A program is nondeterministic only when every artifact that differs also
differs between two baseline builds; a deterministic difference in another
artifact still fails the gate. The runtime-only check now reads the symbols
of changed vendor archives as well as runtime objects.
Records checked from a proxy in a program that freezes untyped values no
longer fail on the proxy's integrity query: a proxy is frozen exactly when
its target is. A sloppy-mode function called with undefined or null
receives the global object that globalThis reads, so its builtin members
such as console answer before anything else reads the global object. The
new corpus programs are named instead of numbered and record their CI
costs.
A method value of a web stream class, such as a saved
WritableStream.prototype.close, called on an instance whose own property of
the same name wraps it, ran the own property again, so the wrapper recursed.
The classes' method values now call the class's method directly
(ScrDynHandleClass.method_invoke); member calls still look at own properties
first.
TransformStream resolved its start promise with a transformer start's
result without adopting a thenable, so both sides started at once and a
rejection was lost. The start promise now resolves as a promise's resolve
function does (scr_dyn_promise_resolve_with): a thenable adopts through its
resolve job, a throwing `then` read rejects, and the stream starts or errors
when it settles, in Node's order.
Lowerer.namesWebStreamClass, a cache made when first needed, is listed in
Lowerer.unjournaled.
A dev executable was one partition up to 1 MiB of LLVM text, so every edit
compiled the whole program again. Unoptimized partitions are compiled on
their own, with nothing imported across them, so dividing a program does
not change its code's quality, and the helper reuses each partition an edit
does not change from the partition cache.
nativeProgramPartitions now takes whether the program is optimized. Dev
executables are divided from 64 KiB of LLVM text, with at least 32 KiB per
partition: four partitions up to 128 KiB, then at least 8 as before. Release
and speed executables keep their partition and code generation counts.
The test compiles the three npm package twice, dev and release, and both
cases shared one 600s budget through test.each. Release compiles the whole
library into one LLVM module that scriptc-llvm-codegen optimizes and
codegens in a single process on a single core: 426s of the 477s total run
in the native-archive phase alone. Across sandbox lanes release measured
331, 335, 339, 345, 348, 350, 358, 428, 450, 511, 521 and 581s, so whole-
box speed varies about 1.7x and the slowest lanes sat within 20s of the
budget; the sanitized dev case hit 600s twice. There is no regression, the
work is fixed and single-threaded.
Generate the two cases in a loop so each gets its own timeout: 1200_000ms
for release and for dev under SCRIPTC_SAN, and the unchanged 600_000ms else.
Test names are byte-identical to the .each %s expansion, so
skipUnownedTest keeps assigning each case to the same shard.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The scr_map unit test compiles 23 runtime translation units with
ASan/UBSan, and that build is essentially the whole test: 90s of clang
against a 2.1s binary run. scr_hash.c alone takes 29s at -O1 because the
sanitizer instruments its unrolled digest rounds; scr_json.c and
scr_lib.c add 28s more. The test then normally ran within 20s of its
120s timeout, and whenever a lane shared the box it repeatedly timed out
in both the plain and sanitized lanes.
The link set cannot shrink: scr_map.c's dyn ops need scr_dyn_* from
scr_json.c, scr_lib.c supplies the remaining date/math/number/perf
symbols, and scr_lib.c needs scr_hash.c. The test asserts Map semantics
under sanitizers, not codegen, and its cost checks are relative bounds,
so build it at -O0: every assertion and sanitizer check still runs and
the build drops to about 15s. Eight concurrent copies now take 20-22s
each instead of 90s, with the timeout unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Node erases a type assertion, so `typeof (stored as R).member` reads the
property off whichever value is stored: when `stored` is
`R | Record<K, R>` and the record arm is holding, the read answers
undefined and the probe is false. Two earlier decisions made this throw
instead. lowerAsExpression applied the checked union extraction for
`stored as R` eagerly, trapping on exactly the arm the probe exists to
detect; and lowerFieldRead answered the read from the ASSERTED checker
type, which also folded `typeof` to a constant.
Defer the assertion's extraction for a member PRESENCE PROBE - the
operand of `typeof`, or an operand of `===`/`!==`/`==`/`!=` against
undefined, null or `void 0` - when the stored union's record arms declare
the member unevenly. The read then answers per arm off the runtime tag
(assertedMemberRead), each declaring arm reading its slot and the rest
answering undefined; a read with no per-arm answer still applies the
extraction the assertion would have taken. `"member" in (stored as R)`
over the same shape likewise probes the stored value.
Every real use - the member called, compared by identity, read into a
typed slot - keeps the checked extraction, so a lying assertion still
throws at its use. Types don't lie; a probe simply isn't the use.
