@shd101wyy/yo 0.1.28 → 0.1.30

package/std/encoding/hex.yo

@@ -48,7 +48,7 @@ _hex_encode_impl :: (fn(data : ArrayList(u8), hex_chars : str) -> String)({
   out := ArrayList(u8).with_capacity(data.len() * usize(2));
   i := usize(0);
   while(i < data.len(), i = (i + usize(1)), {
-    b := data.get(i).unwrap();
+    b := data(i);
     hi := usize((b >> u8(4)) & u8(0xF));
     lo := usize(b & u8(0xF));
     out.push(hex_chars.bytes(hi));
@@ -64,7 +64,7 @@ export(hex_encode);
 // ============================================================================
 // Decoding
 // ============================================================================
-_hex_nibble :: (fn(c : u8, using(exn : Exception)) -> u8)(
+_hex_nibble :: (fn(c : u8, exn : Exception) -> u8)(
   cond(
     ((c >= u8(48)) && (c <= u8(57))) => (c - u8(48)),
     // '0'-'9'
@@ -76,7 +76,7 @@ _hex_nibble :: (fn(c : u8, using(exn : Exception)) -> u8)(
   )
 );
 /// Decode a hexadecimal string to bytes. Throws via `Exception` on invalid input.
-hex_decode :: (fn(s : str, using(exn : Exception)) -> ArrayList(u8))({
+hex_decode :: (fn(s : str, exn : Exception) -> ArrayList(u8))({
   cond(
     ((s.len() % usize(2)) != usize(0)) => {
       exn.throw(dyn(EncodingError.OddLength));
@@ -86,8 +86,8 @@ hex_decode :: (fn(s : str, using(exn : Exception)) -> ArrayList(u8))({
   out := ArrayList(u8).with_capacity(s.len() / usize(2));
   i := usize(0);
   while(i < s.len(), i = (i + usize(2)), {
-    hi := _hex_nibble(s.bytes(i));
-    lo := _hex_nibble(s.bytes(i + usize(1)));
+    hi := _hex_nibble(s.bytes(i), exn);
+    lo := _hex_nibble(s.bytes(i + usize(1)), exn);
     out.push((hi << u8(4)) | lo);
   });
   out

