What changed on the way to 1.0.

Unreleased

Changed

• Diagnostic, explanation and generated-page text no longer names milestones, design-log entries or another release: V8005 reads "Sakura Lang does not support packages yet", V9002's root-handler message says which effects get root handlers, and D096 no longer names SAKURA_MAX_HEAP, which the WASM host does not read. Codes, kinds and JSON fields are unchanged; occurrence ids, which hash the message, change with it.

0.1.0 - Unreleased

The first non-alpha preview and the close of milestone M4, the WebAssembly backend (exit commit dee11301). Sakura Lang is still pre-1.0: read STABILITY.md before depending on anything below. The Rust MSRV is unchanged (1.99).

What is stable and what is not

• No stability promise yet. There is no stable language, std, CLI, --json or ABI contract in 0.1.0. RFC 0001 (Draft) proposes the guarantees, and the draft inventory in STABILITY.md names what each covers; if the owner accepts it, its promises begin at v0.2.0. Every --json record is versioned (kind, schema_version), and compiler/contracts/json.txt lists its fields.
• WASM backend: done. --target wasm builds, runs, tests (with --contracts) and verifies programs as --target js does; CI's parity suite compares the two backends' output, traces and defect records on Linux x64 and ARM64, macOS ARM64 and Intel, and Windows x64. sakura test --record still needs --target js. Modules carry runtime ABI 1.4.0.
• --target native: experimental. It exists only in a compiler built from source with the Cargo native feature; the release binaries and packages do not include it. It is outside every compatibility promise and stays experimental at v0.2.0. Natively, Http, serve and Llm still stop with a D090 or D091 defect.
• Packages: not supported. [dependencies] in sakura.toml is reserved and refused with V8005 dependencies_not_supported; nothing is fetched. Packages are planned for a 1.x minor release.
• Platforms. A packaging target is called supported for this release only after its published-install smoke passes on every applicable channel; the install page states each platform's level.
• Performance. These notes quote no benchmark ratios: benchmark numbers stay advisory until a quiet-window run on the exit commit is blessed.

Semantics changes for owner review (rows 8–10 of the M4 exit checklist):

• Serve.host() on --target wasm answers a request the heap cannot take 503 with a D096 record, a request still waiting when the program ends 500, and a trap 500 before the server stops and the program exits 70; on both backends a request arriving after the server stops is 503 (Fixed below; design §17.223).
• A response body cut short in Http.host()'s send is Err(HttpError) on both backends instead of a defect or a crash (Changed below, Breaking; design §17.209 (2)).
• Symbolic links in an fs.write grant: a write through a dangling link is refused, and the JS and WASM hosts open the resolved path with O_NOFOLLOW, so a link planted during the call is refused within the limits ABI §8.3 states (Security below; design §17.233). The dangling-link hole shipped in v0.1.0-alpha.1.

Entries marked Breaking can change what a program that worked on v0.1.0-alpha.1 does.

Added

• The npm packages carry a README, keywords and an issues link, so the npm page shows how to install and start. Each platform package's README points to sakuralang.

• Experimental sakura build --target native and sakura run --target native in a compiler built with the native feature (plan M5 N2): Cranelift compiles the program to an executable main linked with the native runtime, whose defect records carry the same spans as JS and WASM. Native stays experimental at v0.2.0; release builds do not include it. Native executables carry unwind tables and a DWARF line table, so lldb, gdb and profilers show Sakura frames at their .sak lines, and a sakura.native record that the runtime checks before running (V8003 for another target, layout profile or ABI). sakura build --target native --native-checks builds a checked executable that stops at any generated heap access outside its object.

• sakura run --target native (a compiler built with the native feature) runs Json.encode, Json.decode, Json.parse, Json.schema, Cli.args and Cli.parse (plan row N1b). The JSON codec is written once in the Rust runtime and matches the JS runtime's text and decode messages, where clauses included. Programs that use Http, serve or Llm still stop with a D090 or D091 defect natively.

• Sql.memory() and Sql.sqlite(path) run natively on bundled SQLite, each database on its own worker thread, with rows, decode errors and SQLite's messages matching the JS runtime. Cancelling a running statement (a lost Task.race, a timeout) interrupts it, and a write that committed before stays committed.

• The WASM runtime's stats() reports four more counters, recorded by SAKURA_WASM_STATS, SAKURA_NATIVE_STATS and bench/harness (runtime ABI 1.3.0, design §17.176 (1), plan row N0b): reuse_attempts and reuses (an owned List, Map or Set update testing whether it may write its wrapper and each node on its path in place, and the tests that could), borrow_candidates (executed reference-count increments before a call that only reads the value, which stays live after it) and borrows (always 0 until borrowing lands). Benchmark records add reuse_rate (null when nothing was attempted) and the module's abi_version.

• sakura build --target wasm --dump owned prints the ownership facts as the LIR computes them from the committed Core snapshot (design §17.176 (2)); they match the JS backend's dump.

• The WASM module's stats() export reports an eleventh counter, restarts: the calls of a direct function run again through frames after its native twin ran out of stack gauge (runtime ABI 1.2.0, design §17.160 (2)). ABI 1.2.0 also lists the host imports and handle kinds as built; a 1.1 host refuses a 1.2 module (V8003), so the bundled host and the module move together.

• A tree-sitter grammar in editors/tree-sitter-sakura/ (not published) with highlight, locals, indent and injection queries and Rust and Node bindings. CI parses every .sak file in the repository with it and checks that, wherever the compiler's parser reports no syntax error, its tokens, items, statements and match arms have the compiler's spans, with LF and CRLF line endings. It is for editors and tooling; the compiler's parser stays the parser of record.

• bench/bench run --suite wasm times the benchmark suite built with --target wasm on Node and Wasmtime against hand JS on Node, after the same oracle, recording each row's backend and the module's stats() counters; its numbers stay advisory until a quiet-window bless (design §17.191 (2), §17.153). The nightly benchmark workflow runs it as its own job.

• V4004 match_too_large (pattern phase): a match, catch or let pattern whose decision tree passes 1,048,576 nodes, counting the rows its or-patterns expand into and the matches in its guards, is an error from sakura build, run and test instead of a build that runs away in memory and time (design §17.193). The arm count itself is not limited.

• sakura new and sakura init write .gitattributes with *.sak text eol=lf, so Windows checkouts of sources stay LF, and *.snap -text, so git never converts a snapshot's line endings and a value with \r\n compares byte for byte (design §17.180 (4b), §17.196 (1)). A snapshot that differs only in line endings names *.snap -text and sakura test --update-snapshots.

• sakura verify --json writes schema_version: "1.1" on every record, and its summary counts reused: the obligations whose record was rebuilt from an authenticated cache entry instead of being solved; the human summary prints (n reused). Consumers check the major version and ignore unknown fields. An unknown whose reason is resource_limit is now cached and reused by sakura verify (the rlimit is in the key), so a second run does not spend the full budget on it again; it never removes a check. Proof cache entries move to format 2, so each obligation is solved once more after upgrading (design §17.164 (1), (2)).

