- Add format 5 foreign callback descriptors with strict retained, context, and void-return validation.
- Marshal copied callback arguments through an optional MPSC event-loop queue in both C and LLVM backends.
- Cover concurrent delivery, liveness, fairness, teardown, cross-platform builds, and document the boundary contract.
Co-authored-by: DemonGPT <127974011+DemonGPT@users.noreply.github.com>
* fix(runtime): trust Windows root certificates
- Load default TLS roots from the Windows ROOT store.
- Link crypt32 for Windows TLS builds.
- Cover the certificate-store import in cross-build tests.
Co-authored-by: Kayakyx <Kayakyx@users.noreply.github.com>
* fix Windows CA store policy handling
* fix(runtime): cover Windows policy root stores
* fix(runtime): dedupe Windows root stores
* fix(tls): match Windows system CA stores
---------
Co-authored-by: Kayakyx <Kayakyx@users.noreply.github.com>
- Implement the Zig 0.16.0 AArch64 musl runtime and preserve compiler failure diagnostics.
- Promote the target through executable, library, localization, and documentation matrices.
- Verify both backends and the complete arm64 Alpine differential contract.
Co-authored-by: Arth Tyagi <41021374+arthtyagi@users.noreply.github.com>
- Bump all published packages and the surface manifest to v0.0.30.
- Promote host-callback channels into the marked release notes.
- Include callback registration in cross-target ABI symbol checks.
* feat: add host-callback channels to library mode
- the profile's `callbacks` array declares named channels and
`abi.callback_register_symbol` names the one registration entry point:
`int32_t <sym>(const char *name, void (*fn)(void), void *ctx)` — 0 on
success, -1 for an unknown or NULL name, latest registration wins, a
NULL fn clears, registrations persist across init/reset. The stored
pointer's typed shape is the channel's with the opaque context first,
the panic sink's layout
- channel signatures ride the existing marshalling classes: params are
f64/bool/string/bytes plus the u8/u32/i32 plumbing classes (outbound
plumbing keeps JS's ToUint32/ToInt32, the executable FFI rule);
returns are scalar only (f64/bool/u8/u32/i32/void — a buffer return
needs an ownership contract the mode does not define). string/bytes
parameters arrive as (ptr, len) pairs borrowed for the call's duration
- compiled code reaches a channel as a signature-only ambient function
declaration whose direct calls deliver synchronously on the calling
thread; the recognition rides the FFI import machinery under a library
flavor: SC4024 refuses a call the channels cannot serve (undeclared
name or off-class signature), unused channels are legal capacity, and
callback-free profiles keep the ambient ReferenceError semantics
- calling an unregistered channel is the SC4025 runtime trap: a detected
trap through the library funnel, so the structured sink message names
the channel in its text and the entry the host called in its symbol
field, and profile teachings/remediations overlay it like the rest of
the runtime family
- registration slots are per copy of the runtime state, the sink's story:
per-archive under abi.localize_runtime (the register symbol joins the
localization keep-list), per-thread instance under
abi.instance_per_thread. The host callback must not reenter any library
entry or unwind across library frames
- both emissions produce identical behavior by construction: the slot
store/fetch lives in scr_library.c (scr_library_cb_set/_require/_ctx),
the generated TU emits the registration dispatch and typed indirect
calls, and the trap text is assembled once at export resolution
- callback-free profiles emit byte-identical program TUs and serialized
IR, and executable builds are byte-identical end to end
- conformance: the CB suite (tests/harness/library-callbacks.test.ts)
covers the acceptance stream, unregistered and pre-registration traps,
symbol exactness, teaching overlays, SC4024 refusals, capacity and
callback-free postures, the localized+thread-instanced composition
probe, and ASan reruns; profile-shape refusals join
library-profile.test.ts
* fix: preserve callback binding identity
* fix: harden library callback contracts
* fix: recognize project callback declarations
* fix: enforce host callback declarations
What we did:
- Add the compiler and runtime support required to build the real Portless CLI as a fully static native binary and run its proxy, alias, framework, parallel-registration, and process-cleanup workflows without Node.
