feat(selfhost-check): type-inference slice 1 — conservative expr_type_root + RS0013 (foundation; gate unchanged at 26)

olwang · claude · olwang · commit f5c60dce2948 · 2026-07-03T13:12:32.000-07:00
Begin the semantic type tier of the self-hosted checker: a conservative
expression type-of pass (`expr_type_root`) and the RS0013 (invalid-try)
sub-rules that consume it. `expr_type_root` types ONLY the forms the oracle
computes with certainty (literals, value keywords, Some/Ok/Err, sum-variant
heads, unqualified same-file calls via fn_return_root, and let-/param-typed
idents) and returns "" (unknown) for Binary/Index/Field/qualified &amp;
receiver calls/object/array/closure — unknown =&gt; no fire =&gt; no false
positive. It is the foundation the later slices (RS0210/RS0207/RS0208)
reuse.

RS0013 is emitted (sub-rules A: `?` in a non-Result/Option-returning fn;
B: `?` on a confidently concrete non-Result/Option operand) but is
deliberately NOT added to CHECKER_TARGET_CODES, so it is filtered from the
parity comparison and the gate stays green at 26 codes. Reason (FALLBACK):
the oracle's third sub-rule (error-type mismatch) fires on ast-call-missing-
effect-nested.rss via qualified stdlib calls (`File.open_write?`/`File.write?`
→ FileError) whose error type needs the full stdlib signature DB the token-
level checker intentionally lacks; typing qualified calls would risk corpus-
wide false positives. So RS0013 cannot reach 0-mismatch at the spec's
conservatism level yet.

Verified: checker_parity_corpus 619/619 ok, 0 mismatches, 0 run-failures at
the same 26 codes. RS0013 fires correctly on all 11 sub-rule-A/B files
(incl. fixtures try-operator-non-result{,-value}.rss) and on zero clean `?`
files. Ledger milestone 2l records the foundation and the precise blocker.

Co-Authored-By: Claude Opus 4.8 &lt;noreply@anthropic.com&gt;
diff --git a/docs/ledgers/rss-selfhost-ledger.md b/docs/ledgers/rss-selfhost-ledger.md
@@ -1196,3 +1196,55 @@ gap is VM value-representation / intrinsic-dispatch cost (the next big lever).
 - **Status:** the frontend-object AST parity ladder (structure → line:col →
   line:col:len) is CLOSED. Remaining self-host frontier is the semantic tier
   (type-inference + borrow-checker codes; see the SH-026 step-2 tail).
+
+### Milestone 2l — type-inference engine slice 1: conservative `expr_type_root` + RS0013 (FALLBACK: foundation committed, RS0013 left OUT of the gate)
+
+- **Goal:** begin the semantic type tier — a CONSERVATIVE expression type-of pass
+  (`selfhost/check.rss::expr_type_root`) and use it to land RS0013 (invalid-try),
+  the most FP-safe type code. Foundation reused by later slices (RS0210 operator,
+  RS0207 argument, RS0208 return).
+- **Built (committed):** `expr_type_root(toks, s, e, bodyOpen, exprPos, popen,
+  pclose, declared, allFns)` — types ONLY the forms the oracle computes with
+  certainty, else "" (unknown => no fire => no false positive):
+  * String / number (`number_literal_root` = Float iff text has `.`, else Int) /
+    Char literal · `true|false`→Bool · `null`→JsonLiteral · `Unit`→Unit ·
+    `None`→Option · `Some(..)`→Option · `Ok|Err(..)`→Result · a sum-variant head →
+    its owning sum (`variant_owner`) · an unqualified call `name(..)` → same-file
+    `fn_return_root` or a declared-type constructor · a bare ident → a let-typed
+    local (recursively) or a declared-type param (`param_type_root`).
+  * Everything else — Binary / Index / Field / qualified & receiver calls
+    (`Ns.m(..)` / `x.m(..)`) / object / array / closure — returns "" by design
+    (those need the full stdlib signature DB the token-level checker lacks; keeping
+    them unknown is the FP-safety mechanism). Helpers `try_operand_root` +
+    `fn_invalid_try` reproduce two of the three RS0013 sub-rules token-level.
