Phase 2 numbers: exact int64 and IEEE doubles (#1758)

.claude/rules/c-runtime-memory.md

@@ -92,7 +92,7 @@ iteration, or a collector that quietly stops working).
   record, `store_put` refused to re-insert it, and the caller was told 1).
 
 - **`eigs_json_encode` borrows its argument and `eigs_json_parse_value` returns
-  an owned ref.** `eigs_json_encode(make_num(x))` leaks the `make_num`; a parsed
+  an owned ref.** `eigs_json_encode(make_float(x))` leaks the `make_float`; a parsed
   Value must be decref'd on *every* path including early returns, and the value
   read out of it before the decref. Three of the five call sites in
   `ext_http.c` had this wrong (#731) — if you touch one, re-audit the rest.
@@ -148,11 +148,15 @@ iteration, or a collector that quietly stops working).
 - **Container elements are `EigsSlot` storage (#1665 arm D); read them only
   through `src/container.h`, and know which getter owns what.** Every rule
   below was bought by a real bug during the migration:
-  - `list_get_ref` / `dict_value_get_ref` return **NULL for a number** by
-    contract. Test `list_elem_type` / `slot_type` before dereferencing, and
-    never write `get_ref(...)->type == VAL_NUM` (always false). Ragged tensor
-    rows crashed `relu`/`gather` this way (B5), and the DMG in-place
-    register-write fast path silently never fired (B2, +38% Ir).
+  - `list_get_ref` / `dict_value_get_ref` return **NULL for an immediate
+    number**, a double or an SMI (`src/container.h`:133 and :137). A boxed
+    int (|i| >= 2^47, since #1758 R1.3) is a heap slot, so it comes back as a
+    non-NULL `VAL_INT` Value. Test `list_elem_type` / `slot_type` before
+    dereferencing. Never write `get_ref(...)->type == VAL_FLOAT` (always
+    false), and never read `get_ref(...)->type == VAL_INT` as "an int" (it is
+    true for a boxed int only, never for an SMI). Ragged tensor rows crashed
+    `relu`/`gather` this way (B5), and the DMG in-place register-write fast
+    path silently never fired (B2, +38% Ir).
   - A view (`list_get_view`, `slot_view`, `EIGS_VIEW`, `BUILTIN_*_VIEW`) is
     **stack storage**: never return it, store it, or incref-and-keep it, and
     a `BUILTIN_*_VIEW` compound literal dies at its enclosing block. A view in

.github/workflows/phase2.yml

@@ -0,0 +1,81 @@
+name: phase2
+
+# #1758: landed MAP rows, the pre-registered builtin table on matched
+# capability profiles, the C readers and the stdlib differential. The shared
+# phase2_check.py helper derives the complete declared MAP prefix.
+on:
+  push:
+    branches: [phase2-numbers]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  phase2:
+    name: phase2 (MAP + builtins + readers + lib)
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    services:
+      db:
+        image: postgres:16
+        env:
+          POSTGRES_USER: eigs
+          POSTGRES_PASSWORD: eigs_test
+          POSTGRES_DB: eigs_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U eigs"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      DATABASE_URL: postgres://eigs:eigs_test@127.0.0.1:5432/eigs_test
+    steps:
+      # Every branch and tag is needed: origin/main and v0.46.0.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+      - name: Fetch the approved builtin bar object
+        run: |
+          git fetch --no-tags origin 0a73adb0612f8612d75393891ae2ba2e1c803663
+          git cat-file -e '0a73adb0612f8612d75393891ae2ba2e1c803663^{tree}'
+      - name: Install matched capability dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libpq-dev zlib1g-dev libsdl2-2.0-0 libsdl2-mixer-2.0-0 libsdl2-ttf-2.0-0
+      - name: Build tag, main and branch profiles serially; run the phase2 lane
+        run: |
+          set -euo pipefail
+          export XDG_CACHE_HOME="$RUNNER_TEMP/cache"
+          make --no-print-directory observer-anchor
+          anchor="$XDG_CACHE_HOME/eigs-oracle-anchor/$(sha256sum tools/observer_oracle/build_anchor.sh | cut -d' ' -f1)/src/eigenscript"
+          mkdir -p "$RUNNER_TEMP/main" "$RUNNER_TEMP/tag-profiles"
+          git archive origin/main | tar -x -C "$RUNNER_TEMP/main"
+          git archive v0.46.0 | tar -x -C "$RUNNER_TEMP/tag-profiles"
+          make -C "$RUNNER_TEMP/main" > "$RUNNER_TEMP/main-build.log" 2>&1 \
+            || { tail -n 50 "$RUNNER_TEMP/main-build.log"; echo "::error::the origin/main build failed"; exit 1; }
+          # The table uses matching capability builds; a capability-unavailable
+          # transcript is a failure, including on the tag (ruling A3).
+          for profile in server zlib db; do
+            target="$profile"
+            [ "$profile" != db ] || target=server-db
+            make -C "$RUNNER_TEMP/tag-profiles" "$target" > "$RUNNER_TEMP/tag-$profile-build.log" 2>&1 \
+              || { tail -n 50 "$RUNNER_TEMP/tag-$profile-build.log"; echo "::error::the tag $profile build failed"; exit 1; }
+            printf -v "TAG_BIN_${profile^^}" '%s' "$RUNNER_TEMP/tag-profiles/build/$target/eigenscript"
+            export "TAG_BIN_${profile^^}"
+          done
+          export CC_GUARD_LOG="$RUNNER_TEMP/cc-guard.log"
+          : > "$CC_GUARD_LOG"
+          for profile in server zlib db; do
+            target="$profile"
+            [ "$profile" != db ] || target=server-db
+            PATH="$PWD/tools/cc-guard-bin:$PATH" make "$target"
+            printf -v "BRANCH_BIN_${profile^^}" '%s' "$PWD/build/$target/eigenscript"
+            export "BRANCH_BIN_${profile^^}"
+          done
+          # Restore the release alias before the MAP and library checks.
+          PATH="$PWD/tools/cc-guard-bin:$PATH" make build
+          bash tools/cc_guard.sh --report
+          bash tools/phase2_ci.sh "$anchor" "$RUNNER_TEMP/main/src/eigenscript" src/eigenscript