- Support Portless's dual HTTP/1.1 and HTTP/2 secure-server graph, including ALPN dispatch, shared request/connect listeners, HTTP/2 CONNECT responses, enableConnectProtocol settings, req.stream access, session errors, and the required ownership and lifecycle handling.
- Lower Portless's indexed absence probes, strict indexed comparisons, optional chains, server options, and container patterns. Preserve Node-style self-reexecution and correctly frame forwarded chunked responses.
- Add focused corpus and server differentials plus an isolated-copy acceptance harness that builds and exercises the pinned Portless checkout in plain and sanitized modes without modifying the external checkout.
- Validate the static binary against Portless's official e2e suite: all 13 files and 16 tests pass.
What we decided was out of scope:
- Broader HTTP/2 client policy, lifecycle compatibility, protocol validation, listener overloads, and unrelated HTTP/2 completeness.
- General runtime-optional soundness beyond the Portless paths. Making that mechanism generally sound requires function-scoped tracking so reused local IDs cannot leak optional state between functions, assignment-aware tracking so writing a definitely present value clears hidden undefined state, and correct preservation across generators, modules, and finally blocks. That larger cross-cutting change remains a dedicated follow-up.
- Removing the self-reexecution heuristic's inherent ambiguity. A direct invocation whose first user argument canonically names the executable is currently treated as Node's repeated script slot and collapsed. An explicit native reexec marker can address that in future work.
* feat: add mobile library targets for iOS and Android
- three library-mode-only triples join SCRIPTC_TARGET:
aarch64-apple-ios, aarch64-apple-ios-simulator (darwin hosts with
Xcode's iPhoneOS/iPhoneSimulator SDKs), and aarch64-linux-android
(any host with an NDK). The consuming pattern is an embedding app
linking profile-configured static archives — Xcode on the Apple side,
Gradle/NDK on the Android side — so the executable lane refuses the
triples with SC3002 and the pointer to --lib
- zig bundles no Apple or bionic libc: resolveCc discovers the sysroot
(xcrun for the selected Apple SDK; ANDROID_NDK_ROOT or the newest
ndk/<version> under the SDK root) and spells it into targetArgs,
where every cache tier already keys it. The canonical LLVM spellings
map to zig's own with the minimum-version floors pinned:
aarch64-ios.15.0[-simulator] stamps LC_BUILD_VERSION minos 15.0 into
every object, aarch64-linux-android.26 pins the bionic stub level an
embedder's minSdkVersion must meet. API 26 bionic carries everything
the library-lane units call (arc4random_buf included), so no shim TU
joins the archive
- localization follows the existing object-format rule: both iOS
platforms ride the Mach-O host-ld64 arm (ld64 reads iOS objects and
preserves platform/minos through the -r merge), Android rides the
cross-ELF arm (zig relocatable merge + in-process demotion) via the
driver's zig spelling. abi.instance_per_thread needed no per-target
work — thread-local statics compile identically on all three
- admission is a pure env/host check ahead of toolchain discovery: an
iOS triple off a darwin host and near-miss mobile spellings refuse
SC3002 with the pairing or the supported set named, in compile() and
compileLibrary() both, decorated by the profile teaching machinery
- library-multi grows the mobile lanes: M12 admission shape always
runs; SCRIPTC_IOS=1 builds localized a/b archives per target and
emission (M1 symbol exactness, ambient audit, version floor), links
probes with the Xcode clang, and EXECUTES the two-instance and
four-thread probes on a booted simulator byte-for-byte against the
desktop expectations (device-arch archives are build+link verified);
SCRIPTC_ANDROID=1 does the same through the NDK clang and an
emulator, reusing a running device or writing and booting a headless
arm64 AVD directly
- the surface manifest's coverage notes record the mobile posture (the
library-admissible surface only; no mobile claim outside it), the
profile spec and the platforms page carry the mobile matrix with the
version floors, and non-mobile builds are unchanged byte-for-byte
* fix: harden mobile target tooling
* Harden mobile target test isolation
* feat: extend runtime symbol localization to Windows hosts and cross targets
- abi.localize_runtime follows the archive's OBJECT FORMAT instead of the
build host: ELF and COFF archives localize from any supported host
