@amritk/nish-x86_64-linux 0.12.0 → 0.14.0

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 `nish` compiles a static subset of TypeScript to LLVM IR and, with
 `--link`, to a native binary. The compiler is itself a native binary, written
-in Nish (`self/`), and needs nothing to run; the `--link` step (and anything
+in Nish (`src/`), and needs nothing to run; the `--link` step (and anything
 else that turns `.ll` into machine code) needs an LLVM toolchain.
 
 ## 1. Prerequisites
@@ -142,7 +142,7 @@ The npm route installs the **native** compiler, and it is a download rather than
 build: nothing is compiled on your machine. The package declares one
 `nish-<os>-<arch>` package per supported platform as an `optionalDependencies`
 entry with `os` and `cpu` set, so npm fetches exactly the one that matches and
-skips the rest. Each of those carries the self-hosted compiler — `self/`
+skips the rest. Each of those carries the self-hosted compiler — `src/`
 compiled by itself — already built, `--verify`d and smoke-tested on a machine
 of its own architecture by the release workflow.
 
@@ -198,7 +198,7 @@ nish: no prebuilt compiler for freebsd/x64
 
 Until 0.6.0 it ran the TypeScript compiler that shipped in the same package
 instead — the same compiler by every test here, about eight times slower, and
-no C toolchain needed. That compiler was `src/`, which was deleted in R6
+no C toolchain needed. That compiler was stage0, which was deleted in R6
 ([wp19](wp19-stage0-retirement.md)), so there is nothing left in the package to
 fall back to. The cost is stated where the rest of that deletion's costs are,
 in [wp19 §6](wp19-stage0-retirement.md#6-what-retirement-costs-stated-plainly),
@@ -218,7 +218,7 @@ routes are
   # in the glibc container, where build/nish runs
   build/nish app.ts -o app.ll
   # on the musl host, with its own clang and the runtime from this repository
-  clang app.ll runtime/runtime.c runtime/runtime_os.c -lm -o app
+  clang app.ll runtime/runtime.c runtime/runtime-os.c -lm -o app
   ```
 
   `--link`ing inside the container is the mistake to avoid: it shells out to the
@@ -268,7 +268,7 @@ npm install -g ./amritk-nish-0.4.0.tgz ./amritk-nish-x86_64-linux-0.4.0.tgz
 ```
 
 As a native compiler, which needs no Node at all. A release also attaches the
-self-hosted compiler — the binary `self/` produces by compiling itself — one
+self-hosted compiler — the binary `src/` produces by compiling itself — one
 per supported platform, from the version named in the last column:
 
 | Asset | For | Attached from |
@@ -326,7 +326,7 @@ release exists, take its version from
 Unpack it and run `bin/nish` from wherever you like; put that on `PATH` if you
 want it there. Keep the directory intact rather than moving the binary out of
 it: `--link` runs `scripts/build.sh` and compiles the C runtime
-(`runtime/runtime.c` and `runtime/runtime_os.c`, the system-call half), and the
+(`runtime/runtime.c` and `runtime/runtime-os.c`, the system-call half), and the
 compiler finds all of them relative to its own location — `bin/nish` alone in a
 directory can still emit IR with `-o`, but `--link` will tell you it cannot
 find `scripts/build.sh`.
@@ -367,23 +367,23 @@ Building the IR yourself rather than through `--link` means naming the runtime
 on the `clang` line, and it is two files:
 
 ```bash
-clang app.ll runtime/runtime.c runtime/runtime_os.c -lm -o app
+clang app.ll runtime/runtime.c runtime/runtime-os.c -lm -o app
 ```
 
 `runtime.c` is the half every program touches — the arena, strings, arrays,
-number formatting, the panics — and `runtime_os.c` is the half that wraps the
+number formatting, the panics — and `runtime-os.c` is the half that wraps the
 system calls: files, directories, subprocesses, `getenv`, the monotonic clock.
 They are separate so that each carries its own measured size ceiling
 ([docs/wp7-runtime.md](wp7-runtime.md)); nothing in the core calls into the
 system-call half, so an older line that names `runtime.c` alone still links a
 program that reads no files and spawns nothing. `scripts/build.sh` compiles
-`runtime_os.c` beside any `runtime.c` it is handed, so a build that goes
+`runtime-os.c` beside any `runtime.c` it is handed, so a build that goes
 through it — every `--link`, and every `--profile` recipe in these documents —
 needs to name only the one.
 
