v0.18.0: Surface and Interface Simplification

Status: published (2026-08-28). The working tree adopts the completed language contracts and semantic-authority rewrite below without compatibility modes. Phase 3 does not change the source language. The Phase 0 final review and Phase 1 final review, and the Phase 2 final review, and the Phase 3 final review, record their boundary audits and remediation.

Phase 0: Construction Independence

Phase 0 removes the default construct-member modifier and separates three responsibilities that previously overlapped:

• nominal representation and field visibility alone decide whether Type { ... } is legal;
• a nonempty construct Type { ... } declares named construction functions and typed literals;
• nominal type hover presents the nominal declaration, while each construction member presents its own contract at its own source identity.

The declaration graph stores construction membership but no selected primary member. The checking layer owns one canonical use-site construction surface and one explicit representation-access contract for diagnostics that need field-level visibility. Completion, checking, and navigation consume those contracts instead of reconstructing member or visibility lists. Presentation does not depend on a checking-only construction view.

Completion Gate

Phase 0 is complete only when:

• the parser rejects default in construct and rejects empty construct declarations;
• construction declarations, lowering, validation, checking, and presentation retain no default member state or duplicate-default diagnostic;
• public-field structs remain structurally constructible regardless of an authored construct declaration, while opaque or private representations remain inaccessible;
• nominal hover never appends a construct block and never exposes a partial private representation;
• the standard library and current examples use the new syntax;
• active specification and development documents contain no superseded construction-default or public-construction-hover design;
• focused and complete workspace tests, warnings-denied Clippy, formatting, generated documentation, and repository whitespace gates pass;
• the final review finds no compatibility parser, duplicate construction authority, repeated visibility decision, reverse dependency from presentation to checking internals, or obsolete wrapper retained solely for the removed feature.

Non-goals

Phase 0 does not choose a single conventional factory name, change typed-literal call syntax, change interface default methods, or remove construction-member completion and navigation.

Phase 1: Source-Declared Named Builtins

Phase 1 gives every named compiler-represented type one ordinary source declaration and makes the function modifier order uniform:

pub primitive type i32
primitive func new_error(code: &str, message: &str): error

Discovery resolves each named builtin locator to one exact public declaration token. Declaration lowering binds that token to the existing canonical BuiltinType, publishes it through ordinary module and source namespaces, and derives inherent-surface ownership from the declaration's module. The compiler-managed universal fallback makes these entities available without importing the standard module. Type binding, value-position construction owners, checking, hover, completion, highlighting, and navigation consume the same projected entity. Anonymous structural slices retain one separately selected attachment module because [T] has no named declaration.

Completion Gate

Phase 1 is complete only when:

• active syntax accepts only primitive type Name and primitive func name(...): Type;
• each bundled named builtin has one exact public declaration selected by discovery;
• ordinary user source cannot author, shadow, alias over, or redeclare a builtin name;
• named builtin inherent authority comes from the selected declaration module, not a second scalar/string/error attachment table;
• type and construction-owner resolution contain no spelling-to-semantic fallback;
• source presentation and navigation use the selected declaration and its documentation;
• structural slice authority remains explicit and is not conflated with named declarations;
• active specification, standard source, fixtures, and editor tests use only the new forms;
• complete tests, warnings-denied Clippy, formatting, generated docs, and repository integrity gates pass;
• the final review finds no compatibility parser, duplicate spelling renderer, repeated authority lookup, semantic dependence on SourceIndex, or downstream path/name inference.

Non-goals

Phase 1 does not make structural type constructors nominal, expose user-defined primitives, change the canonical runtime representation of any builtin, or replace the closed primitive-role registry.

Phase 2: Instance-Owned Interface Implementation

Phase 2 removes the standalone conform declaration and makes instance the sole source owner of behavior attached to an existing type. A bodyless impl Interface instance member declares one explicit nominal interface implementation and binds associated types. Ordinary inherent methods provide the required behavior; checked-program construction freezes each interface-method identity to one exact inherent callable before body dispatch or executable specialization.

The phase also separates generic arguments from associated bindings and nominal interface requirements from callable contracts:

instance ValuesIter<T> {
    impl Iterator { .Item = T }

    method &+self.next(): T? { ... }
}

func consume<T>(value: T): void where T impl Iterator { .Item = &str }

Angle brackets contain generic arguments only. Associated bindings use { .Name = Type }. impl denotes nominal interface implementation only; callable types use ordinary callable annotations with a statically selected concrete witness and no erased runtime representation.

