# The compiler A map of `jibb-dev/lib/jibb.hoon`, the compiler as milestone 1 left it: the layout pass, the parser, and the printers the golden tests compare. The file explains itself in design notes at its top, numbered 1 to 4; this page says where things are and points there for the reasoning. The plan's Compiler architecture section gives the whole pipeline. Here it is shortened, with the milestone that builds each step; milestone 1 built the first line: ``` /ui source → layout pass → parser → a syntax tree per module milestone 1 → module graph: imports resolved, Hoon types read from Clay milestone 2 → type checker, one module at a time, in dependency order milestone 2 → core language milestone 3 → Nock milestone 3 → JavaScript milestone 6 ``` ## Constraints - **One core, no Ford runes.** `urbit eval` runs the library as `=> `, and a ship builds it as `/lib/jibb.hoon`. So it can't import with `/-` or `/+`, and under `urbit eval` it can't scry. Anything from Clay, such as an imported module's text or a `/sur` file's type, is best passed in by the caller, which keeps every stage testable under eval. - **The standard library is the subject.** Under `urbit eval`, as on a ship, the library is built against `..zuse`: `hoon.hoon`, lull and zuse. It reads literals with Hoon's own parser, `nuck:so`. Hoon's type engine, `ut`, is there for milestone 2, and under eval `ride` compiles Hoon source, such as a `/sur` file without Ford runes, into a type, which tests can use in place of Clay's builds. - **The spec wins.** Where the file and the spec disagree, the spec is right, and the file's notes quote its words for each rule they implement. The repository spec records the decision to drop `$?`, pending synchronization to the Claude document. ## API From the header of the file: | Arm | Takes | Gives | | --- | --- | --- | | `+layout` | `[file=path src=@t]` | `(list token)`: never fails; an error is the last token | | `+layout-error` | `[file=path toks=(list token)]` | `(unit error)`: the error token's error, if any | | `+parse` | `[file=path src=@t]` | `(each module error)` | | `+parse-tokens` | `[file=path toks=(list token)]` | `(each module error)` | | `+golden` | `[file=path src=@t]` | `[tokens=@t tree=@t]`: both stages printed, or the rendered error | | `+golden-types` | `[file=path src=@t]` | A partial inference report; explicitly says the module has not been checked | | `+golden-types-imports` | `[file=path src=@t externals=iexternals]` | The same partial report, with selected caller-supplied Hoon mold results | | `+show-tokens` | `(list token)` | `@t` | | `+show-module` | `module` | `@t` | | `+show-error` | `[src=@t error]` | `@t` | A file is a Clay path whose last segment is the extension, as `/ui/basket/jibb`. ## Where things are The core is split into chapters, `+| %name`, in this order: | Chapter | Holds | | --- | --- | | `%positions` | `loc`, `span` and `error` | | `%tokens` | `token`, `lexeme`, `glyph` and `lit`: what the layout pass emits | | `%tree` | The syntax tree: `module`, `import`, `def`, `expr`, `piece`, `qseg`, `item`, `edit`, `arm`, `sample`, `field`, `pattern`, `shape` and `pseg` | | `%api` | The arms above that aren't printers | | `%lexer` | The layout pass's door, `+lexer`, and its helpers | | `%printers` | `+show-tokens`, `+show-module`, `+show-error` | | `%parser-helpers` | Error building (`+fail`, `+fail-in`, `+fail-space`, `+fail-line`, `+moved`, …) and the `+then` combinator | | `%parser` | The parser's door, `+parser`: one arm per EBNF rule, as `+read-module`, `+read-expr`, `+read-mold` | | `%span-check` | `+check-spans`, which `+golden` runs on every tree, and `+check-spans-test` | | `%type-inference` | The initial inference fragment and its unification helpers; not yet a module type checker | The inference fragment supports fixed auras, unrestricted `@`, one-way widening into it and toward aura-family ancestors, generic variables and gates, faced and unfaced cells, cell sample binders, known record field reads, a cell pattern of two or more binders, a complete two-arm loobean branch, a complete two-arm unit-shaped branch, closed local mold aliases and acyclic forward value references. For a supported single syntactic top-level recursive gate, the checker infers the sample first and uses that exact sample, including its field faces, in a monomorphic self placeholder. The completed body must unify with the placeholder before the gate is generalized; incompatible recursive arguments can report the call and argument sites. Uses of generalized top-level definitions instantiate their schemes independently. For a complete loobean branch with one direct self-call arm, the checker can infer the other arm independently and use its closed, fully resolved type to seed the recursive result; it then checks the whole body. Open or pending base types do not seed the result, and other branch shapes still depend on the existing partial inference. A supported single local recursive gate also uses a monomorphic self reference while its body is checked, then generalizes variables free of its enclosing environment; captured variables remain shared. Acyclic local value definitions can refer forward. The checker collects written capitals per `++` before inference, excluding nested definitions: a capital used in an enclosing definition is shared with its locals, even when written later, while a capital introduced only in a local definition is generalized there. Sibling locals can introduce independent capitals with the same spelling; generic mold parameters keep their own scope. Top-level groups of syntactic gates are inferred together with monomorphic placeholders and shared substitutions, then generalized only after the whole group checks; downstream uses and library interfaces instantiate those schemes independently. A dependency graph identifies groups with two iterative depth-first passes; its conservative local-reference edges can reject otherwise valid programs. Supported local mutually recursive gate groups also use shared monomorphic placeholders and generalize only after the group checks, preserving captured outer variables. Some proven non-gate value cycles are diagnosed; other mixed gate/value cycles, polymorphic recursion, unresolved literal constraints and unresolved branch joins remain unsupported. Acyclic simple local mold aliases can also refer forward, and are scoped to the body, not its gate's sample. Nonrecursive generic aliases of supported molds can be applied at exact arity, including locally and through library interfaces; their parameters are lexical. Closed, provably disjoint nonrecursive unions and tagged single-case molds support contextual term values, `~` and `|=%tag` constructors. Literal heads compare by their runtime noun, so `|=%$` can construct an explicit null-, loobean-zero- or term-zero-headed case. Equal heads with distinct payloads can be selected when exactly one payload fit is proven; unknown or ambiguous alternatives remain unsupported. Unresolved tags and nulls remain pending, with distinct partial-inference diagnostics. Nonrecursive top-level generic union molds with provably disjoint cases also support contextual tags and constructors at exact arity; their arguments are retained through generalization and supported library interfaces. Nonrecursive generic aliases can reorder, repeat or omit parameters while preserving a supported union’s origin, including through local scopes and library interfaces. Generic unions declared directly inside a body and recursive molds outside the source-proven slices described below remain unsupported. A directly known named union can instantiate an unconstrained generic gate sample while retaining its origin, generic arguments and faces. Unnamed, pending-tag, recursive, unknown-atom and variable-bound union origins remain unsupported. A value with type variable `A` can fit a field whose type is that same `A`, including in generic union payloads and nested or repeated record fields. A differing-variable face constraint remains unsupported. When inference forces two distinct explicitly written capitals equal, it reports both source sites; forcing a capital to a concrete type remains unsupported in this fragment. It can infer and generalize atom constraints arising from explicit capitals or bare sample binders, preserve those constraints through aliases, instantiate them independently, and print multiple constraints. Unresolved decimal variables default to `@ud` for inferred types without