refuseX509DynValues walks a converted value's type looking for an
X509Certificate record, and it memoized only records (by shape id) and
unions (by union id). A type that reaches itself through an array, set,
map or promise has no id to memoize by, so `type Rec = string | Rec[]`
in a program that also holds a certificate recursed until the compiler
ran out of stack — a crash, not a diagnostic.
The walk now keeps an identity-based visited set over those kinds: a type
met again while it is still being visited answers false, the least fixed
point of reachability, since nothing outside the cycle makes a
certificate reachable. Unions keep their memo, which now also covers a
union cycle that names one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
String(), template literals and `+` with a string refused a union with an
object arm other than a program class or URL (SC1090). classUnionToString
now also takes typed array, Date and RegExp arms and converts each arm as
ensureString converts it alone: a typed array through its join (a Buffer
through its own toString), a date through toString, a regular expression
through its source and flags.
The npm any-chaining fixture compiles with this PR's index-signature
record conversions and then reached String() of a `URL | Uint8Array`
option in its package. It now matches Node, and its KNOWN entry is
removed.
Adds corpus program union-object-arms-to-string.ts, its corpus cost and
its preflight/order baseline.
A statically decided `in` over a union of fixed record shapes treated
every field read as a pure receiver, so `"k" in (make().stored as R)`
folded to a constant without calling make(), and the several-arm answer
re-read the receiver once per tag test. A field read is now pure only
over a pure object (isSafeToRepeat). Any other receiver rides one tag test
when the answer is constant, and the several-arm answer evaluates it once
into a hidden local instead of refusing.
A presence probe through an assertion (`typeof (u as R).member`) answered
an arm with a getter of that name as if it lacked the member: undefined,
without running the getter. The per-arm read now calls the getter on that
arm, as Node's read does, and an arm with only a setter keeps the
assertion's checked extraction.
asserted-arm-probe.ts covers both: a receiver whose call is counted, and a
getter arm beside a data arm.
A call whose checker type is never exits the statement only when the call
is made. In an optional chain (`maybe?.fail()`, `this.helper?.fail()`,
`fail?.()`), a missing receiver or callee ends the chain without making
the call, and the checker still types the call never when the chain's
base has a non-nullable declared type, as an array element read does.
Such a statement completes, so a read after it is not proven present.
exitsAbruptly now skips a call whose callee chain uses `?.`.
A union of two or more class arms and at most two unit arms (`A | B`,
`A | B | undefined`, sum types over classes) now holds the instance
pointer instead of a reference-counted %ScrUnion box, as unions of
records already do. NULL and the null sentinel encode the unit arms.
The arm of a value is the arm whose preorder interval holds the
instance's class id. On 64-bit targets, hierarchy members already keep
their class id in the high half of the rc word, or in the 32-bit header
of ProgramLifetime classes. A standalone class that is an arm of such a
union now keeps its id the same way and counts in the low half; the
count reaches the immortal all-ones value instead of wrapping, as for
hierarchy members.
Each union has a tag helper that narrowing checks inline. Unions over
the same classes share one retain, release and trace: retain and
release use the shared 32-bit count, and only a release of the last
reference dispatches on the arm to that class's release. Unions over
ProgramLifetime classes retain and release nothing. When one arm
carries a collector header, every class of every arm's hierarchy does.
Arms may not extend one another, and must all be compact or all keep
the rc word, and all be ProgramLifetime classes or none. 32-bit
targets, library builds, lifetime-region programs, debug builds, and
unions used as Map keys or Set elements keep boxes.
The LLVM helper's runtime-unit now optimizes a unit itself (--opt-level),
with IR instrumentation (--profile-generate) or a profile (--profile-use),
through the same pipeline as program code. The Linux x64 pack's speed
units are compiled to unoptimized bitcode and optimized there with
packages/runtime-pack-common/profiles/linux-x64-gnu.profdata.gz, so one
LLVM writes and reads every profile. Release and library flavors are
unchanged. The pack manifest records how the profile matched the units.
