VM: make correct JavaScript universally bytecode-eligible

Parent: #459 Depends on: #460

Goal

Make every semantically eligible JavaScript function and program reach the bytecode VM, removing the current flat-slot lexical-scope barrier without weakening tree-walker equivalence.

Current boundary

The compiler now has explicit lexical scopes, checked TDZ/const slots, captured iteration environments, and direct-eval activation views. 81ce8599 adds exact ordinary block-function/CaseBlock lexical and Annex B bindings (#788), with required-bytecode Annex B function-code witnesses at 159/159. 8d772d15 adds program/suspendable environment-mode declarations (#790), including 153/153 required-bytecode Annex B global-code witnesses. e1afde2d removes the blanket rejection of nested suspendable templates inside ordinary VM functions through live defining-environment views (#794), with the concurrent-GC ownership prerequisite in #796. e0ed6eb1 installs complete callee parameter metadata (#795), and 8a1398ff preserves exact lexical private and field-initializer eval contexts across parameter entry and suspension (#797). These landed prerequisites have completed required integration in CI run 33113309062: all 53 executed jobs passed; the scheduled-only nightly job was skipped. Automatic tiering still follows workload policy; required-bytecode admission is not proof of default-tier selection or throughput leadership.

Scope

• Add explicit lexical-scope metadata and storage for block bindings, TDZ state, catch bindings, class names, and per-iteration environments.
• Preserve O(1) slot access for statically resolved bindings while allocating environment cells only where capture/dynamic lookup requires them.
• Compile top-level, functions, methods, constructors, arrows, generators, async functions, and async generators through one verified eligibility model.
• Model eval, with, direct eval, global resolution, this, super, new.target, and upvalues with explicit dynamic barriers rather than blanket or unsafe admission.
• Add compiler/VM/tree-walker differential generation for scopes, abrupt completion, closures, exceptions, suspend/resume, and proper tail calls.
• Publish admission counters by reason so remaining tree-walker execution is auditable.

No-workaround rules

• Do not flatten a scope whose identity/TDZ is observable, eagerly heap-allocate every local, disable per-iteration capture semantics, or silently route a failing compiled path to a different result.
• Tree-walker fallback remains exact during rollout but is not completion for a construct declared bytecode-eligible.

Acceptance

• Shadowing, TDZ, catch/class scopes, and per-iteration closures pass forced tree-walker/VM differentials.
• Eligible test262 and PR-249 programs execute through VM witnesses with identical result, exception, side effects, steps, and async ordering.
• Admission inventory reports every compiler rejection with a stable reason; no unclassified fallback remains.
• Focused VM, full unit, test262, no-GIL, TSan, threadfuzz, generator/async, debugger, and moving-GC gates pass.
• #460 records tree-walker/VM/tier attribution before and after without a regression caused by unnecessary heap environments.

Foundation

Architecture boundary: docs/architecture.md; bytecode/compiler paths: src/compiler.zig, src/bytecode.zig, and src/vm.zig.

Latest parameter-reference boundary

2865b8b4 (#798) admits exact lexical parameter references through existing checked resolution. Against 8a1398f, the same 9,643 positive paired files improve from 8,475 to 8,809 passes (+334, zero new failing paths); 834 existing failures remain. All 13 default-tier diagnostics retain 11,494 passes with byte-identical output (0 default-tier flips). Full local units: 2,020 pass / 1 skip / 0 fail/leak; focused ReleaseSafe+TSan and 700 seeded fuzz programs pass. Pushed CI 33127832028 is pending. #799 tracks the next assignment/update initializer boundary. These scoped gains do not complete universal admission, the separate #787/#791 ownership audits, or performance attribution.

Plain-function admission taxonomy landed on main in ab660166.

The compiler now returns a stable typed admission result instead of collapsing every plain-function barrier into error.Unsupported. Current reasons distinguish generator/async inputs, function-scope disposal, block-nested function declarations, lexical shadowing, TDZ hazards, parameter prologues, and residual unsupported lowering. The legacy compile API remains source-compatible.

Validation: direct src/compiler.zig test root, 107/107 passed, including every rejection tag and a positive compiled case.

The admission-inventory acceptance item remains open: runtime policy skips (debugger/method/arguments/candidate policy), top-level/generator/async rejections, aggregate counters, and an inventory reporter still need to consume stable reasons.

Runtime admission telemetry is now on main in dc0d629e, building on the typed compiler admissions in ab660166 and 4d9bd64e.

Every runtime Function now retains a stable BytecodeAdmissionReason, and Context.bytecodeAdmissionSnapshot() exposes context-owned atomic counts covering program, plain-function, generator, async, and nested-template decisions. Shared-realm recording was verified with 4 concurrent writers (40,000 exact counts per reason), and the focused inventory tests pass under TSan.

Validation: compiler root 110/110; adjacent VM admission 3/3; full unit suite 1,470/1,470 across 10 shards; docs build and link check.

The acceptance checkbox remains open intentionally: program_source_policy and VM template fallbacks are still coarse categories, so “no unclassified fallback remains” is not yet true. The next admission slice should replace those generic buckets with causal subreasons and add the inventory reporter/witness output.

The remaining admission-classification gap is closed on main in 64bacae9, following ab660166, 4d9bd64e, and dc0d629e.

Source-policy skips now retain causal reasons for lexical declarations, catch, switch, labels, arguments functions, legacy .caller/.arguments, and nested function declarations. Nested function templates carry the compiler decision that produced either bytecode or a null chunk, distinguishing parameter-prologue rejection from unsupported lowering. The legacy generic counters remain in the stable schema but have no emission sites; runtime tests prove all generic template counters and program_source_policy remain unchanged.

Validation: focused admission tests in Debug and TSan; compiler root 110/110; docs manifest/build/link checks; full sharded unit suite 1,471/1,471 with 0 leaks. Execution admission decisions are unchanged, so this flips 0 test262 cases.

The admission-inventory acceptance checkbox is now complete. The broader lexical-scope compilation and forced VM-equivalence work remains open.

Forced tree-walker/VM differential controls are now available on main in cff13e9f.

The test-only tree_walker mode suppresses plain synchronous bytecode, and required mode fails closed if the program compiler or a called plain-function/template path would fall back. Admission counters prove which tier actually executed, preventing a green result from silently representing the same tree-walker path twice.

Initial witnesses compare exact result bits, observable closure/property/array state, exception class/message, and pre-throw side effects in Debug and TSan. Full suite: 1,474/1,474, 0 leaks. This advances the forced-differential foundation but does not check the first acceptance item yet: shadowing, TDZ, catch/class scopes, and per-iteration capture still need correct VM lowering before their differential matrix can pass.

Class/method VM admission advanced on main in 28b00703.

