- New codes, minted in badType's classification order: SC2005 values whose type keeps a generic call signature, SC2006 index-signature shapes outside the supported set, SC2007 overloaded function types, SC2008 intersections with no resolved lowering, SC2009 supported container/function/record shapes over a component outside its slot — the SC2009 message names the offending component (Map/Set key-value domains, array/tuple elements, union arms, function rest/params/returns, record members) via describeComponentBlocker/describeRecordMemberBlocker in frontend/types.ts, which mirror mapType's own rules on the failure path only.
- Standard-library nominal types with no lowering at all (Date, ArrayBuffer, WeakMap, the iterator and constructor interfaces) now route to the existing SC2020 story instead of the supported-set recitation; stdlib provenance is checked after the container claims so Map/Set/Promise instantiation failures keep their component story.
- SC2001 keeps the honest remainder — bigint and symbol primitives, constructor objects, and library-derived or unresolved generic shapes — and its registry name now says so; across the diagnostics corpus its rendered sites drop from 57 to 5.
- Every new code flows through the diagnostics registry, the regenerated surface manifest, and coverage-report grouping; five new tests/diagnostics programs pin one rendered frame per code, and the ts7 order-parity baselines re-record to include them.
- Zero behavior change to accepted programs: the differential corpus (900 programs) is untouched and green, and the full suite passes.
- staticCallOn and lowerClassValueProperty fenced every #private static access with a through-a-VALUE receiver, so C.#m()/C.#f on a const-bound class expression, A.#f through a const alias of the class, and Example.#m() under a replacing decorator all died with SC1090 while the direct class-name spelling compiled.
- The static-WRITE path already knew the sound rule (exactClassOfReceiver plus the leaf-class arm); classValueIsExactlyOwn now shares it with the call and read paths: a receiver that provably IS the class, or a class with no strict descendants, always carries the declaring class's brand — the fence stays for slots a subclass can inhabit, where Node throws TypeError.
- Rebindable decorated names ride the leaf arm for free: replacement decorators fence any class with subclasses before minting the rebindable global, so the decoration result is always the declaring class object.
- The read path additionally gains the subclass-spelling fence (reading an inherited private static through a subclass-named binding) that the call and direct-read paths already had.
- Fixtures 2520-2523 pin the four call forms (class-name calls including static field initializers and subclassed declarers, const-bound class expressions with reads/writes/calls, decorated classes under both replacing and void decorators, aliased class values local/module/param) byte-identical vs Node on both backends; the private-members diagnostics fixture repins the residual fence on a descendant-capable slot.
- order-parity baselines re-record for corpus 2470-2476 (new fixtures only)
- regex.ts drops the RegExp | undefined fence (regex union arms compile)
- spread-fences.ts drops the optional-into-required SC2002 (the checked NARROW lift, divergence 38's stance: the flow traps at runtime where it used to fence at compile)
- LIB_FN_SYMS mapped net.{get,set}AutoSelTimeout to scr_net_{get,set}_auto_sel_timeout; the runtime defines autosel — every LLVM-tier program touching the surface died at link
- The ABI guard gains a table-existence audit: every scr_* string the backend sources can emit must exist in scr_runtime.h as a prototype or extern data symbol
- Fixture 2500 exercises the surface differentially on both backends
- LIB_FN_SYMS mapped net.getAutoSelTimeout/setAutoSelTimeout to scr_net_get_auto_sel_timeout/scr_net_set_auto_sel_timeout, but the runtime defines scr_net_get_autosel_timeout/scr_net_set_autosel_timeout (the C backend already used the correct spelling), so any program touching net.getDefaultAutoSelectFamilyAttemptTimeout on the LLVM tier died at link with undefined symbols.
- The ABI guard could not see this: the literal-declare source scan only checks fully-literal declare strings, and the emitted scan's corpus slice never exercises the net autosel surface — a table entry whose fixture doesn't exist was invisible from both directions.
- llvm-runtime-abi.test.ts grows a third, table-driven direction: every scr_* name the backend sources can ever emit — the static string tables plus every literal @scr_* template reference (interpolated per-type families excluded) — must exist in scr_runtime.h as a prototype or extern data symbol, so a two-string name skew now fails at test time instead of at the user's link step.
