Hojun-Cho/ww

Author SHA1 Message Date

Author	SHA1	Message	Date
Hojun-Cho	26ba1ad1b5	wcc_ww/cgen+peellint: #109 close #101 primsize-alias family by construction Route the 16 routable bare-primsize GUARD sites (is-primitive / struct-vs-prim dispatch) through the #101 aliasprimsize SSoT helper. Byte-NEUTRAL by construction: an alias-narrow name is already neutralized downstream by the same arm, so routing emits no new asm (the empty-flip-set ken oracled). Shape-A exclude-prim-early (3): cgenutil sretretsize / structparamsize / structfloatclass — `primsize>0 return` then structlookup→nil returns the same value; route returns it early, same. Shape-B prim-guard-then-structlookup (13): cgenutil 4604/4650 + cgenexpr 4136/10244 + the 9-site CALL/assign cluster — primsize==0 →structlookup→nil→fall to normal; route skips the block→same normal. Install the peellint bare-primsize FINALE (B7 lint-fuse contract): tools/peellint now rejects any bare primsize() in the ww stage outside the annotated whitelist. Evasion-hardened per the B7 lesson — a character scan (comments + string/char literals stripped first) and a LEFT+RIGHT word-bounded match of the bare `primsize` TOKEN (not just `primsize(`), so the aliasprimsize() wrapper is never a hit and every compiling spelling reds: the call primsize(nm), the paren-wrap (primsize)(nm), the function-value bind `let p = primsize`, and any line-split. ww-only (the C stage dealiases via type_chase_named, no primsize symbol). Two independent exemption windows (peel-ok vs primsize-ok) so neither rule blinds the other. Runs as a make-test dep. Whitelist the 6 designed exemptions with primsize-ok WHY-annotations: machinery — aliasprimsize body (SSoT chase) \| typenodeprimresolved + exprprimresolved (#11/#33 prim-resolver chasers) \| cgcast leaf-loop + cgenexpr #11 deref-store (own ps==0 fallback; route would regress #11) \| the primsize oracle/definition itself (nothing below to chase). structural — elemsizeof x2 + paramfieldsize (chase lives in the -c twin elemsizeofc; threading c is the dormant #110). Empty-flip-set proof: zero C bytes; cstage binaries bit-identical; bootstrap byte-id 990-997 + 950 all green (w6c == w6c_ww on the full selfhost, self-rebuild identical); combined.ww (w6c + wwdump) regen idempotent; sizelint 0; peellint 0 (raw-peel AND bare-primsize over the whole tree = the close-by-construction proof, zero unwhitelisted survivors). Tests: 944_peellint_gate +14 rows (bare / space-before-paren / name-at-EOL split / string-blind opener / paren-wrap / fn-value-bind RED; aliasprimsize wrapper + primsize-ok annotated GREEN; corrupt annotation RED; independent peel/primsize windows; C-file out-of-scope). Closes the #101 primsize-alias family by construction. #109.	2026-06-06 13:06:37 +09:00
Hojun-Cho	4b118fa8f8	cgen: B7 emitter elem chases + tools/peellint gate — #5 alias-arc cs side closed by construction The last four raw `->under` reads outside the whitelist were the static-DATA emitters' ELEMENT-type single peels (the outer type already chased): emit_array_lit_bytes:14356, emit_strarray_data:14574, emit_slice_data:14788, let_pre_intern:15088 -> type_chase_named. :15088 is the :14574 row's label-order leg and must flip in the same commit or _S_ labels intern in emit order, not decl order (the in-tree comment at the site); the strarr row's byte-id is the coupling proof. Behavior moves (ken B7 first-position oracle + impl pre-state, all pre-observed at `05f7af7`): - [N]alias-struct + [N]alias-str globals graduate cs link-ERR ("undefined reference") -> 0/0 BYTE-ID (cs emits ww's DATAW). - zero-consumer latent silence closed: a never-referenced 2-level-elem-alias global silently lacked DATA (no reference, no link error); now emits, pinned by the byte-id cell. - []alias-str diagnostic routing: the alias escaped the 3-way slice-of-{str,slice,tagged} fatal onto the downstream "not a foldable constant" text — now the intended 3-way text (== control). - []alias-tagged DESIGNED NARROWING: the alias dodged the 3-way fatal ENTIRELY — cs silently accepted + RAN WRONG for reachable consumer shapes (review-verified at base: a len+payload-read probe exits 1; the len-only row was luck-correct). Now loud with the 3-way text; widen what the gate SEES, never what it ACCEPTS (B6-c2 precedent). - kb7_slc/slc0 scalar legs byte-NEUTRAL (the synthesized-array choke-point already handled them); full kb corpus sweep: movers are exactly the two graduation shapes, nothing else. tools/peellint (sizelint clone, dep of test/test-unit): character-scan strips comments and string/char literals, then matches the under-token accessor-spelling-wide — `->under`/`.under` in C (deref-dot is the same peel), `.under` in ww, optional whitespace after the operator, and the line-split continuation (operator at EOL, `under` next line). Scope cmd/wcc + cmd/w6c + selfhost/cmd/wcc + lib/ww (lib/ww/typ.ww ruled IN — it is type.c's ww mirror, the accessor layer itself); `peel-ok`/`peellint-ok` annotations exempt a 10-line window. Green at this tip = zero unwhitelisted raw peels survive; the gate lands in the commit that deletes the last raw read (the-funnel-completing-commit- carries-the-gate; sizelint precedent). Whitelist, 27 entries: cmd/wcc/type.c :78 :141 construction, :162 chase body, :180 :193 :214 recursive chase cmd/wcc/check.c :102 :2572 resolve-state probes, :2586 construction cmd/w6c/cgen.c :731 probe-cleared scan peel (B5-c1), :813/:814 :834/:835 peel-ok #218 variant-match lib/ww/typ.ww :316 construction, :374 :385 :410 :437 :447 :463 :475 :488 :514 recursive chase selfhost/cmd/wcc/cgenutil.ww :1302 chase body (tichase), :2759 probe-cleared peel selfhost/cmd/wcc/check.ww :1815 construction (peellint-ok) Negative validation wired into 944_peellint_gate (B4 precedent): re-introduced raw peel (C and ww spellings) REDS the lint; corrupted annotation (peel-okk-…, token-bounded matcher) REDS the lint; the check.ww:3683 "io.underread" prose, a code read of a longer field, and comment-quoted tokens are pinned green regression rows; real tree must lint clean. 944_alias_emit_b7_run pins all four emit paths table-driven (14 rows / 36 checks) incl. ken's ww observation cells (ww checker rejects slice-literal globals, "let: not assignable" — unmoved; plain []str louds at ww's own emitslicedata 3-way, pinned by the shared needle). REVIEW AMENDMENT (reviewer-B7, fix-what-you-find): the frozen tip's regex matcher passed five compiling evasion spellings green — `t -> under` spacing, `t->`/EOL + `under` next-line (both stages; ww parses `t.`/EOL too), C deref-dot `(*t).under`, ww `t. under`, and a string literal containing a block-comment opener that blinded the regex comment-strip for the rest of the file. The matcher is now a character scan (comments + string/char literals stripped before matching) with the widened token rule above; all six spellings are pinned RED rows in 944_peellint_gate (checks 10 -> 16). The 10-line annotation window stays as designed (a peel within an annotation's window is exempt by construction — the window IS the exemption mechanism). Lint + test bytes only; zero compiler-source bytes moved in review. What this does NOT close, said out loud (f2-ruling): a consumer that never spells `under` at all — a switch on t->kind that simply never peels — has no token for the lint to see. The accessor+lint closes the WRONG-PEEL class (single-peel where chase was needed) by construction; the NO-PEEL class is closed only at sites where classification routes through the internalized chasing helpers, and contained elsewhere by the acceptance-commit-carries-tripwires doctrine, which stays standing for every future acceptance widening. The gate does not make alias bugs impossible; it makes the four-times-burned shape unwritable. Rule-11 note: forced fuse — the four conversions ARE the last raw-read deletions; peellint cannot be green one commit earlier (consumer-graph -forces-the-fuse precedent, #61). Invariants: cs asm byte-NEUTRAL on the whole bootstrap corpus (five mains + smoke, base-input pre==post); five mains cs==ww byte-id at tip; _ww binary quartet bit-identical to the W2 baseline (ww changes are comment-only annotation bytes — codegen-inert, proven by the md5 hold); w6c_ww+wwdump main.combined.ww regen'd via make, idempotent; 989 lib ratchet zero flips (31 byte-id / 9 pinned-divergent / 3 pinned-wwreject across 43 units); sizelint 0; peellint 0; make test-unit "all 294 tests passed" (292 + the two new suites).	2026-06-06 06:05:46 +09:00
Hojun-Cho	f80927201b	tools/sizelint + CLAUDE.md rule 13: gate hardcoded size literals Drew's Hare-discipline framing: "no hardcoded size literals anywhere in the compiler." This session spent 32 commits sweeping after-the-fact and STILL kept introducing new bypass sites in our own structural work (A.5's tupleelemslot/fieldslotsize most recently). The cure is a gate that catches new violations at commit time, not a deeper sweep. tools/sizelint (sh+gawk): - Always-on: `.size = NN` / `->size = NN` / `prim(...,"name",NN,...)`. - Context-gated literals (NN(u64\|i64) and `return NN`) in files or fns matching size\|slot\|elem\|field\|stride\|paramfield\|tinfo\|primtype\| slotsize\|letemit\|tagged. - Allow-list via `// sizelint-ok: <reason>` or `/* sizelint-ok: ... */`. - Comment strip happens after allow-list match so prose mentions of 16/24 stay quiet. Makefile: `test: all sizelint $(TESTS)` so the gate runs before any binary builds. CLAUDE.md rule 13 documents the discipline + escape hatch + optional pre-commit-hook symlink. Audit caught 3 real cstage bugs (cmd/wcc/check.c resolve_type:1002, 1079, 1531 hardcoded `tt->size = 16` / `= 32` for tagged-with-ptr and tagged-with-slice payloads — should read `8 + sub.size`). Fixed inline; behavioral no-op today (pt->size=16, st->size=24, sub.size=24 match the prior literals) but the SSoT seam carries forward through #1/#34/#65. 8 SSoT-seed allow-lists added (cstage type.c ty_str/ty_slice prim factories; wwstage primtypesize/tyslicesize; lib/ww/typ.ww tystr + slice fields + their main.combined.ww mirrors). One amalloc-overalloc allow-list at lib/ww/typ.ww:273 cites pending #36 (typed amalloc). #66 filed for extending the filter once #65 routes lib/bytes + lib/getopt's sizeof(slice) / sizeof(option) literals through SSoT — naive line-pattern extension would false-positive on 22+ ELF wire- format sites in dynout.ww. 131/131 + 994 + 995 + bootstrap green with `make sizelint` exit 0.	2026-05-20 15:22:21 +09:00

