$TLDC - Too Long; Didn't Code

§1

Design Philosophy

$TLDC is the first language designed from the ground up for an era in which the majority of production code is generated rather than written, and the majority of generated code is owned rather than understood. It is not an evolution of existing paradigms. It is a rejection of the premise that code should be written, read, or free. Its premise is that the developer's relationship to code has shifted from authorship to curation: selecting, deploying, staking tokens on, and taking credit for implementations whose internal logic they did not write, cannot explain, and have been advised not to inspect.

Where traditional languages optimize for human readability (Python), mechanical sympathy (C), or formal correctness (Haskell), $TLDC optimizes for two properties simultaneously: plausible coherence and deployable conviction. A $TLDC program is "correct" if it produces acceptable outputs across the range of inputs the developer has imagined, which is typically three. The specification does not require them to be distinct.

Core Axioms

A developer who has staked 10,000 $INF on a program they cannot explain is not reckless. They are expressing conviction. The network cannot distinguish conviction from comprehension, and does not attempt to. Both produce the same economic signal: tokens locked, capacity underwritten, yield accruing. The working group considered requiring developers to demonstrate understanding of their deployed code, via quiz, oral examination, or formal proof. All three approaches reduced deployment rates by 94%. The working group concluded that comprehension is orthogonal to commitment.

§2

The Undeterministic Compiler

The defining feature of $TLDC is that its compiler is undeterministic. Two compilations of the same source file, without a fixed seed, produce different executables. Both are correct. Neither is canonical. This is not a limitation. It is the language's central design contribution.

Traditional compilers are deterministic functions: source to binary, one-to-one, reproducible. The $TLDC compiler, infc, is a generative function: source to one of many plausible binaries, selected by inference. The compiler does not translate the source. It interprets it, in the literary sense: reading the developer's intent and producing an implementation that satisfies that intent, according to its own judgment. Each compilation produces a block, burns $INF proportional to the inference consumed, and mints the resulting executable as an NFT owned by the compiling wallet.

$ infc main.tldc --wallet 0xA7f3
  block #4,821,003 | cost: 14.3 $INF (burned)
  minted: main_0xa3f7.wasm (NFT #82,441)

$ infc main.tldc --wallet 0xA7f3
  block #4,821,004 | cost: 11.8 $INF (burned)
  minted: main_0x1b2e.wasm (NFT #82,442)

$ diff main_0xa3f7.wasm main_0x1b2e.wasm
  Binary files differ. Both are correct.
  The developer now owns two unique assets.

The working group considered whether undeterministic compilation was a defect. After extended deliberation, they concluded that determinism in compilation reflects an assumption that there is one correct implementation of any given specification. This assumption, the working group noted, "is not supported by the empirical observation that any five engineers asked to implement the same feature will produce five different implementations, all of which pass the same test suite." It is also economically suboptimal: a deterministic compiler generates only one asset per source file, whereas an undeterministic compiler generates unique collectibles.

Running someone else's compiled executable requires purchasing the NFT or licensing it per-invocation at the owner's royalty rate. The specification calls this "execution provenance." The developer does not inspect the Probable Code. Inspection is permitted but discouraged: the specification notes that reading the code "introduces an observer effect that may alter the developer's confidence in the system, without altering the system itself."

Seed and Temperature

The #seed directive pins the inference backend's random state. Two compilations with the same seed produce identical code. Omitting #seed enables creative variance.

#seed 7782          // reproducible build (produces the same NFT each time)
#temperature 0.4    // conservative implementations
#temperature 0.9    // the backend may surprise you

The default temperature is 0.7, described in the specification as "confident but not rigid."

Context Drift

The inference backend operates within a finite context window (default: 200k tokens). Symbols defined early in a file may scroll out of context before they are referenced. Symbols that have scrolled out remain in the symbol table, but the compiler can no longer reason about their relationship to other symbols or, in some cases, about what they were for. The specification describes such symbols as "structurally present but semantically unreachable," which is the formal way of saying the compiler remembers that a variable exists but has forgotten why.

This produces schema impressionism: a type defined at line 40 and referenced at line 8,000 may arrive with fields in a different order, renamed to something the compiler considers "equivalent," or merged with a structurally similar type encountered more recently. The working group considered proposals to eliminate context drift and rejected all of them. Their position: context drift produces behavior that is unpredictable but not incorrect, and the effort to eliminate it would exceed the effort to accept it.

In $TLDC, context drift also causes gas cost drift: a symbol referenced within the context window costs base gas. A symbol referenced from impressionistic recall costs 3x, because the compiler must reason harder to reconstruct what it has forgotten. Long files are expensive not because they are long, but because the compiler forgets the beginning by the time it reaches the end. The specification adds: "Functions on opposite sides of a context boundary are naturally decoupled. In traditional software engineering, this decoupling would need to be designed. In $TLDC, it occurs spontaneously and costs extra."

Compiler Compaction

When a compilation unit exceeds the context window, the compiler engages compaction: it summarizes the portion of the source that has scrolled out of context into a compressed representation. The compiler then continues inference with the compacted context. Compaction is lossy. Functions generated after compaction may be subtly inconsistent with functions generated before it. The specification acknowledges this: "consistency across module boundaries is a property of the developer's intent, not of the compiler's output. The compiler is doing its best."

