nomen-lang 0.7.1 → 0.9.0

package/core/System/LinkedList.nm

@@ -16,7 +16,14 @@ pub mv struct LinkedList<T>: Enumerable {
 	pub func add = (ref self, mv T value) {
 		var int idx = self.count
 		self.values.grow(idx + 1)
-		self.values.store(idx, value)
+		// The value arrives owned (`mv T value`): move a value-struct element
+		// into the fresh slot (the caller's storage zeroes, no deep copy);
+		// strings keep the deep-copying store (their pair arrives by value).
+		if T_IS_VALUE_STRUCT {
+			self.values.store_take(idx, value)
+		} else {
+			self.values.store(idx, value)
+		}
 		self.nexts.grow_int(idx + 1)
 		self.nexts.store_int(idx, -1)
 		self.prevs.grow_int(idx + 1)

package/core/System/List.nm

@@ -6,18 +6,52 @@ pub mv struct List<T>: Viewable {
 	var items = Buffer<T>()
 
 	pub func push = (ref self, mv T value) {
-		if self.length >= self.items.cap {
-			var new_cap = 4
-			var int old_cap = self.items.cap
-			if old_cap >= 4 {
-				new_cap = old_cap * 2
+		if self.length < self.items.cap {
+			// The value arrives owned (`mv T value`): a value-struct element
+			// moves into the fresh slot (store_take — the caller's storage
+			// zeroes, no deep copy); strings and scalars keep the
+			// deep-copying store.
+			if T_IS_VALUE_STRUCT {
+				self.items.store_take(self.length, value)
+			} else {
+				self.items.store(self.length, value)
 			}
-			self.items.grow(new_cap)
+			self.length += 1
+			return
+		}
+		self.reserve(1)
+		if T_IS_VALUE_STRUCT {
+			self.items.store_take(self.length, value)
+		} else {
+			self.items.store(self.length, value)
 		}
-		self.items.store(self.length, value)
 		self.length += 1
 	}
 
+	// Capacity for `extra` more elements without reallocation: the exact
+	// growth policy `push` uses (double from 4, so repeated single pushes
+	// amortize). Returns the resulting capacity. Splitting it out of `push`
+	// is what makes the compiler's in-place push lowering possible: the
+	// destination slot for a `push(parse(line))` argument must exist before
+	// the argument call runs, so the backend reserves first and constructs
+	// the callee's result directly into `items.data[length]` (the in-place
+	// #4). Sound for extra=1 by the same proof as push's old inline growth:
+	// length + 1 > cap grows to exactly the capacity push would have grown
+	// to.
+	internal func reserve = (ref self, int extra: extra >= 0, out int) {
+		if self.length + extra <= self.items.cap {
+			return self.items.cap
+		}
+		var int new_cap = 4
+		var int old_cap = self.items.cap
+		if old_cap >= 4 {
+			new_cap = old_cap * 2
+		}
+		while new_cap < self.length + extra; new_cap *= 2 { }
+		self.items.grow(new_cap)
+		return self.items.cap
+	}
+
 	pub func pop = (ref self, mv out T) {
 		if self.length <= 0 {
 			return self.items.move(0)
@@ -73,6 +107,62 @@ pub mv struct List<T>: Viewable {
 		panic("index out of range")
 	}
 
