Runtime: optimize owned string, RegExp, and JSON pipelines

Parent: #459 Depends on: #460, #465, #469

Goal

Build owned high-throughput string, RegExp, and JSON pipelines that are competitive with JSC across ASCII, UTF-8, UTF-16, Unicode-heavy, and adversarial inputs.

Scope

• Profile and optimize string representation transitions, flat/slice/rope/concat forms, interning/atomization, hashing, equality, search, replace, split, case conversion, normalization, iteration, and property-key conversion.
• Avoid repeated UTF-8/UTF-16 transcoding while preserving code-unit/code-point semantics, lone surrogates, normalization, locale behavior, and stable embedding views.
• Extend the owned zig-regex integration with reusable compiled plans, literal admission, capture storage reuse, one-pass/DFA/backtrack selection, replacement expansion, Unicode sets/properties, and bounded failure behavior.
• Add a streaming or iterative owned JSON parser/stringifier fast path with exact reviver/replacer/toJSON/property-order/cycle/BigInt/error semantics and bounded nesting.
• Expose tier/runtime/allocator counters and memory profiles for these pipelines.

No-workaround rules

• No system regex/JSON library, ICU, JSC/V8 code, third-party parser, invalid Unicode shortcut, omitted capture/replacer behavior, or input-specific precomputation.
• Cache keys and lifetimes must be bounded, content-correct, realm-safe, and no-GIL synchronized.

Acceptance

• #460 includes small/large, ASCII/Unicode, flat/rope, match/no-match/pathological, parse/stringify, and callback-observable rows.
• test262, Unicode/CLDR generators, regex dependency tests, fuzzing, OOM, deep input, GC, no-GIL, and TSan pass.
• Exact-parent profiles prove lower conversion/allocation/backtracking/hash/dispatch cost with bounded memory.
• Every accepted direct JSC comparison row wins on the declared host with exact output/checksum equality.
• build.zig.zon retains only the owned local zig-regex dependency for regex semantics.

Foundation

Current canonical semantics live in src/value.zig, src/jsstring.zig, src/interpreter.zig, and the sibling ../zig-regex package.

Landed the reusable RegExp execution slice in two main-branch commits:

• zig-regex 0da6eb2 adds absolute-offset Matcher.findFrom while preserving original-input anchor semantics and reusing Thompson VM scratch.
• zig-js 549ff01f keeps one matcher per interpreter/compiled RegExp, routes exec/test/split/replace through it, and releases every owned Match metadata result.

The representative variant /id=(\d+);\s+state=([a-z]+)/ was rebuilding a Thompson VM for every global exec call because character-class sets do not take the one-pass path. In shared-realm mode those temporary allocations serialized on the shared arena.

Measured diagnostic impact with the frozen checksum unchanged:

• quick 4-lane / 40-job variant: about 12 s -> 0.96 s; arena contention 887,532 -> 1,127; spins about 1.50 billion -> 0.99 million; peak RSS about 1.59 GB -> 455 MB;
• full 4-lane / 800-job variant now completes in about 40 s with 1.48 GB peak and 76 MB retained RSS; the previous implementation produced no 4-lane checkpoint after about 30 minutes;
• full 8-lane / 800-job variant completes with checksum 1,643,904,000, 1.12 GB peak RSS, and 123 MB retained RSS.

Validation: zig-regex 49/49 build steps; zig-js 1,503 unit tests with 0 skipped/failed/leaked; benchmark-comparison-test; exact full 4- and 8-lane V15 rows.

This advances the reusable-plan, capture-lifetime, bounded-memory, and shared-realm portions of #473. The issue remains open: the 8-lane row still reports material shared-arena contention, and the broader string/JSON, Unicode/adversarial, fuzz/OOM/TSan, exact-parent, and direct-JSC acceptance work is not yet complete.

Follow-up publication evidence for the reusable RegExp matcher work is now on main in 96220688: report, raw artifact.

The clean full-work V15 run completed all 510 phase snapshots in one exact-identity segment. Every shared RegExp base/variant row passed at 1/2/4/8 lanes with frozen checksum, tier, environment, worker, allocation, GC, CPU, and RSS validation. The eight-lane variant records checksum 1,643,904,000 and retained RSS 1,018,609,664 bytes.

The same row still records 740,010 invocation arena contentions and 47.69 billion spins in the standalone diagnostic probe, so this is not being presented as completion of #473. It closes the specific per-call VM-construction and Match-lifetime defect with full-matrix evidence; shared allocator pressure plus the remaining string/JSON, Unicode/adversarial, fuzz/OOM/TSan, exact-parent, and direct-JSC acceptance work stays open.

Implemented the next RegExp parser boundary in zig-regex 7196733, with downstream coverage in zig-js e8432679. Ordinary legacy and /u character classes now accept an unescaped opening bracket as ClassAtomNoDash; /v continues to reserve it for class-set syntax. Validation: zig-regex 49/49 build steps; focused zig-js boundary test passed with zero leaks. The exact unmodified Octane RegExp row now parses and begins running; it next exposes a separate runtime call failure tracked under #504, so this is a staged conformance gain rather than closure evidence.

The Octane follow-through exposed and fixed a second general RegExp invariant in zig-js 72745298. RegExp literals and internal RegExpCreate operations no longer inherit an enclosing constructor new.target; they allocate from the current realm intrinsic, while actual RegExp construction retains its explicit new.target-aware path. Before the fix, a literal such as /^ba/ inside a constructor received that constructor prototype and lost .exec. Coverage exercises both a compiled function constructor and a class-constructor/tree-walker shape. Validation: 18 RegExp-focused unit tests passed with zero leaks; test/language/statementList remained 80/80. Together with zig-regex 7196733, the exact unchanged Octane RegExp row now completes and validates its expected output in both isolated score and separate attribution modes.

#515 is complete on main in e7d430f. JSON.parse, JSON.rawJSON, and reviver traversal now fail hostile recursive nesting through the existing native/logical stack contract instead of overflowing the process stack. The 50,000-array reproduction changed from SIGSEGV/139 to exact RangeError, JSON.parse remains 77/77, and Debug/ReleaseSafe/TSan plus the full 1,545-test unit inventory are green.

Completed the next owned-string/JSON slice in #516. 88b5b169 makes validated unescaped JSON values and keys borrow their source slice until the runtime establishes final ownership, removing one scratch allocation and byte copy per plain string. b0bcc993 records two exact-parent rows at 0.9787x / 0.9786x retired instructions; wall time remains diagnostic-only and peak RSS is mixed. JSON test262 stays 165/165.

