perf(ts): profile and improve null-safe access checking

Parent: #416; existing workload added under closed #451. Follow-up after landed Record/indexed-interface correctness work #863.

Fresh landed-source matrix 20261010T051920Z on b4985e4 (compiler implementation a6570c8), native SHA-256 d58ddc54a147b3ad8b177a98a6b5cda04fd4df77595c5ccf44da690de5d57b32: complete raw verification passes all 600 rotating rounds, 3000 samples and 145 existing five-compiler protocol-4 admissions. Canonical archive export/verification is still pending behind an unrelated shared-lock holder; do not call the publication complete yet.

Null-safe access is the largest current descriptive gap: Home median 34.066771 ms, native TS7 27.4424375 ms, fastest competitor 16.895500 ms (Home 2.016322x slower). This is not a causal comparison or statistical-significance claim. Checked JS and interface composition also remain near 2x gaps, and only startup leads (1/20; 12/20 versus native TS7).

Required workflow: preserve the existing matrix, every sample and all adverse controls; finish its publication first. Inspect the exact current native image with a byte/source-owned mapping before choosing an optimization. Add logical negative controls for actual optional-chain, optional-call and nullish results before any new null-safe timing so erased results cannot be admitted. Use identical strict no-emit source graphs/configurations and pinned canonical competitors; keep source bodies and diagnostics intact. No guessed hotspot from old addresses, library/filename/benchmark shortcuts, semantic depth or work caps, skipped checks, weaker diagnostics, alignment tuning, filtered timings or run-to-pass.

Acceptance: general semantic-preserving implementation justified by current profiling, positive/negative and full module gates, exact-parent interleaved performance qualification with complete raw retention and independent regression controls, documented full results plus brief README table/link, small Chris-authored conventional main commits linked here without coauthors. Universal leadership, Zod241TS+2HM admission, finite/symbolic Record domains, canonical C++ and other-platform coverage remain part of the parent goal, not excluded or called complete.

Published complete landed-source matrix 20261010T051920Z in Chris-authored conventional commit 1c0f38f on origin/main, no coauthors. Preserved the newer runtime commit by rebasing only the unpublished documentation chunk, no force push. README table and full report: https://github.com/home-lang/home/blob/main/docs/docs/TS_PERFORMANCE.md#landed-record-and-indexed-interface-matrix-2026-10-10-utc . All 600 rotating rounds / 3000 samples / 145 admissions retained and independently verified. Raw archive has 603 checksums, SHA-256 0f71bbe9dcc5a51089d993253c956e80ceb24e520c4de13d3eb9f4e02005255b; context archive has 31 checksums, SHA-256 8e6e787a1e917eea056c9debbb6c5fc358d8560b42a52cbd0ca7368ff4799ff9. No timing repeats, filtering, guard changes or benchmark-policy changes. Changed documents pass Pickier; existing full-repository 11460 errors/10614 warnings retained outside changed files.

Home still leads 1/20 and beats native TS7 on 12/20. Largest fastest-competitor gaps: null-safe access 2.02x, checked JS 2.00x, interfaces 1.98x; descriptive, not causal/significance claims. Zod241TS+2HM, finite/symbolic Record domains, canonical C++ and other-platform coverage remain incomplete. Next #864 step: execute untimed first/middle/last inferred-local and optional-call negative controls on copies of the actual existing null-safe workload before any new profiling/timing/optimization; original timed corpus stays unchanged.

The proposed inferred-local null-safe controls pass across all five unchanged pinned compilers on exact native d58ddc5: positives clean, negatives exactly 18 TS2322 + three each TS2339/TS2345/TS2493 at families 0/128/255. Original timed corpus hashes are unchanged and no new timings were taken.

Implemented protocol 5 in the benchmark harness: mandatory null-safe negatives run before timing; reporters require the full 27-code contract and retained records, keep the complete JSDoc contract, reject legacy schedules/missing admission, and read historical protocol-4 data without relabeling it protocol 5. Null-safe comparisons without the new gate are labeled provisional by the updated reporter. Added regressions for immutable timed sources, internal inferred locals, optional-call/undefined results, partial/silent/abnormal failures, missing source anchors, weakened error multisets and legacy compatibility. All 147 harness tests pass. Full untimed five-compiler admission passes 150/150 with unchanged before/after corpus/compiler provenance. One initial old unit expectation treated future schema 5 as unsupported; repaired with explicit 4/5 compatibility and retained the failure record, not a timing rerun. Small source and evidence/documentation chunks follow; profiling/general optimization remains open.

