func main(): i32 { let value = load_value() catch failure { fallback_for(failure.message()) } if value == 42 { return 0 } return 1 } func load_value(): i32! { return error.new("example.unavailable", "the primary value is unavailable") } func fallback_for(message: &str): i32 { return 42 }

use std/fmt.Format use std/io struct Point { x: i32 y: i32 } instance Point { impl Format method &self.try_format_into(output: &+String): void! { output.try_push_str("(")? self.x.try_format_into(output)? output.try_push_str(", ")? self.y.try_format_into(output)? output.try_push_str(")")? return } } func main(): i32! { let point = Point { x: 3, y: 4 } let message = "point = ${point}\n" io.print(&message)? return 0 }

use std/io use std/vec.Vec struct Point { x: i32 y: i32 } instance Point { operator (&self == other: &Self): bool { return self.x == other.x && self.y == other.y } } func main(): i32! { let first = Point { x: 3, y: 4 } let same = Point { x: 3, y: 4 } let other = Point { x: 5, y: 6 } if first != same || first == other { return 1 } let points = Vec [move first, move other] if points[0] != same { return 1 } var values = Vec [1, 2, 3] values[1] = 4 if values[0] + values[1] + values[2] != 8 { return 1 } io.print("equality found the point\n")? return 0 }

struct Buffer { values: [i32; 3] } instance Buffer { operator (&self[index: usize]): &i32 { return &self.values[index] } operator (&+self[index: usize]): &+i32 { return &+self.values[index] } } func at<C>(container: &C, index: usize): i32 where (&C[usize]): &i32 { return container[index] } func main(): i32 { var buffer = Buffer { values: [3, 4, 5] } buffer[1] = 9 if at(&buffer, 1) != 9 { return 1 } return 0 }

v0.35.0 Phase 4 Case-conversion and Owned-mutation Review

Result: complete with no open Phase 4 finding (2026-09-05). Full Unicode 17.0.0 default case conversion and boundary-safe owned String suffix mutation are implemented as ordinary standard source. The implementation adds no Unicode-aware compiler or runtime primitive.

Closed Product

Borrowed str exposes ordinary and recoverable lower- and uppercase conversion. All four methods delegate to two recoverable cores, so allocator selection changes storage policy without creating a second casing algorithm. Each core iterates valid UTF-8 with the existing scalar iterator and asks std/internal/unicode for full mappings. The only contextual rule, Final_Sigma, uses generated Cased and Case_Ignorable properties; it does not inspect table representation or operating-system locale data.

Owned String exposes allocation-free pop and truncate. pop discovers the preceding scalar boundary with the public borrowed-text boundary contract, decodes through the canonical internal UTF-8 decoder, and changes length only after validating the decoded suffix. truncate validates an in-range boundary before changing length. Both operations preserve capacity and therefore preserve the String's allocator affinity.

Only the four casing lookup operations gained package visibility in this phase, when str became their first sibling-module consumer. Generated arrays and lookup representation remain private to the internal Unicode module.

Findings Closed During Implementation

The first recoverable-casing fixture expected a medial sigma at the end of İΣ. The generated properties correctly make the preceding dotted capital I cased, so Unicode Final_Sigma requires final sigma. The fixture was corrected before completion; implementation and generated oracle did not change.
The standard dependency audit rejected the new str -> internal/unicode, str -> mem, and String helper edges until they were explicitly reviewed. The exact allowlist now records those real source dependencies rather than relying on transitive module availability.
Failure tests initially covered successful recoverable allocation only. Native tests now inject an invalid recoverable allocator and verify that both expanding lower- and uppercase operations return the allocator error rather than publish a partial String.

Evidence

native text tests execute full dotted-I and sharp-S expansion, medial and final sigma, combining case-ignorable context, reverse multi-byte pop, successful and rejected truncate, and capacity preservation;
allocator-failure native tests execute both recoverable casing directions with a deliberately invalid allocator and observe the stable allocation error;
MIR cleanup tests prove that propagation destroys initialized local output storage, including partial owned values, without running cleanup on terminating allocation-abort edges;
standard source checking validates declarations, bodies, public visibility, transitive noalloc, and the exact new module dependencies;
the Unicode generator's exhaustive oracle remains the authority for all scalar mappings and contextual property membership;
the complete workspace, warnings-denied Clippy, no-default-features, Rustdoc, generated-data, documentation, and repository-integrity gates pass at the reviewed commit.

Boundary Result

The generator owns Unicode-file interpretation, the internal Unicode module owns mapping lookup, str owns contextual traversal and output construction, and String owns its logical byte length. Each layer calls only the preceding public or package-internal contract. There is one mapping authority, one UTF-8 decoding authority, one conversion core per direction, and no mutation before a fallible suffix boundary has been accepted.