Tested language contracts
This ledger connects the documented grammar and language rules to executable evidence. Each link names the guide that explains the contract and the regression that checks it. Independent examples have handwritten expected results; the platform run records which build modes and source styles actually executed. See language conformance for qualification and limits.
| Contract | Expected behavior | Evidence |
|---|---|---|
| BLOCKS | Braces and indentation preserve statements; ambiguous indentation is rejected. | Independent cases: values, old-prefix. ambiguous indentation, missing bodies and accidental nesting are rejected |
| FUNCTIONS | Bare functions use labels and inferred body contracts; bodyless functions require native declarations. | Independent cases: values, unlabeled-call. calling a bodyless top-level function is a compile error |
| FORWARD | Contextual forwarding aliases inherit resolved imported target contracts; unsupported profiles and cycles fail closed. | Independent cases: forwarding-chain, forwarding-required-label. inferred results/errors and omitted optional inputs retain target identities despite same-spelled local types; unsupported profiles, private targets, local targets, bodies, annotations and cycles fail closed |
| CLASSES | Classes implement interfaces. Fields initialize before initialize and methods. | Independent cases: interfaces. initialize establishes local class state and record validation with checked errors |
| RECORDS | Records contain immutable data and can validate construction with checked errors. | Independent cases: records. record validation infers checked failures; construction stays pure and main handles them |
| INTERFACES | Explicit methods and selected defaults satisfy every inherited contract; conflicting defaults require an implementation. | Independent cases: interfaces, interface-all-requirements, interface-default-requirements. multiple interface inheritance uses both defaults; one implementation must satisfy every independently inherited interface contract; a selected default method must also satisfy the other interface requirements |
| INTERCEPTORS | Layers wrap calls in order, map labeled inputs, and delegate at most once per path. | Independent cases: interceptors. mutually exclusive next calls are allowed, repeated and catch retry paths are rejected |
| GENERICS | Concrete arguments satisfy constraints; only interfaces declare checked variance. | Independent cases: interfaces, generic-mismatch. invariant aliases, conflicting inference, invalid variance and unmet constraints fail early |
| LABELS | Ordinary inputs need labels; same-name shorthand selects the matching parameter. | Independent cases: values, unlabeled-call. positional, duplicate, and injected arguments are rejected |
| IMPORTS | Imports are explicit, private names cannot cross files, and folder boundaries require exports. | Independent cases: private-import, unexported-folder, internal-composition, internal-import, internal-result. every crossed folder boundary must export its child; a repository package exposes its service and composition without its internal repository; an outward signature cannot expose a folder-internal type |
| PACKAGES | Repository imports resolve exact source identities and integrity-checked native artifacts. | a changed native selection cannot bypass the verified source manifest |
| DI | Bindings resolve in dependency order, and scoped values cache and cannot escape. | Independent cases: dependency-scopes, capabilities. scoped DI caches within a scope, restores nested scopes, and rejects escape |
| EFFECTS | Inferred effects remain bounded by public interfaces and resolved generic capability identities; constructors stay pure and locks exclude I/O. | Independent cases: capabilities, generic-capability-identity. explicit uses is an upper bound; constructors and lock regions retain their checks; generic capability bounds distinguish same-spelled arguments from separate modules |
| ASSIGNMENT | Equals and to assign values with the same checked types and ownership rules. | Independent cases: values. to works for typed generics, owned declarations, and member mutation |
| FLOW | Conditions are bool, logical words short circuit, and loops and returns retain checked flow. | Independent cases: values, symbolic-logic. logical operators skip the unneeded operand |
