feat(compiler): make outputs write-only with live input references

README.md

@@ -125,7 +125,7 @@ Compile and run:
 
 Templates are defined once with a clear input/output contract. The first line declares the output and input — the indented body describes the transformation.
 
-Think of a template as a **black box**: data flows in through inputs, gets transformed, and flows out through outputs. Outputs work **by reference** — calling a template directly modifies the output variable in the caller's scope.
+Think of a template as a **black box**: data flows in through inputs, gets transformed, and flows out through outputs. Outputs work **by reference**. A caller may connect an input and an output to the same variable; inside the call, later input reads observe writes through that output. The caller's variable receives the result after every right-hand side of the assignment has been evaluated.
 
 `math.pt`
 ```python
@@ -134,7 +134,18 @@ y = Square(x)
 	y = x * x
 ```
 
-Inputs are read-only — they flow in. Outputs are writable — they flow out. Every function is a transformation.
+Inputs are read-only — they flow in. Outputs flow out: the template may read one only after assigning it unconditionally, as in `sq = x * x` followed by `cube = sq * x`; before that, use a local. Read-only means the template cannot assign through the input name; it does not freeze a value shared with an output. A caller may reuse a variable as both argument and destination, `a = Square(a)`.
+
+```python
+out, seen = Fold(current, item)
+    out = current + item
+    seen = current
+
+value = 10
+value, seen = Fold(value, 5)  # value = 15, seen = 15
+```
+
+Moving `seen = current` before `out = current + item` instead makes `seen` equal 10. The same order applies to each iteration of a ranged call. To keep an old value across a write, save it first with an explicit assignment; that is where any copy happens.
 
 ### Generics by use
 

compiler/abi.go

@@ -15,10 +15,9 @@ const (
 )
 
 type ABIParam struct {
-	Source    Type
-	Lowered   Type
-	Mode      ABIParamMode
-	AliasSlot int
+	Source  Type
+	Lowered Type
+	Mode    ABIParamMode
 }
 
 type ABIReturn struct {
@@ -29,12 +28,12 @@ type ABIReturn struct {
 
 // FuncABI captures the lowered function boundary for one mangled variant.
 // Direct scalar returns carry a hidden destination seed so a skipped write
-// preserves the caller's value. Range-bearing variants may additionally need
-// hidden alias state for loop-carried accumulation.
+// preserves the caller's value. Whether an input shares a caller binding with
+// an output is a compile-time property of each call site, lowered as a private
+// variant of the function; it never appears in the native signature.
 type FuncABI struct {
-	Params         []ABIParam
-	Return         ABIReturn
-	HasRangeParams bool
+	Params []ABIParam
+	Return ABIReturn
 }
 
 func isDirectScalarABIType(t Type) bool {
@@ -48,18 +47,6 @@ func isDirectScalarABIType(t Type) bool {
 	}
 }
 
-// aliasableOutput reports whether an output can back a parameter's alias slot.
-// The hidden selector picks an output by position and the callee then reads that
-// storage as the parameter's own type, so the two must lower identically. There
-// is no numeric conversion anywhere on this path, and a pointer selected across
-// mismatched types would be loaded as the wrong type.
-func aliasableOutput(paramType, outputType Type) bool {
-	if ptr, ok := outputType.(Ptr); ok {
-		outputType = ptr.Elem
-	}
-	return TypeEqual(paramType, outputType)
-}
-
 func directScalarABIReturnType(outTypes []Type) (Type, bool) {
 	if len(outTypes) != 1 {
 		return nil, false
@@ -79,28 +66,15 @@ func classifyFuncABI(paramTypes []Type, outTypes []Type) FuncABI {
 		},
 	}
 
-	for _, paramType := range paramTypes {
-		if isRangeDriverType(paramType) {
-			abi.HasRangeParams = true
-			break
-		}
-	}
-
-	aliasSlot := 0
 	for i, paramType := range paramTypes {
 		paramABI := ABIParam{
-			Source:    paramType,
-			Lowered:   Ptr{Elem: paramType},
-			Mode:      ABIParamIndirect,
-			AliasSlot: -1,
+			Source:  paramType,
+			Lowered: Ptr{Elem: paramType},
+			Mode:    ABIParamIndirect,
 		}
 		if isDirectScalarABIType(paramType) {
 			paramABI.Mode = ABIParamDirect
 			paramABI.Lowered = paramType
-			if abi.HasRangeParams {
-				paramABI.AliasSlot = aliasSlot
-				aliasSlot++
-			}
 		}
 		abi.Params[i] = paramABI
 	}
@@ -120,16 +94,6 @@ func (abi FuncABI) UsesIndirectReturn() bool {
 	return abi.Return.Mode == ABIReturnIndirect
 }
 
