- A union lacking null or undefined compares against that literal as a constant, both orders
- Effectful operands still evaluate exactly once; switch unit cases ride the same lowering
- The external adversarial corpus stands at 52 of 53 byte-identical
- the contract fixture declares every order anti-alphabetically (type names, fields, enum members, union arms, msg arms, helpers) and the harness asserts the exact orders on both emissions
- its probe reads the identity getters before init and after a poisoning trap and the harness compares both reads to the sidecar's build_id (V12 plus the ratified exemption, end to end)
- V13 rides two independent identical invocations compared hash-equal; V11 rides nm both directions over the prefix
- the contract-attest fixture pins tuple-returning init/update, subscriptions presence, the default <out>.contract.json path, the empty absent forms, and Date.now demoting deterministic to false
- the validator suite passes a full-vocabulary conformance document and catches one targeted mutation per rule, plus SC4009 refusal coverage through compileLibrary
- lib-contract.ts reads the entry's exported types, function signatures, and the ratified exported-const conventions (modelUnbound/msgUnbound/appearanceMsg/chromeMsg/envMsgs) from the AST in statement order, never the checker
- sidecar.ts projects them into the schema's closed vocabulary: declaration-ordered type table with synthesized <Container>_<member> records, five-family msg descriptors (number-first pins number_bytes, bytes-first takes the record family), helper table with the arena bit, channels, and the canonical abi.exports order
- build_id follows the schema's worked definition (compiler version, profile bytes, sorted canonical module graph) and lands on IrLibSection.identity so both backends emit the getters from the one value the sidecar records; the getters are pure constant returns with no entry prologue — poisoned-guard exempt, callable pre-init and post-trap
- not-yet facts emit the stated absent forms: integer_slots [] with every numeric slot f64, deterministic computed by a conservative ambient-surface scan (moduleLibNondeterministicSurface), async_free structural behind SC4005
- sidecar-validate.ts implements the V1-V14 self-check run before writing; unprojectable designations refuse as SC4009 naming the declaration; the CLI prints the sidecar path beside the archive
- profile.sidecar declares the echoed constants (wire/abi/snapshot), the identity-getter symbols, the model/msg designations, and the profile-selected "module-graph" source-hash contract; presence turns contract emission on
- wyhash.ts implements wyhash-64 final_version_3 (BigInt, vector-pinned) with the length-prefixed framing the schema's build_id definition requires
- the profile's exact bytes ride the resolved LibraryProfile (build_id input 2), getter symbols join the pairwise-distinct claim set, and unknown fields inside the section refuse as SC4001
- lowerUnitComparison folds ===/!== against a union lacking the unit arm to the constant answer, both operand orders
- a non-droppable operand still evaluates exactly once, riding a throwaway tag test
- union-switch case null / case undefined take the unit-comparison lowering, so a lacking arm never matches
- the unionEq fallback had coerced the literal through the stranded-arm trap, throwing where Node answers false
- corpus 2490-2494: the find-miss repro, every strict and loose spelling, switch unit cases, effect preservation
- mapType back-references mint placeholder shapes/unions finalized at frame exit; identity is per checker type, and context-sensitive (generic/mixin) knots stay fenced
- every type walk survives cyclic shape graphs: coinductive JSON/dyn-safety predicates, guarded formatIrType/jsvalLiftable, cycle headers via the existing collector fixpoint on both backends
- JSON.stringify throws V8's byte-exact circular TypeError (hop lines, ellipsis rule); cyclic values crossing into checked-dynamic slots trap instead of hanging
- console.log/util.inspect render <ref *N>/[Circular *N] exactly (SEMANTICS 129 resolved; depth:null lowers) and deepStrictEqual terminates through Node's pair memo
- corpus 2480-2488 green on C, LLVM, and the sanitized RC-audit lane, which proves child->parent cycles collect
- Six jobs: plain/san across three sha1-keyed case shards; an aggregate check keeps the old name
- SCRIPTC_TEST_SHARD slices the corpus harnesses; unset means everything
- Two vitest passes per job so file-granular sharding cannot drop corpus slices
- A canonical-table rewrite recognizes getter-table and star re-export plumbing
- Chaseable getter bodies type by their resolved values; the lexer name set is the contract
- Consumer-anchored errors degrade the opted-in package with a note instead of gating
