U Language — The Orthodoxies

Garbage collection

Heap objects reference each other. Cycles keep dead objects alive. Every GC — tracing, generational, incremental — trades throughput for pauses, memory for latency, or both. Go's GC hits 1-3ms pauses. Java's ZGC trades 15% throughput. Python's GC adds 30% overhead. This has been the tax since Lisp in 1958.

State of the art: Java ZGC, Go's concurrent collector, Rust's borrow checker (no GC but steep learning curve), Swift ARC + cycle collector for the cases ARC misses.

U prevents cycles at compile time. The compiler builds the type reference graph, runs Tarjan's SCC algorithm, and requires +R(parent) (weak) on back-edges. Strong references form a DAG — verified statically. ARC handles the rest: deterministic, O(1), no pauses. Per-type slab allocation with hierarchical bitmasks gives O(1) alloc/free with zero fragmentation.

d Element children: [Element +R] // strong — parent owns children parentEl: Element +R(parent) +N // weak — child doesn't own parent

Null pointer exceptions

Tony Hoare's billion-dollar mistake. NullPointerException is the #1 crash in Java. undefined is not a function is the #1 error in JavaScript. Every language that allows null on every type pays this cost continuously.

State of the art: Kotlin ? nullable types, Swift Optionals, Rust Option<T>. All retroactive additions — the ecosystem still has nulls from older APIs.

U's default is -N: values cannot be null. Nullable is opt-in: +N. The compiler rejects null where -N is declared — not as a warning, as an error. No billion-dollar mistake because null isn't the default.

f greet(user: User) -> S // user cannot be null — guaranteed r => "Hello, ${user.name}" f maybeGreet(user: User +N) -> S // explicitly nullable — must handle user == none ? r => "Hello, stranger" r => "Hello, ${user.name}"

Data races

Two threads write to the same memory without synchronization. Undefined behavior in C/C++. Silent corruption in Go (race detector catches ~90% at runtime). The cause of Therac-25, the Mars Pathfinder reboot loop, and countless production outages.

State of the art: Rust's borrow checker (exclusive &mut XOR shared &), Go's race detector (runtime, not exhaustive), Java's synchronized/volatile (manual, easy to forget).

U's defaults make races a compile error. Parameters are -M (read-only). Functions are -E (pure). To mutate shared state, you use MVCC (<<) — which creates a new version, never mutating in place. The dangerous path requires explicit opt-in at every step.

// Both params are -M (read-only) by default. Can't race. f total(items: [I]) -> I r => items.reduce((acc, val) => acc + val, 0) // MVCC: new version, no in-place mutation, no race account << { balance: account.balance - amount }

Async function coloring

If a function is async, every caller must be async. Your codebase splits into red (async) and blue (sync) halves that can't freely interoperate. Refactoring a deep function to async forces changes up the entire call chain.

State of the art: Go solves it with goroutines (all functions are implicitly async-capable). Rust, JavaScript, Python, C#, Swift, Kotlin all have the coloring problem with async/await.

U uses stackful fibers. a marks the CALL as async, not the function definition. The same function works whether its input arrives now or later. No split, no refactoring cascade.

f process(data: S) -> Result // one function definition r => parse(data) result = process(localData) // sync call result = a process(remoteData) // async call — same function

SQL injection

OWASP Top 10 for two decades straight. The Equifax breach (147 million records) was SQL injection. Prepared statements help, but developers still concatenate strings into queries — the language doesn't stop them.

State of the art: Prepared statements (manual discipline), ORMs (hide SQL but introduce N+1 queries), Ur/Web (compile-time safe but unused). Industry relies on code review and SAST tools.

U has a SQL type. Backtick templates produce SQL values where structural positions are compile-time constants and value positions are automatically parameterized. Concatenating a string into SQL is a type error — not a lint warning, a compile error.

query = `SELECT * FROM users WHERE age > ${minAge}` // SQL type, auto-parameterized // query = "SELECT * FROM " + tableName ← type error, won't compile

XSS / HTML injection

Cross-site scripting: user input rendered as HTML executes arbitrary JavaScript. Persists because templating engines fail open — one missing escape and you're vulnerable. OWASP Top 10.