- parseHeader additionally collects extern data symbols (scr_emitter_vt, scr_error_vts) so vtable-global references audit cleanly.
- New corpus fixture 2500-net-autosel-timeout.ts round-trips the default attempt timeout (set then get, integers >= 10 to stay clear of Node's clamp) and is byte-identical vs Node through both backends.
- The return shapeRef now seeds container 'helpers' with the helper name as the member, so an inline-record helper return tables helpers_<name> instead of helpers_<name>_return; parameter naming (helpers_<name>_<param>) is unchanged
- The contract fixture gains 'extent', a helper returning an inline record, pinning the synthesized name helpers_extent in the type table and the value-kind helper return with the arena bit
- The anti-alphabetical suite asserts the new struct entry and helper row on both emissions; V13 byte-determinism stays green
- T[K] resolves against record bindings, Object.hasOwn/assign lower over records and the DOM, fixed shapes take runtime-keyed writes with the miss trap, and string|RegExp unions narrow by instanceof
- the width family gains the checked NARROW lift and the tuple-arm literal route (the option-table shapes)
- island literals complete: get accessors, plain spreads, tagged templates with .raw, jsval ??, and call-time fence deferral for unlowerable members (lambda poisons defer too)
- JS variadic rests under --dynamic bind the engine arguments array and re-invoke through apply; dyn values marshal into the island as the deep copy
- corpus 2470-2476 pin every landing against the Node oracle on both backends
- All twenty schema fields: declaration-ordered type tables, wyhash-64 build_id, descriptor families
- Deterministic byte-equal emission on both backends, validated against rules V1-V14
- Identity getters synthesize as constants: pre-init and post-poison reads match the sidecar
- A computed determinism attestation from a conservative ambient-surface scan
- A union lacking null or undefined compares against that literal as a constant, both orders
- Effectful operands still evaluate exactly once; switch unit cases ride the same lowering
- The external adversarial corpus stands at 52 of 53 byte-identical
- lib-contract.ts reads the entry's exported types, function signatures, and the ratified exported-const conventions (modelUnbound/msgUnbound/appearanceMsg/chromeMsg/envMsgs) from the AST in statement order, never the checker
- sidecar.ts projects them into the schema's closed vocabulary: declaration-ordered type table with synthesized <Container>_<member> records, five-family msg descriptors (number-first pins number_bytes, bytes-first takes the record family), helper table with the arena bit, channels, and the canonical abi.exports order
- build_id follows the schema's worked definition (compiler version, profile bytes, sorted canonical module graph) and lands on IrLibSection.identity so both backends emit the getters from the one value the sidecar records; the getters are pure constant returns with no entry prologue — poisoned-guard exempt, callable pre-init and post-trap
- not-yet facts emit the stated absent forms: integer_slots [] with every numeric slot f64, deterministic computed by a conservative ambient-surface scan (moduleLibNondeterministicSurface), async_free structural behind SC4005
- sidecar-validate.ts implements the V1-V14 self-check run before writing; unprojectable designations refuse as SC4009 naming the declaration; the CLI prints the sidecar path beside the archive
- profile.sidecar declares the echoed constants (wire/abi/snapshot), the identity-getter symbols, the model/msg designations, and the profile-selected "module-graph" source-hash contract; presence turns contract emission on
- wyhash.ts implements wyhash-64 final_version_3 (BigInt, vector-pinned) with the length-prefixed framing the schema's build_id definition requires
- the profile's exact bytes ride the resolved LibraryProfile (build_id input 2), getter symbols join the pairwise-distinct claim set, and unknown fields inside the section refuse as SC4001
- lowerUnitComparison folds ===/!== against a union lacking the unit arm to the constant answer, both operand orders
- a non-droppable operand still evaluates exactly once, riding a throwaway tag test
- union-switch case null / case undefined take the unit-comparison lowering, so a lacking arm never matches
- the unionEq fallback had coerced the literal through the stranded-arm trap, throwing where Node answers false
- corpus 2490-2494: the find-miss repro, every strict and loose spelling, switch unit cases, effect preservation
