volaro 0.1.0-alpha.4 → 0.1.0-alpha.6

package/README.md

@@ -1,8 +1,7 @@
 # Volaro
 
-**Limited alpha, published under the `alpha` dist-tag** (this is `0.1.0-alpha.4`) —
-`npm install volaro@alpha`. Not `latest` (that still resolves to an earlier
-`0.0.x` placeholder) — always specify `@alpha` or the exact version.
+**Limited alpha** (this is `0.1.0-alpha.6`), published under both the
+`latest` and `alpha` dist-tags: `npm install volaro`.
 
 Volaro is an experimental application language intended for AI authoring and
 human review. This package ships the language reference **and a working
@@ -113,11 +112,11 @@ dynamic route), so `volaro dev` on a project directory runs that server.
 ## Scaffold a project
 
 ```bash
-npm create volaro@alpha my-app      # the separate create-volaro package
+npm create volaro my-app      # the separate create-volaro package
 ```
 
-(`@alpha` matters — `npm create volaro` with no tag resolves `latest`, which
-is still an earlier `0.0.x` placeholder, not this build.)
+(If `npm create volaro` prints "This release is a placeholder", npm is
+reusing a cached copy of the old `0.0.1`: run `npm cache clean --force`.)
 
 It writes one single-page starter, a `volaro.json`, and `package.json` scripts
 (`dev` / `build` / `check`) that call `volaro`.
@@ -155,9 +154,9 @@ use them.
 **Form controls:** `input` (a full type matrix, including `checkbox`/`radio`
 binding a `checked` state), `textarea`, `select`/`option`/`optgroup`,
 `fieldset`/`legend`, `datalist`, `button`, `link`. `disabled:` works on
-`button input textarea select fieldset optgroup option`. There is no
-standalone `label` element and no semantic `switch`/`aria-pressed` toggle —
-model one as a `button` reading a `state` bool. `variant:` is a literal
+`button input textarea select fieldset optgroup option`. A toggle is
+`button pressed:<bool>` (a toggle button, `aria-pressed`; there is no
+`switch` role). There is no standalone `label` element. `variant:` is a literal
 style name, not a computed expression. `if` used as an expression is binary
 (`if c a else b`); `match` and block `if` are statements only. A module-level
 `fn` is not available to a view. **`volaro supported` and `volaro crib` are

package/bin/vl.js

@@ -771,8 +771,8 @@ choose the interpreter if \`python3\` is not the one you want.
 
 SHIPPED SUBSET: single page (no router); \`input\` (full type matrix incl.
 checkbox/radio), \`textarea\`, \`select\`/\`option\`/\`optgroup\`,
-\`fieldset\`/\`legend\`, \`datalist\`, \`button\`, \`link\` (no standalone
-\`label\`, no semantic switch/aria-pressed toggle); \`if\` as an expression is
+\`fieldset\`/\`legend\`, \`datalist\`, \`button\` (a toggle is \`button pressed:\`,
+aria-pressed; no switch role), \`link\` (no standalone \`label\`); \`if\` as an expression is
 binary; \`match\` is a statement; a module-level \`fn\` cannot be called from a
 view. \`volaro crib\` + \`volaro supported\` are authoritative for this build;
 \`volaro spec\` is the wider design, not what it accepts.

package/compiler/SOURCE_INFO.json

@@ -1,6 +1,6 @@
 {
-  "revision": "0d5741da1385dd81e277b16715a93592744d8c87",
+  "revision": "78304efecb7e728025c959e1fdf207749b3652ed",
   "source": "git",
   "dirty": false,
-  "content_sha256": "611292080bf797022be28aea42376ca55bbeba3e680c2ec638ae4a1417981ff0"
+  "content_sha256": "1747ce8d53c4ae2caed129b014f01f7e4af5619ab5358a833e0c888e940c830e"
 }

package/compiler/SOURCE_REV

@@ -1 +1 @@
-0d5741da1385dd81e277b16715a93592744d8c87
+78304efecb7e728025c959e1fdf207749b3652ed

package/compiler/validator/vlcheck/ast_nodes.py

@@ -370,6 +370,7 @@ class Literal(Node):
     kind: str = ""      # int float str bool nil duration
     raw: str = ""
     interp_names: list = field(default_factory=list)
+    interp_calls: list = field(default_factory=list)   # bare names called: "{len(xs)}"
 
