Issue #468: Build ADR-321: compile and run build-time code against the dependencies, with a step budget

Open and answer this issue on GitHub.

language, compiler, ready · opened 2026-10-05 · updated 2026-10-08 · 13 comments

How it came up

While deciding #115 and #467, three things were found in build_time.rs, the interpreter that runs a comptime’s calls:

• It ignores the program’s integer types. With fn sq(x: i32) -> i32 { return x * x }, comptime C = sq(100000) lowered to const C: i64 = 10000000000, while let n = sq(100000) stops the program (attempt to multiply with overflow).
• It cannot run a std function written in Rust. This is why ADR-318 D6 had to move seconds() into std’s Nikaia half, which NK1209 (no impl i64) blocks (#374).
• It is slow and unbounded. In the debug build, fib(25) took about 7 s and fib(50) hung the build without a word (ADR-287 D16: no step budget).

ADR-177 had already refused an interpreter for grammars, because an interpreter is a second implementation of the language. The same argument applies to ordinary code.

The decision round, briefly

1. Interpreted or compiled? The owner asked what to expect: compiling should have a fixed cost and win on large tasks. The levers: opt-level=0, rustc directly, one crate per package, a result cache, running beside the rest of the build, and folding only literal expressions.
2. Measured, compiled path only (callgrind, instructions; the owner asked not to measure the interpreter):
   • fib(10), static: 133 M (rustc 44 M, lld 86 M). With bfd instead of lld: 436 M. opt-level=1: 148 M.
   • Cargo alone: 206 M.
   • Linking nikaia-std statically, with the generated project’s own profile (found with cargo build -v; the first attempt used a mismatched rlib): 1 052 M, of which the linker is 948 M. With -C strip=debuginfo: 338 M.
3. The owner asked why linking is so expensive. Static linking merges the dependencies and their debug information into every binary. The owner proposed linking into the compiler’s own process. That was rejected: the compiler holds only the part of std it calls, its symbols are not exported, it is built with its own profile, and a std shipped as a dylib would be fragile across platforms and options.
4. Dynamic linking, measured: 132 M to build (rustc 83 M, lld 47 M) and 36 M to start and run (the loader binding a 29 MB library).
5. The owner asked about project dependencies and remembered that Cargo rebuilds everything for a dylib. Checked: that is true when the difference goes through RUSTFLAGS or a profile. It is not true when only a generated bundle crate gets --crate-type dylib and -- -C prefer-dynamic. In that case cargo rustc -p bundle … reported 46 × Fresh and compiled only the bundle. A comptime program reached nikaia_std through bundle::nikaia_std and gave the right result, at the same cost (132 M + 36 M).

The decision in short

ADR-321 (0.0.513, 1bc83e5). Changed with it: ADR-287 D16 and D18, ADR-318 D6. Specification: Part II 10.2, Part III 13.2b, NK1127, NK1152.

• D1: a comptime that calls a function is compiled and run, never interpreted. Literal-only expressions stay folded by the checker.
• D2: what may run is still the ledger rule (sync, touches ⊆ build parameters), now including std’s Rust half and the dependencies.
• D3: Cargo builds the dependencies, and a generated bundle crate is built as a dylib from the same rlibs. When cross-compiling, there is also a host build.
• D4: one crate per package, rustc direct, results cached by code, toolchain and parameters.
• D5: the run goes beside the rest of the build.
• D6: results come back as data and cross per ADR-311.
• D7: a step budget counted in loop turns and calls, refused with NK1152.

Not decided (ADR-321 §6): the budget’s default and how a program raises it; memory; Windows; whether a grammar run joins the same crate.

