Loment 0.1.5

Loment 0.1.5

The 0.1.5 milestone is closed: 167 of its 173 issues are done. The six still open are the
loment/lspe/ packaging split (tracked for 0.1.5.1), not defects.

This release is mostly about turning promises into artifacts you can inspect: choose is a
seven-dimension matrix whose every legal cell is compiled by both implementations and compared byte
for byte; the gate names every criterion it exempts; and the bootstrap root now carries a
provenance record that a rebuild can falsify.

Install

Asset
loment-0.1.5-linux-x64.tar.gz	Linux x86-64. Unpack anywhere; bin/loment is the launcher.
loment-0.1.5-windows-x64.zip	Windows x86-64. Unzip and run install.cmd.
loment-0.1.5-windows-x64-setup.exe	Windows x86-64, self-extracting. Double-click.
loment-skill.zip	The agent guide (SKILL.md) on its own, for people who want only that.
SHA256SUMS · SHA256SUMS.asc · FINGERPRINT	Checksums, a detached signature, and the key fingerprint. The installers verify the payload before copying anything.

Installing and running needs no Python, no clang and no WSL — native binaries plus the standard
library.

new · choose is a matrix, and the gate walks it

choose now has seven dimensions — mode, gc, runtime, port, vm, lms, lspe — and the
gate covers the whole legal matrix rather than a sample: every legal cell is compiled by the
reference and the self-hosted compiler and the IR must be identical, while the artifact-level rows
are judged on the linked image (loment_choose_matrix_test, 17 criteria).

The mode row became a real layer instead of a word:

• The hosted layer is named. docs/275 defines it against the world-port table: std may carry
  hosted names (libc / filesystem / threads / time / network), no_std may not.
• std + hosted links the real libc.so.6 and runs; a no_std image carries no hosted
  symbols; both front ends refuse no_std + hosted; and the IR itself declares the row, so the
  linker can check a claim it did not write (; loment-mode: no_std against
  ; loment-port: hosted).
• no_gc is accepted and checked the same way: the artifact says “no collector”, and the linker
  fails it if a collector is in the image.

new · the gate says what it skips

• Per-criterion baseline. The known-red list names a criterion, not a suite; * is reserved for
  a suite that crashes before naming anything. Budgets are checked against the base branch, not only
  against themselves: a PR cannot lower a floor or add a skip.
• The capacity ratchet scans the whole tree (loment/**, recursive) and covers two classes it
  used to miss: literal bounds (while j < 200) and fixed-size arrays ([u32; 16]). Every silent
  capacity either gains a guard or is explained by name.
• An independent oracle for the native surface. loment_spec_oracle_test derives expected
  values from a pure-Python model of docs/144 §3, so a criterion can fail when both
  implementations are wrong in the same way — the case a twin criterion cannot see.
• A falsifiable bootstrap root. loment/build/genesis/provenance.json binds the committed
  genesis to its seed, the mirror IR and the toolchain; --check catches a stale root and
  --verify rebuilds it.
• 10 shards, 90 suites, 1206 criteria — with the shard table measured from real runs instead of
  guessed.

new · runtime, threads, LVM

• Real threads carry a concurrency model: a global allocation lock (owner-tid reentrant) around
  alloc / free / the root cursor, and the collector defers entirely once a thread has been
  spawned (docs/245 §10). The criterion runs 4 threads × 1500 rounds and checks for duplicate or
  torn blocks; the thread program's IR is byte-identical between the two compilers.
• LVM ships its interpreter and compact form with the toolchain: T0 through T3, the 6.1× T2
  baseline, and the compact form measured in docs/250 / docs/251. The gate includes stability
  (no tier hangs, five refusals named) and a performance ceiling with a deterministic criterion.
• LibL / LibC link real libraries: system .so (V2) and static .a (V1), IFUNC and STT_NOTYPE
  imports, -fPIC objects (GOTPCREL), TLS relocations, section headers for objdump/readelf,
  PT_GNU_RELRO, and constructors. The reference linker and the self-hosted mirror produce
  byte-identical products on the same inputs.

fix · the 0.1.5 defect sweep

All 134 bug-labelled issues in the milestone are closed, and every fix that changed behaviour
carries a criterion that was red before it and green after. The recurring shape was silence, not
crashes:

• State-slot collisions inside the self-hosted compiler. match arm labels overwrote the GC
  tier flag (#719); the emitter's new diagnostic slot overwrote the thread_spawn flag, which
  surfaced as a bogus “more than 20 arguments” error on a thread probe. Both now have their own
  slots, pinned by criteria.
• Fixed tables that corrupted instead of refusing. The checker's name environment had no bound
  (2048 bytes = 256 entries) — 515 lets in one function segfaulted on Linux and silently wrote
  through on PE. It is now 4096 entries and stops at the cap; the emitter's tables gained guards
  (PT_EMAX, PT_FMAX, PT_GLRMX).
• Crashes replaced by diagnostics. The self-hosted lexer no longer reads past a full token
  buffer (the old guard was non-monotonic), the parser's nesting limits are one left-to-right pass
  over ( / [ / { plus unary chains, and lomadmit reports an oversized input instead of
  truncating. loment_crash_test drives the real driver in all nine cases.
• Formatter twins. Comments inside a multi-line || expression were attributed to different
  lines by the two formatters; a criterion now compares every corpus file byte for byte.
• Security. free scrubs the payload before reuse; http_req_build rejects CR/LF/NUL;
  installers verify every file they copy, invoke PowerShell by absolute path, and refuse to install
  without a verifier; the release publishes a detached signature; lompi pins the registry index
  out of band and quotes package-controlled paths.
• lompi's network layer is the internet package now — net_tcp4 / net_send / net_recv /
  net_hdr_end are gone, and the header-end logic is checked against a CPython oracle rather than
  against a second copy of itself.

