Parents: #493, #496 Related: #759
Problem
Sloppy Script/function evaluation scans block-level Annex B function declarations and stores every source-controlled identifier in std.StringHashMapUnmanaged. Its process-predictable default context lets hostile source precompute collision-heavy candidate names and inflate legacy-binding classification before execution.
Scope
- Replace only the invocation-local Annex B legacy candidate-name set with the existing exact-byte, lazy, failure-atomic secure membership helper.
- Draw one secure seed when the first eligible candidate is inserted; strict code, candidate-free bodies, and skipped scans must request no entropy or table allocation.
- Preserve the separate exact AST-node eligibility set, lexical shadowing, parameter/catch/destructuring rules, labeled/switch/try traversal, pre-created var bindings, duplicate-name behavior, source order, and OOM propagation.
- Keep the existing lexical name traversal and its stack ownership unchanged.
No-workaround rules
- No identifier/depth cap, source rewriting, blacklist, deterministic fallback seed, hash-only equality, skipped candidate/node, broadened rejection, or disabled Annex B behavior.
- No stack implementation, queue, job, Promise, Worker, or Map/Set iterator changes.
Acceptance
- Annex B candidate-name membership uses one non-default secure context per scan.
- Strict/candidate-free/skipped paths remain lazy and allocate no candidate hash table or entropy.
- Wide, escaped, duplicate, shadowed, labeled, switch, catch, and parameter cases preserve exact bindings/errors.
- Focused normal and TSan tests pass without leaks or races.
- Exact-parent relevant Annex B Test262 inventory has zero regressions.