Incan 0.6 — in development

Development release note. Incan 0.6 has not shipped. This page records the release contract and the user-facing direction of the active development line; the tagged release note will distinguish delivered behavior from work that was deferred or explicitly migrated.

The release in one sentence

0.6 makes Incan's own compiler facts and Oven project model the normal authority for compilation, packages, build artifacts, and inspection—so generated Rust is an optional projection, not the semantic handoff.

Why this release exists

0.5 established compiler-owned foundations, checked project boundaries, and the first Oven Alpha evidence. It still retains generated Rust in the normal backend path and leaves Cargo-shaped build behavior too close to the center of the system.

0.6 is the architectural cutover. Its purpose is not to rewrite every compiler component in Incan immediately. It is to put Incan in a position where large parts of its internals can begin moving into Incan source deliberately, while Rust stays a bounded host capability rather than a second semantic authority.

Features and enhancements — in development

dev.7

• Tooling: Explicit Oven bakes support declared Rust library callers of Incan exports, with declared editions, separate library receipts and exact completed-output reuse. (#1486)

• Tooling: Registry-backed Incan libraries publish and execute through original native Loaf dependency records without a generated Cargo lock, retaining exact profile selection and corruption checks. (#2216)

• Tooling: Workspace lock preparation retains every member in the existing owner, avoiding unchanged source collection while observing sibling tests, source changes and membership edits. (CLI reference, #1337, #1698)

• Tooling: incan lock and adjacent standalone oven lock share the Unix project owner; unchanged standalone lock preparation reuses its original session and publication evidence. Workspace and external-entrypoint collection retain their existing behavior. (CLI reference, #1337)

• Tooling: Ordinary builds share the immutable executable between native and completed-output records, preserving a separate writable project output and both receipts. (#2205)

• Tooling: Test progress carries typed events to the CLI, keeping console banners and verbose fixture/phase notices out of JSON Lines reports while preserving diagnostics and uncaptured test output. (#1337)

• Tooling: Test completion carries typed results to the invoking CLI for console, JSON and JUnit reporting, resolving each source-file identity once before execution instead of repeatedly during reporting. (CLI reference, #1337)

• Tooling: Rust oven tests cases from the same harness share a process by default, with one --jobs budget defaulting to four workers and optional --isolate; exact selection, fresh per-case results and Incan fixture scopes are preserved. (CLI reference, #1337)

• Tooling: Native graph finalization uses retained Store coordinates instead of rechecking child outputs for location lookup; publication and execution keep their integrity checks. (#1337)

• Tooling: Cold native preparation compiles independent registry and local dependencies through one executor with up to four workers, preserving exact dependency owners, deterministic inspection records and unchanged reuse. (#1337)

• Tooling: Oven groups Apple drive-cache flushes at Store publication boundaries while synchronizing every staged file and directory, avoiding a full device flush for each source file. (#1337)

• Tooling: Rust test harnesses with compatible requirements share native dependency preparation in the existing owner while retaining their own imports, receipts and output plans. (#1337)

• Tooling: Opt-in invocation traces separate native dependency source preparation, reuse, compiler subprocesses and durable publication across build and Rust test harnesses, including publication validation, copying/linking and synchronization. (#1337)

• Tooling: Explicit oven run prepares stored native plans in the existing Unix owner, reusing guarded compiler probes while preserving local program I/O and Store leases. (#1337)

• Tooling: Native test supervisors report periodic liveness from their existing wait loop, avoiding a dedicated heartbeat thread for each case. (#1337)

• Tooling: Unchanged native test preparation retains its parsed graph and resolution lock in the existing owner, with coordinate and file-change checks before reuse and handoff. (#1337)

• Tooling: Local Rust test graphs preserve root test dependencies, host procedural-macro dependencies and resolved target conditions through ordinary native Loaf admission and reuse. (#1337)

• Tooling: Exact Rust test cases share their collected inventory and search its sorted names without copying the full harness inventory per case; Unix process-group cleanup signals the operating system directly, and invocation tracing separates selection, child setup, waiting and cleanup. (#1337)

• Tooling: Unchanged native test runs retain dependency-inventory validation in the existing owner while continuing to reject changed or corrupted inputs. (#1337)

• Tooling: Rust libraries can declare [rust].path for a nonconventional entry point; Cargo adoption, native dependency snapshots and test discovery preserve it without rewriting source files. (CLI reference, #1337)

• Tooling: Native Rust tests supply Insta’s snapshot workspace directly, avoiding Cargo metadata discovery while preserving explicit workspace configuration. (CLI reference, #1337)

• Tooling: Rust oven tests evaluates conditional Loaf dependencies with the selected toolchain, retains unchanged decisions in the existing owner, and refuses incomplete or incompatible target evidence. (CLI reference, #1337)

• Tooling: Cargo adoption translates implicit optional-dependency features into explicit Loaf feature declarations, including suppression by dep: edges and removal on reimport. (#1337)

• Tooling: oven convert-cargo adopts upstream dev dependencies into [envs.test.dependencies], preserving production optionality and refusing unsupported dependency overlaps before publication. (#1337)

• Tooling: Rust oven tests includes declared mixed Incan/Rust Loaf dependencies with their selected features and supplies compiler test children with the same checked native closure. (#1337)

• Tooling: Rust oven tests resolves package features before test-only dependency overlays, allowing an optional dependency to become mandatory for tests without invalidating its authored feature edges. Compiler frontend, driver and CLI roots declare their test helpers directly. (#1337)

• Tooling: Repeated oven tests requests retain unchanged native test inventories in the existing owner; executable or invocation changes recollect names, while tests and runtime data are evaluated afresh. (#1337)

• Tooling: Repeated native preparation retains the compiler sysroot in the existing compiler memo, with replacement-sensitive executable and runtime-library checks; unsupported layouts keep ordinary probing. (#1337)
• Tooling: Native linker preparation reuses unchanged SDK stub identities through existing file observations, preserving exact receipt identities and restoring missing or corrupted staged members. (#1337)
• Tooling: incan check retains successful diagnostic reports in the existing project owner while reconciling source and dependency changes; incan fmt shares project preparation across file batches and preserves fresh parsing and per-file diagnostics. (#1337)

• Tooling: Rust oven tests preparation shares the ordinary native Loaf plan owner, resolves [envs.test.dependencies], and supplies the authored package version at compile time without leaking that value into test processes. Named environments now use [envs]; the retired [tool.incan.envs] placement reports a migration error. (#1337)

• Tooling: oven tests --jobs N --isolate schedules prepared Rust cases independently while preserving Incan harness isolation and shared serial/resource constraints (#1337).

• Tooling: Rust test cases reuse their current executable’s collected inventory in the existing runner. Changed executables or invocation contexts trigger fresh listing; case results, deadlines and process isolation remain fresh. (#1337)

• Tooling: Reopening unchanged dependency declarations preserves their resolved order, allowing existing native test preparation to match equivalent requests. (#1337)

• Tooling: Unchanged Incan test harnesses retain completed analysis and code generation in the existing project session. Selected cases, source, provider identities and generated files still invalidate preparation; tests always execute freshly. Rust inspection, C header verification and ambient source metadata keep canonical preparation. (#1337)

• Tooling: Repeated Incan and Rust test preparation reuses checked provider identities in the existing project session, preserving physical dependency validation and fresh test execution. (#1337)

• Tooling: oven tests combines Incan and Rust tests through one owner, scheduler and reporting path, with --incan-only and --rust-only selection. incan test delegates to the Incan-only path. (CLI reference, #1337, #1698)

• Tooling: Repeated Unix incan test --list requests reuse preparation in the shared project owner while collecting current test and conftest sources. Build and collection sessions retain their distinct preparation authority when commands alternate. (#1337, #1698)

• Tooling: Unix incan test execution reuses canonical session preparation and shares native dependency admission with builds in the existing lock-guarded project owner, while running fresh tests and fixtures. Console output, JSON Lines records, diagnostics and parallel-worker output remain local to each requesting command. (#1337, #1698)

• Tooling: Ordinary Unix executable builds automatically share a retained build owner, reusing canonical lock, input observations, dependency admission and completed outputs across commands while checking source and output changes. The compiler development helper uses the same owner for direct native builds. (CLI reference, #1337, #1698)

• Compiler: Tuple annotations and inferred tuple literals share one semantic type shape, allowing the experimental direct route to construct, return and match tuple-payload Results without incompatible carrier identities. (#1337, #1698)

• Compiler: The experimental direct route wraps collection values assigned to Option bindings through the shared carrier conversion, preserving empty-list and dictionary assignment behavior. (#1337, #1698, #1832)

• Compiler: The experimental direct driver's manifest-backed executables reuse ordinary completed-output loaves before checking or lowering. Reuse binds source, native resolution and the shared pinned platform policy; standalone sources still compile directly. Normal command backend cutover remains in development. (#1337, #1698)

• Tooling: macOS SDK proc macros link through the pinned Rust toolchain's LLD with explicit macOS 11.0 deployment and SDK 26.5 load commands. Their unit receipts bind the linker, LLVM library, and exact system-library stub bytes; INCAN_OVEN_LINK_SDK selects the stub source directory, defaulting to the Command Line Tools SDK 26.5. (#1698)

• Tooling: Loaf manifests admit scoped Rust dependencies, target entry arrays, and [rust] unit metadata. Standard-library requirements come from the component manifests; conditional Rust projections require selected target cfg evidence. (#1698)

• Tooling: Projects using only rust::std bake and inspect without Cargo; unresolved declared Rust dependencies require a sealed Loaf resolution, and comment-only edits preserve baked source authority. (#1698, #2081)

• Compiler: The experimental direct route consumes validated, shared Body IR in an Incan lowering Loaf. Its scalar plan retains checked integer arithmetic, signed builtin-range facts, canonical calls, formatting ownership, and unwinding cleanup; native corpus validation and cutover remain in development. (#1337)

• Compiler: Oven builds the pinned native driver and its Incan-authored scalar plan with a receipt-bound, crate-scoped rustc-private grant. The conformance fixture checks native output, overflow locations and typed malformed-plan refusal; the native-route cutover remains pending. (#1337)

The compiler owns source meaning end to end

Incan has one execution route. Programs run on the legacy Rust-emission route until the direct route replaces it: the direct route will lower Body IR, the compiler-owned facts of each checked body, inside the pinned rustc without generating Rust, and will replace the legacy route rather than run beside it. The Body IR interpreter that an earlier dev slice ran as a second, partial backend is removed, together with its --backend, --backend-fallback and --shadow build flags and its shadow comparison; the programs its tests ran are behavior fixtures. The behavior fixtures show which behavior holds, and each pending fixture names what does not hold yet. Every build's backend-selection receipt (schema 3) names the backend that produced its output, its revision, and the source and output identities. (#1337)

