v0.33.0 Phase 4 Qualification and Final Review

Status: complete with no open finding (2026-09-04). The reopened review closed the missing tuple-position source-diagnostic boundary and repeated complete qualification. This review makes no publication claim and authorizes no tag, push, upload, or public latest-release change.

End-to-End Responsibility Review

The final review traced tuple facts across every participating responsibility:

• syntax owns delimiter, comma, positional-token, recursive-pattern, postfix-suffix shape, and the canonical source spelling of a tuple position;
• TypeStore alone interns ordered structural tuple identity, with TupleElements enforcing the minimum two-element language invariant;
• checking alone selects element types, operations, places, local pattern bindings, ownership transfer, loans, provenance, cleanup timing, and structural destruction;
• MIR serializes those checked facts into positional aggregate, projection, and destruction operations without resolving types, moves, or loans again;
• the runtime contract closes concrete element representations and rejects malformed public-builder input before target publication;
• MachineLayoutStore alone computes concrete size, alignment, and element offsets; aggregate lowering, address projection, generated destruction, and ABI classification only consume them;
• source indexing owns exact source occurrences but no tuple semantics; semantic queries use the checked place/type and canonical presentation contracts;
• formatter and recovery completion depend on syntax and self-contained type projections rather than an editor-only tuple grammar or a borrowed recovery-store identity.

Each responsibility can change its private representation without requiring consumers to know that representation. No consumer reaches backward to syntax text or a preceding mutable checker to recompute an accepted semantic decision.

Adversarial Review

Repository searches and direct inspection found no remaining tuple TODO, parser-only tuple form, BindingTarget compatibility model, synthetic tuple declaration or field, PackEntry reuse, rendered-name identity, duplicate machine offset computation, editor-specific tuple parser, or backend ownership inference. Empty and one-element tuples are rejected at syntax, semantic construction, and exported runtime boundaries rather than relying on every caller to behave.

The implementation review had already closed four shared-boundary defects: incomplete postfix classification, recovery-store TypeId escape, non-exhaustive interactive-entity selection, and unchecked runtime tuple arity. The final review searched adjacent consumers of those boundaries and found no second list or fallback selection. Discard and partial-move cleanup remain ordinary checked cleanup operations, not tuple-specific MIR policy.

The reopened review found one fifth boundary defect: checking parsed a general integer-literal spelling directly as usize, so digit separators and oversized values escaped as internal errors. TupleElementIndex now owns the narrower canonical spelling once, checking maps every invalid base, spelling, and position to source diagnostic E0413, and CLI and LSP regressions prove that E0900 is not exposed. No downstream layer parses or reconstructs a tuple position from source text.

str.split_once returns borrowed views from self, including defined empty-separator behavior, without exposing storage or allocating. Its implementation and public declaration remain separated through the normal standard-library contract/body model. The tuple example is discovered through existing public-example catalogs and does not introduce another execution path.

Qualification

Release-content commit 9fedd9a4be12d748f055da777436295021a4466a passed:

• two independent cargo test --locked --workspace --all-targets runs from distinct empty external Cargo targets; every enabled test passed and the one public-HTTPS acquisition test was ignored;
• warnings-denied all-target Clippy in both external targets;
• the ignored public-HTTPS Git acquisition test explicitly, without an external Git executable;
• cargo check --locked --workspace --no-default-features;
• formatter, repository whitespace, packaging-shell syntax, and JavaScript syntax checks;
• deterministic 461-page documentation generation and catalog-drift rejection;
• two independent optimized package builds with byte-identical archives and recursively identical installed homes;
• version, doctor, help, initialization, locked/offline check and test, every public single-file and package example, deterministic graph, native run/build/direct execution, exact process-example contracts, and framed LSP analysis from a fresh extracted home;
• installed-home immutability and rejection of separately tampered compiler and standard-library copies.

The retained local candidate is:

• archive: dist/nocter-v0.33.0-arm64-darwin.tar.gz;
• size: 8,342,442 bytes;
• archive SHA-256: ca2c41bfdb96f955e24ad2603cbbfd6e4d7a1b425daf95927a79e1e44d5fdef4;
• compiler SHA-256: 6216873a1bd965b7607eb97e64d6dc05c58fcb53ea28c2c199bffdce5c1e757d;
• standard-library tree SHA-256: 6f8f78fa80716239efcf7a9eaf609d89f9bed07baa7fbc2eb43898b86ccf3ace;
• standard-library regular files: 148.

v0.33.0 is ready for separately authorized publication. Publication must reuse this exact archive without rebuilding it.