known boundaries

• LSPE ships. The lspe dimension, the evidence ledger and the site census are in the tree
  (docs/262), and a release build accepts choose lspe_* — the last channel gate opened for
  0.1.5. Likewise lms ships at lms_full by default (docs/270): the safe memory manager's
  seven levels are present, not a dev-only glimpse.
• The six open 0.1.5 issues are the loment/lspe/ packaging split, not defects.
• no_std enforcement covers the mode/hosted row and the linker check; a library writing
  choose is a loader rule, and full capability-chain reporting for no_std remains #536.

Integrity anchors

These digests are published here, outside the archives they describe.
The installer prints the digest of SHA256SUMS; compare it with this block.

a36abbd127eb0228e597db7fcef1f0fbfa547db355456bec55c9d67b0d050228 *loment-0.1.5-linux-x64.tar.gz
8ec153b1c6808d38ca456a278e2852a46c3786136309060c7632211ed249a0a9 *loment-0.1.5-windows-x64-setup.exe
20b1d25152f3bdd5b7eafa08a04711d9563b7f2d050582994cb1b454497f2809 *loment-0.1.5-windows-x64.zip
23877c998309df829ca7b303395df937132b73419a2f079fb0cd39265935916c *loment-skill.zip

Signing key fingerprint: 39F11DAB7F8B3BA8C56CB57F274CB644E7C4C5D8

Loment 0.1.4.7

Loment 0.1.4.7

A defect release. The headline is not a feature: every library the package ships now compiles to
byte-identical IR in both implementations — 155 modules, zero known gaps, pinned by a criterion
that fails when the list grows. Getting there uncovered a handful of silent state bugs rather than
the "safe-callee set" divergence they looked like from the outside.

Install

Asset
loment-0.1.4.7-linux-x64.tar.gz	Linux x86-64. Unpack anywhere; bin/loment is the launcher.
loment-0.1.4.7-windows-x64.zip	Windows x86-64. Unzip and run install.cmd.
loment-0.1.4.7-windows-x64-setup.exe	Windows x86-64, self-extracting. Double-click.
loment-skill.zip	The agent guide (SKILL.md) on its own, for people who want only that.
SHA256SUMS	Checksums. The installers verify the payload against this before copying anything.

Installing and running needs no Python, no clang and no WSL — the package is native binaries plus
the standard library.

fix

the shipped libraries are twins

tools/loment_store_twin_test.py compiles every module under lompi/store as a root with both
compilers and compares the IR byte for byte. It now reports 155/155 identical, 0 skipped for a
refusal, 0 known gaps (#719). The std facade itself is excluded from that comparison by name and
by a criterion that fails if it ever stops being a pure facade — it has no functions; its 127
modules are each compared individually.

What had to be fixed to get there, in order of how long each was misdiagnosed:

• match arm labels wrote over the GC tier flag. Arm labels lived at 560 + arms*4; a four-arm
  match overwrote 572, the gc_auto_alpha flag. A non-alpha unit was then compiled as alpha:
  alloc(4) promoted to a stack buffer (slot.buf) where the reference keeps it on the heap. The
  symptom appeared only on one dependency chain (stdlib's sd_key_cmp), which is why it read as
  an escape-analysis divergence for most of a day. The labels now have their own slot; the same
  round runs into the capability table, so docs/227 records both attempts.
• Chained casts did only the first step. x as i32 as i64 lost the second conversion and emitted
  store i64 %i32value — invalid IR. Fixed in the expression path, not at every cast site.
• 64-bit decimal literals were not wrapped. let m: i64 = 9223372036854775808; printed 2^63
  where the reference prints -9223372036854775808.
• Builtin calls had no return type in the self-hosted type inference, so load8(b, 0) == 18 && …
  fell back to the expected type (bool) and emitted icmp eq i1 %t, 18.
• Shift operands: acc >> (35 - 5 * j) inherited the outer 64-bit expectation and came out as
  sub i64 with an i32 operand.
• Virtual type sentinels are not token indices. tok_is/tok_kind/tok_eq now refuse the
  ≥2^31 sentinels, and emitted_name translates them. Without this, a codegen built by clang read
  past its input and crashed with 0xC0000005, while the package's own build happened to survive.
• The checker's symbol table now holds 5200 entries (was 4600). The std facade closure has 4956
  top-level names. The constant table (CG_MAXCONST) was added so find_const stops scanning the
  whole unit per identifier — the reason the facade took tens of minutes to compile.