• Packages: Library builds publish versioned executable content for covered public declarations, resolvable through package aliases and facades without producer source, under the original declaring identities and with the selected public type context. Missing, incompatible and uncovered requirements refuse by package, version and requirement. Native linking remains available for packages without executable coverage. (#1339)
• Packages: Native link facts execute only during publisher bakes and produce deterministic, receipted archive assets; consumers import the verified archive into their selected-unit identity and refuse rather than compiling C when the product is absent. (#1561)
• Tooling: The pinned IncQL release gate refuses Cargo and publisher-tool execution, requires every selected registry unit to be attested with unique identity, rejects Cargo-layout fallback and the protobuf-src/cmake bootstrap graph, joins the 14-package IncQL addition set to literal Cargo/Oven equivalence evidence, and runs the Oven quickstart executable. (#1561)
• Tooling: Release packaging accepts Cargo build-script invocations that use rustc's default empty artifact suffix, selects the pinned compatibility-publisher Cargo, and passes the resolved native compiler toolchain into release Loaf publication. (#2016)
• Tooling: A Rust-only Loaf can depend on a sibling Incan Loaf with { loaf = "<name>", path = "..." }; an explicit project bake selects checked caller exports from Rust <library>::caller::incan:: paths, emits the bounded caller namespace and identity record, and builds the Rust binary against the Oven-built Incan rlib through receipted direct rustc. (#1337)
• Tooling: incan inspect representation reports a published package's executable-representation version and the coverage it declares for each public declaration, with refusals carrying their stable reason. A package that publishes none, and a representation this build cannot interpret, are both reported rather than refused. (#1339)
• Packages: .incnlib manifests carry anonymous union types in checked signatures, and declare manifest format 4. A reader without support for the new type reference refuses the manifest by format number rather than failing to parse it, so an artifact from a newer compiler names the reason it cannot be read. Comment- and order-preserving manifest editing is unaffected. (#1339, #1453)
• Standard library: std.toml reads typed manifest values and declared models, reports source locations for parse and structural errors, and writes generated lock documents while retaining TOML date/time kinds. Comment- and order-preserving manifest editing remains deferred. (#1409)
• Standard library: std.environ.args() -> Result[list[str], EnvironError] returns the process argument vector, program name first, so a command-line tool no longer reaches for rust::std::env. A non-Unicode argument fails the way get fails for a non-Unicode value: a not_unicode error that names the argument's position and never its bytes. (#1668)
• Language: str.encode(encoding="utf-8") -> bytes and bytes.decode(encoding="utf-8", errors="strict") -> Result[str, ValidationError] give text its UTF-8 round trip without Rust interop or the OrdinalKey detour, so std.hash and std.encoding compose with text directly. Only UTF-8 is supported: an unsupported literal label is a compile-time error; malformed strict input, a run-time label naming another codec, or an unknown run-time policy is an Err whose code says which (invalid-utf8, unknown-encoding, unknown-errors-policy); errors="replace" substitutes U+FFFD and always succeeds. A run-time label str.encode does not know raises ValueError, as int("x") does. (#1668)
• Language: Mutable Dict[K, V] gains contains_key(key) -> bool, matching FrozenDict; key in dict is unchanged. (#1668)
• Language: Method decorators spell the receiver the way the method does. A decorator on def label(self, value: int) -> str accepts (Box, int) -> str, one on a mut self method accepts (mut Box, int) -> int, and a function returned in the method's place is declared def parse(box: Box, ...) or def grow(mut box: Box, ...). Function types gain the mut parameter marker, (mut T, ...) -> R, for a parameter whose changes reach the caller. It is part of the function type: a def parameter declared mut is marked unless it is an int, float or bool (the function's own copy, whose changes stay local) or of a Rust type; function types match only when they mark the same parameters; a library function keeps its marks across the .incnlib boundary (manifest format 5); and a marker on an int, float or bool parameter of a function type is refused. The compiler decides how the receiver is passed. The former &Box / &mut Box spelling is refused with INCAN-T0110, which names the spelling to write (migration steps), and a self-method decorator chain the receiver cannot be passed through (an imported decorator, a shape written through a type alias, a returned closure, a decorator that calls or passes on the method it decorates, a pub or out-of-chain use of a function of the chain) is refused with INCAN-T0116. (RFC 036, #1790)
• Tooling: A direct-rustc store entry retains the complete receipt of the compilation that produced its bytes, admitted against the entry's own receipt, build unit and intent, and re-checked whenever a held payload is revalidated. incan oven store inspect reports it, so a reused artifact can say what made it rather than only naming a receipt. (#1037)
• Tooling: The compiler-suite third-party foundation is keyed on its own inputs — the private foundation manifest, its lock, the checked-in patches, target, host, profile, rustc and Cargo identities — never on the compiler's source digests. A compiler edit followed by make test-prewarm-oven-loafs selects the existing foundation by that key from the store or a mirror and rebuilds only the shards through direct rustc; the bake report shows foundation_build_elapsed_ms: 0 and the foundation stage's cargo_process_started: false. A changed lock, manifest, patch, target, host, profile or toolchain still rebuilds it. (#1564)
• Tooling: A consumer of an admitted Incan package no longer needs the producer's private Rust path sources to resolve it: the package is identified by its sealed artifact, never by walking the producer's private Cargo edges. Compatible registry units shared by the consumer and a source-free provider, or by two source-free providers in a diamond, are reconciled by their portable RFC 124 identity to one already-compiled artifact; independently staged paths and compile order do not create a second unit. Records for one shared package version still refuse when source, features, target, profile, toolchain or another selected-unit fact differs; distinct package versions remain distinct units, and normal commands never fall back to Cargo. (#1241, #1469)
• Tooling: An explicit consumer bake recompiles a source-backed caller-owned provider and its affected target-library dependencies against the consumer's selected registry units, and the resulting build, run, and test plans reuse that coherent closure without Cargo. Host-only units do not collide across closures; a source-free provider with a different target-library unit remains a refusal. Workspace test-dependency plans bind the member that published them and include only that member's explicit Rust dependency surface. (#1241, #1561)
• Tooling: Release Loafs retain each vocabulary auxiliary target together with the host compiler plugins from the same publisher build. Every auxiliary extern must load through that sealed closure with the compiler that built its target before publication, so a stale cross-target unit cannot be paired silently with a rebuilt proc macro. (#2006)
• Tooling: A package diamond that names one provider under one alias from both sides links it once instead of refusing a duplicate extern. (#1459)
• Tooling: An explicit bake treats a cached output whose release Loaf the active toolchain no longer ships as a cache miss and rebakes; a consumer facing project extensions from two retained families selects the one whose base the toolchain still ships. (#1444)
• Tooling: A normal incan build, run, or test never launches Cargo. A genuinely incompatible shared registry unit is refused with the package and provider artifact that pins it; a library whose assembled closure rustc cannot load is refused with the library and rustc's crate-loading report, including a StableCrateId collision, which carries no error code. (#1141, #1241)
• Tooling: Two large interop projects can share one Oven home. An explicit bake reserves a 4 GiB staging floor before it runs, reclaiming inactive store entries oldest-first to reach it instead of failing with a demand to prune by hand, and prints a note: naming what it reclaimed; entries under a live lease are never touched. The everyday store policy grows to 12 GiB aggregate and per-domain physical allocation so a Bevy-scale and an IncQL-scale project coexist instead of evicting each other. (#1230)
• Tooling: Editing a baked project no longer stops incan build and incan run with a demand to bake again. The sealed project output is set aside with one warning and the edit compiles from source against the dependency closure the bake published; reverting the edit picks the sealed output back up. (#1141)
• Tooling: A no-change incan build on a starter project went from 529 ms to 357 ms on the reference machine, and a cold one from 721 ms to 582 ms: Loaf selection materializes only the candidate it picks instead of every compatible family, the compiler is probed once per process with rustc -vV instead of twice, and a packaged provider's sealed digest is served from a tree-stamp memo. incan build --report json now attributes every preparation step under timings_ms. (#1111, #1556)
• Tooling: A sealed closure's shape check is written down once. Every command that selected the standard-library Loaf re-checked its 9,500 files for presence, regularity and containment; the first command now records a closure proof beside the Loaf envelope (or the Oven store, for a leased project plan) and later ones read that record. Warm no-change build 357 → 277 ms, cold 582 → 416 ms on the reference machine. incan inspect oven still rehashes what it audits. (#1546)
• Tooling: Oven validates caller-owned native output bytes against the digest recorded after compilation before reusing them. Changed outputs and old or malformed reuse evidence trigger a rebuild. (#1463)
• Tooling: Native package imports read published Oven stores without changing access bookkeeping or cache files inside the package artifact. This keeps recorded dependency digests stable during import while retaining ordinary consumer-store reuse. (#1458)
• Tooling: Re-baking an unchanged library keeps its packaged-provider dependency digest stable because nested Oven store access markers, leases and accounting caches are not provider content. A real provider-content change invalidates consumer bake reuse and re-seals the test dependency root. (#1979)
• Compiler: Generated Rust accepts a released stdlib within the declared compatibility range, including a patch release after a prerelease requirement. A new major is rejected; before 1.0, a new minor is rejected, and 0.0.x keeps its patch boundary. Linked prerelease stdlibs still require an exact match. (#1481)
• Compiler: Source traits can inherit imported Rust trait bounds without synthesizing conflicting implementations of foreign parents. (#1427)
• Compiler: A subtrait default can satisfy a compatible required method inherited from a supertrait; adopters satisfy both bounds without duplicate or ambiguous methods. (#1825)
• Compiler: Bodyless trait slots omit mut binding patterns for owned Rust-handle parameters while implementations retain mutable local bindings. (#1828)
• Compiler: A child class override is retained when an inherited method calls it, so the call selects the child implementation. (#1841)
• Compiler: Reading __name__ from a generic callable parameter emits the callable-name support required by a passed function item. (#1865)
• Language: A receiverless method, including a static method or trait method, may declare mut on its first ordinary parameter. (#1884)
• Compiler: Qualified Rust enum patterns work through shared and mutable references without cloning the matched value. (#1448)
• Compiler: Checked SDK artifacts retain derive-provider membership, so @derive(toml) remains available through compiled standard-library imports and re-exports. (#1449)
• Compiler: Imported Rust generic trait bounds accept native scalars and collections, with the actual trait obligation checked by Rust during native compilation. Same-spelled Incan traits still require explicit adoption. (#1451)
• Tooling: Declared scripts that resolve to src/lib.incn fail with a located manifest diagnostic naming the script and library path, before Oven generates executable code. (#1068)
• Language: Source literals and runtime numeric strings share one language-owned underscore-separator policy. Malformed source literals produce compile-time diagnostics, while failed runtime int(str) and float(str) conversions retain the original spelling in the canonical ValueError. (#1249, #1278)
• Tooling: Exact signed and unsigned widths, f32, aliases, and checked fixed-scale decimals now retain their compiler-selected carrier through literals, locals, lossless widening, source-local calls, entry arguments and results, Display output and receipts; f64 is float and travels as one. Exact f32 carriers are finite-only: native f32 arithmetic validates each result before it can be stored, returned, compared, or printed, and runtime f32 boundaries use the same canonical ValueError; float retains IEEE non-finite values. (#1279)
• Compiler: Native compilation materializes stored enumerate results as checked list values and preserves later-used values when introducing aliases, including the required generic Clone bounds. (#1249)
• Compiler: Generic callers now inherit implementation-only bounds from the exact checked trait implementation, including across compiled-library metadata, without imposing those bounds on every use of the owning type. The manifest retains the selected trait identity, arguments, associated types, bound origin, and implementation header; private same-program implementation details remain absent from the public artifact. (#1280)
• Compiler: Dependency-interface predeclaration preserves concrete public result types across cyclic and transitive local imports, so chained generic method calls no longer degrade to unknown placeholder types merely because their modules depend on each other. (#1280)
• Language: Sized integers follow Rust's ordinary debug-trap/release-wrap overflow behavior and provide checked, wrapping and saturating add, sub, mul and pow helpers; lossy resize policies accept an explicit destination such as value.try_resize[u8](). Compiler-selected integer abs and builtin sum continue to fail on overflow in every build profile. (#1249, #1561)
• Compiler: String len(value) and value.len() count Unicode scalar values, through the checked builtin or helper identity. (#1249)
• Compiler: isinstance(value, Target) now retains the typechecker-resolved value and target types, any proven nominal target identity, and the target's exact source span in a dedicated Body IR operation. Ambient and explicit std.builtins.isinstance(...) calls consume the same compiler-owned identity, while a source declaration with that spelling remains an ordinary direct call. This does not add arbitrary runtime type values or general reflection. (#1281)
• Compiler: Body IR carries the checked facts the direct route needs instead of leaving them to be re-derived: a mut parameter's argument as a mutable borrow, a value-returning function's trailing expression as its return, an @rust.extern body's delegated Rust item in place of its placeholder, the owner type of a Self parameter and its fields, a static method call as a direct call, a variant of any enum with its payload, a function named as a value as a forwarding closure, the type a trait's associated function is called on (T.default()), a call through __call__, a stdlib function or constant reached through a module binding (math.sqrt, math.PI), membership in a frozen collection, and a name a tuple assignment binds beside a place. (#1337, #2022, #2023, #2025)
• Dependencies: The locked Wasmtime and Cranelift patch releases advance to the 36.0.17/0.123.17 family, and the declared Wasmtime floor rises to 36.0.17. This clears RUSTSEC-2026-0269, RUSTSEC-2026-0314, RUSTSEC-2026-0316, RUSTSEC-2026-0321, RUSTSEC-2026-0322 and RUSTSEC-2026-0323 from the repository security gate without changing Incan's public language surface.
• Tooling: Release-foundation builds compile the locked xz2 dependency's bundled liblzma archive. Oven can therefore retain and verify the archive as build output instead of inheriting a host pkg-config library path. (#1561)
• Tooling: Project-directory codegraph export includes .incn files outside src/, including project tests, while each file's own checked registry, capability, C ABI, and semantic projections take precedence over dependency-context copies. (#1561)
• Tooling: A plain build of a [[rust.bin]] toolchain Loaf refuses build, feature, backend, lock, report, and retired Cargo controls that its stored direct-rustc plan does not honor. (#1561)
• Tooling: A build retains its release-generation lease for the full lifetime of the selected release compiler, including a profile-mismatched or non-envelope toolchain plan. (#1561)
• Dependencies: Equivalent Cargo version requirements select one order-independent dependency identity when project, provider, inline, and development requirements are unified. (#1561)

Verified means verified by execution. The behavior fixtures are the acceptance record: each is an Incan program whose header declares what a run must show, and it holds for whichever route runs Incan programs. The direct route reaches parity when every fixture passes on it, and only then replaces the legacy route.

Source identity is part of that contract. Imports, aliases, re-exports, locals, members, and generic binders should resolve to one canonical compiler identity across diagnostics, LSP features, graph tooling, and backend facts. This removes the backend-emitted Rust name as an accidental source of semantic truth.

Loaf and Oven become the opted-in project authority

For a project that adopts loaf.toml, Loaf expresses authored project intent and Oven owns resolution, targets, provider planning, cache identity, artifacts, receipts, and publication-facing build evidence. oven build and oven bake will provide the build and target-bound asset surfaces; in-Loaf incan run and incan test will use those same plans and receipts.

Cargo remains valid as a legacy format and explicit compatibility/adoption mode. It does not become invalid, and a Rust-only project can choose Oven without adding Incan source. But once a project is Loaf-native, Cargo cannot silently retake authority over its project graph or provider effects.

The authored project manifest is now loaf.toml. incan.toml is not read as a compatibility format — RFC 117 lists preserving it among its non-goals — so a directory holding one is reported as not being a project manifest, naming the file and saying to rename it once its tables satisfy the Loaf schema. Discovery stops at such a directory rather than walking past it to an ancestor project, because whoever put the file there meant it as a project root. [oven.interop] moves in the same transition to [interop.c], under an [interop] root that names each binding kind; its contents are unchanged.

The generated project lock is now oven.lock. It records the same resolved dependency, provider, and interop graph that incan.lock did, under the name RFC 117 gives it, and both authored and generated filenames are lowercase so a case-only difference never means one thing on Linux and another on macOS or Windows. incan.lock is not read: a project that still has one should run incan lock and delete the old file, which no longer contributes to any build. Committed example locks in this repository are renamed with it.

Incan-only, Rust-only, and mixed projects will have deliberate, non-overlapping source roots. Rust facets, direct rustc planning, build scripts, and proc macros remain supported through governed provider contracts. C and other foreign runtimes stay behind explicit interop boundaries rather than being inferred from a source directory.

• Tooling: The toolchain is three Cargo packages, incan-cli (the incan binary), incan-lsp (the language server) and oven-cli (an oven binary over the same handlers incan oven … and incan lock run; built, not yet shipped in the release archives); the lsp Cargo feature is gone. A source build installs each on its own — cargo install --git https://github.com/encero-systems/incan.git --locked incan-cli, and the same command with incan-lsp — and the prebuilt archives still ship both binaries. (#1478, #1481)

• Compiler: Generated Rust links the standard library as one runtime crate per component — incan_std_core always, and incan_std_data, incan_std_async, incan_std_web or incan_std_testing when the program's namespaces reach them — in place of one incan_stdlib crate selected by Cargo features. incan inspect rust and build reports name those crates. (#1481)

• Tooling: A Rust dependency declared as "1" in one place and "1.0" in another no longer refuses to build as a conflict. Version requirements are compared by the versions they admit, the way Cargo unifies them, while every other identity field of a declaration must still agree exactly. The explicit Loaf publisher now declares every checked standard-library dependency on its generated root, so each one is a direct rustc --extern edge of the sealed closure rather than a declaration the fixture happened not to reach. (#1561)

• Tooling: incan oven harvest turns the compatibility publisher's observation of a registry package — the toolchain, target, profile and features of the selection, the cfg answers its build script emitted and the OUT_DIR files it wrote — into an incan.pub fact proposal, one per binding, and refuses by name every package whose script did something a record cannot yet declare. The release publisher writes the same report from its own capture (--harvest-dir), the toolchain manifest pins the registry index commit the release was settled against, and the bake report lists the registry record that governed each adopted unit. (#1561, #1666)
• Tooling: Standalone and release harvests now share one canonical proposal writer, retain byte-identified link/tool/environment observations in typed refusals, prove libm's script-emitted configuration directly from its selected binding, emit explicit empty facts, prevent a refused package from also appearing as a proposal, and support a lock-bound closure inventory that fails on binding or effect drift. (#1561)
• Tooling: Complete compatibility-harvest observations now become typed publisher link and tool facts, while partial work, unbound bytes, unresolved environment values, and conflicting generated-output observations remain evidence-bearing refusals; each generated path has exactly one out or tool producer, and only out inputs are copied beside proposals. (#1561)
• Tooling: Registry Rust facts have typed [[rust.facts.link]] and [[rust.facts.tool]] declarations with portable, digest-bound executable and input identities. Link facts declare sources and a logical library, while generated files, archives, product digests and producer receipts remain admitted asset data. (#1561, RFC 119)
• Tooling: Native link facts now declare one compiler invocation per named object, allowing mixed C, C++, assembly, and per-file flags. The Oven verifies the exact object set and writes a deterministic indexed static archive itself, with per-object arguments and digests bound into the receipt; dynamic libraries remain refused. (#1561, RFC 119)
• Tooling: The release toolchain's standard-library Loaf family carries a runtime foundation settled by the Incan Rust policy engine: every registry dependency of the closure is a prebuilt, sealed unit whose source, build-script output and features the engine validated against the authored [rust-dependencies] declarations, and a registered Loaf registry (incan.pub) may declare a package's build facts so its build script is never run. incan build, incan run and incan test select that foundation with the release's retained compiler and execute no Cargo, no build script and no ambient rustc. The publisher bakes the closure once and republishes it under the final receipt; a refused policy exchange is retained with the rule that refused it. (#1561)
• Tooling: Release-Loaf reuse and mirror import bind the same Loaf-registry authority digest as publication. Registry evidence is independent of Cargo capture order and includes the governing manifest bytes, so an unchanged governed release reuses its exact generation while changed authority rebakes. (#1561)
• Tooling: Build-script closure receipts use portable unit identities and normalized staging coordinates, and compiler-support pruning removes probes belonging only to discarded script dependencies. Repeating the same capture in another staging directory or Cargo message order therefore produces the same receipt. (#1561)
• Tooling: The release Rust policy response is parsed under a strict schema and reports one inert-build-script warning per selected package. Script-emitted environment directives on ungoverned edges remain receipt evidence and do not become selected unit facts; a registry record that cannot carry observed directives is refused. (#1561)
• Tooling: Loaf readers reject malformed provisional unit identities without panicking, admit distinct host and target leaves for one registry package through the manifest's canonical catalog validator, and recompute retained compiler-closure identity from the declared Toolchain members. (#1561)
• Tooling: Cargo harvests and Cargo-free Oven publisher bakes have a literal raw-byte conformance gate that refuses identity, inventory, integrity, and determinism conflicts and emits per-binding registry attestation evidence. (#1561, RFC 119, RFC 125)

Runtime effects become governed and inspectable

The runtime and embedded-language work in this release is there to make real programs and the new backend prove one another. Accepted embedded fragments have typed descriptors, diagnostics, LSP behavior, and a safe formatter contract: structured fragments format structurally; opaque fragments are preserved unchanged.