Corpus program asserted-arm-probe.ts covers typeof, undefined and
nullish probes on the optional and required shapes, `in` on the required
shape, a probe guarding the real call, and a real use that throws.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An interface's generic method whose own type parameter is constrained by
the enclosing type's parameter (run<T extends TApi>(item: Item<T>)),
implemented by a plain contextually typed lambda, compiles since #2274:
the lambda takes the contextual signature's type parameters and lowers
once, erased. The merged corpus only covers unconstrained contextual
generics, so this program pins the constrained shape with a conditional
member on the argument type, explicit and inferred call type arguments,
the class-body form, and record-held receivers.
Verified against the 2026-10-23 base checkout, where the same shape
refused with SC2009 (Item<T>'s member 'api' has type 'T'), and the pi
models.ts:1159 Model<T> 'compat' shape refused the same way.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Without the node index, or for a function the index didn't record,
eachNodeOfKinds passes every node of the body, statements too. The
unwind ABI's virtual-call pass cast each node to an expression before
testing its kind, and the native compiler checks that cast: with
SCRIPTC_EMIT_FACTS_VERIFY=1, whose comparison walks every body, it
stopped on the first statement. The kind test now narrows the node.
widthLiftPlan had no arm for a record into a record whose destination
declares an index signature, so every nested position that plans through
it (a union arm, a field, an array element) refused the pair with SC2003
even though widthCoerce already compiles the same pair at top level.
Split lowerRecordOvfCaptureHelper into a pure recordOvfCapturePlan (the
same gates, no interning, no observable state, recursion-guarded like
recordWidthPlan) and the existing builder, return { how: "ovf" } from the
width relation for those pairs, and build the capture call in
applyWidthLift. The destination is still a fresh copy, the stance every
width conversion already takes, and no pair that compiled before changes
shape, since recordWidthPlan returns null for index-signature targets.
Adds corpus program record-ovf-union-arm.ts (a tagged index-signature
record narrowing into an index-signature union arm), its corpus cost and
its preflight/order baseline.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A union-to-union conversion refused a source arm whose promise payload
widens (`Promise<void> | undefined` into `Promise<unknown> | undefined`)
with SC2003, although TypeScript accepts the assignment and Node runs
it. planUnionRetag found no route: widthLiftPlan knew the copy-reshape
family but had no promise pair, and its union branch did not list
promise as a same-family arm. The arm-level conversion already existed
(coerceToExpected's checked payload widening, promisePayloadWidens); it
was just not part of the width relation.
A promise pair now plans as promiseWiden and builds through
coerceToExpected, so planUnionRetag's unique-arm route narrows the arm
and converts its payload before wrapping into the destination tag. The
promise keeps its identity and settlement turn; the destination promise
arm must still be unique (two promise arms keep the fence), and a
payload outside the dyn domain (a module namespace) keeps it too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A class instance stored in a slot typed as an anonymous structural object
type failed with SC2003 (in a union) or SC2002 (a plain slot). The type is
marked by the identity-flow scan, but needsView dropped the mark when
nothing compared the value by identity: pi's
`{ handleInput?(data: string): void } | undefined` field is only ever
called through. The type then mapped to a record, and the record copy
cannot carry a prototype method. The same dropped mark also cost named
interfaces with an OPTIONAL method, whose type is `T | undefined` and so
has no call signature where protocol() looks.
A structural type that exposes a program class method can never be a
record copy: the copy would lose the method, its receiver and subclass
overrides. needsView now keeps the mark for such targets, reusing
methodViewSources. The mark exists only because an instance already flows
into the type, so programs without that flow keep their representation.
The new corpus program covers pi's optional-method union, a required
method in a plain slot, a subclass override, identity, and the data-only
width-copy path.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Recording a unit copied the keys and values of every appendable table before the unit and compared them after it. Each appendable table now keeps one snapshot of its entries' content per recorded wave (JournalTable.contents): a unit is checked only on the entries its IR and new entries name, by key or by the helper name its value holds, and the wave's end checks the content and key order of every entry. The name scan keeps only the strings the tables are keyed by (names that start with % and union ids). ShapeRegistry.journalSizes counts its declared-order candidates and attached names as they are added. On tsc-ts the serial mode's overhead over plain lowering falls from 12.7 s to 10.4 s.
In JavaScript sources, WritableStream with its default writer and
controller, TransformStream with its controller, pipeTo and pipeThrough,
and TextEncoderStream and TextDecoderStream join the native web stream
classes, following Node 24's webstreams step by step: sinks and
transformers, backpressure and the writers' ready and closed promises,
abort with the controller's signal, the pipe's shared write requests and
its abort signal, and UTF-8 encoding and decoding across chunks settle in
Node's order. The streams take own properties, which a pipe does not use
for its own reads and writes, and the global object answers the classes
by computed name in programs that name them.
A JavaScript class that extends one of these classes keeps the SC1090
refusal, and TextDecoderStream refuses encodings other than UTF-8.
