Expand description
Fallback accounting + the SUI_VM_STRICT latch — see the module docs for
why the per-builtin layer is counted but never fatal.
Fallback accounting — and the strict latch that makes a laundered answer
impossible to mistake for a computed one.
§The problem this exists to solve
The VM does not evaluate alone. It delegates to the tree-walker at three independent granularities, and until now none of them was observable in practice:
| layer | where | granularity |
|---|---|---|
[Layer::Builtin] | builtins.rs, the bridge call | one builtin call |
[Layer::ImportedFile] | vm.rs, import_file | one imported file |
[Layer::WholeExpression] | the CLI’s VM arm | the entire expression |
The consequence is that a test comparing “the VM” against the tree-walker
can be answered by the tree-walker on both sides. That is not theoretical:
tests/vm_cli.rs (36 cases) and tests/vm_capabilities.rs (23) go through
the CLI, whose VM arm falls back on any error — so a VM failing 100% of
those expressions passed 36/36. A green run meant “the VM did not produce
a different answer”, never “the VM computed this”.
A counter for the middle layer already existed (vm_fallback_count()) and
nothing in the repo ever read it.
§What strict mode does, and what it deliberately does not
SUI_VM_STRICT=1 makes [Layer::ImportedFile] and
[Layer::WholeExpression] hard errors. Both mean the same thing — the
VM could not do its job and the walker covered for it — and that is exactly
what a measurement must not silently absorb.
[Layer::Builtin] is counted but never fatal, at any setting. Bridging
a builtin is the VM’s architecture, not a failure: it has no native
getEnv, match, split, fromTOML, genericClosure, readDir or
hashFile, and it is not supposed to. Making that arm fatal would leave
strict mode unable to evaluate anything at all, which is a strict mode
nobody can use. A caller that wants full purity asserts
count(Layer::Builtin) == 0 for itself.
Being explicit about that asymmetry is the point: a latch that conflates “the VM delegated by design” with “the VM failed” would produce a red that nobody could act on, and reds nobody can act on get switched off.
Enums§
- Layer
- Which delegation boundary was crossed.