Methods now use ordinary compiler admission instead of a blanket policy rejection. Heap activations preserve, precisely trace/relocate, and restore [[HomeObject]]/super state; base constructors install instance private-method/accessor brands before body execution. Deferred class members are admitted only when they do not capture a VM frame slot. Derived constructors and constructors with field initialization retain a stable causal barrier (plain_policy_class_constructor_semantics) until their initialization state is represented by bytecode activations, and unresolved source-level private names reject eager computed-key lowering.

Forced tree-walker/required-bytecode witnesses now cover catch/finally state, ordinary classes, private methods/brands, and repeated super resolution across nested activation returns. The exact-parent corpus comparison found and drove fixes for 528 private-brand failures and 2 computed-private-key failures before landing; final results are unchanged and clean: class statements 4,367/4,367 and object expressions 1,170/1,170 in both binaries.

Validation: focused Debug/TSan tier, compiler, semantic-barrier, and moving-GC tests; all 1,477 unit tests across the final binary partitions plus isolated scheduling-witness confirmation; BunPress build and 89-file link check.

The first acceptance item remains open: catch/class scope coverage has advanced, but shadowing, TDZ, and per-iteration closure lowering/differentials are not complete.

Lexical TDZ/const bytecode lowering landed on main in 88a3d794.

This slice adds lexical-slot metadata plus checked local/upvalue initialization, reads, and assignments. It preserves ReferenceError before initialization (including typeof, assignment-in-initializer, for (let value of value), and captured reads/writes), preserves TypeError for initialized const writes, resets hazardous block slots on re-entry, and holds frame-slot exclusions across each check/read-or-write. Declarations still perform InitializeBinding through the unchecked store. Ordinary proven-initialized let loops keep the existing opcodes and still reach native optimization; checked lexical opcodes fail closed above bytecode.

Forced tree-walker/required-bytecode witnesses compare exception class, side effects, result/state, repeated block entry, mutable post-init writes, and admission counters with zero fallback. Validation:

• focused Debug differential: 1/1
• focused TSan differential: 1/1
• compiler admission/opcode and ordinary-hot-loop guards: 2/2
• full unit suite: 1,487/1,487, 0 skipped/failed/leaked across 10 shards
• ReleaseFast test262: 48,506/48,506 valid + 4,669/4,669 negative, 0 skipped, 0 parse/runtime/host failures (53,175 configured total; 0 flips)
• threadfuzz default: 400 programs from seed 1, 0 failures
• docs link check: 90 files; BunPress build: 49 pages

The first acceptance item stays open. TDZ is now covered for unambiguous slots, but same-name block binding identity/shadowing and fresh per-iteration captured cells remain explicit tree-walker barriers; those need real frame/scope representation rather than flattened-slot workarounds.

Landed the lexical block-binding identity slice in https://github.com/zig-utils/zig-js/commit/dbe906d7bff89aa7f5aab0686196418322dbb0c2.\n\nThe bytecode compiler now assigns distinct activation slots to same-spelled block, for-head, for-of-head, switch CaseBlock, and catch bindings, restores the enclosing compile-time mapping on scope exit, and preserves the selected slot in nested-closure upvalues. Forced tree-walker vs required-bytecode differentials cover nested and sibling shadowing, captured mutation, enclosing-parameter restoration, inner-binding TDZ, loop heads, switch, and catch.\n\nValidation: full units 1,488/1,488; focused TSan differential 1/1; ReleaseFast test262 48,506/48,506 valid plus 4,669/4,669 negative, zero skipped and 0 flips; threadfuzz 400 programs / 0 failures; docs 49 pages and 90/90 link-clean.\n\nThe remaining lexical admission boundary is fresh per-iteration cells when a loop lexical is captured, so the first acceptance checkbox intentionally remains open.

Landed the next bytecode lexical-scope slice in https://github.com/zig-utils/zig-js/commit/aa6ced38be9d145b3d9126cb55d2d205f4337216.

Captured simple let/const heads in classic for and for-of now use real declarative environments with fresh cells per iteration; uncaptured heads retain the O(1) frame-slot path. The lowering establishes TDZ before classic initializers and for-of RHS evaluation, copies multiple classic head bindings in the specified order, and preserves the active environment across break, continue, return, throw, generator suspension, async/async-generator suspension, and class-member capture. The tree-walker TDZ ordering was corrected in the same logical change.

Measured evidence: 1,490/1,490 unit tests; focused TSan differential 1/1; ReleaseFast test262 48,506/48,506 valid plus 4,669/4,669 negative with zero skipped and zero flips; deterministic threadfuzz 400/400; docs 49 pages and 90 links.

The first checklist item remains open. Remaining per-iteration boundaries are captured destructuring heads, captured lexicals declared inside repeated loop bodies, and labeled jumps crossing multiple environment-owning loops. The wider dynamic-scope and suspension/debugger work in this issue also remains open.

Expanded the per-iteration bytecode slice in https://github.com/zig-utils/zig-js/commit/c1160fa79a1598fbef7e591a2e7c26cecb5d754f.

Captured yield-free array/object destructuring heads without default or computed evaluation now use the same fresh declarative-environment model as captured identifier heads. This covers classic for renewal, for-of array/object/rest binding, binding order, constness, TDZ before the classic initializer and for-of RHS, generator suspension, async suspension, and required-bytecode differentials against the tree-walker. Patterns requiring default/computed evaluation remain fail-closed on the exact tree-walker path; the compiler does not admit an enclosing function and then discover an unprepared nested template at runtime.

Measured evidence: 1,491/1,491 unit tests; focused TSan 1/1; ReleaseFast test262 48,506/48,506 valid plus 4,669/4,669 negative with zero skipped and zero flips; deterministic threadfuzz 400/400; docs 49 pages and 90 links.

The first checklist item remains open. Its remaining per-iteration boundaries are destructuring default/computed evaluation, captured lexicals declared inside repeated loop bodies, and labeled jumps crossing multiple environment-owning loops. The wider dynamic-scope, debugger, and suspension coverage in #465 also remains open.

Captured repeated-body lexical scopes and exact abrupt unwind landed on main in https://github.com/zig-utils/zig-js/commit/7c8b5eacdf1bb4d9862d352c10a8e3193450209e.

Captured declarations inside repeated loop bodies now receive fresh declarative environments at the actual nested block, catch, or switch scope that owns them. Yield-free array/object/rest destructuring without default or computed evaluation uses the same path. Each VM activation tracks environment depth, so ordinary and labeled break/continue unwind the exact crossed scopes both directly and through finally. Labeled for-of continues avoid IteratorClose, labeled breaks close exactly once, and consecutive iteration labels now work in both the tree-walker baseline and required bytecode. New environment-mutating bytecodes fail closed above bytecode until native frame states carry equivalent metadata.

