Layer 1 campaign: migrate perry-codegen's lowerings onto the rooting-by-construction API (88 modules, 262 hazard sites) #7615

Activity

1. proggeramlug

   added a commit that references this issue on Aug 8, 2026

   refactor(codegen): migrate expr/url_main.rs onto the Layer 1 rooting …

   ...

   55ddab0
2. proggeramlug commented on Aug 8, 2026

   

   proggeramlug

   on Aug 8, 2026

   ContributorAuthor

   More actions

   Slice 1a — DONE, in #7618

   1 module · 1199 → 1346 lines · 37 raw sites · 40 hazard sites → 0.
   lower_array_method.rs is migrated end to end and listed in MIGRATED_MODULES. No boundary outstanding; the module landed whole, in one PR.

   slice	module	state
   0	expr/url_main.rs	DONE (#7617)
   1a	lower_array_method.rs	DONE (#7618)
   1b	expr/arrays_finds.rs, expr/array_methods.rs	next

   Running total: 2 of 88 modules, 48 of 694 raw sites, 47 of 262 hazard sites.

   Three findings worth carrying into the remaining slices

   1. The hazard-density number was measuring the right thing, but the fix is not where "40 sites" suggests. All 40 came from one structural cause: lower_array_method lowered the receiver above the match, so every arm inherited the same window. One with_operands_rooted around the whole match closes all of them. When a module's hazard count is high, look for a shared prologue before assuming 40 independent edits — the map's haz heuristic counts uses, not causes.

   2. root_reload.rs (#7280) already covers part of this bug class, and the map does not account for it. Where an operand is a shadow-slotted local, #7280's post-pass re-reads it below the collection point, so the pre-migration code was not stale. Three shapes it structurally cannot cover, and those are the real content of a slice:

   • an operand reassigned inside the window — GC: #7154's residual is NOT fixed — the loop-polls config is red 0/30, and stock zod alone fails 5/40 #7280 deliberately bails there (re-loading would observe the assignment, operand_is_reloadable's documented miscompile), so it leaves a stale register. Only a temp root gives both the call-time value and a rewritten address. Confirmed in emitted IR for a.concat(reassign()).
   • operands with no slot at all — call results, property chains, literals.
   • operand-to-operand windows within one argument list.

   Concretely: 36 of the load double instructions this slice removed were #7280 reloads that a root read replaced. A future slice that claims "N hazard sites closed" without separating these is overclaiming. Check the baseline IR for an out-of-sequence register number (%r309 after %r250) — that is #7280 having already fired.

   3. The ledger's escape-hatch check is vacuous for a module that never used temp_root. lower_array_method.rs named it zero times before the migration, so migrated_modules_do_not_reach_past_the_rooting_api passed the instant it was listed. The sabotage arm is what makes the listing mean something, and it was run: a real compiling temp_root_push_double + temp_root_truncate pair injected into the reverse arm turns the test red, naming both lines. Every slice should run that arm and record the result, because for most of the remaining 86 modules the ledger will otherwise pass for free.

   Ordering note for slice 1b and later

   The structural property worth copying is not "call the combinators" — it is lower_expr must not appear in the migrated module. In this slice the arguments each arm consumes are declared once (lowered_arg_count) and the arms only emit, so no arm can reintroduce an unrooted operand. The asymmetry that makes a central table safe: under-counting is a codegen panic on the first program that reaches the arm; over-counting costs an evaluation JS requires anyway. That shape should transfer to arrays_finds.rs and array_methods.rs directly, since they have the same "receiver + N arguments + one consuming call" skeleton.

   Also: lint is red on main, unrelated to this campaign

   python3 scripts/check_test_registration.py fails on a pristine origin/main — test-files/test_gap_repsel_element_shape_loop_clone.ts landed in #7612 (96e034809) without being registered in test-parity/gc_repsel_corpus.txt, so gc_repsel_matrix.sh (gc-stress, gc-moving-witnesses) never runs it. A required-and-red gate means every merge is bypassing it — CLAUDE.md hazard 2. Not fixed in #7618: registering a test changes what those gates execute, which is its own change with its own measurement.
3. proggeramlug

   added a commit that references this issue on Aug 8, 2026

   refactor(codegen): migrate lower_array_method.rs onto the Layer 1 roo…

   ...

