Replace the runtime allocator

The old pool can't return freed memory to the operating system, reuse
a cross-thread free, or re-carve memory from one size class for
another. The arena does all three.

Design: #5735

Author: SeanTAllen

.ci-scripts/freebsd-valgrind-smoke.sh

@@ -3,13 +3,16 @@
 # invoked from .github/workflows/ponyc-tier3.yml. POSIX sh, not bash: FreeBSD's
 # base system has no bash. Expects to run from the ponyc source root.
 #
-# use=valgrind annotates the Pony runtime so Valgrind can understand its custom
-# allocator. FreeBSD ships a modern Valgrind port, so this is the one BSD where
-# running a Pony program under Valgrind actually works — unlike DragonFly, whose
-# Valgrind 3.15 is too old and hangs on the runtime's memory arena
-# (https://github.com/ponylang/ponyc/issues/5435). This smoke guards two things:
-#   1. use=valgrind still builds — `cmake --build` compiles the annotated runtime
-#      into ponyc; a build that can't compile or link is caught here.
+# use=valgrind annotates the classic pool so Valgrind can understand its
+# custom allocation; the arena allocator (the default) carries no
+# annotations and rejects the combination, so the smoke builds
+# pool_classic,valgrind. FreeBSD ships a modern Valgrind port, so this is the
+# one BSD where running a Pony program under Valgrind actually works — unlike
+# DragonFly, whose Valgrind 3.15 is too old and hangs on the runtime's memory
+# arena (https://github.com/ponylang/ponyc/issues/5435). This smoke guards two
+# things:
+#   1. the combination still builds — `cmake --build` compiles the annotated
+#      runtime into ponyc; a build that can't compile or link is caught here.
 #   2. a Pony program compiled with it runs to completion *under Valgrind*
 #      without hanging — the DragonFly failure mode.
 # It deliberately does NOT assert that Memcheck comes back clean: Pony's custom
@@ -26,16 +29,16 @@ set -eu
 # leave their own). This script is self-contained: it rebuilds from scratch, so
 # it can run as its own CI step regardless of what came before.
 rm -rf build/build_debug
-cmake --preset debug -DPONY_USES=valgrind
+cmake --preset debug -DPONY_USES=pool_classic,valgrind
 # The `cmake --build` below is itself the first assertion: it compiles ponyc with
 # the Valgrind-annotated runtime. A use=valgrind build that can't compile or
 # link fails here, at build time.
 cmake --build --preset debug
 
-# use=valgrind sets PONY_OUTPUT_SUFFIX to -valgrind, so the build output lands in
-# build/debug-valgrind. Derive it rather than hardcoding (the suffix is
-# CMake-determined and could grow more segments in a combined build).
-out=$(find build -maxdepth 1 -type d -name 'debug-valgrind' | head -1)
+# The use options set PONY_OUTPUT_SUFFIX, so the build output lands in
+# build/debug-valgrind-pool_classic. Derive it rather than hardcoding (the
+# suffix order is CMake-determined and could grow more segments).
+out=$(find build -maxdepth 1 -type d -name 'debug-valgrind*' | head -1)
 if [ -z "$out" ] || [ ! -x "$out/ponyc" ]; then
   echo "FAIL: valgrind build output directory not found"
   exit 1

.ci-scripts/systematic-testing/determinism_smoke.py

@@ -14,7 +14,7 @@
 build/libs:
 
   1. Builds a systematic-testing ponyc
-     (`use=scheduler_scaling_pthreads,systematic_testing`). The build itself is
+     (`use=systematic_testing`). The build itself is
      the first assertion -- it is the only thing in CI that compiles that code
      path.
   2. Compiles the test/rt-systematic fixtures with it. Each folds the message
@@ -133,11 +133,11 @@
     ("test/rt-systematic/cycle-collection-order-signature",
      "cycle-collection-order-signature", ["--ponycdinterval", "10"]),
 ]
-# The output suffix order (scheduler_scaling_pthreads then systematic_testing)
-# comes from the block order of the PONY_USE_* `if()`s in the top-level
-# CMakeLists.txt, NOT from the order passed to `use=`. If those blocks are
-# reordered this path goes stale; the os.access check below then fails loudly.
-PONYC_REL = "build/debug-scheduler_scaling_pthreads-systematic_testing/ponyc"
+# The output suffix comes from the PONY_USE_* `if()` block in the
+# top-level CMakeLists.txt, not from the order passed to `use=`. If that
+# block is renamed this path goes stale; the os.access check below then
+# fails loudly.
+PONYC_REL = "build/debug-systematic_testing/ponyc"
 
 
 def parse_order_sig(output):
@@ -175,7 +175,7 @@ def build_systematic_ponyc(root):
     # self-consistent, and staying on the native preset keeps the script usable
     # as-is if the job grows to other architectures.
     if run(["cmake", "--preset", "debug",
-            "-DPONY_USES=scheduler_scaling_pthreads,systematic_testing"],
+            "-DPONY_USES=systematic_testing"],
            cwd=root).returncode != 0:
         fail("`cmake --preset debug` for the systematic-testing build failed")
     if run(["cmake", "--build", "--preset", "debug"],

