v0.19.0 Phase 4 Stabilization Review

Result: passed (2026-08-28). This review covers the complete v0.19.0 standard-library and recursive text-search path after Phase 0 through Phase 3 implementation. Release artifact qualification remains a separate gate.

Review Criteria

The review traced:

• descriptor and buffered-stream state across success, explicit close, EOF, failure, and drop;
• allocation origin, growth, replacement, and destruction for raw buffers, String, Vec, region storage, zero-capacity construction, and zero-sized elements;
• component-boundary and exact-size iterator claims against their public contracts;
• every reference-application path from arguments through traversal, sorting, streaming input, buffered output, failure reporting, and process status;
• standard root contracts, implementation bodies, restricted visibility, private helper use, cross-module dependencies, and package-absolute self imports;
• source-backed hover and navigation for the public APIs exercised by the real package;
• stale compatibility behavior, duplicate policy, dead wrappers, repeated arithmetic decisions, and responsibilities that require another responsibility's private representation.

Findings and Remediation

Stream closure did not uniformly make wrappers terminal

File previously mixed descriptor ownership with open state, and buffered writers could retain a retryable-looking value after an underlying failure. File now separates owned-open, borrowed-open, and closed states. Buffered failures converge on one terminal transition. A borrowed stdout or stderr wrapper becomes locally closed without closing the process-global descriptor.

Exact growth retained repeated allocation and overflow policy

String and Vec now share checked addition, multiplication, and geometric-capacity growth through std/internal/mem. Mutation receives the already checked next logical length instead of repeating the arithmetic after reserve. Explicit zero-capacity construction records its selected allocator; only empty defers allocator selection until first growth.

Buffer release and allocator tags had multiple authorities

RawBuffer destruction is now the sole individual-buffer release operation. Allocators select allocation and growth but expose no second consuming free path. Allocator-kind constants remain in the storage owner and consumers ask named predicates instead of repeating numeric tags.

Collection edge contracts were incomplete

Vec now supports zero-sized elements without allocating backing bytes while preserving logical length, movement, and destruction. Owned split consumes the borrowed SplitIter, so text component boundaries have one state machine. ChainIter no longer claims ExactSizeIterator: two individually representable lengths can have an unrepresentable sum.

Standard-source review tables could become stale

The authored-standard test now requires the reviewed module dependency set to exactly equal the resolved graph. It also uses checked semantic entities to reject unreferenced private free functions while exempting compiler-selected primitives and bodies completing root contracts. Unused helpers, state fields, and one-call observation wrappers found by the first run were removed.

Match output issued one syscall for every rendered fragment

The reference application now owns one bounded BufWriter around stdout and explicitly closes it on successful completion. Each match still uses the public Writer contract, output errors remain recoverable, and exact process output is unchanged. The real package LSP test also covers the source-backed BufWriter contract.

Final Boundary Assessment

• Public behavior remains solely in spec/; no compiler semantic branch or primitive was added.
• Target constants and record decoding remain under std/internal/os/darwin; portable filesystem, stream, allocation, text, and collection policy stays in its owning module.
• Resource wrappers own their terminal transitions. Callers do not need to know descriptor reuse, refill offsets, raw allocation tags, or native record layout.
• The reference application retains discovered path data and one largest line, not complete file contents. Geometric growth prevents repeated copying from becoming quadratic, including under a region allocator where old blocks cannot be individually released.
• Successful output is globally path-sorted and buffered without changing its bytes. Directory streams close before child recursion and no symlink becomes a traversal edge.
• Standard contract roots remain bodyless, dependencies and restricted surfaces are reviewed exact sets, and private implementation liveness is checked by entity rather than spelling.

No unresolved correctness, performance, or responsibility-boundary finding remains in Phase 4 implementation scope.

Verification Before Candidate Qualification

The stabilized release-content commit passed two complete locked workspace runs in independent external targets, each with 1,358 passed, zero failed, and one ignored test. Warnings-denied all-target Clippy passed in both targets. The explicit public-HTTPS test passed separately. Formatting, manifest validation, 251-page generated documentation, and repository integrity checks passed. Two optimized archives and extracted homes matched exactly, and the fresh installed CLI, native execution, standard library, and LSP smoke matrix passed without mutating the installed home.