AILang/docs/specs/0054-raw-buf.md

raw-buf — Design Spec

Date: 2026-05-29 (revised twice 2026-05-29) Status: Draft — awaiting user spec review Authors: orchestrator + Claude

Revision 1 note (post intrinsic-bodies). raw-buf.1 (intercept registry) shipped (140a0c0). The intrinsic-bodies milestone (#9) then landed and removed the placeholder-body convention the original spec relied on — kernel-tier fn bodies are now typechecked, so RawBuf.get cannot ship a type-lying placeholder body; it must be (intrinsic). And an (intrinsic) marker now requires a matching INTERCEPTS entry as a lockstep pair, so a "manifest-only / codegen-deferred" intermediate state is forbidden. The kernel-manifest and codegen therefore land together.

Revision 2 note (post raw-buf.2 + plan-recon). raw-buf.2 (the family-crate rename) shipped (fbdbe74). Planning raw-buf.3 then surfaced a deeper gap: RawBuf's operations are a third intrinsic shape the intrinsic-bodies mechanism never handled. The bijection

• symbol story was built for (a) monomorphic top-level intrinsics (answer, float_*) and (b) per-type class-method instances (eq__Int). RawBuf's ops are type-scoped polymorphic top-level intrinsics (forall a with param-in {Int,Float,Bool}, called as RawBuf.get). For that shape:

1. mono_symbol_n mints <base>__<T> from the bare fn name, so RawBuf.get @ Int becomes get__Int — the RawBuf scope never enters the symbol. new/get/set/size @ Int would collide with any other polymorphic free fn of those (very common) names.
2. The bijection collector's Def::Fn arm records the bare name "get" as one marker — matching neither the per-type entries nor their symbols. One polymorphic marker must map to N per-element entries, which the current 1-marker-to-1-entry bijection cannot express.

So raw-buf.3 is no longer "add 12 table rows" — it is a new language mechanism (type-scoped polymorphic intrinsics) that RawBuf is the first consumer of. The remaining work is re-carved into a mechanism prep (raw-buf.3), the RawBuf payload (raw-buf.4), and the stub retirement (raw-buf.5). The decided naming scheme is scope-qualified mono symbols (RawBuf_get__Int); the mechanism is ratified standalone on the stub (the prep pattern that prep.1/.2/.3 used) before RawBuf consumes it. The Goal, slab layout, and feature-acceptance argument are unchanged.

Goal

Ship RawBuf a — the first kernel-tier base extension — as a mutable, indexed, bounded-size flat buffer of primitive elements ({Int, Float, Bool}). RawBuf is the storage primitive that unblocks two downstream needs both already captured in the backlog:

• Series (milestone #8) — a bounded ring buffer with financial-style indexing, implemented as a library extension (pure AILang) wrapping RawBuf a plus bookkeeping fields.
• Embedding-ABI batch FFI (subsumes closed #2) — the M5 friction-harvest measured per-tick FFI at ~206 ns/tick on real EURUSD volume (~658 ms / 3.19M ticks). A contiguous primitive slice amortises that per-tick cost via a batch crossing. RawBuf is that primitive.

The milestone also fulfils the architectural commitment from the kernel-extensions whitepaper § "Plugin contract": the migration of the hardcoded primitive-instance intercepts into one registry, triggered by the first real base extension shipping. raw-buf.1 already discharged that migration; RawBuf is now the first real-payload consumer of that registry — and the first consumer of the type-scoped polymorphic intrinsic mechanism raw-buf.3 adds.

Architecture

Six iterations. raw-buf.1–.4 are done; .5/.6 remain. (The drop ratification, originally bundled into .4, was re-carved into its own iteration .5 once the implement surfaced that an owned cross-module type-scoped intrinsic binder's drop-call needs a codegen resolution mechanism the .4 plan did not scope — see iteration 5.)