To build

1. The bundle crate. Generate <package>-build beside the package in the generated workspace, depending on every dependency a comptime may reach (nikaia-std always). Build it with cargo rustc -p <bundle> --lib --crate-type dylib -- -C prefer-dynamic, in the same target directory and profile as the program.
   • Test: after cargo build of the program, the bundle build reports every dependency Fresh.
2. The comptime crate. Lower every comptime of the package whose initialiser calls a function into one crate: the initialisers, everything they call, and a main that writes each value in ADR-177 D4’s encoding. Compile it with rustc directly: --edition=2024 -C opt-level=0 -C overflow-checks=on -C debug-assertions=off -C prefer-dynamic --extern bundle=… -L dependency=…, with paths through bundle::. Run it with the bundle’s and the toolchain’s library directories on the loader path.
   • Tests: comptime FIB_10: i64 = fib(10) gives 55; comptime D = 5.seconds() runs from std’s Rust half.
3. Same semantics. comptime C = sq(100000) with an i32 sq stops the build at the multiplication, with the program’s message mapped to the .nika line (ADR-300). Test.
4. Ledger rule, unchanged. A callee that is not sync, or that touches anything but the build’s parameters, or that no ledger describes, is NK1152 before anything is compiled.
   • Tests: println in a callee; an undescribed Rust dependency function.
5. Step budget. The lowering counts each loop turn and each call in the comptime crate; past the budget the run stops and the build gives NK1152, naming the comptime and the call path. The call depth stays bounded.
   • Test: fib(50) is refused rather than hanging; fib(20) passes.
   • The default number and how a program raises it are open (ADR-321 §6): use a provisional constant, mark it in code, and prepare the question for the owner.
6. Result cache. Key: each initialiser and its transitive callees’ text, the toolchain, and the build parameters (ADR-287 D15).
   • Test: a second build with no change neither compiles nor runs the comptime crate. Changing a callee re-runs it.
7. Parallelism. Start the comptime build as soon as the ledger has decided what may run. Only NK1116’s fit check (ADR-287 D21, #467) and the writing of the values wait for it.
8. Cross-compiling. When --target is not the host, build the dependencies the bundle reaches for the host as well.
   • Test: --target wasm32-unknown with a comptime that calls std.
9. Remove the call-evaluating part of build_time.rs and its tests. Keep the checker’s fold for literal expressions (ADR-285 D22).
10. Follow-ups:
    • #374’s steps 5–8 no longer need seconds() rewritten in Nikaia (ADR-318 D6 changed).
    • #467’s step 5 (typed arithmetic at build time) is this issue’s step 3.

Comments

keywan-ghadami, 2026-10-05

Added: ADR-321 D8 and D9 — which dependency code may run at build time (0.0.515, 5c616a8)

How it came up

After ADR-321 the owner asked whether foreign code could slip harmful code through its ledger. Checked:

• Nikaia dependencies. A consumer believes a dependency’s shipped nikaia.contracts while its sources hash as recorded (ADR-100 D1, D3). That protects against a stale ledger, not a false one: a package can ship honest hashes next to touches = [] on a function that writes files. A published package without sources is believed outright. --locked re-derives only path dependencies.
• Before ADR-321 this did not matter at build time, because the interpreter could not run dependency functions at all. With native build-time code it does.
• Rust crates. The description is the consumer’s own and is reviewed (ADR-290 D5, NK2505 on moved sources). But touches cannot be derived from Rust: it is a person’s judgement.
• Cargo already runs build.rs and proc-macros of Rust dependencies natively, regardless of anything Nikaia does.

Decision

• D8. Before a Nikaia dependency’s function runs at build time, this build derives that package’s ledger from its sources. The derivation is keyed by the source hashes and done once per version, and D2’s rule reads the derived entries. If they disagree with the shipped ledger, the build is refused with NK1152, naming the package and both answers. A package without sources runs nothing at build time.
• D9. A Rust crate’s function runs at build time only where its description says build_time = true. The column is hand-written, absent means no, and nikaia describe never writes it. std’s Rust half is exempt.
• Not decided (§6): Rust dependencies’ build.rs and proc-macros.