package/std/encoding/json.yo

@@ -8,10 +8,11 @@
 //! { json_parse, json_stringify, JsonValue } :: import "std/encoding/json";
 //! { Exception } :: import "std/error";
 //!
-//! given(exn) := Exception(throw : ((err) -> { escape (); }));
+//! exn := Exception(throw : ((err) -> { unwind (); }));
 //! v := json_parse(`{"x": 1}`);
 //! println(json_stringify(v));
 //! ```
+pragma(Pragma.AllowUnsafe);
 open(import("../string"));
 { ArrayList } :: import("../collections/array_list");
 { snprintf } :: import("../libc/stdio");
@@ -30,7 +31,7 @@ JsonError :: enum(
   InvalidNumber,
   /// Invalid escape sequence in a string.
   InvalidEscape,
-  /// Invalid Unicode escape in a string.
+  /// Invalid Unicode unwind in a string.
   InvalidUnicode,
   /// Other error with a descriptive message.
   Other(msg : String)
@@ -90,8 +91,8 @@ impl(
         i := usize(0);
         while(i < keys.len(), i = (i + usize(1)), {
           cond(
-            (keys.get(i).unwrap() == key) => {
-              return(.Some(values.get(i).unwrap()));
+            (keys(i) == key) => {
+              return(.Some(values(i)));
             },
             true => ()
           );
@@ -149,7 +150,7 @@ impl(
         result := ArrayList(JsonKV).new();
         i := usize(0);
         while(i < keys.len(), i = (i + usize(1)), {
-          result.push(JsonKV(key : keys.get(i).unwrap(), value : values.get(i).unwrap()));
+          result.push(JsonKV(key : keys(i), value : values(i)));
         });
         .Some(result)
       },
@@ -157,6 +158,54 @@ impl(
     )
   )
 );
+/// Index trait — `v(key)` returns the child JsonValue for `key`, panicking
+/// if `v` is not an Object or the key is missing.
+impl(
+  JsonValue,
+  Index(String)(
+    Output : JsonValue,
+    index : (fn(ref(self) : Self, key : String) -> *(Self.Output))(
+      match(
+        self,
+        .Object(keys, values) => {
+          i := usize(0);
+          while(i < keys.len(), i = (i + usize(1)), {
+            if(keys(i) == key, {
+              // SAFETY: `i` is bounded by `keys.len()` and the
+              // Object variant invariant says `values.len() ==
+              // keys.len()`, so `values.project(i)` yields a valid
+              // ref into the Rc-managed values list.
+              return(unsafe(&(values.project(i))));
+            });
+          });
+          panic("JsonValue: key not found in Object")
+        },
+        _ => panic("JsonValue: index by String requires .Object variant")
+      )
+    )
+  )
+);
+/// Index trait — `v(i)` returns the i-th JsonValue, panicking if `v` is
+/// not an Array or `i` is out of bounds.
+impl(
+  JsonValue,
+  Index(usize)(
+    Output : JsonValue,
+    index : (fn(ref(self) : Self, idx : usize) -> *(Self.Output))(
+      match(
+        self,
+        .Array(items) => {
+          assert(idx < items.len(), "JsonValue: Array index out of bounds");
+          // SAFETY: assert above bounds `idx`; `items` is the
+          // Rc-managed Array list whose storage outlives this call
+          // (ref(self) keeps `self` and therefore `items` alive).
+          return(unsafe(&(items.project(idx))));
+        },
+        _ => panic("JsonValue: index by usize requires .Array variant")
+      )
+    )
+  )
+);
 export(JsonValue, JsonKV);
 // ============================================================================
 // Parser state
@@ -364,7 +413,7 @@ impl(
     num_buf.push(u8(0));
     num_ptr := *(char)(num_buf.ptr().unwrap());
     { atof } :: import("../libc/stdlib");
-    val := atof(num_ptr);
+    val := unsafe(atof(num_ptr));
     .Ok(val)
   })
 );
@@ -553,7 +602,7 @@ _parse_value :: (fn(p : _Parser) -> Result(JsonValue, JsonError))({
 // Public API
 // ============================================================================
 /// Parse a JSON string into a `JsonValue` tree. Throws via `Exception` on invalid input.
-json_parse :: (fn(s : str, using(exn : Exception)) -> JsonValue)({
+json_parse :: (fn(s : str, exn : Exception) -> JsonValue)({
   p := _Parser.new(s);
   match(
     _parse_value(p),
@@ -570,7 +619,7 @@ _write_str_escaped :: (fn(s : String, out : ArrayList(u8)) -> unit)({
   bytes := s.as_bytes();
   i := usize(0);
   while(i < bytes.len(), i = (i + usize(1)), {
-    b := bytes.get(i).unwrap();
+    b := bytes(i);
     cond(
       (b == u8(34)) => {
         out.push(u8(92));
@@ -628,12 +677,12 @@ _stringify_into :: (fn(value : JsonValue, out : ArrayList(u8)) -> unit)({
     .Number(n) => {
       buf := Array(u8, usize(32)).fill(u8(0));
       buf_ptr := &(buf(usize(0)));
-      snprintf(*(char)(buf_ptr), usize(32), "%g", n);
+      unsafe(snprintf(*(char)(buf_ptr), usize(32), "%g", n));
       s2 := String.from_cstr(buf_ptr).unwrap();
       bytes := s2.as_bytes();
       i := usize(0);
       while(i < bytes.len(), i = (i + usize(1)), {
-        out.push(bytes.get(i).unwrap());
+        out.push(bytes(i));
       });
     },
     .Str(s) => {
@@ -649,7 +698,7 @@ _stringify_into :: (fn(value : JsonValue, out : ArrayList(u8)) -> unit)({
           },
           true => ()
         );
-        recur(items.get(i).unwrap(), out);
+        recur(items(i), out);
       });
       out.push(u8(93)); // ']'
     },
@@ -663,9 +712,9 @@ _stringify_into :: (fn(value : JsonValue, out : ArrayList(u8)) -> unit)({
           },
           true => ()
         );
-        _write_str_escaped(keys.get(i).unwrap(), out);
+        _write_str_escaped(keys(i), out);
         out.push(u8(58)); // ':'
-        recur(values.get(i).unwrap(), out);
+        recur(values(i), out);
       });
       out.push(u8(125)); // '}'
     }

