v0.26.0: Monotonic Time Foundation

Status: complete, published, and externally audited (2026-09-02). The publication record freezes the release evidence. v0.26.0 adds one bounded application foundation: normalized durations, monotonic elapsed-time measurement, and blocking sleep. It does not add calendar time, async execution, or another guarantee modifier.

Completion Boundary

• std/time.Duration represents every normalized non-negative span through u64 whole seconds and a subsecond nanosecond component;
• constructors avoid intermediate overflow, while addition and subtraction report unrepresentable results through absence rather than trapping;
• Instant.now and Instant.elapsed use a monotonic target counter without exposing its ticks or frequency;
• one complete counter cycle exceeds one hundred years, and elapsed subtraction handles one wrap;
• time.sleep rounds positive sub-resolution waits upward, retries interruption from a freshly measured remainder, chunks values beyond one target wait, and reports other OS failures;
• all public operations publish noalloc, while sleep deliberately makes no non-blocking or realtime promise;
• formatter, hover, completion, navigation, installed-standard checking, and native execution see the same public contracts;
• complete workspace, native, documentation, and design-review gates pass.

Architecture Boundary

nocter-runtime-contract owns three closed target primitive roles: monotonic counter read, fixed counter frequency, and wrapping counter delta. The ARM64 backend implements those roles directly from architectural counter state and materializes the counter read as an ordered observation. Target validation fixes their semantic signatures and effect evidence; the standard library cannot select them by name.

nocter-standard-profile owns the bundled standard package's one physical declaration catalog. Production compilation and physical-standard qualification consume that complete profile. Synthetic primitive fixtures that mirror bundled source reuse its primitive-locator subcatalog rather than copying physical paths and names.

std/internal/os/darwin owns the raw timeout structure and syscall ABI. std/internal/time maps one descriptor-free target wait into a target-neutral completion status. std/time owns counter conversion, normalized value invariants, rounding, chunking, retry, and public errors. The compiler does not know Duration layout or sleep policy, and neither adapter knows the public time model.

Wall-clock gettimeofday is not a fallback for monotonic time because clock adjustment can make it move backward. Dynamic timekeeping calls to libSystem, platform SDK dependencies, and target spelling checks are prohibited.

Phase 0: Contract and Feasibility

Status: complete. The normative contract fixes normalization, checked arithmetic, counter-wrap behavior, resolution rounding, interruption retry, failure codes, noalloc scope, and responsibility boundaries. ARM64 Darwin can supply the counter without an external runtime; its existing syscall boundary can perform descriptor-free timed waits.

Phase 1: Target Primitive Contract

Status: complete. Exact primitive roles, declaration locators, target signature validation, ARM64 selection, closed instruction encoding, and unit tests are implemented. No public time type enters the compiler.

Phase 2: Standard Time Values

Status: complete. std/time owns the public Duration and Instant contracts, private representations, normalization, checked arithmetic, counter conversion, boundary tests, and native counter execution. Target ticks and frequency remain private.

Phase 3: Blocking Sleep

Status: complete. The Darwin adapter owns one descriptor-free select timeout attempt and its private timeval ABI. std/time owns upward rounding, normalization, target-limit chunking, monotonic remeasurement after every wait or interruption, stable public failure, and native elapsed-time tests.

Phase 4: Tooling and Practical Integration

Status: complete. The formatted public elapsed-time example crosses the complete target session. Hover, definition, implementation, and completion tests consume the same std/time contract and body identities. The practical-library reference links to the normative time chapter, and generated documentation publishes both public source and contract pages.

Phase 5: Qualification and Review

Status: complete and reviewed. The Phase 5 review records the Darwin timeout ABI correction, target-neutral wait adapter, closed selector cleanup, complete native and editor matrix, ordered ARM64 counter observation, bundled-standard profile authority, exact dependency audit, and full workspace qualification.

The review found one counter conversion, one normalized value model, one raw target wait, and one target-result classification. It found no wall-clock fallback, machine-to-semantic reversal, target ABI leakage into the public module, caller-discipline selector flag, effect overstatement, or obsolete compatibility wrapper. Phase 5 does not package or publish v0.26.0.

The release-preparation record fixes the qualified source commit, independent source gates, reproducible archive identity, and isolated installed-home evidence. The separately authorized publication is recorded in ../releases/v0.26.0.md.