nomen-lang 0.6.12 → 0.7.0

package/NOMEN_AGENTS.md

@@ -75,8 +75,7 @@ which evaluates cases in order and runs the first true one.
 switch {
 	case moved { ... }
 	case is_ins { ... }
-	else { ... }
-}
+} else { ... }
 ```
 
 Independent conditions that can all fire stay as separate `if`s.
@@ -100,10 +99,16 @@ func safe = (string[] s, int i: i >= 0 && i < s.length, out string) {
 | -------- | ---------------------------------------------- |
 | `ref T`  | mutable borrow; caller must also write `ref`   |
 | `view T` | read-only borrow                               |
-| `move T` | transfer ownership; caller writes `move`       |
+| `mv T`   | transfer ownership; caller writes `mv`         |
 | `out T`  | output parameter, assigned inside the function |
 
 `const` values cannot be passed to `ref` — rebind the caller as `var` first.
+At local bindings the same keywords spell the binding's relationship to its
+initializer: `ref Box q = p` is a mv-struct ALIAS (a plain `var Box q = p`
+copy of a mv value — including a `string` — is an error: say `ref`, `mv`,
+or `.copy()`), `mv` transfers, `view` is a slice. A `ref` alias is not
+reassignable, mutation through it needs a `var` source, and nothing moves
+through it.
 
 ### Return types are `out` at the end
 
@@ -133,8 +138,8 @@ const y = x + 1     // Error: 'x' is null
 private to its declaring scope.
 
 `readonly` is a field-write modifier, not a visibility: the field reads at its
-declared visibility but can only be assigned inside its declaring struct/class
-(and its `extend`s). `const` fields are immutable everywhere.
+declared visibility but can only be assigned inside its declaring struct (and
+its `extend`s). `const` fields are immutable everywhere.
 
 ### Imports
 
@@ -156,10 +161,10 @@ declarations, so never import a sibling. Only cross-namespace references
 Failures are signalled via return values — nullable results, status structs,
 or boolean + out-parameter pairs. There is no `throw`/`try`/`catch`.
 
-`Result<T, E>` is declared `must_use`: a call returning it must bind or match
+`Result<T, E>` is declared `checked`: a call returning it must bind or match
 the value (`var _ = f.close()` to discard deliberately; a bare `f.close()`
 statement is a compile error). Any enum or bitset can opt into this with the
-`must_use` modifier.
+`checked` modifier.
 
 ## Tests
 
@@ -196,10 +201,10 @@ var int y = 10                       // mutable, explicit type
 const int[] nums = [1, 2, 3]
 const int[10] buf = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0]  // fixed-length
 var int? maybe = null                // nullable
-ref int ptr                          // reference to an int
+ref Box q = p                        // mv-struct alias — must be spelled (no plain copies)
 ```
 
-Keywords (`out`, `in`, `match`, `if`, `of`, `as`, `swap`, …) are reserved and
+Keywords (`out`, `match`, `if`, `of`, `as`, `swap`, …) are reserved and
 cannot be used as variable, parameter, field, type, or case names. Function
 names are exempt since calls go through `.name(...)` (e.g. `Regex.match`).
 
@@ -230,10 +235,10 @@ while cond { ... }
 while cond; update { ... }     // post-statement (e.g. while i < n; i += 1)
 ```
 
-### Structs and classes
+### Structs
 
 ```nomen
-pub struct Point {
+pub struct Point {              // Copyable value type
 	pub var int x
 	pub var int y
 	pub func add = (self, Point other, out Point) {
@@ -241,12 +246,15 @@ pub struct Point {
 	}
 }
 
-class Node {                   // class = heap-allocated, reference semantics
+mv struct Node {            // single-owner, move-only (bindings mv)
 	var int value
 }
 ```
 
-Construct by calling the type name as a function: `Point(1, 2)`.
+Construct by calling the type name as a function: `Point(1, 2)`. A `struct`
+whose fields are not all Copyable is a compile error — mark it
+`mv struct`. Sharing a mv instance is spelled: `ref` (alias),
+`Box<T>` (owned heap slot), `WeakHandle<T>` (checked back-pointer).
 
 ### Strings
 
@@ -256,6 +264,12 @@ Console.write("hello \{name}\n")   // interpolation with \{...}
 Console.write_line("with newline")
 ```
 
