- Track whether subscriptions_export is explicitly declared and reject dangling names at the profile.
- Preserve optional omission semantics and cover both paths with contract regressions.
- Preserve tagged-union shape identity when mapping synthesized payload fields into integer inference.
- Refuse fractional writes on named-union and message payload slots, with regressions for both paths.
- Resolve scalar alias chains to their primitive wire types.
- Keep aliases out of the sidecar type table.
- Cover records, messages, helpers, and integer slots.
- Treat readonly T[] and ReadonlyArray<T> as mutability-neutral slices.
- Cover model, message, optional, and helper projections across readonly spellings.
- Lower the HTTPS options row through the runtime ABI with callback ownership and loop liveness.
- Pin HTTP and HTTPS response callbacks with differential and tier-regression coverage.
Co-authored-by: morler <478444+morler@users.noreply.github.com>
- Track canonical field paths through straight-line guards.
- Invalidate path proofs across calls, writes, suspension, and control-flow joins.
- Cover if and ternary proofs with Node-exact C and LLVM regressions.
- Run host artifact and ASan contracts on supported platforms with a Sandbox fallback.
- Clear image-seeded workspace files before extracting the dirty worktree.
- Pin current Linux artifact size classes and regression coverage.
- Retain representative Darwin kqueue coverage in the default gate.
- Schedule native runtime tests by host and make Linux clang invocations portable.
- Resolve canonical OCI manifest digests for direct and indexed images.
- Shard portable coverage across 16 sandboxes while retaining focused Darwin contracts.
- Run invariant suites once and keep differential and sanitizer-sensitive coverage in both lanes.
- Harden sandbox transport, exit-status parsing, and Linux runtime test portability.
- Lower asynchronous ESM initialization with Node-compatible dependency ordering and caching.
- Finish top-level promises consistently across the C and LLVM runtimes.
- Add differential coverage for imports, rejection, and unsettled evaluation.
- Lower Number.prototype.toFixed through the compiler IR and native backends.
- Match JavaScript rounding, range errors, and numeric edge cases in the runtime.
- Add differential coverage and update surface metadata and diagnostics.
- Add a strict versioned manifest and direct C ABI lowering for both backends.
- Link declared native inputs through the CLI and compiler APIs with precise diagnostics.
- Cover the ABI under plain and sanitized integration tests and document its contracts.
- The CA-store surfaces (tlsca.get/root/set) demote the determinism attestation but no fence could deny them: three AMBIENT_SURFACE_FNS rows, one per Node spelling. Split rather than folded into a single "CA store" surface — an author who denies REPLACING the trust anchors is making a different decision from one who denies reading them, and rootCertificates is a value read with no call form to hang a table row on.
- The parity test's full-fence declaration set names the new node-builtin.tls. family; surface-manifest.json regenerated.
- Order-parity baselines for the seven fixtures the two lanes added (2556-2558, 2582-2585). Pure insertions: no recorded baseline moved.
- The crypto introspection statics (getFips and the cipher/hash/curve name lists) bake at the call site, and the crypto constant table joins http2's under a generalized per-module baked-constants lowering.
- The CA-store introspection surface lands in its own unit (scr_tls_ca.c) behind its own link gate, so a getCACertificates-only binary never pulls mbedTLS: getCACertificates, rootCertificates, setDefaultCACertificates.
- http2.createSecureServer grows the eager request handler and the runtime options record, riding the same server-options walk as tls.createServer; string-typed 'data' listeners decode.
- process once/off for 'unhandledRejection' plus the sibling 'rejectionHandled' registry, removal by closure identity per the warning-registry stance.
- Merge resolution unions this lane with main's fs ladders, createRequire erasure, and dyn secure-context work; the runtime's retired "DOM" nickname is spelled "dyn" throughout.
