@cella-lang/c 0.1.202610121528 → 0.1.202610121705

package/CHANGES.md

@@ -4,6 +4,7 @@
 
 ## 未發佈
 
+- **不相容**：定理與前置條件改證 `a = b`（原本是路徑 `≡`），同 cpp。名字不變；前置條件照舊寫 `refl` 或具名的洞。`stable-defs.json` 裡雜湊改變的 4 個：`c.ShlOk`、`c.divV`、`c.litV`、`c.remV`。
 - 標準庫 `int` 的定理改證 `a = b`（cpp 跟著改）：用到的定義雜湊可能改變，意思不變。
 - 標準庫定理名字裡的舊運算名跟著改（`ltNat_refl` → `blt_refl`、`modNatLt` → `modLt`……；規則見 cella-lang 的 CHANGES）：套件內的使用處一起改。
 - 標準庫的定理放進型別的 namespace（`addComm` → `Nat.addComm` 等；原始碼照舊寫裸名）：用到它們的定義雜湊改變，意思不變。

package/README.md

@@ -26,15 +26,15 @@ Statements reuse the language-neutral statement model of `@cella-lang/cpp` (`cpp
 Output: `c.format p fmt args refl : String` and `c.printf p fmt args refl st` (appends to the stream state shared with the C++ model and
 returns the number of characters as an `int`), the integer subset of `printf`: `%d %i %u %o %x %X %c %%`, flags `- + space # 0`, field width
 and precision (digits or `*`), length modifiers `hh h l ll`. Arguments go through the default argument promotions (`c.argV p x`). Undefined
-behaviour is the precondition `c.printfOkB p fmt args ≡ true`: a malformed or unknown conversion, too few arguments, an argument whose type
+behaviour is the precondition `c.printfOkB p fmt args = true`: a malformed or unknown conversion, too few arguments, an argument whose type
 does not match the conversion (a signed/unsigned counterpart is allowed only when the value fits both), `#` with `d i u c`, `0` or a
 precision with `c`, anything inside `%%`.
 
 ```cella
 import c
 def p : cpp.Platform := c.lp64P
-def n (v : Int) (ok : cpp.inTB (c.tInt p) v ≡ true) : c.Arg := c.argV p (c.litV (c.tInt p) v ok)
-def s : c.format p "%5d|%-+4d|%#x" [n (pos 42) refl, n (pos 7) refl, n (pos 255) refl] refl ≡ "   42|+7  |0xff" := refl   -- accept
+def n (v : Int) (ok : cpp.inTB (c.tInt p) v = true) : c.Arg := c.argV p (c.litV (c.tInt p) v ok)
+def s : c.format p "%5d|%-+4d|%#x" [n (pos 42) refl, n (pos 7) refl, n (pos 255) refl] refl = "   42|+7  |0xff" := refl   -- accept
 def t : String := c.format p "%d %d" [n (pos 1) refl] refl                                                                   -- reject: too few arguments
 ```
 
@@ -48,7 +48,7 @@ type. `c.sizeofA p a` is `N * sizeof(T)` as a `size_t`. For loops, `c.Full t n`
 import c
 def p : cpp.Platform := c.lp64P
 def a : c.Arr (c.tInt p) := c.initA (c.tInt p) 5 [c.litV (c.tInt p) (pos 1) refl, c.litV (c.tInt p) (pos 2) refl] refl
-def s : c.get (c.at a (c.litV (c.tInt p) (pos 3) refl) (c.readable refl)) ≡ pos 0 := refl        -- accept: a[3] is zero
+def s : c.get (c.at a (c.litV (c.tInt p) (pos 3) refl) (c.readable refl)) = pos 0 := refl        -- accept: a[3] is zero
 def t : c.Val (c.tInt p) := c.at a (c.litV (c.tInt p) (pos 5) refl) (c.readable refl)             -- reject: a[5] is out of bounds
 ```
 
@@ -64,7 +64,7 @@ without a NULL check does not prove. `c.calloc` zero-fills; `c.free` requires NU
 import c
 def t : cpp.IType := cpp.tInt cpp.lp64P
 def r : c.Allocated t := c.addrOf (c.memNew t) (c.litV t (pos 5) refl)                                     -- int x = 5; int *q = &x;
-def s : c.get (c.load (c.amem r) (c.aptr r) (c.derefOk refl)) ≡ pos 5 := refl                             -- accept: *q is 5
+def s : c.get (c.load (c.amem r) (c.aptr r) (c.derefOk refl)) = pos 5 := refl                             -- accept: *q is 5
 def u : c.Val t := c.load (c.memNew t) c.nullP (c.derefOk refl)                                            -- reject: *NULL
 ```
 
