4 Commits

Author	SHA1	Message	Date
Brummel	dfdc65f21f	audit: spec 0064 cycle close — drift-clean after two ledger fixes (#57) ... Cycle-close audit for spec 0064 (the #57 hardening of the linearity analysis, the #55-cutover precondition; four iterations 47964ab, cc5991e, be259f9, 2769e50). Architect drift review (39b674c..HEAD): both CLAUDE.md lockstep pairs confirmed untouched (INTERCEPTS↔intrinsic markers; Pattern::Lit typecheck↔pre_desugar_validation) — the cycle is genuinely diagnostic-only. It found two drift items, both in the iter-3 contract edit, both fixed here (fix path, folded into the audit close since they are doc-only): 1. [medium] design/contracts/0008-memory-model.md — the iter-3 rewrite placed a "Covers let-aliases…" statement under the "What this widening does NOT do" heading (incoherent) and named only the linearity-check mechanism, silently dropping the codegen dimension the original carve-out actually referred to ("Iter A / pre-tail-call shallow-dec arm" = the drop gates). Verified the real current state: let-aliases are propagated on BOTH axes — the linearity diagnostic (Checker.aliases + resolve_alias, this cycle) AND the codegen drop gates (MTerm::Let's current_param_modes mode inheritance, ailang-codegen/src/lib.rs:1811, pre-existing). The bullet is moved out of the "does NOT do" list into a positive paragraph naming both mechanisms. 2. [low] design/INDEX.md memory-model row — the ratifying-test cell listed only uniqueness.rs while the contract trailer now also names linearity.rs. Cell updated to "uniqueness.rs + linearity.rs". Regression gate (both green, exit 0): - bench/check.py: 34 metrics; 0 regressed, 1 improved beyond tolerance (latency.implicit_at_rc.median_us -5.27%), 33 stable. The "improved" is measurement noise, NOT a real metric move — this cycle is diagnostic-only and touches no codegen/runtime, so it cannot have improved runtime latency. Baseline deliberately NOT updated (no ratify: nothing in the code moved the metric). - bench/compile_check.py: 24 metrics; 0 regressed, 24 stable. Outcome: cycle 0064 tidy (drift-clean). All four #57 hardening classes (value-typed let-binders, local fn-param modes, let-alias propagation, partition_eithers double-consume) shipped and ratified. The #55-cutover precondition is met. Drift-clean is not a milestone close: #55 (the irreversible ParamMode::Implicit deletion) is the next, separate step. refs #57	2026-06-01 18:29:02 +02:00
Brummel	be259f9d46	feat(check): let-alias borrow propagation via alias-redirect (#57, 0064 iter 3) ... Third iteration of spec 0064 (the #55-cutover hardening, #57). Closes false-positive class 2: Term::Let walked its value in Position::Consume, so (let a t (match a …)) over a borrow-mode t consumed t at the binding and tripped consume-while-borrowed -- a let-alias of a borrowed value read in a borrow position is not a consume. Fix: the Checker gains a scoped aliases: HashMap<String,String>. A (let a t body) whose value is a bare Var resolving to a tracked binder records a -> root(t) for the body scope and skips the consume walk of the value. A new resolve_alias helper maps a name to its root, preferring a real binder at each chain step -- so an inner binder named `a` (nested let, pattern binder, lam param) automatically shadows the alias with NO change to with_binder/walk_arm/Lam (the shadowing is resolved centrally in the resolver, not at three scattered introduction sites). Every binder-state lookup keyed by name resolves through the map first: use_var, the App borrow bump + decrement (pushing the resolved root to `lent` so the decrement matches), callee_arg_modes, and the reuse-as source. Design calls (orchestrator): - Alias REDIRECT, not state clone (spec scope decision 3): consuming the alias marks the single root consumed, so a real double-consume through an alias is still caught. A clone would track two independent binders and miss it (unsound). Pinned by the new let_alias_of_owned_double_consume_still_errors unit test: (let a p0 (seq a p0)) over an own heap p0 still fires use-after-consume. - resolve_alias prefers binders -> shadowing needs no edits to the binder-introduction sites. Lower-risk than clearing aliases at each. - reuse-as source (linearity.rs:663) is resolved through aliases too: it is the 4th binder-state-reading site; the spec's Fix 3 named three illustratively. Without