From db89626d1be6f0c700d11134cac07e57d09315ba Mon Sep 17 00:00:00 2001 From: Moon Flower Date: Wed, 14 Oct 2026 09:02:46 +0330 Subject: docs: record the two ownership gaps that block the bootstrap MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `make genome` cannot complete: the second bootstrap stage runs the lifetime checker over the compiler's own source, which reports 8 errors, and mkgenome then reads the diagnostics as an image. the two limits are that an owned value held in a local has no move into another local — every accepted move originates at a call, so the free-then-replace rule only applies when the replacement comes from a call result — and that a local cannot be lent to a global, so redirecting the output stream at a scratch buffer needs a module-level variable. neither limit accepts an unsafe program; both refuse correct ones, so this is a completeness gap rather than a soundness failure. document the affected code, the diagnostics, what was tried and how each attempt failed, and a proposal. add src/tools/bootstrap-check.sh, which rebuilds both bootstrap stages and prints the compiler's diagnostics on its own source instead of the word dump. --- docs/BORROW.md | 2 ++ 1 file changed, 2 insertions(+) (limited to 'docs/BORROW.md') diff --git a/docs/BORROW.md b/docs/BORROW.md index 818eea4..10beb84 100644 --- a/docs/BORROW.md +++ b/docs/BORROW.md @@ -41,6 +41,8 @@ the compiler functions, standard library, and language server currently run with the analysis runs with the existing parser, ownership checker, and lifetime records; it does not have a separate source parser or a complete path-sensitive proof. snapshots conservatively join branches and loops. low-level and unknown boundaries can hide behavior, so a quiet diagnostic set is not a whole-program safety proof. zc is single-threaded; shared closure cells do not define concurrent mutation rules. +two completeness limits block the compiler from compiling itself, and are written up in `docs/BOOTSTRAP-OWNERSHIP.md`. an owned value already held in a local has no move into another local; every accepted move originates at a call, so the free-then-replace rule above applies only when the replacement comes from a call result. and a local cannot be lent to a global, so an output stream has to be redirected at a module-level buffer rather than a scratch local. neither limit accepts an unsafe program; both refuse correct ones. + the maintained regressions cover these cases: | case | behavior | -- cgit v1.2.3