# C+ 0.0.28 — 2026-09-18 This release spans the language and toolchain, package management, the agent surface, Facet's application model, and native Windows, Linux, and Android support. ### Upgrade notes - `[[bin]]` / `[lib]` are removed. Applications use `entry` (with `src/main.cplus` as the default), and C-ABI libraries use `[library]`. - `executor::block_on` / `executor::run` are removed. Use `async fn main`, `.wait()`, or `future::wait_or_cancel`. - A `guard let` complement is `else Pattern`, without pipe delimiters. - `facet/runtime` and `facet/agent` moved to the `facet_runtime` and `facet_agent` packages. The application and navigation APIs changed with the split; the detailed migration table is linked below. - The raw SQLite import is `sqlite/raw`; `sqlite_ffi` is no longer a separate package. `static-arena` is now `static_arena`, and `terminal/appkit` is now `terminal/backend`. - Agent-surface reads and actions take an explicit capability grant, and multiple UI selection is represented as a set. ### Async and concurrency - `async fn main` and async `#[test]` functions are driven by the compiler. Synchronous code consumes a future through `.wait()` or the cancellable `future::wait_or_cancel` path; the old executor entry points are gone. - Dropping a future destroys its suspended frame tree, the reactor owns detached spawned work through teardown, and thread scopes request cancellation before joining. - Async/thread bridges, sockets, and platform reactors gained deadline-aware operations. Windows socket and pipe waits are cooperatively cancellable. ### Facet applications and navigation - Applications register windows with `app.window(name, factory, chrome:)` and start through `App::run`. Window instances are addressed by name and key. - Each window owns routes, default slots, and retained Back/Forward history. Screens receive instance arguments and navigation-state hooks. Window opening never falls back to content navigation on another platform. - Removed `app.screen`, `Screen::chrome`, the standalone runtime hosts and `runtime::Window`, global content navigation, and `nav::Show` modes. See the [migration table](https://github.com/netdur/cplus/blob/v0.0.28/vendor/facet/docs/navigation.md#migration-from-the-previous-api). ### Lifecycle - **A component is told when it is on screen, whatever moved the tree.** `component::Attach::Foreground` and `component::Detach::Background` now reach a boxed component (`component::child`) and a presented one (`mount::set_content`) from the tree itself, not only from the app event stream. One pass computes the answer — in a mounted window, and neither the node nor any ancestor `Display::None` or invisible — and announces the transitions; no mutating verb announces anything, so `switch_to` parking a pane, `set_shown` hiding one, an ancestor hidden twelve levels up and a band rule collapsing a column all arrive the same way. It is not occlusion: scrolled out of view, behind another window or under a sheet are not known and are not claimed. - The pass runs at the end of the frame (`mount::sync`, and again after layout through `core::frames_settled`, where band rules have resolved into `display`). A pane parked and restored inside one tick nets out to nothing, and everything leaving is told before anything arriving, so a device handed between screens is released on one side before the other asks for it. - **A parked pane used to hear `Attach::Mount` again on every restore, and nothing at all on the way out.** The node's single attach slot carries no reason, so `component::child` could say one word; the reason now rides the node's presentation record, the repair `screen::ScreenBox` already had. `Mount` keeps meaning what it meant — the application put this in the tree — and is said once per attachment. A component's own root is also no longer silently robbed of its lifecycle when the application sets `on_attach` on it. ### Toolchain - **`This` in a method body is the block's own type, whatever else the file impls.** The self-type was bound while method signatures were collected and left set afterwards, so every method BODY in the build resolved `This` against whichever `impl` block came last. With two blocks in one file, `let t: This = this;` in the first one typed `t` as the second one's target: a compiler panic when that type lacks the field named next, and IR clang rejects when it has it. Signatures were unaffected, and swapping the two blocks made the same program build. Bodies now bind the self-type for themselves, structs, enums and blessed builtin impls alike. - **A package's public static stays in its own archive.