canDynCheckTo answered false at every recursion back-edge in a record or
array, so a type whose checked graph re-enters itself had no checked
extraction at all. That is ordinary in a callback-options API: a context's
method takes an options object whose callback receives the same context, so
passing an unknown value into the record raised SC1100 even though every
leaf is checkable — pi's LoadExtensionsResult graph (extension commands
whose handlers take the extension context) is the census shape.
Answer the back-edge coinductively, as the composite dynFrom walk already
does for recursive shapes: mark the in-progress key (the wrapper's own
success key) for the duration of the frame and verify every reachable field
at its first visit. A field that fails anywhere still fails the frame, and
the existing failure path keeps dropping dependent conversion results, so a
cycle cannot hide an unsupported sibling. The `unsafe` unit fixture now
carries a genuinely unsupported sibling; its former Map sibling is inside
the check domain, so the back-edge refusal was what made it look unsafe.
Only the static conversion domain widens: a program that compiled before
compiles to the same code, and the runtime extraction still walks the
actual value, throwing a catchable TypeError on a mismatch.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
canBoxDynCompositeAt, the composite extension of the dynFrom domain, had no
promise case: it fell through to the runtime-handle test and answered false,
so a typed record with a Promise-typed field could not convert into an
unknown slot (SC1101). That is the shape of a model store's read state
(`reload?: { readers: number; promise: Promise<StoredModels> }`), and the
same fence blocked a promise in an array element or a union arm.
The backend already knew how to box one: toDynHelper emits
scr_dyn_new_promise for a dyn payload and scr_dyn_new_promise_adapting for
any other inner type, exactly as it does for a bare promise. Mirror that
conversion domain in the predicate — dyn and void inners, or an inner that
converts to dyn — so the promise boxes by REFERENCE wherever the walker
meets it and identity survives the round trip, as in Node.
The corpus program pins the round trip both ways: the payload, the promise
identity, and the absent-field case, under Node and natively.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`for (const name of registry.get(key) ?? [])` (mcp's server-tool registry)
types the head `Set<string> | never[]` and had no lowering: the iterable
union rule knows Iterable/generator unions and the indexed numeric arms, so
the loop fell through to the generic SC2001 fence on the union type.
`never[]` is the empty array literal's own type: its only value is the empty
array, which yields no iterations. `T[] | never[]` reduces in the checker
(never is assignable to T), so the reachable shape is exactly one inhabited
non-array iterable beside `never[]`. That loop is the existing container walk
on the arm the runtime tag selects:
if (unionIsTag(head, setArm)) { <lowerForOfSet on unionNarrow(head)> }
for Set, Map and string — no new representation, and the empty-array arm is
an empty `else`. A union of two inhabited iterables
(`Set<string> | string[]`) still fences: both arms hold values and their
walks yield different element kinds through different protocols.
Corpus 8416-iterable-never-array-arm pins Set/Map/string registries with
present and missing keys, a live set mutated between loops, and an explicit
`Set<string> | never[]` annotation.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`entries.map((entry) => async () => …)` (package-manager's concurrency task
lists, `(() => Promise<…>)[]`) was refused: `.map` rejected a `func` return
with the same badType as a `void` return.
A closure is a supported array element. The closure array literal `[() => 1]`
already lowers to a `func`-element array, where the value is one ScrClosure
for its whole life, stored by reference with the element kind's `_v` adapter
and `scr_closure_trace_v`. The map helper builds the same array, so the
`func` half of the fence goes at both `.map` sites (plain receiver and
union-of-arrays receiver).
The `void` fence stays: `void[]` has no element, because a void return value
is erased before it could be written.
Corpus 8415-map-closure-elements pins the `.map`-produced arrays of closures:
`Array<() => Promise<string>>` and `Array<() => string>`, closure identity
through `indexOf`/`includes`, an inline `.map`, and
`Promise.all(tasks.map((task) => task()))`.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`void | Promise<A> | Promise<void> | Decision` (the agent-loop `finishTurn`
hook, codemode's remote client) had no representation: a union arm's index is
its runtime tag and a promise arm's tag IS the `instanceof Promise` test, so a
second promise arm had no tag. The union was refused (SC2009) and every use
site inherited the blocker.
JavaScript cannot tell the arms apart: `instanceof Promise` answers true for
both and `await` settles to either payload. The union therefore maps to one
promise arm `Promise<A | undefined>`: payloads join like union arms (`void`
becomes the undefined unit, an already-union payload flattens, identical
payloads dedupe, a checked-dynamic payload absorbs the arms the dynamic
representation holds faithfully). A payload with no union arm home (a RegExp
payload, a promise-of-a-promise) keeps the whole union fenced, and the
refusal now says why.
A `Promise<A>` value flowing into the merged arm converts with the existing
checked promise-payload widening (promisePayloadWidens / promiseWiden): the
promise keeps its identity and its settlement turn, and the settled payload
is checked against the payload slot.
