volaro 0.1.0-alpha.5 → 0.1.0-alpha.7

package/README.md

@@ -1,6 +1,6 @@
 # Volaro
 
-**Limited alpha** (this is `0.1.0-alpha.5`), published under both the
+**Limited alpha** (this is `0.1.0-alpha.7`), published under both the
 `latest` and `alpha` dist-tags: `npm install volaro`.
 
 Volaro is an experimental application language intended for AI authoring and
@@ -154,9 +154,9 @@ use them.
 **Form controls:** `input` (a full type matrix, including `checkbox`/`radio`
 binding a `checked` state), `textarea`, `select`/`option`/`optgroup`,
 `fieldset`/`legend`, `datalist`, `button`, `link`. `disabled:` works on
-`button input textarea select fieldset optgroup option`. There is no
-standalone `label` element and no semantic `switch`/`aria-pressed` toggle —
-model one as a `button` reading a `state` bool. `variant:` is a literal
+`button input textarea select fieldset optgroup option`. A toggle is
+`button pressed:<bool>` (a toggle button, `aria-pressed`; there is no
+`switch` role). There is no standalone `label` element. `variant:` is a literal
 style name, not a computed expression. `if` used as an expression is binary
 (`if c a else b`); `match` and block `if` are statements only. A module-level
 `fn` is not available to a view. **`volaro supported` and `volaro crib` are

package/bin/vl.js

@@ -69,6 +69,11 @@ function pyInvocation(pp, moduleName, moduleArgs) {
     ...process.env,
     PYTHONPATH: [pp, VALIDATOR_PP, process.env.PYTHONPATH].filter(Boolean).join(delimiter),
     PYTHONDONTWRITEBYTECODE: "1",
+    // Diagnostics and build summaries contain non-ASCII (box drawing, arrows).
+    // Without this, Windows encodes a redirected stdout with the legacy code
+    // page and the compiler dies with UnicodeEncodeError; the capturing path
+    // below also decodes the child's output as UTF-8.
+    PYTHONIOENCODING: "utf-8",
   };
   return { cmd: py.cmd, argv: ["-B", "-m", moduleName, ...moduleArgs], env };
 }
@@ -771,8 +776,8 @@ choose the interpreter if \`python3\` is not the one you want.
 
 SHIPPED SUBSET: single page (no router); \`input\` (full type matrix incl.
 checkbox/radio), \`textarea\`, \`select\`/\`option\`/\`optgroup\`,
-\`fieldset\`/\`legend\`, \`datalist\`, \`button\`, \`link\` (no standalone
-\`label\`, no semantic switch/aria-pressed toggle); \`if\` as an expression is
+\`fieldset\`/\`legend\`, \`datalist\`, \`button\` (a toggle is \`button pressed:\`,
+aria-pressed; no switch role), \`link\` (no standalone \`label\`); \`if\` as an expression is
 binary; \`match\` is a statement; a module-level \`fn\` cannot be called from a
 view. \`volaro crib\` + \`volaro supported\` are authoritative for this build;
 \`volaro spec\` is the wider design, not what it accepts.

package/compiler/SOURCE_INFO.json

@@ -1,6 +1,6 @@
 {
-  "revision": "8c0952905f3449e5dc7c4fe75c2ba4b718b34148",
+  "revision": "3469656bab89d0e379c1e31cb19013a21fdef556",
   "source": "git",
   "dirty": false,
-  "content_sha256": "24266586ae4ce6a2122f6893b7b44cf1cf721c2e97785afe95751a8109a2cb7a"
+  "content_sha256": "656e9ef8c494c763da68868cf0f80ce509bf51bfd9e71b79ae153407eeb16e83"
 }

package/compiler/SOURCE_REV

@@ -1 +1 @@
-8c0952905f3449e5dc7c4fe75c2ba4b718b34148
+3469656bab89d0e379c1e31cb19013a21fdef556

package/compiler/validator/vlcheck/ast_nodes.py

@@ -370,6 +370,7 @@ class Literal(Node):
     kind: str = ""      # int float str bool nil duration
     raw: str = ""
     interp_names: list = field(default_factory=list)
+    interp_calls: list = field(default_factory=list)   # bare names called: "{len(xs)}"
 