Code the runtime profile finds cold is optimized for speed, not size: a
runtime function the training programs rarely call can be hot in another
program. scr_message.c is optimized without the profile.
scripts/refresh-runtime-profile.mjs trains the profile on the runtime
benchmark workloads and, optionally, a tsc-ts checkout, and keeps only the
records of functions the instrumented runtime units define
(merge-profiles --keep-functions). Tests check that the profile still
matches the runtime and names only runtime functions.
presentAtUse proves that a binding read cannot be undefined when an
earlier `if` leaves only for an absent value, as in
`if (x === undefined) return;` or `throw`. A branch that calls a function
declared to return `never`, such as `if (x === undefined) fail();` or
`this.fail()`, also never completes. It did not count, so the read stayed
possibly undefined.
A function returning such a read as `string` was then taken to return
undefined too. A string[] it filled counted as holding undefined
elements, which applies to every string[] in the program, so an element
of another string[] passed to process.stdout.write failed to compile
(SC2020, "process.stdout.write of non-string data").
exitsAbruptly now counts an expression statement whose call has type
`never`. The lowerer answers that from the checker
(PresenceBindings.neverReturns).
A value typed as a union of tuples or arrays, such as the `as const`
key-table read `SEQUENCES[functionKey]` in pi, was refused with SC2003
when it flowed into a `string[]` or `readonly string[]` slot. A single
tuple already converted through the width family's tuple-to-array
rebuild; a union of tuples had no plan at all.
widthLiftPlan gains the unionArr step for an array destination: every
non-unit arm must lift on its own tag (a tuple rebuilds through
tupleArr, an array copies or lifts through arr), and a unit arm takes
the stranded TypeError, since the slot has no representation for it.
%union.arr dispatches on the runtime tag and applies each arm's lift;
applyWidthLift and one coerceToExpected hook wire it into the top-level
edges that the nested slots already reach through the plan.
The step is planned only after the union-into-one-of-its-arms rule and
only when no arm of the source is already the destination, so every
union that converted before - `T[] | undefined` into `T[]`, optional
array fields, `??=` - keeps byte-identical IR; only sources with no
conversion at all gain one.
Adds the differential corpus program, its cost file, an IR unit test,
and the order-parity baseline.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A program is nondeterministic only when every artifact that differs also
differs between two baseline builds; a deterministic difference in another
artifact still fails the gate. The runtime-only check now reads the symbols
of changed vendor archives as well as runtime objects.
Records checked from a proxy in a program that freezes untyped values no
longer fail on the proxy's integrity query: a proxy is frozen exactly when
its target is. A sloppy-mode function called with undefined or null
receives the global object that globalThis reads, so its builtin members
such as console answer before anything else reads the global object. The
new corpus programs are named instead of numbered and record their CI
costs.
A method value of a web stream class, such as a saved
WritableStream.prototype.close, called on an instance whose own property of
the same name wraps it, ran the own property again, so the wrapper recursed.
The classes' method values now call the class's method directly
(ScrDynHandleClass.method_invoke); member calls still look at own properties
first.
TransformStream resolved its start promise with a transformer start's
result without adopting a thenable, so both sides started at once and a
rejection was lost. The start promise now resolves as a promise's resolve
function does (scr_dyn_promise_resolve_with): a thenable adopts through its
resolve job, a throwing `then` read rejects, and the stream starts or errors
when it settles, in Node's order.
Lowerer.namesWebStreamClass, a cache made when first needed, is listed in
Lowerer.unjournaled.
A dev executable was one partition up to 1 MiB of LLVM text, so every edit
compiled the whole program again. Unoptimized partitions are compiled on
their own, with nothing imported across them, so dividing a program does
not change its code's quality, and the helper reuses each partition an edit
does not change from the partition cache.
nativeProgramPartitions now takes whether the program is optimized. Dev
executables are divided from 64 KiB of LLVM text, with at least 32 KiB per
partition: four partitions up to 128 KiB, then at least 8 as before. Release
and speed executables keep their partition and code generation counts.
