Merge branch 'main' into claude/lucid-pascal-0xL5X

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>

Author: hyperpolymath

.github/workflows/ci.yml

@@ -183,16 +183,22 @@ jobs:
         # ReScript source. Picks the existing res-to-affine test fixture
         # so any drift in the pinned commit's syntactic surface area
         # surfaces here rather than at walker-rule writing time.
+        #
+        # NOTE: tree-sitter-cli >= 0.25 repurposed `--paths` to mean "a
+        # file listing input source paths", not "a directory containing
+        # a grammar". Grammar lookup is now driven by the current
+        # working directory (the CLI walks up looking for grammar.js /
+        # src/parser.c), so we cd into the vendored grammar tree and
+        # pass an absolute path to the fixture. Without this, the step
+        # fails with `Failed to read paths file ... Is a directory`.
         run: |
           shopt -s nullglob
           fixtures=(tools/res-to-affine/test/fixtures/*.res)
           if [ ${#fixtures[@]} -eq 0 ]; then
             echo "no .res fixtures to smoke-parse; skipping"
             exit 0
           fi
-          tree-sitter parse \
-            --quiet \
-            "${fixtures[0]}" \
-            --paths tools/vendor/tree-sitter-rescript \
-            > /dev/null
+          fixture_abs="$(realpath "${fixtures[0]}")"
+          ( cd tools/vendor/tree-sitter-rescript \
+              && tree-sitter parse --quiet "${fixture_abs}" > /dev/null )
           echo "smoke-parsed: ${fixtures[0]}"

.machine_readable/6a2/META.a2ml

@@ -1070,23 +1070,34 @@ Thread per-call-site effect rows from typecheck to codegen via a
   `let`-RHS call's effect row ⊇ `Async`” via a table lookup, replacing
   `is_async_prim_call`/`async_primitives`.
 - *Fallback / safety.* If the table has no entry for a site (e.g. a
-  pre-typecheck embedder path, or a synthesised node), codegen falls
-  back to the structural recogniser. The hardcoded set is retired only
-  once the table path is proven (final slice); over-conservative
-  fallback is always sound (= today's behaviour).
+  pre-typecheck embedder path, or a synthesised node), or the consumer
+  detects a producer/consumer count-mismatch, [Effect_sites.is_async_call]
+  returns false ⇒ the CPS transform simply does not fire for that call.
+  The pre-S4 plan retained the structural recogniser as the fallback
+  *until the table path was proven*; S4 (PR #278) retired the
+  hardcoded `async_primitives` set, so the steady-state fallback is
+  "no transform" — over-conservative, always sound.
 
 Staged (ledger #234; each a gated PR, full `dune test --force` +
 wasm e2e):
-- S1 (this): ADR-016 + plan. No code change.
-- S2: `lib/effect_sites.ml` shared numbering + typecheck builds &
-  returns the side-table. NO codegen behaviour change (table built,
-  unused) — pure, gate-neutral.
-- S3: pipeline threads the table; codegen boundary predicate switches
-  to the table with structural fallback; new e2e proving a
-  *user-defined* `Async` fn triggers the transform (the payoff). All
-  existing http_cps_* / http_response_reader stay green.
-- S4: retire the hardcoded `async_primitives` set (fallback remains
-  for table-miss only); doc truthing.
+- S1 (ADR-016 + plan, PR #270): DONE — no code change.
+- S2a (`lib/effect_sites.ml` shared numbering, PR #275): DONE — pure,
+  gate-neutral.
+- S2b (typecheck builds & returns the side-table, PR #276): DONE — no
+  codegen behaviour change yet.
+- S3 (pipeline threads the table; codegen boundary predicate switches
+  to the table with structural fallback; new e2e
+  `tests/codegen/effect_async_boundary.affine` proving a *user-defined*
+  `Async` fn triggers the transform — PR #277): DONE. All existing
+  http_cps_* / http_response_reader stay green.
+- S4 (retire the hardcoded `async_primitives` set; boundary is now
+  exactly `Effect_sites.is_async_call`; fallback remains for table-
+  empty / count-mismatch only — PR #278): DONE.
+
+*Delivery status:* CLOSED 2026-05-19 end-to-end. Issue #234 closed
+completed (`hyperpolymath/affinescript#234`). The structural name set
+no longer exists; the boundary is single-sourced from the typecheck
+effect side-table via the shared `Effect_sites` ordinal.
 """
 consequences = """
 - Generalises to user-defined `Async` functions; new async primitives