• sakura verify --target wasm replays a disproved obligation on the LIR evaluator, whose Int is WASM's i64, and marks a counterexample that defects as predicted confirmed, as the JS profile already did on the Core evaluator (plan V4b, design §17.164 (4)).

• sakura build --target wasm --manifest writes target/sakura/manifest.json instead of refusing. The manifest is schema 1.1 and gains target (js or wasm); a WASM manifest lists sakura_rt.wasm, sakura_wasm_host.js and sakura_runtime.js as its runtime, and every clause stays runtime_checked because WASM builds drop no checks yet (design §17.163 (3)).

• Release candidate checks enforce deprecation notice periods, major-only removals and unchanged Rust MSRV in patch releases; the deprecation registry starts empty.

• Draft grammar and diagnostic specification in docs/spec/, indexed by fixtures, with a generated diagnostic identity table and a Python drift check; lexical boundary, grammar-alternative and tree-sitter divergence fixtures back its rules, and V8003 has an emission test.

• Draft RFC 0001 proposes stability guarantees and identifies enforcement gaps for owner acceptance at v0.2.0; current compatibility policy is unchanged.

• Intel macOS archives, npm and Homebrew packaging with public Intel-hosted suites, parity and release smoke; both Darwin architectures enter the existing signing job. Release-specific support still requires published-channel acceptance.

• Linux ARM64 glibc release archives and the sakuralang-linux-arm64-gnu npm package, built and smoke-tested on public GitHub-hosted ARM runners. CI runs the Rust suites with pinned Z3/cvc5 and both JS/WASM parity lanes on Linux ARM64. The Homebrew formula directs Linux ARM64 users to the release installer or npm.

• Windows x64 MSVC ZIP and npm packaging, a checksum-verifying PowerShell installer, hosted Windows suites/parity, and native sakura.exe selection in VS Code. Release-specific supported status still requires the published smoke.

• Published-channel acceptance workflow with exact version/commit checks, a deliberate installer target override, and a platform-report issue form for community confirmations.

• Per-OS website install instructions with release-specific platform claims, Node 26 setup for Raspberry Pi users; Windows x64 and Intel macOS are published for 0.1.0, supported once their published-install check is green.

Changed

• Every --json record carries kind and schema_version (design §17.232 (b)): sakura doc --json gains "kind": "symbol_query" and "schema_version": "1.0", and target/sakura/manifest.json gains "kind": "manifest" (still schema 1.1). sakura verify --json on a program that does not compile now writes its diagnostics and summary at schema 1.1, like every other verify record, instead of 1.0. The fields of every kind are listed in compiler/contracts/json.txt, which a test checks every command's output against.

• Breaking: sakura.toml refuses [dependencies] with V8005 dependencies_not_supported (RFC 0001, design §17.232). Packages arrive in a later minor release and the key is reserved: an empty table, entries, an inline dependencies = {} or a dotted key is an error at the key from check, build, run, test and the LSP before anything runs, and nothing is fetched. Remove the table.

• Breaking: a sakura.toml that is not a valid manifest is V8006 manifest_invalid (design §17.239): an unknown table or key, a value of the wrong type, a missing [package] name or malformed TOML is reported by check, build, run, test, verify and the LSP at the place in sakura.toml, with the parser's message, --json records and exit 1. It replaces the human-only sakura.toml: … usage error (exit 2) that only run, test --record and verify printed. Beside [dependencies] both V8005 and V8006 are reported.

• Breaking: a connection that drops while Http.host()'s send reads the response body fails with HttpError (status: None, the reason from the host), as a failed connection already did, on both backends: the JS backend reported the defect D091, and --target wasm ended the process with an unhandled promise rejection, also when a task was cancelled while its send read a body (design §17.209 (2)). A program that retries on HttpError now retries a cut body too; nothing else changes. This is a semantics change: owner review requested (§17.209 (2)).

• Breaking: a program means the same whatever its checkout's line endings (design §2, §17.180 (4b)): a \r\n inside a string literal is \n, and a line comment ends before the \r, so a CRLF file no longer prints a longer string. sakura fmt writes LF (a bare \r in a string of a CRLF file becomes the \r escape), and sakura fmt --check names CRLF line endings as the reason a file is listed. sakura test reports a snapshot that differs only in \r\n against \n as a line-ending mismatch.

• WASM modules record runtime ABI 0x010400 (1.4.0: 1.3.0's counters and 1.4.0's native profile text, design §17.229 (1)). A 1.2 host refuses them with V8003, as the ABI's MINOR rule says, since a module now writes counters an older host does not read; the 1.4 host still runs 1.1 and 1.2 modules.

• Release flags follow the version string (design §17.249): a plain X.Y.Z such as 0.1.0 is a GitHub release marked latest and publishes to npm latest; only -alpha.N or -rc.N is a GitHub prerelease under the alpha or rc dist-tag. The release notes call every 0.x version a pre-1.0 preview with no stability promise yet (RFC 0001, STABILITY.md).

• The documented npm install is the plain npm install --global sakuralang: the packages ship no lifecycle scripts, and release.py now refuses to pack one that declares preinstall, install, postinstall or prepare.

• The JS and WASM hosts answer an OS error by its class, as the native host does (design §17.229 (5)): a permission error is Err("permission denied"), not Node's EACCES: permission denied, open '…'; likewise already exists, is a directory and not a directory. On Node a sleep longer than 2^31 − 1 ms (about 24.8 days) now waits its full duration instead of firing after 1 ms.

• An Int interpolated into sql"…" is bound as an SQLite INTEGER on the JS and WASM hosts, as natively. It was bound as REAL, so sql"select {7} / 2" gave 3.5 (and an Int row failed to decode) where SQLite's integer division gives 3, and typeof(?) said real.

• Json.decode, Cli.parse and Sql.query into a tuple type the program never builds (say (Int, Float, Bool)) work on --target wasm; they stopped with D090 a malformed value crossed the host boundary.

• sakura check, build, run, test, the LSP and the MCP server read std's analysis from a cache on disk instead of analysing std in every process (design §17.195 (3), §17.214 (5)). The cache holds one file per compiler build in <cache>/sakuralang/std, <cache> being $SAKURA_CACHE_DIR, else $XDG_CACHE_HOME or ~/.cache on Unix and %LOCALAPPDATA% on Windows; SAKURA_NO_CACHE=1 turns it off. Output is unchanged with and without it; a damaged or missing file is recomputed and rewritten. The files carry no compatibility promise (STABILITY.md).