| BINDING-PATTERNS | Named immutable-record fields and nested tuple positions create fresh read-only bindings; tuple arity, private access and borrowed lifetimes remain checked. | Independent cases: binding-nested-data, binding-tuple-arity, binding-readonly. named record and nested tuple patterns bind checked fields; patterns reject wrong shapes, duplicate fields/names, existing names and private reads; patterns preserve read-only access and borrowed aliases; pattern aliases can read borrowed inputs without gaining mutation permission |
| MATCH | Optional values contain a value or null; checked patterns narrow values and require coverage. | Independent cases: records, collections. empty inputs infer from sibling labels and invalid records/matches/numbers are rejected |
| ERRORS | Thrown values implement Error and callers catch or propagate all effective failures. | Independent cases: checked-cleanup, unhandled-error, non-error. explicit contracts remain assertions; unhandled inferred errors are checked in main |
| OWNERSHIP | Owned moves invalidate the source and release exactly once; borrows exclude aliases. | Independent cases: checked-cleanup, move-use, alias-read, readonly-write, owned-consumed-once. OWN-1: moving an owned value invalidates its old name and drops it once |
| CLEANUP | Scope exits join children before cleanup; always runs on returns, errors and cancellation. | Independent cases: checked-cleanup. try locals drop before always on normal, return and failure exits |
| TASKS | Task captures, scope joins, deferred errors and ordered waits preserve resource lifetimes. | Independent cases: workers, start-without-scope, task-owned-result-rejected. TASK-18: waiting for a dynamic collection element does not release sibling captures |
| WORKERS | Workers run on OS threads with private heaps and copied data; native handles stay local. | Independent cases: workers, worker-shared. worker errors cancel and join siblings and release local resources; copied records, nested maps, sets and errors survive collection in either heap; native worker permission is an explicit boolean promise and defaults to false; worker help, semantic color and completion distinguish the contextual keyword from user names |
| COLLECTIONS | List, tuple, set and map literals infer types; iteration snapshots preserve insertion order. | Independent cases: collections, mixed-list. hash maps and sets resize, preserve values, and compare tuple keys by value |
| NUMBERS | Integer arithmetic wraps at 64 bits, division is checked and C narrowing rejects overflow. | Independent cases: values. recoverable list and arithmetic errors, optional lookup, and exact wrapping integers |
| TEXT | Text is valid UTF-8 without NUL; bytes retain lengths and text conversion is checked. | Independent cases: text, nul-text. FFI widths, narrowing errors and native benchmark reports are explicit |
| TESTS | Same-file groups rebuild setup for each case and check typed rows independently. | Independent cases: same-file-tests. same-file function suites use explicit imported fixtures and independent parameter rows |
| HTTP | Endpoint wire types, statuses and policy options are checked before native dispatch. | Independent cases: http-wire-cases. same-file endpoint cases exercise routing, binding, errors, and streaming with fresh DI |
| HTML | Components escape text and attributes and check deferred HTTP actions. | Independent cases: html-escaping. server components embed checked HTML and escape interpolated text and attributes |
| NATIVE | Native declarations require descriptor-checked ownership, unsafe calls and supported platforms. | opaque resources have checked acquisition, labeled loans, errors and ownership |
| SPECS | Specifications are deterministic and describe checked public contracts and linked dependencies. | spec generation is byte deterministic across project locations and validates all offline links |
| OWN-2 | A local owned value is dropped once when its scope throws. | Independent cases: owned-error-cleanup. OWN-2: a local owned value is dropped once when its scope throws |
| SHARED-1 | An owned Shared wrapper drops its transferred payload once. | Independent cases: shared-payload-cleanup. SHARED-1: an owned Shared wrapper drops its transferred payload once |
| BORROW-1 | A mutable loan excludes alias reads until its block exits. | Independent cases: borrow-alias-release, alias-read. BORROW-1: a mutable loan excludes alias reads until its block exits |
| TASK-1 | A task read loan pins an alias until wait releases it. | Independent cases: task-loan-released. TASK-1: a task read loan pins an alias until wait releases it |