- mapType back-references mint placeholder shapes/unions finalized at frame exit; identity is per checker type, and context-sensitive (generic/mixin) knots stay fenced
- every type walk survives cyclic shape graphs: coinductive JSON/dyn-safety predicates, guarded formatIrType/jsvalLiftable, cycle headers via the existing collector fixpoint on both backends
- JSON.stringify throws V8's byte-exact circular TypeError (hop lines, ellipsis rule); cyclic values crossing into checked-dynamic slots trap instead of hanging
- console.log/util.inspect render <ref *N>/[Circular *N] exactly (SEMANTICS 129 resolved; depth:null lowers) and deepStrictEqual terminates through Node's pair memo
- corpus 2480-2488 green on C, LLVM, and the sanitized RC-audit lane, which proves child->parent cycles collect
- A canonical-table rewrite recognizes getter-table and star re-export plumbing
- Chaseable getter bodies type by their resolved values; the lexer name set is the contract
- Consumer-anchored errors degrade the opted-in package with a note instead of gating
- Two lowering ICE classes fixed; untyped packages stay flag-invariant
- purely additive: five new fixture entries, zero existing entries changed (2465 pins the flagless chunkGhost SC0001 — the lexer-only name the opt-in types)
- the tsc __esModule stamp and the void-init preamble (with later real assignments) lower to nothing instead of fencing at module load
- require() spreads in a module.exports table are star-re-export plumbing: names resolve statically and the module load rides the import edge
- island/mixin/shadow probes use a read-only peekLocal so speculative queries never thread capture state
- a capture threading through a non-lifted function fences with the binding named (SC1090, statement-deferred in JS) instead of the lowerer assertion
- the fallback loop attributes import-site SC0001s by message (module specifiers and typeof-import paths) and drops the named package with a site-count note
- the solo-probe last resort runs for ALL modes with a note naming the type-only and type-guard inference gap; explicit opt-ins degrade like auto's (the old keep-the-errors stance is superseded)
- require() and default imports of opted-in packages are program-module edges like the import-declaration form, and a compiled-entry resolution maps to its .ts source sibling when the checker admitted the source
- the fs shadow serves opted-in bundle files with the plumbing space-padded and one canonical tail table: chased getter values as alias-plumbed entries, star re-exports as spreads plus per-name member reads, lexer-visible-but-unchaseable names as checked-dynamic any bindings valued undefined
- lexer parity is the contract: the rewritten text answers the same name set to the CJS lexer that the original answers Node, unused helper declarations sweep away, and esbuild's __esModule marker is deliberately omitted (Node never lexed it; spelling it flips default-import interop)
- npmStaticPackageOfPath answers for opted-in workspace realpaths, and the shadow registers a symlinked install's realpath the moment resolution touches it (nested-realm monorepo drivers)
- non-opted UNTYPED node_modules packages serve as an any-surface stub so maxNodeModuleJsDepth cannot change the program's own types under the flag
- auto eligibility refuses only bundler-runtime markers (__webpack_require__) now that degradation is graceful
- scriptc build --lib --profile emits ccc wrappers, init/sink/reset/collect entries, and a static archive
- async_free is structural: the async and event-loop units never link, symbol-audit proven
- Every runtime trap routes through one funnel; the sink contract covers both emissions
- The K-fixture conformance matrix runs a real C host against both backends
- console.log routes non-scalar arguments through the static inspect machinery
- Union arguments dispatch per arm at runtime; string arms print raw
- Object literals widen per-field into a uniquely-fitting union arm
- The limitations page documents the type surface
- Island values exit validated into intrinsic slots; checker-any dispatches to the DOM machinery
- World-mixing backstops make jsval/dyn confusion structurally impossible
- Regex arrays compile; dyn-root JSON.stringify matches across backends
- A silent invalid-C escape and a giant-TU stack overflow fixed
- The full legacy surface: parse, stringify, escape, unescape, the aliases
- Node's scan state machine in C: separators, maxKeys, malformed-escape and truncation quirks
- Link-gated; escape-only programs never link the unit
- Lexically-bound private calls devirtualize by construction; statics and static blocks included
- Private accessors with observable get-then-set order; private generator methods