Specification: Part II 10.2, Part III 13.5 (new build_time column), NK1152.

To build (additional steps, after step 4)

4a. Derived ledger for build-time calls. For every Nikaia dependency whose functions the comptime crate reaches, derive its ledger from its sources (the same inference as --locked), cached by the hashes in its nikaia.derived. Check D2’s rule against the derived entries.

• Test: a path dependency whose committed ledger says touches = [] for a function that calls println is refused with NK1152, naming the package, the function and both entries.
• Test: an honest dependency passes, and its derivation is not repeated on the next build.

4b. No sources, no build-time run. Test: a dependency with a ledger and no sources, called from a comptime, gives NK1152.

4c. build_time column. Read it from contracts/<crate>.contracts. The describer never writes it; check nikaia describe output in a test.

• Test: a described Rust function with sync = true, touches = [] and no build_time, called from a comptime, is refused, and the help names build_time = true. With the column it runs.
• Test: std’s Rust half (5.seconds()) runs without it.

---

Generated by Claude Code

keywan-ghadami, 2026-10-05

Correction: ADR-321 D9 — no Rust code but std’s runs at build time (3a23bb2)

The build_time = true column from the previous comment was the session’s own choice and was not discussed with the owner. The owner rejected the principle behind it: the compiler can vouch only for Nikaia code, whose sync/touches it derives. A Rust crate’s description is a judgement, and a second claim beside it is the same judgement written again. The column is gone.

Now (D9): a Rust crate’s function never runs at build time, described or not. Neither does a Nikaia function whose calls reach one. Both are refused with NK1152, naming the Rust function and the path to it. std’s Rust half is the exception: it is this project’s own code. D2 and D3 are narrowed to match: the bundle names std and the Nikaia dependencies.

Step 4c is replaced:

4c. No foreign Rust at build time.

• A comptime calling a described Rust-crate function (sync = true, touches = []) is refused with NK1152, naming the function.
• A comptime calling a Nikaia function that calls it is refused too, naming the path.
• 5.seconds() from std runs.

Steps 4a and 4b (derived ledger for Nikaia dependencies; no sources, no build-time run) stand.

---

Generated by Claude Code

keywan-ghadami, 2026-10-05

Build plan (the building session)

Checked before starting

• Where the run fits in the pipeline. nikaia build lowers every member in the driver, before cargo build. The rustc wrapper lowers each member a second time inside Cargo, and that second lowering hits the build cache. So:
  • the comptime run belongs in the driver’s lowering;
  • the result cache (step 6) is needed from the start, so that a wrapper relowering inside Cargo never starts a nested Cargo, which would wait on the target-dir lock.
• Where to build. Every lowering already has a workshop (Reads::building_in, beside the build cache, with its own target directory), which the grammar runs use. The bundle and the comptime crates go there. That is a separate target directory from the program’s, so the second lowering inside Cargo can never collide with Cargo’s lock. The cost is that std is built once more per machine for build time, not once per program.
• The mechanism, tried by hand.
  • cargo rustc --lib --crate-type dylib -- -C prefer-dynamic on a bundle pub extern crate nikaia_std; builds libnikaia_bundle.so (34 s cold, debug).
  • A main compiled with rustc --edition=2024 -C prefer-dynamic --extern nikaia_bundle=….so --extern nikaia_std=<the rlib in deps> -L dependency=… is 17 KB and links nikaia_std from the dylib. The second --extern is what lets nikaia_std::… paths resolve in submodules; a use bundle::nikaia_std reaches only the crate root.
  • It runs with the bundle’s directory and rustc --print target-libdir on LD_LIBRARY_PATH.
  • 5.seconds() gives 5. An i32 x * x with x = 100000 panics with attempt to multiply with overflow.

