2150594 | plum | pyrossh

git clone https://git.pyrossh.dev/plum

A statically typed, imperative programming language inspired by rust, python

2150594 — Peter John 2026-11-06T14:03:56+05:30

FBIP stage 1: pilot and verdict, and the simpler language plan

Files changed (29) hide show

compiler/lsp/src/completion.rs +6 -0
docs/backlog.md +1 -1
docs/plans/2026-11-06-fbip-stage1.progress.md +28 -0
docs/plans/2026-11-06-fbip-stage1.results.md +130 -0
docs/plans/2026-11-06-fbip.benchmark.md +4 -0
docs/plans/2026-11-06-receiver-functions.review.md +0 -108
docs/plans/2026-11-06-simpler-language.review.md +112 -0
tests/fbip/slice_shapes.plum +197 -0
tests/fbip/uvec.plum +22 -0
tests/fbip/vec.plum +24 -0
tests/fbip/vec_combined.plum +229 -0
tests/fbip/vec_combined_shared.plum +251 -0
tests/fbip/vec_fip.plum +33 -0
tests/fbip/vec_frames.plum +34 -0
tests/fbip/vec_frameslocal.plum +31 -0
tests/fbip/vec_framesmut.plum +34 -0
tests/fbip/vec_generic.plum +27 -0
tests/fbip/vec_helper.plum +26 -0
tests/fbip/vec_listoflists.plum +39 -0
tests/fbip/vec_local.plum +24 -0
tests/fbip/vec_mutfield.plum +29 -0
tests/fbip/vec_nested.plum +27 -0
tests/fbip/vec_readbetween.plum +25 -0
tests/fbip/vec_returned.plum +30 -0
tests/fbip/vec_returned2.plum +31 -0
tests/fbip/vec_shared.plum +31 -0
tests/fbip/vec_statespread.plum +29 -0
tests/fbip/vec_twolists.plum +27 -0
tests/fbip/vec_unique_names.plum +178 -0

compiler/lsp/src/completion.rs CHANGED Viewed

@@ -37,6 +37,7 @@ const KEYWORDS: &[&str] = &[
     "extern",
     "export",
     "abstract",
+    "fip",
     "if",
     "then",
     "else",
@@ -656,4 +657,9 @@ mod tests {
         let t = plum_checker::withFnScope(&f, &[], || paramPlumType(&ast::ParamType::Type(ty("T", vec![]))));
         assert_eq!(t, PlumType::TParam("T".into()));
     }
+    #[test]
+    fn fipIsOfferedAsKeyword() {
+        assert!(keywordItems().iter().any(|i| i.label == "fip"));
+    }
 }

docs/backlog.md CHANGED Viewed

@@ -4,7 +4,7 @@ Open work, in the order the user queued it, plus smaller items found during buil
 ## Planned (in order)
-**Current order (user 2026-11-05):** explicit fn generics (done faa4d7e) → cleanup phase 3b (pass list, positioned errors; running)  → Io primitive + extern methods → move Rust crates under `compiler/` → tooling + scripts moved under compiler/ (done) → cleanup phase 4 (done: node ids, typed codegen, `inferExpr` errors at spans; `docs/plans/2026-11-05-compiler-cleanup-phase4.results.md`) → phases 5 and 6 (done: file splits, type kinds, tests in Plum; `docs/plans/2026-11-05-compiler-cleanup-phase5-6.results.md`) → game engine refactor (done) → FBIP (user approved 2026-11-06; running, stage 1 first) → top-level functions with receivers and module namespaces (`docs/plans/2026-11-06-receiver-functions.review.md`, needs the user's decisions; replaces the "no top-level functions" note) → benchmark (incl. iterator unboxing / niche Option, run C game A/B) → FBIP (stop for user approval) → deterministic sim → kids' games. The items below keep their detail; this line wins on order.
+**Current order (user 2026-11-05):** explicit fn generics (done faa4d7e) → cleanup phase 3b (pass list, positioned errors; running)  → Io primitive + extern methods → move Rust crates under `compiler/` → tooling + scripts moved under compiler/ (done) → cleanup phase 4 (done: node ids, typed codegen, `inferExpr` errors at spans; `docs/plans/2026-11-05-compiler-cleanup-phase4.results.md`) → phases 5 and 6 (done: file splits, type kinds, tests in Plum; `docs/plans/2026-11-05-compiler-cleanup-phase5-6.results.md`) → game engine refactor (done) → FBIP stage 1 (done: switch, proof, `Array.with`, `fip fun`, pilot; `docs/plans/2026-11-06-fbip-stage1.results.md`) → a simpler language, then the rest of FBIP (`docs/plans/2026-11-06-simpler-language.review.md`, needs the user's decisions) → benchmark (incl. iterator unboxing / niche Option, run C game A/B) → deterministic sim → kids' games. The items below keep their detail; this line wins on order.
 1. **Compiler cleanup and architecture** — `docs/plans/2026-11-04-compiler-cleanup.review.md` (written in another session; meant to run after language-restrictions merged). Approved 2026-11-04; running on branch `superlite/compiler-cleanup`, phase 1 first.
    - **Explicit function generics** (user 2026-11-04: right after cleanup phase 2) — functions declare their generics (`fun map[B](...)`) instead of every single capital letter being a generic; allows longer generic names and one-letter concrete types/tags. Grammar change + about 140 signatures in std/examples. Phase 2's "generics by scope" makes this mostly a grammar + signature rewrite.

docs/plans/2026-11-06-fbip-stage1.progress.md ADDED Viewed

@@ -0,0 +1,28 @@
+- start eeaa05c
+Ruling: user approved FBIP, keep mut for shells and imperative scene; took my recommendations on static proof and no ownership types - cost: none
+Ruling: two stages with a gate: compiler parts and a pilot first, 363 call sites only after the pilot shows in-place updates happen - cost: stage 2 planned later
+Ruling: lint --max-task-min 40, predictor history skewed - cost: a task may run long
+Ruling: skip Wave 0 - cost: none
+- unblocked: dispatched T1 at 10:54:34; waiting on fixes: none
+- unblocked: dispatched T2 at 11:06:24; waiting on fixes: none
+- checkpoint T1 87c3bcc7d7 baseline and probes
+- checkpoint T2 c64fbda376 no-fbip switch
+- unblocked: dispatched T3 at 11:12:16; waiting on fixes: none
+- checkpoint T3 8806e4b41e proof: methods and loops
+- unblocked: dispatched T4 prime at 11:31:41; waiting on fixes: T3 review
+- checkpoint T3 f3adc511da proof: methods and loops
+Ruling: T3 review, about 150 hostile programs, found 2 miscompiles (a closure or callable field named like a function), both fixed - cost: none
+Ruling: two more bugs it found go to a fixer rather than the backlog: a miscompile is not left open - cost: one fix round
+- unblocked: dispatched T4 at 11:53:57; waiting on fixes: F-SIMP-1 F-DEF-1
+Ruling: T4 sent back - a separate local-only proof and a public withUnique don't meet the ruling, and would make the pilot fail by construction; rework on the real proof, with the flag on the call and the choice in codegen - cost: one rework round
+Ruling: F-DEF-1 was a phase 4 regression (any boxed default uninlined); fixed, defaultSingleton removed. A default reading a parameter or self is now rejected; it read the caller's local before; no repo program affected - cost: none, but note a language tightening
+Ruling: F-PUR-1 sent to the same fixer: a miscompile is not left open - cost: one fix round
+Ruling: second attack round before T5, because the proof's rules changed again in T4 - cost: one review
+- unblocked: dispatched T5 at 13:15:17; waiting on fixes: none
+- checkpoint T4 9cf601c77c Array.with
+- unblocked: dispatched T5 at 13:17:18; waiting on fixes: none
+- checkpoint T5 0e5261f915 fip fun
+- unblocked: dispatched T6 at 13:40:26; waiting on fixes: none
+- checkpoint T6 d04a22bfa3 pilot and verdict
+Ruling: pilot verdict is stop stage 2 until the proof is per type; the user approved FBIP but stage 2 now depends on a language plan with user decisions, so stop here and ask - cost: FBIP stage 2 waits
+Ruling: no separate final-reviewer for stage 1 - it ran twice on packet-only evidence with no finding; the proof had two attack rounds, about 1650 programs and a fuzzer instead - cost: a skipped process step, on purpose