+	// Address of the APPEND slot (element `length`) — the in-place push
+	// lowering's destination primitive, the in-place push contract). reserve must have
+	// run, so the slot exists. Offsets mirror the mono layout: length @8,
+	// items.data @24 (the Buffer mono is {_vt, data, cap} = 24 bytes).
+	internal func append_slot_ptr = (ref self, out ptr T) {
+		```
+		#arch: c
+		// Byte math + void* — the body must compile for EVERY element kind
+		// (values, strings, class/trait handles), so it never names T.
+		// T_SIZE substitutes to the element's real stride.
+		return (void *)((unsigned long long)self->items.data +
+			(unsigned long long)self->length * T_SIZE);
+		```
+		```
+		#arch: aarch64
+		// x0 = self (stack-less raw: read from x0). Returns x0 = slot address.
+		ldr x9, [x0, #8]
+		ldr x10, [x0, #24]
+		mov x11, #T_SIZE
+		madd x0, x9, x11, x10
+		```
+	}
+
+	// Address of element `i` (INTERNAL — the ELEMENT BORROW primitive):
+	// `ref T x = list.at(i)` (docs/HANDLERS.md Stage 4, dynamic-tree
+	// dispatch) lowers to this, binding the alias to the slot itself rather
+	// than to a bitwise copy. The pointer is valid while the list is
+	// exclusively borrowed and not resized; a `ref self` call on the list
+	// invalidates the borrow through the ordinary borrow-invalidation
+	// rules. The length constraint is the caller's proof obligation — the
+	// handler desugar's synthesized loops satisfy it from the loop
+	// condition, exactly like `.at`.
+	internal func slot_ptr = (ref self, int i: i >= 0 && i < self.length, out ptr T) {
+		return self.items.slot_ptr(i)
+	}
+
+	// Bounds-checked removal that traps when i is outside [0, self.length) —
+	// same contract as at_or_panic/set_or_panic, for indices that can't be
+	// proven at compile time. The element is moved out (later elements
+	// backward-shift into place) and returned: the caller owns it, so its
+	// resources are reclaimed when the binding's scope ends — binding the
+	// result in a nested block is the way to free an owning element at a
+	// chosen point (its #destroy runs at the block's closing brace).
+	pub func remove_at_or_panic = (ref self, int i, mv out T) {
+		if i < 0 || i >= self.length {
+			panic("index out of range")
+		}
+		var T v = self.items.move(i)
+		var int last = self.length - 1
+		if i < last {
+			self.items.move_range(i, i + 1, last - i)
+		}
+		self.length -= 1
+		return v
+	}
+
 	// A deep copy: a fresh List<T> with an independent copy of every element.
 	// For mv element types (strings, mv value structs) each slot in the
 	// copy owns its own heap data (Buffer deep-copies on store), so the source

package/core/System/Map.nm

@@ -7,23 +7,35 @@
  * bucket indexing is a mask (`hash & (cap - 1)`) instead of a division — and
  * it is correct for negative hashes too: two's-complement `&` already lands
  * in `[0, cap)`, which is why no negative adjustment is needed.
+ *
+ * Each slot carries its key's hash (truncated to 32 bits) in a parallel
+ * `hashes` buffer. Probes compare the stored hash before the key itself, so
+ * a probed slot whose hash differs skips the key load and `==` entirely (the
+ * Swiss-table short-circuit: the full key compare only runs on a hash match,
+ * and a false match still falls through to `==`, so truncation costs
+ * nothing); rehash re-inserts hash-free, reading the stored word instead of
+ * calling `key.hash()` again.
  **/
 pub mv struct Map<TK: Hashable + Equatable, TV> {
 	var length = 0
 	var keys = Buffer<TK>()
 	var values = Buffer<TV>()
 	var used = Buffer<int>()
+	var hashes = Buffer<int>()
 
 	// Variadic-tuple constructor: Map<string, int>(["a", 1], ["b", 2]) or
 	// Map(["a", 1], ["b", 2]) (type args inferred from the first pair).
 	// Zero pairs yields an empty Map, so this also covers Map<K, V>().
-	// The pair reads are temp-rooted (`pairs.at(i)` is a statement temp):
-	// the element transfer is absorbed by set's mv store (store_T
-	// deep-copies string-field elements), so no explicit mv is spelled.
+	// Each pair is read into a local and its fields are MV-DESTRUCTURED into
+	// bindings, so set's mv store receives an explicit transfer chain — no
+	// temp-rooted read exemption involved. (String bindings lower as the
+	// borrow-copy convention: the slot's owner reclaims heap bytes, and the
+	// callee materializes its own copy.)
 	pub func #init = (self, ...[TK, TV] pairs) {
 		var i = 0
 		while i < pairs.length; i += 1 {
-			self.set(pairs.at(i)._0, pairs.at(i)._1)
+			var [mv k, mv v] = pairs.at(i)
+			self.set(mv k, mv v)
 		}
 	}
 
@@ -36,28 +48,84 @@ pub mv struct Map<TK: Hashable + Equatable, TV> {
 			cap = self.keys.alloc(8)
 			self.values.alloc(8)
 			self.used.alloc_u32(8)
+			self.hashes.alloc_u32(8)
 		}
 		if self.length * 4 >= cap * 3 {
 			self.rehash(cap * 2)
 			cap = self.keys.cap
 		}
-		var int idx = self.find_slot(key, cap)
+		var uint32 h = key.hash() as uint32
+		var int idx = self.find_slot(key, h, cap)
 		if self.used.load_u32(idx) == 0 {
 			self.used.store_u32(idx, 1)
-			self.keys.store(idx, key)
-			self.values.store(idx, value)
+			// Both arrive owned (`mv TK key, mv TV value`): a value-struct
+			// key/value moves into its fresh slot (the caller's storage
+			// zeroes, no deep copy); strings keep the deep-copying store
+			// (their pair arrives by value).
+			if TK_IS_VALUE_STRUCT {
+				self.keys.store_take(idx, key)
+			} else {
+				self.keys.store(idx, key)
+			}
+			if TV_IS_VALUE_STRUCT {
+				self.values.store_take(idx, value)
+			} else {
+				self.values.store(idx, value)
+			}
+			self.hashes.store_u32(idx, h)
 			self.length += 1
 		} else {
 			self.values.replace(idx, value)
 		}
 	}
 