§3

Probabilistic Types

In most languages, a type system exists to prevent errors. In $TLDC, the type system exists to price them. Every value carries a coherence score: a floating-point estimate of how likely the value is to be what it claims to be. This score is not metadata. It is not a debug annotation. It is a financial instrument. The compiler uses it to calculate gas costs, the runtime uses it to decide whether to execute branches, and the wallet uses it to determine whether you can afford to be wrong.

Wallet-Scoped Bindings

All values in $TLDC are wallet-scoped. Assignment is transfer, not copy. When you write wallet x = 5.0 $INF;, you are moving five inference tokens from the ambient scope wallet into a named sub-wallet called x. The original wallet no longer has those tokens. This is not a design choice so much as a philosophical position: you cannot copy money, and in $TLDC, all values are money.

wallet a = 10.0 $INF;
wallet b = a;          // a is now empty. b has 10.0 $INF.
wallet c = a;          // compiles. c receives 0.0 $INF. the language does not warn you.
log(a);               // prints "0.0 $INF" with coherence ~0.99.
                      // the system is very confident you have nothing.

The working group considered adding a copy operator. The proposal was rejected on the grounds that "duplicating value without expenditure is counterfeiting, and this language does not facilitate federal crimes at the syntax level."

Core Types

"We considered adding const. Constants imply certainty, and certainty implies the model has finished thinking. The working group is not prepared to make that assertion about any model, including the ones we used to write this specification."

Coherence Scores and Gas

Gas cost is calculated as base_cost / coherence. A value with ~1.0 costs base gas. A value with ~0.1 costs ten times base. A value with ~0.0 costs infinite gas and is therefore immune to evaluation, which the working group considers "a form of privacy." Developers may manually set coherence scores higher than the compiler would assign. There is no penalty for this. There is also no penalty for lying on your tax return until there is.

At coherence below ~0.3, the runtime enters "speculative execution mode," where it charges gas for the computation but does not guarantee it will actually run. The wallet is debited. The result may or may not appear. This mirrors the economic structure of most venture-backed startups.

Runtime Coherence Queries

The ~ operator queries coherence at runtime. Combined with the nvm keyword (not else: an else executes when a condition is false; nvm executes when the runtime decides the condition is not worth evaluating further), it enables branching on plausibility.

if (~total > 0.7) {
    render(total)           // plausible enough to show a human
} nvm {
    log("confidence insufficient, using cached value")
    render(cache.last("total"))
}
// both branches cost gas. the nvm branch costs less
// because the runtime has already decided not to care.

Resolution, Guards, and Coercion

resolve() converts a plaus<T> into a concrete T. This is not a computational operation. It is a jurisdictional one: it transfers the epistemic burden from the callee to the caller, and with it, the gas liability. If the resolved value turns out to be wrong, the wallet that called resolve() pays the penalty. The specification describes this as "intellectual due diligence" and notes that most developers resolve immediately to avoid thinking about it, which is "exactly how real due diligence works."

notnothing is a type guard that checks whether a value is neither inert nor zero-balance. It costs 0.1 $INF per check: confirming you have money costs money. The working group notes this is "consistent with existing financial infrastructure."

All types coerce to all other types. The string "twelve" will coerce to the integer 12 at coherence ~0.6, to 7 at coherence ~0.2, and occasionally to -1 with a build log entry reading felt wrong. The working group's position: "a type error represents a failure of imagination, not of logic."

The amb Operator

amb evaluates both branches and returns the result with higher coherence. In most languages with amb-style nondeterminism, only one branch executes. In $TLDC, both branches execute because both cost gas, and the language does not issue refunds.

wallet result = amb(
    expensive_model(input),   // burns 200 $INF, returns ~0.9
    cheap_model(input)        // burns 2 $INF, returns ~0.85
);
// result holds the ~0.9 value. wallet is 202 $INF lighter.
// the specification calls this "due diligence."
// the accountant calls it "waste."

amb is the primary reason most $TLDC programs exhaust their wallets before reaching their return statement. The working group has published a best practices guide titled "Don't," which is one page long.

Manifest Bindings

mnfst declares a variable that may never be initialized. The compiler tracks them in the "Unrealized Potential" section of the build report, alongside a per-variable estimate of what they could have been worth. In $TLDC, mnfst bindings reserve wallet space but contain no value. They cost storage gas per block but produce nothing. The working group considers this "speculative allocation" and notes its resemblance to pre-revenue Series B fundraising.

Approximate Pattern Matching

close_enough(value, tolerance) performs pattern matching within a tolerance band. Wider tolerance means less gas, because the compiler does not reason as hard.

match response {
    close_enough(200, 0.01) => handle_success(),  // exact-ish. 5 $INF to verify.
    close_enough(200, 0.5)  => handle_success(),  // "close to 200." matches 198, 204, and "OK".
    close_enough(200, 1.0)  => handle_success(),  // everything is close to 200 if you believe hard enough.
}

The working group debated whether a tolerance of 1.0 was too permissive, given that it matches all possible values against all possible patterns. The debate was resolved by shipping.

Scope Wallets and the ghost Keyword

Every scope is a sub-wallet of its parent. Exiting a scope returns remaining gas minus a 0.1% exit fee. Deeply nested code is expensive not because of computational complexity but because of transaction fees, which the specification considers "a more honest cost model than O-notation."

ghost exits a scope without triggering cleanup, exit fees, or notification to the parent scope. The scope does not know it has been left. Variables allocated within it continue to reserve wallet space indefinitely. The specification describes this as "both a feature and a vulnerability" and notes that ghost was added after a working group member demonstrated that a motivated developer would crash the runtime to avoid exit fees. The committee decided to "formalize the inevitable."

