LINT028 and LINT029: argument mutation is a finding

[aleksisch]

Two new lint rules make argument mutation a finding, and the tree is converted to match them where the conversion is done.

LINT028 catches a by-value var argument that the body both writes and reads. The argument is silently a local: its writes never reach the caller, and after the first write the name no longer holds what the caller passed. The fix is a const parameter plus a local copy. This rule is complete across the tree, and it found two live bugs. In examples/games/river_run, drop_texture and drop_fbo zeroed a by-value copy, so the caller's GL handle stayed stale and a reinit could double-delete it. In modules/dasTerminal, the OSC8 hyperlink dedup state traveled by value through the checkpoint chain, so every row restarted from stale state and re-emitted escape sequences. Both are now by-reference.

LINT029 catches a mutated by-ref argument - a var array or table, or an explicit &. Functions communicate through return values; a call site where every argument is read-only is one a reader can reason about locally. Four shapes stay exempt: a returned parameter (that is how a non-copyable value moves out), a struct or handle receiver in any position (the method idiom), block and lambda parameters (a callback's slot is its caller's contract), and every daslib/ folder (library code lives on the builder/state idiom). A deliberate out-parameter keeps its var under // nolint:LINT029.

This is a draft because the LINT029 conversion is partial. The lint tooling, dastest, the LSP subtools, daspkg, das-herd, doc-verify and dasLLAMA's performance tools are converted and their suites pass. About 1270 findings remain, mostly in dasLLAMA, the GPU modules and examples.

Where to look: daslib/lint.das for both rules and the exemption arms, daslib/lint_config.das for lint029_source_exempt, and the three fixtures under utils/lint/tests/.

Validation, claims, ledger

Validation

• The full pre-PR chain was NOT run - this is a draft opened on request, not a merge candidate. The branch is 42 commits behind origin/master and has not been rebased.
• Lint gate is knowingly red: about 1270 LINT029 findings remain in unconverted areas. Zero compile errors tree-wide (3918 files swept).
• Suites run and green: tests/lint (82), dastest/tests (30), tests/json (396), tests/linq (2071), tests/lsp (2), das-herd watcher (123), tests/fio, tests/match, ast-fuzz (16), dasweb-verify (14), dasTerminal semantics.
• tests/sql_conformance cannot run here: dasSQLITE's native module is not built in this worktree (error 20605). Same for dasLLAMA and dasVulkan runtime tests - those sources lint and compile clean but were not executed.
• Docs: das2rst regenerated clean (no stubs, no Uncategorized), sphinx build succeeded; no new warning touches the lint pages.

Claims - stated, not tested

• LINT029 does not break ordinary builds. Verified by compiling files that carry findings: the [lint_macro] only arms in modules that require daslib/lint, so findings surface through the standalone runner and the CI lint lane. A break would look like an unrelated program failing to compile with error 50503.
• The dasTerminal and river_run fixes restore intended behavior rather than change it. Verified by reading each caller: both callers already assumed the callee had written through. A break would look like a hyperlink re-emitted per row, or a GL handle freed twice.

Not done

• About 1270 LINT029 findings remain: dasLLAMA (core, harness, benchmarks), dasImgui, dasVulkan, dasSpirv, dasMetal, examples, tutorials and parts of tests.
• No rebase onto current master, and no full preflight, AOT build or AOT test run.
• Pre-existing findings in modules/dasSMT (STYLE014/015/039, PERF030, LINT016/019) are untouched - that module is not part of this arc.

🤖 Generated with Claude Code