Hojun-Cho

26ba1ad1b5

wcc_ww/cgen+peellint: #109 close #101 primsize-alias family by construction

Route the 16 routable bare-primsize GUARD sites (is-primitive /
struct-vs-prim dispatch) through the #101 aliasprimsize SSoT helper.
Byte-NEUTRAL by construction: an alias-narrow name is already
neutralized downstream by the same arm, so routing emits no new asm
(the empty-flip-set ken oracled).
  Shape-A exclude-prim-early (3): cgenutil sretretsize / structparamsize
    / structfloatclass — `primsize>0 return` then structlookup→nil
    returns the same value; route returns it early, same.
  Shape-B prim-guard-then-structlookup (13): cgenutil 4604/4650 +
    cgenexpr 4136/10244 + the 9-site CALL/assign cluster — primsize==0
    →structlookup→nil→fall to normal; route skips the block→same normal.

Install the peellint bare-primsize FINALE (B7 lint-fuse contract):
tools/peellint now rejects any bare primsize() in the ww stage outside
the annotated whitelist.  Evasion-hardened per the B7 lesson — a
character scan (comments + string/char literals stripped first) and a
LEFT+RIGHT word-bounded match of the bare `primsize` TOKEN (not just
`primsize(`), so the aliasprimsize() wrapper is never a hit and every
compiling spelling reds: the call primsize(nm), the paren-wrap
(primsize)(nm), the function-value bind `let p = primsize`, and any
line-split.  ww-only (the C stage dealiases via type_chase_named, no
primsize symbol).  Two independent exemption windows (peel-ok vs
primsize-ok) so neither rule blinds the other.  Runs as a make-test dep.

Whitelist the 6 designed exemptions with primsize-ok WHY-annotations:
  machinery — aliasprimsize body (SSoT chase) | typenodeprimresolved +
    exprprimresolved (#11/#33 prim-resolver chasers) | cgcast leaf-loop +
    cgenexpr #11 deref-store (own ps==0 fallback; route would regress
    #11) | the primsize oracle/definition itself (nothing below to chase).
  structural — elemsizeof x2 + paramfieldsize (chase lives in the -c
    twin elemsizeofc; threading c is the dormant #110).