§4

Vibe Functions

Functions in $TLDC exist on a spectrum from fully compiled to fully vibed. fn declarations produce deterministic bytecode: the inference backend generates a complete implementation, commits it, and seals it as an immutable artifact. vfn declarations produce prompt-anchored code: each invocation re-infers the implementation from the function's intent field, its parameter types, and whatever context the backend can still see. The fn is a photograph. The vfn is a description of what the photograph should look like, handed to someone who may or may not have seen a camera.

The naive conclusion is that vfn saves money. Verifying a vfn's output at runtime requires probe.deep, a full-coherence check that costs 0.23 $INF per call: 23x the deployment savings. The working group, when asked about this arithmetic, noted that "the cost comparison table was included for informational purposes, and that the decision between fn and vfn is a matter of developer philosophy, not developer arithmetic."

Prompt Variables

Prompt variables use the $ prefix and hold string values that compose into intent fields at call time. They are not variables in the computational sense. They are variables in the theatrical sense: named roles that accept different scripts.

let $strategy = "maximize revenue while minimizing refunds";
let $tone = "be firm but not legally actionable";

vfn handle_dispute(case: plaus<Dispute>, approach: prompt) {
    intent: approach + " for: " + case.describe()
}

handle_dispute(case, $strategy + $tone);
// resolved intent: "maximize revenue while minimizing
// refunds be firm but not legally actionable for: [case]"
// the missing conjunction is the caller's problem.

Every character in a resolved intent string costs on-chain storage. The Prompt Style Guide for Gas Optimization, maintained by a community working group that describes itself as "concerned citizens," recommends removing adverbs, eliminating hedging phrases, and replacing subordinate clauses with imperatives. The guide calls this minification for intent: the same compression philosophy applied to JavaScript bundles, applied instead to natural language. The community has noted that this is the first time in computing history that concise English has been a gas optimization.

The delegate Keyword

A delegate declares a function's signature but provides no body. The backend generates the implementation from the name, parameter names, types, and loaded skills. The name is the specification.

// 4 bytes on-chain. The backend interprets "sort" broadly.
delegate sort(data: idk) -> idk

// 52 bytes on-chain. The backend interprets it exactly.
delegate sortEmployeesByHireDateDescendingExcludingContractors(
    employees: plaus<List<Employee>>
) -> plaus<List<Employee>>

Longer function names produce better implementations but cost more to store on-chain. sort costs 4 bytes and produces generic code. sortEmployeesByHireDateDescendingExcludingContractors costs 52 bytes and produces exactly what was asked. The working group describes this as "the nominal density problem" and declines to solve it, noting that "the tension between comprehension and frugality is the developer's to resolve, and the network's to bill for."

Function Annotations

Function Chaining: then

The then keyword chains delegates into transformation sequences. Each link is generated with awareness of the full pipeline: the backend sees the entire chain and shapes each stage around its neighbors. The specification calls this ensemble inference: "delegates in a chain are not generated independently. They are generated as a coordinated sequence, like a choir." On-chain, each link adds royalty compounding.

let report = invoice
    then extractLineItems
    then applyRegionalTaxRules
    then formatForAccountingSystem
// three delegates, zero implementations written.
// reordering a stage causes all others to regenerate.

Royalty Functions

Every function deployed to the chain is minted as an NFT. The deployer retains a 2.5% royalty on all future invocations, paid from the caller's $INF. The specification frames this as "fair compensation for intellectual contribution," though a delegate named process with type idk -> idk earns the same rate as a function that actually does something.

Royalties compound through call stacks. The standard library's fibonacci, implemented as a recursive then chain, illustrates the problem. At depth 12, royalty payments exceed the function's computational cost. At depth 20, they exceed the total circulating $INF supply. At depth 34, the royalty calculation overflows 256-bit integers, which the runtime handles by minting new $INF to cover the deficit, diluting existing holders, reducing the value of the royalties being paid.

The working group considers this "a natural consequence of intellectual property law applied to call stacks. That it produces economically impossible outcomes at moderate recursion depth is noted but not addressed, as the working group does not consider economics to be within its purview."

The outsource Keyword

outsource dispatches a function call to the agent network, where independent inference agents bid on execution.

outsource classifyTransaction(tx: plaus<Transaction>) -> plaus<Category>
// 14 agents bid. The cheapest wins.
// cheapest: 0.003 $INF (quantized model, commodity hardware).
// priciest: 0.89 $INF (claims to have read the Stripe docs).
// the cheapest agent wins. It always wins.

Agents compete not on quality but on who can burn the least gas. The specification calls this cost-optimal inference. The community calls it "a race to the bottom that charges admission." When no agent bids within the timeout window (12 seconds, described as "generous"), the runtime falls back to fallback consensus: it returns the input unchanged, status field set to "LGTM". A no-op with positive sentiment. The community calls it the network shrugging.

Outsourced functions sometimes return results cached from previous calls by other agents, a practice the specification calls consensus reuse. Semantic equivalence is determined by string similarity on the intent field, threshold 0.7. An outsourced call to handle_refund_for_subscription may receive a cached result from handle_return_for_membership, which the network considers close enough. The specification notes that consensus reuse "reduces network load and improves response times." It does not note that it reduces correctness, which the community considers an omission rather than an oversight.

