Nocter v0.65.0 Release Notes#

Nocter v0.65.0 adds the shared-state, coordination, lifecycle, HTTP application-data, session, and observability foundations needed to build a practical stateful service. One complete HTTP service now exercises those contracts together from concurrent request handling through graceful shutdown and final state recovery. The release changes no Nocter source-language syntax.

Cooperative Shared State and Bounded Coordination#

std/sync adds Mutex<T>, const-generic bounded channels, and explicit cancellation source/token pairs. The APIs are designed for Nocter's cooperative single-threaded executor: waits yield through descriptor readiness, immediate operations do not allocate, and no contract implies atomic access from foreign threads.

A channel fixes its positive capacity in the type, preserves FIFO order, returns unsent values when the receiving side is closed, and reports final sender closure. MutexGuard<T> is the sole mutable capability for one protected value. Cancelling or destroying an owner cannot leave a mutex locked, a queued value unowned, or a waiter stranded.

use std/sync.{Channel, Receive, Send}

async func transfer(): void! {
    let channel = Channel<i32, 8>.bounded()?
    let endpoints = channel.split()
    let sender = move endpoints.0
    let receiver = move endpoints.1

    match await sender.send(42) {
        Send.sent {}
        Send.closed(_) { return error.new("example.closed", "receiver closed") }
    }
    match await receiver.receive() {
        Receive.value(_) { return }
        Receive.closed { return error.new("example.closed", "sender closed") }
    }
}

Shared allocation and notification descriptors remain package-internal authorities. The compiler does not recognize synchronization type names, and std/sync does not inspect scheduler queues or target syscalls.

Structured Service Lifetime#

std/service.ServiceScope owns admitted child computations, one shared cancellation domain, and their eventual outcomes. Stopping a scope closes admission and requests cancellation; shutdown observes every retained child before reporting the first failure. Destruction also requests cancellation, so abandoned service work cannot detach silently.

service.termination_requested() exposes the first process-wide SIGINT or SIGTERM request as a target-independent value. The Darwin implementation preserves host dispositions and feeds the existing executor readiness model rather than adding a polling loop or a second scheduler.

Bounded HTTP Application Data and Stateful Routing#

std/http adds bounded, strict representations for form values, media types, and cookies. Application limits constrain item count, individual decoded values, and aggregate decoded bytes. Ordered duplicates remain visible, malformed percent encoding and UTF-8 are rejected, and query and form plus-sign rules remain distinct.

Router<State> owns exactly the state supplied at construction and lends &State to the selected handler. It does not clone state, discover globals, spawn work, or hide synchronization. Route precedence and ambiguity checks remain one deterministic authority, while applications decide whether their state contains immutable values or explicit synchronization.

Sessions and Structured Operational Events#

std/session.SessionId is an opaque 256-bit identity issued from operating-system cryptographic randomness. Its canonical transport spelling is strict URL-safe unpadded Base64. HTTP owns the separate SessionCookie policy, which validates cookie names and paths, rejects ambiguous request fields and duplicate session names, and emits HttpOnly, SameSite=Lax response cookies.

std/log builds timestamped typed events with explicit destinations. Duplicate field names are rejected. Redacted fields never retain the supplied secret because redaction occurs at field construction, before an event or JSON value exists. Compact JSON projection is deterministic and does not read hidden process-global context.

Complete Stateful HTTP Service#

The public http-service example combines bounded concurrent dispatch, explicit router state, mutex-protected events, session issue and transport, large streaming bodies, recoverable handler failure, deterministic JSON output, connection draining, and final state recovery. Its native qualification checks the complete service boundary rather than isolated API calls alone.

Compatibility and Non-goals#

v0.65.0 adds standard-library modules and APIs without removing a source-language form. It does not add a multithreaded executor, atomic shared state, unbounded queues, distributed session storage, HTTP/2, a database client, a general web framework, or compiler-recognized synchronization types.

Release Qualification#

Release-content commit 8744a1ecf8ea13a9369b61a366c6c343afddd355 passed the complete disposable compiler gate, deterministic 360-page documentation generation, two independent byte-identical package builds, installed-home workflows, fresh and replacement nocter install, every public example, interactive LSP checks, immutability checks, and compiler and standard-library tamper rejection. The retained arm64-darwin archive is 9,466,133 bytes with SHA-256 24fa1607f6faf1ea2e0efee21885dde20d7a4e5648fb86d4a7f8d67e2dce65de. Publication must reuse this exact archive without rebuilding it.