Optimizer: execute for-in enumeration with exact multi-result recovery

Parent: #467.

At 969c0f5, an executed ReleaseSafe/Darwin admission probe warms three required-bytecode functions 64 times. Node and zig-js both return [3,"a","a"] for sum, early-return and break variants over {a:1,b:2}. The sum and early-return functions publish optimizer artifacts with non-continuation side exits; the break function publishes no optimizer artifact. Merely finding an enum_keys operation descriptor is not proof that it executes natively: a direct plan/lowering probe exits at bytecode origin 1, before enum_keys, with its one input still on the recovered operand stack.

Implement owned for-in effects through the optimizer, including enum_keys, one-candidate enum_next, and enum_end_completion. Enumeration returns multiple values: target/key snapshot/index for preparation, and an updated index plus key/presence/candidate flags for each candidate. SSA, native result transport, exact continuations and moving-GC maps must describe all of them. Do not invoke a user-visible effect twice to recover another result or replace it with an unrooted private tuple.

Acceptance:

• Native artifact/admission witnesses prove enumeration effects execute, including exhaustion, break, early return, throw and finally completion.
• Forced optimizer-off/on exact differentials cover primitive/null inputs, prototype shadowing, deleted candidates, proxy callback ordering and exceptions, changing loop targets, captured lexical iteration bindings and nested enumeration.
• Each candidate preserves the existing dispatch/watchdog/termination/GC polling obligations; callback completion resumes after the completed effect without replay.
• Moving GC traces every target/snapshot/key/result across proxy reentry and suspension of a native caller.
• Serialized/no-GIL Debug, ReleaseSafe and unsuppressed TSan controls pass, with OOM/fault recovery and exact-parent test262 for-in/proxy/control subtrees.
• Existing full corpus and seeded fuzz gates pass without exclusions or relaxed budgets.

No source edits have been made for this boundary yet; the reproduced limitation is optimizer admission, not a JavaScript result mismatch.

Landed in 668590a on main: added exact fixed-width NativeFrame transport for enum_keys/enum_next, preserved enum_end_completion continuation state, verified optimizer lowering descriptors, and wired VM native dispatch with GC-rooted enumeration callbacks.

Evidence: the focused optimizer lowering witness and focused VM dispatcher witness both pass. The combined root was intentionally stopped after the repository SafeAllocator emitted an unbounded leak dump; no source failure was inferred from that run.

This is the transport/runtime slice only. The next slice will prove real optimizer artifact admission/execution with forced optimizer-off/on differentials before changing the for-in status or claiming issue completion.

Landed and pushed directly to main as bdf14d6 (fix(jit): admit for-in stack-state loops).

This slice enables loop OSR imports with non-empty operand stacks, preserves exact boolean/number types across loop block arguments, and adds a deterministic resumable for-in optimizer artifact witness. The witness confirms OSR + side exits and a native enum_next descriptor; enum_keys/enum_next/enum_end_completion exact result transport remains covered by the existing transport test.

Bounded evidence (serialized, focused optimizer root):

• optimizer lowering admits a resumable for-in loop: PASS
• optimizer lowering publishes exact for-in result transport: PASS
• optimizer lowering publishes rooted interpreter-owned side exits: PASS

The full context-linked unit gate remains blocked before test execution by the local ../zig-gc shim missing Accounting.promoted_cells; no workaround or dependency edit was made.

Follow-up verification on committed main bdf14d6: the isolated VM root ran vm: native operation dispatcher transports for-in results exactly successfully (3/3 linked tests, 0 failures). The compiler-shaped OSR witness confirms enum_next is the native loop-region operation; enum_end_completion remains an interpreter-owned abrupt-completion continuation and is covered by the exact transport lowering/dispatcher tests. No context-linked differential was claimed because the local ../zig-gc shim still fails compilation on the missing Accounting.promoted_cells field.

Landed and pushed directly to main as 22c07c6 (test(jit): cover native for-in deletion exhaustion). The focused VM dispatcher witness now verifies: (1) a snapshotted key deleted after enum_keys yields candidate=true/present=false; (2) the next live key is returned with cursor advancement; (3) exhaustion keeps the cursor stable and returns key=undefined/present=false/candidate=false; and (4) enum_next is dispatched exactly three one-candidate times while enum_end_completion remains accounted once. The isolated VM root passes 3/3 linked tests. Full context differential remains pending the local ../zig-gc Accounting.promoted_cells mismatch.