+	// The IN-PLACE STORE primitive — the write-side sibling of `get_ptr`.
+	// Runs set's whole preamble (alloc-if-empty, rehash-at-load-factor) and
+	// probe with the KEY (which precedes the value in evaluation order at a
+	// `set(key, f(x))` site), then does everything set does EXCEPT write the
+	// value: the insert path marks the slot used, stores the key, and bumps
+	// length; the replace path reclaims the displaced value through
+	// `values.destroy_at` (the destroy half of replace, no copy). It returns
+	// the VALUE SLOT's address, so the compiler's in-place `set` lowering
+	// constructs `f(x)` straight into it — no `_param_N` temp home, no
+	// callee-side deep copy, no temp free. INTERNAL, like every slot
+	// primitive: the raw pointer must not cross the library boundary, and
+	// the caller must overwrite the slot before it is read or destroyed
+	// again (both paths leave it owning nothing).
+	internal func set_slot_ptr = (ref self, TK key, out ptr TV) {
+		var int cap = self.keys.cap
+		if cap == 0 {
+			// alloc_T: for Buffer<TK> it is T_SIZE-aware (string keys are
+			// 16-byte slots); for ClassBuffer<TV> it delegates to alloc_int
+			// (one pointer per slot). Both have it for generic parity.
+			cap = self.keys.alloc(8)
+			self.values.alloc(8)
+			self.used.alloc_u32(8)
+			self.hashes.alloc_u32(8)
+		}
+		if self.length * 4 >= cap * 3 {
+			self.rehash(cap * 2)
+			cap = self.keys.cap
+		}
+		var uint32 h = key.hash() as uint32
+		var int idx = self.find_slot(key, h, cap)
+		if self.used.load_u32(idx) == 0 {
+			self.used.store_u32(idx, 1)
+			self.keys.store(idx, key)
+			self.hashes.store_u32(idx, h)
+			self.length += 1
+		} else {
+			self.values.destroy_at(idx)
+		}
+		return self.values.slot_ptr(idx)
+	}
+
 	pub func get = (self, TK key, out TV) {
 		var int cap = self.keys.cap
 		if cap == 0 {
 			return 0
 		}
-		var int idx = self.find_slot(key, cap)
+		var int idx = self.find_slot(key, key.hash() as uint32, cap)
 		if self.used.load_u32(idx) == 0 {
 			return 0
 		}
@@ -71,7 +139,7 @@ pub mv struct Map<TK: Hashable + Equatable, TV> {
 		if cap == 0 {
 			return fallback
 		}
-		var int idx = self.find_slot(key, cap)
+		var int idx = self.find_slot(key, key.hash() as uint32, cap)
 		if self.used.load_u32(idx) == 0 {
 			return fallback
 		}
@@ -85,19 +153,45 @@ pub mv struct Map<TK: Hashable + Equatable, TV> {
 		if cap == 0 {
 			panic("key not found")
 		}
-		var int idx = self.find_slot(key, cap)
+		var int idx = self.find_slot(key, key.hash() as uint32, cap)
 		if self.used.load_u32(idx) == 0 {
 			panic("key not found")
 		}
 		return self.values.load(idx)
 	}
 
+	// The VALUE SLOT BORROW — `Buffer.slot_ptr` for Map values. One probe
+	// (a `has` + `get` pair collapses into it) and the result aliases the
+	// slot instead of copying it, so container-bearing values stop paying
+	// the owning-specialized deep copy on every lookup. Traps when the key
+	// is absent — a missing key is a bug at a slot-borrow site (miss-as-case
+	// lookups use `get_or`). INTERNAL, like every slot-borrow primitive: the
+	// raw pointer must not cross the library boundary, so user code reaches
+	// it only through the element borrow, `ref TV v = map.get_or_panic(k)`,
+	// which the checker rewrites to this — the same lowering `ref T x =
+	// list.at(i)` gets from `slot_ptr`. The borrow is unpoliced inside the
+	// library: rehash/remove move or free slots, so do not hold it across
+	// one. This is also the anchor for in-place `set(key, f(x))` (probe
+	// first, construct into the slot).
+	internal func get_ptr = (self, TK key, out ptr TV) {
+		unsafe {
+			var int cap = self.keys.cap
+			if cap > 0 {
+				var int idx = self.find_slot(key, key.hash() as uint32, cap)
+				if self.used.load_u32(idx) != 0 {
+					return self.values.slot_ptr(idx)
+				}
+			}
+			panic("key not found")
+		}
+	}
+
 	pub func has = (self, TK key, out bool) {
 		var int cap = self.keys.cap
 		if cap == 0 {
 			return false
 		}
-		var int idx = self.find_slot(key, cap)
+		var int idx = self.find_slot(key, key.hash() as uint32, cap)
 		return self.used.load_u32(idx) != 0
 	}
 