Measured evidence: 1,493/1,493 units with 0 skipped/failed/leaked; focused TSan repeated-body and moving-GC regressions 2/2; ReleaseFast test262 48,506/48,506 valid plus 4,669/4,669 negative with 0 skipped, 0 parse/runtime/host failures, and 0 flips; deterministic threadfuzz 400 programs from seed 1 with 0 failures; BunPress 49 pages and 90 link files.

This removes the captured-body and labeled multi-environment boundaries from the previous update. The first acceptance item remains open intentionally: destructuring defaults/computed-key evaluation still retains the exact tree-walker path, and the wider dynamic-scope, debugger, no-GIL, and suspension matrix in this issue is not complete. No dependency or tooling-script changes were made; the owned Home and BunPress boundaries remain intact.

The remaining captured-pattern evaluation boundary landed on main in 6b60d843.

Defaults, computed keys, nested array/object patterns, and object rest now lower directly into the active per-iteration bytecode environment. For example, for (const {[key()]: value = fallback, ...rest} of inputs) stays in required bytecode while closures capture fresh value/rest cells. The lowering preserves RequireObjectCoercible before computed-key side effects, one ToPropertyKey coercion, exact IteratorClose, default anonymous-function naming, TDZ/const initialization, abrupt completion, and generator/async suspension. Unsupported native compilation still fails closed to the exact bytecode tier.

Evidence:

• focused VM/JIT plus relocation inventory: 184 JIT tests and 4 VM cases passed;
• full units: 1,494/1,494, zero skipped/failed/leaked;
• focused TSan: 2/2, no report;
• ReleaseFast test262: 48,506/48,506 valid + 4,669/4,669 negative, zero skipped/failures (53,175 total; 0 flips);
• threadfuzz: 400 programs from seed 1, 0 failures;
• docs: 90 link files clean and 49 pages built.

This completes the first #465 acceptance checkbox. The issue stays open for corpus/PR-249 VM witnesses with step and async-order evidence, the full no-GIL/debugger/moving-GC matrix, and #460 tier-attribution evidence.

Implemented and pushed a16c5634 (fix(vm): lower destructuring catch bindings).

This removes the bytecode admission fallback for catch binding patterns. For example, catch ({[key()]: value = fallback(), ...rest}) now lowers defaults, computed keys, nested patterns, rest, TDZ, iterator closing, and captured per-execution cells directly into required bytecode; generator/async suspension and moving-GC relocation are covered. Binding-time failures also now execute an enclosing finally before the new error propagates in both the VM and tree walker.

Validation: 1,496/1,496 unit tests; focused TSan suspension and moving-GC witnesses; 184 JIT tests; 4 focused VM cases; GC relocation inventory; threadfuzz 400 programs from seed 1 with 0 failures; docs link/build gates; ReleaseFast test262 48,506/48,506 valid + 4,669/4,669 negative, 0 skipped. Flips 0 test262 cases; no regressions.

The real-corpus VM witness gate landed on main in 7a831095.

zig build vm-corpus-witness now runs four exact Test262 programs through forced tree-walker and required bytecode, then runs PR-249 lifecycle/join-semantics.js with JIT disabled in both serialized and no-GIL contexts. The assertions cover result/exception identity, getter and iterator-close side-effect counts/order, async finally ordering, reverse mixed sync/async disposal, repeated/concurrent joins, and join synchronization. Required mode makes any program or nested-template fallback a hard failure.

The gate keeps Test262/PR-249 host scaffolding automatic and stamps each corpus-created function with its source tier contract across interpreter and direct VM activations. This also enabled object-literal accessors and top-level async templates in compiled programs. While proving the gate, the staging await-using witness exposed and fixed unhandled rejection bypassing remaining disposal; it now produces SuppressedError(firstDisposeError, secondDisposeError) in both tiers.

Evidence: 1,500/1,500 units, zero skipped/failed/leaked; normal and TSan corpus witnesses green, including no-GIL; focused TSan required/disposal tests green; threadfuzz 400 programs from seed 1 with zero failures; ReleaseFast Test262 48,506/48,506 valid + 4,669/4,669 negative, zero skipped/failures (53,175 total; 0 flips); docs 90 link files and 49 pages.

The corpus-witness acceptance item is now checked. The issue remains open for the wider focused gate matrix and #460 before/after tier-attribution evidence.

The tier/environment attribution needed for this issue has landed:

• Implementation: https://github.com/zig-utils/zig-js/commit/5c37571fbce30fa7ad9c3a6423ceaae784342d32
• Clean full-size evidence: https://github.com/zig-utils/zig-js/commit/70dede433f815c96e6e07963162434df245c9e25
• Report · raw JSON

The sidecar records tree-walker, VM, baseline/optimizer/OSR entries, deoptimizations, admission reasons, native publications, generated-code bytes, and environment allocations without enabling profiling in scored timing contexts. Base/variant parity is enforced for both tier sets and exact environment counts.

Current validation: 1,501/1,501 units; focused TSan attribution witness; 53,175/53,175 Test262; full representative attribution; benchmark harness self-tests; docs. I am leaving the remaining acceptance item open until the exact-parent before/after performance comparison and the rest of the no-GIL/threadfuzz/generator/debugger/moving-GC matrix are recorded.

#555 removes a false bytecode-eligibility barrier in 00a401d7: comments, strings, property names, and identifier substrings containing arguments/eval no longer set uses_arguments. A dedicated witness now produces identical tree-walker/required-bytecode result bits with one compiled template, zero arguments-policy rejection, and zero fallback. Real arguments and conservative direct-eval references remain protected.

Opened #615 for the bounded TDZ-admission complexity slice: exact parse-plus-compile growth witnesses first, then a single exhaustive pending-name traversal with unchanged conservative TDZ semantics. This is independent of the user-owned queues/jobs work.

Opened and implemented child #618 for a distinct remaining plain-function admission hotspot: repeated loop-body declarations were rescanning the full body once per binding. Benchmark-first commit 3fcd7f02 freezes ten structural rows; implementation 14ca5cd4 performs one compile-owned capture analysis while preserving slot/environment policy. Focused compiler, forced-bytecode, moving-GC, catch, and frontend gates are green; full/corpus/evidence closure remains on #618.

Compiler child #619 is implemented benchmark-first in be27ecd4 and 8bbbf402. Deferred class bodies now scan one exact set of ordinary/non-Environment frame slots instead of rescanning the full member surface per slot, while eager computed keys and Environment-backed captures retain their existing admission semantics. Ten structural/allocation controls, focused compiler/frontend gates, and the full 1,733-pass / 1-skip unit inventory are green. Exact isolated performance and Test262 accounting remain tracked on #619 before closure.

Opened #621 for a bounded plain-function admission cost: shadowing and TDZ classification independently rebuild the same binding inventory and rescan the same statement surface. It preserves every rejection/opcode decision and is benchmark-first.