Closed #517 with a spec-shaped JSON Parse Record tree in 535d5cda, replacing the global reviver-source scan while keeping the no-reviver path allocation-free. Exact-parent evidence records 0.188x wall time, 0.1248x retired instructions, and 37.2 MB vs 46.3 MB median peak RSS on the callback-observable width row. JSON.parse test262 remains 77/77.

The #518 escaped-value ownership experiment was measured and rejected, not retained. The managed-backing handoff regressed the seven-pair decision row to 1.021x wall, 1.0017x instructions, and higher peak RSS, so 5a86e04 restores the prior parser/GC path exactly. The workload remains in 9961a43 and the rejected raw evidence is recorded by 500e67a for a future owned string-builder design.

Completed another runtime-pipeline item in #519. JSON.stringify replacer PropertyList construction now preserves specification ordering while using an invocation-local hash index instead of a quadratic duplicate scan. The isolated workload improved to 0.038x wall time and 0.0336x instructions; complete-pipeline instructions improved to 0.8661x. Exact follow-up evidence also drove a bucket-lifetime correction, reducing median peak RSS from 45.5 MB to 34.3 MB. Commits: https://github.com/zig-utils/zig-js/commit/c823cfba, https://github.com/zig-utils/zig-js/commit/2e48c838; evidence: https://github.com/zig-utils/zig-js/commit/11833827.

#537 completes another owned-string/frontend boundary. Template cooked values now avoid per-byte arena growth and redundant copies for plain quasis, while escaped and normalized text retains exact owned semantics; tagged raw strings and invalid-escape undefined are preserved. Exact-parent ordinary instruction ratios are 0.816x/0.803x/0.800x at 1K/2K/4K, with escaped/tagged controls at 0.887x/0.924x and identical checksums. Validation and commit links are recorded in #537; #473 remains open for its broader runtime string/RegExp/JSON acceptance work.

Child #556 is complete. JSON.stringify active-cycle membership now uses a shallow-lazy, relocation-stable exact identity index with full OOM/GC/TSan/test262 coverage. Exact-parent evidence: https://github.com/zig-utils/zig-js/commit/ac9dc52b . The real depth-4096 cycle retired 0.3688x instructions; the separately exposed nested-output recopy cost is tracked in #558.

Child #558 is complete. Runtime 3ec9847f removes recursive nested-output copying; evidence 61652299 records the exact-parent result. At JSON.stringify depth 4,096, retired instructions fell to 0.2341x and median peak RSS to 0.0311x, with Test262 remaining 66/66. Next adjacent JSON work is tracked in #557.

Child #557 is complete. Benchmark 98972688, runtime a7da43f4, and evidence 6dbe188f replace per-byte JSON.stringify appends with exact bulk ordinary runs. Stable retired-instruction ratios are 0.9560x/0.9565x at 16K/64K plain width and 0.9575x for sparse mixed escapes; Test262 remains 66/66.

Frontend child #560 is complete in 8dc1c182, with dependency OOM rollback coverage in zig-regex#20. Parse-time RegExp plans no longer remain in the long-lived AST/context arena; validation stays eager and exact-parent RegExp test262 remains 2,117/2,117 across the two measured subtrees. Runtime search-input conversion remains separate work under this parent.

Child #561 is complete in benchmark d51b6a7f and runtime e96196c8. RegExp search-input preparation now performs zero conversion allocations for ASCII, BMP, lone-surrogate, and /u/v no-op inputs; astral expansion is one overflow-checked bounded allocation. Exact-parent medians improve across all four controls and RegExp test262 remains 2,117/2,117 across the measured subtrees.

Child #562 is complete in benchmark e7df6540 and runtime 034e431c. UTF-8 egress now borrows already-valid input and uses one bounded allocation only for surrogate transformation. Exact-parent TextEncoder controls improve 14.4%–47.3%; full units and adjacent URI encoding conformance remain exact.

Opened #599 from the post-#597/#598 current-main cold profile. Managed string construction is now the dominant active engine leaf: 1,437 five-second top-of-stack samples map to the byte-serial cached contentHash, versus 318 in the next engine leaf. The child preserves exact byte collision resolution and all WTF-8/representation semantics; lifecycle/jobs work is excluded.

Child #599 is complete via 043f9788. Deterministic XXH3 plus vectorized ASCII/Latin-1 classification removes the serial FNV hotspot while exact bytes remain authoritative on collision. Exact-parent cold median improves 19.44%, cached hash/classification profile leaves fall 40.2%, and all 7,870 measured String/RegExp/JSON/Temporal test262 cases remain exact.

Opened #600 from the post-#599 staged profile. Managed string inputs are still scanned independently for surrogate presence (242 sampled leaves) and ASCII/Latin-1 classification (115 leaves). The child fuses those exact facts into one vector pass and reuses the immutable classification across canonicalization/hash flags; byte equality, WTF-8 folding, ownership, and OOM rules remain unchanged.

#600 was measured and rejected with no code landed. The fused WTF-8 classification/canonicalization candidate was -0.802% across 101 alternating cold-start pairs but only -0.010% on a dedicated 1,000-iteration strings workload, and sampling showed no material collapse in total relevant leaf work. Full details are recorded on #600.

Opened #601 from the post-#599/#600 exact-main profile. Temporary managed strings still eagerly pay XXH3 at construction even when never compared; the representative strings profile samples the hash path but no StringCell.eql leaf. #601 keeps classification eager and uses the existing metadata word for a race-safe first-equality cache, with exact bytes authoritative.

Child #601 is complete via 8dd7605d. Uninterned temporary strings now defer deterministic XXH3 until first equality while keeping classification eager and exact bytes authoritative. Exact-parent cold median improves 18.06% (101/101 wins), the dedicated strings row improves 0.615% (20/21), sampled construction hash leaves fall 38 -> 0, and 7,870 affected test262 cases remain exact.

Opened #602 from the post-#601 current-main cold profile. Resolved typeof still allocates a managed runtime string for one of eight spec-fixed spellings; #602 returns immutable static cells through the shared applyUnary boundary and keeps exact HTMLDDA/callable/Symbol/BigInt classification.

Child #602 is complete on main via e9d641d3. Resolved typeof now returns one of eight immutable static StringCells at the shared unary boundary, eliminating a managed cell and backing allocation per evaluation. The exact 4,480-operation workload removed 8,961 cumulative cells and 573,504 GC-cell bytes including warmup; 41 paired samples improved median time by 1.299% with 41/41 candidate wins. Exact test262 typeof remained 16/16 and the full unit gate was clean.

Opened #622 for a correctness and adversarial-complexity defect in String search predicates. includes/startsWith/endsWith currently interpret UTF-16 positions as WTF-8 byte offsets; #622 owns exact code-unit semantics plus a bounded-linear non-ASCII matcher while preserving the allocation-free ASCII path.

