AILang/docs/journals/2026-05-13-audit-24.md

# audit-24 — milestone close (Show + print rewire)

**Date:** 2026-05-13
**Milestone:** Show + print rewire (number-24 family)
**Iters covered:** 24.1 (`f38bad8`, shipped 2026-05-12) → 24.2 (`3286117`) → 24.3 (`246b5c7`)
**Range from previous close:** `0dcdaab..0cfb3f6` (audit-ct-tidy → iter-24.3 INDEX)
**Status:** drift_found — `24.tidy` queued

## Summary

The Show + print milestone shipped in three iters: 24.1 installed
`bool_to_str` + `str_clone` runtime + codegen primitives at heap-Str
ABI level (pre-mq audit lineage); 24.2 added `class Show` + four
primitive instances (Int/Bool/Str/Float) to the prelude and migrated
the 22b user-Show fixture corpus to `TShow`/`tshow` to eliminate
post-prelude.Show ambiguity; 24.3 added `fn print` with explicit-let
body, three E2E fixtures (positive 4-prim, user-ADT, negative
NoInstance), an IR-shape pin on `print__Int.body`, a Show-aware
NoInstance diagnostic, plus three compiler-path repairs surfaced by
the user-ADT E2E (canonical-form normalisation of
`MonoTarget::FreeFn::type_args`, codegen cross-module reference
fallback, FreeFnCall constraint-residual push).

Architect drift review surfaces 7 items: three [high] (missing DESIGN.md
documentation of the three iter-24.3 strengthenings: canonical-form
`type_args`, post-mono cross-module-ref invariant, FreeFnCall constraint-
residual push; missing codegen-level pin for the import_map-fallback
path; constraint-residual push currently fires only in the dot-qualified
FreeFnCall branch), three [medium] (`unwrap_or_default` in the
method-name lookup masks class-index drift; `normalize_type_for_lookup`
duplicated across two `mono.rs` sites with manual-lockstep invariant;
negative-test coverage is single-shape — only `f : Int -> Int`, not
user-type-without-instance), and one [low] (bench `architect_sweeps.sh`
noise on three pre-milestone-24 DESIGN.md lines — not new drift).

Bench: `bench/check.py` exit 1 with 2 regressed / 1 improved metrics
(metric identities migrate between runs — first run hit
`latency.implicit_at_rc.max_us +209%`, second run hit
`latency.explicit_at_rc.max_us +66%` + `bench_list_sum.bump_s +11.9%`).
`bench/compile_check.py` exit 1 with 3-5 regressed metrics across
runs (metric identities migrate: first run hit `build_O0_ms.*`
cluster within tolerance, second run hit `check_ms.*` cluster with
several +25-34% deltas). `bench/cross_lang.py` exit 0, 25/25 stable.
**9th consecutive audit observation** of the documented noise envelope
covering `latency.implicit_at_rc.*` / `latency.explicit_at_rc.*` /
`bench_list_sum.bump_s` / `check_ms.*` metric-cluster migration
across consecutive runs. Conservative-call convention has held the
baseline pristine across 8 prior audits since `audit-cma`; this
audit extends the lineage to 9 with the same conservative call —
the metric-migration-between-runs is itself attribution evidence
that the signal is variance, not regression.

Resolution path: `24.tidy` iteration covers 5 actionable drift
items (three [high] + two [medium] documentable/refactorable). The
[medium] "negative-test coverage single-shape" item moves to the
roadmap P3 backlog. The [low] bench_sweep noise is carry-on.

## Architect drift items

### [high-1] Three iter-24.3 strengthenings undocumented in DESIGN.md

**Paths:** `crates/ailang-check/src/mono.rs:687-696` + `:1287-1294`,
`crates/ailang-codegen/src/lib.rs:1980-2000` + `:2200-2244` +
`:2776-2816`, `crates/ailang-check/src/lib.rs:2820-2865`,
`docs/DESIGN.md` §"Monomorphisation" or new subsection.