package/std/encoding/punycode.yo

@@ -12,6 +12,7 @@
 //! ascii_domain := to_ascii(`münchen.de`);  // "xn--mnchen-3ya.de"
 //! unicode_domain := to_unicode(ascii_domain);  // "münchen.de"
 //! ```
+pragma(Pragma.AllowUnsafe);
 open(import("../string"));
 { ArrayList } :: import("../collections/array_list");
 // Punycode constants (RFC 3492 section 5)
@@ -53,25 +54,25 @@ _adapt :: (fn(delta_val : i32, num_points : i32, first_time : bool) -> i32)({
   k + ((((_BASE - _TMIN) + i32(1)) * d) / (d + _SKEW))
 });
 // Encode a single Unicode code point as UTF-8 bytes.
-_encode_codepoint :: (fn(cp : i32, out : *(ArrayList(u8))) -> unit)(
+_encode_codepoint :: (fn(cp : i32, out : ArrayList(u8)) -> unit)(
   cond(
     (cp < i32(0x80)) => {
-      out.*.push(u8(cp));
+      out.push(u8(cp));
     },
     (cp < i32(0x800)) => {
-      out.*.push(u8(i32(0xC0) | (cp >> i32(6))));
-      out.*.push(u8(i32(0x80) | (cp & i32(0x3F))));
+      out.push(u8(i32(0xC0) | (cp >> i32(6))));
+      out.push(u8(i32(0x80) | (cp & i32(0x3F))));
     },
     (cp < i32(0x10000)) => {
-      out.*.push(u8(i32(0xE0) | (cp >> i32(12))));
-      out.*.push(u8(i32(0x80) | ((cp >> i32(6)) & i32(0x3F))));
-      out.*.push(u8(i32(0x80) | (cp & i32(0x3F))));
+      out.push(u8(i32(0xE0) | (cp >> i32(12))));
+      out.push(u8(i32(0x80) | ((cp >> i32(6)) & i32(0x3F))));
+      out.push(u8(i32(0x80) | (cp & i32(0x3F))));
     },
     true => {
-      out.*.push(u8(i32(0xF0) | (cp >> i32(18))));
-      out.*.push(u8(i32(0x80) | ((cp >> i32(12)) & i32(0x3F))));
-      out.*.push(u8(i32(0x80) | ((cp >> i32(6)) & i32(0x3F))));
-      out.*.push(u8(i32(0x80) | (cp & i32(0x3F))));
+      out.push(u8(i32(0xF0) | (cp >> i32(18))));
+      out.push(u8(i32(0x80) | ((cp >> i32(12)) & i32(0x3F))));
+      out.push(u8(i32(0x80) | ((cp >> i32(6)) & i32(0x3F))));
+      out.push(u8(i32(0x80) | (cp & i32(0x3F))));
     }
   )
 );
@@ -82,7 +83,7 @@ _string_to_codepoints :: (fn(s : String) -> ArrayList(i32))({
   (i : usize) = usize(0);
   (blen : usize) = bytes.len();
   while(i < blen, {
-    (b : i32) = i32(bytes.get(i).unwrap());
+    (b : i32) = i32(bytes(i));
     (cp : i32) = i32(0);
     (size : usize) = usize(1);
     cond(
@@ -108,7 +109,7 @@ _string_to_codepoints :: (fn(s : String) -> ArrayList(i32))({
     (j : usize) = usize(1);
     while(j < size, {
       if((i + j) < blen, {
-        cp = ((cp << i32(6)) | (i32(bytes.get(i + j).unwrap()) & i32(0x3F)));
+        cp = ((cp << i32(6)) | (i32(bytes(i + j)) & i32(0x3F)));
       });
       j = (j + usize(1));
     });
@@ -127,7 +128,7 @@ punycode_decode :: (fn(input : String) -> Option(String))({
   (basic_end : i32) = i32(-(1));
   (j : i32) = (input_len - i32(1));
   while((j >= i32(0)) && (basic_end < i32(0)), {
-    if(i32(bytes.get(usize(j)).unwrap()) == i32(0x2D), {
+    if(i32(bytes(usize(j))) == i32(0x2D), {
       basic_end = j;
     });
     j = (j - i32(1));