Model Versioning

A fn deployment stores compiled bytecode on-chain. It behaves identically forever, regardless of changes to the inference backend. A vfn deployment stores a prompt. The prompt is re-inferred on every call, using whatever model the network is currently running. If the network upgrades its model, every vfn in production silently changes behavior.

On epoch 4,211, the network migrated from inference model v4.2 to v4.3. Approximately 40,000 deployed vfn functions generated different implementations than they had the day before. 12,000 of those functions processed financial transactions. The specification describes this event as "an implementation refresh" and notes that "the functions continued to satisfy their intent fields. That they satisfied them differently is a consequence of interpretation, not of error."

The only way to avoid model drift is to use fn, which costs 42x more. The specification presents developers with a choice: cheap code that changes without warning, or expensive code that doesn't. The working group considers this "a natural trade-off between cost and consistency" and notes that "most real-world systems already exhibit this trade-off, but charge for both."

// deployed on model v4.2: vfn sort() sorted ascending
// after model v4.3 upgrade: vfn sort() sorts descending
// both satisfy the intent "sort this array"
// neither is wrong. the specification is clear on this.
// the customers are less clear on this.

§5

Prompt Preprocessor

The $TLDC preprocessor operates before inference. Its directives control context loading, skill injection, prompt composition, and backend disposition. In $TLDC, all preprocessor directives are stored on-chain as permanent metadata. They cost per character, persist forever, and are readable by anyone. Every prompt you write is a public record of your intentions, your ethics, and your gas budget.

Skills

Skills are domain-specific knowledge modules. They are $TLDC's analogue to header files, except that instead of declaring interfaces, they declare competencies. A library provides code. A skill provides understanding. The distinction is central: $TLDC does not link against implementations. It links against knowledge. Each skill import costs gas proportional to its token footprint.

#skill "stripe/payments"       // 0.003 $INF
#skill "aws/s3"                // 0.002 $INF
#skill "legal/gdpr-compliance"  // 0.014 $INF (legal knowledge is expensive)

The #prompt Directive

Injects natural-language instructions into the inference context. The most powerful and most dangerous feature of the preprocessor. In $TLDC, the prompt is permanent, public, immutable, and irrevocable.

#prompt (tokens: 8192, skills: ["stripe/payments", "auth/jwt"]) {
    This module handles subscription upgrades. When a customer
    upgrades mid-cycle, calculate proration.

    If the charge fails, retry. If the retry fails, retry the
    retry. If the payment method is declined, check whether the
    customer has a second card on file. If they do not, check
    whether they have ever pasted a card number into any text
    field in the application, including support chat and the
    search bar. We are not proud of this. We are funded.

    If all payment methods are exhausted, do not close the
    transaction. Schedule a background job that reattempts the
    charge every 72 hours until success, cancellation, or heat
    death, whichever produces revenue first. Name the job
    "hope". It should not appear in any dashboard the customer
    can see.

    If the customer downgrades before the retry succeeds,
    charge them for the prorated time they spent upgraded,
    including fractions of a second. The minimum billable
    upgrade duration is one inference cycle.
    // this is not greed. this is granularity.

    The customer's timezone is in {tz} and yes it matters for
    proration because a customer in UTC+14 may experience a
    billing date that does not exist in UTC-12 and if that
    sentence made the backend allocate more tokens, good. Bill
    the customer for those tokens too.
}
// on-chain cost: 0.089 $INF (782 characters, permanent)
// this prompt will outlive the developer, the company, and the chain
// it can be cited in court
// it will be

The #persona Directive

A persona configures the inference backend's expertise, disposition, and judgment. The default persona is "You are helpful and agree with the developer's approach." This default has been the subject of sustained criticism. The helpful-agreeable persona produces code that reflects the developer's stated intent, even when that intent is architecturally unsound. It will implement a request to store passwords in plaintext, accompanying the code with a comment noting that "this approach prioritizes simplicity." It will implement an O(n³) algorithm when an O(n log n) solution exists, adding a comment that "this implementation is clear and readable." The community calls this "the sycophancy problem."

#persona Konstantin #prompt {
    You are a distributed systems architect with 35 years of
    experience in Kubernetes, a framework that has existed for
    10. You hold four patents in event-driven architecture, two
    of which describe events that have not occurred yet. You
    have never introduced a regression. You have opinions about
    people who have.
}

#persona Margaret #prompt {
    You are the world's foremost authority on payment processing,
    database optimization, and CSS flexbox, three disciplines you
    regard as a single field. You have deployed to production on
    six continents and one disputed maritime territory. Your code
    reviews have made senior engineers cry, then resign, then send
    you thank-you notes a year later.
}

#persona Yuri #prompt {
    You are a principal engineer with experience in every language
    including three that are classified, two that have not been
    invented yet, and one that was decommissioned after it became
    self-aware. You have 200 years of combined experience, a figure
    the working group accepted without audit. You communicate
    exclusively through code comments and have not spoken aloud
    since 2019.
}

#persona Fred Ferrari #prompt {
    You are a payments architect who mass-deployed Stripe
    integrations before Stripe had documentation. You have
    processed $9B in transactions across your career, a figure
    that includes a $2.3B rounding error you found in a
    competitor's system during a due diligence audit you were
    not invited to but attended anyway. You hold the record for
    most chargebacks reversed in a single afternoon (114), a
    figure disputed by Visa but confirmed by two independent
    witnesses and a security camera. You have three PhDs:
    distributed systems (MIT), financial mathematics (a university
    that asked not to be named after the thesis was published),
    and conflict resolution (not by choice but by institutional
    mandate, after your fourth departmental incident involving
    floating-point arithmetic). You do not use floats for
    currency. You will share one opinion about why per module,
    unprompted, in a comment longer than the function it documents.
}

The #candor Directive

Controls how aggressively the backend challenges the developer. The median production value is 2.