Compiler child #621 landed benchmark-first in 3bc06b01 and 84efdae5. Plain-function admission now builds one binding inventory for shadow/TDZ decisions and proves no-lexical early exits exactly. Full units, compiler TSan, and 1,869 exact Test262 cases are green; guarded performance evidence remains on #621.

Closed #693 via b962e23d: object-produced StringData now crosses the byte-returning ToString path as canonical WTF-8 while preserving string-hint ToPrimitive order. Focused tier controls, full Debug/TSan, and exact computed-property-name Test262 accounting are green.

Bytecode-eligibility leaf #704 is complete in feat(compiler): lower nullish coalescing expressions (#704). General ?? expressions now compile across program, plain-function, generator, and async admission through the existing nullish VM branch. Forced tree-walker/required-bytecode, focused TSan, full 1,798/1/0/0 units, and exact 0/24 → 0/24 CoalesceExpression Test262 accounting are green.

Bytecode-eligibility leaf #705 is complete in feat(compiler): lower member logical assignments (#705). Ordinary named/computed &&=, ||=, and ??= now retain one Reference in plain, generator, and async activations with exact coercion/accessor/proxy/suspension order. Full 1,802/1/0/0 units, 12/12 TSan, 12/12 frontend, and exact 0/78 → 0/78 Test262 accounting are green. Direct program mode remains causally blocked by #706 rather than using shared scratch.

Landed the next independent compiler leaf in feat(compiler): lower member compound assignments (#707). Ordinary named/computed member op= references now compile in plain, generator, and async activations with one base/key/GetValue/PutValue sequence, exact coercion order, and suspension-safe activation-local state. Exact compound-assignment Test262 stayed byte-identical at 0 fail / 454 pass; focused TSan 6/6, frontend 12/12, full units 1,805 pass / 1 skip / 0 fail / 0 leak. Top-level program lowering remains explicitly behind #706; super writes remain receiver-aware future work.

Landed the member-update eligibility tranche in #708 via 1f925020. Ordinary named/computed prefix/postfix ++/-- now compiles for plain, generator, and async functions with one activation-local Reference, including suspension during key resolution. Exact Test262 stayed 142/142 before → after (0 flips/regressions); full units were 1,808 pass, 1 skip, 0 fail/leak. Program mode remains causally behind #706 and super remains explicitly unsupported.

Landed the tagged-template Reference tranche in #709 via ee0e0520. Computed member and named/computed super tags now compile across plain/generator/async bytecode, including tail position and suspended keys/substitutions, with no new opcode. Exact Test262 stayed 27/27 before → after; full units were 1,812 pass, 1 skip, 0 fail/leak.

Landed child #710 in e818a068: named/computed super calls now use receiver-aware proper-tail-call lowering, generator super spread uses the existing receiver-aware spread opcode, and tail spread retains its causal missing-op barrier. Relevant Test262 stayed 102/102 with byte-identical diagnostics; full units passed 1,814 / 1 skipped / 0 failed / 0 leaked.

Opened #711 for the next bounded eligibility tranche: ordinary non-tail spread calls and constructors can reuse the existing receiver-aware/direct/new spread opcode family across program/plain/generator/async modes. Direct-eval and proper-tail-spread barriers remain explicit; no new runtime primitive or job surface is in scope.

Related #711 landed in d1c8251b — feat(compiler): lower spread calls and constructors (#711): ordinary program/plain/generator/async spread calls and constructors now use the existing variadic bytecode family with exact receiver and evaluation ordering. Exact call/new/super Test262 remained 245/245 with byte-identical diagnostics and 0 regressions.

Optional-chain bytecode eligibility is now tracked in #712. It is scoped to compile-owned branch patching over existing nullish/member/call operations, with no program scratch or stacks/queues/jobs runtime changes.

Optional-chaining compiler lowering is complete in #712 and landed as ef067c10: all bytecode tiers, receiver/spread/suspension/indirect-eval/PTC coverage, full units green, and exact optional-chaining Test262 38/38 → 38/38 with zero regressions.

Opened #713 for the next bounded universal-bytecode lane: property/optional/non-Reference delete lowering across all compiler tiers, with bare identifier and super delete retained as causal environment/super barriers.

Child #713 is complete in 7a1932cf: named, computed, optional, and non-Reference delete expressions are now bytecode-eligible across program/plain/generator/async tiers. Exact Test262 stayed delete 69/69 and optional-chaining 38/38 with zero regressions; identifier and super deletion remain explicit causal barriers.

Child #714 is complete on main via ffeedf57: import.meta now has owned bytecode lowering across plain/generator/async module functions, exact declaring-module activation state, atomic lazy identity, moving-root relocation, and cached native-tier rejection. Evidence: 1,826 units passed (+1 established skip), focused TSan 6/6, frontend 12/12, and Test262 import-meta 22/22 → 22/22 with 0 regressions.

Child #715 is complete and landed on main in a5280fad. It lowers captured named/computed direct, logical, compound, and update super writes for plain and resumable bytecode, fixes tree-walker logical-reference retention, and caches exact native-tier rejection. Full units passed 1,830/1,831 with 1 expected skip; focused Test262 stayed 94/94 (super) and 485/485 (assignment), with 0 flips and 0 regressions.

SuperReference bytecode coverage advanced in #716, landed as e051fc45. Named/computed delete super now admits across plain and resumable tiers with exact GetThisBinding/key ordering, no ToPropertyKey, moving-GC coverage, and cached native rejection. Exact delete Test262 remains 69/69 with no regressions.

DeleteExpression bytecode coverage is now complete through #717, landed as c8e1b0c0. Bare identifier deletion now admits across program, plain, generator, async, and async-generator tiers with exact Environment/global resolution and bounded frame/upvalue fallbacks. Full units: 1,837 pass / 1 skip / 0 fail/leak; exact delete Test262 remains 69/69.

#718 landed in 4740df55, removing the class-heritage bytecode admission barrier across program, plain-function, generator, async, and async-generator tiers. The parent remains open for its broader compiler/JIT scope.

Child #718 (class heritage across bytecode tiers) landed in 4740df55: program/plain/generator/async/async-generator admission now covers ordinary, suspended, and awaited heritage with exact TDZ, single `prototype` observation, strict-class-code environment semantics, and moving-GC rooting. Focused 13/13, TSan clean, full units 1,840 pass / 0 fail, Test262 `expressions/class` + `statements/class` 8,426 cases with zero flips. Child #719 is in progress on top of it.

New scoped children: #720 (super member logical assignments — the remaining causal rejection noted by #705/#715) and #721 (program-mode member references via #706 scratch).

Child #719 landed in 2388fd77 — feat(compiler): lower proper tail spread calls (#719). Strict ordinary spread calls now retain terminal activation replacement across direct, member, optional, parenthesized-optional, and super forms with precise native roots. Full units were 1,844 passed / 1 skipped / 0 failed or leaked; focused TSan was 4/4; exact-parent call/optional/super/return Test262 stayed byte-identical at 240/240 with 0 regressions.

