[1.13] Type-check put, return and require -- and give literals a type

Reid ruled these three in, corpus cost accepted.

`put` and `return` already compared types, but only when BOTH sides resolved to a
NAMED type: `valueType` yields None for a predefined one, so exactly the case a
generator trips over was skipped in silence. The named comparison is KEPT -- it is the
stricter rule and the right one where it applies, since RIDDL treats a declared alias
as a distinct name rather than a transparent synonym -- and the TypeExpression check
runs only where the named one could not, so the two cannot double-report.

`require … with` was never type-checked at all: only presence, plus a prompt
ascription. It is checked in `checkStatementScopes` rather than `validateStatement`
because `valueTypeExpr` needs the in-scope lets and foreach elements, which only that
walk carries.

**The real find was that LITERALS had no type**, which I hit by instrumenting the
require check and watching `valueTypeExpr` answer None for `"a string"`. That was not
a gap in these three positions -- it was a gap in the shared helper, so every position
built on it, constructor arguments included, silently skipped its most common argument
shape. Literals are typed now; a NumericLiteral deliberately still is not, because
`checkNumericLiteralConformance` already judges those with a better message.

It found nine genuine type errors in our OWN fixtures -- a string into an Integer
field in six suites, a string where a record or an entity reference was wanted in two
more. Every one is fixed as a fixture defect, not worked around.

One test asserted SILENCE for a string literal on the stated grounds that "a literal
has no resolvable type expression here". That premise is now false, so the case now
asserts the opposite and a NEW case covers the still-valid rule using a value that is
genuinely undeterminable.

Also corrects two mislabelled rule ids that this made visible. `checkAssignable`'s
GENERIC arm -- any assignability failure -- carried `stmt-id-entity-mismatch`, telling
an author their plain type error was a problem with entity identity. It is
`value-type-mismatch` now, and the wrong-entity arm takes the name that describes it.
`stmt-id-type-mismatch` is left with no producer and is RETIRED rather than deleted:
it shipped in rc.25, so its code stays reserved and can never come back meaning
something else.

Corpus cost is two models, both true positives: reactive-bbq returns a String where an
aggregate is declared, ToDoodles puts one where a record is. Tasks filed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: reid-spencer

BACKLOG.md

@@ -1026,7 +1026,10 @@ Each was noticed while doing something else, checked against the code at the
 `file:line` cited, and deliberately not fixed in the same commit. **The
 verification is carried here so it is not repeated.**
 
-- **[1.13]** **Type-check `put`, `return` and `require … with`.** Constructor
+- ~~**[1.13]** **Type-check `put`, `return` and `require … with`.**~~ — **DONE 2026-08-26.**
+  Reid: type-check them, corpus cost accepted. Original entry follows.
+
+  **[1.13 — as filed]** Constructor
   arguments gained type checking on 2026-08-25 and these three did not.
   **Verified**: `checkAssignable` (`ValidationPass.scala:7473`) has exactly two
   call sites — `:1853` (constructor arguments) and `:9011` — while `put` and
@@ -1036,7 +1039,10 @@ verification is carried here so it is not repeated.**
   shape as the constructor gap, which riddl-generator found by emitting Java that
   would not compile. Expect corpus cost, and measure it before ruling.
 
-- **[1.14]** **`find -type <unknown>` silently matches nothing.** A typo in a type
+- ~~**[1.14]** **`find -type <unknown>` silently matches nothing.**~~ — **DONE 2026-08-26**: a
+  typo is now a parameter error with close matches, exit 7. Original entry follows.
+
+  **[1.14 — as filed]** A typo in a type
   name produces `0 matched` and exit 0, which is indistinguishable from a correct
   query with no hits — the exact "confident answer computed over nothing" failure
   `find` was built to end.
@@ -1048,7 +1054,10 @@ verification is carried here so it is not repeated.**
   already flagged as a risk — so do that first, and put it beside the AST rather
   than in the command.
 