| TASK-2 | Starting a child inside a borrow suspends the parent mutation right. | Independent cases: task-active-borrow-mutation. TASK-2: starting a child inside a borrow suspends the parent mutation right |
| TASK-3 | A task reading self blocks a direct field write until wait. | Independent cases: task-self-update. TASK-3: a task reading self blocks a direct field write until wait |
| TASK-4 | Every branch must wait before the parent regains mutation rights. | Independent cases: task-branch-incomplete, task-branches-joined. TASK-4: every branch must wait before the parent regains mutation rights |
| TASK-5 | An inner scope join releases its capture before an outer mutation. | Independent cases: task-nested-join. TASK-5: an inner scope join releases its capture before an outer mutation |
| TASK-6 | Collection pressure cannot reclaim a resource captured by a child. | Independent cases: task-capture-pressure. TASK-6: collection pressure cannot reclaim a resource captured by a child |
| TASK-7 | Waiting for the last loop child does not release earlier captures. | Independent cases: task-loop-latest-loan. TASK-7: waiting for the last loop child does not release earlier captures |
| TASK-8 | An owned Shared wrapper cannot move while a child borrows it. | Independent cases: task-shared-active-move. TASK-8: an owned Shared wrapper cannot move while a child borrows it |
| TASK-9 | Moving an owned Shared wrapper into its child transfers cleanup. | Independent cases: task-owned-transfer, task-cancel-before-entry. TASK-9: moving an owned Shared wrapper into its child transfers cleanup |
| TASK-10 | A child capture pins mutable nested fields through aliases. | Independent cases: task-nested-alias-mutation. TASK-10: a child capture pins mutable nested fields through aliases |
| TASK-11 | Shared construction cannot transfer a child-borrowed wrapper. | Independent cases: task-shared-active-wrap. TASK-11: Shared construction cannot transfer a child-borrowed wrapper |
| TASK-12 | Owned rebinding cannot transfer a child-borrowed wrapper. | Independent cases: task-shared-active-rebind. TASK-12: owned rebinding cannot transfer a child-borrowed wrapper |
| TASK-13 | An owned return cannot outrun a child borrowing its value. | Independent cases: task-shared-active-return. TASK-13: an owned return cannot outrun a child borrowing its value |
| TASK-14 | Freeze waits for a child with mutable access. | Independent cases: task-freeze-active, task-freeze-after-wait. TASK-14: freeze waits for a child with mutable access |
| TASK-15 | Waiting for one loop iteration does not release earlier children. | Independent cases: task-loop-retains-borrow. TASK-15: waiting for one loop iteration does not release earlier children |
| TASK-16 | A scope inside each loop iteration joins its own child. | Independent cases: task-loop-scopes-join. TASK-16: a scope inside each loop iteration joins its own child |
| TASK-17 | Throwing an owned error cannot outrun a child borrowing it. | Independent cases: task-owned-active-throw. TASK-17: throwing an owned error cannot outrun a child borrowing it |
| TASK-19 | Waiting for a task that references another task does not join both. | Independent cases: task-reference-is-not-join. TASK-19: waiting for a task that references another task does not join both |
| ERROR-1 | Starting defers a checked error until wait or implicit join. | Independent cases: task-error-at-wait, task-error-at-join. ERROR-1: starting defers a checked error until wait or implicit join |
| ERROR-2 | A parent error stays primary while cancelled child cleanup fails. | Independent cases: task-parent-error-priority. ERROR-2: a parent error stays primary while cancelled child cleanup fails |
| ERROR-3 | A public Task<T> parameter exposes Error at a helper wait. | Independent cases: task-public-error-contract. ERROR-3: a public Task<T> parameter exposes Error at a helper wait |
| CLEANUP-1 | Always executes before a returned result is observed. | Independent cases: cleanup-before-result. CLEANUP-1: always executes before a returned result is observed |
| CLEANUP-2 | Returning from a scope joins its child before the caller resumes. | Independent cases: scope-joins-before-return. CLEANUP-2: returning from a scope joins its child before the caller resumes |
| SYNTAX-1 | Braces and indentation preserve ownership and join behavior. | Independent cases: owned-consumed-once, task-owned-transfer, scope-joins-before-return. SYNTAX-1: braces and indentation preserve ownership and join behavior |