docs/plans/2026-11-06-fbip-stage1.results.md ADDED Viewed

@@ -0,0 +1,130 @@
+# FBIP stage 1: results and the verdict on stage 2
+Taken 2026-11-06 on master, release build (`cargo build --release -p plum-cli`), `target/release/plum run --lib-path .`. Load average 1.6 to 3.8 during the runs (3.8 at the start, 3.2 at the end). The program clock has 1 ms resolution, so anything under 3 ms is a floor, not a measurement. Differences of 10 to 20 percent are noise.
+## What stage 1 built
+The pieces below are in the tree and are not re-measured here (see the T2 to T5 results):
+* `--no-fbip` on `plum run`, `build`, `test` (`PassOptions.fbip`): no spread or array write is marked unique.
+* A stronger uniqueness proof (`compiler/core/src/uniqueness.rs`): method `self` and receivers, overrides, `x = x.m(..)` hand-over in loops and fields, functions returning their own unique argument, read-only methods.
+* `Array.with(self, i, v) -> Array[T]`: copies unless the call is marked unique, then `Array.withUnique` writes in place.
+* `fip fun`: a compile error, at the spot, when a spread or `Array.with` in it is not proved in place.
+* Aliasing tests in `tests/fbip/` and a differential fuzzer (`tests/fbip/fuzz`).
+T6 adds the pilot: `tests/fbip/vec.plum`, a persistent `struct Vec[T](data: Array[T], size: Int)` with `push`, `set`, `at`, `length`, growing by doubling, in plain Plum with a spread and `Array.with` and nothing else. Twelve shapes (`tests/fbip/vec_<shape>.plum`, each importing `vec.plum`, each with a small checked test and a `main` that times the big size), one combined program of all shapes (`vec_combined.plum`, `vec_combined_shared.plum`), the same on `Slice` (`slice_shapes.plum`), a unique-name copy (`uvec.plum`, `vec_unique_names.plum`) and a `fip fun` version (`vec_fip.plum`).
+## The central finding: names
+The proof keys methods and fields by name across the whole program, and the standard library is part of the program. With the realistic names, `push`, `set`, `data` and `size`, nothing the pilot does is proved in place, in any shape, even the simplest (`v = v.push(i)` on a local). Reasons `--explain-fusion` gave for `Vec.push`, all from std code the program only imports:
+* `push`: a call of `push` from `Str.split` on a `Slice` local (`result`), and calls from std's own `test` blocks on `Array`. The proof resolves `v.push(..)` to every method named `push`, so `Slice.push` and `Array.push` call sites count as callers of `Vec.push` with a value that is not unique.
+* `set`: `Str.byteToStr` calls `out.set(..)` on an `Array`.
+* `data`, `size`: `Slice` has fields of those names (`mut data`, `mut size`), written and passed on. Renaming only `push` and `set` is not enough: `Vec` was still copying on every push. All four names have to differ.
+`at` and `length` do not matter (they never take part in an update).
+Experiment, shape 1, 100,000 pushes (ms): realistic names 1281; `push` renamed only 1290; `set` renamed only 1278; `push`+`set` renamed 1276; `data`+`size`+`at`+`length` renamed 1277; `push`+`set`+`data`+`size` renamed 1; all unique 1.
+So: only unique names work, and stage 2 as planned would fail in practice. A real `Slice`, `Map`, `Set` or `Heap` has to be named `push`, `set`, `data`. Also: the message for the failing case blames the caller (`v` is bound to a value that may be shared), not the name collision. `fip fun push` with the real names fails to compile, correctly, and the error is misleading for the same reason (tests/fbip: the failing text is `not in place: self may be shared by a caller: v is bound to a value that may be shared (call of push from fill)`; `v` is fine).
+## The table of shapes
+Times in ms. "real" = realistic names; "unique" = unique names (`UVec`, `udata`, `upush`, ...). 100,000 pushes per run unless stated; a copying run is quadratic, so 100,000 is what finishes (about 1.3 s). "1M" = 1,000,000 pushes, run only where the unique-name version is proved. `Slice` is the same shape in `slice_shapes.plum` (it mutates in place today; its own file because `Slice.push` shares a name with `Vec.push`). Median of 3 for the 1M columns.
+| # | shape | real: proved? | real ms | unique: proved? | unique ms | unique 1M | Slice 100k | Slice 1M |
+|---|---|---|---|---|---|---|---|---|
+| 1 | local in a loop `v = v.push(i)` | no | 1281 | yes | 1 | 10 | 1 | 7 |
+| 2 | `mut` field, `self.items = self.items.push(x)` | no | 1267 | yes | 1 | 12 | 0-1 | 10 |
+| 3 | field of a nested struct | no | 1251 | yes | 1 | 11 | 1 | 8 |
+| 4 | helper `v = grow(v, i)` | no | 1272 | yes | 1 | 10 | 1 | 7-9 |
+| 5 | generic: `Vec[Int]` and `Vec[Vec2]` | no | 4027 | yes | 2 | 21 | 2 | 15 |
+| 6 | length read between updates | no | 1270 | yes | 1 | 10 | 1 | 7 |
+| 7 | two Vecs in one struct | no | 2586 | yes | 2 | 21 | 1-2 | 15 |
+| 8a | Vec of Vecs, rows built then pushed | no | 47 | no (reason A) | 46 | - | 1 | 10 |
+| 8b | `rows.set(j, rows.at(j).push(i))` | no | (copies the row, inherent) | no | - | - | - | - |
+| 9 | returned from a function, pushed by the caller | no | 1260 | no (reason B) | 1270 | - | 1 | 6 |
+| 9b | returned from a function, only read by the caller | no | 2774 | yes | 2 | - | - | - |
+| 10 | immutable state `S(..s, items: s.items.push(x))` | no | 1264 | no (reason C) | 1274 | - | 1 | 9 |
+| 11 | 20,000 items x 200 frames through a state struct field | no | 22272 | no (reasons C, D) | 22178 | - | 25 | 25 |
+| 11b | same, `Vec` in a local handed through a function | no | 24335 | yes | 31 | - | - | - |
+| 11c | same, `mut` field `w.items = w.items.set(i, ..)` | no | 24590 | no (reasons D, E) | 22270 | - | - | - |
+| 11d | same on a persistent `List`, `l = l.map(..)` | - | - | - | - | - | - | 15-19 |
+| 12 | one value shared on purpose | copies, correct | 0 | copies, correct | 0 | - | - | - |
+Results are the same with `--no-fbip` (the sweep checks the checksums), and the answers in shape 12 hold in every program.
+Reasons the unique-name versions are not proved (verbatim from `--explain-fusion`):
+* A (8a): `row` is passed to method `upush`, which may keep it. The row is a local that is pushed into the outer Vec at its last use. The proof treats passing a value as an argument as possibly keeping it, so `row` stops being unique, and then the `push` calls on `row` fail, and the proof is by name, so the push on the outer Vec fails too.
+* B (9): `v` is bound to a value that may be shared (call of `upush` from run9); a call from make9 passes a unique value. `make9` builds `v` in a loop with `v = v.upush(i)` and returns it, but the caller does not take `make9(n)` as fresh. 9b (the caller only reads, or pushes onto another vec) is proved, so the failure is the caller's later `v = v.upush(..)` on a returned value.
+* C (10, 11): field `items` is passed on without being written back (call of `upush`/`uset` from `step10`/`frame11`). The functional form `State(..s, items: s.items.push(x))` hands the field to a user method inside a spread. The proof accepts `S(..s, f: s.f.with(..))` for the intrinsic `Array.with`, but not the same shape through a user method. Four variants, each in its own program, all failed the same way: a spread through a function, a constructor without a spread, a spread inline in the loop, and a local `v := s.items.push(x)` then `S(items: v, ..)`.
+* D (11, 11c): `v` is stored in field `items` (call of `upush` from run11). Building the Vec in a local and moving it into `World(items: v, ..)` at its last use makes `v` non-unique.
+* E (11c): field `items` may be shared (call of `uset` from frame14), the `mut`-field form, once D has poisoned the field.
+### Poisoning between shapes
+One shared name, one program. Unique names, shapes 1 to 7 (+13 or 15) in one program: all proved, 1 to 3 ms (`vec_unique_names.plum`, in the sweep). Adding any one of these to that program turns every other shape into a copy (1260 to 4000 ms): 8 (a Vec stored in a container), 9, 10, or 12 (a value shared on purpose, a test with `a.push` twice). A single shared use anywhere makes the method copy for every caller; the proof has no per-call-site copy (the header says so). Shape 12 alone is enough, so a program with one undo snapshot or one saved previous state loses in-place everywhere. In the realistic-name program (`vec_combined.plum`) every shape copies.
+### Other observations
+* `bigger := self.data.resize(n)` then `Vec(data: bigger.with(..), ..)` reported `bigger is read after the update` although it is not (growth branch). Chaining `self.data.resize(n).with(..)` is proved; `vec.plum` uses that form. A proof false negative that costs one extra copy per growth.
+* In `plum run` the standard library's `test` blocks are part of the analysis ("a call from test Array ..."). Calls in imported std tests poison names in a program that never runs those tests.
+* Cost where it works: `Vec` in place is 10 ms per 1M pushes against `Slice` 7 ms (1.4x), and 31 ms against 25 ms for 4M indexed updates (shape 11b vs 11).
+* A persistent `List` rebuilt each frame with `l.map(|x| x + 1)` does the 4M updates of shape 11 in 15 to 19 ms, as fast as in-place `Slice` (25 ms). Rebuilding whole collections per frame is already cheap; FBIP only matters for updating or pushing one element of a big collection.
+* 11 copying: 22 s for 4M updates, 5.5 microseconds per update of a 20,000-element Vec (an 8-byte-per-slot copy each time). Updating a handful of elements per frame in a copying Vec is affordable (about 50 microseconds for ten); updating every item is not.
+## `fip fun`
+`tests/fbip/vec_fip.plum`: `FVec` with `fip fun fpush` and `fip fun fset` (unique names) compiles and passes. A caller that holds the vec twice (`b := a; c := a.gpush(2)`) is refused with `type error: not in place: self may be shared by a caller: a is also held by b (call of gpush from keep)` at the call's line and column. That error is useful. The one for collisions is not: with the realistic names `fip fun push` is refused with `v is bound to a value that may be shared (call of push from fill)`, naming a local that is fine instead of the colliding `Slice.push` and `Str.split`. Another early failure while writing the test: `v := fill(20); v = v.fset(3, 99)` is refused (reason B above), correctly but surprisingly.
+## Call sites in std and examples
+Method: `grep -nE '\.(push|pop|set|removeAt|clear|add)\('` over `std` and `examples` `.plum` files, then a script that skips comment lines and splits sites inside `test` blocks from the rest, and classifies the rest by receiver text and method (no type information, so some `set` sites are guesses between `Array.set` and `Map.set`). The earlier figure of 363 was a different pattern; this count is 477 sites, of which 287 are inside `test` blocks (they test the APIs, and are ported with them) and 190 are code:
+| category | sites | would work (with unique names and today's proof) | would not |
+|---|---|---|---|
+| `push` on a local or parameter (a builder: `out := Slice[T](); loop out.push(..); out`) | 68 | most: shape 1/9b. Fail if the result is pushed onto after being returned (shape 9) or if the vec is stored in a container first (8a) | the 9 and 8a cases, an estimate of 10 to 15 sites |
+| Array element write inside a data structure (`self.data.set(..)` in Slice, Map, Deque, Heap, Grid, Scene's sort) | 46 | shape 2: already `self.data = self.data.with(..)` on a `mut` field; but all of these types share field names `data`, `keys`, `buf`, `items`, so need per-type keying; `Slice.slice` shares `data` (see views) | about the same 46 until per-type |
+| scene-node `add` (the mutable tree API `parent.add(child)`) | 30 | not applicable: a tree with shared children | not a collection update |
+| `Map.set` / `Slice.set` | 12 | Map.set returns nothing today; a persistent Map is a separate rewrite | |
+| `pop` / `removeAt` / `clear` (shrinking, return a value) | 11 | need a new API (the removed element and the new collection) | all need a redesign |
+| `push` on a `mut` struct field (`self.mines.push(..)`, `w.orbs.push(..)`) | 10 | shape 2 and 3 | |
+| `canvas.clear` / `io.clear`, math `add`, other | 12 | not collections | |
+| `push` on `self` (collection internals) | 1 | | |
+So of the 190 code sites, about 22 are not collection updates and 30 are the scene tree. Of the other 138 collection updates, about 124 (the builders, `mut`-field pushes and Array writes) are in shapes that work in isolation, and only if per-type keying exists and no shared use of the same collection API exists anywhere in the program; about 25 to 30 of the pushes and all 11 shrinking ops need a changed API or a proof extension. Nearly all of them are at the mercy of the name collision, and every one would be at the mercy of a single shared use.
+## Shared views: `Slice.slice`
+`Slice.slice(i, j)` returns a `Slice` over the same `data` array with a different `start` and `size`; `set` on the view changes the parent. A persistent `Slice` cannot do that: two holders of one array make `data` non-unique, and the proof is by field name, so every `Slice` write would copy. Outside `std/Slice.plum`'s own tests, `.slice(` has one call in std and examples (a `Str.slice` test). `sublist` and `drop` already copy. So the sharing view is not used in real code and a persistent Slice can make `slice` copy (or drop it), losing nothing a program uses. A real read-only view (`SliceView`, borrows the array) would be a separate type with no write methods.
+## Differential and fuzz
+* `target/debug/plum test std examples tests`: 961 passed, 0 failed, 209 files (786 before the plan). With `--no-fbip`, `--no-fusion` and the default, `target/debug/plum test tests/fbip` gives 144 passed, 0 failed, 28 files each.
+* `bash tests/fbip/fuzz/fuzz.sh 1000 1100`: ok=101, diff=0, err=0.
+## VERDICT
+**Stop stage 2 as planned. Go only after fixes, and the fixes are not small.** Porting `Slice`, `Map` and the rest to persistent APIs now would make them slower than today's mutating versions in the cases that matter (22 s for the game-update shape that `Slice` does in 25 ms), because none of the real names are proved.
+The pilot does show the in-place machinery is sound and fast where it applies: with unique names, shapes 1 to 7 and 11b are in place at 1.4x the cost of `Slice`, the answers match with and without `--no-fbip`, and the fuzzer finds nothing. The work is in the proof's reach, not in `Array.with` or `fip fun`.
+Fixes the proof needs, in order of how much they matter:
+1. **Per-type keying.** Without it nothing works under real names. The checker already resolves every method call and field access; record the resolved callee and the field's owner type per `NodeId` and key the proof's tables by (type, method) and (type, field) instead of by name. This also removes std's tests and `Str.split` from the picture. Cost: the checker emits a side table per instantiation, `uniqueness.rs` (about 2,000 lines) changes its `methodIdx` and `fields` keys and its method resolution; the aliasing tests stay valid. The largest single item.
+2. **No poisoning by a shared use.** A shared call site must only make that call site copy. The usual way is a second compiled copy of the method for shared receivers (`push` and `push#shared`), picked per call site by the proof; the cost is code size (each used method up to twice) and a proof that is per call site, not a fixpoint on the method. Without this, one snapshot in a program, which the deterministic simulation (replay, rewind) wants, turns all updates to copies.
+3. **Hand-over forms.** `S(..s, f: s.f.m(..))` through a user method (shape 10, the functional game's form); a unique local moved into a constructor field, an argument or a container at its last use (shapes 8a, 11); a function returning its own unique local counting as fresh to its caller (shape 9). All three are one idea, ownership moves at the last use, and each is a rule in the proof with an aliasing test. Cost: moderate; each form is local to one function.
+4. Smaller: the `bigger.with(..)` false negative; error messages that name the colliding method instead of blaming a local.
+Rough sense of the order: 1 is a week of care, 2 and 3 are each smaller but 2 changes code generation. A stage 2 that ports only `Array`-backed types the engine controls, with unique-looking names, would work today but is exactly the workaround this pilot says real collections cannot use.
+## What this means for removing the imperative scene and `mut`
+Not supported by the numbers, in either direction:
+* `mut` fields and the imperative scene are the only shapes that are fast today under real names (`Slice` at 7 ms per 1M pushes, 25 ms for the 4M-update frame loop). Removing them and returning the next game from `update` would make every collection update go through `Vec`-style code that copies, 22 s in the frame loop, until fixes 1 to 3 land.
+* But the functional style that rebuilds per frame is not the problem. `List.map` per frame does the same 4M updates in 15 to 19 ms, so a game that returns a new world each frame from `update`, built from lists and spreads of small structs, is already fast. What is slow is a big array or map kept across frames and updated at a few indices; those are the shapes the proof does not reach.
+* The scene tree (30 `add` sites) is a mutable tree with shared children whatever the proof does; it is not a candidate for this mechanism.
+Recommendation: keep `mut` and the imperative scene for now, as the approved review plan says. Decide the removal after fixes 1 and 2 and a second pilot that repeats shapes 10 and 11 under real names. If fix 1 turns out larger than expected, an alternative worth weighing is `fip`-checked, explicitly owned collections at the type level instead of a program-wide proof.