gates; defaulting inside gate types and other constraint cases remain incomplete. It does not yet check a module, complete imports, general patterns, general deferred constraints, recursive molds, dependency cycles or most errors with both conflicting excerpts. Definite cast and call mismatches, incompatible branches and overlapping union cases report both sites and excerpts. Concrete branch results can join at an explicitly present parent aura or `@`. Some known tuple and record positions acquire matching faces; other variable-dependent face merges, general branch tag context and ambiguous call-result propagation remain unsupported; function compatibility involving nested `@` and variable-dependent joins remain unsupported except for equal types and the source-bound gate-sample proof below. For a single recursive gate outside a group, the reporting path repeats inference rather than instantiating its generalized interface inside its own body; a group report uses its stored schemes. This adds work, and the current dependency pass can take quadratic time on long forward chains; the milestone's speed target remains unverified. A separate conservative pass reports unions whose cases are provably disjoint or overlapping and leaves other cases unresolved; it does not claim the mold is checked. Unsupported forms are reported as such, and the partial output says the module has not been checked. A direct unshadowed prelude call can use checked source layouts when a positional argument is a directly named, already inferred root gate. For two-slot function samples, the checker can match a named update against an unnamed generic gate sample without confusing a binder face with a nested record face. Both explicitly named slots must agree; source boundaries are evidence for this fit, not a call-arity rule. The source gate and prelude annotation must be available from their checked bindings. Local or dynamic gates, aliases without direct evidence, recursive or SCC placeholder bodies, other sample shapes and unresolved call-sample variables remain unsupported by this proof. Ordinary inference remains the fallback. The checker retains a per-analysis index of finalized root gates and a prelude source table bound to the entire trusted prepared interface. A dependency screen avoids building the table when the root cannot use it; changing the interface invalidates it. The host remains responsible for supplying a prepared interface paired with its source. The matcher checks each slot and product in both directions with a shared substitution. Before returning its tentative proof it requires both complete call samples to normalize to closed, tag-free types, then repeats every slot check and requires the substitution and fresh-ID counter to remain unchanged. This keeps later argument or enclosing constraints from invalidating an earlier face check, and preserves pending constraints, capital checks and projection evidence. These scans and the bounded second proof add work; they do not establish a global linear-time bound. Before the empty-capital optimization below, single sequential eval runs including startup showed that 2,000 ordinary gates used 70.20 seconds of user CPU at baseline and 70.64 seconds with the cached source table. Fifty unsupported eligible scalar-slot calls used 24.75 and 25.71 seconds, while fifty function-slot failures used 24.15 and 25.36 seconds. Fifty successful calls took 26.56 seconds before the final stability replay and 26.99 seconds with it. These are synthetic measurements, not production performance limits. Restricted-number promotion only applies to written capital variables. If none are present, it returns immediately instead of traversing the environment. In one startup-inclusive pair of runs on 2,000 independent gates, output was byte-identical and user CPU fell from 71.67 to 38.26 seconds; wall time was 72.80 versus 51.66 seconds while other checks were running. This does not establish a bound for dependent modules or a complete-checker benchmark. A bounded source proof can also establish distinct literal heads when a union case is a one-hop application of a uniquely resolved local generic mold. It compares literal runtime nouns and checks the original mold normally before publishing an interface. The same source proof improves the partial report, which still says the mold is not checked. The new proof declines nested or qualified applications, opaque references, recursive-index states, holes and deferred obligations; other valid unions can remain unsupported. A 256-node source budget and a separate 256-entry inherited-state budget apply per attempt. They do not bound the existing pairwise union pass, parsing, atom or name sizes, or downstream checking. Prepared interfaces and inference state remain trusted inputs. `tools/type-union-source-test` and the shared ship guard exercise source resolution, reporting, rollback and these bounds. A separate positive witness can identify overlap in two-field, literal-headed cases when a unique one-hop local, one-parameter generic alias is applied to a concrete primitive payload. It compares the literal noun values and proves the payloads have a shared noun, so an empty or unknown payload is not a witness. The partial report identifies both original case sites. `infer-jibb-file-detailed` returns structured overlap evidence for the first failed mold, including the originating path, exact source, mold name and both case spans. Ordinary Jibb imports preserve a child’s evidence through source and cache checks; the legacy `infer-jibb-file` API remains a text-result adapter and renders both excerpts. Specialized API and prepared-prelude paths retain their existing generic or text-only error boundaries. This witness uses a shared 256-node source/pair budget per attempt; generic-wrapper parameter validation has a separate 256-entry cap. An unsupported earlier case may hide a later overlap. Existing pairwise union analysis, parsing, atom and name sizes, source-excerpt rendering, and downstream checking remain outside these budgets. `tools/type-union-alias-overlap-test` checks the source proof and partial report; `tools/type-full-overlap-test` checks the detailed and legacy full-module paths, source attribution and cache behavior. A single-arm cell pattern can bind two or more positions, with its last binder capturing the remaining tail. Duplicate and shadowed names are rejected. A definite non-cell spine fails; an intermediate union or collection that might contain a cell remains unsupported. For a known non-union cell, a separate one-arm rule also accepts structured patterns, including nested literal and wildcard positions, when the existing coverage proof establishes the whole pattern. It binds payloads with their original types and checks result context; unknown, partially covered, union or recursive spines stay unsupported. String interpolation infers its pieces in order and preserves substitutions and pending constraints. A piece with a known atom aura, unrestricted `@`, or a tape `(list @tD)` is accepted; an isolated decimal literal takes its normal `@ud` default. A known cell reports that it needs a printer, and an explicitly generic atom asks for an aura at its use site. Loobeans, term singletons, non-tape collections, open types and a type fixed only later remain unsupported in this fragment. The Hoon bridge translates imported `*` as the any-noun type, directly or within supported nonrecursive cells. The reader may still decline a disjoint tagged union with a noun payload, and recursive imports containing `*` remain unsupported. It accepts an exact fork of the two loobean singletons as `?