| CANCEL-1 | An unhandled child error cancels siblings and runs always cleanup. | Independent cases: task-cancel-sibling-cleanup, task-cancel-before-entry. CANCEL-1: an unhandled child error cancels siblings and runs always cleanup |
| CANCEL-2 | An inner scope failure cancels outer siblings and joins cleanup. | Independent cases: task-cancel-outer-cleanup. CANCEL-2: an inner scope failure cancels outer siblings and joins cleanup |
| FUNCTIONS-1 | Records, destructuring, snapshot iteration and checked matching run natively. | Independent cases: records, collections, closed-choices. records, destructuring, snapshot iteration and checked matching run natively |
| FUNCTIONS-2 | Stateful DI is fresh by default, scopes cache locally, and compositions are imported explicitly. | Independent cases: dependency-scopes, internal-composition. stateful DI is fresh by default, scopes cache locally, and compositions are imported explicitly |
| FUNCTIONS-3 | Formatting preserves comments and uses the configured canonical syntax. | formatting preserves comments and uses the configured canonical syntax |
| FUNCTIONS-4 | Ownership rejects alias overlap, escaping loans, and moves on loop re-entry. | Independent cases: alias-read, task-loop-retains-borrow, move-use. ownership rejects alias overlap, escaping loans, and moves on loop re-entry |
| FUNCTIONS-5 | Colon blocks accept tabs, spaces, nesting, braced children and multiline collections. | colon blocks accept tabs, spaces, nesting, braced children and multiline collections |
| FUNCTIONS-6 | Indented declarations, constructor bodies, interceptors and same-file tests compile. | Independent cases: interceptor-injected-constructor, same-file-tests. indented declarations, constructor bodies, interceptors and same-file tests compile |
| FUNCTIONS-7 | Generic constraints permit interface methods and explicit checked variance permits producers. | Independent cases: interfaces. generic constraints permit interface methods and explicit checked variance permits producers |
| FUNCTIONS-8 | Non-null branches, short-circuit conditions and early return guards narrow local values. | Independent cases: optional-guards. non-null branches, short-circuit conditions and early return guards narrow local values |
| FUNCTIONS-9 | Explicit capabilities and header DI forward dependencies through class and function calls. | Independent cases: capabilities. explicit capabilities and header DI forward dependencies through class and function calls |
| FUNCTIONS-10 | Declared mutation and private storage use public constructor labels and caller borrow. | Independent cases: inferred-contracts. declared mutation and private storage use public constructor labels and caller borrow |
| FUNCTIONS-11 | Pure bodies, read-only aliases, ambient I/O and hidden service lookups are rejected. | pure bodies, read-only aliases, ambient I/O and hidden service lookups are rejected |
| FUNCTIONS-12 | Injected return references retain scope origins and transitive shared captures fail. | injected return references retain scope origins and transitive shared captures fail |
| FUNCTIONS-13 | Cleanup annotations cannot add recoverable errors. | cleanup annotations cannot add recoverable errors |
| FUNCTIONS-14 | Test setup includes explicitly imported compositions with private adapters. | test setup includes explicitly imported compositions with private adapters |
| FUNCTIONS-15 | Public bodies infer forward generic results, capabilities and escaping errors; specs and hints agree. | Independent cases: inferred-contracts. public bodies infer forward generic results, capabilities and escaping errors; specs and hints agree |
| FUNCTIONS-16 | Mutation inference follows aliases and calls while managed access and pure interfaces stay checked. | Independent cases: inferred-contracts, readonly-write. mutation inference follows aliases and calls while managed access and pure interfaces stay checked |
| FUNCTIONS-17 | Recursive results need an anchor and inferred results still require all paths to return. | Independent cases: inference-recursive-unanchored, inference-partial-return. recursive results need an anchor and inferred results still require all paths to return |
| FUNCTIONS-18 | Cached editor revisions infer afresh without mutating parsed source or old views. | cached editor revisions infer afresh without mutating parsed source or old views |
| FUNCTIONS-19 | Inferred endpoint results generate a typed OpenAPI response. | inferred endpoint results generate a typed OpenAPI response |