Makefile

@@ -36,7 +36,7 @@ LDFLAGS := -pie -Wl,-z,relro,-z,now -lm -lpthread
 endif
 
 SRC_DIR := src
-SOURCES := $(SRC_DIR)/eigenscript.c $(SRC_DIR)/lexer.c $(SRC_DIR)/parser.c $(SRC_DIR)/builtins.c $(SRC_DIR)/builtins_buf.c $(SRC_DIR)/builtins_host.c $(SRC_DIR)/builtins_tensor.c $(SRC_DIR)/fsutil.c $(SRC_DIR)/hash.c $(SRC_DIR)/alloc.c $(SRC_DIR)/state.c $(SRC_DIR)/strbuf.c $(SRC_DIR)/ext_store.c $(SRC_DIR)/fmt.c $(SRC_DIR)/lint.c $(SRC_DIR)/lint_host.c $(SRC_DIR)/chunk.c $(SRC_DIR)/compiler.c $(SRC_DIR)/vm.c $(SRC_DIR)/task.c $(SRC_DIR)/jit.c $(SRC_DIR)/trace.c $(SRC_DIR)/eigs_embed.c $(SRC_DIR)/repl.c $(SRC_DIR)/step.c $(SRC_DIR)/tape_read.c $(SRC_DIR)/bundle.c $(SRC_DIR)/main.c
+SOURCES := $(SRC_DIR)/eigenscript.c $(SRC_DIR)/lexer.c $(SRC_DIR)/parser.c $(SRC_DIR)/builtins.c $(SRC_DIR)/builtins_int.c $(SRC_DIR)/builtins_buf.c $(SRC_DIR)/builtins_host.c $(SRC_DIR)/builtins_tensor.c $(SRC_DIR)/fsutil.c $(SRC_DIR)/hash.c $(SRC_DIR)/alloc.c $(SRC_DIR)/state.c $(SRC_DIR)/strbuf.c $(SRC_DIR)/ext_store.c $(SRC_DIR)/fmt.c $(SRC_DIR)/lint.c $(SRC_DIR)/lint_host.c $(SRC_DIR)/chunk.c $(SRC_DIR)/compiler.c $(SRC_DIR)/vm.c $(SRC_DIR)/task.c $(SRC_DIR)/jit.c $(SRC_DIR)/trace.c $(SRC_DIR)/eigs_embed.c $(SRC_DIR)/repl.c $(SRC_DIR)/step.c $(SRC_DIR)/tape_read.c $(SRC_DIR)/bundle.c $(SRC_DIR)/main.c
 HOSTED_SOURCES := $(SOURCES) $(SRC_DIR)/ext_gfx.c
 MODEL_SRC := $(SRC_DIR)/model_io.c $(SRC_DIR)/model_infer.c $(SRC_DIR)/model_train.c
 BINARY  := $(SRC_DIR)/eigenscript
@@ -90,7 +90,7 @@ define AUX_REFRESH
 	done
 endef
 