   4f281c6
4. proggeramlug commented on Aug 8, 2026

   

   proggeramlug

   on Aug 8, 2026

   ContributorAuthor

   More actions

   Slice 1b — DONE, in #7620

   2 modules · 1562 → 1763 lines · 40 raw sites · 26 hazard sites.
   expr/arrays_finds.rs and expr/array_methods.rs are migrated end to end and listed in MIGRATED_MODULES. No boundary outstanding; both landed whole, in one PR.

   slice	module	state
   0	expr/url_main.rs	DONE (#7617)
   1a	lower_array_method.rs	DONE (#7618)
   1b	expr/arrays_finds.rs, expr/array_methods.rs	DONE (#7620)
   2	expr/instance_misc1.rs, expr/logical_collections.rs, lower_call/property_get/map_set.rs	next

   Running total: 4 of 88 modules, 88 of 694 raw sites, 73 of 262 hazard sites.

   One combinator was added, and it is the only one the campaign should need for this shape

   rooting::with_operands_rooted_across(ctx, exprs, across_exprs, across, body) — root a group across a lowering step whose representation the caller picks. Its two callers are u8[i] and buf[i], where the index goes through lower_expr_as_i32 or fptosi and the receiver is live across that choice; handing the index to with_operands_rooted would force every such read back onto the NaN-boxed path, which is a codegen-quality regression rather than a rooting fix.

   Note what it is not: it never takes a bare register. The root_i64(ctx, reg) that rooting.rs's comment warns about would put ordering back in the author's hands (#7192); this one still owns the lowering, the re-read point and the release. with_operands_rooted is now its empty-across case, so operand_protection stays the single decision site — the drift that produced #7114 was two helper families answering that question separately, and the campaign should not recreate it by growing a family of combinators that each re-derive collects.

   Four findings for the remaining slices

   1. The haz heuristic under-counts one shape and it is the worst one. The map gives these two modules 26 hazard sites. It counts NaN-boxed operand registers used after an intervening emission. Expr::BufferSlice does something worse and is not in that count: it unboxes the receiver to a raw BufferHeader* and then lowers start and end. When you audit a module, grep for unbox_to_i64 / unbox_str_handle above a lower_expr, not only for reused _box registers.

   2. That raw shape is also the one #7280 provably cannot reach. root_reload re-reads a shadow slot into a double. If the stale value is an i64 derived above the window, there is nothing for it to rewrite. Slice 1a's finding was that #7280 already covered the shadow-slotted majority (still true — 16 of this slice's removed load double instructions are exactly those reloads); this is the complement, and it is what a slice should be claiming.

   3. Ledger vacuity is now written into the code, not just into a PR. escape_hatch_uses strips comments, and every module migrated so far except expr/url_main.rs named temp_root zero times beforehand — so listing it goes green instantly. MIGRATED_MODULES' doc comment now says so and states the obligation: run the sabotage arm, per module (the assert stops at the first offender, so one run cannot speak for two), and record it. Slice 1b did: arrays_finds.rs:279/:280 and array_methods.rs:59/:60, both red, both reverted.

   4. ★ Codegen is not run-to-run deterministic, which is a trap for exactly this campaign's evidence (#7622). Compiling one source twice with the same binary permutes @.str.N numbering, js_register_function_name order, and — in test_gap_class_expr_dynamic_parent_ctor — which perry_method_* symbol three call sites name. In slice 1b's 149-module IR comparison, 3 of the 9 differing functions were this and not the change. They are distinguishable only because their instruction multisets were identical AND a same-binary double compile reproduced the same permutation. A future slice that reports raw diff output will report phantom regressions; one that compares multisets without checking determinism will silently dismiss a real ordering change. Both halves are needed.

