llms.txt

# Almide

> A programming language designed so that LLM-written code survives modification. Pure-Rust
> compiler, `.almd` source files, dual-target codegen (Rust, WASM).
> Every design decision serves one metric: **modification survival rate**
> on the [almide-dojo](https://github.com/almide/almide-dojo) MSR benchmark.

If you are an LLM writing Almide code, read this file first. It is
concise on purpose. Follow the link map for depth. This file and
docs/CHEATSHEET.md are the STABLE surface (#1483): every example fence
labeled `almide check` is compiled by CI on every change, so what you
read here is what the current compiler accepts.

## Fast facts

- Extension: `.almd`. Auto-imported (no `import` needed): `string`, `int`,
  `float`, `list`, `map`, `set`, `option`, `result`, `value`, `error`,
  `math`, `datetime`.
  Sized-numeric conversion modules (`int8`, `int16`, `int32`, `int64`,
  `uint8`, `uint16`, `uint32`, `uint64`, `float32`, `float64`) are also
  auto-imported for UFCS — e.g. `x.to_int64()` on `x: Int32` resolves to
  `int32.to_int64(x)`.
  Everything else needs an explicit `import`: `args`, `base64`, `bytes`,
  `env`, `fs`, `hash`, `hex`, `html`, `http`, `io`, `json`, `matrix`,
  `net`, `path`, `process`, `random`, `regex`, `testing`, `zlib`.
- Not in the stdlib since dialect epoch 14: the neural-network kernels
  (`gelu`, `softmax_rows`, attention, RoPE, the row norms, Q1_0/Q8_0, the
  Qwen3 blocks) are package `almide/nnlib` (`import nnlib`, then `nnlib.gelu(m)`),
  and the OpenAI / Anthropic streaming clients are package `almide/llm`
  (`import llm`, then `llm.openai_streaming_call(...)`); add one with
  `almide add almide/nnlib@v0.1.0`. The `mem` module and `bytes.heap_save` /
  `heap_restore` are gone: they did nothing under reference counting.
- Null is spelled `T?` (shorthand for `Option[T]`, valid in every type
  position — the canonical spelling, `almide fmt` normalizes to it; ADR-0010).
  `?` binds to the preceding type atom, never across `->`: `(A) -> B?` is a fn
  returning `Option[B]`, an optional fn value spells `((A) -> B)?`, nested
  Option spells `(T?)?`. Errors are spelled `Result[T, E]`, or `-> T!` for the
  pure-fallible `Result[T, String]` return (value tails lift into ok(...)).
  A lambda whose body uses `!` is a fallible closure `(A) -> Result[T, E]`
  — first-class, and as the callback of any list / map / set / option HOF
  (`list.all(xs, (x) => p(x)!)!`, `map.fold`, `option.map`, …) it makes the HOF
  fallible with the first-err form;
  fn-type slots spell it `(A) -> B!` / `(A) -> B!E`. Its E comes from the context
  (a typed slot or `let`, the fn its result propagates into), else from the
  join of its `!` operands: one shared E stays, a disagreement falls to String
  (ADR-0021). In test blocks lambda-`!` stays unwrap. No `null`, no `throw`, no
  exceptions.
- Effectful functions are written `effect fn f() -> T`. Pure functions
  cannot call effect functions (checked, emits E006). Exception: `println`,
  `eprintln`, `panic` and the `assert` family work in a pure fn (writes and
  aborts, never reads — ADR-0022), so a `main` that only prints is
  `fn main() -> Unit`; write `effect fn main()` when it reads or propagates.
  Every stdlib reader is an effect fn — `io.read_line`, `io.read_byte`,
  `io.read_n_bytes`, `process.args`, `env.args`, and the `args` module's
  `args.flag` / `option` / `option_or` / `positional` / `positional_at` /
  `raw` — so reading stdin or argv needs an effect fn (dialect epoch 8).
  A user-declared effect fn is always fallible, so write `f()!` on every
  effect call — read the `!` like Swift `await` (it marks where the world is
  touched); it is Swift `try`, never `try!`. On a stdlib effect fn that cannot
  fail the `!` is a no-op. An effect fn returning `Option[T]` (`args.option`,
  `args.positional_at`) takes the `!` before a default:
  `args.positional_at(0)! ?? "in.txt"` — `!` propagates the error, `??`
  defaults the none (without the `!`, `??` wants an `Option[T]`: E001).
- Generics use `[T]` (not `<T>`). Variants use leading `|`.
- `match` is exhaustive; missing arms emit a warning.
- Multiple lets chain by newline (no `in`). No `let rec`, no `head :: tail`
  cons, no `[a, ...rest]` spread in list patterns.

## Link map

| Topic | File |
|---|---|
| Syntax + stdlib idioms cheatsheet | [docs/CHEATSHEET.md](docs/CHEATSHEET.md) |
| Design philosophy (ambiguity removal) | [docs/design/DESIGN.md](docs/design/DESIGN.md) |
| Full language spec | [docs/SPEC.md](docs/SPEC.md) |
| Grammar | [docs/GRAMMAR.md](docs/GRAMMAR.md) |
| Stdlib spec per module | [docs/specs/](docs/specs/) |
| Stdlib reference per module (signature index is machine-generated) | [docs/stdlib/](docs/stdlib/) |
| Module system (import, sub-modules, diamonds) | [docs/specs/module-system.md](docs/specs/module-system.md) |
| Package system (deps, MVS, versions) | [docs/specs/package-system.md](docs/specs/package-system.md) |
| Error-code reference | [docs/diagnostics/](docs/diagnostics/) (run `almide explain E001`) |
| Patterns that are rejected on purpose | [docs/design/REJECTED_PATTERNS.md](docs/design/REJECTED_PATTERNS.md) |
| Recent changes | [CHANGELOG.md](CHANGELOG.md) |

## CLI

```
almide check <file>          # type-check only
almide run <file>            # compile + execute
almide build <file> -o app   # build binary (default: Rust target)
almide build <file> --target wasm
almide build <file> --target linux-musl   # static musl binary (or any rustc triple)
almide test [pattern]        # run tests (*.almd with `test { }` blocks)
almide fmt <file>            # format
almide compile [module]      # emit .almdi module interface
almide explain E001          # expand a diagnostic code
almide explain --list --json # every code: {code, mnemonic, severity, since, verdict}
almide ide outline <file>                 # one-line-per-decl summary
almide ide outline @stdlib/string         # stdlib API listing
almide ide doc string.to_upper            # signature + doc for a symbol
almide ide stdlib-snapshot [--json]       # concatenated stdlib outlines for
                                          # SYSTEM_PROMPT injection (~3.5K tokens)
almide mcp                   # MCP server on stdio: check / test / api / explain /
                             # fmt-check as typed tools with JSON results
```

Machine-readable output (prefer these when a program, not a person, reads it):
`check --json` (one diagnostic per line: `{level, code, message, hint, try,
try_replace, repair, file, line, col}` — apply `repair.primary` unattended only
when its `applicability` is `"machine-applicable"`), `test --json`, `fmt --check --json`,
`compile --json`, `ide outline --json`, `ide stdlib-snapshot --json`.
An MCP client (Claude Code, …) gets the same answers as tool calls via
`almide mcp` — see [docs/mcp.md](docs/mcp.md).

## Core idioms

### Prefer match over if-chains

```almide check
// ✗
fn rust_type_chain(kind: String) -> String =
  if kind == "int" then "i64"
  else if kind == "float" then "f64"
  else "unknown"

// ✓
fn rust_type(kind: String) -> String = match kind {
  "int"   => "i64",
  "float" => "f64",
  _       => "unknown",
}
```

### Prefer list combinators over `var + for`

```almide check
fn transform(item: String) -> String = string.to_upper(item)

// ✗
fn shout_loop(items: List[String]) -> List[String] = {
  var result: List[String] = []
  for item in items { result = result + [transform(item)] }
  result
}

// ✓
fn shout(items: List[String]) -> List[String] = items |> list.map(transform)
```

### Recursion for stateful loops (no head :: tail)

When the iteration count is known up front, write a range `for` (`for _ in 0..<n`) and thread state with `var`. Recursion is for early exit (`break`/`continue` shapes) and for loops whose bound is not known in advance — not for counted `f(n - 1)` loops.

```almide check
fn peek(s: String, p: Int) -> String = string.slice(s, p, p + 1)
fn is_ws(c: String) -> Bool = c == " " or c == "\t"

fn skip_ws(s: String, p: Int) -> Int =
  if p < string.len(s) and is_ws(peek(s, p)) then skip_ws(s, p + 1)
  else p
```

For head/tail on lists, use `list.first` / `list.drop(xs, 1)`:

```almide check
fn sum(xs: List[Int]) -> Int = match xs {
  [] => 0,
  _  => {
    let h = list.first(xs) ?? 0
    let t = list.drop(xs, 1)
    h + sum(t)
  },
}
```

### Effect fn with `guard else err(...)`

```almide check
import fs

effect fn open_file(path: String) -> Result[String, String] = {
  guard fs.is_file(path) else err("not a file: ${path}")
  fs.read_text(path)!
}
```

### `??` / `?` / `!`

```almide check
fn port(v: Value) -> Int =
  result.to_option(value.as_int(value.field(v, "port") ?? value.null())) ?? 8080   // Option fallback

fn host(v: Value) -> Option[String] =
  value.as_string(value.field(v, "host") ?? value.null())?                          // Result → Option (inside a fn returning Option)

effect fn parse_port(s: String) -> Result[Int, String] = ok(int.parse(s)!)          // unwrap a Result, propagate err (effect fn only)
```

### Which error type — a layer, not a taste call

`E = String` is the **erasure** layer: the *reporting* channel, read by humans
and models. It is the DEFAULT and what the whole stdlib uses. A variant `E` is
the **refinement** layer: the *branching* channel, where the program changes
behaviour on the content. Pick it only when you want to branch on the content
AND the domain is closed — a module or package that takes care of that error
itself. Leaving that domain, demote to String; the demotion is always spelled
as a `map_err`, because there is no conversion hook to hide it.

```almide check
import fs

// erasure (default) — add context, never replace silently
effect fn read_config(p: String) -> Result[String, String] =
  fs.read_text(p) |> result.map_err((e) => "loading config: ${e}")

// refinement — inside the module that handles these kinds
type LoadError = | NotFound(String) | BadValue(String)

fn load(p: String) -> Result[String, LoadError] =
  if p == "" then err(NotFound(p)) else ok(p)

// demotion at the boundary — visible, never implicit
fn load_at_boundary(p: String) -> Result[String, String] =
  load(p) |> result.map_err((e) => "${e}")
```

Do not branch on message TEXT (`string.contains(e, …)`, `e == "..."`) — E035.
Non-goals, decided and not open: no `From`-style conversion hook, no error
sets / unions / rows, no implicit propagation, no inferred lambda error type,
`main` stays String. Full rule: `docs/specs/result-option-effect.md` §8.0, §9.

### Operators, not comparison functions

Almide uses operators for comparison and equality. There is no
`int.gt`, `int.lt`, `int.eq`, etc. Use `>`, `<`, `==`, `!=`, `>=`, `<=`.
Equality (`==` / `!=`) works on any type.

### sqrt, abs, etc.

`int.sqrt` does not exist. Convert, sqrt, optionally convert back:

```almide check
fn isqrt(n: Int) -> Int = {
  let root_f = float.sqrt(int.to_float(n))
  let root_i = float.to_int(root_f)    // truncating
  root_i
}
```

`int.abs`, `float.abs` do exist.

## Diagnostic codes LLMs hit most (retry anchors)

| Code | Meaning | Usual fix (from `try:` snippet) |
|---|---|---|
| E001 | Type mismatch | Often Unit-leak: add a trailing expression, or rebind via `let new_x = if cond then … else …` |
| E002 | Undefined function | Often a cross-language idiom (`length` → `len`, `push` → `+ [x]`). Check `almide ide outline @stdlib/<m>` |
| E003 | Undefined variable | Missing explicit `import json` / `import fs` / etc |
| E004 | Arg count mismatch | Signature placeholder in try: shows `<name: Type>` |
| E005 | Arg type mismatch | Often needs explicit conversion (`int.to_string(n)` etc) |
| E006 | Pure fn calls effect fn | Mark the caller `effect fn`, and propagate the call's error with `!` (`f(x)!`) unless a `!` / `??` / `match` already consumes its Result |
| E007/E008 | Fan block misuse | See `docs/specs/fan.md` |
| E009 | Reassign immutable | `let` → `var` |
| E010 | Non-exhaustive match | Add the missing arm(s) or `_ => ...` |
| E011 | Mutable var mutated inside closure in pure fn | Refactor with `list.fold` / `list.count` / etc, or mark fn `effect fn` |
| E012 | Duplicate definition (fn / test) | Rename one side |
| E013 | Field access on non-record / missing field | Check spelling; non-records don't have method syntax (see E002) |
| E014 | Unreachable match arm | Drop the dead arm, or tighten the earlier arm so this one is reachable |
| E015 | Possible stdlib reimplementation (warning) | Delegate via the `try:` shim, or rename if intentionally different |
| E016 | Function in a `Set` element or `Map` key | Keep closures in a `List`, or use a comparable key (closures are fine as `Map` values) |
| E017 | Record construction on an enum type name | Construct a specific record-bearing case (`Named { ... }`), not the enum type |
| E018 | Empty collection with an uninferable element type | Annotate the element type (`let xs: List[Int] = []`), or inline (`list.len([]: List[Int])`) — never silently defaulted (Rust/Swift rule) |
| E019 | Ambiguous variant constructor (same ctor name in two or more types) | Rename the constructor in one of the types so the name is unique (a qualified `Type.Ctor` is not yet supported) |
| E020 | Two distinct types share one name with different structures | Rename one of the colliding types |
| E021 | Invalid record construction/pattern shape (positional args on a record, unknown/duplicate/missing field, paren pattern on a record case) | Records take named fields: `Cfg(name: x)` or `Cfg { name: x }`; match record cases as `Case { .. }` |
| E022 | `!` (unwrap-propagate) outside an effect fn body or test block | Mark the enclosing fn `effect fn`, or use `??` for a fallback value (`!` inside a lambda can't propagate) |
| E023 | Derived `Codec`/`Ord`/`Hash` not satisfied by a field type | Add `: P` to the offending field type (every field of a `: P` type must itself be `P`) — or hand-write `Type.encode`/`decode` for Codec |
| E024 | Integer literal out of range for its type (would silently fold to 0) | Use a literal within the type's range. Two causes, two fixes: **magnitude** → smaller literal or wider type (`UInt64` reaches its full `18446744073709551615`); **sign** (`let k: UInt64 = -5`) → drop the `-` or use the signed type of the same width. `-9223372036854775808` (i64::MIN) and `-0` in an unsigned type are both valid |
| E025 | Cannot infer a concrete type — an undecidable type slot (e.g. the error type of a value that is always `ok(...)`) was never pinned | Annotate the binding with its full type (`let r: Result[Int, String] = ...`); an unconstrained slot is an error even if never constructed, never silently defaulted |
| E026 | `[]` indexing on a String (a UTF-8 codepoint sequence, not a byte/char array) | Use `string.get(s, i)` (returns `Option[String]`) or `string.char_at(s, i)`; range slicing `s[a..b]` is fine |
| E028 | `main()` takes no parameters (`fn main(args: List[String])` is not wired on any target) | Read program arguments with `env.args()` inside the body |
| E029 | Unknown type name in an annotation or record literal (would fail the native build after check accepted) | Declare the type, fix the spelling, or add the missing import |
| E030 | Type has no ordering — `list.sort/min/max` or a `sort_by` key over Map/Set/Fn or compound-nested Float | Sort by an explicit orderable key (`list.sort_by(xs, (m) => <Int/String key>)`) |
| E031 | Retired range spelling — `..`/`..=` were replaced by Swift-style `..<` (exclusive) / `...` (inclusive) | Write `0 ..< n` / `1 ... n`, or run `almide fix <file>` to migrate every range mechanically |
| E032 | Immutable binding (a `let`, a non-`mut` parameter, or a temporary) passed to a `mut` parameter — including every in-place writer's receiver (`list.push`, `map.insert`, the `bytes` writers `append_*`/`set_*`/`write_*`/`fill`/`clear`/`copy_from`) | A local: declare the root binding with `var` instead of `let`. A helper that writes its caller's buffer: declare the parameter `mut b: Bytes` and pass a `var`. A temporary must be bound to a `var` first (split from E007 in 2026-08) |
| E033 | Opaque type constructed outside its defining module | Use the defining module's public constructor API (split from E008 in 2026-08) |
| E034 | Error-channel operator (`!` / `?` / `??`) on a non-Option/Result operand | Drop the operator — a plain value has no error channel; if a fallible call was intended, apply it to that call's Result |
| E035 | (warning) Branch condition reads error message text (`string.contains(e, …)` / `e == "…"` on an err binding) | Branch on a variant error type or use `??` for a kind-independent fallback; message text is a report, not an API |
| E036 | (warning) `map_err` lambda never uses its error value — original error silently discarded | Keep the chain: `(e) => "context: ${e}"`; discard deliberately with `(_) => …` |
| E037 | Equality between incompatible types (Result on one side only, or same container with different params — used to die as rustc E0308 after check passed) | Unwrap the Result side (`!` / `??` / match), or make both operand types identical |
| E038 | `??` separated from its fallback (line-crossing swallowed the next statement; also the missing-operand form) | Put the fallback on the same line as `??`; multiline = parens with `??` trailing |
| E039 | Retired `result.collect`/`collect_map` — Rust's collect short-circuits, almide's collected ALL errors (opposite strategy, same name); the fns are REMOVED (an ordinary E002 now) | All-errors: `let (oks, errs) = result.partition(rs)` then branch on `list.is_empty(errs)`; first-err: `list.map(xs, (x) => f(x)!)!` |
| E041 | Implicit propagation (auto-?) was REMOVED (ADR-0008) — the value stays a Result in all 5 former positions | Append `!` to propagate (mechanical insertion carried by the error), or consume the Result (`??` / `?` / match) |
| E042 | A statement-position Result is discarded — the error would be silently dropped (must-use, every fn kind) | Propagate with `expr!`, or discard on purpose with `let _ = expr` |
| E043 | `list.try_*` was REMOVED (ADR-0006) — the core HOF is fallibility-polymorphic: a callback ending in `!` (or a named `-> T!` fn) instantiates the fallible form, first-err short-circuit included | `list.try_map(xs, f)` → `list.map(xs, (x) => f(x)!)!` (same shape for filter/flat_map/filter_map/fold/find/each) |
| E044 | a PURE `main` returns Unit — a program's result is its output, not a return value (`fn main() -> Int` used to die downstream as invalid Rust); an EFFECT main may declare any Ok type (its wrapper discards the payload) | `fn main() -> Unit = println("${...}")`, or `process.exit(n)` for an exit code |
| E045 | tuple index `.k` is defined only on tuples and only below the arity — `.0` on Int, or `.5` on a pair, is a check-time error naming the type/valid range (previously an Unknown that died at build as a compiler-blaming banner, #1266) | index within `.0`..`.arity-1`, or destructure: `let (x, y) = t` |
| E046 | `_` in a call ARGUMENT is not a value and is NOT partial application — it lowered to `Unit` and died at build as a compiler-blaming banner (`add(_, 10)` → `add((), 10i64)`); measured: binding it typed the RETURN type, and in pipe position it counts as an extra argument (E004). `_` in EXPRESSION position stays a sanctioned typed hole | name the missing value with a lambda: `(x) => add(x, 10)` |
| E047 | Invalid escape in a string literal — an escape Almide does not define (`"\q"`), or a `\u{…}` outside the Unicode scalar range (`"\u{110000}"`, surrogates). Both used to pass through SILENTLY as their own spelling (#1264) | Double the backslash for a literal one (`"\\d+"`), or use a raw string (`r"\d+"`); for a codepoint stay within U+0000..U+D7FF / U+E000..U+10FFFF (`"\u{0}"`, not `"\0"`) |
| E048 | A constructor pattern the SUBJECT does not have: wrong family (`some`/`none` destructure an Option, `ok`/`err` a Result, and the two never mix — `list.get`/`map.get`/`string.find` return `T?`, `int.parse`/`fs.read_text`/`json.parse` return a Result), a builtin carrier aimed at a USER variant, or a user case borrowed from another variant. The checker only rejected a ctor pattern over a plain SCALAR, so these bound their payload Unknown and died at build — a compiler-blaming banner, or invalid generated Rust for the foreign-case cell (#1341) | Use the subject's own cases; for the family swap the error's `try:` names the same arm position (`ok(..)`→`some(..)`, `err(..)`→`none`, `some(..)`→`ok(..)`, `none`→`err(..)`), and for a variant the hint lists its cases |
| E049 | `let ... in <expr>` is OCaml/Haskell syntax — Almide has no `in` keyword: bindings chain by newline and the block's trailing expression is its value | delete the `in`; what follows it is already the continuation. The fix-it is machine-applicable, so `almide fix <file>` removes every one mechanically |
| E050 | A local `fn` collides with a selectively-imported name (`import json.{parse}` + `fn parse`) — one bare name, two resolutions: the checker used to pick the local fn while lowering picked the import, so a call type-checked against one function and EXECUTED the other (#1425) | Rename the local fn, or drop the name from the import list and call it module-qualified (`json.parse`) |
| E051 | A file's `@dialect(N)` stamp names a HIGHER dialect epoch than the compiler implements — the file was verified against a newer language than the one being asked to compile it, so a success here would be luck rather than evidence | Upgrade the compiler; or, if the file really targets this dialect, run `almide check <file> --stamp` on a clean check to write the correct epoch (it only ever moves the stamp forward) |
| E052 | A call names a `@deprecated` function. The hint names the replacement and classifies the edit by COMPARING the two signatures: identical means the rename is the whole edit, anything else means the arguments need looking at | Same signature: `almide fix <file>` applies it unattended. Different signature: the hint still names the replacement, but the edit is yours — the auto-fix is withheld on purpose rather than risk a miscompile |
| E053 | An attribute name the compiler does not read (`@deprecatd`, `@inline`, anything invented). It parses and then nothing happens — before this warning a misspelled `@deprecated` left every caller unwarned while the author believed otherwise | Fix the spelling (the hint suggests the nearest real one, or lists the whole vocabulary). Almide reads: @extern @export @intrinsic @wasm_intrinsic @inline_rust @mutating @consume @borrow_ref @pure @schedule @location @derived @main @deprecated @dialect |
| E054 | `almide fmt` refused to write: formatting would not conserve the program (parse, AST, or comments — the #1309 `--safe` verifier). The file is left untouched | Nothing in your source — this is a FORMATTER bug; report the file, leave it unformatted, format the rest |
| E055 | `?.` on a Result — the optional chain is Option-only (`o?.f` is `option.map`) | Convert or unwrap first: `(r?)?.field` (Result→Option, then chain), `(r ?? fb).field`, or `match` |
| E056 | (warning) `?` on an Option is a no-op — the operand is already an Option, nothing converts | Drop the operator; to unwrap use `?? fallback`, `match`, or `!` (effect fn) |
| E057 | fn declaration has no body — only @extern/@intrinsic may omit it | Write `= expr` (or `= { ... }`) after the signature |
| E058 | Unhashable Map key: Float, Map, or a record/variant carrying one anywhere in its fields (a FUNCTION in the key is E016) | Key on String/Int/Bool (or a record/variant of those); carry the unhashable value on the VALUE side |
| E059 | `for` over a non-iterable head (`for x in 5`) — the loop head must be a List or a Map | Iterate a List, a range (`for i in 0...n`), or a Map (`for (k, v) in m`) |
| E060 | (warning) Import hygiene: a module imported and never used, or imported twice under two names | Remove the unused/duplicate import; `import _name` suppresses a deliberate one |
| E061 | Top-level `let` bound to a lambda — the closure has no home in a module constant and the binding is not callable | Declare it as a function: `fn name(…) = …`; a `let`-bound lambda inside a fn/test body is fine |
| E062 | (warning) Shebang without `-S`: `#!/usr/bin/env almide run` runs on macOS and dies on Linux, whose kernel hands `env` the rest of the line as ONE argument | Write `#!/usr/bin/env -S almide run` — `-S` makes `env` split the line on both kernels |
| E070 | `@bounded`: a loop without a compile-time trip count (`while`, `for` over a container, run-time range bounds) | Use a counted range with literal bounds: `for i in 0..<N` (ALS-B3) |
| E071 | `@bounded`: allocation inside a counted loop (list/map/string construction, concat, push, closure) | Allocate outside the loop; accumulate scalars inside (ALS-B4) |
| E072 | `@bounded`: `break`/`continue` inside a counted loop | Single exit: run every iteration and select with a branch (ALS-B5) |
| E073 | `@bounded`: recursion — the reachable call graph must be a DAG | Replace recursion with a counted loop (ALS-B6) |
| E074 | `@bounded`: a non-`@bounded` callee, closure, or higher-order call | Mark the callee `@bounded` or call a first-order pure stdlib member (ALS-B7) |
| E075 | `@bounded`: run-time-length heap construction (`string.repeat(s, n)`, `list.with_capacity(n)`, …) | Give every constructed length a compile-time size (ALS-B8) |
| E076 | `@bounded`: an effect outside the declared capability (env/fs/http/… or `fan.*`) | The profile's capability is standard output only (ALS-B9) |
| E077 | `@bounded`: Float arithmetic or comparison (provisional rule) | Keep to Int arithmetic; Float values may be held and passed (ALS-B10) |
| E078 | `@bounded`: `!` propagation or `guard` inside a counted loop | Propagate or guard outside the loop; default with `??` inside (ALS-B11) |
| E080 | An or-pattern alternative binds a variable (`some(n) \| none`) — the body cannot depend on which alternative matched | Write separate arms when the body needs the payload, or use `_` inside the alternative |
| E082 | The wasm target cannot lower the program on `--target wasm` (the reason and the function it came from are printed with the code; on the build route it can be a host op the stock-WASI shim cannot serve) — `almide check --target wasm` reports it at check time | On the build route try `almide run --target wasm` (the embedded host serves every op); otherwise restructure the walled shape named in the error |
| E083 | The wasm emitter's own exit validator found a frame whose exit window releases a different set of credits than its exit plan declared (an owned block dropped or released twice) — a compiler defect, never a program error | Report it with the program; `almide run` (native) is unaffected |
| E084 | A literal argument to stdlib `process.exit` is outside the exit status `0..=255` | Choose `0` for success or `1` through `255` for failure; computed arguments keep the runtime range check, and a WASI preview-1 build refuses 126..=255 at runtime |
| E085 | `@intrinsic` / `@wasm_intrinsic` on a fn, or a `prim.*` reference / `import prim`, outside the stdlib (a user file binding a runtime symbol or calling the primitive floor directly bypasses the capability profile; `prim` is not user surface) | Intrinsics live in the stdlib; wrap in an effect fn — import the stdlib module that owns the operation (`fs`, `http`, `process`, …) and call it from an `effect fn` of your own. For `prim.*`, call the public function the hint names (`prim.read_text_file` → `fs.read_text`) |
| E081 | The called stdlib fn is not available on `--target wasm` (the declared wasm wall set, `proofs/target-availability.toml`) | Run natively, use the named portable alternative from the `try:` line, or wait for the port the reason names |
| E040 | Retired json.*/value.* alias — the dynamic surface has one name per operation: `value.*` is the data model, `json.*` the format (parse/stringify) | Use the named `value.*` survivor (`json.as_int(v)` → `value.as_int(v)?`, `json.get` → `value.field(v,k)?`, `value.get` → `value.field`), or run `almide fix <file>` |
| E089 | A `${…}` segment whose value has no defined string form — Bytes, Unit, Matrix, a raw pointer, a function value, or a container/record/variant holding one; also reported at the CALL that instantiates a generic fn whose body interpolates its type parameter | Interpolate what you mean: `${bytes.to_list(b)}` / `${bytes.to_string_lossy(b)}`, `${matrix.to_lists(m)}`, the result of calling the function (`${f(x)}`); a Unit carries nothing, so drop the segment |
| E086 | A value built inside a `scoped { … }` block would outlive it (the block's value, or a write to an outer binding) — the rows name where it was allocated and where the scope ends (ALS-E31) | Compute the scalar summary inside the scope and let that cross the boundary |
| E087 | An operation not permitted in a scoped region: a callee that is not `scoped fn`, a global, host output or an `effect fn`, an unknown indirect call, a heap value captured from outside, a type outside the fragment, or `!` / `?` / `guard` (ALS-E31) | Declare the callee `scoped fn`, pass the value in as a parameter, or move the effect outside the scope |
| E088 | A recursive call in a `scoped fn` retains the current activation — a single non-tail self-call, or mutual recursion between scoped workers (ALS-E31) | Carry the pending work in an accumulator and return the recursive call, or fold the mutual pair into one worker |
| E090 | An `@extern(c)` signature with a type that has no C representation — a list, Bytes, map, record, variant, Option, tuple or fn value parameter, a `String` return, or a `mut` parameter | Pass C scalars (`Int`, sized ints, `Float`, `Bool`, `RawPtr`, `String` parameters), or bind through an `@extern(rust, "crate::host", "f")` fn in `native/*.rs`, which takes Almide values as `&[u8]` / `&[T]` / `&str` / `&Record` |
| E092 | A `@pure` fn is not pure — it is an `effect fn` or an `@extern`, or it (or anything it calls) prints, panics, asserts, calls a stdlib fn with an effect category (`io.write`, `process.pid`, …) or calls an `@extern` | Move that call to a caller that is not `@pure`, or remove `@pure`; a call through a fn-typed parameter does not count |
| E093 | A type applied to a different number of type arguments than its declaration has parameters — `Pair[Int, Int]` for `type Pair[T] = (T, T)`, `Score[Int]` for `type Score = Int`, or a builtin: `List[Int, Int]`, `Map[String]`, `Result[Int]` | Write one type per declared parameter (the message spells them: `Pair[T]`, `Map[K, V]`), or drop the brackets for a type without parameters |
| E094 | Type aliases form a cycle — `type A = B` with `type B = A`, or `type Tree = List[Tree]` through a type argument | Give the cycle a nominal type: a record or variant may refer to itself (`type Tree = { kids: List[Tree] }`) |
| E095 | The app passed to `http.serve` reads a local of the fn that serves it — `let boot = random.int(1, 9)` in main read by the handler, or `let app = http.router(…)!` in main passed to `serve` | Make the value a top-level `let` (`let app = http.router(…)` at top level, served as `http.serve(8080, app!)!`), or compute it inside the handler per request |
| E096 | A fn with a `mut` parameter used as a function value — `let f = bump`, `list.map(xs, bump)`, a record field, a list element, a return, `counter.bump` — a function type cannot carry the write-back to the caller's `var` | Call it directly (`bump(s)` with `var s`), or pass a lambda that names the `var` (`() => bump(s)`); as a callback argument, a lambda of the slot's arity that copies into a local `var` (`(item) => { var copy = item; bump(copy); copy }`); a fn that only changes its own copy drops `mut` and returns the new value |
| E097 | `pub` before a `type`, `protocol` or `test` — `pub type Point = { … }`; a type and a protocol are public by default and a test has no visibility | Delete `pub` (machine-applicable, `almide fix`); narrow a type with `mod type` (project) or `local type` (file) |
| E098 | The closure passed to `testing.assert_aborts` captures a local of the test (a `let`, `var`, `where` binding or outer lambda parameter), or is a fn value rather than a lambda written in the call — it runs in a child process or instance where the locals do not exist | Compute the value inside the closure, or make it a top-level `let` |
| E099 | `testing.assert_aborts` outside a direct call in a test block — in a `fn`, `main` or a top-level `let`, used as a value, or inside another `assert_aborts` closure | Call it directly in the `test` block, once per abort |
| E420 | Function visibility violation (callee is private) | Make the callee public, or add a public shim |