 
 @dataclass

package/compiler/validator/vlcheck/checks.py

@@ -17,7 +17,7 @@ from .elements import (
     AUTOCOMPLETE_TOKENS, BUTTON_TYPES, ELEMENT_EVENTS, INPUT_TYPE_ATTRS,
     KNOWN_EVENTS,
     EXCLUSIVE_CHILDREN, EXCLUSIVE_PARENTS, NAMED_LANDMARKS,
-    NATIVE_ELEMENT_TAGS, OL_TYPES,
+    NATIVE_ELEMENT_TAGS, OL_TYPES, SPECIAL_ELEMENT_NAMES, attr_is_known,
     PHRASING_ELEMENTS, PHRASING_ONLY_PARENTS, TEXT_ARG_ELEMENTS,
     VOID_ELEMENTS,
     BDI_DIRS, BDO_DIRS, INTERACTIVE_ELEMENTS, LINK_RELS, LINK_TARGETS,
@@ -66,6 +66,23 @@ BUILTINS = {
 BUILTINS.update(ELEMENT_NAMES)
 _PRIM_NAMES = {"int", "float", "str", "bool", "bytes", "time", "dur", "uuid", "json", "nil"}
 
+# Names on the BUILTINS allowlist that are methods in the language, never free
+# functions. A bare call (`len(xs)`) passed --resolve and was emitted verbatim,
+# an undefined JS function: ReferenceError at load (action-48).
+_METHOD_ONLY = {
+    "len": "xs.len()", "format": "value.format(pattern)",
+    "reload": "posts.reload()", "loading": "posts.loading()",
+}
+# Free functions the spec shows but no emitter lowers as a bare call (not in
+# vlbuild's STD_FNS). Only an error where the build emits the call -- a view
+# or a service route; a module-level `fn` body is never emitted into either.
+_FN_NOT_BUILT = {
+    "sorted": "sort_by(xs, fn(x) x)", "first": "xs[0] (check xs.len() > 0 first)",
+    "fold": "a `for` loop over a `let mut` accumulator",
+    "merge": "a record literal naming every field",
+    "to_int": "no string-to-int conversion is built yet; keep the value an int",
+}
+
 # `use std.X { name, ... }` names `vlbuild` actually lowers to a working call
 # -- NOT the same list as `BUILTINS` above (that one is a generous, deliberately
 # loose allowlist for the W-UNDEF-NAME heuristic, and includes several names,
@@ -246,6 +263,11 @@ class Checker:
         # keeps a `alt_todo:` / other TODO marker out of a shipped build.
         self.release = release
         self.diags: list[Diagnostic] = []
+        # semantic(): names the module declares or imports, and whether the
+        # code being walked is emitted by the build (views, routes) or not
+        # (module-level fn bodies)
+        self._module_names: set[str] = set()
+        self._emitted = True
 
     # -- emit ----------------------------------------------------------
     def _d(self, code: str, sev: Severity, msg: str, node, fix: str | None = None) -> None:
@@ -255,6 +277,7 @@ class Checker:
 
     def run(self, mod: A.Module) -> list[Diagnostic]:
         from .test_ids import check_test_ids
+        self._module = mod
         self.diags.extend(check_test_ids(mod, self.filename))
         self.structural(mod)
         self.styling(mod)
@@ -266,6 +289,7 @@ class Checker:
         self.children_marker(mod)
         self.services(mod)
         self.api_params(mod)
+        self.api_base(mod)
         self.imports(mod)
         self.semantic(mod)
         return self.diags
@@ -327,17 +351,12 @@ class Checker:
                 elif isinstance(node, A.For):
                     value_names.update(getattr(node, "vars", []) or [])
 