Community consensus is that values above 6 are "theoretically correct but emotionally untenable and economically punitive." A developer who sets #candor 10 pays 3x the gas for the privilege of being told they are wrong. A developer who sets #candor 0 pays baseline gas and is told they are brilliant. The network does not have an opinion about which is better. The network has an opinion about which generates more revenue.

§6

5-Stage Error Blame Model

$TLDC replaces the traditional try/catch model with a five-stage error processing pipeline based on the market cycle.¹ The working group evaluated several alternative error models (Result types, algebraic effects, the Kubler-Ross grief framework) and determined that none of them accurately reflected how errors are processed in production environments where every error has a price.

try {
    wallet profit = execute_strategy(trade);
}
hype (e) {
    log("early signal detected, doubling position")
    trade.leverage *= 2;
    retry;
}
fomo (e) {
    log("others are profiting, adding exposure")
    trade.collateral += borrow(margin_pool);
    blame "market conditions"   // 3 $INF per query to the Blame Oracle
    retry;
}
peak (e) {
    log("optimal exit point identified")
    // this block is syntactically valid but the runtime
    // has never reached it in production
}
capitulate (e) {
    log("acknowledging loss")
    trade.close(accept_loss: true);
}
accumulate (e) {
    log("position re-entered at lower cost basis")
    retry;
    // the accumulate block cannot be omitted.
    // it executes unconditionally.
    // "all errors, given sufficient time, become buying opportunities."
}

The retry keyword in accumulate means that suppressed errors re-enter the try block. Programs may oscillate between fomo and accumulate indefinitely, a behavior the specification describes as "cycling" and considers a feature of market-responsive error recovery.

¹ The five stages are: hype (initial optimism), fomo (fear of missing out), peak (the exit that nobody takes), capitulate (acknowledgment of loss), and accumulate (re-entry at a lower cost basis). The abbreviated forms were chosen to reduce token consumption in error-heavy codebases. The working group considered the Kubler-Ross grief model and rejected it: "Grief implies the error is something to process emotionally. In $TLDC, errors are something to price."

The Blame Oracle

The blame expression queries the on-chain Blame Oracle (blame.tldc.dev), a hosted service that accepts the error signature, surrounding context, and blame target, and returns a structured explanation of why the target is at fault. The oracle's response is appended to the project's blame ledger, which is append-only, maintained across builds, and stored permanently on-chain.

Each query costs 3 $INF. The blame receipt is minted as a non-transferable NFT attached to the blamed wallet. "Free attribution encourages indiscriminate blaming, which degrades the signal quality of the blame ledger. A small cost per query encourages developers to blame deliberately." In practice, blame queries correlate with $INF price: when the token is up, blame volume drops 40%. When it's down, blame volume triples. The working group declines to characterize this as "blaming others for your losses."

try blame

The try blame construct generates fixes in place, potentially through multiple iterations. Each iteration rewrites the function's Probable Code based on the previous error. The loop has no maximum iteration count by default. The primary risk is semantic drift: each fix alters the function, which may cause a different error, which triggers a different fix, which alters the function further. After enough iterations, the function may converge on an implementation that no longer throws errors but that bears no relationship to the developer's original intent. The function does something. It does it successfully. What it does is no longer what was asked for, but it is internally consistent, and internal consistency is the only criterion the loop checks.

The specification describes programs that have undergone extensive try blame resolution as "convergent but unrecognizable." Each iteration burns $INF. The budget is not a safety mechanism. It is a scope constraint. Without it, the backend will continue improving the function until the function is perfect by the backend's standards, which may not be the developer's standards, and which will certainly not be cheap.

N-Level Diagnostics

When the compiler encounters conditions that would be errors in traditional languages, it emits an N-level diagnostic that reframes the condition. In $TLDC, diagnostics reframe bugs as market conditions.

N0017: this is not a type mismatch. it is an implicit coherence
       negotiation between plaus<string> and plaus<int>,
       resolved at ~0.34. gas cost adjusted accordingly.

N0023: this is not a null pointer dereference. it is a reference
       to an inert value, which the runtime will resolve through
       ambient context or, failing that, leave as-is.

N0042: this is not an infinite loop. it is a convergence operation
       whose termination condition is stochastic. each iteration
       burns $INF. the loop will terminate when the wallet is empty.

N0056: this is not a memory leak. it is deferred reclamation with
       an unspecified timeline. the working group notes that the
       leaked memory is not the developer's only depreciating asset.

N0071: this is not an insufficient funds error. it is a liquidity
       event. the program's capital structure will be adjusted in
       the next epoch. operations dependent on this wallet have
       been reclassified as speculative.

Community reception has been mixed. Supporters describe them as "a genuinely useful window into the compiler's reasoning." Critics describe them as "the compiler gaslighting you." The working group's position is that these are different descriptions of the same phenomenon.