.machine_readable/6a2/STATE.a2ml

@@ -68,7 +68,7 @@ test-files = 54
 # the feature is not enforced on user programs through the CLI pipeline.
 affine-types = "wired-and-reachable (Track A Manhattan plan complete 2026-04-10. Quantity semiring in lib/quantity.ml; invoked from typecheck.ml:1206 inside the standard CLI pipeline. Surface syntax per ADR-007 hybrid: @linear/@erased/@unrestricted attributes (Option C primary) on let/stmt-let/param/lambda-param, AND :1/:0/:ω numeric sugar (Option B) on let/stmt-let. Scaled Let rule per ADR-002 implemented in lib/quantity.ml ExprLet/StmtLet — closes BUG-001 (ω-let smuggles linear values) and BUG-002 (zero-let erasure). Four regression fixtures in test/e2e/fixtures/ exercise both surface forms. Behavioural enforcement verified via E2E Quantity test suite — 4 new passing tests, 0 regressions.)"
 linear-arrows = "enforced (2026-04-11): Three-part fix landed. (1) typecheck.ml lambda synth: |@linear x: T| e now synthesises T -[1]-> U (was always QOmega). (2) typecheck.ml lambda check mode: explicit param quantity annotation validated against expected TArrow quantity; unannotated params inherit context quantity. (3) quantity.ml ExprLambda: added env.errors accumulator; annotated lambda params declared via env_declare so env_use tracks them; usage verified with check_quantity after body walk; violations pushed to env.errors and drained at end of check_function_quantities (step 4). Saved/restored env.quantities entries to prevent scope leakage. Two E2E fixtures + 2 passing tests. 75 tests total, 0 regressions. Commit d2f9b7b pushed."
-borrow-checker = "phase-3-part-1-landed (CORE-01, PR #240 Refs #177, 2026-05-19, gate 263/263): borrow-graph validation wired — BorrowOutlivesOwner emitted (&local escaping its block), shared-XOR-exclusive enforced at use sites (UseWhileExclusivelyBorrowed), ownership derived from param type TyOwn/TyRef/TyMut (owned/ref/mut discipline now enforced from real parsed source — closed a latent hole), call-arg borrows temporary, ref-binding graph tracked. Part 2+ deferred: NLL/region inference, flow-sensitive escape via `outer = &x`, tighter quantity integration. Authoritative: docs/CAPABILITY-MATRIX.adoc + docs/TECH-DEBT.adoc CORE-01."
+borrow-checker = "phase-3-part-3-slice-A-landed (CORE-01, Refs #177, 2026-05-24): pt1 (#240, gate 263/263) borrow-graph validation wired — BorrowOutlivesOwner emitted (&local escaping its block), shared-XOR-exclusive enforced at use sites (UseWhileExclusivelyBorrowed), ownership derived from param type TyOwn/TyRef/TyMut (owned/ref/mut discipline now enforced from real parsed source — closed a latent hole), call-arg borrows temporary, ref-binding graph tracked. pt2 (gate 271→274 and 278→281) return-escape (return-of-ref-rooted-at-callee-owned-binding caught) + &mut e parser surface (zero Menhir conflict delta — exclusive borrow finally expressible from real source). pt3 Slice A NLL last-use expiry: forward pre-pass compute_last_use_index maps each symbol to its greatest mentioning statement index; check_block expires ref-bindings introduced in-block once their binder is dead, releasing the underlying borrow. Unblocks `let r = &x; print(*r); x = 2` and `let m = &mut x; let y = *m; x` while still rejecting same-block live aliasing (2 positive + 1 anti-regression hermetic tests in E2E Borrow Graph). Residual (Slices B–D): flow-sensitive escape via `outer = &x`, origin/region variables (Polonius surface) + loan-live-at-point dataflow across CFG joins, tighter quantity integration. Authoritative: docs/CAPABILITY-MATRIX.adoc + docs/TECH-DEBT.adoc CORE-01."
 row-polymorphism = "60% (records + effects rows implemented in typecheck/unify; not fully exercised end-to-end)"
 effects = "interpreter-complete (handler dispatch, PerformEffect propagation, ExprResume, multi-arg ops all wired in interp.ml 2026-04-11). WasmGC: ops registered as unreachable stubs; ExprHandle/ExprResume reject with UnsupportedFeature — full WASM dispatch needs EH proposal or CPS transform."
 dependent-types = "parse-only (TRefined AST node exists and refinement predicates parse, but predicates do not reduce; no SMT/decision procedure wired in)"

