v0.30.0 Phase 5 Qualification and Final Review

Status: complete with no open finding (2026-09-03). Phase 5 closes implementation and qualification for the exact-path synchronous subprocess boundary. It changes the normative chapter from future direction to the current v0.30.0 source-tree contract without claiming that v0.30.0 has already been published.

Complete Path Review

The review traced Command.new and arg from validation through owned NUL-terminated storage, pointer-vector preparation, launch-channel creation, fork classification, the child exec path, parent report collection, exact-pid wait, public failure selection, typed terminal status, and destruction. It also reviewed the primitive registry, standard-profile locators, target contract validation, Machine context dependency, ARM64 selection and materialization, native test selection, editor queries, public-example catalog, installed-home path, and generated documentation.

Each decision retains one owner:

• command.nct owns input validation, owned path and argument storage, argv construction, and the private ExitStatus representation;
• subprocess_darwin.nct owns fork and wait classification, close-on-exec channel mechanics, raw exec reporting, and Darwin terminal-status decoding;
• command_darwin.nct owns synchronous orchestration and public process-error selection;
• internal/os/darwin owns syscall numbers and generic raw syscall result declarations;
• the compiler owns opaque process-context transport, closed primitive signature validation, and target ABI materialization without knowing Command, ExitStatus, wait bits, or public errors;
• the shared public-example catalog owns practical fixture and observation data once.

No later layer reconstructs an earlier choice from source text, names, or a lower-level representation. The pair-result syscall role remains generic and carries two target result words; only standard source assigns fork or pipe meaning. The inherited environment-vector role exposes an opaque entry fact to trusted standard source and is not rebuilt from public UTF-8 environment views.

Resource and Failure Review

All allocation, validation, byte copying, and pointer-vector growth occur before pipe creation and fork. A fork failure closes both descriptors. The child closes the read descriptor, attempts one exact-path exec, reports only a raw errno on rejection, closes through the raw failure routine, and terminates without returning to allocation, destruction, formatting, or user code. The parent closes its writer, drains and closes the report reader, and waits for the exact created pid before selecting either the report failure or terminal result.

Interrupted report I/O and wait are retried at the raw transition boundary. Partial or oversized report observations cannot become an errno or successful exec. An ordinary exit code 127 remains a typed child status and cannot become exec rejection. The exposed API contains no descriptor or independent Child; callers cannot omit cleanup or reaping. Path and argument bytes are owned, so callers also need not preserve borrowed inputs.

The raw wait_failed boundary remains explicit because an operating system can refuse terminal observation. With the current runtime's exact fork pid, fixed wait options, valid status storage, and absence of threads or signal handlers that can steal a child, ordinary Nocter source cannot create that state. The implementation does not fabricate successful reaping when the kernel reports otherwise.

Adversarial Search

Repository-wide searches found process syscall constants only in the target OS module; launch and wait interpretation only in std/process; public process error codes only in policy source and their black-box tests; and Command/ExitStatus compiler knowledge only in source-facing tooling tests. No obsolete alternate subprocess API, shell fallback, PATH lookup, environment reconstruction, magic exit-code protocol, copied editor surface, or second execution contract was found.

Qualification

Phase 5 passes:

• cargo test --locked --workspace, including 497 checking, 123 declaration-lowering, 84 language-server, 55 command, 36 native-session, and 68 architecture/conformance tests; one public HTTPS acquisition test remains intentionally ignored;
• cargo clippy --locked --workspace --all-targets -- -D warnings;
• cargo check --locked --workspace --no-default-features;
• cargo fmt --all -- --check;
• deterministic generation of all public HTML with node docs/build-docs.js;
• shell and JavaScript syntax checks for release packaging and site generation;
• repository whitespace and generated-output checks.

No implementation or documentation remediation remains. v0.30.0 is ready for release preparation; this phase does not assign the release identity, create a distribution archive, or publish it.