Programming Language

Nocter

A self-contained systems language built around simplicity, encapsulation, and foolproof design.

Documentation GitHub
/development/reviews/v0.28.0-phase-5.md

v0.28.0 Phase 5 Text, Formatting, and Output Review

Status: complete with no open finding (2026-09-02). The implemented v0.28.0 boundary passes the complete compiler workspace, authored-standard, native execution, semantic editor, formatter, documentation, and static-quality gates. Release identity and archive qualification remain the separate release-preparation boundary.

Reviewed Boundary

The review traced borrowed trim results from ASCII byte scans to compiler-validated provenance, and owned transformations from capacity planning through String mutation and destruction. It traced scalar formatting from every built-in implementation through the private decimal renderer, the recoverable Format requirement, the aborting interface default, interpolation dispatch, and type-owned conversion. It traced text output from Writer defaults and process conveniences through the shared descriptor loop, Darwin syscall facts, target-neutral error classification, and captured native stdout and stderr.

The adversarial search covered duplicate UTF-8 scanners, duplicate decimal generation, retained typed append matrices, parallel output loops, public internal helpers, hidden allocation or buffering, target leakage, failure-channel reinterpretation, source-only editor models, obsolete wrappers, and contracts that depend on another responsibility honoring an undocumented precondition.

Authority Review

std/str/trim.nct is the only producer of ASCII trim boundaries. It recognizes exactly the six specified ASCII whitespace bytes, and every selected boundary is therefore a UTF-8 boundary. std/str/transform.nct reuses the existing find_from search authority and the String storage authority. Replacement performs one sizing pass and one emission pass without storing matches or searching replacement text. Capacity overflow reaches the standard allocation-abort boundary before construction.

std/fmt/scalar.nct is the only decimal renderer. All built-in implementations call its signed or unsigned entry point, type-owned conversion calls the same Format implementation, and JSON diagnostics call usize.try_format_into. The former public try_append_* and append_* matrices and their implementation source are absent. The signed and unsigned digit helpers are distinct only because the language has no same-width signed-to-unsigned conversion; their inputs are produced by the adjacent modulo operation and do not form a cross-source contract.

Format.try_format_into owns recoverable destination growth, while its one standard default owns conversion to allocation abort. Compiler interpolation freezes only the exact format_into declaration and ordinary interface dispatch selects the default. The compiler does not know the name or semantics of the recoverable method, and the standard library does not acquire a second interpolation or MIR path.

std/io/output.nct is the only complete descriptor-write loop. File.write, stdout, stderr, and the four process conveniences reach that loop. Writer.write_line remains an interface-derived adapter and does not create a second descriptor policy. Formatting never receives a writer error, and output never interprets allocation failure. Raw file descriptors, syscall numbers, errno, and the WriteProgress transition remain private or package-internal.

Safety and Observable Behavior

All-whitespace trim results are empty views at the source end. Replacement rejects an empty pattern before capacity planning and advances by the complete nonempty match, so it cannot loop without progress or split UTF-8. Exact capacity arithmetic is checked before owned mutation. The sizing and emission loops are one private algorithm responsibility; no external caller supplies an unchecked offset, capacity, or progress fact.

Recoverable formatting may leave an appended prefix, and the aborting default terminates on the same failure instead of inventing a domain error. Decimal boundaries include the complete i64 minimum and u64 maximum. Interpolation evaluates and formats each value through its frozen static dispatch and preserves ordinary cleanup behavior.

Descriptor output retries interruption, advances only by a target-reported count no larger than the remaining view, rejects zero progress, and maps every other target failure once. Line output writes text followed by exactly one LF and deliberately promises neither atomicity nor buffering. The noalloc guarantee follows the checked transitive call graph; no wrapper receives a manual effect exception.

Residue and Tooling Review

Searches found no active try_append_* declaration, deleted formatting-source reference, second write syscall path, format-to-writer protocol, or compatibility alias. The exact authored-standard dependency graph accepted the change without an unreviewed edge. Public roots remain bodyless, implementation sources export no new surface, and private implementation functions retain semantic references.

Formatter coverage uses the ordinary syntax tree, and semantic editor tests open the real package source before querying hover, completion, and navigation. The shared LSP test setup requires a complete analysis snapshot rather than letting each feature assume a different initialization state. The practical example's native process contract is the repository-owned authority for its status and byte streams; release qualification separately verifies that an extracted toolchain can execute the same source without repository-local toolchain state.

Qualification

Phase 5 passed:

  • cargo test --locked --manifest-path development/compiler/Cargo.toml --workspace, including 497 checking, 82 language-server, 47 command, and 31 native-session tests, with one public-HTTPS test intentionally ignored;
  • cargo clippy --manifest-path development/compiler/Cargo.toml --workspace --all-targets -- -D warnings;
  • cargo check --locked --manifest-path development/compiler/Cargo.toml --workspace --no-default-features;
  • formatter, authored-standard dependency, public-example execution, and complete target-session gates;
  • deterministic documentation generation and catalog validation;
  • packaging shell and JavaScript syntax, Rust formatting, and repository whitespace checks.

No implementation remediation was required during this final review. v0.28.0 is ready for release preparation; this review does not assign the release identity, build an archive, or publish it.