** Splitting the library into one object per module placed data by reachability, and a `static` that nothing inside the package reads is reached from nowhere — so it was in no member of `lib.a` and no export of the dylib, though it is made `weak_odr` for the express purpose of being kept. A global that its linkage says must survive the link is now defined in its own module's piece whether or not anything reaches it, while one the linkage says is discardable still travels only where it is used. Verified against the single-object build: the two now export the same data symbols. - **A package archives one object per module.** `lib.a` used to hold a single object, so resolving any symbol from a package linked every module it had — a facet app on Android that imports `stdlib/vec` linked `process` and `pty`, and with them a `posix_spawn` API floor of 28 for code it could not reach. The library pipeline now partitions the emitted IR one piece per source file, compiles the pieces in parallel and archives all of them; a consumer links the modules it reaches. The Android gallery links at API 24 again. `CPC_ONE_OBJECT=1` restores the single object. - **A call to an extension method whose module is not imported reports one error**: E0388 at the call site, naming the import to add. It used to be preceded by an E0312 per defaulted parameter, each located inside the extending module's file (`.gesture(on_click: h)` without `facet/gestures`: twenty errors inside `vendor/`, the real one last). ### Packages - A bundled archive named `lib.a` appears once on the link line. The default prebuild setting no longer causes the same author-supplied archive to be classified and appended a second time. - **`llama_cpp` regenerated against llama.cpp b11003 (0.4.1), and regenerated from upstream's own headers from now on.** The package used to carry a hand-curated `upstream/llama_cplus.h` mirroring llama.cpp's ABI; it had drifted badly — still declaring `llama_model_params::use_mmap`, `use_direct_io` and `use_mlock` after upstream deleted them, never having heard of `load_mode`, `lazy_mode`, `load_mtp` or `llama_context_params::n_outputs_max_per_seq`. Every field past `n_gpu_layers` read the wrong bytes. `build.sh` now runs `cpc-bindgen` directly on `include/llama.h` and `tools/mtmd/mtmd.h`, so layouts come from clang's record layout of the real header and the mirror is gone. - The facade gained a sampler chain (`temperature`/`top_k`/`top_p`/`min_p`/ `seed` on `load`, greedy at temperature 0), `Session::tokens_for`, `describe`, `reset`, `train_context_size`, `parameter_count`, `embedding_size`, `vocabulary_size`, `bitmap_audio`, and `Bitmap` dimension accessors. Three fixes rode along: `sample` no longer calls `llama_sampler_accept` after `llama_sampler_sample` (which already accepts — the double count skews every stateful sampler), model paths cross to C as a NUL-terminated `CString` rather than a bare `str` pointer, and `generate` clears the KV cache unless asked to continue. - `llama_cpp` gained an e2e suite (`src/test_main.cplus`) that loads a real GGUF and drives real inference, gated on `LLAMA_CPP_TEST_MODEL` and loud when it skips. The unit tests never reach a `llama_*` symbol, so this is the only half that can catch ABI drift — restoring the stale `llama_model_params` kills the test binary with SIGSEGV, which is what it is there to do. ### Platforms and capabilities - **Windows** gained a complete host toolchain path, the standard-library platform layer, a broad native Facet backend, the agent/inspector transport, WinHTTP and filesystem watching, Media Foundation camera capture, Credential Manager storage, file picking, notifications, permissions, haptics, and related capability backends. - **Linux** gained a rebuilt GTK Facet backend and agent surface plus native process/PTY, terminal, HTTP, inotify, camera/V4L2 preview, location, secure storage, file-picker, and inspector paths. - **Android** gained a native Facet runtime and agent surface, recycler-backed controls, rich rendering and input, notifications, application links, secure storage, system file picking, and Maven/AAR dependency resolution. - **iOS** gained a much broader UIKit surface, device/simulator checks, multiwindow and keyboard behavior, context menus, agent access, notifications, application links, and camera/device capability integrations. - The capability layer now covers notifications, application links, camera, location, sensors, biometrics, secure storage, permissions, file picking, haptics, sharing, HTTP, and filesystem watching with native implementations or explicit unsupported results per platform. ### Completion — one composed answer, three front doors - **`complete FILE:LINE:COL`** — the caret question, answered whole. The graph decides whether a caret follows a `.