Promise epoch-2026.9

[djabi]

epoch-2026.9 is now the current stable epoch.

This one is about memory safety — both removing the way to opt out of it, and
fixing the places where the compiler was not delivering it.

• unsafe is gone from the language. The unsafe annotation, unsafe { }
  blocks, and the raw pointer type T* were all removed. Nothing in the
  standard library or the catalog needed them. The capability annotations that
  remain are now native-only where that is the honest answer: `interior
  requires `native, and `sendable/`sharable are rejected on a
  Promise type. This is a breaking change if you were writing any of them.
• More than thirty ownership and codegen defects fixed. Most were silent —
  a go { } block capturing an owned local took ownership without marking it
  moved, so the outer scope read freed memory; Channel.send of a temporary
  closure corrupted the env; a typed error catch at a supertype dropped only
  the base type's fields. Bare failable calls in condition, for-in-subject,
  and match-scrutinee position were a systematic hole and are now checked.
• The compiler can cross-compile. A --target flag with triple-aware
  opt/llc/PAL selection, linker dispatch, and a target-keyed cache.
• HTTPS works end to end. Server.bind_tls for serving, and
  Client.set_tls_config for custom CAs and mutual TLS. A TLS server was
  sending only its leaf certificate on every backend, dropping the issuers in
  a fullchain.pem — that is fixed.
• macOS builds without Xcode. Linking goes through a bundled libSystem.tbd
  stub instead of Apple's SDK, matching what Windows and Linux already did. This
  landed because Xcode 27's SDK declares an architecture our linker cannot parse,
  which stopped Promise building on any Mac that updated — so the host SDK was
  removed as an input rather than pinned to a version that would break again.
• net, io and os grew what real programs need — DNS and
  connect-by-hostname, per-operation deadlines and cancellation, durable file
  writes (atomic rename, advisory locking, fsync), child-process supervision
  with signals and process groups, and a CSPRNG.

Failable goroutines landed too (go! plus auto-propagating <-), protocol
names are now reserved so a near-miss signature fails where it is written
rather than where it is used, and the test suite got several times faster.

Release notes and downloads: https://github.com/promise-language/promise/releases/tag/epoch-2026.9
Installing: https://github.com/promise-language/promise/blob/main/docs/installing.md

Promise is pre-1.0 and the language is still moving — expect breaking changes
between epochs. If you hit something, Q&A and Ideas are open.