validate

func BodyIsFrameReleasable ¶

func BodyIsFrameReleasable(proc ValidatedBodyAndParams, selfName string, env *environment.EnvironmentFrame) bool

BodyIsFrameReleasable reports whether proc's activation frame may be released to the pool at its tail calls (the OpReleaseEnvFrame optimization — fib-shaped general tail recursion). Unlike OpSelfTailCall it does NOT rebind in place or hardcode a jump: it releases the dead frame and performs a normal apply (which re-resolves the callee). So it needs neither the define's stability nor a self-tail call — only that the body can never expose its frame to a continuation:

• no capture operator in the body (no call/cc &c.),
• no escaping closure, and
• every callee is the self name or a capture-safe, non-rebindable primitive (bodyCalleesAllCaptureSafe) — a callee that could capture would pin the frame.

This is a conservative, per-body approximation of the interprocedural classifier (ClassifyFrameReclaim): it covers self-recursion over capture-safe primitives (fib, tak) but refuses a tail call to another user-defined function (mutual recursion), which the full call graph would admit. Sound either way; the call-graph precision is a later refinement.

func BodyIsSelfTailReusable ¶

func BodyIsSelfTailReusable(
	proc ValidatedBodyAndParams,
	selfName string,
	env *environment.EnvironmentFrame,
) bool

BodyIsSelfTailReusable is the compiler entry point: it builds the production capture-operator identity test from env (hygiene-correct: a locally-shadowed call/cc is not the primitive) and runs the self-tail-reuse safety predicate. selfName is the closure's own bound name as a symbol Key.

NOTE: this is the IN-BODY safety half. The caller must additionally ensure the self BINDING is immutable against cross-unit redefinition — for a top-level define that means IsStable() at the emit site; for a lexical named-let loop the in-body ¬set! this predicate checks is the whole story.

func CallbackIsCaptureSafe ¶

func CallbackIsCaptureSafe(arg ValidatedExpr, env *environment.EnvironmentFrame) bool

CallbackIsCaptureSafe reports whether a callback ARGUMENT at a call site is provably capture-safe — the D2 proof the inline-HOF dispatch (callback specialization Strategy A) requires before inlining a curated tail HOF's reclaiming loop with this callback substituted. Inlining a capturing callback into a frame-reclaiming loop would be a use-after-release, so this answers true only with positive proof; everything uncertain is false (the soundness asymmetry — a false negative merely forgoes the optimization).

Two positive forms:

• a symbol resolving to a binding that is IsCaptureSafe() AND IsStable() — the same gate bodyCalleesAllCaptureSafe applies to a loop's callees: capture-safe (cannot invoke a Scheme procedure, so cannot capture) and stable (not rebindable to something that can), or
• a lambda literal whose body ProcedureBodyIsCaptureSafe proves cannot capture the caller's continuation. selfName is "" — an argument callback is anonymous, so no callee is exempted as a self-recursive tail call.

Anything else — a procedure-invoking, unbound, or rebindable symbol; a lambda that runs a capture operator or a procedure-invoking callee; or a computed operator expression (neither symbol nor lambda) — returns false.

func ClassifyFrameReclaim ¶

func ClassifyFrameReclaim(
	unit []ValidatedExpr,
	env *environment.EnvironmentFrame,
) map[string]bool

ClassifyFrameReclaim returns, for every top-level function define in unit, whether its frame is reclaimable at its tail calls. It is the exported entry point over the Layer-B/C internals: build the call graph, run the greatest-fixpoint mayCapture, and project to a name→verdict map. The verdict is conservative (any uncertainty ⇒ not reclaimable).

Same-unit-define immutability is read from the producer's Stable bit via env.GetBinding(...).IsStable() — the single source of truth, backed by Option-B enforcement (the set!-gate + the cross-unit redefine guard). The tier-(a) vs tier-(b) distinction is therefore a property of WHICH env is passed, not a classifier argument: an env whose same-unit defines are NOT stamped Stable (WithImmutableTopLevel off, or a non-compiled env) yields mutable same-unit edges (tier-(a) behavior); an env whose defines ARE Stable (WithImmutableTopLevel on, compiled) yields immutable edges (tier-(b)).