The lesson recorded in docs/158 and docs/227: a twin criterion that skips a module records
nothing about it, and "both compilers agree" said very little while whole suites were outside the
comparison.

fix · the 0.1.4.7 sweep

Thirty-five defects, each with a criterion that was red before the fix:

• std: bigdec_div_small with a zero divisor now returns the BIG_DIV0 sentinel instead of
  taking SIGILL (#722).
• internet: ten parser defects — IP/URI acceptance, port overflow, HTTP version shape, header
  control bytes, DNS compression pointers, the 255-octet name limit, CNAME/NS bounds, class checks
  (#680–#688).
• LVM: the compact form's decoder now refuses truncation, trailing bytes, impossible counts and
  bad pool bytes with a named section (#689–#693); lvm.py --compact-out/--compact make the format
  reachable from the CLI (#723).
• LSP: four defects in definition/hover/completion handling (#705–#710).
• tools and libraries: JSON, CSV, path and fmt fixes (#696–#699).
• VM runtime: three tier-boundary fixes (#715–#717).
• self-hosted compiler: dependency bodies are checked; the dependency pass hands each unit only
  its own closure instead of the whole program, so a sibling's choose runtime no longer reads as
  that unit's requirement (#726) — this is what made std/f64conv importable through the reference
  compiler at all.

docs/250 now points at the criteria that actually run (#725), and the missing self-hosted mirror
for the compact form is recorded in docs/158 with a ratchet that fails when someone starts it
(#724).

notes

• Gate: 992 criteria. loment_store_twin_test and the new language-face criteria are registered in
  .github/gate-floors.txt.
• The std facade is still slow to compile with the self-hosted compiler (the header of
  std.lomt has measured it since 0.1.4.5). Use individual modules; the facade is for "I want all
  of it".

Loment 0.1.4.6

Loment 0.1.4.6

Sixty-seven pull requests since 0.1.4.5-quickfix. Three of them are things getting their first real
version — an interpreter tier beside the compiler, libc reachable from both sides of the link, and a
gate that can finally see the runtime it is supposed to guard. The rest is the largest defect sweep
this project has had; most of the issue numbers below come from it.

This is not an exhaustive changelog — the issue and pull-request numbers are the index.

Install

Asset
loment-0.1.4.6-linux-x64.tar.gz	Linux x86-64. Unpack anywhere; bin/loment is the launcher.
loment-0.1.4.6-windows-x64.zip	Windows x86-64. Unzip and run install.cmd.
loment-0.1.4.6-windows-x64-setup.exe	Windows x86-64, self-extracting. Double-click.
loment-skill.zip	The agent guide (SKILL.md) on its own, for people who want only that.
SHA256SUMS	Checksums. The installers verify the payload against this before copying anything.

Installing and running needs no Python, no clang and no WSL — the package is native binaries plus
the standard library.

new

• LVM — the interpreter tier, T0 to T3. It reads the same IR the linker does, so a program never
  gains a second source of truth. T0 was the fourth reader of that IR (#277); T1 records a feedback
  profile without changing a byte of output (#379); T2 moves instruction decoding out of the execution
  loop — 6.1× T0 on the corpus, byte-identical output (#587); #328's compact form is
  375.9 KB → 107.0 KB for the same unit (#588); T3 adds guarded specialisation and deoptimisation
  (#589). Specs: docs/243, docs/247, docs/259, docs/250, docs/261.
  choose vm is accepted by this release — 0.1.4.5 refused it in a release build, and that gate
  opened here. What that does not mean: the interpreter is the repository's tools/lvm.py family,
  which the package does not ship, and the dimension does not change what the compiler emits yet. The
  line is a declaration, not a guarantee — the same standing as no_runtime.
• Threads. thread_spawn in the language, plus an os/thread library whose syscall numbers are
  read from the header rather than remembered (#349, docs/245).
• Four shipped libraries, each judged against a real implementation. os — 5 modules against
  CPython in the same Linux environment (#310); internet — 7 modules against real resolvers and
  servers (#281); LibL, the libc face: fopen/fread/fwrite/fseek, the remaining printf
  formats, malloc/calloc as spellings over the builtin heap (#397); and LibC — link the real
  libc, statically (#415) and at run time (#574). loment run calls zlib's compress/uncompress
  either way (#359, #360). The 0.1.4.5 lock on use libl and on libc is open (#406): a release build
  links a real libc.so.6 and runs it end to end.
• LMS level 1 — a second memory architecture beside the collector: its checker (E028/E029) and its
  level-3 entry, in both implementations (#414).
• Potato v14 — net_ladder, the width composition of a unit's networking sites (#278); and the
  zero-width phase's static rule (#311).
• A gate that can see the runtime. The 104 criteria that need a produced binary now run natively
  on the Linux runner instead of skipping (#380, #382); a criterion that did not run no longer counts
  as a pass, and .github/gate-floors.txt is a two-way ratchet (#404). Whole-tree generated artifacts
  left the pull-request path (#447).
• Distribution. Read-only mirrors on GitLab, Gitee, Codeberg and Bitbucket, pushed on every commit
  to main (#575); a Simplified Chinese README (#573); the VS Code extension is on the Marketplace
  (#273, #274, #275); releases announce themselves to Mastodon (#317, #318).