`, and each singleton separately as `%.y` or `%.n`, including inside supported faced cells. Contextual loobean literals specialize against a matching singleton by noun, including a proven singleton in a direct union; named loobean singletons do not silently widen to a distinct aura. Open `%f`, other values, and other forks containing loobean singletons remain unsupported; recursive Hoon molds containing flags can also fail closed. A bare tag that provably matches no case of a known union reports the union and tag sites. This covers casts, single-argument calls, contextual unit payloads, list items and supported branch arms, including unnamed imported unions. For syntactic tuples, ordered fit replay can identify a missing tag in a nested position; an earlier mismatch or uncertainty stops the replay instead of guessing. Existing tags whose shape or payload does not fit retain the ordinary mismatch; unresolved tags stay pending. A change can replace uniquely named fields on a fully known, faced record spine, including through a nested wing. Replacements receive the field type as context, substitutions and pending constraints are retained, and the resulting type remains the original record. Missing fields, empty changes and definite replacement mismatches report sites; the expected-type site is the edit, since the original field declaration location is not retained. Unknown or partly unfaced spines, ambiguous fields and repeated edits remain unsupported. A cast to a known record also supplies field context to a tuple or record initializer, including nested list and union fields. The expected-type site is the cast mold; the original field declaration location is not retained. Isolated cart-style `init` and `update` expressions infer in this fragment. The complete cart-store source fails closed because store kind and declaration scope are not yet checked. For supported closed unions, the type printer keeps the union’s origin separate from its displayed name. It prints an in-scope name such as `msg` or `msg.lib`, including in records and gates; an accessible imported nongeneric alias may name a transitive union. A nongeneric body-local union that escapes its scope, or an origin without an accessible name, prints its cases separated by spaces, parenthesized when nested. That case-list form is print-only. A supported generic union prints its name and all arguments, including unused arguments; when its name is unavailable, the partial printer reports that limitation instead of dropping its arguments. Two faces for the same imported origin remain compatible; compatibility between distinct union origins, including in gate types, remains unsupported. Some comparisons of generic union arguments also remain unsupported rather than deciding equality or mismatch. The Hoon bridge also translates some imported unnamed unions into this representation; unsupported cases remain errors. Multi-argument calls form one right-nested sample: `f a b c` supplies `[a [b c]]`, with the last argument able to be a cell itself. The fragment fits the complete sample, preserving known faces and shared variables. Known sample positions can provide list or union context to arguments; unknown sample shapes use ordinary inference and some contextual forms remain unsupported. For a definite mismatch, the diagnostic points to a specific argument when it can establish which one failed; otherwise it reports the combined sample. A list literal can be inferred when a cast or known gate sample supplies a list type and the supplied prelude has the validated standard list definition. Empty, nonempty and nested literals work, including contextual union tags in elements; mismatched elements report the item and expected type. Imported Hoon lists share this representation. Under the same known context, `~` and zero-valued term literals fit an empty list, and a two-item unfaced cell `[head tail]` is a cons; cons cells and list literals can be nested. Mismatched heads or tails report both sites. A known list result also supplies context through complete loobean, unit-shaped and list-shaped branches, including recursive and nested branches. Known loobean result context can propagate through supported complete branches and binder-only cell arms, with a final directional fit; a binder-only arm over a union subject remains unsupported. A known gate with an unresolved result variable can also receive an enclosing result type before its argument is inferred, for example allowing `^- (list @t) (id ~)`; unknown callees and unresolved targets retain the conservative path. A known gate sample supplies context to corresponding positions of a single tuple or record argument, including nested cells; a zero literal can therefore fit a list position. A bound zero constant still remains unsupported rather than a definite mismatch, and an unknown callee does not supply context. Uncontextualized list literals also infer with a fresh element variable, including empty and nested lists; the resulting variable can generalize. Unresolved item tags and uncertain widening remain unsupported. Faced or longer cons cells, and a missing or altered prelude list remain unsupported. For a known standard list with a supported element type, it also infers a complete two-arm branch using `~` and `[item rest]`, in either order. The binders have the element and list types and cannot shadow or duplicate names. Unknown subjects, unsupported element types, other patterns and incomplete arms remain unsupported. A term-headed pair such as `gap+%s2` follows the same contextual inference as `[%gap %s2]`; its synthetic head uses the pair’s span in diagnostics. A backtick constructs a unit when the supplied prelude has the validated standard `unit` template. Its payload is inferred normally, retaining pending literals and generic variables; nested units work and the prelude’s `some` becomes available. With ordinary result annotations, its `bind`, `biff`, `both`, `clap`, `clef` and `flit` also infer. A known unit in a cast, call, list item or record field supplies its payload context, including nested units and lists; definite mismatches identify the payload and context. Unrelated union identities, some variable-dependent fits, and missing or altered prelude templates remain unsupported. A known union of `~` and a null-headed cell can be matched by `~` and `[~ value]` arms in either order. The payload binder is checked for shadowing. Unknown subjects, missing or duplicate arms, and unresolved branch results remain unsupported; this fragment infers the prelude’s `fall` and `need` signatures. The checked inference fragment represents the empty mold `!!` explicitly. A cell with a proven-empty field is empty, while a gate returning `!!` and the empty values of `(list !!)` and `(unit !!)` remain inhabited. Supported union matches discard proven-empty cases, reject unreachable list or unit payload arms, and require a proof of reachability for fixed opaque cases. A written capital may have an inhabited instance; the existing definition-boundary checks still reject forcing it to a concrete empty type. A directly known standard `(list !!)` permits a single null arm, including in a result context. Unknown and opaque types, other one-arm list subjects, and proofs exceeding their budgets fail closed. Emptiness checks use up to 256 type-node visits per fit or list/unit reachability proof and 4,096 visits when filtering union cases. These bounds do not cover substitution walking, parsing, normalization, source lookup or repeated attempts. This is a supported checking slice, not a proof of arbitrary recursive molds or runtime execution. A known closed union with two or more arms can be matched when each arm provably covers or excludes each remaining case. The checker first tries whole cases; when a pattern splits a case, it can expand known `?` positions into their two noun values, up to 64 alternatives across the union. Binders retain the original case type, and one arm may bind several refinements of that case. It reports missing alternatives and arms already covered, checks tags by noun value, and supports imported and generic union cases. Other partial patterns, expansions above the limit, binders spanning distinct cases, differing arm result types and some complex two-arm subjects remain unsupported. When a cast or known call sample supplies a result type, a known union subject accessed by a wing, a grouped wing or a supported shallow call can propagate that context through whole-case arms and supported finite loobean refinements, including nested cell and list positions. Other partial-pattern contexts and subject forms remain unsupported. The Grammar’s `step` block infers in this fragment, but its module is not yet checked. A known closed union can also provide context to each arm of a complete loobean or unit-shaped branch in a cast or a call with a known union sample. Nested branches and transparent groups work; a mismatch reports the expected union and the offending arm. General patterns and context through bodies with local definitions remain unsupported, and unrelated unresolved tags stay pending. The separate `jibb-dev/lib/jibb-import.hoon` is an unfinished reader for selected Hoon type graphs. It handles named recursion, nested map, set, queue, list, unit, jar and jug arguments, direct ordered maps, and direct `$^` unions whose source branches can be proved disjoint. It also recognizes a direct ordered-map call with two simple named mold operands, as in Tlon `notes.log`, after validating provenance and operand source; revisiting the same map hold fails closed. It also reads ordered map fields in records when the map arguments are syntactically fixed atom molds and other fields are fixed atom molds or standard collections of static atom molds. Collection names must not be shadowed. The reader can also import a mark door sample, removing its outer sample face and validating its build subject. For a mark whose sample is exactly a named arm of its single Ford-imported `/sur` core, it can recover a source-proved nonrecursive union, including source-location wrappers around fields; recursive or unverified fallback results remain unsupported. The reader checks explicit Hoon `$%`, `$?