docs/plans/2026-11-06-fbip.benchmark.md CHANGED Viewed

@@ -50,3 +50,7 @@ Each probe has a `test` at size 1000 and the sweep covers them.
 | `plum build examples/games/functional/game_state_view.plum -o <scratch>` (release), 3 runs | 0.77, 0.75, 0.75 s |
 | `plum.wasm` for that game | 79,397 bytes |
 | `target/debug/plum test std examples tests` | 61 s wall (83 s user), 786 tests, 178 files, load 5 to 8 |
+## After stage 1 (T6)
+The pilot persistent `Vec` and the same shapes on `Slice` are measured in docs/plans/2026-11-06-fbip-stage1.results.md (`tests/fbip/vec_*.plum`, `tests/fbip/slice_shapes.plum`). Release build, load 1.6 to 3.8. In short: `Slice` 1M pushes 7 ms, persistent `Vec` in place 10 ms with unique names, 1281 ms for 100k pushes (copying) with the realistic names `push`/`data`; per-frame update of 20,000 items for 200 frames: `Slice` 25 ms, `List.map` 15 to 19 ms, copying `Vec` 22 s, in-place `Vec` on a local 31 ms.

docs/plans/2026-11-06-receiver-functions.review.md DELETED Viewed

@@ -1,108 +0,0 @@
-# Top-level functions with receivers: review plan
-**Status:** planned, not approved. Runs after FBIP, because both rewrite the same files. Nothing is built until you say so.
-**Your idea (2026-11-06):** all functions are top level, written `fun Color.toStr(self)`. `primitive` is restricted to the standard library. Functions that need grouping go in their own module.
-## Summary
-Today a method is written inside its type's body, and a group of related functions goes in a `primitive`. This plan gives one way to define a function: always at the top level, with the type in its name when it belongs to one.
-```plum
-enum Color =
-  | Red
-  | Green
-  | Blue
-fun Color.toStr(self) -> Str = match self
-  Red => "Red"
-  Green => "Green"
-  Blue => "Blue"
-```
-Calling code doesn't change: `c.toStr()` still works, and so does everything built on it, such as generics, operators, `for` and overrides. The compiler already lifts nested methods to top-level functions with a receiver type internally, so this is mostly a change to the grammar and the source files.
-## What you will get
-- One way to write a function, and one less level of indentation everywhere.
-- A type's declaration shows only its fields or variants, so it's easy to read at a glance.
-- The definition looks like the call: `fun Vec2.add` and `Vec2.add` read the same way.
-- User code has no `primitive` to learn.
-- Modules do the grouping, like Gleam, which also gives Plum real namespaces.
-## How it looks
-```plum
-struct Vec2(x: Float, y: Float)
-fun Vec2.add(self, o: Vec2) -> Vec2 =      # self: a method, called v.add(o)
-  Vec2(x: self.x + o.x, y: self.y + o.y)
-fun Vec2.unit() -> Vec2 =                  # no self: a static, called Vec2.unit()
-  Vec2(x: 1.0, y: 1.0)
-fun Box[T].map[B](self, f: fn(T) -> B) -> Box[B] =   # generics
-  Box(value: f(self.value))
-override fun Orbs.update(self, dt: Float) = ...      # overrides
-abstract fun Game.draw(self)                         # abstract methods
-fun steer(ship: Ship, dt: Float) -> Ship = ...       # a plain function
-```
-## The real work: modules need to become namespaces
-**This is the main finding, and the biggest part of the plan.** Grouping functions in a module only works if a module has its own names. Today it doesn't: the loader merges every imported file's items into one program, so all names share one global namespace. Two files can't both define `clamp`, as that's a "duplicate declaration" error, and there's no `math.clamp(x)` form. `Math.sqrt` only works today because `Math` is a `primitive`.
-So user code needs something like this:
-```plum
-import app/rules
-fun main(io: Io) =
-  n := rules.clamp(5, 0, 3)
-```
-## What will be built
-| Part | What it does | Size |
-|---|---|---|
-| Module namespaces | `import a/b` gives the name `b`, with `b.f()`, `b.T` and `b.Const`. Two modules can define the same name. Type methods come with their type | L |
-| Receiver syntax | `fun T.m(self)`, statics, generics, `override`, `abstract`, `extern` on `Io`, in the grammar, parser, formatter and LSP | M |
-| Top-level constants | `Vec2.Zero = ...` for a type, and `MaxRetries = 3` for a module (193 constants today, all inside bodies) | S |
-| Migration tool | A script rewrites nested methods to top level. About 1,050 functions: 741 in `std`, 252 in `examples`, 64 in `tests` | M |
-| User primitives | `Config`, `Grid`, `Id`, `Layout`, `Rules`, `Shelf` in the examples become types or modules, and `primitive` outside `std` becomes an error | S |
-| Remove the old form | A method inside a type body becomes a parse error with a pointer to the new form | S |
-| Docs | Language guide and examples | S |
-## Decisions for you
-1. **What about std's namespaces?** `Math`, `Os`, `Http`, `Testing`, `Base64`, `Ui`, `Key`, `Mouse` and `Blend` are `primitive` namespaces in `std`. You said `primitive` stays allowed in `std`, so `Math.sqrt` can stay as is. **I'd convert the plain namespaces to modules too,** keeping `primitive` for what it's truly for, declaring built-ins (`Int`, `Str`, `Io`, `Array`). Then `primitive` means one thing, and users see one model. That changes the case: `import std/math`, then `math.sqrt(x)`. It's more churn, though, and could be a later step.
-2. **Must a method live in the same file as its type?** I'd say yes, like Go: there are no surprise methods from imports, and one file shows all of a type's behaviour. `std/Json` adds `toJson` to `Int`, `Str` and others, so std stays exempt, as it is today.
-3. **How are names imported?** I'd start with `import a/b` then `b.f()`, like Gleam, plus types usable unqualified where the import names them. Does `import std/game/Game` still give plain `Game`, `Key` and `Canvas`? **I'd keep types and enum variants unqualified by import,** since `Game` and `Some` everywhere would otherwise get noisy, and require the module name only for plain functions and constants. Worth a look at real code before settling.
-4. **Free functions in `main`'s file?** You earlier noted the opposite idea, that every function should belong to something. This plan replaces that note: plain functions stay, in modules. I'd also keep `steer(ship, dt)` style rules as plain functions.
-## Risks
-- **Namespaces touch the loader, checker, codegen and LSP.** They're the risky part, since names are assumed global throughout. Internally, the simplest route is to mangle names per module when merging, so later passes stay unchanged.
-- **A large diff.** About 1,050 functions move, so review has to rely on tooling. The check is that example wasm stays byte-identical across the syntax migration, since the syntax changes and the program doesn't.
-- **Self-hosting and FBIP.** The FBIP `fip` keyword has to fit the new form, as `fip fun T.m(self)`, and stage 2's call-site rewrites should land first.
-- **Scattering.** Methods can drift away from their type within a file. `plum format` could keep them together if this becomes annoying.
-## Out of scope
-Package management, visibility (`pub`/private), and multi-file types.
-## How we will know it works
-- Wasm is byte-identical before and after the syntax migration, on every example.
-- Two modules can define the same function name and both work.
-- All tests pass, and the docs show one form only.
-- `primitive` outside `std` and a method inside a type body each give a clear error.
-## Rough time and cost
-Two builds. Namespaces first, about 6 to 8 tasks, then receiver syntax and migration, about 5 to 6 tasks. Could land in either order, but namespaces first lets the migration move grouped functions straight into modules.