• A process that analyses several programs (the LSP and MCP servers, test suites) analyses the std library once and reuses it for every program after the first; a single sakura check is unchanged. Snapshot files now list std first, so FileIds in --dump core and the Core snapshot's files change order, and the snapshot hash changes (design §17.195).

• An analysis that reuses std carries std's symbols, interface hashes and evaluated names and its lowered items instead of walking its 45 trees again (design §17.204 (2)).

• V1002 on Type.member suggests the one exported function that is a prefix of the typed name or extends it (List.lenght → len, List.fil → filter) when no near spelling exists, as a suggested fix, never machine_applicable; sakura explain V1002 names std's len convention (design §17.182 (2)).

• V1002 on Type.member no longer falls back to the one function within two edits when the usual did-you-mean finds none: List.size gets no List.slice fix, and List.lenth → List.len comes from the prefix rule as suggested, not machine_applicable (design §17.187, withdrawing §17.165 (2)'s fallback, which shipped in v0.1.0-alpha.1).

• V2002 names a Type.member callee as written: List.map` (std/list) takes 2 arguments, this call passes 1 rather than the bare map (design §17.182 (3)).

• --target wasm runs a perform bound to a handler literal in the same function (design §17.113 (a)) as a direct call of its clause, and gives such functions and their clauses direct twins, so a loop performing a local handler's operation allocates no continuation frames: handled_d1, _d4 and _d16 run 4 frames per run(1000) where they ran 1,005 (design §17.211 (1)). Output, traces and defects are unchanged.

• --target wasm calls a closure inside a direct function through the closure's own direct twin when it has one, so List.map, fold, filter and the other std functions taking a callback run their loop without continuation frames: contracts_plain, pipeline, shapes, map_set and nbody run 4 frames at their smallest size where they ran 1,121, 2,508, 5,010, 2,005 and 7,005 (design §17.211 (2)). A callback that performs still runs through frames. Output, traces and defects are unchanged.

• On --target wasm, a fused xs[i].expect(…) or map[k].expect(…) (design §17.151) reads the element in place instead of building and dropping an Option; output and defects are unchanged.

• sakura test --contracts --target wasm runs the synthesized contract properties on WASM instead of refusing, with the counterexamples, shrinks, stored regressions and exit code JS reports for the same seed (design §17.163 (4)). sakura test --record --target wasm is refused with `--record` needs `--target js` before the permission check.

• sakura build --target wasm drops the checks of obligations sakura verify --target wasm proved on the i64 profile, as the JS build does for the js profile, and its manifest says proved for those clauses (design §17.163 (4), M4-OPT). The JS modules a WASM build writes for decoding keep every check.

• sakura build deletes a proved check's predicate along with the check: an ensures or where built from comparisons, arithmetic, projections and constructors is no longer evaluated once sakura verify proved it. A predicate that calls a function is still evaluated, so a defect inside that function is still reported (design §17.98, §17.118).

• == and != on an enumeration whose constructors have no fields (type Dir = North | South), or against a field-less constructor (shape == Empty, o == None), compare constructor tags instead of walking the values, on JS and WASM; results, traces and defects are unchanged and --dump core shows the comparison as tag_eq (design §17.183, WS-P11a).

• Exhaustiveness checking costs each match arm the earlier arms with the same head constructor, not every earlier arm (design §17.200 (8)), so a long match of guarded rows alternating with literal rows no longer checks in quadratic time. Diagnostics are unchanged.

• The exhaustiveness index recurses into every column a match specialises (design §17.200 (8)), so thousands of arms under one constructor (Some(1), Some(2), …), over a tuple of literals or over nested constructors no longer cost each arm every earlier arm. Diagnostics are unchanged.

• A loop body with more than eight CPS steps keeps the shared-continuation form instead of the resumable for (;;) loop, which copies the rest of an iteration once per step; sakura build --dump direct lists each such loop as resumable or shared(too-many-steps(<n>)) (design §17.181 (1)).

• The Sakura skill keeps its examples, syntax list, and edit loop in a smaller entry point, with repair and completion detail in its references. Its 7,500-byte ASCII limit now measures release metadata after template fill, with a 7,000-byte source working target (design §17.188).

• The agent-DX offline fixture validator runs independent tasks in a thread pool, with --jobs 1 for serial execution and byte-identical task-ordered reports (design §17.197).

• The agent-eval runner caps the episodes of one approved run with --max-episodes (default 48) instead of 48 across all runs, leaving the dollar ledger as the only cap across runs; agent-eval.yml gains seed and max_episodes inputs (design §17.182 (4)).

Removed

• The unused [targets] manifest table. It was parsed and never read; it is now an unknown key and so V8006.

• The native host's SAKURA_BLOCKING_THREADS: nothing used its blocking pool (design §17.229 (4)), and Sql runs on per-database workers instead.

Fixed

• Serve.host() on --target wasm answers a request the guest heap cannot take with 503 and retry-after: 1, writing the defect D096 to stderr, where it was a 500 with nothing on stderr; the server keeps serving. A request still waiting when the program ends is now answered 500 (it got no answer), with one D090 "server stopped" record unless a defect ended the program. On both backends, once the server stops, a request still arriving on an open connection is 503 with the connection closed and its handler never runs (design §17.223, ABI 1.2.3).

• A runtime trap while Serve.host() serves on --target wasm no longer ends the process with an unhandled exception: the request is answered 500, the server stops (later requests are 503), and the program exits 70 with one D090 record that names the function and the PC (design §17.223 (2), ABI 1.2.3). sakura test reports the test as a defect and runs the rest on a fresh instance, as for any trap.

• Serve.host() on --target wasm no longer ends the process when a request is larger than SAKURA_MAX_COPY_BYTES: the request is answered 413 with the connection closed and the handler not run, as a body over 1 MiB already is, and a handler's response over the budget is 500; each writes the defect D091 to stderr, and the server keeps serving (design §17.216 (4)). The JS backend copies nothing into a guest and is unchanged.

• On --target wasm, running main again on one instance (the benchmark harness's Node cells do, once per sample) no longer keeps 4 objects per run: the Node host releases each finished root task through the new module export task_free, and the clauses of a host handler (Console.host(), Clock.host() and the other *.host() handlers) are freed with it instead of being static (design §17.212, ABI 1.2.2).

• A WASM function with more than about 16,000 &&-guarded match rows no longer aborts Node after printing its output (design §17.236, plan row 31). Past 256 jumps back to a function's dispatch loop, each 256 jumps branch through a stub, so the loop header has at most ⌈jumps/256⌉ + 1 predecessors; V8's optimizing tier failed past 65,535. 16,384 and 32,768 rows run on Node and Wasmtime; functions of at most 256 jumps are byte-identical.

• Type arguments on the first alternative of a variant list (type T = Some<Int> | Nada) are V0001, as on a later alternative. They were accepted, and sakura fmt printed the declaration as Some | Nada. A lone Name<Args> is still an alias.