` and `$^` unions against the Grammar’s disjointness rule, as @iko confirmed on 2026-10-30. For an explicit `$%` with distinct literal head tags, it can also prove restricted local named payload dependencies, including bare `~` fields, re-evaluate and validate each source branch, and recover the union before Hoon collapses it. The real Tlon `notes.u-note` exercises its `[%deleted ~]` case. A bounded fallback also recovers one level of local named tagged unions inside such a union, including Tlon `notes.u-notebook` and `notes.u-notes`. Source-proved tagged unions can also be wrapped in Hoon `$~` defaults, including a downstream union using Tlon `epic.saga`; the selected source and projected branches still undergo the same provenance and disjointness checks. The tagged-source helper peels up to four consecutive default wrappers, while default wrappers encountered inside dependency proofs consume the existing semantic-node budget. A source-proved nested self-recursive union retains its named owner, including Tlon `notes.import-node`; deeper, mutually recursive or unproven cases stay unsupported. The nested source proof has a 256-visit semantic-node budget, and source-location wrapper peeling is limited to four per node; Hoon evaluation and source scans are not metered. It rejects recursive or computed dependencies, inherited same-name collisions, unsupported nested unions and proofs exceeding a shared 4,096-node budget. It re-evaluates statically recognizable source branches before Hoon can collapse them, checks materialized fork cases, and rejects shapes it cannot prove disjoint. Static records may also have verified standard-collection and `path` siblings. One direct explicit union argument in a standard list, set, map or unit is accepted when its call wrapper and collection provenance are verified and its static cases are pairwise disjoint. A synthetic regression checks that forged wrapper subjects, samples and tails are rejected. Other collection-union forms, nested ordered maps, general source-level disjointness and complete integration with the checker remain unfinished. `+golden-types-imports` can consume fixed-aura atoms, valid term singletons, Hoon's `%n` zero singleton as Jibb `~`, nested faced or unfaced cells, unions of supported, pairwise-disjoint cases, and opaque standard collections with supported arguments from caller-supplied reader results for declared `/-` imports; `+golden-types-with-marks` accepts the same shapes for declared marks. The caller must pass unchanged results from the source-aware reader: the bridge validates the supplied graph but cannot detect source cases Hoon collapsed before that graph was built. The opaque collection types retain their names and arguments for identity, unification and printing. The validated standard prelude `list` mold shares the imported list representation; other Jibb-written collection molds and most prelude collection operations remain unsupported. Other forms remain unsupported. Its disjointness proof is conservative and can reject a valid union it cannot prove disjoint. Collection recognition requires the originating `/sur` core. The reader validates direct zuse subjects and Ford subjects consisting of faced imported cores and a validated tail, checking imported cores transitively; it rejects shadowed names, inconsistent core subjects and other subject shapes. For a recursive reference, the reader matches the exact Hoon hold against named arms in validated cores, including transitive Ford imports; it rejects missing, unlabelled or ambiguous origins. Its fixtures include three real Tlon files; `tools/importer-test` compares the internal projection under eval, and the ship test compares the same golden output. `tools/type-import-test` and `tools/type-mark-test` compare bridge reports under eval and on the ship. `tools/type-tlon-test` and its ship counterpart exercise four real Tlon presence unions and a field read through the source-aware reader and partial checker. `tools/clay-fixtures` also passes Clay-built `/sur` molds and mark samples through the Clay-built importer and partial checker. An import-free Jibb library can export an opaque single-parameter recursive identity when its source has exactly two distinct term-tagged cases: a text leaf and a node containing `(list (name M))`, optionally with one `$-(@t M)` event field. A module-local index records the exact parsed source, defining path and prepared prelude interface; it is shared across that module's inference passes, and its canonical `list` must be source-backed. The normal resolver publishes an interface only after all ordinary mold and value checks succeed. Same-origin aliases retain the defining identity and independently instantiate type arguments; distinct origins remain unsupported. The opaque identity is conservatively treated as gate-bearing for numeric defaulting, and gate-freedom remains unknown. Explicit literal-headed construction uses a source-proven one-layer view: the event result receives the existing type argument and recursive children keep the defining identity. It consumes the existing shared 256-step recursive inference budget, and a per-view 4,096-visit guard bounds the new face and substitution scan; longer scans decline. These bounds do not cover parsing, existing inference, atom sizes or repeated attempts. One startup-inclusive, shared-load comparison of 100 valid and 100 invalid source definitions took 29.67 s wall / 25.14 s user CPU before this slice and 33.47 s / 26.99 s with it; the former declined all 200 while the latter inferred the valid definitions. These single runs are not a production benchmark. Matches over explicit source tags, flat binder or wildcard fields, and nonbinding catch-alls use that same one-layer view and existing binder, coverage and branch checks. Up to 128 arms are screened per attempt; longer matches decline. A single-arm match on a direct in-scope wing can report its missing case, and a contextual one-arm call subject can use a nonbinding catch-all. Recursive children retain their nominal type and arguments. Subject recognition and view validation can each scan substitutions, and the scan cap applies separately to each attempt. In one separate startup-inclusive comparison of 100 valid and 100 invalid source matches, the construction-only checker took 30.18 s wall / 29.31 s user CPU and declined all 200, while the pattern slice took 28.28 s / 27.69 s and inferred or diagnosed them. These single shared-load figures are not production benchmarks. General structural fits, whole-case binders, nested recursive patterns, uncontextualized single-arm call subjects, recursive source with imports and local recursive molds remain unsupported; the test tree does not prescribe the eventual `element` representation. Caller-supplied detached interfaces and caches retain the existing trusted-input contract. Self-recursive `/sur` molds can cross the bridge as opaque module-and-name identities when their supported source-aware graph passes validation, including one-argument lists containing same-origin recursive references. The real Tlon `notes.import-node` reaches this bridge; it does not unfold or construct the recursive type. Aliases, foreign references, recursive marks, unfolding, construction and field access remain unsupported; the partial printer declines recursive names that are not in scope. The partial checker also recognizes a source-proven Jibb recursive mold consisting of `~` and one faced cell with a fixed-aura head and direct self tail. Its identity includes the defining path and name. It unfolds this shape for supported null