A rustc 4-digit code (`error[E0XXX]`) leaking through always indicates
an Almide codegen bug, not a user error — report at the issues URL.

## Project layout

```
mypkg/
  almide.toml          # [package] name = "mypkg"
  src/
    main.almd          # entry: `import self.<sibling>`
    classifier.almd    # sibling module
```

Sibling import is `import self.classifier` — no file paths.

## What Almide is NOT

- Not Haskell/ML — no `let rec`, no `let … in`, no type classes (protocols exist but have explicit `impl`), no HKTs.
- Not Rust — no lifetimes, no borrow checker surface syntax, no `unsafe`, no traits-as-data-attributes.
- Not JS/Python — no dynamic typing, no `null`, no exceptions, no method-call syntax (`x.foo()` on non-UDTs).

Cross-language idioms that compile in other languages and break here:
`let x = … in body` (OCaml), `head :: tail` (Haskell), `[a, ...rest]`
(JS/Rust), `int.gt(a, b)` (Go-ish), `x.toUpperCase()` (JS method chain).
Diagnostics for each carry a `try:` snippet that shows the Almide form.

## For agents and harnesses

- Start by calling `almide ide stdlib-snapshot` once and embedding the
  result in your SYSTEM_PROMPT. It is the authoritative inventory
  (~3.5K tokens text, ~14K JSON).
- On compile error, read the `hint:` and `try:` sections of the
  diagnostic — they are designed to be copy-pasteable.
- Do not write `test "…" { }` blocks in harness-submitted code unless
  the harness explicitly asks for them; this is the top parser cascade
  cause.