Protocol-5 null-safe admission is landed in Chris-authored source commit 5a5db50 and documentation/evidence commit 666a8ad, pushed to origin/main without coauthors. Newer runtime work preserved. All 147 harness tests and 150/150 actual five-compiler admissions pass. Null-safe negative projects reject exactly 27 errors (18 TS2322; three each TS2339/TS2345/TS2493) at first/middle/last inferred locals, optional calls and tuple paths. Compiler and timed corpus unchanged; no new timings or optimization claim.

README has a brief outcome row and links to https://github.com/home-lang/home/blob/main/docs/docs/TS_PERFORMANCE.md#null-safe-inferred-result-admission-2026-10-10-utc . Raw evidence: 20261010-nullsafe-inferred-admission-864.tar.gz, SHA-256 6084fa605da7cdc3b7dd8858934b635ff57d799e65329281d82f3b0b02958ca2, all 24 payload checksums verified. Publication context SHA-256 fa1789b570931e9c81b695d8e94568166a732ae085db482bb3e565d51fec1de4, all 10 checksums verified. Changed documents pass Pickier; unchanged full-repository baseline 11460 errors/10614 warnings retained outside changed files. Historical matrix 20261010T051920Z remains protocol 4 and is not relabeled as having these stronger controls before timing.

Read-only mapping for actual native d58ddc5 is queued behind another live shared-lock holder. No diagnostic relink/image or sampling has started. Next step is exact-original-object layout proof outside declared relocation-sized words and current-native null-safe profiling, then a general optimization with complete gates/A-B/regression evidence. Zod241TS+2HM, finite/symbolic Record, C++ and other platforms remain incomplete; goal active.

Preparing a deterministic 32768-family diagnostic scale (128x the existing 256-family null-safe workload), without changing its type structure, source bodies, strict configuration or compiler mode. Fixed first/middle/last inferred-local negatives preserve the new 27-error contract. This is an untimed profiling fixture, not a new ranked benchmark row. All required reference/native scale admissions must pass before one actual-native sampling process; no repeated process until a desired sample, old-address reuse, relinking, diagnostic image, semantic cap or skipped body. Exact d58ddc5 original cached-object/native mapping and fixture preparation are queued under the unchanged shared-lock/3840MB/600s guards. No sampling has started yet.

Exact-current-native mapping and deterministic scale preparation completed, both exit 0. Native d58ddc5 matches the original cached link image; object SHA-256 266add3b449c17bb470dc801a52ed15d50f5df2671e37085e6a052ab2c08b0b0. Object text 9675952 bytes maps into native text 9677200 bytes with zero changed bytes outside whole declared relocation-sized words; 159379 relocation entries cover 633792 bytes. Those masked words are not claimed opcode/bit-equivalent; the extra 1248 native-tail bytes remain unmapped. 5890 original symbol ranges are mapped. No relink, diagnostic image or sampling occurred.

Prepared the frozen 32768-family null-safe diagnostic project from the unchanged workload generator, plus fixed negatives at0/16384/32767. Input inventory hashes are 8a5189f35dce03eb36a01c1dfd110b2fb57d87176b9a719f4d51719582464d01 positive and 620343e19b0569c66c220a9a3c49c18c48e6b1191eea8f3c83342f2f78bc8cd7 negative. Full TS6/nativeTS7/Home positive and 27-error negative admission is now running under the unchanged600s/3840MB guard. Sampling will not start unless all six admissions pass. This is untimed diagnostic scaling, not a new ranking row or gain claim.

Scaled admission progress: TS6/nativeTS7/Home all accept the positive32768-family graph; TS6/nativeTS7 also reject the fixed27-error negative graph. Home negative is still running; no sampling has started. The Home positive admission was directly observed live for119 seconds before later successful completion, so the initial2-second middle-window estimate is not representative of this scale. Before any sampling, revised the fixed windows to0.1 and60 seconds, one second each. The original plan/reason are retained in profile-procedure-revision.json. This is not selecting a favorable measured sample: there are zero sampling runs or new timing samples, unchanged compiler/input, and exactly one sampling process remains planned. Early completion, skipped windows and failures will be retained without repeat-to-sample. Full scale admission still gates sampling.