docs/plans/2026-11-06-simpler-language.review.md ADDED Viewed

@@ -0,0 +1,112 @@
+# A simpler language: review plan
+**Status:** waiting for your decisions. Nothing here is built. This replaces the receiver-functions plan, whose `fun Orb.update(self)` syntax you rejected.
+**Evidence:** FBIP stage 1 results, docs/plans/2026-11-06-fbip-stage1.results.md.
+## Summary
+Remove inheritance, two of the three scene styles, and `primitive` namespaces from user code. Give Plum real modules. Make games plain structs. Then finish FBIP, which gets much simpler once inheritance is gone.
+The pilot showed that FBIP can't go ahead as planned: the in-place proof works by name across the whole program, so a collection with ordinary names like `push` and `data` is never updated in place. That makes the work here a prerequisite, not just a tidy-up.
+## What a game looks like
+Methods stay indented under their type. Plain functions and constants live at the module level.
+```plum
+import std/game/gfx
+import std/game/input
+import std/game/scene
+ArenaW = 800.0
+struct Ship(x: Float, vx: Float) =
+  fun update(self, ax: Float, dt: Float) -> Ship =
+    Ship(..self, x: clamp(self.x + self.vx * dt, ArenaW), vx: self.vx + ax * 300.0 * dt)
+  fun render(self, sheet: Texture) -> Node =
+    Sprite(tex: sheet, x: self.x, y: 300.0, w: 32.0, h: 32.0)
+struct OrbRun(ship: Ship, sheet: Texture) =
+  fun update(self, io: Io, dt: Float) -> OrbRun =
+    OrbRun(..self, ship: self.ship.update(input.axis(io, Key.Left, Key.Right), dt))
+  fun draw(self, io: Io) =
+    gfx.clear(io, Color.Black)
+    self.ship.render(self.sheet).draw(io)
+fun clamp(v: Float, max: Float) -> Float =
+  v.max(0.0).min(max)
+fun main(io: Io) -> OrbRun =
+  OrbRun(ship: Ship(x: 0.0, vx: 0.0), sheet: gfx.loadTexture(io, "sprites.png"))
+```
+A game is any type with `update` and `draw`, found by duck typing, as with Ebiten.
+## What will be built
+In this order, because each step makes the next one easier.
+| Step | Part | What it does | Size |
+|---|---|---|---|
+| 1 | Plain games | Any type with `update` and `draw` is a game, and `update` returns the next one. Ports every game and fixture | M |
+| 1 | One scene style | Remove `std/game/imperative` and `std/game/pure` (about 2,250 lines) and their examples. State-and-view stays, as `std/game/scene` | M |
+| 2 | No inheritance | Remove `abstract`, `override` and struct embedding: `embeds.rs`, subtyping, most of `ctors.rs`, override dispatch | L, mostly deletion |
+| 3 | Modules | `import a/b` gives `b.f()` and `b.Const`. Two modules can reuse a name. Module-level constants. `extern` on module-level functions, with `io` first. `primitive` only for std's built-ins | L |
+| 4 | Syntax | The changes in decision 3 below | M |
+| 5 | Proof by type | The proof uses the checker's types, so `Vec.push` and `Slice.push` are separate. With no overrides, every call has exactly one target | L |
+| 6 | Last-use moves | A local moved into a field or returned counts as handed over: `S(..s, f: s.f.push(x))` through a method, and a returned unique local | M |
+| 7 | Shared and unique callers | One shared call no longer turns every call into a copy, by compiling a second version of the function | M |
+| 8 | FBIP stage 2 | Run the pilot again. If it passes, port `Slice`, `Map`, `Buffer`, `Deque` and the rest | L |
+## What the pilot measured
+20,000 items updated for 200 frames, through a state struct field, on a release build:
+| Version | Time |
+|---|---|
+| Today's `Slice` with `mut` | 25 ms |
+| A persistent `List`, `l = l.map(..)` | 15 to 19 ms |
+| A pilot `Vec` in a local, proved in place | 31 ms |
+| A pilot `Vec` in a state struct field, copying because the proof fails | 22,000 ms |
+Two things follow:
+- **In-place works when it's proved,** close to `Slice`. When it isn't proved, it's about 900 times slower. That's the risk `fip fun` exists to catch.
+- **A persistent `List` is already fast, even faster than `Slice`.** The state-and-view style holds lists, so games using it are safe now, before any of steps 5 to 8.
+## Decisions for you
+1. **Remove inheritance?** Recommended. It costs little in features (enums and structs of functions cover it), and it removes most of the difficulty in the proof.
+2. **Remove the imperative scene?** Recommended. If you'd rather keep a tree of objects you can change, the alternative is to keep it, written with `mut` fields and enums.
+3. **Which syntax changes?**
+   - **Block `if` as an expression, and no `return`.** Recommended, the most valuable and the most disruptive. Fusion skips any function with an early `return`, so this turns the optimiser on everywhere. `?` stays. Returning from inside a loop would need `fold` or a helper.
+   - **`self.items .= push(x)`** for `self.items = self.items.push(x)`. Recommended.
+   - **`State(..s, ship.x: 1.0)`**, paths in a spread. Recommended, because binding a field to a variable blocks the proof.
+   - `consume`, a move marker: only if steps 5 to 7 leave a real gap.
+4. **Should std's namespaces become modules?** `Math.sqrt` becomes `math.sqrt`, and so on. Recommended, so `primitive` means one thing: declaring a built-in.
+5. **How are names imported?** Recommended: types and enum variants are unqualified, and functions and constants use the module name: `Texture`, `Some`, but `gfx.rect`.
+6. **Remove `mut`?** Later. It becomes possible after step 8, if the shells no longer need it. Decide then, with numbers.
+## Risks
+- **Silent copies are the top risk.** A shape the proof misses is about 900 times slower, with no error. `--explain-fusion` shows it and `fip fun` makes it an error, but a game that doesn't use `fip` just gets slow.
+- **Steps 5 to 7 may not cover real game code.** The pilot re-run at step 8 decides that, and `List` remains a fast fallback either way.
+- **Wrong proofs are silent bugs.** Each proof change gets the same attack as stage 1: hostile programs and the fuzzer in `tests/fbip/fuzz`, compared against `--no-fbip`. That found four real miscompiles in stage 1.
+- **Losing the object model.** People from libGDX or Unity lose a familiar style, and very large worlds rely on fusion. Measure `stress_scene` and `stress_world` at step 1.
+- **Modules touch every pass,** since names are assumed global throughout. Mangling names per module while merging keeps later passes unchanged.
+## Out of scope
+Package management, visibility (`pub`/private), multi-touch, and splitting `Io`.
+## How we will know it works
+- Each step keeps all tests green, compared against a recorded baseline.
+- The pilot's table passes with realistic names, in particular a state struct field.
+- `stress_scene` and `stress_world` are no slower than today, on a quiet machine.
+- The compiler is smaller at the end than now.
+## Rough time and cost
+Large, but steps 1 and 2 are mostly deletion. Each step is its own build and can be stopped at. Steps 1 to 4 are worth having even if FBIP stops there.

tests/fbip/slice_shapes.plum ADDED Viewed

@@ -0,0 +1,197 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/Slice
+import std/List
+import std/game/Vec2
+# The comparison for tests/fbip/vec_*.plum: the same twelve shapes on `Slice`, which mutates in place
+# today (`push`, `putAt`), and the per-frame update on a persistent `List` (`List.map`). Same
+# checksums as the Vec versions. Kept in its own file because `Slice.push` and `Vec.push` share a
+# name, which the uniqueness proof cannot tell apart.
+fun s1(n: Int) -> Int =
+  v := Slice[Int]()
+  for i := range n
+    v.push(i)
+  v.length() + v.at(n - 1) + v.at(n / 2)
+struct Bag2(items: Slice[Int], mut count: Int) =
+  fun add(self, x: Int) -> Unit =
+    self.items.push(x)
+    self.count = self.count + 1
+fun s2(n: Int) -> Int =
+  b := Bag2(items: Slice[Int](), count: 0)
+  for i := range n
+    b.add(i)
+  b.items.length() + b.items.at(n - 1) + b.count
+struct Inner3(items: Slice[Int])
+struct Outer3(inner: Inner3, tag: Int)
+fun s3(n: Int) -> Int =
+  o := Outer3(inner: Inner3(items: Slice[Int]()), tag: 5)
+  for i := range n
+    o.inner.items.push(i)
+  o.inner.items.length() + o.inner.items.at(n - 1) + o.tag
+fun grow4(v: Slice[Int], x: Int) -> Slice[Int] =
+  v.push(x * 2)
+  v
+fun s4(n: Int) -> Int =
+  v := Slice[Int]()
+  for i := range n
+    v = grow4(v, i)
+  v.length() + v.at(n - 1)
+fun s5(n: Int) -> Int =
+  a := Slice[Int]()
+  b := Slice[Vec2]()
+  for i := range n
+    a.push(i)
+    b.push(Vec2(x: Float(i), y: 1.0))
+  r := a.length() + b.length() + a.at(n - 1)
+  if b.at(n - 1).x == Float(n - 1) then r else 0 - 1
+fun s6(n: Int) -> Int =
+  v := Slice[Int]()
+  for i := range n
+    len := v.length()
+    v.push(len)
+  v.length() + v.at(n - 1)
+struct Pair7(xs: Slice[Int], ys: Slice[Int])
+fun s7(n: Int) -> Int =
+  p := Pair7(xs: Slice[Int](), ys: Slice[Int]())
+  for i := range n
+    p.xs.push(i)
+    p.ys.push(i * 2)
+  p.xs.length() + p.ys.length() + p.xs.at(n - 1) + p.ys.at(n - 1)
+fun s8(n: Int) -> Int =
+  rows := Slice[Slice[Int]]()
+  for r := range n / 10
+    row := Slice[Int]()
+    for c := range 10
+      row.push(r * 10 + c)
+    rows.push(row)
+  rows.length() + rows.at(n / 10 - 1).at(9)
+fun make9(n: Int) -> Slice[Int] =
+  v := Slice[Int]()
+  for i := range n
+    v.push(i)
+  v
+fun s9(n: Int) -> Int =
+  v := make9(n)
+  for i := range n
+    v.push(i + n)
+  v.length() + v.at(2 * n - 1)
+struct State10(items: Slice[Int], tick: Int)
+fun step10(s: State10, x: Int) -> State10 =
+  s.items.push(x)
+  State10(..s, tick: s.tick + 1)
+fun s10(n: Int) -> Int =
+  s := State10(items: Slice[Int](), tick: 0)
+  for i := range n
+    s = step10(s, i)
+  s.items.length() + s.items.at(n - 1) + s.tick
+struct World11(items: Slice[Int], frame: Int)
+fun frame11(w: World11, n: Int) -> World11 =
+  for i := range n
+    w.items.putAt(i, w.items.takeAt(i) + 1)
+  World11(..w, frame: w.frame + 1)
+fun s11(n: Int, frames: Int) -> Int =
+  v := Slice[Int]()
+  for i := range n
+    v.push(0)
+  w := World11(items: v, frame: 0)
+  for f := range frames
+    w = frame11(w, n)
+  w.items.at(0) + w.items.at(n - 1) + w.frame
+# the persistent alternative to Slice: a List, rebuilt each frame by `map`
+fun s11list(n: Int, frames: Int) -> Int =
+  l: List[Int] := Nil
+  for i := range n
+    l = Cons(head: 0, tail: l)
+  for f := range frames
+    l = l.map(|x| x + 1)
+  l.at(0) + l.at(n - 1) + frames
+fun main(io: Io) =
+  n := 100000
+  t := Time.now(io).toMillis()
+  r := s1(n)
+  u := Time.now(io).toMillis()
+  io.printLn("slice shape 1 result={r} ms={u - t}")
+  t = Time.now(io).toMillis()
+  r = s2(n)
+  u = Time.now(io).toMillis()
+  io.printLn("slice shape 2 result={r} ms={u - t}")
+  t = Time.now(io).toMillis()
+  r = s3(n)
+  u = Time.now(io).toMillis()
+  io.printLn("slice shape 3 result={r} ms={u - t}")
+  t = Time.now(io).toMillis()
+  r = s4(n)
+  u = Time.now(io).toMillis()
+  io.printLn("slice shape 4 result={r} ms={u - t}")
+  t = Time.now(io).toMillis()
+  r = s5(n)
+  u = Time.now(io).toMillis()
+  io.printLn("slice shape 5 result={r} ms={u - t}")
+  t = Time.now(io).toMillis()
+  r = s6(n)
+  u = Time.now(io).toMillis()
+  io.printLn("slice shape 6 result={r} ms={u - t}")
+  t = Time.now(io).toMillis()
+  r = s7(n)
+  u = Time.now(io).toMillis()
+  io.printLn("slice shape 7 result={r} ms={u - t}")
+  t = Time.now(io).toMillis()
+  r = s8(n)
+  u = Time.now(io).toMillis()
+  io.printLn("slice shape 8 result={r} ms={u - t}")
+  t = Time.now(io).toMillis()
+  r = s9(n / 2)
+  u = Time.now(io).toMillis()
+  io.printLn("slice shape 9 result={r} ms={u - t}")
+  t = Time.now(io).toMillis()
+  r = s10(n)
+  u = Time.now(io).toMillis()
+  io.printLn("slice shape 10 result={r} ms={u - t}")
+  t = Time.now(io).toMillis()
+  r = s11(20000, 200)
+  u = Time.now(io).toMillis()
+  io.printLn("slice shape 11 result={r} ms={u - t}")
+  t = Time.now(io).toMillis()
+  r = s11list(20000, 200)
+  u = Time.now(io).toMillis()
+  io.printLn("list map shape 11 result={r} ms={u - t}")
+test "slice shapes agree with the vec shapes"
+  assert s1(1000) == 2499
+  assert s2(1000) == 2999
+  assert s3(1000) == 2004
+  assert s4(1000) == 2998
+  assert s5(1000) == 2999
+  assert s6(1000) == 1999
+  assert s7(1000) == 4997
+  assert s8(1000) == 1099
+  assert s9(500) == 1000 + 999
+  assert s10(1000) == 2999
+  assert s11(50, 5) == 15
+  assert s11list(50, 5) == 15