1. Intercept registry (raw-buf.1) — DONE (140a0c0). Lifted the hard-coded try_emit_primitive_instance_body match into the registry table INTERCEPTS in crates/ailang-codegen/src/intercepts.rs; the dispatch site is an intercepts::lookup call. (The subsequent intrinsic-bodies milestone added the (intrinsic) marker, the Term::Intrinsic leaf, and the marker ↔ entry bijection pin on top of it.)

2. Kernel family-crate rename (raw-buf.2) — DONE (fbdbe74). Renamed crates/ailang-kernel-stub/ → crates/ailang-kernel/, reshaped as a family-crate (src/lib.rs hub re-exporting src/kernel_stub/{mod.rs, source.ail}). Public symbol STUB_AIL preserved; zero behavioural change.

3. Type-scoped polymorphic intrinsic mechanism (raw-buf.3) — The new language mechanism RawBuf needs, built and ratified standalone on the stub (no RawBuf yet), mirroring how prep.1/.2/.3 built kernel-extension mechanisms ratified by the stub. Two coupled pieces:

   • Scope-qualified mono symbols. When a type-scoped call T.f (prep.1 spelling) resolves to a polymorphic op f of TypeDef T, monomorphisation mints T_f__<elem> (e.g. StubT_peek__Int) — the TypeDef scope is part of the symbol, so two different types' identically-named ops never collide, and the emitted IR is legible (it reads as "the T.f specialised to <elem>"). The codegen intercept dispatch keys on this scoped symbol.
   • Bijection expansion over param-in. The bijection collector (intercepts::tests::workspace_intrinsic_markers) gains an arm: a top-level (intrinsic) op that is polymorphic and type-scoped to a TypeDef with param-in (a S1 S2 …) expands to one marker T_f__Si per allowed element type Si. One polymorphic marker → N per-element entries, all pinned by intercepts_bijection_with_intrinsic_markers. Ratified by adding ONE polymorphic type-scoped (intrinsic) op to the stub's StubT (StubT.peek : (borrow (StubT a)) -> a) plus its 2 scope-qualified INTERCEPTS entries (StubT_peek__Int, StubT_peek__Float — StubT's param-in is {Int, Float}) and a unit test asserting the scoped symbols + the bijection. peek retires with the stub in raw-buf.6, exactly as answer does. No running E2E here (constructing a StubT needs the Term::New desugar that lands in raw-buf.4); the mechanism is unit-test ratified.

4. RawBuf payload + Term::New desugar (raw-buf.4) — DONE. RawBuf as a clean consumer of the raw-buf.3 mechanism, plus the (new …) construction sugar. Shipped:

   • The raw_buf submodule (src/raw_buf/{mod.rs, source.ail}) with the RawBuf TypeDef (param-in (a Int Float Bool)) and the four ops new/get/set/size, each an (intrinsic) marker.
   • The 12 scope-qualified INTERCEPTS entries (RawBuf_{new,get,set,size}__{Int,Float,Bool}) + emit fns (@ailang_rc_alloc + getelementptr + load/store) — mechanical on top of the raw-buf.3 naming + bijection machinery.
   • The Term::New desugar (new T <types…> <values…>) → (app T.new <values…>) (general — (new StubT 42) benefits too), removing BOTH codegen Term::New deferral arms that prep.2 left marked "milestone raw-buf". The desugar runs before check, dropping the NewArg::Type; the element type is recovered by inference from use.
   • The flat intrinsic-storage drop function @drop_raw_buf_RawBuf (a single @ailang_rc_dec on the slab pointer), emitted for any TypeDef whose new op is (intrinsic)-bodied.
   • ailang-surface wiring: parse_raw_buf + workspace injection (raw_buf kernel-tier auto-imported; workspace count 4 → 5). The worked consumer program runs end-to-end and prints 60; the Float/Bool variants and the param-in reject also ship. kernel_stub (with peek + answer) stays alongside (count 5). Not in .4: the drop call does not yet fire at scope close for an owned RawBuf binder — that needs the codegen resolution mechanism in .5 (the drop function is correct and waiting).

