verified globally leak-free + value-correct both modes. Spec + plan +
harness amended to the stronger global model (sum all ailang_rc_stats:
lines; the M2-TLS cross-attribution documented as correct behaviour). No
fresh grounding-check (removes an over-strong measurement assumption).
Tasks 6 (DESIGN.md frozen-layout SSOT + lockstep pointers + freeze wording
+ enforceability demo) and 7 (workspace-green gate) re-dispatched on the
amended plan. Bench/architect milestone-close is audit-owned.
iter embedding-abi-m3.1 (PARTIAL); INDEX.md line deferred to the DONE commit
Tasks 1-4 land fully review-green and are the cohesive shippable
subset (the per-thread embedding ABI, fully wired + proven):
- T1: FIXED-FIRST alloc-guard baseline pin (RED captured -> GREEN at T4).
- T2: runtime/rc.c gains ailang_ctx_t {alloc_count,free_count} +
ailang_ctx_new/_free + __thread __ail_tls_ctx; the two increment
sites become 'if (_ctx) _ctx->... else g_rc_...'. g_rc_* statics +
ailang_rc_stats_atexit + the constructor RETAINED VERBATIM as the
null-ctx (single-threaded executable) fallback. rc_accounting_tsan.c
+ driver: per-ctx 8x200000 tsan-clean (de-globalisation positive proof).
- T3: codegen Target::StaticLib forwarder gains a leading 'ptr %ctx'
+ one '@__ail_tls_ctx = external thread_local global ptr' decl +
TLS save/store/restore around the BYTE-UNCHANGED internal call;
_adapter/_clos + internal arg vector untouched (M1 decision held);
doc-comment provisionality narrowed to the value/record layout.
- T4: build_staticlib rejects --alloc != rc (RC-only swarm artefact).
Boss adjudication of the orchestrator's Task-5 BLOCKED (spec-defect,
correctly surfaced not hacked): swarm.c's -DSHARED_CTX negative
control is structurally impossible — examples/embed_backtest_step.ail
is a non-allocating scalar kernel that never writes a ctx field, and
__ail_tls_ctx is __thread, so a shared-ctx scalar swarm has no
shared-memory write to race on (the spec's OWN item-1 honesty point).
The de-globalisation teeth belong to the item-1 rc_accounting harness
(shared ctx genuinely races on ctx->alloc_count; orchestrator
independently confirmed tsan exit 66). Spec amended in lockstep
(Goal coherent-stop, must-fail-axis item 2, Testing item 3,
Acceptance) so item 3's negative control is item-1's by the
de-globalisation-proof / capability-demo split; plan Task 5
restructured (swarm.c per-ctx capability demo only; negative-control
standing test relocated into the item-1 harness driver) + Task 3's
plan-transcription error (@ail_backtest_step ->
@ail_embed_backtest_step_step) corrected. This is a Boss
consistency-repair of an internally-contradictory clause whose intent
is already correctly realised in the same spec — not a redesign; no
brainstorm bounce. Task-5 working files discarded (corrected plan
reproduces them; a structurally-RED test must not enter main).
INDEX.md + final journal land at iter completion (re-dispatch [5,9]).
Tasks 1-3 of docs/plans/embedding-abi-m1.1.md, a verified known-good
subset (cargo build --workspace exit 0; full workspace green; the
roundtrip_cli all-examples gate green):
- Task 1: CLI build-path MissingEntryMain baseline pin
(examples/embed_noentry_baseline.ail + embed_missing_main_baseline.rs;
triple-assertion, layered on the green codegen-unit pin lib.rs:3314).
- Task 2: additive FnDef.export: Option<String> (serde default +
skip_serializing_if, modelled on FnDef.doc); compile-driven thread
of export: None across ~85 FnDef/AstFnDef literals / 18 files incl.
all in-source #[cfg(test)] mod tests + drift/hash/spec-drift
literals + the codegen lib.rs:3320 in-source pin; hash-stability
golden pin; DESIGN.md fn-JSON "export" line. DONE_WITH_CONCERNS
(plan symbol content_hash_fn -> def_hash per hash_pin.rs, plan-
pseudo-vs-reality class, plan corrected).
- Task 3: Form-A (export "<sym>") modifier — parse_export +
parse_fn thread + write_fn_def emission + form_a.md grammar;
byte-identical round-trip.