• The WASM test runner (sakura test --target wasm) reports a module of another ABI as error[V8003] and exits 2, as runMain does, instead of throwing.

• A syntax error now hides only the diagnostics that point into the body holding it (design §17.207 (1)). Before, every diagnostic raised while that body was checked was dropped, so sakura check could miss an error in another module, such as a bad signature (V2002) first used from the broken body, that an analysis after an edit then reported. Diagnostics inside the broken body, and a V3001 about its calls, stay suppressed as before.

• After an edit, a literal into a refined type is checked again when the edited function is reached from the refinement only through a requires or ensures clause, in the LSP and MCP servers and any other process that analyses more than once (design §17.87). Before, the literal kept its old verdict, so a V5004 could be missing. Only the names a refinement's evaluation can call now make a function's body interface, so editing a function that merely shares its name with a parameter or local of such a call chain rechecks its own module only.

• After an edit, an unchanged module's test block no longer reports a V5004 (a literal that breaks a refinement) twice, or a typed hole twice, in the LSP and MCP servers and any other process that analyses more than once: a reused module's tests, types and effects are no longer checked again (plan WS-C1a). Type diagnostics within a file are listed by position in Analysis results, so a reusing analysis lists them as a fresh one does; the human and JSON output already sorted them.

• A long flat match no longer overflows the compiler's stack (design §17.193): a 3,000-arm literal match crashed a debug sakura run, because its decision tree is an if chain as deep as its arms. Every recursive walk over an IR (the match compiler, Core passes, the LIR lowering, the snapshot converter, the evaluator) grows its stack on the heap when it runs low, so no number of arms, lets or constructors bounds a pass. The JS output and --dump core stop indenting past 32 levels, so deep code is linear in size (the 3,000-arm program's JS falls from 406 MB to 5.4 MB), and sakura check indexes a type of thousands of variants in linear time. Such a program still exceeds node's limits when it runs: its JS nests a labeled block per arm, and its WASM a block per LIR block.

• A 3,000-arm literal match now runs on node with both backends (design §17.200): a match on Int or String literals is one switch over its literals instead of a chain of tests (--dump core shows it) whose cases hold the arms that one row reaches, wildcard rows are compiled once below the literals before them, an else no longer nests, a join past 64 nested labeled blocks is an arrow function, and the rows after a failed guard continue in a join, so the emitted JS nests as deep as the source plus a constant. On WASM a function past 256 blocks dispatches through two levels of br_table and its blocks share locals, and an Int switch of more than eight arms is a jump by index arithmetic when its keys are dense or a binary search: the module no longer traps at compile, and V8 no longer runs out of memory optimizing a function of thousands of blocks. The snapshot writer grows its stack like its reader.

• A long run of guarded match rows now runs on node with both backends (design §17.220): the rows after a failed guard follow in its else rather than in a join, so the JS is a flat sequence of ifs and WASM has one block fewer per guard. 3,000 guarded rows in a loop overflowed node's parser and about 10,000 outside one exhausted its stack; deep_ir.rs now runs 3,000 in a direct-style and a performing loop and 20,000 outside one. Past 256 nested blocks the rest of the run starts a new chunk, and the chunks are joined as a balanced tree, so Core stays within the snapshot's depth bound and JS nests only log₂ of the chunks.

• Core is a function of the source: type and row parameters are numbered per definition, so sakura build --dump core, the Core snapshot and the emitted JS of a program no longer depend on what an earlier analysis in the same process (an LSP or MCP server, a test run) had checked. sakura verify solves the obligations of generic definitions once more, since their cache keys hash the renumbered Core (design §17.194).

• Tail calls around a cycle of up to four monomorphic functions without contract checks (is_even/is_odd, a state machine) run as one loop on both backends instead of through continuation frames, so they need constant stack: each function of the cycle carries a copy of the others (design §17.160 (5), WS-P9). Output, effect order, defect messages and blame sites are unchanged. A generic member, or one that checks a contract, is not copied (a contracted function still runs the others in its own loop); non-tail calls stay calls.

• A call in tail position under an else if, or under an if nested in an if branch, is a tail call: self-recursive and mutually recursive functions written that way run as loops too, where they ran through frames before. A terminating program's output, effects and defects are unchanged.

• A tail-call cycle whose functions cannot be nested inside each other, such as three functions that each call both others, also runs as one loop per function: the loop dispatches on a state number, with one switch (§17.208 (1)), to its copies of the other functions (design §17.192 (2), WS-P9b). WS-P9's limits still apply (four functions, 1,024 copied expressions), and output, effects, defect messages and blame sites are unchanged.

• Terminal output names a source outside the working directory by its OS path (C:\other\main.sak, /other/a b.sak) instead of the URI's path (/C:/other/main.sak, /other/a%20b.sak) (design §17.196 (3)).

• file:// URIs are RFC 8089 on every OS (design §17.180 (4a)): on Windows a source is file:///C:/dir/src/main.sak instead of file://C:%5Cdir%5Csrc%5Cmain.sak, so its module name, the sakura.toml lookup, terminal paths relative to the working directory and the MCP paths filter work there. Unix URIs are unchanged. The MCP paths filter accepts a client's spelling of a file: URI (file:///c%3A/…).

• sakura run exits 70 with the raw code on stderr when the program's exit code is outside 0..=255 (a Windows NTSTATUS such as Ctrl-C's), instead of truncating it to a byte. On Windows, node is found through PATHEXT (a node.cmd shim works), solvers are found as z3.exe and cvc5.exe, and test permission grants carry no \\?\ prefix (design §17.180 (4c)). Windows is not yet a supported platform.

• agent_docs normalizes Windows path separators so the skill mirror, manifest, hashes, and ZIP are byte-identical to Unix output (design §17.180 (5)).

• The agent skill entry point is at most 7,500 bytes of ASCII, pinned by a sakura_cli test, so it fits below the eval harness tool-output limit with its metadata filled in. Its four examples stay; the provenance details moved to references/repairs.md and the audit and verify notes to the cookbook (design §17.182 (1)).

Security

• On the JS backend and --target wasm, a symbolic link that another process plants at a write's path between the grant check and the open is refused with "escapes the directory" and its target is never created. Before, the host checked the path and then opened it in a separate call, which followed the new link. Fs.write, Fs.read, a File opened to read, write or append, and sakura test --record's cassette now open the resolved path with O_NOFOLLOW and do their I/O through the descriptor (design §17.233). A link inside the directory that exists before the call still works. Known limit, stated in ABI §8.3: a parent directory swapped for a link in that window, Sql.sqlite's database file, the directory Fs.list reads (entry names only) and Windows are not covered on the JS hosts. The native host has no window.