5. Owned cross-module type-scoped drop-call resolution (raw-buf.5) — The codegen mechanism that makes the .4 flat drop fire. An owned RawBuf binder's value is a cross-module type-scoped intrinsic call ((app RawBuf.set …) : own (RawBuf a)); codegen's is_rc_heap_allocated only marks an App binder drop-trackable when synth_callee_ret_mode resolves the callee's Own ret-mode, but codegen synth_arg_type has no TypeDef-first / cross-module-mono resolution ladder (unlike the checker's lib.rs:3465), so the binder is classified non-trackable and no drop call is inserted. A second site — uniqueness::infer_module's per-module globals map — likewise misses the cross-module borrow mode, defaulting the RawBuf.get arg to Consume. raw-buf.5 teaches codegen's resolution a TypeDef-first + cross-module-mono arm (mirror of the checker ladder) feeding is_rc_heap_allocated / synth_callee_ret_mode / drop_symbol_for_binder, and extends uniqueness::infer_module with cross-module op visibility. Ratified by raw_buf_no_leak (the worked Int program under AILANG_RC_STATS reaches live == 0). This is the drop ratification the spec's acceptance criterion requires; isolating it keeps the resolution-mechanism change off the .4 payload diff.

6. kernel_stub retirement (raw-buf.6) — RawBuf now subsumes every ratification role the stub held: Term::New end-to-end (the (new RawBuf …) consumer), param-in reject (the Str reject fixture), kernel-tier auto-import, the monomorphic intrinsic path (RawBuf has no nullary intrinsic, but the path is exercised by the prelude's float_*), and — crucially — the type-scoped polymorphic intrinsic mechanism (RawBuf's four ops). Delete src/kernel_stub/ + its re-export, drop parse_kernel_stub + its injection, remove the answer and the two StubT_peek__* INTERCEPTS entries + their emit fns (their markers leave with the stub — the bijection lockstep holds), delete kernel_stub_module_round_trips, re-baseline workspace_pin to 4 (raw_buf in, kernel_stub out), and update design/INDEX.md + design/models/0007-kernel-extensions.md. The ailang-kernel crate stays as the family-crate home for future kernel-tier modules.

Ordering rationale: .3 isolates the risky mono+bijection mechanism change (proven on the stub) from RawBuf's payload diff; .4 lands RawBuf as a mechanical consumer plus the orthogonal (new …) desugar + the flat drop function; .5 isolates the codegen drop-call resolution mechanism (cross-module type-scoped ret-mode

• uniqueness visibility) off the .4 payload diff; .6 removes the now-redundant stub without touching the new RawBuf code. Each bijection-registry change is isolated to one diff (peek entries added in .3, 12 RawBuf entries in .4, peek+answer removed in .6).

Concrete code shapes

Primary — the raw-buf.3 mechanism ratifier (StubT.peek)

raw-buf.3 adds one polymorphic type-scoped (intrinsic) op to the stub to prove the mechanism. The op and its scope-qualified entries are the iteration's concrete deliverable (the must-pass evidence that scoped symbols + bijection expansion work). The fn is appended to the existing STUB_AIL source (crates/ailang-kernel/src/kernel_stub/source.ail):

  (fn peek
    (doc "Ratifies the type-scoped polymorphic intrinsic mechanism: StubT.peek is polymorphic over a (param-in {Int,Float}) and type-scoped to StubT. Codegen intercepts StubT_peek__Int / StubT_peek__Float emit a load from the Stub payload. Retires with the stub in raw-buf.5.")
    (type (forall (vars a) (fn-type (params (borrow (con StubT a))) (ret a))))
    (params s)
    (intrinsic))

(Shown text, not ail: kernel_stub is a reserved built-in module name, so the source cannot be ail check-ed standalone — reserved-module-name. Ratification is the round-trip test + the bijection/mono unit tests, not a standalone parse.) Its two scope-qualified entries (StubT_peek__Int, StubT_peek__Float) land in INTERCEPTS together with the bijection-collector extension; the bijection test pins the 1-marker→2-entries mapping.