(native or cross), Mach-O localization keeps the macOS host linker, and
the SC3002 fence narrows to the pairings that remain — macos targets
off darwin hosts (named in the diagnostic) and hosts outside
darwin/linux/win32
- COFF combine+demote is an in-process transform (object-localize.ts):
no linker offers a COFF relocatable mode (lld-link mirrors MSVC
link.exe; zig's COFF driver refuses multi-object merges) and
llvm-objcopy rejects symbol-scope flags for COFF, so
mergeAndLocalizeCoffObjects performs the staging archive's member
selection, the section merge, cross-object symbol resolution by index,
COMDAT deduplication, and demotion to static over the object bytes;
survivors drop the COMDAT flag so mingw .refptr stubs never
deduplicate against another archive's copies at the embedder's link,
and per-object CodeView sections stay out of the merged member (their
item indices are a per-object contract)
- cross ELF merges through `zig cc -target <triple> -r` (zig is already
the cross driver's hard requirement) and localizeElfObject demotes in
process — locals-first symbol reorder, relocation remap, COMMONs kept
global — resolving section groups the way binutils'
--force-group-allocation does; the darwin ld64 and native-linux
binutils recipes are byte-for-byte the historical ones, and darwin
hosts now admit macos cross triples through the same ld64 arm
- library-multi grows the M10/M11 cross lanes (SCRIPTC_CROSS, with
container and Windows-box execution legs, thread-instanced composition
included), runs M1/M2/M6/M7 on win32 hosts (`zig cc` probes, llvm-nm
symbol checks, CRLF-normalized probe output), and object-localize.test.ts
pins the transforms over synthesized objects in every suite
- non-localized archives are unchanged byte-for-byte
* fix: tighten runtime object localization
* fix: honor COFF COMDAT selection semantics
* test: serialize cross-target library builds
* docs: clarify Windows library link dependencies
* feat: support thread-instanced library state
- Add the abi.instance_per_thread profile field: the archive's TUs compile
with -DSCR_THREAD_INSTANCES, and the SCR_TL qualifier in scr_runtime.h
moves every runtime unit's mutable statics into thread-local storage;
both backends emit the program TU's module globals, run-once guards, and
lazily-compiled regex literal caches thread-local to match
- ONE linked archive then serves one independent instance per embedder
thread through the unchanged entry family: a thread registers its sink
and calls the init entry, and owns its own collector, result arena,
poison flag, and program state — a trap poisons only the instance it
fired in while sibling threads' instances keep answering
- Document the contract beside the profile spec: one instance per thread,
selected implicitly by the calling thread; instance lifetime is the
thread's lifetime; the never-entered-from-two-threads rule is unchanged;
independent of and composable with abi.localize_runtime
- Immutable interned data (string literals, unit arms, template arrays,
vtables) stays shared — Darwin ASan's image-registration common
included, keeping the one-registration-per-image discipline; the
exception cell's current pointer resolves a NULL sentinel in this mode
because a thread-local address is not a constant initializer
- Add the four-thread acceptance probe (distinct per-thread workloads,
concurrent instance-local inits, per-instance collects, a trap delivered
to its own thread's sink exactly once), the composition probe pairing a
thread-instanced localized archive with a second different-prefix
localized archive, an explicit ASan rerun beside the suite-flavor
sanitized builds, and profile-shape coverage; schedule the new lane
contracts beside M1/M2
- Non-opted builds are byte-for-byte unchanged: the qualifier expands to
nothing outside -DSCR_LIB -DSCR_THREAD_INSTANCES (verified object-level
over every touched runtime TU in both default and library flavors)
* fix: keep sanitized runtime-localized archives linkable on ELF
ASan's instrumented globals ride ELF section groups; archives built from
shared runtime objects carry groups with REPEATED signatures, so a process
linking two runtime-localized sanitized archives kept one archive's group
and discarded the other's — whose now-local references then dangled at the
embedder's link. Resolving the groups into the combined relocatable member
(ld -r --force-group-allocation) keeps every archive's copies; the
localization step then demotes them per archive exactly like unsanitized
state. Plain builds carry no section groups, so the flag is inert there.