-.PHONY: db-params-test all build server server-db full http net gfx zlib lib amalgamation tsan test test-changed precheck sandbox-intern-test install install-gfx clean coverage coverage-clean fuzz fuzz-run lsp lsp-asan dap jit-smoke embed-smoke embed-smoke-asan embed-smoke-asan-server embed-smoke-gfx embed-concurrent asan asan-server valgrind pgo poison freestanding-check freestanding-libc-diff asan-http asan-gfx tsan-server tsan-http nativefn-test arming-mt-test embed-roads print-% sigpipe-contract-test sigpipe-partial-test ui-sdl-input-gfx pool-off asan-pool-off pool-off-num pool-off-callenv jit-checked
+.PHONY: db-params-test all build server server-db full http net gfx zlib lib amalgamation tsan test test-changed precheck sandbox-intern-test install install-gfx clean coverage coverage-clean fuzz fuzz-run lsp lsp-asan dap jit-smoke embed-smoke embed-smoke-asan embed-smoke-asan-server embed-smoke-gfx embed-concurrent asan asan-server valgrind pgo poison freestanding-check freestanding-libc-diff asan-http asan-gfx tsan-server tsan-http nativefn-test arming-mt-test embed-roads print-% sigpipe-contract-test sigpipe-partial-test ui-sdl-input-gfx pool-off asan-pool-off pool-off-num pool-off-callenv jit-checked smi-trap
 
 # ---- Per-variant objdir engine (#740) -------------------------------------
 # The engine's rules are defined before `all`, so pin the default goal.
@@ -196,7 +196,15 @@ SRC_V_jit-checked := $(HOSTED_SOURCES)
 FLAGS_jit-checked := $(CFLAGS) $(DEFS_OFF) -DEIGENSCRIPT_EXT_GFX=1 -DEIGS_JIT_CHECKED $(VERDEF)
 LIBS_jit-checked  := $(LDFLAGS) -ldl
 
-VARIANTS := release server server-db zlib asan asan-server tsan tsan-server valgrind poison pool-off asan-pool-off pool-off-num pool-off-callenv jit-checked
+# #1758: compatibility target for the pre-R1.3 int-source gate. R1.3 retires
+# EIGS_SMI_TRAP now that integer literals are producers; slot_as_ptr still
+# checks tags through EIGS_SLOT_CHECKED. Historical R1.1/R1.2 calibrations
+# build their pinned pre-flip source rather than treating this as a trap.
+SRC_V_smi-trap := $(HOSTED_SOURCES)
+FLAGS_smi-trap := $(CFLAGS) $(DEFS_OFF) -DEIGENSCRIPT_EXT_GFX=1 -DEIGS_SMI_TRAP -DEIGS_SLOT_CHECKED $(VERDEF)
+LIBS_smi-trap  := $(LDFLAGS) -ldl
+
+VARIANTS := release server server-db zlib asan asan-server tsan tsan-server valgrind poison pool-off asan-pool-off pool-off-num pool-off-callenv jit-checked smi-trap
 
 # Objects depend on Makefile+VERSION so a flag or version-string change
 # rebuilds; header edits are covered by the generated .d files.
@@ -244,6 +252,51 @@ build/$(SLOT_TEST_VARIANT)/test_container_slots: tests/test_container_slots.c $(
 container-slot-test: build/$(SLOT_TEST_VARIANT)/test_container_slots
 	@echo "Container slot API test built: $<"
 