 
 @dataclass

package/compiler/validator/vlcheck/checks.py

@@ -17,7 +17,7 @@ from .elements import (
     AUTOCOMPLETE_TOKENS, BUTTON_TYPES, ELEMENT_EVENTS, INPUT_TYPE_ATTRS,
     KNOWN_EVENTS,
     EXCLUSIVE_CHILDREN, EXCLUSIVE_PARENTS, NAMED_LANDMARKS,
-    NATIVE_ELEMENT_TAGS, OL_TYPES,
+    NATIVE_ELEMENT_TAGS, OL_TYPES, SPECIAL_ELEMENT_NAMES, attr_is_known,
     PHRASING_ELEMENTS, PHRASING_ONLY_PARENTS, TEXT_ARG_ELEMENTS,
     VOID_ELEMENTS,
     BDI_DIRS, BDO_DIRS, INTERACTIVE_ELEMENTS, LINK_RELS, LINK_TARGETS,
@@ -66,6 +66,23 @@ BUILTINS = {
 BUILTINS.update(ELEMENT_NAMES)
 _PRIM_NAMES = {"int", "float", "str", "bool", "bytes", "time", "dur", "uuid", "json", "nil"}
 
+# Names on the BUILTINS allowlist that are methods in the language, never free
+# functions. A bare call (`len(xs)`) passed --resolve and was emitted verbatim,
+# an undefined JS function: ReferenceError at load (action-48).
+_METHOD_ONLY = {
+    "len": "xs.len()", "format": "value.format(pattern)",
+    "reload": "posts.reload()", "loading": "posts.loading()",
+}
+# Free functions the spec shows but no emitter lowers as a bare call (not in
+# vlbuild's STD_FNS). Only an error where the build emits the call -- a view
+# or a service route; a module-level `fn` body is never emitted into either.
+_FN_NOT_BUILT = {
+    "sorted": "sort_by(xs, fn(x) x)", "first": "xs[0] (check xs.len() > 0 first)",
+    "fold": "a `for` loop over a `let mut` accumulator",
+    "merge": "a record literal naming every field",
+    "to_int": "no string-to-int conversion is built yet; keep the value an int",
+}
+
 # `use std.X { name, ... }` names `vlbuild` actually lowers to a working call
 # -- NOT the same list as `BUILTINS` above (that one is a generous, deliberately
 # loose allowlist for the W-UNDEF-NAME heuristic, and includes several names,
@@ -246,6 +263,11 @@ class Checker:
         # keeps a `alt_todo:` / other TODO marker out of a shipped build.
         self.release = release
         self.diags: list[Diagnostic] = []
+        # semantic(): names the module declares or imports, and whether the
+        # code being walked is emitted by the build (views, routes) or not
+        # (module-level fn bodies)
+        self._module_names: set[str] = set()
+        self._emitted = True
 
     # -- emit ----------------------------------------------------------
     def _d(self, code: str, sev: Severity, msg: str, node, fix: str | None = None) -> None:
@@ -255,6 +277,7 @@ class Checker:
 
     def run(self, mod: A.Module) -> list[Diagnostic]:
         from .test_ids import check_test_ids
+        self._module = mod
         self.diags.extend(check_test_ids(mod, self.filename))
         self.structural(mod)
         self.styling(mod)
@@ -266,6 +289,7 @@ class Checker:
         self.children_marker(mod)
         self.services(mod)
         self.api_params(mod)
+        self.api_base(mod)
         self.imports(mod)
         self.semantic(mod)
         return self.diags
@@ -327,17 +351,12 @@ class Checker:
                 elif isinstance(node, A.For):
                     value_names.update(getattr(node, "vars", []) or [])
 
