Toolchain: complete Zig 0.18-dev migration audit

Track the Zig 0.17-to-0.18-dev migration against the pinned CI compiler (0.18.0-dev.146+35accc0).

Completed in pushed commits:

• a2a51ed: package minimum, CI/performance pins, and primary setup contract.
• aebe04b, d23079e, a1db176, 332e3c8, 51c9fe5: current docs, generated evidence, README generator ownership, and compatibility notes.
• 4055ed1: qualified OptimizeMode tags and explicit shipped-library/unit-test no-libc parity.

Evidence:

• zig build: pass
• docs-link-check: 378 files, all links resolve
• BunPress: 51 pages pass
• focused primary unit test: Debug, ReleaseSafe, and unsuppressed TSan each 1/1 pass, 0 leaks; TSan artifact contains ___tsan_init
• release compatibility: 12/12 gates green

Remaining audit: run the required focused dependency/build gates under the pinned compiler, verify CI metadata and shipped artifacts, and preserve historical 0.17 benchmark evidence without relabeling it. Do not remove error handling from std.crypto APIs unless the current signature proves the operation cannot fail.

Additional gate result: the first runtime-thread audit exposed stale evidence counts (agent 3→5, VM 8→19), not a Zig API/runtime defect. Commit f5f7aaf reconciles the exact token-counts; the fail-closed audit now passes with 6 production call sites across 6 resource classes and 171 reviewed test-only direct spawns.

Conformance/focused evidence: the ReleaseFast test262 runner built under 0.18 and one pinned test/language/expressions/new file executed successfully (OK undefined). zig build test-frontend passed all 80 bounded frontend/VM cases.

Shipped-boundary evidence: zig build test-c-api passed under 0.18: 117/117 declarations complete, 117 public symbols present, 26 zig-js extensions, and 460 private-profile exports; inherited-host fixture also passed (448/99/123/7, 64/65/66/67 callbacks).

Full sharded unit run (Zig 0.18.0-dev.146, zig build test-parallel -Dunit-jobs=2) was started as the first memory-bounded heavy gate and was stopped after the logs reached ~728 MiB of allocator traces. The two concrete failures observed before stopping share the same environment cause:

• context.test.module functions keep declaring import.meta across bytecode suspension — src/context.zig:12300, expected CompactionStatus.compacted, found no_candidates.
• context.test.generic Array borrowed index keys survive collection and moving GC — src/context.zig:12917, expected compacted, found no_candidates.

The sibling ../zig-gc/src/root.zig is explicitly a measurement-only non-collecting shim: collectYoungAndCompact and collectAndCompact always return .no_candidates, and its header states that GC-enabled tests are unsound under the shim. The run also emitted the shim's expected SafeAllocator leak traces. No zig-js source was changed to mask this; the full unit gate remains pending a real zig-gc checkout or an explicitly provisioned CI dependency. Main remained clean and no commit was made for this environment-only result.

No-GIL gate diagnosis (Zig 0.18.0-dev.146): the one-shard run was stopped after remaining live without a result. The first corpus case, isolated as zig-out/bin/threads-test parallel-js one smoke.js, reproduces a segmentation fault in the local ../zig-gc measurement-only shim, not in a zig-js source edit:

SafeAllocator.remap -> src/context.zig:215 -> src/context.zig:2785 -> std.ArrayList.ensureTotalCapacity -> ../zig-gc/src/root.zig:108 (track: self.cells.append) -> ../zig-gc/src/root.zig:272 (create) -> src/gc.zig:5562.

The shim's cells ArrayList is not a concurrent collector backing and its header explicitly says GC-enabled/no-GIL paths are unsound under the shim. The crash is therefore a confirmed dependency/environment blocker for the unsuppressed no-GIL gate. I am not modifying the shim or weakening the gate; it requires the real zig-gc checkout/CI dependency before this requirement can be verified.

WebAssembly wg-1.0 gate passed under Zig 0.18.0-dev.146 using the pinned WebAssembly/spec wg-1.0 commit 977f97014c962f7bd1291fcc6d28b41a924882bf: 73 files, 18,795 pass, 0 fail, 475 declared skips, 0 crashes. No source changes were needed.

