v0.8.3 — verification track, SHM-ring interop, fast JSON

The largest release since v0.8.0 (cumulative since v0.8.2). Four headline arcs, no source-level breaking changes.

🔍 Compile-time verification track (GitHub #18)

Six candidate analyses, addressed — canonical catalog in spec/verification.md.

• Bus-graph checks (item 4) — default-on: blocking-call detection, orphan topics, bus cycles + re-entrant sync-deadlock, backpressure, subject type-mismatch.
• Race-completeness (item 2) — a GenMC model-checking CI gate over the lockfree hashmap, pinned-locus mailbox, and cooperative-pool bus queue under all C11 interleavings.
• Memory-bound proofs (item 1) — opt-in hale check --warn-unbounded-alloc. Per-method allocation summary + call-graph escape/loop dataflow, an empirically-validated reclamation model (which corrected the spec), a bound solver, call-result escape tagging, and loop-ranking that proves while v < N const counters bounded. Off-default deliberately, pending an @unbounded escape valve.
• Resource-budget tracking (item 5) — opt-in: counts (threads / pools / subjects / fds), a CI ceiling gate (--check-resource-budget budget.toml), and fd-leak detection (--warn-resource-leak).
• Closure-assertion lifting (item 3) — scoped & deliberately parked (the tractable case is already handled by typecheck).

🔗 Binary shared-memory-ring interop

Read/write externally-defined SHM rings by declaring their layout — no hand-written FFI.

• std::bytes binary packing — bounds-checked LE/BE readers + BytesBuilder writers.
• ring_layout declaration + shm_ring(..., layout: N) binding; read-only consumer, producer, and conformance checks.
• Raw BytesView payload mode for heterogeneous rings; Go-style struct field tags + repr-tagged field accessors; a zero-copy reserve/commit write surface.

⚡ JSON performance

Generated codecs from json: tags (Tier 2) → SIMD/AVX2 cursors (Tier 3) → inlined leaf primitives. A representative parse went ~291 ms → ~58 ms — within range of V8.

🧰 Standard library & runtime

• std::term (is_tty, size, RawMode) + raw byte I/O (std::io::stdout::write_bytes, std::io::stdin::read_byte) — terminal hygiene with no vendored FFI.
• Tree-walking interpreter retired — hale run compiles + execs via codegen.
• BytesBuilder.append_str; ECDSA P-256 fallible(CryptoError); stale-view panic via exit() (atexit-safe).

Plus the earlier v0.8.3 language-surface work (CQRS no-locus-return, resets_per_epoch windowed closures, nested-long-running-child rejection) and a codegen reorg.

Full details: see CHANGELOG.md.