Cost: the merge only runs for a union that already has two promise arms,
which is refused today. Every other union interns the same arms in the same
order, so a fully typed program without such a union compiles to identical
IR.
Corpus 8414-promise-union-arms pins identity through the union slot,
`instanceof Promise` narrowing, `await`, `.then`, the void arm, the rejection
path and a non-promise data arm.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`interface HttpError extends Error { status: number }` receives `new Error(...)`
asserted to it. The error's fields are writable and later writes must show
through the view, so the view is the error object, not a record built from it.
A lib Error, TypeError, ... instance now carries identity into the structural
view, the same way a program class instance does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A Map or Set is a live collection: a record copy answers the members it copied
once and misses every later write, so `function freeId(seen: { has(k: string):
boolean })` called with a Map must answer through the Map.
The collection now carries identity into the record view, and the view is
registered as a collection view: it keeps checked identity without protocol
dispatch, because there is no stored member to read. Its method calls dispatch
on the collection at runtime (`scr_native_map_invoke`), and `size` reads the
collection's own member.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`type Readable = Pick<Session, "read">` is the same live view of a class
instance as the inline `Pick<Session, "read">` spelling. Only the inline form
was recognized, so a view named through an alias became a record copy: it
dropped the class's methods and lost the instance's identity.
The resolved type of a program alias is the alias itself, so the reference is
read from the alias's declaration instead: `Pick`/`Omit` keep their first type
argument, and another alias is followed through its own declaration, bounded
in depth. `originsOf` resolves the view the same way, so the class family
behind a named view is found too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
readline's emit and EventEmitter's emit copy the listener list before
running it, so that listeners added or removed during the emit don't
change who runs. The copy was a malloc and a free per emitted event: per
line for a readline 'line' listener. A list of at most four listeners is
now copied into a stack buffer; longer lists still allocate.
A new corpus program pins the snapshot semantics for lists below and above
four listeners: a listener added during an emit runs from the next emit, a
removed one still runs in that emit, and a once listener runs once.
`.length` of a tuple is its arity, and the lowering folded it to that
constant only when the receiver was rooted at a binding or `this`. Any
other receiver (a call result, a ternary, an `as` assertion, an `as
const` literal) was refused with SC1090.
The receiver is now evaluated once, for its side effects and exceptions,
and its value discarded; the expression is the arity. A binding, `this`,
or a chain of plain property reads from one still folds. A chain through
an accessor is evaluated, so an accessor that returns a tuple runs, as in
Node.
The keyed and tuple-index dispatches read the receiver and key inside a
discard statement, which re-evaluated an effectful receiver expression
(an `in` test over a call result) and ignored a key call that rebinds the
receiver binding. Both now settle the receiver into a hidden local before
the key evaluates, and the inherited-key probe returns its answer
directly instead of wrapping it in a discard statement.
Narrow the union field write's no-static-supertype path to unions that
have a dynamic arm, so a union of unrelated static storage types keeps
its refusal, matching the read path; a runtime-keyed spread into a record
is covered by the checked extraction test instead of the refusal table.
Review threads:
- 4403396631 inherited-key probe evaluated an effectful receiver twice
- 4403396650 key/index calls that reassign the receiver binding
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A procStream-typed receiver that is a call or an accessor read now runs
for its effects, and propagates its throw, before the fold answers 0: the
constant sits in a seqExpr behind an exprStmt receiver, the same
evaluate-for-effect shape objectIsDisjointFalse uses. A pure alias still
folds to the bare constant. The corpus program covers a call receiver, an
accessor receiver and a throwing receiver against Node.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A program with no async functions, generators or timers never ran the
event loop, so a promise rejection nothing handled went unreported:
`Promise.reject(new Error('x'))` alone exited 0, where Node prints the
error and exits 1. The loop now also runs when the program makes a
promise (a Promise static, `new Promise` or Promise.withResolvers), and
its end reports the rejection, runs the 'exit' listeners with code 1 and
exits 1, as for async programs. Programs that make no promise keep their
code unchanged.
Array.prototype.join reads the length before it converts the separator.
The lowering converted the separator first and let the join read the
length afterwards, so a separator whose toString changed the array joined
the wrong number of elements. When ToString of the separator value can run
code of the program (a checked-dynamic value, an object or class instance
with toString), the join now reads the length first: an array that grew
joins its first elements, and the missing elements of one that shrank join
as empty strings. Primitive separators keep the direct join.
6883-node-island-builtin-handles builds a Headers inside an island, undici
loads node:tls for the builtin classes it backs, and OpenSSL parses the
system CA bundle through PEM/X509. That state is freed only by
OPENSSL_cleanup at exit, which NI-7c keeps off, and the stacks carry no
node::crypto frame, so the existing entries cannot match. Name OpenSSL's
allocator entry points, as the file already does for the rest of libnode's
process-lifetime state.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mock-timers' "named and namespace imports keep the loop's timers" and
6811-node-island-uncaught-listener check the order in which real timers
fire, with delays 1 to 5 ms apart that are scheduled one after another.
