nomen-lang 0.6.12 → 0.7.0

package/core/System/Graph.nm

@@ -6,7 +6,7 @@
 /**
  * A graph of values connected by edges
  **/
-pub struct Graph<T>: Enumerable {
+pub mv struct Graph<T>: Enumerable {
 	var values = Buffer<T>()
 	var head_edge = Buffer<int>()
 	var edge_target = Buffer<int>()
@@ -14,7 +14,7 @@ pub struct Graph<T>: Enumerable {
 	var node_count = 0
 	var edge_count = 0
 
-	pub func add_node = (ref self, move T value) {
+	pub func add_node = (ref self, mv T value) {
 		var int idx = self.node_count
 		self.values.grow(idx + 1)
 		self.values.store(idx, value)

package/core/System/Init.nm

@@ -2,14 +2,14 @@
  * Program startup state — the argument count and argument list passed to `main`,
  * plus whether stdout is a terminal (for renderer selection).
  **/
-pub struct Init {
+pub mv struct Init {
 	var int argc
 	var string[16] args
 	var bool is_tty
 }
 
 // FFI: the C library's decimal-string parser (stdlib.h).
-extern func atoi = (string s, out int)
+foreign func atoi = (string s, out int)
 
 /**
  * Parses a decimal string into an int

package/core/System/LinkedList.nm

@@ -6,14 +6,14 @@
 /**
  * A doubly-linked list of values
  **/
-pub struct LinkedList<T>: Enumerable {
+pub mv struct LinkedList<T>: Enumerable {
 	var values = Buffer<T>()
 	var nexts = Buffer<int>()
 	var prevs = Buffer<int>()
 	var int head = -1
 	var count = 0
 
-	pub func add = (ref self, move T value) {
+	pub func add = (ref self, mv T value) {
 		var int idx = self.count
 		self.values.grow(idx + 1)
 		self.values.store(idx, value)

package/core/System/List.nm

@@ -1,11 +1,11 @@
 /**
  * A growable, ordered list of values (`push`/`pop`/`at`)
  **/
-pub struct List<T>: Viewable {
+pub mv struct List<T>: Viewable {
 	var length = 0
 	var items = Buffer<T>()
 
-	pub func push = (ref self, move T value) {
+	pub func push = (ref self, mv T value) {
 		if self.length >= self.items.cap {
 			var new_cap = 4
 			var int old_cap = self.items.cap
@@ -18,7 +18,7 @@ pub struct List<T>: Viewable {
 		self.length += 1
 	}
 
-	pub func pop = (ref self, move out T) {
+	pub func pop = (ref self, mv out T) {
 		if self.length <= 0 {
 			return self.items.move(0)
 		}
@@ -51,13 +51,13 @@ pub struct List<T>: Viewable {
 		panic("index out of range")
 	}
 
-	// A non-owning `view T` over [start, end). Delegates to the backing Buffer's
+	// A non-mv `view T` over [start, end). Delegates to the backing Buffer's
 	// #arch slice primitive — no #arch code here. Borrows from self.
 	pub func slice = (self, int start: start >= 0, int end: end >= start, out view T) {
 		return self.items.slice(start, end)
 	}
 
-	pub func set = (ref self, int i: i >= 0 && i < self.length, move T value) {
+	pub func set = (ref self, int i: i >= 0 && i < self.length, mv T value) {
 		self.items.replace(i, value)
 	}
 
@@ -65,7 +65,7 @@ pub struct List<T>: Viewable {
 	// for indices that can't be proven at compile time (cross-module calls
 	// can never discharge `set`'s parameter constraint) and out-of-range is
 	// a bug, not a case.
-	pub func set_or_panic = (ref self, int i, move T value) {
+	pub func set_or_panic = (ref self, int i, mv T value) {
 		if i >= 0 && i < self.length {
 			self.set(i, value)
 			return
@@ -74,7 +74,7 @@ pub struct List<T>: Viewable {
 	}
 
 	// A deep copy: a fresh List<T> with an independent copy of every element.
-	// For owning element types (strings, owning value structs) each slot in the
+	// For mv element types (strings, mv value structs) each slot in the
 	// copy owns its own heap data (Buffer deep-copies on store), so the source
 	// and the copy share nothing. Not available for class/trait element types
 	// (the copy would share the stored instances — the checker rejects it).

