func main(): i32 { let value = load_value() catch failure { fallback_for(failure.message()) } if value == 42 { return 0 } return 1 } func load_value(): i32! { return error.new("example.unavailable", "the primary value is unavailable") } func fallback_for(message: &str): i32 { return 42 }

use std/fmt.Format use std/io struct Point { x: i32 y: i32 } instance Point { impl Format method &self.try_format_into(output: &+String): void! { output.try_push_str("(")? self.x.try_format_into(output)? output.try_push_str(", ")? self.y.try_format_into(output)? output.try_push_str(")")? return } } func main(): i32! { let point = Point { x: 3, y: 4 } let message = "point = ${point}\n" io.print(&message)? return 0 }

use std/io use std/vec.Vec struct Point { x: i32 y: i32 } instance Point { operator (&self == other: &Self): bool { return self.x == other.x && self.y == other.y } } func main(): i32! { let first = Point { x: 3, y: 4 } let same = Point { x: 3, y: 4 } let other = Point { x: 5, y: 6 } if first != same || first == other { return 1 } let points = Vec [move first, move other] if points[0] != same { return 1 } var values = Vec [1, 2, 3] values[1] = 4 if values[0] + values[1] + values[2] != 8 { return 1 } io.print("equality found the point\n")? return 0 }

struct Buffer { values: [i32; 3] } instance Buffer { operator (&self[index: usize]): &i32 { return &self.values[index] } operator (&+self[index: usize]): &+i32 { return &+self.values[index] } } func at<C>(container: &C, index: usize): i32 where (&C[usize]): &i32 { return container[index] } func main(): i32 { var buffer = Buffer { values: [3, 4, 5] } buffer[1] = 9 if at(&buffer, 1) != 9 { return 1 } return 0 }

v0.32.0 Phase 0 Review

Result: complete with no open finding. This review evaluates the adopted configured-subprocess contract before source implementation begins.

Findings Closed by the Contract

Whole-stream transfer could deadlock in both directions

A child may wait for stdin while its stdout or stderr pipe is full, and the parent may block writing stdin while no output is drained. The contract requires one fair readiness loop over every active direction and permits only one bounded operation per ready direction before repolling.

Early stdin closure could terminate the parent

An ordinary pipe write can raise SIGPIPE. Changing the process-wide signal disposition would leak standard-library policy into unrelated user code. The Darwin SDK exposes descriptor-local F_SETNOSIGPIPE; the input-pipe owner must enable it before execution and classify EPIPE as an ordinary child refusal to consume remaining input.

Environment edits could become lossy reconstruction

The public environment query API validates UTF-8, while inherited process entries can contain arbitrary bytes. The prepared environment keeps untouched raw entry addresses and replaces only exactly matched configured names. It never reconstructs inherited state through public views.

Child setup failures could collapse into exec failure

Input descriptor installation, output descriptor installation, working-directory change, and executable replacement have different public meaning. The close-on-exec report receives distinct stages, while ordinary child exits remain entirely outside that protocol.

Stdin could create a second polling and cleanup authority

Adding a writer beside CaptureSession would duplicate readiness, failure precedence, and resource cleanup. Phase 2 instead replaces the capture-only session with one command-I/O owner. Raw poll classification remains target-specific and does not choose public errors.

Feasibility Evidence

The active macOS SDK declares:

SYS_chdir as syscall 12;
POLLOUT as event bit 4;
F_SETNOSIGPIPE as descriptor command 73.

A native descriptor probe applied command 73 to an ordinary pipe successfully; after its read end closed, writing returned EPIPE instead of terminating the process. The input design therefore does not depend on changing global signal handling.

Nocter already exposes generic one- and three-argument Darwin syscall roles, close-on-exec pipe ownership, bounded raw reads, raw writes, and staged child launch reporting. No parser, checker, semantic representation, MIR, machine, image-format, or compiler primitive change is required.

Boundary Review

Public semantics remain in the specification; this review contains only implementation evidence.
Command owns source configuration and a prepared plan owns every post-fork address.
The child receives only stable words and owned descriptors; it cannot allocate or validate.
Target code returns typed syscall facts and cannot select public process errors.
One lifecycle owner selects failure precedence only after exact-child observation.
No compatibility alias, alternate API spelling, or feature-specific compiler path is introduced.

Phase 1 may begin without an unresolved design decision.