Completion Gate

Phase 2 is complete only when:

• active syntax, formatting, source, standard-library, examples, and fixtures contain no conform declaration or colon-based nominal interface requirement;
• declaration identity contains an instance-owned interface-implementation fact and no standalone conformance owner, callable owner, generic owner, or contract-joining path;
• every required interface method maps to one exact applicable inherent callable by normalized signature, independent of source, instance-fragment, and declaration order;
• implementation overlap, associated bindings, default selection, generic proof, opaque witnesses, interpolation, expansion, and editor navigation consume that one frozen authority;
• generic angles never encode associated bindings, and associated projection equality is expressed by the binding block of its interface application;
• each semantic interface requirement owns that exact application and its associated bindings; presentation and proof never reconstruct one predicate from adjacent requirement records;
• callable annotations preserve exact closure witness specialization without an erased callable layout, indirect ABI, vtable, or impl func relation;
• implementation-source rules require program-wide impl Interface facts in index.nct, while private instance fragments remain ordinary method-body owners;
• focused tests, complete workspace tests, warnings-denied Clippy, formatting, generated documentation, and repository whitespace gates pass;
• a final review finds no compatibility parser, legacy conformance identity, duplicate method search, callable/interface union masquerading as one source relation, order-dependent selection, or editor reconstruction of implementation semantics.

Non-goals

Phase 2 does not add dynamic interface values, erased callable objects, interface-specific method adapters, overload ranking, interface inheritance, or runtime generic dictionaries.

Phase 3: Persistent Semantic Authority

Phase 3 replaces direct mutation plus rollback with immutable semantic authorities and explicit branch-local transactions. It covers type interning, copyability memoization, and closure definition together: changing only one store would leave two incompatible transaction models in body checking.

An immutable TypeStore is the read-only type snapshot exposed by prepared, checked, and recovery products. A construction-only TypeAuthority owns its exact generation and is the only value that can open or accept a TypeTransaction. SemanticAuthority keeps that owner inseparable from copyability through preparation, body recovery, checked completion, member queries, and concrete specialization. BodySemanticTransaction adds the closure transaction at the body boundary. A successful body consumes its transaction into the next immutable authority; a failed body either discards its transaction or freezes the exact branch as an editor recovery capability. No failure mutates and then repairs the accepted authority.

Type identities are authority-relative. A descendant preserves every ancestor identity and may be committed sequentially. Sibling branches may assign the same numeric slot independently and must never exchange a bare TypeId; every cross-boundary type belongs to its checked, recovery, or projected authority. Storage chunks, persistent indexes, lineage tokens, and transaction mechanics remain private to their owning crates.

Member completion forks one composite query transaction from the immutable checked or recovery authority. Its temporary structural types and copyability memoization stay in the generation-local analysis session. Checked queries derive receiver types from body-node identities owned by that same checked program rather than accepting raw cross-generation TypeId input. The query never clones a complete store, changes compiler output, or publishes its branch as checked semantics.

The pre-rewrite structural baseline is:

• three production rollback authorities: TypeStoreCheckpoint, CopyabilityTransaction, and ClosureTableCheckpoint;
• one body-pipeline checkpoint that coordinates those three authorities by calling their private commit or rollback operations;
• one complete type/copyability clone for each retained member-selection interruption;
• one additional complete type/copyability clone when the first member-completion query opens its mutable query state;
• no complete store clone for construction, structural-field, enum-pattern, associated-type, or outcome recovery.

Completion Gate

Phase 3 is complete only when:

• immutable type, copyability, and closure products expose read contracts and cannot be mutated;
• one BodySemanticTransaction owns every program-wide semantic mutation performed while checking a body;
• body success uses consume-and-commit, while body rejection uses discard or immutable recovery freeze;
• TypeStoreCheckpoint, BodySemanticCheckpoint, ClosureTableCheckpoint, their journals, and all body-semantic rollback paths are absent;
• member recovery and member queries retain a shared authority plus their own deltas and contain no complete TypeStore or CopyabilityTable clone;
• authority lineage rejects sibling or stale transaction use and preserves ancestor identities in every descendant;
• prepared and checked programs retain one immutable semantic authority, and Target, MIR, Machine, and runtime layers cannot access transaction or persistent-storage internals;
• repeated editor queries produce identical semantics without mutating compiler products;
• adversarial tests cover branch divergence, stale commit, recovery isolation, deterministic type identity, and multiple independent body failures;
• success-path compilation shows no unexplained median regression above five percent and cannot be qualified with a regression above ten percent;
• focused and complete workspace tests, warnings-denied Clippy, formatting, generated documentation, and repository whitespace gates pass;
• the final review finds no compatibility adapter, duplicate authority, full-store recovery clone, hidden rollback, storage reconstruction, reverse dependency, or semantic decision repeated by a downstream phase.