+            # (1) is checked by semantic(), whose walker scopes names
+            # lexically: an assignment to a list/for var, closure or handler
+            # parameter, match/catch bind or `let` that shadows a readonly
+            # name writes that local, not the view-level value (issue #17).
             for node in _walk(it.body):
-                if isinstance(node, A.Assign):
-                    tgt = getattr(node, "target", None)
-                    nm = tgt.id if isinstance(tgt, A.Name) else None
-                    if nm in readonly:
-                        self._d("E-ASSIGN-READONLY", Severity.ERROR,
-                                "'%s' is a %s and cannot be assigned to -- it is "
-                                "recomputed, not stored. Declare a `state` for a "
-                                "value you change." % (nm, readonly[nm]),
-                                node, None)
-                elif isinstance(node, A.Element):
+                if isinstance(node, A.Element):
                     for k, v in node.attrs:
                         if k != "variant":
                             continue
@@ -585,7 +604,10 @@ class Checker:
                 if any("[" in c and "]" in c for c in classes):
                     self._d("W-CLASS-ARBITRARY", Severity.WARNING,
                             "arbitrary values bypass the accessibility denylist", node)
-                if (node.name in {"button", "input", "link"}
+                # The same element set vlbuild's resolve_classes enforces; the
+                # two must agree or `vlcheck --resolve` passes source the build
+                # then rejects, and the write -> check -> repair loop breaks.
+                if (node.name in {"button", "input", "link", "select", "textarea"}
                         and any(c in {"outline-none", "outline-0", "ring-0"} for c in utilities)
                         and not any("focus-visible:" in c and c.rsplit(":", 1)[-1]
                                     not in {"outline-none", "outline-0", "ring-0"}
@@ -1052,6 +1074,17 @@ class Checker:
             elif k in ("start", "reversed") and name != "ol":
                 self._d("E-ATTR-TARGET", Severity.ERROR,
                         "'%s:' is only supported on 'ol'" % k, node, None)
+            elif k == "pressed" and name != "button":
+                # action-40 (Toggle). `pressed:` is a button's toggle state
+                # (aria-pressed); on any other element it contradicts the
+                # element's role. vlbuild refuses it too (E-PRESSED-TARGET);
+                # the checker must agree or the write -> check -> repair
+                # loop passes source the build then rejects.
+                self._d("E-ATTR-TARGET", Severity.ERROR,
+                        "'pressed:' is only supported on 'button' -- it is a "
+                        "toggle button's on/off state (aria-pressed), and on "
+                        "'%s' it would contradict the element's role" % name,
+                        node, "use a 'button' with 'pressed:' for a toggle")
             elif k == "cite" and name not in ("blockquote", "q"):
                 self._d("E-ATTR-TARGET", Severity.ERROR,
                         "'cite:' is only supported on 'blockquote' and 'q'",
@@ -1061,6 +1094,85 @@ class Checker:
         self._table_element(node, parent_el)
         self._media_element(node, parent_el)
         self._global_and_style_surface(node, parent_el)
+        self._unknown_attrs(node)
+
+    def _unknown_attrs(self, node) -> None:
+        """`E-ATTR-UNKNOWN`: an attribute no rule gives a meaning to.
+        vlbuild refuses these (`Emitter._apply_attr`); until this rule the
+        checker passed them, so `row wrap:true` checked clean and then failed
+        the build. `attr_is_known` holds the emitter's name list, and a
+        vlbuild test sweeps it against the real emitter."""
+        name = node.name
+        if name not in NATIVE_ELEMENT_TAGS or name in SPECIAL_ELEMENT_NAMES:
+            return
+        axes = self._recipe_axes_for(node)
+        for k, _v in node.attrs:
+            if attr_is_known(name, k):
+                continue
+            if axes is None or k in axes:
+                # A recipe's style axis, or a recipes.vl this pass cannot
+                # read: the build decides.
+                continue
+            if any(d.severity == Severity.ERROR and d.start == node.start
+                   and ("'%s:'" % k) in d.message for d in self.diags):
+                continue   # an earlier rule already refused this attribute
+            self._d("E-ATTR-UNKNOWN", Severity.ERROR,
+                    "unknown attribute '%s:' on '%s' -- Volaro has no contract "
+                    "for it, and the build refuses it" % (k, name), node,
+                    "check the spelling, or see the supported attribute list "
+                    "for '%s'" % name)
+
+    def _recipe_axes_for(self, node):
+        """The style-axis names of the recipe this element uses, as the
+        build resolves them (vlbuild style_config.recipe_for): recipes in this
+        file, in a recipes.vl beside it, or in the project's root recipes.vl
+        for a file under app/. None when a recipes.vl does not parse."""
+        recipes = self._recipes()
+        if recipes is None:
+            return None
+        key = name = node.name
+        if name == "input":
+            for k, v in node.attrs:
+                if k == "type" and isinstance(v, A.Name) and v.id in ("checkbox", "radio"):
+                    key = v.id
+        return recipes.get(key, frozenset())
+
+    def _recipes(self):
+        if hasattr(self, "_recipe_cache"):
+            return self._recipe_cache
+        mods = [self._module]
+        here = os.path.dirname(os.path.abspath(self.filename))
+        dirs = [here]
+        d = here
+        while os.path.dirname(d) != d:
+            if os.path.basename(d) == "app":
+                dirs.append(os.path.dirname(d))
+                break
+            d = os.path.dirname(d)
+        for d in dict.fromkeys(dirs):
+            path = os.path.join(d, "recipes.vl")
+            if os.path.abspath(path) == os.path.abspath(self.filename) \
+                    or not os.path.isfile(path):
+                continue
+            from .lexer import Lexer
+            from .parser import Parser
+            with open(path, encoding="utf-8") as fh:
+                src = fh.read()
+            lx = Lexer(src, path)
+            ps = Parser(lx.lex(), src, path)
+            mod = ps.parse_module()
+            if any(x.severity == Severity.ERROR for x in list(lx.diags) + list(ps.diags)):
+                self._recipe_cache = None
+                return None
+            mods.append(mod)
+        out: dict[str, set] = {}
+        for mod in mods:
+            for r in (x for x in mod.items if isinstance(x, A.RecipeDecl)):
+                for row in r.body:
+                    if row.head not in ("base", "default") and row.tokens:
+                        out.setdefault(r.primitive, set()).add(row.tokens[0])
+        self._recipe_cache = out
+        return out
 
