[thiremani]

Closes #123, closes #91, closes #92, closes #143, closes #146.

Every function body that runs now writes every output. A template that can leave an output unwritten is rejected at its definition, whether or not anything calls it:

output "out" may be left unassigned; assign it unconditionally first, or pass the previous value as an input and initialize from it (out = prev), with each caller passing its destination as that input

A function keeps an old value only through an input its caller passes, as in a = Maybe(a, -1) with out = prev first. A call therefore either writes all of its outputs or does not run, and only the caller's own statement decides whether a destination keeps its value.

The PR also stops ranges crossing function boundaries (#146): a function cannot return a range, and a bare range name behaves like the literal it holds: only an assignment without a gate stores or copies a range. That keeps the check's reading of ranges local to each function; see Ranges and functions.

The check

The CFG checks each template once, from its text, the same for every argument type (compiler/cfg.go). A write may be skipped under a statement gate, when its value can fail (a value-position comparison, &&, a checked access, a || whose last alternative can fail, or a call with such an argument), or when a range that may be empty drives it. Only a range literal with constant, nonempty bounds always runs. A call counts as writing every output, since its callee passes the same check, so a caller of a rejected function is not reported again.

Reads before definite assignment, dead stores and write-after-write move into the same pass. The per-specialization CFG, its cached results and the per-script replay are removed (#91, #92). Effects stay for the script root, whose checks move to the text classification in a follow-up.

Which values hold a Range is read from the text as well. Under #146 a binding holds a range when its latest assignment is a bare range literal or name assigned without a gate, which each function's own text decides. Settlement panics when a specialization's Range-typed bindings disagree with that summary. Tests pin each way a value holds or iterates a range against the solver, and a generated sweep checks their combinations.

The pass also reports text it cannot classify, each an error the solver reports in any specialization: a call that names no template, an operator whose sides don't line up (value counts the solver rejects), and an assignment whose values don't fill its targets. Flow checks run only once no template has these errors, so a flow error never stands in for the real one, in that template or in a caller of a function rejected for returning a range. A name reassigned between a range and a non-range value is the type checker's to report, like any other change of type. The pass reads each name by its latest assignment, so a flow error in the text as written comes first, and the type checker reports the retype once the flow checks pass.

Ranges and functions (#146)

• Breaking: a function cannot return a range. An output assigned a range is rejected at its definition, including one output of several, whether the range is a literal or a copy (out = r). Return the bounds and build the range in the caller: lo, hi = Bounds(n), then r = lo:hi; to choose a range under a condition, choose its bounds (lo, hi = n > 0 a, b, then r = lo:hi). A range returned by a call is never iterated: passed to a function, it crashes or miscompiles #143's reproducers now fail at the definition instead of crashing.
• Breaking: a bare range assigned under a gate iterates. Only an assignment without a gate stores or copies a bare range, literal or name, and each value of such an assignment counts on its own, so a, b = i, i + 1 copies i into a. A gate makes its values computations, like &&: x = a > 2 m, x = m > 2 m and x = a > 2 && m all give an element, and r = n > 0 0:5 iterates. Prints keep master's rule: a bare range argument prints as written unless another argument on the line loops over it, so i, i + 1 prints each element while i, j prints both ranges. A main marker shows its range the same way, and width and precision markers take numbers and iterate, in the order the string names them.
• The rule took three rounds. The ninth commit made every bare range name iterate, which broke substitution: j = i no longer matched j = 0:5, and over an empty i, j = i then y = j + 1 gave 1 where y = i + 1 left y alone. The twenty-first went back to master's copies, including under a gate, where a gate then differed from && (x = a > 2 m copied, x = a > 2 && m iterated). The twenty-third iterates a bare range under a gate, as && does, so any value E other than a bare range assigned without a gate is computed per element, as [E] collects it: when every element yields, x = E keeps the last one; otherwise x keeps the last element that yielded, or its old value if none did, while [E] zero-fills the failed cells. A gate's condition still runs once per point of the statement's outer iteration domain, and an && condition once per element of its value.
• The check's range reading needs no other function: the cross-function fixed point, range forwarding through || and && from the sixth commit, and the || range check from the seventh are gone.