What's Changed

• Refactor/codegen model org by @rileyr in #22
• Per-child reclamation for accept'd children (close the daemon leak) by @rileyr in #23
• fix(runtime): poke async pool wake_fd on cross-pool enqueue (on_out starvation) by @rileyr in #24
• fix(desugar): keep cross-pool publishes on the bus (intra-locus opt pool-safety) by @rileyr in #25
• feat(typecheck): gate terminate (locus-only) and release (needs accept) by @rileyr in #26
• feat(reclaim): unify per-child teardown spine + cascade + handler-terminate by @rileyr in #27
• fix(runtime): clean shutdown of classic-pool blocking-accept servers (refstore SIGSEGV) by @rileyr in #28
• feat: self.children.count / .is_empty summary sugar (F.11) by @rileyr in #29
• docs(runtime): resolve Item B (coop→pinned mailbox) — sequencing, not a lost wakeup by @rileyr in #30
• docs: restructure the book + refresh the pond library catalog by @rileyr in #31
• harden: compiled-corpus ASAN oracle + the three leaks it found by @rileyr in #32
• fix(codegen): resolve enum names to Enum, not TypeRef by @rileyr in #33
• perf+ci: cache compiled runtime objects; free runner disk; bound hung tests by @rileyr in #34
• typecheck: reject a dead bus receiver (non-main cooperative subscriber) by @rileyr in #35
• stdlib: std::text::base64::url_encode (RFC 4648 §5, unpadded) by @rileyr in #36
• stdlib: std::crypto ECDSA P-256 (ES256) sign + verify by @rileyr in #37
• typecheck: warn on a blocking syscall in a cooperative-pool run() by @rileyr in #38
• docs+diag: close fathom bus-receipt handoff asks #3-6 by @rileyr in #39
• typecheck: correct the dead-receiver check — require a blocking run() by @rileyr in #40
• hale run compiles + execs (no interpreter) — retire slice 1 by @rileyr in #41
• Delete the hale-runtime interpreter crate — retire slice 2 by @rileyr in #42
• crypto: ecdsa_p256_sign gains a fallible(CryptoError) form by @rileyr in #43
• Interprocedural blocking-call detection (warning path) by @rileyr in #44
• Bus-graph orphan-topic check (GH #18 #4, PR A) by @rileyr in #45
• Bus cycle warning + re-entrant sync-deadlock error (GH #18 #4, PR B) by @rileyr in #46
• spec: add verification.md — canonical static-check catalog by @rileyr in #47
• Bus backpressure check (GH #18 #4) by @rileyr in #48
• Bus subject type-mismatch check (GH #18 #4 — completes item 4) by @rileyr in #49
• Race-completeness PoC: GenMC model of the lockfree hashmap (GH #18 #2) by @rileyr in #50
• Mailbox GenMC model (GH #18 #2, second primitive) by @rileyr in #51
• CI: GenMC race-completeness gate (GH #18 #2) by @rileyr in #52
• Bus queue GenMC model (GH #18 #2, third primitive) by @rileyr in #53
• notes: binary SHM-ring interop design proposal (ring_layout + std::bytes pack) by @rileyr in #54
• stdlib: std::bytes binary-pack readers (shm-ring-interop Proposal A, M1) by @rileyr in #55
• stdlib: BytesBuilder binary-pack writers (shm-ring-interop Proposal A, M2) by @rileyr in #56
• ring_layout declaration (shm-ring-interop Proposal B, PR1) by @rileyr in #57
• shm_ring layout: binding kwarg (shm-ring-interop Proposal B, PR2) by @rileyr in #58
• codegen+runtime: foreign-ring read-only consumer (Proposal B, PR3) by @rileyr in #59
• types: ring_layout↔payload conformance checks (Proposal B) by @rileyr in #60
• codegen+runtime: foreign-ring producer (Proposal B, M3a) by @rileyr in #61
• shm-ring-interop: genericize the foreign-ring naming by @rileyr in #62
• codegen: fix runtime-object temp-path race in parallel builds by @rileyr in #64
• experiments: foreign-ring throughput microbench (Proposal B) by @rileyr in #63
• runtime: incremental wrapped-offset in the foreign-ring hot loops by @rileyr in #65
• spec: catalog the ring_layout conformance checks in verification.md by @rileyr in #66
• shm-ring-interop: close three OOB holes at the foreign-producer boundary by @rileyr in #67
• ci: run the foreign-ring UBSan suite in the asan job (no extra build) by @rileyr in #68
• ci: build-and-run per partition (drop the serial build+archive job) by @rileyr in #69
• tests: fix bytes_pack_read parallel-build-path flake (#67 follow-up) by @rileyr in #70