     # -- inline text and links (action-45.4) ---------------------------------
     def _inline_element(self, node) -> None:
@@ -1967,10 +2079,13 @@ class Checker:
                         "'spellcheck:' is the literal 'true' or 'false'",
                         node, "spellcheck:false")
 
-        if "title" in attrs and name not in TITLE_HOME:
+        if "title" in attrs and name not in TITLE_HOME and name != "dialog":
             # A warning, not an error. It is genuinely harmless as
             # supplementary text and 45.3 already documented it in the global
             # set, so an error would break existing source for no safety gain.
+            # `dialog title:` is not a tooltip: spec §8.8 requires it
+            # (E-DIALOG-TITLE) and the build makes it the dialog's heading and
+            # accessible name.
             self._d("W-TITLE-TOOLTIP", Severity.WARNING,
                     "'title:' on '%s' is a tooltip: it is not shown on a touch "
                     "device at all, is not reachable by keyboard, and most "
@@ -2537,6 +2652,43 @@ class Checker:
                                 "to carry it", ep,
                                 f"add '{p.name}' to the 'query' line, or '{{{p.name}}}' to the path")
 
+    def api_base(self, mod: A.Module) -> None:
+        # An outbound `base` is joined to each endpoint's `path` with exactly
+        # one `/` between them (spec section 9). A base that cannot join
+        # safely is refused here, before the build: `base "/"` with
+        # `path "/api/login"` used to produce `//api/login`, which a browser
+        # sends to a host named `api` -- with the login body. A bare host or
+        # a relative path is refused for the same reason: it resolves
+        # against whatever page is open. vlbuild's `normalize_api_base` is
+        # the fail-closed backstop with the same rule.
+        for it in mod.items:
+            if not isinstance(it, A.ApiDecl):
+                continue
+            for d in it.settings:
+                if not isinstance(d, A.Directive) or d.head != "base":
+                    continue
+                rest = d.tokens[1:] if d.tokens and d.tokens[0] == "base" else list(d.tokens)
+                raw = rest[0] if rest else ""
+                if len(raw) >= 2 and raw[0] == '"' and raw[-1] == '"':
+                    raw = raw[1:-1]
+                b = raw.strip()
+                if b == "":
+                    continue
+                if b.startswith("//"):
+                    why = ("starts with '//', which a browser reads as a URL on "
+                           "another host (protocol-relative), not a path on this origin")
+                elif b.startswith("/") or re.match(r"^https?://[^/?#\s]+", b):
+                    if "?" not in b and "#" not in b:
+                        continue
+                    why = "must not carry a query string or fragment"
+                else:
+                    why = ("must be an absolute http(s):// URL or a same-origin path "
+                           "starting with '/'")
+                self._d("E-API-BASE", Severity.ERROR,
+                        f"'api {it.name}' base \"{b}\" {why}", d,
+                        'base "/"  (this origin; joined to each path with one /)  '
+                        'or  base "https://api.example.com/v1"')
+
     # -- page.server.vl (spec section 10.2) ----------------------------------
     _PS_WRITE_METHODS = ("post", "put", "patch", "delete")
 