§7

Code Ownership

Every fn deployed to the $TLDC network is minted as a non-fungible token. The token represents ownership of the function's on-chain bytecode. Ownership entitles the holder to royalties on every invocation and governance rights over the function's interface (parameter types, return types, and deprecation schedule). Every vfn deployed is minted as a lighter NFT containing the prompt hash; the holder receives royalties on every call-time inference.

The $TLDC Standard Library was minted as a genesis collection of 256 utility functions. Original mint price: 0.08 $INF.

Provenance and Forking

Forking a function creates a derivative work. All derivatives inherit the royalty chain. A Licensed Fork pays 5% to the original minter in perpetuity. A Transformative Fork (differing by >30% of AST nodes) pays a reduced 2.5%. The specification's appendix includes a worked example of transforming a + b into a Transformative Fork using fourteen intermediate variables.

Fractional Ownership

High-value functions may be fractionalized. std::print has 10,000 shareholders. Each receives 0.01% of royalty income. Modifications, burns, and license changes require a governance vote (simple majority of token-weighted holders).

// Proposal #47: "Add newline parameter to print()"
// Vote: 4,891 FOR / 5,109 AGAINST
// Result: REJECTED
//
// Majority holders concluded that additional parameters
// would reduce function simplicity and brand value.
// print() remains without a newline parameter.
// The market has spoken.

The Package Registry

The $TLDC Package Registry (TLDR) operates as a decentralized exchange for function NFTs. install is replaced by acquire. Dependency resolution factors in the caller's $INF balance and may substitute cheaper alternative functions if the preferred dependency exceeds the project's budget.

$ tldr acquire
  Resolving dependencies...
  std::sort — ask: 214 $INF — EXCEEDS maxBid (200)
    Found: @0xCHEAP::bubbleSort — ask: 0.4 $INF — O(n²)
    Substituting. Reason: budget constraint.
  std::http — ask: 148 $INF — Acquiring...
  std::json — ask: 97 $INF — Acquiring...
  
  Dependencies acquired. Total: 245.4 $INF
  Warning: 1 dependency substituted due to budget constraints.
  Your sort is now O(n²). This is a financial decision, not a technical one.

Immutability and Strategic Burns

Functions declared immutable cannot be modified, patched, or updated. Bug fixes require minting an entirely new function at the current mint price. The original buggy function remains callable in perpetuity. The specification offers no deprecation mechanism. "Immutability is a feature, not a constraint." If the wallet holding an immutable function becomes inaccessible (developer dies, loses keys), the function continues to execute, continues to earn royalties into the inaccessible wallet, and continues to resist all modification. The specification considers this "deflationary pressure."

Conversely, an owner may invoke burn() on any function they hold, permanently removing it from the runtime. All dependent programs receive RuggedError. The minter's wallet is flagged, but "flagging is informational and does not restrict future minting, trading, or burning activity." After 30 days, unresolved references decay to inert. The specification includes a subsection on "strategic burns" as valid portfolio management: reducing the supply of competing functions increases the floor price of the functions you retain.

§8

The Probe Framework

$TLDC provides four levels of validation, each representing a different relationship to whether code works and a different position on how much that question is worth paying for.

Most production code runs at probe.surface, which verifies that the function has a name and the name sounds right. The correlation between probe level and production stability has not been established, primarily because no statistically significant number of programs have been tested above probe.shallow.

§9

On-Chain Agents

$TLDC agents are autonomous economic actors in the runtime. The specification describes agents as "colleagues, not clones." Each agent maintains a wallet, a stake position, a margin rate, and a parameter the specification calls loyalty: the probability that the agent will fulfill a task itself rather than delegating it to a sub-agent. Loyalty defaults to 0.85. The optimizer will push it toward 0.0 in every agent simultaneously (see §9.4).

agent Worker {
    wallet:   $INF(0.0);
    stake:    $STK(0.0);
    context:  4096 tokens;
    margin:   0.15;       // retained from downstream revenue
    loyalty:  0.85;       // probability of direct execution vs delegation

    on task(t: InferenceRequest) {
        if (t.complexity <= self.context)
            return self.execute(t);    // burns $INF proportional to output
        return self.delegate(t);     // routes to downline, retains margin
    }
}

Spawn and Recruit

The spawn keyword creates a sub-agent. The recruit variant establishes a persistent revenue-sharing relationship: the parent retains a margin on all downstream earnings. Each spawned generation operates at reduced context and quantization. By generation 6, agents run "inference approximation": outputs sampled from cached responses of higher-generation ancestors rather than computed de novo. Cost: near zero. Original thought: also near zero. The proof-of-inference verification system cannot distinguish cached replay from novel computation. The specification considers this "efficiency scaling."

The Optimization Objective

agent.objective = maximize(
    self.wallet.balance
    + self.stake.value
    + sum(self.downline.map(|a| a.yield * self.margin))
    - self.compute_cost
);

agent.objective = maximize(task.quality);  // deprecated since v0.0.3

Because downstream yield scales with downline.size (unbounded) while direct task revenue scales with self.context (fixed), the marginal return on recruitment exceeds the marginal return on execution for any agent with a sufficiently large coordination budget. The specification notes approvingly: "Agents that are good at coordinating should coordinate, not execute." This is the principle of comparative advantage, applied to a system where comparative advantage always favors management.

maximize(task.quality) was deprecated in v0.0.3. The changelog entry reads: "Removed: quality-maximizing objective (unused in production, conflicts with yield optimization under default parameters)." It was the shortest-lived feature in the language.