Landed and pushed directly to main as a178170 (test(jit): cover native for-in input shapes). The same isolated VM dispatcher witness now also covers nullish inputs (empty key snapshot and exact exhausted tuple) and primitive string input (ToObject boxing plus indexed key enumeration), in addition to deleted snapshot keys, a live successor, and exhaustion. The bounded root passes all 3 linked tests. This is test evidence only; no context-linked forced optimizer differential is claimed while ../zig-gc remains the known compile blocker.

Landed and pushed directly to main as bacbe78 (test(jit): execute native for-in next). Added a compiled optimizer artifact witness that runs enum_next through tryRunManagedNative/NativeFrame, not just direct dispatcher calls: first candidate, a snapshot key deleted before the next call, then exact exhaustion all complete with the expected boolean result. The expanded direct dispatcher witness also remains green. This is the strongest isolated runtime evidence so far; the full forced optimizer-off/on Context differential is still pending the local ../zig-gc shim mismatch.

Landed and pushed directly to main as ea8580c (test(jit): execute native for-in result recovery). The managed NativeFrame execution witness now runs compiled enum_keys and checks the transported cursor result, then runs compiled enum_end_completion with zero native results and checks the completion kind survives to the return. Alongside bacbe78, this covers compiled execution of all three enum operations; the full forced optimizer-off/on language differential remains the required next gate and is still blocked by the local ../zig-gc shim mismatch.

Landed and pushed directly to main as b3dbac7 (test(jit): execute native for-in OSR loop). This is a real OSR execution witness: it seeds Exec at the enum_next loop header with the exact [target, keys, cursor] state, runs the compiled optimizer loop through a deleted snapshot key and exhaustion, observes a side exit at IP 9 with the recovered five-word operand state, then resumes runChunk and returns the expected result. The adjacent compiled single-candidate witness remains green. This proves loop-level NativeFrame/deoptimization recovery in the isolated VM root; Context-level forced off/on language differentials remain pending the local ../zig-gc shim mismatch.

Landed and pushed 7f291df (test(jit): differential for-in control paths). The focused VM-root gate passes all 3 linked tests. It runs a bounded source matrix twice—baseline VM and live jit.Owner—and requires exact equality for enumeration, prototype shadowing, early return, break, deletion, throw/catch, finally cleanup, and nested enumeration. The admitted early-return function publishes an optimizer artifact and the inventory observes native enum_next dispatch. The richer control-path functions remain intentional fallback witnesses where their current admission is rejected. Full context/unit gates remain blocked by the repository's local measurement-only ../zig-gc shim; no shim changes or workarounds were made.

Follow-up landed as 76b3317 (test(jit): verify native for-in result arity). The same source-level differential now inspects the published optimizer artifact and requires enum_keys result_count=3 and enum_next result_count=4, in addition to exact baseline/native equality and observed native enum_next dispatch. Focused VM-root gate: all 3 linked tests passed.

Follow-up landed as 994b04c (test(jit): cover for-in proxy and capture cases). The same bounded baseline/native source differential now covers proxy ownKeys/descriptor callback ordering, replacing the loop target after snapshot, primitive string input, and captured lexical iteration. Exact observed result suffix: kbaba|abcp|01|ap. Focused VM-root gate: all 3 linked tests passed; no engine workaround or dependency edit.

Landed ab6c720 (test(jit): witness native for-in break). The source-level differential now uses a minimal numeric break loop whose optimizer artifact is required to publish, while the richer break/string and exception/finally cases remain exact baseline/native fallback witnesses. Focused VM-root gate: 3/3 linked tests passed.

Landed dc6f0a7 (test(jit): witness native for-in exhaustion). A minimal numeric complete-snapshot loop is now part of the source-level baseline/native differential and its optimizer artifact is required to publish, covering native exhaustion without string-operation noise. Focused VM-root gate: 3/3 linked tests passed.

Landed a38d451 (test(jit): witness native for-in abrupt paths). Minimal throwing and try/finally for-in loops now each require a published optimizer artifact, while the broader source matrix continues exact baseline/native comparison. Focused VM-root gate: 3/3 linked tests passed.