- Include the Windows runtime unit in library archives
- Add opt-in library target-matrix conformance coverage
- Exercise both emission paths across supported desktop targets
- Add Agent connection accounting and HTTP/socket compatibility surfaces
- Support dynamic Buffer at and slice access
- Pin behavior with differential corpus coverage
- Every K-fixture library profile cross-builds through compileLibrary for aarch64-linux-gnu.2.36, x86_64-linux-gnu.2.36, x86_64-windows-gnu, and x86_64-macos, both emissions — 112 archives, ~2min warm, which plus the hard zig requirement is why the lane is env-gated like its linux/windows siblings
- Per archive on the host: K1 symbol exactness against the profile's declared set (Apple's nm is llvm-nm and reads ELF/COFF/Mach-O alike; Mach-O's underscore is the only decoration), the K8 ambient audit in bare and COFF-dllimport spellings, and probe LINKABILITY against the target's libc plus the documented win32 embedder libs
- K2 execution probes ride the existing infrastructure gates: SCRIPTC_LINUX=1 runs the scalar round-trip per linux triple in the bookworm container, SCRIPTC_WIN=1 ships it to the box over scp and folds the mingw CRT's text-mode CRLF back on that one leg
- x86_64-macos stays build-only by contract; the probe runs as a bonus when Rosetta is detected
- README documents the fifth lane beside the linux/windows differentials
- integer_slots records u64 as u64: the wire flattening narrows to the frozen TypeRef spellings where it belongs
- Declaring any integer slot force-lowers the designated init, update, and subscription exports, so every model-field write proves or refuses like an export slot; declared field reads seed their class shapes
- Export integer classes stay attested by the emitted C signature under the same gate — the sidecar list is the document-side complement, and its refusal message now says so
- integer_slots now records each slot's DECLARED class ({i64, u64}); the i64 flattening narrows to the frozen format-1 TypeRef/descriptor spellings where unsigned-ness genuinely has no vocabulary, and the V1 self-check accepts both classes
- library builds declaring sidecar integer slots force-lower the designated init/update/subscriptions exports and every model-first contract helper, so record-field and msg-arm writes enter the prove-or-refuse boundary check instead of attesting from dead-stripped vacuity
- declared record-field reads seed their class shape (whole, class range), the assumption side of the slot contract: an unguarded counter increment now refuses RANGE with the teaching triple rather than a spurious may-be-NaN wholeness complaint
- profile-export param/return classes stay out of integer_slots by design — the attestation mirrors the document's own i64-spelled slots (the V10 bijection; abi.exports carries no TypeRefs) while an export's class is attested by the artifact's C signature under the same gate; the unconsumed-path refusal teaches this
- regressions added: u64 attests u64 while the TypeRef spells i64, unproven update writes into a declared model field refuse SC4022/SC4023 by slot path, and guarded writes prove and attest
- The written-binding decline yields when the declared type has no mapping or the write's RHS roots at an ambient-undefined name
- A class extending a collection-poisoned base flushes the base's diagnostics eagerly: the heritage evaluates at module init, so deferring the compiler's own fence manufactured a silent wrong output
- for-of, destructuring, and spread over engine-held dyn values ride the engine's own iterator protocol with V8's exact non-iterable spellings; for-of over dyn lowers generally
- Static promises cross into the engine as thenables; Promise.all over mixed and non-literal entries runs the engine's own combinator; engine-array fulfillments exit by reference
- The re-minted silent-wrong-answer path is closed: island-literal members whose values poison fence at the read with the captured diagnostic
- The checked-dynamic tree replaces the old nickname across comments and internal docs
- Node serves the builtin for both spellings — a builtin wins over a same-named npm package for the bare specifier — so both key the same lowering tables
- The stale prefix-only caution predated the createRequire erasure; the hint's claim and the behavior now agree
- trapDeclRootOf's written-binding decline now requires a mappable declared type: ordinary storage only buys anything when it compiles — an unmappable recursive call shape traded the compiling no-storage trap for a guaranteed SC2009 on a value that never exists
- bindingEverWritten skips statement-position writes whose RHS chain roots at an ambient-undefined name: that statement IS the RHS root's throw (lowerExprStatement's first claim) and never touches the target's storage, so it cannot justify the decline
- A poisoned base a top-level class extends flushes its deferred diagnostics eagerly (collectClassShape): the heritage evaluates at module init and the base's fence is the compiler's own — Node defines the base fine — so the deferred trap compiled a binary that refused at startup where Node runs; leaf and derived-only poisoned classes keep the JS deferral
- Fixtures: corpus 2632 (unmappable written trap binding) and 2633 (ambient-rooted rewrite), diagnostics js-extends-poisoned-base (the eager report names the base's real blocker), errors.test pins for both deferral edges that must NOT report eagerly; order-parity baselines recorded for the new entries
- text, json, and buffer settle real promises over the readable machinery with Node's settle timing and rejection set; arrayBuffer and blob fence with their representation reasons
- createRequire over this file's URL is compile-time plumbing: builtin specs become namespace imports, relative JSON bakes as validated documents, npm packages ride the require-condition graph, unresolvable names throw Node's catchable MODULE_NOT_FOUND
- module.builtinModules bakes as the compat target's exact list
# Conflicts:
# packages/compiler/src/frontend/lowering/lower-modules.ts
# packages/compiler/src/frontend/lowering/lowerer.ts
- Buffer slice and subarray become true aliasing views over the retained owner — mutating through a view was silently computing wrong bytes
- Each stream tick posts a one-to-one marker on the user tick queue, so stream emissions interleave with process.nextTick in enqueue order, Node's order by construction; the station remains for teardown
- Stream emitters model the pre-created event-key shape governing eventNames order; push honors defaultEncoding with Node's unknown-encoding errors
# Conflicts:
# packages/compiler/test/ts7/baselines/order-parity.json
- The forwarding shape — emit(event, ...args) whose rest appears only as super.emit(event, ...args) — lowers per dispatching event as a real hierarchy method, vtable-participating
- error events keep the throw-when-unhandled path through overrides; super.emit resolves to the nearest override ancestor, JS's chain
- Receivers above every override route through interned instanceOf dispatch; other emitter members and stream-rooted classes keep their fences with reasons stated
# Conflicts:
# packages/compiler/test/ts7/baselines/order-parity.json
- An interval-and-wholeness inference over the lowered IR proves integrality and range for every value reaching a declared i64/u64 slot, with loop-header widening precise enough that the bounded counter loop proves its exact range
- Refusals carry the slot path, the failed obligation with evidence, and the author's concrete fix as SC4021, SC4022, and SC4023
- Declared slots are both obligation and assumption: call sites check arguments, callee bodies assume their classes; integer returns emit exact machine-integer wrappers and inbound params trap through the structured host-contract family
- Math.trunc and Math.ceil compile statically
# Conflicts:
# packages/compiler/src/library/profile.ts
Chris Tate