feat(compiler): element-wise array comparison masks + per-slot condition propagation

[thiremani]

Two connected changes: array comparisons become shape-preserving element-wise masks, and value-position lowering is unified on per-slot condition propagation so every conditional form — comparisons, chains, arithmetic, || — resolves slot by slot through one mechanism.

Array comparison = element-wise mask

Array comparisons (>, <, <=, >=, ==, !=) produce a shape-preserving, element-wise mask instead of a shrinking filter: each position yields its LHS element where the comparison holds, else 0, in place. Array-array zips to the min length; array-scalar spans the array and broadcasts the scalar. This is the scalar "comparison yields LHS-or-0" applied per element, consistent with array arithmetic (+, *), which already zips to min length.

[1 3 5 7] > [0 4 4 8]   ->  [1 0 5 0]   (was [1 5])
[4 8 1]   > 3           ->  [4 8 0]     (was [4 8])

Strings stay lexicographic; array arithmetic is unchanged; range-driven stream comparisons still skip (see Range Semantics).

Per-slot condition propagation

Extraction now returns a condition per output slot, and conditions merge along dataflow: a comparison ANDs its operands' slot conditions with its own cell; slot-aligned arithmetic zips; a call ANDs every argument condition into all of its outputs (a failing argument comparison skips the call and keeps old — the scalar hoist rule at tuple width); array cells and (cond value) remain self-resolving. Gates fold all slots into one AND. Statement commits gate each destination slot independently against seeded temps: array slots mask (overwrite), scalar slots keep old on failure — exactly what a single comparison does, per slot.

This makes the following first-class (no special cases, no all-or-nothing fallbacks):

• Chained tuple comparisons: a, b = Pair(5,7) > Pair(1,8) < Pair(9,9) → 5 keep-old; as a gate it ANDs like a single chain.
• Arithmetic over tuple comparisons: (Pair(5,7) > Pair(1,8)) + Pair(0,0) → 5 0 fresh; the combine runs only when its slot commits.
• Per-slot || fallback: slot i takes the right side only when slot i of the left failed; fallback beats keep-old; both-fail keeps old; masks always yield so || never affects array slots. || inside comparison operands works.
• Ranged statement conditions gate iterations without changing per-slot value semantics.

The old || yield lowering, the tuple-comparison special case, and both interim solver rejections are deleted. The one rejection kept is a || in a (cond value) value arm — a position that previously panicked the compiler (also on master) and is now a clean, deduplicated diagnostic; the misleading "not converging" cascade after a function-body type error is gone.

Memory safety

The ownership protocol was adversarially reviewed and each fix is pinned by a leak-checked e2e test: static strings are never stored as leaking heap copies (nor freed as if they were heap); slot commits derive their store target from the slot's element type (static winner over a heap destination is copied by coercion); spine-leaf values deref before the copy decision (a Ptr-wrapped call output previously aliased into a || slot and double-freed); named array operands survive their masks; runtime-skipped mask stores free on the else arm and failed bounds guards free all unresolved masks; a parenthesized right-operand comparison no longer double-frees on the false path (pre-existing on master).

Out-of-bounds reads fail their lanes

An OOB read was context-dependent (whole-statement no-op in plain/tuple assignments, checked-get zero in scalar comparisons and || fallbacks). It is now a failed condition on the lanes it feeds, merged by the same dataflow rules: a plain read no-ops its assignment; sibling expressions in one statement commit independently (a, b = arr[oob], 5 keeps a, sets b; simultaneous-assignment order preserved, so swaps still work); a call merges lanes, so an OOB argument keeps that call's outputs old as a unit; comparisons and || fallbacks fed by an OOB read keep old instead of judging a fabricated zero. Collector cells over explicit ranges keep the documented OOB-reads-zero opt-in.

Tests / docs

E2E coverage for masks (position stability, arr-scalar, unequal lengths, heap-string elements), per-slot tuples (keep-old, chains, arithmetic spines, gated call leaves, ranged gates, per-slot || incl. heap fallbacks, static/heap string ownership, runtime-skipped masks, OOB operands) — all leak-checked. Solver unit tests updated (chains and inner-|| now type cleanly; value-arm || rejected exactly once even across fixpoint passes). Docs (README, Conditional Value Semantics, Range Semantics) updated.

[thiremani]

Review: feat(compiler): make array comparison an element-wise mask, not a filter

Clean semantic redesign. The filter→mask change is well-motivated (position-preserving, consistent with array arithmetic zip-to-min), and the per-slot tuple comparison is a natural extension. The test coverage is thorough — mask position stability, unequal lengths, heap-string ownership, keep-old-on-false for existing vars, gated tuples, OOB operands, and chained rejection — all leak-checked. The chained-rejection guard in commit 2 is the right call: reject now rather than silently regressing to all-or-nothing. Docs updated consistently.

A few observations (none blocking):

---

1. Duplicated result-symbol construction (compiler/array.go)

compileArrayArrayMask and compileArrayScalarMask both end with:

i8p := llvm.PointerType(c.Context.Int8Type(), 0)
return &Symbol{
    Type: Array{Headers: nil, ColTypes: []Type{resElem}, Length: 0},
    Val:  c.builder.CreateBitCast(resVec, i8p, "arr_i8p"),
}

That is 4 lines at 2 call sites — small, but if the Length: 0 / Headers: nil contract ever changes, both must update. A one-liner helper (maskResult(resElem, resVec)) would centralize it. Not critical at two sites — up to you.

2. Generic LLVM IR block names (compiler/cond.go)

assignUnderStmtCond creates blocks named "if" and "continue" — the most generic names possible. Every other helper in this PR uses descriptive prefixes (mask_set, tuple_slot_if, tuple_bounds_ok, etc.), which makes IR dumps and crash stacks much easier to navigate. Something like "stmt_cond_if" / "stmt_cond_cont" would be consistent with the rest of the file.

3. Double-negative guard in independentTupleComparison (compiler/cond.go)

if !info.HasCondArray() && !info.HasCondScalar() {
    return nil, false
}

Reads as "if it has neither comparison mode, bail." Correct, but a moment of hesitation on first read. A positive helper like info.HasAnyComparison() (returning HasCondArray() || HasCondScalar()) would make this guard read as if !info.HasAnyComparison() — clearer intent. Minor style nit.

4. Test comment wrapping (compiler/solver_test.go:642)

// cell is a mask (an array value), not a boolean, and gate lowering would
// silently drop it. MixSA returns (scalar, array) so the array cell is not first —

The second line extends past the ~80-col guide where the surrounding comments wrap. Very minor; easy to fix if you are already touching the area.

---

Overall: Solid work. The semantics are clear, the per-slot decomposition is well-guarded (bounds, statement-cond, chained rejection), and the ownership model (mask owns copies, source retains) is correctly handled for both scalar and heap types. Good to merge after addressing any of the above you agree with.

Co-Reviewed-By: Claude Opus 4.6