| FUNCTIONS-20 | Concise contracts compile to native C, preserve mutation, checked errors and generic values. | Independent cases: inferred-contracts. concise contracts compile to native C, preserve mutation, checked errors and generic values |
| FUNCTIONS-21 | A forwarding interceptor infers the target result independently for each application. | Independent cases: interceptor-generic-dispatch. a forwarding interceptor infers the target result independently for each application |
| FUNCTIONS-22 | Javadoc checks inferred results and errors, and generic method contracts supply result context. | Javadoc checks inferred results and errors, and generic method contracts supply result context |
| FUNCTIONS-23 | HTTP policies infer only their mapped capability operations; explicit limits still apply. | HTTP policies infer only their mapped capability operations; explicit limits still apply |
| FUNCTIONS-24 | Inherited default bodies and nested interceptor errors participate in the inference fixed point. | Independent cases: interceptor-generic-dispatch, interceptor-short-circuit. inherited default bodies and nested interceptor errors participate in the inference fixed point |
| FUNCTIONS-25 | Empty result literals need an anchor; other returns can supply their item type. | Independent cases: inferred-empty-list, inferred-unanchored-empty. empty result literals need an anchor; other returns can supply their item type |
| FUNCTIONS-26 | Pure local synchronized storage needs no artificial effect clause. | Independent cases: inferred-empty-list. pure local synchronized storage needs no artificial effect clause |
| FUNCTIONS-27 | Long inferred capability contracts collapse inline and remain complete in tooltips. | long inferred capability contracts collapse inline and remain complete in tooltips |
| INTERCEPTORS-1 | Constructor interceptor failure releases the completed object and its owned fields before catch. | Independent cases: interceptor-constructor-cleanup. constructor interceptor failure releases the completed object and its owned fields before catch |
| INTERCEPTORS-2 | Interceptor layers enter in order, map subsets, override inputs, and unwind results. | Independent cases: interceptor-order-and-mapping, interceptor-repeated-next. interceptor layers enter in order, map subsets, override inputs, and unwind results |
| INTERCEPTORS-3 | Next without overrides preserves original arguments even after parameter reassignment. | Independent cases: interceptor-original-inputs. next without overrides preserves original arguments even after parameter reassignment |
| INTERCEPTORS-4 | Generic interceptors wrap constructors, methods, void calls, and default interface dispatch. | Independent cases: interceptor-generic-dispatch. generic interceptors wrap constructors, methods, void calls, and default interface dispatch |
| INTERCEPTORS-5 | Constructor interceptor dependencies participate in eager DI ordering. | Independent cases: interceptor-injected-constructor. constructor interceptor dependencies participate in eager DI ordering |
| INTERCEPTORS-6 | A fresh interceptor instance is created for each invocation. | Independent cases: interceptor-fresh-instance. a fresh interceptor instance is created for each invocation |
| INTERCEPTORS-7 | A processor can short circuit without calling its target. | Independent cases: interceptor-short-circuit. a processor can short circuit without calling its target |
| INTERCEPTORS-8 | Interceptor errors are checked on functions and constructor calls. | Independent cases: interceptor-checked-failures, interceptor-unhandled-failure. interceptor errors are checked on functions and constructor calls |
| INTERCEPTORS-9 | Next errors can be handled by an interceptor. | Independent cases: interceptor-short-circuit. next errors can be handled by an interceptor |
| INTERCEPTORS-10 | Incompatible labels, mappings, results, and next overrides fail before C compilation. | Independent cases: interceptor-invalid-mapping. incompatible labels, mappings, results, and next overrides fail before C compilation |
| INTERCEPTORS-11 | Owned inputs are forwarded once or dropped on short circuit. | Independent cases: interceptor-owned-inputs. owned inputs are forwarded once or dropped on short circuit |
| INTERCEPTORS-12 | Using a moved interceptor input after next is a compile error. | Independent cases: interceptor-moved-input. using a moved interceptor input after next is a compile error |
