change: raise on invalid input in numeric/data builtins (silent-tolerance batch-2)

[InauguralPhysicist]

Second batch of the silent-tolerance audit (#490–#512). Builtins that folded bad input to a null / 0 / "" / wrong-order sentinel — the hardest class of bug to spot in a data or numeric pipeline — now raise a catchable error from the closed error-kind set.

Changes

Builtin	Bad input	Was	Now
matmul (#512)	incompatible shapes / non-matrix / oversized	silent null	value / type_mismatch / limit
sha256 md5 *_file hmac_sha256 (#511)	non-string (and missing file)	"" sentinel (silent wrong digest)	type_mismatch (io on open fail)
range (#497, #498)	non-numeric arg; past 1M cap	silent []; unbounded build → OOM	type_mismatch; limit
sort_by (#501)	key fn returns non-number	coerced to 0.0 (silent wrong order)	type_mismatch (mirrors sort #368)
get_at set_at buf_get buf_set (#499, #502)	out-of-range / non-list / non-int index	silent fold-to-0 / no-op	index_range / type_mismatch, matching xs[i]

range's #498 was a genuine latent OOM: the 1M cap sized only the prealloc while the loop still ran to the original bound.

Load-bearing check

No stdlib (lib/) reliance on any silent path. The only reliance was three tests asserting the old buggy behavior, updated to assert the raise:

• test_hash.eigs — sha256/md5 of null, sha256_file missing
• test_coverage_v2.eigs — range of "hello", get_at OOB (via the file's expect_error helper)
• test_builtin_indirect.eigs — buf_get OOB
• test_builtin_contracts.eigs — get_at/set_at past-the-start (this asserted an inconsistency with [], which already raises on -4; the change makes them consistent — exactly get_at / set_at / char_at silently ignore negative indices, diverging from the [] operator's documented negative indexing #312's stated goal)
• test_builtin_overflow.sh — matmul overflow now catchable (crash-safety intent preserved)

Tests

New suite section [116] — test_raise_on_bad_input.eigs, 21 checks (each raise + a happy-path sanity check).

• Release suite: 2646/2646
• ASan + detect_leaks=1: 2646/2646, leak tally 0

Deferred to a batch-2b follow-up (genuine design calls / larger changes): #500 regex invalid-pattern, #508 len, #506 append, #504 substr, #495 json_decode leniency, #507 json_path, #494 parser, #491 for-in, #503 list_truncate.

Closes #497
Closes #498
Closes #499
Closes #501
Closes #502
Closes #511
Closes #512

🤖 Generated with Claude Code