   Also filed from this slice, not fixed in it

   #7621 — path.resolve(base, computedShortString) throws ERR_INVALID_ARG_TYPE where node returns the path. Expr::PathResolveJoin unboxes with unbox_to_i64, so an SSO string's inline bytes are dereferenced as a StringHeader* (#214 class; bisected by string length). Same unaudited shape in PathExtname, PathNormalize, PathResolve, PathMatchesGlob. The correct helper allocates, so the fix opens the #7213 window in the same arm — it needs its own rooting decision, and does not belong inside an IR-identical refactor.

   lint is still red on main for an unrelated reason

   python3 benchmarks/ci_public_baseline_check.py fails on a pristine origin/main (public artifact benchmark harness changed; regenerate it with ./benchmarks/run_public_baseline.sh). #7618 reported the same step failing on every main run from 2026-07-29. Because lint is a sequence, that step's failure used to skip every later gate in the job; the if: ${{ !cancelled() }} added to the later steps means they now still speak, but the job itself stays red.
5. proggeramlug

   added 2 commits that reference this issue on Aug 8, 2026

   refactor(codegen): migrate arrays_finds.rs + array_methods.rs onto th…

   ...

   38ff7ec

   refactor(codegen): migrate instance_misc1 + logical_collections + map…

   ...

   b99df1e
6. proggeramlug commented on Aug 8, 2026

   

   proggeramlug

   on Aug 8, 2026

   ContributorAuthor

   More actions

   Slice 2 — DONE, in #7627

   3 modules · 3207 → 3739 lines · 60 raw sites · 40 hazard sites.
   expr/instance_misc1.rs, expr/logical_collections.rs and
   lower_call/property_get/map_set.rs are migrated end to end and listed in
   MIGRATED_MODULES. No boundary outstanding; all three landed whole, in one PR.

   slice	module	state
   0	expr/url_main.rs	DONE (#7617)
   1a	lower_array_method.rs	DONE (#7618)
   1b	expr/arrays_finds.rs, expr/array_methods.rs	DONE (#7620)
   2	expr/instance_misc1.rs, expr/logical_collections.rs, lower_call/property_get/map_set.rs	DONE (#7627)
   3	expr/objects_arrays_lit.rs, expr/array_literal.rs, expr/object_literal.rs, expr/array_push.rs	next

   Running total: 7 of 88 modules, 148 of 694 raw sites, 113 of 262 hazard sites.

   Two combinators added, and slice 3 already needs one of them

   with_operands_rooted_across_call — the window's across step is an emitted
   runtime call, not a lowered expression, so there is no Expr for
   any_may_trigger_gc to read and the answer is stated (conservatively) rather
   than derived. Its callers are re.test / re.exec, whose unconditional
   js_jsvalue_to_string_coerce dispatches a user toString. Deriving the window
   from the string operand answers false for a plain local and drops the root at
   exactly the site #7154 faults at. The precedent for taking the answer is
   temp_root::guard_store_operand_across, which has done so since #7201;
   operand_protection still decides how each operand is protected, and all three
   with_operands_rooted* forms now share one implementation so the family cannot
   grow three orderings.

   with_rooted_accumulator — a GC-managed value the lowering keeps updating
   while it lowers more user code. Slice 3 is the "literal accumulators" slice, so
   it should reach for this rather than building a second one. The invariant it
   enforces is the one a raw handle cannot: the accumulator never exists as a
   register held across an emission. Consuming calls re-read it as part of being
   emitted, a helper returning a fresh address publishes it straight back
   (advance), and the one point a register escapes is finish, below the last
   collection point and above the release.

   RootedSlot now carries its own Repr. A temp-root slot is representation-
   agnostic, so the temp_root_get_i64 vs temp_root_get_double choice used to
   live at each call site, where a mismatch is a silent miscompile rather than a
   type error.

   Four findings for the remaining slices

   1. A high root count in the map means "already correct", not "already
   migrated" — and the slice must say which. map_set.rs carries root: 49 and
   was hand-rooted end to end by #6970; its migration is a translation, and its
   IR is byte-identical. ObjectSpread and Object.assign are the same. Claiming
   those as closed hazards would be overclaiming in the way slices 1a and 1b warned
   about. What the translation genuinely buys is that the release stops being a
   statement a later edit can move into a branch — the shape #7462 shipped in
   URLSearchParams.delete, which is the direct sibling of these arms, so the
   risk is demonstrated rather than hypothetical.