docs/CAPABILITY-MATRIX.adoc

@@ -84,16 +84,26 @@ enforced. Handlers: *interpreter-complete*; WasmGC dispatch is
 `UnsupportedFeature` pending the EH proposal or the CPS transform (the #225
 CPS line is closing the async slice of this).
 
-|Borrow checker |*partial — graph validation landed (CORE-01 pt 1)* |
+|Borrow checker |*partial — graph validation + NLL last-use landed
+(CORE-01 pts 1–3 Slice A)* |
 Place/borrow/move infra + use-after-move, conflicting-borrow,
 move-while-borrowed, lambda-capture. *CORE-01 part 1* (PR #240, Refs #177,
 gate 263/263): borrow-graph validation wired — `BorrowOutlivesOwner` now
 emitted (`&local` escaping its block); shared-XOR-exclusive enforced at
 *use* sites (`UseWhileExclusivelyBorrowed`); ownership now derived from the
 parameter *type* (`TyOwn/TyRef/TyMut`) so the owned/ref/mut discipline is
 actually enforced from real parsed source (closed a latent hole); call-arg
-borrows made temporary. *Deferred (CORE-01 pt 2+):* NLL/region inference,
-flow-sensitive escape via `outer = &x`, tighter quantity integration.
+borrows made temporary. *Part 2* (Refs #177): return-escape +
+`&mut e` parser surface (the exclusive borrow is finally expressible from
+source). *Part 3 Slice A* (Refs #177): non-lexical lifetimes —
+ref-bindings expire at their binder's *last use*, not at block exit
+(`compute_last_use_index` pre-pass + per-statement expiry in
+`check_block`). Patterns like `let r = &x; print(*r); x = 2` and
+`let m = &mut x; let y = *m; x` now type-check, while still-live borrows
+continue to block aliasing assignments. *Deferred (Slices B–D):*
+flow-sensitive escape via `outer = &x`; origin/region variables
+(Polonius surface) + loan-live-at-point dataflow across CFG joins;
+tighter quantity integration for captured linears.
 
 |Quantity / affine types |*enforced* |QTT semiring in `lib/quantity.ml`,
 invoked inside the standard CLI pipeline. `@linear`/`@erased`/`@unrestricted`

docs/ECOSYSTEM.adoc

@@ -80,7 +80,8 @@ made real; #228/ADR-014 module-qualified paths (estate port unblocker). |
 |*E* |typed-wasm convergence hardening (the transition runway): the
 AffineScript↔typed-wasm contract widened from L7+L10 toward full
 L1–6/L13–16 emitted-wasm enforcement; estate-wide re-validation (#235);
-effect-threaded async-boundary recogniser (#234); the #225/#160 convergence
+effect-threaded async-boundary recogniser (#234, DELIVERED 2026-05-19 —
+ADR-016, S1..S4 / PRs #270/#275/#276/#277/#278); the #225/#160 convergence
 ABI matured to "shared with Ephapax". |*planned* |Begins when D's substrate
 (INT-01..04, CORE-01) is closed; ends at a stable, multi-producer
 typed-wasm convergence ABI.
@@ -234,6 +235,15 @@ byte-level wasm-IR extension (I32Load8U/I32Store8 absent today)
 sub-slices: S5 (native clocks/env/argv via preview2), S6b
 (`wasi:sockets`), S6c (flip the default wasm target from preview1
 → component). WIT world of record: `wit/affinescript.wit`
+bridges to `wasi:clocks`/`wasi:cli`. Real-host main-invoke deferred
+to S6 (WIT export-lifting / wasi:cli/run command shape).
+**S5 string accessors (env_at/arg_at) DONE: the wasm IR gained
+the byte-level load/store family (I32Load8U/I32Store8 + the full
+WebAssembly 1.0 §5.4.6 row, opcodes 0x2C..0x35 / 0x3A..0x3E);
+accessors lower to on-demand `environ_get`/`args_get` paired with
+the existing `*_sizes_get` import (dedup keeps each WASI import
+once even when both `*_count` and `*_at` are used).** WIT world
+of record: `wit/affinescript.wit`
 |INT-04 |Publish compiler + runtime to JSR (then npm) |#181 |runtime
 packaging READY (affine-js + affinescript-tea JSR dry-run green;
 manual-only `publish-jsr.yml`; docs/PACKAGING.adoc). INT-01 dep