Task 4 BLOCKED (Boss plan-defect: fixtures declared module != file
stem; AILang's loader hard-enforces module==stem at workspace.rs:438,
so ail check panicked on load before the gate). Boss resolution
(Option 2, overriding the orchestrator's Option 1, rationale in the
journal + plan Design-decision 6): keep descriptive embed_* filenames,
rename fixture MODULES to their stems — the C symbol backtest_step
stays via (export ...), demonstrating spec Decision 2's mangling-
decoupling rather than violating it; archive becomes
libembed_backtest_step.a, internal symbol @ail_embed_backtest_step_step,
host.c unchanged. Plan fixed (Design-decision 6 + Task-4 module==stem
+ Task-5/6/7 dependent strings + the no-*. Float-head + content_hash_fn
concerns folded). Headline fixture corrected; blocked-Task-4 WIP
discarded (recreated by the [4,7] re-dispatch from the fixed plan).
PARTIAL commit (not the iter's final commit): the implement Repair
path mandates committing the known-good subset so the [4,7]
re-dispatch starts from a clean tree that includes Tasks 1-3 (Tasks
4-7 structurally depend on the schema field + surface). INDEX line
added when the full iter lands post-re-dispatch.
One iteration (not the 4-then-3 split the brainstorm carrier
assumed): the recon's cross-references prove a Rust exhaustive-match
enum-variant removal is atomic and the workspace test suite is
necessarily red between the Rust cut and the fixture/doc/drift
cleanup, so the full cargo-test green gate can only sit at the final
task. 6 tasks: T1 RED must-fail pins, T2 the atomic Rust cut
(~40 match arms + mut_scope_stack signature + all ~37 callers +
escape-guard loop-half-preserving simplification + codegen rename
mut_var_allocas→binder_allocas; gate cargo build 0-errors + T1
GREEN), T3 dangling test-pin deletions, T4 DESIGN.md hard-delete,
T5 faithful let/if fixture rewrites + 3 rejection-probe deletions,
T6 carve_out 18→12 + roadmap + final full-suite + loop/recur
non-regression gate. Plan-recon resolved 3 open Qs (form_a.md does
not exist — grammar lives in parse.rs doc-comment; round_trip.rs +
roundtrip_cli.rs auto-sweep examples/; escape.rs:533 walker is
loop-reachable).
Single-iteration, RED-first plan for the prose-loop-binders spec.
Task 1 pins the desired Option-A bytes in two new committed
.prose.txt fixtures + two snapshot tests (RED against the old
renderer). Task 2 rewrites the Term::Loop arm of write_term and
gates GREEN via the snapshot suite + two ail-prose CLI byte-matches
+ an exact untouched-set check. Recon-verified line anchors; planner
Step-5 self-review clean on all 8 items.
Terminal iteration of the standalone loop/recur milestone.
Replaces the iter-1 lower_term CodegenError::Internal stub with
real LLVM-IR lowering: loop binders as entry-block allocas (the
mut.3 pending_entry_allocas mechanism, reusing mut_var_allocas so
the existing Term::Var load path needs zero new code), a fresh
loop-header block reached by an unconditional br, recur stores +
back-edge br, a new loop_frames codegen stack saved/restored at
the lambda boundary (mut.3 triple precedent). Four Boss design
calls baked into the plan header, all on architectural-consistency
/ spec-pinned-invariant grounds (not effort): (1) alloca + clang
-O2 mem2reg, NOT hand-emitted phi (no linear-emit phi precedent;
spec's "phi" is the secondary impl-shape; mem2reg gives identical
optimized output); (2) reuse mut_var_allocas + the existing
Term::Var load path (Var-lowering byte-unchanged; representation-
sharing only); (3) loop-exit value is the emergent product of the
existing if/match join once recur sets block_terminated, no
separate result phi; (4) reuse the single block_terminated field,
recur sets it at its own emit site (parallel setter), zero edits
to existing SET/READ sites (tail-app byte-unchanged). Three new
.ail fixtures: sum_to->55 run, deep-n 1e6->500000500000 (clause-2
correctness made executable), infinite-loop build-only. iter-3 is
codegen-only: no schema/typecheck change, hash pins + drift trio
stay green untouched. Self-review item 7 (the systemic fix folded
into iter-2) applied: T1's field-add is not a fn-signature change,
no deferred-caller-past-gate.
Second of three iterations of the standalone loop/recur milestone.
Replaces the iter-1 synth CheckError::Internal stub with real
binder typing + positional recur arity/type checking via a
loop_stack frame, a new private verify_loop_body tail-position
pass (sibling of the spec-frozen verify_tail_positions), and the
four Recur* diagnostics. Three Boss design calls baked into the
plan header: (1) RecurTypeMismatch is an Assign-style structural
subst-compare not a unify-propagate (so the dedicated code fires
point-exactly per spec acceptance); (2) loop_stack element type is
Vec<Type> (positional, not name-keyed IndexMap — recur rebinds by
position; binder names enter ordinary locals like Term::Let);
(3) diagnostic-code precedence is by pass ordering (synth before
verify_loop_body), already correct, no explicit logic needed.