## Meta

- License: MIT or Apache-2.0 (see LICENSE files).
- Repo: <https://github.com/almide/almide>
- Dojo (MSR benchmark): <https://github.com/almide/almide-dojo>
- Current stable: v0.68.0 (prev v0.67.1). v0.68.0 is the inspected-stdlib train: every stdlib function carries an inspection stamp backed by a recorded native/wasm run, and dialect epoch 14 records what the compiler stops accepting — `fan.race` is now `fan.min(budget)` with a required clock budget, `fan.any` is gone (write `a() ?? b() ?? fallback` or `list.find_map(xs, (x) => f(x)?)`), `testing.assert_throws` is `testing.assert_aborts(expected, f)`, the arena checkpoints `mem.save`/`mem.restore`/`bytes.heap_save`/`bytes.heap_restore` are deleted, and the neural-network kernels of `matrix` moved to the almide/nnlib package. A `fan` block can build a record from its arms, identifiers may be non-ASCII (a module name stays ASCII), and the batch fixes a false E041 on an annotated binding, a wasm fold that evaluated its source after its init, a native self-append clone, and an AVX2 Q8_0 dot product that diverged from wasm on a -128 weight. v0.67.1 is a patch: a borrowed head match inside a loop builds again on native (a 0.67.0 regression where one arm cloned the head and the other borrowed it, so the generated Rust failed with E0308). v0.67.0 is the readers-are-effects train: `args.*`, `io.read_byte`, `io.read_n_bytes` and `process.args` are effect fns that take an explicit `!` (dialect epochs 7–13 record every change to what the compiler accepts), compiler-introduced names are kept apart from yours, `check` is faster, and `--host js` can suspend on async JS imports through JSPI (mark the binding `@extern(wasm, "js", "name", returns: promise)`; the declaration stays an ordinary `fn`, an unmarked hook that returns a Promise is refused with that fix, only the exports that can reach an async import return a Promise, calls are serialised, and `init()` refuses where JSPI is missing — Node >= 24.20, Chrome >= 137 or workerd), exports marshal Bytes, List, Option and records and unwrap an effect fn's Result, and it carries the batch-2 native/wasm divergence and ownership-certificate fixes. v0.66.0 is the one-wasm-emitter train: `--target wasm` builds through the structural emitter alone — the incumbent WAT renderer and its fallback route are deleted, a program the leg declines is an E082 wall, `@export` names its export, and the env switches only the incumbent read are retired (`ALMIDE_WASM_STRUCTURAL` is now `ALMIDE_WASM_SKIP_STOCK_AUDIT`); `net` gains Unix-domain sockets with descriptor passing and shared-memory files (`unix_connect` / `unix_listen` / `unix_accept` / `unix_send` / `unix_recv` / `unix_take_fds` / `unix_poll` / `unix_wait` / `unix_close`, `shm_create` / `shm_resize` / `shm_write` / `shm_read`; native only, declared in the target-availability matrix); the wasm leg counts heap blocks live at exit and releases what it used to leak (a record a field write replaces, field-path push temporaries, `map.get_or` / `list.get_or` defaults, fallible-HOF carriers, a fresh `??` fallback), and mut list / string / map forms lower through a record field path of any depth. Fixed: a user fn named like a stdlib mutator no longer takes that stdlib fn's `mut` params on native (a 0.65.1 regression), a registry-linked stdlib call reads its `mut` params from its declaration on wasm (a 0.65.1 regression), a closure's `bytes.set_*` write through a captured var reaches the var on wasm, a var changed only through a `mut` param is shared by a closure on native as on wasm, stream fusion and top-level-let forcing are judged once for both backends, cross-module default arguments are filled and typed in the caller, and wasmtime is 49.0.1 (RUSTSEC-2026-0315/0316). v0.65.1 is a patch train of correctness and HTTP fixes: on the structural wasm leg a container that stores a top-level `let` value co-owns it, so the global is no longer freed when the container is dropped (a use-after-free that corrupted later records); `json.stringify` escapes every U+0000–U+001F other than `\n \r \t` as `\u00xx` on every leg (C-095); a bare trailing `\r` is kept as line content by `string.lines`, `fs.read_lines*` and the fold/for-each line walkers on every leg (C-220, C-225); diagnostic line numbers after a multi-line string literal are correct; `almide run` replaces itself with the program, so a signal sent to its pid reaches the program; `http.serve` drains the request in flight and flushes stdout on the first SIGTERM/SIGINT (a second signal flushes and exits 1), bounds request reading (413 over 1 MiB, 400 on a short body, 503 after 30 s, chunked request bodies decoded), sends no body for HEAD/204/304, IANA reason phrases and `Connection: close`, and refuses a response header holding CR/LF; the HTTP client parses URLs like curl/WHATWG, refuses a header name, value or method that would split the request, honours HTTPS_PROXY / HTTP_PROXY / ALL_PROXY / NO_PROXY (CONNECT, absolute-form, SOCKS5), trusts the OS store and SSL_CERT_FILE / SSL_CERT_DIR beside the bundled roots, skips 1xx interim responses, reads chunk extensions, and bounds the dial (30 s), the response (1 GiB) and the response head (1 MiB); a program the incumbent wasm leg cannot lower walls instead of emitting invalid wasm, and a structural-leg wall names the function it came from. v0.65.0 is the failure-channel train: a lambda's failure channel is its context type (a typed slot `(A) -> B!E`, a typed `let`, or the fn its result propagates into), else the join of its `!` operands, with `String` as the top when they disagree, identically on native, wasm and the interpreter (ADR-0021, C-369), and E022 names both disagreeing operands and the conversion; `println`, `eprintln`, `panic` and `assert` / `assert_eq` / `assert_ne` are admissible in a pure `fn` (ADR-0022) — they write or abort and never read, so a pure fn that prints keeps a pure signature; `process.exit` passes the exit status 0..=255 through on native and on the embedded host, so a wrapper hands on its child's 126, 127 and 128+n (a WASI preview-1 build refuses 126..=255 with its own error line, and any code outside 0..=255 is a domain error on every leg); `panic` in a value-producing branch arm builds and behaves identically on every leg; `almide build --target <triple>` (and the `linux-musl` shorthand) builds for the requested native target, `CARGO_BUILD_TARGET` is honoured, and a target that cannot be honoured fails loudly; an unknown annotation type is one located E029, reported before its consequences, with the nearest declared type as the suggestion; `datetime.monotonic_ns` and the fs ops run on the structural wasm leg and in a stock WASI preview-1 build. Fixed: `bytes.repeat` checks its size by division on wasm, so a wrapping `len * n` is the defined out-of-memory abort rather than an out-of-bounds write (C-197); the native `linear_*_row_no_bias` family and `select_rows_f32` on wasm check the matrix dimension ceiling (C-161). It also carries the fixes staged as v0.64.1: a module's forward reference to its own type resolves to that type (it used to pick another module's same-named type depending on import order); a bare type, protocol or variant case resolves only among the modules the file can see, and a name only an unimported module declares is E029 with the qualified spelling as its hint; `!` on a never-err stdlib effect call (`random.int`, `env.millis`) is accepted inside an effect-slot lambda such as an `http.serve` handler, as in an effect fn body; a program that serves can read the clock on wasm; list patterns inside tuple patterns are checked for exhaustiveness by length and keep their guards on native; `==` on a type that holds a function is E016 at check time; effect fn values flow through declared fn types on the structural wasm leg, so the http router renders there; the native build caches are bounded by total size (`ALMIDE_CACHE_MAX_BYTES`, default 4G). v0.64.0 is the edit-before-you-write train: `almide survive <file> --with <patch|text> --json` applies a proposed edit in memory and reports, per diagnostic / test / contract fixture, what is unchanged, newly broken, newly fixed or removed, without writing (also as the MCP tool `almide_survive` and the LSP request `almide/survive`), and `almide apply --if-survives` writes only an edit that breaks nothing; a diagnostic carries its repair as a field (`repair: {primary, alternatives, example}` in `check --json`, consumed by `almide fix` and LSP quick fixes), every code whose fix-it verdict is mechanical emits a machine-applicable repair, and `almide explain --list --json` lists every code with its severity, first release and verdict; the http client gains a call handle — `http.start(method, url, body, headers, {total_ms, idle_ms})` then `http.poll` / `http.read_new` / `http.wait` / `http.cancel` — with per-call deadlines and cancellation (native; wasm follows), and `*_with_limits` twins of the streaming calls. v0.63.1 is a patch train of wasm-leg fixes, all found when the almide-dojo modification bank first ran every program on the structural wasm leg: a record read from a captured `var` and stored in a list is no longer freed by the var's next assignment (a 0.63.0 regression); a dropped `Map` or `Set` releases its lookup index, so a fold that builds many maps no longer runs out of memory; `x = f(x, ...)` releases the old value when `f` only borrows it; `almide run --target wasm` runs with no time limit, as native does. `float.to_fixed` prints from exact scaling (about 50x faster on wasm) and `float.to_string` reads its power-of-ten constants from a compact table (about 3x faster on wasm), with byte-identical output. v0.63.0 is the certified-ownership train: every native borrow and clone decision is made by passes over one use-kind analysis and checked against the final IR by an ownership certifier (a borrowed param that is consumed, a clone at a last use, an owned param nothing needs owned, a borrowed callable that escapes; on by default in debug builds, `ALMIDE_CERTIFY_OWNERSHIP=fail` in release, and a CI corpus gate holds zero violations), the per-pass IR verifier runs in every build profile, and the declared pass order is gated by a seeded shuffle that byte-diffs the emitted Rust. What that means for a program on the native leg: a parameter the body only reads is passed by reference, including a record, list, String or variant (a variant whose matches only read its payloads), a mutually recursive group and a monomorphised generic; a fused pipe over a variable borrows its elements when the callbacks only read them; a fn-typed parameter that does not escape is a borrowed callable and a lambda handed to it is a plain closure, with no box and no captured copies; a `mut` parameter of scalar type changes the caller's variable on every path. Performance: `binarytrees` and `treealloc` run faster than the ordinary Rust program through the region window (gated together with its ablation); the native `Map` is a compact ordered dictionary with borrowed lookup keys; derived `Codec.decode` pays its per-field error frame only on the error path; `list.enumerate` in source position and `xs = list.set(xs, i, v)` stop copying; a pure pipe of list combinators lowers to one iterator expression. Surface and tooling: `string.byte_slice(s, start, end) -> String?` (half-open UTF-8 byte offsets: `some` copy exactly when `0 <= start <= end <= len` and both ends are codepoint boundaries, `none` otherwise, C-348); `almide build --target wasm --host js` writes the JS host, the glue and the typings next to the module and ships only the imports and exports the program uses; `@extern(wasm, ..)` builds on the default structural leg; a record or variant that derives `Ord` orders on the structural leg, and so does a compound `sort_by` key; `almide fmt` wraps at 100 columns and keeps an argument list or record literal the author split; `almide test` reports the tests it ran and exits 5 when it ran none, on both targets; `check --json` walks every package entry; every `ALMIDE_*` environment switch is registered in one roster (`almide switches`). Diagnostics: an effect fn tail, match arm, if branch or guard else that still propagated a Result implicitly is now E041/E042 with the `!` fix-it, and so are an effect call in operator operand position and an un-annotated Result binding inside a lambda body; a local binding wins over a module of the same name in MEMBER position too, so `let list = [1,2]` then `list.len(list)` is the local's method with the receiver as its first argument (E004, whose hint names the shadow and points at the binding) rather than the module call it reads as — it used to check clean and emit invalid Rust; E002 points its caret at the callee and suggests names related by containment; a value in callee position is reported as not-a-function; every fs and process failure names the call and the operand, with one errno vocabulary on every leg. Fixed: a `??` inside a `fan` arm keeps its default (C-349); a self tail call's list accumulator no longer aborts; a let-bound payload of a record-shaped variant case and a `zip_with` callback's captured String are no longer freed under their owner on wasm; native stdout flushes per write only on a terminal; `check --json` exits on the same verdict as plain `check` (any parse error or `error`-level diagnostic is a non-zero exit — it used to report success for every program that merely parsed, so a harness gating on the status read a rejected program as accepted). v0.62.0 is the language-surface train: `testing.assert_snapshot(actual, expected)` with `almide test --update-snapshots` as the accept step (a drifted literal is rewritten in place; `--ci` refuses to write); list-rest patterns `[h, ..t]` and as-patterns `name @ pattern` on every leg; the `int` bit family (`count_leading_zeros` / `count_trailing_zeros` / `pop_count` / `bit_reverse` / `byte_swap`) and `int.bits_to_f32`; the `bytes` search / edit / predicate family; `http` exposes status, headers and body through a `*_response` family beside every verb, and the framed request family (`request` / `request_status` / `get_status` / `request_bytes` / `get_bytes`) serves the embedded wasm lane; `fs.glob` matches segment-wise on both legs; `path.extension` treats a leading dot as a hidden-file marker; a module's record prints its declared name (`Cfg { … }`) on every leg; `list.unique_by` admits any equatable key; effect callbacks reach every `fan` mapper head; a tuple-pattern lambda as a pipe stage destructures the piped value; a `let`-bound range that is indexed or measured stays on the native trust-spine render. Fixed: the closure-call RC guard on a borrowed heap argument (a use-after-free on the structural leg, C-333), `select_rows_q1_0`'s row schedule, the E060 self-module-import false positives, the quadratic `map.set` build loop, package builds made byte-identical, the E081 target-availability verdict per leg. ADR-0005 is pinned (the pipe × `??` desugar order, the operator equivalences as contracts). ADR-0005 D4 opens its window: the eager `option.unwrap_or` / `result.unwrap_or` are deprecated (E052, `use = "??"`) — write `value ?? default` (the default is evaluated only on the fallback path); `almide fix` rewrites both the direct call and the pipe-stage form. Removed one dialect window later. ADR-0013 is accepted: `String` becomes a shared immutable buffer with copy-on-write on `string.push` / `string.clear` (the representation the wasm leg already has; native lands after 0.62.0 behind strchurn / fasta / decode ratchets). v0.61.1 is a patch train of correctness fixes: `guard c else err(…)` in a Unit effect `fn main` — the idiomatic CLI argument check — lowers on BOTH wasm legs (the structural leg's silent err-swallow at main is also fixed: `Error: <msg>` + exit 1, the C-035 contract); same-named types in two modules dispatch to their own convention methods; the wasm assign-site churn leak is closed (an accumulator loop that OOM'd now runs, `--heap-cap` is enforced on the structural leg); decode errors name the received kind with a composable `, at path` suffix; `string.length` is deprecated with a machine-applicable rewrite to `string.len` (E052 — the one live synonym, retiring); the `[]`-generics steer fires in declaration heads and type annotations. v0.61.0 added the STATUS-PRESERVING HTTP CLIENT: `http.get_status` / `http.request_status` return `(status_code, body)` for any complete response — a 404 is `Ok((404, body))`, not an `Err`; `Err` is reserved for transport failures (connection / TLS / timeout), so callers branch on the numeric status instead of pattern-matching bodies. Mirrors the `get`/`request` and `get_bytes`/`request_bytes` family shape (a general `request_status` + a GET convenience), tuple return over the existing marshalling precedent (no new nominal type), native-only like the rest of the http client and declared both directions in the target-availability matrix. Stdlib 969 -> 971 functions across 43 modules.
- Previous stable: v0.60.0 (prev v0.59.2). v0.60.0 is the STAGE-2 ENGINE release: the commissioned structural wasm emitter (typed IR -> wasm bytes, no WAT text) is the default `--target wasm` leg after its develop soak, with the incumbent WAT trust-spine as the verified-to-verified reroute for shapes it declines. Language surface (RC-soaked): (a) OR-PATTERNS — `"a" | "an" | "the" => …` match alternatives (ALS-E18, C-323), binder-free by rule (E080, three fixture families + registry doc), covering their UNION for exhaustiveness (an or-covered match needs no wildcard), desugared to one IR arm per alternative BEFORE the backends so cross-target identity is constructive; (b) builtin CONSTRUCTORS ARE FUNCTION VALUES — bare `some`/`ok`/`err` parse as their eta-expansion (`[1, 2] |> list.map(some)` == `[some(1), some(2)]`, ALS-E27, C-322), user-ctor first-class status officialized (1-ary = `(A) -> T`, multi-arg = no partial application, 0-ary = the value), and fmt prints the bare ctor back (the eta-synthesis leak is closed and inverted). Diagnostics: E081 — a stdlib fn NO wasm leg builds errs at CHECK time with the reason and the portable alternative, backed by the TARGET-AVAILABILITY MATRIX (proofs/target-availability.toml): every public stdlib fn measured per-run with the renderer's own verdict through a shape ladder (340 lower / 49 structural-only / 23 both-legs walls / measured-vs-declared diffed four directions in CI; the pending-self-host ratchet burned 31 -> 16 in the release window — int bit trio, map/set is_empty, the error trio, map all/any/count, set all/any, list.find_index, json.to_map). The 23 remaining both-legs walls are triaged on #1423: 2 fixable (fs.fold_lines_range, env.sleep_ms), 9 port-work (http.* -> wasi:http p3), 12 justified-forever candidates (process.* — stock WASI has no subprocess API; env.set / testing.assert_throws pend semantic rulings). EXPERIMENTAL (env-gated, default behavior unchanged): the direct WASM COMPONENT legs — `--component` emits a direct WASI 0.2 component from the structural leg, and `ALMIDE_COMPONENT_P3=1` a WASI 0.3 component on the async canonical ABI (stdio over component-model streams, the full fs READ+WRITE surface with the completion-future durability handshake, canonical-ABI facts DERIVED from the vendored WIT at emit time, the WASI pin ledger proofs/wasi-pin-policy.toml re-derived per run); fan meets the async ABI there — `fan.map`/`fan.any` over `fs.read_text` prefetch every read as `[async-lower]` open-at subtasks drained by a waitable-set in ARM order, `fan.any` abandons losers via the `subtask.cancel` cooperative handshake, and the split is contracted unobservable (C-321: same bytes as the sequential form on every leg, the err text itself certifying arm order). Assurance: #576 CLOSED — the StructuralRuntime Rocq arc (45 kernel-checked theorems) binds the emitted runtime end to end: the emitter's real `$inc`/`$dec_flat`/`$free`/`$alloc` BYTES decode to the proven instruction trees (grounded per run), the trees realize the FC-3 model transitions, and whole runs preserve the heap invariant on the CONCRETE memory — the F-class (double-free, stale-count reuse, aliased handout) is a violated lemma of the emitted code. First DOSSIER-CARRYING release: the v0.60.0 tag assembles and Sigstore-attests the trust-spine dossier (#571/#1534). Also aboard: a PARSING CONFORMANCE CORPUS for the Codec surface ported from an upstream schema library's tests (verdicts and values only, the absent surface named per row), and derived decode BORROWS its input (every field read a borrowed lookup — the #1679 first slice). RC-SOAK HARDENING (rc1 -> rc3): the first real imperative programs through the structural default found two silent regressions, both fixed and fixture-pinned before final — #1688 (a `mut Bytes` forwarded to a callee from an if/match arm emitted wrong bytes silently; the C-132 move-mode fold now covers match arms and bare Unit leaves, a phase-4 HOIST moves branch-arm write-backs to straight-line position — the gzip-inflate block-dispatch shape lowers structurally, C-326 — and whatever still cannot be proven is REFUSED by the emitter's branch wall and rerouted to the certified leg, with a `!` refusal-ratchet row in the alloc/size ledgers so a refusal can never silently become an emit again, C-324) and #1689 (`bytes.push` reallocated len+1 per push and never freed the outgrown block — n^2/2 retention, OOM at 69k pushes; `$bytes_push` now carries the `$list_push` discipline: cap fast path, geometric growth, rc==1 free — 200k pushes in 8 ms, C-325). Docs honesty pass (#1696 step 3): TRUST-SPINE.md / proven-vs-trusted.md / wasm README now state plainly that the DEFAULT leg is trusted-not-proven (differential evidence) and the certificate lives on the opt-in incumbent until #1696 moves it. Contracts 326, cross-target fixtures 644, release blockers 0, codopsy A (92/100) held. Known frontier: the E081 set above; #1557 legs 2/3 and #1564's `-> T?!` producer cell carry over; the fuzz-block syntax and the env.set/assert_throws wasm semantics await ○× rulings; #1696 steps 4-5 (certificate on the structural leg, incumbent retirement) are the standing arc.
- Previous: v0.59.2 (prev v0.59.1). v0.59.2 is the BOUNDED-PROFILE catch-up release, cut from a v0.59.1-based patch branch (no Stage 2 engine switchover aboard — that soaks on develop for 0.60): (a) the @bounded profile checker lands E070-E078 (ALS §B / ADR-0017, spec-first since 2026-08-21); (b) the ±0 min/max tie follows IEEE 754-2019 via totalOrder (ALS-T23 / ADR-0016) — on develop the same semantics lands as #1613 with the structural-emitter leg included, and the first-operand C-049 tie rule is retired.
- Previous: v0.59.1 is the CHECK-GREEN-MUST-BUILD release: a layered DDD verification (domain/application/infra packages over protocol ports, two structurally different adapters behind one generic use case) surfaced a batch of check-green/build-dead defects, all fixed with two-leg regression pins. (a) Cross-module convention methods carry their receiver BORROW MODE (#1549, incl. the mut-receiver emit-key mirror), a whole-parameter assignment to a `mut` param writes back through the &mut binding (#1550), and a protocol-bound generic's `mut` param keeps its by-reference convention through monomorphization (#1551) — the batch also covered derived-variant `.repr()`, top-level lambda `let` (E061), the Never guard else, guard-let in loops, and the mono/cross-module mut conventions. (b) A generic fn calling ANOTHER MODULE's generic fn monomorphizes the callee (#1556): the module-generic mono defers its prune, runs a second round after the top-level fixed point (module chains converge; BARE sibling spellings are discovered and rewritten module-scoped), and dedups instances against the module's own fn list — check was green while native died E0425 and wasm walled unlinked. (c) The C-132 move-mode bare-name landmine is defused (#1558): ambiguity is judged PER SCOPE, so a user `fn replace` no longer silently loses its write-back rewrite to stdlib's unrelated `string.replace` (the wall message had never named the collision). (d) A borrowed-param RHS stored into a field or indexed slot owns its String (#1560 — `t.name = s` emitted `&str` where the slot needs owned). (e) `almide fmt` keeps a protocol's `mut self: Self` (#1559 — the AST-conservation verifier caught the dropped `is_mut`). The pin doctrine these landed under is now recorded in-tree: a NATIVE codegen fix pins as a compiler test (tests/native_mut_param_pins_test.rs, 5 tests, A/B-verified red on the pre-fix compiler) because a wasm-leg corpus fixture never executes the broken native emit; the wasm-leg fixtures pin the cross-target behavior beside them. wasm subset: the COMPILER_FRONTIER debt reached ZERO — #1547's three shapes all lower (a `Result[(V1, V2), String]` transition return rides a generated `$__drop_vp_<A>_<B>` wrapper; closures CAPTURE rich lists — `List[<variant>]`/`List[<record>]` — through a tagged env class freed by a generated `__drop_env_rich` dispatcher; both port/adapter shapes run byte-identical under a 4 MB heap-cap churn), record-valued maps gained their stdlib family + the ROUTED shared-cell class (#1143 — `map.new/set/get` on `Map[String, <record>]`, a captured-and-mutated map cell frees through its type-specific sweep; C-319's statement widened), Codec `List[scalar]` defaults decode on wasm (#1520/#1563 — the `__decode_default_list_*` twins), and `mut` receivers/params lower via a borrowed-param COW admission (#1557 leg 1 — Dup+MakeUnique, no rc undercount, alias-exact). Record-pair Result returns lower (#1564 — `fn advance(s: St) -> (St, Ev)!` with St a RECORD, the transition shape over an ordinary aggregate: the `$__drop_vp_<A>_<B>` slot classification widened from variants to records — recursive-drop records recurse via `$__drop_<R>`, all-scalar records free flat — covering the (record, variant)/(record, record)/(record, String)/flat-record cells byte-identical and leak-free under heap-cap churn). The #1527 fuzz-frequency wall burn-down took the authoritative shard from 86 to 75 walls (result.filter's payload-independent `_h` twin with the interpreter VOTING via a new hof glue; list-of-maps and flat-payload-Result call arguments materialize as borrow views; `unwrap_or` results carry their read shape — the specimen fixture records that the trigger is the OPTION-RESULT nesting). Runtime: the HTTP client read timeout is CONFIGURABLE — `ALMIDE_HTTP_TIMEOUT_SECS`, `0` = block until the server answers (a local-LLM endpoint needs 30-120 s before the first byte, #1561) — and the timeout error names the knob instead of the raw errno. Also: module-level String constants fold through const references (#1552), a `_`-named module's derived Codec decode links (#1555), and an oversized wasm fn is survivable — a >50k-locals fn walls WITH its name and count, and the local-slot reuse pass takes a 15,021-local render fn to 24 declared locals (#1554). Contracts 302, cross-target fixtures 592 -> 600 (all 3-way voting), walled-real baseline EMPTY, rustc-warning ratchet 0. Known frontier: #1557 legs 2/3 (cross-module protocol-method linking — the obvious resolution fix produces a silent-empty run, scouted with findings recorded on the issue; nested package imports); #1564's second repro family (`-> T?!`) still walls honestly, and the axis is MEASURED as the Ok payload's PRODUCER, not its type: a plain-constructor payload (`ok(some(Row { .. }))`) lowers for record and variant alike; an inline `ok(<stdlib call>)` payload (`ok(list.get(xs, 0))`, `ok(xs |> list.find(lambda))`) walls for BOTH kinds; the bare-call `if`-tail under the `?!` lift (`if b then list.get(xs, 0) else none`) walls for a RECORD payload while the same call's variant payload lowers — the last open #1564 cell; and binding the call first (`let hit = list.get(xs, 0)` then `ok(hit)`) lowers everywhere, the in-language workaround.
- Previous: v0.59.0 (prev v0.58.0). v0.59.0 unblocks protocol-based static DI: an effect protocol method reached through a generic bound now type-checks AND lowers. Two independent defects had made the shape unwritable, and neither was reachable without a bound. (a) The checker never applied the effect-fn Result lift on that path — `finalize_call_return_ty` gates the lift on `env.functions` carrying the callee, and a bounded call has no such entry while the receiver is still a type var, so `check` saw the bare declared `T` while codegen emitted a call returning `Result[T, String]`. The two agreed only while the value was passed straight through: returning it unchanged worked, binding it with `let` or using it as a `match` subject emitted invalid Rust, and a `!` was rejected outright (E034 on a scalar/heap return, E001 one level too deep on an Option return) or ICE'd in ConcretizeTypes with unresolved types. There was no spelling that both type-checked and lowered once the value was consumed — which is every repository, since one whose result is never read is not a repository (#1545). (b) mono's `fix_body_match_ty` overwrote `body.ty` with the declared `ret_ty`. An effect fn's body is not Ok-lifted until ResultPropagation, which runs downstream of mono, so a body typed as the Ok payload was CORRECT there, not stale; overwriting it made the body CLAIM to be a Result it never wrapped, and ResultPropagation's "already Result — nothing to repair" gate then skipped the lift, emitting a bare `()` where `Result<(), String>` was expected. Only programs carrying a generic bound were affected, because mono is what runs at all; the workaround was a trailing explicit `ok(())` (#1546). Pure protocol bounds were never affected — the basic form, `List[T]`, multiple bounds `[T: P + Q]`, and heap-returning methods all ran throughout, which is what isolated both defects to the effect path. The regression tests split by target on purpose: the checker lift is a corpus test (`spec/lang/protocol_generics_test.almd`, on the wasm leg), the ok-lift is a compiler test (`tests/effect_tail_generic_bound_test.rs`) because `wrap_non_result` is `matches!(target, Target::Rust)` and a corpus file would assert nothing on the wasm leg — the same reasoning as the #1210 tests. Known frontier: a `Result[tuple]` return still walls honestly on wasm (#1547) — `-> (St, Ev)!` declines while the same function over a record (`-> Outcome!`) lowers, which is exactly what an aggregate transition returning `(new_state, event)` hits.
- Previous: v0.58.0 (prev v0.57.2). v0.58.0 grows the THIRD ORACLE and corrects a both-backends-wrong decode. Behaviour: clock reads are effect fns (#1515 — `datetime.now()!` / `datetime.monotonic_ns()!`; nondeterminism is visible in the type system, held by the cap-effect consistency gate; bundled stdlib effect fns are never Result-lifted so migration is the `!` alone); `matrix.from_q1_0_bytes` and the q-format loaders decode on the GLOBAL-k schedule with a per-element bound on BOTH legs (columns need not be a 128-multiple; a block outside the buffer decodes 0.0 — was silently wrong numbers, found by the nightly fuzzer against the byte-oracle KAT); `list.slice` negative-index doctrine is unified across every route (negative start -> empty, end clamped — was a wasm infinite loop on the heap-element twin); tail-recursive effect fns with an explicit `err(reason) => err(reason)` arm build again (#1536 — the v0 TCO accumulator was payload-typed while the err arm assigned the full Result, rustc E0308 on a check-green body; the err tail now takes the effect convention's own `?` early exit, pinned under C-069). Added: stdlib `hash` (FNV-1a 32 + SHA-256, self-hosted on wasm, pinned to published vectors, C-299); a diagnostics wave (structured @deprecated errors, one-sided Option compare is E037, unhashable Map keys coded by cause, machine-applicable Fix-it floor 27); Codec rejects generic derives at check; the regex engine walks repetition iteratively (one wasm frame per match; the `+` try floor is the entry count). Assurance: the reference interpreter crossed its tagged-heap arc (#1226 slice 2) — abstains 135 -> 27 rows, real 3-way votes 77% -> 96%, zero dissent throughout, with slot materialization STRICT against declared element types after the nightly fuzzer proved the mislabeled-impl leak class (17 findings, all disposed same-day, confirm night findings=0); two unmasked interpreter bugs fixed with 3-way pins (record literals construct omitted DEFAULTED fields, C-036; `!` on None in a pure Option fn propagates `none`, C-211); release evidence is sealed per-tag (proofs/releases/v0.58.0.toml). Known frontier: Codec decode heap-result-match shapes stay walled honestly on wasm (#1520/#1522); the v1 leg deliberately declines the TCO loop rewrite for err($var)-base effect bodies (real input-bounded recursion; disclosed in C-069); #1229 quadratic wasm string-accumulator concat carries over.
- Previous: v0.57.1 (prev v0.57.0). v0.57.1 is a CORRECTNESS + ASSURANCE release; no surface changes, no breaking changes — everything 0.57.0 ran, 0.57.1 runs, including multi-GiB allocations on both targets. The integer-domain sweep: a new instrument (tools/domain_edge_matrix.py) crossed every public stdlib fn taking an Int with a fixed edge set on both targets and found 218 divergent cells, all closed, reducing to three mechanisms: (a) ADDITIVE bounds guards (`pos + len > blen`) defeated by their own arithmetic under wrapping Int — worst case `bytes.read_string_at(b, -1, 3)` returned the heap block's cap field AS STRING CONTENT, exit 0, both legs; every guard is now subtractive (C-054); (b) UNSIGNED steps inside signed arithmetic, native only — datetime.from_parts wrapped negative months, math.choose accumulated in u64, string.from_codepoint turned 2^32 into a valid NUL codepoint, datetime.to_iso wrote non-UTF-8 bytes for out-of-range years; all match the always-i64 self-host now; (c) RAW failure forms — list.range(i64::MIN, 3) was a native capacity-overflow panic (exit 101); every allocating path now fails through checked arithmetic + try_reserve into the single defined `Error: out of memory` + exit 1 on both targets. A unified 2 GiB allocation ceiling was implemented mid-cycle and WITHDRAWN before release (ratified ○×: A) after a nine-compiler survey found zero precedent for a chosen cross-target cap — each leg allocates to its own structural bound, and native satisfying what wasm32 cannot is the contracted divergence C-197 declares, per-cell in proofs/domain-edges.toml (64 declared, 0 untriaged). Also: io.read_n_bytes(i64::MAX) read NOTHING on wasm (i32 truncation at the host floor) — now chunked 64 MiB reads with no cap on the answer; bytes.chunks no longer computes its count from an overflowed `(total + size - 1)`. Verification hardening: output-parity fixtures run with stdin closed and the verdict counters must sum to the corpus (a fixture reading stdin had silently truncated the sweep and reported ~300 phantom regressions); check-contracts.sh no longer races SIGPIPE under pipefail (it was red ~1 run in 6, naming a different contract each time); the domain-edge instrument re-measures a DIVERGE alone before recording it; new gate scripts/check-alloc-ceilings.sh holds the repeat family's released ceiling together across every spelling. v0.57.0 is a CORRECTNESS + ASSURANCE release; no surface changes. Fixed, all live in 0.56.0: (a) COMPILER PANIC — `guard let` inside a for/while body crashed lowering (#1204; the loop form was the construct's most natural use and had zero coverage — C-224 now pins 12 byte-identical shapes); (b) `Bytes?`/`Matrix?` `??` inline in a call argument emitted invalid Rust (#1210, E0308 — the RcCow arm mismatch; found by the bytes semantics-manifest measurement on its first run); (c) matrix transcendentals diverged native ⇄ wasm and BY HOST ARCH — up to four answers for one program (#1197; pow/rope/sigmoid now route the vendored musl-libm, softmax/gelu run ONE canonical unfused fast-exp on both legs — wasm has no FMA instruction, so unfused is the only reachable fixed point; C-223); (d) an expression-nested `!` on wasm read the err block's payload slot as the value (#1183, accept-and-wrong — ANF-hoisted to the proven bind-position machinery; C-222); (e) the certificate-layer itoa printed negative i64 as u64 (sign + wrap-negation magnitude, i64::MIN exact). Assurance: the mission-critical arc's instruments — every hand-written WAT prelude fn classified with re-measured evidence (proofs/wat-prelude-audit.toml; two dead fns deleted, five executed with pinned stdout); the interp oracle's BRIDGEABLE class reached ZERO (voting 253/369 = 68.6%; trampoline TCO, env/fs/args floors, fan.any — every remaining abstention is the declared interp-heap arc); the semantics manifest armed bytes/int/process (measured probes, never reasoned); scalar-read and platform-libm audit gates hold at zero unguarded. Known limitation (perf, not correctness): the wasm string-accumulator TCO is quadratic at scale — byte-identical output, #1229 tracks the amortized-capacity fix.
- Previous: v0.56.0 (prev v0.55.0). v0.56.0 removes the `list.try_*` family — the ADR-0006 arc's final act, one release after its deprecation window. SURFACE CHANGE: the seven twins (`try_map` / `try_filter` / `try_flat_map` / `try_filter_map` / `try_fold` / `try_find` / `try_each`) are gone as public names; a call is E043 carrying the mechanical rewrite (`list.try_map(xs, f)` → `list.map(xs, (x) => f(x)!)!` — fold takes the two-arg lambda, the rest are the same shape). The MEANING lives on the fallibility-polymorphic core (v0.55.0, D1): the callback's `!` is the strategy, one name per combinator — `try` was a loan-word whose lenders disagree (Rust try_fold = short-circuit, Swift/Zig try = propagation = almide's `!`), and the ambiguity retires with the name. Mechanics: the seven bodies persist as `__fallible_*` INTERNAL CARRIERS the checker's fallible-callback normalization routes to (named `__try_*` for one release; naming one in source is now the same E043, because deleting the public spelling while the carrier stayed writable — and IDE-visible — renamed the second spelling rather than removing it), so the polymorphic form's behavior — and its wasm closure-lifting native-fallback frontier, ledgered since 0.53.6 — is the same shipped code; the family gate completes its three-state arc (completeness matrix 0.53.6 → frozen seven 0.54.0 → EMPTY surface + carriers-exist now); the one real-world use (tools/almide-gates, the measured migration cost of the whole removal) moved to the polymorphic spelling.
- Previous: v0.55.0 (prev v0.54.0). v0.55.0 is the EXPLICIT-PROPAGATION SWITCH: the 0.54 deprecation window closes and the ADR-0008 world is the only world. (a) Implicit propagation (auto-?) is REMOVED — every formerly-stripping position (statement, un-annotated let/var, condition, value-pattern match subject, interpolation, assignment) is the hard error E041 with the mechanical `!` insertion; a discarded statement-position Result is E042 (must-use, EVERY fn kind) with the two escapes spelled in the hint (`expr!` propagates, `let _ = expr` discards); `let _ = f()` now genuinely DISCARDS — the err does not propagate (pre-switch it did; C-217 pins the new behavior cross-target). The two hazards the implicit form carried — pattern-shape-dependent stripping and annotation-inverted behavior — are structurally gone (spec/lang/explicit_propagation_test.almd fails on 0.54 by design: the A/B). (b) The fallibility axis reaches fn types (ADR-0006 D1, #1108 Phase 2a): the core list HOFs are 1-bit fallibility-polymorphic — `list.map(xs, (x) => f(x)!)!` (or a named `-> T!` callback) instantiates the first-err short-circuit form; one name per combinator, the callback's `!` carries the strategy (Swift SE-0413's shape, E=String per ADR-0002). Consequently `list.try_*` is DEPRECATED (E043, the hint IS the mechanical rewrite) and the seven are removed together in v0.56.0. (c) `result.collect`/`collect_map` are REMOVED (ADR-0007's window): partition is the substance, the polymorphic map the first-err traversal; the List[String]-err join on `!` outlives the retired name (spec/stdlib/result_errjoin_effect_test.almd). (d) `T?` is general Option shorthand (ADR-0010): valid in EVERY type position, atom-tight binding (`(A) -> B?` returns Option; `((A) -> B)?` is an optional fn value — measured 0 uses; nested spells `(T?)?`), and CANONICAL — `almide fmt` normalizes `Option[T]` to it (spec+examples migrated, 1044 sites; stdlib keeps longhand as the boundary-unification witness). (e) #1125 is fixed (C-216): explicit `!` on a declared-Option effect call was the wasm silent-wrong class (raw Option block read as a Result — hit=999 then an rc_dec trap, pre-existing since 0.53.6); the spelled marker is now the implicit strip's identical twin on native, wasm, AND the interpreter (the 3-way oracle dissented until the strip landed there too) — the drop-in equivalence the switch REQUIRES. Output-parity ratchet 406 → 408; contracts 215 → 217.
