AILang/docs/journals/2026-05-12-audit-eob.md

audit-eob — Milestone close: heap-str-abi (closing iter eob.1)

Date: 2026-05-12 Milestone: heap-str-abi (hs.1 + hs.2 + hs.3 + hs.4 + eob.1) Status: Closed, three DESIGN.md tidies applied inline (eob.tidy)

Architect drift review

ailang-architect reported drift_found across the commit range 750f97e..78e8338. Lockstep invariants and codegen ABI all intact; three high-severity items in DESIGN.md plus one medium record-keeping note.

[high — spec acceptance] docs/DESIGN.md:2338-2342 — float_to_str described as "type-installed but codegen-deferred" with CodegenError::Internal. Stale since hs.4.

[high — spec acceptance] docs/DESIGN.md:2387 — same caveat inside the "What is supported" inventory; int_to_str was absent from the inventory entirely.

[high — spec acceptance] docs/DESIGN.md (missing) — no "Str ABI" anchor documenting the heap-Str / static-Str dual realisation, shared consumer ABI, or codegen-elision invariant for static-Str-in-RC-paths.

[medium — record-keeping] docs/journals/2026-05-12-iter-hs.4.md closed DONE_WITH_CONCERNS with weakened RC assertions; eob.1 retroactively restored the strict invariants. No forward-pointer appended; readers cross-walk via INDEX.md.

Tidy fixes applied inline (eob.tidy)

All three high-severity DESIGN.md drift items addressed in this audit commit (Boss-mechanical edits — no separate plan / implement dispatch warranted; the spec amend was small, the Str-ABI-anchor content was already fully known from the just-closed milestone):

1. docs/DESIGN.md:2338-2343 (float_to_str caveat block): replaced the codegen-deferred prose with a one-paragraph statement that float_to_str and int_to_str are fully wired, allocate a heap-Str slab, and carry ret_mode: Own. Forward-references the new Str-ABI anchor.

2. docs/DESIGN.md:2387-2392 (inventory bullet): dropped the codegen-deferred parenthetical from float_to_str; added int_to_str : (Int) -> Str to the inventory; pointer to the Str-ABI section for the dual realisation.

3. docs/DESIGN.md (new "Str ABI" subsection placed after the Float-semantics block, before "What is not (yet) supported"): documents the two realisations (static-Str packed-struct <{ i64, [N+1 x i8] }> globals in .rodata; heap-Str slabs allocated via ailang_rc_alloc(8 + len + 1)); the shared consumer ABI (Str pointer at len-field offset 0, bytes at payload + 8, inherited strcmp semantics); and the codegen-level non-RC invariant for static-Str (move-tracking partial-drop + non-escape lowering + Type::Con { name: "Str" } carve-outs at field_drop_call and drop_symbol_for_binder's App arm).

Medium-severity hs.4-journal forward-pointer: skipped. INDEX.md already links hs.4 → eob.1 chronologically; the eob.1 journal explicitly cross-references hs.4's deferred fix as the iter's motivation. A forward-pointer in hs.4's own file would push the append-only convention; the cross-walk from INDEX is sufficient.

Bench-regression check

Sequence run as Boss (the && chain in audit-SKILL.md tripped at check.py's exit 1; compile_check.py and cross_lang.py then run separately to read their exit codes cleanly):

• check.py: exit 1 — 63 metrics; 2 regressed, 5 improved beyond tolerance, 56 stable.
  • Regressions: bench_list_sum.bump_s +12.60% (tol 10%); bench_hof_pipeline.bump_s +11.65% (tol 10%). Both only marginally over tolerance; the other four bump_s metrics (bench_tree_walk, bench_closure_chain, bench_compute_collatz, bench_list_sum_explicit) are stable within ±7%.
  • Improvements: three on the latency.explicit_at_rc cluster (p99_us -37.37%, p99_9_us -40.14%, p99_over_median -37.35%); two gc_over_bump mirrors on bench_list_sum and bench_hof_pipeline (ratio falls because the denominator — bump_s — rose; same physical signal as the bump regressions).
• compile_check.py: exit 0; 24 metrics, all stable within ±25%.
• cross_lang.py: exit 0; 25 metrics, all stable within ±15%.

Classification

Latency cluster (latency.explicit_at_rc.p99_us / p99_9_us / p99_over_median): third consecutive sighting across audit-cma → audit-ms → audit-eob. audit-ms flagged this as "one more audit before considering ratification"; this is that one more audit.

eob.1's only codegen-side touchpoints are the drop.rs Str carve-out (8 LOC) and the ret_mode: Own flip at four signature sites; none of those should plausibly shift latency p99 by 37%. The signal predates this milestone (audit-cma was three milestones ago). Conservative call: still do not baseline-update on this audit. The cluster is real and persistent, but the underlying cause is unknown, and a baseline update without an identified attribution would obscure the next signal that does have an attributable cause.

Recommendation forward: if the cluster persists into the next two audits unchanged, ratify with --update-baseline and a journal entry naming the persistence as the ratify rationale (absence of identified cause being the standing fact). If the cluster shifts or shrinks meaningfully, that is itself the attribution signal.

bump_s cluster (bench_list_sum.bump_s, bench_hof_pipeline.bump_s): first sighting in any recent audit. Both metrics only marginally over the 10% tolerance. The other four bump_s measurements are stable, which makes "shared underlying bump-allocator change" unlikely; per-fixture system noise (12.6% on a ~50ms benchmark is ~6ms of jitter) is the most parsimonious explanation.

eob.1 made zero changes to bump-allocator codepaths. The implementer's end-report flagged this same cluster as appearing during the workspace bench sweep before commit. Conservative call: first-sighting rule — do not baseline-update; observe in the next audit; if it persists, investigate.

Baseline left pristine on every script for the third consecutive audit. No --update-baseline invocation.

Status

Closed. Heap-str-abi milestone fully landed:

• Static-Str layout migrated (hs.1, hs.2).
• Heap-Str runtime additions wired (hs.3, hs.4).
• Effect-op-borrow rule + RC-discipline closes (eob.1).
• DESIGN.md anchors both arg-position rules + Str-ABI dual realisation (eob.1 + eob.tidy in this audit).
• WhatsNew entry + roadmap P1 close (eob.1).

Working tree exits audit clean. main HEAD advances by exactly this audit commit.