State of the art: React's JSX auto-escapes (but dangerouslySetInnerHTML exists). Template engines with auto-escape (but raw mode exists). CSP headers (defense in depth, not prevention).

Same mechanism as SQL. HTML type with backtick templates. Structural positions are constants; interpolated values are auto-escaped. You cannot construct HTML from a runtime string without going through the type system.

page = `<div class="greeting">Hello, ${userName}</div>` // userName is auto-escaped — <script> becomes <script>

Floating-point rounding

0.1 + 0.2 != 0.3 in every language since 1985. Financial calculations drift. Cryptocurrency smart contracts lose funds to rounding. Scientific results are non-reproducible across hardware.

State of the art: BigDecimal (Java: 100x slower), Decimal128 (Python: 10-30x slower), fixed-point (manual scaling, error-prone), integer-cents (works but loses expressiveness).

U's Q type stores rationals as (numerator, denominator) integer pairs using IEEE 754 doubles as exact integer storage. Every integer below 2⁵³ is exact. Division is deferred until a decimal result is needed. 0.1 + 0.2 == 0.3 is TRUE. The Quotient Tree algorithm (arXiv:2607.22612) amortizes cancellation for O(1) per operation.

f splitBill(total: Q, people: I) -> Q r => total / people // exact — no rounding, no epsilon

The boundary: transcendental functions (sin, cos, exp) are inherently irrational for most inputs. Q covers rational arithmetic exactly; transcendentals produce N (float). The boundary is the algebraic/transcendental divide — a mathematical fact, not a design compromise.

Enum/switch ceremony

Add a variant to an enum — every switch statement that doesn't handle it is a bug. TypeScript's exhaustiveness check helps but requires a never clause. Most languages don't check at all. The missing case becomes a runtime crash.

State of the art: Rust match (exhaustive), Swift switch (exhaustive), Kotlin when (exhaustive for sealed classes). Three different keywords doing the same thing.

U has no enum, no switch, no match. Variants are subtypes: d Circle : Shape. Dispatch is .on() with typed handlers — the same .on() that iterates lists. One mechanism for both. The compiler checks exhaustiveness: add a variant, every .on() site fails to compile until you handle it.

d Shape d Circle : Shape radius: N d Rect : Shape width: N height: N f area(shape: Shape) -> N shape.on( (sh: Circle) => r => 3.14159 * sh.radius * sh.radius, (sh: Rect) => r => sh.width * sh.height )

Lifetime annotations and borrow-checking complexity

Rust proved memory safety without GC is possible. But the borrow checker rejects valid programs, the learning curve is 6-12 months, and lifetime annotations (<'a, 'b>) infect every API signature. The #1 reason developers abandon Rust.

State of the art: Rust's borrow checker is the only mainstream compile-time memory safety system. Everything else uses GC or is manual (C/C++).

U's approach: stack by default (-R), explicit heap (+R), ARC with compile-time cycle prevention (+R(parent)), and -M default immutability. No lifetime annotations, no borrow checker, no <'a>. The modifier system provides memory safety through the pit of success — the safe path is the default path, and every deviation is one explicit modifier.

f process(data: S) -> S // -R -M by default: stack, read-only r => data.upper() // no lifetime to declare

The boundary: Rust's borrow checker can express more fine-grained sharing patterns (multiple readers XOR one writer at the reference level). U's model is simpler but defers to MVCC for concurrent mutation — a different tradeoff with less expressive power for lock-free data structures.

AI-generated code requires human review

LLMs write plausible code that might be wrong, insecure, or subtly buggy. Copilot suggestions are accepted without review 30% of the time. AI-generated code has been shown to introduce vulnerabilities that pass code review.

State of the art: Human code review. SAST/DAST tools. Copilot with "trust but verify." No system makes the verification automatic.

The u keyword marks a function as AI-managed. The LLM generates the body; the compiler verifies it against the full typed contract — parameter types, return type, error types, modifiers, and structured intent tags (@intent, @constraint, @security). If the body violates the contract, it doesn't compile. The type system IS the review.