Authority declarations, grants, execution receipts, redaction, replay, and policy inspection make runtime effects explainable. Source and packages state requirements; Loaf applies project policy and target selection; Oven enforces and records the resulting execution. Source code cannot grant itself host authority.

• Stdlib: std.hash adds keyed authentication with hmac_sha256, covering one-shot tags, an incremental signer, and constant-time verification. An unkeyed digest can only prove a value is self-consistent, since the hash formula is public source; a keyed MAC is what lets a process prove a value it received across an untrusted boundary was one it produced earlier. Verified against the RFC 4231 vectors (#1075).
• Compiler: The nine reserved host.* runtime capabilities are declared in the compiler's own bundled std.runtime source, using the same capability declaration a package uses rather than a separate built-in list. A requires entry can now name one — from std.runtime import host, then requires = [host.fs.read] — and a misspelled host capability is an unresolved-symbol compile error instead of a runtime denial reported somewhere else. Granting and enforcing this authority is not wired yet; this is the declaration and reference half. (RFC 104, #1029)
• Compiler: @provider_operation can name a host capability, so an operation declares the authority it needs the same way it declares a package capability. The decorator resolved its capability reference only through package dependencies, which cannot see the compiler's own bundled std.runtime, so @provider_operation(host.fs.read) was unresolvable. (RFC 104, #1029)
• Compiler: A capability declaration no longer fails compilation. It declares authority rather than code, so it emits no Rust item, but lowering treated it as an unhandled declaration and failed any module containing one — which meant std.runtime typechecked while refusing to build. (RFC 104, #1029)
• Tooling: incan inspect codegraph publishes RFC 104 capability declarations, including each one's description, typed scope dimensions, and the resolved identities of the capabilities it requires. A policy, CI job, editor, or agent can read what a package declares it can do without executing source or parsing a capability block. (RFC 104, #1027)

Inspection becomes a first-class product surface

The CLI, LSP, Architect, MCP tools, and Rust/Oven views will consume the same source and build facts. They should agree about a symbol's identity and range, a package or artifact's provenance, the selected target and provider, and whether information is stale. Rust-aware inspection is deliberately bounded to the workspace, package, target, artifact, and explicit interop edges that Oven needs—it is not a separate compiler.

What must be true before 0.6 ships

• The direct route replaces the legacy route only when every behavior fixture passes on it; a fixture marked pending stays visibly red until then.
• Every build records the route that produced its output.
• Generated Rust remains inspectable, but normal compilation, package contracts, and Oven do not rely on it as a semantic handoff. Reading it now takes a decoding step: every linker-visible Incan-origin declaration is emitted under a reversible incan-v1 identifier that encodes its canonical identity, and a private function carries no source-named alias at all.
• Rust-only, Incan-only, and mixed Loaves can bake without Cargo acting as the project authority; Cargo compatibility remains explicit and well-described.
• Canonical source identities, provenance, source ranges, and stale-state behavior agree across compiler and inspection consumers.

Bugfixes

• Tooling: oven bake publishes a Rust dependency whose library declares several crate types, such as crc-fast with lib, cdylib and staticlib, matching every output Cargo reports and rebuilding the rlib that dependents link. (#2244)

• Compiler: Concrete f32 display on the direct route retains a decimal point for integral values and negative zero without widening fractional digits; printing, str() and interpolation share the corrected runtime formatter. (#1337)

• Tooling: Keep continue match arms multiline so formatting preserves valid syntax (#2222).

• Compiler: Ordinary source libraries reuse their projected standard namespace when linking compiled dependencies, preventing duplicate namespace declarations in nested generated projects. (#1337)

• Compiler: Unnamed generated inspection probes no longer hide selected Rust dependency metadata, preserving public re-export identities while still refusing ambiguous or malformed selected sources. (#1337)

• Compiler: Ordinary Rust inspection follows the declared target dependency when host or transitive crates share its name, and preserves authored dependency aliases. Original source and execution authority checks remain active. (#2215)

• Tooling: Parallel Incan test compilation uses the existing compiler stack size, preventing worker stack overflow on nested expressions without requiring RUST_MIN_STACK. Worker startup failure stops new launches and waits for active work before reporting an error. (#2213)

• Tooling: Rust oven tests invalidates native harnesses after helper-only edits through #[path], include_str! and include_bytes!; unchanged and restored inputs reuse existing outputs, while compilation races refuse publication. (#1337, #1698)

• Tooling: incan fmt preserves top-level section comments and their surrounding blank lines after functions with multi-paragraph docstrings or nested match statements. (#2063)

• Tooling: Ordinary native dependency reuse validates compiled artifacts and the retained dependency declaration without walking archived source bodies. Source inspection still verifies the complete original source inventory; changed native members, substituted declarations and unlisted native files remain errors. (#1337, #1698)
• Compiler: Rust trait metadata searches only the queried crate and its dependencies, so unrelated loaded crates cannot change its implementation candidates. Concrete re-exports include traits declared by their exporting crate, and generic declarations retain their original bounds. Older metadata cache records are re-extracted. (#1337)
• Tooling: A [[rust.facts]] record can no longer declare RUSTC_BOOTSTRAP, in its compile environment or in a link or tool environment. The variable makes the pinned stable rustc accept unstable features, and a fact record about one crate was the one remaining route to that permission, since Oven already clears it from the ambient environment of every direct rustc launch. (#1337)
• std.async: Sender.reserve() type-checks from source and returns a value-less SendError[None] when the channel is closed; reservations do not recover a message value. (#1976)
• Compiler: Model and class constructors build in if, elif, while, match, assertion, comprehension-filter, generator-filter and for expression positions, including through nested field, method, operator, index and cast chains. (#1561)
• Compiler: decimal128[p, s] resolves as the same fixed-scale decimal type as decimal[p, s], including in nested annotations. (#1561)
• Compiler: Integer and float literal suffixes such as 42u16, 7i8 and 3.14f32 select the named exact-width type, and an out-of-range suffixed literal is refused. (#1561)
• Compiler: A d decimal literal is refused with INCAN-T0001 unless its destination is a fixed-scale decimal type. (#1561)
• Compiler: A zero integer part consumes no precision in a fixed-scale decimal literal, so 0.12345d fits decimal[5, 5]. (#1561)
• Compiler: A standard-prelude Mod[Rhs, Output] generic bound exposes its __mod__ hook to % operator resolution while a same-named local trait keeps its own contract. (#1561)
• Language: float is an alias of f64, as RFC 009 specifies: the two spellings are one type, an f64 holds NaN and infinity and displays as a float does, and a float no longer raises ValueError when it becomes an f64. f32 stays finite-only, and an f32 value widens into a float destination. (#1561)
• Language: Arithmetic over two values of one integer type yields that type (i8 + i8 is an i8), an unsuffixed integer literal operand takes the other operand's exact-width type, signed exact-width // and % keep their type with Python's flooring, and ** with a non-negative literal exponent keeps its base's type. +, -, *, // and % over two different integer types are refused with INCAN-T0001 and a hint naming resize() and try_resize(), and so is a prefix - on an unsigned value. A compound assignment x op= y is checked as x = x op y, so n += 1 on an i32 binding, %= with an integer literal on a u16, b //= 2 on a u8 and s *= s on an f32 are accepted. (#1561, #1812)
• Compiler: Every lossless numeric widening the checker accepts now builds: a narrower integer or an f32 reaching a binding, argument, return, field, field or index assignment, collection element, Option payload or union member is widened to the destination's type, and a lookup probe (in, a dict key, count, index, get) to the element or key type. Two integer types compare in the narrowest type holding both, and a pair none holds (u128 beside a signed type) is refused. A numeric type inside a collection, tuple, Option or function type now matches only itself, so list[i8] is no longer accepted as a list[int], which built nothing. (#1561)
• Language: int is an alias of i64, as RFC 009 specifies: i64, long and bigint are the one int type, so a mut parameter spelled with any of them is the function's own copy that its body may rebind, and a function type refuses the mut marker on it as it does on int. (#1561)
• Language: Bit arithmetic follows RFC 009's same-type rule: &, | and ^ over two values of one integer type yield that type, << and >> yield their left operand's type, and ~ keeps its operand's type, so u8 & u8 is a u8 and flags |= 1 on a u8 binding is accepted. &, | and ^ over two different integer types are refused with INCAN-T0001, and an unsuffixed integer literal operand takes the other operand's exact-width type. (#1561)
• Language: Every exact-width numeric type satisfies the Clone, Debug, Display, Default, PartialEq and PartialOrd bounds, and every exact-width integer type the Eq, Ord and Hash bounds. (#1561)
• Language: The arms of a match have one type in every position, a match used as a statement included. A literal arm takes the type of the place the match is written to, a narrower numeric arm is widened and a payload arm is wrapped in Some in the arm itself, and arms that share no type, such as "zero" beside 5 or i8 beside u8, are refused with INCAN-T0001. The break values of a loop: expression are widened the same way. (#1561)
• Language: A yield of a narrower numeric value into a Generator[int] is widened to the element type, as a returned value is. (#1561)
• Language: A tuple, list, dict, set, frozen collection, Option or Result that holds a generator, a function or a bytes value at any depth has no printed form, and print, println, str(...) and an f-string {value} refuse it with INCAN-T0103. (#1561)
• Language: A generic function or method that uses its type parameter as a set element or dict key through a dict or set type it holds, an index write d[key] = value, or a set or dict method such as add or insert requires Eq and Hash of that type parameter: its generated code builds, and a call binding the parameter to a type without them, such as float, is refused with INCAN-T0114. (#1561)
• Tooling: SDK preparation in an installed toolchain uses its packaged support-workspace lock before any enclosing checkout lock, keeping component dependency selection tied to the shipped toolchain. (#1561)
• Tooling: incan build and incan run link the compiled standard-library component selected by a source module import, including std.testing, when the program also consumes a packaged library. (#2011)
• Compiler: A trait-qualified Rust call such as Mac.update(self.handle, data) passes its receiver as the trait's method declares it (&mut self, &self or self), and a trait-qualified call on a known trait whose method signature is unavailable, or whose method the trait does not declare, is refused at check time. (#1375)
• Compiler: A method call through an explicitly imported Rust extension trait that the compiler has no inspected metadata for, such as value.borrow() after from rust::std::borrow import Borrow, builds. (#1450)
• Compiler: Default is usable as a generic bound: [T with Default] accepts a @derive(Default) type and builds. (#1374)
• Compiler: Library compilation reuses checked provider identities within a compilation session while revalidating provider and support files before reuse. SDK manifest rewrites invalidate the parsed-manifest cache even when file size and modification time are unchanged. (#1633)

0.6 is not released yet, so this list carries only fixes that are merged, regression-tested, and part of the release branch's supported behavior.