• A write through a dangling symbolic link inside a directory the manifest's fs.write grants is refused with "escapes the directory" on the JS backend and --target wasm, as the native host already refuses it. Before, Fs.write, a File opened to write or append, sakura test --record's cassette and Sql.sqlite followed the link and created its target wherever it pointed, outside the grant (shipped in v0.1.0-alpha.1; N1a review). A dangling link pointing back inside the directory is refused too. To migrate, write to the link's target path instead of the link.

• Breaking: SAKURA_MAX_COPY_BYTES must be decimal digits with a value from 1 to 2^53 - 1: any other value (empty, 0, a sign, a fraction, an exponent such as 1e3, hex, spaces such as " 42", words) is the defect D091 naming the variable and the value, at first use: Http.host()'s send on the JS backend, and on --target wasm, where the budget covers every host answer, the first answer or Serve.host() starting. A non-numeric value turned the limit off, an empty one refused every response body, and forms like 1e3 were accepted (design §17.209 (1)). To migrate, set the variable to a plain byte count or unset it for the 256 MiB default.

• Http.host()'s send on the JS backend reads at most SAKURA_MAX_COPY_BYTES (default 256 MiB) of a response body, as --target wasm already did: a larger body, or a declared content-length over the limit, aborts the fetch and fails with HttpError "response too large", where the whole body was read with no limit (design §17.205 (3)). To migrate, raise SAKURA_MAX_COPY_BYTES or read a large response with Http.stream.

• sakura test --record stores at most 16 MiB (16,777,216 bytes) of a response body, sent or streamed: past that, Http.send or Http.stream under Http.recording fails with HttpError "response body over 16 MiB: sakura test --record stores at most 16,777,216 bytes of a response body" and the cassette is not appended to. A larger streamed body was held whole, one list element per byte, until the test runner's heap ran out (security review C2, design §17.205 (2)); a sent body was appended whole (design §17.209 (4), which also changed the message's last words from "of a streamed body"). To migrate, record a smaller response, or read a large one outside Http.recording.

• New macOS tag releases require Developer ID signing with team P62B65A837 and Apple notarization before checksums, Homebrew archives and npm packages are assembled. Ordinary dry runs skip signing. A separate protected sign_test dispatch exercises fresh signed binaries without publishing; bare Mach-O executables cannot carry a stapled notarization ticket.

Performance

• Ownership facts follow a collection through records, tuple results, borrowing parameters and closures, and through recursive calls (design §17.201 (3), WS-P13b): a def that threads a record of lists, such as DeltaBlue's Planner, updates them in place when its caller's record is owned, on the direct and the CPS ABI. --dump owned gains the reasons param, field and tuple, and prints each consuming def's owned-entry verdict beside the plain one. Outputs are unchanged.

• The DeltaBlue benchmark stores dense variable and constraint ids in List instead of Map, following design §17.217 and WS-P13c. The std index and Sakura skill reference document this collection choice. Oracle checksums are unchanged.

• SAKURA_TRACE effect traces are written in batches on JS and WASM rather than one write per record. The lines are unchanged; a run killed by a signal can lose the tail of its trace.

• --target wasm gives each variable of a function its own local only up to 256 variables; past that, a block's variables share locals by liveness (design §17.219 (3), plan row 29), so V8 no longer needs memory in proportion to the variable count to compile a function of thousands of lets. Functions of at most 256 variables compile to the same bytes.

Documentation

• CI requires authored guide examples and rendered documentation links to pass, reusing the existing compiler and website builds.

• Draft public-interface inventory in STABILITY.md, with a generated clap/environment/exit-code baseline and workspace drift test; classifications await RFC 0001 acceptance at v0.2.0.

• Rechecked M4 guides against the compiler, repaired runnable tour examples, and documented current-main migration notes, runtime limits, caching and release status. Added a broad sample gate and rendered-route/link checks; refreshed generated agent references and kept the skill entry point below 7,000 bytes.

0.1.0-alpha.1 - 2026-10-18

The first published preview (GitHub prerelease, Homebrew tap and npm). This section is the development log as it stood at the tag, including the implementation history before it.

Security

• The proof key is refused when its directory is writable by other users or owned by another user, as a readable key file already was; a key inside the project root or the proofs directory is refused from any working directory; sakura build only reads the key and never creates it; and a proof cache entry carries a format under its MAC, so an entry of another format is solved again (security review K1–K3, design §17.164 (3)).

• --target wasm checks what its JS host answers instead of trusting it (security review W1–W4, W7–W11; ABI 1.1.2): an operation index or a builtin result of the wrong shape is a D090 defect, never a heap read, and a completion payload must be a fresh Bytes. A response over SAKURA_MAX_COPY_BYTES (256 MiB) is Err("response too large") from Http and a D091 defect elsewhere, instead of D096; a full request table is D091 for Clock.sleep (which returned at once) and serve_listen. A database from Sql.sqlite or Sql.memory() and an Llm.anthropic handler, with its key, are released when their handler ends rather than at exit. sakura test --target wasm runs the tests after a host fault on a fresh instance. On both backends Sql.sqlite's Fs.root() runs in the clause's task, so it no longer spends a task number in SAKURA_TRACE on JS (design §17.159 (5)).

• Breaking: Secret.map(s, f, reason: Trust) takes a @trust("…") reason, and sakura audit lists each call beside Secret.expose: a pure f cannot perform, but a defect in it can print the clear value (security review S1, design §17.159 (2)). Http.bearer is unchanged for callers; std's own site is not listed.

• Serve.host() reads at most 1 MiB of a request body: a larger body is answered 413 and its connection closed without running the handler. A reply whose status or headers the server cannot send is reported as a D091 defect and answered 500, and the server keeps running instead of stopping (security review H1, H2).

• --target wasm now sends Secret HTTP headers (Http.bearer, and Llm.anthropic over Http.host()) instead of refusing the request, as gate 10 approved (security review W0): http_send and http_stream_open are kind-secret host imports beside js_handler, and cassettes still see the header redacted. The guest and the host overwrite their transport copies of the value once it has crossed (ABI 1.1.1 erratum, §8.1 and §8.4).

• The installer verifies GitHub artifact attestations when gh is available and fails on verification errors; otherwise it reports "integrity verified, not attested". Installation now requires an absolute prefix and uses a securely created staging file.

• M3 exit gate 10 passed on 2026-10-18: the security review of the escape rules, the cassette format and the Untrusted template rule is signed by Claude Fable 5.1 under the owner's written delegation (design §17.159; not the owner's personal review). M3 is complete and the reviewed code is no longer frozen. The review records follow-up findings as plan WS12: Secret.map will take a Trust reason, plain sakura test will pass empty permissions to the runtime, Serve.host() gains a request body cap, the proof key's directory mode is checked, non-release workflows pin action SHAs, and WASM may send Secret headers once the approved transport change lands.

• sakura test always passes SAKURA_PERMISSIONS: without --record its grants are empty, so a test that installs Env.host() reads no runner variable and Sql.sqlite under Fs.host() cannot create a database file (WS12 item 2, review R1/R2). Test.fixtures() keeps its own grants.