and cell construction and for a two-arm null/cell match; static application-path literals use the verified public `qath` alias. The internal prelude defines `qath` as a transparent knot sequence and the public prelude re-exports it. Each inference attempt has 256 unfolding and static-segment steps; parsing and separate retries are not bounded by that limit. Dynamic application-path segments, broader patterns and other recursive shapes remain unsupported. Route and static-file existence checks remain milestone 4. Callers that have a `/sur` core and a name can use `+read-named`: it checks for a locally declared arm before asking Hoon to evaluate the mold, and reports evaluation failures with the final Hoon trace line. `+read-mold-in` remains available when the caller already has the selected type. The opt-in `+read-named-diagnostic` and `+read-mark-diagnostic` preserve successful graphs and distinguish definite `%invalid` evidence emitted directly by the reader from `%unsupported` failures. Other failures, including unverified union disjointness and vase recognition based only on a name, remain unsupported. These entry points revalidate and re-walk failed types; the opt-in `+golden-types-with-reader-diagnostics` accepts unchanged structured reader results and reports definite aura, core or proven union-overlap errors at their imported mold use sites, when the import and supplied input are unique. Ordered replay covers direct and nested cell samples, record and function casts, and non-generic same-module aliases; it stops at an unsupported prefix, cycle or shadowing failure. Union molds, generic applications, transitive modules and unsupported reader outcomes still report generic limitations. Replay repeats inference and may add work; this entry point remains partial. Existing checker entry points continue treating failed imports as unsupported. It also fails closed on repeated field faces along an imported record spine, including recursive roots; the diagnostic remains generic. Hoon type graphs can erase unfaced nested-cell boundaries, so the check may conservatively reject a valid source with equal names in distinct erased scopes. Faced nested records and union alternatives keep separate scopes. For supported source-aware Hoon `$?` unions, the reader can prove a definite overlap by independently evaluating and projecting the original cases, verifying each projected head against its source tag, and finding a shared runtime noun in a pair. Its positive witness traverses faces, named nodes, forks, cells, supported atom forms and `*`; `!!`, opaque references, applications and unproved aura intersections cannot themselves establish a witness. It compares singleton noun values independently of aura, and requires inhabited positions throughout a cell. Unknown or exhausted proof remains unsupported, while existing disjoint-source recovery still handles proven distinct cases. The source screen admits at most 128 cases and 4,096 raw noun nodes; dependency checking and the pair/type witness each have their own 4,096-node budget. Hoon evaluation, projected-graph validation, chapter lookup, atom byte sizes and other type-graph walks remain outside those budgets. The error points at the Jibb use; source case locations are unavailable. This is a partial named-reader analysis, not general imported-union checking or a mark-reader overlap diagnostic. In single startup-inclusive runs of eight Hoon reads, a benign three-case union used 37.78 seconds of user CPU with the earlier narrow witness and 39.99 seconds with the structural witness; a repeated-head union used 39.84 and 40.97 seconds. Other checks ran concurrently, so these measurements do not establish a production bound. The partial report can diagnose certain non-gate value dependency cycles, including cycles through gates. It requires an explicit atom or loobean result cast and a syntactically proven dependency group with unshadowed simple samples; it identifies the value and a dependency site. Untyped results, branches, nested definitions, qualified wings and complex samples remain unsupported. The proof constructs an additional dependency graph. One 24-case recursive/generic eval run took 19.7 s with it and 18.6 s before it, including startup; these single runs do not isolate the graph cost. The source-backed `+api-path-analysis-source` is a separate partial analysis, not an API check: it resolves reachable Jibb imports and declared mark graphs and returns path and scry segments, full and diff mark identities and their types. It also checks derived-name collisions. Full and diff payloads must be direct declared mark names; typed scry parameters must be a same-name, same-aura subset of the watch parameters, and unknown or duplicate segment binders fail closed. It creates no request gates. The caller must pass a trusted prepared prelude and unchanged source-aware reader results. `+api-path-evidence-source` retains that analysis with the API source, complete prepared prelude (including reserved names), supplied reader results and resolved Jibb dependency cache. `+api-path-watchability` classifies a unique declaration as watchable or not watchable, or reports unknown when evidence is absent or ambiguous. The artifact and reader results are trusted host inputs; the host must bind them to the source versions used later. This is declaration evidence, not proof about an arbitrary request value, a checked API module, a runtime validator or an island watch. For a unique supported declaration, `+api-request-parts` retains that evidence with the typed path parameters in source order, the full-state reply sample, and a fold type when there is one diff mark. The fold takes the tagged diff and previous full state and returns full state. Missing or ambiguous evidence, unsupported parameter auras and multiple-diff folds fail closed. These are components for a future request gate; they do not yet fix its argument order, construct a request, or prove watchability of a value. `+api-support-analysis-source` additionally infers supported ordinary API molds and values, resolves every declared mark, and retains their source, dependency and path evidence. Unsupported helpers or marks fail closed. An unused `/-` core is not independently validated, ordinary definitions that need derived gates remain unsupported, and this result is not a checked API interface or an exported request. The ordinary import resolver can infer derived request-gate types for multiple supported API paths. A case may take one typed path parameter before its reply gate, or one diff fold after the reply; a case with both, multiple parameters or diffs, or a separate scry path remains unsupported. Each reply maps the full mark type to a fresh `M` and the request result is `(ask M)`. Checked ordinary API values and molds, declared mark molds and a supported poke constructor are exported too. Every selected `/sur` core must have a directly used, successfully read mold; unselected core bindings are not independently validated, and Jibb module imports remain unsupported in this API fragment. The unchanged todo API fits this fragment. A call whose direct result is a known named generic union can receive a matching same-origin, same-arity result context before its arguments are inferred. This retains the ordered generic arguments and existing capital checks; pending tags, recursive or variable-bound origins and unrestricted atom cases remain conservative. Constructor fitting reports unsupported when an unresolved or opaque case could contain the requested tagged head. It keeps definite missing-case errors for proven nonmatching cases, including an explicitly atom-only faced head. The real todo callback `|=%got` can infer when an `(ask msg)` result context fixes its message union; the uncontextualized call remains unsupported. A two-item tuple with an explicit term, null or loobean head can receive payload context from a known union when every alternative is a literal-headed cell and its head noun is unique. The payload must be a direct wing-headed call, optionally grouped, with literal, wing or constructor arguments. The checker first retains the original inference if it already fits; otherwise it tries the contextual path once and fits the selected case and enclosing union. It declines this path if any substitution has a structural root, because a caller may have walked away variable provenance. Duplicate heads, opaque competitors and other shapes also stay conservative. The guard scans