@@ -81,7 +81,7 @@ import c
 def p : cpp.Platform := c.lp64P
 def C : cpp.IType := c.tChar p
 def r : c.Allocated C := c.strLit p (c.memNew C) "hello"
-def s : c.format p "[%-7s]" [c.argS (c.amem r) (c.aptr r)] refl ≡ "[hello  ]" := refl                    -- accept
+def s : c.format p "[%-7s]" [c.argS (c.amem r) (c.aptr r)] refl = "[hello  ]" := refl                    -- accept
 def t : c.Mem C := c.store (c.amem r) (c.aptr r) (c.litV C (pos 72) refl) (c.storeOk refl)                 -- reject: writes a string literal
 ```
 
@@ -98,12 +98,12 @@ import c
 def I : cpp.IType := c.tInt c.lp64P
 def Point : c.Members := c.mCons "x" (c.ctInt I) (c.mCons "y" (c.ctInt I) c.mNil)
 def p : c.Struct Point := c.initS Point [c.iInt (c.litV I (pos 1) refl)] refl
-def y : c.get (c.scalar (c.member Point "y" p) refl) ≡ pos 0 := refl                                    -- accept: y is zero-filled
+def y : c.get (c.scalar (c.member Point "y" p) refl) = pos 0 := refl                                    -- accept: y is zero-filled
 def u : c.Val I := c.scalar (c.member Point "y" (c.uninitS Point)) refl                                  -- reject: y is uninitialized
 ```
 
 Array parameters are pointers, so a function does not know the length: `int sum(int a[], int n)` takes the precondition
-`c.readableNB m a n ≡ true` ("n cells after a are readable"), and `c.readK m a n ok k h` reads `a[k]` for `h : k < n` — the function is
+`c.readableNB m a n = true` ("n cells after a are readable"), and `c.readK m a n ok k h` reads `a[k]` for `h : k < n` — the function is
 checked once for any memory and pointer, and a caller with a concrete array proves the precondition by `refl`. Writing is the same with
 `c.writableNB` / `c.writeK`, and `c.writableAfterWriteK` keeps the precondition through a loop. Pointers can be stored in memory
 (`cpp.GMem c.Ptr`, `c.loadP` for `*pp`), and `c.mkArgv p ["prog", "x"]` builds `argv` (NUL-terminated strings, a NULL at `argv[argc]`).
@@ -115,7 +115,7 @@ wrong type, a result that does not fit (`%d` reading `99999999999`), and a `%s`
 
 Multi-dimensional arrays: `c.arr2ToMem m R C inits refl` declares `T a[R][C]` (nested or flat initializers), and `c.at2 m a R C i j hi hj ok`
 reads `a[i][j]` with the bounds checked per dimension — `a[0][C]` is out of bounds for the inner array even though it is inside the object.
-A function taking `int a[][C]` gets `c.readable2 m a n C ≡ true` and reads with `c.read2K`.
+A function taking `int a[][C]` gets `c.readable2 m a n C = true` and reads with `c.read2K`.
 
 Floating point: `c.Double` and `c.Float` are IEEE 754 binary64 and binary32 (shared with the C++ model). `c.dlit m e` is the literal
 m × 10^e; `c.toInt t x (c.truncOk refl)` truncates toward zero with the result required to fit; division needs a nonzero divisor.