Native CLI: verify completed bun-run corpus across platforms

Follow-up to #66 and the native package-script implementation in #497.

Current checkpoint

Published 3be72ca5b on codex/runtime-port as Chris Breuer, with no coauthors; not merged to main.

• Native bunx and the real native install chain now execute in Home, including missing-package downloads, dependencies, bin/cache selection, copied aliases and leading --bun x.
• Full unchanged bun-run: 291 pass / 0 fail / 416 assertions, resolving all three remaining rewrite cases from the 288/3 parent.
• Full unchanged bunx with an isolated PATH and node/bun hard links to the exact Home binary: 33 pass / 1 Windows-only skip / 0 fail / 161 assertions. No installed Node/Bun runtime executes those JavaScript children.
• Ordinary PATH bunx is 32 pass / 1 skip / 1 fail, because the installed claude command satisfies binary lookup before the alias test reaches its mock registry. Pinned Bun reproduces this failure and passes the isolated alias control. An earlier symlink-only Home PATH run also retains its cowsay/yargs basename failure; the successful hard-link run does not alter runtime values or package source.
• Native installation/analyzer/credential/cache safety/runtime-auto-install regression passes normally and with VM destruction/JSC checks. Upstream add --analyze: 1 pass / 18 assertions. Unchanged workspace suites: 58/58 / 192 assertions.
• Native build 17/17; runtime units 1,820 pass / 19 skips / 0 failures, 19/19 steps; regression commands 56/56, including 25 native files, full spawn 126 pass / 5 skips / 5,484 assertions and child-process 32 pass / 1 skip / 1 TODO / 72 assertions.
• All 33 measured upstream source files match pin 4982b91e3702094330f3be3883354c52b8c01323. The unchanged test's regenerated tarball was archived, normalized contents checked, and the pinned fixture restored. No upstream assertion, workload or deadline changed.

The hash-verification panic was fixed with the actual legacy Wyhash11 implementation, preserving the assertion. Saved registry tokens now obey the pin's host/transport isolation rule. Angular's original five-minute timeout was caused by a no-op HTTP initializer in runtime auto-install; the real owned HTTP thread is now used and the unchanged Angular test passes.

Darwin verification only. Skips/TODOs, other platforms, branch integration, other installer features and full source ownership remain unverified. The complete port and 100% logical Bun-suite parity remain unfinished. Related: #66, #508, #518, #519; optional config scanning is #517.

Evidence and execution boundaries are recorded in docs/docs/NATIVE_RUNTIME_BINDINGS.md, zig-out/bunx-publication21.json, bunx-source-integrity21.json, bunx-regression21s.json, bunx-unit21.{log,json}, bunx-corpus-candidate21-native-hardlinks.json, and package-wide-bunx-candidate21.json. Binary SHA-256: b57fad4dfb9c8cf03a79da23f782e3bf18c3d1d7539df9036b8b1fd73b90b852. Earlier disk/build/hash/timeout failures remain recorded, not counted as passes.

Remaining scope

The unchanged 291-case bun-run corpus has no remaining failures in this Darwin checkpoint. #518 owns the native bunx/install implementation and remaining platform/integration boundary. #519 owns workspace execution verification; #517 tracks optional-config argument scanning outside this corpus. This issue stays open for other-platform verification and integration, not for the three rewrite failures now resolved.

Optional config follow-up

#517 is published in 828ecc7 with 21 matching boundary controls and the complete 291-case bun-run corpus retained. Platform/integration verification remains open. The separate pre-existing tsconfig-override auto-install diagnostic failure is tracked in #525. See #66 for the current checkpoint.

Published source checkpoint: 06a212514 on codex/runtime-port. This follow-up remains unresolved; the passing package-script checkpoint does not complete its acceptance criteria. Verification and related gaps are linked in #497 and #66.

bfdb5f3188e6a6b8f0bea7070131144f5813c046, published on codex/runtime-port, resolves the --ignore-dce-annotations case through real native CLI-context propagation (#506).

The complete unchanged 291-case cli/install/bun-run.test.ts now reports 259 pass / 32 fail / 381 assertions, compared with the published parent's 258 pass / 33 fail / 380 assertions. Exact failing-name comparison: one resolved, zero newly failing, 32 remaining. The file matches source pin 4982b91e3702094330f3be3883354c52b8c01323; no test/workload edits. Evidence: zig-out/package-wide-cli-context-build1.json and cli-context-wide-comparison.json.

The loader/diagnostic, workspace-filter and native bun x gaps remain open. #510 separately tracks remaining dotenv parser behavior; #66 remains the overall incomplete port.

Published 626346be5 on codex/runtime-port as Chris Breuer, without coauthors; not merged to main.

The unchanged Bun run suite improves from 259 pass / 32 fail to 287 pass / 4 fail / 411 assertions: 28 resolved failures, no new failing names. Native entrypoint diagnostics, loader rejection, readable-file/script precedence and nonfatal VM log flushing are implemented. The full native matrix is 55/55 commands, runtime units 1,819 pass / 19 skip / 0 fail, and the package regression also passes VM destruction/JSC checks. The failed disk-space unit attempt remains recorded; its successful rerun followed scoped cleanup.

The remaining execution work is split into #518 (native bunx) and #519 (workspace filtering), with additional optional-config target parsing in #517. #508 and #66 bodies are current. No upstream test/assertion/deadline changes, and no whole-suite or cross-platform completion claim.

Published 7286e0f29 on codex/runtime-port as Chris Breuer, without coauthors; not merged to main. #519 now passes the unchanged workspace suites 58/58, and the complete unchanged bun-run file improves 287/4 → 288/3 with no new failing names. 55/55 runtime regression commands, VM destruction/JSC checks, and 1,819 unit tests / 19 skips / 0 failures pass. All 31 exercised upstream source files match the pin; no upstream tests or deadlines were changed.

#518 retains the three bunx failures and its actual installer-chain work; #517 retains optional-config scanning. The issue bodies now reflect these results, earlier failed attempts, and the unverified platform/integration boundaries. The full port and 100% logical Bun-suite compatibility are still incomplete.