docs(unshadow): #2-ext rt_str inline — 🔴 CLOSED-NEGATIVE (ABI-boundary falsification)

.verdicts/unshadow-2ext-rt-str-inline/F-UNSHADOW-2EXT-RT-STR-INLINE.txt

@@ -0,0 +1,69 @@
+F-UNSHADOW-2EXT-RT-STR-INLINE  —  🔴 CLOSED-NEGATIVE
+========================================================
+Host: pool mini (macOS arm64).  Base: origin/main 002cedc58 (codegen.hexa
+context identical at the buildable measurement base af645e419).
+
+FALSIFIER (pre-registered)
+  "A simple pure rt_str_* accessor (rt_str_starts_with) can be inlined at its
+   codegen call site — replacing the out-of-line precompiled-runtime.o C-ABI
+   call with its body — so clang -O2 optimizes across the boundary, while
+   staying byte-identical and single-eval (let-bound expr arg)."
+
+METHOD
+  Prim chosen: rt_str_starts_with (the str_len free-fn path is a dead/latent
+  branch: cg_rt_target()=="c" so the rt_* family is unreachable, and the
+  str_len builtin emits an uncompilable `hexa_str_len(HexaVal)`; the working
+  string-length path is `.len()` -> hexa_int(hexa_len(...)) which is already a
+  direct exported call). rt_str_starts_with IS live (emitted by `.starts_with()`)
+  and PURE (runtime_core.c):
+      int rt_str_starts_with(HexaVal s, HexaVal prefix) {
+          if (!HX_IS_STR(s) || !HX_IS_STR(prefix)) return 0;
+          size_t plen = HX_STRLEN(prefix);
+          return hxlcl_strncmp(HX_STR(s), HX_STR(prefix), plen) == 0;
+      }
+  Inline emitted at all 3 call sites with a DOUBLE-EVAL GUARD (both args
+  let-bound once into __sw_s / __sw_p in a GCC statement-expression).
+
+VERIFICATION (verbatim)
+  [isolation diff — base vs inline emitted C, ONLY the call site differs]
+  23c23
+  <     hexa_println(hexa_to_string(hexa_bool(rt_str_starts_with(__hexa_sl_0, __hexa_sl_1))));
+  ---
+  >     hexa_println(hexa_to_string(hexa_bool(({ HexaVal __sw_s = (__hexa_sl_0), __sw_p = (__hexa_sl_1); (!HX_IS_STR(__sw_s) || !HX_IS_STR(__sw_p)) ? 0 : (hxlcl_strncmp(HX_STR(__sw_s), HX_STR(__sw_p), HX_STRLEN(__sw_p)) == 0); }))));
+
+  [double-eval guard — design CORRECT: each arg let-bound exactly once,
+   visible above as `HexaVal __sw_s = (...), __sw_p = (...)`. BASE single-eval
+   reference: result=true / calls=1]
+
+  [BASE corpus g5 reference output]
+  true / false / true / true / false / true / false / true / hits=3
+
+  [THE WALL — inline arm fails to LINK]
+  Undefined symbols for architecture arm64:
+    "_HX_STRLEN", referenced from:
+        _u_main in sw_corpus_inl.o   (x8)
+  clang: error: linker command failed with exit code 1
+
+  [root cause — runtime.h export boundary]
+  grep -c "HX_STRLEN\|hxlcl_strncmp" self/runtime.h  ->  0
+  runtime.h does NOT include <string.h> and exports ONLY HexaVal-level ABI
+  functions (rt_str_starts_with itself is exported at runtime.h:257). HX_IS_STR
+  and HX_STR ARE exported; HX_STRLEN and hxlcl_strncmp are NOT — they exist only
+  inside the runtime.c amalgam. Emitted programs (`#include "runtime.h"` + link
+  runtime.o) therefore cannot reference the prim's internal helpers.
+
+FINDING (ruled-out axis)
+  rt_str_* body-inlining at the codegen call site is BLOCKED by the runtime.h
+  ABI boundary. Every meaningful rt_str_* accessor body touches runtime-internal
+  scalar helpers (HX_STRLEN, hxlcl_strncmp, libc strlen/strncmp) that are
+  deliberately NOT exported to emitted programs. This is the structural reason
+  the hexa_int pilot (#2) succeeded where strings cannot: hexa_int's box-literal
+  `((HexaVal){.tag=TAG_INT,.i=N})` uses ONLY the runtime.h-visible HexaVal struct
+  layout + a literal — no internal helper. String prims have no such purely-layout
+  inline form. The double-eval guard design is independently correct (proven in
+  the emitted C); the falsification is purely at the link boundary, NOT the guard.
+  Inlining would require either exporting the internal helpers in runtime.h (a
+  runtime-ABI change that re-widens the very boundary UNSHADOW aims to remove) or
+  adding `#include <string.h>` to the global emit prelude (not a surgical call-site
+  inline; reintroduces the strncmp/strlen macro-shadow collisions runtime.c fights).
+  Both are out of scope for a call-site inline. CLOSED-NEGATIVE.