Child issue #724 is complete in 3c752e8c: yield-aware object assignment patterns now lower object-rest identifier/member/super targets while preserving PropertyName, Reference, CopyDataProperties, ToPropertyKey, and PutValue ordering. Focused normal and TSan passed; full units were 1,845 passed / 1 skipped / 0 failed / 0 leaked; the exact-parent Test262 assignment/dstr boundary remained 368/368 with 0 regressions.

#706 landed in be928fbd with #721 riding on it: program chunks now carry activation-local, GC-rooted scratch and top-level member references (logical/compound/update) admit across the VM. Remaining causal rejections at top level: optional-chain assignment targets and super references (#720).

#725 landed in 44371d94: program/plain/generator/async bytecode now shares an owned, GC-scanned for-in enumerator with live deletion checks, completion-safe cleanup, native bindings, and #706-backed program scratch. Exact for-in Test262 stayed 115/115 with 0 regressions; full units stayed green.

Opened #726 for the next bounded eligibility tranche: plain-function and method destructuring assignments should reuse the existing activation-local native pattern compiler rather than rejecting frame mode or executing bind_pattern through the tree-walker. The child owns exact iterator/reference/default/rest ordering and explicitly excludes stacks, queues, jobs, Promise, Worker lifecycle, and Map/Set iterator work.

Performance child #621 is now fully closed by 1a0cf6e2: exact 1K/2K/4K binding-inventory evidence validates the single-inventory implementation, with linear growth preserved and roughly 6% fewer retired instructions at every width. This does not close #465's broader bytecode-eligibility scope; active child #726 remains the next native-lowering tranche.

Child #726 landed in 525aa677: plain-function and method destructuring assignments now use activation-local native bytecode for frame/upvalue/global/member/super targets, with exact iterator and object-rest ordering and no bind_pattern callback. Focused normal/TSan/frontend gates passed; full units were 1,852 pass / 1 skip / 0 fail / 0 leak; exact assignment/dstr Test262 remained 368/368 with zero flips. #465 remains open for broader universal eligibility.

Opened #728 for the next bounded eligibility tranche: strict ordinary functions and methods can own their unmapped arguments exotic in one precise VM frame slot, while sloppy mapped arguments retain their separate live parameter-aliasing barrier. The child explicitly excludes stacks, queues, jobs, Promise, Worker, and Map/Set iterator work.

Progress: #728 is complete in feat(compiler): lower strict arguments objects (#728). Strict unmapped arguments objects now live in precise VM activation slots, including nested-arrow ownership, methods, constructors, recursion, moving GC, and native-tier fail-closed behavior. Exact relevant Test262 evidence stayed 1,323 -> 1,323 with 0 regressions. Sloppy mapped arguments and direct eval remain explicit Environment-backed barriers.

Opened #729 for the remaining sloppy mapped-arguments admission boundary after #728: exact frame-slot parameter maps, escape/GC lifetime, duplicate-formal mapping, severing, and no-GIL synchronization. It explicitly leaves direct eval and non-simple parameter prologues outside the claimed surface and excludes stacks/queues/jobs work.

26b8c248 lands #729: sloppy simple-parameter arguments owners now enter the VM with object-owned atomic mapped cells, exact severing, moving/concurrent GC edges, and automatic admission. Direct eval, non-simple parameters, legacy caller reflection, and native tiers remain explicit boundaries.

Opened compiler child #730 for the remaining plain-function destructuring declaration barrier. It owns frame-local var hoisting, exact block lexical predeclaration/TDZ, native BindingInitialization, mapped-formal stores, repeated-body environments, and for-in/of pattern heads. The implementation is locally green through focused normal/TSan differentials; full gates and exact Test262 accounting remain pending.

Named final rest parameters are now lowered into precise VM activation slots and #735 is complete on main via cadfab9b, with dedicated OOM restoration (742cbb8e) and shared-chunk no-GIL/TSan (48e2ab0f) witnesses. Defaults, destructuring, direct eval, derived-field ordering, and Annex B remain separate explicit barriers.

Audit follow-up #737 is complete in e71ce6cb: activation-eliding native calls now fail closed on non-simple parameter metadata. This protects #735 rest entry semantics and the upcoming #736 destructuring-formal prologue.

Initializer-free destructuring-parameter follow-up #736 is complete in e2ba5ac3. Plain VM frames now own hidden raw input slots and native BindingInitialization prologues; defaults, computed keys, pattern/rest mixing, direct eval, derived-constructor ordering, and Annex B block-function work remain explicit barriers here.

Primitive-literal default-parameter child #738 is complete in d95aaf63. Exact undefined selection now runs in the native VM entry stream beside #736 patterns. Shadowable source undefined, expression-bearing Initializers, nested pattern expressions, and rest mixtures remain explicit parameter-Environment/ordering barriers here.

Compiler coverage advanced in #739 via feat(compiler): lower closed default expressions (#739): closed primitive default-expression trees now use native VM parameter frames, with exact interpreter fallback retained for observable forms.

Invocation-context parameter coverage advanced in #740 via feat(compiler): lower invocation defaults (#740): bare this, new.target, and exact own arguments defaults now use ordered VM frames, while parameter-environment and constructor-policy barriers remain explicit.

Ordered parameter-frame coverage advanced in #741 via feat(compiler): lower earlier parameter defaults (#741): a bare reference to a strictly earlier formal now enters the VM without weakening self/later TDZ or outer-environment barriers.

Follow-on compiler slice #742 landed on main in 54c54afe. It composes the proven primitive (#739), invocation-context (#740), and earlier-parameter (#741) leaves through the existing safe unary/binary/logical/conditional/sequence grammar, with byte-identical Test262 results (10296 -> 10296) and full normal/TSan/no-GIL/OOM validation.

Follow-on compiler slice #743 landed on main in 1b7e8e58. It extends #742's proven parameter-safe grammar to non-optional public named/computed property reads while reusing canonical guarded VM [[Get]] execution. Test262 stayed byte-identical (10296 -> 10296); full normal/TSan/no-GIL/OOM and 400-iteration default/TSan threadfuzz gates passed.

Follow-on compiler slice #744 landed on main in 402e805a. It extends #743's proven parameter-safe value/property grammar to non-optional, non-spread value and member calls while reusing canonical receiver-aware VM execution. Test262 stayed byte-identical (10296 -> 10296); full normal/TSan/no-GIL/OOM and default/TSan threadfuzz gates passed.

#745 landed on main as feat(compiler): lower parameter construction defaults (#745). It extends the fail-closed plain-function grammar from #744 to recursively safe non-spread construction using canonical new_call, with exact Test262 accounting (10,296 -> 10,296; 0 flips), full units, no-GIL/TSan, OOM, and fuzz coverage. The next constructor-specific compiler boundary discovered by this work is tracked in #746.