package/core/System/Map.nm

@@ -8,7 +8,7 @@
  * it is correct for negative hashes too: two's-complement `&` already lands
  * in `[0, cap)`, which is why no negative adjustment is needed.
  **/
-pub struct Map<TK: Hashable + Equatable, TV> {
+pub mv struct Map<TK: Hashable + Equatable, TV> {
 	var length = 0
 	var keys = Buffer<TK>()
 	var values = Buffer<TV>()
@@ -17,6 +17,9 @@ pub struct Map<TK: Hashable + Equatable, TV> {
 	// Variadic-tuple constructor: Map<string, int>(["a", 1], ["b", 2]) or
 	// Map(["a", 1], ["b", 2]) (type args inferred from the first pair).
 	// Zero pairs yields an empty Map, so this also covers Map<K, V>().
+	// The pair reads are temp-rooted (`pairs.at(i)` is a statement temp):
+	// the element transfer is absorbed by set's mv store (store_T
+	// deep-copies string-field elements), so no explicit mv is spelled.
 	pub func #init = (self, ...[TK, TV] pairs) {
 		var i = 0
 		while i < pairs.length; i += 1 {
@@ -24,7 +27,7 @@ pub struct Map<TK: Hashable + Equatable, TV> {
 		}
 	}
 
-	pub func set = (ref self, move TK key, move TV value) {
+	pub func set = (ref self, mv TK key, mv TV value) {
 		var int cap = self.keys.cap
 		if cap == 0 {
 			// alloc_T: for Buffer<TK> it is T_SIZE-aware (string keys are
@@ -169,9 +172,9 @@ pub struct Map<TK: Hashable + Equatable, TV> {
 	}
 
 	func rehash = (ref self, int new_cap) {
-		var Buffer<TK> old_keys = move self.keys swap Buffer<TK>()
-		var Buffer<TV> old_values = move self.values swap Buffer<TV>()
-		var Buffer<int> old_used = move self.used swap Buffer<int>()
+		var Buffer<TK> old_keys = mv self.keys swap Buffer<TK>()
+		var Buffer<TV> old_values = mv self.values swap Buffer<TV>()
+		var Buffer<int> old_used = mv self.used swap Buffer<int>()
 		var int old_cap = old_keys.cap
 
 		self.keys.alloc(new_cap)
@@ -187,13 +190,13 @@ pub struct Map<TK: Hashable + Equatable, TV> {
 				// afterwards. load_T would leave the old slot referencing
 				// the same class pointer — a double-free when old_keys is
 				// destroyed. The results are bound to locals so an
-				// owning-element copy (e.g. a `Buffer<string>` slot, which
+				// mv-element copy (e.g. a `Buffer<string>` slot, which
 				// store_T strdup's) is freed here once the new buffer has
 				// made its own copy — passing them inline would orphan the
 				// move_T results.
 				var TK k = old_keys.move(i)
 				var TV v = old_values.move(i)
-				self.set(move k, move v)
+				self.set(mv k, mv v)
 			}
 		}
 	}

package/core/System/Math.nm

@@ -28,5 +28,5 @@ pub struct Math {
 	}
 
 	// libm natural logarithm — extern.
-	extern func log = (float x, out float)
+	foreign func log = (float x, out float)
 }

package/core/System/Mutex.nm

@@ -10,16 +10,28 @@
 // observes the cancel flag at its next checkpoint after acquiring — so a
 // matching unlock is always sound.
 
+// Mutex is an OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 3 — the shape
+// menu): the single field is an opaque handle, so the value is movable and
+// its `#destroy` closes what the handle names. Moving a Mutex transfers the
+// handle; there is no aliasing copy to misuse. Sharing one across tasks
+// rides the checked region borrows (`async { }`) — the lock/unlock methods
+// take the receiver bare (struct receivers travel by address), so a locked
+// section mutates the kernel object the handle names, never the binding.
+
 /**
  * A pthread-backed mutual-exclusion lock for protecting shared mutable state
  **/
-pub class Mutex: Sendable {
+pub mv struct Mutex {
 	pub var uint64 handle = 0
 