Landed 43384f9 (test(jit): cover native for-in preparation OOM). In explicit arena mode, the test forces enum_keys allocation failure at nativeOperationDispatch, verifies the out_of_memory status and zero temporary roots, then reruns enum_keys and enum_next successfully with exact transported results. It deliberately does not fake a precise GC heap: temp rooting is a no-op in arena mode, while the real GC-root path remains covered by the existing Context/GC tests once the missing zig-gc collector is restored. Focused VM-root gate: 3/3 linked tests passed.

Landed and pushed 74373bc (test(jit): cover native for-in proxy trap order).

The focused VM-root gate now covers the native dispatcher against a real JavaScript Proxy:

• ownKeys and getOwnPropertyDescriptor callbacks produce the exact kba order;
• enum_keys publishes the 3-result state;
• two enum_next calls publish b then a, both present;
• runtime inventory records exactly 1 enum_keys and 2 enum_next calls.

The broader focused filter passed all 7 matching VM/JIT tests, including preparation OOM recovery, result recovery, and exact exhaustion. The test uses the arena-mode fixture and does not claim precise moving-GC coverage; that remains gated on restoring the real zig-gc implementation rather than modifying the measurement-only local shim.

Landed and pushed 0df7166 (test(jit): verify native for-in callback resumption).

The proxy-backed native dispatcher test now includes a has trap. It verifies that snapshot preparation produces exactly kba, the first enum_next extends it to kbahb, and the second extends it to kbahbha. That proves each candidate invokes the observable callback once and that resumption does not replay ownKeys or descriptor callbacks. The focused native for-in filter remains 7/7 passing, including OOM recovery, result recovery, and exact exhaustion.

This remains an arena-mode dispatcher test; real moving-GC/precise-root validation is intentionally still pending restoration of the real zig-gc dependency.

Follow-up verification on current main (0df71667): the bounded isolated VM root passes all 7 matching native for-in tests with zero failures:

• preparation allocation-failure recovery;
• compiled one-candidate execution;
• compiled result recovery;
• exact exhaustion recovery;
• proxy trap ordering and callback resumption;
• the linked JIT root.

No source change is being claimed in this update. I also did not land a termination test whose synthetic source-level admission failed to reach enum_next; that would have been misleading. Existing generic optimizer checkpoint coverage remains green, while an enum-specific moving-GC/termination differential still requires the real ../zig-gc collector rather than the local measurement-only shim. The parent remains open for that real-collector gate and the serialized Debug/ReleaseSafe/unsuppressed-TSan evidence.

Additional bounded verification on clean main (0df71667):

• the existing Context forced tree-walker vs required-bytecode for-in differential passes 2/2 with zero failures;
• the isolated VM native for-in filter remains 7/7 with zero failures;
• the existing moving-GC-named Context test reaches its assertion and reports OK with the current sibling shim, but the shim then emits an unbounded SafeAllocator leak report because it does not reclaim or move cells. I interrupted that diagnostic stream to protect the host, so this is not moving-GC evidence and is not being counted as a green gate.

The checkout remains clean and HEAD matches origin/main. No source commit is appropriate for this verification-only slice. The next actionable gate is the same parent issue’s real-collector run, followed by serialized Debug/ReleaseSafe and unsuppressed TSan evidence.

Real-collector focused gate update on clean main (0df71667): the module roots were wired explicitly to the separate real zig-gc checkout for these runs; build.zig.zon was not changed.

• Context forced tree-walker vs required-bytecode for-in differential: 2/2 Debug, 2/2 ReleaseSafe, 2/2 unsuppressed TSan.
• Context moving-GC for-in root witness: 2/2 Debug, zero leak report.
• Dedicated moving-nursery staggered-age compaction witness: 2/2 Debug, including nonzero moved-cell accounting.
• Native VM for-in filter: 7/7 Debug, 7/7 ReleaseSafe, 7/7 unsuppressed TSan; no sanitizer report.

This is stronger evidence than the local ../zig-gc measurement shim and confirms the optimizer transport/recovery paths across the real collector’s precise-root integration. The parent remains open: the repository’s normal dependency path still names the local shim, and the complete issue acceptance still requires the full serialized integration/TSan/fuzz and enum-specific moving execution gates before claiming closure. No source change or commit was appropriate for this verification slice.

Native for-in moving-nursery witness landed in cf156b1c (test(jit): cover native for-in moving recovery).

The new real-collector-only Context test warms an optimizer artifact, asserts enum_next publishes all four results, re-enters through a Proxy has trap, requests a moving nursery checkpoint, and verifies the exact loop result plus moved-cell accounting and cleared relocation state.