- Previous: v0.54.0 (prev v0.53.6). v0.54.0 is the ERROR-SURFACE RATIFICATION release: ADRs 0002–0009 fixed the error-handling design space in one arc (fallibility ⊥ effect; String is the TERMINAL error type with a branching doctrine, not a tag system; value-level operators are desugarings of named stdlib fns; propagation will be EXPLICIT-ONLY) and this release ships everything the rulings unblocked. (a) The pure-fallible return marker `-> T!` (#1103 Phase 1, ADR-0002): `fn parse(s: String) -> Int!` is `Result[Int, String]` without the effect axis — parses in return position, resolves through the checker, round-trips `almide fmt`; the value-tail lift is Phase 1b. (b) The E041 deprecation window (#1123, ADR-0008 release N): implicit propagation — the auto-? that silently unwrapped a Result in statement position, un-annotated let/var, conditions, value-pattern match subjects, and interpolation — now WARNS at all five classes, with a zero-width `!` insertion hint at plain-Call sites only (multi-token spans lie: a pipe span produced `|>!`, a fan block `fan!.any`, so non-Call sites warn without a hint; the harness try-apply gate pins the restriction). Behavior is unchanged this release; the NEXT minor switches — implicit propagation is removed, an unused statement-position Result becomes a check error, and the `e()?` / `e() ?? fb` special rules die with it (blocked on #1125, a pre-existing wasm bug the migration itself flushed: param-position explicit `!` prints a wrong value then traps, reproducible on v0.53.6). WRITE `!` NOW. (c) The `list.try_*` family is FROZEN at seven (ADR-0006) — v0.53.6's completeness matrix is INVERTED into a freeze gate: no new try_ member ever; the fallibility-polymorphic core combinators (#1108, `list.map(xs, (x) => f(x)!)!`) replace the family wholesale, then all seven are removed together. (d) `result.collect`/`collect_map` are deprecated (E039, ADR-0007): Rust's collect short-circuits where almide's collected ALL errors — an opposite strategy under the same name loses the writability tiebreak; `result.partition` is the substance. (e) Error-doctrine lints (ADR-0004): E035 flags branching on error TEXT, E036 flags a `map_err` that drops its error argument (`(_)` is the intentional discard). (f) Diagnostic hygiene (#1113): E007/E008's double meanings split into E032 (mut param) and E033 (opaque ctor), off-type `!`/`?`/`??` numbered E034, every code carries fixture + doc + the uncoded-diagnostic ratchet (40 → 39). Checker holes closed (#1115–#1121): E037 same-head eq mismatches, E038 line-crossing `??`, guard-else exit const-folding with new signed comparison folds, the `??` fallback constraint, Result[Unit] interpolation. (g) Stdlib per ADR-0004 D4: the fs content-reader `*_if_exists` family (absence-as-Option with runtime NotFound classification, C-215); `assert_none`/`assert_err` complete both assertion polarities; `option.to_result` generalizes over E with a pure bundled body. docs/specs/result-option-effect.md is REWRITTEN from 287 measured probe cells and the native⇄wasm output-parity ratchet rises 383 → 406.
- Previous: v0.53.6 (prev v0.53.5). v0.53.6 is the ZERO-COMMITTED-SHELL unblocker: the two primitives whose absence forced real programs back to `var + for` and `perl -e 'alarm'`. (a) The `list.try_*` family (#1041) — `try_map` / `try_filter` / `try_flat_map` / `try_filter_map` / `try_fold` / `try_find` / `try_each`, each the core combinator with its callback lifted to `-> Result[_, E]`, short-circuiting on the FIRST err (later elements are never evaluated), so an effectful pipeline stays a combinator chain: `files |> list.try_map((f) => read_meta(f))!`. The completeness rule is a machine-checked matrix (tests/list_try_family_gate_test.rs) with recorded omissions (`any`/`all`/`count` are try_find's domain; `sort_by` has no erring order). Pure-Almide bundled generics — on the wasm leg they are the honest closure-lifting frontier (native fallback), ledgered next to list.iterate. (b) `process.exec_status_timeout(cmd, args, timeout_ms)` (#1040, C-214) — the ONE admissible timeout: spawning a process is already outside the byte-identity contract, so bounding it adds no nondeterminism (bounding a pure computation would — the 0.29.0 removal stands; today's `fan.timeout` is the separate deterministic omega-replay form). If the deadline fires the child is KILLED and the err is exactly `exec timed out after <ms>ms`; whether it fires belongs to the host. Chatty children cannot deadlock the drain (reader threads); the parity gate dropped its perl `alarm; exec` wrapper for it.
- Previous: v0.53.5 (prev v0.53.4). v0.53.5 is the ONE-NAME-ONE-MEANING release. SURFACE CHANGE: the 15 retired json.*/value.get aliases are DROPPED after their one-release E040 window (#1078) — constructors and accessors live on `value.*` (`value.null`/`value.object`/`value.field`/`value.as_int(...)?` …), json keeps the format (parse/stringify/pretty, path API, typed-key `get_*`); a retired spelling is an ordinary E002 now, the migration map is docs/stdlib/json.md#renamed-operations, and the namespace gate pins the end state (no fn reachable under two module names — one behavioral tightening: `value.as_int` does not widen Float, unlike the dropped `json.as_int`). The bytes byte-level writer family is complete and cross-target (C-213): the Endian-parameterized typed IO compiles natively (#1098 — the runtime owns the enum + dispatch, the FileStat pattern), the `write_*` serialization cursor links on wasm (#1099 — three were `append_*_be` under another name), and the reference interpreter models the WHOLE family from the name with a completeness gate scraping stdlib/bytes.almd itself (#1021). The interpreter also copies `mut` parameters back to the caller's binding (#1022), giving C-132 a real third vote. Accounting honesty: a user-fn `??` operand's unwrap helper is credited in the caps counter (#1079 — the one mir>ir direction the elided-call backstop forbids), the self-host link-collision wall got its unit seam + the two-module hex fixture that no corpus program had ever exercised (#1068, C-212), and the native ownership verifier tracks the payload-borrow address chain and heap branch results (#1037 — two phantom-violation classes cleared; the remaining matrix false-fail is #1100, a result-rewrite window bug with the op-stream evidence filed). Release-PR CI dropped from ~48m to ~28m by narrowing the platform legs to their historically-proven-unique coverage, with the audit recorded in the workflow (#1039).
- Previous: v0.53.4 (prev v0.53.3). v0.53.4 is a WRITABILITY patch — four defects a writer hits and one idiom that no longer needs a workaround. (a) A tuple pattern in LAMBDA parameter position now binds every name (#1060): the parser had produced `tuple_names` since the form existed but nothing downstream read it, so the second name was undefined and the writer got E003 on a variable they had just written. `((k, v)) => …` works on `map.entries`, `list.enumerate` and any pair list, so CLAUDE.md's documented `let (a, b) = entry` rewrite is retired. (b) An ordering comparison on strings coerces BOTH operands (#1033): a `String` parameter is emitted as `&str` natively and a literal as an owned `String`, and whether the bare variable also got `.to_string()` was decided per-USE by clone insertion — so `c >= "0" and c <= "9"` compared `&str` with `String` on one side. rustc rejected what `almide check` accepted, native-only; the SINGLE-comparison shape was broken too, which the report did not mention. (c) A lambda argument wrapped in redundant parentheses is recognized as a lambda (#1018), so its parameters are pinned from the callee signature; previously the body inferred against fresh vars, an ill-typed `+` unified as concat instead of colliding, and the first complaint arrived at IR verify — past the boundary where an E-diagnostic promises that a check-green program builds. Reported against map.fold, but the trigger was the paren, so every parenthesized lambda argument was affected. (d) #1056 (false unused-variable warning on a directly-called lambda binding) was already fixed upstream and is verified closed.
- Previous: v0.53.3 (prev v0.53.2). v0.53.3 closes the two module-identity gaps v0.53.2 left open, and both turned out to be one theme: a name was resolved from the wrong SOURCE. (a) Inside a DEPENDENCY package's submodule, a qualified sibling reference (`domain.Span` in `wire.almd`) fell through to a bare fallback that strips the module and finds the REFERENCING file's own same-named type — silently, since a structurally compatible type still type-checks; sibling references now resolve against the current package (#1094). (b) The same package's derived Codec methods never linked AT ALL, collision or not: the definition emitted `almide_rt_<pkg>_v0_<mod>_<pkg>_<mod>_Type_encode` (module doubled, because the versioned origin does not prefix-match the IR name) while each call site rebuilt the name from its own guess — the codegen map now stores the symbol the DEFINITION emits, so no consumer guesses. (c) On the wasm leg, two modules declaring the same bare type name with one Codec derive walled (`unlinked stdlib/runtime call: Span.encode`) while native ran: the wasm owner map was built from type DECLARATIONS, so a module that derives nothing still claimed co-ownership and the unique-owner test declined for every caller; it is now built from definitions, matching what native always did (#1093). native == wasm holds for the shape again.
- Previous: v0.53.2 (prev v0.53.1). v0.53.2 is a MODULE-BOUNDARY patch: the conveniences that worked in a single file and broke across an `import` now behave the same on both sides. Default arguments travel with a function's exported signature (#1088 — the arity check consulted the stdlib table for every dotted name, and lowering's defaults map was per-file and keyed without the module prefix, so fixing only the checker would have shipped a 1-arg call into a 2-arg function); a convention method resolves from the receiver's qualified type whether it was DERIVED (registered bare) or written EXPLICITLY (registered prefixed), which restores `p.encode()`, `x.repr()` and the `json.encode(p)` convenience across a boundary (#1087, #1089) — the repr case is the one that failed SILENTLY, rendering the variant name with no diagnostic anywhere. `import json` is no longer reported unused on a file whose next token uses it. Two non-boundary fixes: `almide fmt` kept a comment written inside a record body (#1090 — it was DELETED, and a comment is the one artifact the compiler cannot reconstruct), and a method chain may break the line before its `.`, which SPEC.md §2.1 already specified (#1091). Not closed: a type name is still not namespaced per module for the convention-method table, so two modules declaring the same name still fail — but now via the #433 name-pin gate NAMING both candidates instead of a field mismatch attributed to an innocent file (#1087a, the #908 class), and a `[T: Codec]` bound still mangles the method name during monomorphization.
- Previous: v0.53.1 (prev v0.53.0). v0.53.1 is an INTERNAL-QUALITY patch (the codopsy grade-A campaign, compiler-internals leg, part 1): 30+ almide-mir files refactored to grade A with behavior-preserving extractions — the worst hotspots dismantled (the native Result-carrier rewrite's one-body cy-76 state loop into a window tracker, the wasm fuser's cy-61 dispatch onto shared instruction-name tables, the heap-branch desugar fixpoint into an ordered pass table), duplicated ownership bookkeeping deduplicated into named helpers, and guard ladders split into predicate functions. Zero observable behavior change: every batch pinned by the full suite (613 mir tests, spec/lang on both legs) and the Trust Spine corpus gates. Remaining files tracked in #1085.
- Previous: v0.53.0 (prev v0.52.0). v0.53.0 is the PLATFORM-CONFORMANCE release (the Wasm 3.0 / WASI audit burn-down): NaN observation is canonical on every target and host architecture (C-210 — the deterministic-profile stance applied at the language layer, with a machine gate pinning no-relaxed-SIMD/atomics/shared in emitted modules); the self-host linker walls same-name/different-signature collisions instead of emitting an invalid module (#1068); function-tail closure calls emit return_call_indirect (C-178); and the wasm leg now RUNS ON WINDOWS HOSTS with a per-push CI parity gate (#1066) — the fs path contract is recorded against what Go, Rust, and wasi-libc actually do on wasip1.
- Previous: v0.52.0 (prev v0.51.0). v0.52.0 is the JSON-INTEROP DECISION release: #1062 ("interop with the world's JSON is an accident, not a decision") is decided and closed with ZERO added mechanisms — no rename knob, no variant-tagging knob, no new syntax. The stance, now official in CHEATSHEET's "JSON & the wire" section: wire types mirror the wire's names verbatim (`traceId: String` in a wire type is correct practice, not a style violation — renamed-by-convention knobs are the one design whose failure mode is runtime-silent, which loses the MSR tiebreak); `as "wire"` is scoped down to keys that cannot be Almide identifiers; foreign tag shapes (internally-tagged unions) are hand-written codecs — per-case Codec records plus a ~1-line-per-case dispatch that composes with every derived Codec automatically. The semantics under that stance are C-209: derived Codec encode OMITS a none Option field (proto3-style unset; every peer that started null-by-default — serde, Go, aeson — grew an opt-out later, so Almide omits from day one), decode keeps folding missing/null to none, so decode(encode(x)) == x while encode(decode(doc)) normalizes; defaults stay emitted; a proto3 oneof is now just an all-Option mirror type with `= none` defaults — one key on the wire, zero special casing (the OTel demo's Jaeger-400 class dies at the root). `Value` fields pass through verbatim in both directions, making `Option[Value]` the sanctioned 3-state escape hatch (missing → none, explicit null → some(null) — the ONE Option cell where absent and null differ, RFC-7386-shaped). The #1061 class ("check passes, generated Rust fails") turned out to be 13 field-type cells wide, not 2, and is GONE both ways: Value/Option[Value]/List[Value]/Option[List] lower correctly, containers nest arbitrarily (#1065 — List[Option[T]] with meaningful element nulls, List[List[T]], Option[List[Option[...]]], via per-type recursive workers with Try only in bind position), and everything outside the closed grammar rejects at declaration with targeted E023 hints (Option[Option] at any depth is void on the wire; element-position Option[Value] has no absent state; sized numerics/Bytes/tuples/fn/Result are not wire concepts). The executable spec is spec/stdlib/codec_field_matrix_test.almd (every accepted cell's wire bytes + decode states + the retraction law) plus spec/wasm_cross/codec_none_omission.almd (byte-identical native == wasm) plus tests/diagnostics/e023-codec-* (every rejected cell). Cross-target reach (#1064): an Option block IS a 0-or-1-element list block, so both drop generators now normalize Option[heap] fields to their List twins before classification — variant record-ctors and records with Option[String]/Option[variant] fields lower on the wasm leg (previously an honest wall in call-arg position, and a LIVE LEAK for a record field holding a Var-built Option[String], whose some-payload a flat rc_dec never freed); some/ok over a list payload routes through the same ANF-materialize-retry the Call class uses; Option-field variant encodes ride per-case payload workers so the derived encode stays in the return-match subset. Two latent deriver bugs fixed en route: field bind vars were `_{name}`, so a Codec field literally named `v` (or a variant payload field named `tag`/`payload`) shadowed the document in emitted native Rust and mis-decoded at runtime ("expected Object") — binds are `_f_`-prefixed now; and CHEATSHEET documented a `{"tag","value"}` variant wire shape that has not existed for months (the derived form is externally tagged — `{"Click": [10, 20]}` — which is where #1062's own premise came from). The walled-real frontier is enumerated honestly: six functions in the new matrix file (the Result[List[Option[T]], String] heap-result arm class + record binds whose Option payloads sit outside the drop-exact set) are ledgered in proofs/walled-real-baseline.txt as the next brick, running green on the native leg meanwhile. E022's lift (allow `!` propagation in pure Result-returning fns — the one gap every peer language with hand-written codecs has an answer to) is split to #1067.
- Previous: v0.51.0 (prev v0.50.0). v0.51.0 is the SURFACE-RULE release: the six dogfooding issues #1049-#1054 were one defect in different coats - a rule the writer generalizes from the docs failing on compiler internals they cannot see - and each is now position-independent (`!` uniform on effect calls, operand-position implicit unwrap, feature-classified import walls, annotatable runtime-backed stdlib types, shape-derived hints).
- Previous: v0.41.0 (prev v0.40.2). v0.41.0 is an INSTRUMENT + MEASUREMENT release, the first Unit of the 0.41→0.99 version ladder (docs/roadmap/ROAD_TO_1_0.md — all 40 open issues mapped to release arcs, executed AI-DLC-style per docs/AI_DLC.md with a per-Unit plan/ledger pair under docs/ai-dlc/units/). The headline: the nightly differential fuzzer is CONFIRMED BACK as a usable instrument — the build lives in its own job so the campaign spends its whole runner lifetime fuzzing instead of ~62% of it compiling, and the full-budget streak reads 3/14 consecutive completed nights (scored by scripts/fuzz-track-record.sh; those nights are red only because the working instrument now records a real finding — triaging it is 0.42's work, and #924 stays open until the 14-night streak). Runtime performance is MEASURED again (#917 closed): research/benchmark/perf/results/ carries dated both-leg results — 8 benchmarks with native and wasm variants plus handwritten-Rust references — replacing the dead v0.25.0 scoreboard, published in BENCHMARKS.md and the README headline, and a two-sided perf-ratio ratchet (scripts/check-perf-ratio.sh) gates the Almide/Rust runtime ratio in CI: a regression fails, and so does a stopped-clock "improvement" below half the baseline, which would mean the benchmark broke. Plus: research perf sources migrated off the retired range spellings, and grammar-lab's last stale sources (retired ranges, the removed ++ operator, effect-call propagation) revived.
- Previous: v0.40.2 (prev v0.40.1). v0.40.2 is a TEST-INFRASTRUCTURE PERFORMANCE patch: the three cross-target corpus gates (native==wasm equivalence, the interp 3-way oracle, wasm-opt parity) asked three questions about the same spec/wasm_cross corpus and each walked it separately — 1908 builds of which 954 were redundant. They now share ONE lazily-built table of legs inside one test binary (#952): the corpus costs native + wasm + wasm-opt, all three gates read the same table, and the interp harness's ~90 duplicated helper lines are gone (net −138). Measured: ~380s → 225s for all three gates on the 324-fixture corpus. The unification PRESERVES the #991/#998 hang-proofing semantics in the shared leg builder: a guest exit 127 is a comparable observable, and a mid-run wasmtime spawn failure becomes a per-fixture sentinel leg that each gate reports as that fixture's failure — never a whole-gate skip. Every classification arm moved verbatim; the interp abstain ledger stays backend-free and never self-skips.
- Previous: v0.40.1 (prev v0.40.0). v0.40.1 is an LSP CORRECTNESS PATCH, proven by an instrumented CI probe. The chain: the LSP test suite built Windows file URIs as `file://C:\...` (invalid), the server's params deserialization rejected them, and `handle_request`'s `None` path sent NO response — a JSON-RPC violation that left the test client awaiting forever, burning a 6-hour Windows runner on EVERY develop→main PR since v0.39.0 (invisible: build-cross is not a required check). All three links fixed: every request now gets a response (null for the unanswerable, with the drop logged; undeserializable notifications log instead of vanishing), the tests build URIs correctly cross-platform, and `uri_to_path` now percent-decodes and normalizes drive paths — VS Code on Windows sends `file:///c%3A/...`, which the old bare strip_prefix turned into a nonsense path, silently degrading per-project analysis for every real Windows editor. Probe measurement: 6h hang → 20/20 in 2.17s. Plus `ALMIDE_LSP_TRACE` server tracing, server-stderr capture in the test client, a 60s read deadline with kill-on-drop, a 60-minute build-cross cap, and GIT_TERMINAL_PROMPT=0 workflow-wide — a repeat of this class is a fast, named red.
- Previous: v0.40.0 (prev v0.39.0). v0.40.0 is a TRUST-INFRASTRUCTURE release: the "gates that don't gate" audit (#994) closed 16 issues where a green check measured nothing. The headline resurrection: proofs/output-parity.sh — the v1 stdout-parity ratchet — had NEVER executed in CI (it resolved its oracle via PATH while CI only built ./target/release, #978); re-armed, its baseline grew 210 → 378 fixtures and every failure class now names its files. The measured-TCB gate forbids trust-spine's self-fulfilling carried-forward fallback and caught real drift on its FIRST run (checker.ml 1144 → 1196 lines; TRUST-SPINE.md corrected, #989). Wall presentation completes #931: a span-carrying wall renders a surface-language headline + the documented rewrite hint + caret, the compiler-internal reason demoted to a note:, with WallShape stamped through the nesting wrappers and a shape/hint matrix gate. Vacuous passes are structurally unreachable at every fixed site: the determinism gates enforce corpus identity with a walled ceiling of 0 (#985), embedded-size ratchets BOTH directions with the floor at its real ~286 sources (#987), forbidden-impurities scans all 8 compile-path crates with existence checks (#986), the wasm cross-target gate treats a guest exit 127 as a comparable observable instead of returning green mid-corpus (#991), the contract-ledger paths-ignore bypass is closed (#982), build-cross runs the whole workspace with an ALMIDE_EXPECT_TOOLS tripwire (#983), and spec/ + examples/ are formatted and held by the fmt --check gate (#919). Dev loop: release builds are incremental, so an mtime-only docs/stdlib bump rebuilds in ~0.8s instead of 8.6–30s; cold CI runners opt out via CARGO_INCREMENTAL=0 (#1006).
- Previous: v0.39.0 (prev v0.38.0). v0.39.0 is a SYNTAX + TOOLING release. The headline: the Rust-style range spellings are REPLACED by Swift's — `..<` is the exclusive range, `...` the inclusive one (#967). The old spellings do not fail cryptically: E031 names the replacement with a fix-it, `almide fix` performs the migration surgically, and every range in the repo's own snippets (wasm runtime, checker/interp/lower test snippets, docs) is migrated with it. Cross-target correctness: `bytes.copy_from` into a mutable-global destination routes through the storage slot like the other in-place mutators, and an aliased source is hoisted as an owned snapshot so the copy reads the pre-write bytes (#964); `fan` is documented as the deterministic list-order surface it is and the fan block is counted into C-004's interleaving exception (#965). LSP (#961): positions honor UTF-16 code units across the server as the protocol requires, dependency fetching stays off the keystroke path, fix-its are delivered as code actions, and unscoped rename is dropped rather than kept wrong. Instrument: a wasm-leg COMPILE error in the differential fuzzer is a FAILURE, not a v1-wall skip (#962); each fuzz night records a structured verdict line with a track-record scorer for the closure streaks (#960); and the Test Rust job caches the cargo registry and target dir so PR runs stop cold-building the workspace (#968).
- Previous: v0.38.0 (prev v0.37.0). v0.38.0 is a PERFORMANCE + SURFACE-COMPLETENESS release. Three superlinear/wasm-memory classes die: `json.parse` is linear on wasm — heap-element `list.push` is amortized with geometric growth and the parser's per-element recursion became loops, 11 min → 129 ms on a 100k-element array, deep arrays no longer overflow the stack; the string self-append accumulator runs flat — `__str_append1` writes in place at rc==1, 1.27 GB peak → 20.8 MB at 4M appends, and C-054's construct-from-temp leak exception is RETIRED with flat-RSS evidence at 10M iterations (#911); repeated in-place writes through a mutable global stay in place — the receiver borrows the post-COW handle so the second write stops paying an O(|buffer|) copy per iteration, nendo's three-copies-per-vertex VRM loop 23 s → 2 ms (C-193). Correctness: a module-level global reads its TRUE value on every branch path — the materialization memo is scoped to straight-line context through one chokepoint and heap-result arms carry the C-188 arm discipline; a `let CAP` compared in an else arm read 0 and rejected every glTF primitive (C-191, #945); an auto-unwrapped effect call interpolated into a string lifts and propagates like any call argument (C-192, #950). The sized-integer surface is COMPLETE BY RULE (#956): 96 new fns — `to_<dst>_checked`/`to_<dst>_saturating` for every one of the 38 lossy sized→sized pairs, `int.from_uint64_checked/_saturating` for the one lossy widening, `min_value`/`max_value` on all nine integer carriers — and the SHAPE is machine-enforced by a numeric-matrix gate in `almide docs-gen --check` that derives the expected surface from the range table and diffs it against the compiler's own module interfaces in BOTH directions (a lossless pair must NOT carry the trio; a tamper drill proves both detection directions), with the stdlib claim regenerated at 965 functions across 41 modules and the API-family rule recorded: families are extended by matrix, never point-wise. Tooling: `almide explain` answers every documented diagnostic from the INSTALLED binary (docs embedded at build time, #923); wall reasons render through Display as one sentence at any depth and the verified-native fallback is noticed by default (#931); heap classification is defined ONCE per runtime model with the five drifted copies deleted, fixing a Named lift leak in ANF and TCO (#926). Trust spine: runs on the release path, every compiler crate, the stdlib AND the spec corpus itself; wasmtime is installed in CI and a missing gate tool is a FAILURE there, an honest skip locally (#921); the axiom audit asserts kernel-checked cleanliness — 67/67 Print Assumptions with a tamper drill that compiles an injected Axiom to prove the detector fires (#920); the byte-binding gate extracts $rc_inc/$rc_dec from the RENDERER's own rendered output and parses the proven byte lists from the .v sources, so no hand-copied constant sits between the theorem and the shipping bytes (#932); README and TRUST-SPINE claims (checker size, theorem counts, proven-vs-trusted boundary) are script-derived. And the v0 retirement's dead code is GONE: the orphaned 26-pass wasm pipeline, the second Perceus, the sketch emitters, the unused wasm-encoder dependency and five tracked binaries — 4,756 lines deleted with every gate byte-identical before and after (#930); the examples ledger is compile-gated and four months of broken examples are fixed.
- Previous: v0.37.0 (prev v0.36.0). v0.37.0 is a CORRECTNESS + REACH release: sixteen new behaviour contracts (C-175…C-190), the cross-module link path made sound, and the code-health campaign finished. Cross-target correctness: a scalar `if` ARM now executes its statement effects — a mutable-global write inside the ordinary early-return guard `if bytes.len(d) < 12 then 0 else { bytes.set_i32_le(g, …); … }` lowers instead of walling, and an outer-`var` reassignment inside an arm hits that var's STABLE local instead of a frame-local rebind, which was last-writer-wins and printed 1 where native printed 1001 (C-188, a silent wrong value); sized-integer `^` wraps at the declared width like `+`/`-`/`*` — it reached the lane as a `math.pow` CALL and bypassed the wrap in three places (C-180), and `^` is the same total exponentiation as `math.pow` (C-184); `UInt64` reaches its full declared domain with every observer reading the slot unsigned (C-179); the heap-element `chunk`/`windows` twins clamp negative counts like their Int siblings did — `windows(xs, i32::MIN)` computed ~2^31 windows and hung wasm against native's instant `[]` (C-054, found by differential fuzz); `fan.any` returns the first Ok in LIST order whatever position it is in, lowered as one first-ok chain instead of duplicating the continuation per level (C-185); a mutable-global projection read in a loop-body call argument reads the CURRENT slot every iteration — the hoist walker descended through loop bodies and froze one stale handle for the whole loop (C-177); an in-place mutator writing through a module-level `var` buffer COWs the SLOT (C-187, it blocked almide-graphics/nendo's VRM viewer, whose whole scratch arena is one module-level buffer); mutual tail recursion runs at unbounded depth via `return_call` (C-178); `args.positional` stops dropping the first argument (C-181); a negated float literal takes its context's float type so `Float32` negatives build (C-182). Lowering reach (each previously an honest wall): variant-typed List literals in bind and heap-result-if-arm position (C-175), `some`/`ok` around an inline tuple-returning call (C-176), a loop-carried append of list-of-scalar-records (C-183), an inline index read appended to a list accumulator (C-186), `bytes.data_ptr` self-hosted on wasm, `io.read_all` as a chunked stdin read-to-EOF loop, and main-less modules with `pub fn` exports rendering as LIBRARY wasm with a synthesized empty start. Cross-module linking was the release's deepest fix: module top-let ids are disambiguated across regions and remapped into a reserved band so two regions cannot collide, const-fold substitution is scoped per region (one module's literals could replace another region's same-numbered vars), the name bridge is keyed by the origin spelling both sides carry, and an in-place mutator receiver resolves LOCALLY before the globals map — `value_or_global` documents that precedence and the two are not one numbering space, so a sibling's first PARAMETER and a consumer's first top-let are both `VarId(0)`. The monomorphization key is now injective: it keeps EVERY bounded type variable (compound types returned no name and were silently dropped, so two instantiations shared one specialization) and gives tuple and function types real names. Instrument: the nightly fuzz builds in its own job so the campaign spends the whole runner lifetime fuzzing, with the budget sized to the lifetime the runner actually grants; the fuzzer's native leg is split into timed build and run steps so a slow rustc under load can no longer masquerade as a hang; and `almide build` stages and renames its output instead of copying onto the existing inode, which macOS's vnode signature cache turned into a SIGKILL on the next exec. Tooling: `almide fmt --check` is a REAL gate — it names each unformatted file and exits non-zero, and directory arguments recurse; previously it printed the formatted text and exited 0 unconditionally, so every CI gate written against it was a no-op (#919). The formatter also stopped emitting optional statement semicolons and a leading blank line — output that appears in no hand-written Almide anywhere in the repo. Chore/quality: the codopsy campaign (#851) is complete — all five target crates at or above grade, almide-mir 67 → 75 (B) with issues 384 → 276, achieved by classifying the 175 over-threshold functions first and extracting only the 62 that were genuinely complex (over BOTH thresholds); the 105 that were cyclomatic-only are flat dispatch tables where splitting makes the code worse. Every extraction is verified as a pure move by corpus certificates (5,365 functions × 5 artifacts) byte-identical against a same-HEAD baseline. Sequence-suffixed split files (`_p2`/`_b`/`_c`) are renamed to content names across codegen, frontend, interp, ir, tools, egg-lab and lsp; the workspace (not just the root package) now runs in CI cargo tests; and the embedded stdlib payload has a size ratchet. `env.os`/`env.temp_dir` are named and bounded as the equivalence law's ONLY exemption (C-189). The nightly differential fuzzer, running a full campaign again for the first time in weeks, then caught two defects that were fixed before this release shipped. One was a same-day regression: converting the MIR STRICT-value mode from a process-global flag to a scoped guard put the guard around the IR phase, but the mode is read by MIR op LOWERING, which runs after that guard drops — the old global was never reset, so lowering had been inheriting strict mode by leak. Every deferred `Op::Const` ZERO went back to rendering as an executable 0, and wasm printed 0 where native printed 100. The guard now spans the whole render and the lowering entry ASSERTS the mode, so the invariant is checked on every wasm render rather than by one test. The other was an acceptance gap with a wider hole than its repro: the declared-type context reached an int literal through exactly ONE level of unary minus, so `let m: Int8 = -(300)`, `--300` and `-(-300)` were never range-checked at all and rustc rejected the emitted `-300i8` after `check` accepted. The literal is now found through its whole paren/minus chain, and the NET sign decides — `-9223372036854775808` is `i64::MIN` and valid while `--9223372036854775808` is +2^63 and no signed type holds it. Underneath the first finding was a real wall, also closed here: a closure's env holds its non-heap captures in raw 64-bit slots, but the class test restated a SUBSET of `is_heap_ty`'s negation (`Int | Bool`), so a `Float` capture — and every sized int width — refused to lift and walled the ENCLOSING function. Float needed no reinterpret: a MIR float local already holds its bits in an i64 and the float ops reinterpret around themselves (C-190).
- Previous: v0.36.0 (prev v0.35.0). v0.36.0 retires the wasm renderer's silent-deferral machinery and adds ten behaviour contracts (C-165…C-174). Cross-target: a tail-recursive Map/Set accumulator SHARES its non-empty seed instead of binding an empty deferred block (C-174 — a live wasm miscompile found by the #810 census; the deferred bind terminal is now DEFAULT-DENY behind a three-shape whitelist, so the class cannot recur silently, and error operators beyond the effect-unwrap desugar's reach wall by name); integer literals are range-checked against the SIGN and the i64 CARRIER, not only the magnitude, with three distinct E024 hints that state the type's range (C-173 — `let x: UInt32 = -5` is E024 now; #872 tracks the UInt64 lane above i64::MAX); type-erased `unwrap_or` is self-hosted for every heap payload (C-172); byte-offset bounds are subtractive so a near-i64::MAX position cannot wrap (C-171); integer arithmetic emits wrapping ops so the overflow law holds under overflow-checks and in module-level lets (C-170); `list.repeat` aborts over the same ceiling `string.repeat` has (C-169); `list.flatten` borrows its argument (C-168); `float.clamp` keeps an in-range -0.0's sign (C-167); the map to_string family and the Float-value display are self-hosted (C-166); and the skv-map / String-list / String-set heap-accumulator folds are self-hosted (C-165). Every lowered function now passes a def-before-use wellformedness gate; the ALS conformance report is GENERATED from the contract ledger with a CI freshness gate; and two flagship examples — a terminal raytracer and a Lisp interpreter — are byte-identical across targets, pinned by a roster gate that forces every example into PARITY or a declared-reason ledger.
- Previous: v0.35.0 (prev v0.34.3). v0.35.0 is a CORRECTNESS release driven by the differential fuzzer and the issue ledger — ten cross-target divergences fixed, three v1 subset walls closed, two acceptance gaps where `almide check` passed but the generated code did not build, and four new behaviour contracts (C-161…C-164) with eight new cross-target fixtures. Cross-target: matrix constructor dimensions clamp negatives and abort over a shared 2^28 ceiling in the T6 form (C-161 — a transformer-shaped program with `seq = -2^31` used to crash on BOTH legs in DIFFERENT forms, native a raw-vec capacity-overflow panic at exit 101, wasm an out-of-bounds trap at exit 134, and the convention permits neither); `io.write`/`io.write_bytes` are self-hosted on wasm over the single-iovec `prim.fd_write` floor with the same `Capability::Stdout` as `io.print`, and emit in PROGRAM order natively (they had gone through a 64 KiB BufWriter flushed only at exit while `println!` wrote through Rust's own Stdout, so interleaved output came out reordered — wrong even native-only) (C-162); a heap-result `if`/`match` BOUND to a let/var executes the taken arm, the missing case being a String LITERAL payload under `some(...)` (C-163); list modifiers and suffix copies over tuple/record/nested-list elements have rc-correct twins so the result co-owns each copied element (C-164, previously an honest wall); every `bytes.read_*` offset guard is `checked_add` (a negative `pos` became a huge `usize` and the addition wrapped back INTO range, panicking in the slice index), `string.pad_start`/`pad_end` clamp the width signed, `bytes.copy_to_ptr` clamps its capacity unsigned, and a `repeat` past a shared 2^31-byte ceiling aborts identically on both legs (C-034); `float.to_fixed` at a precision past an f64's ~1074-digit exact expansion no longer reads adjacent heap on wasm (C-155 — the pre-existing fixture truncated the expansion to six characters, far before the boundary); `string.replace_first("", "", to)` returns `to` (the not-found sentinel collided with an empty needle's legitimate match at the end); `matrix.swiglu_gate` with an empty weight yields the empty matrix. Check-accepted-must-build: intrinsic borrow modes now come from the native runtime's OWN signature (build.rs extracts the per-parameter `&mut`-ness of every `pub fn almide_rt_*`), retiring the "returns Unit ⇒ mutates arg 0" heuristic that emitted `almide_rt_io_write(&mut chunk)` against a `&Vec<u8>` parameter (#803); a write-only `var` survives dead-binding elimination (an index-assign is a WRITE, so `use_count` never counted it and DCE stripped the `let` the write-back still named, #857); `let bs: List[Int8] = [1, 256]` is rejected at check time instead of by rustc. Diagnostics: an imported module's type errors now reach the importer on every path — module bodies were never inferred on the check path and the build drivers appended `infer_module`'s diagnostics to a list nobody read, so a `base64` E006 lived for weeks behind it (#862); surfacing them also fixed two latent false positives they had been hiding (a phantom E019 "ambiguous constructor 'Wrap': declared in Wrapper and Wrapper", and a phantom E020 for a legal same-name type across packages). Subset coverage: `almide test` runs test blocks on the wasm leg for files that also declare `main` (mirroring native test mode, which compiles `main` but never calls it — 17 spec files moved off the native fallback), bundled stdlib modules link per FUNCTION so an intrinsic-bearing module's pure-Almide extensions stop walling, and name-keyed stdlib decisions strip the monomorphization suffix; `spec/` native fallbacks went 32 → 11, of which 8 are genuinely host-dependent, and the walled-real ratchet is back at 0 (the Trust Spine gate had been red since the bundled-stdlib linking work: `classify_corpus` gated import resolution on the HARDCODED stdlib list AND carried its own copy of the linkable-module rule, so its wall report described a program the real pipeline never compiles). Tooling: `ALMIDE_WALL_REASON=1` names which stage declined a wasm render and threads the per-function reason through; `almide compile <module> --json` now serves the bundled-only modules (`path`, `args`, `html`, `mem`). Docs: sixteen new stdlib pages — EVERY bundled module now has one (39/39, up from 23): `path`, `args`, `html`, `mem`, `net`, `zlib`, `base64`, `hex` plus the eight sized-numeric conversion modules, all carrying the machine-owned signature index, with executable worked examples — that is how three of the defects above were found. The module interface can also finally NAME the sized numerics (`Int8`…`UInt64`, `Float32`/`Float64` are their own `Ty` variants, not `Named`, so every signature involving them had serialized as `unknown` — `int.to_int8` read `(n: Int) -> ?`).