• Compiler: A dependency's exported enum variant no longer hides a derivable trait of the same spelling. The trait bound on the module's functions, its __derives__ metadata, and a direct from module import Trait derive all resolve the trait declaration whichever of the two is declared first, so a module derive satisfies the bound and the direct derive is no longer reported unknown. (#1429)
• Compiler: Adopting a source trait that merely shares the spelling Serialize or Deserialize no longer injects serde derives or the to_json / from_json methods of std.serde.json. The JSON protocol keys on the identity the compiler proved for the adopted trait, which follows a facade re-export to the declaring std.serde.json module, so a local or third-party trait of that name compiles to an ordinary empty impl while the stdlib traits keep their behavior under every import spelling. (#1431)
• Compiler: A module import used only by a module derive is retained under the binding the source chose, so import codec as formats with @derive(formats) keeps use crate::codec as formats; beside the emitted trait impls, and a compiled standard-library bundle reached through from std import toml keeps its SDK projection instead of resolving the external toml crate. (#1434)
• Interop: Native baking accepts a receipt-bound project extension and its exact installed base Loaf, fixing automatic C-interop bootstrap after the move to shared runtime closures. (#1561)
• Tooling: Oven accepts equivalent symlinked and canonical project-root spellings when retaining completed output, while rejecting files outside the physical project root and symlinked output files. (#1589)
• Inspection: Codegraph schema 8 distinguishes same-named local declarations and parameters by their checked owner and binding ordinal, preserving identities across comments, unrelated insertions, and top-level reordering. (#1629)
• Compiler: Comments in an imported trait definition no longer change the generated std.io code by accidentally selecting type facts from matching offsets in the importing module. Local trait defaults retain their own checked expression types. (#1592)
• Tooling: The helpers a vocabulary desugarer receives from providers or exports whose names differ only in non-identifier characters, such as providers a-b and a_b, stay distinct instead of shadowing each other. (#1380)
• Compiler: Module collection keys source files by identity rather than by the path spelling they were reached through. An entry spelled through a symlink whose import cycle reaches back into it (macOS keeps its temporary directories behind one) was collected twice, and the module graph refused the pair as a duplicate module identity. (#1557)
• Stdlib: Integer Duration constructors clamp negative inputs to zero, and Duration.from_millis preserves exact seconds and nanoseconds across the full nonnegative int range. (#1630)
• Compiler: A generic model or class whose type parameter appears only in method signatures, such as model Column[T]: sql: str with def __mul__(self, other: T) -> Column[T], builds and runs; its Debug output and field reflection list only its fields, and an explicit constructor type argument such as Column[str](...) is kept. A newtype whose underlying type does not mention a declared parameter, or an enum none of whose variant payloads mentions one, is refused at check time at the parameter. (#1370)
• Compiler: Four generic-bound and type-argument diagnostics no longer mislead. A with bound that names a type rather than a trait is reported as such instead of asking the reader to "implement float", and a failing explicit type argument is named as the type argument rather than "the argument type"; a call that no overload accepts lists every candidate with the reason it was rejected instead of only the first-declared one's bound; an unknown name in a callable's type position suggests declaring it as a type parameter (def widen[U](...)) before suggesting an import; and a short explicit type-argument list names the parameters it left unbound and shows the _ placeholder that infers them. (#1373)
• Compiler: A mut Dict parameter now takes the same generated-Rust shape as a local dictionary: files[key] = value inserts, key in files probes contains_key, and files.get(key) borrows its key, instead of indexing or contains calls that rustc rejected on &mut HashMap. (#1668)
• Compiler: dict.keys() and dict.values() outside a comprehension materialize the list the typechecker reports, so sorted(d.keys()), key in d.keys(), and len(d.values()) compile; for loops and comprehensions over them keep a direct iterator and now bind owned items, so out.append(value) inside the loop no longer pushes a reference. (#1668, #1461)
• Compiler: list(source) is a real conversion: it collects exactly what for item in source yields (a list's, set's, frozen list's, or frozen set's items, a dict's keys, one-character strings from text, integers from bytes, an Iterator's or generator's items, or a Rust iterator's items) and an empty list() adopts its annotated element type. The call typechecked but reached the generated Rust as a call to an undefined list function; a source that cannot be iterated, such as a scalar or a tuple, is now a type error. (#1464)
• Compiler: A list or dict comprehension over a by-value Rust iterator such as rust::std::env::args(), or over a generator, consumes it through IntoIterator exactly as a for statement over the same value does, instead of borrowing it with .iter(), which the type does not have. (#1490)
• Tooling: SDK provider identities stay stable when a consumer uses only part of a compiled standard-library provider. Nested commands no longer reject a matching provider solely because its unused runtime facets were absent from the consumer's identity catalog. (#1481)
• Compiler: Native package consumers retain compiler macro dependencies used only in a provider's child modules, including function-only facades. (#1467)
• Compiler: Loops over nested literals such as [[], ["x"]] infer the string element type without an extra caller annotation. (#1471)
• Compiler: import module::item compiles to the same canonical call as from module import item. The Rust-style spelling typechecked but native compilation named the item by its source name with no matching import in scope, so the generated crate did not compile. (#1441)
• Compiler: A local function called inside a lambda passed to a Rust method builds. (#1492)
• Compiler: A module-qualified type in an annotation, such as Result[None, toml.TomlError] after from std import toml, resolves to the same declaration as importing TomlError directly; a qualified spelling that names no type is refused at the annotation. (#1437)
• Compiler: Deque[str].from_iter(...) and every other type application keep their type arguments, so a string literal appended to the result builds. (#1494)
• Tooling: A command that has to wait for the SDK provider store lock says so, naming the store and the fact that another Incan process holds it, instead of blocking silently. A three-file incan inspect codegraph that sat in flock for half an hour looked like a compiler hang. (#1514)
• Tooling: A Loaf project that also holds a Cargo.toml builds with one warning naming the ignored file; a directory holding only the retired incan.toml stops project discovery with an error asking for the rename rather than being stepped over. (#1008)
• Language: {{ and }} in an f-string render one literal brace, as in Python, so f"{{{name}}}" prints {x}; both characters were reaching the output. (#1562)
• Tooling: A workspace member that carries a feature-selecting dependency edge can be baked inside its workspace. A command's --features selection no longer rewrites the shared root lock, an explicit provider bake publishes the root lock with every member that can already resolve, and a member's sealed authority binds only its own lock entry, so baking providers leaf-first no longer invalidates each other. (#1414)
• Tooling: incan oven bake --target TRIPLE can request an explicit Rust target instead of the active compiler's host target. The target is bound into receipts, completed outputs, warm reuse, structured reports, and release-policy publication; unavailable target toolchains or dependency closures still fail explicitly rather than falling back. (#1561)
• Tooling: Release archives retain the exact support and SDK locks used to prepare their installed components, resolve Cargo through an explicit executable or the selected Rustup toolchain, and publish the ordinary Loaf family before the explicit release-policy bake rebuilds and retains its target-bound runtime closure. A normal command that selects that release's ToolchainLoaf acquires only the same-generation retained compiler and admitted closure, refusing missing or invalid evidence rather than baking it. This does not yet prove #1561 acceptance for every policy or provider path. (#1561)
• Compiler: Source-backed standard-library module imports retain the trait metadata required by their qualified codec functions. Models using @derive(toml) satisfy TOML codec bounds with either module import spelling and with aliases. (#1473)
• Compiler: Equality assertions accept inline model constructors on either side of the comparison without requiring an intermediate local binding. (#1470)
• Compiler: Reference-aware assignments preserve an existing borrow and materialize known borrowed values at owned destinations. Read-only nominal helpers and tree cursors can infer shared borrowing from complete local use and checked Rust receiver lifetimes, avoiding copies of ancestor subtrees. Crate-visible and inherent method entry points retain their callable ABI; mutation, escapes, overlapping call arguments, and unknown contracts keep owned behavior. (#1455)
• Language: Plain assignment inside a nested block now reassigns the nearest enclosing binding — requiring mut and a compatible type — instead of silently creating a new block-local; let and mut remain the explicit shadowing forms, and mut name = value now declares a new binding over an active name rather than being rejected as mutation of an immutable one. This brings assignment behavior to the documented scoping contract. (#1072, #1248)
• Language: print and println now render every argument, space-separated. Previously every argument after the first was silently dropped in generated Rust, with no diagnostic. (#1248)
• Language: print and println are protected builtin bindings: source declarations, imports, parameters, and local bindings cannot replace them. Fields and methods with these names remain valid. (#1249)
• Language: Duplicate declarations and same-spelling imports are now rejected by one frontend binding registry instead of silently replacing whichever declaration was seen first. Imports are reported as ambiguous when their canonical targets differ or cannot be proven equal; an explicit alias resolves intentional conflicts. The immutable line-output spellings print and println cannot be reused for ordinary lexical declarations or imports, while member names and ordinary builtin spellings such as len remain available under their normal namespace rules. (#1042)
• Compiler: Unreachable code after an unconditional return is reported. (#1117, #1134)
• Compiler: A package that calls between its own modules again projects the callee's emitted name. A package origin identifies which library declares a method; it does not make that method foreign to the build producing it, and reading it as foreign made a package decline to name a wrapper it was itself emitting. (#1174)
• Compiler: A Result-returning main retains ordinary runtime panic diagnostics and requested import this output, matching the existing setup in other entrypoint forms. (#1249)
• Language: A match written as a function's last statement now returns its value instead of being discarded, and every arm converts to the type the match produces. The documented spelling for pattern alternation previously emitted let _ = match ...;, so a value-returning function built from it produced Rust that would not compile, and str arms stayed borrowed where an owned String was required. (#1386)
• Tooling: A vocabulary companion may bind a helper to any callable spelling on its package's public surface, including a public partial and a reexport alias, and its own build now rejects a binding that resolves to something uncallable through a chain of aliases. The provider's build and every consumer's frontend read one export authority, so a helper the provider published can no longer be rejected as missing by the consumers that import it. (#1031)
• Editor integration: Signature help, scoped-symbol resolution, completion context, and call-site type arguments now reach inside an embedded fragment's expression holes. A hole is ordinary Incan that the compiler already typechecks, but the editor treated the whole fragment as opaque, so a call written inside one silently lost tooling that works everywhere else. One shared traversal now answers which expressions a fragment owns, for the compiler and its tooling alike. (RFC 081, #1022)
• Tooling: incan fmt renders an embedded fragment from its structured tree, and preserves the original source verbatim only when the claiming descriptor declares itself layout-sensitive. The formatter previously preserved every fragment verbatim regardless, which is the third fallback state RFC 081 rules out; a descriptor's layout_sensitive declaration was recorded and never read. (RFC 081, #1022)
• Editor integration: Hover and go-to-definition now stop at an embedded fragment's ownership boundary. Both resolved names by scanning source text, so a markup tag name or a style declaration property — perfectly good ASCII identifiers — resolved against ordinary Incan scope and answered with whatever unrelated local happened to share the spelling. DSL-owned syntax now reports which submode and which library own it; expression holes, being ordinary Incan, keep every tooling path they already had. (RFC 081, #1022)
• Tooling: incan fmt keeps a RegexTemplate fragment's backticks and ${...} delimiters, and formatting a file with a verbatim-preserved fragment is a fixed point; all six accepted submodes round-trip. (RFC 081, #1022)
• Editor integration: The language server now answers textDocument/semanticTokens/full, so editors highlight Incan from the compiler's own reading of a file rather than from a regex grammar. Declarations take the kind of the thing they declare, type positions come from the parsed program instead of from capitalization, member access separates a called method from a read property, and an f-string's interpolated expressions are highlighted as code rather than as string content. Embedded fragments are highlighted as their own submode, so a markup tag or a style selector never renders as an Incan local, while the expression holes inside a fragment do. A file that does not currently parse keeps its highlighting, losing only type positions and fragment ownership. (RFC 081, #1400)
• Compiler: import module::item binds the item with its declared signature, so a call through it has the item's return type, and examples/advanced/multifile typechecks again. (#1407)
• Tooling: A vocabulary companion no longer has to declare a helper binding for every helper it emits. An unbound helper key resolves directly against its package's checked public surface, the same surface an ordinary consumer imports through; an explicit binding remains the override for a key whose export spelling deliberately differs. A companion that listed its own package's export names was maintaining a second copy of that surface, kept honest only by a test. (#1032)
• Tooling: incan fmt no longer rewrites valid source into different or broken source. An enum's with <Trait> adoption was dropped entirely, a byte literal's escaped quote and backslash were unescaped so the literal no longer terminated, and a guarded match arm was rewritten into an arrow form the parser rejects. Every committed example is now round-tripped by a property test that asserts the result still parses and is a fixed point. (#1401)
• Compiler: A destructured constructor binding in Body IR carries its declared payload type and the ownership fact that follows from it. case Shape.Circle(v) | Shape.Square(v), if let Some(v) = o, and assert o is Some(v) all bound v as an unresolved type because only Ok/Err payloads were split; the typechecker now records every pattern node's checked type and the one pattern walk reads it back. (#1245)
• Compiler: A const annotated list[T], dict[K, V], or set[T] is rejected at the annotation, naming the FrozenList[T]/FrozenDict[K, V]/FrozenSet[T] the constant actually carries and the spelling to write instead. The annotation was silently retyped, so the first call that passed the constant to a list[T] parameter failed with a mismatch naming a type the author never wrote. str/bytes annotations still freeze silently, since FrozenStr/FrozenBytes read wherever str/bytes is expected. (#1488)
• Docs: The std.datetime capability catalog spells its interval form as TimeDelta.days(1) and lists its import form; TimeDelta(days=1) never compiled, since TimeDelta has three required fields. A compiler-suite root now builds the cataloged forms of a self-contained entry as a program, so a documented form that does not compile fails the suite rather than reaching the reference. (#1385)
• Language: A float renders as Python spells it in every display position — f-string {x}, str(x), print/println — so an integral value keeps its decimal point: f"{100.0}" is 100.0, 100.0 / 4.0 prints 25.0, 1e16 is 1e+16, and the non-finite values are inf, -inf, nan. Rust's Display dropped the point, so text a program emitted (SQL, JSON, CSV) carried an integer where it meant a float. An f64 is a float and renders as one; an exact f32 keeps its native spelling. (#1372)
• Compiler: A user facade that republishes a compiled standard-library function, such as pub from std.regex import compile, now binds the same provider declaration a direct import binds, so a call through the facade that omits defaulted parameters compiles. Checking accepted the omitted arguments while the generated call passed only the written ones, and rustc rejected the build. (#1435)
• Compiler: A decorator whose parameter and return explicitly name a published union alias, such as def preserve(func: (Answer) -> Answer) -> ((Answer) -> Answer) over a dependency's pub type Answer = int | str, keeps the dependency's union representation on the decorated function. The decorated static was typed with a consumer-local wrapper while the decorator returned the dependency's, and native library baking failed. (#1453)
• Compiler: A model or class constructed with named arguments written out of declaration order evaluates those arguments in the order written. Document(intent=inspect(source), evidence=Evidence(source=source)) moved source into evidence before intent had read it, and the generated Rust failed with E0382; lowering now binds such arguments to temporaries in written order and assembles the fields afterwards. (#1462)
• Compiler: Returning a for loop's variable as an Ok or Err payload compiles: the payload now goes through ownership planning, so a binding iterated by reference is cloned where the Result needs the owned value instead of reaching rustc as &Vec<String> (E0308). Alongside, the final read of an owned local inside a return operand is treated as its last use however many loops or match arms surround the statement, which removes clones at returns rather than adding them. (#1489)
• Compiler: An empty list literal compared against a list[T], in either position and with either equality operator, carries T from the typechecker onto the literal, so the generated Vec::<T>::new() no longer depends on the emitter recovering the element type from the other operand and the comparison is never an ambiguous PartialEq (E0283), including with the JSON dependency linked. (#1476)
• Compiler: A std.serde.json trait imported under an alias, from std.serde.json import Serialize as JsonSerialize, works in every position the alias can appear in. @derive(JsonSerialize) and T with JsonSerialize were accepted, but a to_json() call through the bound emitted the alias inside the stdlib path (json::JsonSerialize, E0433); the dispatch path now names the declaration the alias resolves to, the identity the compiler already proved for the import. (#1712)
• Compiler: The std.rust callable markers Fn[...], FnMut[...] and FnOnce[...] compile as bounds whose type arguments are the callable's parameter list, satisfied by a named function or closure that takes those parameters, and incan check refuses a function whose arity or parameter types do not match the marker. A marker names at most two parameters, on a function or method's type parameter; a marker with more, or on a model, class, enum, trait, newtype or type alias parameter, is refused with INCAN-T0106. (#1716)
• Compiler: A builtin trait imported under an alias, from std.derives.comparison import Eq as Equality, works as a generic bound: T with Equality lowers to the same Rust trait as T with Eq, which a @derive(Eq) type implements, where before the bound named the alias's source trait and the build failed. A user trait that merely shares a builtin's name keeps its own path.
• Compiler: str(a + b) renders the whole sum, and so does str(...) over any negated, cast or arithmetic argument; a float argument keeps its Python spelling. (#1726)
• Compiler: Importing Clone, Copy, Default, Debug, Display, Eq, Ord or Hash from its std.derives.* module keeps the module's generic bounds working: the import names the trait for @derive(...), with and bounds, so from std.derives.copying import Clone beside an adopter of FallibleIterator builds and a T with Copy bound accepts a derived type. (#1727)
• Tooling: The release-Loaf publisher publishes a closure whose build scripts emit configuration through rustc-env under names no registered compiler fact covers; libm emits CFG_CARGO_FEATURES=["arch", "default"] and two siblings for its own test logging. That output stays bound to the capture receipt through the build-script closure digest, and a registered name a script emits is still carried in the graph. (#1704)
• Tooling: The Rust toolchain a release Loaf carries ships the host's self-contained linker, lib/rustlib/<host>/bin/rust-lld and the gcc-ld/ wrappers, so a binary links from it on x86_64-unknown-linux-gnu, where that linker is the default since Rust 1.90; a closure retained without the linker is observed afresh rather than reused. (#1732)
• Tooling: A compiler probe (rustc -vV, --print sysroot, --print cfg) runs without the inherited LD_LIBRARY_PATH, DYLD_LIBRARY_PATH and DYLD_FALLBACK_LIBRARY_PATH, as it runs without the Cargo variables, so a copied or store-retained toolchain reports its own sysroot and Oven retains it as its own closure. (#1755)
• Language: not and unary - over an operator expression apply to the whole expression. not (1 == 2) was emitted with the negation bound to the first operand alone, so it built and printed false; the same grouping was lost for not x == y, -(a + b), not (a and b), not bool(n) and ~(a | b). The operand of a prefix operator now keeps its grouping through lowering, so every such expression prints what the language reference promises. (#1763)
• Compiler: A consumer that narrows a dependency's published union alias read through a dependency-owned pub model field, such as match measure.expr: over pub type ColumnExpr = Union[IntLiteralExpr, StringLiteralExpr], builds, as do a binding copied from the field and the elements of a List field iterated in a loop. (#1697)
• Compiler: A str literal nested inside a tuple, constructor or Option pattern, such as (_, "answer") => or Account(type="premium") =>, selects its arm; a top-level literal arm is unchanged. (#1707)
• Compiler: A constructor pattern that names a subset of a model's or class's fields, such as Account(tier=1) => or the RFC 021 alias form Account(type="premium") =>, compiles. The generated struct pattern omitted the other fields and rustc refused it with E0027; the typechecker now records the fields a partial pattern leaves unnamed and lowering spells each as a wildcard. (#1708)
• Compiler: A tuple pattern over a value annotated tuple[int, str] binds its names with the element types, so (number, word) => println(f"{number} {word}") works like it does over a tuple literal. The written annotation resolves as the generic Tuple spelling, which the pattern check did not destructure, so the names were never bound. (#1714)
• Compiler: A pattern alternation whose alternatives carry str literals below the top of the pattern, such as (0, "a") | (1, "b") =>, Some("alice") | Some("bob") => or (n, Some("a") | None) =>, and a top-level "a" | _ over a str value, select their arm in match and if let instead of failing to build. A guard after an alternation runs once, for the first alternative that matches (#1739).
• Compiler: A constructor pattern that names only the public fields of a model or class with private fields, such as Account(kind="premium") => over an imported pub model Account, builds; the fields it leaves unnamed match any value (#1740).
• Compiler: Some(x) passed, bound or returned where Option[A | B] is expected wraps x into the union, so describe(Some("plain")) against Option[LocalPath | str] and Some(FROZEN_TEXT) against Option[FrozenStr | int] compile like the bare member already did. The checker now records the constructor's instantiation at the union as the call's parameter fact, and the argument takes the union's wrapper at the call; the generated Some("plain".to_string()) used to fail with E0308. (#1724)
• Compiler: Result.inspect and inspect_err with a named function over a Copy payload compile: result.inspect(observe_int) passed the by-value fn item where the std.result helper takes a borrowed observer (fn(&T), for every T), and rustc refused it with E0308 while a callable object or a non-Copy payload worked. The observer is passed as a non-capturing closure that reads the payload through the borrow. (#1718)
• Compiler: list(source) and a comprehension over a Generator[T] source build and run. The runtime generator's own collect (the shape gen.collect() relies on) shadowed the Iterator trait's on an owned receiver, so the generated .collect::<Vec<_>>() was refused with E0107; both paths now reach the trait's adapters by name. (#1464)
• Language: FrozenList([...]), FrozenDict({...}) and FrozenSet([...]) are refused at check time with the documented spelling, const NAME: FrozenList[T] = [...]. The language defines no value constructor for a frozen collection; the call was typed as unknown and passed checking, and the build failed on a Rust constructor that does not exist. (#1719)
• Compiler: An annotated tuple literal gives its elements the annotation's element types: pair: tuple[Option[str], int] = (None, 1), (Ok(1), 0) as a tuple[Result[int, int], int], and a None element of a tuple[T, Option[T]] or list[Option[T]] literal in a generic body build instead of failing in rustc (E0308). (#1847)
• Compiler: A list, dict or tuple literal at an Option or union destination takes the destination's one member of its kind, so a = [] and b = [None] for an Option[list[...]] or list[int] | str binding build; an empty or None-only literal at a destination with two members of its kind (list[int] | list[str]) is refused with INCAN-T0001. (#1832)
• Compiler: An integer literal at a float, f32 or f64 destination is the float of the same value, in a declaration, a reassignment, a chained assignment, a field, a parameter, a default, a returned value and a tuple, list or dict element, and builds instead of failing in rustc (E0308); an int value at such a destination stays refused. (#1831)
• Compiler: An integer literal written to an element of a list[float] or a value of a dict[str, float] (xs[0] = 3, d["k"] = 1) is the float of the same value; the checker refused it, while the same literal in the collection's declaration was accepted. (#1854)
• Compiler: A value written to an Option field, element or return type is wrapped in Some: return 5 in a function returning Option[int], box.items = [1] and Box(count=5) for Option fields, and slots[0] = 5 for a list[Option[int]] build instead of failing in rustc (E0308). (#1858)
• Compiler: An integer literal takes the float type in more positions: an Option[float] or float | str destination, an Option[float] parameter, the payload of Ok(1) at a Result[float, str], the argument of xs.append(1), d.insert("k", 1), o.unwrap_or(0) and x.powf(2), and an argument of a generic call whose other argument binds its type parameter to float (pick(2.5, 1)). (#1859)
• Compiler: A value assigned to a binding of a nested Option type is wrapped in each Option layer: a: Option[Option[int]] = 5 holds Some(Some(5)), and [] or [1] at an Option[Option[list[int]]] binding build instead of failing in rustc (E0308). (#1860)
• Compiler: An empty list or dict literal passed to a generic parameter such as list[T] or Option[list[T]] takes the element type the call's other arguments bind (first_or([], 5) passes a list[int]), and a call where nothing binds the type parameter (count([])) is refused at the literal with INCAN-T0001; the literal named the callee's T in the caller, which failed in rustc (E0425, E0308). (#1862)

