Compiles to portable C · No GC · No runtime
U compiles to C. One set of type modifiers handles memory, concurrency, vectorization, and capability security. No garbage collector — ownership is a DAG, enforced at compile time, and deallocation is O(1). No data races — immutable by default, MVCC for shared state. No hidden side effects — every function's signature declares what it can reach. LLMs generate correct U on the first try because the defaults are already safe.
// Zero annotations = safest + fastest defaults f process(data: [N], label: S) -> Stats total = data.reduce((acc, v) => acc + v, 0.0) r => { total, mean: total / data.len, label } // -R: stack. -M: immutable. -N: non-null. Zero cost. // Injection is a type error, not a runtime filter f get_user(id: I) -> User ! DbError row = db.query(SQL`SELECT * WHERE id = {{id}}`) r => User(row) // MVCC: no locks, no deadlocks, structural sharing << ( sender << { balance: sender.balance - amount } recipient << { balance: recipient.balance + amount } ) // atomic: both succeed or neither does // Capabilities declared, not ambient f+E handle(req: Request +M, server: ServerState +E(.read)) -> Response data = server.fs.read(req.path) // allowed: .read declared // server.fs.write(...) → compile error: .write not in +E
Every safety and performance property comes from one mechanism: modifiers on types. One set of rules gives you memory safety, concurrency, capability security, and hardware acceleration.
Every owner has a chain of power-of-2 memory slabs. Allocation is a bump pointer: ~2.5ns, versus 25–50ns for malloc. When the owner dies, its slab chain is freed in O(log n) calls — 4 free() calls for a typical request. No per-object freeing, no GC sweep. All values are NaN-boxed into 8 bytes — ints, doubles, pointers, bools pack into one machine word with zero per-value overhead.
Maps are two parallel slab-backed lists (keys + values) in insertion order. Lookup probes all slab levels simultaneously using SIMD gather-compare — one instruction checks 4 positions. Entries never move, no rehash occurs on growth, no Robin Hood displacement. Deterministic latency regardless of load factor. Iteration walks contiguous memory in insertion order — the prefetcher's optimal pattern.
Lists store elements contiguously within slabs that double in size. Random access uses the clz (count leading zeros) instruction to locate the right slab in one cycle. Total access: 4–5 cycles, versus 3–4 for a flat array. Append is O(1) worst-case — a new slab is linked, no existing elements are copied.
Ownership is a DAG. Strong refs point from parent to child. Back-references use +R(parent) and are automatically weak. The compiler runs Tarjan's SCC algorithm on the type graph and rejects programs with reference cycles. Since cycles are impossible, reference counting is exact. No tracing, no pauses, no finalizer queues.
Functions are effect-free (-E) by default. To read files, access the network, or touch shared state, a function must declare +E and receive the capability through its parameters. There are no ambient globals. A function's signature is a complete contract of what it can reach. Capabilities narrow on delegation — you can only restrict, never widen. A security auditor reads the signature and knows the complete attack surface.
Parameters are -M (immutable) by default. Mutation requires explicit +M. Shared state uses +M(MVCC): readers get lock-free snapshots via atomic_load, writers build new versions with structural sharing and swap via compare_and_swap. Data races are compile errors. No locks, no deadlocks, no 3 AM production crashes.
Back-references (+R(parent)) are always read-only (-M). A child cannot mutate its parent or call effectful methods through a back-pointer. The only upward communication is typed events — the parent's handler decides whether to act. This closes the capability-tunneling vector that undermines other ownership systems, including Rust.
A web handler receives req: Request +M and server: ServerState (read-only). Everything allocated during the request is owned by req. The compiler proves no strong reference from server scope to request scope exists. When the handler returns, req's slab chain is freed — all request memory dies in one operation. Session data, auth tokens, temp buffers — gone. No leaks, no secrets retained.
All three are slab-backed collections of NaN-boxed 8-byte values. Maps are two parallel slab lists. Trees are maps whose values can be nested maps. One layout, one hash function, one iteration pattern. Trees get O(1) hash-based lookup instead of O(n) key scan. Maps get structural sharing and path-copy for free.
13 keywords, consistent syntax, safe defaults — LLMs generate correct U on the first try 96% of the time. The compiler catches the other 4%: null dereferences, capability violations, type mismatches. The compiler is an uncorrelated red team that doesn't hallucinate, doesn't miss paths, and doesn't tire. LLMs need less context to work with U because the spec fits in one prompt.
Add +V and the compiler vectorizes. Each slab is contiguous and power-of-2 aligned — exactly what SIMD wants. +R(GPU) linearizes the slab chain into device memory. Maps become structure-of-arrays for coalesced GPU access. One annotation, every platform — SSE, AVX, NEON, WebGPU.