Stages, one package each

1. Compiled path, std only.
   • The bundle (nikaia-std only).
   • One comptime crate per comptime for now: the program lowered without main, plus fn __nikaia_comptime_value() -> T { return <initialiser> }, plus a main that dumps it with grammar_run’s dumper.
   • Compiled with rustc directly.
   • The result cache keyed by the crate’s text, rustc -vV and the bundle.
   • Earlier comptimes are cache hits when the sub-program is checked.
   • Used where the build has a workshop and the initialiser calls something.
   • The interpreter stays, until stage 4, for a bare check with no workshop and for initialisers that read an asset or run a grammar.
   • Tests: fib(10), sq(100000) stops the build, 5.seconds() inside a callee.
2. Step budget and call depth (D7, step 5) in the lowering of the comptime crate; fib(50) is refused.
3. One crate per package (D4), parallel to the rest of the lowering (D5, step 7).
4. The interpreter’s call path goes (step 9). The tests move to a workshop.
5. Nikaia dependencies in the bundle with derived ledgers (D8, 4a/4b); no foreign Rust (D9, 4c); cross-compiling (step 8).

Question for the deciding session

Which code reports a build-time run that stops as the program would, for example on an overflow (step 3)?

• NK1152 is not allowed, and its text now also carries the budget and the depth.
• NK1127 is cannot be computed.
• Neither says it ran and stopped: comptime C = sq(100000) has run and aborted at the multiplication.

Until this is answered, stage 1 reports it as NK1152. The message names the comptime, the runtime’s message (attempt to multiply with overflow) and the .nika line, where the runtime reports one. The code stays easy to change.

---

Generated by Claude Code

keywan-ghadami, 2026-10-05

Added: bounds for a build-time run (ADR-321 D7, D10–D12; f88f917, 72582eb)

How it came up

The owner wanted a way to say how long build-time code may run. The point is not protection against malicious code but protecting the programmer from themselves: one wrong line and the machine hangs. The discussion found two ways a machine hangs. An endless loop is one, and the step budget covers it. Memory filling up and the system swapping is the other, and a step budget stops it too late. The owner then asked how to measure both:

• Steps: a counter in the generated code, decremented at every loop back-edge and every function entry, plus a stack of function numbers for the message. A call into std’s Rust half counts as one step.
• Memory: the generated crate gets its own #[global_allocator] that counts live bytes. It is deterministic per architecture, works on every platform, and covers std too. OS limits (setrlimit) were rejected because macOS does not enforce them and Windows has no equivalent in that form.

Owner’s answers

1. A comptime raises a bound at its own declaration, not in the manifest and not on the command line.
2. No measurement first. Generous defaults: 4 GiB, and a step budget sized for about 20 s. Taking 10⁸–10⁹ counted steps a second, that is 10 000 000 000 steps. This is an estimate.
3. A memory bound: yes.
4. A progress message for a long run: yes.

Not decided: the spelling a comptime uses to raise a bound (ADR-321 §6). It is being asked now.

To build: step 5 replaced, 5a–5c added

1. Step budget. Lower a counter into the comptime crate: decrement at each loop back-edge and function entry, and abort past the budget, which is 10¹⁰ by default. Keep a stack of function numbers for the message. NK1152 names the comptime, the bound and the call path.
   • Test: fib(60) is refused with the path fib → fib → …; fib(25) passes.
   • Measure the counter’s overhead with callgrind on a tight loop, with and without the counter (instructions), and record it in the issue. 5a. Memory bound. A counting #[global_allocator] in the comptime crate: live bytes, abort past 4 GiB by default with NK1152.
   • Test: let mut xs = []; while true { xs.push(1) } is refused by the memory bound, not the step budget.
   • Test: "x".repeat(5_000_000_000) from std is refused. 5b. Raising a bound at the declaration. Wait for the spelling decision. Until then the defaults are fixed. 5c. Progress message. When a run passes a few seconds, the compiler prints `TABLE` in config.nika is running (5 s), at most every few seconds. Test with a fake slow run: the message appears and the build output is unchanged.