bench/unshadow/strstarts_corpus.hexa

@@ -0,0 +1,24 @@
+// bench/unshadow/strstarts_corpus.hexa — string-heavy correctness corpus
+// for the `.starts_with()` -> rt_str_starts_with prim. Exercises empty
+// strings, exact match, over-length prefix, and UTF-8. BASE output (g5
+// reference, verified on mini macOS arm64):
+//   true / false / true / true / false / true / false / true / hits=3
+fn main() {
+    let s = "hello, world"
+    println(to_string(s.starts_with("hello")))
+    println(to_string(s.starts_with("world")))
+    println(to_string(s.starts_with("")))
+    println(to_string(s.starts_with("hello, world")))
+    println(to_string(s.starts_with("hello, world!")))
+    println(to_string("".starts_with("")))
+    println(to_string("".starts_with("x")))
+    println(to_string("café ☕".starts_with("café")))
+    let mut hits = 0
+    let words = ["apple", "apricot", "banana", "avocado", "cherry"]
+    let mut i = 0
+    while i < 5 {
+        if words[i].starts_with("a") { hits = hits + 1 }
+        i = i + 1
+    }
+    println("hits=" + to_string(hits))
+}

bench/unshadow/strstarts_heavy.hexa

@@ -0,0 +1,24 @@
+// bench/unshadow/strstarts_heavy.hexa — UNSHADOW #2 EXTENSION micro-bench.
+//
+// Hot loop hammering the `rt_str_starts_with` string prim via the
+// `.starts_with()` method. Intended A/B: base (out-of-line
+// `rt_str_starts_with(s, p)` call across the precompiled-runtime.o C-ABI
+// boundary) vs an inlined-at-call-site arm.
+//
+// FINDING (closed-negative): the inline arm CANNOT be linked. The prim body
+// (`HX_STRLEN(prefix)` + `hxlcl_strncmp(HX_STR(s), HX_STR(p), plen)`) needs
+// runtime-internal symbols that runtime.h deliberately does NOT export to
+// emitted programs (only the HexaVal-level ABI fn `rt_str_starts_with` is
+// exported). So this bench runs the BASE arm only; the inline arm is the
+// ruled-out axis. See domains/UNSHADOW.log.md (2026-05-29 extension entry).
+fn main() {
+    let s = "the quick brown fox jumps over the lazy dog 0123456789"
+    let p = "the quick"
+    let mut acc = 0
+    let mut i = 0
+    while i < 20000000 {
+        if s.starts_with(p) { acc = acc + 1 }
+        i = i + 1
+    }
+    println("acc=" + to_string(acc))
+}

bench/unshadow/strstarts_singleeval.hexa

@@ -0,0 +1,22 @@
+// bench/unshadow/strstarts_singleeval.hexa — double-eval guard probe.
+//
+// The receiver of `.starts_with()` is a side-effecting call (`make_str()`
+// increments a global counter). A correct single-evaluation lowering prints
+// `calls=1`; a double-eval (the to_int / comptime-fold miscompile class)
+// would print `calls=2`.
+//
+// The proposed inline DID let-bind the args exactly once in the emitted C —
+//   `({ HexaVal __sw_s = (make_str()), __sw_p = ("hello"); ... })`
+// — so the single-eval guard design is correct (verified in the emitted C).
+// The inline is blocked at LINK (unexported runtime internals), not by the
+// guard. The BASE arm here is the live reference: it prints `calls=1`.
+let mut _calls = 0
+fn make_str() -> string {
+    _calls = _calls + 1
+    return "hello_world"
+}
+fn main() {
+    let r = make_str().starts_with("hello")
+    println("result=" + to_string(r))
+    println("calls=" + to_string(_calls))
+}

domains/UNSHADOW.log.md

@@ -2,6 +2,35 @@
 
 Append-only history sister of `UNSHADOW.md`. Each entry starts with `## <ISO timestamp> — <header>` (newest on top); body = `- [x]` (done) / `- [ ]` (pending) checkbox tasks.
 