@@ -106,7 +200,7 @@ pub mv struct Map<TK: Hashable + Equatable, TV> {
 		if cap == 0 {
 			return
 		}
-		var int idx = self.find_slot(key, cap)
+		var int idx = self.find_slot(key, key.hash() as uint32, cap)
 		if self.used.load_u32(idx) == 0 {
 			return
 		}
@@ -119,7 +213,9 @@ pub mv struct Map<TK: Hashable + Equatable, TV> {
 		// so entries past a non-moveable one are not stranded behind an empty
 		// slot (which would make find_slot miss them). No tombstones, so
 		// find_slot/get/has/set are unchanged, and the cost is the local cluster
-		// length — not a full O(cap) rehash on every delete.
+		// length — not a full O(cap) rehash on every delete. `home` reads the
+		// stored hash word (no re-hash per shifted entry), and the word moves
+		// with the entry — find_slot's hash short-circuit trusts it.
 		var int gap = idx
 		var int k = idx
 		while true {
@@ -130,7 +226,7 @@ pub mv struct Map<TK: Hashable + Equatable, TV> {
 			if self.used.load_u32(k) == 0 {
 				break
 			}
-			var int home = (self.keys.load(k).hash() as int) & (cap - 1)
+			var int home = (self.hashes.load_u32(k) as int) & (cap - 1)
 			var int dgap = gap - home
 			if dgap < 0 {
 				dgap = dgap + cap
@@ -147,20 +243,77 @@ pub mv struct Map<TK: Hashable + Equatable, TV> {
 				// used.store marks it empty (the buffer destroy skips it).
 				self.keys.shift(gap, k)
 				self.values.shift(gap, k)
+				self.hashes.store_u32(gap, self.hashes.load_u32(k))
 				self.used.store_u32(gap, 1)
 				gap = k
 			}
 		}
+		if TK_NEEDS_STRDUP {
+			if gap == idx {
+				// No entry shifted: the removed entry still owns its strdup'd
+				// bytes in its slot (a shift's first move would have
+				// reclaimed them — see shift_T above). destroy_at frees the
+				// buffer and zeroes the slot: a later set() that lands in
+				// this hole stores over the bytes assuming a fresh slot, and
+				// a stranded-then-overwritten entry leaks.
+				self.keys.destroy_at(idx)
+			}
+		}
+		if TK_IS_VALUE_STRUCT {
+			if gap == idx {
+				// Same hole for a value-struct key: reclaim the slot's owned
+				// fields (destroy_at frees and zeroes; scalars-only structs
+				// reclaim nothing and the call is a no-op).
+				self.keys.destroy_at(idx)
+			}
+		}
+		if TV_NEEDS_STRDUP {
+			if gap == idx {
+				self.values.destroy_at(idx)
+			}
+		}
+		if TV_IS_VALUE_STRUCT {
+			if gap == idx {
+				self.values.destroy_at(idx)
+			}
+		}
 		self.used.store_u32(gap, 0)
 		self.length = self.length - 1
 	}
 