/// @intent Rank by relevance. Prefer exact title matches. /// @constraint Must handle empty query gracefully. /// @security Never expose internal product IDs. u f search(query: S, items: [Product]) -> [Product] ... // body generated by LLM, verified by compiler

The boundary: the compiler verifies type safety, not semantic correctness. It proves the function returns the right type and handles all errors. It cannot prove the search ranking is good — that's what @constraint and @example tags are for: informal contracts that guide the LLM but aren't compiler-checked.

Documentation drifts from code

Doc comments rot. JSDoc lies. Swagger specs are out of date the week they ship. The industry treats documentation as a social problem ("developers should update docs") because no one treats it as a compiler problem.

State of the art: JSDoc/Javadoc (manual), TypeDoc (auto-generated but shallow), Swagger/OpenAPI (separate spec, drifts). All require human discipline to maintain.

UDoc: 125 mechanical hooks that derive facts directly from the AST. Zero LLM. Zero hallucination. Reads, writes, guards, throws, calls, returns, transactions, complexity, patterns, code smells — all computed, not written. It can't drift because it's computed from the source on every build. Outputs in 20 languages.

Invisible exceptions

Java tried checked exceptions — developers hated them and wrapped everything in RuntimeException. Every other language uses unchecked exceptions: the function signature doesn't tell you what can go wrong. You discover errors at runtime, in production. And try/catch enables the worst antipattern: catch(Exception e) {} — silent swallowing.

State of the art: Rust Result<T, E> (good but verbose — .unwrap() everywhere). Go's error return (explicit but unchecked — _ = err compiles). Swift's throws (checked but limited to one error type).

U's ! declares error types in the function signature. No try/catch — postfix x instead. expr x fallback provides a typed substitute on any error. expr x.on(...) dispatches by error type with per-type fallbacks. Statement-level x.on(policy) registers reusable middleware for retry, logging, and observation. Every error is handled at the expression, handled by middleware, or propagated — no third option, no silent swallowing.

f process(input: S) -> Dashboard ! AuthError x.on(retry_policy) // reusable middleware user = fetch_user(input) x guest_user() // typed fallback data = db.get(user.id) x.on( (err: DbError) => default_data() // per-type fallback ) r => Dashboard({ user: user, data: data })

Invisible side effects

Any function might do I/O, write to a database, send an email, or launch a missile. You can't tell from the signature. Haskell tracks effects with monads — but monads are so inconvenient that no other mainstream language adopted them.

State of the art: Haskell's IO monad (correct but unpopular), Koka's effect handlers (academic), Unison's abilities (niche). No mainstream language tracks effects.

U's default is -E: functions are pure. I/O requires +E. One character, not a monadic wrapper. If you call a +E function, yours must be +E too — effects propagate upward, visible in every signature.

f add(aa: I, bb: I) -> I // -E: pure. Cannot do I/O. r => aa + bb f+E save(data: S) -> none // +E: effectful. I/O declared. File.write("out.txt", data) none

Mutability is the default

Variables are mutable by default in C, Java, Python, JavaScript, Go, and nearly every mainstream language. const and final are afterthoughts. The result: unintended mutation is the most common bug category after null.

State of the art: Rust let is immutable (good, but let mut is common). Kotlin val vs var. JavaScript const (only prevents reassignment, not mutation).

U's default is -M: everything is read-only. Mutability is opt-in: +M. Immutability propagates through references — a -M reference to a struct freezes all its fields through that reference. The safe path requires zero annotation.

f describe(pt: Point) -> S // pt is -M: read-only, propagates // pt.x = 5.0 ← compile error: -M propagates r => "(${pt.x}, ${pt.y})" f zero(pt: Point +M) // +M: explicitly mutable pt.x = 0.0 pt.y = 0.0

Keyword sprawl

C has 32 keywords. Java has 67. Rust has 39 plus 18 reserved. Every new feature needs a new keyword: async, await, yield, match, impl, dyn, where, sealed. The grammar grows monotonically.

State of the art: No language has reduced its keyword count after 1.0. Every language's grammar is strictly larger than its predecessor's.

U has 13 single-letter keywords. They compose: a f = async function, z f = compile-time, u f = AI-managed. The modifier system (+M, -E, +R) handles what other languages add keywords for. There is really only one way to do each thing.

SIMD requires platform-specific intrinsics

To vectorize a loop, you write _mm256_mullo_epi32 (x86) or vmulq_s32 (ARM). Portable SIMD libraries exist but add abstraction overhead. Auto-vectorization is unreliable.