- Two lowering ICE classes fixed; untyped packages stay flag-invariant
- purely additive: five new fixture entries, zero existing entries changed (2465 pins the flagless chunkGhost SC0001 — the lexer-only name the opt-in types)
- 2465-2468 byte-match Node fully static: the esbuild __export table, the __reExport star, the tsc __exportStar barrel, and the defineProperty getter family
- 2469 pins consumer-anchored degradation: a type-only surface name drops exactly the named package to the island with the site-count note
- auto opts a getter-table bundle in (the marker relaxation), and the untyped-package stub pin replaces the accidental inferred-surface bonus
- the island differential lane excludes the opt-in-only cases by design
- the tsc __esModule stamp and the void-init preamble (with later real assignments) lower to nothing instead of fencing at module load
- require() spreads in a module.exports table are star-re-export plumbing: names resolve statically and the module load rides the import edge
- island/mixin/shadow probes use a read-only peekLocal so speculative queries never thread capture state
- a capture threading through a non-lifted function fences with the binding named (SC1090, statement-deferred in JS) instead of the lowerer assertion
- the fallback loop attributes import-site SC0001s by message (module specifiers and typeof-import paths) and drops the named package with a site-count note
- the solo-probe last resort runs for ALL modes with a note naming the type-only and type-guard inference gap; explicit opt-ins degrade like auto's (the old keep-the-errors stance is superseded)
- require() and default imports of opted-in packages are program-module edges like the import-declaration form, and a compiled-entry resolution maps to its .ts source sibling when the checker admitted the source
- the fs shadow serves opted-in bundle files with the plumbing space-padded and one canonical tail table: chased getter values as alias-plumbed entries, star re-exports as spreads plus per-name member reads, lexer-visible-but-unchaseable names as checked-dynamic any bindings valued undefined
- lexer parity is the contract: the rewritten text answers the same name set to the CJS lexer that the original answers Node, unused helper declarations sweep away, and esbuild's __esModule marker is deliberately omitted (Node never lexed it; spelling it flips default-import interop)
- npmStaticPackageOfPath answers for opted-in workspace realpaths, and the shadow registers a symlinked install's realpath the moment resolution touches it (nested-realm monorepo drivers)
- non-opted UNTYPED node_modules packages serve as an any-surface stub so maxNodeModuleJsDepth cannot change the program's own types under the flag
- auto eligibility refuses only bundler-runtime markers (__webpack_require__) now that degradation is graceful
- ci.yml runs test (plain|san, 1..3/3) on macos-15; an aggregate job keeps the old "test" check name for anything pinned to it
- each job runs vitest twice: --shard=i/3 over everything but the corpus lanes, then the four corpus lanes with only their case slice — a file lands in exactly one --shard slice, so mixing the axes would silently drop cases
- tests/harness/shard.ts: SCRIPTC_TEST_SHARD="i/n" slices case lists by sha1(name) mod n — stable across corpus growth, every case in exactly one shard, unset means everything
- differential, llvm-differential, npm, and server harnesses slice through it; the llvm tier-floor assertion checks only this shard's floor programs
- shard.test.ts pins the partition contract (union exact, disjoint, key-stable, env-driven default) and stays green with the job-wide env set
- A one-shot delayed touch can vanish inside the watch backend's async startup window
- Both watch fixtures kick on an interval until first delivery, bounded loudly
- Nothing pinned changes; stdout bytes identical
- Node-on-macOS backs fs.watch with an FSEvents stream that starts asynchronously, so both fixtures' single delayed touch could slip into the startup window and vanish, the persistent watcher holding Node's loop until the 300s hang detector fired
- 1751 rewrites the target on a 50ms interval until the first delivery closes everything; the options-record pins (three-arg form with undocumented keys, options-only form, readline crlfDelay) and the exact stdout bytes are unchanged
- 1564 gets the same treatment in both phases: interval appends for the change phase, name flipped out of and back into existence for the rename phase
- a 600-kick bound turns a genuinely dead watcher into a loud nonzero exit instead of a silent hang
- the compiled side never raced (kqueue/inotify register synchronously at the fs.watch call), so only the Node oracle behavior changes
- scriptc build --lib --profile emits ccc wrappers, init/sink/reset/collect entries, and a static archive