Changed

• Breaking: Sakura Lang source files end in .sak instead of .sakura, a clean switch with no fallback (owner decision, design §17.179). Rename sources with git mv main.sakura main.sak; sakura names the rename when given a .sakura file or a tree with only .sakura sources. The VS Code extension, the skill bundle, the agent-DX tasks (revision 2) and every document follow. sakura.toml, the sakura:///std/… URIs and the sakura language id are unchanged.

• Design round 13 (§17.169–§17.178) defines M5's offset32 native ABI, native host coverage, single-thread execution and cancellation, proven-copy warnings, four memory-checking lanes, dependency pins and staged platform matrix; regions and representation changes remain deferred pending measurements.

• N0a adds opt-in native codegen/host skeletons, exact toolchain dependency pins and a platform-A CI job that links and executes a constant object and a test-only runtime staticlib wrapper. Real runtime staticlib linkage and the ABI export move to N1a; native compilation and execution of Sakura programs remain unimplemented.

• V2002 on a call to a declared function names the callee and its home module and fills expected/actual with the two counts (`Env.get` (std/env) takes 1 argument, this call passes 2); a call through a function value keeps the type form (design §17.165).

• V1002 on Type.member suggests the one function within two edits when the usual did-you-mean finds none (List.lenth → List.len, machine-applicable) (§17.165).

• V3001's with fix names the effect's one deterministic std handler when there is one (with Env.of(?vars), still incomplete), and sakura explain V3001 says how to recover from a residual Fail<E> (§17.165).

• The agent-eval harness (version 2) records each lookup with its size and success, splits reported diagnostics from codes quoted in documents, reports the remaining input and the refused request, and pairs input-cap arms (--input-caps 40000,60000) (§17.165).

• Design round 12 (§17.160–§17.168): design §12.1 now lists only the sakura build flags that exist (--release is removed; every build keeps its checks) and marks sakura mcp serve --tools as planned; sakura verify --json will report summary.reused under schema 1.1 and reuse unknown(resource_limit) results; WASM defect records will match JS in code, message and site before M4 is called complete; the rest of M4 is ordered in plan m3-completion-and-m4.md §3.8, M5 planning opens in docs/plans/m5-native.md, and docs/plans/road-to-1.0.md is a provisional outline.

Fixed

• --target wasm defect records now match --target js in code, message and site (design §17.162): a contract defect says precondition `nonzero` of positive violated (not contract `nonzero` violated) and carries the same spans, the blamed call first and the clause as definition; Option.expect reports the program's own message, and D004, D011 and D031 name the value, the inner defect and the offset as JS does. The spans come from the module's sakura.debug section (ABI 1.1.3, wording only), so --strip drops them.

• A cassette line that lacks an exchange field (or has one of the wrong type) now fails Http.recording's open with <path>:<line>: not a cassette exchange (missing <field>) instead of a D090 at replay (security review C1).

• The Sakura skill starts with a bounded guide read and recommends targeted lookup to avoid repeated full-guide input costs. The first paid DX5 pilot now has a public report; no additional episodes are authorized.

• A requires violated inside a self-tail-recursive function now blames the self call (down2(n - 2)) instead of the outer call that entered the loop. Contracted functions take their blame site as a trailing parameter on the JS backend, and predicates that cannot defect skip the D011 bracket (design §17.115); defect codes are unchanged.

• M4 documentation now describes source-built WASM execution and verification, CI parity, the pending Secret-header transport review, and implemented versus planned backend and agent tooling. Added the static-verification tour.

• The committed skill manifest omits its history-dependent commit field; file and ZIP SHA-256 hashes remain. Identical contents stay fresh across commits and rebases, and generation no longer requires Git history. CLI commit metadata stays build-time.

• Restored std index complexity and behaviour notes and added a task-oriented lookup table; the checked skill reference and downloadable bundle include both.

• Website production builds preserve Fumadocs search highlights without Lightning CSS's false positive ::highlight warnings; Turbopack still minifies the emitted CSS.

• Native benchmark builds include the OCaml shared modules and Unix library and resolve Koka shared imports from the entry directory, matching the independent verifier's C build configuration without changing port algorithms or toolchain pins.

• Benchmark nbody uses persistent List.set, and the countdown hand-JS control checks arithmetic overflow in source operation order (§17.150). Checksums are unchanged; pre-change ratios are excluded across these definition boundaries. The WS-S10 evidence records the remaining controls' arithmetic-check gaps.

Added

• --target wasm runs direct code without continuation frames: each direct top-level function whose body is first-order gets a native twin with Int/Float arguments in registers, and deep recursion falls back to frames past a stack gauge (design §17.118). fib 30 runs about 4× faster on Node; output, defects and traces are unchanged. --no-direct builds the all-frame module.

• The WASM module's stats() export also reports frames, Int/Float boxes, Dups and Drops (runtime ABI 1.1.0), and SAKURA_WASM_STATS=<path> makes the WASM host append them at exit. The LIR computes the same direct facts as sakura build --dump direct.

• --target wasm runs Http.host() sends and streams, Sql.sqlite, Serve.host(), Llm.stream through Llm.anthropic and Log.json() as the JS backend does; every semantics fixture and example agrees with JS on output and effect trace, with @js/@wasm fixture expectations where Int differs, and the parity harness reports which host imports the corpus exercised (plan M4 W2). Until the owner's review of Secret transport (design §17.155), a WASM request carrying secret_headers is refused rather than sent. JS traces no longer spend a task number on a refinement check inside a JSON decode, so task numbers compare exactly across backends.

• A VS Code extension in editors/vscode/ (not published; build a .vsix locally): .sak highlighting generated from the website grammar, language configuration, and a client for sakura lsp per project (nearest sakura.toml) with error-page links, quick fixes showing their impact class, stale-fix refusal, Show Hole Context and format on save. sakura lsp diagnostics gain codeDescription links to /docs/errors/<code>, quick fixes carry data.impact/data.applicability, and a client supporting documentChanges gets fixes pinned to the document version. New docs page: Editor setup.

• Release preparation for v0.1.0-alpha.1 (not published): the workspace version is 0.1.0-alpha.1; sakura --version and MCP compiler_info (commit) report the source commit of a stamped build. release.yml builds macOS arm64 and Linux x86-64 archives with SHA-256 sums, a provenance record, the skill ZIP, tools/install/install.sh (pinned version, strict checksum verification), a Homebrew formula and npm packages; a manual run is a dry run, and every publishing step waits for the owner.

• Twelve agent-DX pilot tasks with isolated oracle fixtures, gold/hollow solutions, schema and frozen-baseline checks in ordinary Cargo CI. The protocol defines the Anthropic-only $10 pilot budget; paid execution and its runner remain deferred.