it, (reuse-as <alias> …) would mis-fire reuse-as-source-not-bare-var on what IS a Var. Faithful completion of Fix 3. The diagnostic now reports the resolved root name (the actual consumed resource), not the surface alias. Closes the design/contracts/0008-memory-model.md let-alias carve-out (was "has not shipped yet") and extends its Ratified-by trailer to name linearity.rs, where the propagation now lives -- a contract change riding with the feature that forces it. RED-first: examples/c2_let_alias.ail added to harden_ownership_false_positives_are_clean (RED: consume-while-borrowed on count's t); GREEN after. Verified: c2 RED->GREEN; 120 linearity unit tests green; the soundness test fires; harden false-positive + heap double-consume guards green; cargo test --workspace green; bench/check.py 34/34, compile_check.py 24/24 stable. Diagnostic-only; no schema/type/codegen change. Class 4 (partition_eithers body rewrite) remains for the final iteration of spec 0064. refs #57	2026-06-01 18:12:25 +02:00
Brummel	b151990028	audit: raw-buf close-fixes — honesty + ledger for the binder-rename (refs #43) ... Architect drift review at raw-buf milestone close (after 55d76ae closed #43) surfaced three items; this commit clears them. All three lockstep- invariant pairs were confirmed intact and the effective-name keying was confirmed consistent across the desugar→lift boundary (lift_letrecs reads the desugared tree's effective names too). 1. [high] Honesty fix. `fresh_binder`'s doc-comment (and 55d76ae's body) claimed "authored names cannot contain `$` — the lexer reserves it". False: the lexer (ailang-surface) reserves only `.`, not `$`. The `$`-for-synthetic convention is not enforced. So collision-freedom rests solely on the `used` + in-scope-`scope` probe, which does not see an authored `<base>$<n>` that is out of scope at mint time but later binds under the same `(def, name)` key — the very collision class this fix closes. Latent (no fixture uses a `$` binder), but the stated rationale was wrong. Doc-comment now describes the probe honestly and names the gap + its two possible closures (enforce the reservation, or seed `used` with every authored binder name in the def). The enforce-or-retract decision is the next-direction follow-up. 2. [medium] design/models/0003-pipeline.md — "desugar currently only flattens nested constructor patterns" no longer matches the code (it now also alpha-renames shadowing binders). Corrected to current state (honesty-rule). 3. [low] design/contracts/0008-memory-model.md — the three drop gates all key on `(def_name, binder_name)` consume_count, silently relying on per-fn binder-name injectivity, which the ledger never stated. Added that invariant as an explicit precondition of the gates, with the desugar guarantee and its ratifying tests. No code-logic change; doc-comment + ledger only.	2026-05-30 12:50:55 +02:00
Brummel	832375f2ac	convention: counter-prefix file naming across docs/specs/, docs/plans/, design/contracts/, design/models/ ... All 176 files in the four accumulating directories now use a zero-padded 4-digit counter prefix that reflects creation order (`NNNN-slug.md`). The counter is assigned per directory in strict git-log creation order; ties broken alphabetically by original name. The old `YYYY-MM-DD-` prefix on docs/specs/ and docs/plans/ files is dropped — the date is recoverable from git log and the counter carries the ordering. A file's counter is stable for the life of the file: never reassigned, never reused, never compacted. Deleted files retire their counter; subsequent files do not fill the gap. This is the property that lets cross-references stay literal — refs use the full filename including the counter (`design/contracts/0007-honesty-rule.md`) so they grep cleanly and resolve directly without a glob step. 313 cross-references updated across .md/.rs/.toml/.c/.json files (test pins, include_str! paths, design-INDEX entries, baseline notes, runtime C comments, inter-contract markdown links incl. bare basename and `../models/foo.md` forms). CLAUDE.md gets a new "File-naming convention" section spelling out the rule and rationale. skills/brainstorm/SKILL.md and skills/planner/SKILL.md updated so new spec/plan creation produces counter-prefixed names from the start. The full test suite (cargo test --workspace) passes.	2026-05-28 13:31:31 +02:00