Confirmed and fixed the one parser regression from the Zig 0.18 ReleaseFast test262 run. startsExpression() treated template_middle/template_tail as a possible YieldExpression operand, so function* g(){ str = 1${ yield }3${ 4 }5; } parsed the continuation as an expression and failed. Added a focused parser regression test and pushed f3f6b27a (fix(parser): accept bare yield before template continuation) directly to main. The yield subtree now reports 63 pass / 0 fail (previously 62 pass / 1 parse-fail), a +1 flip.

Zig 0.18 ReleaseFast test262 follow-up:

• fix(intl): apply TimeClip before date-time formatting (278b7b70) fixes the four DateTimeFormat -0.9 failures by clipping before adding the resolved time-zone offset. Focused subtree: 244/244 pass (was 240/244).
• fix(temporal): count skipped local dates in duration balancing (4d6a73a6) fixes Samoa date-line zero-span accounting in both total and round paths. Focused subtrees: 16/16 pass.

The three legacy Date toISOString boundary cases remain unchanged and reproduce the same non-throwing result in Node 24 on this machine, so they are not attributed to the Zig 0.18 migration. A post-fix full corpus run is still required before closing this issue.

Final ReleaseFast test262 run after f3f6b27a, 278b7b70, and 4d6a73a6:

• VALID: 48,503/48,506 (100.0%); parse-fail 0; runtime-fail 3; host-fail 0.
• NEGATIVE: 4,669/4,669 (100.0%).
• skipped: 0.
• Intl.DateTimeFormat: 244/244, including all four TimeClip cases.
• Temporal.Duration: 21/21, including total/round DST balancing.
• Remaining three are the legacy Date.prototype.toISOString/15.9.5.43-0-{8,9,10}.js boundary cases. Node 24 on this same machine also returns valid ISO strings for the constructed dates instead of throwing, so these are not attributed to Zig 0.18.

The parser, Intl, and Temporal fixes are pushed directly to origin/main; unit/no-GIL gates remain pending because the local ../zig-gc measurement-only shim cannot provide moving collection or synchronized cell tracking. The complete runner transcript is retained locally on the validation host.

TSan qualification (unsuppressed, isolated parallel-js one smoke.js):

• zig build threads-test-bin -Dtsan=true succeeds and the binary links libclang_rt.tsan_osx_dynamic.dylib.
• The first smoke case exits 134 with a real ThreadSanitizer race in the local ../zig-gc measurement shim: concurrent root.Heap(gc.Binding).TrackedCell ArrayList.append/addOne accesses from the main thread and worker thread. The reported stack enters through gc.allocCell/gc.allocObj; this is the shim's unsynchronized global cell registry, not a zig-js 0.18 API compile regression.
• No suppressions were set (TSAN_OPTIONS=halt_on_error=1). The full no-GIL corpus remains intentionally unrun after the same shim failure was reproduced without TSan.

This keeps #1111 open pending a real synchronized/collecting zig-gc checkout or an explicit maintainer decision to qualify this environment as dependency-blocked.

Zig 0.18 real-GC follow-up and focused fixes:

• Replaced the local non-collecting shim with pinned zig-gc commit 0285ef8.
• The first full zig build test-parallel -Dunit-jobs=2 completed in 1,979.9s across two shards: 1,398 passed, 1 skipped, 3 failed, 1 leaked. The observed failures were real-GC/JIT lifetime and trampoline defects, not 0.18 API compile failures.
• Commit 6f63f5f rejects invalid native operation descriptors before converting the raw opcode; its focused test passes with zero leaks.
• Commit 6a74748 roots the receiver, captured next method, output array, and yielded values across Iterator.prototype.toArray calls and appends. The moving native-realm wrapper test now passes with zero leaks in tree-walker and required bytecode modes.
• Commit f91ae15 prevents native callbacks from recursively re-entering the heap driver and routes driver-owned JavaScript calls through pending heap activations. Deep VM recursion and explicit native caller-entry focused tests pass with zero leaks.

The full sharded suite must be rerun after these fixes. No workaround, disabled gate, or dependency shim change was used. Issue 1111 remains open pending the post-fix full unit suite, unsuppressed TSan/no-GIL evidence, and the remaining release gates.