Empty-flip-set proof: zero C bytes; cstage binaries bit-identical;
bootstrap byte-id 990-997 + 950 all green (w6c == w6c_ww on the full
selfhost, self-rebuild identical); combined.ww (w6c + wwdump) regen
idempotent; sizelint 0; peellint 0 (raw-peel AND bare-primsize over the
whole tree = the close-by-construction proof, zero unwhitelisted
survivors).  Tests: 944_peellint_gate +14 rows (bare / space-before-paren
/ name-at-EOL split / string-blind opener / paren-wrap / fn-value-bind
RED; aliasprimsize wrapper + primsize-ok annotated GREEN; corrupt
annotation RED; independent peel/primsize windows; C-file out-of-scope).

Closes the #101 primsize-alias family by construction.  #109.

2026-06-06 13:06:37 +09:00

Hojun-Cho

4b118fa8f8

cgen: B7 emitter elem chases + tools/peellint gate — #5 alias-arc cs side closed by construction

The last four raw `->under` reads outside the whitelist were the
static-DATA emitters' ELEMENT-type single peels (the outer type already
chased): emit_array_lit_bytes:14356, emit_strarray_data:14574,
emit_slice_data:14788, let_pre_intern:15088 -> type_chase_named.
:15088 is the :14574 row's label-order leg and must flip in the same
commit or _S_ labels intern in emit order, not decl order (the in-tree
comment at the site); the strarr row's byte-id is the coupling proof.

Behavior moves (ken B7 first-position oracle + impl pre-state, all
pre-observed at 05f7af7):
- [N]alias-struct + [N]alias-str globals graduate cs link-ERR
  ("undefined reference") -> 0/0 BYTE-ID (cs emits ww's DATAW).
- zero-consumer latent silence closed: a never-referenced
  2-level-elem-alias global silently lacked DATA (no reference, no
  link error); now emits, pinned by the byte-id cell.
- []alias-str diagnostic routing: the alias escaped the 3-way
  slice-of-{str,slice,tagged} fatal onto the downstream "not a
  foldable constant" text — now the intended 3-way text (== control).
- []alias-tagged DESIGNED NARROWING: the alias dodged the 3-way fatal
  ENTIRELY — cs silently accepted + RAN WRONG for reachable consumer
  shapes (review-verified at base: a len+payload-read probe exits 1;
  the len-only row was luck-correct). Now loud with the 3-way text;
  widen what the gate SEES, never what it ACCEPTS (B6-c2 precedent).
- kb7_slc/slc0 scalar legs byte-NEUTRAL (the synthesized-array
  choke-point already handled them); full kb corpus sweep: movers are
  exactly the two graduation shapes, nothing else.

tools/peellint (sizelint clone, dep of test/test-unit): character-scan
strips comments and string/char literals, then matches the under-token
accessor-spelling-wide — `->under`/`.under` in C (deref-dot is the
same peel), `.under` in ww, optional whitespace after the operator,
and the line-split continuation (operator at EOL, `under` next line).
Scope cmd/wcc + cmd/w6c + selfhost/cmd/wcc + lib/ww (lib/ww/typ.ww
ruled IN — it is type.c's ww mirror, the accessor layer itself);
`peel-ok`/`peellint-ok` annotations exempt a 10-line window. Green at
this tip = zero unwhitelisted raw peels survive; the gate lands in the
commit that deletes the last raw read (the-funnel-completing-commit-
carries-the-gate; sizelint precedent). Whitelist, 27 entries:
  cmd/wcc/type.c    :78 :141 construction, :162 chase body,
                    :180 :193 :214 recursive chase
  cmd/wcc/check.c   :102 :2572 resolve-state probes, :2586 construction
  cmd/w6c/cgen.c    :731 probe-cleared scan peel (B5-c1),
                    :813/:814 :834/:835 peel-ok #218 variant-match
  lib/ww/typ.ww     :316 construction, :374 :385 :410 :437 :447 :463
                    :475 :488 :514 recursive chase
  selfhost/cmd/wcc/cgenutil.ww :1302 chase body (tichase),
                    :2759 probe-cleared peel
  selfhost/cmd/wcc/check.ww    :1815 construction (peellint-ok)

Negative validation wired into 944_peellint_gate (B4 precedent):
re-introduced raw peel (C and ww spellings) REDS the lint; corrupted
annotation (peel-okk-…, token-bounded matcher) REDS the lint; the
check.ww:3683 "io.underread" prose, a code read of a longer field, and
comment-quoted tokens are pinned green regression rows; real tree must
lint clean. 944_alias_emit_b7_run pins all four emit paths
table-driven (14 rows / 36 checks) incl. ken's ww observation cells
(ww checker rejects slice-literal globals, "let: not assignable" —
unmoved; plain []str louds at ww's own emitslicedata 3-way, pinned by
the shared needle).