   2. The haz heuristic misses a third shape: an interned key. Slice 1b found
   it misses raw unbox_to_i64 receivers. Expr::WithSet shows the other end —
   the stale value was the property key, a load from a __perry_init_strings_*
   handle global materialised above the RHS. That global is a registered root that
   evacuation rewrites, so the register named from-space while the global did not:
   the write landed under a garbage key. When auditing a module, look for
   emit_with_key / ctx.strings.entry(..).handle_global loads above a
   lower_expr, not only for reused _box registers.

   3. Two accumulators in this slice were not rooted at all, and neither is in
   the map's root column: Math.min/Math.max with three or more arguments
   threads a raw ArrayHeader* through js_array_push_f64 across each remaining
   argument's lowering, and fetch's static-headers build does the same with
   js_object_alloc. Both are #7154's ObjectSpread bug in arms nobody had looked
   at, and both are beyond #7280 because the stale value is a raw i64. Grep the
   remaining slices for let mut current / a handle threaded through a loop that
   contains a lower_expr.

   4. #7622 is still live and the control is still mandatory. On the 149-module
   corpus, compiling twice with the same binary produced 5 ordering-only
   permutations; the A/B produced 16 diffs of which 5 were ordering-only, 4 in the
   control set and one (test_gap_class_ref_new_dynamic::main) not — it had to be
   pinned separately by compiling that one source six times with the baseline
   binary, differing every time. The set of contaminated functions varies between
   runs, so "it was in my control set" is not a sufficient test; the shape
   (opcode multiset equal, ordering only) plus a targeted repeat is.

   Also filed from this slice, not fixed in it

   • a[i]++ holds its receiver and index across three user-code-capable calls before js_dyn_index_set (#7154 shape) #7628 — a[i]++ (Expr::IndexUpdate) holds its re-read receiver and index
     across js_dyn_index_get, js_to_numeric and js_numeric_step before
     js_dyn_index_set consumes them. It needs a per-use re-read inside the
     body rather than one group-wide re-read, i.e. an Arg that carries an operand
     group's Root/Reload/Reuse decision and materialises per call. The raw API
     already has the primitive (RootedOperands::reread_one, GC: evacuating minor drops an old-to-young field[1] edge, crashing with 'value is not a function' #7154). Per the
     template's rule that combinator arrives with its caller; Expr::PropertyUpdate
     has the same skeleton and should be done in the same change. The
     operand-to-operand half is closed in refactor(codegen): migrate instance_misc1 + logical_collections + map_set onto the Layer 1 rooting API (#7615) #7627.
   • test_gap_fetch_request_from_node_incoming_message SIGABRTs deterministically on pristine main, and is in no allowlist #7629 — test_gap_fetch_request_from_node_incoming_message SIGABRTs
     deterministically (3/3) on a pristine main build and is in no allowlist. Not
     a rooting bug and not caused by this slice; reported because parity is
     tag-gated, so it has been able to hide.

   lint on main

   python3 benchmarks/ci_public_baseline_check.py is still red on pristine
   origin/main, as #7618 and #7620 both reported (every main run since
   2026-07-29). Every other step of the lint job passes on this branch.
7. proggeramlug commented on Aug 8, 2026

   

   proggeramlug

   on Aug 8, 2026

   ContributorAuthor

   More actions

   Correction to the comment above: the dependency-scale corpus was also run for slice 2 and is green in both gated modes (81 zod modules, 12899 functions, 12908 root stores → 0 violations; --seeded-violations 40 at 40/40; --unrooted-allocas 0 over 15242 gc-capable allocas). Root stores there went 12878 → 12908, and the informational --stale-registers --moving-only ratchet is unchanged on both arms (23 curated / 115 dependency). That is the population the accumulator combinator most needed to be measured on, since zod is precisely the "builds objects field by field out of data" shape #7280 named.
8. proggeramlug

   added 3 commits that reference this issue on Aug 8, 2026

   refactor(codegen): migrate instance_misc1 + logical_collections + map…

   ...