@@ -2626,13 +2778,18 @@ class Checker:
     # -- semantic (scoped) ---------------------------------------------
     def semantic(self, mod: A.Module) -> None:
         top = set(BUILTINS) | set(_PRIM_NAMES)
+        # names the module itself declares or imports: a call to one of these
+        # is the author's own function, never the builtin of the same name
+        self._module_names = set()
         for it in mod.items:
             nm = getattr(it, "name", None)
             if nm:
                 top.add(nm)
+                self._module_names.add(nm)
             if isinstance(it, A.Use):
                 for n in it.names:
                     top.add(n)
+                    self._module_names.add(n)
                 base = it.path.replace("./", "").replace("../", "")
                 base = base.split("/")[-1].split(".")[-1]
                 if base:
@@ -2648,20 +2805,28 @@ class Checker:
 
         for it in mod.items:
             if isinstance(it, A.FnDecl):
-                scope = {p.name for p in it.params}
+                scope = _Scope((p.name for p in it.params), "function parameter")
+                self._emitted = False
                 self._scoped(it.body, [top, scope], fallible=_fallible(it.ret))
+                self._emitted = True
             elif isinstance(it, A.ViewDecl):
-                scope = {p.name for p in it.params} | {"session"}
+                scope = _Scope((p.name for p in it.params), "parameter")
+                scope.bind("session", "session")
                 for s in it.body:
-                    if isinstance(s, (A.StateDecl, A.DeriveDecl, A.LoadDecl)):
-                        scope.add(s.name)
+                    if isinstance(s, A.StateDecl):
+                        scope.bind(s.name, "state")
+                    elif isinstance(s, A.DeriveDecl):
+                        scope.bind(s.name, "derive")
+                    elif isinstance(s, A.LoadDecl):
+                        scope.bind(s.name, "load result")
                 self._scoped(it.body, [top, scope], fallible=True)
             elif isinstance(it, A.ServiceDecl):
                 for r in it.routes:
-                    scope = {p.name for p in r.params} | {"session"}
+                    scope = _Scope((p.name for p in r.params), "route parameter")
+                    scope.bind("session", "session")
                     for seg in r.path.split("/"):
                         if seg.startswith(":"):
-                            scope.add(seg[1:])
+                            scope.bind(seg[1:], "route parameter")
                     self._scoped(r.body, [top, scope], fallible=_fallible(r.ret))
 