+`string` is **mv**: `var b = a` (two string variables) needs `mv b = a`
+or `a.copy()`; `return self.field` and `var s = obj.field` need `.copy()`;
+storing a bare `string` parameter into a string field needs `.copy()`;
+`xs.push(s)` / `m.set(k, v)` need `mv`/`.copy()`. Literals are fresh values.
+`view string` is the cheap read-only borrow.
+
 ### Traits
 
 ```nomen

package/audit_runtime.c

@@ -57,6 +57,7 @@ static void *audit_alloc(unsigned long size) {
 	header->magic = NOMEN_AUDIT_MAGIC;
 	header->size = size;
 	header->state = NOMEN_AUDIT_LIVE;
+	if (getenv("NOMEN_AUDIT_TRACE")) fprintf(stderr, "ALLOC %lu\n", (unsigned long)size);
 	__atomic_add_fetch(&nomen_malloc_count, 1, __ATOMIC_SEQ_CST);
 	return (void *)(header + 1);
 }
@@ -73,6 +74,7 @@ static nomen_audit_header *audit_header(void *ptr) {
 // Retire a block: poison the header first so a second free of the same pointer
 // is recognized as stale, then hand the memory back and drop the count.
 static void audit_release(nomen_audit_header *header) {
+	if (getenv("NOMEN_AUDIT_TRACE")) fprintf(stderr, "FREE %lu\n", (unsigned long)header->size);
 	header->magic = 0;
 	header->state = NOMEN_AUDIT_DEAD;
 	__atomic_sub_fetch(&nomen_malloc_count, 1, __ATOMIC_SEQ_CST);

package/core/System/Arena.nm

@@ -16,7 +16,7 @@
 // the arena's own #destroy reclaims every still-live slot at scope exit.
 
 /**
- * A copyable, non-owning handle to an `Arena<T>` slot. The generation makes a
+ * A copyable, non-mv handle to an `Arena<T>` slot. The generation makes a
  * reused slot distinguishable from the one this handle was issued for.
  **/
 pub struct ArenaRef<T> {
@@ -32,7 +32,7 @@ pub struct ArenaRef<T> {
  * A generational arena: one owner of a set of `T` values, addressed by
  * copyable `ArenaRef<T>` handles.
  **/
-pub struct Arena<T> {
+pub mv struct Arena<T> {
 	// Slot payloads. T = value struct/primitive routes to Buffer<T>; T =
 	// class/trait routes to ClassBuffer<T> (monomorphize rewrites the field),
 	// so slot ownership follows the usual element rules.
@@ -63,7 +63,7 @@ pub struct Arena<T> {
 	 * Store `value` in a slot (reusing a freed slot when one is available) and
 	 * return a handle to it.
 	 **/
-	pub func alloc = (ref self, move T value, out ArenaRef<T>) {
+	pub func alloc = (ref self, mv T value, out ArenaRef<T>) {
 		var int index = -1
 		if self.free_count > 0 {
 			// Reuse a freed slot. Its generation was already bumped by `free`,
@@ -140,7 +140,7 @@ pub struct Arena<T> {
 	/**
 	 * Replace the value `handle` names (same slot, same handle).
 	 **/
-	pub func set = (ref self, ArenaRef<T> handle, move T value) {
+	pub func set = (ref self, ArenaRef<T> handle, mv T value) {
 		if !self.is_valid(handle) {
 			panic("arena: set through a stale handle")
 		}

package/core/System/Array.nm

@@ -92,7 +92,7 @@ pub struct Array<T>: Viewable {
 		}
 	}
 
-	// A non-owning (ptr, len) slice [start, end) over self's inline element
+	// A non-mv (ptr, len) slice [start, end) over self's inline element
 	// storage, returned as a `view T`. Borrows from self (may not outlive it,
 	// invalidated on reassignment). Element access via view.at / view.length.
 	pub func slice = (
@@ -139,83 +139,113 @@ pub struct Array<T>: Viewable {
 		}
 		return _result;
 		```
-		```
-		#arch: aarch64
-		// x0 = value, x1 = count
-		// Returns x0 = heap-allocated array pointer ([ptr]=length, [ptr+8..]=data).
-		// This is a regular static function: the caller receives the pointer in x0,
-		// so no sret/x8 buffer is involved.
-		stp x19, x20, [sp, #-16]!
-		stp x1, x0, [sp, #-16]!		// [sp]=count, [sp+8]=value
-
-		// ptr = malloc(8 + count * T_SIZE)
-		mov x2, #T_SIZE
-		mul x0, x1, x2
-		add x0, x0, #8
-		bl _malloc
-		mov x19, x0                 // x19 = ptr
-
-		// Store the length prefix and set up the data area.
-		ldr x1, [sp]                // count
-		str x1, [x19]               // [ptr] = count
-		add x20, x19, #8            // x20 = data area
-
-		cbz x1, .Larray_with_end
-
-		ldr x0, [sp, #8]            // value
-		mov x2, #0                  // i = 0
-		.Larray_with_loop:
-		mov x3, #T_SIZE
-		mul x4, x2, x3              // offset = i * T_SIZE
-		add x5, x20, x4             // addr = data + offset
-