Primary — the raw_buf kernel-tier module (raw-buf.4, gate-verified)

The exact Form-A source the raw_buf submodule embeds. It parses and type-checks against the current tool (ail check → ok); the four (intrinsic) markers are legal because the module is (kernel). RawBuf.get returns the bare element type a; set is linear (own in, own out).

(module raw_buf
  (kernel)
  (data RawBuf (vars a)
    (doc "Mutable, indexed, fixed-size flat buffer of primitive elements. Opaque single-ctor handle; codegen intercepts emit raw alloc/load/store over an @ailang_rc_alloc slab. Element type restricted to {Int, Float, Bool} via param-in.")
    (ctor B a)
    (param-in (a Int Float Bool)))
  (fn new
    (doc "Allocate an uninitialised RawBuf of capacity n. Compiler-supplied (intrinsic) body; codegen intercept RawBuf_new__<T> emits @ailang_rc_alloc plus the i64 size header. Element bytes are uninitialised; caller must set before get.")
    (type (forall (vars a) (fn-type (params (con Int)) (ret (own (con RawBuf a))))))
    (params n)
    (intrinsic))
  (fn get
    (doc "Indexed read. UB if i >= (size b); caller checks bounds via size. Compiler-supplied (intrinsic) body; codegen intercept RawBuf_get__<T> emits getelementptr plus load.")
    (type (forall (vars a) (fn-type (params (borrow (con RawBuf a)) (con Int)) (ret a))))
    (params b i)
    (intrinsic))
  (fn set
    (doc "Indexed write. Linear: own in, own out. Under uniqueness in-place; under shared copy-on-write (Issue #22). Compiler-supplied (intrinsic) body; codegen intercept RawBuf_set__<T> emits getelementptr plus store.")
    (type (forall (vars a) (fn-type (params (own (con RawBuf a)) (con Int) a) (ret (own (con RawBuf a))))))
    (params b i v)
    (intrinsic))
  (fn size
    (doc "Element count. Compiler-supplied (intrinsic) body; codegen intercept RawBuf_size__<T> emits a single i64 load from the slab header.")
    (type (forall (vars a) (fn-type (params (borrow (con RawBuf a))) (ret (con Int)))))
    (params b)
    (intrinsic)))

The (ctor B a) is a nominal fiction for the type system: it gives RawBuf an identity and keeps a non-phantom. Real code never constructs it — every operation is codegen-intercepted, and (new RawBuf …) desugars to (app RawBuf.new …), not to a (term-ctor RawBuf B …).

Primary — the worked consumer program (raw-buf.4 acceptance)

The program an LLM author naturally writes for "I need a small mutable indexed buffer to score N values and read them back." It is the feature-acceptance criterion's empirical evidence. It uses the (new RawBuf …) construction sugar (available once raw-buf.4 lands the Term::New desugar). It references the raw_buf module, injected only from raw-buf.4 — so it does not check against the current tool (RawBuf is not yet a workspace module). Left unlabeled deliberately: it describes post-raw-buf.4 surface.