 	pub func #init = (self) {
+	// The constructor's `self` is the INLINE instance (a local value in the
+	// C lowering — methods take the pointer form, the ctor does not), so the
+	// C body uses the `.` accessor; the aarch64 body writes through x19 =
+	// &instance as always.
 	```
 	#arch: c
-	self->handle = (unsigned long long)__nomen_mutex_create();
+	self.handle = (unsigned long long)__nomen_mutex_create();
 	```
 	```
 	#arch: aarch64

package/core/System/Random.nm

@@ -15,10 +15,16 @@
 //
 import Time
 
+// Random is an OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 3 — the shape
+// menu): bindings mv instead of alias. The state is a bare uint64, so the
+// value is freely movable (and trivially copyable in principle — `mv`
+// is the uniform spelling for the launch/IO primitives; a `ref Random`
+// parameter is the read-only borrow that keeps one stream per binding).
+
 /**
  * A fast splitmix64 pseudo-random number generator
  **/
-pub class Random {
+pub mv struct Random {
 	// The raw 64-bit generator state (seeded from the wall clock by the
 	// no-arg constructor, or an explicit seed for reproducible sequences).
 	pub var uint64 state = 0

package/core/System/Result.nm

@@ -1,4 +1,4 @@
-pub must_use enum Result<T, E> {
+pub checked enum Result<T, E> {
 	case ok(T value)
 	case error(E error)
 }

package/core/System/Sendable.nm

@@ -1,9 +1,9 @@
-// Marker trait for types whose values are safe to move across task boundaries.
+// Marker trait for types whose values are safe to mv across task boundaries.
 // See ASYNC.md for the design. Auto-derivable in a follow-up; for now, structs
 // opt in explicitly with `: Sendable`.
 
 /**
- * A marker trait for values that are safe to move across task boundaries
+ * A marker trait for values that are safe to mv across task boundaries
  **/
 pub trait Sendable {
 }

package/core/System/Set.nm

@@ -7,12 +7,12 @@
  * slot indexing is a mask (`hash & (cap - 1)`) — correct for negative hashes
  * too (two's-complement `&` already lands in `[0, cap)`).
  **/
-pub struct Set<T: Hashable + Equatable> {
+pub mv struct Set<T: Hashable + Equatable> {
 	var length = 0
 	var slots = Buffer<T>()
 	var used = Buffer<int>()
 
-	pub func add = (ref self, move T value) {
+	pub func add = (ref self, mv T value) {
 		var int cap = self.slots.cap
 		if cap == 0 {
 			cap = self.slots.alloc(8)
@@ -148,8 +148,8 @@ pub struct Set<T: Hashable + Equatable> {
 	}
 
 	func rehash = (ref self, int new_cap) {
-		var Buffer<T> old_slots = move self.slots swap Buffer<T>()
-		var Buffer<int> old_used = move self.used swap Buffer<int>()
+		var Buffer<T> old_slots = mv self.slots swap Buffer<T>()
+		var Buffer<int> old_used = mv self.used swap Buffer<int>()
 		var int old_cap = old_slots.cap
 
 		self.slots.alloc(new_cap)
@@ -163,12 +163,12 @@ pub struct Set<T: Hashable + Equatable> {
 				// is owned by exactly one buffer (the new self) afterwards.
 				// load_T would leave the old slot referencing the same class
 				// pointer — a double-free when old_slots is destroyed. The
-				// result is bound to a local so an owning-element copy (e.g. a
+				// result is bound to a local so a mv-element copy (e.g. a
 				// `Buffer<string>` slot, which store_T strdup's) is freed here
 				// once the new buffer has made its own copy — passing it inline
 				// would orphan the move_T result.
 				var T v = old_slots.move(i)
-				self.add(move v)
+				self.add(mv v)
 			}
 		}
 	}

package/core/System/Spawnable.nm

@@ -1,18 +1,18 @@
 // Spawnable — the trait role of a deferred-work LAUNCHER (the C# shape;
-// see docs/ASYNC.md, "Design decisions"). A Spawnable class packs a deferred unit of work
-// (the construction special form) and its `start` submits it, yielding the
-// library-owned `Task<T>` handle — so the await half is guaranteed by the
-// return type and each type carries exactly one role: `Thread<T>`/`Fiber<T>`
-// are spawnable, `Task<T>` is awaitable. `Awaitable` stays non-generic (its
-// `wait` does not mention T); `Spawnable` is generic because `start`'s
-// return type does.
+// see docs/ASYNC.md, "Design decisions"). A Spawnable type packs a deferred
+// unit of work (the construction special form) and its `start` submits it,
+// yielding the library-owned `Task<T>` handle — so the await half is
+// guaranteed by the return type and each type carries exactly one role:
+// `Thread<T>`/`Fiber<T>` are spawnable, `Task<T>` is awaitable.
+// `Awaitable` stays non-generic (its `wait` does not mention T);
+// `Spawnable` is generic because `start`'s return type does.
 //
 // `detach` is the daemon role: run the work unjoinable, statement only.
 
 /**
- * A class that can launch a deferred call and hand back its Task<T> handle
+ * A type that can launch a deferred call and hand back its Task<T> handle
  **/
 pub trait Spawnable<T> {
-	func start = (ref self, move out Task<T>)
+	func start = (ref self, mv out Task<T>)
 	func detach = (ref self)
 }

package/core/System/Stream/Directory.nm

@@ -28,10 +28,9 @@ pub struct Directory {
 			case err == 66 {
 				return DirectoryError.not_empty
 			}
-			else {
+		} else {
 				return DirectoryError.other
 			}
-		}
 	}
 
 	// (static) Create a directory at `path`; returns errno (0 on success).

package/core/System/Stream/File.nm

@@ -56,10 +56,9 @@ pub struct File {
 			case err == 17 {
 				return FileError.already_exists
 			}
-			else {
+		} else {
 				return FileError.other
 			}
-		}
 	}
 
 	// Open the file at `path` with a C mode string ("r", "w", "a", …).
@@ -157,9 +156,9 @@ pub struct File {
 	}
 
 	// Read every byte from the current position to EOF and return it. Sets
-	// `eof` and `error`. Declared `move out string`: the raw body mallocs a
+	// `eof` and `error`. Declared `mv out string`: the raw body mallocs a
 	// fresh buffer and hands ownership to the caller.
-	func raw_read_all = (ref self, move out string) {
+	func raw_read_all = (ref self, mv out string) {
 		```
 		#arch: c
 		FILE *f = (FILE*)(unsigned long long)self->handle;
@@ -272,8 +271,8 @@ pub struct File {
 