fix

• Reclamation. The sweeper no longer clears four mark bytes per freed block, which had been
  collecting live blocks next to garbage (#363, #312); free checks ownership and refuses a double
  free (#276); block-interior precision landed as per-site slot masks (#315, #286); an argument to a
  whitelisted syscall counts as a borrow, lifting the measured proof surface from 4/23 to 8/23 (#384);
  a collection no longer empties the free list (#407, #366); the collection trigger is attached where
  the bytes are asked for and counts what the allocator consumes, so str_concat counts too (#408,
  #412, #367); a recycled block keeps its recorded size, so the walks cannot be derailed (#410, #368);
  a promoted buffer's words reach the root scan (#410, #362); L2's epoch stops at the next same-name
  let, so two sibling loops no longer block each other (#585, #364).
• Diagnostics that used to be silent or wrong. @ at statement start, binary literals and the
  fall-off-the-end rule are rejected the way the reference rejects them (#396, #645, #49, #12, #22);
  an unknown type is E030 rather than E002 (#448); seven cases that were silent, wrong or fatal now
  say what the reference says (#398); the same program computes the same numbers in every surface
  grammar (#644, #237); use std no longer crashes (#644); the formatter keeps comments and keeps
  declaration modifiers on the declaration's line (#644, #45, #46).
• The emitter refuses what it cannot express. Mixed-width arithmetic is a checker error instead of
  invalid IR (#540, #289); bool != bool gets the reference's type in the self-hosted compiler (#540,
  #316); 11+ parameters (#540, #265); a struct whose last field has no trailing comma (#540, #11);
  integer literals wrap to their declared type (#535, #529).
• Runtime and CLI. Array indexing and arithmetic are checked, division by zero is a trap with a
  message, and the default tier's refusal names the right setting (#533, #18, #19, #321); let x = 1;
  (#7), let a: f64 (#323), a bare return; (#335), the compiler's own heap for brk (#345), the
  250-term expression (#226) and 400 nested blocks (#44) are diagnosed instead of crashing; Windows
  builds a PE rather than an ELF (#320); loment check no longer exits 0 for a file that cannot be
  built (#48); the language server reports the symbol's range (#508, #27, #28) and respects
  choose write grammar (#262); user-facing failures stop leaking internal names and unshipped doc
  paths (#440, #8); the Rust backend refuses free instead of lowering it to a no-op (#413, #165).
• Linker. A negative index is sign-extended (#430, #313); the mirror linker reads 64-bit globals
  and multi-line case tables (#439).

new issues

#442

Loment 0.1.4.5 QuickFix

Loment 0.1.4.5 QuickFix

A patch on top of 0.1.4.5. The toolchain
binaries in this package are byte for byte the same as that release's; what changed is the
Windows installer.

What was wrong

Double-clicking setup.exe looked like it did nothing. Measured, it was doing everything: the
package unpacked, install.cmd ran, the toolchain was installed, and the version file was written.
What it never did was show anything — and the console it leaves behind is not visible in that
launch, so "installed correctly" and "nothing happened at all" were the same thing on screen. It also
left cmd processes sitting at pause afterwards.

That is worse than a cosmetic problem: the previous release's headline installer bug was a package
that silently installed nothing, so the reasonable reading of "no window appeared" was that this one
was broken too.

What this release changes

The installer has a face. A window that, on a plain double-click:

1. fades in a rounded Loment mark and Welcome to Loment;
2. asks where to install, with the switches it used to bury in README.md as checkboxes
   (PATH, .lomt/.lom file association, the agent guide);
3. shows the install as it runs — the actual install.ps1 output, streamed line by line;
4. ends on a receipt: a green check, Loment 0.1.4.5 QuickFix is installed., and the window
   stays open until you close it.

It does not reimplement any of the install: it drives install.ps1 and shows what install.ps1
says. One implementation of the install, two faces.

The command line is untouched. install.cmd with any argument (-Prefix, -NoPath,
-DryRun, -Uninstall, and everything CI uses) takes the console path it always had, with the same
output and the same exit codes. Only a bare double-click — no arguments — opens the window.

A second, quieter fix. The installers now resolve loment and lompi after installing and
name anything earlier on PATH that is not this install. They only ever append to PATH
(deliberately — an installer should not reorder a machine it does not own), so a copy installed
earlier by hand wins silently, and lompi version then reports the older build with nothing
anywhere explaining why.

Install

Asset
loment-0.1.4.5-quickfix-windows-x64-setup.exe	Windows x86-64. Double-click; a window walks you through it.
loment-0.1.4.5-quickfix-windows-x64.zip	Windows x86-64. Unzip and run install.cmd (same window), or call install.ps1 yourself.
loment-0.1.4.5-quickfix-linux-x64.tar.gz	Linux x86-64. Unchanged from 0.1.4.5 — the Linux route always printed what it was doing.
loment-skill.zip	The agent guide (SKILL.md) on its own.
SHA256SUMS	Checksums. The installers verify the payload against this before copying anything.