All six complete32768-family scale admissions pass: TS6/nativeTS7/Home positives silent and negatives exact27 errors, original positive/negative input inventories unchanged. Guard exits0, peak tree footprint2377MB under unchanged3840MB/600s ceiling. No semantic or workload caps, source/body changes, image changes or timings.

Starting exactly one unmodified actual-native d58ddc5 profiling process after complete protocol-5 native preflight. Fixed windows0.1 and60 seconds, one second each; revision rationale was recorded before sampling. Original cached-object/non-relocation layout proof is independently verified. Missing windows, early completion and failures retained; no repeat-to-sample. Only displayed PCs will be resolved, with original ellipses/group counts kept unassigned. No whole-run CPU percentage or gain inferred from these exploratory samples.

Actual-native profile completed once, exit0 and silent, under unchanged guard (peak tree footprint687MB). Both one-second windows succeeded at actual offsets0.105 and60.004 seconds; native process was not repeated. Independent verification passes original-object/non-relocation map, all30 protocol-5 native preflight checks plus six complete scale reference/native checks, raw input/native/source identity and lossless displayed-PC mapping. Early/middle samples have817/830 main-thread observations;181 symbols have explicit displayed PCs. These are exploratory windows, not whole-run CPU percentages; collapsed group counts and ellipses stay unassigned.

Current-native displayed PCs resolve to moduleNamespaceTypeForLocalImport at0x1002eda08 offsets188/200, checkFnSignatureOnly at0x10051ab44 offsets19852/20788/32528, and aliasedGuardReferencesAreStable at0x1003320c0 offsets152/180/456/488. Original actual-native disassembly places the namespace helper offsets in its root-statement import-kind scan, and the32768-family project contains no imports. This identifies unnecessary namespace-resolution scanning to investigate, not a measured optimization gain. No old68c6 addresses or diagnostic image used. Preserve #857 ordered namespace-index rejection; do not revive/tune that cached design. Next work is publish complete scoped profile evidence, then evaluate a materially different general absence/binding proof without changing resolution order, source ownership, body checks or diagnostics, with full correctness/performance/regression gates before landing.

Published verified exact-native profile in Chris-authored conventional main commit cb6b427, no coauthors. README link and report: https://github.com/home-lang/home/blob/main/docs/docs/TS_PERFORMANCE.md#exact-native-null-safe-profile-2026-10-10-utc . Raw archive SHA-2569dcf699825b34f6f7b5a69d0d20030326566ced5e017f2b3cdf133f0afee7bdb, all46 checksums; publication context SHA-2560ef684693f67545c34f139ab8cdf73d2fdae80089b095c01ff02221fb448b46c, all10 checksums. One actual native process, two fixed windows,36 admissions; no CPUshare/gain or masked-word opcode equivalence claimed. Changed docs pass Pickier; unrelated11460errors/10614warnings retained.

Next candidate is materially different from rejected #857: a stateless live-HIR import-payload emptiness proof at moduleNamespaceTypeForLocalImport. Every normal HIR import node is allocated through Builder.addImport, which appends its payload before constructing the node. Empty live pool therefore proves the original root-statement scan cannot find any import; later HIR imports automatically make the pool nonempty. No source-word/filename/library shortcut, cache, snapshot, name index, cap, allocation, changed lookup order or cached resolved type. For any nonempty pool, the complete original resolver is unchanged. Test empty/comment/sourceless contexts, real namespace/import-equals paths, virtual sections, unrelated containers, later HIR growth and dynamic behavior; full semantic/admission/performance/regression qualification before adoption. No candidate code or gain has been published yet.

Implemented an uncommitted stateless candidate: moduleNamespaceTypeForLocalImport checks only the current HIR import-payload pool length. Empty means no valid import node exists anywhere; nonempty delegates to the byte-identical original resolver body. Independent source audit confirms no cache/state, source marker, filename/library predicate, reordered search, stored namespace type or changed lowering. Existing #857 ordered import index is not reused. Added four full-checker tests covering empty/comment/string and sourceless contexts, virtual namespace/require-equals resolution, nonempty pools with another root, and actual later Builder.addImport/root growth while the raw source marker still says no imports. The live pool observes that growth immediately. Full checker gate is running under unchanged guards; no candidate benchmark/adoption/gain claim yet.