 	// Read up to the next '\n' (the newline is not included). Sets `eof`
 	// when the end of the file is reached and `error` on failure. The raw
-	// body mallocs a fresh buffer — `move out string` transfers it.
-	func raw_read_line = (ref self, move out string) {
+	// body mallocs a fresh buffer — `mv out string` transfers it.
+	func raw_read_line = (ref self, mv out string) {
 		```
 		#arch: c
 		FILE *f = (FILE*)(unsigned long long)self->handle;
@@ -416,8 +415,8 @@ pub struct File {
 
 	// Read up to `size` bytes from the current position. Sets `eof` if fewer
 	// than `size` bytes remain and `error` on failure. The raw body mallocs a
-	// fresh buffer — `move out string` transfers it.
-	func raw_read_chunk = (ref self, int size, move out string) {
+	// fresh buffer — `mv out string` transfers it.
+	func raw_read_chunk = (ref self, int size, mv out string) {
 		```
 		#arch: c
 		FILE *f = (FILE*)(unsigned long long)self->handle;
@@ -590,7 +589,7 @@ pub struct File {
 
 	// (static) Write `data` to `path` (replacing any existing contents) in
 	// one open/write/close. A write failure is reported as `.error`, not
-	// silently swallowed (the `must_use` Result discard check forces this to
+	// silently swallowed (the `checked` Result discard check forces this to
 	// be deliberate).
 	pub func write_all = (string path, string data, out Result<bool, FileError>) {
 		var Result<bool, FileError> result = .error(FileError.other)

package/core/System/Stream/Http.nm

@@ -48,10 +48,9 @@ pub struct Http {
 			case err == 3 {
 				return HttpError.connect
 			}
-			else {
+		} else {
 				return HttpError.other
 			}
-		}
 	}
 
