ALPN wire/corpus-filter checkpoint (2026-10-10): ALPN 9ec6ebcd6, filters efde19005, and verified evidence. HTTPS and tls.Server callback names decode as ASCII; native selection preserves the first matching offered wire bytes by offset, including valid byte aliases. Negotiated protocol getters use Latin-1. HTTPS constructor acceptance matches Node's deferred type-validation phase; later accepted-socket validation remains open. The complete ordinary trusted ALPN control passes on Node and Home. Corpus dispatch now forwards every supported name-filter alias across file/multiple-file/directory/subset routes; ordinary execution controls verify excluded bodies do not run.
22 native groups; ten ABI tests/684 assertions; five Zig tests; 54/54 Debug steps. Seven unchanged files retain 60 passes plus three process checks and one registered failure/failed file (#874), no skips/TODOs. All 176 committed archives and 16 restored reports validate against retained outcomes, including the existing failure and filtered-report rejection; final source hashes match committed bytes.
The additional original TLS selection receives no validated coverage credit. Initially the lost filter ran all 38 cases. After forwarding, one case passes and 37 are filtered, but JUnit represents them as skips while process counters report zero intentional skips. The strict validator still rejects that discrepancy. #876 tracks filtered-case accounting and remaining corpus CLI options; #481 documents direct native CLI work. #875/#532 remain open for HTTPS accepted-TLSSocket receiver, callback error/lifecycle and reload compatibility. Initial failures, disk refusal, cleanup and existing style/format findings are retained. Excluded regressions remain unverified; full Bun suite, #872 and Release/ASAN/all-platform coverage remain open under #66.
ALPN callback argument/selection checkpoint (2026-10-10, partial compatibility): source 1f8514300 and verified evidence. Protected HTTPS callbacks now receive SNI and offered protocols and select an actually offered protocol through default/registered SNI contexts. Trusted repeated handshakes and HTTP requests pass, along with the valid argument/selection Node reference control. 22 native groups; ten ABI tests/684 assertions; five Zig tests; 54/54 Debug steps. Seven unchanged files retain 60 passes plus three process checks and one registered failure/failed file (#874), no skips/TODOs. All 84 committed archives and seven restored reports validate, including the failure.
Accepted-TLSSocket receiver compatibility remains incomplete: the user callback currently receives undefined as its receiver. The earlier server-receiver expectation was incorrect and was removed after checking Node; receiver parity is not claimed. #875/#532 stay open for this bridge, exact constructor validation timing, error/shutdown/reentrancy behavior, reload/reconfiguration, encoding and platform coverage. Initial host-memory stop, disk refusal, terminal cleanup and failed portability/validation/receiver controls are retained. Excluded regression files remain unverified; full Bun suite, #872 and Release/ASAN/all-platform coverage remain open under #66.
Binary ALPN/static SNI checkpoint (2026-10-10, corpus retains failure): source c3dd1b308 and verified evidence. TLS config owns explicit-length ALPN bytes through clone/free/transfer/equality/hash and socket consumers. HTTP selectors reference each retained context's config, including registered SNI contexts. Valid binary IDs, caller-buffer mutation, preference/context-content discrimination and trusted SNI controls pass. 21 native groups; ten ABI tests/684 assertions; five Zig tests; 54/54 Debug steps. Seven unchanged files retain 60 passes plus three process checks and one registered failure/failed file (#874), no skips/TODOs. All 76 committed archives and seven restored reports validate, including the failure. Initial string-conversion compile failure remains. #875/#532 remain open for dynamic callbacks/SNI handoff, reload, malformed-list validation and wider lifetime/platform coverage. Excluded regression files remain unverified; full Bun suite, #872 and Release/ASAN/all-platform coverage remain open.
HTTPS static ALPN checkpoint (2026-10-10, corpus retains failure): selector 264bf4d93, forwarding d21ce2d58 and verified evidence. HTTPS options now preserve ALPNProtocols and normalize array/buffer forms; the HTTP SSL_CTX selector reads server-owned config. Valid list preference, encoded buffer and reused-connection controls negotiate real HTTP/1.1 with certificate verification enabled. 20 native groups; ten ABI tests/684 assertions; five Zig tests; 54/54 Debug steps. Seven unchanged files retain 60 passes plus three process checks and one registered failure/failed file (#874), no skips/TODOs. All 75 committed archives and seven restored reports validate, including the failure. The initial namespace compile error remains. #875/#532 remain open for dynamic callbacks, SNI handoff, reload, encoding/length edges and wider lifetime/platform coverage. Excluded regression files remain unverified; full Bun suite, #872 and Release/ASAN/all-platform coverage remain open.
A valid local control passes ALPNProtocols: ['http/1.1'] to node:https.createServer, but the server constructor in _http_server.ts drops that option before the Bun server TLS config receives it. A trusted TLS fetch succeeds with no negotiated ALPN. The generic node:tls listener negotiates the same protocol, and Home now records the actual negotiated bytes in resource timing. Source checkpoint: https://github.com/home-lang/home/commit/2dd946c6a87b00d7b8dc45e5aa259b1277c1b3d9.
Complete HTTPS option normalization/forwarding and its native server ALPN selection path. Verify valid protocol lists, callback/selection behavior, reconfiguration and connection reuse with ordinary local TLS conformance. Do not fabricate an ALPN result or disable certificate verification to make the control pass.
Parents: #873, #869, #532 and #66. Current resource timing correctly leaves nextHopProtocol unset when no protocol is negotiated.