Brummel
19dc42f5ca
The first formal-links milestone shipped clause-5 + 8 links across the
existing file layout. Browsing surfaced that file-only granularity is
only as precise as the file boundaries — three files mixed two or
three navigation targets under one address, so the 8 links could not
multiply without ambiguity. This commit fixes the substrate, then
applies the sweep the original milestone deferred.
Splits (each extracts an already-self-contained section into its own
file so links land on the topic, not the parent doc's TOC):
contracts/typeclasses.md
→ +contracts/prelude-classes.md (Eq/Ord/Show ships, polymorphic `print`)
→ +contracts/method-dispatch.md (5-step dispatch rule, candidate index)
contracts/memory-model.md
→ +contracts/language-constraints.md (the 4 binding constraints
making RC sound without a
cycle collector)
models/authoring-surface.md
→ +models/prose-projection.md (Form-B / `ail prose` / merge-prose)
Each new file enters design/INDEX.md as its own row (three contracts
share show_no_instance_e2e.rs / uniqueness.rs as ratifying tests;
prose-projection is a model). Two pre-existing links rebind to the
new topic-files (memory-model.md → method-dispatch.md;
float-semantics.md → prelude-classes.md).
Link sweep: 8 → 88 formal Markdown links over 23 files. Every file
in design/contracts/ + design/models/ now has at least one outgoing
link; the tree is fully connected. Links are file-relative
`[label](path)` per the established convention, fenced code blocks
are skipped (a `](` inside ```jsonc``` is literal text), the durable
tier (design/ + crates/ + runtime/) is enforced by clause-5.
Tests:
- design_index_pin.rs (5/5 clauses): clean-cut, INDEX resolution,
ratifying-test resolution, no decision-record prose in contracts/,
body links durable + resolving.
- docs_honesty_pin.rs (5/5): one assertion rebinds from typeclasses.md
to prelude-classes.md (where the gated sentence now lives);
design_corpus widens to include the 4 new files so the Wunschdenken
/ doc-archaeology sweeps continue to cover everything that used to
live in the parents.
No spec/plan/journal for this batch — interactive collaboration after
the milestone closed; the user gated the splits explicitly before the
sweep.
3.3 KiB
Embedding ABI
Embedding ABI
ail build --emit=staticlib compiles a module to a relocatable
lib<entry>.a (program objects only) plus a separate
libailang_rt.a (the RC runtime: rc.c + str.c), with no
@main trampoline and no MissingEntryMain requirement — a
kernel module is a library.
Each fn carrying (export "<sym>") (schema: FnDef.export) is
emitted as an externally-visible C entrypoint @<sym> forwarding to
the internal @ail_<module>_<fn>. The symbol is author-chosen and
decoupled from the ail_<module>_<def> mangling so a module/fn
rename does not move the C symbol.
The set that can cross the boundary is exactly: Int (lowered
i64), Float (lowered double), or a single-constructor record
whose every field is one of those (crossing as a bare ptr to the
box layout below); the fn's effect set must be empty. There is no
general value-marshalling layer — the host hand-constructs and
hand-reads that box layout directly, so the enumerated set is the
whole contract, narrow by construction, not a subset of a wider
embedding ABI. Because the box layout is the host's contract
surface with no accessor indirection, it is a one-way commitment
frozen as of M3: a compiler change MUST NOT move the box offsets
below for an exported type, nor invert the host-free rule.
These are enforced at ail check (export-non-scalar-signature,
export-has-effects) — an effectful or non-scalar export fails to
typecheck. Every exported entrypoint takes a mandatory leading ailang_ctx_t*
(M2): a per-thread embedding context created by ailang_ctx_new()
and released by ailang_ctx_free(), owned by the calling thread for
its lifetime. The host links one ailang_ctx_t per OS worker thread
and the runtime accounts RC alloc/free into it: the per-allocation
hot path (the per-ctx counters and the per-object refcount header)
is non-atomic by design and never shared — a box never crosses a
thread (Ctx: !Send) and each ailang_ctx_t is
single-thread-per-ctx. The one datum a multi-threaded host shares
is the global RC-stats fallback counter (used when no ctx is
bound); it is atomic-relaxed so the swarm's leak accounting is
exact. The swarm artefact is data-race-free, sanitiser-verified.
The staticlib swarm artefact is RC-only:
ail build --emit=staticlib rejects --alloc=gc/--alloc=bump
(the shared Boehm collector is not swarm-safe). The value/record
layout is frozen as of M3 (see Frozen value layout); the
ctx-threaded C signature is the M2 shape.
Export parameters are written bare: a scalar type carries no
own/borrow mode (a single-constructor record export parameter,
by contrast, carries own/borrow — see memory model
for the full ownership contract; the
frozen value layout below specifies how that contract lands at the C ABI). The
canonical M1 export shape:
(fn step
(export "backtest_step")
(type
(fn-type
(params (con Int) (con Int))
(ret (con Int))))
(params state sample)
(body
(app + state (app * sample sample))))
ail emit-ir <module> --emit=staticlib prints this kernel's LLVM
IR (the external @<sym> forwarders, no @main) instead of the
executable-path main-required rejection — the Decision-5
IR-readability affordance for a main-free kernel.
Ratified by: crates/ailang-codegen/tests/embed_record_layout_pin.rs.