A const initialized by an array literal and spread once can still run
that spread more than once: in a loop body, loop test or update, a
function, or a class field initializer. Each run inserts the same
elements in JavaScript, so copying them into the destination's layout
would break identity. Those spreads keep the element-layout refusal.
Each armed site lowers the code after it twice, and a cast inside another
site's tail is lowered in both copies, so n sequential casts produced 2^n
copies of the code after the last one. A site now arms only while fewer
than two splits enclose its tail or share its split point; later casts
keep the throwing cast.
The generic store keeps a native Error's code slot in step with writes
through its checked view, as it does for name, message, stack and cause,
so the store cache leaves `code` to it. The header invariant accepts
scr_js_*.test.c units, which link the dynamic tier.
The stream probes for untyped values (pipe destinations, pipeline
stages, readline input and output, and the checks against the stream
classes) read the vtable word of any boxed object. Instances with a
class id in the rc word have no vtable word, so a hierarchy instance
whose first field is a number crashed those probes. scr_stream_vt_of
answers NULL for them, and each probe treats that as no stream.
The Limitations page partials keep one sentence per line so edits to
different sentences merge, but AGENTS.md's general Markdown rule asks
for paragraphs on one line, and changes that followed it conflicted with
the split text. AGENTS.md now names the partials as the exception, and
limitations-partials.mjs gains a check, run by pnpm lint, that fails on a
partial line holding two sentences, and a fix mode that splits such lines.
The one partial that held several sentences per line is split; Markdown
joins the lines, so the page renders the same.
workloads.json listed every workload in one array, and its README table
listed them in one hand order, so changes that each added a workload
appended at the same place and conflicted. Each workload is now a JSON
file in benchmarks/runtime/workloads/ named after it, read through
benchmarks/runtime/workloads.mjs by the bench runner, the zero-cost
gate, the strace script and the dynamic-tier test, ordered by category
and then name. The loader still reads workloads.json in a checkout from
before this change, so the gate can compare against one. The README
table follows the same order.
The lib-fn sets and prefix lists in runtime-features.ts grew by
appending, so changes that added different entries to one list touched
the same last lines and conflicted. Each list's entries are now sorted
within its commented groups, and the all-off feature literal follows the
rules table's name order. Entry order is unobservable: the lists feed
membership maps and prefix tests that each set their own flag.
hot-shots, a StatsD client compiled from its JavaScript, failed when a
program constructed a client. Each gap on its UDP path is closed
generically:
- Sloppy-mode functions with named parameters may read `arguments`
where the aliasing of their parameters cannot show: only
`arguments.length`, or element reads without parameter or element
writes.
- An `any` slot admits any boxable function value, including functions
with optional parameters (`C.prototype.m = function (...)` through an
untyped receiver).
- In a JavaScript file TypeScript does not check, a prototype method
takes its documented parameters as checked-dynamic values, as
constructors already did.
- JavaScript dgram sends run completion callbacks, buffer lists,
connected sends and the six-argument offset/length form.
- A dgram socket crosses into the checked-dynamic tree as a handle
(SCR_DYNH_DGRAM_SOCKET) whose methods are function values, with
untyped listeners that survive 'close'. The handle lives in its own
runtime unit (scr_dgram_dyn.c, the dgramDyn feature), linked only
when a program converts a socket to or from an untyped value.
- `String.prototype.concat` on strings, and `parseInt` over a possibly
missing or untyped value in JavaScript.
Corpus programs 6590-6596 and the hot-shots-udp npm
case (hot-shots 8.5.0 vendored) match Node in both lanes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
#1360 moved the content hash and row count into next.config.mjs and
deleted node-v24-compatibility-meta.json, but a later merge kept a
branch's copy. Nothing reads it, and its hash line conflicts on every
compatibility change. The local compatibility check now fails while the
file exists, so a merge can't bring it back unnoticed.
When an operand of a bitwise operator is a hoisted optional boolean, the
operands evaluate into temporaries before the operation. A left operand
that is safe to repeat, such as a variable read, kept its place in the
operation while the right operand's temporary ran first, so a right
operand that assigns that variable changed the value the left operand
read: `seen ^ (seen = !seen)` gave 0 where Node gives 1.
The left operand now takes a temporary whenever the right one does, so
both evaluate in source order. The corpus program covers an assignment
in the right operand of ^ and <<.
fs.realpathSync and fs.realpathSync.native read as function values
lower to the fs.realpathValue libCall. The library sidecar's determinism
attestation demotes on every fs.* spelling, so a fence on realpathSync
has to witness that one too. It is now an alias of both members, and
the surface-manifest attestation parity test passes again.
`JSON.parse(text) as T`, `const x: T = anyValue` and `await res.json()
as T` threw `TypeError: expected X at $.path, got Y` when the value did
not fit `T`. Node never checks an assertion and continues with the value
it has, so the build-container listener rejected an order Node accepts
and a JWT with a string `exp` became a 500.