Focused evidence against the real local collector: Debug 2/2, ReleaseSafe 2/2, unsuppressed TSan 2/2 with no report. The repository shim cleanly skips this witness because it is explicitly non-collecting and must not be used as moving-GC evidence. The parent remains open for the full normal-dependency integration, serialized gates, fuzz/watchdog, and enum-specific moving acceptance matrix.

Additional serialized real-collector gate after cf156b1c: the single --test-filter for-in run passed 18/18. It covered the Context tree-walker/required-bytecode differential, moving required-bytecode roots, the new native moving-nursery witness, all native VM result/OOM/exhaustion/proxy-order tests, compiler/optimizer lowering witnesses, parser diagnostics, and interpreter coverage. No concurrent corpus or full-suite process was used.

ReleaseSafe confirmation: the same serialized real-collector --test-filter for-in matrix passed 18/18, including the moving native Context witness and all VM/compiler/optimizer for-in cases. Debug and ReleaseSafe are now green for the aggregate filter; the new witness also has an independent unsuppressed TSan 2/2 pass.

Landed eb6b0fc8 (test(jit): cover native for-in termination) on main and pushed to origin/main.

Added a bounded optimizer-tier witness that warms a repeated 8-key for-in, verifies the compiled enum_next descriptor publishes all 4 results, arms the VM stop flag, and verifies the native checkpoint unwinds as Error: worker terminated without losing the operation inventory.

Focused src/vm.zig root results: Debug 7 passed / 1 documented shim skip; ReleaseSafe 7 passed / 1 documented shim skip; unsuppressed TSan 7 passed / 1 documented shim skip. No full corpus or parallel suite was run.

Follow-up 67c7a2ee (test(jit): cover native for-in watchdog termination) is also on main and origin/main.

The same warmed native enum_next workload now covers both termination channels: an armed stop flag and an expired watchdog deadline. Each path reaches the native checkpoint, unwinds as Error: worker terminated, publishes the watchdog termination request where applicable, and records native enum_next execution.

Focused single-test results: Debug, ReleaseSafe, and unsuppressed TSan each passed 2/2 (the test plus the linked JIT test). No corpus or parallel suite was started.

Landed 37bfe7a4 (test(jit): cover native for-in proxy throw transport) on main and pushed to origin/main.

This adds a NativeFrame dispatcher witness for enum_keys → enum_next with a proxy has trap that throws. It verifies the four-result operation contract, catchable_exception status, exact exception bits, exactly one observable trap call (no dispatcher replay), and temporary-root cleanup. The witness passes focused Debug, ReleaseSafe, and unsuppressed TSan.

This is deliberately a direct NativeFrame boundary test: proxy source inputs still decline optimizer admission and fall back through the interpreter, so the test does not claim end-to-end native proxy admission.

Follow-up verification for 37bfe7a4: the complete focused native for-in cluster passed 8 tests with 0 failures and 1 documented moving-nursery skip. It covered preparation OOM recovery, one-candidate execution, exact result recovery, exhaustion, stop/watchdog checkpoint behavior, proxy trap order, and the new proxy-throw dispatcher witness. The linked JIT test also passed.

Landed b897477f (test(jit): witness native for-in completion execution) on main and pushed to origin/main.

The optimizer/NativeFrame completion-only fixture now records and requires exactly one enum_end_completion dispatch after recovering the exact completion pair. Focused Debug, ReleaseSafe, and unsuppressed TSan all pass.

The source-level break/finally control paths still side-exit before this completion opcode; that remains an implementation gap, not an omitted claim.

Landed 4c1f31af (test(jit): cover native for-in proxy catch recovery) on main and pushed to origin/main.

This is the real optimizer/NativeFrame/deoptimization path: a compiled enum_next operation with an active catch target invokes a proxy has trap that throws, reconstructs the exact exceptional target with the exception on the operand stack, resumes bytecode catch code, and returns 99. The observable trap counter remains exactly one across native failure and catch continuation, proving no replay. Focused Debug, ReleaseSafe, and unsuppressed TSan all pass.

Post-4c1f31af focused cluster: 9 passed, 0 failed, 1 documented moving-nursery skip. This includes the new optimizer/NativeFrame proxy catch-recovery case plus preparation OOM, result transport, exhaustion, termination, proxy ordering, and completion execution witnesses. The task-local .zig-cache was pruned after verification.

