Experiment: dark compile <fn> (merge compiler repo into main repo)

[StachuDotNet]

(very WIP, dunno if this will go anywhere)

Vendored darklang/compiler (the x64 AOT compiler) into darklang/dark as a build-gated project and
wired up a dark compile <fn> path: resolve a package fn, bridge it into the compiler's AST, compile to
native ELF, run it, diff the bytes against the interpreter. All behind -p:DarkWithCompiler=true /
#if DARK_WITH_COMPILER — flag off and the .sln/default build are byte-identical, so this can't break
anyone. The question: fold the compiler in-tree, point it at real package fns, and see how far it gets +
what has to sit between the two codebases.

Where it landed: ~59% of package fns compile to native ELF (floor), and of those ~61% prove
byte-identical to the interpreter, 0 known miscompiles (also a floor — the harness can't synth args for
a big chunk of them, see below). dark compile <fn> works but it's still builtin-shaped, not a nice
command yet.

---

What it looks like

Still builtin-shaped (dark eval 'Builtin.compiler…'), but this is the whole loop — bridge, compile to
native ELF, run it, diff against the interpreter:

# compile a fn body to native + run it in-process
> dark eval 'Builtin.compilerCompileAndRun "(fun (x: Float) -> Stdlib.Float.multiply x (Stdlib.Float.sqrt 4.0)) 2.5"'
(true, "5.0")

# point it at a real package fn and prove it matches the interpreter (compile + run ELF + run interp + diff bytes)
> dark eval 'Builtin.compilerEquivSweep ["512efce2…"]'   # Darklang.Stdlib.Float.turnsToRadians
512efce2…    match

# ^ that one was a DIFF until this branch — the float args got swapped (f(x, g()) computed f(x, x)):
512efce2…    DIFF|c=39.47841760435743|i=15.707963267948966    # tau*tau vs tau*2.5

# a fn the bridge can't lower yet fails cleanly, with the actual reason (not a stack trace)
> dark eval 'Builtin.compilerCoverageSweep ["…"]'
False|unsupported-type: TCustomType          # generic/alias custom type, not bridged yet
False|unsupported-builtin: httpClientRequest # effectful, routes through the seam but can't be cleanly proven

# the payoff when it lands — same answer, compiled vs interpreted:
> dark eval 'Darklang.Perf.compareEval (fun n -> Test.fib n) 27'
compiled 196418 in 3ms · interpreted 196418 in 10.7s · 3576x

---

Two runtimes + the glue

dark (ProgramTypes, real F# builtins, package mgr, live ExecutionState) and the compiler (its own
AST -> ANF -> MIR -> LIR -> x64, its own .dark stdlib, finger-tree lists, regalloc — knows nothing about
our builtins or package store). Three bits of glue:

1. PT -> AST bridge (Builtins.Compiler/Bridge.fs, ~2300 loc) — total, hard-failing lowering of a fn +
   its whole type/call closure, in-process, no text hop. Anything unbridgeable -> unsupported-<cat>,
   which is the only reason the blocker histogram is trustworthy.
2. Runtime seam — compiled code has no native builtins, so it emits hostRpc("Stdlib.String.length\n args") and an in-process F# daemon runs the real builtin against a real ExecutionState and marshals
   back. One boundary, per-builtin table, swap to native later with no ABI change. Costs an IPC hop per
   builtin call (real tax on builtin-heavy code; native migration kills it).
3. Differential harness — compile + run the ELF + run the interp (both bounded) + compare canonical
   wire bytes. Compile != correct; every number here is diffed, not assumed.

Compiles fine

Basically the whole surface: arith + all int widths, strings, records/enums (construct/access/match),
generics (monomorphized), lists, tuples, record-update, string interp, pipes, lambdas/HOFs, recursion,
package-value constants, aliases. Real code — JSON serializers, LSP types, render helpers — mostly goes
straight through.

Doesn't

Long-tail plateau, no single wall: generic/alias custom types, bare-[] inference (the naive fix hangs
the compiler), effectful builtins (route through the seam fine but can't be cleanly proven — IO/nondet),
and a pile of upstream-unresolved names the stored PT itself can't resolve. And the harness is its own
ceiling: ~a third of compiling fns are "unprovable" — not wrong, just can't synth valid args for
custom-type/fn params. Fixing arg-synth (bind generic tyargs, sample nested records with bounds) converts
most of those to proven — and immediately outed 2 more real miscompiles nobody had ever exercised. That
fix is written but not committed: it also shows the interpreter can't be interrupted, so a slow fn hangs
the whole sweep (wants a cancellation token first).

---

What had to change in each repo

darklang/compiler (~369 loc, 9 files — needs upstreaming). The fun part: most of the "hard" bugs in
its own notes were mischaracterized. The real ones were small register bugs, found by diffing the
post-regalloc LIR of a wrong minimal case vs a right one:

• passes/x64/6_CodeGen.fs: (a) HeapStore of a string literal clobbered RCX — an allocatable reg —
  smashing the adjacent tuple slot -> the tuple/list SIGSEGV the notes blamed on "unfixable register
  allocation" this whole time; (b) unsigned compare/div/mod lowered signed (UInt64 >= 2^63 read
  negative); (c) FArgMoves skipped parallel-move resolution, so a cyclic float shuffle like f(x, g())
  quietly computed f(x, x). Plus File.delete was a no-op stub -> real unlink.
• passes/2_AST_to_ANF.fs: variant-tag lookup scoped by type (latent wrong-tag miscompile); lambda-lift
  inference leniency.
• passes/1.5_TypeChecking.fs: tvar unification instead of structural eq in Apply/FuncRef — it was
  rejecting correct code anywhere one side still held a tvar (bit us ~6x).
• stdlib: Float.fromBits, String.toBytes, Rpc.dark seam prims; reserved XMM15 as a float scratch for
  the FArgMoves fix.

darklang/dark — basically all additive and flagged. Bridge + seam (Builtins.Compiler, ~2300 loc)
is new; the compiler is vendored as a gated project; one guarded combine entry is the only shared-wiring
touch. Flag off -> default build unchanged.

---

Takeaways + next

Biggest lesson: most of the wins came from disproving the compiler's own notes or fixing my harness, not
from compiler limits. The structural-eq trap bit 6x; two of three "walls" in the notes were stale
comments; the headline "unfixable register bug" was a one-line RCX save.

To make it actually real:

• Interpreter cancellation token (through Execution.executeFunction) is the keystone — unblocks the
  arg-synth proof-coverage jump and makes full-tree sweeps robust. It's the one thing that reaches into
  the non-gated interpreter, so it wants care.
• Seam host placement (daemon vs in-process vs NativeAOT .so) is the live call if we pivot; wire format
  • dispatch table stay either way.
• Vendor the compiler's test suite (never came over). Right now every change to the vendored compiler
  is checked only via package-fn diffs — which is exactly how those three register miscompiles survived in
  darklang/compiler in the first place.

Not shippable, but the shape's clear and the correctness bar is real. Ping me for the LIR-diff trick —
it's the thing that made the codegen bugs tractable.