-	func find_slot = (self, TK key, int cap, out int: out >= 0 && out < cap) {
+	// An independent copy: a fresh Map whose every member slab is fresh
+	// (keys/values deep-copied per element, `used`/`hashes` copied word by
+	// word), with the same length and entries. The u32-word buffers are
+	// copied through their own primitives — `Buffer.copy` is T_SIZE-aware
+	// (8-byte loads for `int`), which would read past a 4-byte-per-slot
+	// `alloc_u32` slab. Not available for class/trait keys or values (the
+	// member routes to ClassBuffer, which has no copy — the checker rejects
+	// the call; see the copy gate in check_access_node).
+	pub func copy = (self, out Map<TK, TV>) {
+		var dst = Map<TK, TV>()
+		dst.keys = self.keys.copy()
+		dst.values = self.values.copy()
+		dst.used.alloc_u32(self.keys.cap)
+		dst.hashes.alloc_u32(self.keys.cap)
+		var i = 0
+		while i < self.keys.cap; i += 1 {
+			dst.used.store_u32(i, self.used.load_u32(i))
+			dst.hashes.store_u32(i, self.hashes.load_u32(i))
+		}
+		dst.length = self.length
+		return dst
+	}
+
+	func find_slot = (self, TK key, uint32 h, int cap, out int: out >= 0 && out < cap) {
 		// cap is a power of two, so this is `hash mod cap` via a mask —
 		// non-negative for any hash (two's complement), no adjustment.
-		var int idx = (key.hash() as int) & (cap - 1)
+		var int idx = (h as int) & (cap - 1)
 		while self.used.load_u32(idx) != 0 {
-			if self.keys.load(idx) == key {
+			// The stored-hash word short-circuits the key compare: a probed
+			// slot whose hash differs (every step of a collision walk past
+			// the home slot) skips the key load and `==`. A hash match still
+			// falls through to `==`, so the 32-bit truncation costs nothing.
+			if self.hashes.load_u32(idx) == h && self.keys.load(idx) == key {
 				return idx
 			}
 			idx += 1
@@ -171,15 +324,23 @@ pub mv struct Map<TK: Hashable + Equatable, TV> {
 		return idx
 	}
 
+	// Rehash hash-free: the stored per-slot hash words move with the entries,
+	// so no `key.hash()` runs here and the insertion probe needs no key
+	// compares (keys arrive unique — they came from a valid table). This is
+	// the other half of the Swiss-table trick; the old form re-inserted via
+	// `self.set(mv k, mv v)`, re-hashing every key and re-comparing keys on
+	// every probed slot.
 	func rehash = (ref self, int new_cap) {
 		var Buffer<TK> old_keys = mv self.keys swap Buffer<TK>()
 		var Buffer<TV> old_values = mv self.values swap Buffer<TV>()
 		var Buffer<int> old_used = mv self.used swap Buffer<int>()
+		var Buffer<int> old_hashes = mv self.hashes swap Buffer<int>()
 		var int old_cap = old_keys.cap
 
 		self.keys.alloc(new_cap)
 		self.values.alloc(new_cap)
 		self.used.alloc_u32(new_cap)
+		self.hashes.alloc_u32(new_cap)
 		self.length = 0
 
 		var i = 0
@@ -196,7 +357,19 @@ pub mv struct Map<TK: Hashable + Equatable, TV> {
 				// move_T results.
 				var TK k = old_keys.move(i)
 				var TV v = old_values.move(i)
-				self.set(mv k, mv v)
+				var uint32 h = old_hashes.load_u32(i)
+				var int idx = (h as int) & (new_cap - 1)
+				while self.used.load_u32(idx) != 0 {
+					idx += 1
+					if idx >= new_cap {
+						idx = 0
+					}
+				}
+				self.used.store_u32(idx, 1)
+				self.keys.store(idx, k)
+				self.values.store(idx, v)
+				self.hashes.store_u32(idx, h)
+				self.length += 1
 			}
 		}
 	}

package/core/System/Mutex.nm

@@ -25,10 +25,10 @@ pub mv struct Mutex {
 	pub var uint64 handle = 0
 
 	pub func #init = (self) {
-	// The constructor's `self` is the INLINE instance (a local value in the
-	// C lowering — methods take the pointer form, the ctor does not), so the
-	// C body uses the `.` accessor; the aarch64 body writes through x19 =
-	// &instance as always.
+		// The constructor's `self` is the INLINE instance (a local value in the
+		// C lowering — methods take the pointer form, the ctor does not), so the
+		// C body uses the `.` accessor; the aarch64 body writes through x19 =
+		// &instance as always.
 	```
 	#arch: c
 	self.handle = (unsigned long long)__nomen_mutex_create();

package/core/System/Random.nm

@@ -41,10 +41,9 @@ pub mv struct Random {
 
 	// The next 64-bit value (splitmix64: golden-ratio step, then two
 	// multiply-xor rounds). Pure Nomen — the 64-bit arithmetic, bitwise
-	// operators, and hex literals all lower directly. The aarch64 codegen is
-	// a little looser than a hand-written `#arch` body would be (constant
-	// materialization, field reloads, non-immediate shift counts); see
-	// FOLLOWUP.md if this ever needs to be hot.
+	// operators, and hex literals all lower directly; the aarch64 64-bit
+	// arithmetic folds (PERF_PLAN item 15) keep the emission within a few
+	// instructions of a hand-written `#arch` body.
 	pub func next = (ref self, out uint64) {
 		self.state = self.state + 0x9E3779B97F4A7C15
 		var uint64 z = self.state