 ## 2a. What `npm run build` does
 
-`self/` is the compiler, written in Nish, and it compiles itself
+`src/` is the compiler, written in Nish, and it compiles itself
 ([docs/wp14-selfhost.md](wp14-selfhost.md)). From a checkout, with clang on
 `PATH`, `npm run build` runs `scripts/bootstrap.sh` with the seed from §2:
 
@@ -406,11 +406,11 @@ binary itself. It looks for `scripts/build.sh` and the two `runtime/*.c` files
 one level up from wherever it was invoked, then in the working directory, so
 it wants a checkout or an installed package around it the way `nish` does.
 
-Because the seed is the last release, `self/` may only *use* in its own
+Because the seed is the last release, `src/` may only *use* in its own
 source the constructs that release compiles. A new construct is implemented
-in `self/` and becomes usable inside `self/` from the next release on; CI's
+in `src/` and becomes usable inside `src/` from the next release on; CI's
 `bootstrap` job is what checks that the released seed still builds stage1.
-Until R6 the seed was a TypeScript compiler in `src/`, run under Node; it was
+Until R6 the seed was a TypeScript compiler, stage0, run under Node; it was
 deleted once the native one answered every flag it did
 ([wp19](wp19-stage0-retirement.md)).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amritk/nish-x86_64-linux",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "The @amritk/nish native compiler for Linux on x86_64",
   "license": "MIT",
   "os": [

package/runtime/nish.d.ts

@@ -54,6 +54,12 @@ type u64 = number;
 type f32 = number;
 type f64 = number;
 
+// ---- Ranged integers (docs/wp31-ranged-integers.md) --------------------------
+//
+// An `i32` the compiler knows lies in `[Lo, Hi]`. The bounds are numeric
+// literal types, and `tsc` checks only that; the range itself is `nish`'s.
+type integer<Lo extends number, Hi extends number> = number;
+
 // ---- Result (docs/LANGUAGE.md -> Result and error handling) ------------------
 //
 // Modelled as the tagged union TypeScript would use anyway, intersected with
@@ -104,6 +110,19 @@ declare function Err<T, E>(error: E): Result<T, E>;
 // `Process` is not that lucky, so a project that needs `@types/node` for other
 // reasons should drop this file's `process` rather than fight it.
 
+/**
+ * The disposable protocol `using` reads (WP29 P2, docs/wp29-thread-surface.md
+ * §5): declared here so that a program using `nish/threads`'s scope needs no
+ * `"ESNext.Disposable"` in its `lib`. `nish` itself takes `using` only for a
+ * `scope()`, and `[Symbol.dispose]` only in `nish/threads`.
+ */
+interface SymbolConstructor {
+  readonly dispose: unique symbol;
+}
+interface Disposable {
+  [Symbol.dispose](): void;
+}
+
 interface Console {
   /** `x` and a newline to stdout. Statement position; exactly one argument. */
   log(x: string | number | boolean): void;
@@ -142,6 +161,18 @@ declare function toF64(x: number | boolean): f64;
 declare function f64ToBits(x: f64): i64;
 declare function bitsToF64(bits: i64): f64;
 