+            # (1) is checked by semantic(), whose walker scopes names
+            # lexically: an assignment to a list/for var, closure or handler
+            # parameter, match/catch bind or `let` that shadows a readonly
+            # name writes that local, not the view-level value (issue #17).
             for node in _walk(it.body):
-                if isinstance(node, A.Assign):
-                    tgt = getattr(node, "target", None)
-                    nm = tgt.id if isinstance(tgt, A.Name) else None
-                    if nm in readonly:
-                        self._d("E-ASSIGN-READONLY", Severity.ERROR,
-                                "'%s' is a %s and cannot be assigned to -- it is "
-                                "recomputed, not stored. Declare a `state` for a "
-                                "value you change." % (nm, readonly[nm]),
-                                node, None)
-                elif isinstance(node, A.Element):
+                if isinstance(node, A.Element):
                     for k, v in node.attrs:
                         if k != "variant":
                             continue
@@ -488,13 +507,14 @@ class Checker:
                     if not valid:
                         self._d("E-THEME-SHAPE", Severity.ERROR,
                                 "malformed %s token row" % category.head, category)
-        allowed = {"button", "input", "card"}
+        allowed = {"button", "input", "card", "select", "textarea", "checkbox",
+                   "radio", "link", "fieldset", "table", "details"}
         seen_recipes: set[str] = set()
         for recipe in (x for x in mod.items if isinstance(x, A.RecipeDecl)):
             if recipe.primitive not in allowed:
                 self._d("E-RECIPE-UNKNOWN-PRIMITIVE", Severity.ERROR,
-                        "Slice 1 recipes support button, input, and card; got %r"
-                        % recipe.primitive, recipe)
+                        "recipes support %s; got %r"
+                        % (", ".join(sorted(allowed)), recipe.primitive), recipe)
                 continue
             if recipe.primitive in seen_recipes:
                 self._d("E-RECIPE-SHAPE", Severity.ERROR,
@@ -541,7 +561,8 @@ class Checker:
                 if value not in axes.get(axis, set()):
                     self._d("E-RECIPE-SHAPE", Severity.ERROR,
                             "default %s:%s is not declared" % (axis, value), recipe)
-            if recipe.primitive in ("button", "input"):
+            if recipe.primitive in ("button", "input", "select", "textarea",
+                                    "checkbox", "radio", "link"):
                 all_tokens = " ".join(" ".join(r.tokens) for r in recipe.body)
                 if "focus-visible:" not in all_tokens:
                     self._d("E-RECIPE-FOCUS", Severity.ERROR,
@@ -583,7 +604,10 @@ class Checker:
                 if any("[" in c and "]" in c for c in classes):
                     self._d("W-CLASS-ARBITRARY", Severity.WARNING,
                             "arbitrary values bypass the accessibility denylist", node)
-                if (node.name in {"button", "input", "link"}
+                # The same element set vlbuild's resolve_classes enforces; the
+                # two must agree or `vlcheck --resolve` passes source the build
+                # then rejects, and the write -> check -> repair loop breaks.
+                if (node.name in {"button", "input", "link", "select", "textarea"}
                         and any(c in {"outline-none", "outline-0", "ring-0"} for c in utilities)
                         and not any("focus-visible:" in c and c.rsplit(":", 1)[-1]
                                     not in {"outline-none", "outline-0", "ring-0"}
@@ -1050,6 +1074,17 @@ class Checker:
             elif k in ("start", "reversed") and name != "ol":
                 self._d("E-ATTR-TARGET", Severity.ERROR,
                         "'%s:' is only supported on 'ol'" % k, node, None)
+            elif k == "pressed" and name != "button":
+                # action-40 (Toggle). `pressed:` is a button's toggle state
+                # (aria-pressed); on any other element it contradicts the
+                # element's role. vlbuild refuses it too (E-PRESSED-TARGET);
+                # the checker must agree or the write -> check -> repair
+                # loop passes source the build then rejects.