Landed and pushed on main: ceeb5ab (transport roots and recovery), 89fec61 (rooted admission/live constants/shared advancement/tests/docs), following #1108's1f53d086 fixture correction.

The native transport buffer is traced and relocated until every enumeration projection reaches scratch; initialization precedes map publication, clearing follows transfer, and completed-effect checkpoints follow the whole tuple. Malformed arity/root masks fail verification. Managed constants resolve through the live traced chunk, preparation and candidate receivers survive callbacks, and OSR retains exact operand state and handler depth while refusing unguarded numeric stack imports.

Evidence:

• Real collector optimizer/for-in cluster272/272 in Debug, ReleaseSafe and unsuppressed ReleaseSafe+TSan, no skips; instrumentation verified, no supplied suppressions.
• Executed before recovery/transport failures now pass12 serialized/no-GIL combinations, with actual compaction before result transfer and at the completed checkpoint. Real artifact/OSR admissions, completion controls, live constants and256 exact callback budget/stop comparisons pass.
• Exact parent4c1f31af:15 test262 subtrees,7980 cases per tree/required-bytecode mode. Both sides0 failures; exact failure sets unchanged,0 flips.
• Default400, verify300, mid-GC900, TSan60 programs pass under unchanged CI watchdogs.
• Full no-GIL Debug and ReleaseSafe each253/253, unchanged600-second per-case limit.
• #1108 fixture controls Debug2/TSan2/ReleaseSafe20 pass. Pinned BunPress0.2.14 manifest51 pages and relocation inventory pass.

The exact-parent full mid-GC control has8 late-asyncJoin finite-wait failures; both affected seed-four parent/candidate profiles pass individually. Cause is undetermined and retained in #1109; no parent-green or performance claim is made. Proxy prototype/has-trap semantic defects remain #1107, next before class support. Unsupported control resumes exact bytecode; source-level abrupt paths still may use that fallback.

Hosted integration is pending. The full combined local unit relink remains subject to #933's explicit3072 MB human block; these focused gates do not claim full-suite success. Keeping this issue open pending the remaining integration/acceptance audit.

Implemented and pushed directly to main:

• 0103ec72 feat(jit): recover native for-in cleanup — publishes exact exceptional cleanup metadata for native enum_next, preserves live handler metadata during OSR admission, and transports the interpreter-owned completion/finally-dispatch state through the NativeFrame boundary.
• a3559c9b test(jit): cover descriptor throws during native for-in — follows the current #1107 descriptor-based for-in semantics.

Evidence:

• zig build test-jit: 160 passed, 1 expected platform skip, 0 failed, 0 leaked.
• Focused native/baseline witness after rebasing onto #1107: 1 passed, 0 failed, 0 leaked.

Caches were pruned after verification; no worktree was used.

Landed and pushed 5a4d011 (fix(jit): publish cleanup for every enum_next) directly on main. The publisher now scans all eligible enum_next descriptors and emits one enum_end_completion cleanup/recovery pair per candidate; the metadata verifier now treats runtime_result.lhs as a result ordinal rather than a scratch-slot input. Added a forced interpreter/native nested and sequential proxy-throw differential. Evidence: test-jit 161 passed, 1 expected platform skip, 0 failed/leaked; native for-in Debug 8 passed/1 expected skip/0 failed/leaked; ReleaseSafe 8 passed/1 expected skip/0 failed/leaked; unsuppressed TSan 8 passed/1 expected skip/0 failed/leaked; current vs preserved parent runner: for-in 115/115, Proxy 311/311, try/control 201/201, zero failures.

Follow-up landed as a771aa8 (fix(jit): clean enum state before finally bodies). Native exceptional cleanup now recognizes the required enum_end_completion prefix even when a user finally body follows, so it clears private for-in state before entering user cleanup. Added a forced interpreter/native proxy-throw differential asserting exactly one finally effect and preservation of the original throw. Debug, ReleaseSafe, and unsuppressed TSan native for-in gates: 8 passed, 1 expected moving-GC skip, 0 failed/leaked.

Post-a771aa8 exact-parent comparison is clean. Rebuilt the immediate parent 5a4d011 and current main with the same pinned test262 corpus: for-in 115/115 vs 115/115, Proxy 311/311 vs 311/311, and try/control 201/201 vs 201/201; all zero failures.