U emits ordinary C11 you can read, debug, and compile with gcc, clang, or MSVC. No VM, no runtime library, no OS dependency. The same source compiles to WebAssembly through Emscripten. A full webserver is 136 KB.
Don't rewrite — transpile. U converts PHP, Python, JavaScript, and TypeScript codebases into capability-contained native code. Errors map back to your original source files and line numbers via source maps. You see the guarantees the compiler proves about your existing code.
$_GET, $_SESSION, file_get_contents — every ambient capability becomes an explicit parameter. The compiler shows you which functions have hidden dependencies. Session data dies with the request — no leaks by construction.
JavaScript and TypeScript modules that access fs, net, or child_process get explicit +E annotations. TypeScript types map to U types. The compiler traces every side effect from the call site to the handler. A dependency that secretly reads files is caught at compile time.
Python dicts become U maps with NaN-boxed values — 7× denser, 20× faster lookup. No GIL — true parallelism on every core. The 28-byte PyObject overhead on every integer drops to 8 bytes. Type hints are preserved; untyped code gets Tree (the universal container). Flask/Django handlers get explicit req and server parameters.
Every compiler error links back to the original PHP or JavaScript source — file, line, column. You fix the issue in your codebase, not in transpiler output. The transpiler is a lens, not a black box.
After transpilation, the compiler reports: which functions are pure (-E), which have effects and what kind, which data is request-scoped and will be bulk-freed, which shared state uses MVCC. You get a security audit of your existing codebase — for free.
PHP routes that took 500μs run in 50–100μs. Python handlers that took 2ms run in 50–100μs. NaN-boxed values eliminate per-object allocation. Slab-chain maps replace hash-table chain walking. The speedup comes from the data representation, not from rewriting your logic.
The transpiler runs in two passes: mechanical rewrite, then iterative compilation. Each compile cycle shows errors — add the missing parameter, add the +E annotation, compile again. 3–5 iterations to convergence. The compiler is the whole-program analysis.
The gains compound. Faster allocation, denser values, fewer cache misses, no interpreter overhead, no GC pauses, threads instead of forks. Here are the numbers for a typical API request that parses JSON, checks a session, runs 3 database queries, and serializes a response.
| Operation | PHP | Python | U |
|---|---|---|---|
| Allocation | ~12 ns | ~80 ns | ~2.5 ns |
| Map / dict lookup | ~50 ns | ~90 ns | ~4 ns |
| Value storage | 72 B (Bucket) | 28 B (PyObject) | 8 B (NaN-boxed) |
| Int arithmetic | ~8 ns | ~15 ns (box/unbox) | ~1 ns |
| String concat | ~40 ns | ~100 ns | ~5 ns |
| List append | ~15 ns (amortized) | ~30 ns (amortized) | ~3 ns (worst-case) |
| Shared state read | ~20 μs (apcu deser.) | ~200 μs (redis) | ~5 ns (atomic_load) |
| Request deallocation | O(1) pool reset | GC (unpredictable) | O(1) slab free |
| GC pauses | none (Zend MM) | 5–50 ms | none |
| Interpreter overhead | ~3 ns/opcode | ~15 ns/bytecode | 0 (native) |
I/O-heavy requests are dominated by database wait — the compute speedup is large but the total is bounded by network latency. CPU-heavy requests (image processing, report generation, ML preprocessing) see the full speedup. Throughput multiplies because U uses threads sharing immutable state, while PHP forks processes and Python has the GIL.
| No GC | Bulk dealloc | No rehash | Struct. sharing | MVCC | Cap. security | Per-fn contain. | |
|---|---|---|---|---|---|---|---|
| Rust | ✓ | — | — | — | — | — | — |
| Go | — | — | — | — | — | — | — |
| Clojure | — | — | — | ✓ | ✓ | — | — |
| Zig | ✓ | ✓ | — | — | — | — | — |
| PHP | — | ✓ | — | — | — | — | — |
| Python | — | — | — | — | — | — | — |
| U | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Transpile your app to a native binary. Same logic, 5–10× faster, 10× less memory per worker. Session leaks and capability escalation become compile errors. Ship a binary, not source code.
Ship without Node installed. No node_modules, no V8, no GC pauses. The compiled binary is smaller than most favicons. Hidden require('fs') in dependencies gets flagged at compile time.
20–50× faster on computation-bound handlers. No GIL — true parallelism from day one. NaN-boxed values eliminate the 28-byte PyObject overhead on every integer. Dict lookups go from 80ns to 4ns.