+- **RS0013 sub-rules (oracle has THREE, not two):**
+  * **A — result-returns** (`analyzer/runtime_guarantee.rs::
+    check_try_operator_result_returns`): any `?` in a fn whose return base ∉
+    {Result, Option}. Token-level, exact. Reproduced. (10 corpus files, incl.
+    fixture `try-operator-non-result.rss`.)
+  * **B — value-is-result** (`checks/body/try_checks.rs::check_try_value_is_result`):
+    a `?` operand of a confidently-known concrete non-Result/Option type.
+    Reproduced via `expr_type_root`. (1 file: fixture
+    `try-operator-non-result-value.rss` — operand `load(..)`→`Image`.)
+  * **C — error-type mismatch** (`checks/body/try_checks.rs::check_try_error_types`):
+    a `?` whose operand `Result<T, E_op>` has `E_op` ≠ the fn's declared error
+    type. Reproduced for unqualified operands only.
+- **BLOCKER (why RS0013 is NOT in CHECKER_TARGET_CODES):**
+  `tests/fixtures/fail/ast-call-missing-effect-nested.rss` (fn returns
+  `Result<Unit, IOError>`) fires sub-rule C on TWO **qualified stdlib** operands —
+  `File.open_write(..)?` and `File.write(..)?`, whose error type the oracle knows
+  is `FileError` (≠ `IOError`). Reproducing that needs per-method stdlib
+  error-type inference on qualified/receiver calls, which the spec deliberately
+  keeps UNKNOWN (typing them risks corpus-wide false positives on the many clean
+  `File.*?`/`Json.*?` calls whose error type matches). So RS0013 cannot reach
+  0-mismatch at the spec's conservatism level — FALLBACK taken.
+- **Outcome:** `expr_type_root` + the RS0013 sub-rule A/B wiring are committed and
+  exercised across all 619 corpus files (0 run-failures). RS0013 is EMITTED by the
+  checker but stays OUT of `CHECKER_TARGET_CODES` (filtered from parity), so the
+  gate is unchanged. It fires correctly on 11 of the 13 oracle-RS0013 files (all
+  sub-rule A + B); the 2 sub-rule-C files stay unflagged (the documented blocker),
+  and every clean `?` file stays unflagged (0 false positives, verified).
+- **Gate:** `checker_parity_corpus` 619/619 ok, 0 mismatches, 0 run-failures at
+  the SAME 26 codes (RS0013 absent). Green.
+- **Next slice:** RS0013 becomes gateable once qualified-call error-type inference
+  exists; meanwhile `expr_type_root` is ready for RS0210/RS0207/RS0208.
diff --git a/selfhost/check.rss b/selfhost/check.rss
@@ -2602,6 +2602,170 @@ fn file_unsafe_use(toks: read List<Tok>) -> Bool {
     return hit
 }
 
+// ---------------------------------------------------------------------------
+// Type-inference engine — slice 1: conservative expression type-of + RS0013.
+//
+// `expr_type_root` computes the type ROOT of an expression region, but ONLY for
+// the forms whose type the oracle (crate::hir::infer + checks/shared) computes
+// with certainty; everything else (Binary / Index / Field / qualified & receiver
+// calls / object / array / closure) returns "" (UNKNOWN). Returning unknown =>
+// no diagnostic => no false positive; that conservatism is the safety mechanism
+// and the reason this foundation is reused by the later slices (RS0210 operator,
+// RS0207 argument, RS0208 return). See crate::checks::shared::builtin_value_type_name,
+// crate::hir::number_literal_type_name, and checks/body/try_checks.rs.