(module raw_buf_demo
  (fn main
    (type (fn-type (params) (ret (con Int))))
    (params)
    (body
      (let buf (new RawBuf (con Int) 3)
        (let buf (app RawBuf.set buf 0 10)
          (let buf (app RawBuf.set buf 1 20)
            (let buf (app RawBuf.set buf 2 30)
              (app + (app RawBuf.get buf 0)
                (app + (app RawBuf.get buf 1)
                  (app RawBuf.get buf 2))))))))))
; ail check && ail build && ail run → prints 60

No (import raw_buf) needed: RawBuf is visible via kernel-tier auto-import (prep.3). RawBuf.set/.get/.new resolve via type-scoped namespacing (prep.1) and mono to the scope-qualified symbols RawBuf_set__Int / RawBuf_get__Int / RawBuf_new__Int. The element type a = Int is fixed by inference: it flows from the (app RawBuf.set buf 0 10) value arg (10 : Int) through the linear own (RawBuf a) threading. (For the direct-call equivalent without the (new …) sugar — (let buf (app RawBuf.new 3) …) — the same inference applies; the desugar reduces (new RawBuf (con Int) 3) to exactly that.)

Primary — the param-in reject fixture (raw-buf.4 must-fail)

(module raw_buf_reject_str
  (fn cant_str
    (type (fn-type (params (borrow (con RawBuf (con Str)))) (ret (con Str))))
    (params buf)
    (body (app RawBuf.get buf 0))))
; ail check → param-not-in-restricted-set: type Str not in {Int, Float, Bool}

Must fail at the checker with the ParamNotInRestrictedSet diagnostic shipped in prep.3 (fieldtest F8) — the must-fail evidence that param-in is alive on a real-payload extension. Depends on raw_buf being injected, so not gate-checkable today (unlabeled).

Secondary — scope-qualified mono symbol (raw-buf.3, implementation)

Current behaviour: mono_symbol_n(base, types) (crates/ailang-check/src/mono.rs:521) joins base and each type's mono suffix with __. For a bare-named poly free fn get it yields get__Int — no type scope. The bijection collector's Def::Fn arm (intercepts.rs ~490) inserts the bare f.name.

raw-buf.3 change (shape — exact threading mapped by plan-recon): a type-scoped call T.f carries the resolved TypeDef T; mono uses a scope-qualified base T_f so the symbol is T_f__<elem> (StubT_peek__Int, later RawBuf_get__Int). The bijection collector gains an arm that, for a polymorphic top-level (intrinsic) op scoped to a TypeDef with param-in (a S1 …), emits T_f__Si for each Si. Both the mono mint and the collector must compute the identical string (the bijection test is the pin).

Secondary — INTERCEPTS entry shape (raw-buf.4, implementation)

The registry struct (raw-buf.1) is Intercept { name, expected_params, expected_ret, wants_alwaysinline, emit }. One representative of the 12 RawBuf entries (the exact symbol strings are produced by the raw-buf.3 mechanism and pinned by the bijection test):

// crates/ailang-codegen/src/intercepts.rs — appended to INTERCEPTS
Intercept {
    name: "RawBuf_new__Int",            // scope-qualified mono symbol of RawBuf.new @ Int
    expected_params: &["i64"],          // capacity n
    expected_ret: "ptr",               // slab base pointer
    wants_alwaysinline: false,
    emit: emit_rawbuf_new_int,         // @ailang_rc_alloc(8 + n*8); store i64 n at offset 0
},
// + RawBuf_new__{Float,Bool}, RawBuf_get__{Int,Float,Bool},
//   RawBuf_set__{Int,Float,Bool}, RawBuf_size__{Int,Float,Bool}

Secondary — Term::New desugar (raw-buf.4, implementation)

Term::New { type_name, args } with args: Vec<NewArg> (NewArg::Type | NewArg::Value, both parsed + round-trip ratified). The desugar rewrites it to an application of the type's new fn, passing only the NewArg::Value args:

(new RawBuf (con Int) 3)        ; Term::New { type_name: "RawBuf",
                                ;   args: [Type(con Int), Value(3)] }
  ──desugar──▶
(app RawBuf.new 3)              ; a = Int resolved by inference from use

Important: the AST has no type-ascription term and Term::App carries no type-args, so the desugar drops the NewArg::Type and the element type is recovered by ordinary inference (it flows from how the result is used — see the worked program). This suffices for every real program that uses the buffer; an isolated (new RawBuf (con Int) 3) with no constraining use would leave a ambiguous, which is acceptable (no real program does that). After this pass no Term::New survives into codegen; both deferral arms (lib.rs ~2094 lower_term, ~3296 synth) are removed. The prep.2 checker already accepts Term::New (it parses, round-trips, and typechecks via the new def's signature); whether it needs any extension for the NewArg::Type-bearing form is a raw-buf.4 verify-first task (plan-recon maps the current Term::New typecheck path).