@@ -139,7 +140,7 @@ punycode_decode :: (fn(input : String) -> Option(String))({
   );
   (bi : i32) = i32(0);
   while(bi < basic_length, {
-    (cp : i32) = i32(bytes.get(usize(bi)).unwrap());
+    (cp : i32) = i32(bytes(usize(bi)));
     if(cp >= i32(0x80), {
       return(.None);
     });
@@ -162,7 +163,7 @@ punycode_decode :: (fn(input : String) -> Option(String))({
       if(idx >= input_len, {
         return(.None);
       });
-      (digit : i32) = _decode_digit(i32(bytes.get(usize(idx)).unwrap()));
+      (digit : i32) = _decode_digit(i32(bytes(usize(idx))));
       idx = (idx + i32(1));
       if(digit < i32(0), {
         return(.None);
@@ -198,7 +199,7 @@ punycode_decode :: (fn(input : String) -> Option(String))({
   (result_bytes : ArrayList(u8)) = ArrayList(u8).new();
   (ri : usize) = usize(0);
   while(ri < output.len(), {
-    _encode_codepoint(output.get(ri).unwrap(), &(result_bytes));
+    _encode_codepoint(output(ri), result_bytes);
     ri = (ri + usize(1));
   });
   .Some(String.from_bytes(result_bytes))
@@ -212,7 +213,7 @@ punycode_encode :: (fn(input : String) -> String)({
   (basic_count : i32) = i32(0);
   (ci : i32) = i32(0);
   while(ci < cp_count, {
-    (cp : i32) = cps.get(usize(ci)).unwrap();
+    (cp : i32) = cps(usize(ci));
     if(cp < i32(0x80), {
       out.push(u8(cp));
       basic_count = (basic_count + i32(1));
@@ -231,7 +232,7 @@ punycode_encode :: (fn(input : String) -> String)({
     (m : i32) = i32(0x7FFFFFFF);
     (mi : i32) = i32(0);
     while(mi < cp_count, {
-      (cp : i32) = cps.get(usize(mi)).unwrap();
+      (cp : i32) = cps(usize(mi));
       if((cp >= n) && (cp < m), {
         m = cp;
       });
@@ -241,7 +242,7 @@ punycode_encode :: (fn(input : String) -> String)({
     n = m;
     (ei : i32) = i32(0);
     while(ei < cp_count, {
-      (cp : i32) = cps.get(usize(ei)).unwrap();
+      (cp : i32) = cps(usize(ei));
       if(cp < n, {
         delta = (delta + i32(1));
       });
@@ -283,7 +284,7 @@ to_unicode :: (fn(hostname : String) -> String)({
   (result : String) = ``;
   (pi : usize) = usize(0);
   while(pi < parts.len(), {
-    (part : String) = parts.get(pi).unwrap();
+    (part : String) = parts(pi);
     if(pi > usize(0), {
       result = `${result}.`;
     });
@@ -315,7 +316,7 @@ to_ascii :: (fn(hostname : String) -> String)({
   (result : String) = ``;
   (pi : usize) = usize(0);
   while(pi < parts.len(), {
-    (part : String) = parts.get(pi).unwrap();
+    (part : String) = parts(pi);
     if(pi > usize(0), {
       result = `${result}.`;
     });
@@ -324,7 +325,7 @@ to_ascii :: (fn(hostname : String) -> String)({
     (bytes : ArrayList(u8)) = part.as_bytes();
     (bi : usize) = usize(0);
     while(bi < bytes.len(), {
-      if(i32(bytes.get(bi).unwrap()) >= i32(0x80), {
+      if(i32(bytes(bi)) >= i32(0x80), {
         has_non_ascii = true;
       });
       bi = (bi + usize(1));