+# #1758 R1.1: the C slot test (docs/design/phase2-numbers.md 2.5). It includes
+# the single-file amalgamation so the static slot classifiers are reachable;
+# tests/phase2/slot_layer.sh runs it and compares the entries it examined with
+# the population tools/phase2_inventory.py derives. The release flavour turns
+# on slot_as_ptr's refusal with -DEIGS_SLOT_CHECKED; ASan turns it on itself.
+# Both carry -Wall -Wextra, and the runner fails on any warning: release
+# compiles the amalgamation at -O0 and ASan at -O1, the two levels #1775
+# found warnings at (and -O0 is about 41 s against -O2's 162 s).
+PHASE2_SLOT_VARIANT ?= release
+PHASE2_SLOT_FLAGS_release := -Wall -Wextra $(WERROR_FLAGS) -O0 -g -DEIGS_SLOT_CHECKED
+PHASE2_SLOT_FLAGS_asan := -Wall -Wextra $(ASAN_FLAGS)
+build/phase2/eigenscript_all.c: $(filter-out $(CLI_ONLY),$(SOURCES)) $(wildcard $(SRC_DIR)/*.h) tools/amalgamate.sh Makefile
+	bash tools/amalgamate.sh build/phase2
+build/phase2/slot_layer_%: tests/phase2/slot_layer.c build/phase2/eigenscript_all.c tools/werror_flags.txt
+	$(CC) $(PHASE2_SLOT_FLAGS_$*) -Ibuild/phase2 -o $@ $< -lm -lpthread
+.PHONY: phase2-slot-test
+phase2-slot-test: build/phase2/slot_layer_$(PHASE2_SLOT_VARIANT)
+	@echo "phase2 slot test built: $<"
+
+# #1758 R1.6a: final reader C fixture, through the no-SDL amalgamation.
+PHASE2_READERS_VARIANT ?= release
+PHASE2_READERS_FIXTURE ?= readers
+build/phase2/readers_%: tests/phase2/readers.c build/phase2/eigenscript_all.c tools/werror_flags.txt
+	$(CC) $(PHASE2_SLOT_FLAGS_$*) -Ibuild/phase2 -o $@ $< -lm -lpthread
+# R1.6d-D1: raw stored payloads through the actual graphics/audio readers.
+build/phase2/gfx_audio_boundary_%: tests/phase2/gfx_audio_boundary.c src/ext_gfx.c build/phase2/eigenscript_all.c tools/werror_flags.txt
+	$(CC) $(PHASE2_SLOT_FLAGS_$*) -Ibuild/phase2 -o $@ $< -lm -lpthread -ldl
+build/phase2/gfx_byte_boundary_%: tests/phase2/gfx_byte_boundary.c src/ext_gfx.c build/phase2/eigenscript_all.c tools/werror_flags.txt
+	$(CC) $(PHASE2_SLOT_FLAGS_$*) -Ibuild/phase2 -o $@ $< -lm -lpthread -ldl
+# R1.6z-D1 public getter bit-round-trip gate; compile outside timed MAP rows.
+build/phase2/embed_buffer_get_raw_%: tests/phase2/embed_buffer_get_raw.c build/phase2/eigenscript_all.c tools/werror_flags.txt
+	$(CC) $(PHASE2_SLOT_FLAGS_$*) -Ibuild/phase2 -o $@ $< -lm -lpthread
+# Q7 lands in R1.6e; an absent source is a build failure once selected.
+build/phase2/q7_readers_%: tests/phase2/q7_readers.c build/phase2/eigenscript_all.c tools/werror_flags.txt
+	$(CC) $(PHASE2_SLOT_FLAGS_$*) -Ibuild/phase2 -o $@ $< -lm -lpthread
+# N6: actual shared writer plus Python repr/bit/truncation oracle cases.
+build/phase2/num_text_%: tests/phase2/num_text.c build/phase2/eigenscript_all.c tools/werror_flags.txt
+	$(CC) $(PHASE2_SLOT_FLAGS_$*) -Ibuild/phase2 -o $@ $< -lm -lpthread
+# R1.7-D4: signed-zero constant keys are compared by bits.
+build/phase2/const_dedup_bits_%: tests/phase2/const_dedup_bits.c build/phase2/eigenscript_all.c tools/werror_flags.txt
+	$(CC) $(PHASE2_SLOT_FLAGS_$*) -Ibuild/phase2 -o $@ $< -lm -lpthread
+.PHONY: phase2-readers-test
+phase2-readers-test: build/phase2/$(PHASE2_READERS_FIXTURE)_$(PHASE2_READERS_VARIANT)
+	@echo "phase2 reader test built: $<"
+
 # Focused lifetime regression for sandbox descriptor interns (#964). Link the
 # public embedding/runtime surface without CLI-only translation units so the
 # C test can inspect the internal thread-local intern accounting directly.
@@ -469,13 +522,16 @@ observer-anchor:
 # observer-anchor builds, or reuses, in the user cache. FLOOR=<file>, on the command
 # line or in the environment, names another floor; an empty FLOOR skips the floor
 # and the anchor. EXPECT=ieee,int64 fails when an expected capability is absent
-# (#1758). CI calls score.py directly, through tools/observer_oracle/ci_lane.sh
-# (the required check `observer oracle (floor)`).
+# (#1758). Both pass --declared tests/phase2/oracle_expect.txt: Phase 2's known-
+# wrong capability verdicts, each with its recover round (#1830); an undeclared
+# wrong verdict or a stale declaration fails, and #1776 merges only when the file
+# is empty (tools/phase2_cost.sh --final). CI calls score.py directly, through
+# tools/observer_oracle/ci_lane.sh (the required check `observer oracle (floor)`).
 .PHONY: observer-oracle
 observer-oracle: FLOOR ?= tools/observer_oracle/floor.json
 observer-oracle: build
 	$(if $(FLOOR),$(OBSERVER_ANCHOR))
-	python3 tools/observer_oracle/score.py src/eigenscript $(if $(FLOOR),--floor $(FLOOR)) $(if $(EXPECT),--expect $(EXPECT))
+	python3 tools/observer_oracle/score.py src/eigenscript $(if $(FLOOR),--floor $(FLOOR)) $(if $(EXPECT),--expect $(EXPECT)) --declared tests/phase2/oracle_expect.txt
 