- async_free is structural: the async and event-loop units never link, symbol-audit proven
- Every runtime trap routes through one funnel; the sink contract covers both emissions
- The K-fixture conformance matrix runs a real C host against both backends
- console.log routes non-scalar arguments through the static inspect machinery
- Union arguments dispatch per arm at runtime; string arms print raw
- Object literals widen per-field into a uniquely-fitting union arm
- The limitations page documents the type surface
- Island values exit validated into intrinsic slots; checker-any dispatches to the DOM machinery
- World-mixing backstops make jsval/dyn confusion structurally impossible
- Regex arrays compile; dyn-root JSON.stringify matches across backends
- A silent invalid-C escape and a giant-TU stack overflow fixed
- The full legacy surface: parse, stringify, escape, unescape, the aliases
- Node's scan state machine in C: separators, maxKeys, malformed-escape and truncation quirks
- Link-gated; escape-only programs never link the unit
- Lexically-bound private calls devirtualize by construction; statics and static blocks included
- Private accessors with observable get-then-set order; private generator methods
- Brand checks fold statically or ride the vtable interval test
- util.inspect omits private members exactly like Node
- The performance global routes through the perf_hooks lowering in all spellings
- Response declares its implemented headers/arrayBuffer/bytes surface
- Math.max and Math.min lower at any arity with NaN and negative-zero exactness
- Copy-installed workspace members classify like symlinked ones
- The performance global routes through the perf_hooks lowering in all spellings
- Response declares its implemented headers/arrayBuffer/bytes surface
- Math.max and Math.min lower at any arity
- Copy-installed workspace members classify like symlinked ones
- the uncollected-class capture box no longer carries the boxNewC marker comment: run()'s sweep sanitizes the slot before emission, so the pin asserts no R adapters, no uncollected marker, and a plain-kind box
- a dyn root holding undefined stringifies to the TEXT "undefined" (Node's answer for the undefined result value) instead of the nested-position writer's null — corpus 2448 pins both backends
- fallible like the C dispatch: a runtime handle inside the tree throws, so the pending check runs
- island ('any') arguments at intrinsic/libCall/callValue slots take the validated exit (dynCheck's stance); non-exit-safe slots fence with the slot named, and the boundary pass backstops every jsOp/dynCall/dynInvoke argument so world-mixing sites can never ICE
- a checker-'any' receiver/callee that LOWERED checked-dynamic dispatches to the DOM machinery: ambient-this reads are dynKeyGet, rest-args map/forEach ride the runtime dispatch, dyn callees take dynCall
- Object.entries/values push unit-armed (null | undefined) fields as the null literal; new Set(seed) exits an island-handle seed as a validated copy
- fence-bodied functions emit even when their ABI names an unregistered class, and a run()-end sweep rewrites leftover unregistered-class type slots to the inert f64 placeholder — the clang invalid-C escape closes with the ICE
- RegExp[] compiles (REF elements, both backends; map callbacks returning other unrepresentable kinds meet a named fence), and the C emitter appends program-sized line arrays by loop, not spread (500k-line TUs overflowed the stack)
- order-parity baseline gains the 2450-2457 corpus entries and the private-members diagnostics entry (purely additive; re-recorded from the native lane).
- Privates ride the ordinary member maps under their unspellable spelled names; a subclass redeclaring an inherited private name is fenced, so base-chain walks ARE lexical resolution and privates never enter vtables — JS's no-dynamic-dispatch semantics by construction.
- Private GENERATOR methods compose the generator machinery with this as param 0 through the gen-spawn wrapper (the vtable problem that keeps public generator methods fenced does not exist for privates); async and generic privates ride their existing static-dispatch machinery.
- Private statics lower as module globals/functions through the declaring class's own name; subclass-named and class-value receivers fence (JS brands the declaring constructor alone).
- '#x in obj' lowers as instanceof-the-declarer: static folds at/below and disjoint, the vtable interval test when the declarer sits below the receiver's static class, and unions of decided class arms collapse to tag tests; unknown/generic/static brands fence with pointed hints.
- util.inspect omits private fields exactly like Node (an all-private class prints 'C {}'); corpus 2450-2457 pin every form differentially on both backends, diagnostics private-members pins the fences.