docs/TECH-DEBT.adoc

@@ -110,16 +110,37 @@ typed/codegen'd like `&e` — exclusivity is a static borrow property).
 `&`-in-`#{` literals and bare block-statements already parse on `main`;
 `-> &T`/`&T` *type* sigil deliberately **not** added — `ref T`/`mut T`
 keyword types already express reference types; a `&T` sigil is duplicate
-surface (ADR territory, not a soundness gap). *Part 2 residual — now the
-analysis, not surface:* NLL/region inference (Polonius) + flow-sensitive
-escape via `outer = &x` are now *expressible* (surface unblocked); the
-remaining work is the dataflow analysis itself. |S1 |pt1 #240 + pt2
-return-escape + `&mut` surface DONE (Refs #177); residual = NLL analysis
-— issue #177
-|CORE-02 |Effect-handler dispatch on WasmGC (currently `UnsupportedFeature`;
-EH proposal or CPS). The #225 CPS line closes the async slice. |S2 |partial
-(#225 line CLOSED PR1..PR3d+PR4; #234 generalises the recogniser —
-ADR-016 ACCEPTED, side-table typecheck→codegen, staged S1..S4; S1 done)
+surface (ADR territory, not a soundness gap). *Part 3 Slice A — NLL
+last-use expiry LANDED* (Refs #177): a forward pre-pass
+(`compute_last_use_index`) maps each symbol to the greatest statement
+index that mentions it; after each statement, `check_block` expires any
+ref-binding introduced in that block whose binder is now dead, releasing
+the underlying borrow. Unblocks the canonical NLL patterns
+(`let r = &x; print(*r); x = 2`; `let m = &mut x; let y = *m; x`) while
+preserving soundness — the anti-aliasing rules still fire against
+statements that *do* use the binder (3 hermetic tests in "E2E Borrow
+Graph", two positive + one anti-regression). *Slices B–D residual:*
+flow-sensitive escape via assignment to an outer mutable
+(`outer = &x`); origin/region variables (Polonius surface) + loan-live-
+at-point dataflow across CFG joins; tighter quantity integration for
+captured linears. |S1 |pt1 #240 + pt2 return-escape + `&mut` surface +
+pt3 Slice A NLL last-use DONE (Refs #177); residual = Slices B–D
+(flow-sensitive escape, origin variables, quantity integration) —
+issue #177
+|CORE-02 |Effect-handler dispatch on WasmGC (was `UnsupportedFeature`;
+the chosen path is CPS over the EH proposal). The #225 CPS line closed
+the async slice; #234 generalised the boundary recogniser from a
+hardcoded name set to "any call whose effect row ⊇ `Async`". |S2
+|*CLOSED 2026-05-19* — #225 line CLOSED PR1..PR3d+PR4; #234 ADR-016
+delivered end-to-end (S1 #270 ADR; S2a #275 shared call-site
+numbering `lib/effect_sites.ml`; S2b #276 typecheck builds the
+ordinal→effect side-table; S3 #277 pipeline threads it + codegen
+boundary predicate switched + user-defined-`Async` e2e
+`tests/codegen/effect_async_boundary.affine`; S4 #278 hardcoded
+`async_primitives` set retired — boundary is now exactly
+`Effect_sites.is_async_call`). Issue #234 closed completed. Table-miss
+fallback (`Effect_sites.is_async_call` = false ⇒ no transform) remains
+as the sound table-empty / count-mismatch path.
 |CORE-03 |ADR-014: module-qualified type/effect path. Decision settled
 (both `.`/`::` accepted, `Pkg::Type` canonical, `.`→`::` for free via the
 `::`-fold). Was the estate's dominant parse blocker (525/1177 .affine).
@@ -159,7 +180,32 @@ complete; convergence ABI shared w/ Ephapax
 insert/set/remove/keys/values; AOT-gated (#136). Closes ESC-03 #247 (the
 #229 `Dict.t` target); unblocks the additive `Http.affine` headers→Dict
 upgrade
-|STDLIB-04 |Residual `extern` builtins → real implementations |S3 |open
+|STDLIB-04 |Residual `extern` builtins → real implementations (umbrella;
+split into 04a–04e 2026-05-24 per per-extern audit, one row per PR) |S3
+|open (5 sub-rows)
+|STDLIB-04a |Mut effect externs (`make_ref`/`get`/`set`) — *LANDED*
+(Refs #328): interp uses `VMut` cell (`lib/interp.ml`); Deno codegen
+lowers to `{__cell: x}` single-field object (`lib/codegen_deno.ml`);
+3 hermetic e2e tests in "E2E STDLIB-04a Mut #328" (Int + String
+round-trips + Deno codegen __cell-shape assertion) |S3 |DONE
+2026-05-24 (Refs #328)
+|STDLIB-04b |Throws extern `error<T>` — *LANDED* (Refs #329): mirrors
+`panic`'s divergent semantics with a polymorphic return (`<T>` unifies
+with the call-site expectation, unobservable at runtime). Wired in
+interp (`RuntimeError`), Deno codegen (`throw new Error`), resolve
+seed, and typecheck as a scheme (`poly1` so each call instantiates a
+fresh tyvar). 3 hermetic tests in "E2E STDLIB-04b error #329". |S3
+|DONE 2026-05-24 (Refs #329)
+|STDLIB-04c |`string_concat` extern — no direct wiring found; `++`
+operator independently lowered. Decide: remove (operator-only) or wire
+to mirror `++` |S3 |open — issue #330
+|STDLIB-04d |IO externs (`print`/`println`/`read_line`/`read_file`/
+`write_file`) — wired on all backends but no dedicated hermetic e2e
+tests; test-debt, not impl-debt |S3 |open — issue #331
+|STDLIB-04e |Pure externs (`int_to_string`/`string_to_int`/
+`string_length`) — real + tested (`lib/interp.ml:615-633`,
+`lib/codegen_deno.ml:263-272`); bookkeeping to mark DONE |S3 |open —
+issue #332
 |===
 