The test compiles the three npm package twice, dev and release, and both
cases shared one 600s budget through test.each. Release compiles the whole
library into one LLVM module that scriptc-llvm-codegen optimizes and
codegens in a single process on a single core: 426s of the 477s total run
in the native-archive phase alone. Across sandbox lanes release measured
331, 335, 339, 345, 348, 350, 358, 428, 450, 511, 521 and 581s, so whole-
box speed varies about 1.7x and the slowest lanes sat within 20s of the
budget; the sanitized dev case hit 600s twice. There is no regression, the
work is fixed and single-threaded.
Generate the two cases in a loop so each gets its own timeout: 1200_000ms
for release and for dev under SCRIPTC_SAN, and the unchanged 600_000ms else.
Test names are byte-identical to the .each %s expansion, so
skipUnownedTest keeps assigning each case to the same shard.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The scr_map unit test compiles 23 runtime translation units with
ASan/UBSan, and that build is essentially the whole test: 90s of clang
against a 2.1s binary run. scr_hash.c alone takes 29s at -O1 because the
sanitizer instruments its unrolled digest rounds; scr_json.c and
scr_lib.c add 28s more. The test then normally ran within 20s of its
120s timeout, and whenever a lane shared the box it repeatedly timed out
in both the plain and sanitized lanes.
The link set cannot shrink: scr_map.c's dyn ops need scr_dyn_* from
scr_json.c, scr_lib.c supplies the remaining date/math/number/perf
symbols, and scr_lib.c needs scr_hash.c. The test asserts Map semantics
under sanitizers, not codegen, and its cost checks are relative bounds,
so build it at -O0: every assertion and sanitizer check still runs and
the build drops to about 15s. Eight concurrent copies now take 20-22s
each instead of 90s, with the timeout unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Node erases a type assertion, so `typeof (stored as R).member` reads the
property off whichever value is stored: when `stored` is
`R | Record<K, R>` and the record arm is holding, the read answers
undefined and the probe is false. Two earlier decisions made this throw
instead. lowerAsExpression applied the checked union extraction for
`stored as R` eagerly, trapping on exactly the arm the probe exists to
detect; and lowerFieldRead answered the read from the ASSERTED checker
type, which also folded `typeof` to a constant.
Defer the assertion's extraction for a member PRESENCE PROBE - the
operand of `typeof`, or an operand of `===`/`!==`/`==`/`!=` against
undefined, null or `void 0` - when the stored union's record arms declare
the member unevenly. The read then answers per arm off the runtime tag
(assertedMemberRead), each declaring arm reading its slot and the rest
answering undefined; a read with no per-arm answer still applies the
extraction the assertion would have taken. `"member" in (stored as R)`
over the same shape likewise probes the stored value.
Every real use - the member called, compared by identity, read into a
typed slot - keeps the checked extraction, so a lying assertion still
throws at its use. Types don't lie; a probe simply isn't the use.
Corpus program asserted-arm-probe.ts covers typeof, undefined and
nullish probes on the optional and required shapes, `in` on the required
shape, a probe guarding the real call, and a real use that throws.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An interface's generic method whose own type parameter is constrained by
the enclosing type's parameter (run<T extends TApi>(item: Item<T>)),
implemented by a plain contextually typed lambda, compiles since #2274:
the lambda takes the contextual signature's type parameters and lowers
once, erased. The merged corpus only covers unconstrained contextual
generics, so this program pins the constrained shape with a conditional
member on the argument type, explicit and inferred call type arguments,
the class-body form, and record-held receivers.
Verified against the 2026-10-23 base checkout, where the same shape
refused with SC2009 (Item<T>'s member 'api' has type 'T'), and the pi
models.ts:1159 Model<T> 'compat' shape refused the same way.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Without the node index, or for a function the index didn't record,
eachNodeOfKinds passes every node of the body, statements too. The
unwind ABI's virtual-call pass cast each node to an expression before
testing its kind, and the native compiler checks that cast: with
SCRIPTC_EMIT_FACTS_VERIFY=1, whose comparison walks every body, it
stopped on the first statement. The kind test now narrows the node.
widthLiftPlan had no arm for a record into a record whose destination
declares an index signature, so every nested position that plans through
it (a union arm, a field, an array element) refused the pair with SC2003
even though widthCoerce already compiles the same pair at top level.
