Harden Cupid mode for all embedded programs

[frankischilling]

Part of #13

Question

Harden Cupid mode across all 104 top-level Cupid C programs and 22 browser fragments after strict C/Doom migration: production-scale globals/includes, full wide integer and float/double semantics, native bindings, top-level execution, #exe, native asm, class/new/del, reg/noreg, and SIMD extensions. Keep the complete embedded runtime corpus active and add host/guest behavior gates rather than trimming extension fixtures.

[frankischilling]

Pushed e6fafcf to bootstrap/cupid-self-hosting.

The private in-kernel CupidC compiler now tags loop and switch control frames. A switch-local break removes its saved selector before jumping to the switch exit. A continue searches outward for the nearest loop and removes one saved selector for each switch it crosses, while leaving controls outside that loop intact.

/bin/feature25.cc covers while, do/while, and for, nested switches, nearest-inner-loop selection, 600,000 switch-crossing continuations, 600,000 switch breaks, and the standalone continue outside loop diagnostic. The rebuilt image's exact QEMU smoke reports:

[cupidc] error (line 1): continue outside loop
[feature25] PASS do=1 for=1 while=1 stack=1 reject=1 nearest=1
[cupidc] JIT execution complete (stack: 0 bytes used, peak: 0 bytes)

The final repository gate passes all 364 tests with one expected skip, and make all rebuilds the complete image. ADR 0078 and the user-facing docs record the behavior and one remaining limit: the compiler reserves 128 control frames, but deep recursive parser recovery does not yet have a safe fail-closed depth proof.

Issue #31 stays open for the rest of the embedded Cupid C corpus and its wider migration dependencies.

[frankischilling]

Progress through a14ce50 is published in draft PR #33.

The in-kernel CupidC parser now accepts 128 active control frames and 1,024 active statement calls, rejects the next entry before deeper recursion, and recovers in the same REPL. The production emitter preserves nested loop and switch cleanup for break and continue, and /bin/feature25.cc exercises the depth, overflow, recovery, and long-running cleanup paths. Decimal floating constants and the supported integer-to-floating conversions are also present in the refreshed checked seed.

The current embedded corpus contains 105 top-level bin/*.cc roots and 22 browser fragments. The strong four-vCPU gate reaches the desktop and terminal and completes in-OS CupidC execution with that corpus still active.

Issue #31 remains open. Host-runnable source self-hosting, the remaining floating forms and conversions, wider Cupid extensions, and full behavior coverage across every embedded program still need work. No program or browser fragment was removed to fit the compiler.

[frankischilling]

Commit 2a7fbb9 adds typed runtime unary signs to the private in-kernel CupidC compiler. char and int remain on the integer path. float and double stay in XMM0, where unary minus toggles only the IEEE-754 sign bit. Unary plus preserves the scalar value. Non-arithmetic operands now receive a specific diagnostic, and the next REPL expression still compiles.

feature13_double.cc no longer works around the compiler with 0.0 - 5.5. Its guest proof covers negative binary32 and binary64 values, the exact 0x80000000 negative-zero payload, unary plus, string-operand rejection, recovery, and clean JIT completion.

All 30 kernel compile tests and 80 GUI terminal contracts pass. A fresh image boots the focused command successfully. The complete four-vCPU e1000 frontier also passes all ten guest commands, six USB storage lifetimes, HID reattachment, framebuffer comparison, AC97, and PC-speaker checks. ADR 0189 and the bootstrap records capture the decision and evidence.

Issue #31 stays open because the remaining Cupid mode surface still includes floating truth and updates, broader SIMD value semantics, and the rest of the active embedded corpus hardening.

[frankischilling]

Commit 0d45715 tightened the private CupidC unary-sign runtime proof. The frontier now permits the deliberate non-arithmetic operand diagnostic exactly once, after one complete feature13 compile line and inside one completed feature13 success slice. Stale, repeated, embedded, out-of-order, partial, and unrelated compiler errors remain fatal.

The change adds 90 GUI contract tests and a two-test host oracle that compiles the active byte writers and scalar-negation helpers, checks their exact instruction streams, and interprets raw binary32 and binary64 payloads. The canonical audit passes. The checked-seed root build passed in 343 seconds, and the final four-vCPU e1000 frontier passed in 242 seconds. Its 94,323-byte log has SHA-256 c91ec6438c176d2270d8f52df34d47ad60b3be891c3916d1cf9624b0609427e1 and contains one compile marker, one permitted diagnostic, one feature pass, no other CupidC error, and ten JIT completions.

This advances the Cupid-mode hardening work, but issue #31 remains open because its broader embedded-program and language-surface acceptance criteria are not complete.

[frankischilling]

Private CupidC now supports all six scalar float and double comparisons in commit 0f6e78a.

Matching widths use UCOMISS or UCOMISD, mixed widths compare as double, and the result is normalized to int. Explicit parity handling keeps every unordered relation false except !=. The compiler also rejects pointer, aggregate, function-pointer, and SIMD operands instead of converting their storage bits.

The focused emitter suite covers exact bytes, ordered values, signed zero, subnormals, infinities, quiet NaNs, signaling NaNs, and invalid operand types. All 30 checked-seed kernel compile tests and 92 GUI contract tests pass. A complete normal image build and the private four-vCPU e1000 frontier also pass; feature13 reports ordered=6, mixed=4, zero=2, and unordered=6.

Issue #31 remains open for runtime floating truth, floating updates, SIMD gaps, and the broader embedded corpus.

[frankischilling]

Pushed a7c46c7 to bootstrap/cupid-self-hosting.