     def _resolve(self, name: str, scopes: list[set]) -> bool:
@@ -2688,9 +2853,12 @@ class Checker:
         if isinstance(st, A.Let):
             self._expr(st.init, scopes, fallible)
             self._declare(st.name, scopes, st)
+            if st.name and st.name != "?" and isinstance(scopes[-1], _Scope):
+                scopes[-1].kinds[st.name] = "mutable let" if st.mut else "`let` binding"
         elif isinstance(st, A.Assign):
             self._expr(st.target, scopes, fallible)
             self._expr(st.value, scopes, fallible)
+            self._check_assign(st, scopes)
         elif isinstance(st, A.ExprStmt):
             self._expr(st.expr, scopes, fallible)
         elif isinstance(st, A.Return):
@@ -2705,13 +2873,13 @@ class Checker:
         elif isinstance(st, A.Match):
             self._expr(st.subject, scopes, fallible)
             for pat, guard, body in st.arms:
-                inner = scopes + [set(getattr(pat, "binds", []))]
+                inner = scopes + [_Scope(getattr(pat, "binds", []), "match binding")]
                 if guard is not None:
                     self._expr(guard, inner, fallible)
                 self._block(body, inner, fallible, in_loop)
         elif isinstance(st, A.For):
             self._expr(st.iter, scopes, fallible)
-            inner = scopes + [set(st.vars)]
+            inner = scopes + [_Scope(st.vars, "loop variable")]
             self._scoped(st.body, inner, fallible, in_loop=True)
         elif isinstance(st, A.While):
             self._expr(st.cond, scopes, fallible)
@@ -2723,7 +2891,7 @@ class Checker:
         elif isinstance(st, A.Try):
             self._expr(st.expr, scopes, fallible)
             for pat, body in st.catches:
-                inner = scopes + [set(getattr(pat, "binds", []))]
+                inner = scopes + [_Scope(getattr(pat, "binds", []), "catch binding")]
                 self._scoped(body, inner, fallible, in_loop)
         elif isinstance(st, (A.Break, A.Skip)):
             if not in_loop:
@@ -2739,14 +2907,15 @@ class Checker:
         elif isinstance(st, A.LoadDecl):
             self._expr(st.expr, scopes, fallible)
             self._scoped(st.pending, scopes, fallible)
-            inner = scopes + [{st.error_name}] if st.error_name else scopes
+            inner = (scopes + [_Scope([st.error_name], "load error")]
+                     if st.error_name else scopes)
             self._scoped(st.error_body, inner, fallible)
         elif isinstance(st, A.OnBlock):
-            inner = scopes + [set(st.args)]
+            inner = scopes + [_Scope(st.args, "handler argument")]
             self._scoped(st.body, inner, fallible, in_loop=False)
         elif isinstance(st, A.ListBlock):
             self._expr(st.src, scopes, fallible)
-            inner = scopes + [{st.var}]
+            inner = scopes + [_Scope([st.var], "list variable")]
             if st.key is not None:
                 self._expr(st.key, inner, fallible)
             self._scoped(st.body, inner, fallible, in_loop=False)
@@ -2762,8 +2931,60 @@ class Checker:
                 if isinstance(node, A.Name):
                     self._use(node, scopes)
 
+    def _check_builtin_call(self, call, scopes: list[set]) -> None:
+        """A bare call to an allowlisted name the build cannot lower compiles
+        to an undefined JS function (action-48). Skipped when the name is the
+        author's own: a local binding or a module declaration or import."""
+        callee = call.callee
+        if not isinstance(callee, A.Name):
+            return
+        nm = callee.id
+        if nm in self._module_names or any(nm in s for s in scopes[1:]):
+            return
+        if nm in _METHOD_ONLY:
+            self._d("E-METHOD-AS-FN", Severity.ERROR,
+                    "'%s' is a method, not a function -- `%s(...)` compiles to "
+                    "an undefined function and throws when the page runs"
+                    % (nm, nm), call, "call it on the value: `%s`" % _METHOD_ONLY[nm])
+        elif nm in _FN_NOT_BUILT and self._emitted:
+            self._d("E-FN-NOT-BUILT", Severity.ERROR,
+                    "'%s' is in the spec but this build has no working `%s` -- "
+                    "the call compiles and throws when it runs" % (nm, nm),
+                    call, "use %s" % _FN_NOT_BUILT[nm])
+
+    def _check_assign(self, st, scopes: list[set]) -> None:
+        """Only a view `state` and a `let mut` can be reassigned (spec 5.1:
+        bindings are immutable unless declared `mut`). The binding that counts
+        is the one the name resolves to -- the innermost scope declaring it --
+        so a local that shadows a derive is judged as that local (issue #17).
+        A view `derive` / `load` value or parameter is recomputed, not stored:
+        assigning to one lowers to a dead JS statement. A loop variable lowers
+        to a JS `const`, so assigning to one throws at runtime."""
+        tgt = getattr(st, "target", None)
+        if not isinstance(tgt, A.Name):
+            return
+        nm = tgt.id
+        owner = next((s for s in reversed(scopes) if nm in s), None)
+        kind = getattr(owner, "kinds", {}).get(nm)
+        if kind is None or kind in _ASSIGNABLE:
+            return  # module-level / builtin names are not judged here
+        if kind in _READONLY_VIEW:
+            self._d("E-ASSIGN-READONLY", Severity.ERROR,
+                    "'%s' is a %s and cannot be assigned to -- it is "
+                    "recomputed, not stored. Declare a `state` for a "
+                    "value you change." % (nm, kind),
+                    st, None)
+            return
+        fix = ("declare it `let mut %s = ...`" % nm if kind == "`let` binding" else
+               "copy it into a new binding first -- `let mut next = %s` -- "
+               "and assign to that" % nm)
+        self._d("E-ASSIGN-IMMUTABLE", Severity.ERROR,
+                "'%s' is a %s and cannot be reassigned -- bindings are "
+                "immutable unless declared `let mut`." % (nm, kind),
+                st, fix)
+
     def _block(self, stmts, scopes: list[set], fallible: bool, in_loop: bool = False) -> None:
-        self._scoped(stmts, scopes + [set()], fallible, in_loop)
+        self._scoped(stmts, scopes + [_Scope()], fallible, in_loop)
 