Zig 0.18 real-GC follow-up and focused fixes:\n\n- Replaced the local non-collecting shim with pinned zig-gc .\n- The first full unit-test-parallel self-test: ok zig-js unit tests: 2 parallel shards -> .zig-cache/unit-shards shard plan: 2228/2801 measured tests, 2 tail tests rebalanced; expected-ms 1943627,1953097 shard 0: 850/1401 [0/2] vm.test.class call guards preserve native optimizer exceptional exits...FAIL (TestUnexpectedResult) shard 0: FAIL (3378 ms) shard 0: FAIL (TestExpectedEqual) shard 0: FAIL (42 ms) shard 0: 878/1401 [0/2] vm.test.vm: optimizer native call resumes a function-valued parameter...FAIL (TestUnexpectedResult) shard 0: FAIL (24 ms) shard 0: FAIL (TestExpectedEqual) shard 0: FAIL (24 ms) shard 0: FAIL (TestExpectedEqual) shard 0: FAIL (27 ms) shard 0: FAIL (TestExpectedEqual) shard 0: FAIL (25 ms) shard 0: FAIL (TestExpectedEq/Users/glennmichaeltorregosa/.local/share/zig/0.18.0-dev.146+35accc0/lib/std/testing.zig:93:17: 0x103b6d37b in expectEqualInner__func_7797 (test) shard 0: FAIL (459 ms) shard 0: ^ ('\xFAIL FAIL (TestExpectedEqual) shard 0: FAIL (2616 ms) shard 0: FAIL (TestExpectedEqual) shard 0: FAIL (3827 ms) shard 1: 227/1400 [1/2] context.test.Thread asyncJoin commits thenable adoption without waiting for its deferred result...FAIL (Throw) shard 1: FAIL (5023 ms) shard 1: 881/1400 [1/2] vm.test.literal function metadata preserves copied methods in native execution...FAIL (TestUnexpectedResult) shard 1: FAIL (75 ms) shard 1: FAIL (TestExpectedEqual) shard 1: FAIL (3024 ms) shard 1: FAIL (TestExpectedEqual) shard 1: FAIL (105 ms) shard 1: FAIL (TestExpectedEqual) shard 1: FAIL (91 ms) shard 1: FAIL (TestExpectedEqual) shard 1: FAIL (96461 ms) shard 1: 994/1400 [1/2] vm.test.vm: optimizer closure allocation observes live defining-frame writes...FAIL (TestUnexpectedResult) shard 1: FAIL (3011 ms) shard 1: FAIL (TestExpectedEqual) shard 1: FAIL (189 ms) slowest: 130346 ms interpreter.test.internal descriptors roots unwind on every allocation failure slowest: 117230 ms context.test.proper tail calls agree across tree-walker expression forms and required bytecode slowest: 108113 ms context.test.realm array intrinsics preserve identities and species across execution tiers slowest: 100610 ms context.test.reentrant coercion and assignment roots survive moving nursery slowest: 96461 ms vm.test.vm: optimizer synchronous iterator seeded serialized and four worker effects slowest: 96062 ms context.test.parallel_gc soak: sustained parallel allocation reclaims across rounds, no leak/UAF slowest: 94701 ms context.test.constructor prototype realms retain private identities and native ownership slowest: 85760 ms context.test.constructor prototype primitives preserve object types and NewTarget realms slowest: 69197 ms context.test.parameter references preserve exact lexical initialization slowest: 68334 ms context.test.private eval contexts survive function escape and suspension zig-js unit tests: 2783 passed; 1 skipped; 17 failed; 0 leaked; 2349.1s wall across 2 shards per-shard logs: .zig-cache/unit-shards completed in 1,979.9s across two shards: 1,398 passed, 1 skipped, 3 failed, 1 leaked. The observed failures were real-GC/JIT lifetime and trampoline defects, not 0.18 API compile failures.\n- prevents a native-operation callback from converting an invalid u16 into a bogus ; its focused test passes with zero leaks.\n- roots the receiver, captured , output array, and yielded values across calls and appends. The moving native-realm wrapper test now passes with zero leaks in tree-walker and required bytecode modes.\n- prevents native callbacks from recursively re-entering the heap driver and routes driver-owned JS calls through pending heap activations. Deep VM recursion and explicit native caller-entry focused tests pass with zero leaks.\n\nThe full sharded suite must be rerun after these fixes. No workaround, disabled gate, or dependency shim change was used. #1111 remains open pending the post-fix full unit suite, unsuppressed TSan/no-GIL evidence, and the remaining release gates.