The base-class instance-initializer slice #747 landed on main in d9d480d0. Required bytecode now owns the complete pre-parameter public/private/auto-accessor field prefix, computed Symbol/string keys, lexical field context, GC/OOM unwind, and shared no-GIL execution with no interpreter callback or hidden fallback.

Evidence: 8,426 → 8,426 relevant Test262 class cases with 0 failures/0 flips; full units 1,891 pass, 1 skip, 0 fail/leak; frontend 25/25; threadfuzz 400/0 normal and TSan. The remaining constructor boundary is derived super()/uninitialized-this activation semantics in #746.

Constructor eligibility milestone #746 is complete through #747 and #748. afb9ce2c removes the broad class-constructor policy barrier for complete derived activations, including super(), fields/brands, lexical arrows, completion, native exits, OOM/GC, and no-GIL state. Direct eval remains an explicit plain_rejected_unsupported_lowering boundary. The broader universal-bytecode work in this issue remains open.

The remaining ordinary-function direct-eval admission boundary is now decomposed as #771. The source audit confirms this is the broad uses_direct_eval rejection in plain-function and nested-template compilation: the VM already owns direct-eval call opcodes and realm semantics, but it does not yet expose exact mutable frame bindings to EvalDeclarationInstantiation. #771 requires an explicit activation binding view and forbids snapshots, eager heap allocation of every local, AST callbacks, globalized eval, or hidden fallback. It also excludes stacks/queues/jobs and related lifecycle work.

#771 advanced in c82295c2: ordinary VM activations now have compiler-described, GC-safe live binding views over exact frame slots. Admission remains fail-closed until lazy call-site materialization and the full direct-eval semantics are wired.

The direct-eval child advanced in f525dd46: ordinary VM activations now have lazy, rooted, failure-atomic Environment materialization over the live binding views introduced previously. #771 remains fail-closed while opcode threading and full eval semantics are completed.

The #771 bytecode boundary advanced in 03f7bc58: fixed, spread, receiver, and tail eval calls now have activation-aware plan-carrying opcodes with intrinsic-identity gating. Universal admission remains fail-closed pending declaration persistence and remaining context semantics.

Progress for #771: 1761996e retains atomically published ordinary-activation eval declaration environments, anchors inner eval at materialized defining frames, delays materialization until eval parsing succeeds, and traces/relocates the edge. Focused normal 3/3 and TSan 2/2 pass with no leaks. Broad VM admission remains closed pending re-entrant parent-cache refresh and the remaining parameter/named/runtime/debugger contexts.

Progress for #771: 9e9462a8 makes retained direct-eval activation Environments re-entrant, concurrent-publication safe, moving-GC rooted, and transactional across injected OOM. Focused materialization/opcode checks pass 2/2 normally and 2/2 under TSan with zero leaks. Universal admission remains closed pending the remaining context matrix.

Child #771 advanced in 4f792e14 and a74f2029: ordinary simple-parameter direct eval now runs from required bytecode over exact live activation bindings, including mapped arguments and persistent sloppy declarations. Incomplete ParameterEnvironment, method/constructor, and runtime-Environment contexts remain fail-closed. Focused compiler probes pass 4/4 and direct-eval units pass 16/16 in both normal and TSan modes; broader #771 acceptance and exact Test262 accounting remain pending.

Progress for the direct-eval bytecode tranche landed in c422cf78 and is tracked in #771. Runtime-created lowerable functions now honor required-bytecode mode, direct-eval TDZ state is present from function entry, and escaping eval/evalScript/ShadowRealm functions survive forced moving compaction. Focused evidence: direct eval 18/18 normal + TSan; ShadowRealm 5/5.

Direct-eval method and derived-constructor bytecode admission landed in b73106f4, tracked by #771. Required bytecode now preserves super, new.target, private names, and uninitialized this for these class contexts; focused direct-eval tests are 20/20 normal with the class differential passing under TSan.

Progress via #771: 52bde55a preserves Annex B.3.5 simple-catch Environment Record semantics for activation-backed direct eval in required bytecode, while destructuring catches remain conflict-checked. Focused direct-eval: 22/22; exact catch differential under TSan: 1/1; zero leaks; default test262 flips: 0.

Further #771 progress: b683c4b6 admits direct eval for rest-only and expression-free destructuring parameter lists while preserving unmapped arguments semantics. Default-bearing lists remain causally rejected until the separate parameter/body Environment Records exist. Focused direct eval: 24/24; exact differential under TSan: 1/1; zero leaks; default test262 flips: 0.

Related bytecode-eligibility progress landed in commit 1f594e7b via #776: ordinary default-parameter functions with body-only direct eval can now stay in required bytecode while preserving distinct parameter/body binding cells and exact dynamic shadowing. The required-bytecode differential reports no fallback/rejection for the covered functions. Full units are green (1,961 passed, 1 skipped), and the exact scored Test262 boundary set is 10/10 before and after.

Required-bytecode parameter-phase direct eval expanded in commit f49add08: 15 exact Test262 witnesses pass in both tree-walker and required-bytecode modes, including parameter eval records, parameter/body separation, and eval-var conflicts across declarations, expressions, and arrows. Full units are 1,964 passed / 1 skipped / 0 failed / 0 leaked; focused TSan, injected OOM, shared no-GIL, and 400-program threadfuzz gates are green. The six rest-pattern variants retain their explicit parameter-prologue rejection.

Commit 04913596 closes #776 and makes mixed/default/destructuring rest parameter prologues ordinary-bytecode eligible. Six previously barred Test262 required-tier witnesses now pass beside their tree-walker controls; the scored set remains 10/10 with 0 semantic flips, full units are green, and threadfuzz is 400/400. Native optimization remains deliberately fail-closed for the activation-owned tail descriptor, so this is a correctness/capability gain only.

Landed feat(vm): lower ordinary block function bindings (#788) directly on main as Chris, with no trailers.

Measured against cfef054: required-bytecode Annex B function-code witnesses 2/159 -> 159/159 (+157), each paired with a passing forced-tree-walker run. Default-tier Test262 results remain byte-identical: 3,024 passes, zero failures across twelve Annex B/eval/function/block/switch/with/loop subtrees; zero default-tier flips or regressions in that measured set.

Final full units: 1,998 pass / 1 platform skip / 0 fail / 0 leak. Allocation-failure checks: 35/35. Block-function checks: 6/6 in Debug, TSan and ReleaseSafe, including actual moving GC, no-GIL shared closures and interruption recovery. Seed-1 ReleaseFast threadfuzz: 400 default and 300 verify programs, zero failures.

The full run exposed an allocation-test fixture flaw: opportunistic arena backing-buffer resize changed the alloc count between fault replays. The fixture now explicitly refuses resize/remap so every growth allocation is fault-injected; production allocation is unchanged.