 == Section D — INT (ecosystem integration)
@@ -211,6 +257,14 @@ survives, `wasmtime run` exits 0. Real-host main-invoke now
 works via `wasmtime run <component>`.** Remaining S6
 sub-slices: S5 (native clocks/env/argv), S6b (`wasi:sockets`),
 S6c (flip the default wasm target from preview1 → component)
+regression proves no collision. **S5 (env_at/arg_at) DONE — wasm
+IR extended with the byte-level load/store family
+(I32Load8U/I32Store8 and siblings); accessors lower to on-demand
+`environ_get`/`args_get` imports paired with the existing
+`*_sizes_get` (dedup keeps each WASI import exactly once even when
+both `*_count` and `*_at` are used in the same unit); guest
+allocates a length-prefixed AS string and byte-copies from the
+WASI buffer.** Real-host main-invoke = S6 (WIT export lifting)
 |INT-04 |Publish to JSR/npm |S2 |#181 packaging READY (dry-run green,
 manual workflow); compiler-binary distribution decided = **ADR-019**
 (#260, Releases + thin Deno/JSR shim, staged S1..S4) — S1/S2/S3
@@ -263,7 +317,9 @@ Proven + locked (see INT-02)
 |CONV-01 |Estate-wide re-validation of the #199/#205 closure ABI (static →
 real wasm engine) |S2 |open #235
 |CONV-02 |Effect-threaded async-boundary detection (generalise the
-structural-conservative recogniser) |S2 |open #234
+structural-conservative recogniser) |S2 |*CLOSED 2026-05-19* — #234
+DELIVERED end-to-end (ADR-016 S1..S4; PRs #270/#275/#276/#277/#278).
+See CORE-02 above for the resolution narrative.
 |CONV-03 |#225/#160 convergence ABI matured to "shared with Ephapax" |S1
 |partial (PR3a/b/c merged)
 |CONV-04 |Widen emitted-wasm enforcement beyond L7+L10 toward L1–6/L13–16 |S2