.ci-scripts/test-debugger.sh

@@ -15,12 +15,13 @@
 # is on the list even though the runtime sets it to SIG_IGN: a debugger stops on
 # an ignored signal too, seeing it before the process's disposition applies.
 #
-# SIGTERM is on the list for a different reason: nothing in the runtime raises
-# it, the tests do. CI exports PONY_TEST_DEBUGGER and runs `ctest -L ci-core`,
-# which puts both the stdlib suite and every full-program test under the
-# debugger. A test that raises a signal missing from these lists does not fail
-# outright — the debugger stops on the first delivery and exits, killing the
-# whole leg — so a test that raises a new signal must add it here.
+# SIGTERM and SIGUSR2 are on the list for a different reason: nothing in the
+# runtime raises them, the tests do. CI exports PONY_TEST_DEBUGGER and runs
+# `ctest -L ci-core`, which puts both the stdlib suite and every full-program
+# test under the debugger. A test that raises a signal missing from these
+# lists does not fail outright — the debugger stops on the first delivery and
+# exits, killing the whole leg — so a test that raises a new signal must add
+# it here.
 #
 # The Windows counterpart, test-debugger.ps1, forwards no signals: Windows
 # raise() calls the handler directly instead of raising an OS signal the

.github/workflows/build-release-image.yml

@@ -217,7 +217,7 @@ jobs:
           path: 'stdlib-docs/site/'
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@v4
 
   trigger-release-announcement:
     needs:

.github/workflows/changelog-bot.yml

@@ -20,7 +20,7 @@ jobs:
     name: Update CHANGELOG.md
     steps:
       - name: Update Changelog
-        uses: docker://ghcr.io/ponylang/changelog-bot-action:0.3.10
+        uses: docker://ghcr.io/ponylang/changelog-bot-action:0.3.9
         with:
           GIT_USER_NAME: "Ponylang Main Bot"
           GIT_USER_EMAIL: "ponylang.main@gmail.com"

.github/workflows/generate-documentation.yml

@@ -35,4 +35,4 @@ jobs:
           path: 'stdlib-docs/site/'
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@v4

.github/workflows/ponyc-tier3.yml

@@ -387,6 +387,7 @@ jobs:
           set -e
           cd /build/ponyc
           df -h
+          export PONY_FULL_PROGRAM_TIMEOUT=120
           cmake --preset debug
           cmake --build --preset debug
           cmake --build --preset debug --target pony-doc-tests pony-lint-tests pony-lsp-tests

.github/workflows/ponyc-weekly-checks.yml

@@ -60,7 +60,10 @@ jobs:
             directives: pool_memalign
           - image: ghcr.io/ponylang/ponyc-ci-ubuntu26.04-builder:20260425
             debugger: lldb
-            directives: pool_retain
+            directives: pool_classic
+          - image: ghcr.io/ponylang/ponyc-ci-ubuntu26.04-builder:20260425
+            debugger: lldb
+            directives: pool_classic,pool_retain
           - image: ghcr.io/ponylang/ponyc-ci-ubuntu26.04-builder:20260425
             debugger: lldb
             directives: runtimestats
@@ -130,10 +133,8 @@ jobs:
   # the Linux directive checks pass -- the slower Windows runner isn't spent on a
   # directive that's already broken on Linux. That dependency also carries the
   # no-changes gate for free: when there are no changes use_directives is skipped,
-  # which skips this job too, so it needs no check-for-changes `if` of its own. The
-  # matrix has one entry today (runtime_tracing, the only use= option with
-  # Windows-specific runtime code); add rows as more Windows-supported options
-  # become worth checking here.
+  # which skips this job too, so it needs no check-for-changes `if` of its own. Add
+  # rows as more Windows-supported options become worth checking here.
   use_directives_windows:
     needs: use_directives
     runs-on: windows-2025-vs2026
@@ -148,6 +149,10 @@ jobs:
           # runtime_tracing's format specifiers for the runtimestats-gated fields
           # only compile in this combined build, so cover it explicitly.
           - directives: runtime_tracing,runtimestats
+          # Windows defaults to the arena allocator, so this row builds the
+          # classic pool there, as PonyUses.cmake requires for every entry in
+          # its Windows allowlist.
+          - directives: pool_classic
     name: 'use ${{ matrix.directives }} (Windows)'
     steps:
       - name: Checkout
@@ -288,6 +293,61 @@ jobs:
           topic: ${{ github.repository }} scheduled job failure
           content: ${{ github.server_url}}/${{ github.repository }}/actions/runs/${{ github.run_id }} failed.
 