• Compiler: unwrap_or on an Option[str] passes a str binding as the owned fallback it returns, in a call, an f-string, an assignment and a return, instead of a reference that failed in rustc (E0308). (#1875)

• Compiler: A method that assigns to a field, writes an element of one, or calls a method that changes one (self.items.append(x), self.items.pop(), a mut self method of its own) while its receiver is a plain self is refused at check time with INCAN-T0102, naming the method, the place it writes and the mut self receiver to declare. The generated Rust borrows a plain-self receiver shared, so the write only failed in the build (E0594/E0596); classes, models, trait default methods and trait implementations are all covered. (#1723)

• Compiler: A Tuple or tuple annotation written without its element types is refused at check time with INCAN-T0104, suggesting tuple[int, str]; the bare word named a Rust type that does not exist (E0425). A source type that takes the spelling for itself still resolves as that type. (#1717)
• Compiler: A Rust associated call that leaves its owner's type arguments open, such as HashMap.new() on rust::std::collections::HashMap, is refused at check time with INCAN-T0105 when nothing later can fix them: the value is bound to a local nothing reads, or is not bound at all. A binding a later statement reads (an insert, a typed return) and an annotated binding stay accepted, since Rust infers from those; the bare shape failed the build with E0282. (#1720)
• Compiler: print, println, str(value) and an f-string {value} display a value alike: a tuple, list, dict, set, Option or Result displays its structure in each. A value with no printed form (a union value, a generator, a function, bytes, or a model, class, enum or newtype that provides no Display) is refused with INCAN-T0103 there and as the type argument of a Display bound. (#1725, #1748)
• Compiler: A type that adopts Error and has no Display of its own displays its message() in every display position (an f-string {error}, str(error), print and println, or std.builtins.str / std.builtins.println) and satisfies a Display bound such as def show[T with Display](value: T) -> str, whether it is a model, class, enum or newtype. A value of a type parameter bounded by Error, and self in a default method of a trait that extends Error, render the same way, decided per adopter, so an adopter with its own __str__ keeps it. (#1561, #1748, #1778)
• Compiler: A list, dict, set, Option or Result annotation, a frozen collection or a Generator written without type arguments is refused with INCAN-T0104, alone or nested (Option[List]). (#1749)

• Compiler: A name the source declares or binds with the __incan_ prefix is refused with INCAN-T0111; a type's __incan_new constructor hook is exempt. (#1769)

• Compiler: A function re-exported under a new name at two facades in a row, pub from provider import calculate as facade_calculate and then pub from facade import facade_calculate as exported_calculate, is callable from a consumer that imports the last name. The second facade published only its own alias and never the declaration's projection, so the consumer's import was unresolved (E0432); the checker now records, beside an import's identity, the name the declaring module binds it under, and lowering spells a re-export hop by that name exactly as a single-level pub from … import … as … is spelled. An imported alias declaration keeps its own spelling. (#1710)

• Compiler: A model that declares a @staticmethod and an instance method under one spelling, Counter.next(4) beside counter.next(), compiles: both call sites already selected their declaration, but lowering dropped the pair from the inherent impl as a name collision Rust cannot express, so the type-owned call named a projection the impl never defined (E0599). Every inherent method is emitted under its identity projection, so the pair stays, including a static factory chained into an instance method of the same name over a field of that name (Span.days(-7).days(2)). (#1709)

• Language: A model, class or enum written with Awaitable[T] is refused at the adoption, naming why: Awaitable[T] is realized only as a generic bound, and a model or class always derives Clone and Debug, which the JoinHandle[T] such a wrapper holds cannot be. The reference page's wrapper example passed incan check and then failed to build, since no Rust trait backed the adoption (E0405). A bound F with Awaitable[T] now lowers to the async runtime's Awaitable<T> trait, so generic code that awaits its parameter builds. (RFC 039, #1711)

• Compiler: An explicit compilation-unit or package registry entry (capabilities.entry(key=…, subject=RegistrySubject.current_unit(), descriptor=…)) builds under incan run. Lowering checked the entry call against one spelling of its identity, the one the in-process tests produce, and refused the spelling the compiled standard library gives the same call; it now verifies the checked identities and spells the checked subject constructor the way the placeholder was spelled. (RFC 113, #1713)
• Compiler: A std.serde.json Serialize or Deserialize bound, parameter type or -> Serialize return builds, with to_json(), T.from_json(text) and json_stringify over its value. A newtype that derives Serialize or Deserialize provides them as a model does. (#1820)
• Compiler: list.append takes a newly built value whose type is not Clone, such as handles.append(spawn(work(n))). Appending such a value read from a name, field or element is refused (INCAN-T0001). (#1821)
• Compiler: After from std import serde, serde.json.Serialize and serde.json.Deserialize name the std.serde.json traits after with, as a bound, a parameter type and a return type, as json.Serialize does after from std.serde import json. (#1887)
• Compiler: A module-qualified derive, @derive(json.Serialize) or @derive(json.Deserialize) (or through serde.json after from std import serde), adopts the trait it names as @derive(Serialize) does after from std.serde.json import Serialize; a qualified derive that names no derivable trait is refused (INCAN-T0001). (#1885)
• Compiler: A trait declared with Serialize (the std.serde.json trait, under any spelling) builds: its adopters get to_json() through it and json_stringify accepts a value bounded by it, and an adopter that also derives Serialize implements the trait once. A type that adopts two traits sharing a supertrait implements that supertrait once, and a builtin supertrait its derives already implement (trait Keyed with Eq beside @derive(Eq), or with Clone on a model) is not implemented again. (#1845)
• Compiler: A trait written inside another type in a callable signature or a local annotation, such as -> Option[Serialize] or items: list[Shape], is refused by incan check (INCAN-T0001), naming the trait and the type; the build used to fail with a bare trait in the Rust type (E0782). A whole parameter or return type naming the trait is unchanged. (#1866)
• Compiler: A model, class or enum that derives or adopts Serialize or Deserialize needs the trait of each field or payload type: a member whose type is, or holds, a model or class that does not provide it is refused by incan check (INCAN-T0001), naming the member and that type, where the build used to fail. A model or class that provides only one of the two traits no longer counts as providing the other, here or in a route's JSON payload check (INCAN-T0112). (#1886)
• Compiler: A newtype that derives Serialize or Deserialize needs the trait of its underlying type, as a model needs it of its fields, and a construction of a generic newtype, model or class whose type argument, written (Boxed[int](1)) or inferred (Boxed(1)), does not satisfy a bound the type declares (newtype Boxed[T with Serialize]) is refused by incan check (INCAN-T0001), where the build used to fail. (#1867)
• Compiler: A type pattern over a union covers only the values selected by its nested pattern; int(0) no longer counts as covering every int value in an exhaustive match. (#1876)
• Compiler: Some, Ok and Err patterns accept exactly one payload sub-pattern; extra sub-patterns are refused during checking instead of producing invalid Rust patterns. (#1877)
• Language: An f-string format specifier other than ? is refused with INCAN-T0001 instead of being discarded from the formatted output. (#1834)
• Language: FrozenStr, FrozenList, FrozenSet and FrozenDict use the same display shapes as their ordinary counterparts, including quoted strings and integral floats with a decimal point; FrozenBytes, like bytes, has no display form. (#1838)
• Language: A union value nested inside a collection displays as its active member value instead of exposing the generated union variant name. (#1833)
• Compiler: The documented std.web surface builds. .value on a Query[T] or Json[T] from std.web reads the payload the extractor holds as its tuple field (E0609); a Json or Query the program declares or imports from elsewhere keeps its own value field. A declared Html return type is the text response Html<String> (E0107). A route payload with no JSON form, directly or inside a collection such as Json[list[Search]], is refused by incan check (INCAN-T0112) instead of failing the handler registration in the build (E0277). (#1768)
• Compiler: A module-qualified standard-library web type such as web.Html or web.Json[T] names the same surface type as its direct import. (#1824)
• Compiler: App, Response and Request from std.web are recorded as non-Clone, so a kept dict.get result over one is refused with INCAN-T0118; a lookup used only to read the value remains accepted. (#1830)
• Tooling: In a source checkout, incan run, incan build, incan oven bake and test collection read a file with the same standard-library vocabulary as incan check: they reuse the SDK component inventory incan check publishes, without ever building it, where they used to find none and refused a checked C binding declaration as a syntax error. When no inventory is published, or its identity cannot be computed (a standard-library source mid-edit), non-writing consumers proceed as before; the incan oven bake lock-write refusal is described below. (#1774)
• Tooling: incan oven bake no longer drops SDK state that the existing project or workspace-member lock records. Without a discoverable SDK inventory, it refuses to rewrite such a lock, leaves it unchanged and directs the user to incan lock, which prepares and publishes the inventory before the bake is retried. A lock without recorded SDK state is written as before. (#2007)
• Tooling: incan run FILE -- ARG ... passes ARG ... to the executed program for both selected and freshly prepared Oven outputs. (#1883)
• Tooling: The runtime-foundation rebuild launches its store-retained rustc without the inherited LD_LIBRARY_PATH, DYLD_LIBRARY_PATH and DYLD_FALLBACK_LIBRARY_PATH, through the launcher the compiler probes use since #1755, so a rebuilt unit is compiled by the retained closure's own driver rather than one the caller's loader path names. (#1785)
• Language: A model or class field, or an enum variant payload, whose type does not implement Clone and Debug, such as a JoinHandle[T] field, is refused at the declaration with INCAN-T0113 instead of failing the build. A newtype carries Clone when its underlying type implements it, so type Handle = newtype JoinHandle[int] builds, and a model satisfies a T with Clone bound through its automatic derive. (#1754)
• Language: A set element type or dict key type that does not implement Eq and Hash, such as set[Tag] over an enum without derives or set[float], is refused with INCAN-T0114 instead of failing the build, including as the type argument of a generic call that uses its type parameter as a set element or dict key. (#1758)
• Compiler: An argument that is not a task where spawn, timeout, timeout_ms, race_timeout or arm requires one, such as spawn(work) or a name bound to work(), is refused with INCAN-T0115 instead of failing the build. Migration: write the call as the argument, spawn(work()). (#1772)
• Compiler: A module that re-exports an alias declaration without its target, such as pub from provider import scale_alias, gives its consumers a callable name that builds, including through a second facade that renames it. (#1750)
• Compiler: A static re-exported through a facade binds its provider projection publicly even after a private import, and a later private repeat keeps the initializer import needed by reads in the facade. (#1839)
• Compiler: A module that re-exports a dependency's renamed function under a further name, such as pub from pub::calc_lib import facade_calculate as b_calculate, gives its consumers a callable name that builds. (#1751)
• Compiler: An alias of a module member, such as root = math.sqrt after import std.math as math, calls that member, also beside a direct import of it. (#1764)
• Compiler: A function from a pub:: dependency can be taken as a first-class value through its imported module binding, such as calculate = cl.calculate, and called through that value. (#1840)
• Compiler: A relative import in a nested module, such as from ..db.schema import Database or its super:: spelling, reaches the module it names, and a run of n leading dots climbs n - 1 directories. (#1766)
• Compiler: A dependency method that returns a union, a list of a union or an Option of a union gives the consumer a value of its own matching union type, so the build succeeds. (#1797)

• Language: from std import Debug, and any other name that is not a standard-library submodule, is refused at check time with INCAN-I0001, naming the std.* module that declares it. (#1767)

