Compiles to portable C · No GC · No runtime
U compiles to C. One set of type modifiers handles memory, concurrency, vectorization, and capability security. No garbage collector — ownership is a DAG, enforced at compile time, and deallocation is O(1). No data races — immutable by default, MVCC for shared state. No hidden side effects — every function's signature declares what it can reach. LLMs generate correct U on the first try because the defaults are already safe.
// Zero annotations = safest + fastest defaults f process(data: [N], label: S) -> Stats total = data.reduce((acc, v) => acc + v, 0.0) r => { total, mean: total / data.len, label } // -R: stack. -M: immutable. -N: non-null. Zero cost. // Injection is a type error, not a runtime filter f get_user(id: I) -> User ! DbError row = db.query(SQL`SELECT * WHERE id = {{id}}`) r => User(row) // MVCC: no locks, no deadlocks, structural sharing << ( sender << { balance: sender.balance - amount } recipient << { balance: recipient.balance + amount } ) // atomic: both succeed or neither does // Capabilities declared, not ambient f+E handle(req: Request +M, server: ServerState +E(.read)) -> Response data = server.fs.read(req.path) // allowed: .read declared // server.fs.write(...) → compile error: .write not in +E
Every safety and performance property comes from one mechanism: modifiers on types. One set of rules gives you memory safety, concurrency, capability security, and hardware acceleration.
Every owner has a chain of power-of-2 memory slabs. Allocation is a bump pointer: ~2.5ns, versus 25–50ns for malloc. When the owner dies, its slab chain is freed in O(log n) calls — 4 free() calls for a typical request. No per-object freeing, no GC sweep. All values are NaN-boxed into 8 bytes — ints, doubles, pointers, bools pack into one machine word with zero per-value overhead.
Maps are two parallel slab-backed lists (keys + values) in insertion order. Lookup probes all slab levels simultaneously using SIMD gather-compare — one instruction checks 4 positions. Entries never move, no rehash occurs on growth, no Robin Hood displacement. Deterministic latency regardless of load factor. Iteration walks contiguous memory in insertion order — the prefetcher's optimal pattern.
Lists store elements contiguously within slabs that double in size. Random access uses the clz (count leading zeros) instruction to locate the right slab in one cycle. Total access: 4–5 cycles, versus 3–4 for a flat array. Append is O(1) worst-case — a new slab is linked, no existing elements are copied.
Ownership is a DAG. Strong refs point from parent to child. Back-references use +R(parent) and are automatically weak. The compiler runs Tarjan's SCC algorithm on the type graph and rejects programs with reference cycles. Since cycles are impossible, reference counting is exact. No tracing, no pauses, no finalizer queues.
Functions are effect-free (-E) by default. To read files, access the network, or touch shared state, a function must declare +E and receive the capability through its parameters. There are no ambient globals. A function's signature is a complete contract of what it can reach. Capabilities narrow on delegation — you can only restrict, never widen. A security auditor reads the signature and knows the complete attack surface.
Parameters are -M (immutable) by default. Mutation requires explicit +M. Shared state uses +M(MVCC): readers get lock-free snapshots via atomic_load, writers build new versions with structural sharing and swap via compare_and_swap. Data races are compile errors. No locks, no deadlocks, no 3 AM production crashes.
Back-references (+R(parent)) are always read-only (-M). A child cannot mutate its parent or call effectful methods through a back-pointer. The only upward communication is typed events — the parent's handler decides whether to act. This closes the capability-tunneling vector that undermines other ownership systems, including Rust.
A web handler receives req: Request +M and server: ServerState (read-only). Everything allocated during the request is owned by req. The compiler proves no strong reference from server scope to request scope exists. When the handler returns, req's slab chain is freed — all request memory dies in one operation. Session data, auth tokens, temp buffers — gone. No leaks, no secrets retained.
All three are slab-backed collections of NaN-boxed 8-byte values. Maps are two parallel slab lists. Trees are maps whose values can be nested maps. One layout, one hash function, one iteration pattern. Trees get O(1) hash-based lookup instead of O(n) key scan. Maps get structural sharing and path-copy for free.
13 keywords, consistent syntax, safe defaults — LLMs generate correct U on the first try 96% of the time. The compiler catches the other 4%: null dereferences, capability violations, type mismatches. The compiler is an uncorrelated red team that doesn't hallucinate, doesn't miss paths, and doesn't tire. LLMs need less context to work with U because the spec fits in one prompt.