- Brand checks fold statically or ride the vtable interval test
- util.inspect omits private members exactly like Node
- The performance global routes through the perf_hooks lowering in all spellings
- Response declares its implemented headers/arrayBuffer/bytes surface
- Math.max and Math.min lower at any arity with NaN and negative-zero exactness
- Copy-installed workspace members classify like symlinked ones
- The performance global routes through the perf_hooks lowering in all spellings
- Response declares its implemented headers/arrayBuffer/bytes surface
- Math.max and Math.min lower at any arity
- Copy-installed workspace members classify like symlinked ones
- a dyn root holding undefined stringifies to the TEXT "undefined" (Node's answer for the undefined result value) instead of the nested-position writer's null — corpus 2448 pins both backends
- fallible like the C dispatch: a runtime handle inside the tree throws, so the pending check runs
- island ('any') arguments at intrinsic/libCall/callValue slots take the validated exit (dynCheck's stance); non-exit-safe slots fence with the slot named, and the boundary pass backstops every jsOp/dynCall/dynInvoke argument so world-mixing sites can never ICE
- a checker-'any' receiver/callee that LOWERED checked-dynamic dispatches to the DOM machinery: ambient-this reads are dynKeyGet, rest-args map/forEach ride the runtime dispatch, dyn callees take dynCall
- Object.entries/values push unit-armed (null | undefined) fields as the null literal; new Set(seed) exits an island-handle seed as a validated copy
- fence-bodied functions emit even when their ABI names an unregistered class, and a run()-end sweep rewrites leftover unregistered-class type slots to the inert f64 placeholder — the clang invalid-C escape closes with the ICE
- RegExp[] compiles (REF elements, both backends; map callbacks returning other unrepresentable kinds meet a named fence), and the C emitter appends program-sized line arrays by loop, not spread (500k-line TUs overflowed the stack)
- order-parity baseline gains the 2450-2457 corpus entries and the private-members diagnostics entry (purely additive; re-recorded from the native lane).
- Privates ride the ordinary member maps under their unspellable spelled names; a subclass redeclaring an inherited private name is fenced, so base-chain walks ARE lexical resolution and privates never enter vtables — JS's no-dynamic-dispatch semantics by construction.
- Private GENERATOR methods compose the generator machinery with this as param 0 through the gen-spawn wrapper (the vtable problem that keeps public generator methods fenced does not exist for privates); async and generic privates ride their existing static-dispatch machinery.
- Private statics lower as module globals/functions through the declaring class's own name; subclass-named and class-value receivers fence (JS brands the declaring constructor alone).
- '#x in obj' lowers as instanceof-the-declarer: static folds at/below and disjoint, the vtable interval test when the declarer sits below the receiver's static class, and unions of decided class arms collapse to tag tests; unknown/generic/static brands fence with pointed hints.
- util.inspect omits private fields exactly like Node (an all-private class prints 'C {}'); corpus 2450-2457 pin every form differentially on both backends, diagnostics private-members pins the fences.
- scr_qs.c ports Node v24's legacy codec quirk-faithfully (the scan state machine with maxKeys' pair budget, unescapeBuffer's code-unit byte truncation with U+FFFD replacement decode, encodeStringified's value rules over the DOM crossing); link-gated by moduleUsesQs, and escape rides the always-linked component encoder
- parse's result is the call site's ParsedUrlQuery dictionary (the networkInterfaces verification stance; the runtime fills the overflow map and groups repeats into string[] buckets), sep/eq/maxKeys complete to Node's defaults, and custom encoder/decoder options fence by name
- decode/encode lower as Node's own aliases; both backends emit the same runtime calls byte-identically
- querystring joins SUPPORTED_BUILTIN_MODULES, the fallback declarations, and the regenerated surface manifest, so npm-static packages requiring it unguarded stop falling back to the island (the shim stays for island code)
- corpus 2460-2464 pin the grammar corners against Node: malformed escapes, '+' vs %2B, repeated keys, maxKeys with empty segments, multi-char/multi-byte separators, astral truncation, and every CJS acquisition spelling
- non-core scr_trap/scr_trap_fmt move from scr_console.c to scr_exception.c: the failure-channel unit is in every link, the runtime's own unit-test TU subsets included (the console unit is not)