Every code step literal — synth signature/threading, the two real
arms, verify_loop_body full body, four negative .ail.json
fixtures, carve-out 13->17 + stale-header fix, pin harness, ct1 F2
sibling — all verified against read source. Codegen stays the
iter-1 stub (iter 3). Self-review: reused iter-1's loop_sum_to.ail
as the positive-check fixture rather than create a near-duplicate.
First iteration of the loop-recur milestone: Term::Loop /
Term::Recur / LoopBinder as strictly-additive nodes across all six
crates' no-wildcard Term matches, parse/print/round-trip,
hash-stability + drift anchors. No typecheck semantics (synth
stubs CheckError::Internal — iter 2), no real codegen (lower_term
stubs CodegenError::Internal — iter 3); both stub points mirror
mut.1. Two Boss calls baked into the plan header: (1)
verify_tail_positions 'byte-unchanged' = tail-app role unchanged,
operationalised via the tail-app IR-snapshot non-regression test
(literal source freeze impossible — exhaustive no-wildcard match);
(2) codegen is in iter-1 scope as stubs/pass-throughs because the
workspace must compile for cargo test --workspace (the iter goal).
Recon DONE_WITH_CONCERNS — all three open questions resolved at
plan time (Q3: print.rs:352 is a Type match, untouched).
The effect-op-arg-modes brainstorm spec bundled a real, self-contained
DESIGN.md honesty fix with speculative build-ahead infra (an EffectOpSig
arg-mode field whose only consumer was a synthetic test op). Recon had
already destroyed the "effect-handler infrastructure" premise: the effect
raise/declare/subset/propagation machinery is fully generic over any
effect string; the only real prerequisite was one struct field, not a
milestone. The user rejected the bundle as incoherent and the
build-ahead half as the iteration-discipline trap repeated.
- Retire the uncommitted effect-op-arg-modes spec (deleted from the
working tree; never committed).
- roadmap: drop the false "sub-ms-2 = effect-handler infrastructure"
framing; mark Stateful-islands sub-milestone sequencing as UNDER
RE-THINK with the user (no !Mut planning until that conversation);
add the split-out effect-doc-honesty as an in-flight P2 [~] todo.
- plan docs/plans/2026-05-16-effect-doc-honesty.md: placeholder-free
tidy plan (the three DESIGN.md fictions + form_a.md + main.rs +
a new doc-presence pin) over recon-mapped exact byte sites.
- brainstorm SKILL: specs and design talk LEAD with the AILang (.ail)
program that should work (= the feature-acceptance clause-1
evidence); the Rust implementation shape is secondary, never a
substitute; a no-surface infra milestone still shows concrete .ail
(often a must-fail fixture). Codifies user feedback from this session.
11 tasks clustered on the recon's lockstep-invariant pairs so each
task leaves the workspace in a defined state. Forward revert against
git show 1ff7e81: as the per-region byte oracle (no git revert/reset;
main sacrosanct). Boss judgement folded in: bench/orchestrator-stats
it.* json KEPT (historical record like journals); A1 amendment
discard already done Boss-side pre-plan (the checkout step is a
no-op, only the superseded header remains on that file);
verify_structural_recursion helper provenance resolved by
oracle-diff method, not guess. carve_out_inventory corrected from
the spec's "recompute count" to the recon-accurate "remove 7
string-set entries". Net additions written verbatim (F1/F4 note,
de-claimed clause-3 sentence, deferred roadmap entry, superseded
header, doc-presence test) per the Iron Law. Behavioural-equivalence
gate (Task 11) builds a 1ff7e81 worktree reference compiler and
diffs the surviving corpus byte-for-byte — pristine, not ratified.
Parent spec: docs/specs/2026-05-16-iteration-discipline-revert.md
(b3853bf). Grounding-check PASS. Recon DONE_WITH_CONCERNS, all three
concerns Boss-resolved.
Boss-resolved design decisions baked in (DD-1 loop_stack in synth like
mut.2's mut_scope_stack + RecurNotInTailPosition in verify_tail_positions;
DD-2 LoopBinder derives = MutVar's, no PartialEq; DD-3 stub-then-fill
sequencing). Recon-enumerated walker-arm site list incl. the test-side
exhaustive match (codegen_import_map_fallback_pin.rs:62) mut.1's plan
missed. it.2/it.3 explicitly out of scope.
Eight tasks addressing the architect's two [high] drift items
(lambda-captures-of-mut-var diagnostic + codegen comment cleanup),
two [medium] items (stale mut.1-stub history comments in DESIGN.md
and codegen), plus the bench compile_check.py check_ms regression
(~30-50% relative; closed by short-circuiting the empty
mut_scope_stack walk in synth's Term::Var arm).
Architect's [low] item (prose render of MutVar drops type
annotation) deliberately deferred per architect recommendation —
prose surface design is itself pending.
