Published completion
04569d8f9 is pushed on codex/runtime-port as Chris Breuer without coauthors; not merged to main. Parent: #66. Follow-up to #532. Related remaining SNI/ALPN work: #542. Pin: Bun 4982b91e3702094330f3be3883354c52b8c01323.
Result
Native TLS now retains serialized session and NSS keylog payloads on the SSL object, flushes session before keylog and application data, and rechecks socket/wrapper lifetime after every callback. The actual Zig dispatch replaces the former no-op exports for direct TCP TLS, upgraded Duplex TLS and named-pipe wrappers. net.ts forwards client and server keylog/session handlers and preserves TLS 1.2 sessions until secureConnect.
The complete unchanged test/js/node/tls/node-tls-connect.test.ts advances from 26 pass / 4 fail / 1 skip / 102 assertions at the published parent to 28 pass / 2 fail / 1 skip / 106 assertions, exactly matching pinned Bun. The two remaining failures inspect live bun.sh OCSP metadata and reproduce in pinned Bun; they are preserved as failures. The original Duplex event case and session-before-destructive-data-callback case pass with unchanged deadlines.
The new native lifetime regression verifies Buffer shape, NSS newline format, server TLSSocket propagation, session-before-data ordering, destruction inside a session callback, Duplex wrapper teardown and forced GC. It passes 20/20 independent process repetitions. Adjacent unchanged TLS files are 47 pass / 2 skip / 7 fail / 424 assertions; all seven failures are #542.
Final verification: native build 17/17, runtime units 1,828 pass / 19 skip / 0 fail with 19/19 build steps, and sequential runtime regressions 62/62. Candidate SHA-256: ad1800ecef37c99a21f912ed45e56653f994cfaddc340f2435f6b90b9451b757. No upstream test, assertion or deadline changed.
Ownership boundary
The debug build currently links Bun's pinned release openssl.c.o, which already contains the pending-event ABI. Home's checked-in openssl.c now has the corresponding logical source implementation and compiles cleanly with the release object's exact compile flags and Home headers. This closes the event behavior accepted here, but does not claim rebuilt/owned native dependencies, Linux/Windows verification, branch integration, skipped/TODO completion or whole-suite parity.
Evidence: zig-out/tls543-unit-final.log, tls543-regressions.json, tls543-repeat.json, focused complete-file and adjacent TLS records, and docs/docs/NATIVE_RUNTIME_BINDINGS.md.