Memory safety,
without the GC tax.

Return a reference without writing a lifetime

Riddle has no lifetime syntax. An interprocedural fixpoint escape analysis computes a "leaked parameters / returned-from parameters" summary for every function, and uses it to decide whether a local stays on the stack or is promoted to the conservative non-moving GC heap. Storage location never relaxes move or borrow checking.

struct Foo {
    x: i32,
    y: i32,
}

fun make_ref() -> &Foo {
    let foo = Foo { x: 1, y: 2 };
    &foo // escapes the frame, so foo is promoted to the GC heap
}

The GC only decides addresses — destruction stays deterministic

Types implementing `std::ops::Drop` run their destructor deterministically when the owning scope ends. Escaping to the GC heap changes a value’s address, not when it is destroyed; drop flags make sure a moved-out value is never destroyed twice.

struct FileHandle {
    raw: i32,
}

impl Drop for FileHandle {
    fun drop(&mut self) {
        // release the external resource behind raw
    }
}

Locals, parameters, pattern bindings, iteration elements, aggregate fields and closure environments are all covered.

• Drop + Copy, calling the destructor directly, and moving a field out of an explicit Drop type are all rejected
• A for loop’s current element, its iterator and its early-exit paths each get their own drop scope

Abstraction that costs nothing at runtime

Traits support default methods, associated types with defaults, supertrait declarations and transitive bounds. Generics are monomorphized in the C backend, and const generics lift lengths into the type.

trait Summary {
    fun title(&self) -> &str;

    fun summarize(&self) -> &str {
        self.title()
    }
}

struct Buffer<T, const N: usize> {
    data: [T; N],
}

An impl that does not override a method inherits the trait’s default body.

• <T: A + B> and where clauses; where on an impl is checked against the Paterson condition
• Operators dispatch to user types through #[lang = "..."] traits; scalar operations lower straight to native C operators with no wrapper functions
• == / != check PartialEq, ordering comparisons check PartialOrd, and heterogeneous right-hand-side impls are supported

The compiler tells you exactly which arm is missing

`match` performs recursive exhaustiveness checking over enums, booleans, `()`, integers, tuples and structs. A non-exhaustive integer match does not report a vague error — it reports the uncovered contiguous ranges.

fun classify(n: i32) -> i32 {
    match n {
        x if x < 0 => -1,
        0 => 0,
        _ => 1,
    }
}

Exhaustiveness gaps are reported as E0039 together with the uncovered ranges.

• A failed guard falls through to the following arms; guarded arms do not count toward static exhaustiveness
• Unit, tuple and struct enum variant patterns are supported, and payload bindings are visible in both the guard and the arm

Talking to C, with the boundary written down

Imports inside an `unsafe extern "C"` block are unsafe by default, and you opt individual functions back in with `safe fun`. The C backend provides no built-in helpers keyed on function names — every `extern "C"` declaration becomes an ordinary external symbol.

unsafe extern "C" {
    safe fun abs(x: i32) -> i32;
    fun malloc(size: usize) -> *mut u8;
}

fun main() {
    let value = abs(-42);
    let pointer = unsafe { malloc(16) };
}

Dereferencing and indexing raw pointers requires an unsafe context.

• &str maps to const char* in C imports; exported definitions with a body keep the { ptr, len } fat pointer
• unsafe fun and unsafe fun(...) -> T function types, with one-way safe-to-unsafe conversion