Behavior changes

• Breaking: a body that can skip an output write no longer compiles. Migrations: a default first (y = n, then y = n > 1 Fib(n - 1) + Fib(n - 2)); a prev input to keep a caller's value; a local for a checked access (t = arr[i], then out = t) until checked-access fallbacks land.
• A body whose only write to an output is a comparison, such as out = x > 0, is rejected even when every caller passes arrays, where the comparison is a mask that always writes. Write a default first: out = prev, as Pos does, or out = []0 in a function that only takes arrays.
• Templates nothing calls now get dead-store and write-after-write checks, and a flow error in any template fails the whole package before any script compiles.
• While any template has a structural or text error, no template gets flow errors; they appear once it is fixed.
• An undefined function, an operator whose sides don't line up, and an assignment whose values don't fill its targets are reported at the definition, for templates nothing calls too. Before, they appeared only when a script called the template. Scripts now read the same assignment mismatch: 3 targets but 4 values and operand mismatch: "*" has 2 values on its left but 1 value on its right.
• out = prev followed by out = x > 0 is accepted for scalar and array x. It used to be a dead store for arrays. The array specialization still copies the default; the docs now say so instead of claiming it is dropped.
• A ranged call through prev filters only when shared: Filter(kept, 1:5) keeps 2, Filter(0, 1:5) ends at 0.
• Breaking: a condition inside a range literal's bound no longer counts as a condition of the value around the range. (0:(n > 0) + 0) || 99 and (0:(n > 0) + 0) && 99 are rejected, like (0:n + 0) || 99 and like the same range named before the statement. For a default result when the range yields nothing, assign the default first: x = 99, then x = 0:(n > 0) + 0. For a default bound when the condition fails, put the fallback inside the bound: 0:((n > 0) || 3); the twenty-seventh commit's footer names only this second form. A nested literal's bounds now run once, before its loop nest, even when an outer range is empty.

The ABI doesn't change: the seed and write markers go unused outside callee-owned domains. Removing them is #69 (ABI 3.0), and stable inputs are #144.