+                self._d("E-ATTR-TARGET", Severity.ERROR,
+                        "'pressed:' is only supported on 'button' -- it is a "
+                        "toggle button's on/off state (aria-pressed), and on "
+                        "'%s' it would contradict the element's role" % name,
+                        node, "use a 'button' with 'pressed:' for a toggle")
             elif k == "cite" and name not in ("blockquote", "q"):
                 self._d("E-ATTR-TARGET", Severity.ERROR,
                         "'cite:' is only supported on 'blockquote' and 'q'",
@@ -1059,6 +1094,85 @@ class Checker:
         self._table_element(node, parent_el)
         self._media_element(node, parent_el)
         self._global_and_style_surface(node, parent_el)
+        self._unknown_attrs(node)
+
+    def _unknown_attrs(self, node) -> None:
+        """`E-ATTR-UNKNOWN`: an attribute no rule gives a meaning to.
+        vlbuild refuses these (`Emitter._apply_attr`); until this rule the
+        checker passed them, so `row wrap:true` checked clean and then failed
+        the build. `attr_is_known` holds the emitter's name list, and a
+        vlbuild test sweeps it against the real emitter."""
+        name = node.name
+        if name not in NATIVE_ELEMENT_TAGS or name in SPECIAL_ELEMENT_NAMES:
+            return
+        axes = self._recipe_axes_for(node)
+        for k, _v in node.attrs:
+            if attr_is_known(name, k):
+                continue
+            if axes is None or k in axes:
+                # A recipe's style axis, or a recipes.vl this pass cannot
+                # read: the build decides.
+                continue
+            if any(d.severity == Severity.ERROR and d.start == node.start
+                   and ("'%s:'" % k) in d.message for d in self.diags):
+                continue   # an earlier rule already refused this attribute
+            self._d("E-ATTR-UNKNOWN", Severity.ERROR,
+                    "unknown attribute '%s:' on '%s' -- Volaro has no contract "
+                    "for it, and the build refuses it" % (k, name), node,
+                    "check the spelling, or see the supported attribute list "
+                    "for '%s'" % name)
+
+    def _recipe_axes_for(self, node):
+        """The style-axis names of the recipe this element uses, as the
+        build resolves them (vlbuild style_config.recipe_for): recipes in this
+        file, in a recipes.vl beside it, or in the project's root recipes.vl
+        for a file under app/. None when a recipes.vl does not parse."""
+        recipes = self._recipes()
+        if recipes is None:
+            return None
+        key = name = node.name
+        if name == "input":
+            for k, v in node.attrs:
+                if k == "type" and isinstance(v, A.Name) and v.id in ("checkbox", "radio"):
+                    key = v.id
+        return recipes.get(key, frozenset())
+
+    def _recipes(self):
+        if hasattr(self, "_recipe_cache"):
+            return self._recipe_cache
+        mods = [self._module]
+        here = os.path.dirname(os.path.abspath(self.filename))
+        dirs = [here]
+        d = here
+        while os.path.dirname(d) != d:
+            if os.path.basename(d) == "app":
+                dirs.append(os.path.dirname(d))
+                break
+            d = os.path.dirname(d)
+        for d in dict.fromkeys(dirs):
+            path = os.path.join(d, "recipes.vl")
+            if os.path.abspath(path) == os.path.abspath(self.filename) \
+                    or not os.path.isfile(path):
+                continue
+            from .lexer import Lexer
+            from .parser import Parser
+            with open(path, encoding="utf-8") as fh:
+                src = fh.read()
+            lx = Lexer(src, path)
+            ps = Parser(lx.lex(), src, path)
+            mod = ps.parse_module()
+            if any(x.severity == Severity.ERROR for x in list(lx.diags) + list(ps.diags)):
+                self._recipe_cache = None
+                return None
+            mods.append(mod)
+        out: dict[str, set] = {}
+        for mod in mods:
+            for r in (x for x in mod.items if isinstance(x, A.RecipeDecl)):
+                for row in r.body:
+                    if row.head not in ("base", "default") and row.tokens:
+                        out.setdefault(r.primitive, set()).add(row.tokens[0])
+        self._recipe_cache = out
+        return out
 