tests/fbip/uvec.plum ADDED Viewed

@@ -0,0 +1,22 @@
+import std/Int
+import std/Array
+import std/Slice
+# FBIP pilot, the unique-name copy of vec.plum: `udata`, `usize`, `upush`, `uset`, `uat`, `ulen`, names no std
+# type uses, so the proof can see this type alone. Same code otherwise. Used by vec_unique_names.plum.
+struct UVec[T](udata: Array[T], usize: Int) =
+  fun init() -> UVec[T] = UVec(udata: Array[T]().resize(0), usize: 0)
+  fun upush(self, v: T) -> UVec[T] =
+    if self.usize < self.udata.length()
+      UVec(..self, udata: self.udata.with(self.usize, v), usize: self.usize + 1)
+    else
+      UVec(udata: self.udata.resize(if self.usize == 0 then 8 else self.usize * 2).with(self.usize, v), usize: self.usize + 1)
+  fun uset(self, i: Int, v: T) -> UVec[T] =
+    UVec(..self, udata: self.udata.with(i, v))
+  fun uat(self, i: Int) -> T = self.udata.get(i)
+  fun ulen(self) -> Int = self.usize

tests/fbip/vec.plum ADDED Viewed

@@ -0,0 +1,24 @@
+import std/Int
+import std/Array
+import std/Slice
+# FBIP pilot: a persistent vector written only in Plum, with the realistic names a real
+# collection would use (`data`, `size`, `push`, `set`, `at`, `length`). `push` and `set` return the
+# new vector; they update in place only when the compiler proves nobody else holds the old one.
+# Shapes that use it: tests/fbip/vec_*.plum. Results: docs/plans/2026-11-06-fbip-stage1.results.md.
+struct Vec[T](data: Array[T], size: Int) =
+  fun init() -> Vec[T] = Vec(data: Array[T]().resize(0), size: 0)
+  fun push(self, v: T) -> Vec[T] =
+    if self.size < self.data.length()
+      Vec(..self, data: self.data.with(self.size, v), size: self.size + 1)
+    else
+      Vec(data: self.data.resize(if self.size == 0 then 8 else self.size * 2).with(self.size, v), size: self.size + 1)
+  fun set(self, i: Int, v: T) -> Vec[T] =
+    Vec(..self, data: self.data.with(i, v))
+  fun at(self, i: Int) -> T = self.data.get(i)
+  fun length(self) -> Int = self.size

tests/fbip/vec_combined.plum ADDED Viewed

@@ -0,0 +1,229 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/game/Vec2
+import tests/fbip/vec
+# Every shape in one program, to see whether one shape's calls poison another's.
+# Shape 1: a Vec in a local, `v = v.push(i)` in a loop.
+fun run1(n: Int) -> Int =
+  v := Vec[Int]()
+  for i := range n
+    v = v.push(i)
+  v.length() + v.at(n - 1) + v.at(n / 2)
+# Shape 2: a `mut` field of a struct, `self.items = self.items.push(x)` in a method.
+struct Bag2(mut items: Vec[Int], mut count: Int) =
+  fun add(self, x: Int) -> Unit =
+    self.items = self.items.push(x)
+    self.count = self.count + 1
+fun run2(n: Int) -> Int =
+  b := Bag2(items: Vec[Int](), count: 0)
+  for i := range n
+    b.add(i)
+  b.items.length() + b.items.at(n - 1) + b.count
+# Shape 3: a Vec in a field of a nested struct, `o.inner.items = o.inner.items.push(i)`.
+struct Inner3(mut items: Vec[Int])
+struct Outer3(inner: Inner3, tag: Int)
+fun run3(n: Int) -> Int =
+  o := Outer3(inner: Inner3(items: Vec[Int]()), tag: 5)
+  for i := range n
+    o.inner.items = o.inner.items.push(i)
+  o.inner.items.length() + o.inner.items.at(n - 1) + o.tag
+# Shape 4: a helper that takes the Vec and returns it, `v = grow(v, i)`.
+fun grow4(v: Vec[Int], x: Int) -> Vec[Int] = v.push(x * 2)
+fun run4(n: Int) -> Int =
+  v := Vec[Int]()
+  for i := range n
+    v = grow4(v, i)
+  v.length() + v.at(n - 1)
+# Shape 5: Vec[Int] and Vec[Vec2] in one program.
+fun run5(n: Int) -> Int =
+  a := Vec[Int]()
+  b := Vec[Vec2]()
+  for i := range n
+    a = a.push(i)
+    b = b.push(Vec2(x: Float(i), y: 1.0))
+  r := a.length() + b.length() + a.at(n - 1)
+  if b.at(n - 1).x == Float(n - 1) then r else 0 - 1
+# Shape 6: the length is read between updates, `n := v.length(); v = v.push(n)`.
+fun run6(n: Int) -> Int =
+  v := Vec[Int]()
+  for i := range n
+    len := v.length()
+    v = v.push(len)
+  v.length() + v.at(n - 1)
+# Shape 7: two Vecs in one struct, both pushed.
+struct Pair7(mut xs: Vec[Int], mut ys: Vec[Int])
+fun run7(n: Int) -> Int =
+  p := Pair7(xs: Vec[Int](), ys: Vec[Int]())
+  for i := range n
+    p.xs = p.xs.push(i)
+    p.ys = p.ys.push(i * 2)
+  p.xs.length() + p.ys.length() + p.xs.at(n - 1) + p.ys.at(n - 1)
+# Shape 8: a Vec of Vecs. 8a builds rows and pushes them; 8b pushes onto a row stored in the outer Vec (`rows = rows.set(j, rows.at(j).push(i))`).
+fun run8(n: Int) -> Int =
+  rows := Vec[Vec[Int]]()
+  for r := range n / 10
+    row := Vec[Int]()
+    for c := range 10
+      row = row.push(r * 10 + c)
+    rows = rows.push(row)
+  rows.length() + rows.at(n / 10 - 1).at(9)
+fun run8b(n: Int) -> Int =
+  rows := Vec[Vec[Int]]()
+  for r := range 10
+    rows = rows.push(Vec[Int]())
+  for i := range n
+    j := i % 10
+    rows = rows.set(j, rows.at(j).push(i))
+  rows.at(0).length() + rows.at(9).at(n / 10 - 1)
+# Shape 9: built by one function, returned, then pushed by the caller.
+fun make9(n: Int) -> Vec[Int] =
+  v := Vec[Int]()
+  for i := range n
+    v = v.push(i)
+  v
+fun run9(n: Int) -> Int =
+  v := make9(n)
+  for i := range n
+    v = v.push(i + n)
+  v.length() + v.at(2 * n - 1)
+# Shape 10: an immutable state struct, `State(..s, items: s.items.push(x))`, in a step function.
+struct State10(items: Vec[Int], tick: Int)
+fun step10(s: State10, x: Int) -> State10 =
+  State10(..s, items: s.items.push(x), tick: s.tick + 1)
+fun run10(n: Int) -> Int =
+  s := State10(items: Vec[Int](), tick: 0)
+  for i := range n
+    s = step10(s, i)
+  s.items.length() + s.items.at(n - 1) + s.tick
+# Shape 11: a game-like update, every item of a 20,000-item Vec updated per frame, through a struct field of an immutable state, for many frames.
+struct World11(items: Vec[Int], frame: Int)
+fun frame11(w: World11, n: Int) -> World11 =
+  for i := range n
+    w = World11(..w, items: w.items.set(i, w.items.at(i) + 1))
+  World11(..w, frame: w.frame + 1)
+fun run11(n: Int, frames: Int) -> Int =
+  v := Vec[Int]()
+  for i := range n
+    v = v.push(0)
+  w := World11(items: v, frame: 0)
+  for f := range frames
+    w = frame11(w, n)
+  w.items.at(0) + w.items.at(n - 1) + w.frame
+fun main(io: Io) =
+  t1 := Time.now(io).toMillis()
+  r1 := run1(100000)
+  u1 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 1 result={r1} ms={u1 - t1}")
+  t2 := Time.now(io).toMillis()
+  r2 := run2(100000)
+  u2 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 2 result={r2} ms={u2 - t2}")
+  t3 := Time.now(io).toMillis()
+  r3 := run3(100000)
+  u3 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 3 result={r3} ms={u3 - t3}")
+  t4 := Time.now(io).toMillis()
+  r4 := run4(100000)
+  u4 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 4 result={r4} ms={u4 - t4}")
+  t5 := Time.now(io).toMillis()
+  r5 := run5(100000)
+  u5 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 5 result={r5} ms={u5 - t5}")
+  t6 := Time.now(io).toMillis()
+  r6 := run6(100000)
+  u6 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 6 result={r6} ms={u6 - t6}")
+  t7 := Time.now(io).toMillis()
+  r7 := run7(100000)
+  u7 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 7 result={r7} ms={u7 - t7}")
+  t8 := Time.now(io).toMillis()
+  r8 := run8(100000) + run8b(2000)
+  u8 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 8 result={r8} ms={u8 - t8}")
+  t9 := Time.now(io).toMillis()
+  r9 := run9(50000)
+  u9 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 9 result={r9} ms={u9 - t9}")
+  t10 := Time.now(io).toMillis()
+  r10 := run10(100000)
+  u10 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 10 result={r10} ms={u10 - t10}")
+  t11 := Time.now(io).toMillis()
+  r11 := run11(20000, 200)
+  u11 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 11 result={r11} ms={u11 - t11}")
+test "vec local"
+  assert run1(1000) == 2499
+test "vec mutfield"
+  assert run2(1000) == 2999
+test "vec nested"
+  assert run3(1000) == 2004
+test "vec helper"
+  assert run4(1000) == 2998
+test "vec generic"
+  assert run5(1000) == 2999
+test "vec readbetween"
+  assert run6(1000) == 1999
+test "vec twolists"
+  assert run7(1000) == 4997
+test "vec listoflists"
+  assert run8(1000) == 1099
+test "vec listoflists (2)"
+  assert run8b(1000) == 100 + 999
+test "vec returned"
+  assert run9(500) == 1000 + 999
+test "vec statespread"
+  assert run10(1000) == 2999
+test "vec frames"
+  assert run11(50, 5) == 15

