class_super: CFG-aware super(...) lint + reject super-skip-intermediate

Examples/wip.das documents three latent footguns in the class system. This
PR closes two of them and removes the dormant opt-in lint that was supposed
to cover the third.

(1) Every derived-class constructor whose parent has a user-defined ctor
must call super(...) exactly once on every control-flow path. Replaces the
opt-in always_call_super single-bool check with a CFG-aware {lo, hi}
walker (countSuperCalls) modeled on exprReturns. Catches missing super,
super on only one if/else branch, super in a loop (unbounded count),
super called twice on the same path. Handles try/recover: the try block
is the normal-flow path; the recover block is fatal-panic-with-diagnostics
and is ignored (matched on both the direct ExprTryCatch and the JIT-mode
builtin_try_recover rewrite via call->func->module->name == "$" guard).

(2) super(...) and super.X() may only walk past an intermediate class that
has no user-defined ctor or matching method. Skipping a class with its
own user ctor (whose invariants would silently be bypassed) is rejected
at the typer with invalid_super_call. Empty-intermediate skip (e.g. the
SkipMid pattern in tests/language/super.das) stays legal.

The always_call_super option is hard-removed - policy field, lint binding,
option-table row, serialize stream byte, and doc references all deleted.

Out of scope (PR2): synthesizing a derived default ctor that chains via
super() when no user ctor is provided.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: borisbat

doc/source/reference/language/classes.rst

@@ -169,7 +169,17 @@ up the inheritance chain to the nearest ancestor that does:
 
 Walk-up matches by argument types, so overloaded ``super(args)`` calls pick the closest
 ancestor whose constructor or method accepts those arguments. If no ancestor matches, the
-call is rejected at compile time.
+call is rejected at compile time. The walk-up may only step past a class that has no
+user-defined constructor (or method, in the case of ``super.method()``); attempting to
+skip a class whose user constructor (or method) would otherwise establish invariants is
+rejected — call the immediate parent and let it chain via its own ``super()``.
+
+Every constructor in a derived class whose parent has a user-defined constructor must call
+``super(...)`` exactly once on every control-flow path. The lint is unconditional:
+
+* zero ``super(...)`` calls on any reachable path → error;
+* two or more ``super(...)`` calls on any path → error;
+* ``super(...)`` inside a loop body → error (call count is not bounded to one).
 
 Inside a derived class's finalizer (``operator delete``), ``delete super.self`` runs the
 parent's finalizer on the current object:
@@ -197,9 +207,6 @@ functions — see :ref:`Structs <structs>`.
 Base-class finalization is explicit, not automatic: a derived finalizer that omits
 ``delete super.self`` will not run any ancestor finalizer.
 
-The option ``always_call_super`` can be enabled to require ``super()`` in every constructor
-(see :ref:`Options <options>`).
-
 Alternatively, the parent's method can be called directly using the backtick syntax:
 
 .. code-block:: das

doc/source/reference/language/options.rst

@@ -92,10 +92,6 @@ Lint Control
      - bool
      - true
      - Disallows writing to nameless (intermediate) variables on the stack.
-   * - ``always_call_super``
-     - bool
-     - false
-     - Requires ``super()`` to be called in every class constructor.
    * - ``no_unused_function_arguments``
      - bool
      - false

doc/source/reference/tutorials/18_classes.rst

@@ -75,6 +75,67 @@ bypassing virtual dispatch::
 The compiler rewrites ``super()`` to ``Parent`Constructor(self, ...)`` and
 ``super.method()`` to ``Parent`method(self, ...)``.
 
+``super(...)`` is required exactly once per path
+================================================
+
+Every constructor in a derived class whose parent has a user-defined constructor
+must call ``super(...)`` exactly once on every control-flow path. The lint catches:
+
+::
+
+  class Bad : Base {
+      def Bad(f : bool) {
+          if (f) {
+              super()   // ERROR: false branch has zero super() calls
+          }
+      }
+  }
+
+  class AlsoBad : Base {
+      def AlsoBad {
+          super()
+          super()       // ERROR: super() called more than once
+      }
+  }
+
+A call to ``super(...)`` inside a loop is also rejected — the count is not
+bounded to one. To branch on arguments, both branches must call ``super(...)``::
+
+  class OK : Shape {
+      def OK(big : bool) {
+          if (big) {
+              super("Big")
+          } else {
+              super("Small")
+          }
+      }
+  }
+
+``super.X()`` cannot skip an intermediate
+=========================================
+
+``super.X()`` (whether ``X`` is a method or the name of an ancestor class) may
+walk past only intermediate classes that have **no** user-defined constructor or
+matching method. Skipping a class whose user code would otherwise establish
+invariants is rejected. Empty intermediates are still legal::
+
+  class A {
+      def A { /* ... */ }
+  }
+
+  class B : A {
+      def B { super() }     // B has its own ctor
+  }
+
+  class C : B {
+      def C {
+          super.A()         // ERROR: would silently skip B's invariants
+      }
+  }
+
+If you really want only ``A``'s setup, name the immediate parent:
+``super.B()`` (or ``super()``) and let ``B``'s constructor chain to ``A`` itself.
+
 Creating instances
 ==================
 

include/daScript/ast/ast.h

@@ -1567,7 +1567,6 @@ namespace das
         /*option*/ bool no_unsafe_uninitialized_structures = true; // if true, then unsafe uninitialized structures are not allowed
         /*option*/ bool strict_properties = false;                 // if true, then properties are strict, i.e. a.prop = b does not get promoted to a.prop := b
         /*option*/ bool no_writing_to_nameless = true;             // if true, then writing to nameless variables (intermediate on the stack) is not allowed
-        /*option*/ bool always_call_super = false;                  // if true, then super() needs to be called from every class constructor
     // environment
         /*option*/ bool no_optimizations = false;                  // disable optimizations, regardless of settings
         /*option*/ bool no_infer_time_folding = false;             // disable infer-time constant folding

src/ast/ast_infer_type.cpp

@@ -13,6 +13,32 @@ namespace das {
     // in ast_handle of all places, due to reporting fields
     void reportTrait(const TypeDeclPtr &type, const string &prefix, const callable<void(const TypeDeclPtr &, const string &)> &report);
 