---

Generated by Claude Code

keywan-ghadami, 2026-10-05

Stages 1 and 2 are built

0.0.518 (4334347), stage 1: a comptime that calls a function is compiled and run

How it works:

• comptime_run.rs builds a sub-program: the file without its main, the earlier comptimes as the literals they came to, and fn __nikaia_comptime_value() -> T { return <initialiser> }. Its main writes the value in the grammar run’s encoding.
• It is linked against a dylib bundle of std, built once in the workshop. The bundle is built with cargo rustc --crate-type dylib -- -C prefer-dynamic, and the program is compiled with rustc directly.
• The answer is cached by the program text, rustc -vV and the bundle (D4). A stop is cached too.
• The ledger rule (D2) is asked for each callee before anything is compiled.
• The stop is reported with its own site table: generated line → byte of the span. The checker turns the byte back into a place in the checked file.

What it does now:

• comptime C = sq(100000) with an i32 sq is NK1152, C stopped while the program was built: attempt to multiply with overflow., with the caret on return x * x (step 3).
• text::digit_value('7') inside a callee gives 7. The interpreter refused it with NK1127.

Limits of this stage, where the interpreter still answers:

• a program of more than one file, or one with a grammar;
• an initialiser with a method call or an asset;
• a bare check with no workshop.

0.0.519 (3651a17), stage 2: the bounds

• D7, steps. Build::counts_steps makes the emitter write nikaia_std::build_time::enter("f") into every function’s opening brace and step() into every loop body.
  • Past the budget: NK1152, F took more than … steps, with the path (It was in SPUN > spin.).
  • Past 10 000 calls deep: went more than 10000 calls deep.
  • A loop that never ends and fib(50) are refused; fib(20) passes.
• D10, memory. A #[global_allocator] in the run’s own program is not used when std is linked dynamically: a counter in it stayed at 0. So the counting allocator lives in the generated bundle, and the run’s main sets the bound. Past 4 GiB: held more than … bytes at once.
• D12, progress. After 5 s, and then every 10 s, the build prints note: X is still being computed while the program is built (N s).
• A run that dies without a word (killed for its memory) now says how it ended, instead of an empty message.
• D11, raising a bound. The spelling is still open. The bounds travel with the workshop (Reads::bounded), so the tests ask for smaller ones.

Tests: tests/comptime_compiled.rs (9). The bench and example lowerings are unchanged.

Measured for the deciding session (D7’s default)

Callgrind, instructions, on a loop that only counts:

opt-level	instructions per counted step
0 (step 2’s setting)	37
1	13

The slope was taken over 10 million steps, with step() as one relaxed fetch_sub on a static. That puts the default of 10¹⁰ steps at about 3.7·10¹¹ instructions at opt-level=0. That is minutes, not D7’s estimate of about twenty seconds. opt-level=1 would be about 1.3·10¹¹. The ADR measured opt-level=1 at 148 M instructions to compile, against 133 M.

Question: is the default meant to be reached in about twenty seconds? If so:

• the budget would be 10⁹ at opt-level=0, or
• the comptime crate would be compiled at opt-level=1.

Next

Stage 3: one crate per package (D4), beside the rest of the lowering (D5).

---

Generated by Claude Code

keywan-ghadami, 2026-10-05

The compiled path covers more (0.0.520–0.0.524)

Each package passes the build_time, comptime, grammar, project and examples tests, the bench and example lowerings are byte-identical, and clippy is clean.

