Brummel
bcd41810f4
Reader-facing prose and rustdoc carried opaque shorthand like
"Decision 10", "clause-5", "mq.1", "ct.1", "eob.1", "rpe.1",
"post-mq.3", and "Iter 22b.1:" with no in-repo definition the reader
could follow. This commit replaces every such occurrence in the
durable tier the reader is most likely to land on (design/ ledger +
source //! module headers + the central /// public-item rustdoc) with
an inline content phrase plus, where applicable, a Markdown link to
the file that defines the referenced concept.
design/ ledger — 16 files:
Definition-site headings demoted from "Decision N: <title>" to
"<title>": authoring-surface, tail-calls, memory-model section in
rc-uniqueness.md, dual-allocator section, typeclass design,
effects "pure core + algebraic effects".
Cross-reference sites: "Decision 1" -> canonical-schema principle
(data-model); "Decision 3/4" -> effects + scope-boundaries; "Decision
6" -> authoring-surface; "Decision 8" -> tail-calls; "Decision 9" ->
rc-uniqueness (dual-allocator); "Decision 10" -> memory-model;
"Decision 11" -> typeclasses (model). "clause-5" -> body-link
durability gate. "clause-3" (in language-constraints) ->
bug-class-reintroduction discriminator. "mq.1/2/3", "ct.1/4",
"eob.1", "rpe.1" -> the canonical-form rule / the type-driven
dispatch / the Str carve-out / etc. "post-mq.3" -> "type-driven".
design/contracts/feature-acceptance.md: file-local "clauses 1/2/3"
-> "criteria 1/2/3" (sprachliche Kohärenz mit der File-Überschrift
"Feature-acceptance criterion"); "the clause-3 mechanism" -> "the
bug-class-reintroduction discriminator".
Source //! module headers — 24 files:
Stripped "Iter X.Y:" prefixes and "(Decision N)" / "(mq.X)" tags
from spec_drift, uniqueness, reuse_shape, migrate_canonical_types,
typeclass_22b{2,3,c}, suppress_filter, lift, mono, linearity,
diagnostic, method_dispatch_pin, method_collision_pin,
no_per_type_print_ops, mq3_multi_class_e2e, print_mono_body_shape,
print_no_leak_pin, cli_diag_human_workspace_load_error,
ct1_check_cli, prose snapshot, unbound_in_instance_method_pin,
mono_xmod_ctor_pattern, desugar.
Central /// public-item rustdoc:
ast.rs (full sweep — every "Iter X" + "Decision N" prefix
reformulated; mode/Type::Fn rustdoc now points at memory-model.md;
Constraint / SuperclassRef / InstanceDef / ClassDef rustdoc points
at typeclasses contract).
diagnostic.rs (all "(Iter X)" / "(mq.X)" tags on diagnostic codes
removed).
lib.rs (FORM_A_SPEC rustdoc points at authoring-surface.md
instead of "Decision 6").
canonical.rs (type_hash + Float-literal rustdoc).
Still outstanding (for a follow-up commit): ~500 inline `//`
code-body comments with `Iter X.Y` markers across the workspace, and
a handful of `///` rustdoc items in hash_pin / workspace_pin / lift /
mono / suppress_filter test-pin and internal-function bodies. Code
identifiers (test filenames like `mq3_multi_class_e2e.rs`, function
names like `iter18e_drop_iterative_default_preserves_hashes`) stay
verbatim per the user's "code identifiers stay verbatim" rule.
Tests: design_index_pin 5/5 + docs_honesty_pin 5/5; workspace builds
clean; full `cargo test --workspace` previously green (every
`test result: ok` line, no FAILED line).
2.9 KiB
Tail calls
Explicit, verified tail calls
For an LLM author, recursion is the natural iteration form
(\n. if n == 0 then () else loop(n-1) is what I reach for, not
a for-loop). Without a tail-call guarantee, every recursive
program has a silent stack-depth ceiling that no compile-time
diagnostic warns about. That is exactly the class of correctness
hazard the language exists to eliminate.
Solution: explicit, verified tail calls.
- AST.
Term::App { fn, args, tail: bool }andTerm::Do { op, args, tail: bool }(see Data model) gain atailflag, serde-defaulting tofalseso existing fixtures load withtail: falseand their hashes stay bit-identical. - Typecheck. A new pass
verify_tail_positions(fn_body)runs after the main type-check. It walks the body with anis_tail_context: boolthreaded down. The flag istrueat the start,truefor the body of everyTerm::Matcharm,truefor the right operand ofTerm::Seq,truefor the body ofTerm::Let,truefor the body ofTerm::Lam(each Lam opens its own tail scope). The flag isfalsefor: args of anyApp/Do/Ctor, scrutinee ofMatch, left ofSeq, condition ofLet-bound expression. When the walker visits anApp { tail: true }orDo { tail: true }, the flag must betrueat that visit; otherwise emit diagnostictail-call-not-in-tail-position. - Codegen. Emit
musttail call(LLVM IR) for marked calls instead of plaincall. LLVM rejects at IR-verification time if the call cannot physically be a tail call (calling convention mismatch, signature divergence, etc.). The reject surfaces as a hard build error, not a silent runtime surprise. - Form (A). Two new keywords:
tail-app,tail-do. Productions are positional analogues ofapp/dowithtail: trueset on the resulting term. EBNF gains 2 lines; total production count goes from ~28 to ~30, still inside the constraint-1 budget (see authoring surface).
What this does NOT promise. Per the tail-call survey of existing fixtures,
many existing recursive calls are not in tail position
because they are arguments to constructor calls (e.g.
Cons (f h) (map f t)). The current pipeline adds annotation + verification;
it does not add a CPS transform or accumulator-form
rewrite. Programs whose recursion is constructor-blocked
will continue to be stack-bounded by recursion depth. The
canonical authoring pattern in such cases is to write the
accumulator-form variant (map_acc, fold_left, etc.)
explicitly. The stdlib ships both forms where
relevant.
Migration of existing fixtures is partial: only
print_list-style terminal recursions get marked. The
constructor-blocked recursions in map, sort, insert
remain unmarked — they cannot benefit from musttail
without a source-level rewrite.
Ratified by: crates/ailang-check/src/lib.rs.