Commits

1. test: rewrites the 34 fixture functions that could skip a write. They already passed on master. Two expected outputs change: ConditionalNestedSkipped prints 10 10, and CallStaticShareSkipped commits two empty static strings. Three labels that named the removed seed or a skipped write are renamed, and acc.exp gains the Filter cases.
2. feat(compiler)!: the rule, the per-template pass, the range summary and its settlement check, with unit-test migrations. TestMutualRecursion keeps its one-output-waits-a-pass scenario through gated recursive locals. New end-to-end cases: Pos (scalar and array) and DoubleLast, a range from a call through prev.
3. refactor(compiler): removes the body-effect fixed point, which can no longer weaken anything: BodyOutputEffects, the specialization call graph with its Tarjan components and worklist, and per-specialization statement effects (+35 −538).
4. docs: the docs and README describe the rule as implemented and keep stable inputs and ABI 3.0 as planned.
5. fix(compiler): from review: the pass reports text it cannot classify instead of drawing flow errors from it. Before, a template with an arity mismatch and a value that could fail, or with a name reassigned between a range and a non-range value, got "may be left unassigned" errors that hid the real one. The eleventh commit hands the range retype back to the type checker.
6. fix(compiler): from review, superseded by the eighth commit: a call under || or && passes on each of its outputs' ranges, for calls with several outputs too. Before, kept, k = n > 0 && Two(n) and kept, k = Two(n > 0) || Two(3) stopped with an internal error once called, and outputs written by that || were rejected. New end-to-end case: MultiOutputRanges.
7. fix(compiler): from the sweep: the check reports an operator whose sides don't line up, as the solver does, instead of a flow error that hid it (a, b = Two(n) * 2, out = MakeRange(n > 0) || 0:n). passedRanges now says, for the range summary, the flow checks and this check alike, which values pass a range on whole; the eighth commit removes it with range outputs.
8. feat(compiler)!: functions cannot return ranges (Functions cannot return ranges, and a bare range name behaves like its literal #146). Each function's range summary becomes its own. Fixtures that returned ranges return bounds instead, or go where the case can no longer arise; DoubleLast keeps its point with a local range.
9. feat(compiler)!: a bare range name iterates wherever it is used (Functions cannot return ranges, and a bare range name behaves like its literal #146): assignments keep the final value, and prints and markers run once per value. The type checker, the per-function check and lowering follow; fixtures, the README and the docs migrate. The twenty-first commit restores master's copies.
10. fix(compiler): from review: a string's markers drive in the order they appear. The ninth commit took a string's value markers before its width and precision markers, so "|-n%(-w)d| -j" made j the outer loop although w comes first. Also drops two stale copy statements from Range Semantics. The twenty-first commit drops this ordering with the ninth's rule, since only width and precision markers drive again.
11. refactor(compiler): from review: a range retype is left to the type checker, which already rejects any change of a variable's type; once the flow checks pass, it reports the retype at the same position. The per-function check reads each name by its latest assignment instead of rejecting the change, so a template nothing calls is no longer checked for it, like any other type error. Also drops the IR plan's mention of the || range check the eighth commit removed.
12. docs: from review: the type checker reports a range retype only once the flow checks pass. They read each name by its latest assignment, so a body with r = n, a print of r, then r = 0:n and res = r is reported only for leaving res possibly unassigned. The IR plan and the eleventh commit's test comment said the type checker's error always appears.
13. fix(compiler): from review: the flow checks wait until every template passes the structural and text checks. A caller of a function rejected for returning a range, declared before or after it or reaching it through a function that forwards the call, got two false dead-store errors next to the real one. This predates the PR's last commits.
14. docs: from review: drops the last mentions of ranges returned by calls. Two passages said such a range may be empty, and the PIR matrix said gate_heap covers a function-returned Range; the fixture builds its range from a function's returned bounds.
15. refactor(compiler): checkTemplateFlow takes the classifiedTemplate that AnalyzeFuncs builds, instead of its three fields as separate parameters.
16. refactor(compiler): rangeFlow becomes writeClassifier. The name dates from when range facts flowed between functions; it now only classifies one template's writes.
17. refactor(compiler): writeClassifier gives way to plain functions. The classification walk keeps one local map of the bindings that hold a range and passes it to classifyWrites, maySkip, the drives functions and updateRanges. Its own set of defined names goes too: the walk opens a function scope and declares names as it goes, so a string's markers resolve against the names defined before it, as in the type checker. Two new cases pin that resolution, and they pass on the sixteenth commit as well.
18. style(compiler): from review: a blank line separates each loop from the return after it in the three functions the seventeenth commit reshaped.
19. refactor(compiler): from review: valueSlots, valueCount and callTemplate become CFG methods, since the template checks are their only callers; they were CodeCompiler methods only because they sat beside the cross-function range summary that the eighth commit removed. checkSettledRanges moves to solver.go, next to its only caller, which passes it the template's summary.