-- **[1.15]** **Decide whether `StatsPass.numPromptStatements` is renamed.** The
+- ~~**[1.15]** **Decide whether `StatsPass.numPromptStatements` is renamed.**~~ — **RULED
+  2026-08-26**: add `numDoStatements`, deprecate the old name. Done. Original entry follows.
+
+  **[1.15 — as filed]** The
   `PromptStatement` → `DoStatement` rename (`e226f240e`) deliberately stopped at
   this field.
   **Verified**: it survives at five sites in

language/input/dokn.riddl

@@ -214,7 +214,7 @@ domain dokn is {
                 reply result Location.LocationDetails
               }
               on query Location.getLocationNotes {
-                reply result Location.LocationNotes(notes = "the notes")
+                reply result Location.LocationNotes(notes = prompt("the notes for this location"))
               }
             }
         } with {

language/input/everything_full.riddl

@@ -61,7 +61,7 @@ context full is {
   adaptor fromAPlant to context APlant is {
     handler adaptCommands is {
       on command ACommand {
-        send command DoAThing(thingField = "the thing") to outlet APlant.Source.OutCommands
+        send command DoAThing(thingField = 42) to outlet APlant.Source.OutCommands
       }
       on other { error "unexpected message" }
     }
@@ -90,7 +90,7 @@ context full is {
           // APlant.Source.OutCommands is declared `type DoAThing`, so only a DoAThing may be
           // placed on it. This used to send `event Inebriated`, which nothing rejected until the
           // send/portlet conformance check landed (2026-08-19).
-          send command DoAThing(thingField = "another thing") to outlet APlant.Source.OutCommands
+          send command DoAThing(thingField = 43) to outlet APlant.Source.OutCommands
         end
       }
     }

language/src/main/scala/com/ossuminc/riddl/language/RuleId.scala

@@ -381,7 +381,6 @@ enum RuleId(
   case ClauseWrongArity extends RuleId("handler-clause-wrong-arity")
   case NotInstantiable extends RuleId("stmt-not-instantiable")
   case TerminateNeedsId extends RuleId("stmt-terminate-needs-id")
-  case IdTypeMismatch extends RuleId("stmt-id-type-mismatch")
   case IdEntityMismatch extends RuleId("stmt-id-entity-mismatch")
   case TellValueNeedsId extends RuleId("stmt-tell-value-needs-id")
   case TellCrossesDomain extends RuleId("stmt-tell-crosses-domain")
@@ -527,7 +526,13 @@ object RuleId:
     *
     * Empty today because no rule has yet been withdrawn.
     */
-  val retired: Set[String] = Set.empty
+  val retired: Set[String] = Set(
+    // Published in 2.0.0-rc.25 on `checkAssignable`'s wrong-entity arm, which now answers to
+    // `stmt-id-entity-mismatch` -- the name that says what it means. Retired rather than reused:
+    // a consumer suppressing it, or keying a migration on it, must not have it silently come back
+    // attached to a different rule.
+    "stmt-id-type-mismatch"
+  )
 
   /** The closed set of subject prefixes -- the kind of thing a rule is ABOUT.
     *

