Matcher assertions: assert/expect over equals/contains/not/isOk

[assapir]

PARKED — do not merge. Stacked on #233 (feat/test-harness), which is its base.

Implements the locked assertion redesign: an assertion takes the value under test first and a
matcher second, and the old assert(x) / assertEq(a, b) family is gone.

assert(2 + 2, equals(4))              ~ fatal: report at the call site, exit 101
expect(body, contains("HTTP/1.1"))    ~ recorded: mark the case failed, carry on
expect(status, not(equals(500)))
expect(response, isOk())

Shape

assert/expect and the five matchers (equals, contains, not, isOk, isNotOk) are
compiler-provided, like print: no import, and a matcher is a form rather than a value —
which is what lets one matcher name work over every type while the language has no generics.

• Checker (src/typechecker/checker/assertions.rs) settles the matcher's shape and the
  types it can read: equals needs an == member (so any user record or sum works exactly as
  far as its own member does), contains needs a Text or an array, isOk/isNotOk need a
  sum carrying that variant, not recurses. A matcher applied to a type it cannot read is a
  compile error naming what is missing.
• Codegen (src/codegen/generator/assertions.rs) evaluates the subject once and lowers
  the matcher to the condition it tests plus the description of what it wanted — rendered
  only on the failing path, through the same ` render path print uses, with a Text
  quoted so a trailing space shows.
• Runtime: two new intrinsics, __assert_failed (frame + exit 101) and __expect_failed
  (frame + mark the case failed + return), both reusing report.rs's existing frame renderer,
  which fail_at now splits into report_at + exit.
• The skip semantics: expect reads the case's failed mark first and evaluates nothing
  when it is set, so the first failure in a case skips the rest of that case — subjects
  included — while the suite carries on. That is the isolation mechanism; no fibers involved.
• expect needs a case: legal only lexically inside an it inside a describe. Outside a
  describe there is no reporter (the blocks are stripped from run/compile/build);
  inside one but outside an it there is no case to mark, so the failure would print and never
  be counted. Both are compile errors pointing at assert.

What #233 could not do, and now can

A failure no longer ends the run, so the reporter prints a real tally. reportCase gained a
failed :: Bool, the registry gained a per-case mark and a failed count, and reportSummary
exits non-zero when any case failed:

arithmetic
  ✓ holds
  ✗ does not hold
  ✓ runs after the failure

2 passed, 1 failed

Migration

Wide and mechanical. Every examples/*.qn (all self-asserting), the .qn snippets embedded in
ten Rust test files, both bench corpora, and corelib/test.qn — which keeps the harness, the
reporter and failAt, and loses assert/assertEq/assertNotEq/assertOk/assertNotOk/
AssertOpts. assertEq(a, b) → assert(a, equals(b)), assertNotEq(a, b) →
assert(a, not(equals(b))), assertOk(r) → assert(r, isOk()), assert(a == b) →
assert(a, equals(b)). A custom failure message has no replacement: the matcher's own report
names what was expected and what was found.

Two gates moved with it: the examples self-assert check now looks for assert( rather than a
<< core.test import, and the every-intrinsic link gate exempts __expect_failed (no ^
program can reach it — expect only exists in a suite, and suites run under the JIT only),
pointing at where it is covered.

Ships with

• tests/assert_test.rs — every matcher over the built-ins and over a user record and a user
  sum (its own == decides, its own ` renders), negation and double negation, the
  Result matchers, Text quoting, subject-evaluated-once, the full failure frame, the
  location through a helper and through an imported module, native-AOT parity, and each
  diagnostic that refuses a matcher a type cannot answer.
• tests/test_harness_test.rs — a failed expect skips the rest of its case and nothing more,
  the run tallies both ways and exits non-zero, expect outside a describe and outside an
  it are both refused, assert in a case is still fatal.
• examples/assert_demo.qn rewritten around the vocabulary (including a user record with ==
  and `); examples/test_suite.qn now shows expect.
• docs/corelib/test.md rewritten; docs/LANGUAGE.md, docs/ROADMAP.md (the quilon test
  item flips 🔨 → ✅), CLAUDE.md and CHANGELOG.md follow.

Review

Read-only correctness and simplification passes ran on the branch; both sets of findings are
addressed in 33b3adb. The correctness pass found two real defects — an expect outside any
it printed a failure nothing tallied (suite exited 0) and poisoned the next case, and a
generic sum payload paired with a Text panicked inkwell instead of erroring. Both are fixed
with regression tests. It reported the block structure, dominance, i1/i64/f64 handling,
tag convention, evaluation order, unsafe pointer handling and intrinsic wiring clean.

The simplification pass found five real duplications; the Text field split, the sum-tag
comparison and the i64→Bool narrowing now each live in one place. Two of its proposals were
deliberately not taken: splitting generate_binary_operator to share its value-level tail
(the caveat is a worse error message on an unreachable path), and folding green/red into a
paint helper (a module's non-exported names are not linked into a program, so it would need a
third exported name).

Gate

cargo fmt --all -- --check, cargo clippy --workspace --all-targets --all-features -D warnings, and RUSTFLAGS=-D warnings cargo test --workspace — all green (46 test binaries).

🤖 Generated with Claude Code