the substitution for each eligible tuple and may perform one extra shallow inference; it does not guarantee globally linear work. This lets an explicitly typed todo subscription body infer; it does not check an island or prove request watchability. `+gate-free-type` is a separate three-way proof over normalized checker types: it reports a gate-free result, a gate-bearing witness with its field path, or unknown. It tracks conservative inhabitance before reporting a gate in a cell, spends one shared node budget, and treats opaque recursion, open variables, unknown collection forms and `*` conservatively. Source-proven `qath` and the recognized list/unit representations have dedicated proofs. `+gate-free-mold-source` parses and resolves one named mold with a fresh active-root graph, retaining the complete prepared prelude, source bundle, trusted reader inputs, dependency cache and inferred mold. It caps classification at 256 nodes; parsing, import resolution and type inference are not covered by that cap. The host must canonicalize paths and bind trusted sources and reader results to their versions. API, store and private roots decline; other definitions and unused imported Hoon bindings are not fully checked. This is mold analysis, not a module, kind, island, watchability or runtime check, and it does not infer general gate-free constraints. A full ordinary module may export a narrow checked program `main` only as a direct, unqualified `(program init update view subs)` call with four simple wing arguments, modulo transparent grouping. The canonical prepared prelude must supply both the `program` value and mold. The ordinary source-backed program fit and all normal mold, value and request-graph checks complete first. The inferred `main` must be closed and invariantly match an instantiated `program` mold from that prelude. The initializer must have a closed gate scheme; its data and model contain no open variables and share the existing 256-node gate-free budget, with `%yes` required for both. The named subscription gate must syntactically return null through transparent casts, groups and definition-free bodies. Arbitrary or aliased mains, API/store kinds, gates or unknowns in data/model, and nonempty subscriptions fail closed. This retains source and graph evidence and permits ordinary downstream imports; it neither executes the program nor proves runtime watchability. When only that program's initializer and `main` are unresolved, a bounded transactional retry can derive the initializer's expected gate from the resolved update, view and subscription components. It instantiates all schemes above the greatest variable ID in the module and prelude, reuses the source-backed positional fit and stable replay, and leaves only the initializer's data variable open. The named initializer must be a direct gate whose transparent body is a tuple ending in null. Its own sample fixes data; ordinary inference, product and whole-gate fits, pending-tag and finalization checks, and a fresh ordinary `main` inference must all succeed before the ordinary kind and graph checks publish anything. Aliases, non-main libraries, simultaneous unresolved subscriptions, nonempty subscriptions and unrelated pending tags decline. Each case's canonical API identity and source-derived schema travel across imports in a nonrecursive graph certificate containing the exact source bundle, prelude, reserved scope and trusted reader results. Cached interfaces must match those inputs and cannot hide an active ancestor; unknown legacy entries are rebuilt from their unique supplied source. Request-bearing closures are limited to 256 paths and requests. Closed gate samples can also fit when an unnamed input slot corresponds to a named one, provided products are identical and nested value faces and ambiguous cell tails remain intact. This is type inference only: request lowering, runtime schema validation and value watchability proofs are not implemented. `+golden-types-with-prelude` accepts case-local Jibb module sources alongside `/sur` and mark results and the vendored prelude source. It resolves reachable ordinary library modules in dependency order, caching completed interfaces per invocation and exporting supported closed value schemes, direct generic unions, and simple or nonrecursive generic mold aliases whose bodies the fragment supports. It detects missing sources and cycles and rejects a dependency if its interface cannot be inferred by the fragment. Qualified wings can also read nested fields of an imported value, instantiating that value’s scheme independently at each use; missing, ambiguous and non-record fields remain unsupported. The supplied prelude is parsed into a **partial interface**: all names actually declared in the source are reserved, while only the molds and values this fragment can infer are available. These include the validated standard `list` mold, `unit`, the doc-exact generic `cmd` union, `same`, `fall`, `need`, `bond`, `lure`, `weld`, `snoc`, `turn`, `lent`, `zing`, `flop`, `rear`, `drop`, `skim`, `skip`, `murn`, `join`, `snip`, `levy`, `lien`, `cork`, `corl`, `cury`, `curr`, `lead`, `late`, `trip` and `tuba`; unsupported entries remain unavailable. The validated `list` is injected while the prelude’s gates are inferred; `weld` and `turn` use ordinary explicit result casts. An absent or altered `list` is not injected, and an altered declaration cannot leak through a direct or transitive mold alias. The same validated template is available when prelude mold aliases are prepared, so supported direct and transitive aliases can use it. A named prelude union keeps the fixed `/lib/jibb/prelude/jibb` origin in every module, and its name remains unqualified when a library exports a type containing it. The prelude inventory is incomplete, so reserving the names in this source does not establish complete shadowing coverage. The source-backed internal prelude defines `poke`, which the public prelude re-exports as an ordinary transparent type. A dedicated trusted internal-prelude preparation path also supplies private comparison, arithmetic and text-conversion schemes for the Jibb-written `gth`, `add`, `dec`, `trip` and `tuba` wrappers. Ordinary module resolution rejects that primitive path even if a caller supplies a spoofed root or bundle. The low-level prepared interface is still trusted host input; the host must select the vendored sources and canonicalize paths. Primitive execution and shape-based jet recognition are not implemented. The Jibb-written `lth`, `gte` and `lte` gates compose the source-backed `gth` and `not` gates; supported calls infer a shared atom constraint and return `?`. Their execution and jet recognition await the backend. The source-backed `add` and `dec` wrappers use private arithmetic interfaces whose shared atom variable excludes loobeans; the partial checker preserves that constraint through supported inference and prints `where A is an atom other than ?`. The partial checker resolves the supported `poke` source shape, preserves its public name, and rejects ordinary imports of the private internal path. The Jibb-written `lent` recursively counts a list using `add`; the partial checker infers its generic list argument and `@ud` result. Its execution and jet recognition remain unverified until the backend exists. The Jibb-written `zing` concatenates homogeneous lists in order using `weld`; the checker infers `(list (list A))` to `(list A)`, including for gate elements. Hoon `zing` also accepts heterogeneous noun lists, which this type does not express. `tools/hoon --raw -f tools/testdata/zing-hoon-reference.hoon` compares an equivalent Hoon recursion with Hoon `zing` on selected finite inputs; it does not execute Jibb or verify lowering or jet recognition. The Jibb-written `lead` and `late` are curried pair constructors: `((lead a) b)` returns `[a b]`, while `((late a) b)` returns `[b a]`. The checker infers independent argument types and accepts gates as ordinary values; neither helper invokes an input gate. A Hoon translation is compared with Hoon’s helpers by `tools/hoon --raw -f tools/testdata/lead-late-hoon-reference.hoon`. This does not execute Jibb or verify lowering or jet recognition. An imported API with one mark and a matching direct `+$ poke` declaration can export a derived constructor and retain agent/mark metadata when the source representation has the supported agent case. Other API shapes, complete private module checking, root API and kind