- scr_qs.c ports Node v24's legacy codec quirk-faithfully (the scan state machine with maxKeys' pair budget, unescapeBuffer's code-unit byte truncation with U+FFFD replacement decode, encodeStringified's value rules over the DOM crossing); link-gated by moduleUsesQs, and escape rides the always-linked component encoder
- parse's result is the call site's ParsedUrlQuery dictionary (the networkInterfaces verification stance; the runtime fills the overflow map and groups repeats into string[] buckets), sep/eq/maxKeys complete to Node's defaults, and custom encoder/decoder options fence by name
- decode/encode lower as Node's own aliases; both backends emit the same runtime calls byte-identically
- querystring joins SUPPORTED_BUILTIN_MODULES, the fallback declarations, and the regenerated surface manifest, so npm-static packages requiring it unguarded stop falling back to the island (the shim stays for island code)
- corpus 2460-2464 pin the grammar corners against Node: malformed escapes, '+' vs %2B, repeated keys, maxKeys with empty segments, multi-char/multi-byte separators, astral truncation, and every CJS acquisition spelling
- non-core scr_trap/scr_trap_fmt move from scr_console.c to scr_exception.c: the failure-channel unit is in every link, the runtime's own unit-test TU subsets included (the console unit is not)
- K8 additionally asserts no scr_loop/fiber/timer/child symbol is defined in or referenced by the archive — the design's mechanical backstop for the narrowed core base set
- five generic fixtures under tests/core-mode (scalars, buffers, reinit, traps, init-trap) with C probe drivers; the harness flips the profile emission and pins identical outputs across the two lanes
- K1 nm symbol exactness both directions; K8 ambient audit (no sigaction/signal/pthread_create/atexit/setvbuf references — scr_init and scr_lib_init compile out under SCR_CORE)
- K3 covers both arena postures over one core; K5-K7 cover sink-exactly-once, init traps, pre-registration abort, Uncaught rendering, poisoned-core aborts; K10 reruns K4/K5/K7 under ASan + the RC audit's re-init zero-heap seam
- K9 drives SC4002/SC4003/SC4004/SC4005/SC4007 end to end with the profile-teaching rider verbatim
- IrModule.core lands the resolved export map + mode-provided symbol names on the IR; both emitters generate the external ccc wrappers, the re-runnable init entry (globals released and zeroed, error-vt stamps, %main, escaped-exception check), sink registration, and the optional reset/collect entries from the same facts
- marshalling wrappers delegate to scr_core.c helpers (str/bytes in-copy, arena-out), so the two emissions are identical by construction; both arena postures emit from resultResetSymbol
- compileCoreArchive builds <name>.core.a: program TU + the narrowed core runtime set (no scr_async/scr_child) + IR-gated pure-data units, all -DSCR_CORE; vendored zlib objects keep the libc/libm-only undefined-reference contract on hosts
- profile-mapped exports seed lowering reachability (coreRoots) so uncalled exports stop dead-stripping on the core path
- emitted family-4 traps (OOM, invalid union tag, bad key) route through scr_trap in both backends
- CLI verb: scriptc core --profile <file> [-o out]
- names the deliberately re-typed ambient surface, the second-chance preflight, and the declared-but-fenced console members
- the union-edges bullet drops console.log(u), which now dispatches per arm
- literalUnionArmOf probes the contextual union's checker members: literal-vs-literal fields decide by value, absent arm fields must be optional-flavored, excess fields disqualify
- exactly one fitting member builds the literal at that arm's shape so its field types drive every property's coercion; zero or several keep the SC2003 fences
- corpus 2442-2444 pin the reducer and discriminated-message shapes differentially on both backends
- console.log/info/debug/error/warn take unknown[] and render every non-scalar argument through the static util.inspect at the rest-args depth 2, strings verbatim
- top-level unions dispatch per arm at runtime with string arms raw, and util.format's %s/rest args take the same per-arm rule
- info and debug lower as stdout aliases of log; the remaining stock console members are declared in the fallback so stock-clean programs meet per-site SC2020 hints instead of a fallback-manufactured SC0001
- corpus 2440/2441 pin the widened shapes on both backends, console.log(process.argv), a find() miss union, and console.log(undefined) included
- diagnostics snapshots re-pinned: the union console fences retire and utility-types reports its real per-site fences
- mixed.ts and dynamic-mix.ts compare unknown against number so the SC1040 blocker line survives the same-kind == lowering; snapshots re-record
- corpus 2428's example strings drop the brand word; order-parity baseline re-records for the content change
- executable expansion in scr_console.c is byte-identical fputs/vfprintf + abort; core expansion in the new scr_core.c poisons, delivers to the registered sink exactly once, aborts pre-registration or if the sink returns
- 89 fputs/fprintf+abort pairs and 10 bare OOM aborts across the 20 core-linkable TUs now funnel; lazy atexit teardowns (json errdyn, regex bytecodes, symbol registry) reroute to the core reset registry via scr_atexit
- scr_core.c owns sink/poison/result-arena/reset-registry/marshalling helpers; scr_exception.c renders escaped exceptions as "Uncaught ..." into the funnel; scr_lib exposes its cleanup to the reset seam
Chris Tate