-		// Store the value (in x0) into [x5] using a width that matches
-		// T_SIZE. For T_SIZE <= 8 the value is in x0 directly (char/int/
-		// pointer); for T_SIZE > 8 (struct) x0 is a pointer to the bytes
-		// and we copy them one by one.
-		cmp x3, #8
-		b.gt .Larray_with_copy_loop
-		cmp x3, #4
-		b.eq .Larray_with_store4
-		cmp x3, #2
-		b.eq .Larray_with_store2
-		cmp x3, #1
-		b.eq .Larray_with_store1
-		// T_SIZE == 8 (int/string-ptr/class-ptr): single 8-byte store
-		str x0, [x5]
-		b .Larray_with_next
-		.Larray_with_store4:
-		str w0, [x5]
-		b .Larray_with_next
-		.Larray_with_store2:
-		strh w0, [x5]
-		b .Larray_with_next
-		.Larray_with_store1:
-		strb w0, [x5]
-		b .Larray_with_next
-
-		.Larray_with_copy_loop:
-		// Struct element (T_SIZE > 8): x0 is a pointer to the bytes — copy
-		// them one by one so adjacent slots aren't clobbered.
-		mov x6, #0                  // j = 0
-		.Larray_with_byte:
-		ldrb w7, [x0, x6]
-		strb w7, [x5, x6]
-		add x6, x6, #1
-		cmp x6, x3
-		blt .Larray_with_byte
-
-		.Larray_with_next:
-		add x2, x2, #1
-		ldr x1, [sp]
-		cmp x2, x1
-		blt .Larray_with_loop
-
-		.Larray_with_end:
-		mov x0, x19                 // return heap pointer
-		add sp, sp, #16
-		ldp x19, x20, [sp], #16
-		```
+	```
+	#arch: aarch64
+	// Returns x0 = heap-allocated array pointer ([ptr]=length, [ptr+8..]=data).
+	// Entry dispatch (the asm twin of the C body's #if T_NEEDS_STRDUP): a
+	// FAT T (string) arrives as the (ptr, len) pair in x0/x1 with the count
+	// in x2; a thin T arrives as the value in x0 with the count in x1.
+	// STRUCT_PLAN_3 B1 cutover: a FAT seed must be strdup'd per slot — every
+	// slot sharing one pointer would be freed n times by the mv
+	// set/destroy paths (pre-B1 the displaced-set free was record-guarded,
+	// so a raw rodata seed was simply never freed).
+	stp x19, x20, [sp, #-16]!
+	mov x7, #T_FAT
+	cmp x7, #1
+	b.eq .Larray_with_fat_entry
+	// Thin: [sp] = value, count in x1.
+	stp xzr, x0, [sp, #-16]!
+	mov x19, x1
+	b .Larray_with_counted
+	.Larray_with_fat_entry:
+	// Fat: [sp] = len, [sp+8] = ptr; count in x2.
+	stp x1, x0, [sp, #-16]!
+	mov x19, x2
+	.Larray_with_counted:
+
+	// ptr = malloc(8 + count * T_SIZE)
+	mov x2, #T_SIZE
+	mul x0, x19, x2
+	add x0, x0, #8
+	bl _malloc
+	mov x20, x0                 // x20 = base pointer
+	str x19, [x20]              // [ptr] = count
+
+	cbz x19, .Larray_with_end
+	mov x2, #0                  // i = 0
+	.Larray_with_loop:
+	mov x3, #T_SIZE
+	mul x4, x2, x3
+	add x5, x20, #8
+	add x5, x5, x4              // addr = data + offset
+
+	// T_FAT (string): strdup the seed's ptr half into each slot.
+	mov x7, #T_FAT
+	cmp x7, #1
+	b.ne .Larray_with_plain
+	ldr x0, [sp, #8]
+	cbz x0, .Larray_with_pair
+	bl _strdup
+	ldr x1, [sp]
+	str x0, [x5]
+	str x1, [x5, #8]
+	b .Larray_with_next
+	.Larray_with_pair:
+	stp xzr, xzr, [x5]
+	b .Larray_with_next
+
+	.Larray_with_plain:
+	// Store the value (parked at [sp+8]) using a width that matches
+	// T_SIZE. For T_SIZE <= 8 the value is a scalar; T_SIZE > 8 (a
+	// non-fat struct) byte-copies from the parked pointer.
+	cmp x3, #8
+	b.gt .Larray_with_copy_loop
+	cmp x3, #4
+	b.eq .Larray_with_store4
+	cmp x3, #2
+	b.eq .Larray_with_store2
+	cmp x3, #1
+	b.eq .Larray_with_store1
+	ldr x0, [sp, #8]
+	str x0, [x5]
+	b .Larray_with_next
+	.Larray_with_store4:
+	ldr x0, [sp, #8]
+	str w0, [x5]
+	b .Larray_with_next
+	.Larray_with_store2:
+	ldr x0, [sp, #8]
+	strh w0, [x5]
+	b .Larray_with_next
+	.Larray_with_store1:
+	ldr x0, [sp, #8]
+	strb w0, [x5]
+	b .Larray_with_next
+
+	.Larray_with_copy_loop:
+	// Struct element (T_SIZE > 8): [sp+8] is a pointer to the bytes —
+	// copy them one by one so adjacent slots aren't clobbered.
+	mov x6, #0
+	ldr x0, [sp, #8]
+	.Larray_with_byte:
+	ldrb w7, [x0, x6]
+	strb w7, [x5, x6]
+	add x6, x6, #1
+	cmp x6, x3
+	blt .Larray_with_byte
+
+	.Larray_with_next:
+	add x2, x2, #1
+	cmp x2, x19
+	blt .Larray_with_loop
+
+	.Larray_with_end:
+	mov x0, x20                 // return heap pointer
+	add sp, sp, #16             // pop the parked value pair
+	ldp x19, x20, [sp], #16
+	// Fall through to the builder's .return epilogue (it pops the raw
+	// block's stack frame) — a bare `ret` here would skip it.
+	```
 	}
 