• Compiler: A literal in a match pattern is checked against the type and width of the position it matches: (0, "a") => over a tuple[int, int] value, 300 => over a u8, 1.5 => over an int, 1 => over a float (an integer literal is an int), None => over an int or 0 => over an Option[int] is refused at check time, as are decimal and bytes literal patterns, which have no pattern form in the build. Exhaustiveness counts a constructor arm only as far as its payload patterns cover: Some(0) beside None leaves Some(_) uncovered and is refused (rustc reported E0004), while arms that cover a payload between them, such as Ok(Some(n)) beside Ok(None), still make the match exhaustive. A match over a generic enum names the variant it misses, and a match over any other subject, such as an int, a str, a tuple or a model, is held to the same rule, so arms that are only literals need a _ arm. Match patterns specifies both rules. (#1741)

• Compiler: count on a list has both of its forms, chosen by argument count: items.count() returns the number of items, for any element type, and items.count(value) returns how many items equal value. The value form was refused as the iterator terminal, and the no-argument form compiled to 0; items.index(value) keeps its one form, and a call with an argument count neither form takes is refused naming the forms. (#1776)
• Compiler: A method returning a model declared later in the same module gives its call site that model's fields, so Maker().make().x checks when Made is declared after Maker. Collection resolved the not-yet-declared name to a placeholder that no later step revisited; once every declaration is collected, including in an inline test module, the placeholders in fields, method and function signatures, variant payloads and trait adoptions resolve to the declarations they name. (#1780)
• Compiler: A generic function that forwards its type parameter to a generic method, or calls a method of a generic model it holds, builds: bound inference now follows every call to a source-declared method, as it followed calls to generic functions, and gives the caller every bound of the called method and of that method's impl header, such as Display from a formatting sibling method, PartialEq from == or Clone from returning a field, including across the project's source modules. rustc used to refuse the caller (E0277, E0599). (#1779, #1280)

• Language: A generic declaration that instantiates a model, class, enum or newtype whose type parameter declares a bound, such as consume[T](stream: Stream[T]) over model Stream[R with Clone], a field stream: Stream[T] of a generic model, or Stream(item=value) in a generic function body, is refused at check time with the bound to write, T with Clone; the build refused it with E0277. The standard library's and compiled libraries' bounded types follow the same rule, so ReaderChunks[R] needs R with BinaryReader and Deque[T] needs T with (Clone, Eq). (#1280)

• Compiler: A tuple assignment to fields and list elements, such as items[i], items[j] = (items[j], items[i]), builds and runs: the right side is read once and each place is written in order, so a swap exchanges the values. (#1798)

• Compiler: A tuple unpacking into names that are already bound reassigns them, so a, b = (b, a + b) in a loop or branch updates the enclosing a and b. (#1799)
• Compiler: A chained assignment such as x = y = x + 1 gives its value to every target from left to right: a name already bound is reassigned, so the enclosing x in a loop or branch updates, and a new name is declared. A chain whose targets have different types is refused at check time unless its value is built only from literals and empty constructors or has a fully known type, and a chain with a type annotation (x: T = y = value) is refused. (#1806)
• Compiler: A for loop over a list of task handles that awaits each handle builds and runs: the loop takes the handles out of the list, and reading the list again after the loop is refused with INCAN-T0119, also after a loop that hands each handle on in a way that built before, such as passing it to a generic function. Loops over other item types are unchanged. (#1844)
• Compiler: A for loop that hands each task handle on by value over a list element, a field, a list, dict or set method such as values(), enumerate(...), zip(...), a mut parameter or the variable of a loop that reads its items in place is refused with INCAN-T0119 instead of failing to build. A loop over a list literal, a comprehension or a call result receives each handle by value. (#1561)
• Compiler: A package whose modules each declare a type of the same name and a union over it, such as Product and Answer = Product | int in both first and second, builds and publishes each module's union as its own type. (#1796)
• Compiler: A union member that names a model, class, enum or newtype is the declaration its name resolves to where the union is written, also at check time: when first and second each declare Product and Answer = Product | int, a first.Answer value is refused where a second.Answer or a union over another module's Product is expected, and a plain second.Product value is refused at a first.Answer destination with INCAN-T0001. (#1796)
• Compiler: A module that reaches another module's union only through that module's functions, such as from first import label then label(2), builds the wrapper of the module that wrote the union, also where it binds no name for the member type or where its own Product names another module's declaration. (#1796)
• Compiler: Holder[int] | str written in two modules that each declare a generic Holder[T] is one union type per module and builds with one wrapper each. (#1796)
• Compiler: A value returned or passed into a union alias imported from another module is wrapped into the union, for an alias named module-qualified (first.Answer) and for one imported by name while another module of the package also declares a type of that name. (#1796)
• Compiler: A union member written through an import alias, such as FirstProduct | str after from first import Product as FirstProduct, names the imported declaration, so the union builds and its values are built and matched through the alias. (#1796)
• Compiler: isinstance(value, T) and value is not None narrow a value whose type is an alias of a union or an optional, so if isinstance(answer, Item): return answer.value with answer: Answer and type Answer = Item | int builds. (#1796)
• Compiler: JoinHandle[T].abort() is accepted as the synchronous cancellation operation exposed by std.async. (#1856)

• Compiler: std.fs.Path keeps its declared Clone capability and is not classified as the same-named std.web.Path[T] extractor. (#1855)

• Compiler: A trait method whose mut parameter is an int, float or bool, also through a type alias, builds, whether the method is abstract or has a default body. (#1827)

• Language: A method partial over a model's or class's method, named directly or through a method alias, on a generic model or over a mut self method, builds and calls its target with the preset, and a method reached only through another method is kept in the build. (#1765)
• Compiler: An imported partial called without a leftover argument passes the target's default when that default crosses the package boundary; otherwise the call is refused at check time for the missing argument, as the direct call is. (#1760)
• Compiler: A positional call to an imported partial keeps presets on later parameters, so show_ace("p:") supplies both the residual prefix and the preset label. (#1848)
• Compiler: A call that omits an argument passes the default as the callable's module resolves it: a stdlib const such as std.hash's DEFAULT_CHUNK_SIZE, a module's own const where the caller declares one of the same name, and the const an import names. (#1771)
• Compiler: Defaults that construct same-named types from different modules keep each type's declaring-module path, so a caller can omit both arguments without one Size, Mode or other nominal type replacing the other. (#1843)
• Compiler: A default or method-partial preset may name a const, function, model, class, enum or newtype private to its module, and a caller in another module that omits the argument receives it. (#1771)
• Compiler: A caller in another package that omits an argument receives a default that calls a function the package declares, directly, through a public symbol alias or through its module, or constructs a newtype the package declares or a model or class it exports; a default that calls or constructs anything else, such as a builtin, a partial or a private model, and every method-partial preset, is a required argument there. (#1771)
• Compiler: Some(member) whose destination is a dependency's Option[A | B] takes the dependency's union as a call argument, list element, field value, annotated binding, match arm and returned value, and Ok(member) and Err(member) against a dependency's Result[A | B, E] do the same. (#1743)
• Compiler: A generic function, method or trait method that reads an element of a list[K] by index, slices a list[K], or reads a value of a dict[_, V] by key builds with no bound on the type parameter, such as def first[K](items: list[K]) -> K: return items[0]; it passed incan check and failed the build. (#1756)
• Compiler: An imported trait's default method builds in an adopter in another module when it names a type, an enum variant or a function of the trait's own module, private functions included, and a trait imported through a re-export (pub from shapes import Measured) is the declaring module's trait, so with Measured adopts it with its defaults. (#1759)
• Compiler: An imported trait default that reads a constant from its declaring module keeps that module's path when expanded into an adopter elsewhere. (#1873)
• Compiler: A method chain on a FallibleIterator value, such as numbers().map(double).collect() on a dependency's adopter, builds in a module that does not import the trait. (#1761)
• Compiler: A mut parameter of a trait method, required or default, and of its implementations can be changed in the body, and the caller sees the change; the build refused the change. (#1773)
• Compiler: A compiled library publishes the mut marker on class and model method parameters, so consumers refuse immutable arguments and preserve changes made through mutable ones. (#1836)
• Compiler: Compiled generic models and classes publish inferred inherent-implementation and method bounds, so consumers cannot call methods through an under-bounded generic receiver. (#1819)
• Compiler: Compiled generic functions and trait methods publish inferred bounds such as Clone, and consumers must declare those bounds when forwarding their own type parameters. (#1826)
• Compiler: A dependency function or method returning int | str | None converts its present provider-union payload when passed to a consumer's Option[int | str]. (#1835)
• Compiler: A dependency function default that reads a module static keeps the static's canonical projection and initialization guard when the caller omits that argument. (#1842)
• Language: A mut parameter is a mutable binding in its body, so n += 1 on mut n: int checks. A mut parameter of type int, float or bool is the function's own copy, and one of any other type (except a Rust type, *args and **kwargs) shows its changes to the caller. Rebinding such a parameter, or holding it in another name or value, is refused with INCAN-T0001. When a call changes it, an immutable binding or a field of one, a list or dict element, a static or a for loop variable passed for it is refused with INCAN-T0117, where the build failed or the change was lost; a call through a type parameter's bound, a trait-typed value, a function type or a reassigned local counts as changing it. (#1773)
• Language: A call changes a mut Generator parameter when its body uses the generator, and changes a mut parameter through a name a match, if let or while let pattern binds from it; an immutable binding passed for such a parameter is refused with INCAN-T0117 instead of receiving a copy that failed to build or whose change was lost. An immutable binding whose type cannot be copied, such as a Generator, is refused with INCAN-T0117 for a mut parameter the call does not change, too. (#1561)
• Language: A method call on a mut parameter changes it only when the method it runs takes mut self, including a method named through a method alias and a method a trait provides, so calling a plain-self alias or trait method no longer refuses an immutable argument with INCAN-T0117. (#1561)
• Compiler: A mut binding of one function or method no longer makes a same-named immutable binding of another body acceptable where a Rust parameter takes &mut or a C binding takes a resource exclusively. (#1561)
• Compiler: A match, if let or while let arm that changes a value through a name its pattern binds from a mut parameter, a field of one, a loop variable over one, or a field of self in a mut self method changes the caller's value; it failed to build over the parameter itself (E0507) and lost the change over a field or a loop variable. (#1561)
• Compiler: A method alias called on a mut parameter calls the method it names; it failed to build (E0599). (#1561)
• Language: A change through a name a match, if let or while let pattern binds from a mut local, or a field or list element of one, changes that local, and one from a binding or parameter declared without mut, a static, self in a plain self method or a dict value is refused with INCAN-T0001; both used to act silently on a copy. (#1561)
• Compiler: A trait that a model or class adopts through @derive(...), as a trait imported by name or through a module's __derives__, has its methods callable on the type, as a with clause gives; item.tag() passed incan check and failed the build. (#1792)
• Language: set(gen) over a Generator[T] collects the values the generator yields, as list(gen) does. (#1744)
• Language: A const FrozenList, FrozenSet or FrozenDict takes the reads of its mutable form: c.len() is an int; x in c and x not in c test membership, and s.contains(x) checks its probe; items[i] reads an element, counting a negative index from the end and raising IndexError out of range; d[key] is typed V and raises KeyError for a missing key, and d.contains_key(key) tests for one, where a key outside K is refused and a text key takes any str or FrozenStr probe; for, set(c) and comprehensions iterate each element or key; and str and bytes items and values read as str and bytes. (#1757)
• Language: A module-level model, class, enum, trait, newtype or type named like a standard-library type the module does not import, such as FieldInfo or Response, is the type that name refers to in the module, including in the declaration's own method signatures. (#1770, #1795)
• Language: A name that is not an Incan keyword, such as impl, dyn, ref, move or use, can name a field, method, parameter, keyword argument, enum variant or type parameter; reflection and JSON report a field by that name. (#1775)
• Language: A local annotated with the type of the static it reads, count: int = COUNT, directly or through a type alias, is a live alias of the static, as count = COUNT is. (#1777)
• Compiler: Copying a dict, set or spread list from a mut parameter produces an owned collection without cloning an already borrowed parameter or moving through that borrow. (#1852)
• Language: A JoinHandle field is refused by the existing non-Clone field rule before a loop can borrow and await its handles; task handles that must be awaited belong in a local list, whose taking-loop contract remains explicit. (#1853)
• Compiler: Calling a mutating collection method on a list element, such as rows[0].append(value), borrows the element mutably instead of changing a cloned temporary. (#1857)
• Compiler: Reading a tuple element through a list index emits one valid dereference path, without dereferencing the tuple value before selecting its field. (#1861)
• Compiler: Loops over enumerate, zip, dictionary values and an indexed nested list retain mutable access to elements when their bodies change those elements. (#1863)
• Compiler: Mutated bindings introduced by a match or comprehension are mutable in generated Rust, and a closure that shares an outer local with later code captures its construction-time snapshot. (#1864)
• Compiler: Mutable loop elements use iter_mut() without adding an invalid mut to destructured reference bindings, including a field loop whose body calls an Incan mut self method. (#1869)
• Compiler: A generic type parameter copied when a value is passed to a mut parameter receives the required Clone bound in generated Rust. (#1874)
• Compiler: A default that reads a static of its module, in a function, a method, a method-partial preset or a static method, reads that static where another module omits the argument, also when that module declares a static of the same name, and a default that reads a static its module imports reads the imported static; the build failed or read the caller's static. (#1842, #1561)
• Compiler: A for loop over zip(a, b) whose body changes the items of one operand changes that operand in place and reads the other as a loop over it alone reads it, so a range, an immutable list or a list of int beside the changed list builds, and a loop that changes a dict's tuple values or a list read out of another list reads each int of the tuple as an int. (#1863, #1561)

• Compiler: A for loop whose body calls a mut self method on the loop item inside another expression, such as println(c.bump()), f(c.bump()), [c.bump()] or c.inner.bump(), changes the item in the list, as the same call written as its own statement does; the build failed. (#1869, #1561)

• Compiler: An argument passed to a method on a module static, or on a field of one, is readable after the call, including a key read again by counts[name] = counts.get(name).unwrap_or(0) + 1 and an argument named in the receiver's path, graph[node].contains(node); a str literal inserted or appended into a static collection builds. (#1793)