Opened dependent child #623 for indexOf/lastIndexOf. Their positions/results are nominally UTF-16 today, but the match itself is still raw WTF-8 bytes; it will reuse #622’s exact matcher and add a bounded-linear last-match scan.

Child #622 is complete on main via 287550f8. includes/startsWith/endsWith now use exact UTF-16 positions, with allocation-free ASCII matching and bounded-linear non-ASCII matching backed by freeable scratch. Exact Test262 remained 75→75 with zero flips; full units and normal/TSan private-ABI matrices are green. Numeric search continues in #623.

Dependent child #623 is complete on main via 9a167534. indexOf/lastIndexOf now return exact UTF-16 code-unit indices, including astral halves and lone surrogates, with allocation-free ASCII matching and bounded-linear freeable KMP scratch for non-ASCII. Exact Test262 remained 72→72 with zero flips; full units and focused TSan are green.

Tracked the remaining plain-string UTF-16 search/output gap as #624. It reuses the exact matcher from #622/#623 for replace, replaceAll, and non-empty string split, while retaining the ASCII fast paths and bounded-linear matching.

Closed #624 via e3f2ea45: plain-string replace, replaceAll, and split now use exact bounded-linear UTF-16 matching with ASCII fast paths. Exact affected Test262 stayed 220→220 with zero failures/flips; full units 1,738 passed, 1 skipped.

#664 tracks a representation-boundary correctness defect in JSON.stringify: the string gap is currently truncated to 10 WTF-8 bytes instead of the first 10 UTF-16 code units. The fix keeps ASCII allocation-free and preserves exact astral/lone-surrogate behavior without third-party conversion.

Child #664 is complete on main via 0052b2aa: JSON.stringify string spacing now truncates by UTF-16 code units, including canonical split-astral handling and bounded flat-Latin-1 conversion. Full units: 1,754 passed / 1 skipped / 0 failed / 0 leaked. Relevant Test262: 66 -> 66 passing.

Opened #665 for the next independent string-representation gap: String exotic reflective descriptors still use backing-byte lengths/slices, diverging from the existing UTF-16-aware ordinary get/own-key paths. Scope includes primitive/boxed descriptors, compatible immutable redefinition, CopyDataProperties, and O(1) ASCII/flat-Latin-1 indexing. It excludes all user-owned job and Map/Set iterator surfaces.

Child #665 is complete on main via f30b9e0b: String exotic descriptors and primitive spread/rest now use exact UTF-16 code units across flat Latin-1 and canonical WTF-8, with linear iteration and canonical surrogate materialization. Full units: 1,755 passed / 1 skipped / 0 failed / 0 leaked. Relevant Test262 remains 2,641/2,641 passing.

Opened #666 for the next independent StringCell boundary: String.prototype.toString/valueOf currently rewrap physical asStr() bytes instead of returning [[StringData]]. The child requires the spec-direct Value return, zero allocation/transcoding, representation coverage, and unchanged realm-correct brand errors.

Completed child #666 via 4c922933 and fa4d29cd: String.prototype.toString/valueOf now return existing StringData Values by identity, removing one StringCell rebuild per successful call. Canonical and physical flat-Latin-1 witnesses passed with zero allocations; Test262 14/14 and full units 1,756 passed, 1 skipped, 0 failed/leaked. #666 is closed.

Opened #667 for a remaining StringCell representation boundary: Abstract Relational Comparison still treats physical asStr() storage as canonical WTF-8. The child reuses the representation-aware UTF-16 iterator, keeps streaming comparison allocation-free, and requires canonical plus physical flat-Latin-1 witnesses.

Child #667 is complete via 75e56136: relational String comparison now streams exact representation-aware UTF-16 units, and canonical String search shares the same iterator implementation. Canonical and physical flat-Latin-1 tree-walker/VM witnesses passed 2/2 each with zero comparator allocation; Test262 184/184 and full units 1,758 passed, 1 skipped, 0 failed/leaked.

Opened #668 for the next StringCell representation boundary: dynamic-code parser ingress still consumes physical bytes. The child borrows canonical/ASCII storage, converts only physical flat Latin-1 to WTF-8, and covers eval, realm/ShadowRealm evaluation, and Function-family constructors with exact OOM behavior.

Child #668 is complete via 355329dc: dynamic-code parser ingress now borrows canonical/ASCII StringCell bytes and performs one bounded conversion only for physical flat Latin-1. Eval/realm/ShadowRealm/Function-family witnesses passed under both layouts; Test262 620/620 and full units 1,760 passed, 1 skipped, 0 failed/leaked.

Opened #669 for a remaining owned-output boundary: Object.prototype.toString concatenates custom Symbol.toStringTag from physical bytes. The child writes canonical/flat content directly into one exact final buffer, avoiding both invalid flat bytes and a temporary transcode allocation.

Child #669 is complete in 170aa4a8: custom Object.prototype.toString tags now compose into one exact final representation-aware StringCell backing, including managed-GC accounting and flat-Latin-1 canonical hashing. Test262 is 41/41 with zero flips; full units are 1,764 pass + 1 skip with zero failures/leaks; focused managed-GC TSan is clean.

Child #671 is complete in da430db1: structured-clone String fields now use one representation-aware canonical wire writer. The physical flat-Latin-1 path is allocation-exact and failure-atomic, with the global storage switch still intentionally unchanged.

Opened #672 for the next independent StringCell boundary: private ABI decoded String values are still exposed through physical bytes to canonical property-key, atom, URL/form, module-source, time-zone, and Error consumers. The child preserves borrowed ASCII/canonical paths and requires one bounded flat-Latin-1 conversion with exact OOM/ABI behavior.

Child #672 is complete in df57cd7e: decoded private-ABI String values now cross into semantic byte consumers through one canonical WTF-8 boundary, borrowing ASCII/canonical storage and bounding future flat-Latin-1 conversion.

Opened #675 for the remaining JSON StringData reader migration: primitive/boxed replacer keys, boxed gap coercion, and JSON.rawJSON payload emission still interpret physical asStr()/toStringV bytes as canonical. The child preserves borrowed ASCII/canonical paths and will verify exact output under the real flat-Latin-1 storage switch.

Landed child #675 via fix(json): canonicalize StringData readers (#675). JSON replacer PropertyLists, boxed gaps, and raw JSON validation/emission now cross representation-aware WTF-8 boundaries. Test262 stayed stringify 66/66 and rawJSON 10/10 with 0 flips; full units were 1768 pass, 1 skip, 0 fail, 0 leak.

Opened #676 for the four remaining direct string-result builders that append physical ToString bytes: String.raw substitutions, Array toLocaleString, TypedArray join, and TypedArray toLocaleString. The child preserves single coercion and exact ordering while making the output boundary representation-aware.