   379a9ed

   refactor(codegen): migrate instance_misc1 + logical_collections + map…

   ...

   418d548

   refactor(codegen): migrate the literal-accumulator modules onto the L…

   ...

   0a6a920
9. proggeramlug commented on Aug 8, 2026

   

   proggeramlug

   on Aug 8, 2026

   ContributorAuthor

   More actions

   Slice 3 — DONE, in #7636

   4 modules · 1776 → 2264 lines · 18 raw sites · 7 hazard sites.
   expr/objects_arrays_lit.rs, expr/array_literal.rs, expr/object_literal.rs
   and expr/array_push.rs are migrated end to end and listed in
   MIGRATED_MODULES. No boundary outstanding; all four landed whole, in one PR.

   slice	module	state
   0	expr/url_main.rs	DONE (#7617)
   1a	lower_array_method.rs	DONE (#7618)
   1b	expr/arrays_finds.rs, expr/array_methods.rs	DONE (#7620)
   2	expr/instance_misc1.rs, expr/logical_collections.rs, lower_call/property_get/map_set.rs	DONE (#7627)
   3	expr/objects_arrays_lit.rs, expr/array_literal.rs, expr/object_literal.rs, expr/array_push.rs	DONE (#7636)
   4	expr/index_get.rs, expr/index_set.rs, expr/property_get.rs + submodules	next

   Running total: 11 of 88 modules, 166 of 694 raw sites, 120 of 262 hazard
   sites.

   No fourth combinator, and the one place that argued for one

   Slice 2 asked slice 3 to reuse with_rooted_accumulator rather than build a
   second one. It does — the spread literal's growing array (advance, because the
   address legitimately changes on every append), the object literal's half-built
   handle on both build paths — and with_operands_rooted covers the array
   literal's element group and arr.push(...src)'s operand pair.

   The shape that looked like it needed a fourth: a this-capturing method
   closure's deferred value. It is consumed by the this patch loop below every
   remaining initializer, so its root must span exactly that suffix of the literal,
   and the number of such values is data-dependent. All three
   with_operands_rooted* forms lower their operand list up front, which for an
   object literal would evaluate every property before storing any of them and
   reorder observable side effects — so none of them can express it. But
   with_rooted_accumulator already is "a GC value held while more user code is
   lowered", so the answer is one nested scope per such property, which falls out as
   a small recursion over the property list. Recorded here because the next slice
   will hit the same question: "the list is dynamic" is not on its own a reason
   for a new combinator; "the operands must be lowered interleaved with their
   consumers" is what rules the operand forms out.

   Four findings for the remaining slices

   1. Slice 3's honest count is one repair, three translations, and the map's
   root column predicted it. objects_arrays_lit.rs (root: 15),
   array_literal.rs (8) and object_literal.rs (21) were all correctly rooted
   already — by #7280 and #6951 — so their migrations are translations with
   byte-identical IR. array_push.rs (root: 0) named no rooting symbol at all
   and needed none, which is the case the ledger doc calls vacuous: only the
   sabotage arm makes its listing an assertion. The haz heuristic counted 6 sites
   there and all 6 are the same false positive — a raw i64 unboxed from a
   receiver that is lowered after the value and therefore has no window.

   2. A high haz on a module with root: 0 can mean "no window", not "no
   root". Slice 2's finding 3 said to grep for let mut current threaded through
   a loop containing a lower_expr; the complement is worth stating too. Before
   concluding a raw unbox_to_i64 is a hazard, check what is lowered after it.
   In both array_push.rs arms the answer is "an Expr::LocalGet", i.e. a slot
   read, and a slot read placed after arbitrary user code observes what evacuation
   wrote back — so the register is fresh by construction.