• The agent-DX episode runner (evals/agent-dx/harness/runner.py): isolated episodes, hidden oracles on frozen snapshots, JSONL transcripts, metrics, transcript replay and a scripted backend tested offline in CI. Live Anthropic runs require an owner approval, a budget and pinned prices, and stop at a committed $10-total spend ledger; agent-eval.yml is manual-dispatch only. No paid run has happened.

• Eight offline cookbook projects cover refined JSON, file CLI, HTTP retry/cassettes, SQLite parameters, direct router tests, scripted LLM tools, budgeted agents and persistent indexed updates. Cookbook pages and the embedded skill reference are generated from those projects; CI checks their source, fixtures and freshness.

• Downloadable Sakura skill with a byte-identical website mirror, deterministic ZIP, SHA-256 checksum and content manifest. agent_docs --check and the CLI harness reject distribution drift; the agents docs and /llms.txt link the bundle.

• Error-code reference pages at /docs/errors/<code>, generated by agent_docs for all 90 registered codes: the explanation, the tests/ui program that triggers the code, its JSON diagnostic and, for 64 codes, a fixed program the ui suite checks clean. sakura explain prints the page URL after its text, and 32 explanations that lacked a repair gained one.

• sakura new and sakura init write AGENTS.md and a CLAUDE.md importing it when absent. sakura setup [--client claude|codex|cursor|all] [--apply] prints, and with --apply writes, the project-local sakura skill, the client's MCP entry (merged into an existing config; a config it cannot parse gets a printed entry and nothing is written) and Cursor's rule; sakura new --setup <client> runs it after scaffolding. sakura mcp serve without --root uses the nearest sakura.toml upward and refuses to start outside a project (§17.143).

• Canonical Sakura agent skill source with a compiler-driven edit loop, four offline examples and a fixture-seeded repair table. Generated references, embedded metadata and distribution are tracked separately in the agent DX plan.

• Benchmark results retain every process peak RSS, and comparisons report process medians alongside the unchanged maximum-based +25% RSS gate. The WS-P1 variance study and raw evidence are documented in bench/README.md.

• Benchmark runs record host load and a quiet-window verdict (meta.host.quiet); bench bless refuses runs that are not quiet, bench compare reports loaded-host runs as advisory (host load L), map_set times its Int, String and tuple keys as separate cells, and the CI noise job runs weekly (design §17.153).

• Research on language design, agent ergonomics, memory management, effects, standard-library direction, and open-source engineering practices in research/.

• Bun / Next.js / Fumadocs website and documentation delivery in website/.

• Initial language design in docs/design.md, with proposed syntax and open decisions.

• Community governance, contribution and AI-assistance policies, security guidance, and dual MIT OR Apache-2.0 licensing.

• RFC and architecture decision records, compatibility policy, GitHub contribution forms, and bootstrap CI/dependency automation.

• sakura mcp serve: the compiler as an MCP server with check, symbol and hole queries, docs, formatting, checked patches and test runs. Setup: docs/mcp.md.

• sakura lsp: a language server with diagnostics, hover, go to definition, completion, formatting and quick fixes.

• sakura fix [--preview] [--apply ids] applies compiler fixes by impact class, and sakura check --frozen-specs <symbols|all> [--since rev] reports spec changes since a git revision as V8020.

• sakura new <cli|lib|agent|api> <name> and sakura init scaffold a project, and sakura run exits 75 when main declares an effect that [permissions] does not grant.

• sakura audit [--json] [paths] lists every @trust (with its reason and sink), @total, @external, @resource and refined-type T.from site in your packages, as a table by file or as JSON Lines audit records plus a summary. It exits 0 after reporting sites; loading/usage failures remain errors. A literal whose refinement is undecidable at compile time is listed as a from site with reason: "literal".

• sakura doc [--search "fn(List<A>) -> Int"] [symbol] [--json] prints signatures, effect rows, contracts and doc comments offline; --json returns the records of MCP symbol_query.

• sakura test --contracts also runs one property per pub fn with a refined parameter or a requires clause: inputs come from the parameter types, requires filters them, and ensures is checked. A property that discards more than 90% of its inputs fails and is reported as W7001 at the function. A shrunk failure is saved to tests/regressions/<fn>.json and runs first next time. Functions with effects other than Fail, Clock and Random are skipped unless @contract_test(handlers: [Effect.constructor()]) names their handlers.

• The sakura explain pages for V5003, V5004, V6002, V6003, W5005 and W7001 describe the M3 rules with minimal pairs; the retired V5002 page remains for older reports.

• Test fixtures accept backend-suffixed expectations (// expect-defect@js: D003, // expect-exit@wasm: …) beside the unsuffixed default; the M4 harness will use them.

• compiler/fuzz: cargo-fuzz targets for parsing, checking, formatter idempotence and row unification laws, run nightly for ten minutes each, with minimized failing inputs uploaded as workflow artifacts.

• Tool.of lowers a named @tool function through Tool.from with synthesized argument schema.

• Effect-row parameters on types, including Tool<e>, Agent<T, e> and Router<e>.

• Opaque constructor/field access outside the defining module is rejected with V1006; compiler-known prelude Trust restricts @trust("reason") to trusted sink arguments (V6001).

• sql"…" interpolations convert through SqlValue.from and remain bound parameters.

• Typed failures escaping test bodies are reported as test failures.

• sakura build --manifest emits the trusted base and runtime contract obligations to target/sakura/manifest.json.

• sakura build --emit lir writes the WASM backend's validated low-level IR as text to target/sakura/lir/main.lir (M4 preview; no WASM is emitted yet). --layout=niche is accepted and refused until the Option niche layout lands.

• sakura build --dump core prints the user modules' Core, with each Int operation the JS backend's interval pass proves marked proved (design §17.114).

• sakura build --dump owned lists each collection update as owned (in place) or shared(<reason>) with reasons origin, borrowed-after, captured, stored, escapes-call <name> and join; --dump core marks owned updates (design §17.149).

• sakura verify [--json] [--target js|wasm] [--rlimit N] [--solver PATH] discharges contract, overflow and division obligations with Z3 5.3.1 (proved, disproved with a counterexample replayed through the evaluator, unknown, unsupported, and W7002 for a proof over an impossible path) and records statuses in the manifest; sakura build then drops a proved ensures/where check only while its MAC-authenticated proof still matches the code. [verify] rlimit in sakura.toml sets the solver budget. The website now documents verification, with a captured CLI example, JSON Lines records, cache authentication and check-removal limits.

• sakura test --record, Http.recording, Llm.replay and Test.fixtures support scoped cassette recording and offline replay. Example fixtures are explicitly synthetic.

• Scoped escape diagnostics V6002/V6003, foreign-capability FFI rejection V6001, and refined-target Untrusted.validate with V5003 for invalid targets.

