Class: securely seed runtime private environments

Parents: #493 Related: #761, #770, #847

Problem

ClassDefinitionEvaluation builds an immutable runtime map from source-controlled raw private identifiers (for example, #field) to per-evaluation storage identities. The map and the transient nested-class shadowing clone currently use default-context std.StringHashMapUnmanaged, so hostile source can precompute collision-heavy private-name sets after parser/compiler name tables have already been hardened.

This map is lexical execution metadata: it is retained by methods, constructors, field initializers, suspended VM activations, exception handlers, and direct eval. Its lookup behavior must remain identical across every carrier.

Scope

• Introduce one exact-byte, unpredictable hash context for each newly created runtime PrivateEnvironment.
• Preserve that context in the immutable map and reuse it for transient nested-class shadowing clones; do not request entropy per name, lookup, clone, or inherited outer entry.
• Rehash flattened outer PrivateEnvironment entries into the new class environment while preserving innermost-name shadowing.
• Carry the hardened map type unchanged through the tree walker, bytecode VM, functions, generators/async activations, exception unwinding, computed-name preparation, and direct-eval early-error validation.
• Keep classes with no new private bound identifiers allocation- and entropy-free by reusing the outer environment exactly.
• Make entropy/allocation failure publish no partial PrivateEnvironment and preserve exact JavaScript error ordering.

No-workaround rules

• No private-name count/length/depth cap, source rewriting beyond the existing semantic identity rewrite, blacklist, public/address/time-derived seed, deterministic fallback, hash-only equality, linear-search fallback presented as hardening, or weakened private-name early errors.
• No per-name/per-lookup OS entropy request, duplicate runtime map, parser/compiler behavior change, or public API/ABI change.

Acceptance

• Every runtime PrivateEnvironment lookup/insertion/removal/iteration uses its installed secure exact-byte context, including nested-class shadow filtering and flattened outer entries.
• Candidate-free classes reuse the outer map without entropy or allocation; first-map failure is atomic.
• Focused wide, duplicate accessor, nested shadowing, computed-name, closure, direct-eval, generator/async, abrupt-unwind, moving-GC, and required-VM witnesses pass.
• Focused normal, ReleaseSafe, and TSan/no-GIL coverage passes with zero leaks/races.
• Exact-parent relevant Test262 class/private-name inventories have nonzero accounting and zero regressions.
• Full unit and threadfuzz gates pass.

Implementation and focused evidence are complete on an unpushed direct-child candidate of 58ed1311:

• Runtime PrivateEnvironment maps now own one root-Shape-derived secure exact-byte context.
• Nested shadow-filter clones reuse their source map's context; inner environments rehash flattened outer entries under the inner context and retain innermost shadowing.
• The same immutable type is carried through parser direct-eval validation, interpreter functions/environments, VM handlers, generators, activations, computed-key preparation, and unwind.
• A class without a new private bound identifier returns its exact outer map before allocation or key derivation.
• Deterministic default-seed collision-family placement, clone isolation, and first-insert allocation failure: 1/1 unit.
• Private-focused normal units: 122/122, zero failures/leaks.
• Focused computed-environment TSan, including shared no-GIL evaluation and moving GC: 3/3 clean.
• Focused ReleaseSafe: 3/3.
• New production reuse/shadowing/identity witness: 1/1.

Exact-parent ReleaseFast Test262 at pinned corpus 4249661388e5d3f92a85186213da140a6481490f:

• test/language/expressions/class: parent 4,059 pass / 0 fail; candidate 4,059 / 0.
• test/language/statements/class: parent 4,367 pass / 0 fail; candidate 4,367 / 0.
• Required-VM witness over the same inventories: parent and candidate each 8,426 agree / 0 diverge.
• Net flips: 0 gains, 0 regressions.

An earlier zero-output attempt was rejected before use because this worktree's Test262 submodule was uninitialized; the pinned corpus was then initialized and both denominators were explicitly verified. Full units and threadfuzz remain pending because an unrelated user-owned Home compiler repeatedly occupies the host; no overlapping engine gate is being started.

Completed by fix(class): seed runtime private environments (#848).

Runtime class PrivateEnvironments now use one root-Shape-derived secure exact-byte context per evaluated class. Nested shadow-filter clones retain that context, flattened outer names are rehashed under the inner environment, and the immutable map type is carried through tree-walker/VM closures, suspension, handlers, unwind, computed keys, and direct eval. Candidate-free classes reuse the exact outer map without allocation or key derivation. No cap, fallback seed, linear fallback, duplicate map, or weakened private-name semantics was introduced.

Final evidence:

• exact-parent ordinary Test262: 8,426/8,426 pass on parent and candidate, zero flips;
• exact-parent required-VM witness: 8,426/8,426 agree on both, zero divergences;
• full units: 2,247 passed + 1 platform skip, 0 failed/leaked;
• focused TSan/no-GIL/moving-GC: 3/3 clean;
• focused ReleaseSafe: 3/3;
• threadfuzz: 400 programs, 0 failures.