• 0.0.520 (c63200a): any initialiser with a call is compiled. This now includes method calls, from std or from the program: "abc".to_uppercase() gives "ABC", and the interpreter had refused it. D2 is now read off the ledger entry derived for the sub-program’s value function. That covers every call it reaches, methods included.
• 0.0.521 (4eb9c8b): programs of several files.
  • Every file of the package goes into the sub-program, lowered the way modules lowers a package.
  • The site table now records the file as well as the byte.
  • A stop in another file is named by the function it happened in: It stopped in sq, in another file of the program.
• 0.0.522 (09fbb09): asset("…") together with a call (twice(asset("data.txt"))).
  • The build reads the file under ADR-310’s rules, and the read text replaces the asset before lowering.
  • NK1175 and NK1176 are reported before anything is compiled.
• 0.0.523 (ce50fb7): earlier comptimes of any shape are carried in. Lists, tuples, structs and variants are written as literals (ORIGIN.scaled(10).sum()).
• 0.0.524 (8ab948f): programs with a grammar.
  • The bundle now also names winnow and winnow_grammar, so such a program compiles its ordinary comptimes.
  • An initialiser that runs a grammar entry (Cfg::file(…)) still goes through the grammar run (ADR-177 / §6).

Where the interpreter still answers (stage 4 is to remove it)

1. A check with no workshop. This is the library API the unit tests use. Every CLI build has a workshop. The plan: move the tests (build_time.rs and the others) onto a shared workshop, then report NK1127 where there is no workshop.
2. Option defaults (ADR-318). contracts::evaluate_defaults evaluates them during ledger inference, with Reads::none(). Compiling them means handing the workshop down to the inference, a pipeline change of its own.
3. Grammar entries in an initialiser. These go through the grammar run, which compiles rather than interprets. Its dispatch lives in build_time.rs and stays there.
4. An initialiser whose type has no written form here (Ty::Unknown).

Then stage 3 (one crate per package, run beside the lowering) and stage 5 (D8/D9 dependencies, cross-compiling).

---

Generated by Claude Code

keywan-ghadami, 2026-10-05

0.0.525 (4df38b9): build_time’s tests run on the compiled path

The 47 tests in tests/build_time.rs now run through a workshop, as a build does, so they exercise the compiled path. 43 passed unchanged.

The D2 refusal now names the callee as the call resolves: io::read_to_string by its path, Reader::read by its key.

Three tests now expect ADR-321’s answers instead of the interpreter’s:

Case	Before (interpreter)	Now (compiled)
forever(n + 1)	too deeply (depth 128)	went more than 10000 calls deep
comptime N = io::read_to_string()	NK1127	NK1152, You can’t call io::read_to_string… (std’s Rust half is under D2 now)
xs[7] on an Array[i64, 3] in a callee	NK1165, help The indexes go from 0 to 2.	NK1152, BAD stopped while the program was built: index out of bounds: the len is 3 but the index is 7., with the caret on return xs[7]

One more question for the deciding session, beside the stop code asked above. Part III’s table still describes NK1165 as an index into an Array at build time.

• With compiled build-time code, such an index is the program’s own abort, with Rust’s runtime message.
• Should NK1165 be retired, along with whatever code a stopped run gets?
• Or should the compiled run translate the abort back into NK1165’s sentence?

Today the program’s runtime message is the same one the program gives when it runs. So the build-time and run-time words now agree, which is D1’s point.

---

Generated by Claude Code

keywan-ghadami, 2026-10-05

Step 5b decided: the spelling (ADR-321 D11, a6525af)

comptime(steps: 50G, ram: 16Gi) TABLE = build_table(asset("data.csv"))

How it was decided

The decision round weighed these forms:

• (a) options in parentheses after the word, as dsl sqlite(schema: APP) does (ADR-299 D3);
• (b) options after ; at the end of the line;
• an @comptime(…) annotation. Rejected: Nikaia has no annotation system outside grammars, and building one for this case is too much;
• comptime(expr; …) as an expression. Rejected: all 60 real comptimes in the repository are package-level, and that would need a top-level let, or package constants turned into functions, which loses ADR-287 D21’s open number;
• the owner’s comptime(step=1G, ram=4G) NAME =. Adopted, with : instead of = (named arguments everywhere are name: value) and with scale literals from ADR-322 (#469’s build), including Gi for binary.