passes/src/main/scala/com/ossuminc/riddl/passes/validate/ValidationPass.scala

@@ -2396,6 +2396,37 @@ case class ValidationPass(
     * predicate with nothing to read, and a superfluous one reads as if it were being checked when
     * the invariant never looks at it.
     */
+  /** [1.13]: does the `with` value have the type the invariant `requires`?
+    *
+    * Separate from [[checkRequireArgument]], which answers a different question -- is a value
+    * PRESENT when one is required -- and runs where the `let` scope is not available.
+    *
+    * A `PromptValue` is skipped: `checkRequireArgument` already checks its ascription against the
+    * same `requires` type, and reporting both would double up on one mistake. So is an
+    * undeterminable value type: `valueTypeExpr` returning None means this check has nothing to say,
+    * which is the same conservative rule the constructor-argument check follows.
+    */
+  private def checkRequireArgumentType(
+    rs: RequireStatement,
+    parents: Parents,
+    lets: Seq[LetStatement],
+    elements: Map[String, TypeExpression]
+  ): Unit =
+    for
+      ir <- rs.condition match
+        case ir: InvariantRef => Some(ir)
+        case _                => None
+      inv <- resolution.refMap.definitionOf[Invariant](ir.pathId)
+      tr <- inv.requires match
+        case Some(tr: TypeRef) => Some(tr)
+        case _                 => None
+      expected <- resolution.refMap.definitionOf[Type](tr.pathId).map(_.typEx)
+      arg <- rs.argument
+      if !arg.isInstanceOf[PromptValue]
+      actual <- valueTypeExpr(arg, parents, lets, elements)
+    do checkAssignable(expected, actual, None, parents, arg.loc, s"${inv.identify} requires")
+  end checkRequireArgumentType
+
   private def checkRequireArgument(inv: Invariant, argument: Option[Value], loc: At): Unit =
     inv.requires match
       case Some(tr: TypeRef) if argument.isEmpty =>
@@ -7746,7 +7777,7 @@ case class ValidationPass(
               s"'$adPath' is not an id of '$edPath'",
             suggestion = s"Supply an id obtained from '$edPath' -- an id value identifies one " +
               "instance of one processor and cannot stand in for another's.",
-            ruleId = Some(RuleId.IdTypeMismatch)
+            ruleId = Some(RuleId.IdEntityMismatch)
           )
       case _ =>
         if !e.isAssignmentCompatible(a) then
@@ -7755,7 +7786,14 @@ case class ValidationPass(
             s"$what is declared '${e.format}' but the value is '${a.format}'",
             suggestion = s"Supply a value of type '${e.format}', or declare the field as " +
               s"'${a.format}'.",
-            ruleId = Some(RuleId.IdEntityMismatch)
+            // `value-type-mismatch`, NOT an id rule. This arm is ANY assignability failure -- a
+            // String where a record is wanted, say -- and it carried `stmt-id-entity-mismatch`
+            // until 2026-08-26, which told an author their plain type error was a problem with
+            // entity identity. The mislabel was invisible while the check ran only on constructor
+            // arguments whose failures happened to be Id-vs-UUID; extending it to `put`/`return`/
+            // `require` made it visible immediately. **A wrong id is worse than no id**: it is
+            // exactly what a consumer filters and suppresses on.
+            ruleId = Some(RuleId.ValueTypeMismatch)
           )
   end checkAssignable
 
@@ -8410,6 +8448,18 @@ case class ValidationPass(
       // `let e = empty T*` infers `T*` -- the ascription IS the type, which is the whole point of
       // the ascribed form. A bare `empty` has no type of its own; the position supplies it.
       case ev: EmptyValue => ev.typeEx
+      // [1.13]: a LITERAL denotes its own type, and until 2026-08-26 none of them did -- so every
+      // position built on this helper (constructor arguments, `put`, `return`, `require … with`)
+      // silently skipped an argument written as a literal. `require inv with "text"` where the
+      // invariant requires an Integer said nothing at all. Found by instrumenting the require
+      // check and watching `valueTypeExpr` answer None, not by reading it.
+      //
+      // A NumericLiteral deliberately gets NO arm: `checkNumericLiteralConformance` already judges
+      // a numeric literal against the expected type, and with a better message ("Natural is a
+      // positive whole number") than a bare assignability failure. Two checks on one mistake is
+      // the double-reporting this codebase keeps recording.
+      case _: LiteralString  => Some(String_(v.loc))
+      case _: BooleanLiteral => Some(Bool(v.loc))
       case vr: ValueRef   => valueRefTypeExpr(vr, parents, lets, elements)
       // A55/`self`: the SYNTHESIZED Aggregation is the only place `self`'s type is materialized.
       // `let me = self` then `me.id` reaches this ARM through `valueRefTypeExpr`'s
@@ -9465,6 +9515,19 @@ case class ValidationPass(
             ruleId = Some(RuleId.PutTypeMismatch)
           )
         case _ => ()
+      // [1.13]: the comparison above runs only when BOTH sides resolve to a NAMED type -- which is
+      // the stricter rule and the right one there, since RIDDL treats a declared alias as a distinct
+      // name rather than a transparent synonym. But `valueType` yields None for a PREDEFINED type,
+      // so `putting` a `String` where an `Id(E)` was wanted said nothing at all. Fall back to the
+      // TypeExpression level, which is what the constructor-argument check uses, and only when the
+      // named comparison could not run -- so the two can never double-report one mistake.
+      if expected.isEmpty || actual.isEmpty then
+        for
+          e <- output.putOut match
+            case tr: TypeRef => resolution.refMap.definitionOf[Type](tr.pathId).map(_.typEx)
+            case _           => None
+          a <- valueTypeExpr(ps.value, parents, lets, elements)
+        do checkAssignable(e, a, None, parents, ps.loc, "'put' value")
     }
   end validatePut
 