checking, stores, complete `ask` and `pure` checking, lowering and runtime effects remain unfinished. A possible store or root API declaring `+$ poke` reports that kind or scope needs unsupported inference; definite duplicate declarations and unrelated shadowing still report conflicts. Prepared interfaces and caches are trusted caller inputs; the future host and linker must ensure the private source validated during preparation is the same version used to lower derived constructors. A `*` payload may contain gates, so the fragment treats it conservatively; full gate-free checks are unfinished. The shared module-scope fixture compares the prepared and source-taking paths against the real prelude and a two-module golden under eval and on the ship. `+prepare-prelude` derives the interface and declared-name inventory from the trusted vendored source. Hosts can reuse its result with `+golden-types-with-prepared-prelude`; they must pass the unchanged result of preparation, not an independently constructed value. Empty, malformed and duplicate-name prelude sources fail closed. The source-taking `+prepare-prelude` and `+golden-types-with-prelude` do not supply the internal module; their `-and-internal` or `-with-internal` variants accept its source for the supported private import. API files, modules with `main`, unsupported definitions and many other features remain outside this subset. The older `+golden-types-with-modules` entry point fails closed for imports because it has no prelude scope. None of these partial reports claims the module has been checked. And the design notes: | Note | Says | | --- | --- | | 1. Positions | Lines and columns count from 1, columns in characters; every token and node has a span, start and end, and the rules a node's span follows | | 2. The layout pass | 2.0 where errors point, then lines, characters, blank lines, levels (INDENT, NEWLINE, DEDENT), the end of the file, tokens and tightness, paths, literals (read with `nuck:so`), strings, and what fails here | | 3. The parser | Why recursive descent (the grammar is LL(2) after the layout pass), the EBNF rule by rule with the node each gives, what the EBNF leaves out and how it's filled in, spacing, and where each error points, with its message | | 4. Printed formats | The token, tree and error formats the golden files hold | Source-backed `like` maps the product of an existing `(like A)` result while retaining its position and remaining input. The partial checker infers supported positional calls by peeling only known sample-slot faces, retaining faces belonging to values; ambiguous variable-bound spines and nested face loss remain unsupported. Backend execution remains outstanding. The internal prelude defines transparent `(ask M)` cases for pure, agent and store requests; the public prelude re-exports it and defines `pure` in Jibb. Preparation supplies the private module with `list.core` and `unit.core` only from validated canonical public templates. If a template is unavailable, an isolated check validates the private molds, but only molds independently inferred against the actual available templates enter the interface. The partial checker infers supported constructors and exhaustive matches; absent versus present-zero state remains distinguishable. Agent and store receiver fields carry raw nouns and cannot prove schema validity or watchability. The public prelude also defines the documented `sub` union in Jibb; supported watch payloads retain the public `(ask M)` type. A `sub` value is not itself proof that its request is watchable. Generated decoders, source-bound runtime validation, request lowering, other derived request shapes and island watch checks remain unfinished. Public prelude preparation is partial: consumers must verify that `ask` was actually exported with its source origin. Public identity aliases of private generic unions retain their public name when the origin, arity and argument order match exactly, including through imported values. Fixed, reordered, repeated and phantom generic aliases remain unsupported where a safe public name cannot be recovered; a fixed nongeneric alias is not printed as though it accepted type arguments. The partial checker reserves `proj` in module, local, sample, pattern and import bindings, including bindings inside unsupported source; a field, tag or path segment may still have that spelling. With a known expected record type, it checks selected explicit `(proj record)` calls over closed, uniquely faced records, preserving the source expression, its type, the result type and field axes in the checked interface. Imported and private-prelude dependencies retain the source needed to lower those plans. The checker does not yet lower or execute them. It supports selecting one or more fields in their original order; a single selected field keeps its face and uses one source axis. Reordered fields, unknown or open record spines, some nested contexts and recursive groups with projections remain unsupported. A directional fit of a wider faced record fails closed instead of inserting a projection, including within supported list, unit and record positions. To limit repeated work, record-spine proofs are reused along the same closed spine and stop at 1,024 fields; field boundaries and the special handling of positional calls reset the appropriate proof. Prepared interfaces and their source remain trusted host inputs. ## The tree Every node is `[%tag at=span …]`, so `+span-of` finds its span in one place; the few that aren't say so in the `%tree` chapter. The kinds of node: - **Module**: imports (`%sur` for `/-`, `%mark` for `/%`, `%jibb` for `/=`), then definitions (`%mold` for `+$`, `%value` for `++`). - **Expressions** (`expr`): `%lit`, `%str`, `%path`, `%qath`, `%wing`, `%change`, `%pair`, `%unit`, `%group`, `%list`, `%tuple`, `%gate-wide`, `%ctor`, `%call`, `%gate`, `%cast`, `%trace`, `%branch`, `%crash`, and `%body` for an indented body, with its local definitions if it has any. - **Molds as written** (`shape`): `%aura`, `%hole`, `%noun`, `%void`, `%flag`, `%const`, `%ref`, `%tvar`, `%path`, `%apply`, `%cell`, `%union`, `%fn`, `%generic`. A `%hole` retains the span of `_`; an inferred typed path segment retains that span separately from its enclosing segment. A `%union` spans its first through last case and has no lead token; a single case is its own mold. `%generic` spans from the `|$` after a `+$` name through its body. - **Samples, fields and patterns**: a sample is `%bind`, `%face`, `%pun`, `%cell` or `%bare`, since a bare name binds anywhere in a sample; a pattern is `%lit`, `%str`, `%any`, `%bind` or `%cell`. - **Literals** (`lit`) keep the form they matched, their aura and value, and their text as written, which the printers show. The parser accepts type holes. The partial checker records each ordinary hole with its span and validates the obligations created in a value or local definition before generalization. A solved concrete type or an explicitly written in-scope capital resolves a hole; a later use cannot repair it. Independent decimal holes may default to `@ud` when the surrounding inferred type is gate-free; variables reachable from the environment or written capitals are protected from premature defaulting. Structural named-mold holes are diagnosed at their source, while complex named molds, inferred path segments, recursive groups with holes and unresolved constraints remain unsupported. Partial prelude and API interfaces cannot silently export unchecked holes. A separate syntax-tree pass reports duplicate names within a written record at both field sites, including in unused definitions; nested and separate records have independent scopes. The tree keeps everything the checker needs to report an error at the code as written: open and closed brackets give the same node, but every node keeps its span. ## Positions and errors - A span runs from a node's first character to just past its last. A node ends where its last token ends, never at a layout token, and holds its children's spans in order. `+check-spans` tests both rules on every tree the golden tests print. - An error is `[file=path line=@ud col=@ud msg=tape]`: a start, no end yet. Milestone 2's type errors need more, since the plan asks that "each error names both conflicting sites, with excerpts". Spans keep their ends for that. - Every error points at the first character where the text stops being the start of any valid module (note 2.0). The layout pass never fails: it ends its tokens