-func (abi FuncABI) NumAliasSlots() int {
-	count := 0
-	for _, param := range abi.Params {
-		if param.AliasSlot >= 0 {
-			count++
-		}
-	}
-	return count
-}
-
 func (abi FuncABI) sourceParamBaseIndex() int {
 	if abi.UsesIndirectReturn() {
 		return 1
@@ -141,21 +105,59 @@ func (abi FuncABI) SourceFunctionParamIndex(paramIndex int) int {
 	return abi.sourceParamBaseIndex() + paramIndex
 }
 
-func (abi FuncABI) AliasParamBaseIndex() int {
+func (abi FuncABI) DirectReturnSeedParamIndex() int {
+	if abi.Return.Mode != ABIReturnDirect {
+		return -1
+	}
 	return abi.sourceParamBaseIndex() + len(abi.Params)
 }
 
-func (abi FuncABI) AliasFunctionParamIndex(paramIndex int) int {
-	slot := abi.Params[paramIndex].AliasSlot
-	if slot < 0 {
-		return -1
+// sharableOutput reports whether an input of paramType can share an output
+// declared as outType: the input's storage must be the declared type or a
+// compatible wider representation that a store converts (an owned string for
+// a static output, a concrete-rank array for an untyped empty one, a schema
+// for a header-only table). A struct shares only at its exact type, since
+// nothing converts its fields. The shared output then uses the input's
+// storage, so a write lands where the next read looks.
+func sharableOutput(paramType, outType Type) bool {
+	if _, isStruct := outType.(Struct); isStruct {
+		return TypeEqual(paramType, outType)
 	}
-	return abi.AliasParamBaseIndex() + slot
+	return bindingSlotCompatible(paramType, outType) && TypeEqual(mergeBindingSlotType(paramType, outType), paramType)
 }
 
-func (abi FuncABI) DirectReturnSeedParamIndex() int {
-	if abi.Return.Mode != ABIReturnDirect {
-		return -1
+// aliasPattern decides, per callee parameter, the one-based caller destination
+// whose binding the argument shares, or 0; nil when no parameter shares one.
+// argNames holds one entry per parameter, empty for an argument that is not a
+// plain identifier. dests contains output destination names in order, with
+// synthetic staging names already resolved to the bindings they represent.
+// outTypes are the declared output types. enclosing maps a caller-body input to
+// the caller output it already shares, so a nested call forwards that sharing.
+// A parameter shares at most one destination, the first that matches.
+func aliasPattern(argNames, dests []string, paramTypes, outTypes []Type, enclosing map[string]string) []int {
+	var pattern []int
+	for i, name := range argNames {
+		if name == "" {
+			continue
+		}
+
+		for j, dest := range dests {
+			if j >= len(outTypes) {
+				break
+			}
+			if !sharableOutput(paramTypes[i], outTypes[j]) {
+				continue
+			}
+			if dest != name && enclosing[name] != dest {
+				continue
+			}
+			if pattern == nil {
+				pattern = make([]int, len(argNames))
+			}
+			pattern[i] = j + 1
+			break
+		}
 	}
-	return abi.AliasParamBaseIndex() + abi.NumAliasSlots()
+
+	return pattern
 }

compiler/bounds.go

@@ -498,6 +498,11 @@ func (c *Compiler) arraySymbolForAffineGuard(arrayExpr ast.Expression) (*Symbol,
 	if !ok {
 		return nil, nil, false
 	}
+	// A staged slot can change length inside the loop, so a bound checked
+	// once before it does not hold for every iteration.
+	if _, staged := c.currentStmtCtx().stagedSlots[raw.Val]; staged {
+		return nil, nil, false
+	}
 	arraySym := c.derefIfPointer(raw, ident.Value+"_affine_arr")
 	arrType, ok := arraySym.Type.(Array)
 	if !ok || arrType.ElemType == nil {