20. refactor(compiler): from review: templateKey moves next to the funcKey type in codecompiler.go, and the two places that built the same key inline, template registration and the type checker's outputReads lookup, use it.
21. feat(compiler): from review: a bare range name behaves like its literal again (Functions cannot return ranges, and a bare range name behaves like its literal #146, amended). Assigned whole it copies the range, and printed or named in a main marker it shows the range, unless the statement's condition, for a value, or another argument on the line, for a print, loops over that name. This restores master's behavior on top of the per-function check, which tracks copies again: a copy is a definite write, and out = r with a local range is a range output. Fixtures and unit tests return to their pre-ninth-commit forms, and the seventeenth commit's marker cases now use width operands, since a main marker no longer drives. The twenty-third narrows the copy to assignments without a gate.
22. docs: the README and docs describe the amended rule again. The IR plan's retype example becomes res = r + 1, since res = r now copies the range and is rejected as a range output.
23. feat(compiler)!: from review: a bare range assigned under a gate iterates, as under && (Functions cannot return ranges, and a bare range name behaves like its literal #146, amended again). The type checker copies a bare range only when the assignment has no gate, lowering brings back compileAssignedValue to run the loop when no enclosing loop binds the range, now for a bare literal as well as a name, and the per-function check stops scanning conditions. cond_accum's four gated range cases now expect elements, a new case covers a gate with no range of its own (a name, a literal, and an empty range that keeps the old value), and four unit tests that pinned gated copies flip.
24. docs: the README and docs say a bare range iterates under a gate and choose a range under a condition through its bounds. Also two review corrections: the bare-name rule names the gate rather than any loop in the statement, and descriptor copies are unconditional writes because they are never gated.
25. fix(compiler): from review: a range literal's bounds resolve before its loop, like any operands, so a bound with && or || that fails leaves the loop with no iterations: destinations keep their values and a collector gets no cells. An iterated literal with such a bound (0:(n > 0 && n) + 0, [0:(n > 0 && n)], Accum(x, 0:(n > 0 && n)), arr[0:(n > 0 && n)]) stopped with an internal error, on master as well, and the twenty-third commit added the gated form, x = n > 0 0:(n > 0 && n). The loop now runs the bounds through compileCondOperands, the branching path that && operands and call arguments take, and an index access keeps its per-element check instead of building such a literal ahead of its loop. New empty_range cases cover each form, with bounds that yield and bounds that fail. The twenty-seventh commit replaces this lowering, which still ran some bounds again for each element and lost an out-of-bounds read in a bound.
26. docs: from review: Conditional Value Semantics says how often each spelling runs its condition: a gate once per point of the statement's outer iteration domain, before its values, and && once per element of its value, with an example whose condition prints.
27. fix(compiler)!: from review: an iterated range literal builds its range once, ahead of the loop nest it drives or before a call that runs the loop itself, through one function that every loop, the affine bounds check and a call's own loop share. Every bound must yield, conditions and checked accesses alike, or the range is empty. This fixes the twenty-fifth commit's remaining wrong results: a statement that loops first ran an && bound again for each element (x = 1 > 0 0:(x < 1 && 3) gave 1, not 2), a comparison bound ran twice, and an out-of-bounds read in a bound was lost (bounds[1]:(n > 0 && 3) + 0 wrote 2 instead of keeping the old value). It also fixes three things that were wrong on master: an indexed range's bound ran twice, a nested literal was rebuilt for each outer element (x = i + 0:x gave 2 where naming the range first gave 3), and printing a range expression whose bound read out of bounds printed elements. The type checker follows the same boundary, so a bound never gives a || or && left side a condition, while the per-template check still counts the bounds of a range literal assigned whole. New empty_range cases count bound runs through Loud and cover a bound that reads its destination, an empty outer range, a value with its own &&, a call's own loop, out-of-bounds bounds in a sum, an index, a call and a print, a heap comparison in a bound, and a range reassignment that keeps its old range; two unit cases pin the rejections.
28. docs: Range Semantics says a range literal builds its range once, before its loop nest, and that a failed bound empties the range without failing the value around it.
29. refactor(compiler): checkTemplateFlow reads as its three steps: forwardPass, the forward loop the second commit had inlined from master's typedForwardPass; rejectUnassignedOutputs; and backwardPass, which now takes the outputs set without a copy, since nothing reads the set after it.
30. refactor(compiler): from review: forwardPass ends by reporting the outputs a body can leave unassigned, instead of returning the outputs it assigns for checkTemplateFlow to check. The end of the body is where the caller reads every output, so it is the pass's last read check, and checkTemplateFlow is left with the forward and backward passes, like the script's check.
31. test: from review: cond_accum drops CrossRange and LitCross. LitCross repeats rl = i < 2 0:3 + 10 without the + 10, and breaking the lowering it was added for still fails to compile without either case, through SeedLit, FreshLit and empty_range's collectors. CrossRange was the only bare range name under a gate whose condition names another range, and its result does not depend on which loop iterates the name.