with an error token, and the parser reports whichever error comes first, its own or that one. - The parser's messages read "expected , found ", with an optional "; ". The layout pass's state the rule broken, as "a tab: Jibb uses spaces only" or "`|%` is left out: modules are records". None ends with a period, and all start lowercase unless they open with a name, as "Jibb writes no @c literals". `+show-error` prints `::: `, the line, and a caret under the column. ## Printed formats Note 4 has examples of each. - **Tokens**: one per line, `:`, then `tight` if the token follows the previous one on its line with no space between, then its kind and text. - **Trees**: S-expressions, `(kind line:col fields kids)`, with each node's start; a node whose kids are all leaves prints on one line. Past 64 levels the indent stops growing, so the printed tree stays linear in the text's size. - **Errors**: as above. Control characters print as spaces in the excerpt, so the caret stays under its column. ## Tests `tools/golden` runs `+golden` under `urbit eval` on every case and compares `tokens.txt` and `tree.txt`; opted-in cases also compare `+golden-types` with `types.txt`. `tools/ship gen-tests` writes a `-test` arm per case that does the same on the ship. The type output is provisional until the checker can check complete modules and imports. ## Speed Starting `urbit eval` and building the library takes about 8 s. A 2,000-line module of 400 definitions then parses in about a second. Loops over definitions, arms, lines and items are tail calls, so a long module grows no stack; nesting costs a few stack frames a level, and 100,000 nested brackets still parse (note 3). The experimental deferred constructor path can close a small import-free library transaction when ordinary resolution stalls. It retries definitions whose earlier attempts failed from their original states, retaining only successful attempts. A transaction with at most 64 definitions makes at most 4,096 attempts; it stops after a pass with no progress. This bounds the new attempt count, not each attempt's parsing, type walks or ordinary inference. Deferred definitions are restricted to simple one-component wings, literals, static strings, gates, transparent groups and empty bodies, calls, casts and a restricted boolean branch. Each successful call or cast fit must have exactly equal normalized operands so later substitutions cannot invalidate a face check. A multi-argument call also needs closed argument, sample and product types because positional face checks depend on slot boundaries and whether the result can be a cell. Other fits fail closed. A 512-node screen bounds visited expression nodes and a separate 512-node scan bounds each stability check; neither bounds mold shapes, string-piece checks, parsing, normalization, lookup, or total repeated inference. It accepts only a direct constructor callback with a closed input, records its pending fit under the source-owned inference state, and generalizes each definition against the live environment and pending constraints. Before publication it discharges and replays every edge, rejects unresolved tags or changed replay state, and checks that all molds and values are complete. The reporter reads the committed schemes for definitions added by the transaction. API and store paths, `main`, prepared-prelude recovery, imports, recursive groups, unresolved holes or written capitals, and new projection actions remain outside this full-module path. `%grec` in the constraint or freshness scan is conservatively unsupported. This is not an island-kind, runtime, or watchability check. An expected cell type can supply context to both arms of a loobean branch. This slice first retains any ordinary inference that already fits. Otherwise it retries from the original state only when a syntax screen excludes nested branches, casts, gates and local bodies, and a substitution screen excludes structural bindings. Both arms must fit, their normalized results and the expected type must be closed, their result types must match, and both fits must replay without changing the final substitution or fresh-ID counter. A successful retry retains the original arm type and its written faces; a failed retry returns the original inference result. The source and substitution screens each visit at most 512 entries. This permits at most one extra attempt for an eligible branch; the screens do not bound preexisting inference, type walks, list construction, or work across separate analyses. In an isolated diagnostic with the real todo API and reader inputs, this cell context allowed the original update body to infer when its result type was written explicitly and experimental source-defined text helpers were supplied. The unchanged island still needs those text helpers, an actual source-backed `program` and UI interface, context propagation across definitions, island-kind checking and watchability proof. This branch change itself provides no runtime implementation or watchability evidence. A deferred boolean branch must use both distinct literal loobean patterns. Its subject is unified with `?`; the arms are inferred in source order without contextual retry. Equal normalized arm types are retained directly. When both written arms are direct literals that each created their own unbound pending tag, the checker can instead retain two source-owned fit obligations to a shared, monomorphic result variable. A later definition may close that variable; replay uses the ordinary literal fit, requires a closed atomic target or a union of direct constant/cell cases, and rejects faced targets and faced union cases. It replays all edges under the final substitution without adding bindings or fresh IDs. This does not support deferred list literals, union-pattern reachability, arbitrary branch expressions or prepared-prelude/imported modules. It does not establish request watchability. With the caller's unchanged prepared prelude, the partial report can also recover a narrow import-free, non-main ordinary library initializer. A direct tuple literal may retain one source-owned fit obligation for each newly created pending literal until a later exact result cast closes them. A separate bounded candidate screen admits a direct tuple even without a constructor call. The prepared transaction requires exact agreement among the supplied interface, value inventory and reserved molds, and retains the API, store, import and `main` exclusions. It only adds recovered entries to the partial report: the ordinary full-module resolver does not publish them. Wrong unit or draft fields, unrelated pending tags and mold-name collisions fail closed; without the later final cast, the initializer remains not checked. This does not add list-literal deferral or import-aware recovery. Before the no-prepared-prelude fallback, the checker screens the already parsed source for a direct single-constructor call beneath groups, gates, casts or bodies without local definitions. The screen visits at most 64 AST nodes per definition and rejects sources with more than 64 definitions or 65,536 bytes. A transaction is attempted at most once per resolver or report invocation and holds at most 64 pending edges. These limits do not bound the initial parsing, ordinary resolution, normalization, or total work across separate analyses. On the pre-recursive-index snapshot, startup-inclusive synthetic 1,000-gate comparisons had baseline/candidate user times of 25.97/29.30 seconds and 26.30/27.46 seconds in reverse order. These are limited shared-load measurements, not production benchmarks. The trimmed source-backed and direct-guard fixture passed in 28.13 seconds wall and 27.53 seconds user on one run after screening; its cases include parse-success checks in the same transaction source pass. The outer resolver and reporter each parse independently, and a fallback currently parses the source again. A single sequential, startup-inclusive comparison against checkpoint `c96597d` measured user CPU for an unrelated stalled library at 25.04 seconds baseline and 26.32 seconds with the screened fallback; an incompatible constructor took 25.72 and 27.16 seconds; a direct constructor that the baseline declined and the candidate resolved took 24.46 and 26.79 seconds. These are small shared-load measurements, not a production benchmark. The screen was separately checked with a trapping fallback: the unrelated source skipped it, while the eligible conflicting source reached it.