Brummel
176821c2e7
The 3020-line docs/DESIGN.md is replaced by the design/ ledger:
design/INDEX.md (sole addressable spine, typed Contracts+Models tables,
polymorphic links — prose file OR authoritative source //!), 14
design/contracts/*.md test-linked invariants + 3 source-link-only
contracts (mangling/env-construction/qualified-xref, no prose file —
code is SoT), 5 design/models/*.md whitepapers, and
docs/journals/2026-05-19-design-decision-records.md (the
relitigation-guard archive — every why/rejected/does-not-do/rollback/
empirical ### moved out at ###-granularity). Clean cut: git rm
docs/DESIGN.md, no stub.
RED-first crates/ailang-core/tests/design_index_pin.rs — the 4-clause
anti-regrowth spine (DESIGN.md-gone / every-INDEX-link-resolves /
every-contract-names-a-resolvable-ratifier /
contracts-carry-no-decision-record-prose) — demonstrably RED before,
GREEN after. Build-atomic by task ordering: design_schema_drift.rs's
include_str! (the only compile-time consumer) retargeted to
design/contracts/data-model.md BEFORE the deletion; its
## Data model/## Pipeline slicer dropped (a simplification the split
enables). 2 NoInstance diagnostics + 2 lockstep E2Es retargeted to
design/contracts/{float-semantics,typeclasses}.md. ~12 agent reading
lists + 5 SKILL bodies + CLAUDE.md + skills/README.md + ~25
code/C/.ail/spec comment xrefs retargeted; OQ7 dangling 'Iter 13b'
cite deleted (no forward target — a pointer would be fiction).
honesty-rule.md rewritten so the rule names the new home
(rationale->journals), resolving the recon-found internal
contradiction; the two docs_honesty_pin.rs:70,72 pinned phrases kept
verbatim+contiguous.
Boss-verified independently: cargo test --workspace 646 passed /
0 failed; design_index_pin 4/4; acceptance grep CLEAN of live
DESIGN.md refs (residuals = only the spec-mandated clause-4
deletion-enforcer). 2 DONE_WITH_CONCERNS routed to the mandatory
milestone-close audit: (a) str-abi.md:23 '(iter str-concat,
2026-05-13)' provenance stamp trips advisory architect_sweeps Sweep-1
— Boss-confirmed byte-identical to DESIGN.md@deeffb1:2062-2065, a
faithfully-migrated PRE-EXISTING anchor (regexes verbatim, only path
retargeted), NOT split-introduced — RATIFY-or-tidy at audit; (b) a
now stale-direction intra-prose 'see Str ABI below' cross-ref in
float-semantics.md — audit-adjudication candidate. Plan defect noted:
Task 9 Step 4's verbatim acceptance grep used a ^./ anchor not
matching the system's grep -rIn output; substance re-verified CLEAN.
Spec grounding-check PASS x2. Journals INDEX + decision-records
pointer appended (Boss-only).
61 lines
2.8 KiB
Markdown
61 lines
2.8 KiB
Markdown
# Tail calls
|
|
|
|
## Decision 8: explicit, verified tail calls
|
|
|
|
For an LLM author, recursion is the natural iteration form
|
|
(`\n. if n == 0 then () else loop(n-1)` is what I reach for, not
|
|
a `for`-loop). Without a tail-call guarantee, every recursive
|
|
program has a silent stack-depth ceiling that no compile-time
|
|
diagnostic warns about. That is exactly the class of correctness
|
|
hazard the language exists to eliminate.
|
|
|
|
Solution: explicit, verified tail calls.
|
|
|
|
- **AST.** `Term::App { fn, args, tail: bool }` and
|
|
`Term::Do { op, args, tail: bool }` gain a `tail` flag,
|
|
serde-defaulting to `false` so existing fixtures load with
|
|
`tail: false` and their hashes stay bit-identical.
|
|
- **Typecheck.** A new pass `verify_tail_positions(fn_body)`
|
|
runs after the main type-check. It walks the body with an
|
|
`is_tail_context: bool` threaded down. The flag is `true` at
|
|
the start, `true` for the body of every `Term::Match` arm,
|
|
`true` for the right operand of `Term::Seq`, `true` for the
|
|
body of `Term::Let`, `true` for the body of `Term::Lam` (each
|
|
Lam opens its own tail scope). The flag is `false` for: args
|
|
of any `App`/`Do`/`Ctor`, scrutinee of `Match`, left of
|
|
`Seq`, condition of `Let`-bound expression. When the walker
|
|
visits an `App { tail: true }` or `Do { tail: true }`, the
|
|
flag must be `true` at that visit; otherwise emit diagnostic
|
|
`tail-call-not-in-tail-position`.
|
|
- **Codegen.** Emit `musttail call` (LLVM IR) for marked calls
|
|
instead of plain `call`. LLVM rejects at IR-verification
|
|
time if the call cannot physically be a tail call (calling
|
|
convention mismatch, signature divergence, etc.). The reject
|
|
surfaces as a hard build error, not a silent runtime
|
|
surprise.
|
|
- **Form (A).** Two new keywords: `tail-app`, `tail-do`.
|
|
Productions are positional analogues of `app`/`do` with
|
|
`tail: true` set on the resulting term. EBNF gains 2 lines;
|
|
total production count goes from ~28 to ~30, still inside
|
|
the constraint-1 budget.
|
|
|
|
**What this does NOT promise.** Per the tail-call survey of existing fixtures,
|
|
many existing recursive calls are *not* in tail position
|
|
because they are arguments to constructor calls (e.g.
|
|
`Cons (f h) (map f t)`). The current pipeline adds annotation + verification;
|
|
it does **not** add a CPS transform or accumulator-form
|
|
rewrite. Programs whose recursion is constructor-blocked
|
|
will continue to be stack-bounded by recursion depth. The
|
|
canonical authoring pattern in such cases is to write the
|
|
accumulator-form variant (`map_acc`, `fold_left`, etc.)
|
|
explicitly. The stdlib ships both forms where
|
|
relevant.
|
|
|
|
Migration of existing fixtures is partial: only
|
|
`print_list`-style terminal recursions get marked. The
|
|
constructor-blocked recursions in `map`, `sort`, `insert`
|
|
remain unmarked — they cannot benefit from `musttail`
|
|
without a source-level rewrite.
|
|
|
|
Ratified by: `crates/ailang-check/src/lib.rs`.
|