+//
+// NOTE: RS0013 is emitted below but is intentionally NOT in CHECKER_TARGET_CODES
+// (so it is filtered from the parity comparison and the gate stays green). Two of
+// its three oracle sub-rules are reproduced faithfully — (A) `?` in a function
+// whose return type is not Result/Option, and (B) a `?` whose operand has a
+// confidently-known concrete non-Result/Option type. The third sub-rule
+// (error-type mismatch) fires on qualified stdlib calls whose error type needs
+// the full stdlib signature DB, which is deliberately kept UNKNOWN here; see the
+// ledger milestone for the precise blocker (ast-call-missing-effect-nested.rss).
+// ---------------------------------------------------------------------------
+
+// crate::hir::number_literal_type_name reproduced: a numeric literal is Float iff
+// its text contains a `.` (code point 46), else Int (`1e5` has no `.` => Int).
+fn number_literal_root(text: read String) -> String {
+    let cs = String.chars(value: read text)
+    let n = List.len(list: read cs)
+    let mut i = 0
+    let mut isFloat = false
+    while i < n {
+        if Char.to_code(value: read List.get(list: read cs, index: read i)) == 46 { isFloat = true }
+        i = i + 1
+    }
+    if isFloat { return "Float" }
+    return "Int"
+}
+
+// Conservative expression type-of: the type ROOT of the region [s0,e), or "" when
+// not provably known. Only the SURE forms are typed:
+//   * String / number / Char literal      · true|false -> Bool
+//   * null -> JsonLiteral · Unit -> Unit  · None -> Option
+//   * Some(...) -> Option · Ok|Err(...) -> Result
+//   * a sum variant head -> its owning sum
+//   * an unqualified call name(...) -> same-file fn return root, or a declared
+//     type name it constructs
+//   * a bare ident -> a let-typed local (recursively) or a declared-type param
+// Anything else (Binary / Index / Field / qualified or receiver call / object /
+// array / closure) -> "".
+fn expr_type_root(toks: read List<Tok>, s0: read Int, e: read Int, bodyOpen: read Int, exprPos: read Int, popen: read Int, pclose: read Int, declared: read Set<String>, allFns: read Set<String>) -> String {
+    let mut s = s0
+    if is_effect_kw(toks: read toks, i: read s) { s = s + 1 }
+    if s >= e { return "" }
+    let k0 = tk_kind(toks: read toks, i: read s)
+    if (s + 1) == e {
+        if k0 == TOK_STRING { return "String" }
+        if k0 == TOK_NUMBER { return number_literal_root(text: read tk_text(toks: read toks, i: read s)) }
+        if k0 == TOK_CHAR { return "Char" }
+    }
+    if is_ident_tok(toks: read toks, i: read s) == false { return "" }
+    let head = tk_text(toks: read toks, i: read s)
+    if (s + 1) == e {
+        if head == "true" || head == "false" { return "Bool" }
+        if head == "null" { return "JsonLiteral" }
+        if head == "Unit" { return "Unit" }
+        if head == "None" { return "Option" }
+    }
+    let after = dotted_end(toks: read toks, i: read s)
+    // A constructor / unqualified call spanning the whole region: `head ( ... )`.
+    if after == (s + 1) && at_symbol(toks: read toks, i: read (s + 1), code: read SYM_LPAREN) {
+        let close = find_matching(toks: read toks, open: read (s + 1), openSym: read SYM_LPAREN, closeSym: read SYM_RPAREN)
+        if close != (e - 1) { return "" }
+        if head == "Some" { return "Option" }
+        if head == "Ok" || head == "Err" { return "Result" }
+        let owner = variant_owner(toks: read toks, vname: read head)
+        if String.len(value: read owner) > 0 { return owner }
+        if Set.contains<String>(set: read allFns, value: read head) {
+            return fn_return_root(toks: read toks, fnName: read head)
+        }
+        if Set.contains<String>(set: read declared, value: read head) { return head }
+        return ""
+    }
+    // A bare, unqualified ident spanning the whole region.