@@ -9497,6 +9560,19 @@ case class ValidationPass(
             ruleId = Some(RuleId.ReturnTypeMismatch)
           )
         case _ => ()
+      // [1.13]: the comparison above runs only when BOTH sides resolve to a NAMED type -- which is
+      // the stricter rule and the right one there, since RIDDL treats a declared alias as a distinct
+      // name rather than a transparent synonym. But `valueType` yields None for a PREDEFINED type,
+      // so `returning` a `String` where an `Id(E)` was wanted said nothing at all. Fall back to the
+      // TypeExpression level, which is what the constructor-argument check uses, and only when the
+      // named comparison could not run -- so the two can never double-report one mistake.
+      if expected.isEmpty || actual.isEmpty then
+        for
+          e <- fn.output match
+            case Some(tr: TypeRef) => resolution.refMap.definitionOf[Type](tr.pathId).map(_.typEx)
+            case _                 => None
+          a <- valueTypeExpr(rs.value, parents, lets, elements)
+        do checkAssignable(e, a, None, parents, rs.loc, "'return' value")
     }
   end validateReturn
 
@@ -9800,6 +9876,12 @@ case class ValidationPass(
           rs.condition match
             case be: BooleanExpression => validateValue(be, parents, lets, elements)
             case _                     => ()
+          // [1.13]: the `with` value is type-checked against what the invariant `requires`. Until
+          // now only its PRESENCE was checked (`checkRequireArgument`) plus a `prompt` ascription,
+          // so `require inv with someId` supplied an `Id(E)` where a `UUID` was wanted and nothing
+          // said so. Checked HERE rather than in `validateStatement` because `valueTypeExpr` needs
+          // the in-scope `let`s and `foreach` elements, which only this walk carries.
+          checkRequireArgumentType(rs, parents, lets, elements)
         case ms: MatchStatement =>
           validateMatch(
             ms,

passes/src/test/scala-jvm-native/com/ossuminc/riddl/passes/validate/AskTest.scala

@@ -61,7 +61,7 @@ class AskTest extends AbstractValidatingTest {
        |    entity Ledger is {
        |      state S of record D.C.R is {
        |        handler H is {
-       |          on query D.C.Ask is { reply result D.C.Answer(v = "the answer") }
+       |          on query D.C.Ask is { reply result D.C.Answer(v = 1) }
        |        } with { briefly "h" }
        |      } with { briefly "st" }
        |    } with { briefly "en" }

passes/src/test/scala-jvm-native/com/ossuminc/riddl/passes/validate/BoundMessageOperandValidationTest.scala

@@ -78,7 +78,7 @@ class BoundMessageOperandValidationTest extends AbstractValidatingTest {
 