Installing and running needs no Python, no clang and no WSL.

Which release to install

• 0.1.4.5's installer is unchanged and stays published as it is. Its setup.exe does install —
  it just does it invisibly. If you already installed from it, you have this toolchain; nothing needs
  re-installing.
• 0.1.4's setup.exe is still not being rebuilt
  (#117) — that asset genuinely installs nothing.
  Use the zip, or take this release.

Everything else

There are no other changes. What 0.1.4.5 contains — the four-rung GC ladder and the generational
collector, networking on both targets, lompi 0.2.0 Alpha — and what it does not contain, along
with the known open bugs, are listed in the
0.1.4.5 release notes; that document
still stands as written.

Loment 0.1.4.5

Loment 0.1.4.5

Three things were announced in
v0.1.4.5-pre while they were still
being built; they are in this release, along with the fixes that accumulated since 0.1.4.

This is not an exhaustive changelog — the issue and pull-request numbers below are the index.

Install

Asset
loment-0.1.4.5-linux-x64.tar.gz	Linux x86-64. Unpack anywhere; bin/loment is the launcher.
loment-0.1.4.5-windows-x64.zip	Windows x86-64. Unzip and run install.cmd.
loment-0.1.4.5-windows-x64-setup.exe	Windows x86-64, self-extracting. Double-click.
loment-skill.zip	The agent guide (SKILL.md) on its own, for people who want only that.
SHA256SUMS	Checksums. The installers verify the payload against this before copying anything.

Installing and running needs no Python, no clang and no WSL — the package is native binaries plus
the standard library. loment run hello.lomt and you are done.

---

New

LomentGC — reclamation as a ladder

Reclamation in Loment is not one algorithm over one heap. Every alloc site is assigned, at compile
time, to one rung of a ladder, and how much of this program's memory the collector is responsible
for is a number carried in the artifact:

Rung	What it does
L0	static promotion — a provably non-escaping allocation never reaches the heap at all
L1	last-use — the allocator front is returned right after the final use
L2	block epochs — a loop body, or either arm of an if, that allocates and drops returns its whole region at once
L3	mark-sweep with precise roots, triggered by bytes allocated

All four rungs are implemented twice — the reference compiler (tools/lomentc.py) and the
self-hosted one (loment/selfhost/) — and the two must agree byte for byte (#109, #110, #143, #157).
The tiers choose gc_manual / choose gc_auto / choose gc_auto_alpha select how far down the
ladder a unit is allowed to go. Potato v10 carries gc_ladder = {l0, l1, l2, l3, total_sites},
and two independent validators check the arithmetic (l0 + l1 + l2 + l3 == total_sites) without
reading a single line of source (#172).

The gc_auto_alpha policy is no longer one fixed threshold: it follows the live set (#200) and
collects generationally — a 1024-entry card table, a write barrier at every store8 site, and
minor / major levels (#230). The difference that matters between the tiers is not throughput but
the ceiling: on loment/examples/gc_heap/ — the repository's first program that really builds on
the heap (#264) — the same linked-list walk runs to completion under gc_auto and gc_auto_alpha
and exhausts the arena under gc_manual. Numbers in docs/210 §7.

Networking, on both targets

The same .lomt source opens a socket on Linux and on Windows, from the same output bytes. On
ELF the calls are the Linux syscalls directly; on PE the runtime dispatches 29 syscall numbers —
eight for files and processes, and the whole network surface through ws2_32: the sockets plus
poll, select, sendmsg / recvmsg, socketpair and epoll_* (#191 and the batches in
docs/217). As of this release no networking syscall is left
unimplemented on either target. syscall7 fills all six argument registers, so address-carrying
UDP — sendto / recvfrom, where the sixth argument is the socklen_t — is writable in the
language (#199). tools/loment_pe_test.py walks the whole surface by having a program connect to
itself.

lompi, the package manager

lompi moves to 0.2.0 Alpha and fetches by itself: lompi fetch reads the registry over a
raw socket instead of printing a git clone for you to run (#267). What it cannot do is HTTPS or
hostnames — there is no TLS and no resolver in the toolchain, so http:// with an IPv4 literal is
the whole fetchable surface (docs/236). Along the way the store
argument became optional, instance identity stopped re-reading the store, and --opt reached the
packaging path (#183, #188).

Two smaller features

• register <name> { ... } — declare a loment subcommand from source instead of hand-placing
  a loment-<name> executable on PATH (#208).
• The escape hatch, end to end — loment build --opt, a pre-optimized kernel object, and
  lompi obj, for the cases where the native toolchain's lack of an optimizer is the thing in your
  way (docs/212, #179, #195).