+    if after == (s + 1) && (s + 1) == e {
+        let owner = variant_owner(toks: read toks, vname: read head)
+        if String.len(value: read owner) > 0 { return owner }
+        let lr = find_let_rhs_start(toks: read toks, bodyOpen: read bodyOpen, matchPos: read exprPos, name: read head)
+        if lr >= 0 {
+            let re = next_line_or_block_end(toks: read toks, start: read lr, end: read exprPos)
+            return expr_type_root(toks: read toks, s0: read lr, e: read re, bodyOpen: read bodyOpen, exprPos: read lr, popen: read popen, pclose: read pclose, declared: read declared, allFns: read allFns)
+        }
+        if popen >= 0 && pclose >= 0 {
+            return param_type_root(toks: read toks, open: read popen, close: read pclose, name: read head)
+        }
+        return ""
+    }
+    return ""
+}
+
+// The type root of a `?`-operand ending just before the `?` at `qPos`. Only the
+// two operand shapes whose start is unambiguous token-level are typed: a call
+// `name(...)?` (unqualified only) and a bare ident `x?`; anything else (qualified
+// call, index, field, literal) -> "" (unknown => FP-safe).
+fn try_operand_root(toks: read List<Tok>, qPos: read Int, bodyOpen: read Int, popen: read Int, pclose: read Int, declared: read Set<String>, allFns: read Set<String>) -> String {
+    let prev = qPos - 1
+    if prev <= bodyOpen { return "" }
+    if at_symbol(toks: read toks, i: read prev, code: read SYM_RPAREN) {
+        let mut d = 0
+        let mut j = prev
+        let mut op = -1
+        while j > bodyOpen && op < 0 {
+            if at_symbol(toks: read toks, i: read j, code: read SYM_RPAREN) {
+                d = d + 1
+            } else if at_symbol(toks: read toks, i: read j, code: read SYM_LPAREN) {
+                d = d - 1
+                if d == 0 { op = j }
+            }
+            j = j - 1
+        }
+        if op <= bodyOpen { return "" }
+        let callee = op - 1
+        if is_ident_tok(toks: read toks, i: read callee) == false { return "" }
+        if at_symbol(toks: read toks, i: read (callee - 1), code: read SYM_DOT) { return "" }
+        return expr_type_root(toks: read toks, s0: read callee, e: read qPos, bodyOpen: read bodyOpen, exprPos: read callee, popen: read popen, pclose: read pclose, declared: read declared, allFns: read allFns)
+    }
+    if is_ident_tok(toks: read toks, i: read prev) {
+        if at_symbol(toks: read toks, i: read (prev - 1), code: read SYM_DOT) { return "" }
+        return expr_type_root(toks: read toks, s0: read prev, e: read qPos, bodyOpen: read bodyOpen, exprPos: read prev, popen: read popen, pclose: read pclose, declared: read declared, allFns: read allFns)
+    }
+    return ""
+}
+
+// RS0013 INVALID_TRY_OPERATOR (sub-rules A + B): true iff the fn at `start` uses
+// `?` in a way that is invalid. (A) any `?` in a fn whose return root is not
+// Result/Option (check_try_operator_result_returns). (B) a `?` whose operand has
+// a confidently-known concrete non-Result/Option type (check_try_value_is_result).