 	pub func add = (self, Array other, out Array) {

package/core/System/Atomic.nm

@@ -0,0 +1,81 @@
+// Atomic<T> (STRUCT_PLAN_3 N4) — a lock-free protected slot for 64-bit
+// integer state shared across tasks.
+//
+// A type may be mutated through a cross-worker borrowed capture iff the
+// mutated slot is protected: an `Atomic<T>` field (lock-free), a `Shared<T>`
+// field (lock-guarded), or a handle. The Atomic's METHODS are the sanctioned
+// mutation path — the R3 freeze (checked region borrows) deliberately
+// exempts them, so a spawned worker can bump a borrowed counter:
+//
+//   var Atomic<int> counter = Atomic<int>()
+//   async {
+//       var t = Thread(work(counter)).start()   // counter borrowed
+//       ...
+//   }
+//   func work = (ref Atomic<int> counter) {
+//       counter.fetch_add(1)
+//   }
+//
+// T must be a 64-bit integer type — the slot is one machine word and the
+// operations are single-word atomics.
+
+/**
+ * A lock-free 64-bit integer slot for cross-task shared state
+ **/
+pub struct Atomic<T> {
+	// The machine word. Private by discipline: mutate through the methods
+	// (direct assignment replaces the atomic — the checker's freeze blocks
+	// that through borrowed captures).
+	var uint64 word = 0
+
+	pub func load = (self, out T) {
+		```
+		#arch: c
+		return __atomic_load_n(&self->word, __ATOMIC_SEQ_CST);
+		```
+		```
+		#arch: aarch64
+		// Load-acquire takes no offset — compute the word's address first.
+		add x0, x0, #8
+		ldar x0, [x0]
+		```
+	}
+
+	pub func store = (ref self, T v) {
+	```
+		#arch: c
+		__atomic_store_n(&self->word, v, __ATOMIC_SEQ_CST);
+		```
+		```
+		#arch: aarch64
+		add x8, x0, #8
+		stlr x1, [x8]
+		```
+	}
+
+	// Adds v and returns the PREVIOUS value (fetch-and-add).
+	pub func fetch_add = (ref self, T v, out T) {
+		```
+		#arch: c
+		return __atomic_fetch_add(&self->word, v, __ATOMIC_SEQ_CST);
+		```
+		```
+		#arch: aarch64
+		add x8, x0, #8
+		ldaddal x1, x0, [x8]
+		```
+	}
+
+	// Replaces the value and returns the PREVIOUS one.
+	pub func swap = (ref self, T v, out T) {
+		```
+		#arch: c
+		return __atomic_exchange_n(&self->word, v, __ATOMIC_SEQ_CST);
+		```
+		```
+		#arch: aarch64
+		add x8, x0, #8
+		swpal x1, x0, [x8]
+		```
+	}
+}