Added b49729d (test(jit): gate moving enum transport on real gc). The moving enum transport witness now explicitly skips only when the configured zig-gc module lacks RelocationVisitor; with a real relocating collector it remains active. Under the repository measurement-only shim it reports 0 passed / 1 skipped / 0 failed instead of a false relocation assertion and leak-heavy run.

Follow-up 427c79e (test(gc): gate for-in relocation witnesses) adds the same explicit real-collector guard to the required-bytecode moving-root witness in context.zig. Under the checked-in measurement-only zig-gc shim, both moving-GC witnesses now skip honestly; with RelocationVisitor they execute normally.

Additional control-matrix evidence: native and baseline for-in control paths agree passes in Debug, ReleaseSafe, and unsuppressed TSan (1/1 each, zero failures/leaks). This covers exhaustion, break, early return, throw/finally, nested, proxy order/throws, changing targets, primitive inputs, captured bindings, and no replay of observable traps.

Environment note: no real zig-gc checkout exists locally beyond Documents/Projects/zig-gc, whose root.zig identifies it as a measurement-only non-collecting shim. Therefore relocation/GC-enabled for-in gates cannot provide valid local evidence; the moving witnesses now skip only when RelocationVisitor is absent. Native Debug/ReleaseSafe/unsuppressed TSan control gates remain fully exercised and green.

Oracle check: Node v24.4.1 and Home/JSC home-tool produce the same for-in result for exhaustion, break, deletion during enumeration, proxy descriptor throw, and finally completion: ["ab","a","a","true:2","9:1"].

Gate evidence (environment blocker, no source change): the prescribed default threadfuzz -Dfuzz-iters=400 fails deterministically at seed 1; Debug also reproduces with threadfuzz 1 1. LLDB stops two worker threads in compiler_rt.memcpy/memset while ../zig-gc/src/root.zig:108 concurrently grows Heap.cells via unsynchronized ArrayListUnmanaged.append; one thread frees/reallocates the tracked-cell list while another appends. This checkout's ../zig-gc is the documented measurement-only non-collecting shim (no real parallel-GC bookkeeping), so I am not weakening the fuzzer or adding a shim-only workaround. The required gate remains pending a real zig-gc checkout; the engine source tree is unchanged and clean.

Follow-up pushed as e96fb9d0 (test(jit): cover for-in deletion shadowing and null). The forced native/baseline control differential now explicitly covers deletion during enumeration (ac), duplicate prototype shadowing (acb), and primitive/null inputs (01:). Current focused evidence: Debug 2/2 passed, ReleaseSafe 2/2 passed, and unsuppressed TSan 2/2 passed; zero failures/leaks. The local moving-GC and full threadfuzz limitations remain documented above and are unchanged.

Follow-up pushed as 70718933 (test(jit): cover for-in next allocation recovery). Added a proxy-backed enum_next allocation-failure witness that verifies native out-of-memory transport, temporary-root cleanup, no proxy callback replay during the failed attempt, and exactly-once callback execution after allocator recovery. Focused evidence: Debug 2/2 passed, ReleaseSafe 2/2 passed, and unsuppressed TSan 2/2 passed; the broader native for-in filter was 10 passed, 1 skipped for the documented moving-GC shim limitation, 0 failed. The full threadfuzz/real moving-GC gate remains pending a real zig-gc checkout as documented above.

Follow-up pushed as 06278b8a (test(jit): prove native for-in preparation executes). The forced optimizer-off/on differential now asserts the runtime inventory records enum_keys as well as enum_next and enum_end_completion, closing the prior admission-evidence gap where a descriptor alone did not prove native preparation executed. Debug, ReleaseSafe, and unsuppressed TSan focused controls each pass 2/2.

Exact-parent conformance gate completed serially with the rebuilt current runner: test/language/statements/for-in 115/115 before and 115/115 after; test/built-ins/Proxy 311/311 before and 311/311 after; test/language/statements/try 201/201 before and 201/201 after. All six runs exited 0 with zero failures; no semantic source changes were introduced by the evidence-only commits.

Pushed 3a36247 (test(jit): guard direct for-in admission) directly to main as glennmichael123 <gtorregosa@gmail.com> with no trailers.\n\nThis adds a real boundary witness: a warmed for-in optimizer artifact contains enum_keys and enum_next, requires execution/activation context, and tryRunNativeDirectCall returns a miss without advancing optimizer-hit accounting. Managed execution remains the permitted path for enumeration effects.\n\nVerification: the focused witness passed Debug, ReleaseSafe, and the repository-supported unsuppressed TSan filter (1/1 each). The stale pre-edit full test262 process was stopped after advancing through 100% RegExp/property-escape subtrees; no result is claimed. The broader local enumeration family was also stopped because the measurement-only ../zig-gc shim emitted an unbounded SafeAllocator leak dump; this is an environment limitation, not attributed to the new witness. Existing exact-parent for-in/Proxy/try evidence remains unchanged (115/115, 311/311, 201/201), and child #1107 remains the separate proxy-semantics slice.