` (the receiver's fields and methods), a `::` (a module's items or a type's methods and variants), or neither (everything in scope), filters by the word already typed, and ranks nearest-binding-first. `scope-at` / `type-at` / `members` remain the primitives; deciding *which* of them a caret is asking is C+'s rules, so it lives in the compiler rather than in each caller. Available as `cpc query complete`, as the `complete_at` MCP tool, and as the LSP's `textDocument/completion` — all three call one function in core. - **`cpc lsp` is resident.** It used to rebuild the whole project on *every* request (~2 s each on a large one), which is why it had no completion. The graph is now built once per project root and kept warm, with open buffers overlaid and rebuilds on a worker — the same session type `cpc mcp` uses, now shared from `cplus-core::session` rather than duplicated. Measured on a 185-module project: 3.7 s for the first answer, 3.7 ms for every one after it. - **`cpc lsp` resolves dependencies.** It loaded projects without their declared `[dependencies]`, so every vendored import reported *E0401 imported file not found*, the graph never built, and the editor silently fell back to single-file behaviour on any real project. It now resolves the way `cpc build` does, and diagnostics for such a project are the program's own instead of a fabricated missing import. - **The graph is indexed.** `CodeGraph` carries `by_id` / `by_name` (symbol id and bare name to node indices), built once with it, so `def`, `members`, `symbols`, `callable_ids` and the completion walks stop scanning the whole node vector. Measured on a 43k-node project: `find_members` 1.63 → 0.29 ms, 2.67 → 0.43 ms on a 107-member type, `file_symbols` 0.12 → 0.07 ms. A symbol id can repeat (two `impl` blocks, one method name), so both maps hold a list — and answers stay in declaration order, so an indexed query answers identically to the scan it replaced. `cpc lsp` also stopped canonicalizing every file in the project on every request. ### facet — Return in a prompt commits what you TYPED - The key equivalents landed and Return still "did not work", because the sheet committed the value it OPENED with. An NSTextField does not hold the text you are typing — the window's shared FIELD EDITOR does, and `stringValue` is only refreshed from it when editing ENDS. Clicking a button ends editing on the way, because the click moves first responder. **Return does not**: it arrives through `performKeyEquivalent:`, which fires the button before anything touches the responder chain. So a Rename kept the old name and a New File got an empty one. `prompt_ok` now sends `endEditingFor:` before reading, which is what every native dialog does. - **The routing itself is now tested rather than left to hands.** A real `NSEvent` through `performKeyEquivalent:` is what a window does with a key-down before the responder chain sees it, so driving it is the routing and not a stand-in for it. Setting `keyEquivalent` and asserting the property — which is all the previous change did — asserts nothing about whether AppKit delivers the key. - Also pinned, and NOT facet's doing: a prompt opens with the caret in the field and the old name selected. A `selectText:` call was added here on the assumption that it did not, and removed again when measurement showed it changed nothing — AppKit's initial-key-view behaviour already does both. The test stays, because a future change to the tree could take it away. ### agent — `wired` was false for a gesture, and `click` acted then denied it - A regression from `wired` itself. It read appkit_ext's agent-click SLOT for every non-control — a slot facet never fills — so every gesture-bound container reported `wired=false`. That is the one CORRECT way to make a non-control clickable, and the very form the flag was added to tell apart from a dead button. - A framework swaps in a class that receives input only for a node that HAS input: facet leaves a plain container as a `FlexFlippedView`, which does not answer `performClick:`, and arms it into a `FacetInput00`, which does. So answering the selector IS the answer. The exception is appkit_ext's own two classes, whose `performClick:` reads the slot and does nothing when it is empty — for those, and only those, the slot is the question. - **`click` no longer acts and then reports `no_handler`.