Source audit confirms the guarded fallback body is byte-identical to the parent; no source-marker/name/cache/state shortcut. Frozen exact-parent protocol before any timing: parent cb6b427/native d58ddc5, candidate live-HIR emptiness guard; all20 official rows with10 alternating pairs each, independent30-pair null-safe target, independent30-pair confirmations for ten named risks (destructuring/interfaces/classes/imports/reexports/CommonJS/checkedJS/tuples/recursive-generics/large-predicates). Every other wholly-negative screen interval triggers exactly one predefined30-pair independent confirmation. Fixed20000-resample seed864 paired mean-saving95% bootstrap; positive target interval required and any independent wholly-negative saving interval rejects adoption. All raw samples/warnings retained, no repeats-to-pass, alignment tuning or guard changes. Full semantic/admission and unchanged Zod diagnostic delta required before timing. Subsequent full competitor matrix remains separate, never inferred from Home A/B. Protocol saved before measurement; checker build still running, no candidate timing started.

Live-HIR absence candidate full checker gate now passes4557/4557. The first run passed4555 and failed two new tests that incorrectly compared fresh namespace TypeIds after successive dynamic lowering. Preserved that full failure log. Tests now compare complete structural identity plus the concrete exported answer member/number type instead of demanding a resolved-TypeId cache; all four new empty/sourceless/virtual/import-equals/unrelated-root/later-HIR checks pass. Production fallback body remains byte-identical; independent source audit passes. Native build and full Program/driver/CLI/entrypoint gates are running under unchanged guards. Parent d58ddc5 image retained unchanged. No timing or candidate adoption yet; frozen pre-measurement530-pair base protocol and deterministic adverse-screen confirmations remain unchanged.

Candidate native build succeeded under unchanged guard, image SHA-256e3e0be622f647eed2453500eb6d9216516021f796966a6f9ece5d93af8508040. Parent image remains d58ddc5. Full protocol-5 actual image audit passes180/180 checks (five pinned compilers including candidate plus retained parent), independently validated raw exits/error multisets/commands and unchanged artifact provenance. Pinned unchanged Zod graph matches parent exactly at241TS errors +2HM9002; still unadmitted and untimed. Checker4557 and Program255 pass; harness147 passes. Driver/CLI/entrypoint suites remain live. No candidate timing or adoption yet; source/body audit and frozen paired protocol remain unchanged.

All candidate semantic gates qualify before timing: checker4557, Program255, driver200, CLI76, entrypoint38, harness147, actual image admission180 with unchanged corpus/payload/source provenance, exact parent-matching Zod241TS+2HM. Independent final gate/source audit passes parentd58ddc54/candidatee3e0be62 and exacta5ce10d1 patch. Starting frozen screen: all20 official workloads,10 alternating exact-parent pairs each after3warmups, fresh per-phase positive/negative controls, every sample retained, same600s/3840MB guard. Original source/helper body and images held fixed. No candidate commit or gain claim; screen cannot replace required independent30-pair target and fixed/adverse-risk confirmations.

Frozen screen completes once: all200 pairs /60 fresh Home-image admissions retained, exit0, unchanged source/input/image provenance. Independent paired verifier passes orders/exits/error contracts/raw arrays and fixed20000-resample seed864 statistics. Official null-safe screen is INCONCLUSIVE: parent32.4637915ms, candidate32.5441040ms,6/10 faster pairs, mean-saving95% interval -0.062092 to+0.399496ms. Reexports have an adverse screen: -0.972819 to-0.057670ms,2/10 faster pairs. Reexports are already a fixed independent risk, so no additional screen-triggered phases are needed. Most rows spanzero; tuple screen saving retained, not treated as adoption proof. Starting the prescribed separate30-pair null-safe target then all fixed risk confirmations exactly once. No repeating screen, dismissing adverse results, filtering, alignment tuning, source/corpus changes or gain/adoption claim.