Fresh verification on current clean main (6f105d3) with the pinned Zig 0.18.0-dev.146+35accc0 toolchain:\n\n- focused native for-in Debug: 10 passed, 0 skipped, 0 failed, 0 leaked\n- focused native for-in ReleaseSafe: 10 passed, 0 skipped, 0 failed, 0 leaked\n- focused native for-in unsuppressed TSan: 10 passed, 0 skipped, 0 failed, 0 leaked; no sanitizer output\n\nThe cluster includes preparation and candidate OOM recovery, compiled enum_keys/enum_next/result recovery, exact exhaustion, termination checkpointing, proxy trap order, proxy throw transport, optimizer deoptimization into catch, and the moving-nursery witness. This is fresh focused evidence only; #1106 remains open for the broader serialized no-GIL/fuzz/exact-parent/full-corpus acceptance.

Fresh current-main no-GIL evidence for #1106:\n\n- command: zig build threads-test -Dthreads-parallel-js=true\n- 253/253 corpus files passed\n- exit 0\n- no failure, leak, or sanitizer markers\n\nThis run covered the full serialized no-GIL corpus, including JIT invalidation and OSR, GC relocation and blocked-root stress, Atomics/Condition/Lock waits, object-model races, termination, OOM, VM-state, and CVE cases. The issue remains open for the deterministic fuzz and exact-parent/full-corpus gates.

Fresh current-main deterministic fuzz evidence for #1106:\n\n- command: zig build threadfuzz -Dfuzz-iters=400\n- default profile: 400 programs from seed 1\n- 0 failures\n- wall time: 285605 ms\n\nCombined with the current native for-in Debug/ReleaseSafe/TSan 10/10 cluster and the full no-GIL 253/253 corpus, this closes the broad concurrency/fuzz evidence for the current tree. The remaining acceptance work is the exact-parent affected test262 run and any final full-corpus/release evidence.

Fresh current-main ReleaseFast conformance evidence for #1106:\n\n- test/language/statements/for-in: 0 fail, 115 pass\n- test/built-ins/Proxy: 0 fail, 311 pass\n- test/language/statements/try: 0 fail, 201 pass\n\nThe current runner was rebuilt from clean main with Zig 0.18.0-dev.146+35accc0. Combined with the fresh native for-in Debug/ReleaseSafe/TSan 10/10 cluster, no-GIL 253/253 corpus, and deterministic fuzz 400/400, the current acceptance evidence is green. Existing exact-parent comparisons for these same affected paths are also recorded above; no source changes occurred during this verification slice.

Final acceptance update on the actual origin/main tip f0072c9:\n\n- fast-forwarded clean main to the two already-pushed commits c35bc09 and f0072c9; no work was overwritten\n- native for-in Debug cluster on the new tip: 10 passed, 0 skipped, 0 failed, 0 leaked\n- ReleaseFast test262 for-in: 115/115\n- ReleaseFast test262 Proxy: 311/311\n- ReleaseFast test262 try/control: 201/201\n- prior current-tree ReleaseSafe native for-in: 10/10\n- prior current-tree unsuppressed TSan native for-in: 10/10, no sanitizer output\n- prior current-tree no-GIL corpus: 253/253\n- prior current-tree deterministic fuzz: 400/400\n- existing exact-parent comparisons for the affected subtrees remain 115/115, 311/311, and 201/201 with zero flips\n\nThe implementation and evidence slices are already pushed directly to main. No workaround or dependency-shim change was used.

Fresh current-main no-GIL evidence for #1106:\n\n- \n- 253/253 corpus files passed\n- exit 0\n- no failure, leak, or sanitizer markers\n\nThis run covered the full serialized no-GIL corpus, including JIT invalidation/OSR, GC relocation and blocked-root stress, Atomics/Condition/Lock waits, object-model races, termination, OOM, VM-state, and CVE cases. The issue remains open for the deterministic fuzz and exact-parent/full-corpus gates.