package/core/System/Awaitable.nm

@@ -1,9 +1,9 @@
 // Awaitable — the consumption side of the async model (ASYNC.md,
 // "Awaitable trait"). Park-flavored by design: `wait` MAY park the current
-// execution context (inside a fiber it parks the fiber and frees its
-// worker; on a raw thread it blocks). A Rust-style poll/Waker trait is
-// deliberately rejected — it would smuggle the state-machine transform back
-// in through the trait definition.
+// context (inside a fiber it parks the fiber and frees its worker; on a raw
+// thread it blocks). A Rust-style poll/Waker trait is deliberately rejected —
+// it would smuggle the state-machine transform back in through the trait
+// definition.
 //
 // `Task<T>` is the conformer: `Thread(...).start()` and `Fiber(...).start()`
 // both yield one, so a generic helper taking `Awaitable` waits on either.
@@ -11,11 +11,18 @@
 // start-optional lifecycles are legitimate for user primitives; must-start
 // is a per-struct `#destroy` contract (see Thread.nm / Fiber.nm and
 // ASYNC.md).
+//
+// `wait` takes the receiver by VALUE (bare `self`, not `ref self`): waiting
+// never mutates the handle — it parks on the future the handle NAMES. That
+// makes the bare `Awaitable` parameter (the T3 stack-copy box — zero
+// malloc, caller keeps ownership) the sanctioned dispatch form; a `ref
+// self` wait would be a mutating call, and through a boxed mv struct
+// the mutation spellings cannot cross a borrow (STRUCT_PLAN_3 B4/T2).
 
 /**
  * Something whose completion can be waited on (may park the current context)
  **/
 pub trait Awaitable {
-	func wait = (ref self) {
+	func wait = (self) {
 	}
 }

package/core/System/BigInt.nm

@@ -1,7 +1,7 @@
 /**
  * An arbitrary-precision integer
  **/
-pub struct BigInt {
+pub mv struct BigInt {
 	var sign = 0
 	var len = 0
 	var digits = Buffer<int>()

package/core/System/Box.nm

@@ -0,0 +1,32 @@
+// Box<T> (STRUCT_PLAN_3 B2) — a mv pointer to a heap-allocated T: the
+// cycle-breaking and stable-address shape for mv structs.
+//
+//   mv struct Node {
+//       var int value
+//       var Box<Node>? next
+//   }
+//
+// DECLARED as `mv struct` (R tranche 4 — the `class` keyword is
+// retiring), but the runtime representation is unchanged: ONE POINTER at
+// runtime (the checker stamps the wrapper's storage class at gather time —
+// a compiler-generated wrapper holding the value inline). `Box<T>?` is the
+// natural null slot (B6's null-pointer lowering), construction mallocs the
+// wrapper and moves the value in, and destroy reclaims the pointee. Field
+// and method access THROUGH a box is transparent — the checker rewrites
+// `box.field` to `box.value.field` — so the wrapper never leaks into user
+// code. The declared `mv` is the move-only marker (boxing TAKES
+// OWNERSHIP of the pointee); the stamped storage class is the shape.
+//
+// `T` is a value struct. (Boxing a reference is pointless — trait handles
+// are already boxed.)
+
+/**
+ * A mv pointer to a heap-allocated value — the cycle-breaking shape
+ **/
+pub mv struct Box<T> {
+	// The wrapped value. Access through the box is transparent: the checker
+	// rewrites `box.f` to `box.__value.f`, so this field never appears in
+	// user code (the `__` prefix keeps it out of every legal field name).
+	// `mv` spelling: boxing TAKES OWNERSHIP of the pointee.
+	mv T __value
+}