- K8 additionally asserts no scr_loop/fiber/timer/child symbol is defined in or referenced by the archive — the design's mechanical backstop for the narrowed core base set
- five generic fixtures under tests/core-mode (scalars, buffers, reinit, traps, init-trap) with C probe drivers; the harness flips the profile emission and pins identical outputs across the two lanes
- K1 nm symbol exactness both directions; K8 ambient audit (no sigaction/signal/pthread_create/atexit/setvbuf references — scr_init and scr_lib_init compile out under SCR_CORE)
- K3 covers both arena postures over one core; K5-K7 cover sink-exactly-once, init traps, pre-registration abort, Uncaught rendering, poisoned-core aborts; K10 reruns K4/K5/K7 under ASan + the RC audit's re-init zero-heap seam
- K9 drives SC4002/SC4003/SC4004/SC4005/SC4007 end to end with the profile-teaching rider verbatim
- IrModule.core lands the resolved export map + mode-provided symbol names on the IR; both emitters generate the external ccc wrappers, the re-runnable init entry (globals released and zeroed, error-vt stamps, %main, escaped-exception check), sink registration, and the optional reset/collect entries from the same facts
- marshalling wrappers delegate to scr_core.c helpers (str/bytes in-copy, arena-out), so the two emissions are identical by construction; both arena postures emit from resultResetSymbol
- compileCoreArchive builds <name>.core.a: program TU + the narrowed core runtime set (no scr_async/scr_child) + IR-gated pure-data units, all -DSCR_CORE; vendored zlib objects keep the libc/libm-only undefined-reference contract on hosts
- profile-mapped exports seed lowering reachability (coreRoots) so uncalled exports stop dead-stripping on the core path
- emitted family-4 traps (OOM, invalid union tag, bad key) route through scr_trap in both backends
- CLI verb: scriptc core --profile <file> [-o out]
- literalUnionArmOf probes the contextual union's checker members: literal-vs-literal fields decide by value, absent arm fields must be optional-flavored, excess fields disqualify
- exactly one fitting member builds the literal at that arm's shape so its field types drive every property's coercion; zero or several keep the SC2003 fences
- corpus 2442-2444 pin the reducer and discriminated-message shapes differentially on both backends
- console.log/info/debug/error/warn take unknown[] and render every non-scalar argument through the static util.inspect at the rest-args depth 2, strings verbatim
- top-level unions dispatch per arm at runtime with string arms raw, and util.format's %s/rest args take the same per-arm rule
- info and debug lower as stdout aliases of log; the remaining stock console members are declared in the fallback so stock-clean programs meet per-site SC2020 hints instead of a fallback-manufactured SC0001
- corpus 2440/2441 pin the widened shapes on both backends, console.log(process.argv), a find() miss union, and console.log(undefined) included
- diagnostics snapshots re-pinned: the union console fences retire and utility-types reports its real per-site fences
- executable expansion in scr_console.c is byte-identical fputs/vfprintf + abort; core expansion in the new scr_core.c poisons, delivers to the registered sink exactly once, aborts pre-registration or if the sink returns
- 89 fputs/fprintf+abort pairs and 10 bare OOM aborts across the 20 core-linkable TUs now funnel; lazy atexit teardowns (json errdyn, regex bytecodes, symbol registry) reroute to the core reset registry via scr_atexit
- scr_core.c owns sink/poison/result-arena/reset-registry/marshalling helpers; scr_exception.c renders escaped exceptions as "Uncaught ..." into the funnel; scr_lib exposes its cleanup to the reset seam
- moduleCoreAsyncSurface finds the first async/timer/event-loop/ambient-process reach with its source anchor (async/generator functions named; libCall prefix table over timers/child/net/http/streams/signals; refused value kinds)
- coarse moduleUses* predicates as the entry-anchored safety net behind the fine-grained table
- six-program detection test (sync graph clean; async fn, generator, setTimeout, spawnSync, process.on refused)
- loadCoreProfile parses/validates the ratified profile shape (prefix discipline, pairwise-distinct symbols, meaning-changing unknown-field refusal, both arena postures, the collect entry)
- u8/u32/i32 plumbing classes accepted in parameter position only; integer returns name ask 4 in the refusal
- SC4001–SC4007 factories in the diagnostics registry, with the SC4004/SC4005 profile-teaching rider
- 17-case validation test
Chris Tate