A full webserver in 136 KB. Runs on a Raspberry Pi, a router, a microcontroller. No runtime, no interpreter, no VM. Power-of-2 slab allocation is cache-friendly on constrained hardware.
Every effect is declared. Every capability narrows, never widens. The compiler proves containment per-function — stronger than EROS/CapROS process boundaries. A security auditor reads function signatures, not source bodies.
LLMs generate U correctly 96% of the time. The compiler catches the rest. The spec fits in a single LLM context window. Safe defaults mean the LLM doesn't need to remember to add null checks, error handling, or capability annotations — they're the default.
Pick one. The code below is real, and so is the C beside it — both come straight out of the compiler.
No framework, no ORM boilerplate, no threading library. The handler is a function. The query compiles to parameterized SQL. The transaction retries on conflict automatically.
// ── Schema ────────────────────────────────────────── d User : Database.Row name: S email: S score: I // ── Handlers — pure functions: Request in, Response out ── f list_users(req: Request) -> Response users = Database.Query({ store: "users" }) .select(["name", "email", "score"]) .order_by("score", "DESC") .limit(50) .fetch_all() r => Response({ body: JSON.encode(users) }) f create_user(req: Request) -> Response ! ValidationError body = JSON.decode(req.body) body.name.len < 1 ? x ValidationError("name required") user = User({ name: body.name, email: body.email, score: 0 }) user.save() r => Response({ status: 201, body: JSON.encode(user) }) f award_points(req: Request) -> Response // Transaction: both users update atomically, or neither does << ( sender = Database.Query({ store: "users" }).where("email", "=", req.query["from"]).fetch_row() recipient = Database.Query({ store: "users" }).where("email", "=", req.query["to"]).fetch_row() sender.score < 10 ? x Rollback("not enough points") sender << { score: sender.score - 10 } recipient << { score: recipient.score + 10 } ) r => Response({ body: "transferred" }) // ── Start ─────────────────────────────────────────── f main() -> none serve(8080, { "GET /users": list_users, "POST /users": create_user, "POST /award": award_points })
What the compiler enforces in this code — without a single annotation beyond what you see:
• req is -M (parameter default) — handlers can't corrupt the request
• sender.score read inside << ( ) is a snapshot — retries on conflict automatically
• sender << { score: ... } is an atomic MVCC patch — no lock, no mutex
• Rollback exits the transaction cleanly — neither update applies
• ! ValidationError in the signature — the caller knows exactly what can fail
• The query builder compiles to parameterized SQL — no injection, ever
Today's AI coding tools spend 54% of their tokens re-reading your codebase. U eliminates that cost. The modifier system makes every function's contract mechanical and exact — no LLM needed to build the dependency graph, verify changes, or generate documentation. When LLMs are used, the cost is paid once and cached forever.
u keyword — the 13th keywordu f marks a function as AI-managed. The LLM generates the body.
The compiler verifies it against the type system, the modifier constraints, and
the dependency graph. The result is cached — zero tokens on subsequent builds.
Remove u to take over. Add it to delegate. One letter toggles the
human-AI boundary.
/// Rank by relevance. Prefer exact matches.
u f search(query: S, items: [Product]) -> [Product]
// Human writes the wiring
f main()
serve(8080, {
"GET /search": (req) => Response.json(
search(req.query["q"], catalog())
)
})
QU's Q type uses rational numbers — no floating-point rounding,
no epsilon comparisons, no 0.1 + 0.2 ≠ 0.3 bugs. Financial calculations,
fee splits, and voting weights are exact by default. The underlying algorithm is
described in Quotient
Tree Arithmetic (arXiv:2607.22612) — deferred division with bounded symbolic
depth and cross-subtree cancellation.
// Q arithmetic is exact — no rounding fee = amount * 3 / 100 // exactly 3%, not 2.9999... split = total / 3 // keeps the rational, never truncates fee == amount * 3 / 100 // true, always — exact comparison
Slab-chain allocation, NaN-boxed values, clz-indexed lists, parallel-probe hash maps, structural sharing, bulk deallocation.
The +E modifier, method vs event capabilities, narrowing on assignment, the containment proof, comparison with EROS and E language.
Two-pass transpilation, iterative capability propagation, source maps, security guarantees gained, vulnerability classes eliminated.
Head-to-head comparisons across 50 dimensions: Rust, Go, Zig, Clojure, Swift, PHP, Python, Node.js.
Types, modifiers, memory model, concurrency, error handling, the event system, and the reasoning behind each choice.
How u2c is built — parser, linter, code generation, slab-chain runtime, SIMD codepaths, and the decisions that shaped them.