** The first version sent the click anyway on the reasoning that a report is not a refusal. That was worse than the bug it replaced: a verb that performs the action and says it did not cannot be trusted in either direction, and an agent retrying does the thing twice. It refuses without sending now, so a disagreement is inert. ### facet_runtime — a screen is not freed while its jobs are running - `App::run` settles before dropping the primary screen. **Two of the three paths that free a screen did not.** `pushed_closed` calls `on_detach`, removes the entry and frees the box; `presented_closed` frees the tree — neither waited. A worker still inside that memory keeps writing, the next screen is allocated into it, and the fault surfaces in whatever was allocated next, which is why this family of crash never looked like the screen that caused it. - Both settle now, and the wait lives at the FREE rather than at a caller: `close_all_pushed` runs before `App::run`'s settle, so a wait at the caller would still have been too late for pushed screens. - **The bailout says so.** `spins > 100000` turns "teardown would wedge" into "teardown frees anyway", which is the same crash by another route. It is now a line on stderr rather than a silent `break`. ### facet — the dialogs answer the keyboard, and open on a value - **Return and Escape.** A native alert gives a window a default button and a cancel button for free; a facet sheet is built out of facet controls — which is what makes it keyed and agent-drivable — and the cost is that everything the platform did for nothing has to be said. It was not said, so typing a name into a prompt and pressing Return did nothing, and the only way out of any sheet was the mouse. The primary button now carries `keyEquivalent "\r"` and the secondary `"\x1b"`, which also draws the default accented. Return fires while the text field has focus, because a window's default button answers regardless of first responder. - **A `choose` sheet binds neither**, deliberately: its buttons are N options and none is "the obvious one", so binding Return would act on the user's behalf without being asked. - **`prompt` opens on a value.** `initial:` — the ledger's `initialValue`, which is NOT the placeholder: one is the hint shown while the field is empty, the other is what the field starts with and what a person then edits. Only the hint had reached facet's signature, so Rename opened on nothing with the old name greyed out behind the caret. Appended last, on the neutral base and both facades. - **Guard 8: an implementation CLAIM accounts for the row's parameters.** `METHOD_DROPS` says "facet says it as `runtime::prompt`" and that was checked at the METHOD level only — the verb exists, so the row is answered. A claim on a row with three or more parameters now has to say what each one is carried as, or that it is absent and why. It found two more the moment it ran: `DisplayActionSheet`'s `cancel` and `destruction` — a choose sheet has no cancel button and no way to mark an option destructive, and neither absence had been decided. Nine unaccounted parameters print on every regen. ### facet_uikit — a context menu, as the platform's own long press - **`context_menu` is built on iOS**: `UIContextMenuInteraction` + `UIMenu` / `UIAction`, in `menus.cplus`. A right-click and a touch-and-hold are one affordance — Apple's own framing — so the ledger's `ContextFlyout` maps 1:1 and facet's contract never says "right click"; each backend picks the gesture its platform has, the way `swipeable` is a menu on macOS and a pan on iOS. - **The menu is built when it OPENS**, not when it is attached. A `UIMenu` is immutable and arrives from a provider block, where AppKit mutates an NSMenu built at attach time — so the provider re-reads the nodes each time and `enabled` and the titles are current with no refresh path at all. - **A UIAction is the sender.** `UIActionHandler` is `void (^)(UIAction *)`, so one block type serves every item. `UIAccessibilityIdentification` is not adopted by `UIMenuElement`, so the key rides `UIAction.identifier` — the slot that means the same thing — and the payload rides an associated object. `component::key_of` / `item_of` answer off a menu action exactly as off a row, and reading a sender that is not a view answers empty instead of raising, the same guard AppKit needed. - **A separator is an inline group.