Iter 24.3 silently strengthened three load-bearing mono / codegen /
synth invariants without documenting them in DESIGN.md:

- (a) `MonoTarget::FreeFn::type_args` carries canonical (`<owner>.<bare>`)
  types post-collection via `normalize_type_for_lookup`. Pre-iter
  invariant was "subst.apply result"; new invariant is
  "subst.apply result normalised to registry-lookup form".
- (b) Post-mono synthesised bodies may carry cross-module references
  to modules their source template didn't import. Codegen falls back
  to direct `module_user_fns` / `module_def_ail_types` lookup when
  the prefix isn't in the current module's `import_map`.
- (c) FreeFnCall synth pushes one `ResidualConstraint` per declared
  forall-constraint with rigid vars substituted by fresh metavars.
  Pre-iter, the arm had `constraints: _` (constraints ignored);
  latent for milestone-23 fixtures because all primitive instances
  discharged silently.

Future planner / implementer work that touches these surfaces will
not see the strengthenings without a doc anchor.

**Outcome:** fix in `24.tidy` (doc-only).

### [high-2] Codegen import_map fallback path has no unit-level pin

**Path:** `crates/ailang-codegen/src/lib.rs:2200-2244` + `:1980-2000` +
`:2776-2816`.

The three cross-module-fallback arms (`resolve_top_level_fn`,
`lower_app` cross-module arm, `synth_with_extras` Var arm) introduce
a new dispatch path: try `import_map`, fall back to direct
`module_user_fns` / `module_def_ail_types` lookup. The fallback is
**only** justified by post-mono synthesised cross-module references.
No codegen-level unit test pins the failure mode; the only test that
would catch a regression is the E2E `show_user_adt.ail.json`. If a
future refactor tightens `resolve_top_level_fn` back to import_map-only,
the regression surfaces only at E2E (slow to bisect).

**Outcome:** fix in `24.tidy` — add a unit pin asserting the fallback
resolves for a synthesised `prelude.print__T` → `<user_module>.show__T`
pair without going through `import_map`.

### [high-3] FreeFnCall constraint-residual push covers only dot-qualified branch

**Path:** `crates/ailang-check/src/lib.rs:2820-2865`.

The constraint-residual push happens **only** in the dot-qualified
`prefix.suffix` synth branch (the only branch that populates
`free_fn_owner = Some(...)`). Bare-name references to polymorphic free
fns that resolve through other branches (locals shadow,
`env.module_globals` direct hit at the current module, etc.) do not
push residuals for declared constraints. For prelude poly fns this is
fine because the auto-injected prelude call-path always lands in the
dot-qualified branch — but the invariant is implicit and undocumented.
The same "silent unknown variable from codegen" failure mode existed
pre-iter-24.3 for any milestone-23 negative case (`ne` on a type
without `Eq` instance, etc.); the iter-24.3 fix covers Show only
because that's what the negative E2E exercised.

**Outcome:** fix in `24.tidy` — generalise the constraint-residual push
to all FreeFnCall synth branches, OR document the invariant
"poly free fns always reach synth via the dot-qualified branch" and
pin it with a unit test.

### [medium-1] `unwrap_or_default` in method-name lookup masks class-index drift

**Path:** `crates/ailang-check/src/lib.rs:2852-2858`.

Method-name lookup in the FreeFnCall constraint-residual push uses
`unwrap_or_default()` (empty string fallback) when `class_methods` has
no entry for the residual class. A user constraint referencing a class
that does not exist would silently render `NoInstance` with an empty
`method:` field. The iter-22 `MissingClass` pre-pass plausibly rejects
this earlier, but the fallback masks the dependency.

**Outcome:** fix in `24.tidy` — replace with explicit `Internal` or
`expect(...)` to surface registry/index drift on regression.

### [medium-2] `normalize_type_for_lookup` duplicated across two sites

**Path:** `crates/ailang-check/src/mono.rs:687-696` + `:1287-1294`.

The two `normalize_type_for_lookup` call sites use a literal copy of
the body comment rather than extracting a helper. The two sites must
agree byte-identically (per iter-24.3 journal: "Must agree byte-
identically with that site or Phase 3 rewrite cursor produces a mono-
symbol name that differs from the Phase 2 synthesis name"). A
`normalize_free_fn_type_args(env, module_name, metas, subst)` helper
would make the lockstep enforceable by construction.