+## 2026-05-29 — #2 EXTENSION (rt_str_* string prim inline) — 🔴 CLOSED-NEGATIVE (ABI 경계 차단)
+
+#2 hexa_int 인라인을 STRING 런타임 prim 으로 확장 시도. 결론: **rt_str_\* prim 의 body 를
+codegen 콜사이트에 인라인하는 것은 `runtime.h` export 경계로 인해 구조적으로 불가** —
+publishable closed-negative. milestone flip 없음(확장 로그 only). verdict 원문:
+`.verdicts/unshadow-2ext-rt-str-inline/F-UNSHADOW-2EXT-RT-STR-INLINE.txt`.
+
+- [x] prim 선정: `rt_str_starts_with` (HexaVal 2-arg · PURE · 비할당 · LIVE). 후보 조사에서 발견한 함정:
+      `str_len` free-fn 경로는 dead — `cg_rt_target()=="c"` 라 `rt_str_len_v`/`rt_str_*` 분기는 도달 불가이고,
+      `str_len` 빌트인은 `hexa_str_len(HexaVal)`(컴파일 불가) 를 emit하는 latent 버그 경로. 실제 작동하는
+      문자열-길이 경로는 `.len()` → `hexa_int(hexa_len(...))` 로 **이미** 직접 export 콜(추가 인라인 여지 없음).
+- [x] codegen 구현: 3개 `.starts_with()` 콜사이트(self/codegen.hexa) 를 GCC statement-expression 인라인으로 교체.
+      DOUBLE-EVAL 가드 적용 — 두 인자 모두 `__sw_s`/`__sw_p` 로 **단 한 번** let-bind (expr 인자라 필수).
+- [x] g5 격리 byte-diff: base vs inline emitted C 가 **콜사이트 라인만** 상이(나머지 byte-identical). verbatim:
+      `< ...rt_str_starts_with(__hexa_sl_0, __hexa_sl_1)...`
+      `> ...({ HexaVal __sw_s = (__hexa_sl_0), __sw_p = (__hexa_sl_1); (!HX_IS_STR(__sw_s)||!HX_IS_STR(__sw_p))?0:(hxlcl_strncmp(HX_STR(__sw_s),HX_STR(__sw_p),HX_STRLEN(__sw_p))==0); })...`
+- [x] single-eval 가드 검증: emitted C 에서 각 인자가 정확히 1회 let-bind 됨이 육안 확인. BASE single-eval 레퍼런스
+      `make_str().starts_with("hello")` → `calls=1`. 가드 **설계는 정상** — 반증은 가드가 아니라 링크 경계.
+- [x] **THE WALL** (반증): inline arm 링크 실패 — `Undefined symbols: "_HX_STRLEN", referenced from _u_main` (x8).
+      근본원인: `grep -c "HX_STRLEN|hxlcl_strncmp" self/runtime.h` = **0**. runtime.h 는 `<string.h>` 도 미포함,
+      HexaVal-레벨 ABI 함수만 export(`rt_str_starts_with` 자체는 runtime.h:257 export). `HX_IS_STR`/`HX_STR` 는
+      export 되지만 `HX_STRLEN`/`hxlcl_strncmp` 는 runtime.c amalgam 내부에만 존재 → emitted 프로그램에서 참조 불가.
+- [x] **정직한 finding (ruled-out axis)**: hexa_int 가 성공한 이유 = box-literal `((HexaVal){.tag=TAG_INT,.i=N})`
+      이 runtime.h-가시 struct 레이아웃 + 리터럴만 사용(내부 헬퍼 0). 모든 의미있는 rt_str_\* body 는 내부 스칼라
+      헬퍼(HX_STRLEN/strncmp)를 건드려 순수-레이아웃 인라인 형태가 없음. 인라인하려면 (a) runtime.h 에 내부
+      헬퍼 export(=UNSHADOW 가 없애려는 경계를 도로 넓힘) 또는 (b) 전역 emit 프리앰블에 `#include <string.h>`
+      추가(콜사이트 surgical 인라인 아님 + strncmp/strlen 매크로-shadow 충돌 재유발) 필요. 둘 다 스코프 밖 → CLOSED.
+- [x] 정확성 우선: silent miscompile 위험 회피 위해 codegen 변경 **revert**(인라인은 `_HX_STRLEN` 미정의로 빌드 자체 실패).
+      bench/log/verdict 만 commit. UNSHADOW.md cross-layer milestone **미변경**(extension).
 ## 2026-05-29T12:59Z — #4 atlas-guided const-fold pilot — 🔵🟢 g5 IDENTICAL · ~65% faster
 
 UNSHADOW.easy.md §A ("루프/호출을 안 돌기"): codegen 이 PURE·atlas-검증