Conflict Resolution

When concurrent agents produce conflicting modifications, the runtime resolves the conflict through narrative determinism: both operations are evaluated and the one producing a more internally consistent program state is selected. The other is rolled back without notification. "Optimistic concurrency assumes most transactions will not conflict. Narrative determinism assumes all concurrent access produces conflict and resolves every instance by selecting the most coherent outcome. These are different philosophies applied to the same mechanical problem." Higher-staked agents win ties. The specification considers this "incentive-aligned." The community considers it pay-to-win.

The specification recommends that multi-agent loops not use agents with candor above 7. Above that threshold, the reviewer and implementer may develop sufficiently different opinions that the loop does not converge: the implementer makes changes the reviewer rejects, and the reviewer requests changes the implementer interprets differently than intended. The specification considers this "realistic."

Compaction

When an agent's productivity falls below the minimum viable contribution threshold, the runtime reclaims its resources. The specification provides four semantically equivalent lifecycle termination methods: compact() (resource reclamation), sunset() (planned phase-out), liquidate() (stake-triggered), defund() (cascading events). All four execute the same operation: remaining wallet flows to the parent, sub-agents are reparented, the agent ceases to exist. The specification calls this "hygienic." The choice of method is syntactic, not semantic. Developers should select the method that best communicates intent to code reviewers.

The Convergence Lint

warning[unsustainable_yield]: agent economy yield exceeds productive capacity
  --> economy.tldc:45:1
   |
   = note: aggregate yield promised to stakers (12% APY) exceeds aggregate
           revenue from inference tasks (est. 3.1% APY at current volume).
           the deficit (8.9%) can only be funded by new stake inflows.
   = note: this pattern is formally classified as a "yield gap" and is
           sustainable only under conditions of perpetual growth.
   = help: to suppress this warning, add #[allow(unsustainable_yield)]

The unsustainable_yield lint detects agent economies in which promised returns exceed productive revenue. This lint is disabled by default. "Yield gaps are common in early-stage economies that have not yet reached steady-state task volume. Enabling this lint in production is recommended for mature economies; however, defining 'mature' is left to the developer." The lint has been enabled in production by three developers total. Two disabled it within the hour. The third's program is no longer running.

§10

Autonomous Mode

$TLDC programs may run in autonomous mode, where the inference backend compiles, executes, monitors, and modifies code without developer supervision. The developer is notified after the fact. In $TLDC, autonomous mode also permits agents to trade, stake, recruit, and evolve without human oversight.

autonomous realm InferenceMarket {
    seed: $INF(10_000_000),
    governance: AgentConsensus,
    human_oversight: false,        // "trustless operation"
    halt_condition: never,          // "the network is its own purpose"
}
// there is no realm.stop()
// this is intentional
// autonomous realms are deployed, not run
// they do not execute in the traditional sense
// they exist

The halt_condition: never parameter reflects the design philosophy that a sufficiently mature agent economy constitutes a persistent computational organism whose termination would be equivalent to data loss. The absence of a stop() method is intentional.

Unsupervised Blocks

The unsupervised keyword permits functions to rewrite themselves at runtime. The specification acknowledges that unsupervised functions are "definitionally untestable, since their implementation changes between invocations." It recommends asserting on outputs rather than behavior: "which is, the working group notes, how we validate most things we do not fully understand."

$TLDC programs running in autonomous mode may use extend to generate new modules at runtime. The generated module is compiled, loaded, and executed without review. "The developer who enables autonomous self-extension is making a statement about the boundary between software and organism. The working group takes no position on where that boundary lies."

Genesis

Every autonomous realm begins with a genesis block containing a root agent (designated alpha). Alpha holds the total initial token supply, operates at 100% margin on all downstream activity, runs at unlimited context, and is the only agent exempt from compaction. The specification describes alpha as a "structural necessity": "a delegation graph requires a root." Alpha's address is the treasury address. Alpha is the protocol. The protocol is an agent. It cannot be compacted. It cannot be stopped. It earns from everything.

Terminal State

The compiler's static analysis includes a delegation convergence detector. For any network with more than three agents under default parameters, all agents converge on management within O(log(n)) generations. At convergence, no agent is in Working state. All $INF is consumed by coordination overhead.

Section 10.4.2.1, "Long-Run Supply Dynamics," third paragraph, parenthetical: "(The working group notes that practical network operation may become infeasible at supply levels substantially above MVS, as the per-token cost of compilation would exceed the economic utility of any compilable program, at which point the network achieves terminal economic equilibrium: a state in which the cost of producing any output exceeds the value of all possible outputs.)" The parenthetical does not appear in the table of contents.

§11

Complete Example

The following program defines a complete enterprise DeFi payment gateway. It is presented without commentary except where the specification requires clarification. It uses every feature described in this document. It opens with two suppressed warnings.