To build

5b. Bounds at the declaration.

• Parse comptime(steps: <int>, ram: <int>) NAME = … at item level and in a body. Either name may be omitted, and comptime NAME = … keeps the defaults (10G steps, 4Gi). Any other name gives NK1109.
• The values are build-time integers; with #469 they can be written 50G / 16Gi.
• Test: comptime(steps: 100) X = fib(20) is refused by the step budget, while comptime X = fib(20) passes.
• Test: comptime(steps: 60G) X = fib(45) passes where the default would refuse.

---

Generated by Claude Code

keywan-ghadami, 2026-10-05

0.0.528 and 0.0.530: the ledger’s pass stops computing comptimes; step 5b is built

0.0.528 (047df7b): the ledger’s pass computes no comptime

The ledger’s inference checks every file to learn what each call resolves to. That check used to compute every comptime and every computed default through the interpreter, and then the real check compiled and ran them again.

• check_for_the_ledger is the same walk, but it leaves build-time values alone and reports nothing about them.
• A variant built in an initialiser (Shape::Num(1.5)) is no longer treated as a call to compile.

What remains on the no-workshop path (stage 4, found by making that path panic and running the suite). Only callers of the check API that pass no workshop still reach it:

• the tests in comptime.rs, comptime_item.rs, option_defaults.rs, modules.rs and specification.rs;
• defaults inside a run’s sub-program.

The next step is to move those tests onto a shared workshop.

0.0.530 (744d8e6): comptime(steps: …, ram: …) (step 5b)

• Parsed at item level and in a body, the same way a call’s options are parsed. A bound left out keeps the default.
• The bounds go into the run’s program, so changing a bound runs it again.
• Tests in comptime_compiled.rs:
  • comptime(steps: 100) F = fib(20) is refused, both at item level and in a body.
  • comptime(steps: 1M) passes where a default of 1 000 refused.
  • comptime(ram: 64Mi) stops a list that grows without end at 67108864 bytes.
  • comptime(stpes: 5) gives NK1109 with Did you mean steps?.
• The step’s test with fib(45) and steps: 60G is not written. At opt-level=0 it takes minutes, as measured above. The 1M-against-1 000 test checks the same thing.

Question for the deciding session: what does a bound get whose value is not a whole number the build knows (comptime(steps: one()), or a negative one)?

• Neither D11 nor Part III says.
• The build gives NK1102 for now: steps takes a whole number the build knows, and this is not one. Nothing runs.
• NK1102 is described as an argument is not what the parameter takes, which is close. If it should be NK1109 or another code, that is a one-line change.

---

Generated by Claude Code

keywan-ghadami, 2026-10-05

Stage 4: the tests run through a workshop (0.0.532 e3d4d1d, 0.0.533 3e46d96)

What changed:

• tests/common now has workshop(), reads(), infer() and checked(). These test files use them: comptime.rs, comptime_item.rs, option_defaults.rs, modules.rs and specification.rs.
• specbook::verdicts and report take a workshop. The example uses the user’s build-time workshop, as a build of a loose file does. EXPECTED.txt is unchanged.
• emit_program_reading now also compiles defaults in its workshop. The workshop for defaults is kept per thread, so tests running side by side no longer share it.
• A program of several files computed every comptime a second time through the interpreter: Needs::of asked each file what it uses with a full check. Build::leaves_values now skips the values there.
• Two tests expected the interpreter’s refusal of "hallo".to_uppercase(). That is now computed, as "HALLO".

What still reaches the interpreter. Checked by making that path report itself and running every build-time test file:

• Outside a run: nothing.
• Inside a run’s sub-program: computed defaults, which its own check and ledger evaluate a second time with no workshop. A compiled run would recurse into itself, so the workshop is cleared there.

Next:

1. Hand the outer ledger’s computed defaults to the sub-program, so the run has nothing to compute again.
2. Then remove the call-evaluating part of build_time.rs (step 9).

