sentinel pointers and c strings

TODO.md

@@ -20,7 +20,7 @@
      - `[]T`: pointer and length
      - `[;S]T`: pointer and length with a sentinel invariant
      - ordinary slices do not guarantee null termination
-   - string literals as immutable sentinel slices backed by static arrays
+   - string literals as immutable sentinel slices backed by static arrays (superseded by milestone 3.5)
    - character literals
    - optionals with trapping unwrap and fallback operations
    - native structs with compiler-controlled layout
@@ -44,6 +44,16 @@
    - emit LLVM c-variadic declarations and calls
    - keep native brolang variadics and tuple design separate
 
+3.5. sentinel pointers and c strings (implemented)
+   - add sentinel many-item pointers: `[*;S]T`
+   - represent string literals as immutable pointers to statically stored sentinel arrays: `@[N;0]u8`
+   - arrays expose `.len` but no `.ptr`; slices and pointers-to-arrays expose sentinel-preserving `.ptr`
+   - allow pointer-to-array `.len`, indexing, slicing, pointer decay, and slice construction without explicit dereference
+   - preserve or forget sentinel information through compatible pointer and slice coercions without copying arrays
+   - allow zero-terminated immutable byte pointer views to convert to immutable `*c_char` and `[*;0]c_char`
+   - keep `u8` and `c_char` distinct to preserve target-dependent scalar c semantics
+   - reject general `u8`/`c_char` interchange, slice-to-pointer coercion, and conversion to mutable c character pointers
+
 4. advanced c interop
    - by-value records and unions
    - function pointers and callbacks