| INTERCEPTORS-13 | Interceptor errors must respect implemented interface contracts. | Independent cases: interceptor-interface-error. interceptor errors must respect implemented interface contracts |
| INTERCEPTORS-14 | Interceptors import and export normally, and private interceptors stay file scoped. | Independent cases: interceptor-export, interceptor-private-import. interceptors import and export normally, and private interceptors stay file scoped |
| INTERCEPTORS-15 | Annotated native functions retain the unsafe requirement and wrap the native call. | Independent cases: interceptor-native, interceptor-native-unsafe. annotated native functions retain the unsafe requirement and wrap the native call |
| INTERCEPTORS-16 | Generic inferred and explicit interceptor inputs work with nested collection types. | Independent cases: interceptor-generic-inputs. generic inferred and explicit interceptor inputs work with nested collection types |
| INTERCEPTORS-17 | Owned return contracts survive an interceptor chain. | Independent cases: interceptor-owned-return. owned return contracts survive an interceptor chain |
| INTERCEPTORS-18 | Interceptor constructor DI cycles are rejected. | Independent cases: interceptor-di-cycle. interceptor constructor DI cycles are rejected |
| INTERCEPTORS-19 | Generic interceptor inputs infer interface arguments from concrete classes. | Independent cases: interceptor-generic-inputs. generic interceptor inputs infer interface arguments from concrete classes |
| INTERCEPTORS-20 | Transparent constructor interception preserves a fresh result for ownership. | Independent cases: interceptor-owned-return. transparent constructor interception preserves a fresh result for ownership |
| INTERCEPTORS-21 | Constructor interception returning an existing input cannot claim fresh ownership. | Independent cases: interceptor-owned-alias. constructor interception returning an existing input cannot claim fresh ownership |
| INTERCEPTORS-22 | Nonvoid around bodies must return or throw on every path. | Independent cases: interceptor-partial-return. nonvoid around bodies must return or throw on every path |
| INTERCEPTORS-23 | Constructor and interceptor roots survive repeated garbage collection. | Independent cases: interceptor-root-pressure. constructor and interceptor roots survive repeated garbage collection |
| INTERCEPTORS-24 | Around resolve parameters use DI and are omitted from argument mappings. | Independent cases: interceptor-injected-constructor. around resolve parameters use DI and are omitted from argument mappings |
| INTERCEPTORS-25 | Private interceptor declarations cannot be imported or exported. | Independent cases: interceptor-private-import. private interceptor declarations cannot be imported or exported |
| INTERCEPTORS-26 | Two next labels cannot override one target argument. | Independent cases: interceptor-overlapping-next-labels. two next labels cannot override one target argument |
| SHORT_ERRORS | Short error declarations retain resolved Error identity and checked caller obligations. | Independent cases: interceptor-short-circuit, record-copy-validation. short error declarations remain checked errors with named data |
| INDEXING | List indexing is checked; Map indexing is optional; Tuple positions are constant. | Independent cases: indexing-and-remainder. indexing preserves checked list reads, optional map lookup, and constant tuple reads |
| NULL_FALLBACK | Otherwise evaluates only for null and preserves falsy values. | Independent cases: defaults-and-fallback. otherwise evaluates only for null and preserves false, zero and empty text |
| LITERAL_DEFAULTS | Omitted literal defaults are typed and freshly evaluated; explicit null is a value. | Independent cases: defaults-and-fallback. literal parameter defaults are typed, labeled, and freshly constructed per call |
| INTERPOLATION | Scalar interpolation evaluates in source order and preserves Unicode text rules. | Independent cases: interpolation-order. interpolation and record updates evaluate each input once in source order |
| REMAINDER | Integer remainder checks zero and defines the signed-minimum edge. | Independent cases: indexing-and-remainder. integer remainder has signed operands, checked zero, and defined minimum overflow |
| TEXT_HELPERS | Text helpers keep Unicode units explicit and parse bounded numbers strictly. | Independent cases: strict-text-helpers. text helpers preserve Unicode and use checked strict parsing |