REVIEW AMENDMENT (reviewer-B7, fix-what-you-find): the frozen tip's
regex matcher passed five compiling evasion spellings green — `t ->
under` spacing, `t->`/EOL + `under` next-line (both stages; ww parses
`t.`/EOL too), C deref-dot `(*t).under`, ww `t. under`, and a string
literal containing a block-comment opener that blinded the regex
comment-strip for the rest of the file. The matcher is now a
character scan (comments + string/char literals stripped before
matching) with the widened token rule above; all six spellings are
pinned RED rows in 944_peellint_gate (checks 10 -> 16). The 10-line
annotation window stays as designed (a peel within an annotation's
window is exempt by construction — the window IS the exemption
mechanism). Lint + test bytes only; zero compiler-source bytes moved
in review.

What this does NOT close, said out loud (f2-ruling): a consumer that
never spells `under` at all — a switch on t->kind that simply never
peels — has no token for the lint to see. The accessor+lint closes the
WRONG-PEEL class (single-peel where chase was needed) by construction;
the NO-PEEL class is closed only at sites where classification routes
through the internalized chasing helpers, and contained elsewhere by
the acceptance-commit-carries-tripwires doctrine, which stays standing
for every future acceptance widening. The gate does not make alias
bugs impossible; it makes the four-times-burned shape unwritable.

Rule-11 note: forced fuse — the four conversions ARE the last raw-read
deletions; peellint cannot be green one commit earlier (consumer-graph
-forces-the-fuse precedent, #61).

Invariants: cs asm byte-NEUTRAL on the whole bootstrap corpus (five
mains + smoke, base-input pre==post); five mains cs==ww byte-id at
tip; _ww binary quartet bit-identical to the W2 baseline (ww changes
are comment-only annotation bytes — codegen-inert, proven by the md5
hold); w6c_ww+wwdump main.combined.ww regen'd via make, idempotent;
989 lib ratchet zero flips (31 byte-id / 9 pinned-divergent / 3
pinned-wwreject across 43 units); sizelint 0; peellint 0;
make test-unit "all 294 tests passed" (292 + the two new suites).

2026-06-06 06:05:46 +09:00

Hojun-Cho

f80927201b

tools/sizelint + CLAUDE.md rule 13: gate hardcoded size literals

Drew's Hare-discipline framing: "no hardcoded size literals anywhere in
the compiler." This session spent 32 commits sweeping after-the-fact
and STILL kept introducing new bypass sites in our own structural
work (A.5's tupleelemslot/fieldslotsize most recently). The cure is a
gate that catches new violations at commit time, not a deeper sweep.

tools/sizelint (sh+gawk):
- Always-on: `.size = NN` / `->size = NN` / `prim(...,"name",NN,...)`.
- Context-gated literals (NN(u64|i64) and `return NN`) in files or fns
  matching size|slot|elem|field|stride|paramfield|tinfo|primtype|
  slotsize|letemit|tagged.
- Allow-list via `// sizelint-ok: <reason>` or `/* sizelint-ok: ... */`.
- Comment strip happens after allow-list match so prose mentions of
  16/24 stay quiet.

Makefile: `test: all sizelint $(TESTS)` so the gate runs before any
binary builds.

CLAUDE.md rule 13 documents the discipline + escape hatch + optional
pre-commit-hook symlink.

Audit caught 3 real cstage bugs (cmd/wcc/check.c resolve_type:1002,
1079, 1531 hardcoded `tt->size = 16` / `= 32` for tagged-with-ptr and
tagged-with-slice payloads — should read `8 + sub.size`). Fixed
inline; behavioral no-op today (pt->size=16, st->size=24, sub.size=24
match the prior literals) but the SSoT seam carries forward through
#1/#34/#65.

8 SSoT-seed allow-lists added (cstage type.c ty_str/ty_slice prim
factories; wwstage primtypesize/tyslicesize; lib/ww/typ.ww tystr +
slice fields + their main.combined.ww mirrors). One amalloc-overalloc
allow-list at lib/ww/typ.ww:273 cites pending #36 (typed amalloc).

#66 filed for extending the filter once #65 routes lib/bytes +
lib/getopt's sizeof(slice) / sizeof(option) literals through SSoT —
naive line-pattern extension would false-positive on 22+ ELF wire-
format sites in dynout.ww.

131/131 + 994 + 995 + bootstrap green with `make sizelint` exit 0.

2026-05-20 15:22:21 +09:00

3 Commits