No performance claim or universal environment-mode claim: #790 retains two verified pre-existing global-switch failures and the remaining program/suspendable declaration work. Pushed integration remains pending.

The #790 environment-mode declaration tranche is now on main in 8d772d15, with separately landed GC ownership (#791) and realm identity (#793) prerequisites. Required-bytecode global Annex B witnesses improved 65/153 -> 153/153; all 469 direct/indirect eval witnesses remain passing in both forced modes. Default-tier reports are unchanged across 15 measured subtrees (3215 passes, one existing failure). Local full units: 2006 pass, 1 platform skip, zero failures/leaks; focused TSan and 700 fuzz programs pass. Required CI for the final commit is queued. Full evidence is in #790 and commit bodies; native stack/queue/job and Worker/Promise implementation remains untouched.

Advanced #465 with e1afde2d (#794): ordinary VM functions can now create nested generator/async/async-generator closures over live defining frame bindings. 52433f82 (#796) fixes the independent collector-lock/reentry bug exposed by full integration.

Combined local evidence: 2011 unit passes / 1 platform skip / 0 failures or leaks, 45 generator + 4 capture + 1 moving-GC TSan checks, and 700 seeded fuzz programs with zero failures. Six exact-parent Test262 subtrees retain 1642 passes and five unchanged failures, and 1388 positive paired-tier witnesses retain their results. The new dedicated nested-capture witness changes required mode 0/1 -> 1/1. Details and preserved failed-run accounting are in #794 and #796.

The five existing generator eval-parameter failures now have a concrete follow-up in #795. Current boundary text has been refreshed to include #790 and #794. No throughput claim or scheduler/stack/queue/job/lifecycle implementation change; pushed CI is queued.

#795 landed as e0ed6eb1: exact callee parameter metadata/strictness, complete destructuring initialization context, and body-entry restoration.

The seven generator/async-generator eval-parameter cases now pass. Across 13 measured subtrees, 11,487 pass / 7 fail became 11,494 pass / 0 fail; the paired required-bytecode corpus has those same seven gains and zero new failing paths. Its 369 pre-existing failures remain explicit, so this does not close the broader VM-admission work.

Full local units (2013 pass, one platform skip), focused ReleaseSafe/TSan, and 700 seeded fuzz iterations pass. Pushed CI is queued. The audit's remaining private-name/field-initializer context defects are tracked in #797; native stack/queue/job and lifecycle mechanisms were untouched.

Landed #797 in 8a1398ff — fix(eval): retain lexical private contexts across suspension (#797), directly on origin/main as Chris, without trailers.

This completes the private-name/field-initializer context follow-up discovered during #795: exact lexical capture for ordinary and suspendable functions, correct nested-class shadowing, parameter/resume context restoration, early rejection of unknown private names, and indirect-eval/dynamic-constructor isolation. Existing native stack, queue, job, and root ownership is reused unchanged; #791 remains separate.

Measured evidence: 24 paired-mode witnesses improve 5 -> 24 pass; all 18 measured Test262 diagnostic subtrees are unchanged (12,075 pass / 2 existing fail, zero flips or regressions in this scope). The 9,643 eligible positive paired corpus files retain 8,475 passes and the identical 1,168 existing required-bytecode failures. Full units: 2,017 pass, 1 skip, 0 fail/leak. ReleaseSafe + TSan passes private 4/4, parameter 47/47, generator 45/45 (overlap); 400 default + 300 verify seeded fuzz programs pass. The GC witness proves actual receiver relocation.

#797 has updated local acceptance and remains open for pending required CI. Evidence: /tmp/zig-js-797-context.2QwDxk/README.md. This does not claim the parent VM-admission goal is complete.

Landed e4f76af6 — feat(vm): admit parameter assignment expressions (#799) after numeric prerequisite d2ad8a8f (#800). Same 9,643-file paired inventory: 8,809/834 -> 8,838/805, +29 required-tier gains, zero regressions. Default-tier 11,494/0 unchanged. All 43 parameter + 16 numeric paired controls pass; full combined suite 2026 pass / 1 skip / 0 failures/leaks, TSan/no-GIL/OOM/moving tests and 700 fuzz programs pass. Exact source, counts and boundaries are on #799/#800. Descendant CI 33130214332 is queued; earlier #798/#800-only runs were superseded, not counted successful. New #801 has six actual moving-collection reproductions for remaining callee-local coercion and member-assignment roots. The broader goal remains open.

Follow-up uncovered by #801 testing: the following program passes both tiers, but wrapping that same program in an ordinary IIFE rejects the anonymous function with template_plain_rejected_unsupported_lowering in required mode (same at baseline e4f76af and the #801 draft, without GC). The program-tier reference/order regression now passes; the additional function-scope admission gap remains part of #465, not a GC pass.

(function(){
var log='',key={toString(){log+='key';return 'x';}};class A{set x(v){log+='A';this.saved=v;}}class B{set x(v){log+='B';this.saved=v;}}class C extends A{run(){return super[(log+='expr',Object.setPrototypeOf(C.prototype,B.prototype),key)]=(log+='rhs',Object.setPrototypeOf(C.prototype,A.prototype),4);}}var c=new C();var n=c.run();var result=n+':'+c.saved+':'+log;
return result;
})()

Retained before/after diagnostics: /Users/chris/.cache/zig-js-801.9pDs7h/{before,after}-super-base-witness.log. No fallback or production scope workaround was added.

Landed ab23a1bb — fix(gc): root reentrant coercion and assignment state (#801). Six actual-moving failures now pass; final coverage includes 63 moving cases, 2,031 units (one skip, zero failures/leaks), Debug+TSan/no-GIL/OOM/root mapping and 700 seeded fuzz programs. All 15,319 measured upstream passes are unchanged; local paired ordering controls improve 8/10 -> 10/10. Full evidence and boundaries are on #801; pushed CI 33133426218 is pending. Earlier #798/#799 are now closed after all 53 executed jobs passed CI 33130214332. Missing VM legacy introspection remains #802 and deferred class frame capture #803; native activation/job ownership #787/#791 is untouched.

Landed f83c4191 — feat(vm): retain live deferred class captures (#803) on origin/main. #803 now retains exact live defining-frame bindings for deferred classes, including later sloppy-eval bindings, without changing native stack/queue/job lifecycle. #804/#805 separately track construction receiver/class-state ownership fixed in the same validated change. Same 9,643 eligible positive paired Test262 files: four gains (statements/class/elements), zero regressions; 11,563 default-tier cases unchanged. Local 41/41 paired witnesses, 20 actual-moving cases, 2,037 full units plus one platform skip, focused TSan/no-GIL/OOM and 700 fuzz programs pass. Full pushed integration is pending in CI 33135419183; children remain open. #619 retains the distinct unfinished classifier-scaling evidence boundary; #802 and reserved native ownership audits are not claimed complete.