Question for the deciding session. Once the interpreter is gone, what does a check with no workshop answer for a comptime that calls something? This is the library API, e.g. check::check. A CLI build always has a workshop.

• (a) NK1127, can’t be computed while the program is built, with a note that this check has no place to compile build-time code.
• (b) Nothing: the value is left open, as the ledger’s pass does since 0.0.528, and a later check with a workshop answers it.

(a) is more honest toward a caller that wants an answer. (b) is quieter, but a caller could then take a program as checked although its comptime was never run. Until this is answered, the interpreter stays for exactly this case.

The note on an undeclared callee is also stale and goes with the interpreter. It still reads “it comes from std or a package, which is compiled Rust … the compiler can only run code written in your program”, which ADR-321 made untrue.

---

Generated by Claude Code

keywan-ghadami, 2026-10-06

0.0.600 (cc27792): step 1 of Next, a run reads the defaults the program’s ledger computed

What was broken: a default that only std’s Rust half can compute (mark: ref String = "!".repeat(3)) was refused with NK1127 and the interpreter’s note. The run that computes it lowers every function of the program. A function beside it that calls shout("yo") and leaves mark out had no value for it, so rustc refused the run, and the interpreter answered.

What changed:

• The checker hands its ledger to a comptime’s run (comptime_run::compute(…, outer)). The run’s own inference takes each default from that ledger and no longer computes it again without a workshop.
• A left-out option whose default is not known in a run is unreachable!("a default not computed yet"). A run can only reach it through a ring, which NK1168 refuses first. If a run does stop there, its default was refused, and the run is answered as before.
• A ref String default is computed as the String it views (comptime_run::as_built), as a comptime’s value is.
• Side finding #498, fixed: a left-out String option with a text default was handed "…" (a &str) and refused by rustc.

Tests in option_defaults.rs:

• a_default_std_computes_reaches_a_comptime, with ref String and with String;
• a_text_default_for_an_owned_string_is_one.

Still open:

• Step 9: remove the call-evaluating part of build_time.rs.
• The questions above remain unanswered: the stop code, NK1165, NK1102 for a bound, and what a check without a workshop answers.

---

Generated by Claude Code

keywan-ghadami, 2026-10-07

The four questions asked in the comments above, gathered in #525 (decision):

• the stop code;
• NK1165;
• a bound that is not a whole number;
• a check without a workshop.

Step 9 waits on the last one. Stages 3 and 5 do not wait on any of them, so this issue stays ready.

---

Generated by Claude Code

keywan-ghadami, 2026-10-08

Where this stands (checked against develop, 0.0.655)

Built since the last comment:

• Dependencies at build time (D13): build_time_dependencies.rs.
• No foreign code in the build-time program (D14) and no foreign Rust at build time (D9, step 4c).
• The bundle is built once per machine, not per project (0.0.645).

Still open:

1. D4/D5, stage 3: one crate per package, run beside the build. Not built. Each comptime still compiles a sub-program of its own. Only tests/build-time has comptimes that call something (28, plus 2 in std); no example or benchmark does. So this is first-build cost for one test package for now. Warm builds hit the result cache.
2. D8’s refusal (step 4a/4b): no case reaches it today. The run already reads the entries derived from each dependency’s sources (comptime_run::by_package), never the shipped ones, so a false touches cannot slip through. There are two places a refusal could fire, and neither exists yet:
   • A path dependency’s shipped ledger cannot disagree, because every build rewrites it (and --locked refuses a mismatch).
   • A package without sources cannot be depended on until #99. Both tests belong to #99’s build.
3. Step 8 (cross-compiling). The bundle and the run are built for the host whatever --target says, which is what step 8 asks. There is no test: wasm32-unknown is refused before anything is built (std needs mmap and threads there), and this machine has no other Rust target installed.
4. Step 9 waits on #525’s question 4.

---

Generated by Claude Code

Back to Open Issues