tests/fbip/vec_combined_shared.plum ADDED Viewed

@@ -0,0 +1,251 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/game/Vec2
+import tests/fbip/vec
+# Every shape in one program, to see whether one shape's calls poison another's.
+# Shape 1: a Vec in a local, `v = v.push(i)` in a loop.
+fun run1(n: Int) -> Int =
+  v := Vec[Int]()
+  for i := range n
+    v = v.push(i)
+  v.length() + v.at(n - 1) + v.at(n / 2)
+# Shape 2: a `mut` field of a struct, `self.items = self.items.push(x)` in a method.
+struct Bag2(mut items: Vec[Int], mut count: Int) =
+  fun add(self, x: Int) -> Unit =
+    self.items = self.items.push(x)
+    self.count = self.count + 1
+fun run2(n: Int) -> Int =
+  b := Bag2(items: Vec[Int](), count: 0)
+  for i := range n
+    b.add(i)
+  b.items.length() + b.items.at(n - 1) + b.count
+# Shape 3: a Vec in a field of a nested struct, `o.inner.items = o.inner.items.push(i)`.
+struct Inner3(mut items: Vec[Int])
+struct Outer3(inner: Inner3, tag: Int)
+fun run3(n: Int) -> Int =
+  o := Outer3(inner: Inner3(items: Vec[Int]()), tag: 5)
+  for i := range n
+    o.inner.items = o.inner.items.push(i)
+  o.inner.items.length() + o.inner.items.at(n - 1) + o.tag
+# Shape 4: a helper that takes the Vec and returns it, `v = grow(v, i)`.
+fun grow4(v: Vec[Int], x: Int) -> Vec[Int] = v.push(x * 2)
+fun run4(n: Int) -> Int =
+  v := Vec[Int]()
+  for i := range n
+    v = grow4(v, i)
+  v.length() + v.at(n - 1)
+# Shape 5: Vec[Int] and Vec[Vec2] in one program.
+fun run5(n: Int) -> Int =
+  a := Vec[Int]()
+  b := Vec[Vec2]()
+  for i := range n
+    a = a.push(i)
+    b = b.push(Vec2(x: Float(i), y: 1.0))
+  r := a.length() + b.length() + a.at(n - 1)
+  if b.at(n - 1).x == Float(n - 1) then r else 0 - 1
+# Shape 6: the length is read between updates, `n := v.length(); v = v.push(n)`.
+fun run6(n: Int) -> Int =
+  v := Vec[Int]()
+  for i := range n
+    len := v.length()
+    v = v.push(len)
+  v.length() + v.at(n - 1)
+# Shape 7: two Vecs in one struct, both pushed.
+struct Pair7(mut xs: Vec[Int], mut ys: Vec[Int])
+fun run7(n: Int) -> Int =
+  p := Pair7(xs: Vec[Int](), ys: Vec[Int]())
+  for i := range n
+    p.xs = p.xs.push(i)
+    p.ys = p.ys.push(i * 2)
+  p.xs.length() + p.ys.length() + p.xs.at(n - 1) + p.ys.at(n - 1)
+# Shape 8: a Vec of Vecs. 8a builds rows and pushes them; 8b pushes onto a row stored in the outer Vec (`rows = rows.set(j, rows.at(j).push(i))`).
+fun run8(n: Int) -> Int =
+  rows := Vec[Vec[Int]]()
+  for r := range n / 10
+    row := Vec[Int]()
+    for c := range 10
+      row = row.push(r * 10 + c)
+    rows = rows.push(row)
+  rows.length() + rows.at(n / 10 - 1).at(9)
+fun run8b(n: Int) -> Int =
+  rows := Vec[Vec[Int]]()
+  for r := range 10
+    rows = rows.push(Vec[Int]())
+  for i := range n
+    j := i % 10
+    rows = rows.set(j, rows.at(j).push(i))
+  rows.at(0).length() + rows.at(9).at(n / 10 - 1)
+# Shape 9: built by one function, returned, then pushed by the caller.
+fun make9(n: Int) -> Vec[Int] =
+  v := Vec[Int]()
+  for i := range n
+    v = v.push(i)
+  v
+fun run9(n: Int) -> Int =
+  v := make9(n)
+  for i := range n
+    v = v.push(i + n)
+  v.length() + v.at(2 * n - 1)
+# Shape 10: an immutable state struct, `State(..s, items: s.items.push(x))`, in a step function.
+struct State10(items: Vec[Int], tick: Int)
+fun step10(s: State10, x: Int) -> State10 =
+  State10(..s, items: s.items.push(x), tick: s.tick + 1)
+fun run10(n: Int) -> Int =
+  s := State10(items: Vec[Int](), tick: 0)
+  for i := range n
+    s = step10(s, i)
+  s.items.length() + s.items.at(n - 1) + s.tick
+# Shape 11: a game-like update, every item of a 20,000-item Vec updated per frame, through a struct field of an immutable state, for many frames.
+struct World11(items: Vec[Int], frame: Int)
+fun frame11(w: World11, n: Int) -> World11 =
+  for i := range n
+    w = World11(..w, items: w.items.set(i, w.items.at(i) + 1))
+  World11(..w, frame: w.frame + 1)
+fun run11(n: Int, frames: Int) -> Int =
+  v := Vec[Int]()
+  for i := range n
+    v = v.push(0)
+  w := World11(items: v, frame: 0)
+  for f := range frames
+    w = frame11(w, n)
+  w.items.at(0) + w.items.at(n - 1) + w.frame
+# Shape 12: one value shared on purpose. Every holder keeps its own contents; this is a correctness test.
+fun run12() -> Int =
+  a := Vec[Int]()
+  for i := range 20
+    a = a.push(i)
+  b := a.push(100)
+  c := a.push(200)
+  d := a.set(0, 7)
+  e := b.set(1, 8)
+  ok := a.length() == 20 && a.at(0) == 0 && a.at(1) == 1
+  ok2 := b.length() == 21 && b.at(20) == 100 && b.at(1) == 1 && c.length() == 21 && c.at(20) == 200
+  ok3 := d.at(0) == 7 && e.at(1) == 8 && e.at(20) == 100 && b.at(0) == 0
+  if ok && ok2 && ok3 then 1 else 0
+fun main(io: Io) =
+  t1 := Time.now(io).toMillis()
+  r1 := run1(100000)
+  u1 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 1 result={r1} ms={u1 - t1}")
+  t2 := Time.now(io).toMillis()
+  r2 := run2(100000)
+  u2 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 2 result={r2} ms={u2 - t2}")
+  t3 := Time.now(io).toMillis()
+  r3 := run3(100000)
+  u3 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 3 result={r3} ms={u3 - t3}")
+  t4 := Time.now(io).toMillis()
+  r4 := run4(100000)
+  u4 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 4 result={r4} ms={u4 - t4}")
+  t5 := Time.now(io).toMillis()
+  r5 := run5(100000)
+  u5 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 5 result={r5} ms={u5 - t5}")
+  t6 := Time.now(io).toMillis()
+  r6 := run6(100000)
+  u6 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 6 result={r6} ms={u6 - t6}")
+  t7 := Time.now(io).toMillis()
+  r7 := run7(100000)
+  u7 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 7 result={r7} ms={u7 - t7}")
+  t8 := Time.now(io).toMillis()
+  r8 := run8(100000) + run8b(2000)
+  u8 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 8 result={r8} ms={u8 - t8}")
+  t9 := Time.now(io).toMillis()
+  r9 := run9(50000)
+  u9 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 9 result={r9} ms={u9 - t9}")
+  t10 := Time.now(io).toMillis()
+  r10 := run10(100000)
+  u10 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 10 result={r10} ms={u10 - t10}")
+  t11 := Time.now(io).toMillis()
+  r11 := run11(20000, 200)
+  u11 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 11 result={r11} ms={u11 - t11}")
+  t12 := Time.now(io).toMillis()
+  r12 := run12()
+  u12 := Time.now(io).toMillis()
+  io.printLn("vec_combined shape 12 result={r12} ms={u12 - t12}")
+test "vec local"
+  assert run1(1000) == 2499
+test "vec mutfield"
+  assert run2(1000) == 2999
+test "vec nested"
+  assert run3(1000) == 2004
+test "vec helper"
+  assert run4(1000) == 2998
+test "vec generic"
+  assert run5(1000) == 2999
+test "vec readbetween"
+  assert run6(1000) == 1999
+test "vec twolists"
+  assert run7(1000) == 4997
+test "vec listoflists"
+  assert run8(1000) == 1099
+test "vec listoflists (2)"
+  assert run8b(1000) == 100 + 999
+test "vec returned"
+  assert run9(500) == 1000 + 999
+test "vec statespread"
+  assert run10(1000) == 2999
+test "vec frames"
+  assert run11(50, 5) == 15
+test "vec shared"
+  assert run12() == 1

