Brummel
832375f2ac
All 176 files in the four accumulating directories now use a zero-padded 4-digit counter prefix that reflects creation order (`NNNN-slug.md`). The counter is assigned per directory in strict git-log creation order; ties broken alphabetically by original name. The old `YYYY-MM-DD-` prefix on docs/specs/ and docs/plans/ files is dropped — the date is recoverable from git log and the counter carries the ordering. A file's counter is stable for the life of the file: never reassigned, never reused, never compacted. Deleted files retire their counter; subsequent files do not fill the gap. This is the property that lets cross-references stay literal — refs use the full filename including the counter (`design/contracts/0007-honesty-rule.md`) so they grep cleanly and resolve directly without a glob step. 313 cross-references updated across .md/.rs/.toml/.c/.json files (test pins, include_str! paths, design-INDEX entries, baseline notes, runtime C comments, inter-contract markdown links incl. bare basename and `../models/foo.md` forms). CLAUDE.md gets a new "File-naming convention" section spelling out the rule and rationale. skills/brainstorm/SKILL.md and skills/planner/SKILL.md updated so new spec/plan creation produces counter-prefixed names from the start. The full test suite (cargo test --workspace) passes.
2.9 KiB
Tail calls
Explicit, verified tail calls
For an LLM author, recursion is the natural iteration form
(\n. if n == 0 then () else loop(n-1) is what I reach for, not
a for-loop). Without a tail-call guarantee, every recursive
program has a silent stack-depth ceiling that no compile-time
diagnostic warns about. That is exactly the class of correctness
hazard the language exists to eliminate.
Solution: explicit, verified tail calls.
- AST.
Term::App { fn, args, tail: bool }andTerm::Do { op, args, tail: bool }(see Data model) gain atailflag, serde-defaulting tofalseso existing fixtures load withtail: falseand their hashes stay bit-identical. - Typecheck. A new pass
verify_tail_positions(fn_body)runs after the main type-check. It walks the body with anis_tail_context: boolthreaded down. The flag istrueat the start,truefor the body of everyTerm::Matcharm,truefor the right operand ofTerm::Seq,truefor the body ofTerm::Let,truefor the body ofTerm::Lam(each Lam opens its own tail scope). The flag isfalsefor: args of anyApp/Do/Ctor, scrutinee ofMatch, left ofSeq, condition ofLet-bound expression. When the walker visits anApp { tail: true }orDo { tail: true }, the flag must betrueat that visit; otherwise emit diagnostictail-call-not-in-tail-position. - Codegen. Emit
musttail call(LLVM IR) for marked calls instead of plaincall. LLVM rejects at IR-verification time if the call cannot physically be a tail call (calling convention mismatch, signature divergence, etc.). The reject surfaces as a hard build error, not a silent runtime surprise. - Form (A). Two new keywords:
tail-app,tail-do. Productions are positional analogues ofapp/dowithtail: trueset on the resulting term. EBNF gains 2 lines; total production count goes from ~28 to ~30, still inside the constraint-1 budget (see authoring surface).
What this does NOT promise. Per the tail-call survey of existing fixtures,
many existing recursive calls are not in tail position
because they are arguments to constructor calls (e.g.
Cons (f h) (map f t)). The current pipeline adds annotation + verification;
it does not add a CPS transform or accumulator-form
rewrite. Programs whose recursion is constructor-blocked
will continue to be stack-bounded by recursion depth. The
canonical authoring pattern in such cases is to write the
accumulator-form variant (map_acc, fold_left, etc.)
explicitly. The stdlib ships both forms where
relevant.
Migration of existing fixtures is partial: only
print_list-style terminal recursions get marked. The
constructor-blocked recursions in map, sort, insert
remain unmarked — they cannot benefit from musttail
without a source-level rewrite.
Ratified by: crates/ailang-check/src/lib.rs.