Split lowerRecordOvfCaptureHelper into a pure recordOvfCapturePlan (the
same gates, no interning, no observable state, recursion-guarded like
recordWidthPlan) and the existing builder, return { how: "ovf" } from the
width relation for those pairs, and build the capture call in
applyWidthLift. The destination is still a fresh copy, the stance every
width conversion already takes, and no pair that compiled before changes
shape, since recordWidthPlan returns null for index-signature targets.
Adds corpus program record-ovf-union-arm.ts (a tagged index-signature
record narrowing into an index-signature union arm), its corpus cost and
its preflight/order baseline.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A union-to-union conversion refused a source arm whose promise payload
widens (`Promise<void> | undefined` into `Promise<unknown> | undefined`)
with SC2003, although TypeScript accepts the assignment and Node runs
it. planUnionRetag found no route: widthLiftPlan knew the copy-reshape
family but had no promise pair, and its union branch did not list
promise as a same-family arm. The arm-level conversion already existed
(coerceToExpected's checked payload widening, promisePayloadWidens); it
was just not part of the width relation.
A promise pair now plans as promiseWiden and builds through
coerceToExpected, so planUnionRetag's unique-arm route narrows the arm
and converts its payload before wrapping into the destination tag. The
promise keeps its identity and settlement turn; the destination promise
arm must still be unique (two promise arms keep the fence), and a
payload outside the dyn domain (a module namespace) keeps it too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A class instance stored in a slot typed as an anonymous structural object
type failed with SC2003 (in a union) or SC2002 (a plain slot). The type is
marked by the identity-flow scan, but needsView dropped the mark when
nothing compared the value by identity: pi's
`{ handleInput?(data: string): void } | undefined` field is only ever
called through. The type then mapped to a record, and the record copy
cannot carry a prototype method. The same dropped mark also cost named
interfaces with an OPTIONAL method, whose type is `T | undefined` and so
has no call signature where protocol() looks.
A structural type that exposes a program class method can never be a
record copy: the copy would lose the method, its receiver and subclass
overrides. needsView now keeps the mark for such targets, reusing
methodViewSources. The mark exists only because an instance already flows
into the type, so programs without that flow keep their representation.
The new corpus program covers pi's optional-method union, a required
method in a plain slot, a subclass override, identity, and the data-only
width-copy path.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Recording a unit copied the keys and values of every appendable table before the unit and compared them after it. Each appendable table now keeps one snapshot of its entries' content per recorded wave (JournalTable.contents): a unit is checked only on the entries its IR and new entries name, by key or by the helper name its value holds, and the wave's end checks the content and key order of every entry. The name scan keeps only the strings the tables are keyed by (names that start with % and union ids). ShapeRegistry.journalSizes counts its declared-order candidates and attached names as they are added. On tsc-ts the serial mode's overhead over plain lowering falls from 12.7 s to 10.4 s.
In JavaScript sources, WritableStream with its default writer and
controller, TransformStream with its controller, pipeTo and pipeThrough,
and TextEncoderStream and TextDecoderStream join the native web stream
classes, following Node 24's webstreams step by step: sinks and
transformers, backpressure and the writers' ready and closed promises,
abort with the controller's signal, the pipe's shared write requests and
its abort signal, and UTF-8 encoding and decoding across chunks settle in
Node's order. The streams take own properties, which a pipe does not use
for its own reads and writes, and the global object answers the classes
by computed name in programs that name them.
A JavaScript class that extends one of these classes keeps the SC1090
refusal, and TextDecoderStream refuses encodings other than UTF-8.
The node24-web-stream lifecycle, errors, queues, transforms, pipes,
pipe-errors, pipe-abort, tee and encoding cases now match Node.