tests/fbip/vec_fip.plum ADDED Viewed

@@ -0,0 +1,33 @@
+import std/Int
+import std/Array
+# `fip fun` on the pilot's shape: the compiler accepts a push/set written as a spread plus `Array.with`
+# when it proves the update in place, and refuses the program (tests/fbip_u/ shows the error) when
+# it does not. Names are unique (`fdata`, `fpush`) because the proof is by name.
+struct FVec[T](fdata: Array[T], fsize: Int) =
+  fun init() -> FVec[T] = FVec(fdata: Array[T]().resize(0), fsize: 0)
+  fip fun fpush(self, v: T) -> FVec[T] =
+    if self.fsize < self.fdata.length()
+      FVec(..self, fdata: self.fdata.with(self.fsize, v), fsize: self.fsize + 1)
+    else
+      FVec(fdata: self.fdata.resize(if self.fsize == 0 then 8 else self.fsize * 2).with(self.fsize, v), fsize: self.fsize + 1)
+  fip fun fset(self, i: Int, v: T) -> FVec[T] =
+    FVec(..self, fdata: self.fdata.with(i, v))
+  fun fat(self, i: Int) -> T = self.fdata.get(i)
+  fun flen(self) -> Int = self.fsize
+fun fill(n: Int) -> FVec[Int] =
+  v := FVec[Int]()
+  for i := range n
+    v = v.fpush(i)
+  v = v.fset(3, 99)
+  v
+test "fip vec: push and set"
+  v := fill(20)
+  assert v.flen() == 20 && v.fat(3) == 99 && v.fat(19) == 19

tests/fbip/vec_frames.plum ADDED Viewed

@@ -0,0 +1,34 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/game/Vec2
+import tests/fbip/vec
+# Shape 11: a game-like update, every item of a 20,000-item Vec updated per frame, through a struct field of an immutable state, for many frames.
+struct World11(items: Vec[Int], frame: Int)
+fun frame11(w: World11, n: Int) -> World11 =
+  for i := range n
+    w = World11(..w, items: w.items.set(i, w.items.at(i) + 1))
+  World11(..w, frame: w.frame + 1)
+fun run11(n: Int, frames: Int) -> Int =
+  v := Vec[Int]()
+  for i := range n
+    v = v.push(0)
+  w := World11(items: v, frame: 0)
+  for f := range frames
+    w = frame11(w, n)
+  w.items.at(0) + w.items.at(n - 1) + w.frame
+fun main(io: Io) =
+  t11 := Time.now(io).toMillis()
+  r11 := run11(20000, 200)
+  u11 := Time.now(io).toMillis()
+  io.printLn("vec_frames shape 11 result={r11} ms={u11 - t11}")
+test "vec frames"
+  assert run11(50, 5) == 15

tests/fbip/vec_frameslocal.plum ADDED Viewed

@@ -0,0 +1,31 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/game/Vec2
+import tests/fbip/vec
+# Shape 11b: the per-frame update on a Vec held in a local and handed through a function, no struct around it.
+fun frame13(v: Vec[Int], n: Int) -> Vec[Int] =
+  for i := range n
+    v = v.set(i, v.at(i) + 1)
+  v
+fun run13(n: Int, frames: Int) -> Int =
+  v := Vec[Int]()
+  for i := range n
+    v = v.push(0)
+  for f := range frames
+    v = frame13(v, n)
+  v.at(0) + v.at(n - 1)
+fun main(io: Io) =
+  t13 := Time.now(io).toMillis()
+  r13 := run13(20000, 200)
+  u13 := Time.now(io).toMillis()
+  io.printLn("vec_frameslocal shape 13 result={r13} ms={u13 - t13}")
+test "vec frameslocal"
+  assert run13(50, 5) == 10

tests/fbip/vec_framesmut.plum ADDED Viewed

@@ -0,0 +1,34 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/game/Vec2
+import tests/fbip/vec
+# Shape 11c: the per-frame update on a Vec in a `mut` field, `w.items = w.items.set(i, ..)`.
+struct World14(mut items: Vec[Int], mut frame: Int)
+fun frame14(w: World14, n: Int) -> Unit =
+  for i := range n
+    w.items = w.items.set(i, w.items.at(i) + 1)
+  w.frame = w.frame + 1
+fun run14(n: Int, frames: Int) -> Int =
+  v := Vec[Int]()
+  for i := range n
+    v = v.push(0)
+  w := World14(items: v, frame: 0)
+  for f := range frames
+    frame14(w, n)
+  w.items.at(0) + w.items.at(n - 1) + w.frame
+fun main(io: Io) =
+  t14 := Time.now(io).toMillis()
+  r14 := run14(20000, 200)
+  u14 := Time.now(io).toMillis()
+  io.printLn("vec_framesmut shape 14 result={r14} ms={u14 - t14}")
+test "vec framesmut"
+  assert run14(50, 5) == 15

tests/fbip/vec_generic.plum ADDED Viewed

@@ -0,0 +1,27 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/game/Vec2
+import tests/fbip/vec
+# Shape 5: Vec[Int] and Vec[Vec2] in one program.
+fun run5(n: Int) -> Int =
+  a := Vec[Int]()
+  b := Vec[Vec2]()
+  for i := range n
+    a = a.push(i)
+    b = b.push(Vec2(x: Float(i), y: 1.0))
+  r := a.length() + b.length() + a.at(n - 1)
+  if b.at(n - 1).x == Float(n - 1) then r else 0 - 1
+fun main(io: Io) =
+  t5 := Time.now(io).toMillis()
+  r5 := run5(100000)
+  u5 := Time.now(io).toMillis()
+  io.printLn("vec_generic shape 5 result={r5} ms={u5 - t5}")
+test "vec generic"
+  assert run5(1000) == 2999

tests/fbip/vec_helper.plum ADDED Viewed

@@ -0,0 +1,26 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/game/Vec2
+import tests/fbip/vec
+# Shape 4: a helper that takes the Vec and returns it, `v = grow(v, i)`.
+fun grow4(v: Vec[Int], x: Int) -> Vec[Int] = v.push(x * 2)
+fun run4(n: Int) -> Int =
+  v := Vec[Int]()
+  for i := range n
+    v = grow4(v, i)
+  v.length() + v.at(n - 1)
+fun main(io: Io) =
+  t4 := Time.now(io).toMillis()
+  r4 := run4(100000)
+  u4 := Time.now(io).toMillis()
+  io.printLn("vec_helper shape 4 result={r4} ms={u4 - t4}")
+test "vec helper"
+  assert run4(1000) == 2998

tests/fbip/vec_listoflists.plum ADDED Viewed

@@ -0,0 +1,39 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/game/Vec2
+import tests/fbip/vec
+# Shape 8: a Vec of Vecs. 8a builds rows and pushes them; 8b pushes onto a row stored in the outer Vec (`rows = rows.set(j, rows.at(j).push(i))`).
+fun run8(n: Int) -> Int =
+  rows := Vec[Vec[Int]]()
+  for r := range n / 10
+    row := Vec[Int]()
+    for c := range 10
+      row = row.push(r * 10 + c)
+    rows = rows.push(row)
+  rows.length() + rows.at(n / 10 - 1).at(9)
+fun run8b(n: Int) -> Int =
+  rows := Vec[Vec[Int]]()
+  for r := range 10
+    rows = rows.push(Vec[Int]())
+  for i := range n
+    j := i % 10
+    rows = rows.set(j, rows.at(j).push(i))
+  rows.at(0).length() + rows.at(9).at(n / 10 - 1)
+fun main(io: Io) =
+  t8 := Time.now(io).toMillis()
+  r8 := run8(100000) + run8b(2000)
+  u8 := Time.now(io).toMillis()
+  io.printLn("vec_listoflists shape 8 result={r8} ms={u8 - t8}")
+test "vec listoflists"
+  assert run8(1000) == 1099
+test "vec listoflists (2)"
+  assert run8b(1000) == 100 + 999

tests/fbip/vec_local.plum ADDED Viewed

@@ -0,0 +1,24 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/game/Vec2
+import tests/fbip/vec
+# Shape 1: a Vec in a local, `v = v.push(i)` in a loop.
+fun run1(n: Int) -> Int =
+  v := Vec[Int]()
+  for i := range n
+    v = v.push(i)
+  v.length() + v.at(n - 1) + v.at(n / 2)
+fun main(io: Io) =
+  t1 := Time.now(io).toMillis()
+  r1 := run1(100000)
+  u1 := Time.now(io).toMillis()
+  io.printLn("vec_local shape 1 result={r1} ms={u1 - t1}")
+test "vec local"
+  assert run1(1000) == 2499

tests/fbip/vec_mutfield.plum ADDED Viewed

@@ -0,0 +1,29 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/game/Vec2
+import tests/fbip/vec
+# Shape 2: a `mut` field of a struct, `self.items = self.items.push(x)` in a method.
+struct Bag2(mut items: Vec[Int], mut count: Int) =
+  fun add(self, x: Int) -> Unit =
+    self.items = self.items.push(x)
+    self.count = self.count + 1
+fun run2(n: Int) -> Int =
+  b := Bag2(items: Vec[Int](), count: 0)
+  for i := range n
+    b.add(i)
+  b.items.length() + b.items.at(n - 1) + b.count
+fun main(io: Io) =
+  t2 := Time.now(io).toMillis()
+  r2 := run2(100000)
+  u2 := Time.now(io).toMillis()
+  io.printLn("vec_mutfield shape 2 result={r2} ms={u2 - t2}")
+test "vec mutfield"
+  assert run2(1000) == 2999

tests/fbip/vec_nested.plum ADDED Viewed

@@ -0,0 +1,27 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/game/Vec2
+import tests/fbip/vec
+# Shape 3: a Vec in a field of a nested struct, `o.inner.items = o.inner.items.push(i)`.
+struct Inner3(mut items: Vec[Int])
+struct Outer3(inner: Inner3, tag: Int)
+fun run3(n: Int) -> Int =
+  o := Outer3(inner: Inner3(items: Vec[Int]()), tag: 5)
+  for i := range n
+    o.inner.items = o.inner.items.push(i)
+  o.inner.items.length() + o.inner.items.at(n - 1) + o.tag
+fun main(io: Io) =
+  t3 := Time.now(io).toMillis()
+  r3 := run3(100000)
+  u3 := Time.now(io).toMillis()
+  io.printLn("vec_nested shape 3 result={r3} ms={u3 - t3}")
+test "vec nested"
+  assert run3(1000) == 2004

tests/fbip/vec_readbetween.plum ADDED Viewed

@@ -0,0 +1,25 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/game/Vec2
+import tests/fbip/vec
+# Shape 6: the length is read between updates, `n := v.length(); v = v.push(n)`.
+fun run6(n: Int) -> Int =
+  v := Vec[Int]()
+  for i := range n
+    len := v.length()
+    v = v.push(len)
+  v.length() + v.at(n - 1)
+fun main(io: Io) =
+  t6 := Time.now(io).toMillis()
+  r6 := run6(100000)
+  u6 := Time.now(io).toMillis()
+  io.printLn("vec_readbetween shape 6 result={r6} ms={u6 - t6}")
+test "vec readbetween"
+  assert run6(1000) == 1999