Private CupidC now materializes scalar float and double truth for !, ?:, if, while, for, and do ... while. Both signed zero encodings are false; finite nonzero values, infinities, and NaNs are true.

The first guest run exposed a second bug: many value-returning kernel bindings were registered as void. The repair audits all 510 declarations and registrations. The table now has 318 typed value results and 192 verified void results, with a negative test for untyped non-void drift.

Evidence:

• 105 focused emitter, binding, diagnostic, and frontier-contract tests pass.
• The four-job OS build passed in 554.3 seconds.
• The complete four-vCPU e1000 frontier passed in 237.3 seconds and continued through godsong.cc, the command that caught the old binding type.
• The checked-seed frontier compiled all 155 production sources twice with zero deferred boundaries and passed in 1,437.9 seconds.

ADR 0193, the bootstrap log, capability and migration matrices, wiki pages, and in-OS CTXT help record the implementation and the failed first runtime attempt. Issue #31 remains open for floating increment and decrement, remaining SIMD operators, and the other Cupid mode gaps.

[frankischilling]

Pushed 7c4eb8c to bootstrap/cupid-self-hosting.

Private CupidC now supports prefix and postfix ++ and -- for direct scalar float and double variables. One typed helper handles local, parameter, global, statement, expression, and for update paths. Postfix forms preserve the old floating payload in XMM2 while the new XMM0 value is stored.

The refactor removed eight duplicated integer-only mutation bodies and reduced cupidc_parse.o by 1,100 bytes, from 298,280 to 297,180. Invalid arrays, aggregates, function pointers, and SIMD vectors now receive increment or decrement requires a scalar variable.

Evidence:

• 109 binding, unary, comparison, truth, update, and GUI contract tests pass.
• The four-job OS build passed in 564.1 seconds.
• The complete four-vCPU e1000 frontier passed in 236.9 seconds with local, global, loop, negative-zero, and NaN update evidence.
• The checked-seed frontier compiled all 155 production sources twice with zero deferred boundaries and passed in 1,386.9 seconds.

ADR 0194, the bootstrap log, current matrices, wiki pages, and in-OS CTXT help record the implementation. Issue #31 remains open for indirect floating lvalues, broader SIMD operators, and the remaining private Cupid mode gaps.

[frankischilling]

Commit c11326f moves the private in-kernel CupidC ABI forward. Direct calls, stored function pointers, object methods, and pointer methods now use one scalar cdecl layout with four-byte scalar and pointer slots plus eight-byte double slots. Callees advance parameter offsets by the same widths, and callers reclaim the exact outgoing area. Feature13 now calls a real double, double, double, int helper nine times, and the private four-vCPU guest reaches [feature13-call] PASS checks=9. Aggregate calls, SIMD arguments, variadic promotion, structure returns, and other Cupid-mode gaps keep this ticket open.

[frankischilling]

Pushed commit 5875c6a.

Browser JavaScript numbers now stay in a native double lane from lexer token through AST and interpreter value. Decimal fractions and signed or uppercase exponents survive parsing, comparisons and truth no longer narrow through an integer scale, division and remainder keep IEEE behavior, and NaN plus signed infinities have explicit formatting. browser --selftest runs the real lexer, parser, and interpreter without opening a window and reports 17 computed checks.

The Browser work also drove a substantial private CupidC repair. One-dimensional fixed float and double arrays now keep their element type and stride across global, local, block-static, and persistent REPL storage. Indexed SSE loads, stores, arithmetic compound assignments, and sizeof(*array) use the declared width. Direct functions and methods retain fixed parameter types for scalar conversion, variadic tails receive the represented default promotions, char follows integer promotion, global floating scalars no longer overlap, pointer-result stride metadata is reset correctly, and invalid or overflowing array layouts fail before allocation.

Evidence:

• The final focused Browser, call-ABI, floating, and GUI contract run passes all 143 tests in 7.136 seconds.
• The broader private and production compiler set passes all 142 tests in 123.925 seconds.
• The strict frontier compiles all 155 sources twice with 3,749,796 byte-identical output bytes per pass.
• All 68 build-graph tests pass, and the read-only active-audit check matches.
• make all passes in 1,463.8 seconds and produces the final 200 MiB image.
• Complete four-CPU GUI frontiers pass on e1000 and RTL8139 in 270.1 and 270.0 seconds. Each log contains the exact 17-field Browser PASS marker and no Browser failure marker.

Issue #31 stays open. Private CupidC still needs multidimensional floating arrays, fixed SIMD arrays, floating pointer dereference, floating arrays inside records, and broader embedded-program coverage. Browser still lacks the rest of ECMAScript numeric literal and conversion behavior. No source was removed or simplified to fit the compiler.

[frankischilling]

Commit b1106c2 adds compiler-head support for direct returns-twice calls without losing live expression operands. The implementation includes exact positive and negative contracts, corrected dglibc jump templates, a modeled two-return execution oracle, and a complete passing toolchain run with stage identity and all 20 artifacts verified.

The checked seed and active dglibc source still use the compatibility form, so this advances the bootstrap without closing the issue. Seed promotion, active-source migration, and guest runtime proof remain open.

[frankischilling]

Commit 58ea93c promotes returns-twice support into the checked five-tool seed. The new seed reproduces all five tools at stage two, passes the complete 39-test seed module, rebuilds and verifies the normal 20-artifact Toolchain cohort without host code generators, and keeps the 717-input build graph green.

Issue #31 remains open. Active dglibc still uses the unannotated compatibility checkpoint; source migration and guest runtime proof are the next steps.