Secondary — slab layout (raw-buf.4)

  [ size : i64 ][ elem_0 ][ elem_1 ] ... [ elem_{size-1} ]
  ^             ^                                          ^
  offset 0      offset 8                                   offset 8 + size*sizeof(T)

Element widths: Int = 8, Float = 8, Bool = 1. Header is i64, 8-byte aligned; element payload follows directly. @ailang_rc_alloc is called with 8 + size * sizeof(T) and returns the slab base ptr. The size header is self-describing, so drop and RawBuf.size need no side-table. Drop is a single @ailang_rc_dec on the slab pointer — primitive elements carry no recursive drops; the per-TypeDef drop generation gets a flat-slab arm (raw-buf.4 emits the drop function; raw-buf.5 makes the drop call fire). (@ailang_rc_dec is the real runtime symbol — the earlier @ailang_rc_release spelling was a spec slip.)

Components

Component	Iter	Files
Intercept registry	raw-buf.1 (DONE)	crates/ailang-codegen/src/intercepts.rs + dispatch in lib.rs
Kernel family-crate rename	raw-buf.2 (DONE)	crates/ailang-kernel/ (renamed); ailang-surface dep + loader.rs; doc/ledger rows
Type-scoped polymorphic intrinsic mechanism	raw-buf.3	scope-qualified mono mangling in crates/ailang-check/src/mono.rs (+ wherever prep.1 type-scoped resolution records the TypeDef, per recon); bijection-collector expansion arm in crates/ailang-codegen/src/intercepts.rs (workspace_intrinsic_markers); StubT.peek fn added to crates/ailang-kernel/src/kernel_stub/source.ail + 2 StubT_peek__* entries + emit fns; kernel_stub_module_round_trips updated for the new fn; mono/bijection unit tests
RawBuf payload + Term::New desugar	raw-buf.4 (DONE)	new crates/ailang-kernel/src/raw_buf/{mod.rs, source.ail} + lib.rs re-export; parse_raw_buf + injection in crates/ailang-surface/src/loader.rs + re-export in lib.rs; 12 entries + emit fns in intercepts.rs; Term::New desugar in crates/ailang-core/src/desugar.rs + removal of both codegen deferral arms in crates/ailang-codegen/src/lib.rs; flat-slab drop function in drop.rs/lib.rs; workspace_pin 4 → 5; round-trip + Int/Float/Bool/reject E2E
Owned cross-module type-scoped drop-call resolution	raw-buf.5	TypeDef-first + cross-module-mono resolution arm in codegen synth_arg_type (crates/ailang-codegen/src/lib.rs) feeding is_rc_heap_allocated / synth_callee_ret_mode / drop_symbol_for_binder; cross-module op visibility in uniqueness::infer_module (crates/ailang-check/src/uniqueness.rs); raw_buf_no_leak E2E
kernel_stub retirement	raw-buf.6	delete crates/ailang-kernel/src/kernel_stub/ + re-export; drop parse_kernel_stub + injection; remove answer + StubT_peek__* entries + emit fns in intercepts.rs; delete kernel_stub_module_round_trips; workspace_pin 5 → 4; design/INDEX.md + design/models/0007-kernel-extensions.md

Data flow

Mechanism (raw-buf.3):

1. A consumer call T.f (type-scoped spelling, prep.1) resolves to the polymorphic op f of TypeDef T, recording T as the resolution scope.
2. Monomorphisation at element type Si mints the scope-qualified symbol T_f__Si; codegen emits a fn of that name; the intercept dispatch keys on it.
3. The bijection collector expands each polymorphic type-scoped (intrinsic) op over its TypeDef's param-in set into the same T_f__Si strings, and requires each to resolve to an INTERCEPTS entry (and vice versa, minus OPTIMISATION_ONLY).