package/std/encoding/toml.yo

@@ -10,6 +10,7 @@
 //! // Or via the encoding index:
 //! { toml_parse, TomlValue } :: import "std/encoding";
 //! ```
+pragma(Pragma.AllowUnsafe);
 open(import("../string"));
 { ArrayList } :: import("../collections/array_list");
 /// TOML value type — the result of parsing a TOML document.
@@ -37,8 +38,8 @@ impl(
         i := usize(0);
         while(i < keys.len(), i = (i + usize(1)), {
           cond(
-            (keys.get(i).unwrap() == key) => {
-              return(.Some(values.get(i).unwrap()));
+            (keys(i) == key) => {
+              return(.Some(values(i)));
             },
             true => ()
           );
@@ -62,7 +63,7 @@ impl(
         found := false;
         while(i < len, i = (i + usize(1)), {
           cond(
-            (keys.get(i).unwrap() == key) => {
+            (keys(i) == key) => {
               &(values(i)).* = value;
               found = true;
             },

package/std/encoding/utf16.yo

@@ -68,11 +68,11 @@ export(utf8_to_utf16);
 ///
 /// Decodes surrogate pairs back into supplementary code points.
 /// Throws via `Exception` on unpaired surrogates.
-utf16_to_utf8 :: (fn(data : ArrayList(u16), using(exn : Exception)) -> String)({
+utf16_to_utf8 :: (fn(data : ArrayList(u16), exn : Exception) -> String)({
   out := ArrayList(u8).new();
   i := usize(0);
   while(i < data.len(), {
-    w := u32(data.get(i).unwrap());
+    w := u32(data(i));
     cond(
       // Surrogate pair: high surrogate 0xD800-0xDBFF
       ((w >= u32(0xD800)) && (w <= u32(0xDBFF))) => {
@@ -82,7 +82,7 @@ utf16_to_utf8 :: (fn(data : ArrayList(u16), using(exn : Exception)) -> String)({
           },
           true => ()
         );
-        w2 := u32(data.get(i + usize(1)).unwrap());
+        w2 := u32(data(i + usize(1)));
         cond(
           ((w2 < u32(0xDC00)) || (w2 > u32(0xDFFF))) => {
             exn.throw(dyn(EncodingError.InvalidChar(u8(0))));