With the groups resolved, ELF surfaces the same deliberate exception
Mach-O already documented: the image-wide registration guard COMMON stays
shared so the final image registers its ASan globals exactly once — M1/M7
now pin that spelling on both platforms. The explicit ASan pairing (M8)
additionally points Linux LSan away from contractually thread-lifetime
instance state, exactly as the sanitized suite lanes do.
* fix: isolate inspect state per thread
* fix(runtime): share uptime anchor across threads
* feat: support multi-instance library mode via runtime symbol localization
- Add the abi.localize_runtime profile field: the archive build combines the
program object with exactly the runtime/vendor members it reaches and
demotes every external definition except the profile-declared symbols to a
local symbol (darwin: one ld -r pass with -exported_symbols_list; linux:
ld -r then objcopy --keep-global-symbols)
- N archives built under pairwise-distinct prefixes now link into one process
with no symbol collisions and no shared mutable runtime state: each
instance owns a private copy of the allocator, collector, result arena, and
panic sink, so sinks register per instance and a trap poisons only the
instance it fired in
- Document the embedder contract beside the profile spec: one thread per
instance (an instance is never entered from two threads), and values cross
instances only through the embedder's own byte/record marshalling
- Refuse cross-target localized builds with SC3002 (the step runs the host
toolchain's ld/objcopy over host-format objects); absent or false keeps the
classic single-archive artifact byte-for-byte
- Add the two-instance acceptance probe (two archives, two embedder threads,
independent collects, a trap delivered to its own sink exactly once while
the other instance keeps answering) plus symbol-exactness, profile-shape,
and target-posture suites, and schedule the artifact contracts on the gate
host
* fix: tighten runtime localization validation
* fix: harden localized library publication
* feat: support wasm32-wasi as a production target
- Add production LLVM WASI codegen with a 32-bit ABI, coroutines, and dynamic modules
- Integrate WASI builds and execution into the CLI with capability diagnostics
- Add differential coverage and document the fourth production target
Co-authored-by: Albert <57402359+bulatovv@users.noreply.github.com>
* fix: address wasm target review findings
* fix WASI guest paths and fetch alias detection
* fix WASI async bridge and fetch detection
---------
Co-authored-by: Albert <57402359+bulatovv@users.noreply.github.com>
- Document static and dynamic HTTP/fetch support for Windows cross targets.
- Keep Windows fetch differential fixtures hermetic and parity-correct under filtering.
Co-authored-by: mike douges <6801309+itsdouges@users.noreply.github.com>
* Support static HTTP server timeout properties
- Lower typed timeout property reads and writes through both native backends.
- Store Node-compatible defaults independently on each HTTP/HTTPS server.
- Cover defaults and assignments with differential corpus tests.
Co-authored-by: Eli Sterling <240321107+eli-sterling@users.noreply.github.com>
* Support keep-alive timeout buffer property
* Fix HTTP server timeout property lowering
* fix: scope HTTP server timeout handling
* fix: preserve HTTP server timeout semantics
---------
Co-authored-by: Eli Sterling <240321107+eli-sterling@users.noreply.github.com>
* feat(ffi): support call-scoped native callbacks
- Add format-2 callback/context declarations with exact ABI positions and strict lifetime validation.
- Emit capture-aware C and LLVM trampolines with scalar coercion and exception propagation.
- Document the callback contract and cover both backends in plain and sanitized tests.
Co-authored-by: DemonGPT <127974011+DemonGPT@users.noreply.github.com>
* fix FFI callback safety
---------
Co-authored-by: DemonGPT <127974011+DemonGPT@users.noreply.github.com>
- Bound each readable wake so busy sockets yield to timers and other descriptors.