The node24-web-stream lifecycle, errors, queues, transforms, pipes,
pipe-errors, pipe-abort, tee and encoding cases now match Node.
exactInteger can answer a limit's ToUint32 view, which for a number
literal is a literal of its unsigned bits: -1 has the view 4294967295. The
counted loop took such a literal as its i64 endpoint as written, so a
negative limit became a large positive endpoint and the loop ran when it
should not. An i32 literal endpoint is now read as signed or unsigned, as
the integer says.
A counted for loop converts its limit to an i64 endpoint. A limit that is
not a literal went through the double every time: converted to double,
clamped to 2^53, rounded with llvm.floor or llvm.ceil and converted back.
At the default target CPU the rounding is a libm call, which a loop such as
`for (let i = values.length - 1; i > at; i--)` paid on every entry even
when `at` was an int32 local. A limit that is an exact integer (an int32
local, an integer view, or a proven range) is its own floor and ceiling and
within ±2^53, so it is now the endpoint directly; other limits keep the
double path.
A function value with more parameters than the slot it flows into is
assignable in TypeScript exactly when the extra trailing parameters are
optional, and a call through the slot passes no value for them, so the
callee sees undefined as it does in JavaScript. funcCoerceAdapter refused
every such pair, so a callback parameter forwarded into a narrower slot
fell through to requireExactShape and failed with SC2003 ("union
conversion has no unambiguous layout mapping") even though the checker
accepted the program.
The adapter now supplies each omitted extra parameter with omittedArgFor
(the undefined arm of the parameter's ABI union, or the checked-dynamic
undefined). A pair whose extra parameter cannot hold undefined stays
refused, and an extra required parameter remains a checker error.
Only pairs that previously returned null reach the new code, so programs
that compiled before are unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A record now has a reads section: the entries of its function tables that the unit's IR and new entries name and that the tables held before the unit, each with a digest of its content (contentDigest). An applier checks that it holds each one with the same content. This catches helpers named in creation order, such as %dyn.class.protocol.<n>, which another process can number differently.
Two lowering effects had no table a record could check. A unit that collects a function-local class registers the class's members as reachable units, and Object.freeze of a class instance adds hidden fields to the class layout. The lowerer now counts both (unitRegistrations, classLayoutChanges), and a unit that changes either count has no record.
Response.clone and Request.clone tee the body. The tee branches of a body
read from a JavaScript ReadableStream did not keep that body's chunk check,
so consuming the original or the clone took string chunks as text. The
check is now a flag on the body's stream that its tee branches inherit, and
consuming either branch rejects with Node's TypeError "Received
non-Uint8Array chunk".
analyzeFrameEscapes walked every function's body on each visit of its parameter and capture fixpoint, and once more for each function's locals: 1.8 s on tsc-ts's IR, plus 0.5 s for the locals. Each function's body is now walked once into a summary: its value groups, the groups that escape whatever the facts say, and per group the calls and closures whose facts decide it. A query explores only the facts its answer depends on (a parameter's fact depends on the uses of its own group) and solves that part of the graph to its greatest fixpoint; solved facts are kept for later queries. The answers are unchanged: on tsc-ts every parameter fact and every function's frame locals are identical, and the emitter's queries take about 0.35 s.
When Error.captureStackTrace evaluates a JavaScript constructorOpt (a getter,
a call, or this.constructor with a constructor getter), V8 has already
evaluated the target. The lowering kept the target in a local only when its
expression was not a plain read, so a constructorOpt that assigned the target
variable made the capture install the stack on the new value. The target is
now always kept in a local before the constructorOpt runs.
Under Node.js, publish() deep-freezes everything it reaches, so
Object.isFrozen and Object.isSealed return true and Object.isExtensible
returns false for a published object, array, Map or Set. Native builds
already refused writes into published values, but answered these queries
as for an unpublished value: publication marks an object immortal and sets
no frozen bit.
- record.isFrozen, array.isFrozen and the extensibility test of Maps and
Sets also read an immortal rc word as published, the test of the
published write guards, for the types the program may publish
(PublishedTypes). Other types emit the code they did.
- scr_dyn_is_frozen, scr_dyn_is_sealed and scr_dyn_is_extensible answer
for a published object, array, Map or Set, or a checked view of one,
before materializing the view.
Dev executables compiled their program shards in fixed batches of up
to eight, each batch waiting for its slowest shard before the next one
started. Keep up to eight clangs busy instead, each taking the next
shard when it finishes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A view writes its source's slots through the target type's stores, which
have no frozen-write guard, so a write through a view made before
Object.freeze(source) changed the frozen record. A view's record-source
entry also owns the source's capsule, an edge the cycle analysis does not
see: a source that stored its own view, or a value reaching it, kept both
records until process exit.
A source now takes part in a view only when it is not freezable and its
fields, elements, map entries, union arms and overflow properties cannot
hold a value of the target type. A class instance, function, untyped value
or other reference that can reach arbitrary objects counts as holding
every type, and a value of a view target type counts as holding the
records it may view, so two views cannot close a cycle either. Other
conversions keep their copy.
Chris Tate