---

Fix

• The Windows installer works. (#117) — 0.1.4's
  self-extracting setup.exe unpacked and exited having installed nothing: it launched install.cmd
  by bare file name, and where NoDefaultCurrentDirectoryInExePath is set, cmd cannot resolve
  that. The launch command now carries the unpack directory. The 0.1.4 asset itself is not being
  rebuilt — that would change the bytes under a version number already in the wild — so 0.1.4 users
  should stay on the zip until they move here.
• The installers now name a shadowing lompi / loment. They only ever append to PATH
  (deliberately: an installer should not reorder a machine it does not own), so a copy installed
  earlier by hand wins silently — you type lompi version and get the older build with nothing
  explaining why. Both scripts now resolve the names after installing and print the path that is
  actually in front, without removing it.
• lomelf can link an L0-promoted product. An alloca used as a plain SSA value was not
  recognised, so a unit whose alloc sites were all promoted to the stack could not be linked at all
  (#239, #257). The same fix moved the write barrier
  to follow "does this unit need a heap", which had been emitting a reference to an arena that
  L0-promotion had removed.
• Two IR bugs that made array-subscript artifacts invalid LLVM (#177), and a release-manifest
  ordering bug that made every pull request look conflicted (#138).
• Entry points are correctly aligned: stackrealign is now emitted on _start, whose stack is 8
  bytes off the SysV convention (#206). Binary operators are typed by the expected type rather than
  by their operands (#204), and loment fmt refuses a file written in a non-native surface grammar
  instead of destroying it (#115, #203).
• The surface-grammar translators, in batches. About thirty issues fixed in the C, Python and
  other choose write grammar paths — silent drops, silently-wrong values, and files that failed to
  compile with a generic error instead of saying what was unsupported: the issues are #74,
  #115–#137 and #145–#155, and one language server crash (#142); the batches that fixed them are
  #171, #180 and #201. (docs/211 is how they were found: a
  pure-Loment project written in each surface grammar.)
• Two flaky criteria were made deterministic (#190, #261); flaky checks turn unrelated pull
  requests red and cost every contributor time.

---

What else

Not in this release.

• choose hosted — the dimension for artifacts that link real libc and shared libraries — is
  refused by a release build, by name (docs/222 sec 4.5,
  docs/219 sec 8c, #207, #258). The capability is in the development
  channel; calling libc from a 0.1.4.5 build is not offered.
• The vm dimension is in main and is refused by a release build the same way — it is a
  gate, not a feature, and an extension module's bytecode does not exist yet.
• The development side is not self-hosted. The toolchain compiles and runs with no Python at run
  time, but the reference implementation (tools/lomentc.py and friends) and the Python test suites
  are still in the repository (docs/189). "The repository contains
  only Loment" is not yet true.
• There is no networking library and no admission gate. std has no net module — you write the
  syscalls yourself — and a unit that declares excluded "network: ..." is not stopped from calling
  socket, because the capability check compares domain names and never looks at behaviour
  (docs/218).

Known bugs, still open. The ones most likely to be met, with their issue numbers:

• #164 — free checks neither ownership nor
  double-free, so freeing twice puts one region both at the frontier and on the free list, and two
  live allocations alias. Also #165: the Rust
  backend lowers free to a no-op.
• #265 — a function with 11 or more parameters makes
  the self-hosted compiler die with SIGILL, silently, where the reference implementation accepts it.
• #163 — lompi truncates any source file larger
  than 256 KiB, and the content-hash identity covers only the truncated part.
• #226 — a flat expression of ~250 terms makes
  check die with a RecursionError instead of a diagnostic.
• #149 — check does not check the bodies of
  modules brought in by use, so a library can ship with a body type error and every consumer checks
  clean. #139: two files that declare the same
  module name pass check and then produce IR with two define i32 @f.
• #262 — both language servers ignore the
  choose write grammar declaration, so a valid file in a non-native gr...

Loment 0.1.4.5 — coming

Loment 0.1.4.5 — coming

This is an announcement. There is nothing to download.

The tag carries no archives and no installers — it exists so that what 0.1.4.5 will
contain is stated in public while it is still being built. If you want a toolchain today,
install 0.1.4.

Each section says which half it is: in main today or planned.

Three things are coming in 0.1.4.5.

1. LomentGC — the four-tier reclamation ladder

In main today.

Reclamation in Loment is not one algorithm over one heap. Every alloc site is assigned, at
compile time, to one rung of a ladder, and how much of this program's memory the collector is
responsible for is a number carried in the artifact:

Rung	What it does
L0	static promotion — a provably non-escaping allocation never reaches the heap at all
L1	last-use — the allocator front is returned right after the final use
L2	block epochs — a loop body that allocates and drops returns its whole region at once
L3	mark-sweep with precise roots, triggered by bytes allocated

The ladder is implemented twice — the reference compiler (tools/lomentc.py) and the
self-hosted one (loment/selfhost/) — and the two must agree byte for byte. The three tiers
choose gc_manual / choose gc_auto / choose gc_auto_alpha select how far down the ladder a
unit is allowed to go. Potato v10 carries gc_ladder = {l0, l1, l2, l3, total_sites},
and two independent validators check the arithmetic (l0 + l1 + l2 + l3 == total_sites)
without reading a single line of source.