Build-time (raw-buf.4 onwards):

1. CLI loads workspace → ailang-surface injects raw_buf as a kernel-tier module (kernel: true).
2. check walks consumer code; (con RawBuf (con Int)) resolves to raw_buf.RawBuf via kernel-tier auto-import (prep.3).
3. param-in on a rejects non-{Int,Float,Bool} instantiations via the existing ParamNotInRestrictedSet diagnostic.

Codegen-time (raw-buf.4 onwards):

1. The desugar replaces every Term::New with (app T.new <values>); the element type is inferred from use.
2. Codegen reaches the registry dispatch site; if the fn's scope-qualified mono symbol resolves via intercepts::lookup, the entry's emit runs (the (intrinsic) marker has no body).
3. RawBuf_new__Int emits the alloc; RawBuf_set__Int a store i64; RawBuf_get__Int a load i64; RawBuf_size__Int a header load.

Drop-call resolution (raw-buf.5): the desugared (app RawBuf.set …) : own (RawBuf a) binder is recognised as rc-heap-trackable once codegen synth_callee_ret_mode resolves the cross-module type-scoped callee's Own mode; the let-scope-close drop call to @drop_raw_buf_RawBuf then fires.

Workspace module count: prelude + kernel_stub + 2 test fixtures = 4 before raw-buf.4. raw-buf.4 adds raw_buf → 5. raw-buf.6 retires kernel_stub → 4. The workspace_pin test pins each transition.

Error handling

Two consumer-facing diagnostics; both already shipped, no new arms:

• param-not-in-restricted-set (prep.3, fieldtest F8) — fires on (con RawBuf (con Str)) or any non-{Int,Float,Bool} element.
• type-scoped-member-not-found — fires on (new SomeType …) when SomeType has no (fn new …). (raw-buf.4 note: because the Term::New desugar now runs before check, the rejection is raised by synth's type-scoped resolution of the desugared (app SomeType.new …), surfacing the more precise type-scoped-member-not-found rather than the prep.2 new-type-not-constructible it superseded — same rejection condition, more context. The prep.2 new-arg-kind-mismatch is obsoleted: the desugar drops the type-arg, so there is no arg-kind to mismatch.) raw_buf ships new, so the worked program passes.

The codegen Term::New deferral arms (lib.rs ~2094 + ~3296, message "… milestone raw-buf") are removed in raw-buf.4 once the desugar eliminates Term::New before codegen. Neither is user-facing — both are the prep.2 deferral marker. They have no test pinning them today (internal CodegenError::Internal); raw-buf.4's build-and-run E2E (the worked program printing 60) is the forward ratification.

Bounds checks are not in scope: RawBuf.get/.set are UB if `i

= size(b); caller checks via RawBuf.size`. A future axis, no backlog item yet.

Testing strategy

raw-buf.3 (mechanism):

• Mono unit test: a type-scoped poly intrinsic op mints the scope-qualified symbol (StubT_peek__Int, StubT_peek__Float) — asserts the new mangling directly, no running program needed.
• Bijection: intercepts_bijection_with_intrinsic_markers stays green with the peek marker expanded to its 2 scope-qualified entries (proves the 1-marker→N-entries expansion).
• kernel_stub_module_round_trips updated for the added peek fn (parse → serialise → round-trip holds).
• Full suite green; no workspace-count change (peek is added to the existing stub, no new module).

raw-buf.4 (RawBuf payload + desugar):