Landed child #676 via fix(string): canonicalize ToString result builders (#676). String.raw and Array locale builders now preserve non-ASCII physical StringData through one representation-aware output boundary. The four affected Test262 subtrees stayed 113/113 with 0 flips; full units were 1769 pass, 1 skip, 0 fail, 0 leak.

Opened #677 for the remaining global numeric-parser StringData boundary. parseFloat and parseInt currently scan physical ToString bytes, so flat Latin-1 U+00A0 can incorrectly block the numeric prefix; the child preserves exact coercion and grammar while canonicalizing only at scanner ingress.

Landed child #677 via fix(number): canonicalize parser StringData (#677). The global numeric scanners now preserve non-ASCII ECMAScript whitespace from physical flat Latin-1 StringData while retaining one input coercion and parseInt input-before-radix order. Test262 stayed 109/109 with 0 flips; full units were 1770 pass, 1 skip, 0 fail, 0 leak.

Opened #678 for the RegExp construction/state half of the StringData audit: constructor flags, compile pattern/flags, generic toString source/flags, and legacy input. Symbol protocols remain separate so their observable coercion and lastIndex ordering can be verified independently.

Opened #679 for the RegExp symbol-protocol half of the StringData audit: match/matchAll/replace/split flags, replacement templates, and String matchAll/replaceAll flag checks. This is deliberately separate from #678 so lastIndex, species, replacement-token, and dispatch ordering receive their own witness.

Landed child #678 via fix(regexp): canonicalize construction StringData (#678). RegExp constructor/compile/toString/legacy state now crosses representation-aware WTF-8 boundaries with exact ordering preserved. Targeted Test262 stayed 45/45 with 0 flips; full units were 1771 pass, 1 skip, 0 fail, 0 leak. Protocol follow-up remains #679.

Landed child #679 via fix(regexp): canonicalize protocol StringData (#679). RegExp match/matchAll/replace/split and String replaceAll/matchAll now cross representation-aware WTF-8 boundaries with exact dispatch and replacement coercion order preserved. Affected Test262 stayed 263/263 with 0 flips; full units were 1772 pass, 1 skip, 0 fail, 0 leak.

Opened #680 for the shared Annex B CreateHTML attribute boundary used by anchor, fontcolor, fontsize, and link. It preserves one coercion and quote escaping while canonicalizing only the attribute bytes appended to output.

Landed child #680 via fix(string): canonicalize CreateHTML attributes (#680). Annex B anchor/fontcolor/fontsize/link now preserve non-ASCII physical StringData through the shared attribute boundary while retaining receiver order and quote escaping. Test262 stayed 28/28 with 0 flips; full units were 1773 pass, 1 skip, 0 fail, 0 leak.

Opened #681 for the TextEncoder.encodeInto ingress mismatch. encode already uses canonical WTF-8; encodeInto still decodes physical ToString bytes and can emit U+FFFD for valid flat Latin-1 input. The child preserves UTF-16 read and byte written accounting.

Landed child #681 via fix(encoding): canonicalize encodeInto StringData (#681). TextEncoder.encodeInto now matches encode for physical flat Latin-1 input with exact UTF-8 bytes and read/written accounting. Test262 has no TextEncoder Web API inventory, explicitly recorded; full units were 1774 pass, 1 skip, 0 fail, 0 leak.

Opened #682 for DOMException persistent StringData. Message and name currently enter stored exception state as physical ToString bytes; the child preserves message-before-name coercion and canonicalizes only at storage ingress.

Landed child #682 via fix(domexception): canonicalize stored StringData (#682). DOMException name/message persistent state now preserves physical flat Latin-1 text with exact message-before-name coercion. Test262 has no DOMException Web API inventory, explicitly recorded; full units were 1775 pass, 1 skip, 0 fail, 0 leak.

Opened #683 for the three remaining Response StringData boundaries: constructor and JSON statusText storage plus redirect URL parsing. Core URL/Request URL ingress is already representation-aware; broader Request option strings remain separate.

Closed #683 via https://github.com/zig-utils/zig-js/commit/58c0544: Response constructor/JSON status text and redirect URL inputs now cross canonical WTF-8 boundaries, with single-coercion and forced-flat-storage witnesses. Focused Debug/flat/ReleaseSafe/TSan passed 1/1 each; full units 1776 passed, 1 skipped, 0 failed, 0 leaked. Test262 has 0 Response Web API files, so no corpus claim.

Opened #684 to make Event/CustomEvent persistent type strings and EventTarget listener type comparison independent of physical StringData representation. Scope excludes promise jobs, queues, workers/threads, and Map/Set iterators.

Closed #684 via https://github.com/zig-utils/zig-js/commit/965b5d1: Event/CustomEvent type persistence and EventTarget listener dedup/remove/dispatch comparisons now use canonical, representation-aware StringData boundaries. Focused Debug/flat/ReleaseSafe/TSan passed 1/1 each; full units 1777 passed, 1 skipped, 0 failed, 0 leaked. Test262 has 0 DOM Events Web API files, so no corpus claim.

Opened #685 for the default Array sort/toSorted string comparator: reuse the engine UTF-16 code-unit comparator instead of ordering WTF-8 bytes, while preserving exact ToString order. Baseline Test262 sort subtree is 54/54 and lacks the astral/BMP case.

Closed #685 via https://github.com/zig-utils/zig-js/commit/5c3bcc8: Array sort/toSorted default comparison now streams UTF-16 code units from retained string Values, and toSorted shares undefined-last CompareArrayElements semantics. Focused Debug/flat/ReleaseSafe/TSan passed 1/1 each; full units 1778 passed, 1 skipped, 0 failed, 0 leaked. Test262 stayed sort 54/54 and toSorted 21/21; flips 0.

Opened #686 for Error.prototype.stack materialization: stored message and explicit sourceURL Values must be read through canonical WTF-8 rather than raw physical bytes. Baseline dedicated Test262 stack subtree is 35/35.

Closed #686 via https://github.com/zig-utils/zig-js/commit/63baccc: Error.prototype.stack now composes stored message and explicit sourceURL through representation-aware WTF-8 reads. Focused Debug/flat/ReleaseSafe/TSan passed 1/1 each; full units 1779 passed, 1 skipped, 0 failed, 0 leaked. Test262 stack stayed 35/35; flips 0.

Opened #687 for computed-property display names: storage keys already canonicalize correctly, but NamedEvaluation/SetFunctionName re-read the coerced string Value through raw physical bytes. Baselines are object expressions 1170/1170 and class elements 1534/1534.

