The 0008 totality core shipped via #55 (spec 0062, 76b21c0), but both
model whitepapers still claimed "nothing here is shipped" — drift the
architect would flag.
- 0008: STATUS now "partially realised". Records what landed (binary
ParamMode, value-type trivial-own, no mode-polymorphism, the hash
reset) and points at the contract ledger for current-state facts.
Marks §3.4/Q3 naming as resolved (verbal own/borrow kept, user
decision); leaves the return-side escape axis (§5.1-5.2), multi-return
(§5.3), and Q2/Q4 as the genuine remainder. escape.rs is named as the
opt-only stack-promotion pass, not the §5.2 reachability check.
- 0009: STATUS stays "nothing shipped" (true), but the runtime-axis-dual
paragraph now notes 0008's annotation axis landed, so 0009's
precondition is met rather than hypothetical; the §8-Q3 coupling to
0008's unshipped return-escape pass is flagged as still ahead.
Contract 0008-memory-model.md needed no change — already current.
Records the runtime-axis dual of ownership totality (model 0008). 0008
totalises the *annotation* (own/borrow everywhere, no Implicit) but keeps
universal RC as the floor; 0009 asks the question totality makes askable
— must the runtime discipline stay universal, or can it follow the type?
Principle: RC is authored, never universal. Default `box` (affine,
refcount-free, deterministic scope-drop ≈ Box); opt-in `rc` (refcounted,
explicit `share` ≈ Rc). Motivated by the maintenance record: ~1/3 of
recent commits touch RC/ownership/drop, no bug was ever in the RC runtime
itself — all lived in the inference (uniqueness-elision, is_rc_heap_allocated,
mode-through-subst) that exists only to reconcile affine ownership with
universal RC and strip the RC it over-charges.
Soundness leans on existing law: the 0015 DAG constraints + linear-by-
default already draw the "needs-a-count" partition; `rc` only names it.
No cycle collector reappears (rc graphs stay acyclic). No `&mut` mode:
in-place mutation rides consume-and-return (move, not alias), so
constraint 3 (immutable-once-constructed) holds — `mut` is out by
principle. §5 enumerates what leaves the compiler (uniqueness-elision,
is_rc_heap_allocated term-shape predicate, over-strict lint, reuse-as,
escape-clawback) and what stays (the affine/linearity check, already
present).
Status-stamped NOT current state, per the honesty rule and the 0008
precedent; INDEX.md left untouched (exploration whitepapers are not on the
canonical spine until adopted). Composes with 0008 regime A, which already
makes transitive box-drop sound. §8 isolates the open questions (closure
capture move/share, clone-vs-share split, coupling to 0008's escape pass,
keyword spelling, sharing-heavy workloads).
Brummel