State of the art: C/C++ intrinsics (fast, non-portable), Rust std::simd (portable, nightly), compiler auto-vectorization (unpredictable).

U's +V modifier marks data as vectorizable. The compiler emits GCC/Clang vector extensions, which lower to SSE/AVX (x86), NEON (ARM), or WASM SIMD. One modifier. The compiler auto-vectorizes .map() and .reduce() on +V data — no intrinsics, no platform-specific code.

data: [I +V] = [1, 2, 3, 4, 5, 6, 7, 8] doubled = data.map(val => val * 2) // emits pmuludq/paddd on x86

Concurrent mutation needs locks

Shared mutable state requires mutexes, semaphores, read-write locks, or lock-free CAS loops. All are hard to get right. Deadlocks, priority inversion, lock contention — the entire field of concurrent programming exists because of this one problem.

State of the art: Mutexes (manual, deadlock-prone), lock-free algorithms (expert-only), Clojure STM (correct but niche), actor model (Erlang/Akka — good but different paradigm).

MVCC. The << operator creates a new version, never mutating in place. Transaction blocks (<< ( ... )) make multi-object updates atomic. No locks, no CAS, no deadlocks. The same model that makes PostgreSQL correct makes U correct.

<< ( sender << { balance: sender.balance - amount } recipient << { balance: recipient.balance + amount } ) // atomic: both succeed or neither does

GPU programming is a separate language

CUDA, OpenCL, Metal, WGSL, HLSL — GPU programming means a second language with different rules, a separate compiler, and a manual data transfer ceremony between host and device.

State of the art: CUDA (NVIDIA only), Metal (Apple only), WGSL (portable but manual), Triton (Python-embedded, ML-focused). No mainstream language compiles the same source to both CPU and GPU.

+R(GPU) marks data as GPU-resident. A .map() on GPU data compiles to a WGSL compute shader. The compiler checks that the handler is lane-representable (pure, no outer captures) and rejects handlers that can't vectorize. Same source, same types, different target.

data: [I] +R(GPU) = [1, 2, 3, 4] result = data.map(val => val * 3) // compiles to WGSL compute shader

New languages need years of LLM training data

LLMs generate code in proportion to training data. New languages (Zig, Mojo, Roc) get poor Copilot support because there isn't enough code to train on. This creates a chicken-and-egg problem that kills adoption.

State of the art: LoRA fine-tuning (expensive, model-specific), few-shot prompting (fragile), tree-sitter grammars (helps completion, not generation).

The U LLM Primer is 1,600 tokens — 0.8% of a 200K context window. Any frontier LLM writes correct U after reading it. No fine-tuning, no LoRA. The language is small enough (13 keywords) that a reference card is sufficient. The compiler's verify-and-retry loop catches remaining errors. The language was designed to overlap with patterns LLMs already know.

Dynamic vs static is a tradeoff

Static types give safety but slow down prototyping. Dynamic types give speed but let bugs through. TypeScript is the compromise: gradual typing. You pick a point on the spectrum and accept the costs on both sides.

State of the art: TypeScript (gradual, incomplete), Python type hints (optional, unenforced), Flow (abandoned by Facebook in favor of TypeScript).

U is fully statically typed, but the modifier system makes types do MORE work than in any other language. One function signature encodes mutability, nullability, purity, determinism, residency, async, and error types — in single-character modifiers. No verbosity tax. The types catch entire bug classes that no amount of testing would find, without slowing you down.

Event listeners leak memory

The observer pattern creates reference cycles: subject holds listener, listener's closure holds subject. React needs useEffect cleanup returns. jQuery needs .off(). Angular needs ngOnDestroy. Forget once, memory leak. Every UI framework has its own deregistration ceremony.

State of the art: React cleanup functions (manual), WeakRef-based listeners (limited browser support), Angular's takeUntil pattern (boilerplate). All require developer discipline.

U's event system ties subscriptions to an owner lifecycle: e(obj).on(handler, { owner: t }). When the owner dies, all its subscriptions are automatically removed. No cleanup function, no manual deregistration, no ceremony.

e(button).on(handleClick, { owner: t }) // dies when t dies // No useEffect cleanup. No removeEventListener. No .off().