Independent official null-safe target completes once:30 raw pairs /4fresh admissions, exit0, raw order/exits/provenance/stats verification pass. Parent median34.037958ms, candidate33.840708ms,17/30 candidate-faster; paired mean-saving95% interval -0.106168 to+2.981053ms spanszero. Parent maximum60.264167ms is retained, not filtered or called a reason to rerun. This does NOT satisfy frozen positive-target-interval acceptance, regardless of the descriptive median or exploratory scale profile. Starting all ten prescribed independent30-pair risk confirmations exactly once to complete the frozen evidence. No source change/alignment tuning/retiming, no gain/adoption claim; candidate remains uncommitted. After complete disposition, restore if unqualified and document all530base pairs plus any deterministic adverse additions.

Frozen complete decision is REJECT: all530 original paired rounds and100 per-phase Home admissions retained across12 completed phases, plus180 initial image admissions. Official target CI spanszero and fails the required positive independent interval. No independent risk interval is whollynegative; interface composition has a saving interval, but it does not replace primary acceptance or establish equivalence elsewhere. Adverse reexport screen and its inconclusive independent confirmation retained; no extra screen-triggered phases. All ten risk confirmations ran exactly once, no filtering/retiming/alignment tuning.

Candidate guard and four new tests were removed with a scoped recoverable patch reversal; worktree is clean at parent cb6b427, candidate was never committed/pushed. Fresh bounded parent-native restoration is running and must match d58ddc5 byte-for-byte. Complete raw/statistical/rejection/restoration docs and brief README table will follow in a small Chris-only issue-linked main commit. This exact candidate is not adopted or tuned until a different hypothesis; universal goal remains active.

Final independent completed-data/restoration verifier passes. Disposition REJECT,530 paired rounds across12 phases,100 fresh per-phase admissions plus180 initial image admissions, all arrays/orders/exits/fingerprints and frozen bootstrap statistics rechecked. Null-safe independent target remains inconclusive (-0.106168 to+2.981053ms) and fails required positive interval; no independent risk interval is whollynegative. Parent60.264167ms observation and adverse reexport screen retained, never filtered or used to rerun. No causal gain, equivalence or new competitor rank claimed.

All candidate code and four tests removed through scoped recoverable patch reversal; candidate never committed/pushed. Fresh clean-parent build exits0 and restored native matches d58ddc54a147b3ad8b177a98a6b5cda04fd4df77595c5ccf44da690de5d57b32 byte-for-byte; source clean. One supplemental verifier attempt reached restoration check while actual restoration build was still live and metadata unavailable; retained that orchestration failure and reran only the same verifier after build completed, not any compiler measurements. Complete rejection evidence/report/README table publication is next. This exact candidate is not adopted/tuned; pursue a materially different measured hypothesis afterward. Goal remains active.

Published complete live-HIR import-absence rejection in Chris-authored conventional origin/main commit35e3326510572dfc93d06293cad217ca167859ce, no coauthors. README table/link and full31-row report: https://github.com/home-lang/home/blob/main/docs/docs/TS_PERFORMANCE.md#live-hir-import-absence-rejected-2026-10-10-utc . All530 original pairs and280 admissions retained; no timing repeats/filtering/alignment tuning. Raw archive SHA-25666e1e2d44ee47056cdee463d6b5eb900dadbf10aa1dfa4464c7d081a1b27bda9, all1269 checksums; publication context SHA-2564d4880ea1624db0bb3d0b8eba17fc61520b37894a03ec3490a9bc2f777eee922, all13 checksums. Changed docs pass Pickier; unrelated11460errors/10614warnings retained outside changes.

Candidate never pushed; exact source/test patch removed, fresh parent native restored byte-for-byte to d58ddc5, sourceclean. Target17/30 faster but saving95% CI -0.106..+2.981ms; parent60.264167ms retained. No independent risk CI whollynegative, but no equivalence/gain inferred. Reexport adverse screen and zero-spanning independent check both retained. This exact candidate is rejected, not tuned for a favorable rerun. Next different profile-supported path: guardReferencesAssignedIdentifier inlines into aliasedGuardReferencesAreStable and scans every HIR node for identifiers contained in each guard span. The current actual-image PCs152/180/456/488 are retained; any faster range lookup must preserve whole-HIR span semantics including unrelated/recovery/zero/reversed/overlap spans, dynamic assignments, HIR growth/in-place mutation and OOM behavior. Source inspection is not itself a CPUshare/gain. Full universalgoal remains active and incomplete.

