* Handle static lastIndexOf position semantics
* Record TS7 baseline for positioned string search corpus
* Stabilize HTTP timeout differential fixtures
* Order proxy fixture server shutdown
* chore(release): prepare v0.1.4
- Bump the CLI, compiler, runtime, and platform packages to 0.1.4.
- Add v0.1.4 release notes and regenerate the static surface manifest.
* test: keep upgrade fairness client open through timer check
- Keep upgraded clients connected through the fairness timer check under CI load.
- Fail the driver clearly if its watchdog expires.
* test: record fork dispatch TS7 baseline
- Record the new fork dispatch corpus entry in the TS7 order canary.
- Pin its single-module evaluation order and empty preflight diagnostics.
* fix(runtime): complete fork IPC shutdown before close
- Release the IPC writer listener when the remote channel closes after writes finish.
- Deliver disconnect before close for forked children with active IPC listeners.
* fix(http): enforce HTTP/1.1 Host requirement
- Enforce Node's default Host behavior while preserving opt-out and HTTP/1.0 handling.
- Match the 400 wire response and add C/LLVM differential coverage.
* feat(http): add static HTTP trailer and streaming support
- Parse incoming chunk trailers and expose distinct/raw trailer reads.
- Frame outgoing trailers and add streaming controls with differential coverage.
* fix(http): harden request trailer parsing
- Safely discard trailers after early responses while preserving parser validation.
- Bound aggregate head and trailer parsing by bytes and field count.
- Add regressions for early response trailers and overflow rejection.
What we did:
- Add the compiler and runtime support required to build the real Portless CLI as a fully static native binary and run its proxy, alias, framework, parallel-registration, and process-cleanup workflows without Node.
- Support Portless's dual HTTP/1.1 and HTTP/2 secure-server graph, including ALPN dispatch, shared request/connect listeners, HTTP/2 CONNECT responses, enableConnectProtocol settings, req.stream access, session errors, and the required ownership and lifecycle handling.
- Lower Portless's indexed absence probes, strict indexed comparisons, optional chains, server options, and container patterns. Preserve Node-style self-reexecution and correctly frame forwarded chunked responses.
- Add focused corpus and server differentials plus an isolated-copy acceptance harness that builds and exercises the pinned Portless checkout in plain and sanitized modes without modifying the external checkout.
- Validate the static binary against Portless's official e2e suite: all 13 files and 16 tests pass.
What we decided was out of scope:
- Broader HTTP/2 client policy, lifecycle compatibility, protocol validation, listener overloads, and unrelated HTTP/2 completeness.
- General runtime-optional soundness beyond the Portless paths. Making that mechanism generally sound requires function-scoped tracking so reused local IDs cannot leak optional state between functions, assignment-aware tracking so writing a definitely present value clears hidden undefined state, and correct preservation across generators, modules, and finally blocks. That larger cross-cutting change remains a dedicated follow-up.
- Removing the self-reexecution heuristic's inherent ambiguity. A direct invocation whose first user argument canonically names the executable is currently treated as Node's repeated script slot and collapsed. An explicit native reexec marker can address that in future work.
- Bound each readable wake so busy sockets yield to timers and other descriptors.
- Add differential coverage for continuously flooded upgraded connections.
- The crypto introspection statics (getFips and the cipher/hash/curve name lists) bake at the call site, and the crypto constant table joins http2's under a generalized per-module baked-constants lowering.
- The CA-store introspection surface lands in its own unit (scr_tls_ca.c) behind its own link gate, so a getCACertificates-only binary never pulls mbedTLS: getCACertificates, rootCertificates, setDefaultCACertificates.
- http2.createSecureServer grows the eager request handler and the runtime options record, riding the same server-options walk as tls.createServer; string-typed 'data' listeners decode.
- process once/off for 'unhandledRejection' plus the sibling 'rejectionHandled' registry, removal by closure identity per the warning-registry stance.
- Merge resolution unions this lane with main's fs ladders, createRequire erasure, and dyn secure-context work; the runtime's retired "DOM" nickname is spelled "dyn" throughout.
- The ratified rename rider (world-unification §7 lane 5): "DOM" collided with the browser DOM and, post-lane-1, the structure is no longer a document tree. Comments and doc prose now say "the checked-dynamic tree" for the noun and "dyn" adjectivally; runtime symbol names (scr_dyn_*), the error.domClone libCall, and the real web DOMException family are unchanged.
- The few user-facing strings carrying the nickname move with it (the structuredClone cyclic message, the dc subscriber/publish fences, two emitter ICE texts); diagnostics snapshots regenerated (96 pass). One private compiler constant (DOM_PROTO_METHOD_NAMES -> DYN_PROTO_METHOD_NAMES) rides along.
- Mechanical sweep, 142 files, comments/prose only — no behavior change.
Chris Tate