- Previous: v0.34.3 (prev v0.34.2). v0.34.3 retires the last known lifted-effect ABI hole (#841, the sibling v0.34.2's notes flagged): a CAN-ERR lifted effect fn (`effect fn -> T` whose body can propagate an err, `T` non-Result) compiled to a runtime HYBRID on the wasm leg — ok paths returned RAW `T` while `!`-propagation paths returned a wrapped Err block, two shapes no consumer can discriminate at runtime, so a first-class `Result[T, String]` use (the call passed as a Result argument) silently misread the raw payload and OOB-crashed in the caller's scope-end `__drop_result_value`. Pre-existing (reproduces on v0.33.6). The fix makes the callee ALWAYS wrap, by extending two existing mechanisms rather than adding new ones: (1) the AUTO_WRAP ABI registry now admits EVERY non-Unit can-err lifted fn — the old stmt/tail-position `!` heuristics were an approximation of "can this body err" and missed a branch-nested or argument-position `!`; `compute_can_err` is the precise predicate. Declared-Unit can-err fns are untouched: the Unit classification arm already treats `AUTO_WRAP ∪ can-err` uniformly (`wrap_unit_body_in_ok` — the generated `__almd_test_N` harness precedent, which is also why a naive first-class-use WALL regressed 44 spec files when tried and was abandoned). (2) The heap-result arm machinery's ok-payload wrapper — which the AUTO_WRAP `body.ty` override relies on to wrap each ok arm — was gated to `LitStr | Var | ConcatStr` arms and let CALL-shaped arms (`value.object(..)`, `value.int(n)`) through raw, the other half of the hybrid; `Call` joins the gate, and a `Result[Value, _]` wrapper now routes its drop through the recursive `DropResultValue` instead of the flat String path. A side effect worth naming: generated programs that previously WALLED at the hybrid boundary now lower and run — the differential fuzzer visibly slowed per program because it stopped skipping them, a coverage widening. Fixtures: `spec/lang/effect_result_arg_test.almd` grows the can-err ok/err first-class-argument shapes, all running via the wasm leg. Gates: 303-file spec corpus on both targets with zero regressions, 75 cargo-test suites, diff-fuzz 2×300, output-parity byte-identical counts, the org yaml suite green on both targets.
- Previous: v0.34.2 (prev v0.34.1). v0.34.2 fixes two long-standing wasm-leg correctness bugs, both pre-dating the v0.34.x performance arc (they reproduce on v0.33.6) and both surfaced by this session's deep-verification sweep — one by a generative `xtarget-fuzz` campaign, one by running the org yaml package's test suite on both targets. (1) **`$__drop_opt_str_int` injection is now TYPE-driven** (#840): the recursive drop routine for `Option[(String, <scalar>)]` was only injected when the program called `map.find` — the one producer known when the routine was added — but the drop ROUTER keys on the type, so a plain `some((s, x))` literal produced a routed call with no definition and the WAT failed to parse. The gate is now the exact same type predicate the three router sites use (`Option[Tuple[String, non-heap]]` anywhere in an expression, param, or return type), so the routine is emitted exactly when a drop can route to it. (2) **Never-err lifted effect calls re-wrap in call-argument positions**: a lifted `effect fn -> T` returns raw `T` on the v1 leg, and the never-err pre-pass rewrites its call type to raw `T` everywhere; the `rewrap_never_err_into_result_targets` repair pass rebuilt a real `ok(..)` for bind/assign/List/Tuple/Record targets but never covered a CALL ARGUMENT whose callee param declares `Result[T, String]` — so yaml's `unwrap(parse(text))` handed the callee a raw Value block that its match read as a Result, returning the payload TUPLE handle as the Value ("" instead of "Alice" on wasm, correct on native). The pass now takes the per-function declared-param-type map and re-wraps positionally. The org yaml package's full test suite is green on both targets with this fix. The remaining sibling — a CAN-ERR lifted call used as a first-class Result, whose ok-paths return raw `T` while propagation paths return a wrapped Err block (no sound runtime discrimination; misread + OOB in the scope-end drop) — is tracked as #841 with a minimal repro; a naive wall regresses the generated test-harness runners, so it needs an ABI-level fix. Regression fixtures for both fixes (plus region fixtures pinning frontier-grow-inside-region, float payloads through compact scalar slots, and free-list churn between windows) are in `spec/lang/`. Gates: the 303-file spec corpus on both targets, 75 cargo-test suites, diff-fuzz 2×300 across two seeds, output-parity with counts identical to the pre-fix baseline.
- Previous: v0.34.1 (prev v0.34.0). v0.34.1 closes the adversarial half of the wasm-beats-Rust claim: v0.34.0 beat DEFAULT single-threaded Rust-wasm on all four perf benchmarks; v0.34.1 beats Rust-wasm even when the Rust side is expert-tuned per benchmark (`unsafe get_unchecked` indexing, `-C target-feature=+simd128` auto-vectorization, arena allocation via `typed_arena`) — fannkuchredux 0.83×, nbody 0.82× (vs +simd128, no SIMD on the Almide side), spectralnorm 0.85×, binarytrees 0.94× (vs the arena idiom, from 2.6× behind at the start of the arc), geometric mean 0.86× tuned / 0.57× default, sizes unchanged at 2.8–4.7× smaller. Three levers, all render-side inside the verified envelope (MIR + Perceus certificates untouched, same trust position as v0.34.0's BCE): (1) **flexible f64 classification across call boundaries** — scalar args to `CallFn`/`Call`/`CallImport`/`CallIndirect` no longer POISON the f64-local classification of surrounding arithmetic; the value reinterprets ONCE at the call boundary instead of freezing whole loop bodies into i64 slots (nbody's 34-arg `energy()` call was pinning the entire advance chain; removing the pin took nbody from 0.206s to 0.155s, past auto-vectorized Rust without emitting a single SIMD instruction). (2) **region-specialized allocation** (`region_alloc.rs`, #838 stage 1) — the `consume(produce(scalars))` window (build a tree from scalars, fold it to a scalar, drop it) becomes a bump REGION: `RegionSave` packs `bump|freelist<<32` into one local and EMPTIES the free-list so `$alloc` degenerates to a pure frontier bump, `__rgn_` clones of the closed callee set drop their `Drop*`/rc traffic, and `RegionRestore` reclaims the whole object graph in one frontier reset; qualification is mechanical (closed `CallFn` closure, no host caps / imports / indirect calls / mutable-global slots / `MakeUnique`, window-local heap value proven by occurrence count) and failing it just keeps the normal path. All-const nullary-ctor blocks (`Leaf`) collapse to ONE per-region singleton passed to the clones as a trailing param. (3) **compact headerless block layout inside regions** (`region_compact.rs`, #838 stage 2) — inside a qualified clone family the variant blocks drop the rc/len/cap header AND the tag slot: `Node(Tree, Tree)` goes from 36 bytes to the same 8 bytes (`[left:i32][right:i32]`) the arena idiom gets, handle fields pack as raw 4-byte pointers, scalar fields as 8-aligned i64s, and the match's tag read becomes a `select` on POINTER IDENTITY against the per-region singleton (every region block is a distinct bump address, so identity IS the tag; the singleton itself is rebuilt as a zero-filled compact twin so even a pathological padded-field read agrees under both layouts); `$alloc`'s bump+grow tail is inlined verbatim at compact alloc sites (the free-list is empty by the region invariant, so the scan half is dead — worth as much as the layout itself at ~67M nodes per binarytrees run). Family qualification is all-or-nothing and mechanical: one const-shape `Alloc` form, every raw load/store address chases to `base + header + 8k` with slot kinds unified across all sites, construction stores exactly-once per slot, an escape audit on every chased address, singletons required to be the max-arity-padded all-zero image of a nullary ctor. The measured ceiling probe that motivated stage 2 is recorded in #838: hand-stripping header stores + the tag bounds check from the stage-1 clones moved binarytrees ~1% — the 4.5× footprint reduction was the whole gap. Validation: 75 cargo-test suites, 301-file spec corpus on both targets, 600 differential-fuzz programs across two seeds, output-parity with zero real regressions, N=20 scale run byte-identical to the arena Rust program. Closes #838.
- Previous: v0.34.0 (prev v0.33.6). v0.34.0 is the wasm-beats-Rust performance release: Almide-wasm now outruns equivalent single-threaded Rust (`-C opt-level=3 -C lto=fat -C codegen-units=1 -C panic=abort`, wasm32-wasip1, wasmtime 42) on every benchmark in the perf suite — fannkuchredux n=11 at 0.79×, nbody 5M at 0.92×, spectralnorm 5500 at 0.89×, binarytrees 18 at 0.61× Rust's time (geometric mean 0.79×, ~21% faster), with modules 2.8–4.7× smaller raw and 4.8–7.4× smaller when both sides get `wasm-opt -Oz`. Four levers, all inside the verified envelope (MIR + certificates untouched or provably preserved): (1) **bounds-check elision via guarded loop versioning** (`render_wasm_bce.rs`) — a hot loop renders twice behind a one-time entry guard that proves every elidable index stays in `[0, len)` for the whole run (up/down/two-variable induction bounds from the loop's own top-tested compare, plus constant indices; nested plans compose, with the induction argument restricted to root-depth positions so a nested increment can't outrun the outer break check); guard imprecision can only cost speed, never correctness — the slow arm is the byte-exact original. Rust-wasm keeps the equivalent slice checks where LLVM can't prove them away, which is where fannkuchredux flips from 1.48× slower to 21% faster. (2) **single-prim scalar wrapper inlining** (`scalar_call_inline.rs`) — a `CallFn` to a wrapper whose whole body is one pure-scalar prim (`math.sqrt` & co) is rewritten to the prim at the MIR level, which both removes the call and stops the call boundary from POISONING the f64-local classification of the surrounding arithmetic (one sqrt per iteration used to force the whole nbody advance chain back into i64 slots with reinterpret round-trips). (3) **the self-append rewrite** (`concat_to_append.rs` + a self-hosted `__list_append1` in `stdlib/list_concat.almd`) — `x = x + [e]` (also what `list.push` desugars to on the v1 leg) was a full-copy concat per append, O(n²) for every accumulator loop (spectralnorm's row build: ~4.8 GB of memcpy per run, whose cache pollution also slowed the inner loops); the exact five-op window now becomes one call that appends IN PLACE when `rc == 1 && len < cap` — the runtime rc check subsumes any static alias proof, so value semantics are preserved exactly (an aliased list still snapshots) — and grows by 2·len+8 otherwise. The certificate's loop-slot `(id)` stream is preserved verbatim; the first hand-written-WAT version of the runtime was correctly rejected by the runtime-growth ratchet (§4.1 — the hand-written WAT floor may only shrink) in CI, and the shipped version is self-hosted Almide. (4) **renderer peepholes**: `x*(x±1)/2 → shr_s 1` backed by a parity argument that survives two's-complement wrap (consecutive-integer products stay even mod 2^64; the two `i+j` materializations are matched by straight-line structural equality), and dead constant-store stripping. Two measured tradeoffs are documented rather than papered over: `wasm-opt -Oz` merges the versioned fast/slow copies back into one checked loop (~3× slower on spectralnorm — docs/wasm/WASM-OUTPUT.md now says to benchmark before applying it to compute kernels), and pow2 growth blocks measured ~10% slower than 2·len+8 on read-streamed vectors (block placement effects, noted in the source). Closes #826.
- Previous: v0.33.6 (prev v0.33.5). v0.33.6 is a large internal-quality patch: an AST-quality-driven (codopsy) decomposition pass across the whole codebase (root `src/` + every crate), bringing every one of the 16 codopsy-analyzed units from a 2026-07-11 baseline of 46/D (390 files, 3764 warnings) to C or better — root-src 93, almide-mir 67 (the hardest case, ten dedicated rounds against a scorer plateau — see below), almide-codegen 83, almide-frontend 79, almide-interp 75, almide-tools 73, almide-optimize 94, almide-dialect 77, almide-types 91, almide-syntax 87, almide-ir 82, almide-kernel 84, almide-base 88, almide-egg-lab 94, almide-lang and almide-perceus-belt already 100. ~460 commits, essentially all pure mechanical transforms — name-router/sequential-phase extraction, guard-clause flattening for max-depth, `unwrap()`→`expect()`/`?` for no-unwrap, dead-code removal, CLI output routed through shared `out`/`err` wrappers — each verified behavior-preserving via `classify_corpus` byte-identical certs against the pre-round baseline plus the full test gate (no observable behavior change on either target). Also fixed a real bug in the separate `codopsy` tool itself (github.com/O6lvl4/codopsy, released as v2.1.0): `score_complexity` always penalized at the hardcoded `cc>10`/`cog>15` defaults regardless of a project's configured `max-complexity`/`max-cognitive-complexity` (this repo's own `.codopsyrc.json` sets 20/30), so a relaxed threshold silently kept scoring at the tighter one — a whole band of complexity (cc 10-20 / cog 15-30) was invisible to the issue list yet still penalizing the score, which is why almide-mir's score plateaued for several rounds despite genuine issue-count reductions. Re-measuring under the fixed scorer afterward showed every crate's true score was already comfortably higher than the numbers above (mir 60→67, codegen 60→83, etc.) — this session's decomposition work remains a legitimate quality improvement, but the scorer bug, not remaining complexity, was most of what made the last few points of almide-mir's climb so hard. v0.33.5 fixes two bugs #828/#830 surfaced during v0.33.4's work. Bare `self` as a param only resolved inside `protocol { ... }` declarations — three independent sites re-resolved it from raw AST and needed the same `Self`→enclosing-type fix (`register_fn_sig`, `check_fn_decl`'s scope binding, `lower_fn`'s `IrParam.ty`); fixing all three then surfaced a codegen bug, where the parameter-list renderer escaped Rust keywords via a stale JS-era list (a `--target ts` leftover) instead of the canonical `is_rust_keyword` predicate, so `self` was never escaped — and raw-escaping (`r#self`) doesn't even work for `self`/`Self`/`super`/`crate` in Rust anyway (rustc: "self cannot be a raw identifier"). New `escape_rust_ident()` in `crates/almide-codegen/src/walker/mod.rs` is the actual single source of truth now: normal keywords go through `r#name`, `self`/`Self`/`super`/`crate` are renamed outright (`almide_self`, etc.), and all four emission sites (var reference, fn param, fn definition, fn call) route through it. Fixing the checker/lowering sites also exposed that `almide fmt` printed bare-self methods as the unparseable `self: Self` (the parser can never produce that text itself — bare `self` always consumes the whole param) — `fmt`'s idempotence gate (`fmt_roundtrip_idempotency_all_spec_files`) caught it on the new test fixtures; `is_bare_self_param()` in `crates/almide-tools/src/fmt.rs` now special-cases both param-rendering sites (plain `fn`, `protocol` method) to print bare `self` back out. `Fn(T) -> U` never parsed in any position because `parse_type_expr_inner` (`crates/almide-syntax/src/parser/types.rs`) checked for the lowercase `fn` keyword token, but the documented spelling is capitalized `Fn` — which lexes as `TypeName`, not `TokenType::Fn` — so it fell through to being misparsed as an inline variant constructor (`TypeName(Args)`) instead; fixed with a lookahead branch for `TypeName("Fn")` followed by `(`, reusing the same param-list-then-arrow parsing as the keyword path. New coverage: `spec/lang/bare_self_test.almd`, `spec/lang/fn_type_test.almd`. v0.33.4 removes `impl Protocol for Type { ... }` blocks from the language entirely (lexer/parser/AST/checker/lowering/formatter) — `docs/design/REJECTED_PATTERNS.md` had already rejected the pattern in favor of convention methods only (written the same day as the trait→protocol rename, `56e3b0ad`), but the parser/checker code was never actually removed and kept compiling for ~4 months undetected. `impl X for Y` now hits the keyword-typo hint system pointing at convention methods. The eager per-method signature validation that used to live in `register_impl_decl` (arity + parameter/return type checked against the protocol's declared signature, `Self`-substituted) is ported into `validate_protocol_impls`, so convention-style protocol methods are now checked at `almide check` time instead of silently passing and only failing later at native codegen (#829, closed); signature checking is skipped for generic implementing types for now, since nothing threads a type's own generic args back into the `Self` substitution yet (presence is still required), and `Ty` comparison strips module qualification (`m.Pigment` vs `Pigment`) so a cross-module Codec type doesn't false-positive. `spec/lang/impl_block_test.almd`/`impl_error_test.almd` are removed — every scenario they covered already had convention-style coverage elsewhere in `spec/lang/protocol_*.almd`. Also fixed: the parser's own top-level-declaration error message still listed `trait`/`impl` as valid tokens, and SPEC.md/CHEATSHEET.md documented `impl` as the preferred satisfaction mechanism, contradicting the rejected-pattern decision (#827, closed). Two still-open, unrelated protocol/type bugs surfaced during this work: a bare `self` parameter only resolves inside `protocol { ... }` declarations, not on any actual method (#828); `Fn(T) -> U` never parses as a parameter type, type-alias target, or return type in any position — use the bare-parens form `(T) -> U` instead (#830). v0.33.3 elides dead `Op::MakeUnique` copy-on-write guards for provably-unaliased locals (#824, `crates/almide-mir/src/alias_safety.rs`): `lower_place_mutation` previously inserted the COW/refcount check before EVERY in-place indexed write to a local heap value unconditionally, paying a runtime `rc > 1` branch even where the refcount can only ever be 1 — measurable in hot loops (fannkuchredux wasm: ~16% faster at n=11, 3.89s → 3.22s, byte-identical to native across n=7..12). A per-function LEAST-FIXPOINT dataflow pass proves which locals are never aliased (never a `Dup` src/dst, never a borrowed call argument to an opaque callee, never a `LoadHandle`-read record/container field, never flows out of a branch merge) and drops only the `MakeUnique` occurrences on those; `Op::MakeUnique`'s own semantics and rendering (the `CowSafety.v`-backed COW guard) are untouched. Landed in two commits after CI caught two real gaps this session's own local testing missed: `Op::Dup`'s `dst` (not just `src`) must be tainted — a module-global handle load + Dup can be aliased by another function's `let snap = g`, invisible to a same-function scan (`spec/wasm_cross/module_var_alias_cow.almd`, C-033); and `PrimKind::LoadHandle` (how record-field / heap-container-element reads are lowered — no dedicated "read field" op exists) must taint its `dst` unconditionally too, since a `Dup`'d value `Store`d into a container and later re-`LoadHandle`d back out gets a BRAND NEW `ValueId` with no recorded link to the original alias (`spec/lang/rccow_value_semantics_test.almd`'s "record copy shields the original's bytes field" — CI's `almide test spec/ --target wasm` caught this; the default `almide test`'s native auto-fallback for some files hid it locally). v0.33.2 fixes a silent-miscompilation class: `Parser::parse()` is a recovery parser — an unparseable top-level statement (never valid Almide grammar outside fn/effect fn/type/let/var/trait/impl/test) is dropped via `skip_to_next_decl()`, but `parse()` still returns `Ok` as long as some declaration survived, and several callers (almide-mir's `source_to_ir_with`, `almide compile`, `--target rust` emit, `almide fmt`'s default write-back) checked only the `Result` and never `Parser::errors` — worst case `almide fmt` could silently delete the dropped line from the file on disk. All four now check `.errors` and fail loudly (new regression test in almide-mir's pipeline.rs). The fix surfaced two more pre-existing bugs in cross-module drop-glue codegen (drop_sources.rs): the `__drop_opt_<R>` and `__krec_*` (map/set/list-uniq keyed-record normalization) generators used a module-qualified type name (`m.Cfg`) raw in a FUNCTION NAME position instead of sanitizing dots via `drop_fn_ident` — both fixed, closing the last eight `tests/crossmod_matrix_test.rs` red cells. Also removed the dead `--target ts/typescript` test runner (`cmd_test_ts`), a vestige of the March 2026 TS/JS codegen retirement that had degraded into writing Rust source to a `.ts` file and always failing with a deno/node parse error. This release was prompted by a live almide/playground production incident (`RuntimeError: unreachable` compiling the default sample) — root-caused separately to the playground's own `compile_to_wasm` still calling the RETIRED v0 wasm emitter (#782); fixed in the almide/playground repo to call `almide_mir::pipeline::try_render_wasm_source` (the same v1 entry the native CLI's `--target wasm` uses), redeployed and verified live. v0.33.1 is an internal-quality patch: five cognitive-complexity>100 functions across the MIR lowering and frontend checker are decomposed into named, independently testable helpers (list_call_name, try_lower_option_ctor, lower_expr, infer_expr_inner, infer_expr_inner_g2) — pure mechanical splits, no observable behavior change (verified via classify_corpus byte-identical certs over the full spec corpus, plus the full test gate). v0.33.0 is the wasm performance-parity + fuzz burn-down release: the five-rung renderer arc (#806, closed) takes spectralnorm from 17× to 1.9× vs native (nbody 1.4× — the SIMD-less floor; fannkuch 1.7×) via inline bounds checks, an IR-level pure-scalar inliner with a one-instruction `float.from_int`, f64-typed wasm locals (no reinterpret round-trips), direct-`br_if` loop conditions, and expression-tree fusion + constant-divisor strength reduction — modules also shrink 6-11%. The v1 test surface reaches ZERO: closure ignores 30→0 and the last crossmod KnownBroken cell opens (unannotated generic-ctor top-lets carry their solved payload type to every reader — checker post-solve write-back + v1-pipeline refresh + registration no-clobber, C-157). Fuzz taxonomy is rebuilt (honest subset walls are coverage data with a per-reason histogram, not findings) and eight divergence classes are fixed with contracts: ctor payloads never zero out (scalar-call/tuple/if-merged — C-158), `binary_search` duplicate-key index pinned to Rust std's branchless loop (C-159), json pretty escaping unified to the canonical 5-escape rule (C-095), negative `repeat` counts clamp to empty (C-054), and `to_fixed`'s decimals bound is made total at 0..=4096 (C-155). v0.32.0 was the differential-fuzz burn-down release (#796): silent-wrong-value and double-free families found by the cross-target fuzzer are fixed at the class level. The v0 wasm share family (`or_else`/`unwrap_or_else`/`unwrap_or`/`to_list`/`to_option`/`to_err_option`/`to_result`) now co-owns every kept payload (+1) — un-inc'd aliases double-freed at scope end after CORRECT output; the v1 leg gains the missing repr-routed twins (`option.or_else_h`, `list.slice_str`, the `sort_by` cached-keys desugar is gated to Int keys); the v1 TCO loop rewrite recognizes the auto-`?`-wrapped tail self-call (an err-capable effect fn's recursive arm previously compiled to "exit with the last base" — a carried accumulator returned its INITIAL value); `math.log/log2/log10(-0.0)` = -inf (the musl gate's sign-bit half was dropped); empty pad strings default to a space (native parity). Abort forms are normalized to ONE stderr line + exit 1 on both targets for assert (C-153), clamp (C-154), and to_fixed's decimals domain (C-155). The checker closes four acceptance-parity gaps (check accepted, native build failed): E024 extends to record fields and binop operands, E025 catches unresolved intermediate call slots, E029 rejects unknown type names, E030 rejects unorderable sort elements. `almide build` gains the content-addressed native binary cache (identical generated code from any path reuses one binary — warm builds ~0.06s), `almide fmt` escapes free-form strings (#797), and `almide test`'s wasm leg routes main+test files to the authoritative native fallback instead of silently running only main (#798).
- Previous: v0.31.0 (prev v0.30.0). v0.31.0 completes the walled-real burn-down to the EMPTY baseline (217 → 0 over the full test-fn corpus, the #791 remainder): in-place `list.pop` is self-hosted with the #794 COW receiver discipline (local-var COW / borrowed-param write-through / the two-level record+field COW for record receivers), the optional-chain heap-field match executes, curried and lambda-returning closures resolve through recursive computed-callee closure blocks, test-where case tables unify same-name bindings across cases, `List[Tuple[scalar]]` equality routes to the layout-identical nested-list eq, stdlib `ProcessStatus` literals erase to their structural record, and fan.settle eq operands read the materialized results list element-precise. A statement-position call to a value-returning closure now declares its result from the callee's return type (was an indirect-call type mismatch + a leaked result — exposed the moment `list.pop` linked). Also in this release: the Q8_0 bytes-resident inference path with an AVX2 integer-dot kernel and a cfg-gated rayon parallel runtime, chunked f32 GEMV parallelism, Bytes/Matrix as RcCow value types on the Rust target, per-type synthesized recursive variant equality, and `--no-verified` is now a hard error.
- Previous: v0.30.0 (prev v0.29.0). v0.30.0 extends the verified default to the NATIVE leg (v1-first on BOTH targets; `--no-verified` opts out of both and now prints a deprecation notice toward retirement, #782) and fixes the silent-wrong-value families 0.29.0's verified default had shipped: the C-136 elided-write class (record field assign, map insert, list element store, in-frame heap reassign — all were silent no-ops on the v1 leg), the C-135 declared-Unit effect-fn ABI class, interp empty-defer, the optional-chain eq misread, the map dispatch false-link double-free, mut-param write-back loss, and the option.map dispatch trap. `almide test`'s wasm leg now runs through v1 with a synthesized test runner (test blocks became first-class corpus functions — the exposed 217 walled-real fns were burned down to 37 in the same cycle: sized-numeric compares, ONE recursive typed-equality engine, widening-conversion identities, nested-list equality, map/bytes index lowering, nested-unwrap lifting), and the corpus-wall ratchet is now an ENUMERATED shrinking baseline (`proofs/walled-real-baseline.txt`, remainder tracked in #791; target: empty). Codec types additionally carry real generated container helpers (`__{en,de}code_{list,option}_T`), so List/Option-of-Codec programs render on the v1 leg end-to-end.
- Previously v0.29.0 (prev v0.28.6). v0.29.0 makes the v1 PCC-verified trust-spine renderer the DEFAULT for `almide run/build --target wasm` (v1-first with v0 fallback where v1 walls; `--no-verified` opts out, `--verified` stays an accepted no-op). Shipping gates: the ENDGAME campaign drove the spec corpus's walled-real count 112 → 0 (every function lowers, witnesses, and Rocq-kernel-ACCEPTs; a corpus-wall ratchet now enforces 0 in CI), and the new org byte-verify sweep (`scripts/org-byte-verify.sh`, 3-leg native / v0-wasm / v1-wasm attribution) reports zero v1-attributable mismatches across the org's runnable entries. Also fixes the cross-module classification gap the default flip surfaced: the never-err/auto-wrap ABI pre-pass now classifies main + mangled module siblings as ONE program (a cross-module effect callee like `m.estep` previously stayed unclassified — the caller kept its auto-`?` expecting a heap Result while the callee returned a raw scalar: invalid i64/i32 wasm), and the cross-module top-let bridge keys by the frontend's UPPERCASED synthesized reference names with `module_origin` gating (a lowercase module `let` silently missed the bridge and read an UNRELATED top-let's init via raw VarId collision — a confirmed silent wrong value; `let N = 7; var count = 0` printed 7 for `m.count`). MUTABLE module `var` references are excluded from the bridge (aliasing a var to its init would const-fold reads across mutations) and their raw collisions purged, so they wall honestly → v0 fallback keeps them correct end-to-end. Gate: tests/crossmod_matrix_test.rs (all cells green on both targets).
- Previously v0.28.6 (prev v0.28.5). v0.28.6 crushes the two fatal wasm-parity bugs. (1) #696 — a loop rebuilding a list via `list.push` (dropped or swap-carried each round) trapped with a raw wasm OOB at n≳8000 while native merge-sorted 152k fine, and every such loop silently paid O(n²) bytes where it did not trap. Root cause was compound: LICM hoisted the loop-local `[]` allocation into a shared `__licm` temp (aliasing every iteration to ONE buffer, so per-iteration value semantics survived only via the COW guard), and the swap edge `cur = merged` marked the buffer although `merged` is DEAD after the swap — so the unconditional `__cow_check` re-cloned the whole container on EVERY push. Fixed statically, zero runtime change (contract C-131 / ALS-C5): LICM never hoists a heap-typed result out of a loop, and AliasCowPass elides a DIRECT whole-var alias edge whose source has no read or mutation after it (same-loop sources are re-declared before any use; a LIVE alias — source read after the copy — still clones, `alias_cow` / `bytes_set_value_semantics` byte-identical). Merge sort now byte-matches native at 152k in ~3s. Fixture spec/wasm_cross/loop_buffer_churn.almd. An earlier rc-gated `__cow_check_rc` attempt was REVERTED as unsound: `var b = a` carries no rc_inc for any type, so a refcount is not a sharing witness at bind granularity. (2) #705 — a `mut` parameter of a REALLOCATING container (List/String/Bytes) silently lost its writeback on wasm except for Unit-returning callees in statement position: `let i = push9(v, 7)` pushed into a discarded copy (wasm len=1 vs native len=3; an MLP printed loss 0.0). MutParamLoweringPass now lowers EVERY call position via a bottom-up IrMutVisitor — the call becomes `{ let (__mp_res, __mp_buf) = call; <writeback>; __mp_res }` (value callees return an (orig, buffer) tuple, destructured on the proven BindDestructure path; a hand-built TupleIndex read left the buffer dangling when the tuple temp dropped), writing back to bare vars (Assign) and record fields (`f(b.items, …)` → FieldAssign); bare-name collisions are excluded wholesale (the #692 class — rewriting callee but not caller is an invalid module). Contract C-132 / ALS-M13, fixture spec/wasm_cross/mut_heap_param.almd. Full bar: almide test 280/280 (267 wasm / 13 fallback baseline), wasm_cross release gate green, workspace green, frees-churn green, 132 contracts / 242 fixtures bidirectional. Found & filed #753 (pre-existing debug-only ANF postcondition trap). Previously v0.28.5 (prev v0.28.4).
- Previously v0.28.5 (prev v0.28.4). v0.28.5 closes fuzz triage #727: ALL 8 divergence clusters from nightly run #723 (478 native↔wasm findings, seed 1782027195514436784) are dead — 13/13 campaign representatives replay CLEAN. Two ownership fixes in the v0 wasm emitter did it, both the same class (a combinator handing back a BARE aliased handle the caller then releases): (1) `option.unwrap_or_else`'s Some path now acquires (+1) a HEAP payload before the Option temp's recursive drop releases it — a some(Map) payload was read after free (a 2-entry map printed as hundreds of `false`; String literals masked the bug because data-section statics are never freed); (2) `map.fold` now acquires a heap init when storing the accumulator and releases the previous accumulator after every closure call — the zero-iteration fold returned the init var's handle bare, double-freeing it against the var's own release (rc sentinel trap; with a `map.get_or` subject the allocator reuse printed the init as `[:]`). Killed clusters include the string-garbage/linear-memory dumps, multibyte-concat tail drops, corrupt map keys, ok→err Result flips, one-element list truncation, control-char rendering, float-in-list garbage, and the wasm hang. Contract C-130 (ALS-I1, the share-+1 pass-through discipline) + 2 fixtures — one of which the reference interpreter evaluates, making it a real 3-way vote. Also hardened this session's verification method: full stdout+stderr+exit comparison (a head-1 diff had hidden trailing rc-sentinel traps). Full bar: almide test 280/280, wasm_cross green, interp 3-way green, frees-churn gate green. Previously: v0.28.4 (prev v0.28.3).
- Previously v0.28.4 (prev v0.28.3). v0.28.4 completes the spec↔contract↔fixture traceability program (#565, #563 closed) and fixes the cross-target divergence its first run caught. `list.chunk(xs, 0)` / `list.windows(xs, 0)` are now DOMAIN ERRORS aborting in the ALS-T6 form (`Error: chunk size must be positive` / `Error: window size must be positive`, one stderr line + exit 1, byte-identical native⇄wasm) — previously native leaked Rust's raw `chunks(0)`/`windows(0)` panic (exit 101) while wasm trapped on chunk and **silently returned len+1 empty windows** for `windows(xs, 0)` (a value-vs-abort divergence). A NEGATIVE size keeps the historical behavior promoted to the norm (chunk → whole-as-one-chunk, windows → empty; ALS-T4 rewritten to say exactly that). New contract C-129 + 3 fixtures. The traceability layer itself: `scripts/check-contracts.sh` now enforces (a) a REQUIRED `spec` key on every contract, (b) key resolution to a real `## ALS-xx` heading, and (c) **reverse coverage — every normative ALS section must be cited by ≥1 contract** — all mutation-tested; C-087 re-keyed to ALS-T3 (json.parse adjudications). The ALS stands at 62 normative sections / 129 contracts / 238 bidirectionally-linked fixtures. The reverse check's FIRST run surfacing a live divergence behind an uncited section is the mechanism working as designed: an uncited normative claim is exactly where spec↔implementation drift hides. Previously: v0.28.3 (prev v0.28.2). v0.28.3 fixes #692: when the main program and an imported module of the same package each define a fn with the SAME bare name (different arity/result), an intra-module TAIL call bound the main program's fn and emitted an invalid `return_call` (structural validation failure: "current function requires result type [i64] but callee returns [f64]") while `almide check` stayed green. Root cause: `emit_tail_call`'s Named arm looked up `func_map` by bare name only, while the non-tail path correctly tried the current module's qualified `{module}.{fn}` first. Fix: one shared resolver (current-module qualified → bare → any-module qualified) used by BOTH `emit_call` and `emit_tail_call`, so the two can never resolve the same name to different functions. New CI gate `tests/wasm_same_name_crossmod_test.rs` builds the two-file package and invokes the export via wasmtime. Also in this release cycle: #737 (v0 wasm value.merge) verified already fixed in 0.28.0 and closed; #696 root-cause narrowed to the loop-carried `cur = merged` buffer-swap shape (double-release-with-reuse poisoning the allocator free list — findings on the issue) and #705 (bare `mut List` param writeback, an ABI/repr design decision) remain open. Full bar: almide test 280/280, wasm_cross_target_spec green, develop CI green. Previously: v0.28.2 (prev v0.28.1). v0.28.2 fixes three reported issues. (1) #739 — EVERY native `almide build` of a matrix program had failed since the 0.28.0 flat-matrix runtime landed (`almide check` green, then 6 rustc errors on the generated crate; matrix programs are excluded from the rlib fast path, so all took the broken self-contained cargo path). Root cause was a two-part drift: the generated crate embedded almide-kernel's standalone `bridge` module (a stale `Vec<Vec<f64>>` adapter nothing references), and the burn matrix splicer's marker (`pub type AlmideMatrix = Vec<Vec<f64>>`) — gone from the flat runtime — now matched ONLY inside that bridge, splicing the burn enum into it. Fix: the kernel embed ships compute modules only, and the rotten splicer + its burn/BLAS Cargo template are retired — the flat AlmideMatrix + embedded almide-kernel SIMD (matmul/transpose/softmax/gelu) are pure Rust with zero extra deps, so matrix builds now use the base template (much faster cargo builds). A new e2e gate (tests/native_build_matrix_test.rs) builds AND runs a matrix program natively in CI, closing the \"check green but build broken\" blind spot. `runtime/rs/burn/` is now unreferenced; restoring a BLAS-backed large-matrix path is a tracked follow-up (needs a flat-runtime anchor + 4 fns burn lacks: div/neg/pow/mha_core). (2) #736 — the LAST silent leg of the v1 heap-element list-op class: `list.update` over List[Value]/List[String] trapped on the v1 spine with an indirect-call type mismatch (closure params are i64-widened but RESULTS are not, so a (Value)->Value lambda's i32 handle result mismatched the generic f: (Int)->Int call type). New `list_update_value`/`list_update_str` self-host variants declare the closure at its real element type, share every non-target slot rc_inc-co-owned, and store the closure's owned return with an explicit slot acquisition (a raw store64 is invisible to the ownership cert, whose scope-end auto-release otherwise freed the stored element). Verified on the REAL v1 path (ALMIDE_VERIFIED_DEBUG): byte-identical across native/v0/v1 incl. OOB, identity closure, nested-Object replace, and a 5000x churn; contract C-101 extended + fixture spec/wasm_cross/list_update_heap.almd. insert/remove_at/swap/filter from the same issue were verified already fixed; the remaining nested-list gaps wall loudly and fall back to v0 (honest-wall). (3) #740 — an Int-only math builtin (`math.abs`/`pow`/`max`/`min`) given a Float now hints the Float-PRESERVING sibling (`float.abs`/`math.fpow`/`fmax`/`fmin`) instead of recommending `float.to_int`, which silently truncates (in NN code nearly every abs/pow is on Floats, so the old hint was an actively wrong suggestion); the misleading auto-fix snippet is suppressed. Full bar: almide test 280/280, wasm_cross_target_spec green, crossmod matrix gate green, mir 575 + checker 169, contract ledger 235/235 bidirectional. Previously: v0.28.1 (prev v0.28.0). v0.28.1 fixes two reported bugs, both under the byte-identical native⇄wasm gate. (1) #746 — string literals now decode numeric/Unicode escapes `\xNN` (two hex digits, codepoint 0x00..0xFF) and `\u{…}` (1–6 hex digits, any Unicode scalar); previously they passed through literally so an ANSI ESC (`\x1b`) could not be written as a literal. A malformed escape stays literal, and the escape resolves at lex time so both targets emit identical bytes. (2) #747 — `datetime.format(ts, pattern)` now substitutes the strftime specifiers `%Y %m %d %H %M %S` (the documented `%Y-%m-%d` form) IDENTICALLY on all three backends via the same sequential `string.replace`: native, the default v0 wasm emit (previously a STUB that returned `int.to_string(ts)` and ignored the pattern), and the v1 self-hosted module (which, with native, had substituted a different `YYYY/MM/DD` token set the docs never matched). `%` is special only before a recognized specifier — there is no `%%` escape — and the wasm civil-date decomposition is now one shared helper (contract C-128 / ALS-T17, fixture spec/wasm_cross/datetime_format.almd; SCOPE year 0..9999, as to_iso). Full almide test 280/280, wasm_cross_target_spec green. Previously: v0.28.0 (prev v0.27.6). v0.28.0 ships the v1 MIR trust-spine as an OPT-IN verified wasm codegen and reconciles the v1 line with every substantive fix from the release line. `almide build/run --target wasm --verified` tries the PCC-verified v1 pipeline (byte-identical to the v0 oracle when a program lowers entirely within the trusted subset) and falls back to the v0 codegen otherwise — honest-wall, zero miscompile risk; without `--verified` the default path is unchanged. The reconciliation RE-APPLIED the release line's correctness work onto the v1 tree (which had diverged with its own emit_wasm restructure) rather than merging: `list.push` into a `mut` record field now persists cross-target (the wasm writeback stores the realloc'd pointer back into the record slot — #703/#705), wasm `bytes.from_string`/`to_string_lossy` COPY instead of aliasing (#690), `error.context`'s ok payload is copied so it never aliases the arg on wasm (#591 — the double-free is gone), an in-place mutator on a loop-outer var counts as an iteration-scope heap escape, LICM no longer hoists an in-place mutator's receiver out of a loop (#712), a nested boxed constructor pattern matches on native (#610), String `[]` indexing is rejected at check with `E026` (#558), a local type may shadow a dependency's same-name type (#433), the cdylib build wires `native/*.rs` shims + `[native-deps]` and copies native asset subdirs (#719/#683), an http binary client + percent-decoded query params land, and the dead npm/JS build target is removed. wasm-encoder/wasmparser bumped to 0.252. All under the full bar: parity 210 byte-identical native⇄wasm (MISMATCH 0), PCC ownership/caps/caps-transitive ACCEPT, mir 575 + spec 279 + workspace cargo suite green, 233 contract fixtures linked. Previously: v0.27.6 (prev v0.27.4). v0.27.6 is the ROUND 5–7 HOLE-HUNT + PERF BURN. Round 7 (this release): the wasm `process.args`/`stdin_lines` `List[String]` and its inner Strings were framed with a 4-byte header but read with the canonical 8-byte `[len][cap][data]`, so every element/byte mis-read — now 8-byte, byte-identical content (#645 content; the round-5/6 fix only resolved the emit ICE); cross-module derived `Codec` methods dispatch on wasm instead of an emit ICE, via a unique `func_map` suffix match + the codec helper routed before the dotted-name split (#609, contract C-098); generic `+` on a type parameter re-dispatches to ConcatStr/ConcatList at monomorphization, so `fn dup[T](x: T) = x + x` concatenates for String/List instead of panicking the IR-verify gate (#558, contract C-097); the #433 class on a linked module's record flowing through a `list.fold` lambda is repaired at codegen entry — unambiguous bare type refs completed + the link mangle extended to lambda-param/type-arg/cast Ty positions, so `nn/qwen_loader` builds again (#681); and a `Codec` derive over a `Map`/`Set` field is rejected at check time with `E023` (#655, the derive had no Map/Set arm so it silently emitted a `Value`-as-String fallback). Three bugs are documented OPEN in `docs/roadmap/active/` rather than rushed: #643 (the wasm `?? ""` / `list.get(xs,i) ?? d` RC double-free is allocator-reuse-timing-dependent — a heisenbug that observation via an allocating `__println` perturbs; the #668 share-`+1` fixed a DIFFERENT pass-through-combinator site, not this one), #591 (`error.context`'s OK path leaks a Result into main's return on wasm), and #610 (native-only: a nested ctor pattern at a Box'd recursive-variant field emits invalid Rust; wasm is correct). Rounds 5+6 cleared the rest of the user-reported set (#644/#646/#647/#648) and two rounds of fresh-lens detection. The headline is PERF (#647): user-fn params and closure captures of records/lists used to DEEP-CLONE per call — a 600k-string dictionary workload measured 21x end-to-end (71s → 3.4s), i.e. code an LLM writes naturally silently fell into the slow world. Borrow inference now passes a read-only record param as `&T` (the structural-record rule generalized to user `Ty::Named` record types, populated once per program from the type decls), and forwarding a heap var into a callee slot that itself borrows no longer counts as a consume; auto-derived convention fns (encode/decode/eq/…) are EXCLUDED via a structural `@derived` attribute the derive generator stamps at the single point it produces them — never a method-name guess, which a user method could collide with. Other user issues: the pass-through RC combinators (filter/or_else/flatten/map_err/map/flat_map) now share-`+1` the returned input cell so they no longer double-free (the related `list.get(xs,i) ?? d` loop case is the still-open #643 noted above); emit ICE'd on native-only intrinsics inside UNREACHABLE imported code — a reachability prune now runs before wasm emit so an import graph no longer forces module splitting (#644); `process.args` had no wasm dispatch (emit ICE) — implemented via the WASI `args_sizes_get`/`args_get` imports, byte-identical arg COUNT to native (#645); `[native-deps]` collided with the generated Cargo template + build/test manifests disagreed (#646); `io.print` buffered without flush so streaming output was invisible until exit (#648). Round-6 hole-hunt (#650–#667, #671–#674, #677): codec decode error strings match native variant names + `missing field`, Float decode widens JSON Int, `i64::MIN` literal folding, JSON `\uXXXX`+surrogate pairs and correctly-rounded float tokens (−0.0 sign + exponent ULP), Rust-keyword fn names escaped at CALL sites, param-referencing default args inlined, `bytes.from_list` slice coercion, nested let-destructure + generic record field sizing on wasm, mutually-recursive variant boxing by cycle reachability (#671), ordering operators on compound types rejected in the checker (#672), a real recursive wasm `json.stringify_pretty` mirroring the native depth-indented oracle (#661), inferred lambda-param type pinning for direct HOF calls (#674), and `E025` for an undecidable type slot instead of an internal-error ICE (#677). Round-5 hole-hunt (#620–#634): new diagnostics `E022` (bang-unwrap outside an error-propagating context), `E023` (deriving Codec/Ord/Hash on a non-deriving field), `E024` (out-of-range integer literal, type-aware post-solve); generics resolved through inferred lambda params (fresh-instantiate unbound generics), anonymous-record variant payload registration, phantom generic-param stripping from Rust record structs, empty `map.from_list`/`set.from_list` element type resolved from the result, and nine cross-target/codegen fixes. Every observable cross-target change ships a `spec/wasm_cross/*.almd` fixture + a named contract (ledger now at C-098) and every new wasm runtime routine cites its native oracle in the rt-oracle registry; each landed under the full bar (corpus both targets, byte gate, 3-way interp oracle, churn family, cargo suite). Previously: v0.27.4 (prev v0.27.3). v0.27.4 is the HOLE-HUNT ROUND 2+3 HARVEST: rotating fresh detection lenses (pass-ordering, checker-vs-lowering, interp third-judge, concurrency, numeric, string/Unicode, repr) found and killed another ~14 cross-target bug classes, including TWO silent-wrong-on-wasm corruptions. Silent-wrong killed: (a) the wasm `xs[i]` index syntax had no write-path bounds check — an out-of-bounds `xs[i] = v` was a silent heap write into adjacent allocator memory, and a read at an index >= 2^32 wrapped before the check and returned the wrong element; both now abort with a unified `Error: index out of bounds` on BOTH targets (native via `almide_index!`/`almide_index_set!` macros, wasm via a full-i64 bound guard). (b) An unhashable Float Map key bypassed the hashability checker via the stdlib builder API (map.new/set/from_list) — `almide check` passed, then on wasm two distinct float keys silently collapsed (len 2 -> 1); the checker now sweeps the solved type map so every Map[K,V] gets the rejection regardless of construction syntax. Effect-fn tail recursion regained TCO (the frontend auto-? Try-wrap had hidden the tail self-call from TailCallOpt, so idiomatic recursive effect fns crashed at ~1e5 depth on both targets). Construction-position auto-? became target-directed (a Result-typed record/list/tuple/map slot keeps its Result; native built invalid Rust and wasm ran the wrong value before). The interp third judge's own gaps closed: Map/Set equality is order-independent, NaN comparison returns IEEE false instead of aborting, the None-unwrap message matches the backends, and huge ranges iterate lazily (fuel-bounded) instead of materializing and OOM-aborting the fuzzer. Checker accepts now match lowering: named arguments validate by parameter name (not appended position), calling a non-function value is a clean error, the auto-? first-arg exemption derives from callee signatures (error.message/context, user fns taking a Result first), and UFCS calls fill default arguments. fan race/any/settle accept a var-bound thunk list (not only inline literals). Wide-int Map keys (Int64/UInt64) compile on wasm. string.lines is a true str::lines byte scan (trailing-newline suppression + CRLF stripping) instead of split-on-newline. The pass-ordering belt gained target-conditional before-deps and load-bearing edges; two dead passes (856 lines) were deleted. sort_by calls its key fn once per element on both targets. Each landed under the full bar (corpus both targets explicit, byte gate, 3-way interp oracle, churn family, cargo suite) per change.  Previously: v0.27.3 (prev v0.27.2). v0.27.3 is the HOLE-HUNT HARVEST: a systematic audit hunting three bug CLASSES (multi-place truths that drift, silent fallbacks that fake success, hand-built IR that bypasses pass rules) found and KILLED ten of them at the class level. Corruption fixed: the Perceus Assign arm bypassed the alias rule (`var c = fresh; c = list.get_or(xs, 0, d)` double-freed the shared element — verified sentinel trap), with a principled MOVE exception for ownership-donating TCO temps; the return terminal's expression now goes through the FULL Perceus rule set (the dominant `fn f() { stmts; match … }` shape previously received ZERO rc processing); rc ops targeting MODULE GLOBALS were dropped on BOTH sides (balanced only by mutual omission) and now emit through the global. Silent-wrong killed: every mutation statement (index/map/field assigns, the var-get helper, lambda captures) resolves globals through ONE shared lookup with an ICE on miss — the old bare-name-first probes could bind a same-named WRONG global or silently drop the whole statement; ctor field-layout lookups distinguish 'no registration' (now an ICE) from 'registered empty'; the repr-dispatch fabrication and the mutator write-back silent-skip are ICEs; bytes typed-append routes through the shared write-back (it lost realloc'd buffers for module-global Bytes and overwrote shared-cell pointers). Determinism: the var-rescue tie-break no longer depends on HashMap iteration order (emitted bytes were host-dependent); tuple-destructure offset advances are unconditional (one missing bind no longer corrupts every subsequent element's load). Made unrepresentable: compiled wasm bodies carry their REGISTERED function index and `add_compiled` asserts the landing position — the 'compile order mirrors registration order' convention (held by hand across ~157 runtime routines, where a same-signature neighbor swap binds the wrong body to a name and validates cleanly) is now a build-failure invariant, with 121 sites migrated; top-let global emission positions are asserted; `next_global` derives from the index constants. Deleted: PerceusOptPass (138 lines) — probed at ZERO firings across the corpus; its pattern targeted a removed convention and a match would have removed a protective inc (latent use-after-free). Leak killed: TCO identity carries (`loop(xs, n-1)` keeping xs) no longer emit a temp whose alias-inc had no balancing dec (+1 rc per iteration, rc creep toward wrap). Two new C-066 fixtures pin the assign-alias rule and the container-return dual-authority pair. All landed under the full bar (corpus both targets explicit, byte gate, churn family, cargo suite) per change. Previously: v0.27.2 (prev v0.27.1). v0.27.2 completes Stage C of true Perceus: TCO SELF-CALL LOOPS RECLAIM HEAP PER ITERATION — a 2M-deep constant-size tail recursion went from 4.27 GB peak to a flat ~7 MB (the wasmtime floor; new gate fixture spec/churn/tco_deep_recursion_churn.almd). Three ownership refinements landed together: self-call ARGUMENTS that are calls (not just literals) are now adoption-safe, so their params are managed (user fns return OWNED since the mechanism-#6 dup, and alias-shaped temps receive the bind-level Inc once the TCO rewrite turns args into VDecls — the literal-only test left `spin(n-1, string.take(acc + "x", 8))` unmanaged = unbounded growth); the bind-level alias-Inc on a block-valued binding now fires only when the tail temp's own value ALIASES (an unconditional +1 on fresh tails was a measured 16 B/iteration leak); and removing those masking over-counts exposed TWO real under-counts, both fixed at the root: `?? default` reaching Perceus in its Call{option.unwrap_or} spelling was classified FRESH (the alias classifier only knew the RuntimeCall spelling) — a map-owned payload double-freed at teardown; and the Perceus return-lift hand-builds its `__perceus_ret` binding BYPASSING the alias rule, so a return expression aliasing a to-be-Dec'd local (`if filled then base + "…" else base` with `Dec base` below) returned a FREED pointer — latent for years behind the chain-temp over-incs, surfaced as a resurrection trap the moment they were removed. Also in this release, completeness-by-construction §4 stages 1-2: the unified TopLetStorage attribute (ONE total decision table for module-global storage — classify_storage, the single static-name format site, the single Copy predicate, total alias resolution that REFUSES the build on an unresolvable module-global reference) computed once by a pass and consumed by every walker reference site, the declaration emit, the eager-force order, and the wasm global lookup (VarId-keyed alias map first, name reconstruction demoted to fallback); a walker-side agreement verifier asserts every legacy predicate matches the attribute on every build, so the next #486/#500-class drift is a build failure, not a silent miscompile. Each consumer flip was proven semantics-preserving by a generated-Rust byte-diff across all 342 single-file specs — which itself exposed and fixed that the generated Rust source was NONDETERMINISTIC run-to-run (anonymous-record declarations emitted in raw HashMap order; now sorted). Documented limit (not a bug): a monotonically growing accumulator still peaks at the sum of intermediates — every freed block is one unit smaller than the next request, so first-fit can never reuse it; recorded as an allocator-policy frontier. Previously: v0.27.1 (prev v0.27.0). v0.27.1 fixes the three cross-module top-let storage bugs the new (mutability × module-origin) matrix cells caught the day they were added (#500, #501, #502 — the completeness-by-construction §4 census): a cross-module `var` read miscompiled on BOTH targets (#500 — native rustc E0308/E0277 from rendering the raw `thread_local!`; wasm SILENTLY WRONG: the global lookup still expected old-style prefixed var names after the clean-name+module_origin rework, so every key missed and the read fell to a typed-zero fallback — printed 0/empty and lost mutations; there is now ONE shared `lookup_global` (id → module_origin-prefixed key → bare name) used by the value-read arm and the closure-capture materializer, and a module-origin var that misses every key is a loud ICE instead of a silent zero); `items = items + [n]` inside a module fn silently lost the write on native (#501 — NOT cross-module-specific: the push rewrite turned the Assign into a Method call that pushed onto a DISCARDED CLONE of the ModuleRc read accessor; mutable top-lets now join the keep-as-Assign exemption, and new tests pin append-through-fn plus the self-referential `items = items + [list.len(items)]`); and a cross-module spread base stuck at `SpreadRecord ty=Unknown`, refused by the AllTypesConcrete gate (#502 — three cooperating holes: the unannotated named-ctor top-let seed had no named-record arm so main read a stale Unknown, the repair belt had no SpreadRecord rule, and the Phase-1b name bridge missed the SCREAMING_CASE spelling of the synthetic use-site var; all three fixed, with spread-from-top-let / rebound-local / fn-return covered on both targets). Also fixed in the same release: direct cross-module assignment `m.x = v` to a `pub var` (#505 — the FieldAssign lowering fell back to VarId(0) for a module-alias target and rendered garbage lvalues like `NUMS.nums = …`, rustc E0425; the lvalue now resolves through the SAME shared module-top-let rule the read path uses, on both targets — accepting the spelling rather than rejecting it, since reads compose and an asymmetric rejection would be an LLM trap), plus a doctest fence fix in the matrix-shape pass docs (the root `cargo test` skips sub-crate doctests, so it never surfaced in CI). The matrix gate grew 9 cells and is 29/29 green. Previously: v0.27.0 (prev v0.26.21). v0.27.0 is TRUE PERCEUS: the wasm target FREES BY DEFAULT. Since the first wasm backend, rc_inc/rc_dec were deliberate no-ops — a bump-allocate-and-leak model (sound, but heap grew linearly with every loop iteration; ~431 MB over 4M iterations). The reference-count bodies are now REAL and ON by default (contract C-066): rc_dec frees to a reuse list, construct-and-drop churn runs in O(1) memory (2M-iteration record churn: flat ~13 MB RSS, byte-identical output to native), and loop iterations whose heap values do not escape reclaim wholesale (the per-iteration region reset now also clears the free list, so allocator state never straddles a rolled-back frontier — the unsoundness that class of reset had under real frees). `ALMIDE_WASM_FREES=0` opts back out to the leak model (env-conditional emission is declared behavior under the host-determinism gates). The activation drained 14 cross-target divergences the corpus had never been able to observe under no-op rc, each a missing SHARE-vs-MOVE ownership judgement, including: the record drop glue computed field offsets in NAME order while construction/member/spread use declaration order (mis-offset reads assembled fake pointers — trap or silent leak); a binding's alias-Inc ran AFTER its block value's temp Decs (the temp's typed dec freed the payload, then the late Inc resurrected a freed block — silent corruption; alias-Incs now hoist inside the block, before any Dec); functions returning a borrowed alias (`fn ostr(o) = match o { some(s) => s, … }`) now return OWNED (+1 before return); `string.join` on a 1-element list returned the element pointer itself un-owned; `list.repeat` stored the same pointer N times with one reference; list/map/json runtime families gained per-site element dups (sort/filter post-build walks, map keys/values/recap/remove/update, json get/set/remove_path no-op alias returns and share copies). A tripwire belt makes the remaining failure modes LOUD instead of silent or wall-clock hangs: freed blocks are stamped rc=0 and a second dec traps (double-free sentinel), rc_inc of a freed block traps (resurrection — previously silent value corruption), and the free-list walk has an absolute 1M-step cap so a corrupted cycle traps in milliseconds instead of spinning the host CPU for hours. Known bounded exceptions (tracked in docs/roadmap/active/wasm-frees-ownership-discipline.md): TCO self-call loops still leak per iteration (the per-iteration reclaim re-land is a redesign gated on the new `spec/churn/` fixtures — the cherry-pick of the old design corrupted the free list and was rejected by exactly that gate), and a stored-field over-count leaks one reference per construct-from-temp outside reclaimed regions. New durable gates: `spec/churn/` + `scripts/check-frees-churn.sh` (2M-iteration reclamation fixtures, wall-clock-killed wasmtime, native-output comparison — the corpus alone passed builds with live double-frees twice; these shapes are the gate the corpus cannot be) and `spec/wasm_cross/rc_reclaim_churn.almd` in the byte-identical gate. Previously: v0.26.21 (prev v0.26.20). v0.26.21 installs the first wave of completeness gates (docs/roadmap/active/completeness-by-construction.md) and ships the two compiler fixes they caught on day one. Gates: a NameResolutionTotal verifier at codegen entry refuses any bare type name whose only declaration is module-qualified (the #433/#484/E0425 class, machine-checked across every Ty position); a generated cross-module shape-matrix CI gate (20 multi-file cells — variant payloads, every top-let class, constructions, closures, effect calls) where a rustc error on generated code fails CI and the wasm target must match byte-for-byte under wasmtime; a fmt semantic-preservation gate (formatted output of all 341 single-file specs must re-typecheck); and six emit_wasm lookup-miss sites that buried failures as runtime `unreachable` traps now fail the build with a structured ICE. Day-one catches, all fixed: derived signatures registered their VALUE types bare (`Pigment.decode`'s `Result[Pigment, …]` leaked an unresolvable name into callers); cross-module paren-named construction `m.Cfg(name: x)` was E002 (the v0.26.20 normalization only intercepted bare TypeName callees, not the Member spelling); five formatter meaning-changers (imports used only via a match-subject call deleted — unused-import decisions now consult a token-scan superset that cannot under-count; `mut` parameters dropped; module-level `var` rewritten to `let`; test `where` clauses deleted entirely; a local variable sharing a stdlib module's name got a spurious import injected — auto-add now verifies the module defines a referenced function). And one real miscompilation: a Unit-typed tail variable emitted `local.get`, pushing a value the type system says does not exist — a structurally INVALID module that **wasm-opt had been silently repairing** on every machine that has binaryen; environments without it got modules wasmtime rejects ("values remaining on stack at end of block"). The emitter now honors the `ty_to_valtype(Unit) = None` contract (raw-module sweep: 106/106 wasm_cross fixtures validate without wasm-opt), and post-emit `wasmparser::validate` is **always-on and fatal** (was debug-only, print-only), so a shipped artifact can never again depend on an optional external sanitizer. v0.26.20 closes every open issue in one batch. Cross-module type identity is finished: a variant payload type from another module (`type Tag = EmotionTag(m.Emotion)`) no longer emits an unqualified enum payload (`#484`, regression since v0.26.16 — `lower_variant_case` was the one type-decl position the #433 qualification missed); a cross-module non-Copy top-let passed by value clones out of its `LazyLock` static instead of moving (`#486` — the emit-time-prefixing rework had left CloneInsertionPass's name-prefix predicate dead; classification now keys on `module_origin`); and the checker's record-construction inference — the LAST producer of bare cross-module type names — now returns the canonical qualified `mod.Type` (an un-annotated module record top-let used cross-module previously hit native `E0425` AND a wasm runtime trap from one shared root; the qualification predicate now lives in exactly one function shared with annotation resolution). The effect-fn `Result` auto-unwrap rule is uniform and type-directed across every binding position (`#485`, contract C-064): plain reassignment `x = effectCall()` unwraps like `let`; a Result-typed target (explicit annotation or Result-typed var) keeps the Result; index/map/field assignment follow the same rule (each previously passed the checker and exploded at rustc); and lambda bodies now disable auto-unwrap entirely (`#489` — a closure may escape, so `?` cannot propagate out; the checker and the lowering, which never inserted `?` in lambdas, now agree at check time). The string position API speaks ONE unit — codepoints (`#419`, contract C-065): `len`/`index_of`/`last_index_of`/`get`/`slice` are codepoint-indexed on BOTH targets (docs always said characters; `len` was bytes, `index_of` bytes, `slice`/`get` bytes-with-boundary-snap), so `string.take(s, string.index_of(s, sub) ?? 0)` finally composes on multibyte input; wasm gains a registry-verified `__str_cp_of_byte` conversion routine. Record construction is validated (`#488`, new diagnostic `E021`): the paren-NAMED spelling is accepted and normalized into the brace pipeline (`Cfg(name: x)` ≡ `Cfg { name: x }`, defaults included — previously the checker validated NOTHING and the named args were silently dropped, native ICE-banner / wasm trap or garbage payload); positional args on a record, named args on a tuple constructor, brace construction of a tuple case, unknown/duplicate/missing-without-default fields, and paren patterns on record-payload cases (`SetEmotion(_)` — a native/wasm acceptance divergence) are all rejected at check time; an unknown TypeName in call position is now `E003` instead of a silent fallthrough. A record/variant brace literal in match-subject position is parenthesized in the generated Rust (`#490` — rustc rejects bare struct literals there; wasm ran it). Formatter semantic-preservation fixes: `almide fmt` no longer deletes an import whose only uses are in TYPE position (the unused-import scan walked expressions only), and record field DEFAULTS (`age: Int = 7`) and serialization aliases (`name as "key": T`) survive formatting (both were silently dropped). New roadmap `docs/roadmap/active/completeness-by-construction.md` maps each of these to the missing mechanical guarantee and sequences the next belt (cross-module shape-matrix gate, no-silent-trap emission, fmt re-typecheck gate, NameResolutionTotal verifier). v0.26.19 verifies `#470` resolved and locks the pattern: a large real-world VRM/glTF `json.get_array` whose `list.len` was right but whose element access trapped (`memory access out of bounds`) on `--target wasm` — filed against 0.26.10 — no longer reproduces on 0.26.18+. It was chased against the actual `VRM1_Constraint_Twist_Sample.vrm` (10.7 MB; 240 KB JSON chunk, 717 accessors / 898 bufferViews / 3 meshes / 171 nodes) through nine faithful variants, including the reporter's exact host path (a JS host allocating wasm memory via the exported `__alloc`, writing the full file, calling an exported `probe(ptr, len)` that does `bytes.from_raw_ptr` → GLB-chunk slice → `json.parse` → `get_array` → `list.get_or`) and a heavy walk touching all 717 accessors' nested float arrays — all correct, no trap; the associated `[perceus-belt]` `no RcDec` leak does not reproduce either. The host-buffer / RawPtr / linear-memory bridge that path relies on was reworked in v0.26.15 (`#440`), the most likely fix window. New `spec/wasm_cross/json_gltf_walk.almd` adds a heterogeneous-nested glTF parse + `get_array`/`list.get_or` walk (meshes, every accessor's `min`/`max`, bufferViews) to the byte-identical native⇄wasm gate so the pattern stays locked. v0.26.18 fixes wasm dead-code elimination dropping an exported `pub fn` (`#457`): on `--target wasm`, a `pub fn` exported for the host to call but unreachable from `main`/`_start` had its body eliminated to `unreachable`, so it trapped (`RuntimeError: unreachable`) on the first host call despite still appearing in the export section — breaking the standard host-driven pattern where JS calls exported callbacks (`render_frame(time)`, `on_pointer_*`, any exported `pub fn`) that `main` never invokes. Root cause: WASM DCE ran BEFORE the export set was collected, seeding roots from `main`/`_start` (+ a few runtime helpers) only. Exported `pub fn`s (and `@export(wasm, "symbol")` exports) are now collected before DCE and seeded as roots, so their bodies survive; genuinely-dead PRIVATE functions are still eliminated. Locked by `tests/wasm_export_dce_root_test.rs` (builds the export, invokes it via `wasmtime --invoke`, asserts the value not a trap). v0.26.17 completes per-package namespacing on the CONSTRUCTOR side (`#413`): two packages each declaring a variant with the SAME constructor name (e.g. each with an `Active` case) now resolve correctly — a module's own `Active` is its own enum's case, not the other package's. Root cause: the Rust codegen built a single `constructor → enum` map keyed by the bare ctor name, collapsing a shared name to the last-registered enum, so `package_a.start() = Active` mis-emitted `package_b`'s `Phase::Active` (caught as `E0308`). Following the codegen design principle (the type checker is the source of truth — codegen uses the IR's `.ty`), the walker now derives a constructor's enum from the construction's resolved type (`.ty`) and a match arm's enum from the subject's type, falling back to the collapsing map only for non-variant positions (newtypes, structs); the checker disambiguates the construction by preferring the CURRENT module's candidate (the constructor table now records each candidate's owning module). byte-identical native ⇄ wasm; fixture `spec/integration/modules/same_name_ctor_test.almd`. With v0.26.16 (`#433`, types) this makes per-package namespacing complete — same-name types AND constructors coexist across packages. v0.26.16 lands per-package type namespacing (`#433`): two distinct packages (or sub-modules) declaring a type with the SAME name but a different structure now coexist. Previously the second was silently dropped at link time and a function using it referenced the wrong struct (a cryptic generated-Rust `E0560`/`E0609`), which the v0.26.8 `E020` diagnostic could only flag (forcing a rename). A user module's types are now identified by their qualified canonical name `mod.Type` end-to-end and mangled to a flat, valid identifier `almide_rt_<mod>_<Type>` at codegen — the type-side analogue of the existing `almide_rt_<mod>_<fn>` function mangling — threaded through resolution, registration, lowering, link, and both codegens, byte-identical native ⇄ wasm. Stdlib types stay bare (they back the bare-named Rust runtime); `E020` now only fires for a true same-module duplicate. Covers same-name records and variants, used directly, via dependency functions, in `let` annotations, and as cross-module derived-`Codec` field types (the codec method-name construction reconciles with the new naming). Fixture `spec/integration/modules/same_name_collision_test.almd`. Known limit: a same-CONSTRUCTOR-name across packages (two packages each declaring, say, an `Active` variant case) is still ambiguous and resolves by first-match (tracked in `#413`). v0.26.15 implements the wasm RawPtr / linear-memory bridge (`#440`): `bytes.as_ptr` / `as_mut_ptr` / `from_raw_ptr` / `copy_to_ptr` now work on `--target wasm` (they previously ICE'd in WASM emit; v0.26.12 turned that into a clean build error, and this release implements the bridge itself). A RawPtr is an i32 linear-memory offset on wasm (a real `*mut u8` on native): `as_ptr`/`as_mut_ptr` return the offset of the Bytes data region (`b + DATA_OFF`), `from_raw_ptr(ptr, len)` copies `len` bytes from a raw offset into a fresh Bytes, and `copy_to_ptr(b, ptr, cap)` copies `min(len(b), cap)` bytes through the pointer via `memory.copy` and returns the count. The pointer VALUE differs per target by nature and is never observed across the byte-identical gate — only the bytes it moves are, and those match byte-for-byte (contract `C-062`, fixture `spec/wasm_cross/bytes_rawptr.almd`). `as_mut_ptr` is now `@mutating`, so its Bytes argument is a mutable borrow on native too (the buffer must be `RefMut` to hand out a writable pointer — the same borrow class as the v0.26.9 `mut Map` fix); read/write/clamp are covered on both targets by `spec/stdlib/bytes_rawptr_bridge_test.almd`. The v0.26.12 native-only-ptr emit gate is removed now that all four ops are implemented on wasm. (Passing a RawPtr across the JS boundary via `@export(wasm)` remains a separate follow-up — the four ops and in-language round-trips are complete.) v0.26.14 makes `http.serve` (and any tail call to an `@intrinsic effect fn`) compile (`#434`): such a call lowers to a `RuntimeCall` whose runtime fn returns `Result<T, String>`, but the Result-propagation tail-wrap treated it as a plain value and `Ok(...)`-wrapped it, double-wrapping the Result (`E0308`, "expected `()`, found `Result<(), String>`") — so `effect fn main() = { http.serve(port, handler) }` failed to build even after the v0.26.12 closure-repr fix. Intrinsic effect-fn runtime symbols are now recognized and their tail call is left un-wrapped (it IS the `Result` the effect fn returns), scoped to effect-fn bodies. v0.26.13 smooths an effect-fn `Result` auto-unwrap rough edge (`#438`): inside an effect fn, an `if` whose one branch auto-unwraps an effect-fn call (e.g. via `match`, yielding `T`) and whose other branch is an explicit `ok(...)` (`Result[T, E]`) used to fail `E001` ("type mismatch in if branches"). The auto-unwrap now applies per-branch before the cross-branch comparison, mirroring the existing match-arm rule, so the two reconcile at the `T` level. The if-expression's value type is unchanged, so `if .. then ok(n) else err(..)` still types and runs as a `Result`; the rule is scoped to effect-fn bodies, leaving pure/test `if/else` strict. v0.26.12 turns the wasm RawPtr ICE into a clean build error (`#440`): `bytes.as_ptr` / `as_mut_ptr` / `from_raw_ptr` / `copy_to_ptr` are native-cdylib-only and used to ICE in WASM emit (`[ICE] … no WASM runtime fn`); a pre-emit gate now refuses them on `--target wasm` with a span-tagged `error: RawPtr / linear-memory bridge is not supported on the wasm target` (the linear-memory bridge itself stays tracked in `#440`). It also aligns the `http.serve` handler to the uniform `Rc<dyn Fn>` closure repr, resolving the closure-repr type-check failure (`#434`, the SSE-callback fix's sibling) — note an effect-fn tail call to `http.serve` still hits a separate effect-propagation bug (intrinsic effect calls aren't lifted to `Result`), tracked under `#438`. v0.26.11 completes the soft-keyword-field-name fix (`#418`, begun in v0.26.0): `ok`/`err`/`some`/`none`/`todo` are now valid field and member names in *every* position, not just record literals and type declarations — a named record whose first field is a soft keyword (`Status { ok: true }`), a record-pattern destructure (`match s { Status { ok: o, .. } => … }`), a spread field (`{ ...base, ok: false }`), and a field assignment (`obj.ok = v`). They stay value constructors in *binding* position, so a `let { ok } = r` shorthand remains an error (a bound `ok` could never be read — in value position the lexeme is the constructor again). Tooling fix: `almide test` on the WASM path no longer reports a false PASS for a file with a parse error — it now fails like the rust target / native fallback (a recovered partial AST was previously compiled and run as if green). (Internals: a dead `Map`/`Set` borrow-inference branch was removed, and CI now gates the generated runtime registry against drift from its committed sources.) v0.26.10 lets an inline element-type annotation be parenthesized — `(expr: Type)`, e.g. `([]: List[String])` — so an otherwise un-inferable empty collection can be annotated as a record-field value (`{ tags: ([]: List[String]) }`) or a `let` initializer, not just as a bare call argument (`f([]: List[T])`). Previously the `:` after the inner expression inside parens was a parse error ("Expected ')'"). The parser is shared, so both targets accept it identically. v0.26.9 fixes a `mut Map`/`mut Set` function parameter mutated in place (contract C-061): `fn put(mut m: Map[K,V], …) = map.insert(m, …)` used to fail native `E0596` ("cannot borrow `m` as mutable") because `Map`/`Set` weren't recognized as heap types in borrow inference, so the param was forced to an immutable owned binding and the in-place mutator's `&mut m` had no `mut` binding to borrow — while the structurally-identical `mut List` + `list.push` compiled. Now the param is promoted to a mutable borrow (RefMut) like a list, so it builds on both targets and the mutation persists to the caller, byte-identically wasm (a read-then-write through the same `mut` param works too). v0.26.8 adds `E020`: two distinct types that share the same bare name with different structures (a local type colliding with a dependency's, or a duplicate within one file) are now reported at the source instead of silently shadowing — the second declaration used to win the bare-name slot through link + codegen, surfacing later as a cryptic generated-Rust `E0560`/`E0609` ("no field …") in a function that used the shadowed type. A structurally-identical re-declaration (the diamond case) is not flagged. This is an interim guard while per-package type namespacing (the full fix for `#433`) is pending; rename one type to disambiguate. v0.26.7 makes a `Value` (the dynamic JSON-like type) repr as its JSON text byte-identically native ⇄ wasm (contract C-060): a `Value` field in a `Repr`-deriving record/variant used to fail to compile natively (`Value` impl'd neither `AlmideRepr` nor `Display` — `E0599`/`E0277`) while wasm emitted the placeholder `Value {  }`; both now route through the same JSON serializer (`almide_rt_value_stringify` / `__value_stringify`), bare (`"${v}"`) and as a field (`.repr()` and `{}` paths). The wasm float branch was also corrected to the native `format!`/`__float_display` Display form (it used the round-trip `float_to_string`, so an integer float diverged `3` vs `3.0`), which also makes `value.stringify`/`json.stringify` of a float agree. v0.26.6 makes the shared build-scratch lock (`BuildDirLock`) cross-platform (`flock` on unix, `LockFileEx` on Windows, via `fs2`) instead of a unix-only no-op — so concurrent `almide run`/`build` subprocesses no longer race the shared scratch dir on Windows, and CI runs the test suite in parallel on every OS (no `--test-threads=1` Windows carve-out). v0.26.5 lands two contributor fixes: a `result.*`/`option.*` function no longer auto-`?`'s its FIRST argument (it consumes that as the `Result`/`Option`, so `result.unwrap_or(int.parse(s), d)` keeps `int.parse(s)` intact instead of unwrapping it — `E0308`); `build -o build/app` creates the output's parent directory; and SSE streaming callbacks take `Rc<dyn Fn(String)>` to match the codegen's closure repr, so a capturing closure passed to `http.openai_streaming_call(...)` compiles. v0.26.4 completes cross-module derived `Codec`: a derived codec referencing another module's `Codec` type used to fail to link (`E0425` — the cross-module `T.encode`/`T.decode` call dropped its module prefix); a `mod.Type.method()` call on a cross-module type was rejected (`E003`); and an `Option[CustomCodecType]` field failed to derive on both targets. All three now work, byte-identical native ⇄ wasm. (Internals: the "raw-`impl Fn` element-codec argument" set is now DERIVED from the runtime signatures by build.rs instead of a hand-maintained allow-list.) v0.26.3 supports cross-module record-variant construction and pattern matching (`mod.Ctor { … }` both as an expression and a pattern; previously the construction was mis-typed as a standalone `mod.Ctor` type — `E001` — and the pattern left its bound fields untyped). v0.26.2 implemented derived `Codec` decode for tuple- and record-variant payloads (previously only unit variants decoded; non-unit cases returned `Err("… payload decode not yet implemented")`). v0.26.1 patched a WASM Perceus RC-verification false positive (a `let`-bound list whose only use is being consumed by a `for`-in loop was wrongly flagged as a memory leak and the build was refused). v0.26.0 was a minor release — it carried a BREAKING stdlib rename — fixing Fizz-reported codegen bugs (`ok`/`err`/`some`/`none`/`todo` usable as record field and member names, WASM scratch-local overflow on complex functions, ownership of a `??`-fallback operand and of borrow args inside computed index/key/value assignments, a `value.keys` accessor, and a clear `E019` for an ambiguous variant constructor declared in two or more types) plus the BREAKING http `Response`/`Request` → `HttpResponse`/`HttpRequest` rename (the emitted Rust type alias collided with a user/dependency `enum Response`, `E0428`). v0.25.0 was the cross-target VERIFICATION milestone: a behavior-contract traceability ledger (`docs/contracts/`, 58 contracts C-001..C-058) makes every observable native==wasm promise traceable to executable evidence (a `spec/wasm_cross/` fixture, a differential fuzz, an emit-time Σ-probe, or a Lean theorem) under a bidirectional CI gate; a reference interpreter (`almide-interp`) tree-walks the typed IR as a third independent judge in a three-way differential harness (interp==native==wasm); a generative differential fuzzer runs a nightly campaign; the oracle-pairing registry is drained to ZERO grandfathered routines (every wasm runtime routine cites a native-oracle differential test). Correctness hardening (C-036, C-047..C-058): integer div/mod and `list.product` WRAP on overflow (no debug/release split), scalar `float.min`/`max` are NaN-ignoring with a fixed ±0 tie (no LLVM `maxsd` second-operand drift), vendored musl libm makes trig/exp/log/pow byte-identical, the wasm regex engine is a faithful port of the native engine, list/string Int counts and indices clamp on the full i64 BEFORE narrowing (no 2^32 truncation, no OOB), `List[Float]` ordering uses IEEE-754 totalOrder, and aliased mutable collections enforce value semantics (copy-on-write). New behavior: `almide run --target wasm` builds and runs on wasmtime (the flag was previously swallowed into program args and ran native); an undecidable empty collection (`[]` / `set.new()` / `for _ in []` with no element-type context) is a compile error `E018`, following Rust/Swift instead of silently defaulting the element type; assigning a Unit-returning in-place mutator's result is rejected `E001`. Both targets reject identically where they used to diverge (one compiled, the other didn't).
- v0.53.0 (prev v0.52.0). **The platform-conformance release: the guarantees reach Windows and the current standards.**