- Add differential coverage for continuously flooded upgraded connections.
* feat(fs): expose Stats disk metadata
- Lower blocks, nlink, and atimeMs through the C and LLVM backends.
- Populate path, promise, file-handle, and dynamic bridge stats across supported platforms.
- Add differential, declaration, and npm bridge coverage.
Co-authored-by: I Plan Websites <787729+iplanwebsites@users.noreply.github.com>
* fix(fs): keep Windows stats snapshots coherent
* fix(fs): preserve Windows lstat metadata
* fix(fs): validate Windows mount point payloads
---------
Co-authored-by: I Plan Websites <787729+iplanwebsites@users.noreply.github.com>
- Recognize canonical typed-array loops with semantics-safe fallbacks.
- Emit integer induction and direct integer byte indices in C and LLVM.
- Add backend and differential regression coverage.
Co-authored-by: morler <478444+morler@users.noreply.github.com>
* feat: support process write callback and encoding args
- Lower static stdout and stderr writes with encoding and callback overloads.
- Schedule completion callbacks through the next-tick queue in C and LLVM builds.
- Cover encoding aliases, ordering, and async-free refusal behavior.
* fix: handle omitted process write arguments
* feat: support fs/promises FileHandle
- Add static lowering and typing for fs/promises.open and the supported FileHandle surface.
- Implement FileHandle ownership and I/O across the C runtime and C/LLVM backends.
- Add differential corpus coverage and refresh the supported-surface manifest.
* fix fs file handle argument handling
* fix fs file handle validation
* fix(fs): preserve FileHandle read error codes
* fix(runtime): match empty FileHandle buffer behavior
* feat(string): support static split limits
- Lower split limits for string and literal RegExp separators across C and LLVM.
- Match JavaScript ToUint32 limit semantics in the runtime.
- Add differential coverage and refresh diagnostics and surface metadata.
* fix(string): default undefined split limits
* feat(fs): support static writeSync
- Lower Buffer-window and UTF-8 string overloads through the C and LLVM backends.
- Match Node's positioned and current-offset write behavior, validation, and errors.
- Add differential corpus coverage and publish the static surface manifest entry.
* fix(fs): preserve writeSync runtime semantics
* fix fs.writeSync error parity
* fix fs write descriptor errors
- Lower unshift and reverse through the C and LLVM backends.
- Preserve spread, mutation, evaluation-order, and reference-counting semantics.
- Add runtime, differential, and surface-manifest coverage.
* feat(fs): support static rename APIs
- Lower fs.rename, fs.renameSync, and fs/promises.rename through the C and LLVM backends.
- Add runtime callback, error, and promise handling for rename operations.
- Cover typed and check-JS usage with differential corpus tests.
Co-authored-by: ryoppippi <1560508+ryoppippi@users.noreply.github.com>
* fix Windows rename semantics
* fix: move callback rename work off main thread
* fix(runtime): preserve rename callback checkpoints
---------
Co-authored-by: ryoppippi <1560508+ryoppippi@users.noreply.github.com>
* Support static util.parseArgs
- Lower typed util.parseArgs calls through the C and LLVM backends.
- Add a link-gated native parser with Node-compatible options, tokens, defaults, and errors.
- Cover ESM, CommonJS, default argv, sanitizer, and TS7 behavior.
* fix(runtime): align parseArgs behavior with Node
* fix(runtime): close parseArgs parity gaps
* fix(runtime): match parseArgs edge cases
* fix(runtime): preserve parseArgs short and default semantics
* Support Date instance lowering
- Lower read-only Date values and constructors through the C and LLVM backends.
- Add portable calendar helpers, differential coverage, and documented surface contracts.
- Fence unsupported mutation, identity, locale, and component-constructor forms.