Post-fix full-suite qualification and JIT correction:

The first real-GC sharded rerun after 6a74748 and f91ae15 completed with 2,783 passed, 1 skipped, 17 failed, and 0 leaked across two shards. The failures were concentrated in optimizer callback/continuation accounting because f91ae15 invalidated every native call while the heap driver was active; that was too broad and changed valid optimizer traces.

I corrected this in 012c9ca. Native callback operations retain ordinary optimizer behavior and invalidate only when nested native execution reaches the existing inline-call depth limit, after which the heap driver publishes the callee activation. I also removed the over-broad driver-wide inline-disable state.

Focused post-correction results, all zero leaks: class exceptional exits; environment-binding proxy effects; continuation callbacks (0/448 mismatches); synchronous iterator oracle traces; native tail-call activation replacement; live defining-frame closure allocation; explicit native caller entry; and deep VM recursion. The full sharded suite will be rerun again before this migration issue is closed.

Complete post-correction real-GC unit gate: zig 0.18.0-dev.146 with pinned zig-gc 0285ef8; zig build test-parallel -Dunit-jobs=2; 2,800 passed; 1 skipped; 0 failed; 0 leaked; 2,403.2 seconds wall across two bounded shards. The moving Iterator.prototype.toArray wrapper, native driver re-entry, deep recursion, optimizer callback and continuation, and native caller-entry regressions all pass in this complete run. The unit portion of #1111 is now green. Remaining qualification is unsuppressed TSan/no-GIL, WebAssembly, ReleaseFast test262, and the final issue evidence audit.

Zig 0.18 validation update: the unsuppressed TSan focused gate passed cleanly. Command: zig build test -Dtsan=true -Dtest-filter=parallel_js. Result: 78 passed, 0 skipped, 0 failed, 0 leaked; exit 0; no TSan report and no suppressions. The complete real-GC unit gate remains green at 2800 passed, 1 skipped, 0 failed, 0 leaked.

No-GIL functional gate completed against the real zig-gc checkout and the normal (non-TSan) Debug threads-test binary. Command: home-tool run tools/nogil-corpus-gate.ts. Result: 253/253 passed; 0 regressions against docs/.data/pr249-execution-nogil.json; exit 0. The first attempted run was stopped after read-only sampling showed it had accidentally reused the TSan artifact (~1 GB RSS); the corrected run used a verified non-TSan binary (__tsan_init absent) and stayed memory-bounded.

Threading validation update: the ordinary GIL corpus passed completely. Command: zig build threads-test. Result: 246/246 corpus files passed; exit 0; no failure or leak output. Combined with the unsuppressed TSan focused gate (78/78) and corrected no-GIL functional gate (253/253, zero baseline regressions), the threading lane is green on Zig 0.18-dev.146.

Threading reference checks also passed: zig build threads-reference-audit threads-reference-probes reported PR-249 promoted coverage 253/259 executable files, 0 blocked, 6 terminal dispositions, 5 helper/preload, and terminal disposition probes 5/5 matched; exit 0.

WebAssembly wg-1.0 gate passed on Zig 0.18-dev.146: zig build wasm-spec reported 73 files, 18,795 pass, 0 fail, 475 skip, 0 crash. Pin: WebAssembly/spec wg-1.0 at 977f970. The skip set remains the documented text-parser boundary/feature disposition set.

Final ReleaseFast test262 validation completed. Command: zig build test262 -Doptimize=ReleaseFast. Aggregate: VALID 48,503/48,506; parse-fail 0, runtime-fail 3, host-fail 0; NEGATIVE 4,669/4,669; skipped 0. Exit 1 is the runner’s expected failure status for the same three known legacy Date toISOString runtime cases; no new failures appeared in the Zig 0.18 pass. Full transcript: /tmp/zig-js-zig018-test262-releasefast.log.

Migration audit complete. The required Zig 0.18-dev gates are now covered by the evidence above: full real-GC unit suite 2800 passed / 1 skipped / 0 failed / 0 leaked; unsuppressed TSan 78/78; GIL corpus 246/246; no-GIL 253/253 with zero baseline regressions; reference probes 5/5; Wasm wg-1.0 18,795 pass / 0 fail / 475 documented skips / 0 crash; and ReleaseFast test262 48,503/48,506 valid plus 4,669/4,669 negative, with only the three known legacy Date toISOString residuals. Source and origin/main are synchronized at 012c9ca. Closing this issue as complete; the three Date cases remain a separate compatibility lane rather than a Zig 0.18 migration blocker.