+  always_assert:
+    needs: check-for-changes
+    if: needs.check-for-changes.outputs.has-changes == 'true'
+    runs-on: ubuntu-latest
+
+    # Builds the runtime optimized (release) with its asserts and the arena
+    # allocator's integrity checks kept in, via -DPONY_ALWAYS_ASSERT=ON. A plain
+    # release compiles those checks out; the debug suites run them but
+    # unoptimized. This is the only lane that runs them against optimized code,
+    # where the compiler can expose ordering or undefined behavior the checks
+    # then catch.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: ghcr.io/ponylang/ponyc-ci-ubuntu26.04-builder:20260425
+            debugger: lldb
+
+    name: release with always-assert
+    container:
+      image: ${{ matrix.image }}
+      options: --user pony --cap-add=SYS_PTRACE --security-opt seccomp=unconfined
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+        with:
+          ref: ${{ inputs.ref || github.sha }}
+      - name: Build libs
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          LIBS_IMAGE: ${{ matrix.image }}
+          LIBS_TAG: ${{ hashFiles('lib/CMakePresets.json', 'CMakeLists.txt', 'lib/CMakeLists.txt', 'lib/build-libs.cmake', 'lib/llvm/patches/*') }}
+        run: python3 .ci-scripts/libs-cache/resolve_libs_cache.py --branch-cache --image "$LIBS_IMAGE" --tag "$LIBS_TAG" -- cmake -DJOBS=4 -P lib/build-libs.cmake
+      - name: Build Release Runtime with always-assert
+        run: |
+          cmake --preset x86-64-release -DPONY_ALWAYS_ASSERT=ON
+          cmake --build --preset x86-64-release
+      - name: Test with Release Runtime
+        run: |
+          PONY_TEST_DEBUGGER="$(.ci-scripts/test-debugger.sh ${{ matrix.debugger }})"
+          export PONY_TEST_DEBUGGER
+          export PONY_FULL_PROGRAM_TIMEOUT=120
+          ctest --preset x86-64-release -L ci-core
+      - name: Send alert on failure
+        if: ${{ failure() }}
+        uses: zulip/github-actions-zulip/send-message@bd8ec52de371d139ae8313661b7d8318c19266aa
+        with:
+          api-key: ${{ secrets.ZULIP_SCHEDULED_JOB_FAILURE_API_KEY }}
+          email: ${{ secrets.ZULIP_SCHEDULED_JOB_FAILURE_EMAIL }}
+          organization-url: 'https://ponylang.zulipchat.com/'
+          to: notifications
+          type: stream
+          topic: ${{ github.repository }} scheduled job failure
+          content: ${{ github.server_url}}/${{ github.repository }}/actions/runs/${{ github.run_id }} failed.
+
   with_sanitizers:
     needs: check-for-changes
     if: needs.check-for-changes.outputs.has-changes == 'true'

.github/workflows/release-notes.yml

@@ -21,7 +21,7 @@ jobs:
     name: Update release notes
     steps:
       - name: Update
-        uses: docker://ghcr.io/ponylang/release-notes-bot-action:0.3.13
+        uses: docker://ghcr.io/ponylang/release-notes-bot-action:0.3.12
         with:
           GIT_USER_NAME: "Ponylang Main Bot"
           GIT_USER_EMAIL: "ponylang.main@gmail.com"

.github/workflows/stress-test-generative-systematic-linux.yml

@@ -56,14 +56,14 @@ jobs:
       - name: Build Debug Systematic Runtime
         if: ${{ hashFiles('.libs-cache-miss') == '' }}
         run: |
-          cmake --preset debug -DPONY_USES=scheduler_scaling_pthreads,systematic_testing
+          cmake --preset debug -DPONY_USES=systematic_testing
           cmake --build --preset debug
       - name: Run Generative Stress Test
         if: ${{ hashFiles('.libs-cache-miss') == '' }}
         run: |
           python3 test/rt-stress/generative/orchestrate_systematic.py \
-            --ponyc build/debug-scheduler_scaling_pthreads-systematic_testing/ponyc \
-            --use-flags scheduler_scaling_pthreads,systematic_testing \
+            --ponyc build/debug-systematic_testing/ponyc \
+            --use-flags systematic_testing \
             --start ${{ github.run_id }} --count 250 \
             --out rt-stress-out
       # cancelled() too: keep bundles from seeds that ran before a cancel.