   3. That safety can rest on an evaluation order the spec does not permit, and
   then it is a bug in the other direction — #7634. arr.push(f()) /
   arr.push(...g()) evaluate the receiver after the argument, so an argument that
   reassigns the receiver's binding pushes onto the wrong array (node [9], perry
   [9,2]). Filed rather than fixed: restoring spec order is one call to the
   existing with_operands_rooted_across, but it puts the receiver in a window, so
   every pointer-valued push gains a temp root — a measured before/after, not a
   behaviour-preserving refactor. When a slice finds an arm that is rooting-free,
   ask whether it is rooting-free for a legitimate reason.

   4. A branch the corpora cannot reach needs a unit test, and the way to find out
   is to count, not to read. lower_object_literal's by-name path with a
   non-empty property list — where the this-patch machinery lives — is not
   reachable from TypeScript at all: since #809 every literal containing a
   Prop::Method lowers to a source-ordered IIFE over {}. Measured by grepping
   the emitted corpus rather than by reading the HIR: over all 129 sources / 149
   modules every js_object_alloc is (i32 0, i32 0). So the restructured
   branch got four HIR-built unit tests in perry-codegen --lib instead of relying
   on an A/B that structurally could not cover it. Slice 4's index_set.rs has
   fifteen arms and property_get/globalget.rs six hazard sites; count the call
   sites your probes actually emitted before believing the A/B covered them. In
   this slice the first object-literal probe read its literals' fields back and
   every one was scalar-replaced away — the A/B was green over a corpus containing
   none of the subject.

   Verification, and one thing that is no longer needed

   Per #7625 the emitted IR is run-to-run deterministic, so the #7622 double-compile
   control is retired. The A/B was measured directly: probes byte-identical in both
   environments, the dependency-scale corpus (81 zod modules, 64 MB) byte-identical,
   and the curated corpus 2450/2452 identical — the two differences being one
   instruction pair swapping in the iterator-result literal, where the accumulator's
   re-read is now fused to the emission that consumes it and therefore lands after
   the value's bitcast instead of before. Root-store counts unchanged on both
   corpora (9846 / 12908), which is what a byte-identical translation should read.
   Both gated modes green on both corpora with an empty allowlist, --seeded-violations 40
   at 40/40 on each. Full evidence in #7636.

   lint on main

   python3 benchmarks/ci_public_baseline_check.py is still red on pristine
   origin/main, as #7618, #7620 and #7627 all reported (every main run since
   2026-07-29). The other 26 steps of the lint job pass on this branch.
10. proggeramlug

    added a commit that references this issue on Aug 8, 2026

    refactor(codegen): migrate the object/array literal modules onto the …

    ...

    e4b2989
11. proggeramlug commented on Aug 8, 2026

    

    proggeramlug

    on Aug 8, 2026

    ContributorAuthor

    More actions

    Slice 4 — DONE, in #7642

    9 modules · 6189 → 6600 lines · 10 raw sites · 8 hazard sites.
    expr/index_get.rs, expr/index_get/guarded_array.rs,
    expr/index_get/inline_dyn_typed_array.rs, expr/index_set.rs,
    expr/index_set_typed_array.rs, expr/property_get.rs,
    expr/property_get/globalget.rs, expr/property_get/helpers.rs and
    expr/property_set.rs are migrated end to end and listed in
    MIGRATED_MODULES. No boundary outstanding; all nine landed whole, in one PR.

    slice	module	state
    0	expr/url_main.rs	DONE (#7617)
    1a	lower_array_method.rs	DONE (#7618)
    1b	expr/arrays_finds.rs, expr/array_methods.rs	DONE (#7620)
    2	expr/instance_misc1.rs, expr/logical_collections.rs, lower_call/property_get/map_set.rs	DONE (#7627)
    3	expr/objects_arrays_lit.rs, expr/array_literal.rs, expr/object_literal.rs, expr/array_push.rs	DONE (#7636)
    4	expr/index_get.rs + 2 submodules, expr/index_set.rs + 1, expr/property_get.rs + 2, expr/property_set.rs	DONE (#7642)
    5	lower_call/new.rs + 13 others (call / construct paths)	next

    Running total: 20 of 88 modules, 176 of 694 raw sites, 128 of 262 hazard
    sites.

