Release-candidate notes — 84d3c80 (v1 foundation, N40–N48)

Frozen evidence for one tested commit. This file records what was verified at 84d3c801f4b14056297bc6ceadc5f6441873c594 and is not updated as the project moves. Current implementation truth is ../capability-matrix.md; what is not done is ../limitations.md.

Nothing has been tagged, pushed or published. This is a candidate. Making it a release is a person’s decision, and the procedure for it is at the end of this file.

What this candidate is

Nazm at the end of N48: one checked program lowered once to Core IR (N39) and once to MIR (N40), interpreted from Core IR and compiled from MIR by either of two backends — LLVM text through clang (the default) or Cranelift (N41) — with C functions callable through a declared, capability-gated foreign boundary (N42), a runtime whose every symbol and global is inventoried (N43), a stated scheduler contract (N44), a standard library of seven modules (N45), exact path dependencies with a lock file and reproducible executables (N46), restriction profiles (N47), and nazm inspect, DWARF for --debug builds and --timings (N48).

Identities

Supported platform

The gate, and what it found

Contained (Docker, offline, nazm-contained:1.98.1), on 2026-10-01. The gate ran across the seven fix commits it caused, each stage at the commit named; the commits after 74727bb change tests and the mutation catalogue only.

What the gate found, every item fixed before it closed (commit, then what):

• 180b541 — three mutants of macOS-only code (ZERO_AR_DATE, the link name, the .dSYM step) could not be killed on Linux, where their effects do not exist; each decision is now a function a unit test reads on every host.
• 1b8903f — the Cranelift agreement tests ran programs with no deadline, so a deadlocking mutant was a 1,200 s timeout (no verdict); every program they run is now killed and named after 30 s.
• 74727bb — a language-service defect: a standard-library definition, reference or call-hierarchy item was reported at <cwd>/@std/…, a path that does not exist (N45, exposed by N48’s examples/stdlib/words.nz); a standard module is now named like the prelude. Also: three reserved-namespace checks of which the last made the first two unreachable are one rule with a mutant per namespace, and a mutant that had not built since N37 is repaired.
• 41666b1, a8a7b3f — the five-thousand-task test was refused a thread in the container: the 512 MiB address-space ceiling every compiled test program runs under on Linux did not budget glibc’s 64 MiB malloc arena per thread. The scheduler tests run under the container’s 4 GiB; the limitation that tasks alive at once are bounded by the host’s thread limit is documented.
• 984ceef, 84d3c80 — two mutants whose effect killed a whole test binary (no verdict) were given declared killers that observe it from outside, each verified contained.

Results

cargo test --workspace, run through cargo xtask contained on Linux at a8a7b3f (the workspace stage; 84d3c80 differs from it in the mutation catalogue alone): 2021 passed, 0 failed, 29 ignored. Across 136 suites.

Added 2026-10-01, in N49, because crates/nazm-cli/tests/counts.rs requires every frozen report to state its total and a table that sums to it; the numbers are the gate’s, grouped by listing the same commit’s tests (cargo test --workspace -- --list, 2,050 listed, 29 ignored), and nothing else in this file changed.

Mutation catalogue accounting

Every one of the catalogue’s 808 entries has a verdict, and every verdict is caught:

Composed, and how. No single campaign covers all 808, because the gate changed the tree as it went. The latest verdict per mutant is taken: 574 at 1b8903f (decided by their own killers, in files and through tests no later commit touches), 46 at 74727bb (every mutant in the files that commit changed, and every one its changed tests kill), 182 at a8a7b3f (the suite tier, which no earlier commit could run because its suite was not green, and the scheduler’s mutants), and 6 at 84d3c80 (the mutants whose killers were declared or reused, verified in one session: pristine passes, mutant fails, restored passes). Across every resumed session no verdict was ever reclassified except one runner error re-run to caught. The campaign journals are retained with the gate’s logs; nothing was counted from a log line that a journal does not hold.

Performance at this candidate

../performance.md, The v1 baseline — N48: the contained figures at this candidate, which replace the pre-N1 bench/baseline-linux-aarch64.json as the reference. Against N39’s gate run: interpreter and checker within 0.3–6 %; the native -O0 build of the self-hosted compiler +17 % since N40, attributed by an interleaved host A/B to the MIR emitter’s slot-per-local LLVM text (13,836 allocas against 3,275), with no change to any program’s behaviour.

Known limitations

../limitations.md, by area. The ones a user meets first: one OS thread per task, so the tasks alive at once are bounded by the host’s thread limit; channels carry Int only; no package registry or version ranges; the foreign boundary passes scalars only; --debug gives function and statement positions, no variables, and only through the LLVM backend; a live debugger session was not exercised in this environment (static lldb queries were); verified on two aarch64 targets only.

The human release procedure

Every step is a person’s, in this order, from a clean checkout of exactly this commit. Stop at the first step that does not pass.

1. Check out the commit. git checkout 84d3c801f4b14056297bc6ceadc5f6441873c594 and confirm git status --porcelain prints nothing.
2. Build the runner image (network needed here and nowhere after): docker build -f docker/contained.Dockerfile -t nazm-contained:1.98.1 .
3. Run the gates, contained and offline, each of which must exit 0:
   • cargo xtask contained --profile p4w2t4 tests
   • cargo xtask contained --profile p1 run "cd /src && cargo test -p xtask --test lifecycle -- --ignored --test-threads 1"
   • cargo xtask contained selfhost
   • cargo xtask contained bootstrap
   • cargo xtask contained bench (compare against this file’s numbers, not the stale baseline)
   • cargo xtask check and cargo test -p nazm-cli --test docs
   • the mutation campaign: cargo xtask contained --profile p4t4 mutate --strategy targeted --verify-killers, resumed with --resume until it completes; it must report 0 survived and no mutant without a verdict.
4. Assemble the local candidate: cargo xtask contained run 'sh scripts/release-candidate.sh'. It runs every gate again, builds the artefact under target/, writes a manifest of digests and verifies the artefact against it. It tags, pushes and uploads nothing.
5. Re-digest independently on the host: extract the artefact and compare every file’s SHA-256 with the manifest; the counts must match both ways.
6. Decide. Only then, and only by a person: tag (git tag -a v1.0.0-rc.1 84d3c80 -m "…"), push the branch and the tag, and publish the artefact with this file beside it. None of this has been done.