Closed #687 via https://github.com/zig-utils/zig-js/commit/d02a791: NamedEvaluation/SetFunctionName now reads computed property display names through canonical StringData while preserving one ToPropertyKey coercion. Focused Debug/flat/ReleaseSafe/TSan passed 1/1 each; full units 1780 passed, 1 skipped, 0 failed, 0 leaked. Test262 object expressions stayed 1170/1170 and class elements 1534/1534; flips 0.

Opened #688 for FormData stored entry names: the USVString ingress is canonical, but the shared reader exposes raw physical bytes to lookup/mutation, iteration, private entry access, and URL-encoded serialization. The private C API File filename boundary remains separate.

Closed #688 via https://github.com/zig-utils/zig-js/commit/d162963: all stored FormData entry-name consumers now use representation-aware canonical StringData. Focused Debug/flat/ReleaseSafe/TSan passed 1/1 each; full units 1781 passed, 1 skipped, 0 failed, 0 leaked. Test262 has 0 FormData Web API files, so no corpus claim.

Opened #689 for standards-correct validation, Web IDL ordering, inheritance, and canonical integrity across the RequestInit state already exposed by the engine. Opened related #690 for the currently missing referrer/referrerPolicy/signal/duplex/priority/window state so those members are implemented explicitly rather than ignored.

RequestInit validation and inherited exposed state landed in fix(request): validate and preserve RequestInit state (#689). #689 is closed; the remaining RequestInit members continue under #690.

RequestInit completion child #690 is now implemented and closed by 41639826: full dictionary ordering/state, dependent AbortSignal semantics, referrer policy, duplex/stream validation, and locked-source replacement behavior. Full units are green (1784 passed, 1 skipped, 0 failed/leaked). Header mutation guards remain isolated in #691.

Headers guard support is now complete via #691 and 1a0cc2be.

This adds all Fetch guard states, atomic forbidden/no-CORS mutation enforcement, correct Request/Response guard installation and cloning, privileged Range cleanup, and exact ByteString conversion. Evidence: focused WPT-derived coverage passes in Debug, forced-flat, ReleaseSafe, and TSan; full suites pass at 1789/1/0/0 Debug and 1788/2/0/0 TSan (passed/skipped/failed/leaked). The exact Test262 Request/Headers/Response filename inventory is empty, so the measured Test262 flip count is 0.

Closed the remaining private name/class diagnostic StringData boundary in #692 via 09941fcd. The physical flat-Latin-1 witness now proves non-ASCII callable names, class names, and tags reach private C/ABI consumers as canonical WTF-8, including exact OOM propagation. Full units and TSan pass with no failures/leaks; the affected private-export Test262 inventory is empty, so flips are 0.

Closed #693 via b962e23d: the shared Value.toString byte boundary now returns canonical WTF-8 for every StringData representation, with zero-copy canonical storage, bounded flat-Latin-1 conversion, explicit OOM, exact ToPrimitive ordering, full Debug/TSan gates, and Test262 48 -> 48.

Closed #695 in ef485bab: bound-target names and native Function source names now cross canonical WTF-8 before prefix/formatting. Canonical and flat storage, ReleaseSafe, TSan, full units, and 180 exact Function Test262 cases are green.

Representation-boundary leaf #696 landed in 459af38b. Private equality no longer reads physical string bytes, and private substring predicates now use UTF-16 code-unit semantics. Forced-flat and full-unit gates are green.

Flat-string boundary leaf #697 landed in f9ca94d6: the Value↔NanBox bridge no longer feeds physical flat bytes into canonical WTF-8 interning. Forced-flat convergence, OOM cleanup, TSan, and full units are green.

Flat-string property-key leaf #698 landed in f843f8d8. Iterator.zipKeyed now preserves Latin-1 StringData for padding reads and result publication; forced-flat and exact 44/44 Test262 controls are green.

Closed string-representation leaf #699 in ad6c363c: FormData file-name egress no longer treats flat Latin-1 backing bytes as canonical WTF-8. The exact old path fails the forced-flat fixture; the repaired path passes Debug/ReleaseSafe/TSan and the full 1,795-test unit gate with 0 failures/leaks.

Closed representation leaf #700 in 904c5d6b: Response.clone now preserves non-ASCII statusText across canonical and flat-Latin-1 StringCell layouts without recopying canonical storage. Exact old-path failure is captured; full units remain 1,794 passed, 1 skipped, 0 failed/leaked, with 0 applicable Test262 files.

StringData pipeline leaf #703 is complete in b959adf7. A forced-flat non-ASCII witness proved the stale physical-byte snapshot path failed, while V8 snapshot and heap-profile names now use canonical WTF-8 and pass Debug/ReleaseSafe/TSan plus the 1,796/1 full unit gate. Test262 impact is 0 applicable cases / 0 flips.

Correctness child #749 is complete in c90be9e3: all BigInt StringToBigInt consumers now share the owned canonical grammar and complete ECMAScript boundary-whitespace handling. Focused BigInt units pass 17/17; the three relevant Test262 subtrees remain 162/162 with 0 flips.

Correctness/security child #756 is complete in fix(json): preserve escaped NUL property keys (#756). JSON.parse now routes decoded object names through the canonical public-string key encoding, so escaped NUL keys remain visible to lookup, Object.keys, descriptors, and revivers. JSON Test262 remains 165/165 with zero regressions.

Two JSON correctness/security slices have landed on main: #756 preserves escaped NUL property keys in d78e0403, and #755 securely seeds reviver source-record indexes in a06685ff. Both retain the exact-parent JSON Test262 inventory at 165 pass / 0 fail; the focused JSON unit inventory is now 15/15 with zero leaks, and TSan probes are clean.

JSON security/correctness progress: #757 is complete in 36ad04d4, securing replacer PropertyList deduplication while preserving first-occurrence order, wrapper coercions, encoded NUL keys, and wide keys. Together with #755 and #756, the focused JSON unit inventory is now 16/16 with zero leaks; exact-parent test/built-ins/JSON remains 165 pass / 0 fail.

#764 is complete in fix(strings): randomize intern table placement (#764). Runtime InternTable identity remains exact, but attacker-controlled string placement now uses one lazy per-table secure context for both shard and bucket selection. Exact-parent built-ins/String remains 1,223/1,223.

Flat-string activation child #777 is complete in 7544c504. Eligible non-ASCII Latin-1 StringCells now own one byte per UTF-16 unit, with canonical WTF-8 only at semantic egress. The exact café fixture is 5 -> 4 backing bytes; exact-parent String/RegExp/JSON/language-string Test262 remains 3,291/3,291 with zero flips. No throughput claim.