**Outcome:** fix in `24.tidy` — extract helper.

### [medium-3] Negative-test coverage single-shape (deferred)

**Paths:** `examples/show_no_instance.ail.json` and the broader
NoInstance Show test surface.

The negative E2E covers `f : Int -> Int` (function type without Show
instance). Other NoInstance shapes — user type without instance,
partial-application residual carrying both a missing constraint AND a
NoInstance, polymorphic call with two unsatisfied constraints — are
not pinned. The Show-aware NoInstance arm fires for any
non-prelude-Show type by construction, so the single fixture is
*structurally representative*, but coverage breadth is thin.

**Outcome:** roadmap backlog P3 (not in `24.tidy`). Single-fixture
coverage is acceptable for the architecture-shipping milestone;
broader coverage waits for the corpus-migration milestone (the queued
P2 retirement of `io/print_int|bool|float`) when more downstream
fixtures naturally exercise these shapes.

### [low-1] bench/architect_sweeps.sh noise on pre-milestone-24 DESIGN.md lines

**Path:** `bench/architect_sweeps.sh` matches on `docs/DESIGN.md:50`,
`:449`, `:614`.

All three matched lines predate milestone 24 (text not touched in the
milestone-24 diff). Legitimate references or empirical-addendum
headings, not new history anchors. Sweep noise from prior eras.

**Outcome:** carry-on (not a milestone-24 drift item).

## Bench

- `bench/check.py`: exit 1 with metric identities migrating between
  consecutive runs:
  - Run 1: 2 regressed (`latency.implicit_at_rc.max_us +209%`,
    `bench_list_sum.bump_s +11.9%`), 1 improved
    (`bench_list_sum.gc_over_bump`).
  - Run 2: 2 regressed (`latency.explicit_at_rc.max_us +66%`,
    `bench_list_sum.bump_s +11.9%` again), 1 improved (different
    metric).
  - Pattern: the `latency.*_at_rc.max_us` metric cluster shifts
    identity between runs; `bench_list_sum.bump_s` is the 5th
    consecutive sighting since `audit-mq.tidy`. Same envelope the
    iter-24.3 journal documented as the 8th consecutive observation;
    this audit makes it 9.
- `bench/compile_check.py`: exit 1 with 3-5 regressed metrics across
  runs; metric identity migrates between `build_O0_ms.*` cluster (run
  1) and `check_ms.*` cluster (run 2). All deltas are +5% to +34%
  across runs; tolerance is 20-25% so multiple `check_ms.*` deltas
  cross threshold sporadically. Same migration pattern.
- `bench/cross_lang.py`: exit 0; 25/25 stable.

**Conservative call: baseline pristine for the 9th consecutive audit.**
The metric-identity-migration is itself attribution evidence that the
signal is variance, not regression. If signal were present, the metric
would not migrate between runs at this rate. Ratifying via
`--update-baseline` would pin a snapshot that does not characterise
the actual distribution (since the noise migrates, any single
snapshot is wrong). The right ratification path is the queued P3
"Latency methodology rework — switch from per-run timing to a
histogram-based approach"; until that ships, conservative-call is the
correct response.

No `--update-baseline` invocation this audit.

## Resolution

- `24.tidy` iter to land 5 drift fixes: `[high-1]` (DESIGN.md
  documentation of the three iter-24.3 strengthenings), `[high-2]`
  (codegen import_map-fallback pin), `[high-3]` (FreeFnCall
  constraint-residual push generalisation OR documented invariant),
  `[medium-1]` (replace `unwrap_or_default` with explicit error),
  `[medium-2]` (extract `normalize_free_fn_type_args` helper). Routes
  through `planner` → `implement`.
- `[medium-3]` (negative-test coverage single-shape): roadmap backlog
  P3.
- `[low-1]` (bench sweep noise): carry-on, not actionable.
- Bench: extend lineage to 9th consecutive observation. Pristine
  baseline. Document for future histogram-methodology landing.

## Files touched

- `docs/journals/2026-05-13-audit-24.md` (new, this file)
- `docs/journals/INDEX.md` (one new line)

No production code or test edits in this audit; all recommendations
land in `24.tidy`.