• Language: d.get(key) returns Option[V], and d.get(key, default) returns V: the stored value, or default when no entry holds key, for every dict, a module static included. A result the program keeps is its own copy of the stored value, and a kept result whose value type cannot be copied, such as a Generator, is refused with INCAN-T0118; .copied() and .cloned() after get are refused (INCAN-T0001). (#1561, #1783, #1793)
• Compiler: A const declared str is accepted at a FrozenStr destination, and a FrozenStr at a str destination: a return, an argument, an annotated binding, a field, a collection element, a union member and the payload of Some(...). (#1794)
• Compiler: The checker counts the derives a declaration carries without writing them, and those another derive implies, as present: value.clone() on a model, class, enum or newtype without @derive(Clone), T with PartialOrd for an @derive(Ord) type and T with Copy for a newtype over int are accepted, and ==, !=, an ordering or a list membership test (in, not in) over values whose type implements no equality or order, such as a model without Eq or a list of one, is refused at check time with INCAN-T0001. (#1870)
• Compiler: A derive whose requirements the declaration does not meet is refused at check time with INCAN-T0001, naming the member: @derive(Copy) over a str field or a newtype over str, @derive(Eq), Hash or Ord over a float field, @derive(Default) over a field that declares no default and whose type has none, and @derive(PartialOrd) on a type without PartialEq, as are @derive(Default) on an enum, @derive(Validate) off a model, and a comparison dunder or __str__ declared with another signature than (self, other: Self) -> bool or (self) -> str. (#1871)
• Compiler: A type that defines a comparison dunder or __str__ and also derives what provides the same operator is refused at check time with INCAN-T0001: __eq__ or __ne__ beside Eq or PartialEq, an ordering dunder beside Ord or PartialOrd, and __str__ beside Display, including a derive implied by another or spelled in @rust.derive(...). @derive(Display) alone no longer fails the build, and an enum that defines __eq__ builds without a second PartialEq. (#1872)
• Compiler: sorted(values) sorts a list whose element type has a total order: int, str, bool, a type that derives Ord, such as a model, enum or newtype, a tuple, list or Option of ordered values, and a type parameter declared with an Ord bound. A float list sorts by its partial order. A list of any other element type, f32 included, is refused at check time with INCAN-T0001, naming the type that does not implement Ord. (#1561, #1881)
• Compiler: Type.default() from @derive(Default) gives each field its declared default, and its type's default only to a field that declares none, for a model and a class, and T.default() under a T with Default bound builds the same value. (#1879)
• Compiler: A set or dict hashes a type only through @derive(Hash) or Hash in @rust.derive(...): a type that adopts std.derives.comparison.Hash and defines __hash__ without the derive is refused as a set element or dict key with INCAN-T0114, and the Hash trait's documentation states that __hash__ is an ordinary method. (#1822)
• Language: A @staticmethod that declares a self or mut self receiver is refused at check time with INCAN-T0001. (#1882)
• Language: A Generator[T] takes the whole Iterator[T] surface: the adapters enumerate, zip, skip, chain, flat_map, take_while, skip_while and batch, the consumers count, sum, any, all, find, fold, reduce and for_each, and an Iterator[T] parameter. (#1561)
• Language: A generator function whose only yield follows an unconditional return in its block has no reachable yield and is refused with INCAN-T0001. (#1561)
• Language: flat_map(f) on an Iterator[T] or a Generator[T] takes an f returning any iterable, such as a set, a frozen collection or a Generator, not only a list, and draws each expansion one item at a time, so flat_map(f).take(1) advances only the first expansion, to its first item. (#1561)
• Language: Option.as_mut() borrows a present payload mutably without consuming the option, allowing lazy adapters to update non-Clone iterator state in place. (#1561)

• Language: A module's own or project-imported class ValidationError, model Json or model Query is constructed as that declaration, and a FieldInfo a program imports from one of its own modules is that module's type. (#1795)

• Language: The right side of a tuple unpacking or tuple assignment may be an unparenthesized tuple: a, b = b, a is a, b = (b, a). In an item of a braced vocab body, where a comma separates items, the right side is one expression. (#1789)

• Language: ** binds tighter than a prefix - or ~ on its left and looser than one on its right: -x ** 2 is -(x ** 2), ~x ** 2 is ~(x ** 2), and 2 ** -1 is 2 ** (-1). Migration: a program that raises a negated value writes (-x) ** 2. The operator table in the language reference gives the order the parser applies. (#1786)

• Language: A builtin list, dict or set method, frozen or not, takes positional arguments only, as many as it declares; another count or a keyword argument is refused with INCAN-T0001. list.remove(index) returns None. (#1783)

• Language: A decimal value is assignable to a decimal type that keeps at least its digits before the point (p - s) and its scale s; any other decimal assignment, argument or returned value, such as a decimal[10, 2] value into decimal[1, 1], is refused with INCAN-T0001. (#1809)