Nondeterminism is invisible in the type system

Any function might call Math.random() or Date.now() three calls deep. You discover this when your tests are flaky. No mainstream language tracks determinism in the type system.

State of the art: No mainstream language distinguishes deterministic from nondeterministic functions in the type system. Testing frameworks use seed-based random (partial solution). Property-based testing (finds nondeterminism after the fact).

U separates effects (±E) from determinism (±D) as independent axes. Math.random() is -E +D: harmless to reorder but impossible to memoize. Nondeterminism propagates through signatures. Transaction blocks require -D: randomness inside an atomic operation is a compile error.

f hash(input: S) -> I // -D by default: deterministic, memoizable r => input.bytes.reduce((acc, bb) => acc * 31 + bb, 0) f+D roll() -> I // +D: nondeterministic. Callers know. r => Math.random_int(1, 6)

Copy vs reference confusion

Python's mutable default arguments. JavaScript's object spread that doesn't deep-clone. Java's "everything is a reference except primitives." C++'s implicit copy constructors. Every language has a different rule, and aliasing bugs are pervasive.

State of the art: Rust's ownership model (explicit but complex), JavaScript spread/structuredClone (runtime, easy to forget), Python copy.deepcopy (manual). No language makes the distinction syntactically obvious.

c expr copies. No c, no copy — it's a borrow (read-only by default via -M). One rule. c+R copies to the heap. The syntax makes every copy visible in the source.

original = Point({ x: 1.0, y: 2.0 }) copy = c original // explicit copy heapCopy = c+R original // explicit copy to heap // Without c: borrowed, read-only. Cannot alias-and-mutate.

State management requires a framework

React needs Redux, Zustand, or Jotai. Vue needs Pinia. Angular needs NgRx. Every frontend framework has a state management ecosystem because the language has no built-in model for observable, consistent state updates. The framework tax: 10-50KB bundle, new concepts, new bugs.

State of the art: Redux (2,000 lines, immutable state, reducers), Signals (Solid, Angular — reactive primitives), MobX (observable proxies). Each is a library-level reimplementation of MVCC.

U's << operator IS the state management. Every update creates a new version. Transaction blocks make multi-field updates atomic. e(obj).on(...) notifies subscribers. What Redux reimplemented in JavaScript, U has as a language primitive.

appState << { user: newUser, loading: false } // update state e(appState).on((st: AppState) => render(st), { owner: t }) // subscribe

Off-by-one errors in loops

for (int i = 0; i < n; i++) — the most error-prone line in programming. Fencepost errors. Buffer overruns. Off-by-one is the #2 bug category after null. And the manual loop is the only way to iterate in most languages.

State of the art: Python's for x in list (good), Rust's iterators (good but verbose), JavaScript's forEach/map/filter (good but coexists with for). All languages keep index-based loops as an option, and developers use them.

U has no for, no while, no index variables. There is one way to iterate: .on(), .map(), .filter(), .reduce(). The collection drives the loop. Ranges use .. with w for infinity. No index to get wrong. The compiler auto-vectorizes .map() on +V data — the same code that's safe is also fast.

items.on(item => process(item)) // iterate doubled = items.map(item => item * 2) // transform total = items.reduce((acc, val) => acc + val, 0) // aggregate [0..w].map(ii => ii * ii).take(10) // infinite stream

Breaking API changes are discovered by users

You bump the major version, ship, and wait for bug reports. Semantic versioning is a social contract, not a mechanism. TypeScript's API Extractor helps but is external and optional. Most breaking changes are discovered in production.

State of the art: Semver (convention, unenforced), TypeScript API Extractor (diff tool, optional), Elm's enforced semver (only for Elm packages). No language makes API compatibility a compiler concern.

UDoc computes a contract fingerprint for every function: a hash of parameter types, return type, error types, modifiers, and structured intent tags. Fingerprint change = contract break. The Grokers dependency graph traces every affected call site. Breaking changes are detected at compile time, not after deployment.

// Before: f getUser(id: I) -> User // After: f getUser(id: I) -> User +N // added +N // Compiler: "fingerprint changed. 14 call sites affected."