  **NaN observation is canonical (C-210).** A NaN's raw sign/payload was the one place byte-identity leaked host state: x86 arithmetic produces sign-set NaNs where aarch64 does not, engines may or may not propagate payloads, and from_bits could smuggle any pattern in. Every observation boundary (float.to_bits, the bytes float writes) now collapses NaN to one canonical pattern on BOTH targets and every host arch — stronger than the Wasm 3.0 deterministic profile, which constrains only the wasm leg. The instruction half is machine-checked: emitted modules use no relaxed SIMD, no atomics, no shared memory.

  **An invalid-module escape is dead (#1068).** The audit flushed out a live defect class: the self-host linker deduplicated functions by NAME alone, so two modules' private helpers sharing a name with different arities silently merged and the resulting module failed wasmtime validation AFTER the render wall said Ok — the invalid-wasm-as-Ok class the trust ledger audits as zero (it stayed zero only because no corpus program linked hex.encode and int.to_hex together). The dedup now merges only full-equality duplicates and WALLS collisions.

  **Tail calls complete (C-178).** Function-tail CLOSURE calls render as return_call_indirect under the same reaches-ret-unmodified classification as the named return_call. The depth claim is stated honestly: a cycle that allocates a closure per hop keeps one creator frame per round on both targets — the creator's post-call drop correctly declines a transfer that would leak the closure — so the fixture pins cross-target parity plus an instruction-level gate rather than an overflow-proving depth.

  **Windows joins the wasm leg (#1066).** Previously wasm-on-Windows-hosts was untested by design (no wasmtime on the Windows CI leg, and the unix preopen strategy has no meaning there). The runner now has a Windows strategy — cwd preopened at `.`, the host temp dir mapped at the WASI /tmp convention, TMPDIR steering the temp-dir surface, and the #874 cwd pin in its guest spelling — and a per-push CI job proves native == wasm parity for the fs/temp/NaN/tail-call fixtures on windows-latest. The fs path contract is recorded against what other languages actually do on wasip1: Go keeps a userspace cwd ($PWD else the first preopen name — Almide's pin is that model with the staleness hole closed), Rust declares current_dir unsupported, wasi-libc emulates chdir; Almide deliberately ships no chdir (determinism).

- v0.51.0 (prev v0.50.0). **The surface-rule release: what a writer generalizes must always compile.**

  Dogfooding an OTel SDK in pure Almide produced six issues in one session (#1049-#1054), every one the same defect in a different coat: a rule the writer generalizes from the docs failed depending on compiler internals they cannot see. This release makes those rules position-independent, and it displaced the planned 0.51 (QualifiedRef #908, folded into 0.52 with its ordering constraint intact - recorded in ROAD_TO_1_0.md, not renumbered quietly).

  **`!` on an effect call always compiles** (#1049): on a never-err callee it is a silent no-op - the checker admits it from the signature, the lowering erases the node. Silent on purpose: a "redundant `!`" warning would teach removing it, and the removal breaks the caller the day the fn's classification changes. **Operand position joins binding position** (#1050): a Result-typed call as a binary operand strips to its ok type and the failure propagates exactly as from a `let`; the walled-real ratchet (baseline: empty) forced the lowering to ship in the same change - a Try operand A-normalizes into the proven heap-result-bind brick, and the shape now renders on the wasm leg outright. Also closed there: `helper() == ok(0)` used to pass check and explode as an E0308 in generated Rust; now an honest check-time error.

  **A valid program is never walled as "type errors"** (#1052): unresolved imports wall before inference, one line, as the feature gap they are - the "type errors" bucket stays empty-by-construction for the walled-real ledgers (distinct from #943, which has the module and fails to link it). **The types in the docs are types you can write** (#1053): runtime-backed stdlib nominals (HttpRequest, HttpResponse, and JsonPath - which the new completeness gate found on its first run) resolve in user annotations whenever the owner module is imported; the registry is closed by machine in both directions.

  **Diagnostics stop teaching false moves**: E025's example annotation is derived from the reported shape (#1054); every operator/argument diagnostic meeting a Result names `!` / `?? fallback` / `match`; interpolating a Result warns (`"${resp}"` printing `ok(...)` was legal, silent, and almost never meant). #1051's claimed purity bypass did not exist on head - the rejection was the pure-fn-context E006, uniform across list.map and http.serve - but the contextual lambda-effect model is now machine-pinned and the effect-typed-parameter endgame is designed in #1055 (with #1056 filed for the pre-existing unused-lambda false warning).