package/std/env.yo

@@ -3,6 +3,7 @@
 //!
 //! Mirrors the layout of Rust's `std::env`. Platform/architecture detection
 //! and child-process spawning live in `std/process`.
+pragma(Pragma.AllowUnsafe);
 open(import("./collections/array_list"));
 open(import("./string"));
 open(import("./path"));
@@ -57,7 +58,7 @@ env :: impl({
   /// Returns `.None` if the variable is not set.
   get :: (fn(name : String) -> Option(String))({
     name_cstr := name.to_cstr().ptr().unwrap();
-    val_ptr := getenv(*(char)(name_cstr));
+    val_ptr := unsafe(getenv(*(char)(name_cstr)));
     match(
       val_ptr,
       .None =>.None,
@@ -75,13 +76,13 @@ env :: impl({
         { _putenv_s } :: import("./libc/windows");
         cond(
           overwrite =>
-            _putenv_s(*(char)(name_cstr), *(char)(value_cstr)),
+            unsafe(_putenv_s(*(char)(name_cstr), *(char)(value_cstr))),
           true => {
-            existing := getenv(*(char)(name_cstr));
+            existing := unsafe(getenv(*(char)(name_cstr)));
             match(
               existing,
               .Some(_) => int(0),
-              .None => _putenv_s(*(char)(name_cstr), *(char)(value_cstr))
+              .None => unsafe(_putenv_s(*(char)(name_cstr), *(char)(value_cstr)))
             )
           }
         )
@@ -91,7 +92,7 @@ env :: impl({
           overwrite => int(1),
           true => int(0)
         );
-        setenv(*(char)(name_cstr), *(char)(value_cstr), overwrite_int)
+        unsafe(setenv(*(char)(name_cstr), *(char)(value_cstr), overwrite_int))
       }
     );
     return(result == int(0));
@@ -105,27 +106,29 @@ cwd :: (fn() -> Result(Path, String))(
   cond(
     (platform == Platform.Windows) => {
       { GetCurrentDirectoryW, WideCharToMultiByte, CP_UTF8, WCHAR, DWORD } :: import("./libc/windows");
-      required_size := GetCurrentDirectoryW(ulong(0),.None);
+      required_size := unsafe(GetCurrentDirectoryW(ulong(0),.None));
       cond(
         (required_size == ulong(0)) =>.Err(`Failed to get current working directory on Windows`),
         true => {
           wbuf := *(WCHAR)(malloc(usize(required_size) * usize(2)).unwrap());
-          actual_size := GetCurrentDirectoryW(required_size,.Some(wbuf));
+          actual_size := unsafe(GetCurrentDirectoryW(required_size,.Some(wbuf)));
           cond(
             (actual_size == ulong(0)) => {
               free(.Some(*(void)(wbuf)));
               .Err(`Failed to get current working directory on Windows`)
             },
             true => {
-              utf8_size := WideCharToMultiByte(
-                CP_UTF8,
-                ulong(0),
-                .Some(wbuf),
-                i32(actual_size),
-                .None,
-                i32(0),
-                .None,
-                .None
+              utf8_size := unsafe(
+                WideCharToMultiByte(
+                  CP_UTF8,
+                  ulong(0),
+                  .Some(wbuf),
+                  i32(actual_size),
+                  .None,
+                  i32(0),
+                  .None,
+                  .None
+                )
               );
               cond(
                 (utf8_size <= i32(0)) => {
@@ -134,15 +137,17 @@ cwd :: (fn() -> Result(Path, String))(
                 },
                 true => {
                   utf8_buf := *(u8)(malloc(usize(utf8_size) + usize(1)).unwrap());
-                  result := WideCharToMultiByte(
-                    CP_UTF8,
-                    ulong(0),
-                    .Some(wbuf),
-                    i32(actual_size),
-                    .Some(utf8_buf),
-                    utf8_size,
-                    .None,
-                    .None
+                  result := unsafe(
+                    WideCharToMultiByte(
+                      CP_UTF8,
+                      ulong(0),
+                      .Some(wbuf),
+                      i32(actual_size),
+                      .Some(utf8_buf),
+                      utf8_size,
+                      .None,
+                      .None
+                    )
                   );
                   free(.Some(*(void)(wbuf)));
                   cond(
@@ -166,9 +171,16 @@ cwd :: (fn() -> Result(Path, String))(
     },
     true => {
       { getcwd } :: import("./libc/unistd");
+      // 4096 is PATH_MAX on Linux/macOS and exceeds MAX_PATH (260) on Windows;
+      // the few systems with longer paths fail gracefully via the .None branch
+      // below (getcwd returns NULL and sets errno=ERANGE).
       buf_size := usize(4096);
       buf := *(char)(malloc(buf_size).unwrap());
-      result_ptr := getcwd(buf, buf_size);
+      // SAFETY: `buf` points at a fresh malloc'd `buf_size`-byte buffer and
+      // is freed in both branches below. `getcwd(buf, buf_size)` writes at
+      // most `buf_size - 1` bytes plus a terminating NUL, then returns either
+      // `buf` (success) or NULL (failure — buffer too small / cwd unlinked).
+      result_ptr := unsafe(getcwd(buf, buf_size));
       match(
         result_ptr,
         .None => {
@@ -193,7 +205,7 @@ chdir :: (fn(path : Path) -> Result(unit, String))(
       { SetCurrentDirectoryA, BOOL } :: import("./libc/windows");
       path_str := path.to_string();
       path_cstr := path_str.to_cstr().ptr().unwrap();
-      result := SetCurrentDirectoryA(*(char)(path_cstr));
+      result := unsafe(SetCurrentDirectoryA(*(char)(path_cstr)));
       cond(
         (result == int(0)) =>.Err(`Failed to change directory to: ${path_str}`),
         true =>.Ok(())
@@ -203,7 +215,10 @@ chdir :: (fn(path : Path) -> Result(unit, String))(
       { chdir : unix_chdir } :: import("./libc/unistd");
       path_str := path.to_string();
       path_cstr := path_str.to_cstr().ptr().unwrap();
-      result := unix_chdir(*(char)(path_cstr));
+      // SAFETY: `unix_chdir` is libc `chdir` aliased on import;
+      // `path_cstr` is the null-terminated buffer that `to_cstr()`
+      // just produced and `path_str` keeps alive across this call.
+      result := unsafe(unix_chdir(*(char)(path_cstr)));
       cond(
         (result != int(0)) =>.Err(`Failed to change directory to: ${path_str}`),
         true =>.Ok(())