• Bounded compile-time scalar refinement evaluation: invalid literals report V5004; undecidable literals retain startup checks without a warning.

• Html.from and HTML-valued template interpolation compose markup while escaping text.

• All twelve examples execute (seven run plus test, five test), including committed cassette replay in llm_extract, agent_loop and secrets. This does not close all M3 gates.

Changed

• sakura verify no longer re-solves an obligation whose MAC-authenticated proof record still matches its key and was obtained with the same solvers: it rebuilds the record from the cached solver answers, so a second run on an unchanged tree prints the same records without solving. unknown results are still solved every time, and forged or foreign records are solved again. Proof records written before this change are not read; rerun sakura verify once so that sakura build drops proved checks again.

• Updated live repository links and clone instructions to icantcodefyi/sakuralang.

• Benchmark peak-RSS crossings above 25% now require one confirmation group on Node; Bun crossings warn only (design §17.136). Compare output retains both groups' maxima, medians and counts, and CI reuses the timing confirmation run.

• Security (design §17.130): an opaque type is Schema only inside its declaring module. Elsewhere, any Schema bound that reaches one (Json.decode, Sql.query rows, Llm.generate, Cli.parse, Tool.of arguments, property parameters) is the new error V2033 opaque_not_schema, so data can no longer forge a Query<R>, Html or UrlPart. sakura test --contracts skips a pub fn with such a parameter and names it. Uuid is now String where is_canonical(it) and Decimal is DecimalRepr where is_canonical(it), so both decode with their check; programs that built Uuid("…") or matched on it use Uuid.parse.

• The JS backend emits Int arithmetic it can prove in range (loop counters under their guard, n - 1 under n >= 1, a non-zero literal divisor) as the raw operator, and inlines the safe-integer test of every other +, - and *. Semantics are unchanged: every D001/D002/D003 still happens where it did (design §17.114).

• A sakura.toml naming its package std or main is V8002 reserved_package_name (§17.131).

• A field assignment through a refined type (x.n = -1 on var x: Pos, or r.total.frac = … through a Decimal) is the new error V2034 refined_field_assignment (design §17.135), in every module: the sugar rebuilt the base type and skipped the predicate. The suggested fix rewrites it to x = Pos.from(PosRepr { ..x, n: -1 }); use Pos.validate(…)? for data. Whole reassignment of a refined var is unchanged.

• sakura fmt keeps an if … else on one line only when every branch fits; otherwise every branch is a block (§17.133).

• Retired V5002; narrowed W5005 to user clauses scanning collection parameters with List.all, List.any or List.contains. String.contains no longer triggers it.

• WS7 Phase B documents the landed CLI and language behavior, regenerates the website std signatures from compiler/std/INDEX.md, and describes early M4 R1–R3/L1–L2/V1–V2 work separately from gated integration.

• Refreshed the tours, cassette guide and README for landed contract properties, streaming HTTP, Llm.recording, memory filesystem attenuation, untrusted templates and generic refinements, with source-built CLI verification.

• Renamed the language from Vow to Sakura Lang: binary sakura, sources .sakura, manifest sakura.toml, crates sakura_*, env SAKURA_*, URIs sakura://, repo icantcodefyi/sakura-lang. Diagnostic codes are unchanged.

• Host handlers enforce manifest grants delivered by sakura run in SAKURA_PERMISSIONS.

• Analysis reuses unchanged modules' signatures and bodies; private-body edits lower and check only the edited module. Item/import/export collection remains global. Bodies reachable from refinement predicates participate in interface invalidation.

• Roadmap and source-build documentation now distinguish implemented M3 behavior from M3 exit gates, planned M4 WASM/verification and M5 native execution.

• M3 is complete pending the owner's security review (gate 10): the re-audit after the M3 close-out passes gates 1–9 and 11 at a843e60 (gate report). The reviewed escape, cassette and template code stays frozen until the review packet is signed.

• Faster effect handlers on the JS backend (design §17.113): an operation performed directly in the body of with over a handler literal, or over a call of a function that only builds one (counter(), Clock.fixed(…)), calls its clause directly instead of searching the handler stack. It stays a cancellation point and is traced as before, and a function whose only effects are handled that way runs without continuations. Other operations run a clause that performs nothing inline. Semantics, traces and output are unchanged.

• Direct-style JS no longer keeps a value used once by the next call alive for the rest of the function (design §17.138), which lowered binary_trees' peak memory on Node.

• Faster checked reads on the JS backend (design §17.151): xs[i].expect(…) and Map.get(m, k).expect(…), when the Option is used only there, compile to one checked read that builds no Option. A miss is still D030 with the same message and exit 70.

• Loops on the JS backend that perform effects whose handlers are found at run time now run as plain JS loops (design §17.156): an iteration whose handler answers directly continues in place, and only an iteration that suspends or reaches a handler that itself performs allocates a continuation. handled_suspend runs about 3× faster on Node and its peak memory there fell from ~120 MB to ~50–64 MB. Semantics, traces and output are unchanged.

• Faster collections on the JS backend (design §17.116): List.map, filter, filter_map, flat_map, range, zip and enumerate build their result in place before returning it, for over a list reads each leaf of the vector once, for over a Map or Set copies nothing, and string splitting and map inserts allocate less. String.len is documented as O(n) on JS: compute it once outside a loop.

• List.set, List.push, Map.insert, Map.remove and Set.insert update a collection in place when the compiler proves no other reference to it exists (design §17.149): built from a literal, a fresh constructor, an empty collection or an earlier such update, and only read (len, get, contains) before it is replaced. sieve no longer copies a trie path per write. Every other update stays persistent, so results are unchanged. The WASM runtime writes any path node with a reference count of one in place.

Fixed

• Agent-facing status and MCP documentation now distinguish implemented CLI, stdio, WASM and verification capabilities from planned exports, and explain opt-in frozen specs. Contributor guidance points to the existing Rust workspace and its checks.

• sakura fmt keeps file header comments above sorted imports when an inline block comment precedes the first import, while moving that inline comment with its import.

• sakura fmt preserves U+FDD0 in strings and comments instead of decoding it as a newline, and keeps Unicode separators and control characters inside line comments until LF.

• Llm.stream under Llm.anthropic requests server-sent events and calls on_partial once per text delta instead of once with the whole reply.

• sakura fmt no longer drops comments in import lists, after where, or before a binary -, keeps one-line block comments inline in lists and statements, and lays out comments after = and => instead of copying the statement verbatim. If formatting would still lose a comment or produce code that does not parse, the file is left unchanged and V9001 reported.

• A generic refined type such as type NonEmpty<T> = List<T> where List.len(it) > 0 is its base at its own arguments: NonEmpty<Int> now coerces to List<Int> for calls, methods, fields, patterns and constraints instead of reporting V2032/V2001 about T.

• A non-exhaustive match on a refined list type reports V4001 with the missing case instead of an internal compiler error.