rsscript: reserve __ prefix for compiler-generated helpers

Generated helpers (`__TupleN`, `__rss_*` desugar temporaries, `__rsscript_*`
runtime symbols) all use a `__` prefix but the namespace wasn't reserved, so a
user declaration could collide. Reject user-declared function/type/sum/alias/
const names whose leaf begins with `__` (RS0015), exempting the synthetic
`__TupleN` structs the tuple desugar injects. No real code uses `__` names.

Test: fixtures/fail/reserved-double-underscore-name.rss; tuples still pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: olwang

crates/rsscript/src/analyzer.rs

@@ -203,6 +203,13 @@ fn analyze_program(
     diagnostics
 }
 
+/// `__TupleN` (N digits) is the synthetic tuple struct injected by the tuple
+/// desugar, not a user declaration, so it is exempt from the reserved-name rule.
+fn is_synthetic_tuple_name(name: &str) -> bool {
+    name.strip_prefix("__Tuple")
+        .is_some_and(|n| !n.is_empty() && n.bytes().all(|b| b.is_ascii_digit()))
+}
+
 fn type_aliases_from_program(
     program: &crate::syntax::ast::Program,
 ) -> impl Iterator<Item = (String, String)> + '_ {
@@ -1243,12 +1250,41 @@ impl Analyzer<'_> {
             );
         }
         self.check_module_use_layout();
+        self.check_reserved_declaration_names();
         let items = self.syntax_program.items.clone();
         for item in &items {
             self.check_unsupported_syntax_item(item);
         }
     }
 
+    /// Identifiers beginning with `__` are reserved for compiler-generated
+    /// symbols (tuple structs `__TupleN`, desugaring temporaries `__rss_*`,
+    /// runtime helpers `__rsscript_*`). Reject user declarations that claim a
+    /// reserved name so generated helpers can never collide with source symbols.
+    /// The synthetic `__TupleN` structs the tuple desugar injects are exempt.
+    fn check_reserved_declaration_names(&mut self) {
+        use crate::syntax::ast::Item;
+        for item in self.syntax_program.items.clone() {
+            let (name, span) = match &item {
+                Item::Function(decl) => (decl.name.as_str(), &decl.span),
+                Item::Type(decl) => (decl.name.as_str(), &decl.span),
+                Item::SumType(decl) => (decl.name.as_str(), &decl.span),
+                Item::TypeAlias(decl) => (decl.name.as_str(), &decl.span),
+                Item::Const(decl) => (decl.name.as_str(), &decl.span),
+                Item::Module(_) | Item::Use(_) => continue,
+            };
+            // `Type.method` reserves on the member, not the (user) type prefix.
+            let leaf = name.rsplit('.').next().unwrap_or(name);
+            if leaf.starts_with("__") && !is_synthetic_tuple_name(leaf) {
+                self.unsupported_syntax(
+                    span.clone(),
+                    "reserved declaration name",
+                    "Identifiers beginning with `__` are reserved for compiler-generated symbols; rename this declaration.",
+                );
+            }
+        }
+    }
+
     fn check_module_use_layout(&mut self) {
         // Layout is per source file: a merged multi-file program legitimately has
         // one `module` declaration per file, so the "at most one module" /

crates/rsscript/tests/fixtures/fail/reserved-double-underscore-name.rss

@@ -0,0 +1,10 @@
+// expect: RS0015
+// Identifiers beginning with `__` are reserved for compiler-generated symbols
+// (tuple structs, desugaring temporaries, runtime helpers).
+fn __helper() -> Int {
+    return 1
+}
+
+fn main() -> Unit {
+    return Unit
+}

docs/tinygrad-port-todo.md

@@ -8,8 +8,9 @@ qualified variant patterns), pattern matching (variants/options/constants/tuples
 lists), tuples & destructuring, `#lower_name` escape hatch, source-qualified
 symbol inventory, type-associated constants & static methods, value-semantics
 clone/derives, Option ergonomics (`?`-on-Option + combinators), default
-parameters (Copy and non-Copy), and type aliases (generic + non-generic, expanded
-at every comparison site).
+parameters (Copy and non-Copy), type aliases (generic + non-generic, expanded
+at every comparison site), and a reserved `__`-prefix namespace for
+compiler-generated helpers.
 
 ## Must unblock awkward valid ports
 
@@ -60,13 +61,6 @@ at every comparison site).
   _Acceptance:_ a Rust backend error reports the RSS file, source span, source
   symbol, and lowered Rust symbol.
 
-- [ ] **Generated/internal helper namespace.** Keep compiler-generated helpers
-  compiler-reserved/mangled so they never collide with user module/type/member
-  names.
-  _Why:_ helper names should never consume source-level names or force a port to
-  avoid otherwise valid identifiers. (Module isolation + `#lower_name` cover
-  user-symbol collisions; this is the generated-helper side.)
-
 - [ ] **External/FFI declaration ergonomics.** Declare copied runtime/autogen and
   device boundaries compactly — `native fn` exists, but make whole boundaries easy
   to bind without large wrapper files.