Plan unblocks the follow-on Stateful-islands milestone (effect-
handler infrastructure + !Mut + refs) per architect gate.
Nine tasks: Emitter struct extension with mut_var_allocas +
pending_entry_allocas + entry_block_end_marker fields (Task 1);
start_block captures the entry-block byte marker (Task 2);
Term::Var resolution prepends mut-var lookup with load emission
(Task 3); Term::Mut codegen — alloca to side buffer, init at
current position, store to alloca, push binding (Task 4);
Term::Assign codegen — load alloca, lower value, store (Task 5);
final flush of pending_entry_allocas into self.body at the marker
(Task 6); examples/mut_counter.ail (Int) + examples/mut_sum_floats.ail
(Float) (Task 7); e2e tests in crates/ail/tests/e2e.rs (Task 8);
DESIGN.md bullet under 'What is supported' (Task 9).
Five Boss decisions encoded: entry-block hoist via String::insert_str
at the captured marker (chosen over post-pass or non-standard
emit-at-current); no LLVM helper wrapper — direct push_str matches
existing codebase convention; e2e tests append to the existing
crates/ail/tests/e2e.rs (reuse build_and_run helper); DESIGN.md
bullet lives in 'What is supported' subsection (recon misread —
the section exists at line 2680); Unit-codegen via the existing
Term::Lit { lit: Unit } canonical form.
Seven tasks: three new CheckError variants + code() + ctx() arms
(Task 1); synth signature extended with mut_scope_stack threaded
through ~19 recursive call sites in lib.rs plus the two re-synth
sites in mono.rs:712/1337 (Task 2); Term::Var resolution prepended
with innermost-first mut-scope lookup (Task 3); Term::Mut arm
(Task 4) and Term::Assign arm (Task 5) replacing the iter mut.1
Internal stubs with real logic; five negative fixtures + driver
(Task 6); positive verification of examples/mut.ail typechecking
clean (Task 7).
Four Boss decisions encoded: fixtures under examples/ with driver
at crates/ailang-check/tests/ (convention wins over spec wording);
mut_scope_stack as a synth parameter not an Env field (matches the
locals/effects/subst threading convention); MutAssignOutOfScope's
available list flattens all frames innermost-first;
mono.rs:712/1337 the two re-synth sites that need the threading.
Six tasks: AST + serde (Task 1), substantive walker arms across the
~25 exhaustive Term match sites (Task 2), the two dispatch stubs in
check_term and lower_term that produce CheckError::Internal /
CodegenError::Internal per the spec's out-of-iteration boundary
(Task 3), Form A parser + printer (Task 4), schema-drift + coverage
+ spec-drift extensions + form_a.md + DESIGN.md amendments (Task 5),
examples/mut.ail fixture with round-trip + corpus-coverage gate
(Task 6).
Three Boss decisions made explicit in the plan: walker-arm policy
(substantive everywhere except the two dispatch entry points),
empty-vars canonical-bytes pin, parse rejection of (mut) without
body. Plan-recon flagged all three; the plan resolves them rather
than deferring.
8 tasks. Closes the prelude-decouple milestone by deleting
examples/prelude.ail.json and sweeping the surviving consumers + spec
text + inventory. Three production consumers retire: the migrate-bare-
cross-module-refs defensive include in ail/src/main.rs (with its
lockstep skip-branch), the cross-form-identity preflight test in
ailang-surface (its purpose discharged at pd.2-close), and one in-mod
test in core's workspace.rs (re-pointed from inline include_str! to
ailang_surface::parse_prelude via the dev-dep). Adds a carve-out
retirement pin asserting the JSON file does NOT exist. Updates
carve_out_inventory.rs (eight → seven; §C4(b) row dropped) and the
form-a-default-authoring spec §C4(b) (RETIRED status marker added,
historical text preserved).
6 tasks, scoped to crates/ailang-core/src/workspace.rs only. Surface
unchanged in pd.1 (load_workspace_with survives as a thin shim
composed of the new fns + prelude inject). pd.2 will rewire surface
to call the new API directly and retire the shim. Plan-recon flagged
two ambiguities in the spec's iter-sketch vs. Components wording;
resolved here in favour of the shim approach so all existing tests
stay green without migration. ~12 in-tree validate_canonical_type_names
callers add &["prelude"] as the new second arg.
Adds the six IR-shape tests in crates/ail/tests/e2e.rs to Task 5's
file list and documents the test-harness patch (replace home-rolled
desugar+lift loop with monomorphise_workspace). The patch is the
small structural fix the rpe.1 BLOCKED orchestrator's Cat B
findings pointed to. With the two upstream codegen bugs now fixed
(commits 1fb225e + feb9413), the rpe.1 corpus migration plus this
Cat B harness patch should make the full retry green.
Brummel