Lima 0.4.0 — the 2026-09 review campaign

All three implementations ship 0.4.0 from this tag:

npm	@limaformat/lima@0.4.0
crates.io	lima = "0.4.0"
Go	go get github.com/limaformat/lima/go@v0.4.0

Package versions are independent of the Lima specification version; the
Lima Core 1.0 and References 2.0 specs stay Final, gaining only
non-normative clarifications (§5, §5.2, §6.1.3, error-api).

What's in it

0.4.0 is the result of the first independent whole-repo review of Lima, a
second review of the consolidated result, a delta review of the final fix
batch, and four intermediate re-review rounds.

• Nine rounds of Core 1.0 errata (1.0.1–1.0.9) — block scalars,
  escape-aware key and quoted-string lexing, comment-line lookahead, the
  §5.1 unquoted-key grammar enforced in every context, sibling-key column
  alignment, int/float corpus assertions, raw line terminators and
  U+2028/U+2029 in quoted keys, \# handling in and out of quotes, and the
  comment-boundary whitespace set — all fixing behaviour the specs already
  required.
• Cross-implementation References 2.0 error positions — every token
  now reports its physical (line, column) in the original source,
  counted in Unicode code points, byte-identical across TypeScript,
  Rust, and Go (including inside flow [...] / {...} and across
  \# collapses). Ordering follows the earliest participating token.
• Corpus — 149 → 211 Core and 119 → 136 References 2.0 cases.
  The frozen 1.0.0 baseline (149 Core cases) is byte-identical and
  cryptographically anchored. CI now runs all three implementations.

Accepted cost: parseCore in Rust and Go carries a ~10–20 % regression
from the §5.1 per-key validation and the physical-position token scan.
Realistic frontmatter still parses several times faster than the
corresponding YAML library.

Full changelogs

• js/CHANGELOG.md
• rust/CHANGELOG.md
• go/CHANGELOG.md
• docs/review-2026-09-followups.md — the full review record

The rust/v0.4.0 and go/v0.4.0 tags point at the same commit and exist
for the crates.io and Go module tooling; this is the single release for
all three.