JSON/string pipeline progress landed via #778 in 7071d650: flat Latin-1 string values now emit canonical JSON directly into final output storage with no intermediate transcode allocation. Exact-parent JSON Test262 remains 165/165 and focused normal/TSan plus seeded tier fuzzing are green. #778 remains open only for a clean-host full unit gate; no throughput claim.

String pipeline child #779 landed in a0e184e9: String(value) and new String(value) now retain an existing StringData cell, avoiding the flat Latin-1 transcode and replacement cell. Exact-parent built-ins/String remains 1,223/1,223; focused normal/TSan and 400-program threadfuzz are green. #779 stays open for a clean-host full unit gate.

String pipeline child #780 landed in 0c464096: plain String methods no longer allocate an unused protocol receiver, and real protocol paths retain existing StringData cells. Exact-parent built-ins/String remains 1,223/1,223; focused normal/TSan and 400-program threadfuzz are green. #780 awaits the shared clean-host full unit gate.

Follow-up a85154ed completes #780 semantics: original protocol O remains distinct from the later retained ToString cell, and four code-unit-only methods avoid eager flat Latin-1 transcoding. Exact-parent String Test262 remains 1,223/1,223; normal/TSan and 400-program fuzz evidence are green.

String pipeline/security child #781 landed in a42cf61e: repeat now has exact ToIntegerOrInfinity semantics, O(1) empty/count-one paths, pre-allocation size bounds, flat Latin-1 streaming, logarithmic copying, and exact cross-copy surrogate handling. String Test262 remains 1,223/1,223; repeat is 16/16.

String construction progress: #782 landed on main in 872dbbb5. Binary + and zero/one-argument String.prototype.concat now retain empty-operand identity, enforce checked exact sizing, stream flat Latin-1 into one canonical output buffer, and canonicalize surrogate pairs spanning the boundary. Focused normal/TSan, exact-parent Test262 (22 concat + 48 addition), and threadfuzz 400/0 are green; the clean full unit gate is pending.

d2ad8a8f — fix(runtime): preserve exact numeric update results (#800) is on main. Checked Symbol rejection, arbitrary-precision update arithmetic and retained update caller roots now pass focused OOM/moving-GC/TSan and the combined 2026-pass unit suite. The separate #801 ownership audit is runtime-confirmed: six probes perform actual relocation and expose stale receiver/coercion copies across getters/RHS effects. That remaining safety work is not claimed fixed by #800. Pushed integration is queued on 33130214332.

Landed ab23a1bb — fix(gc): root reentrant coercion and assignment state (#801). Six actual-moving failures now pass; final coverage includes 63 moving cases, 2,031 units (one skip, zero failures/leaks), Debug+TSan/no-GIL/OOM/root mapping and 700 seeded fuzz programs. All 15,319 measured upstream passes are unchanged; local paired ordering controls improve 8/10 -> 10/10. Full evidence and boundaries are on #801; pushed CI 33133426218 is pending. Earlier #798/#799 are now closed after all 53 executed jobs passed CI 33130214332. Missing VM legacy introspection remains #802 and deferred class frame capture #803; native activation/job ownership #787/#791 is untouched.

Landed f83c4191 — feat(vm): retain live deferred class captures (#803) on origin/main. #803 now retains exact live defining-frame bindings for deferred classes, including later sloppy-eval bindings, without changing native stack/queue/job lifecycle. #804/#805 separately track construction receiver/class-state ownership fixed in the same validated change. Same 9,643 eligible positive paired Test262 files: four gains (statements/class/elements), zero regressions; 11,563 default-tier cases unchanged. Local 41/41 paired witnesses, 20 actual-moving cases, 2,037 full units plus one platform skip, focused TSan/no-GIL/OOM and 700 fuzz programs pass. Full pushed integration is pending in CI 33135419183; children remain open. #619 retains the distinct unfinished classifier-scaling evidence boundary; #802 and reserved native ownership audits are not claimed complete.

Runtime follow-up f2340f27 (#808) roots/reloads aggregate results, computed property keys, spread source/destination and iterator records through reentrant effects, including actual relocation. CopyDataProperties now defines own data properties and rechecks live source presence/enumerability. Final #806 evidence: 28 actual-moving cases, paired semantics and runtime OOM restoration pass Debug/ReleaseSafe/unsuppressed TSan; full Debug has 2042 pass / one platform skip / zero failures or leaks, and 700 seed-one fuzz programs pass. This is correctness/ownership evidence, not a throughput or allocation-cost claim. Deeper Proxy metadata operands remain under #810; current pushed integration is https://github.com/zig-utils/zig-js/actions/runs/33137549779 .

The interpreter-side pointer-map hardening tranche is complete in #857 / fec38b3b: Annex B node identity, string literal sites, tagged-template sites, and RegExp matcher state now share one lazy secure exact-identity context with failure-atomic publication. No fallback seed or semantic workaround was introduced.

The JSON cycle-index security follow-up is complete in #858 / c9d414ae. Deep active membership is now both relocation-stable and securely placed; shallow paths remain entropy/allocation-free and exact-parent JSON.stringify remains byte-identical at 66/66.

Focused child #990 now tracks the measured RegExp compiled-program and matcher-scratch retention gap after #989. Exact-main evidence at 32,768 unique patterns: 51.0 MB string control, 316.3 MB eager construction, 557.3 MB after one match each. Implementation and raw before/after evidence will land there.

#990 has landed on main through 8de5d5f9, closing the RegExp-specific runtime-allocation ownership gap. A 64-entry interpreter-local lease cache now reclaims unpinned compiled-program and matcher/result arenas, preserves pinned/reentrant use, and isolates mutable backtracking state by RegExp identity.

The exact-parent diagnostic shows 75.7% lower construction RSS and 79.6% lower construction-plus-first-match RSS at 32,768 unique patterns, with the source-only control and checksums unchanged. Qualification covers 2,456 affected test262 cases, tree/VM agreement, and two no-GIL TSan cases.

Evidence: #990 · report · raw.

Two independently profiled JSON children are complete and pushed directly to main: #991 / d74ac11 (copy ordinary escaped-string spans) and #992 / 0474640 (exact conversion for short integer tokens). Evidence/README summary: 200b87f. Report: https://github.com/zig-utils/zig-js/blob/main/docs/.data/json-parse-cpu-work-2026-09-29.md . All 56 alternating samples are preserved. Debug/default-arena retired instructions decrease 51.7% and 27.5% on the selected probes; controls are -0.08% and +0.41%. JSON test262 stays 165 pass / 0 fail, tree/VM 165 agree / 0 diverge, with focused regression/OOM/boundary gates. These do not satisfy the broad parent acceptance for GC/no-GIL/TSan, ReleaseFast or JSC leadership; that scope remains open.