** UIKit has no separator element; the runs either side of a titleless item become `UIMenuOptionsDisplayInline` sub-menus, which is what draws the divider. - **Inside a table the TABLE answers** — `tableView:contextMenuConfiguration ForRowAtIndexPath:point:` — because UITableView intercepts the long press to arbitrate it against scrolling. The same split that made a `context_menu` in an NSOutlineView row unreachable on AppKit. Both paths end in one function. - The blocks are hand-built with a **static** descriptor rather than taken from the generated binding: `Block_copy` keeps the descriptor POINTER, and a UIAction is retained by UIKit for the life of the menu, so a descriptor on the frame that built the action is read after that frame is gone. - Six checks in `selftest.cplus`, run on a real simulator by `tools/run_ios_tests.sh` — 78 passed, 0 failed. Disabling the two lines in `wants_view` / `create` turns two of them red, which is what makes them checks rather than decoration. ### facet — the payload half of a handler - **`item:` at construction**, on the eight controls whose ledger type declares `CommandParameter` — button, checkbox, icon_button, refreshable, menu_item, context_menu_item, swipe_item, toolbar_item. It sits on the shared band beside `key`, and the pair is the point: **key is the ADDRESS a node answers to, item is the PAYLOAD its handler receives.** - It had to be a *constructor parameter* rather than only `core::set_item`. A handler is `fn(sender, ctx)` and a bound method fills `ctx` with its RECEIVER (E0824) — the same pointer for every row — so the payload is the only thing that can say which one, and it has to be settable in the same expression that sets the handler. Reached only through a setter it forces a builder call into three statements, which is why an application that needed it encoded the payload into the KEY and parsed it back out instead. - Appended LAST in each signature, so nothing a caller already passes positionally moves; every existing call site compiles unchanged. - **`CommandParameter` stopped being dropped as MVVM.** It shared one regex and one reason string with `Command` — but `Command` is `ICommand`, which IS the view-model and is rightly dropped, while `CommandParameter` is the ARGUMENT the handler needs. facet had already rebuilt the concept from first principles as `core::set_item` / `item_of`, whose own comment reads "an item IS the payload half of a handler" — this row's definition. The map now points at where it lives instead of contradicting the code. ### facet — the contract closes over TYPES, not only rows - **Guard 7**: a type the ledger renders must be decided. A row could not leave the ledger without a reason — an unmapped one fails the run — and a TYPE could. The existing type closure builds its work list from the rows a type declares, so a type whose surface is entirely INHERITED was never asked about, which is exactly what a marker type looks like: `MenuFlyoutSeparator` declares one member, its constructor. - The floor is the ledger's own definition of "this renders": every type it puts on screen has an `IHandler`. Each must be extracted, aliased, dropped by family, or **UNBUILT** — a fourth outcome the other three could not express, because ALIAS claims "already covered, nothing refused". - Three were claiming exactly that and were wrong: `MenuFlyoutSubItem` aliased to `MenuFlyout` (a submenu is not a flyout), `MenuBar` to `MenuBarItem` (the item is not the bar), `SwipeItemView` to `SwipeItem`. Six types now print each regen with the platform answer named: MenuBar, MenuFlyoutSeparator, MenuFlyoutSubItem, ShapeView, SwipeItemMenuItem, SwipeItemView. - The check runs from `gen_contract`, not from `ledger_spec`, because that is where it RUNS: `ledger_spec.py` has not been able to regenerate the spec for some time (`check_type_closure` fails on `Matrix`, `NavigationProxy`, `Shape`, `TableModel` and the GIF decoder, none of which have a family rule), so `ledger-spec.json` is a frozen artifact and a floor living only there would never fire. Repairing that tool is its own job. ### facet — six gaps found building iris - **A `context_menu` in a tree or list row can now open.** A table or outline view handles right-click itself and asks its OWN `menu`, which facet never set — so a menu nested in a row was built, attached to the row's view, and unreachable. Both row hosts are facet subclasses now (`FacetTableView` / `FacetOutlineView`) whose `menuForEvent:` answers with the clicked row's menu, after calling super so `clickedRow` still draws the ring. `swipeable`/`swipe_item` was unreachable the same way and is reachable for the same reason. - **A `context_menu` under an unkeyed container is no longer dropped.** A node carrying one asks for a view exactly as one with a gesture or a background does — `wants_menu` joins `has_gestures` and `wants_painting`. Direct children only, so the rule agrees with `attach_context_menu`. - **`run_job` answers whether it started, and refuses a second flight.