Still being built. The adaptive collector for gc_auto_alpha is in review
(#200); today the L3 residual of that tier is
not collected. The GC v2 design (gc_strict, reclamation-by-recomputation, Potato v11) is a
design document, not an implementation — none of its criteria have been run yet.

The design record is docs/210; the ledger of what is claimed
and what is still open is docs/202.

2. Networking, on both targets

In main today.

The same .lomt source can open a socket on Linux and on Windows, from the same output
bytes. On ELF the calls are the Linux syscalls directly; on PE the runtime dispatches 21
numbers through ws2_32. syscall7 fills all six argument registers, so address-carrying
UDP — sendto / recvfrom, where the sixth argument is the socklen_t — is expressible in
the language. tools/loment_pe_test.py walks the whole surface by having a program connect to
itself: socket / setsockopt / bind / listen / getsockname / connect / accept /
read / write / poll / accept4 / IPv6.

Two boundaries, stated plainly, because they are the parts that are not there:

• There is no networking library. std has no net module; you write the syscalls
  yourself. Nothing wraps them yet.
• There is no admission gate. A unit that declares
  excluded "network: 本单元不申请任何 net 能力" (as loment/examples/demo.lomt does) is not
  stopped from calling socket — the capability check compares domain names and never looks
  at behaviour. docs/218 is a research draft arguing the
  project should have no permission list at all rather than a gate; its criteria have not
  been run.

The measurements are in docs/217,
docs/220 and docs/221.

3. lompi 0.2.0 Alpha

Planned.

The package manager moves from 0.1.5 to 0.2.0 Alpha. That announcement lives on the
package manager's own repository, FujoJTOP/lompi.

---

Loment is a systems programming language that compiles to native x86-64 — Linux ELF,
Windows PE, or a freestanding object for bare metal — with no runtime and no libc. The
toolchain is self-hosted at run time: compiling and running needs no Python, no clang and no
WSL. The language surface is frozen (docs/158 says what changing
it costs); the implementation is not, and this announcement is what "not frozen" looks like.

Watch the 0.1.4.5 milestone for the real thing.

Loment 0.1.4

Loment 0.1.4

📢 Notice — Loment 0.1.4 Windows installer

We have identified the following: on some Windows systems, double-clicking loment-0.1.4-windows-x64-setup.exe produces no response whatsoever — no installer window, no error message; the process exits silently with code 0.

The cause has been located. The self-extracting package invokes the installer script by a filename without a path (cmd.exe /c install.cmd), while the script resides in the extraction directory. On systems where the Windows hardening setting NoDefaultCurrentDirectoryInExePath is enabled, cmd no longer searches the current directory and therefore cannot find the script. Note that the same file behaves differently across machines: systems without that setting install normally.

All Windows users are advised to install from the zip archive: unpack loment-0.1.4-windows-x64.zip and run install.cmd in the unpacked directory. Both routes install identical contents.

The fix is complete and will ship with the next release (#114). The published 0.1.4 installer will not be rebuilt — rebuilding would change the bytes published under an existing version number. See #117 for details.

A systems programming language that compiles to native x86-64 — Linux ELF, Windows PE, or a
freestanding object for bare metal — with no runtime and no libc. The toolchain is
self-hosted at run time: compiling and running needs no Python, no clang, no WSL.

Install

Platform	File	How
Linux / WSL	loment-0.1.4-linux-x64.tar.gz	unpack → sh install.sh
Windows	loment-0.1.4-windows-x64.zip	unpack → run install.cmd (or powershell -File install.ps1)
Windows	loment-0.1.4-windows-x64-setup.exe	⚠️ do not use — see the note above
any agent	loment-skill.zip	the language guide on its own, for agents

SHA256SUMS covers the three archives and the skill zip; the installers check it first. Both
install routes put down the same thing: the bootstrap artifacts, the launcher, and the seed.
The Windows installer is unsigned, so SmartScreen will warn once.

Built from main at 0826ac5 (2026-09-23) — share/loment/version inside the package
says so, and that is what the tag v0.1.4 points at.

Verified before publishing: SHA256SUMS checks out for all four files; the Windows zip
installs and the installed toolchain compiles and runs a program natively on Windows
(no clang, no WSL, no Python); the Linux tarball installs in a POSIX shell and its toolchain
does the same in WSL.

What is in it

• The language: Rust-flavoured surface syntax, capability domains
  (capability / guard / excluded / revocable), a frozen surface for this line
  (docs/158).
• Six more surface syntaxes on top of the base one — C, C++, Java, C#, Go, Python: the
  same program, written in any of them.
• A toolchain written in Loment: loment / loment-cli / lompi, plus driver, lsp,
  fmt, doc, lomelf and the native ELF/PE backends. loment run builds a PE program on
  Windows and runs it natively, no clang in the path.
• A standard library in the package: std (127 modules) + host (7), 137 files.
• Potato formal objects (the cross-line contract) exported by the compiler.
• A generated manual, a
  language guide,
  an editor extension, and
  examples.