Co-authored-by: sensei-woo <sensei-woo@users.noreply.github.com>
* Fix Date exception and timezone semantics
* fix: harden Date lowering edge cases
* fix Date lowering edge cases
* Fix Date union fences and offset clipping
---------
Co-authored-by: sensei-woo <sensei-woo@users.noreply.github.com>
* Lower AbortController for fetch cancellation
- Add static and dynamic lowering for construction, signal access, and abort calls
- Back controllers with native signal state shared by fetch
- Cover cancellation semantics across C, LLVM, diagnostics, and surface tests
Co-authored-by: sensei-woo <sensei-woo@users.noreply.github.com>
* Fix AbortController abort edge cases
* Fence AbortController method extraction
---------
Co-authored-by: sensei-woo <sensei-woo@users.noreply.github.com>
* perf(compiler): specialize typed-array element access
- Lower typed-array reads, writes, and lengths directly by IR element kind.
- Preserve coercion, bounds, and receiver lifetime semantics across C and LLVM.
- Cover emission, ABI layout, and Node-differential behavior.
Co-authored-by: morler <478444+morler@users.noreply.github.com>
* fix: retain typed-array receiver across nested assignments
---------
Co-authored-by: morler <478444+morler@users.noreply.github.com>
* fix(compiler): support implicit top-level await modules
- Match Node 24 syntax detection by treating top-level await as an ES module marker.
- Add differential corpus coverage for TypeScript files without explicit imports or exports.
* fix Node ESM classification for top-level await
* fix ESM require diagnostics and classification caching
* fix require binding and package type precedence
* fix: align top-level await module detection with Node
* runtime: pin the ScrCycHdr layout the LLVM backend hardcodes
scr_cyc_mark_live is a static inline, so there is no symbol for the LLVM
backend to call — it open-codes the retain hook as a raw `store i32 0` at
obj-16 and reaches the cycle header at obj-32. Three sites emit that
(llvm/shapes.ts, llvm/classes.ts, llvm/emitter.ts), which makes the C
struct's size and its `color` offset a real ABI between the runtime header
and hand-written IR. The stored VALUE is part of that ABI too: the emitted
store is the literal 0, not the enumerator, so SCR_CYC_BLACK's numeric value
is pinned as surely as the offsets are.
Nothing enforced any of it. llvm-runtime-abi.test.ts mechanically checks that
every `declare @scr_*` agrees with its C prototype, but that is the FUNCTION
ABI; a struct-offset skew is invisible to it, to the type system, and to the
C compiler. Narrowing `color` and putting another field in the freed bytes
compiles clean and silently zeroes that field on every retain; reordering the
color enum compiles clean and makes every retain write the wrong color.
Assert the four properties the emitted IR actually depends on, so the next
edit to this struct or that enum fails the build instead of miscompiling.
The three layout assertions bake in 64-bit pointers and size_t, which every
current target has. A 32-bit port would trip them — correctly: the backend's
hardcoded -16/-32 would need fixing too.
* runtime: collect cycles generationally
A trial-deletion pass costs O(objects reachable from its candidates), and a
candidate inside a large live structure reaches all of it. Collecting every
256 candidates therefore made total collection work quadratic in a growing
live heap: the V8 splay benchmark spent 749ms per iteration, ~99% of it in
the collector re-walking a tree that was entirely live and never garbage.
Make the collector generational, in the shape CPython uses for this same
algorithm. Each header carries a generation; a pass names the oldest one it
will walk and skips anything above it, exactly as it already skips NULL and
immortals; survivors are promoted so later nursery passes never re-walk
them. A pass then costs what was allocated since the last one rather than
the whole heap.
Restricting the walk stays sound because trial deletion is already
conservative in the safe direction: an edge from a skipped older object is
never trial-deleted, so its target keeps that count and reads as externally
referenced — the same answer the collector gives for a stack reference.
What it gives up is cycles that span generations, and the full pass (which
skips nothing, and so is exactly the old algorithm) is what finds those.