| IMMUTABLE_COLLECTIONS | Immutable collection contracts prohibit mutable aliases and preserve deep data access. | Independent cases: immutable-alias. immutable collection contracts make deep record data explicit without accepting mutable aliases |
| RECORD_COPY | Record copies preserve type and rerun checked construction validation. | Independent cases: record-copy-validation. record updates retain identity and unchanged data and rerun checked validation |
| LOOP_CONTROL | Nearest-loop exits run cleanup, join scopes and preserve move/error flow on reentry. | Independent cases: loop-break-continue. loop exits join child tasks, release borrows and locks, and propagate cleanup failures; unreachable waits cannot erase a checked task failure on a loop exit |
| COMPREHENSIONS | List comprehensions evaluate their input once, select and project read-only snapshot items in order, and preserve checked failures, loans and ownership. | Independent cases: comprehension-order. comprehensions select and project in snapshot order without changing their inputs; comprehension input runs once, predicates precede selected projections and iteration is a snapshot; selected references retain read-only access and native ownership cannot enter a comprehension; comprehensions reject repeated continuation calls, repeated owned transfers and unhandled failures |
| FUNCTION_VALUES | Pure function references and expression closures match every inherited single-method contract, retain immutable creation-time captures, labels, checked context and isolated-worker boundaries. Incompatible interface overrides reject. | Independent cases: callback-snapshot, callback-mutable-erasure, interface-override-layout. standalone function values reuse checked callback interfaces and match labels independently of order; closures reject mutable, owned and borrowed reference captures without moving outer values; function values preserve resolved nominal identities and reject larger/default interfaces; callbacks created in a worker use its heap and cannot transfer between heaps; closure body dependencies are retained as deferred calls in both context APIs |
| CHOICES | Unreleased closed choices retain exact immutable record identities and require exhaustive matches, including null for optional values. | Independent cases: closed-choices, incomplete-choice. invalid alternatives and incomplete choices fail with checked source diagnostics; contextual choice names retain typed bindings and ordinary function help; nearby types complete |
| ERROR_CONTEXT | Unreleased explicit context retains concrete error causes and source identities without automatic logging or broad failure conversion. | Independent cases: error-context, mixed-context-causes, phantom-error-catch. context conversion is a chosen checked error rather than implicit Error widening; context rejects non-errors, missing locations and incorrect concrete catches; generic catch rejects erased, optional, container and behavioral witnesses |
| GRAPHEME_TEXT | Unreleased explicit text units and Unicode 18.0.0 default extended grapheme boundaries preserve original bytes and check UTF-8. | Independent cases: grapheme-boundaries. grapheme calls require checked failure handling and the returned list grants reading; generated properties match every official assignment and default across all Unicode code points |
| DOMAIN_VALUES | Unreleased ordinary domain records validate constructors, parsers, copies and JSON decoding; formatting is stable and preserves documented units. | Independent cases: domain-values. public domain values retain nominal types, checked errors and useful editor help |
| OWN-1 | Moving an owned value invalidates its old name and transfers exactly one cleanup obligation. | Independent cases: owned-consumed-once, move-use. OWN-1: moving an owned value invalidates its old name and drops it once |
| TASK-18 | Waiting for a selected collection element retains sibling loans; a collection wait joins every selected task. | Independent cases: task-selected-wait-retains-loans, task-collection-wait-releases-loans. TASK-18: waiting for a dynamic collection element does not release sibling captures |
| TASK-20 | Scheduling an owned input transfers cleanup immediately; cancellation before entry releases it without running the body. | Independent cases: task-cancel-before-entry. cancellation before task entry releases transferred owned inputs |
The ledger does not count a reference as a passed test. CI must execute the linked regression suites and the independent corpus on the required platform. Omitted or unavailable GPU hardware remains an explicit boundary.