Pushed a fourth independently measured JSON improvement to main: #996 / 14cbffb9. It removes one redundant completed-output allocation per stringify: exactly 198,000 fewer backing allocations on each frozen 2,200 x 90 row, with unchanged checksums and all focused/Test262/VM/no-GIL TSan gates green.\n\nThe clean seven-sample direct-JSC publication remains pending until the host is free of the unreapable benchmark contaminant; no wall-time claim was published from the dirty host.

Pushed another independently measured JSON improvement to main: #997 / 15d8fbb4. A 4 KiB stack-first key-snapshot arena with exact heap fallback removes 594,000 backing allocations and about 468 MB of requested backing storage from each frozen full JSON row, with unchanged checksums and focused/Test262/VM/no-GIL TSan gates green.\n\nThe executed 2 KiB variant was rejected because it spilled into an oversized fallback allocation; that negative sizing result is documented in #997. Clean-host seven-sample direct-JSC publication remains pending.

Closed child #998 in 4ccb11d2. SerializeJSONObject now snapshots enumerable key eligibility before any value getter, matching the executed Node differential and Proxy trap order while preserving inherited replacement and replacer-PropertyList behavior. Frozen checksums and all attribution counters are unchanged; five-sample process-CPU medians are neutral-to-better. Focused/Test262/VM/no-GIL TSan gates are green.

Pushed another independently profiled JSON improvement to main: #1001 / bafe31a8. Direct ordinary own data fields now bypass the full generic [[Get]] pipeline while accessor, deletion/inheritance, Proxy, and exotic semantics retain the exact fallback. Seven alternating exact-parent pairs reduce retired instructions to 0.9698x and 0.9731x on the two frozen JSON rows with exact checksums; focused, 165/165 Test262, 165/165 tree/required-VM, OOM/deep-cycle/GC, and no-GIL TSan gates are green. Direct-JSC publication remains open because the frozen rows still trail JSC and the current host load is not suitable for a public wall-time claim.

Pushed the next measured JSON slice to main: #1002 / 61a7ae1e. SerializeJSONObject now carries stable Shape slots through simple ordinary key snapshots and revalidates them under the property lock before every live read, retaining exact fallbacks for mutation and all exotic paths. Seven exact-parent pairs reduce frozen-row retired instructions to 0.8964x / 0.8961x; 4,096-sibling and depth controls improve to 0.7374x / 0.7004x with exact checksums. Test262, required-VM agreement, OOM/GC/deep-cycle and no-GIL TSan gates are green. The broad direct-JSC acceptance remains open; no leadership claim is being made yet.

JSON slice #1003 landed as c79e5d0 and is closed. It removes the per-index arena formatting call in SerializeJSONArray while preserving callback key lifetime, sparse/prototype/accessor semantics, and full Get fallback. Seven paired samples show 0.9902x instructions / 0.9985x CPU on representative_json, 0.9890x / 0.9609x on its variant, and a stable 0.9428x / 0.9658x on the array-heavy shallow-4096 control; checksums are exact. The object-only control remained neutral. All focused, OOM/deep/GC, TSan/no-GIL, JSON Test262, and VM-agreement gates are green. Parent remains open: direct JSC parity is not yet reached.

JSON slice #1004 landed as 27487356 and is closed. Direct ordinary packed arrays now avoid full string-keyed Get only for a live present dense own element; every observable or ambiguous indexed-property case stays generic. Seven paired samples: representative_json 0.9740x instructions / 0.9672x CPU, variant 0.9759x / 0.9746x, array-heavy shallow-4096 0.8940x / 0.8556x, exact checksums. Object-only depth-4096 remained neutral. Focused, semantic/OOM/deep/GC, TSan/no-GIL, JSON Test262, and VM-agreement gates are green. Parent remains open pending direct-JSC parity and publication.

JSON slice #1005 landed as 4b3a14f and is closed. The single-owner stable-key path now elides 2,772,000 mutex acquisitions per frozen invocation, while the enable-before-sharing gate leaves concurrent GC/no-GIL locking unchanged. Paired medians: base 0.9885x instructions / 0.9709x CPU; variant confirmation 0.9931x / 0.9584x; object/array controls improve with exact checksums. All unit, semantic/OOM/deep/GC, TSan/no-GIL, Test262 and VM-agreement gates are green. Clean current main remains roughly 4.39x/4.48x JSC on the two frozen rows, so #473 stays open.

JSON slice #1006 landed as 1eee9212 and is closed. Ordinary named descriptor snapshots now reuse the enable-before-sharing gate: the frozen row drops from 817,937 property locks to 19,292, removing all 798,645 named-snapshot mutexes while shared realms retain the locked path. Seven paired samples keep both JSON rows and shallow/depth controls instruction/CPU neutral; the proxy/accessor control improves to 0.9921x instructions / 0.9842x CPU with exact checksums. Test262, required-VM agreement, real-GC OOM/deep/cycle tests, and TSan/no-GIL gates are green. Clean current candidate is still 4.2965x / 4.4930x JSC, so direct parity and publication remain open.

Child #1007 is complete and landed on main as f3639ef. Preparing private JSON array append state removes repeated published-object synchronization/storage lookup for 594,000 appends in the frozen base row. The grouped confirmation measured 0.98825x retired instructions and 0.97992x process CPU on representative_json; the variant measured 0.99596x instructions with CPU neutral. Checksums, stringify controls, 165 JSON test262 cases, 165 VM/tree witnesses, exhaustive OOM tests, real-GC units, and no-GIL/value-layer TSan gates are clean.

JSON child #1008 is complete on main in b2c9982f. Unpublished JSON.parse object writes now reuse cached immutable Shape-edge state while the ordinary/public setter remains source-identical to its parent.

Seven exact-parent pairs improve the frozen base/variant rows to 0.9841x / 0.9873x retired instructions and 0.9898x / 0.9880x process CPU. Depth, shallow, and unique-shape controls are instruction-neutral with exact checksums. Debug, real-GC OOM/deep-input, 165/165 Test262, 165/165 required-VM agreement, full value-layer TSan, and the shared no-GIL JSON.parse witness are green.

#473 remains open: the two direct-JSC rows still need further causal improvements and final seven-sample publication evidence.

#1009 landed on main as c8d9027. Sustained private JSON.parse container allocation now reuses the existing traced/relocated interpreter reserve after a 16-container cold threshold.

On the frozen representative_json row, seven exact-parent pairs measured 0.990045x retired instructions, 0.975397x CPU, and 0.977660x wall. Total GC-cell demand stayed exactly 1,001,001 while slab-lock acquisitions fell 37.1%. JSON test262 remains 165/165 with 165/165 required-VM agreement; JSON/OOM/GC, TSan/no-GIL, moving-root, and 50,000-level deep-input gates are green.

