v0.27.0 Phase 4 Filesystem and Path Review

Status: remediation and full-workspace qualification complete (2026-09-02). The review found and corrected two observable contract defects. No open defect or near-term structural blocker remains in the reviewed boundary.

Reviewed Boundary

The review traced lexical path queries from the public Utf8Path contracts to borrowed UTF-8 views, and directory mutation from public policy through native path preparation, Darwin target attempts, raw errno classification, and stable built-in errors. It also traced the declarations through formatter inspection, semantic editor queries, native compilation, and authored-standard test discovery.

The adversarial search covered duplicate separator scanners, duplicate syscall or errno facts, public target leakage, mutation retries, recursive-delete residue, public-error re-interpretation, source-only editor models, compatibility wrappers, and unchecked caller assumptions.

Findings and Remediation

create_dir_all originally called the public metadata function after mkdir reported an existing prefix. A dangling symbolic link therefore escaped as std.io.not_found instead of the specified existing non-directory prefix. The call also made internal policy depend on a public sibling API and would have required re-interpreting a public error to distinguish the target state. std/fs/darwin now owns one narrow existing_path_is_directory_target observation. It shares the canonical stat decoding helper, follows links to directories, classifies dangling or non-directory resolution as false, and preserves unrelated target failures. The public policy consumes that typed observation without inspecting a public error.

The extension scan originally excluded the final byte before choosing the rightmost dot. Names such as name.. and ... could therefore treat an earlier dot as an extension separator even though the actual last dot was trailing. The lexical authority now selects the actual rightmost dot first and applies the specification's first-or-last-position rule once. Permanent source tests cover both repeated trailing dots and all-dot names.

Native application coverage now distinguishes dangling links, links to directories, and final link removal. It proves that recursive creation accepts a link that resolves to a directory, rejects a dangling link as a non-directory prefix, and never lets remove_dir follow a final link. Root-only recursive creation is also exercised without mutation.

Authority and Residue Review

std/path/lexical.nct is the only producer of separator, component, and extension boundaries. Every query remains noalloc, returns a view into the owned spelling, and performs no filesystem observation or dot-component normalization. The optional UTF-8 slice result is checked rather than assumed; its boundary is derived only from ASCII separators or dots, so no caller supplies an unchecked offset.

std/internal/os/darwin is the sole source of raw syscall numbers, mode constants, and errno classification. std/internal/path is the sole native path-argument encoder. std/fs/darwin performs target observations and exactly one mutation attempt, while std/fs owns portable left-to-right policy. Stable std.io.* construction remains centralized in std/internal/io. No public module sees a raw errno, syscall number, target buffer layout, or internal outcome type.

create_dir_all validates the complete spelling before its first mutation so a later embedded NUL cannot leave avoidable partial state. Native path preparation still validates each argument at its own boundary. This is intentional independent input validation, not a second semantic decision: removing it would make target correctness depend on every caller remembering a hidden precondition. Completed directories remain visible only for failures that arise after mutation has legitimately started, as specified.

No mutation path retries after interruption. The retry loop remains confined to the observational stat query. No recursive deletion implementation, compatibility alias, target-neutral forwarding wrapper, duplicate path scanner, or obsolete public contract remains.

Formatter, hover, completion, definition, and implementation tests consume the ordinary syntax and semantic-query authorities. The editor integration has no path-specific parser or declaration table. The native application compiles against the physical standard package used by installed toolchains and exercises only public APIs.

Qualification

• complete compiler workspace tests pass, with the existing network integration case ignored;
• complete workspace Clippy passes with warnings denied;
• workspace formatting and repository diff checks pass;
• generated documentation builds deterministically;
• focused native path, filesystem, formatter, and language-server scenarios pass;
• architecture and authored-standard dependency tests pass as part of the complete workspace.

Release packaging and publication are deliberately not part of this implementation review.