Verification

• gofmt and go vet clean. go test -race ./lexer ./parser ./compiler passes, and python3 test.py --leak-check passes 84/84 with every leak check clean, on every code commit, the last at the pushed head (the twelfth changes only docs and a test comment, the twenty-second, twenty-fourth, twenty-sixth and twenty-eighth only docs). Since the twenty-first, the leak-check suite runs on a private compiler cache.
• Mutation sweep over the final classifier, range summary, flow pass, text checks and Functions cannot return ranges, and a bare range name behaves like its literal #146's rules, rerun at the thirteenth commit: 52 single-part mutations, all caught. The fifteenth only changes how the flow checks receive their inputs, and every mutated line still matches. The sixteenth renames the classifier; the ten mutants on the lines it touched were rerun at that commit and are all caught. They include three on the marker scan's order and contents, one where the type checker ignores a string's markers, two on a name's range following its latest assignment, which replace three on the removed retype check, and two on the flow checks waiting for every template. The seventeenth replaces the classifier with functions; at that commit, the 50 mutants that unit tests check were rerun with their patterns updated, plus two new ones on the scope its walk opens (header names never declared, and a scope that sees every name in the body), and all 52 are caught. The eighteenth only adds blank lines, and every mutated line still matches. The nineteenth moves the counting helpers and the settlement check; with the patterns on the moved lines updated, all 52 unit-test mutants were rerun at that commit and are caught. The twentieth only moves a helper and reuses it, and every mutated line still matches. The new cases for callers of a rejected function also fail against the previous per-template gate. The twenty-first restores copies; at that commit the sweep has 62 mutants: the earlier ones with patterns for the restored code, minus two whose code is gone, plus new ones on copies, a condition that loops over the copied name, collectors and width operands in a condition, main markers and print lines. All 60 that unit tests check are caught, and of the two that need the fixtures, one is caught. The other, a bare print argument that never joins its line's loop, appears equivalent, with no behavioral difference found: the line's loop already binds the name, so lowering reads the element either way. The twenty-third replaces the mutants on condition scanning with six on the gate rule and two on the loop that finalizes a gated bare name or literal at the assignment root, 63 in all. All 59 that unit tests check are caught. The two on the root loop first survived, since every gated range fixture had a condition that already looped; a new fixture case with a gate of no range of its own catches both. The print-argument one still appears equivalent. The twenty-fifth adds two mutants, one skipping the operand pass before a literal's loop and one building a literal with a conditional bound ahead of the accesses it indexes; unit tests miss both, and the new fixture cases catch both. The twenty-seventh replaces those two with eight on the new construction: the bounds guard ignored, loop ranges built without resolving their conditions, condition extraction reaching into an iterated literal's bounds, a call's own loop getting an unresolved range, plain and affine-checked loops building their ranges again, the type checker counting a bound's conditions, and a range reassignment that never skips. All eight are caught, seven by the new fixture cases, which the unit tests miss, and one by the new unit cases; the two whose lines changed after the sweep were rerun on the final lines. The twenty-ninth only moves code into two functions and drops a copy; the three mutants on the moved lines were rerun at that commit and are caught, as is the one on maySkip's range check, whose pattern the twenty-seventh had left unmatched. The thirtieth only moves a call; the mutants on the end-of-body check and on output assignment were rerun there and are caught. For the thirty-first, the mutant that stops a bound range literal reading its element was run with both cases removed: the unit tests miss it, and it still fails to compile tests/array and tests/cond.
• A generated sweep types value shapes through a script call: calls with and without a failing argument or a range argument, range literals, range and plain names, strings with range markers, comparisons, &&, || and gates. Under the ninth commit's rule, on all 1,454 of 2,592 shapes the solver accepts, the range summary agrees with it, and every valid value whose write the check calls skippable has a recognized cause. Earlier rounds of the same sweep found the 236 internal errors the sixth commit fixed and the 233 misleading flow errors the seventh fixed. For the twenty-first, a focused sweep of 520 shapes, built from copies, conditions over the copied name, another range or a call, value markers, tuples and a prior range assignment, compiles 348 through a script call with no settlement panic; the other 172 are retypes the type checker rejects. With the type checker changed never to copy, 290 of the 520 panic. For the twenty-third, the same shapes compile 272 with no settlement panic, and the other 248 are retypes, more than before since a gated value now gives an element; with the type checker changed to copy under a gate as well, 234 panic.
• The 30 template blocks gathered from the README, the docs, pluto-lang.dev's pages and playground examples, and the open issues still compile, apart from Require every function output to be definitely assigned #123's own examples of rejected code and two blocks that return a range: A range returned by a call is never iterated: passed to a function, it crashes or miscompiles #143's report, and the Memory Model's old MakeRange example, which this PR rewrites. The README's range examples and the docs' print and marker examples were rerun at the twenty-first commit, and the examples the twenty-fourth changes, a bare j under a shared gate and a range chosen through its bounds, at the twenty-third. The twenty-sixth's example, a gate and an && whose condition prints, was run at the twenty-fifth, and the twenty-eighth's two rejected statements at the twenty-seventh.

Related

• Write Fib's base value first, ahead of Pluto's definite-output rule bench#5, already merged, rewrote the bench's Fib and FibAux the same way (byte-identical code). The bench returns no ranges and copies or prints no range names, so Functions cannot return ranges, and a bare range name behaves like its literal #146 needs nothing there.
• A range returned by a call is never iterated: passed to a function, it crashes or miscompiles #143, a call's returned range is never iterated, was found while probing the range rules; with Functions cannot return ranges, and a bare range name behaves like its literal #146 its reproducers fail at the definition, so this PR closes it.
• The sweep also hit An inline array literal under || or && in a ranged statement or call crashes the compiler #118's crash in a new form: a ranged statement with an inline array literal under && (x = r > 1 3 > 0 && [1]). It predates this PR; An inline array literal under || or && in a ranged statement or call crashes the compiler #118 now covers both forms.
• A review of the twenty-seventh commit found another existing crash with the same cause as An inline array literal under || or && in a ranged statement or call crashes the compiler #118: a range literal under && inside an array literal, [(n > 0) && 0:n]. An inline array literal under || or && in a ranged statement or call crashes the compiler #118 now covers it as a third trigger.

🤖 Generated with Claude Code