     def _expr(self, ex, scopes: list[set], fallible: bool) -> None:
         if ex is None:
@@ -2771,6 +2992,10 @@ class Checker:
         if isinstance(ex, A.Name):
             self._use(ex, scopes)
         elif isinstance(ex, A.Literal):
+            for nm in ex.interp_calls:
+                self._check_builtin_call(A.Call(start=ex.start, end=ex.end,
+                                                callee=A.Name(start=ex.start, end=ex.end, id=nm)),
+                                         scopes)
             if self.strict_names:
                 for n in ex.interp_names:
                     if not self._resolve(n, scopes):
@@ -2783,6 +3008,7 @@ class Checker:
             self._expr(ex.obj, scopes, fallible)
             self._expr(ex.index, scopes, fallible)
         elif isinstance(ex, A.Call):
+            self._check_builtin_call(ex, scopes)
             self._expr(ex.callee, scopes, fallible)
             for a in ex.args:
                 self._expr(a, scopes, fallible)
@@ -2809,12 +3035,12 @@ class Checker:
         elif isinstance(ex, A.MatchExpr):
             self._expr(ex.subject, scopes, fallible)
             for pat, guard, body in ex.arms:
-                inner = scopes + [set(getattr(pat, "binds", []))]
+                inner = scopes + [_Scope(getattr(pat, "binds", []), "match binding")]
                 if guard is not None:
                     self._expr(guard, inner, fallible)
                 self._scoped(body, inner, fallible)
         elif isinstance(ex, A.Closure):
-            inner = scopes + [{p.name for p in ex.params}]
+            inner = scopes + [_Scope((p.name for p in ex.params), "closure parameter")]
             if isinstance(ex.body, list):
                 self._scoped(ex.body, inner, fallible)
             else:
@@ -2839,6 +3065,25 @@ class Checker:
                 "check the name, or add the binding / import")
 
 
+class _Scope(set):
+    """One lexical scope for semantic(): the names it binds, and each name's
+    binding kind (what an assignment to it is judged by)."""
+
+    def __init__(self, names=(), kind: str | None = None) -> None:
+        super().__init__(names)
+        self.kinds: dict[str, str] = {n: kind for n in self} if kind else {}
+
+    def bind(self, name: str, kind: str) -> None:
+        self.add(name)
+        self.kinds[name] = kind
+
+
+# binding kinds an assignment may target
+_ASSIGNABLE = {"state", "mutable let"}
+# view values that are recomputed, not stored (E-ASSIGN-READONLY)
+_READONLY_VIEW = {"parameter", "derive", "load result"}
+
+
 def _fallible(tref) -> bool:
     return isinstance(tref, A.TypeRef) and tref.fallible
 