Starting a materially different profile-supported hypothesis after published rejection35e332651: guardReferencesAssignedIdentifier scans every HIR identifier for each guard span, then calls nodeAssignsIdentifier on the enclosing function body. Proposed exact name-independent proof: if the live body contains no assignment supported by that existing predicate, its answer is false for every possible identifier name, so the global span scan cannot succeed. Traverse exactly the same supported assignment/block/if/switch/switch-case paths; bodies containing any supported assignment retain the byte-identical original full-HIR span scan and live name-specific query. No cached assignment answers, source/filename/library shortcuts, AST-child-only replacement of span semantics, allocation, work/depth cap or changed write recognition. Later HIR/body changes are read on each query. Test equivalence against the old scan across assignment forms, ignored legacy paths, arbitrary overlapping/reversed/zero spans, sourceless/virtual inputs and actual body growth. Full gates and frozen fair exact-parent target/regression qualification before adoption. No implementation/gain has been published yet.

Implemented an uncommitted live-body supported-write absence proof for aliased-guard checking, unrelated to rejected import-absence guard. Original full-HIR span scan and name-specific nodeAssignsIdentifier bodies are independently byte-identical. New name-independent helper traverses exactly the original supported assignment/block/if/switch/switch-case structure. No supported write means no possible name-specific query can succeed; any supported write delegates to the unchanged global scan. No persistent state, allocation, cached mutable answer, AST-descendant-only narrowing, source marker/name/filename shortcut, new write recognition or semantic/work cap.

Four new checker tests compare existential recognized writes and old/new answers across15 body shapes (including legacy-ignored contexts), zero/reversed/overlap spans, sourceless/virtual sources, later body growth, in-place assignment operator changes, and unrelated orphan identifiers whose spans lie inside the guard (retaining original whole-HIR behavior). Full checker gate is queued under unchanged600s/3840MB guard. Static audit first matched the word cache in a comment saying do not cache; retained that orchestration failure and corrected the comment filtering, not semantics or timing. No candidate gain/adoption/source push yet.

Independent source audit passes new live-body write-absence candidate: original global guard-span identifier scan and name-specific assignment query are byte-identical. New proof is live/name-independent/stateless and allocates/caches nothing. Patch SHA-256057a45f84944099d15be507e8ad698b3f8571a752437e9950eb6beb417e05c14 on parent35e332651/native d58ddc5. Full checker gate remains queued behind an unrelated live guard owner, not duplicated.

Frozen pre-timing protocol saved: official256-family null-safe primary (not selecting a larger favorable row),3warmups, all20rows10alternatingpairs, separate30-pair primary, ten fixed30-pair risk confirmations, exactly one30-pair followup for any other wholly-negative screen; fixedseed864/20000 paired mean-saving bootstrap. Positive independent primary required; any independent wholly-negative saving interval rejects. All samples/adverse values retained, no alignment/workcaps/skipchecks/timing repeats. Full semantics147harness/180imageadmissions and unchangedZod241+2 required before timing; complete five-compiler matrix separate afteradoption. No gain/source adoption claim.

Live-body supported-write absence candidate full checker passes4557/4557 on the first actual compiler run, including four new exact-reference tests across15bodyshapes, arbitraryzero/reversed/overlapspans, sourceless/virtualinputs, laterbodygrowth/inplaceoperatorchanges and unrelatedorphanidentifier spansemantics. Source audit proves original full-HIRspan/name-specific query bodies byte-identical; no cache/state/allocation/name/filename shortcut/cap. Harness147passes. Retained unchanged parentnative d58ddc5; candidate nativebuild and fullProgram/driver/CLI/entrypoint gates nowrunning under unchanged3840MB/600s guards. Frozen official-target530pair base protocol ready, no timing/adoption/gain/sourcepush yet.

New live-body supported-write proof candidate ReleaseFast native build succeeds under unchanged3840MB/600s guard (peak2940MB). Checker4557 and harness147 qualified, parentd58 retained, originalglobal-span/name-specific query byteidentity sourceaudit stillpasses. Full Program/driver/CLI/entrypoint suites remainlive. Starting exactcandidate/parent and pinnedcompetitor protocol5 imageadmission180 plus unchanged pinnedZod diagnostic comparison beforeany timing. Frozen official-target/all20row/independentrisk protocol unchanged. No candidate sourcepush/adoption/gain claim.