• docs: highlight Hale code blocks (register hale with highlight.js) by @rileyr in #71
• codegen+runtime: raw BytesView payload mode for ring_layout consumer by @rileyr in #72
• readme: syntax-highlighted SVG for the hero Hale snippet by @rileyr in #73
• syntax: single source for the keyword list; generate the highlighters by @rileyr in #74
• ring_layout: slots framing — read the native LotusRing via the abstraction by @rileyr in #75
• cli+syntax: name the right file + line in multi-file diagnostics by @rileyr in #76
• codegen: BytesView producer path for foreign ring_layout by @rileyr in #77
• runtime: reserve/commit split for zero-copy ring writes (A1, stage 1) by @rileyr in #78
• codegen+syntax: zero-copy ring write surface (A1, stage 2+3) by @rileyr in #79
• syntax: Go-style struct field tags (parse + store) by @rileyr in #80
• codegen+syntax: repr-tagged field accessors (Proposal A′) by @rileyr in #81
• types: typecheck guard for repr-tagged field accessors (A′ follow-up) by @rileyr in #82
• mangle: import-mangle the Topic.write construct's topic ref (A1 follow-up) by @rileyr in #83
• stdlib/json: single-pass object member cursor (JSON Tier 2 substrate) by @rileyr in #84
• codegen+syntax: generated Type::from_json from json: tags (JSON Tier 2) by @rileyr in #85
• json_gen: nested-struct fields in Type::from_json (JSON Tier 2, PR-C) by @rileyr in #86
• notes: locus-only collections decision; JSON arrays a non-goal by @rileyr in #87
• json_gen: generated Type::to_json (JSON Tier 2 emit) by @rileyr in #88
• notes: scope JSON Tier 3 (SIMD parsing) by @rileyr in #89
• json: SIMD-accelerate the object cursor (Tier 3 Level A) by @rileyr in #90
• json: SIMD-accelerate the array cursor (Tier 3 Level A, part 2) by @rileyr in #91
• json: AVX2 path for the SIMD scan primitives (Tier 3 Level A) by @rileyr in #92
• json_gen: inline the generated parser (no cursor structs) by @rileyr in #93
• json_gen: skip unescape copy for escape-free string fields by @rileyr in #94
• notes: scope closing the V8 JSON gap (inline leaf primitives) by @rileyr in #95
• codegen: inline byte_at_unchecked as gep + load by @rileyr in #96
• codegen: inline range_eq vs a string literal (no call) by @rileyr in #97
• notes: record JSON inline-primitive outcome (landed ~58ms) by @rileyr in #98
• notes: scope GH #18 item 1 — memory-bound proofs by @rileyr in #99
• types: allocation-summary scaffold (GH #18 item 1, step 1) by @rileyr in #100
• types: reclamation model + RSS validation (GH #18 item 1, step 2) by @rileyr in #101
• spec: correct free-fn value-allocation reclaim to match shipped behavior by @rileyr in #102
• types: bound solver — call-graph propagation + warnings (GH #18 item 1, step 3) by @rileyr in #103
• codegen: don't mangle locus method names (pond P1) by @rileyr in #104
• stdlib: BytesBuilder.append_str + StringView @ffi clarification (pond P3) by @rileyr in #105
• runtime: view-stale panic via exit() so atexit cleanup runs (pond P2) by @rileyr in #106
• notes: scope std::term + raw byte I/O primitives (pond P4) by @rileyr in #107
• stdlib: std::term::is_tty + std::io::stdout::write_bytes (pond P4 stage 1) by @rileyr in #108
• stdlib: std::term::RawMode guard locus + atexit backstop (pond P4 stage 3) by @rileyr in #109
• stdlib: std::term::size + std::io::stdin::read_byte (pond P4 stages 2+4) by @rileyr in #110
• types: resource-budget count slice (GH #18 item 5) by @rileyr in #111
• types: result-escape tagging on call edges + fd-leak detection (GH #18 #1/#5) by @rileyr in #112
• cli: --check-resource-budget ceiling gate (GH #18 item 5) by @rileyr in #113
• notes: scope GH #18 item 3 (closure lifting) — easy case already handled by @rileyr in #114
• types: held-fd counts in the resource budget (GH #18 item 5) by @rileyr in #115
• types: count held-fd locus instantiations (GH #18 item 5 tail) by @rileyr in #116
• types: loop-ranking — prove while i < N counters bounded (GH #18 item 1) by @rileyr in #117
• notes: record default-on (--warn-unbounded-alloc) as deliberately held by @rileyr in #118
• docs: v0.8.3 changelog + spec/docs sweep for the release by @rileyr in #119

Full Changelog: v0.8.2...v0.8.3