What is not in it (read this before relying on it)

0.1.4 is a real release, and it is not a claim that everything on the roadmap closed.
The audited checklist is
docs/202;
this is where it stands:

• Not fully self-hosted yet. The toolchain runs without Python, but the repo still carries
  non-Loment development-time code — the Python criteria are being ported to Loment one at
  a time (docs/189).
  Two classes are deliberately exempt (vendored cross-line counterparts; hand-written
  verification shells that wait on a deliverable), and editors/ stays JS/TS because VS Code
  extensions can only be JS/TS (docs/202 §2.3).
• A hosted layer is not there yet. A choose no_std project that pulls in a hosted library
  is not rejected today — that check is the next piece of work (docs/202 §2.4).
• GC is one-tier. free is accepted but is a placeholder (the bump heap does not reclaim);
  choose gc_auto / gc_manual are not in the language yet (docs/175 §3.4).
• The gate is "no new reds", not "all green". The committed baseline still has reds; four of
  them need a private sibling repository a public runner cannot read, so "everything green"
  is not literally attainable today (CONTRIBUTING.md).
• Self-consistency is not correctness. A large part of the evidence is "the reference
  implementation and the self-hosted one agree byte for byte" — two implementations by the same
  author agreeing does not prove the semantics are right. That ceiling is stated in
  docs/203 §7.3,
  which is also where the independent review of the audit package lives (24 claims: 22 accepted,
  1 rejected, 1 unverifiable on the reviewer's machine).
• Known open items are listed honestly, not hidden: see
  docs/158 §4 (12 of
  them, including two that are "consistently wrong on both sides" and therefore invisible to a
  byte-comparison).

Pointers

• What 0.1.4 means and where it is going: docs/175
• The audited release checklist, item by item: docs/202
• Independent review of the audit package: docs/203
• Freeze surface and its cost: docs/158
• Contributing, including how to read a red gate: CONTRIBUTING.md

Loment 0.1.4 Pre

A pre-release of main at 0.1.4 — now installable. Tagged so that "the repo has
versions" is visible; 0.1.4 final is not finished yet (see What it is not below).

Install

Platform	File	How
Linux / WSL	loment-0.1.4-linux-x64.tar.gz	unpack → sh install.sh
Windows	loment-0.1.4-windows-x64.zip	unpack → powershell -File install.ps1
Windows	loment-0.1.4-windows-x64-setup.exe	double-click (self-extracting)
any agent	loment-skill.zip	the language guide on its own, for agents

SHA256SUMS covers the three archives and the skill zip; the install scripts check it first.
Both install routes put down the same thing: the bootstrap artifacts, the launcher, and the
seed — the package contains no Python. To build from a checkout instead, see
QUICKSTART.md.

The Windows installer is unsigned, so SmartScreen will warn once.

Which commit these are built from: main at 557fd26 (2026-09-22) — that is the commit
the archives were built from, and share/loment/version inside them says so. The tag
v0.1.4-pre itself points at an earlier commit, so GitHub's auto-generated Source code
archives follow the tag and are the earlier tree — if you want the source that matches these
binaries, check out 557fd26.

Verified after upload: SHA256SUMS checks out for all four files; the Windows zip
installs (install.ps1 -Prefix … -NoPath -NoFileType -NoSkill) and the installed toolchain
compiles and runs a program natively on Windows (no clang, no WSL, no Python); the Linux
tarball installs in a POSIX shell and its toolchain does the same in WSL.

What is here

• A systems programming language that compiles to native x86-64 — Linux ELF, Windows PE,
  or a freestanding object for bare metal — with no runtime and no libc.
• A toolchain written in Loment: compiling and running needs no Python (the bootstrap
  starts from a genesis ELF committed to the repo).
• Six more surface syntaxes on top of the base one: C, C++, Java, C#, Go, Python —
  the same program, written in any of them.
• Potato formal objects (the cross-line contract) exported by the compiler, plus a
  capability domain model (capability / guard / excluded / revocable).
• The static gate runs on GitHub Actions for every pull request and push to main
  (ci.py --static-only). It is a real gate: a measured baseline of reds is committed, and
  a pull request fails if it introduces a new one.
• A generated manual,
  a language guide,
  an editor extension,
  and examples.

What it is not

• Not 0.1.4 final. The language surface is frozen for this line
  (docs/158),
  but the tree is still moving every day.
• Not fully self-hosted yet. The toolchain runs without Python, but the repo still
  carries non-Loment development-time code (the criteria are being ported to Loment —
  docs/189).
• Not all checks are green. The gate's baseline still contains reds — four of them need
  a private sibling repository (FujoJTOP/LinuxFUAI) that a public runner cannot read.
  "Everything green" is therefore not literally attainable today; the gate's rule is
  "no new reds".
• 0.1.4's own prerequisites are not all closed — the audited checklist is
  docs/202.

Pointers

• Version source of truth: tools/loment_release.py (RELEASE)
• Direction / what 0.1.4 means: docs/175
• Release prerequisites, item by item: docs/202
• Freeze surface: docs/158
• Contributing (including how to read a red gate): CONTRIBUTING.md