A failed cast now keeps its value when it initializes a `const`/`let`
binding declared in a function or block and only the code after the cast
reads the binding. That code (the statements after the cast in each
enclosing statement list, up to the declaration) lowers twice: the
static copy, unchanged, runs while the value fits; a dynamic copy, in
which the binding and everything derived from it is typed `any`, runs
after a failure, so missing members read undefined, wrong-typed members
keep their values, extra members stay visible in source order, and
objects keep their identity. The cast sets the flag that selects the
copy: the fused JSON.parse helper's slow path and the plain check call
scr_dyn_check_recover, which takes back the TypeError and parks the
value for checkedCast.fallbackTaken/fallbackTake.
A failed value that flows into a typed slot outside the region is
checked there, as any `any` value is: it continues when it fits and
throws at that use when it does not. A statement of the dynamic copy
with no `any` lowering becomes a runtime fence that throws only when a
failed value reaches it. Module-level bindings, regions with hoisted
declarations or super() calls, union targets and targets holding class instances, and
--tier=static-only (and library mode) keep the throwing cast.
`a?.b.c` on an `any` value now short-circuits only on `a`, so `.c`
throws when `a.b` is undefined, as in Node.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- A JavaScript generator whose inferred return is `any` (it delegates to
itself) is a generator with checked-dynamic channels.
- for await over a checked-dynamic value: a compiled async generator, the
value's Symbol.asyncIterator result, or its synchronous iterator with
awaited values; break and throws close it through an awaited return().
A value that is not iterable throws V8's TypeError.
- yield* in async generators delegates through the same protocol and
completes with the delegate's return value.
The runtime part is a new unit, scr_dyn_for_await.c, linked only by
programs that use it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An emitter used both through its static type and through an untyped
reference aborted: a typed `on` followed by an untyped `emit` (or a typed
`emit` from a class body reaching a listener added through `any`) hit
"computed event collided with a fixed event", and an untyped
`emit('error', ...)` trapped outright. Listener entries held either a
typed adapter or a checked-dynamic thunk, and the emit core trapped when
an entry lacked the form the emit carried.
Entries may now carry both forms. Listeners registered through
scr_emitter_on_dyn keep their thunk beside the typed adapter; typed
emits call the adapter and untyped emits call the thunk with the
arguments as given. The class dispatch of compiled emitters registers
untyped listeners under an event typed code fixes with a typed adapter
for its tuple, and converts the arguments of an untyped emit of such an
event to the tuple for listeners with typed parameters
(scr_emitter_emit_mixed; a mismatch throws the checked conversion's
TypeError). Registrations and emits through untyped values otherwise go
through scr_emitter_on_any/emit_any: runtime adapters under 'error' and
the meta events, and Node's unhandled-'error' contract. The emit core
throws instead of trapping when an entry has no usable form. The
dynamic half of the registry sits behind a hook only on_any installs,
and on_flex/emit_flex keep their plain behavior, so programs without
untyped emitter calls link none of it.
listenerCount, eventNames, removeAllListeners, listeners, rawListeners,
setMaxListeners and getMaxListeners through an untyped value on a
compiled emitter answered "is not a function"; they now dispatch to the
native registry.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- await of a checked-dynamic value is PromiseResolve then await, so an
object with a callable then is adopted. The rewrite applies only when a
program source can define a thenable; other programs keep the plain
checked await.
- promise.constructor answers the Promise constructor; its prototype and
Promise.prototype answer an object holding the runtime's then, catch
and finally as non-enumerable own properties.
- Reflect.getOwnPropertyDescriptor and Reflect.defineProperty over checked
objects.
Together these run execa 5's Promise mixin over checked objects.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Clang has no __builtin_setjmp lowering for AArch64, so scr_wasm.c did not
compile under AddressSanitizer on macOS arm64. Sanitized AArch64 builds
now use an uninstrumented setjmp/longjmp pair that saves the
callee-preserved registers, sp and the frame and link registers; like the
builtin pair, no runtime intercepts it, and scr_wasm_trap still unpoisons
the abandoned frames.
The darwin-arm64, linux-x64-musl and linux-arm64-musl CLI builds failed with
"tsc-ts checker: ... has no @tsc-ts/<platform> executable":
- The lockfile had no entry for @tsc-ts/darwin-arm64@0.0.5, so the
darwin-arm64 install skipped it. The lockfile now lists all seven
platform packages.
- A CLI ships the tsc-ts executable of its target. The musl builds run on
glibc runners, where pnpm installs only the glibc packages. Those jobs now
add musl to pnpm's supported libc before installing.
Main's supported-module hint now lists dns/promises, stream/web and v8,
so the SC0001 hints recorded for readable-stream-3 and
readable-stream-disable no longer matched.
Chris Tate