     # -- inline text and links (action-45.4) ---------------------------------
     def _inline_element(self, node) -> None:
@@ -1965,10 +2079,13 @@ class Checker:
                         "'spellcheck:' is the literal 'true' or 'false'",
                         node, "spellcheck:false")
 
-        if "title" in attrs and name not in TITLE_HOME:
+        if "title" in attrs and name not in TITLE_HOME and name != "dialog":
             # A warning, not an error. It is genuinely harmless as
             # supplementary text and 45.3 already documented it in the global
             # set, so an error would break existing source for no safety gain.
+            # `dialog title:` is not a tooltip: spec §8.8 requires it
+            # (E-DIALOG-TITLE) and the build makes it the dialog's heading and
+            # accessible name.
             self._d("W-TITLE-TOOLTIP", Severity.WARNING,
                     "'title:' on '%s' is a tooltip: it is not shown on a touch "
                     "device at all, is not reachable by keyboard, and most "
@@ -2535,6 +2652,43 @@ class Checker:
                                 "to carry it", ep,
                                 f"add '{p.name}' to the 'query' line, or '{{{p.name}}}' to the path")
 
+    def api_base(self, mod: A.Module) -> None:
+        # An outbound `base` is joined to each endpoint's `path` with exactly
+        # one `/` between them (spec section 9). A base that cannot join
+        # safely is refused here, before the build: `base "/"` with
+        # `path "/api/login"` used to produce `//api/login`, which a browser
+        # sends to a host named `api` -- with the login body. A bare host or
+        # a relative path is refused for the same reason: it resolves
+        # against whatever page is open. vlbuild's `normalize_api_base` is
+        # the fail-closed backstop with the same rule.
+        for it in mod.items:
+            if not isinstance(it, A.ApiDecl):
+                continue
+            for d in it.settings:
+                if not isinstance(d, A.Directive) or d.head != "base":
+                    continue
+                rest = d.tokens[1:] if d.tokens and d.tokens[0] == "base" else list(d.tokens)
+                raw = rest[0] if rest else ""
+                if len(raw) >= 2 and raw[0] == '"' and raw[-1] == '"':
+                    raw = raw[1:-1]
+                b = raw.strip()
+                if b == "":
+                    continue
+                if b.startswith("//"):
+                    why = ("starts with '//', which a browser reads as a URL on "
+                           "another host (protocol-relative), not a path on this origin")
+                elif b.startswith("/") or re.match(r"^https?://[^/?#\s]+", b):
+                    if "?" not in b and "#" not in b:
+                        continue
+                    why = "must not carry a query string or fragment"
+                else:
+                    why = ("must be an absolute http(s):// URL or a same-origin path "
+                           "starting with '/'")
+                self._d("E-API-BASE", Severity.ERROR,
+                        f"'api {it.name}' base \"{b}\" {why}", d,
+                        'base "/"  (this origin; joined to each path with one /)  '
+                        'or  base "https://api.example.com/v1"')
+
     # -- page.server.vl (spec section 10.2) ----------------------------------
     _PS_WRITE_METHODS = ("post", "put", "patch", "delete")
 
@@ -2624,13 +2778,18 @@ class Checker:
     # -- semantic (scoped) ---------------------------------------------
     def semantic(self, mod: A.Module) -> None:
         top = set(BUILTINS) | set(_PRIM_NAMES)
+        # names the module itself declares or imports: a call to one of these
+        # is the author's own function, never the builtin of the same name
+        self._module_names = set()
         for it in mod.items:
             nm = getattr(it, "name", None)
             if nm:
                 top.add(nm)
+                self._module_names.add(nm)
             if isinstance(it, A.Use):
                 for n in it.names:
                     top.add(n)
+                    self._module_names.add(n)
                 base = it.path.replace("./", "").replace("../", "")
                 base = base.split("/")[-1].split(".")[-1]
                 if base:
@@ -2646,20 +2805,28 @@ class Checker:
 
         for it in mod.items:
             if isinstance(it, A.FnDecl):
-                scope = {p.name for p in it.params}
+                scope = _Scope((p.name for p in it.params), "function parameter")
+                self._emitted = False
                 self._scoped(it.body, [top, scope], fallible=_fallible(it.ret))
+                self._emitted = True
             elif isinstance(it, A.ViewDecl):
-                scope = {p.name for p in it.params} | {"session"}
+                scope = _Scope((p.name for p in it.params), "parameter")
+                scope.bind("session", "session")
                 for s in it.body:
-                    if isinstance(s, (A.StateDecl, A.DeriveDecl, A.LoadDecl)):
-                        scope.add(s.name)
+                    if isinstance(s, A.StateDecl):
+                        scope.bind(s.name, "state")
+                    elif isinstance(s, A.DeriveDecl):
+                        scope.bind(s.name, "derive")
+                    elif isinstance(s, A.LoadDecl):
+                        scope.bind(s.name, "load result")
                 self._scoped(it.body, [top, scope], fallible=True)
             elif isinstance(it, A.ServiceDecl):
                 for r in it.routes:
-                    scope = {p.name for p in r.params} | {"session"}
+                    scope = _Scope((p.name for p in r.params), "route parameter")
+                    scope.bind("session", "session")
                     for seg in r.path.split("/"):
                         if seg.startswith(":"):
-                            scope.add(seg[1:])
+                            scope.bind(seg[1:], "route parameter")
                     self._scoped(r.body, [top, scope], fallible=_fallible(r.ret))
 