On a busy runner more time than that can pass between scheduling two of
them, and the order flips in either lane: the sanitized node:test run saw
Node's reference print 'named promise' first, and the sanitized
llvm-differential run saw 'island timer 1' before 'native timer after'.
The delays are now 100 ms apart in mock-timers (100, 200, 300) and the
island's timers (150, 250) start 100 ms after the native ones (10, 50).
Node prints the same output as before.
static-spatial bundles three.js and builds it with the sanitizer, which
passed the default 300 s test timeout on a busy runner. Its cases take
three.test.ts's 1200 s timeout.
A shorthand property's name carries the property's symbol, so the
identifier lowering's typed-array and NaN/Infinity cases, which checked
that symbol's provenance, did not match `{ Uint8Array }` or `{ NaN }`. A
JavaScript source stored the opaque identity token there, and TypeScript
stored a runtime fence; the long form `{ Uint8Array: Uint8Array }` read the
constructor. Both cases now resolve the name as the other builtin cases do
(isStdlibGlobal), which reads the shorthand's value symbol.
In JavaScript sources, `globalThis.NaN` and `globalThis.Infinity`, and
destructuring them from the global object, read the identity token too.
They now read the numbers.
The stale i6 branch marked lazy-traps island-only, which held while the
whole package was refused and ran in a Node island. main compiles the
package statically with a throwing stub per blocked edge, so its require()
edges still match Node through an island while an import() whose literal
specifier resolves nowhere is a deferred SC2012 fence. Record that
remaining gap the way main does instead of claiming Node parity.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`tests/diagnostics/spread-fences.ts` pinned the conditional-spread fence
(`...(c ? { x: 1, y: 2 } : { x: 3, y: 4 })`) and
`spread-runtime-optional.ts` pinned the `{ ...value }` spread over a
callback's runtime-optional record. Both shapes compile now, so neither
file can stay in a suite whose contract is that every program in it fails;
the differential corpus owns them instead (`8501-object-spread-optional-source`,
`8503-object-spread-conditional-shapes`), where the programs run under Node
and as a compiled binary rather than pinning a refusal.
The rest of `spread-fences.ts` already compiled before this branch, and the
fences it named that remain (an element-type mismatch, a non-tuple call
spread) are ordinary type errors, so the file goes with the fence it pinned.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`["one"] | string[]` flowing into a `string[]` slot compiled to the
checked extraction against the array arm alone, so a tuple value threw at
runtime. Node accepts it: the value is an array, and nothing about a
`string[]` position distinguishes which arm produced it.
Let the union-width plan cover a mixed union that holds the destination
arm beside a convertible one, and place that plan before the
checked-extraction rule, so each arm converts on its tag (a tuple rebuilds,
an array copies). A union whose only non-unit arm is the destination
(`T[] | undefined`) still has nothing to convert and keeps its tested
extraction.
tests/corpus/8513-tuple-union-array.ts pins the binding, call-argument,
readonly, and single-tuple shapes against Node.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`(x as T)["m"]` — the element-access spelling of a member probe — was not
recognized as a probe, so it went through the assertion's checked
extraction and trapped exactly like the property spelling did before
#2443. Recognize a literal-key element access as the same probe, and
answer it per arm there too.
`"m" in (x as T)` is likewise a probe of the asserted value, not a use of
the assertion: accept a union whose arms are all records or units when the
per-arm `in` answers every arm, so the optional-arm shape compiles instead
of refusing with SC1090.
A real use of the asserted member keeps the checked extraction and still
throws on a lying assertion.
tests/corpus/8512-asserted-probe-element-and-optional.ts pins the bracket
spelling, the member probe, and the throwing real use against Node.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`(x as T).m` where T's arms disagree about `m` — one declares it as a data
field, another declares only a setter, or only a getter — fell back to the
assertion's checked extraction, which traps on the arm with no data field.
Node reads `undefined` from the setter-only arm (a read never invokes a
setter) and the getter's result from the getter-only arm.
Count an arm as declaring the member when it carries the data field or a
getter, and let a setter-only arm answer its own read as undefined instead
of bailing out.
tests/corpus/8511-asserted-probe-setter-getter-arms.ts pins both shapes
against Node.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`"k" in make().api` folded to `true` (or refused with SC1090) as soon as
the receiver's shape decided the answer, dropping the receiver call. Node
always evaluates both operands of `in`, so the receiver still has to run,
exactly once.
Fold the static answer through a `seqExpr` for any receiver that is not
safe to discard, for the declared-field, accessor, and inherited-name
answers alike. Side-effect-free receivers keep their previous IR.
tests/corpus/8510-in-probe-calling-receiver.ts pins the once-only receiver
evaluation against Node.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