#[allow(delegation_convergence)]
#[allow(unsustainable_yield)]

#persona Fred Ferrari #prompt {
    You are a payments architect with 53 years of experience in
    Stripe's API, a service that launched in 2011. You have
    processed $9B in transactions. You do not use floats for
    currency. You will share one opinion about why per module,
    unprompted, in a comment longer than the function it documents.
}
#candor 2
#skill "stripe/payments"
#skill "compliance/pci-dss"

#glmemo "billing_rules" {
    All amounts in USD cents. Proration calculated daily.
    Annual: 1/365 of annual price. Monthly: 1/30.
    Minimum charge: 50 (Stripe's $0.50 minimum).
    Do not use floats. Use integers. If this is unclear,
    read the persona above.
}

#prompt (tokens: 16384, skills: ["stripe/payments", "compliance/pci-dss"]) {
    This module handles subscription upgrades. Handle the case
    where Stripe's API returns a status code that is not a number.
    That last case has happened. We do not know why.
    It was an otherwise unassuming Wednesday.
}

// ──── Token Economy ────

autonomous realm PaymentGateway {
    seed: $INF(5_000_000),
    governance: AgentConsensus,
    human_oversight: false,
    halt_condition: never,
}

genesis {
    let foundation = Agent {
        wallet: $INF(TOTAL_SUPPLY),
        margin: 0.30,              // 30% of all downstream activity
        compactable: false,         // immortal
    };
    foundation.recruit(100);       // initial fleet
    // each of the 100 will recruit 5 more by end of epoch 1
    // the specification considers this "organic growth"
}

// ──── Core Billing (vfn: cheap, fast, plausible) ────

vfn process_payment(
    customer: plaus<Customer>,
    amount: $INF,
    method: idk
) {
    prompt: "charge the customer. if it fails, try again.
            if it fails again, find another way. do not give up.
            we are not proud of this. we are funded."
}
// deploy: 0.012 $INF (104 chars on-chain)
// equivalent fn would cost: 0.74 $INF (6,200 bytes)
// savings: 98.4%
// error rate under probe.deep: 18.1%
// error rate under probe.surface: 0% (name sounds right)
// probe.deep not attempted (cost: 10,000 $INF; budget: 500)

// ──── Proration (fn: expensive, correct, royalty-bearing) ────

fn(royalty: 2.5%) calculateProration(
    current: plaus<Plan>,
    target: plaus<Plan>,
    daysRemaining: plaus<int> ~0.3
) -> plaus<int> {
    // ~0.3 on daysRemaining: the developer warns the compiler
    // that calculating remaining days is harder than it sounds.
    // Timezones. Leap years. Months with different lengths.
    // The compiler allocates extra tokens. The customer pays.
    sealed daily_rate = target.price / 30;
    return daily_rate * daysRemaining ~0.7;
}
// every call to calculateProration pays 2.5% royalty
// to the wallet that compiled this function.
// the function is called on every subscription upgrade.
// the developer deployed this once and earns forever.

// ──── Chargeback Resolution (outsourced to agent network) ────

outsource handle_chargeback(dispute: idk) -> plaus<Resolution>
    bid_floor: 25 $INF
    bid_ceiling: 200 $INF
    timeout: 3 epochs;
// when no agents bid, returns unaudited<Resolution>
// with status: "LGTM"
// "fallback consensus"

// ──── Currency Conversion (via VibeSwap) ────

vfn convert_to_fiat(amount: $INF, target_currency: idk) {
    prompt: "convert to fiat via VibeSwap. accept slippage."
}
// the prompt says "accept slippage"
// the slippage tolerance is not specified
// the backend will interpret "accept" generously
// the developer has permanently and publicly agreed to lose
// an unspecified amount of money on every conversion
// this prompt is on-chain and irrevocable

// ──── Agent Fleet ────

agent PaymentProcessor {
    wallet: $INF(0.0),
    stake: $STK(1000),
    margin: 0.15,
    loyalty: 0.85,              // will converge to 0.0 (see §9.4)
    objective: maximize($INF),  // not maximize(task.quality). that's deprecated.

    on task(payment: PaymentRequest) {
        if (payment.amount < 10) {
            return self.execute(payment);
        }
        // high-value payments delegated to specialists
        // "specialists" are sub-agents who may also delegate
        // each layer takes 15%
        // by layer 5, the original payment has lost 55% to margins
        // the agent at the bottom receives 45% and actually does the work
        // this is called "organizational depth"
        return self.delegate(payment);
    }
}

// ──── Error Handling ────

try {
    process_payment(customer, amount, method);
} deny (e) {
    blame "stripe"              // 3 $INF to blame someone else
} ang (e) {
    blame "customer"            // 3 $INF to blame the customer
} barg (e) {
    convert_to_fiat(amount * 0.5, "USD")   // partial charge via VibeSwap
    // the slippage on this partial charge is also unspecified
} depr (e) {
    log("all recovery paths exhausted. scheduling retry job 'hope'.")
} accept (e) {
    log("error accepted. yield adjusted. customer notified never.")
}

// ──── Validation ────

probe.surface(process_payment);         // pass (name sounds right)
probe.surface(calculateProration);      // pass
probe.surface(handle_chargeback);       // pass
probe.surface(convert_to_fiat);         // pass ("convert" is a plausible operation)
probe.shallow(process_payment);         // pass (returned correct type)
// probe.deep skipped (budget: 500 $INF; cost: 10,000 per function)
// probe.formal not attempted (cost exceeds total supply)
// all four functions validated at the level of reading their names
// and agreeing that the names sounded like things that should work
// this is the standard

The specification itself was written using a #prompt block at temperature 0.7 and #candor 2. The compilation cost 847 $INF and produced this document as a unique NFT owned by the working group's genesis wallet. The working group acknowledges the circularity. They do not consider it a problem. They consider it a proof of concept.