     "leave a keyword-led operand unaffected" in { (td: TestData) =>
       val src = model(
-        """on command d.c.Foo is { tell command d.c.Foo(a = "the a") to entity d.c.target }"""
+        """on command d.c.Foo is { tell command d.c.Foo(a = 1) to entity d.c.target }"""
       )
       parseAndValidate(src, td.name, shouldFailOnErrors = false) { case (_, _, msgs: Messages) =>
         errorsOf(msgs) mustBe empty

passes/src/test/scala-jvm-native/com/ossuminc/riddl/passes/validate/CompletenessTest.scala

@@ -1315,10 +1315,10 @@ class CompletenessTest extends AbstractValidatingTest {
           |      invariant BalanceNonNegative is "balance >= 0"
           |      state Main of record E.Fields
           |      handler H is {
-          |        on init { set field E.Fields.balance to "0" }
+          |        on init { set field E.Fields.balance to 0 }
           |        on command D.C.Cmd {
           |          require invariant BalanceNonNegative
-          |          send event D.C.Evt(amount = "the amount") to outlet D.C.Events.out
+          |          send event D.C.Evt(amount = 100) to outlet D.C.Events.out
           |        }
           |      }
           |    }

passes/src/test/scala-jvm-native/com/ossuminc/riddl/passes/validate/EntityValidatorTest.scala

@@ -159,7 +159,7 @@ class EntityValidatorTest extends AbstractValidatingTest {
           |    state field of record Hamburger.fields
           |    handler baz is {
           |      on command DoIt {
-          |        send event Message(a = "the a") to outlet ridOfIt
+          |        send event Message(a = 1) to outlet ridOfIt
           |      }
           |    }
           |  } with {

passes/src/test/scala-jvm-native/com/ossuminc/riddl/passes/validate/MessageOperandSourceValidationTest.scala

@@ -99,7 +99,7 @@ class MessageOperandSourceValidationTest extends AbstractValidatingTest {
     "accept a `let`-local bound to a constructed message as the operand" in { (td: TestData) =>
       val src = model(
         extraContext = "",
-        srcBody = """let m = command d.c.Foo(a = "1")
+        srcBody = """let m = command d.c.Foo(a = 1)
             |tell m to entity d.c.target""".stripMargin
       )
       parseAndValidate(src, td.name, shouldFailOnErrors = false) { case (_, _, msgs: Messages) =>
@@ -111,7 +111,7 @@ class MessageOperandSourceValidationTest extends AbstractValidatingTest {
       val src = model(
         extraContext = """function MakeFoo is {
             |  returns command d.c.Foo
-            |  return command d.c.Foo(a = "1")
+            |  return command d.c.Foo(a = 1)
             |}""".stripMargin,
         srcBody = """let m = call function d.c.MakeFoo()
             |tell m to entity d.c.target""".stripMargin
@@ -127,7 +127,7 @@ class MessageOperandSourceValidationTest extends AbstractValidatingTest {
             |query Ask replies result d.c.Answer is { q: Integer }
             |entity Ledger is {
             |  handler H is {
-            |    on query d.c.Ask is { reply result d.c.Answer(v = "the answer") }
+            |    on query d.c.Ask is { reply result d.c.Answer(v = 1) }
             |  }
             |}""".stripMargin,
         srcBody = """let m = ask query d.c.Ask of entity d.c.Ledger
@@ -141,7 +141,7 @@ class MessageOperandSourceValidationTest extends AbstractValidatingTest {
     "accept a widened `send` operand too, not only `tell`" in { (td: TestData) =>
       val src = model(
         extraContext = "",
-        srcBody = """let m = command d.c.Foo(a = "1")
+        srcBody = """let m = command d.c.Foo(a = 1)
             |send m to outlet d.c.src.emitted""".stripMargin,
         srcExtra = "outlet emitted is command d.c.Foo"
       )