+    // True if `klass` has any non-generated user-defined function with the given name (mangled
+    // as `Klass`methodName`). For methodName == klass->name, this detects user ctors; for any
+    // other name, it detects user methods. Used at super(...) / super.method() walk-up sites to
+    // reject silent skip of an intermediate class's user-defined invariants.
+    // The class's ctors/methods live in the same module as the class itself (parser registers
+    // them together), so we look up by name hash on `klass->module->functionsByName` /
+    // `genericsByName` instead of scanning the entire library. The `classParent == klass`
+    // identity check defends against same-named classes in other modules bleeding in via
+    // generic instantiation (the in-tree corpus already has multiple `ContextStateAgent`).
+    static bool classHasUserNamedFunction(Program *, Structure * klass, const string & methodName) {
+        if (!klass || !klass->module) return false;
+        string funcName = klass->name + "`" + methodName;
+        uint64_t hName = hash64z(funcName.c_str());
+        if (auto kv = klass->module->functionsByName.find(hName)) {
+            for (auto * fn : kv->second) {
+                if (!fn->generated && fn->classParent == klass) return true;
+            }
+        }
+        if (auto kv = klass->module->genericsByName.find(hName)) {
+            for (auto * fn : kv->second) {
+                if (!fn->generated && fn->classParent == klass) return true;
+            }
+        }
+        return false;
+    }
+
     CaptureLambda::CaptureLambda(bool cm) : inClassMethod(cm) {}
     void CaptureLambda::preVisit(ExprVar *expr) {
         if (!expr->type) { // trying to capture non-inferred section
@@ -1490,6 +1516,25 @@ namespace das {
                                     return Visitor::visit(expr);
                                 }
                             }
+                            // super.<AncestorClassName>() is the legacy form for invoking that
+                            // ancestor's constructor. Allow only when the named class is the
+                            // immediate parent or reachable through an unbroken chain of empty
+                            // intermediates (no user ctors). Skipping a class with a user ctor
+                            // would silently bypass its invariants.
+                            for (Structure * anc = baseClass->parent; anc; anc = anc->parent) {
+                                if (anc->name == eField->name) {
+                                    for (Structure * mid = baseClass; mid != anc; mid = mid->parent) {
+                                        if (classHasUserNamedFunction(program, mid, mid->name)) {
+                                            error("call to super." + eField->name + " in " + func->name
+                                                    + " cannot skip " + mid->name
+                                                    + " which has its own constructor — call super." + mid->name + "(...) instead",
+                                                  "", "", expr->at, CompilationError::invalid_super_call);
+                                            return Visitor::visit(expr);
+                                        }
+                                    }
+                                    break;
+                                }
+                            }
                             vector<TypeDeclPtr> argTypes;
                             auto selfType = new TypeDecl(Type::tStructure);
                             selfType->structType = func->classParent;
@@ -1515,6 +1560,16 @@ namespace das {
                                         expr->at, CompilationError::ambiguous_super_call);
                                     return Visitor::visit(expr);
                                 }
+                                // No matching method here. Before walking past, check: does this
+                                // baseClass have a user-defined method with the same name (different
+                                // sig)? If yes, we'd silently skip its definition — reject.
+                                if (classHasUserNamedFunction(program, baseClass, eField->name)) {
+                                    error("call to super." + eField->name + " in " + func->name
+                                            + " cannot skip " + baseClass->name + " which defines its own "
+                                            + eField->name + " — adjust args to match " + baseClass->name + "'s overload",
+                                          "", "", expr->at, CompilationError::invalid_super_call);
+                                    return Visitor::visit(expr);
+                                }
                                 baseClass = baseClass->parent;
                             }
                             error("call to super in " + func->name + " is not allowed, no matching super method " + eField->name, "", "",
@@ -5577,6 +5632,9 @@ namespace das {
         // Walks up the inheritance chain looking for a parent class constructor that matches the
         // argument types; this lets `super(...)` call the closest ancestor's constructor when an
         // intermediate class doesn't define its own (mirrors super.method() / delete super.self).
+        // The walk-up may only step past a class with NO user ctor — silently skipping a class
+        // whose user ctor establishes invariants is rejected (use the right `super(args)` shape
+        // to call the immediate parent).
         if (func && func->isClassMethod && func->classParent && expr->name == "super") {
             if (auto baseClass = func->classParent->parent) {
                 vector<TypeDeclPtr> argumentTypes;
@@ -5601,6 +5659,14 @@ namespace das {
                               expr->at, CompilationError::ambiguous_super_constructor);
                         return Visitor::visit(expr);
                     }
+                    // No matching ctor here. Before walking past, check: does this baseClass
+                    // have ANY user-defined ctor? If yes, we'd silently skip its invariants — reject.
+                    if (classHasUserNamedFunction(program, baseClass, baseClass->name)) {
+                        error("call to super in " + func->name + " cannot skip " + baseClass->name
+                                + " which has its own constructor — adjust super(...) args to match " + baseClass->name,
+                              "", "", expr->at, CompilationError::invalid_super_call);
+                        return Visitor::visit(expr);
+                    }
                     baseClass = baseClass->parent;
                 }
                 error("call to super in " + func->name + ": no matching super constructor for " + func->classParent->name, "", "",