 	// Shared socket round-trip used by get/post. `method` is the request
@@ -59,7 +58,7 @@ pub struct Http {
 	// (sends `body` and the Content-* headers). Sets self->status (0 on
 	// failure) and self->error, and returns the response body (empty string
 	// on failure).
-	func raw_exchange = (ref self, string method, string url, string body, move out string) {
+	func raw_exchange = (ref self, string method, string url, string body, mv out string) {
 		// Parse the URL: [http://]host[:port][/path]
 		var host_start = 0
 		if url.starts_with("http://") {

package/core/System/Stream/Tcp.nm

@@ -23,10 +23,15 @@
 // linked companion on aarch64) — OS socket/DNS interop, where hand-written
 // per-target assembly is not practical.
 
+// Tcp is an OWNING STRUCT (STRUCT_PLAN_3 Phase R, tranche 3 — the shape
+// menu): the fields are the fd and an error code — the fd is the handle, so
+// the value is movable and `#destroy` closes it. A moved Tcp transfers the
+// socket; there is no aliasing copy to double-close.
+
 /**
  * A non-blocking TCP socket whose waits park the calling fiber
  **/
-pub class Tcp: Sendable {
+pub mv struct Tcp {
 	// The underlying file descriptor, -1 when closed/failed.
 	pub var int fd = -1
 	// 0 = ok; 1 = DNS, 2 = socket, 3 = connect, 4 = listen, 5 = closed.
@@ -64,7 +69,7 @@ pub class Tcp: Sendable {
 	// ---- listening ----
 
 	// Create a listening socket bound to `port` on all interfaces.
-	pub func listen = (int port, int backlog, move out Tcp) {
+	pub func listen = (int port, int backlog, mv out Tcp) {
 		var int handle = Tcp.listen_fd(port, backlog)
 		var t = Tcp(handle)
 		if handle < 0 {
@@ -76,7 +81,7 @@ pub class Tcp: Sendable {
 	// Accept the next connection, parking the fiber while the backlog is
 	// empty. The returned socket is -1 if the listener was cancelled or
 	// failed.
-	pub func accept = (ref self, move out Tcp) {
+	pub func accept = (ref self, mv out Tcp) {
 		var int handle = Tcp.accept_fd(self.fd)
 		var t = Tcp(handle)
 		if handle < 0 {
@@ -88,7 +93,7 @@ pub class Tcp: Sendable {
 	// ---- connecting ----
 
 	// Connect to `host`:`port`. Check `fd >= 0` (or `error == 0`) for success.
-	pub func connect = (string host, int port, move out Tcp) {
+	pub func connect = (string host, int port, mv out Tcp) {
 		var int handle = Tcp.socket_fd()
 		if handle < 0 {
 			var bad = Tcp(-1)
@@ -115,12 +120,12 @@ pub class Tcp: Sendable {
 
 	// Receive up to `max` bytes. Parks the fiber until data arrives; returns
 	// the empty string at end-of-stream, on error, or when cancelled.
-	pub func recv = (ref self, int max, move out string) {
+	pub func recv = (ref self, int max, mv out string) {
 		return Tcp.recv_some(self.fd, max)
 	}
 
 	// Receive until the peer closes (how Connection: close HTTP works).
-	pub func recv_all = (ref self, move out string) {
+	pub func recv_all = (ref self, mv out string) {
 		return Tcp.recv_until_close(self.fd)
 	}
 
@@ -326,7 +331,7 @@ pub class Tcp: Sendable {
 		```
 	}
 
-	func recv_some = (int handle, int max, move out string) {
+	func recv_some = (int handle, int max, mv out string) {
 		```
 		#arch: c
 		long cap = max > 0 ? max : 1;
@@ -375,7 +380,7 @@ pub class Tcp: Sendable {
 		```
 	}
 
-	func recv_until_close = (int handle, move out string) {
+	func recv_until_close = (int handle, mv out string) {
 		```
 		#arch: c
 		long cap = 4096, len = 0;

package/core/System/String.nm

@@ -1,7 +1,7 @@
 // FFI: the C library's heap-copy entry point (string.h). The adapter
 // marshals the fat string to the thin char* the C ABI expects; the string
 // result is re-wrapped with its length.
-extern func strdup = (string s, move out string)
+foreign func strdup = (string s, mv out string)
 