• Standard library: Decimal values compare and hash by value, whatever the precision and scale of each: 1.5d == 1.50d, 1.49d < 1.5d, and a set holds one of two equal values. (#1810)
• Compiler: ** over a literal base, such as 2 ** 3, (-2) ** 3 or (1 + 2) ** 2, or over a name bound from a literal builds and runs, and an exact-width integer base computes in its own type: small ** 2 with a u8 small of 15 is the u8 225. (#1811)
• Language: /, // and % by zero raise ZeroDivisionError for signed integer, unsigned integer and float operands alike. (#1813)
• Compiler: A call argument takes every layer of a nested Option parameter, so passing 5 to Option[Option[int]] produces Some(Some(5)). (#1561)
• Compiler: Some(None) at a nested Option destination gives None its inner Option type instead of emitting an unconstrained unit option. (#1561)
• Compiler: Assigning a string literal to a str field stores an owned string, as assigning the same literal to a str binding does. (#1561)
• Compiler: Calling an Option method on an indexed list value groups the indexed read before the method, so slots[0].unwrap_or(0) unwraps the element rather than dereferencing the method result. (#1561)
• Compiler: Displaying an unbounded type parameter is refused at check time with INCAN-T0103; the declaration must require Display, Error or a trait that supplies __str__. (#1561)
• Compiler: A string literal takes a FrozenStr member from a union destination in returns, arguments and bindings, matching the strings reference contract. (#1561)
• Compiler: A model or class that adopts Eq, Ord or Hash from std.derives.comparison implements the source trait with its Incan dunder methods instead of naming the incompatible Rust trait. (#1561)
• Compiler: value is None and value is not None over an Option[T] compile to presence checks and do not require T to implement equality. (#1561)
• Compiler: Serde derive paths are rooted at the external crate, so a source binding named serde cannot shadow Serialize or Deserialize. (#1561)
• Language: A model or class field that stores a trait type directly or inside another type is refused with INCAN-T0001 before Rust emission. (#1561)
• Language: An unresolved trait name in a type-parameter bound is refused with INCAN-T0001 at the bound. (#1561)
• Compiler: A generic call infers its list element parameter from a concrete constructor inside an inline list argument. (#1561)
• Language: json_stringify(value) over a model or class that does not provide Serialize, or over a type parameter or trait whose bounds do not provide it, alone or inside a collection, Option or tuple, is refused with INCAN-T0001. (#1561)
• Language: A literal pattern matches only a position of its own scalar family: a literal where the matched value is bytes, a tuple, a collection, a model, class, enum or newtype, a union, a decimal or a type parameter is refused with INCAN-T0001, and a generic enum's payload patterns are checked against the enum's type arguments. (#1561)
• Language: A top-level partial presets a negative number literal, a const imported from another module or read through one (hash.DEFAULT_CHUNK_SIZE), and a set or tuple literal of declaration-safe values; a public partial publishes them as preset metadata. (#1561)
• Language: A local partial of a model, class or newtype constructor, such as partial Reader(layer=layer), constructs the value with its presets as overridable defaults, and a partial of a newtype constructor builds. (#1561)
• Language: A record pattern over a generic model or class, such as Box(value=v) over Box[int], checks each named field against its instantiated type. (#1561)
• Language: In a tuple assignment that writes a field or element beside a name, the name follows name = value: a name with no binding is declared with its element, and a bound name must be mut in any enclosing scope. (#1561)
• Standard library: channel[T](buffer), unbounded_channel[T]() and oneshot[T]() take their element type as an explicit type argument. (#1561)
• Compiler: A method call or an assignment through a constant tuple index changes that element of the tuple in place and builds: pair[0].append(x), self.pair[0].append(x), outer[1][0].append(x), rows[0][0].append(x), pair[0][0] = x and pair[0].field = x. The compiler panicked on these. (#1561)
• Compiler: A mut tuple parameter reads and changes its elements by constant index, pair[0].append(x) and len(pair[0]), instead of failing in rustc (E0608). (#1561)
• Language: A negated integer literal is a constant tuple index counted from the end: pair[-1] is the last element, and an index before the first element is refused with INCAN-T0001. (#1561)
• Language: An element of a tuple is not assignable: pair[0] = x, pair[0] += x and a tuple assignment target pair[0], b = (x, y) are refused with INCAN-T0001, for a written tuple[...] type as for an inferred one. A tuple assignment target that is an element of a str or a frozen collection is refused as the single assignment to it is. (#1561)
• Language: A variant pattern written without its enum (Filled(n)) or through a variant alias matches the subject enum's own variant, at the top of an arm, nested in another pattern or in if let, over a plain or generic enum and over an enum another module declares, and the program builds. (#1561)
• Language: A local partial of a generic function or of a generic model, class or newtype constructor instantiates its target with the type arguments it writes (partial pair[int](a=1)) or its presets fix; a type parameter neither fixes is refused with INCAN-T0001. A local partial of a function imported by name or read through its module passes every argument to it. (#1561)
• Language: @derive(Display) (RFC 000) gives a model, class, enum or newtype a display form, the value's {value:?} structure, in print, str(value), an f-string {value} part and a Display bound; it implies Debug, and beside a __str__ the type declares, inherits or adopts it is refused with INCAN-T0001. (#1561)
• Language: std.async.prelude and std.traits.prelude name the std.async and std.traits root modules, so from std.async.prelude import spawn and from std.traits.prelude import Error import through them. (#1561, #1728)
• Language: import python "PACKAGE" is refused with INCAN-I0001; no Python package is importable. (#1561)
• Language: import M::X of a declaration that M does not export, such as one without pub, is refused with INCAN-I0001, as from M import X is. (#1561)
• Language: A variant pattern with more or fewer sub-patterns than its variant's payload values, a payload variant written without parentheses, and a tuple pattern with more or fewer sub-patterns than its tuple's elements are refused with INCAN-T0001. (#1561)
• Language: A named or unpacked argument to a str or FrozenStr method other than encode(encoding=...) is refused with INCAN-T0001. (#1561)
• Language: A field write, or a list element or dict entry write, through a local declared without mut or a parameter not marked mut is refused with INCAN-T0001, compound and tuple forms included; a local bound directly to a static still writes through to it. (#1561)
• Language: The result of a checked C symbol returning c.ConstPtr[c.c_char] is refused with INCAN-T0001 when it is returned, stored, passed on, assigned to another name or read in a closure; it is copied with copy_utf8(max_bytes=...). (#1561)
• Tooling: A refusal inside a binding declaration's body carries INCAN-T0001 instead of INCAN-I0001. (#1561)
• Language: A model, class, enum or newtype that provides Serialize or Deserialize and holds decimal or a frozen type is refused with INCAN-T0001, and a route payload holding one with INCAN-T0112; neither has a JSON form. (#1561)
• Language: An f-string {value:?} part over a Generator, a function, or a value whose type implements no Debug is refused with INCAN-T0103. (#1561)
• Compiler: A function, parameter, field, local or module named gen, a reserved word of Rust 2024, builds. (#1561)
• Tooling: A codegraph export's header languages lists rust beside incan when any record's language is rust. (#1561)
• Language: A call of a method that changes its receiver (a method declared mut self, or a changing list, dict or set method) through a local declared without mut or a parameter not marked mut, or through a field or element of one, is refused with INCAN-T0001, as a field or element write through one is. (#1561)
• Language: A for loop or a list comprehension that changes its items through its variable is refused with INCAN-T0001 when it reads them in place, directly or through enumerate, zip, a dict's values() or a list or tuple element, from a binding declared without mut, a parameter not marked mut, a static, or self in a plain self method. (#1561)
• Language: A tuple binding may be declared mut, so an element of a local tuple is changed in place (pair[0].append(x)) through a mut binding like any other place. (#1561)
• Compiler: d[key] on a mut dict is a place: a changing method call, a mut self call, a field or element assignment and a for loop that changes its items change the stored value in place, also through a mut dict parameter and through a tuple in the value. A mut self call on a dict value changed a copy, and the other forms failed in rustc. (#1561)
• Compiler: A mut self method called on a list element, or on a field of one, changes the element in the list instead of a copy read out of it, and a for loop that changes the items of a list field of a list element or of a dict value changes them in place. (#1561)
• Compiler: d["key"] read through a mut dict parameter with a str literal key builds. (#1561)
• Language: A closure that captures local values, and a local partial, build as a new local binding (annotated with a function type or not), as an argument for a function-typed parameter that a function or method of the same module only calls, and as the one return value of such a function; every other function-typed slot, such as a list element, a field, a parameter the function stores or passes on, a parameter of a callable value, a branch value or a reassignment, refuses them with INCAN-T0001. A named function and a closure that captures nothing are accepted everywhere, as before. (#1561)
• Language: A local partial may target a method of a value, partial user.label(prefix="x"), and holds the receiver as it was when the partial was built; a method that takes mut self, an overloaded method and a generic method are refused with INCAN-T0001. (#1561)
• Language: Slice syntax on a type that defines __getslice__ (Sliceable[T]) calls it with Some of each written part and None for each omitted one; on a model, class, enum or newtype without the hook it is refused with INCAN-T0001. A slice that omits its end may write its two colons together: items[::2], items[1::2], text[::-1]. (#1561)
• Language: await of an async function called through its module binding, import std.async.time then await time.sleep(1.0), awaits it as a direct import does, and such a call may be passed to spawn. (#1561)
• Language: A for loop, comprehension or pattern that changes the items of a static through a local bound to it is refused with INCAN-T0001, as one over the static itself is, whether the local is declared mut or not; it used to build and lose the change. (#1561)
• Language: A closure that changes a local it reads, by a changing method call, a field or element write, a comprehension over its items or an argument for a mut parameter the call changes, is refused with INCAN-T0001 (the argument with INCAN-T0117): the closure holds its own copy of the local. (#1561)
• Compiler: A list or dict comprehension that changes its items through enumerate, zip, a dict's values() or a list element, and a dict comprehension over a list, change the items in place, over a mut place, and are refused with INCAN-T0001 over a place declared without mut; a comprehension or generator expression over a temporary changes its own items, and a generator expression that changes the items of a place is refused with INCAN-T0001. (#1561)
• Language: A closure written without parameter annotations takes its parameter types from its context: the element type of an iterator adapter or terminal (items.iter().map((x) => x * 2)), the accumulator and element of a fold, and a generic function's function-typed parameter once the other arguments fix its type parameters (apply_twice((x) => x + 1, 3)). A closure that captures local values, or a local holding one, passed to map, filter, flat_map, take_while or skip_while of an iterator, which store their callback, is refused with INCAN-T0001; a generator's filter builds with a closure. (#1561)
• Compiler: A type that adopts std.derives.comparison.Eq and defines __eq__, or adopts Ord and defines __eq__ and __lt__, builds: ==, !=, <, <=, >, >=, sorted(values), a set element or dict key with @derive(Hash), and a T with Eq or T with Ord bound use its dunders, an override of __le__, __gt__ or __ge__ included, whether the trait is imported, aliased or named through its module (with comparison.Ord), and its dunders may take other as the declaring type. Through a type parameter's Eq, Ord or Display bound, a.__eq__(b), a.__ne__(b), the ordering dunders and value.__str__() are the operations they define. A method called on a Self parameter in a type's own method (other.rank()), and a trait default that passes self to a method taking Self, build. (#1561)
• Language: value.__hash__() on a type parameter through its Hash bound is refused with INCAN-T0001: the bound is met only by @derive(Hash), which provides no __hash__. (#1561)
• Language: A pub:: dependency's trait imported under an alias (Tag as Tagged) or exported under one (pub Tagging = Tag) is the dependency's trait: the dependency's adopters meet a bound on it, and a consumer's type that adopts it builds with its own methods. A consumer's type that relies on a default method of a dependency's trait is refused with INCAN-T0001, since a package publishes its traits' method signatures without their default bodies. (#1561)
• Compiler: x.__ne__(y) on a type that adopts std.derives.comparison.Ord without importing Eq, under the trait's own or its module-qualified spelling, is accepted and builds: it is the __ne__ default of the Eq supertrait, not x.__eq__(y). (#1561)
• Language: In a trait's default method, a method that the trait or a supertrait of it declares, called on self or on another Self value, has its declared result type, so self.tag() + "!" is a str; an operation that result does not provide is refused with INCAN-T0001. (#1561)
• Language: A pub:: dependency's trait named through a module binding, import pub::tags as t then with t.Tag or T with t.Tag, or through the dependency's alias of it (t.Tagging), is the dependency's trait: the dependency's adopters meet a bound on it, and a consumer's type adopts it with its own methods. (#1561)
• Language: An iterator adapter or terminal (map, filter, enumerate, any, fold, collect, sum and the rest) called on a list, set, frozen collection or Iterable[T] value itself, rather than on the iterator its iter() returns, is refused with INCAN-T0001. A list's own count() and count(value) are unchanged. (#1561)
• Language: A closure that captures local values, or a local holding one, is refused with INCAN-T0001 as the callback of an iterator terminal (any, all, find, fold, reduce, for_each), of a generator's own map and filter, and as the argument for a function-typed parameter of a standard-library function or method. (#1561)
• Compiler: A method a class inherits calls, through self, the override nearest the subclass, also when a class between them declares it, and that override is kept in the build. (#1841)
• Compiler: A name a module binds to its own type, such as class Index, is that type in a local annotation and a type argument when the standard library declares a trait of the same name that the module did not import. (#1561)
• Compiler: A method a pub:: dependency's model gets from a trait it adopts is callable by a consumer that imports the model but not the trait. (#1561)
• Compiler: A pub:: dependency function taken as a value through a module binding builds without an import of the function. (#1840)
• Compiler: A private constant that a public trait's default reads is built and reachable from an adopter in another module. (#1873)
• Language: dict(source) copies a dict; a source that is not a dict, and a second argument, are refused with INCAN-T0001. (#1852)
• Compiler: A * or ** spread in a list or dict literal copies a collection that a binding, a field or a mut parameter still holds, and set(source) over a mut parameter copies its items. (#1852)
• Compiler: A generic function that copies a list of its type parameter, through sorted(items) or a spread, requires Clone of that type parameter, so it builds for every type argument. (#1561)
• Language: A consumer's type that adopts a pub:: dependency's trait under one spelling meets a bound that names the trait under another: the trait itself, an import alias (Tag as Tagged), the dependency's alias (Tagging) and a module-bound spelling (t.Tag) are one trait. (#1561)
• Compiler: A model or class that adopts std.derives.collection.Iterator[T], under the trait's own name or an import alias, builds with the iterator adapters and terminals called on it (Count(n=0).any(is_big), .map(f).collect(), .fold(0, f)), which behave as on an Iterator[T] value. (#1561)
• Compiler: The closure passed to a Result combinator builds when it returns Ok(...) or Err(...) without spelling the other side (e.or_else((m) => Ok(1))): or_else's callback returns the receiver's success type and and_then's its error type, the other side comes from the call's expected Result type when it has one, and a side nothing gives is None, as for an Ok(...) or Err(...) bound to a local. (#1561)
• Language: A closure that captures local values, or a local holding one, is accepted as the callback of a Result combinator (map, map_err, and_then, or_else, inspect, inspect_err), which calls it before it returns; a function-typed slot that holds a plain function pointer refuses it with INCAN-T0001. (#1561)
• Compiler: A model, class or generic model that adopts std.derives.collection.Iterator[T] through its module (from std.derives import collection then with collection.Iterator[int], or a module alias) builds, and its __next__, called directly or by the iterator adapters and terminals, runs its own body. (#1561)
• Compiler: A Result stays usable after a method reads it: r.map(f) then r.and_then(g), r.unwrap_or(0) twice, and r.inspect(f) followed by another use build for a local, a parameter, a field and a generic Result. (#1561)
• Compiler: The closure passed to inspect or inspect_err builds whatever it does with the payload it observes (e.inspect_err((m) => println(m + "!")), m.upper(), len(m), a call taking m): it takes a non-Copy payload by borrow and a Copy one by value. (#1561)
• Language: A value of type None is refused in every display position with INCAN-T0103. The side of a Result that an Ok(...) or Err(...) bound to a local, or returned by the closure of or_else or and_then, leaves open is None unless the call's expected type, an annotation or the enclosing function's Result return type gives it another: Err(m) => println(m) over e.or_else((m) => Ok(1)) in a function that returns no Result is refused, and so is passing such a Result where a Result with another type on that side is expected. (#1561)
• Language: A closure literal whose body returns Ok(...) or Err(...) has a complete Result result: the side the constructor leaves open is the enclosing function's Result side, or None where that function returns no Result, unless the closure's expected type gives it another, so f = () => Ok(1) then r = f() builds, and passing f where a closure returning Result[int, str] is expected outside a Result function is refused with INCAN-T0001. The closure builds its Result with its own types, not the enclosing function's, and a list comprehension of Ok(...) or Err(...) elements settles its open side the same way. (#1561)
• Compiler: An Option stays usable after unwrap or unwrap_or reads it: o.unwrap_or("b") twice builds for a local, a field, a generic Option, a mut parameter and a static, and so does a Result read through a mut parameter. (#1561)
• Compiler: The default of unwrap_or is a value of the payload type: r.unwrap_or("z") on a Result[str, E] builds, and a default local the program reads again stays usable for an Option and a Result alike. (#1561)
• Language: The default of unwrap_or on an Option[T] or Result[T, E] whose payload is a type parameter of the enclosing generic declaration must be a value of that parameter: r.unwrap_or(0) in def pick[T](r: Result[T, int]) is refused with INCAN-T0001. (#1561)
• Language: The members of a list or dict literal share one type, so a Result side one Ok(...) or Err(...) leaves open, or an Option payload a None leaves open, takes the type another member gives it: [Ok(1), Err("x")] is a List[Result[int, str]] and [None, Some(1)] a List[Option[int]], at any depth. A side no member fixes is settled as for an Ok(...) bound to a local, so xs = [Ok(1)] then xs.append(Err("x")) outside a Result function is refused with INCAN-T0001. (#1561)
• Tooling: An SDK component compiled from its own source is checked as the standard library, whose capturing closures and trait defaults its own lowering spells, as its std.* modules are; stdlib-core was refused a closure in Iterator.flat_map and the item Iterator.collect and FallibleIterator.collect append. (#1561)
• Language: from std.derives import comparison imports the std.derives.comparison module in a project built against the compiled SDK; std.derives has no module of its own, and an item of it that is not a submodule is refused as not exported. (#1561)
• Compiler: In a project built against the compiled SDK, x.__ge__(y) and the other dunders a type gets from adopting std.derives.comparison.Eq or Ord, under the trait's own name, an import alias or its module (with comparison.Ord), build; they failed E0599. (#1561)
• Compiler: In a project module, a bound on a builtin trait the module does not import (T with Display, T with Eq, T with Ord) is the builtin: value.__str__() is the value's display text and a.__ne__(b) and a.__lt__(b) are the operators; value.__str__() failed E0599. (#1561)
• Compiler: In a project built against the compiled SDK, import std.async.prelude and from std.async.prelude import ... use the SDK's std.async module; the build mounted the namespace's prelude source beside the SDK and failed E0432. (#1561)
• Tooling: A project with no compiled SDK, such as one built on a fresh INCAN_HOME, checks each standard-library module it imports from source as the standard library, as std.* modules and SDK component builds are checked; from std.io import BytesIO was refused a closure in Iterator.flat_map and the item Iterator.collect and FallibleIterator.collect append in std.derives.collection. (#1561)
• Compiler: A trait-qualified Rust call on a receiver of unknown type, such as Read.by_ref(cursor) on the guard borrow_mut() returns, borrows no receiver and has a result of unknown type, as without Rust metadata. With std::io::Read inspected, a project importing std.io or std.fs was refused Type '&mut ?' has no method 'take(...)', and a guard passed that way to a reader adapter failed E0277. (#1561)
• Language: Inside the generic function, method or type that declares it, a type parameter is one fixed type, so a value of a concrete type or of another type parameter where that parameter is expected is refused with INCAN-T0001: return 0 in def f[T](x: T) -> T, self.value = 0 for a value: T field, [x, 0] for a list[T] and r.unwrap_or([0]) on a Result[list[T], int] failed E0308. A type parameter bounded by Ord meets a callee's Eq bound where the module does not import Ord. (#1561)
• Language: The side an Ok(...) or Err(...) leaves open as the subject of a match or in the iterable of a for loop is settled as for one bound to a local: match Ok(1): then Err(m) => println(m) in a function that returns no Result is refused with INCAN-T0103, and a subject or iterable that does not print that side builds; it failed E0282. (#1561)
• Language: An Ok(...) or Err(...) argument takes the side it leaves open from its parameter: pick(Err(2), 5) for def pick[T](r: Result[T, int], d: T) builds its Err with the int that d gives T, whichever argument comes first (it failed E0308), and show(Err("x")) for def show(r: Result[int, str]) is accepted inside a function that returns another Result type (it was refused). A side no argument fixes is settled as for a constructor bound to a local. (#1561)
• Language: x.__ge__(y), __le__, __gt__ and __ne__ on a type imported from another module that adopts std.derives.comparison.Ord or Eq are accepted and build, whether or not the importing module imports the trait; they were refused as missing methods. (#1561)
• Compiler: The ordering dunders of a type that derives Ord, such as x.__ge__(y), are its operators and build; they failed E0599. (#1561)
• Language: Inside the generic function, method or type that declares it, a value of a type parameter is not a value of a concrete type: return x for an int result in def f[T](x: T) -> int, passing it to an int or function-typed parameter, and storing it in a str field are refused with INCAN-T0001, unless a bound names the expected trait. A method call on it that no bound's trait declares, other than .clone(), is refused with INCAN-T0001, including a Rust method of a builtin bound such as x.to_string() for T with Display, which built before. Each other case failed E0308 or E0599. (#1561)
• Language: The arguments of a generic call that bind one type parameter bind it to one type: take(1, "s") for def take[T](x: T, y: T) is refused with INCAN-T0001 (it failed E0308), and arguments of numeric types that widen to one bind the parameter to the wider type, in either order, so pick(small, wide) for an i8 and an int builds with T as int for a function, a generic method and a generic model's constructor (it failed E0308). (#1561)
• Language: A call is checked against the bound of a type parameter its arguments leave open. first(Err(3)) for def first[T with Display](r: Result[T, int]) settles T as for a constructor bound to a local, to None outside a Result function, and is refused with INCAN-T0103 (it failed E0277). show(None) for def show[T with Display](o: Option[T]), and a call that leaves such a parameter with no argument and no expected type naming it, are refused with INCAN-T0001. (#1561)
• Compiler: A library publishes each enum's own variants when enums share a variant name, and a variant's payload type declared after its enum as that type. A library declaring Action with Enter(EnterPayload) beside a value enum with Enter = "enter" builds (it failed with "checked/emitted public type arity differs"); a consumer uses the value enum's Enter as a value when the payload enum is declared first, and reads the fields of a payload whose type is declared after the enum (both were refused). (#1561)
• Compiler: A module builds a value of a type that another module of the project declares and names by its declared name, where the module neither imports that type nor declares a type or type parameter of its name: Decision(admitted_evidence_ids=[]) for a list[EvidenceId] field of an imported model, with EvidenceId declared in a third module, failed E0425, and so did a dict, set, None or nested empty collection of such a type passed as a field or an argument. (#1561)
• Language: The arms of a match expression and the break values of a loop: expression share one Option or Result type whichever arm fixes the payload or side the others leave open: None => None then Some(value) => Some(value.to_json()) is an Option[str] and builds, as does None => Err("missing") before an Ok(...) arm (both failed E0308). Only a side no arm or break value fixes is settled, to the enclosing function's Result side or None, so printing the error side of a match whose every arm builds Ok(...) is refused with INCAN-T0103 outside a Result function. (#1561)
• Compiler: In a project with no compiled SDK, which builds each standard-library module it imports from source, a call to a trait method a standard-library type implements, such as buffer.write(value, Endian.Big) and value: u32 = buffer.read(Endian.Big)? on a BytesIO through BinaryWrite and BinaryRead, or buffer.chunks(4) through BinaryReader, names the method the type's module emits, in each of the project's modules; it failed E0599. (#1561)
• Compiler: A for loop over a call that returns a type whose __next__ implements Iterator[T] builds, whatever the call: a method, including one with a default or variadic parameter, a generic or static method, a function or an adapter. for found in word_re.find_iter("one two"): with std.regex, and such a loop over an adopter declared in the program or in a module it imports, failed E0782. (#1561)
• Compiler: A library whose non-root module re-exports another module's declaration spelled from the package root, such as pub from crate.inner import greet in middle.incn or in nested/relay.incn, builds, including through a chain of modules and under a new name; it failed with "identity graph entry greet is not backed by a checked API namespace declaration", or with "projection disagrees with its raw export" for a renamed chain. A consumer imports the name from the package root and from every module that publishes it. (#1561)
• Compiler: A dependency type published at more than one path, at its declaring module, at a module or directory facade that re-exports it, and at the package root, is one type to its consumer: a value spelled through one path is accepted where another path's spelling is expected, a pattern names the type through any of them, and an import from a directory facade that re-exports its child module's declaration (pub from crate.search.models import Nomination in search/mod.incn) is not refused as ambiguous. A field, parameter or return type of a published declaration names the type its declaring module names, through that module's own imports, private ones included, so a model a consumer reaches only as the element type of another model's list field has its declaration's fields and methods, also when the package root does not publish it or publishes a different type under its name; it failed with Type 'Nomination' has no field 'rank'. (#1561)
• Compiler: A dependency whose public surface carries a native union is read from its admitted artifact with the same type names as any other dependency: a model its package root re-exports from a submodule (pub from search import Nomination), reached only as a list or option field of a function's result, has its declaration's fields and methods. It failed with "Type 'Nomination' has no field 'rank'" (#1561).
• Compiler: A consumer that builds a dependency's model with an empty list, an empty dict or None for a field whose element type it never imports (Card(evidence_ids=[]) with EvidenceId from the dependency) builds: the element type is spelled from the dependency crate. It failed in rustc with E0425 for the provider's bare type name (#1561).
• Tooling: A project bake whose Rust dependencies compile one registry package both for the target and for the build host, such as unicode-segmentation when the project uses it and crossterm 0.29's derive_more macro reaches it, declares that package's source once, carrying the features of both compilations. A bake that extends no release Loaf, such as one on a fresh INCAN_HOME, failed with "declares more than one source identity for registry package". A direct-rustc manifest that declares one registry source twice is refused as declaring it more than once; only the same package version with a different checksum, source root or digest is refused as a second source identity. (#1561)
• Tooling: Generated standard-library code binds a registry extern to the unit from its selected standard-library Loaf when a project Rust dependency only pulls another build of that package transitively. The project build remains available to its own dependents through the dependency search path, while a package the project declares directly retains project-root authority. This prevents prebaked standard-library types and generated JSON code from linking against different trait identities. (#2005)
• Tooling: A project with no compiled SDK, such as one built on a fresh INCAN_HOME, links the runtime crates of each standard-library namespace it builds from source, the crates the namespace's SDK component links for a project built against the compiled SDK (incan_std_testing for std.testing, incan_std_data for std.collections, std.json and std.serde, incan_std_async for std.async, and the registry crates a namespace reaches), and every other standard-library runtime crate its modules name. The test dependencies incan oven bake --project . prepares include them, so incan test builds the tests of a project or workspace member that import these namespaces; they failed E0433 with "cannot find module or crate incan_std_testing" or "cannot find incan_std_data in the crate root". A project that consumes a pub:: package whose prepared closure does not link one of these crates is built on its own closure, as a consumer that declares its own Rust dependencies is, instead of failing E0433 on the package's. (#1561)
• Tooling: Publisher bakes execute typed generator facts with exact executable, environment, input, output, host, target, and consumer receipt binding; consumers import the admitted generated inputs and never run the tool. (#1561)

What this does not claim