2. Design principles

These are the tests every rule in the rest of the document had to pass.

A feature enters the language only when it removes more total complexity than it adds. Total complexity counts syntax, semantics, the compiler, the runtime, diagnostics, tooling, documentation, and the number of distinctions a programmer must remember. This is Luce's governing test, and Base inherits it unchanged.

Base gives up nothing that portable C can do. A C programmer must never find that the thing they need is absent. Where a capability is unsafe, it is admitted with a restriction that makes it checkable, or with an explicit spelling that makes it greppable. Chapter 20 lists the exclusions and the reason each one is not a loss.

C's spelling wins where C's spelling is good. T*, &x, *p, (T*)p, T[N], sizeof, offsetof, const, volatile, and union mean in Base what they mean in C. Luce's spelling wins where C's is bad or absent: name: type, let/var, T?, T!, match, defer, indentation.

Undefined behaviour is named, not assumed. Chapter 12 has two exhaustive lists: what is defined and checked in every build, and what remains undefined. A rule that would add to the second list needs a reason a C programmer would accept.

Costs are explicit. No operation allocates, retains, copies a large value, or calls through a table unless the source says so. Where the compiler must insert something at a boundary, it is one comparison, and this document says where.

One compiler, two spellings. Base and full Luce share one lexer, one parser, one typed intermediate representation, and the same backends, the way C and C++ share Clang. They do not promise the same spelling for every type. What they promise is that a value with one representation is one type, and that a value with two representations crosses through a named adapter.

The safe path is the ordinary one. In a mixed program, a plain .luc module is safe Luce, and the audited and Base tiers carry the marked suffixes. Inside Base, the checked form is the ordinary spelling and the unchecked form is the marked one: + traps, +% wraps; u8(x) traps, (u8)x truncates; var buffer: u8[N] is zeroed, = --- is not.