func main(): i32 { let value = load_value() catch failure { fallback_for(failure.message()) } if value == 42 { return 0 } return 1 } func load_value(): i32! { return error.new("example.unavailable", "the primary value is unavailable") } func fallback_for(message: &str): i32 { return 42 }

use std/fmt.Format use std/io struct Point { x: i32 y: i32 } instance Point { impl Format method &self.try_format_into(output: &+String): void! { output.try_push_str("(")? self.x.try_format_into(output)? output.try_push_str(", ")? self.y.try_format_into(output)? output.try_push_str(")")? return } } func main(): i32! { let point = Point { x: 3, y: 4 } let message = "point = ${point}\n" io.print(&message)? return 0 }

use std/io use std/vec.Vec struct Point { x: i32 y: i32 } instance Point { operator (&self == other: &Self): bool { return self.x == other.x && self.y == other.y } } func main(): i32! { let first = Point { x: 3, y: 4 } let same = Point { x: 3, y: 4 } let other = Point { x: 5, y: 6 } if first != same || first == other { return 1 } let points = Vec [move first, move other] if points[0] != same { return 1 } var values = Vec [1, 2, 3] values[1] = 4 if values[0] + values[1] + values[2] != 8 { return 1 } io.print("equality found the point\n")? return 0 }

struct Buffer { values: [i32; 3] } instance Buffer { operator (&self[index: usize]): &i32 { return &self.values[index] } operator (&+self[index: usize]): &+i32 { return &+self.values[index] } } func at<C>(container: &C, index: usize): i32 where (&C[usize]): &i32 { return container[index] } func main(): i32 { var buffer = Buffer { values: [3, 4, 5] } buffer[1] = 9 if at(&buffer, 1) != 9 { return 1 } return 0 }

v0.32.0 Phase 2 Review

Result: complete with no open finding. The configured command now reaches one child setup path and one parent I/O session. This review covers the authority replacement; exhaustive behavior and failure injection remain Phase 3 qualification.

Replaced Authorities

The two-descriptor capture poll, capture session, and capture child-setup sources were removed.
One three-descriptor poll transition now classifies writable stdin and readable stdout/stderr. Direction-specific validation rejects event bits that are valid for another descriptor role.
One CommandIoSession owns optional input state, optional capture state, every pipe endpoint, transfer offsets, capture buffers, scratch storage, liveness, and cleanup.
status and output share the same prepare, fork, launch-report, I/O, wait, and failure-selection path. Their only remaining distinction is whether capture channels are requested and which typed output variant is accepted.

Target and Policy Boundaries

Raw Darwin code reports closed poll, read, write, descriptor-install, directory, exec, and wait facts. It does not construct public process errors.
Child setup reports input installation, output installation, directory change, and executable replacement as distinct stages. Ordinary exit status remains outside the report protocol.
Parent orchestration waits exactly once before selecting launch, capture, or input failures.
A descriptor-local F_SETNOSIGPIPE setting converts early child stdin closure to typed EPIPE; no process-wide signal state is changed.

Single Environment Authority

The old compiler ProcessEnvironmentVector primitive existed only so the previous command path could pass inherited envp directly to exec. The prepared environment now owns every exec vector, so the primitive, its standard profile binding, machine-context dependency, ARM64 selection and emission, and test fixture surface were deleted together. The compiler still retains counted process-entry storage for public argument and environment queries; it can no longer bypass the prepared command environment.

Evidence

Existing native Command.status and Command.output examples run through the unified path.
New target tests observe simultaneous writer/read readiness and prove descriptor-local broken pipe classification without terminating the test process.
All 34 nocter library tests pass through authored and installed standard-library copies.
Focused machine, ARM64, runtime-contract, standard-profile, target-program, and discovery suites pass after primitive deletion; discovery reports no unreferenced private implementation helper.
Complete lifecycle combinations and failure precedence are deliberately owned by Phase 3 rather than inferred from these structural checks.