Non-goals

Phase 3 does not change source syntax, public standard-library behavior, runtime representation, ABI, dynamic interface policy, or callable dispatch. Persistent authority makes independent body branches possible but does not claim parallel body checking; merging concurrently successful siblings requires a separate deterministic identity policy.

Completion Evidence

• default is absent from construct parsing, declaration identity, lowering, validation, checking, presentation, current standard source, and active documentation. The only active occurrences are negative conformance examples; interface default methods remain independent.
• empty construct syntax is rejected, and an empty construction declaration cannot enter the immutable semantic graph.
• structural construction reads representation and field visibility only. One exact-source visibility contract is shared by body checking, construction queries, completion, and nominal hover.
• nominal hover presents complete visible nominal shapes or a header, never a construct block or a partial hidden representation.
• the complete workspace test suite, warnings-denied Clippy, Rust formatting, generated docs, and repository whitespace gates passed from an external Cargo target.
• instance is the sole owner of inherent behavior and nominal interface implementation; standalone conform syntax and semantic identity are absent.
• one aggregate interface requirement owns its interface application and associated bindings from lowering through checked proof and presentation. No phase rejoins adjacent requirement records.
• callable annotations use ordinary callable types and exact static witnesses. They do not enter nominal interface proof or introduce erased callable ABI.
• successful declaration validation produces AcceptedDeclarationProgram, the only semantic input accepted by checking; rejected recovery cannot cross that boundary implicitly.
• the complete workspace test suite, warnings-denied Clippy, Rust formatting, generated docs, and repository whitespace gates passed after the Phase 2 migration.
• type, copyability, and closure construction use persistent immutable bases and exact-base transactions. SemanticAuthority keeps type and copyability inseparable across every checking stage, while BodySemanticAuthority adds the closure commit boundary for each body generation.
• every checkpoint, mutation journal, rollback path, old closure builder, and full-store recovery clone is absent. Nested closure requirements also use persistent storage and linearize only once.
• editor query sessions reject reuse with another semantic authority. Checked and recovery completion tests prove repeated results without mutating accepted compiler products; checked completion derives its receiver type from the selected checked body node.
• concrete dispatch and destruction share one semantic specialization transaction. Structural storage/concreteness facts are fixed at type interning, final copyability closure scans only the appended suffix, and persistent-vector iteration visits tree nodes linearly.
• manifest architecture tests permit persistent-storage dependencies only in model and checking; type-resolved warnings-denied Clippy rejects semantic construction authorities, transactions, closure construction sequences, and persistent collections outside their reviewed owner boundaries; declaration and lowering exemptions are module-scoped.
• stable program facts have one ProgramEnvironment owner across preparation and checked output; accepted semantic facts and closures enter checked output only through the private body-finish construction of CheckedSemanticAuthority.
• preparation owns the only production constructor that seals type and copyability components into a semantic authority; the empty default authority is test-only.
• checked bodies own their exact source identity, and checked or recovery member queries derive visibility from their semantic input rather than accepting an independent caller source.
• same-machine qualification against 264f1464 measured -2.7% warm-success, +3.3% multi-error recovery, -2.7% repeated checked completion, and +0.6% repeated recovery completion. Every median remains inside the five-percent gate.
• the final tree passed complete workspace tests, warnings-denied all-target Clippy, Rust formatting, generated documentation, and repository whitespace validation.
• the post-phase full-boundary review made accepted workspace causality inseparable from each source revision, removed raw compiler failure storage from analysis snapshots, and moved exact declaration-repair evidence once from the diagnostic error into the session semantic authority.
• session evidence bundles no longer expose an unguarded phase-specific accessor path; the query evidence kernel alone may consume resolved raw phase methods, enforced by warnings-denied Clippy.
• typed interruption selection always retains its real stable recovery index, including diagnostic-range selection; no query capability contains a fabricated cache identity.
• semantic mutation construction resolves, sorts, and validates source edit groups once. LSP projection consumes those groups with their accepted document versions and cannot repeat source grouping or overlap policy.
• analysis status is represented by exclusive snapshot state variants, and workspace topology owns one selected or rejected result per document. The removed optional status tag and parallel selection/failure maps cannot drift apart during later feature work.
• interface repair evidence can inhabit only declaration recovery and is separated from its preparation error while checking constructs the typed failure, before either result reaches the semantic pipeline.
• workspace revisions are non-cloneable, carry an opaque document-owner sequence, and validate every changed path with the overlay's canonical-path authority. Workspace analysis rejects a foreign or non-increasing revision before mutating latest-generation state.