     def _resolve(self, name: str, scopes: list[set]) -> bool:
@@ -2686,9 +2853,12 @@ class Checker:
         if isinstance(st, A.Let):
             self._expr(st.init, scopes, fallible)
             self._declare(st.name, scopes, st)
+            if st.name and st.name != "?" and isinstance(scopes[-1], _Scope):
+                scopes[-1].kinds[st.name] = "mutable let" if st.mut else "`let` binding"
         elif isinstance(st, A.Assign):
             self._expr(st.target, scopes, fallible)
             self._expr(st.value, scopes, fallible)
+            self._check_assign(st, scopes)
         elif isinstance(st, A.ExprStmt):
             self._expr(st.expr, scopes, fallible)
         elif isinstance(st, A.Return):
@@ -2703,13 +2873,13 @@ class Checker:
         elif isinstance(st, A.Match):
             self._expr(st.subject, scopes, fallible)
             for pat, guard, body in st.arms:
-                inner = scopes + [set(getattr(pat, "binds", []))]
+                inner = scopes + [_Scope(getattr(pat, "binds", []), "match binding")]
                 if guard is not None:
                     self._expr(guard, inner, fallible)
                 self._block(body, inner, fallible, in_loop)
         elif isinstance(st, A.For):
             self._expr(st.iter, scopes, fallible)
-            inner = scopes + [set(st.vars)]
+            inner = scopes + [_Scope(st.vars, "loop variable")]
             self._scoped(st.body, inner, fallible, in_loop=True)
         elif isinstance(st, A.While):
             self._expr(st.cond, scopes, fallible)
@@ -2721,7 +2891,7 @@ class Checker:
         elif isinstance(st, A.Try):
             self._expr(st.expr, scopes, fallible)
             for pat, body in st.catches:
-                inner = scopes + [set(getattr(pat, "binds", []))]
+                inner = scopes + [_Scope(getattr(pat, "binds", []), "catch binding")]
                 self._scoped(body, inner, fallible, in_loop)
         elif isinstance(st, (A.Break, A.Skip)):
             if not in_loop:
@@ -2737,14 +2907,15 @@ class Checker:
         elif isinstance(st, A.LoadDecl):
             self._expr(st.expr, scopes, fallible)
             self._scoped(st.pending, scopes, fallible)
-            inner = scopes + [{st.error_name}] if st.error_name else scopes
+            inner = (scopes + [_Scope([st.error_name], "load error")]
+                     if st.error_name else scopes)
             self._scoped(st.error_body, inner, fallible)
         elif isinstance(st, A.OnBlock):
-            inner = scopes + [set(st.args)]
+            inner = scopes + [_Scope(st.args, "handler argument")]
             self._scoped(st.body, inner, fallible, in_loop=False)
         elif isinstance(st, A.ListBlock):
             self._expr(st.src, scopes, fallible)
-            inner = scopes + [{st.var}]
+            inner = scopes + [_Scope([st.var], "list variable")]
             if st.key is not None:
                 self._expr(st.key, inner, fallible)
             self._scoped(st.body, inner, fallible, in_loop=False)
@@ -2760,8 +2931,60 @@ class Checker:
                 if isinstance(node, A.Name):
                     self._use(node, scopes)
 