Three things that are load-bearing and were not obvious:
- A restricted pass may spare a candidate ONLY because the edge keeping it
alive came from a generation it refused to walk. The candidate buffer is
the collector's only root set and markRoots consumes the entry, so
dropping such a survivor retires the one record that the object is a
possible cycle root — and a dead cycle whose members were all spared that
way is then invisible to every later pass, full ones included. So a
restricted pass hands its survivors back as candidates. A full pass needs
none of this: it walked every edge, so rc > 0 there is a genuine outside
reference and Bacon-Rajan's own reasoning retires the candidate.
- Live data that is unlinked INTO a dead cycle grows no counter: those
objects were tallied when they were allocated, and they are not in the
nursery. A heap-growth trigger alone therefore never fires for a program
that churns its long-lived structures, so the mature candidate buffer's
own size is a second full-pass trigger.
- Restricting the walk leaves one edge accounted by NOBODY. markGray does
not trial-delete an edge into a skipped generation, and the teardown
contract has free_fn release exactly the UNTRACED children — because every
traced edge was supposed to have been decremented by markGray. So freeing
a white object that holds a traced edge into an older generation drops the
edge while the target keeps the count, and that phantom reference reads as
an external one to every later pass, full ones included: the target and
everything it links to would never be reclaimable again.
The white set pays those edges off explicitly, in two halves, because the
walk cannot do it inline — a release there could free a survivor that
scr_promote still points at, or cascade into the white set mid-teardown.
Each target is PINNED with a retain while `gen` still holds the values the
walk filtered on, and after the teardowns the pin is dropped and the edge
given up for real. Two decrements per entry, because the pin is one of
them; a single release would only undo the pin and leave the phantom edge
where it was. The pin is also what makes the second decrement safe, since
a teardown's releases of untraced children can reach a cycle-headered
object — that is how they re-buffer survivors. One entry per skipped edge,
so several edges sharing a target settle it once each. Nothing pinned can
be in the white set: a skipped older object's edges were never
trial-deleted, so anything it references was scan-blacked rather than
whitened, by the same conservatism above.
The event loop's between-turns collection now runs one scheduled pass
instead of scr_collect_cycles(); a full sweep per turn would walk the whole
live heap every turn, which is the cost the generations exist to avoid.
scr_collect_cycles() stays the exit / session-reset sweep, where the RC
audit runs straight after and wants nothing reclaimable left.
757-cycle-cross-generation.ts covers the third point: a live list mutated
until its nodes promote, then dead nursery cycles holding traced edges into
it. Unaccounted, the sanitized lane reports 60 objects live at exit — the
whole list, held by phantom counts.
Measured, best-of-7 against the previous collector:
splay 620.45ms -> 1.45ms (428x)
deltablue 1.25 -> 0.81 (1.55x)
richards 1.196 -> 1.162 (1.03x)
crypto/navier-stokes/raytrace/regexp unchanged
an LRU cache (200k entries, 200k ops) 32137ms -> 93ms (345x)
a large live cache + 500 event-loop turns 3095ms -> 776ms (4.0x)
The trade is space: floating cyclic garbage is now a bounded fraction of the
live heap instead of a fixed candidate count, so peak RSS on
cyclic-garbage-heavy programs runs ~1.4x the old collector's. Bounded and
flat in run length, not a leak — verified by holding a 200k-object live heap
while churning 200k dead cycles per round for 30 rounds.
Test lanes show byte-identical failure sets against the previous collector:
Linux sanitized 164, Linux plain 528, macOS differential corpus 66 — all
pre-existing on those machines, none introduced or fixed here.
* runtime: bound scheduled mature cycle backlog
* runtime: rearm cycle trigger after candidate deaths
* Restore sandbox test performance
- Re-enable secure native compiler caching for repo-local test artifacts.
- Isolate strict cache coverage while keeping it off the sandbox critical path.
* fix: respect sandbox test runtime limits
* fix(compiler): refine narrowed union payload fields
- Treat pure union discriminant reads as stable within compound guards.
- Cover payload-field range refinement in analysis and library builds.
* fix(compiler): preserve field facts across union discriminants
Chris Tate