package/compiler/validator/vlcheck/elements.py

@@ -413,7 +413,11 @@ CONTROL_ATTRS = {
     }),
     "option": frozenset({"value", "label", "disabled"}),
     "optgroup": frozenset({"label", "disabled"}),
-    "button": frozenset({"type", "name", "value", "disabled", "aria_label"}),
+    # action-40 (Toggle): `pressed:` makes a button a WAI-ARIA toggle
+    # button (`aria-pressed` true/false). The primitive carries the
+    # semantics, so it is a contract here, not an aria passthrough.
+    "button": frozenset({"type", "name", "value", "disabled", "aria_label",
+                         "pressed"}),
     "fieldset": frozenset({"name", "disabled"}),
     "legend": frozenset(),
     "datalist": frozenset(),
@@ -1189,3 +1193,68 @@ ELEMENT_NAMES = frozenset(NATIVE_ELEMENT_TAGS) | SPECIAL_ELEMENT_NAMES
 # Hook support follows emission capability, not merely name recognition.
 TEST_ID_ELEMENT_NAMES = frozenset(NATIVE_ELEMENT_TAGS) | {"status"}
 TEST_SCOPE_ELEMENT_NAMES = TEST_ID_ELEMENT_NAMES | {"dialog", "tabs"}
+
+# ---- The attribute names the emitter lowers ------------------------------
+# vlbuild's `Emitter._apply_attr` ends in `E-ATTR-UNKNOWN` for any name none
+# of its branches claims. vlcheck must refuse the same names, or the
+# write -> check -> repair loop passes source the build then rejects
+# (`row wrap:true`). This is the list of names those branches claim; the
+# emitter-parity test in vlbuild/tests/test_build.py drives the real
+# `_apply_attr` over every element and every name here, so a new branch
+# there without an entry here fails the gates.
+#
+# Names a branch claims on ANY element. Reaching the branch may still be an
+# error (`gap:` on a `strong` is E-LAYOUT-TARGET), but it is not UNKNOWN.
+APPLY_ATTR_NAMES = (
+    frozenset(REFUSED_GLOBAL_ATTRS) | LAYOUT_STYLE_ATTRS | CELL_SPAN_ATTRS
+    | frozenset({
+        "hidden", "lang", "spellcheck", "dir", "test_id", "bind", "tabindex",
+        # vlbuild PX_KEYS, `weight`, `color`/`bg`, `align`, `justify`
+        "gap", "pad", "radius", "size", "max_w", "min_w", "w", "h",
+        "pad_x", "pad_y", "weight", "color", "bg", "align", "justify",
+        "to", "href", "target", "rel", "download", "scope", "open",
+        "datetime", "src", "srcset", "poster", "captions", "preload", "kind",
+        "srclang", "shape", "coords", "use_map", "crossorigin", "loading",
+        "decoding", "variant", "aria_label", "disabled", "pressed",
+        "read_only", "required", "multiple", "pre", "start", "reversed",
+        "cite", "autocomplete",
+        "type", "placeholder", "name", "id", "alt", "title", "fallback",
+        "value", "label", "min", "max", "step", "pattern", "accept",
+        "maxlength", "minlength", "list", "cols", "rows",
+    }))
+
+# Names a branch claims only on some elements; elsewhere they fall through
+# to E-ATTR-UNKNOWN.
+APPLY_ATTR_NAMES_ON = {
+    "span": lambda el: el in ("colgroup", "col"),
+    "low": lambda el: el in ("progress", "meter"),
+    "high": lambda el: el in ("progress", "meter"),
+    "optimum": lambda el: el in ("progress", "meter"),
+    "width": lambda el: el in ("img", "video"),
+    "height": lambda el: el in ("img", "video"),
+    "sizes": lambda el: el in ("img", "source"),
+    "media": lambda el: el == "source",
+}
+for _flag in MEDIA_FLAGS:
+    APPLY_ATTR_NAMES_ON[_flag] = (
+        lambda el: el in MEDIA_ATTRS or el == "img")
+
+# The attributes the emitter consumes before `_apply_attr` runs.
+FIELD_ELEMENTS = frozenset({"input", "textarea", "select"})
+
+
+def attr_is_known(el_name: str, k: str) -> bool:
+    """True when vlbuild lowers attribute `k` on native element `el_name`
+    (or refuses it with a more specific code), false when the build would
+    stop with E-ATTR-UNKNOWN. Recipe style axes and `class:` are the
+    caller's to exclude: they depend on the project's recipes."""
+    if k in ("class", "test_scope"):
+        return True
+    if el_name == "img" and k in ("alt", "alt_todo"):
+        return True
+    if el_name in FIELD_ELEMENTS and k in FIELD_A11Y_ATTRS:
+        return True
+    if k in APPLY_ATTR_NAMES:
+        return True
+    only = APPLY_ATTR_NAMES_ON.get(k)
+    return only is not None and only(el_name)