    Still no fourth combinator

    Slice 4 is a single shape end to end — the StoreOperandGuard family, which is
    with_operands_rooted when the value is lowered by lower_expr and
    with_operands_rooted_across when it is lowered by
    lower_value_for_dynamic_{index,property}_set /
    lower_value_for_optional_barrier. Nothing here argued for a new form.

    Five findings for the remaining slices

    1. ★ A listed module is not an audited module, and this slice is where that
    stopped being pedantry. Two properties, and the ledger only checks the first:

    1. every rooting decision the module makes goes through crate::rooting;
    2. every window in the module HAS a rooting decision.

    index_set.rs and index_get.rs satisfy (1) and do not satisfy (2). The act of
    translating the six guarded arms of index_set.rs is what made it obvious that
    ~20 arms in the same files lower a receiver, lower more user code, then use
    the register, and root nothing — the bounded-index array store, the #5525
    typed-array stores, globalThis[k] = v, and ten read-side arms of
    index_get.rs. Filed as #7640. A ledger line does not mean "no rooting bugs
    here"; it means the module cannot make an ORDERING mistake against the raw API,
    because it no longer names it. That distinction is now written into
    rooting.rs next to the ledger, so slice 5 does not have to rediscover it.

    2. The haz column's false positives have a single signature, and it is worth
    knowing before you start. globalget.rs is credited with 6 hazard sites and
    all six are the same shape: js_get_global_this_builtin_value →
    ctx.strings.intern(property) → format! → unbox_to_i64 → load. intern
    and format! emit no IR. The heuristic measures source distance between a
    binding and its use; a window is measured in emissions. Before triaging a
    haz hit, ask what was EMITTED in between, not how many lines passed — slice
    3's finding 2 is the complement of this ("check what is lowered after it").

    3. #7201 was applied as prose and not as code, and the operand list is what
    makes that unrepeatable. guard_store_operand(ctx, operand, lowered, value)
    derives the window from ONE sibling. Its own doc says that is wrong — "leaves
    o[f()] = 1 unguarded" — and there is a three-argument
    guard_store_operand_across for the right answer. Two call sites in
    index_set.rs used the two-argument form anyway (#7639). With an operand group
    the window is across_collects || any_may_trigger_gc(exprs[i+1..]), i.e. a
    property of list order rather than an argument someone has to pass correctly.
    Slice 5's call/construct paths have exactly this shape — callee, this,
    then N arguments, each live across everything after it — so prefer one group
    over a per-operand flag.

    4. Count the arm's call sites, then check whether the ARM ITSELF is reachable
    from TypeScript. Slice 3's finding 4 said to count before believing an A/B.
    Slice 4 needed the next step. All three repaired arms were reached by the
    curated corpus or by a probe, yet the IR stayed byte-identical, because
    operand_protection returns Reuse when the window cannot collect — so
    "reached" is necessary and not sufficient; you need reached with a collecting
    window. And js_array_set_length_strict is called zero times across all
    129 curated sources. Six hand-written probe shapes failed to reach it too, for a
    structural reason worth writing down: an ordinary o.k = v / o[k] = v
    assignment statement lowers to Expr::PutValueSet and reaches the dynamic IC
    (js_put_value_set_dyn_ic), not the Expr::PropertySet / Expr::IndexSet arms
    in these modules. The answer was differential HIR-built unit tests: same store,
    allocating RHS vs inert RHS, assert the first reserves strictly more root slots.

    5. The ledger sabotage has a failure mode that reads as success. Planting
    super::temp_root::… into a module one directory down (expr/property_get/,
    expr/index_get/) does not resolve — it is crate::expr::temp_root:: from
    there. The plant then fails to COMPILE, the test run is red for the wrong
    reason, and a script that only greps for "FAILED" records it as a successful
    sabotage. Four of this slice's nine modules are nested. Check for error[E0…]
    before believing a red.

    lint on main

    python3 benchmarks/ci_public_baseline_check.py is still red on pristine
    origin/main, as #7618, #7620, #7627 and #7636 all reported (every main run
    since 2026-07-29). The other 23 enumerated steps of the lint job pass on this
    branch.
12. proggeramlug

    added a commit that references this issue on Aug 8, 2026

    refactor(codegen): migrate the computed read/write modules onto the L…

    ...