+fn fn_invalid_try(toks: read List<Tok>, start: read Int, declared: read Set<String>, allFns: read Set<String>) -> Bool {
+    let ns = fn_name_start(toks: read toks, i: read start)
+    let sigEnd = function_signature_end(toks: read toks, start: read (ns - 1))
+    if at_symbol(toks: read toks, i: read sigEnd, code: read SYM_LBRACE) == false { return false }
+    let bodyClose = find_matching(toks: read toks, open: read sigEnd, openSym: read SYM_LBRACE, closeSym: read SYM_RBRACE)
+    if bodyClose < 0 { return false }
+    let popen = find_param_open(toks: read toks, from: read ns, end: read sigEnd)
+    let mut pclose = -1
+    if popen >= 0 {
+        pclose = find_matching(toks: read toks, open: read popen, openSym: read SYM_LPAREN, closeSym: read SYM_RPAREN)
+    }
+    let retRoot = return_type_root_at(toks: read toks, fnkw: read (ns - 1))
+    let returnsResult = retRoot == "Result" || retRoot == "Option"
+    let mut k = sigEnd + 1
+    let mut hit = false
+    while k < bodyClose {
+        if at_symbol(toks: read toks, i: read k, code: read SYM_QUESTION) {
+            if returnsResult == false {
+                hit = true
+            } else {
+                let root = try_operand_root(toks: read toks, qPos: read k, bodyOpen: read sigEnd, popen: read popen, pclose: read pclose, declared: read declared, allFns: read allFns)
+                if String.len(value: read root) > 0 && root != "Result" && root != "Option" { hit = true }
+            }
+        }
+        k = k + 1
+    }
+    return hit
+}
+
 fn main() -> Unit {
     let source = Args.get_or_default(index: 0, default: read "")
     let toks = tokenize(source: read source)
@@ -2630,6 +2794,10 @@ fn main() -> Unit {
     let mut pureBad = false
     // RS0029: any `await` in a non-async function.
     let mut badAwait = false
+    // RS0013: an invalid `?` (non-Result return, or a concrete non-Result operand).
+    // Emitted but filtered from parity (not in CHECKER_TARGET_CODES); see the
+    // type-inference engine section above.
+    let mut invalidTry = false
     // RS0023: `Fd` in a non-native fn signature or a non-resource type field.
     let mut fdSurface = false
     // RS0021: any non-exhaustive match statement or expression in the file.
@@ -2836,6 +3004,7 @@ fn main() -> Unit {
                     if fn_pure_bad(toks: read toks, start: read i, resources: read resources, sumVariants: read sumVariants, pureFns: read pureFns, allFns: read allFns, declared: read declared) { pureBad = true }
                     if fn_has_nonexhaustive_match(toks: read toks, start: read i, declared: read declared, allFns: read allFns) { nonExhaustive = true }
                     if fn_has_bad_await(toks: read toks, start: read i) { badAwait = true }
+                    if fn_invalid_try(toks: read toks, start: read i, declared: read declared, allFns: read allFns) { invalidTry = true }
                     if fn_has_fd_surface(toks: read toks, start: read i) { fdSurface = true }
                     // RS0027: an unknown protocol in this fn's generic bounds.
                     if generics_unknown_protocol(toks: read toks, nameEnd: read dotted_end(toks: read toks, i: read ns), protocols: read protocols) { unknownProtocol = true }
@@ -2917,6 +3086,9 @@ fn main() -> Unit {
     if badAwait {
         Log.write(message: read "RS0029")
     }
+    if invalidTry {
+        Log.write(message: read "RS0013")
+    }
     if asyncNotConsumed {
         Log.write(message: read "RS0022")
     }
@@ -2960,7 +3132,7 @@ fn main() -> Unit {
     if featureViol {
         Log.write(message: read "RS0101")
     }
-    let anyDiag = found || hasUnknownFeat || hasDupFeat || headerCount >= 2 || missingReturn || untypedParam || hasProfile || shareParam || unknownEffect || removedRuntime || invalidSelf || outOfRangeInt || retainsBad || unknownType || missingEffect || pureBad || nonExhaustive || badAwait || fdSurface || lowerConflict || unknownProtocol || noallocAlloc || noBlockCall || noPanicCall || asyncNotConsumed || featureViol
+    let anyDiag = found || hasUnknownFeat || hasDupFeat || headerCount >= 2 || missingReturn || untypedParam || hasProfile || shareParam || unknownEffect || removedRuntime || invalidSelf || outOfRangeInt || retainsBad || unknownType || missingEffect || pureBad || nonExhaustive || badAwait || invalidTry || fdSurface || lowerConflict || unknownProtocol || noallocAlloc || noBlockCall || noPanicCall || asyncNotConsumed || featureViol
     if anyDiag == false {
         Log.write(message: read "CLEAN")
     }