- v0.50.0 (prev v0.49.0). **The decade gate: the numbers become public, derived from a source, and under a ratchet — or they were never claims.**

  #999 observed that build-speed, runtime-perf and safety numbers all existed and **none of them were in the README**. A decade gate that publishes nothing measurable is not a gate. This release closes the 0.4x arc by fixing that, and by fixing it in the only way that survives contact with a second machine.

  Two generated blocks now sit in the README, each rewritten between markers from a committed source and freshness-checked in CI — the ledger claims from `contracts.toml`, and build speed from `docs/benchmarks/build-speed.txt`. **A hand-edited number is a defect the gate catches**, not a change a reader is trusted not to make.

  **The ratchet is deliberately NOT in the PR gate**, and the reason generalises: the numbers are machine-dependent, so re-measuring on a CI runner would fail for every machine except the one that produced the baseline. Freshness belongs in CI; the ratchet belongs where the baseline was measured. Conflating them produces a gate that is red for the wrong reason and therefore switched off within a week — which is also why the tolerance is 1.5× rather than 5%.

  **Runtime perf stays unpublished**, holding #999's own decision. The harness that would carry it exists; wiring it is a real task, not a re-run. The README says so in place of a number, because an unmeasurable figure published is worse than a figure absent.

  The benchmark harness is an Almide program, and the reason is not dogfooding: **a benchmark harness is the one program whose own cost is part of its answer, and shell has no clock.** Every shell attempt spawns a process to read the time, and on a 30ms measurement that process IS the measurement. `datetime.monotonic_ns()` is in-process. This was demonstrated the hard way — a first draft spawned two interpreters per repetition and reported a 28ms command as 117ms, a harness four times the size of its subject.

  **What the decade actually produced, stated against what it set out to do.** Five of its nine rows closed by MEASURING rather than building: the rlib cache, the module cache's first framing, the query layer's two halves, and the 10k-line target were all resolved by numbers that said the work was not yet worth doing — each re-armed with a size or a condition instead of a feeling. Two rows built something (the single driver, the dogfood). One row decided a stance and rooted out a syntax family behind it. One row published the numbers.

  And the decade's most-repeated lesson is not about any of that. Four measurements were published and retracted in it, every one from the same habit: **believing a fast number without checking that the fast path did any work.** A cold build equal to a warm one, a 36× speedup from one flag, a harness slower than its subject, and a 4.4× win that broke a cross-target contract — all four were visible on the face of the result before anyone read the code. Each guard now lives as a comment at the value it protects, so relaxing one means disagreeing with a measurement written next to it.

- v0.49.0 (prev v0.48.0). **The edit loop is attributed to the millisecond, the 4.4x win is measured and then given back, and a native semantic property is found resting on a Cargo flag.**

  #1003's stop condition was "do not start until a real project's full build exceeds 2-3s (~3,000-5,000 lines)." The dogfood is that project, and the trigger **fired** — at ~970 lines, not 3,000. Measured with BOTH caches cleared before every row (the earlier curve cleared only the dependency cache and published warm builds under a cold label): **cold 1.80 ms/line + 0.25s fixed, warm 46 µs/line + 0.35s, 9.3x apart at 2,103 lines where the cold build is 4.19 seconds.**

  But a cold build happens once. What a developer pays repeatedly is the rebuild after a one-module edit, and that is **3.98s** on the same program — with the interesting detail that a COMMENT-only edit is free, because the cache is keyed on the generated Rust and a comment does not change it. Every semantic edit pays the full cost.

  **Attribution took a trace, after reconstruction produced two wrong answers.** Summing separately-invoked phases gave 0.86s against a 3.98s whole; the missing 3.1s was a `cargo build` that hit its own cache and reported a rebuild it did not do. An in-pipeline phase timer (`ALMIDE_TIME_PHASES=1`) settled it in one build: frontend+emit 323ms, v1 native render **16ms**, **cargo 3,092ms** — 90%. An earlier claim that the verified render was 97.6% of the loop was retracted; it had been "measured" with a removed flag whose error message returned in 0.11s.

  Inside cargo it is `opt-level`, and nothing else: with a real source edit before every row, the cargo phase is **724ms at 0, 3,215ms at 1, 3,970ms at 2**. The generated crate is a single 7,733-line `main.rs`, so `CARGO_INCREMENTAL=1` has nothing to partition and does not help. **The edit loop was paying for optimisation it discards** — and #1003's cache would have been an elaborate mechanism for avoiding work that should not happen on that path at all.

  Lowering the dev profile to `opt-level = 0` took `almide run` after a one-module edit from **4.07s to 1.47s**. It was reverted the same day, by CI: `spec/wasm_cross/mutual_tail_recursion.almd` began overflowing the native stack, because **mutual tail recursion is turned into a loop by LLVM's tail-call optimisation, which does not run at level 0**. Wasm has `return_call` and was unaffected, so the two targets diverged.

  The pre-change check had passed, and why it passed is the lesson: it verified 200,000-deep **self**-recursion, which Almide's own TCO already turns into a loop, so it behaves identically at every optimisation level. **Testing the recursion the compiler handles tells you nothing about the recursion it hands to LLVM.**

  What that leaves is worth more than the reverted speedup. Filed as #1043: **a native semantic property — deep mutual recursion terminates — currently rests on a Cargo optimisation level.** That is fragile whether or not anyone lowers it; the property is not guaranteed by the compiler, it is bought by the build profile. Eliminating mutual tail calls in `almide-mir` fixes it and unlocks the 4.4x, and the `opt-level = 1` line now carries the whole measurement in a comment so lowering it again means disagreeing with something written next to the value.

- v0.48.0 (prev v0.47.0). **#928's last two steps close on the same five data points, and the LSP half turns out to be a different question than it looked.**

  #928 sequences four steps with an explicit "only if" between them: unified driver, per-module fingerprint, LSP holds the workspace, memoization. v0.42.0 shipped step 1; v0.47.0 measured step 2 and declined it. This release resolves steps 3 and 4 — from the same measurement, because the same numbers govern both.

  **Step 3, the LSP half.** Holding the analysed workspace and re-analysing only the dirty module plus its reverse dependencies buys back the PROJECT-PROPORTIONAL part of a check. At 2,103 lines that part is **7.4ms**; the other 12.2ms is per-invocation compiler fixed cost that holding the workspace does not remove. So the ceiling on the win is 7.4ms against a 50ms budget already met with 33% headroom — for the largest single item in the arc, comprising workspace state, reverse-dependency tracking and cancellation, each with its own failure modes.

  **The caveat is stated rather than buried, because it changes what should be built first.** Cancellation is not only a latency feature. An LSP that cannot cancel in-flight analysis queues work behind a keystroke burst, and that shows up far above the steady-state number no matter how fast one pass is. This release does NOT claim the LSP is fine; it claims the *incremental re-analysis* half does not pay for itself yet. If responsiveness is reported as a problem, cancellation is the thing to build, and it is independent of every number measured here.

  **Step 4, memoization**, stays last on the issue's own rule — "only if (2)+(3) prove insufficient." Neither was built, so neither proved anything. Deferred on the issue's terms, not on a judgement call.

  **What the two rows actually taught.** Every figure in both Units is `almide check` invoked once. An editor typing at ten keystrokes per second asks a different question, and nothing measured in either Unit answers it — so the most likely thing to make this arc real is not project size but a **second consumer**. That is now the re-arm condition alongside the size one: build phase 1 at ~7,000 lines (CLI) or ~10,800 (LSP only); build cancellation when responsiveness is reported, independent of the steady-state numbers.

  One process correction lands with it. An earlier draft folded 0.47 and 0.48 into a single release on the grounds that two tags over one measurement is ceremony. That was wrong: the ladder is a numbered sequence of rows, each of which ships, and collapsing two because their outcome happened to be the same answer breaks the correspondence between a version and a row — after which nobody can tell whether a row was folded, skipped, or forgotten. One comment on #928, two releases.

- v0.47.0 (prev v0.46.0). **A deferral gets a number, and a race gets a proof.**

  Two things land, and they are opposite in character: one Unit closes by declining to build something, with the measurement that justifies declining; the other establishes the semantics for something that was previously believed impossible in this language.

  **#928's incremental query layer is NOT built, and the number says why.** The hard prerequisite ("a query layer cannot sit on six parallel drivers") was met in v0.42.0, so the metric could finally be measured rather than assumed. One binary, all rows in ONE run, each figure a 10-run mean — a single invocation of a ~30ms process is scheduler noise. Historical project sizes reconstructed with `git archive` into temp trees.

  `almide check` is **3.50 µs/line + 25.5ms fixed**, of which 13.3ms is process startup. So the 50ms interactive budget is crossed at **~7,000 lines** from a shell and **~10,800** in a resident LSP, and the largest project that exists checks in 33.7ms.

  The second half of #928's metric — a warm rebuild doing work proportional to the CHANGE — is **not met by construction, not by degree**. Three measurements in one run: `clean` then check reads 128ms against an immediate re-run's 124ms; a second warm run reads 125ms; touching one leaf module reads 131ms. Touching a module nothing imports costs the same as touching nothing. Every check is O(project). But at 2,103 lines the whole project-proportional term is 7.4ms and the fixed 12.2ms is unrecoverable by any incrementality scheme, so the ceiling on the win is 7.8ms against a budget met with 33% headroom.

  The old trigger was a latency budget with no size attached — nothing could tell you whether you were near it. It is replaced by one stated in the units of the thing that grows.

  **Logical-time async: the semantics is proved, in three layers.** `fan.timeout` was removed in 0.29.0 because a wall-clock bound makes a result a function of the host's speed. The reframe is that the failure was in the *quantity*, not in bounding — replace wall-clock with a budget the program itself determines, and the cross-target equality survives.

  Establishing that is not a matter of adding a counter. The proof ledger fixes it at three levels: **paper theorems** over the formal model, a **Lean kernel-check** of the selection algebra's seven core theorems (`crates/almide-race-belt/`, 0 sorry, CI-gated), and **exhaustive model checking** — 74,898 configurations against every schedule, **zero divergence**.

  What is proved: uniqueness of the selection, schedule independence (confluence), unobservability of pruning and of deferred fuel checks, determinism of consumption, finite observation on the bounded fragment, and — the boundary result — that **a construct selecting a winner by environment time cannot exist in the deterministic layer at all.** What is deliberately NOT proved: that the two renderers implement the semantics. That belongs to the charge-trace validator and the cross-target fixtures, and stays on the *trusted* side of the proven-vs-trusted map. The theorems fix that the semantics is consistent; the implementation gates go looking for evidence that an implementation fails to mirror it. The roles do not overlap.

  **The proof work forced three corrections to the design**, each recorded — which is the evidence that it was not ceremony. The design's own prior-art audit places it precisely: Verse's `race` already does logical-completion-with-source-order-tiebreak, Lingua Franca and Esterel already do logical time, EVM already fuses fuel with rollback, and Haskell's `Par` and LVars already give determinism under a free scheduler. Every ingredient is solved somewhere; **no existing solution covers another**. In one line, what is being built is Verse's `race` running on EVM's gas clock — a confluence of well-solved sub-problems that have not previously been made to hold at once, plus the one requirement none of them has: that two backends agree on the cost.- v0.46.0 (prev v0.45.0). **The dogfood finishes at seven byte-identical gates, and three measurements I published turn out to have measured the wrong thing.**

  `tools/almide-gates` — this repository's own quality gates, written in Almide — reaches **seven byte-identical subcommands** across ~2,300 lines and fourteen modules, gated in CI. The last one is `check-contracts`: 426 lines of bash composing ten independent checks over one parse.

  A clean run of that gate is 13 lines, and matching 13 lines proves almost nothing — on a healthy ledger most checks print nothing, so a port implementing two of ten would also "match". The acceptance criterion was therefore pinned two sessions before the port: the twelve one-line mutations the bash enumerates in its own closing comment, each of which must turn the gate red with the SAME error line. **15 of 15 pass under a full-output byte compare**, including one that produces 809 error lines, all 809 matching in order.

  That suite earned its keep on the first mutation. The port's clean run was byte-identical while its emission ORDER was wrong — it accumulated every error and then every informational line, which matches the bash only when there are no errors to misplace. Comparing only the clean run would have shipped it green and wrong.

  **Eight defects found by writing the dogfood**, which was its purpose: four compiler bugs (#1027, #1029, #1030, #1033), a locale-dependent sort fixed across all eleven scripts that carried it (#1031), an `awk` truncating a title at the first quote fixed across all five extractors (#1032), a phantom trailing line that called 32 agreeing trap fixtures divergent, and two implementations of the evidence-class rank inside the dogfood itself. Five of the eight are one shape: **a rule duplicated because duplication was cheaper than the abstraction is a rule that will eventually be two rules** — and every copy agreed on the day it was written.

  **The measurement work, and three retractions.** This release publishes the build-speed numbers the README never carried (#999), generated from a committed baseline rather than typed, with a freshness gate in CI and a 1.5× ratchet at the measuring machine. The harness is an Almide program using `datetime.monotonic_ns()`, and the reason is not dogfooding: a benchmark harness is the one program whose own cost is part of its answer, and shell has no clock — every shell attempt spawns a process to read the time, which on a 30ms measurement IS the measurement.

  That was not a prediction. Three numbers were published during this decade and then retracted, all from one habit — **believing a fast number without checking that the fast path did any work**:

  - a build curve where cold equalled warm at every size (`almide clean` clears the DEPENDENCY cache; artifacts live in `$TMPDIR/almide-run`, so every "cold" row was warm). Corrected: **cold 1.80 ms/line, warm 46 µs/line, a 9.3× gap.** #1003's own ~1 ms/line estimate was right and my table was the thing that disagreed with it; the issue is reopened.
  - "97.6% of the edit loop is the verified native render", measured with a flag that has been REMOVED — 0.11s was the error message. An in-pipeline phase trace says cargo is 90% and the verified render is 16ms.
  - a 28ms command reported as 117ms by a harness that spawned two interpreters per repetition.

  Each guard is now a comment at the value it protects: N is published with every mean, cold clears both caches, and the loop is in-process.

  **A fourth correction, caught by CI rather than by me.** The edit-loop measurement is real — cargo is 90%, and within cargo it is `opt-level`; lowering the dev profile to 0 takes `almide run` after a one-module edit from 4.07s to 1.47s. It was reverted the same day: **mutual tail recursion is turned into a loop by LLVM's tail-call optimisation, which does not run at opt-level 0**, so `spec/wasm_cross/mutual_tail_recursion.almd` overflowed the native stack while wasm (which has `return_call`) printed the answer. The pre-change check had verified 200,000-deep SELF-recursion — which Almide's own TCO already handles, and which therefore proves nothing about the case delegated to LLVM. Filed as #1043: a native semantic property currently rests on a Cargo optimisation level, which is fragile whether or not anyone lowers it.

  Also in this release: `fan.race` is no longer advertised in the unknown-`fan`-function suggestion. It has been tombstoned since 0.42.0, and naming a removed function to a user who merely mistyped is the same defect class as a tombstone whose migration target is itself gone.

- v0.45.0 (prev v0.44.0). **A tuple-payload Option finally compiles on wasm, and the parity gate becomes an Almide program.**

  The differential fuzzer found this one and it took a trace to close: `some(option.unwrap_or(o, d))` — an Option combinator RESULT, not a tuple literal, used as an element of an owned aggregate — walled the wasm build with `OptionSome argument cannot be faithfully materialized`. The family was keyed FOUR different ways, one cell by type and three by shape, so an inline call result divided cells that a tuple literal or a `let`-bound result did not.

  The last cell's cause turned out to be one missing call. `lower_owned_heap_field`'s `Match` arm recognised only LITERAL arm chains — int literals plus a catch-all, or a two-arm Bool — so the `some`/`none` pair that `option.unwrap_or` desugars to was declined outright. Six other match-lowering sites already try the variant value-match ladder FIRST; that one did not. One arm, ahead of the existing one.

  Five careful readings had eliminated five hypotheses and confirmed none, all of them about a `Call` path the expression never takes. Two instrumented builds found the answer, and a third refuted the guess the second one produced. The rule kept: when eliminations outnumber confirmations and nothing converges, the premise is probably wrong, and only a trace shows which premise.

  The family is now a MATRIX, not a sample. `spec/wasm_cross/option_tuple_payload_matrix.almd` (contract C-201) asserts that all four element-type combinations of a 2-tuple over `{Int, String}` — all-scalar, both mixed orders, all-heap — build and agree native == wasm, with a churn loop on the heap cell because a single pass can double-free once and still print correctly. A future change that re-divides the family by element type fails there instead of waiting for a fuzzer to rediscover it.

  Named honestly rather than papered over: the NATIVE verified render still walls this family on ownership verification and falls back to the standard codegen. That was A/B'd on one binary with the new arm behind a temporary guard — the wall reproduces on a program the arm cannot reach — so it predates the fix, is filed as #1037, and is written into C-201's statement so the contract promises stdout+exit equality and not a verified native render it does not have.

  `tools/almide-gates` — this repository's own gates, written in Almide — reaches **six byte-identical subcommands** and ~1,050 lines. Two landed here. `output-parity` is the first that RUNS things: three processes per fixture over all of `spec/`, three observables compared, a solo retry for every non-match, and a down-only ratchet — 10 lines and 607 bytes identical to the bash, both exiting 0. `fuzz-track-record` replaces `gh api --jq` with real `json` parsing so the response shape faces the type checker, and matched on the first run.

  The port paid for itself again. Its first draft reported 32 trap fixtures as divergent when they agree byte-for-byte, and the cause is worth stating plainly: **a stream's final newline is a line terminator, not an empty line.** `sed` reads it that way; `string.split(s, "\n")` yields one extra empty element. That element is invisible until two normalisers treat it differently — and they must, because the wasmtime frame contains a real blank line while a program's own stderr may legitimately print one. Same class as the `awk` that truncated a contract title at the first quote and the eleven scripts with an unpinned locale: a shell text operation reimplemented from what it looks like it does rather than from what it does, where only a byte-diff refuses to let the plausible restatement pass.

- v0.44.0 (prev v0.43.0). **The dogfood grows a spine, and three shell decision rules become testable.**

  `tools/almide-gates` (Unit 0.46, #1001) reaches **four byte-identical subcommands** — roadmap README (390 lines), contracts README (231), conformance (81), and the shared toolchain stamp (7) — plus **three decision rules extracted from the shell gates as pure, tested functions**. It is now ~740 lines across nine modules and **gated in CI**, so it cannot grow unverified: it is written IN Almide, so a compiler regression breaks it, which is the point of dogfooding it.

  The extractions are a second kind of value, distinct from the six defects the dogfood surfaced in v0.43.0. In bash these rules are interleaved with process invocation and network calls, so the RULE can only be exercised by running the whole gate:

  - **the parity verdict** (`output-parity.sh`) — five outcomes whose ORDER is load-bearing: a render failure with a working oracle is a `wall`, with a failing one it is a `v0fail`. Backwards, every broken fixture reports as a v1 wall, and the wall count is a ratchet, so a mislabel inflates a number the project manages as debt. The bash has it right; nothing tested that it stayed right.
  - **the nightly streak fold** (`fuzz-track-record.sh`) — two streaks over one run list that stop INDEPENDENTLY. A night with findings ends the green streak (#796) but CONTINUES the full-budget one (#924), because #924 measures whether the instrument RAN, not whether it was quiet. Collapsing them — the obvious simplification — makes #924 unmeasurable on a compiler still being fixed.
  - **the contract link symmetry** (`check-contracts.sh`) — and it was run against the real ledger: **346 fixture evidence links checked, 0 asymmetric**. An independent implementation agreeing with the bash audit is the strongest check available short of byte-identity, and it arrived before the full subcommand was ported.

  The toolchain stamp earned its port during this cycle: a parity run refused to start until `make install` caught the PATH binary up with the workspace build, and the Almide version reproduces that abort exactly. It is the same one-binary discipline the fuzz campaigns depend on.

- v0.43.0 (prev v0.42.0). **A checker soundness hole, and the dogfood that found it.**

  **List concat did not constrain its right operand's element type (#1030).** `let xs: List[Int] = [1] + ["a"]` type-checked; native emitted invalid Rust and **wasm printed `[1, 8244]`** — the String block's ADDRESS as an Int element. The list LITERAL path already rejected the same mismatch (`[1, "a"]` is E001), so one property of the language was checked on one path and not the other. Fixed with one call in `infer_plus_op_concat`: `unify_infer` (binds inference variables, stays SILENT on a concrete mismatch) → `constrain` (still unifies, and reports when unification is impossible). That also closed #1029 — an `effect fn` in a `for`-loop body reaching a `List[Int]` as a raw `Result` — and made ITS diagnostic better than a bespoke one would have been: `expected Int but got Result[Int, String]` points at `!` instead of at an "Almide bug" panic.

  **Found by dogfooding (#1001, Unit 0.46).** `tools/almide-gates` reimplements this repo's own gate and doc generators in Almide, with byte-identity against the bash originals as the acceptance check — a dogfood that cannot fool itself about whether it works. Three subcommands now match exactly (roadmap README 390 lines, contracts README 231 lines, conformance 81 lines) across ~490 lines and five modules, including a TOML reader bounded to the subset the ledger actually uses (200 tables, 369 evidence items, verified against counts taken independently before the reader existed).

  In ~490 lines it surfaced **six defects**: four in the compiler (#1029, its root #1030, and #1033 — a chained `String` comparison emitting invalid Rust because only the first use of the operand is owned) and **two in the original tooling** (#1031: `sort` without a pinned locale, so the committed `README.md` was not reproducible across machines — fixed across ELEVEN scripts with a gate, not just the one that surfaced it; #1032: awk unquoting at the first `"`, truncating any title containing an escaped quote — `docs/contracts/README.md` had been publishing a cut-off contract name).

  Those last two share a cause worth naming: with one implementation there is nothing to diff against, so a right answer and a wrong answer look identical. The dogfood's value is not "it found compiler bugs" — it is that **a second implementation makes the first one falsifiable**.

  Also: the interpreter now models `fan` blocks (list-order evaluation, join-all, first `Err` in list order per C-199), so the third oracle covers them instead of emitting a wrong vote.

- v0.42.0 (prev v0.41.0). **One driver, and a concurrency stance.** Two Units ship together.

  **Single driver (#925).** The workspace had NINE hand-written copies of the post-typecheck stage order — the issue counted "≥6" and a mechanical sweep found nine — and they were not the same sequence: `src/cli/*` ran `ir_link` FIRST while the shipped wasm path (`almide_mir::pipeline`) and the third oracle (`almide-interp`) ran it LAST. So native and wasm were compiled from differently-staged IR, and the cross-target equivalence claim rested on an untested assumption that `ir_link`'s position never matters. It is now a MEASUREMENT: native `(exit, stdout, stderr)` was captured for all 329 `spec/wasm_cross` fixtures before the migration, the order was flipped, and the capture repeated — **329/329 byte-identical**. That check was only possible at the moment of the flip; once both legs share the new `almide-driver` crate they move together and the 2-way gate goes blind to exactly this difference. `tests/one_driver_test.rs` now pins BOTH that no second file spells the order (an empty migration ratchet, down from nine) and that the driver's own order is optimize → monomorphize → ir_link, so the #785 class is unrepresentable.

  **Concurrency stance (#1000) and the fan family.** Almide's model is now stated: **deterministic data-parallelism** — `fan` may execute in parallel, but observable behaviour is defined to be sequential evaluation in list order. The decision was forced, not preferred: SPEC.md promised both "results are identical either way" (§13.1) and "first to complete wins" (§13.2), which cannot both hold; the first carries all 200 contracts and wasm32 has no threads. Four reports resolve from it. `fan.race` is REMOVED (E027 tombstone) — reading the IR showed it was replaced by thunk[0]'s body with the other thunks never evaluated, so it was `thunks[0]()` with a name promising a race (#1024). Cancellation is deleted from the spec rather than implemented, because a cancelled sibling's progress is a function of scheduling; join-all with the first Err in LIST order is pinned as **C-199** (#1023). A sibling trap exits through the unified `Error: <msg>` + exit 1 on both targets, contracted as **C-200** (#1026) — measured rather than assumed, which retired a per-arm-buffering design that turned out to be unnecessary.

  **A wrong-bytes bug found on the way (#1027).** UFCS method calls skipped the `mut`-parameter check entirely: `check_call_target_builtin_ufcs` handed `validate_mut_args` a list the RECEIVER was not in, and after UFCS desugaring the receiver IS argument 0 — which for `list.push(mut xs, x)` is precisely the `mut` parameter. So `xs.push(n)` inside a fn whose `xs` is not declared `mut` compiled, and native propagated the mutation to the caller while wasm dropped it: a checker-accepted program printing different numbers on the two targets. The module spelling of the same body was correctly rejected the whole time. Fixing it also closed #1025 with no fan-specific rule, since the two routes to sibling aliasing are now both sealed (no `mut` → E007; `mut` → the caller needs a `var` → E008).

  Also: the `matrix` head-count family had THREE answers to one question (`.max(0)`, `.max(1)`, and no guard at all — the unguarded one turned `n_heads = i32::MIN` into an 18446744071562067968-iteration loop and hung the process while wasm printed a shape). One rule now, a defined abort on both targets, **C-198** plus a 4-test matrix gate. Contract ledger at 200 active / 0 flagged.

- v0.24.0 (prev v0.23.14). The cross-target completeness milestone: integer / and % are TOTAL (zero divisor -> `Error: division by zero`, signed MIN/-1 -> `Error: integer overflow`, exit 1, byte-identical native==wasm); fan.race/fan.any deterministic by list-order (fan.timeout = the one documented wall-clock exemption, compile warning on wasm); compound string interpolation renders Almide-literal repr on both targets (lists, maps `["a": 1]`, sets, tuples, some/ok, records `P { x: 1 }`, variants, anonymous records, recursive ADTs); string predicates (is_alpha/is_alphanumeric/is_upper/is_lower) full-Unicode on wasm via emit-time tables derived from Rust std; abortable top-level lets evaluate eagerly at startup on both targets. Verification: oracle-pairing registry CI gate (every wasm runtime routine must cite a differential test vs the native oracle), Lean proofs kernel-checked in CI (lake build), cross-target gate corpus 65+ files with zero grandfathered exceptions.
- v0.23.14 (prev v0.23.13). Determinism Belt L3: a `Canonical<IrProgram>` type-state + a terminal canonicalization pass make WASM emit order a pure function of content — emit accepts only `Canonical` (and `emit` is `pub(crate)`), so bytes are unreachable without the certificate, the order-determinism analogue of how `Verified` gates emit on RC balance. Also fixes egg fused-lambda param names drifting across compiles in a long-lived process (now VarId-derived), names anonymous records by content hash, sorts default struct-fields, and confines the compiler's clock reads to a wasm-safe shim behind a CI purity gate. 240/240 Rust tests.
- Baseline → 0.14.6 MSR: llama-3.3-70b 17/30 → 23/30 (+20pt);
  Sonnet 4.6 30/30 (100%) validates design.