** Two workers inside one job's `run()` assign the same fields; where those are `Text` or `Vec` the second frees what the first is writing. It shipped as a SIGSEGV. A 64-slot table of job addresses, claimed before the worker spawns and released when the apply is done. `job_in_flight` is the question five services were each answering with a private flag. - **The agent surface tells a wired control from a dead one.** `describe_ui` reports `wired` beside `actionable` and `clickable`, and `click` answers `no_handler` — because an NSControl is driven by its target/action and ONLY that, so a gesture band on a button never fires. Made honest at the source: `controls::arm_control` installs an action when there is something on the other end and clears it when there is not, so lldb and Accessibility Inspector read the same fact. - **The neutral runtime facade compiles, and keeps the facade's surface.** `runtime.cplus` promises app code type-checks on every target; it had stopped compiling on all of them (`Appearance::System` never existed) and was missing eight members the real facades carry. Build it with `cpc build --target android-arm64` — a platform-shadowed file is unbuilt by default on the platform you are standing on. - **A `context_menu_item` handler can tell which item fired it.** A handler is `fn(sender, ctx)` and `ctx` is the component — the same pointer for every row — so identity is read off the sender, and a menu item was the one control kind carrying neither half, because both bindings live in `views::create` and a menu kind never gets a view. `bind_menu_identity` gives it the key as its `accessibilityIdentifier` and the item pointer as an associated object, so `component::key_of` / `item_of` answer from a menu action exactly as from a button. `swipe_item` gets it too. - **A sender that is not a view no longer raises.** `key_of` and `item_of` walk `superview` when the first hop finds nothing, and an NSMenuItem does not answer it — so the natural line sent an unrecognised selector from inside a menu action. `input::superview_of` answers 0 for an object with no superview, which is what the walk's termination condition already means. - **`context_menu` on iOS is an audible debt.** Being a non-view kind was answered first and stopped the question, so declaring one produced no menu and no warning. It warns once now, like every other not-yet-built kind. `facet_gtk`'s README carries the same decision in writing. ### Language — a label names a parameter of the receiver's own method - **Two types may share a labeled method name.** Named arguments are rewritten into positional order by the LOWERING pass, which runs before types exist and so keys method candidates by bare name — every type declaring `on` was a candidate for `s.on(v: 5)`, and the call was **E1002** whenever those candidates disagreed. It now settles only what every candidate agrees on and leaves the rest to sema, which knows the receiver's type and arranges the call from that type's own parameter list. `reload(then:, then_ctx:)` on two stores no longer breaks either one's callers, and no method needs renaming to make a labeled call resolve. - **Two identical declarations are one arrangement.** The dedup that decides whether two candidates would lower a call the same way compared the spliced default *expressions*, and an `Expr` carries its span — so the `0` in one impl block never equalled the `0` in another, and any call omitting a shared default was reported as ambiguous between two declarations a reader cannot tell apart. Defaults now compare by VALUE. - **A label that fits only another type's method was a MISCOMPILE, not an error.** Given `A::go(v, ctx = 0)` and `B::go(ctx, v = 9)`, the call `a.go(ctx: 3)` had exactly one candidate that accepted it — B's — and that arrangement was applied to an `A` receiver: the label `ctx` bound to A's parameter `v`, and B's default `9` was spliced into A's `ctx`. It compiled, and returned a value, for a call whose required argument was never given. Accepting is not belonging: with more than one candidate, a candidate *rejecting* the call is itself type-dependent information, so the decision goes to sema. `a.go(ctx: 3)` is now E0308, naming A's own `v`. - **E1002 is left for the callees that really have no parameter names**: a fn-pointer value (its type records parameter types, not names — a handler field included), and a method reached through a generic receiver, which is not one type until it is instantiated. Its message says which, instead of describing method-name matching that no longer decides anything.