a def call with too few arguments is silently accepted

[haribo]

What happens

A def calling another instruction with too few arguments is not refused. The missing
parameter is simply empty.

def w(p: str) {
    apply {
        file.write(p)        # content is missing
        return ok.done
    }
}

Run against a real target, on a file holding the original content:

probe.w(p=/tmp/arity.txt) ok.done
shell(grep -qx 'the original content' /tmp/arity.txt) err.runtime

The file was overwritten with nothing, and the def reported success.

Why

internal/lang/eval.go checks one bound:

if len(c.Args) > len(def.Params) {
    ev.fail("%s takes %d argument(s), got %d", c.Name, len(def.Params), len(c.Args))
}

Too many is refused; too few falls through, and the loop over c.Args never binds the
remaining parameters. A plan-level call is checked on both bounds
(internal/lang/parser.go:838) — so the same mistake is caught in a plan and silent in a
def, which is where defs compose.

Build

Refuse a call whose argument count is below the number of parameters without a default —
the required count the parser already computes. The message should match the plan's, so
the two paths read the same.

def.Params[i].Default exists, so "required" is a real notion here, not an invention.

Validation

• A failing test first: a def calling a two-parameter instruction with one argument is
  refused at evaluation, naming the instruction and both counts.
• A call omitting a defaulted parameter still works — that is the case the current
  laxity was presumably protecting, and the fix must not break it (docker.prune() relies
  on it).
• The plan path is unchanged.

[haribo]

Audit before implementing.

The claim holds, and the consequence is worse than "a missing argument": a file is destroyed under a success verdict. Reproduced on a real target, on a file holding the original content:

probe.w(p=/tmp/arity.txt) ok.done
shell(grep -qx 'the original content' /tmp/arity.txt) err.runtime

internal/lang/eval.go checks one bound (len(c.Args) > len(def.Params)); the plan path checks both (internal/lang/parser.go:838). So the same mistake is refused in a plan and silent in a def — which is where defs compose, and where nobody is reading the call site.

Three things the verification adds:

1. The notion of "required" already exists here. requiredCount (internal/lang/parser.go:276) counts parameters without a default, in the same package. The fix has nothing to invent.

2. Nothing in the tree depends on the laxity. All 49 stdlib signatures were read and every def→def call counted against them: 0 under-supplied calls. Four defs have optional parameters (docker.prune, docker.compose-restart, dir.copy, dir.sync), and each is called either fully or with its defaults — so tightening to required breaks nothing and still admits the omission those defaults exist for.

3. This is not reachable from a plan, only from a def calling another instruction. That is why it survived: plans are where people look.

Shape

Refuse a call whose argument count is below requiredCount(def), with the message the plan already gives, so the two paths read alike.

Out of scope

The wider question of why a def-side call and a plan-side call are validated by two different pieces of code. Worth an issue; not this fix.

[haribo]

Fixed by #643, merged into develop.

Both bounds are now checked, with the lower one being requiredCount — so omitting a defaulted parameter stays legal, which is what four stdlib defs rely on.

Verified on a real target in both directions:

before:  probe.w(p=/tmp/arity.txt) ok.done   → file emptied
after:   probe.w(p=/tmp/arity.txt) err.agent
             ! file.write takes 2 argument(s), got 1
         → file still holds its content

Before proposing the fix, all 49 stdlib signatures were read and every def→def call counted against them: 0 under-supplied calls, so tightening broke nothing.

Left open deliberately: why a def-side call and a plan-side call are validated by two separate pieces of code. That is a design question, not this fix.

Closes #633 does not fire on a merge into develop; closed by hand.