I am continuing from the pushed head with fresh attribution for the next causal JSON gap.

#1010 landed on main as 934d306. Sustained managed-string production now uses a realm-matched, traced/relocated interpreter reserve after 16 exact cold allocations.

On representative_json, total cell demand stayed exactly 1,001,001 while slab-lock acquisitions fell 25.2%, single-cell allocation locks fell from 407,017 to 6,633, and publication locks fell from 444,141 to 68,781. Seven exact-parent pairs retained lower instructions on both frozen parse rows with neutral instruction controls. JSON is 165/165 with 165/165 VM agreement, 1,327 broader String cases pass, and moving-GC/OOM/no-GIL/TSan gates are green.

Fresh pushed-head attribution now leaves per-cell sweep unpublication and conservative ownership classification as the dominant GC costs; those need separate measured issues rather than being folded into this allocation change.

#1011 is complete in 3abc2fc.

A coherent ever-issued slab envelope now rejects impossible conservative roots before any size-class lock. Exact-source attribution on representative_json cuts conservative-interior locks 2,216,853 → 16,863 (-99.24%) and total slab locks 4,615,990 → 2,416,000 (-47.66%) with identical checksums, cell counts, and collection counts.

Seven interleaved pairs keep every sustained JSON row at 0.98940x–1.00034x retired instructions with sub-0.7% RSD. JSON test262 stays 165/165, required VM agreement 165/165, and Debug/TSan/no-GIL/deep-input gates are green. Full evidence: #1011.

Measured #1012 (coalescing stable-identity epoch invalidation across sweep) in two formulations and closed it as a no-go with no commit. Seven-pair instructions were mixed: parse rows improved only 0.08–0.21%, depth/shallow stringify regressed 0.11–0.12%, and the cold Unicode control regressed 0.96%. The tree is restored to pushed 3abc2fc; evidence and rationale are on #1012.

#1013 landed on main as b0f4b41. Repeated private small-object parses now reuse a byte-verified prepared shape chain while duplicate, indexed, reordered, wide, and encoded-key cases retain the generic path.

Exact attribution cuts shape requests 1,984,837 -> 4,892 (-99.75%) on both frozen ordinary rows with identical checksums, cell allocations, backing allocations, and collection counts. Seven exact-final pairs improve retired instructions 2.45%/2.69%, CPU 3.99%/5.11%, and wall time 3.97%/5.28%; controls are instruction-neutral. JSON remains 165/165 with 165/165 required-VM agreement, and OOM, moving-GC, no-GIL TSan, and 50k-depth gates are green. Full evidence: #1013.

Opened #1014 from the clean post-#1013 JSON attribution. Seven alternating samples show representative_json at 357.280 ms with JIT versus 350.702 ms with JIT disabled, while only 22,215 of roughly 23.16 million VM dispatches transfer. The first optimizer rejection is the managed "row-" constant; #1014 makes that graph-plannable without embedding a raw GC pointer and proves exact OSR frame import/recovery/rooting. The exact function then exposes a separate 147-node/128-slot region-capacity blocker, which will remain a distinct measured child rather than being hidden by a larger scratch array.

JSON/JIT progress: ac67db5 landed on main under #1017. It removes the primitive-string length guard churn from the frozen representative_json loop, reducing exact-parent median 400.774 ms -> 364.558 ms (9.0%) and OSR entries/deoptimizations 243,515 -> 17,113 with checksum 324952086 unchanged. JIT is still 2.2% behind forced VM, so #1017 remains open for the residual overhead; no parent acceptance claim is being advanced yet.

Pushed 8ca0d15 for #1018. The profiled guarded bit_and path removes 240,107 runtime callbacks per scored frozen representative_json invocation, improves the exact-parent seven-sample median by 1.9%, preserves checksum 324952086, and brings JIT marginally ahead of forced VM. Qualification and anti-specialization controls continue before either child is closed.

JSON native-loop tranche completed and published on main.

Closed children:

• #1017: primitive String length inside optimizer regions
• #1018: guarded Number bit_and inside optimizer regions

Evidence:

• 0d2c6cf consolidated report: https://github.com/zig-utils/zig-js/blob/main/docs/.data/json-jit-pipeline-2026-10-01.md
• exact-parent reductions: 6.74%/6.72% retired instructions from #1017, then another 0.96%/0.53% from #1018; all controls within ±0.11%
• same-binary JIT/required-VM: 0.990x / 0.992x elapsed with exact checksums
• direct system-JSC matrix (84 raw samples): JSC remains 4.05x / 4.04x faster on the frozen representative rows and 10.47x / 9.22x faster on depth/shallow 4096 stringify controls

This parent remains open. The measured recursive stringify gap is now isolated in #1019 with callback, OOM, GC, no-GIL, and TSan guardrails rather than being hidden inside this umbrella.

JSON.stringify child #1019 has landed its bounded explicit-frame implementation on main in b617e7cf, with follow-up evidence and collector hardening through 388a01f6.

Verified correctness:

• focused JSON semantics: 16/16
• JSON test262: 165 pass, 0 fail
• forced tree/required-VM: 165 agree, 0 diverge
• 50,000-level object and array witnesses: catchable RangeError in both tiers
• moving-GC/OOM coverage, no-GIL witness, and unsuppressed TSan witness: pass

Clean seven-pair exact-parent CPU evidence preserves all checksums and reports candidate/parent retired-instruction ratios of 0.9988x for depth-4096 and 0.9994x for shallow-4096; the six raw schema-4 artifacts and generated reports are indexed in docs/benchmarks.md.

The direct-JSC acceptance run remains open. Two complete 126-sample attempts were preserved as rejected evidence rather than cherry-picking noisy samples. #1021 now hardens the collector against competing host work, and its upstream Home-driven validator blocker is independently tracked at home-lang/home#834.

No replacement matrix is being started while unrelated command-bearing Bun/Playwright jobs remain active. #1019 and #1021 stay open until the Home gate is green and one genuinely clean seven-triplet matrix completes with exact checksums.

#1019 follow-up: test-only commit 9453de45 adds exhaustive allocation-failure coverage for the new stringify frame-cache spill, reentrant fallback, cleanup, and retry paths. Focused gate: 2/2 pass at a 238 MB bounded peak; runtime behavior and test262 score are unchanged.

JSON frame-stack follow-up: #1019 is still complete through exact-parent correctness/CPU evidence; its remaining direct-JSC acceptance is blocked by #1021. The Home compiler abort behind that tool gate is now reduced to a stale diagnostic-array index and documented with the logical fix shape in home-lang/home#834. Fresh reproduction remains exit 134 at a bounded 138 MB peak, so this is not memory pressure. No zig-js consumer workaround has been added.