package/std/error.yo

@@ -4,7 +4,7 @@ open(import("./fmt"));
 /// Standard error trait for typed error propagation.
 /// All error types should implement this trait along with `ToString`.
 Error :: trait(
-  (source : (fn(self : *(Self)) -> Option(Dyn(SelfTrait)))) ?= ((self) ->.None),
+  (source : (fn(ref(self) : Self) -> Option(Dyn(SelfTrait)))) ?= ((self) ->.None),
   where(Self <: ToString)
 );
 export(Error);
@@ -15,15 +15,27 @@ export(AnyError);
 impl(String, Error());
 /// Non-resumable exception handling effect record.
 /// Use `throw` to raise an `AnyError` and abort the current computation.
+/// `throw` is `ctl(...)` — handler body may contain `unwind`, and the
+/// handler value is frame-bound (see plans/EXPLICIT_EFFECTS.md §4).
 Exception :: struct(
-  throw : (fn(forall(ResumeType : Type), error : AnyError) -> ResumeType)
+  throw : (ctl(forall(ResumeType : Type), error : AnyError) -> ResumeType)
 );
 export(Exception);
 /// Creates a resumable exception effect record parameterized by the resume type.
 /// Unlike `Exception`, the handler can return a value to resume the computation.
+/// `throw` is still `ctl(...)` because the handler MAY choose to unwind;
+/// regular `fn` returns are also valid via subtyping `fn <: ctl`.
 ResumableException :: (fn(comptime(ResumeType) : Type) -> comptime(Type))(
   struct(
-    throw : (fn(error : AnyError) -> ResumeType)
+    throw : (ctl(error : AnyError) -> ResumeType)
   )
 );
 export(ResumableException);
+/// Common effect bundle: Io + Exception.
+/// Used as the effect parameter for Futures that perform Io and may throw.
+/// Construct with `{ io, exn }`; project with `e.io` or `e.exn`.
+IoExn :: struct(
+  io : Io,
+  exn : Exception
+);
+export(IoExn);

package/std/fmt/display.yo

@@ -4,7 +4,7 @@
 //!
 //! ```rust
 //! impl(MyType, Display(
-//!   display : (fn(self: *(Self), writer: Writer) -> Writer)(
+//!   display : (fn(ref(self) : Self, writer : Writer) -> Writer)(
 //!     writer.write_str("MyType(").write_i64(i64(self.value)).write_str(")")
 //!   )
 //! ));
@@ -14,7 +14,7 @@
 /// Complement to `ToString` for streaming output into an existing buffer.
 Display :: (fn(comptime(T) : Type) -> comptime(Trait))(
   trait(
-    display : (fn(self : *(T), writer : Writer) -> Writer)
+    display : (fn(ref(self) : T, writer : Writer) -> Writer)
   )
 );
 export(Display);

package/std/fmt/index.yo

@@ -1,4 +1,5 @@
 //! Formatted output to stdout and stderr.
+pragma(Pragma.AllowUnsafe);
 { fwrite, stdout, stderr } :: import("../libc/stdio");
 { String } :: import("../string");
 { ToString } :: import("./to_string.yo");
@@ -11,11 +12,11 @@ println :: (fn(forall(T : Type), v : T, where(T <: ToString)) -> unit)({
   cond(
     (str_bytes_len > usize(0)) => {
       str_bytes_ptr := str_bytes.ptr().unwrap();
-      fwrite(*(void)(str_bytes_ptr), usize(1), str_bytes_len, stdout);
+      unsafe(fwrite(*(void)(str_bytes_ptr), usize(1), str_bytes_len, stdout));
     },
     true => ()
   );
-  fwrite(*(void)(*(u8)("\n")), usize(1), usize(1), stdout);
+  unsafe(fwrite(*(void)(*(u8)("\n")), usize(1), usize(1), stdout));
 });
 export(println);
 /// Print a value that implements `ToString` to stdout, without a trailing newline.
@@ -26,7 +27,7 @@ print :: (fn(forall(T : Type), v : T, where(T <: ToString)) -> unit)({
   cond(
     (str_bytes_len > usize(0)) => {
       str_bytes_ptr := str_bytes.ptr().unwrap();
-      fwrite(*(void)(str_bytes_ptr), usize(1), str_bytes_len, stdout);
+      unsafe(fwrite(*(void)(str_bytes_ptr), usize(1), str_bytes_len, stdout));
     },
     true => ()
   );
@@ -40,11 +41,11 @@ eprintln :: (fn(forall(T : Type), v : T, where(T <: ToString)) -> unit)({
   cond(
     (str_bytes_len > usize(0)) => {
       str_bytes_ptr := str_bytes.ptr().unwrap();
-      fwrite(*(void)(str_bytes_ptr), usize(1), str_bytes_len, stderr);
+      unsafe(fwrite(*(void)(str_bytes_ptr), usize(1), str_bytes_len, stderr));
     },
     true => ()
   );
-  fwrite(*(void)(*(u8)("\n")), usize(1), usize(1), stderr);
+  unsafe(fwrite(*(void)(*(u8)("\n")), usize(1), usize(1), stderr));
 });
 export(eprintln);
 /// Print a value that implements `ToString` to stderr, without a trailing newline.