 install-gfx: install
 	@echo "NOTE: 'make install-gfx' is a compatibility alias for 'make install'."
@@ -503,7 +559,7 @@ $(SRC_DIR)/lsp_stdlib_index.h: $(wildcard lib/*.eigs) tools/gen_lsp_stdlib_index
 # Builtin half of the same idea (#742): names from the registration seams +
 # ext_names.h, hover detail from the signature comments. Reserved report
 # forms are excluded using lexer.c. Commit the generated header for review.
-$(SRC_DIR)/lsp_builtin_index.h: $(SRC_DIR)/builtins.c $(SRC_DIR)/builtins_host.c \
+$(SRC_DIR)/lsp_builtin_index.h: $(SRC_DIR)/builtins.c $(SRC_DIR)/builtins_int.c $(SRC_DIR)/builtins_host.c \
 		$(SRC_DIR)/hash.c $(SRC_DIR)/ext_store.c $(SRC_DIR)/ext_names.h \
 		$(SRC_DIR)/lexer.c tools/gen_lsp_builtin_index.sh
 	bash tools/gen_lsp_builtin_index.sh
@@ -716,6 +772,12 @@ jit-checked: build/jit-checked/eigenscript
 	$(call RELINK,jit-checked)
 	@echo "EigenScript $(VERSION) (jit-checked: emitted slot witnesses) built. Binary: $(BINARY)"
 
+# #1758 R1.1 (see FLAGS_smi-trap): build it in a scratch tree, then
+#   tools/phase2_check.sh --through R1.1 --smi-trap <tree>/src/eigenscript ...
+smi-trap: build/smi-trap/eigenscript
+	$(call RELINK,smi-trap)
+	@echo "EigenScript $(VERSION) (smi-trap compatibility: checked slots; source trap retired in R1.3) built. Binary: $(BINARY)"
+
 
 # Profile-guided optimization. Builds an instrumented binary, runs the
 # DMG cpu_instrs workload to collect branch/edge counters, then rebuilds
@@ -845,6 +907,10 @@ build/$(HISTORY_BOUNDARY_VARIANT)/test_trace_history_boundary: tests/test_trace_
 trace-history-boundary-test: build/$(HISTORY_BOUNDARY_VARIANT)/test_trace_history_boundary
 	@echo "Trace history boundary test built: $<"
 
+# R1.6d-D1: actual net_send client with raw stored bytes and a real socketpair.
+build/phase2/net_byte_boundary_%: tests/phase2/net_byte_boundary.c src/ext_net.c build/phase2/eigenscript_all.c tools/werror_flags.txt
+	$(CC) $(PHASE2_SLOT_FLAGS_$*) -Ibuild/phase2 -o $@ $< -lm -lpthread
+
 # Witnesses for tools/make_lock_check.sh (#1940). With AFTER set, the recipe
 # refuses to run unless that file exists, so a second make proves it started
 # only after the first make's recipe wrote its DONE file. SESSION records the