Add +V and the compiler vectorizes. Each slab is contiguous and power-of-2 aligned — exactly what SIMD wants. +R(GPU) linearizes the slab chain into device memory. Maps become structure-of-arrays for coalesced GPU access. One annotation, every platform — SSE, AVX, NEON, WebGPU.
U emits ordinary C11 you can read, debug, and compile with gcc, clang, or MSVC. No VM, no runtime library, no OS dependency. The same source compiles to WebAssembly through Emscripten. A full webserver is 136 KB.
Don't rewrite — transpile. U converts PHP and Node.js codebases into capability-contained native code. Errors map back to your original source files and line numbers via source maps. You see the guarantees the compiler proves about your existing code.
$_GET, $_SESSION, file_get_contents — every ambient capability becomes an explicit parameter. The compiler shows you which functions have hidden dependencies. Session data dies with the request — no leaks by construction.
Node modules that access fs, net, or child_process get explicit +E annotations. The compiler traces every side effect from the call site to the handler. A dependency that secretly reads files is caught at compile time.
Every compiler error links back to the original PHP or JavaScript source — file, line, column. You fix the issue in your codebase, not in transpiler output. The transpiler is a lens, not a black box.
After transpilation, the compiler reports: which functions are pure (-E), which have effects and what kind, which data is request-scoped and will be bulk-freed, which shared state uses MVCC. You get a security audit of your existing codebase — for free.
PHP routes that took 500μs run in 50–100μs. Python handlers that took 2ms run in 50–100μs. NaN-boxed values eliminate per-object allocation. Slab-chain maps replace hash-table chain walking. The speedup comes from the data representation, not from rewriting your logic.
The transpiler runs in two passes: mechanical rewrite, then iterative compilation. Each compile cycle shows errors — add the missing parameter, add the +E annotation, compile again. 3–5 iterations to convergence. The compiler is the whole-program analysis.
| No GC | Bulk dealloc | No rehash | Struct. sharing | MVCC | Cap. security | Per-fn contain. | |
|---|---|---|---|---|---|---|---|
| Rust | ✓ | — | — | — | — | — | — |
| Go | — | — | — | — | — | — | — |
| Clojure | — | — | — | ✓ | ✓ | — | — |
| Zig | ✓ | ✓ | — | — | — | — | — |
| PHP | — | ✓ | — | — | — | — | — |
| Python | — | — | — | — | — | — | — |
| U | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Transpile your app to a native binary. Same logic, 5–10× faster, 10× less memory per worker. Session leaks and capability escalation become compile errors. Ship a binary, not source code.
Ship without Node installed. No node_modules, no V8, no GC pauses. The compiled binary is smaller than most favicons. Hidden require('fs') in dependencies gets flagged at compile time.
20–50× faster on computation-bound handlers. No GIL — true parallelism from day one. NaN-boxed values eliminate the 28-byte PyObject overhead on every integer. Dict lookups go from 80ns to 4ns.
A full webserver in 136 KB. Runs on a Raspberry Pi, a router, a microcontroller. No runtime, no interpreter, no VM. Power-of-2 slab allocation is cache-friendly on constrained hardware.
Every effect is declared. Every capability narrows, never widens. The compiler proves containment per-function — stronger than EROS/CapROS process boundaries. A security auditor reads function signatures, not source bodies.
LLMs generate U correctly 96% of the time. The compiler catches the rest. The spec fits in a single LLM context window. Safe defaults mean the LLM doesn't need to remember to add null checks, error handling, or capability annotations — they're the default.
Slab-chain allocation, NaN-boxed values, clz-indexed lists, parallel-probe hash maps, structural sharing, bulk deallocation.
The +E modifier, method vs event capabilities, narrowing on assignment, the containment proof, comparison with EROS and E language.
Two-pass transpilation, iterative capability propagation, source maps, security guarantees gained, vulnerability classes eliminated.
Head-to-head comparisons across 50 dimensions: Rust, Go, Zig, Clojure, Swift, PHP, Python, Node.js.
Types, modifiers, memory model, concurrency, error handling, the event system, and the reasoning behind each choice.
How u2c is built — parser, linter, code generation, slab-chain runtime, SIMD codepaths, and the decisions that shaped them.