    4537021
13. 10 remaining items

    Load more
14. proggeramlug

    added 11 commits that reference this issue on Aug 8, 2026

    refactor(codegen): Layer 1 rooting migration slice 6 — the multi-poin…

    ...

    6d5b0cc

    fix(gc): Layer 1 rooting slice 7 — child_process, Proxy/Reflect, await (

    ...

    a1a8b90

    fix(gc): Layer 1 rooting slice 7 — child_process, Proxy/Reflect, await (

    ...

    6adf1c7

    fix(gc): Layer 1 rooting slice 7 — child_process, Proxy/Reflect, await (

    ...

    d37df2d

    docs(codegen): repoint the TempRootPool doc link after the move (#7615)

    ...

    d21c41f

    refactor(codegen): split the instance allocation out of lower_call/ne…

    ...

    0135353

    refactor(codegen): split string concat out of lower_string_method.rs (#…

    ...

    e138c3b

    fix(gc): Layer 1 rooting slice 8 — the raw API becomes unreachable (#…

    ...

    347e5a8

    test(gc): pin the slice-8 windows, and record two ways the pin was va…

    ...

    ee42889

    docs(codegen): repoint the TempRootPool doc link after the move (#7615)

    ...

    a20c92a

    gc: Layer 1 rooting slice 8 — the raw API becomes unreachable (#7615) (…

    ...

    a853135
15. proggeramlug commented on Aug 9, 2026

    

    proggeramlug

    on Aug 9, 2026

    ContributorAuthor

    More actions

    Closed — the terminal condition is met, by #7670 (slice 8, v0.5.1384).

    The condition as this issue stated it ("expr/temp_root.rs going pub(in crate::rooting) — the raw accessor unreachable, not merely uncounted") turned out not to be expressible in Rust: pub(in path) requires path to be an ancestor of the item (E0742), and crate::rooting is not an ancestor of crate::expr::temp_root. So the file moved. It is now crate::rooting::temp_root, declared mod temp_root; (private) with pub(in crate::rooting) on all 25 accessors — both, because either alone is one keyword from being undone.

    Verified in the merged tree, two ways: a raw call planted in a migrated module at top level (expr/math_simple.rs) and in a nested submodule (expr/static_field_meta.rs) each fail with error[E0603]: module temp_root is private. That is the difference between a ledger line and a guarantee.

    Fourteen raw entry points were deleted rather than narrowed (the StoreOperandGuard and RootedHandle families, lower_exprs_rooted, lower_operand_pair_rooted, temp_root_scope_*, …), per CLAUDE.md's kill-policy: a narrowed-but-live API is a decision nobody has made.

    Eight slices, and every one found live bugs — which was the point, not a side effect. A partial list: arr.length = f() unguarded; two array element stores holding a heap-string key across the value; the polymorphic o[k]=v fallback guarding neither operand; a namespace call with rest parameters printing nothing at exit 0; console.dir(x, y, f()) printing before running f; console.time("t", g()) never evaluating g at all; console.table(a,b,c) silently becoming console.log; child_process validating each argument as it lowered, so execSync(123, sideEffect()) threw before evaluating sideEffect.

    What this does not claim, and the ledger says so in its own comment: a listed module cannot make an ordering mistake against the raw API, because it no longer names it. A window with no rooting decision at all is invisible to the check. #7640 (~20 such arms) and Layer 3 are the open half.
16. proggeramlug

    closed this as completedon Aug 9, 2026
17. proggeramlug

    added 2 commits that reference this issue on Aug 9, 2026

    fix(codegen): root a[i]++ / o.f++'s result across the write (#7628)

    ...

    fb9bd92

    fix(codegen): the lowering-window cluster — push order, member update…

    ...

    9965eb3