• Round-trip raw_buf_module_round_trips (mirror kernel_stub_module_round_trips): assert kernel == true, name raw_buf, RawBuf TypeDef param_in for a contains Int/Float/Bool.
• E2E raw_buf_int_e2e: the worked program — ail check && ail build && ail run → prints 60.
• E2E raw_buf_float_e2e / raw_buf_bool_e2e: Float and Bool variants (Bool catches any i1/i8 packing question).
• E2E raw_buf_param_in_reject_e2e: the Str reject fixture — ail check exits non-zero with param-not-in-restricted-set.
• Term::New desugar ratified by the (new RawBuf …) form building and running (it would hit the now-removed deferral arm otherwise); plus new_stubt_builds_and_runs ((new StubT 42) via the real-body StubT.new).
• Bijection green with the 12 RawBuf entries added.
• workspace_pin count 4 → 5 (+ contains_key("raw_buf")).
• (The drop / no-leak ratification moved to raw-buf.5 — the flat drop function ships here but its call-insertion needs the .5 resolution mechanism.)

raw-buf.5 (drop-call resolution):

• raw_buf_no_leak: the worked Int program under AILANG_RC_STATS reaches live == 0 (the slab is freed at let-scope close). RED before the resolution arm, GREEN after — the iteration's ratifier.
• Full suite green; existing symbols unchanged (the resolution arm fires only for owned cross-module type-scoped binders).

raw-buf.6 (retirement):

• workspace_pin re-baselines 5 → 4 (raw_buf in, kernel_stub out).
• kernel_stub_module_round_trips deleted; raw_buf_module_round_trips carries the invariant forward.
• Bijection green after answer + StubT_peek__* markers + entries leave together with the stub.
• Full suite green; the diff is a removal.

Acceptance criteria

The milestone ships when:

1. The worked consumer program runs end-to-end: ail check && ail build && ail run prints 60 (raw-buf.4 ✓).
2. The param-in reject fixture exits at ail check with the param-not-in-restricted-set diagnostic (raw-buf.4 ✓).
3. RawBuf's four ops are (intrinsic) markers, each mono'd to a scope-qualified symbol (RawBuf_<op>__<T>) with a matching INTERCEPTS entry; intercepts_bijection_with_intrinsic_markers is green (the mechanism in raw-buf.3, the 12 entries in raw-buf.4 ✓).
4. Term::New no longer reaches codegen — the desugar eliminates it and both deferral arms are removed (raw-buf.4 ✓).
5. A RawBuf allocated and dropped at scope close does not leak (raw_buf_no_leak, live == 0) — the drop call fires (raw-buf.5).
6. kernel_stub is retired and raw_buf takes over its ratification roles (raw-buf.6).
7. Workspace test suite green at each iteration boundary, plus the new tests in § Testing strategy.

Feature-acceptance argument

Applied per design/contracts/0004-feature-acceptance.md:

1. LLM author reaches for it naturally. RawBuf is the only path to mutable indexed storage in AILang — the language has no other "fill N slots and read them back" primitive. The worked consumer program is what an LLM author writes for that need; there is no alternative shape to reach for.

2. Measurable improvement. Embedding-ABI M5 measured per-tick FFI at ~206 ns/tick (~658 ms / 3.19M EURUSD ticks). RawBuf as the batch-FFI primitive amortises that per-tick cost across one crossing. The Series milestone (#8) is also blocked on RawBuf; shipping raw-buf removes that block.

3. No reintroduced bug class. Mutation stays mode-tracked: RawBuf.set is own → own, not effect-tracked; no RawBuf effect is declared. Uniqueness inference rewrites in-place; shared ownership falls back to copy-on-write (Issue #22). The pure-core invariant survives (code without a declared effect is pure); local reasoning survives (a fn taking borrow (RawBuf Int) and returning Int is pure from the caller's view). The new scope-qualified mono symbols remove a latent bug class — the get__Int-style collision between different types' identically named polymorphic ops.