Checkpoint for the live supported-write proof: first full checker run passes 4,557 tests, Program passes 255, harness passes 147, and ReleaseFast native build exits 0. Candidate SHA-256 ff78eeff3f36f622db610d23881be7165dce31b424481318e82360f1da5935f8; retained parent d58ddc54a147b3ad8b177a98a6b5cda04fd4df77595c5ccf44da690de5d57b32. Source audit still confirms the original global guard-span and name-specific query bodies are unchanged. Driver and six-image protocol-5 admission are the original queued jobs waiting behind an unrelated shared-lock owner; they have not been duplicated. CLI and entrypoint follow driver. No timing started, candidate source remains uncommitted, and no gain or ranking change is claimed. Frozen all-20 screen / independent official target / independent risks protocol remains unchanged.

All pre-timing semantic gates pass for live supported-write candidate ff78eef: checker 4,557, Program 255, driver 200, CLI 76, entrypoint 38, harness 147 and complete protocol-5 image admission 180. Independent retained-admission verification passes without rerunning compilers; parent/candidate pinned Zod diagnostics remain identical at 241 TS errors plus two HM9002 warnings, unadmitted and untimed. Entrypoint guard peak 2,954 MB; all existing limits unchanged. Starting the frozen single-execution comparison: all 20 official rows (10 pairs each), separate official null-safe target (30 pairs), ten fixed independent risk rows (30 each), plus deterministic one-time confirmation of any other adverse screen. No timing repeats, filtering or alignment tuning. Missing original admission-wrapper terminal accounting is explicitly retained as unknown, not inferred. No source adoption or speedup claim yet.

Accepted and pushed in two Chris-authored conventional commits, no coauthors: 0b8d1f0 perf(ts): avoid impossible assigned-guard scans; 274175d docs(ts): publish accepted null-safe checking evidence. Independent official null-safe median 33.131 → 21.737 ms (34.4% lower), 30/30 faster pairs, paired mean-saving 95% interval +11.347 to +11.772 ms. All 530 original pairs and 280 admissions retained; no independent risk interval wholly negative, while zero-spanning intervals do not imply equivalence. Rebased source patch and rebuilt native byte-identical to measured candidate, unrelated runtime work preserved. Full semantics 4557/255/200/76/38/147 pass. README brief table and full 31-row report published: https://github.com/home-lang/home/blob/main/docs/docs/TS_PERFORMANCE.md#live-body-write-proof-accepted-2026-10-10-utc . Raw accepted archive SHA-256 13964bd69b5f5e437938b9aeeccbf157b642019205faa5af95792656d31abe91; all 1,269 checksums verify. No repeats/filtering/realignment. This Home-only A/B does not update competitor rankings; next is the separate complete five-compiler protocol-5 matrix. Zod remains 241 TS + 2 HM9002, unadmitted and untimed.

Separate complete five-compiler protocol-5 matrix 20261010T081352Z now verified and published in d3cfdac (Chris author/committer, no coauthors). All20 workloads,150 pre-timing admissions,600 rotating rounds,3000 original samples; execution once, no filtering/repeats, guard exit0 peak398MB. Home leads1/20 and beats nativeTS7 on13/20. Null-safe Home22.219ms vs TS7 27.316ms / Rust23.648ms / Bun17.242ms, still1.29x slower than fastest. Largest remaining fastest gaps: checked JS1.94x, interfaces1.88x, TSX1.77x; class1.67x. Full table and refreshed README: https://github.com/home-lang/home/blob/main/docs/docs/TS_PERFORMANCE.md#adopted-write-proof-benchmark-matrix-2026-10-10-utc . Raw archive SHA256 cd1453ab18b37f56c00ef0e7567c314d86e12b879af2423ff247291a45c7f799, all603 payload checksums verify. These descriptive medians are separate from the accepted causal A/B; universal leadership not proven. Continue issue864 investigation of remaining measured gaps; Zod/finiteRecord/C++/otherplatform gaps remain open.