PRECONDITION: env must be the post-compile env for unit (bindings stamped). An un-stamped (validate-only) env reports IsStable()==false uniformly, yielding the conservative tier-(a) verdict with no diagnostic — sound for the optimizer but a silent artifact for a measurement (guard with a positive control).

func LetBindingSelfTailReusable ¶

func LetBindingSelfTailReusable(v *ValidatedLet, i int, env *environment.EnvironmentFrame) (int, bool)

LetBindingSelfTailReusable reports the arity and eligibility of the i-th binding of a recursively-scoped let (letrec / letrec* / named-let) for in-place self-tail reuse — the local-binding analogue of selfTailForDefine. ok is true iff

• the binding's Init is a lambda whose body is self-tail-reusable on the binding name (bodyIsSelfTailReusable), AND
• the binding name is immutable across the WHOLE let: never set! in any binding init or in the let body.

The second clause is the local immutability story. bodyIsSelfTailReusable only inspects the lambda's own body, but a sibling init or the let body could set! the name, which would make a hardcoded jump-to-pc=0 unsound. A lexical letrec binding cannot be mutated from outside the let, so set!-freedom within the let is sufficient (no IsStable() is needed, unlike a top-level define).

PRECONDITION: the caller must ensure v.Kind is recursive (letrec-family) so the lambda can see itself; in a plain let/let* the name is not in scope in the init.

func ProcedureBodyIsCaptureSafe ¶

func ProcedureBodyIsCaptureSafe(proc ValidatedBodyAndParams, selfName string, env *environment.EnvironmentFrame) bool

ProcedureBodyIsCaptureSafe reports whether CALLING proc can never capture the caller's continuation — the property that lets the frame-reclaim classifier trust proc as a callee. It is exactly bodyCannotCaptureCaller (BodyIsFrameReleasable MINUS the escaping-closure check): a procedure that merely builds and returns a closure does not capture the caller's continuation when called, so it is safe as a callee even though its own frame is not releasable.

The compiler stamps a define's binding CaptureSafe from this verdict (compile_define.go), so a proven-safe Scheme procedure — stdlib (zero?, not) or a user helper — is trusted exactly like a capture-safe primitive, without a hand-maintained whitelist. Conservative on forward references: a callee not yet stamped reads IsCaptureSafe()==false, so proc is left unstamped (sound — a missed stamp only forgoes the optimization).

func WalkBindingRefs ¶

func WalkBindingRefs(
	expr ValidatedExpr,
	visit func(sym *syntax.SyntaxSymbol, role RefRole, depth int),
)

WalkBindingRefs walks expr recursively, calling visit for every *syntax.SyntaxSymbol reference encountered, with its role and closure-nesting depth.

depth is the number of escaping closure boundaries crossed (0 = same closure as expr). Immediately-applied lambdas (ValidatedLambda or ValidatedCaseLambda as the Proc of a ValidatedCall or ValidatedApply) do NOT increment depth, since the closure does not escape.

ValidatedSetBang emits a synthetic RefSetBangTarget visit for its target name, then recurses into its value expression as a normal walk (the value's symbol references appear as RefInBody at the same depth).

Symbols are NEVER yielded with RefInClosureBody; "is this inside a closure?" is the depth > 0 predicate.

Role tagging is shallow: RefInCallProc and RefSetBangTarget are reported only on direct symbol children of the surrounding form. A symbol nested inside a non-leaf call-proc child — for example, the inner `f` and `g` in `((if c f g) x)`, or the inner symbols of `((f x) y)` — is reported as RefInBody, not RefInCallProc. The role describes the slot the symbol IS, not the slot of any enclosing non-symbol expression.

func WalkSubExprs ¶

func WalkSubExprs(expr ValidatedExpr, fn func(child ValidatedExpr, role ChildRole))

WalkSubExprs calls fn for every direct sub-expression of expr, reporting each child's structural role:

• RoleCallProc: the operator of ValidatedCall and ValidatedApply
• RoleClosureBody: body of ValidatedLambda, ValidatedCaseLambda clause, or ValidatedDefine (function form)
• RoleNormal: everything else (arguments, inits, branches, sequence bodies)

ValidatedSetBang: walks only the value expression (RoleNormal). The set! target is mutation (tracked by Mutable), not a reference.

ValidatedSymbol has no children — fn is not called. The caller handles symbols directly before calling WalkSubExprs.