+    def _check_builtin_call(self, call, scopes: list[set]) -> None:
+        """A bare call to an allowlisted name the build cannot lower compiles
+        to an undefined JS function (action-48). Skipped when the name is the
+        author's own: a local binding or a module declaration or import."""
+        callee = call.callee
+        if not isinstance(callee, A.Name):
+            return
+        nm = callee.id
+        if nm in self._module_names or any(nm in s for s in scopes[1:]):
+            return
+        if nm in _METHOD_ONLY:
+            self._d("E-METHOD-AS-FN", Severity.ERROR,
+                    "'%s' is a method, not a function -- `%s(...)` compiles to "
+                    "an undefined function and throws when the page runs"
+                    % (nm, nm), call, "call it on the value: `%s`" % _METHOD_ONLY[nm])
+        elif nm in _FN_NOT_BUILT and self._emitted:
+            self._d("E-FN-NOT-BUILT", Severity.ERROR,
+                    "'%s' is in the spec but this build has no working `%s` -- "
+                    "the call compiles and throws when it runs" % (nm, nm),
+                    call, "use %s" % _FN_NOT_BUILT[nm])
+
+    def _check_assign(self, st, scopes: list[set]) -> None:
+        """Only a view `state` and a `let mut` can be reassigned (spec 5.1:
+        bindings are immutable unless declared `mut`). The binding that counts
+        is the one the name resolves to -- the innermost scope declaring it --
+        so a local that shadows a derive is judged as that local (issue #17).
+        A view `derive` / `load` value or parameter is recomputed, not stored:
+        assigning to one lowers to a dead JS statement. A loop variable lowers
+        to a JS `const`, so assigning to one throws at runtime."""
+        tgt = getattr(st, "target", None)
+        if not isinstance(tgt, A.Name):
+            return
+        nm = tgt.id
+        owner = next((s for s in reversed(scopes) if nm in s), None)
+        kind = getattr(owner, "kinds", {}).get(nm)
+        if kind is None or kind in _ASSIGNABLE:
+            return  # module-level / builtin names are not judged here
+        if kind in _READONLY_VIEW:
+            self._d("E-ASSIGN-READONLY", Severity.ERROR,
+                    "'%s' is a %s and cannot be assigned to -- it is "
+                    "recomputed, not stored. Declare a `state` for a "
+                    "value you change." % (nm, kind),
+                    st, None)
+            return
+        fix = ("declare it `let mut %s = ...`" % nm if kind == "`let` binding" else
+               "copy it into a new binding first -- `let mut next = %s` -- "
+               "and assign to that" % nm)
+        self._d("E-ASSIGN-IMMUTABLE", Severity.ERROR,
+                "'%s' is a %s and cannot be reassigned -- bindings are "
+                "immutable unless declared `let mut`." % (nm, kind),
+                st, fix)
+
     def _block(self, stmts, scopes: list[set], fallible: bool, in_loop: bool = False) -> None:
-        self._scoped(stmts, scopes + [set()], fallible, in_loop)
+        self._scoped(stmts, scopes + [_Scope()], fallible, in_loop)
 
     def _expr(self, ex, scopes: list[set], fallible: bool) -> None:
         if ex is None:
@@ -2769,6 +2992,10 @@ class Checker:
         if isinstance(ex, A.Name):
             self._use(ex, scopes)
         elif isinstance(ex, A.Literal):
+            for nm in ex.interp_calls:
+                self._check_builtin_call(A.Call(start=ex.start, end=ex.end,
+                                                callee=A.Name(start=ex.start, end=ex.end, id=nm)),
+                                         scopes)
             if self.strict_names:
                 for n in ex.interp_names:
                     if not self._resolve(n, scopes):
@@ -2781,6 +3008,7 @@ class Checker:
             self._expr(ex.obj, scopes, fallible)
             self._expr(ex.index, scopes, fallible)
         elif isinstance(ex, A.Call):
+            self._check_builtin_call(ex, scopes)
             self._expr(ex.callee, scopes, fallible)
             for a in ex.args:
                 self._expr(a, scopes, fallible)
@@ -2807,12 +3035,12 @@ class Checker:
         elif isinstance(ex, A.MatchExpr):
             self._expr(ex.subject, scopes, fallible)
             for pat, guard, body in ex.arms:
-                inner = scopes + [set(getattr(pat, "binds", []))]
+                inner = scopes + [_Scope(getattr(pat, "binds", []), "match binding")]
                 if guard is not None:
                     self._expr(guard, inner, fallible)
                 self._scoped(body, inner, fallible)
         elif isinstance(ex, A.Closure):
-            inner = scopes + [{p.name for p in ex.params}]
+            inner = scopes + [_Scope((p.name for p in ex.params), "closure parameter")]
             if isinstance(ex.body, list):
                 self._scoped(ex.body, inner, fallible)
             else:
@@ -2837,6 +3065,25 @@ class Checker:
                 "check the name, or add the binding / import")
 
 
+class _Scope(set):
+    """One lexical scope for semantic(): the names it binds, and each name's
+    binding kind (what an assignment to it is judged by)."""
+
+    def __init__(self, names=(), kind: str | None = None) -> None:
+        super().__init__(names)
+        self.kinds: dict[str, str] = {n: kind for n in self} if kind else {}
+
+    def bind(self, name: str, kind: str) -> None:
+        self.add(name)
+        self.kinds[name] = kind
+
+
+# binding kinds an assignment may target
+_ASSIGNABLE = {"state", "mutable let"}
+# view values that are recomputed, not stored (E-ASSIGN-READONLY)
+_READONLY_VIEW = {"parameter", "derive", "load result"}
+
+
 def _fallible(tref) -> bool:
     return isinstance(tref, A.TypeRef) and tref.fallible