 // Raw memory externs — the allocation primitives every `unsafe` Nomen body
 // across core (Buffer, StringBuilder, Array, ...) is built on. This file is
@@ -9,17 +9,20 @@ extern func strdup = (string s, move out string)
 // every core file regardless of pull order. Free externs emit under an
 // `extern_<name>` label that wraps the identically-named C symbol, so these
 // can never collide with it (docs/CORE_RAW.md roadmap items 1+2).
-extern func calloc = (int count, int size, out uint64)
-extern func malloc = (int bytes, out uint64)
-extern func realloc = (uint64 address, int bytes, out uint64)
-extern func free = (uint64 address)
-extern func memcpy = (uint64 dst, uint64 src, int bytes, out uint64)
-extern func memset = (uint64 dst, int value, int bytes, out uint64)
+foreign func calloc = (int count, int size, out uint64)
+foreign func malloc = (int bytes, out uint64)
+foreign func realloc = (uint64 address, int bytes, out uint64)
+foreign func free = (uint64 address)
+foreign func memcpy = (uint64 dst, uint64 src, int bytes, out uint64)
+foreign func memset = (uint64 dst, int value, int bytes, out uint64)
 
 /**
- * A UTF-8 text string — a heap-owned, length-tracked sequence of bytes
+ * A UTF-8 text string — a heap-owned, length-tracked sequence of bytes.
+ * STRUCT_PLAN_3 D3: `string` is OWNING — the fat (ptr, len) pair owns its
+ * bytes, so bindings mv unless a copy is spelled (`.copy()`); `view string`
+ * is the cheap read-only passing form.
  **/
-pub struct string: Stringable, Hashable, Equatable {
+pub mv struct string: Stringable, Hashable, Equatable {
 	pub func hash = (self, out uint) {
 		// djb2 over exactly self.length bytes — matches the byte count of
 		// owned strings and literals (views hash the viewed bytes only).
@@ -31,12 +34,19 @@ pub struct string: Stringable, Hashable, Equatable {
 		return h
 	}
 
-	// Returns an OWNED byte-exact copy of self (`move out string`). Fresh
+	// The uniform mv-type verb: a fresh, owned byte-exact copy of self.
+	// The deep-copy spelling the binding/assignment copy errors name — same
+	// allocation contract as to_string (fresh buffer, never an alias).
+	pub func copy = (self, mv out string) {
+		return self.to_string()
+	}
+
+	// Returns an OWNED byte-exact copy of self (`mv out string`). Fresh
 	// allocation, never an alias of self's storage — the result can outlive
 	// the receiver (e.g. escape a match branch that reclaims the scrutinee
 	// temp). Copies by tracked length, so embedded NULs survive (an extern
 	// strdup boundary would re-synthesize length via strlen and truncate).
-	pub func to_string = (self, move out string) {
+	pub func to_string = (self, mv out string) {
 		```
 		#arch: c
 		// Fat-string ABI: copy self.len bytes; no strlen anywhere.
@@ -90,7 +100,7 @@ pub struct string: Stringable, Hashable, Equatable {
 		panic("index out of range")
 	}
 
-	// A non-owning slice [start, end) into self's buffer. Returns a `view
+	// A non-mv slice [start, end) into self's buffer. Returns a `view
 	// string` (ptr, len) that borrows from self: it may not outlive self's
 	// scope and is invalidated if self is reassigned. Use .to_string() to
 	// materialize an owned copy.

package/core/System/StringBuilder.nm

@@ -178,9 +178,9 @@ pub struct StringBuilder {
 	// measure-and-restart shape: record `length()`, append a section, then
 	// `take_since(mark)` to measure it and re-emit decorated. `mark` clamps
 	// to [0, len]; the returned string is always an independent allocation.
-	// (`move out string` — the raw body mallocs the result, so the caller
+	// (`mv out string` — the raw body mallocs the result, so the caller
 	// owns it by signature, like `Console.read_line`.)
-	pub func take_since = (ref self, int mark, move out string) {
+	pub func take_since = (ref self, int mark, mv out string) {
 		```
 		#arch: c
 		int start = mark;