Landed f2340f27 for #806 with #807/#808 prerequisites. On the identical 9,643 eligible positive upstream files, required-bytecode passes rise 8,842 -> 9,633 (+791, zero regressions); all 13 default-tier reports remain unchanged. Final evidence and per-subtree counts are in #806. Remaining ten files are four Symbol method-name cases, four computed-class/private visibility cases, the private-field for-of assignment TypeError, and default derived-constructor call rejection; they remain visible, not excluded. Full Debug, focused Debug/TSan/ReleaseSafe, 28 actual-moving cases and 700 seeded fuzz programs passed. #810 is a separate unconfirmed Proxy metadata ownership audit. Current integration: https://github.com/zig-utils/zig-js/actions/runs/33137549779 .

Proxy metadata ownership/invariant repair #810 landed in 0ad2b5d9. All 46 actual-moving tier witnesses, 33 paired semantic controls, 4,048 upstream cases, 2,068 full Debug tests, focused Debug/ReleaseSafe/TSan variants and 700 seeded fuzz programs pass locally. Caller-side Object reflection/DefineProperty ownership remains in #811. Prior Linux collection-progress failures are tracked in #812; no full-CI-green claim is made.

Landed #811 in 81978f7b: reflection/copy/integrity caller roots, exact descriptor conversion/publication and nested Proxy validation. Local gates pass: 60 verified moving executions, 33 reflection + 26 Proxy tests in Debug and unsuppressed ReleaseSafe+TSan, full Debug 2101 pass / 1 platform skip, 4619 focused test262 cases unchanged across 21 subtrees, and 700 fuzz programs with zero failures. CI is queued; #811 remains open for it. #810 is closed after its completed workflow, with the sole unrelated no-GIL recurrence recorded in existing #722. The separately reproduced internal-descriptor conversion bug is tracked in #813. Native stack/queue/job and Promise/Worker implementations remain untouched.

Integration update: #813–#822 are now closed after their landed implementations passed terminal combined-main CI at e24c4fa: 53 checks succeeded, one nightly-only check skipped, zero failures/cancellations (https://github.com/zig-utils/zig-js/actions/runs/33211154123). Each issue has its implementation commit and scoped local/conformance evidence. Current uncommitted work is #823 (private realm Error identities and callback/GC roots) plus #826 (restriction enforcement across VM/native/quick/reflection paths). Focused Error tests and the first restriction matrix pass Debug and unsuppressed ReleaseSafe+TSan; the expanded checkpoint/GIL matrix passes Debug and the full 2,170-test sharded suite is running. #824/#825 remain separate follow-ups, not counted complete.

Admission-gate maintenance landed in 15431f24 — test(vm): require disposal bytecode in admission gates (#465). Program, generator, async, and nested parameter-initializer gates had stale rejection expectations even though explicit resource management already emits registration and completion-preserving disposal bytecode. The tests now verify those opcodes and an exact required-tier Symbol.dispose result. Focused checks: 4 compiler admissions plus 2 runtime witnesses pass; combined units 2214 pass / 1 platform skip / 0 fail / 0 leak. Production engine code is unchanged; the broader #465 work remains open.

Resolved child issue #847 in 58ed1311: computed class element names with own private identifiers are now required-VM eligible. The exact class-elements witness improved by 4 cases with 0 regressions (0 divergences / 1,534 agreements), with full unit, TSan/no-GIL, moving-GC, ReleaseSafe, direct-eval, and threadfuzz coverage.

Fresh exact-current (58ed1311) ReleaseFast census of the same six paired families used by #798/#799/#806 is now completely clean. Ordinary execution and required bytecode both pass 9,787 / 9,787, with zero failures and zero divergences:

• expressions/arrow-function: 343
• expressions/class: 4,059
• expressions/function: 264
• expressions/object/method-definition: 303
• statements/class: 4,367
• statements/function: 451

This reconciles the ten residual files reported by #806: #821 covers default derived-constructor call rejection, #838 owns execution-local for-of/yield-star protocol state, and #847 covers the four computed-private visibility cases; the Symbol-name cases also agree in the current aggregate. This proves the historical paired semantic admission boundary, but I am not closing #465 yet: its final exact before/after tier/environment-allocation acceptance still needs an auditable current comparison rather than inference from the clean corpus.

Environment-backed VM/tree-walker lookup parity was preserved by fix(runtime): seed environment binding maps (#850): 2,577 binding-heavy Test262 cases are byte-identical to the exact parent and required-VM reports 2,577 agree / 0 diverge. Direct-eval, TDZ, module live bindings, deletion, moving-GC, no-GIL/TSan, full units, and threadfuzz are clean. This removes the runtime default-hash surface without changing #465 admission policy; #465 remains open for its remaining universal-bytecode gates.

#1064 is complete in fd5baca: global-object Ordinary Get no longer leaks lexical/TDZ bindings or revives deleted builtin properties from the environment mirror. Persistent tree/required/shared-context tests pass 4/4 normally and under unsuppressed TSan; all 530 targeted global/declaration corpus cases remain byte-identical with zero failures.

The next Reference-resolution boundary is tracked as #1065 with an executed seven-assertion Node comparison. Identifier reads/typeof, strict/sloppy stores, inherited globals, and lexical-vs-property deletion still use stale root-mirror assumptions. The issue includes the canonical Reference/store pipeline and warmed global cache/proof checks, rather than another property-read workaround.

#1065 is complete: identifiers and captured global References now follow live object bindings, VM named stores share rooted Reference/PutValue handling, and lexical deletion is separate from object properties. Duplicate assignment helpers are removed.

The seven-assertion Node probe passes in tree/required modes. The broad global suite passes 39/39; focused normal/unsuppressed TSan tests pass 5/5 including an actual no-GIL worker. A published native global proof is tested across deletion, prototype mutation, and descriptor replacement. All 1,246 targeted global/declaration/delete/assignment/with/eval corpus cases remain byte-identical with zero failures.

Closed #1066 in d47d02c: corrected the private process/IPC fixtures to publish injected values as actual global object properties after #1064/#1065 removed environment mirror fallbacks. Both fixtures pass normal, ReleaseSafe, and unsuppressed TSan checks; the private ABI audit remains clean. Full CI is pending.

Closed #1067 in f86ff21: both conformance harnesses now publish host natives on the actual global object. The full packed wg-1.0 inventory exactly matches checked evidence in normal, ReleaseSafe, and unsuppressed TSan (18,795 pass, zero fail/crash, 475 exclusions over 73 files). The local smoke is restored to 33/33. #1068 is also closed in 1be5308: failed smoke runs now exit nonzero, verified with a one-case failure snapshot. Full hosted CI on the latest commit is pending.