tests/fbip/vec_returned.plum ADDED Viewed

@@ -0,0 +1,30 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/game/Vec2
+import tests/fbip/vec
+# Shape 9: built by one function, returned, then pushed by the caller.
+fun make9(n: Int) -> Vec[Int] =
+  v := Vec[Int]()
+  for i := range n
+    v = v.push(i)
+  v
+fun run9(n: Int) -> Int =
+  v := make9(n)
+  for i := range n
+    v = v.push(i + n)
+  v.length() + v.at(2 * n - 1)
+fun main(io: Io) =
+  t9 := Time.now(io).toMillis()
+  r9 := run9(50000)
+  u9 := Time.now(io).toMillis()
+  io.printLn("vec_returned shape 9 result={r9} ms={u9 - t9}")
+test "vec returned"
+  assert run9(500) == 1000 + 999

tests/fbip/vec_returned2.plum ADDED Viewed

@@ -0,0 +1,31 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/game/Vec2
+import tests/fbip/vec
+# Shape 9b: a function that returns a Vec it built in a local, called twice, the result pushed by the caller.
+fun make15(n: Int) -> Vec[Int] =
+  v := Vec[Int]()
+  for i := range n
+    v = v.push(i)
+  v
+fun run15(n: Int) -> Int =
+  v := make15(n)
+  w := Vec[Int]()
+  for i := range n
+    w = w.push(i)
+  v.length() + w.length()
+fun main(io: Io) =
+  t15 := Time.now(io).toMillis()
+  r15 := run15(100000)
+  u15 := Time.now(io).toMillis()
+  io.printLn("vec_returned2 shape 15 result={r15} ms={u15 - t15}")
+test "vec returned2"
+  assert run15(500) == 1000

tests/fbip/vec_shared.plum ADDED Viewed

@@ -0,0 +1,31 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/game/Vec2
+import tests/fbip/vec
+# Shape 12: one value shared on purpose. Every holder keeps its own contents; this is a correctness test.
+fun run12() -> Int =
+  a := Vec[Int]()
+  for i := range 20
+    a = a.push(i)
+  b := a.push(100)
+  c := a.push(200)
+  d := a.set(0, 7)
+  e := b.set(1, 8)
+  ok := a.length() == 20 && a.at(0) == 0 && a.at(1) == 1
+  ok2 := b.length() == 21 && b.at(20) == 100 && b.at(1) == 1 && c.length() == 21 && c.at(20) == 200
+  ok3 := d.at(0) == 7 && e.at(1) == 8 && e.at(20) == 100 && b.at(0) == 0
+  if ok && ok2 && ok3 then 1 else 0
+fun main(io: Io) =
+  t12 := Time.now(io).toMillis()
+  r12 := run12()
+  u12 := Time.now(io).toMillis()
+  io.printLn("vec_shared shape 12 result={r12} ms={u12 - t12}")
+test "vec shared"
+  assert run12() == 1

tests/fbip/vec_statespread.plum ADDED Viewed

@@ -0,0 +1,29 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/game/Vec2
+import tests/fbip/vec
+# Shape 10: an immutable state struct, `State(..s, items: s.items.push(x))`, in a step function.
+struct State10(items: Vec[Int], tick: Int)
+fun step10(s: State10, x: Int) -> State10 =
+  State10(..s, items: s.items.push(x), tick: s.tick + 1)
+fun run10(n: Int) -> Int =
+  s := State10(items: Vec[Int](), tick: 0)
+  for i := range n
+    s = step10(s, i)
+  s.items.length() + s.items.at(n - 1) + s.tick
+fun main(io: Io) =
+  t10 := Time.now(io).toMillis()
+  r10 := run10(100000)
+  u10 := Time.now(io).toMillis()
+  io.printLn("vec_statespread shape 10 result={r10} ms={u10 - t10}")
+test "vec statespread"
+  assert run10(1000) == 2999

tests/fbip/vec_twolists.plum ADDED Viewed

@@ -0,0 +1,27 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/game/Vec2
+import tests/fbip/vec
+# Shape 7: two Vecs in one struct, both pushed.
+struct Pair7(mut xs: Vec[Int], mut ys: Vec[Int])
+fun run7(n: Int) -> Int =
+  p := Pair7(xs: Vec[Int](), ys: Vec[Int]())
+  for i := range n
+    p.xs = p.xs.push(i)
+    p.ys = p.ys.push(i * 2)
+  p.xs.length() + p.ys.length() + p.xs.at(n - 1) + p.ys.at(n - 1)
+fun main(io: Io) =
+  t7 := Time.now(io).toMillis()
+  r7 := run7(100000)
+  u7 := Time.now(io).toMillis()
+  io.printLn("vec_twolists shape 7 result={r7} ms={u7 - t7}")
+test "vec twolists"
+  assert run7(1000) == 4997

tests/fbip/vec_unique_names.plum ADDED Viewed

@@ -0,0 +1,178 @@
+import std/Int
+import std/Str
+import std/Float
+import std/Time
+import std/Io
+import std/game/Vec2
+import tests/fbip/uvec
+# The shapes that are proved in place, in one program, with names no std type uses (`udata`, `upush`, ...). With `data`
+# and `push` (vec_combined.plum) the same code copies on every push.
+# Shape 1: a Vec in a local, `v = v.push(i)` in a loop.
+fun run1(n: Int) -> Int =
+  v := UVec[Int]()
+  for i := range n
+    v = v.upush(i)
+  v.ulen() + v.uat(n - 1) + v.uat(n / 2)
+# Shape 2: a `mut` field of a struct, `self.items = self.items.push(x)` in a method.
+struct Bag2(mut items: UVec[Int], mut count: Int) =
+  fun add(self, x: Int) -> Unit =
+    self.items = self.items.upush(x)
+    self.count = self.count + 1
+fun run2(n: Int) -> Int =
+  b := Bag2(items: UVec[Int](), count: 0)
+  for i := range n
+    b.add(i)
+  b.items.ulen() + b.items.uat(n - 1) + b.count
+# Shape 3: a Vec in a field of a nested struct, `o.inner.items = o.inner.items.push(i)`.
+struct Inner3(mut items: UVec[Int])
+struct Outer3(inner: Inner3, tag: Int)
+fun run3(n: Int) -> Int =
+  o := Outer3(inner: Inner3(items: UVec[Int]()), tag: 5)
+  for i := range n
+    o.inner.items = o.inner.items.upush(i)
+  o.inner.items.ulen() + o.inner.items.uat(n - 1) + o.tag
+# Shape 4: a helper that takes the Vec and returns it, `v = grow(v, i)`.
+fun grow4(v: UVec[Int], x: Int) -> UVec[Int] = v.upush(x * 2)
+fun run4(n: Int) -> Int =
+  v := UVec[Int]()
+  for i := range n
+    v = grow4(v, i)
+  v.ulen() + v.uat(n - 1)
+# Shape 5: Vec[Int] and Vec[Vec2] in one program.
+fun run5(n: Int) -> Int =
+  a := UVec[Int]()
+  b := UVec[Vec2]()
+  for i := range n
+    a = a.upush(i)
+    b = b.upush(Vec2(x: Float(i), y: 1.0))
+  r := a.ulen() + b.ulen() + a.uat(n - 1)
+  if b.uat(n - 1).x == Float(n - 1) then r else 0 - 1
+# Shape 6: the length is read between updates, `n := v.length(); v = v.push(n)`.
+fun run6(n: Int) -> Int =
+  v := UVec[Int]()
+  for i := range n
+    len := v.ulen()
+    v = v.upush(len)
+  v.ulen() + v.uat(n - 1)
+# Shape 7: two Vecs in one struct, both pushed.
+struct Pair7(mut xs: UVec[Int], mut ys: UVec[Int])
+fun run7(n: Int) -> Int =
+  p := Pair7(xs: UVec[Int](), ys: UVec[Int]())
+  for i := range n
+    p.xs = p.xs.upush(i)
+    p.ys = p.ys.upush(i * 2)
+  p.xs.ulen() + p.ys.ulen() + p.xs.uat(n - 1) + p.ys.uat(n - 1)
+# Shape 11b: the per-frame update on a Vec held in a local and handed through a function, no struct around it.
+fun frame13(v: UVec[Int], n: Int) -> UVec[Int] =
+  for i := range n
+    v = v.uset(i, v.uat(i) + 1)
+  v
+fun run13(n: Int, frames: Int) -> Int =
+  v := UVec[Int]()
+  for i := range n
+    v = v.upush(0)
+  for f := range frames
+    v = frame13(v, n)
+  v.uat(0) + v.uat(n - 1)
+# Shape 9b: a function that returns a Vec it built in a local, called twice, the result pushed by the caller.
+fun make15(n: Int) -> UVec[Int] =
+  v := UVec[Int]()
+  for i := range n
+    v = v.upush(i)
+  v
+fun run15(n: Int) -> Int =
+  v := make15(n)
+  w := UVec[Int]()
+  for i := range n
+    w = w.upush(i)
+  v.ulen() + w.ulen()
+fun main(io: Io) =
+  t1 := Time.now(io).toMillis()
+  r1 := run1(100000)
+  u1 := Time.now(io).toMillis()
+  io.printLn("uvec_combined shape 1 result={r1} ms={u1 - t1}")
+  t2 := Time.now(io).toMillis()
+  r2 := run2(100000)
+  u2 := Time.now(io).toMillis()
+  io.printLn("uvec_combined shape 2 result={r2} ms={u2 - t2}")
+  t3 := Time.now(io).toMillis()
+  r3 := run3(100000)
+  u3 := Time.now(io).toMillis()
+  io.printLn("uvec_combined shape 3 result={r3} ms={u3 - t3}")
+  t4 := Time.now(io).toMillis()
+  r4 := run4(100000)
+  u4 := Time.now(io).toMillis()
+  io.printLn("uvec_combined shape 4 result={r4} ms={u4 - t4}")
+  t5 := Time.now(io).toMillis()
+  r5 := run5(100000)
+  u5 := Time.now(io).toMillis()
+  io.printLn("uvec_combined shape 5 result={r5} ms={u5 - t5}")
+  t6 := Time.now(io).toMillis()
+  r6 := run6(100000)
+  u6 := Time.now(io).toMillis()
+  io.printLn("uvec_combined shape 6 result={r6} ms={u6 - t6}")
+  t7 := Time.now(io).toMillis()
+  r7 := run7(100000)
+  u7 := Time.now(io).toMillis()
+  io.printLn("uvec_combined shape 7 result={r7} ms={u7 - t7}")
+  t13 := Time.now(io).toMillis()
+  r13 := run13(20000, 200)
+  u13 := Time.now(io).toMillis()
+  io.printLn("uvec_combined shape 13 result={r13} ms={u13 - t13}")
+  t15 := Time.now(io).toMillis()
+  r15 := run15(100000)
+  u15 := Time.now(io).toMillis()
+  io.printLn("uvec_combined shape 15 result={r15} ms={u15 - t15}")
+test "vec local"
+  assert run1(1000) == 2499
+test "vec mutfield"
+  assert run2(1000) == 2999
+test "vec nested"
+  assert run3(1000) == 2004
+test "vec helper"
+  assert run4(1000) == 2998
+test "vec generic"
+  assert run5(1000) == 2999
+test "vec readbetween"
+  assert run6(1000) == 1999
+test "vec twolists"
+  assert run7(1000) == 4997
+test "vec frameslocal"
+  assert run13(50, 5) == 10
+test "vec returned2"
+  assert run15(500) == 1000