+// ---- Constant time (WP34 N6) ------------------------------------------------
+
+/**
+ * `(a & mask) | (b & ~mask)` with the mask hidden from the optimiser, so it is
+ * never turned into a branch: `a` for an all-ones mask, `b` for zero. Every
+ * operand is one type, `u32` or `u64`. Both are `number` here, so one generic
+ * declaration stands for the two.
+ */
+declare function ctSelect<T extends u32 | u64>(mask: T, a: T, b: T): T;
+/** All-ones of the operands' type when `a === b`, zero otherwise, without a branch. */
+declare function ctEq<T extends u32 | u64>(a: T, b: T): T;
+
 // ---- Streams and files (globals: Nish has no package resolution) ---------
 
 /** `s` to stdout with no trailing newline and no conversion. */
@@ -152,7 +183,7 @@ declare function writeError(s: string): void;
  * `message` and a newline to stderr, then exit 1. Terminates control flow, so
  * it is `never`: that is what lets `tsc` agree that a function ending in a
  * `panic` returns, and that `x` is not null after `if (x === null) { panic(...); }`
- * — the guard-then-panic shape `self/` uses everywhere in place of an assert.
+ * — the guard-then-panic shape `src/` uses everywhere in place of an assert.
  */
 declare function panic(message: string): never;
 /**
@@ -163,6 +194,12 @@ declare function panic(message: string): never;
 declare function readFileSync(path: string): string;
 /** The same read, answering `null` for every path the other exits over. */
 declare function readFileSyncOrNull(path: string): string | null;
+/**
+ * The file's bytes as they are on disk — no UTF-8 assumed, so a zero byte and
+ * a byte of 0x80 or above survive — or `null` for every path
+ * `readFileSyncOrNull` answers `null` for.
+ */
+declare function readFileBytesSync(path: string): u8[] | null;
 declare function writeFileSync(path: string, data: string): void;
 declare function appendFileSync(path: string, data: string): void;
 /** One directory, not recursive; whether a directory is there afterwards. */
@@ -194,6 +231,34 @@ declare function getenv(name: string): string | null;
  * origin is arbitrary, so only the difference between two reads is meaningful.
  */
 declare function monotonicNanos(): i64;
+/**
+ * The modification time of `path` in milliseconds since the epoch, with the
+ * sub-millisecond fraction the file system keeps (Node's `mtimeMs`), or NaN
+ * when it cannot be stat'd. Follows a symbolic link; a directory has one too.
+ */
+declare function statMtimeSync(path: string): f64;
+/**
+ * A descriptor that becomes readable when SIGTERM or SIGINT arrives, whichever
+ * thread the signal lands on, made once (every call answers the same one), or -1.
+ */
+declare function signalFd(): i32;
+/**
+ * Block until SIGTERM or SIGINT arrives and answer its number, 15 or 2; -1 for
+ * any `fd` that is not `signalFd()`'s. No reading under Node, which throws.
+ */
+declare function readSignal(fd: i32): i32;
+
+// ---- `Date` and `crypto` (WP34 N3) -----------------------------------------------
+//
+// `lib.es2022` already declares `Date`, whose `now()` is Nish's one member of it,
+// so nothing is added: `tsc` accepting `new Date()` is `tsc` not being Nish's
+// checker. `crypto` is a Web API that `lib.es2022` leaves out, so it is
+// declared with its one member, typed as Nish types it.
+
+declare var crypto: {
+  /** Every byte of `bytes` from the system's CSPRNG; at most 65,536 bytes a call. */
+  getRandomValues(bytes: u8[]): void;
+};
 
 // ---- The builtin modules (`nish:`) ---------------------------------------------
 //
@@ -210,6 +275,7 @@ declare function monotonicNanos(): i64;
 declare module "nish:fs" {
   export function readFileSync(path: string): string;
   export function readFileSyncOrNull(path: string): string | null;
+  export function readFileBytesSync(path: string): u8[] | null;
   export function writeFileSync(path: string, data: string): void;
   export function appendFileSync(path: string, data: string): void;
   /** `true` when the directory was created, `false` when it already existed. */
@@ -221,6 +287,8 @@ declare module "nish:fs" {
    */
   export function readdirSync(path: string): string[] | null;
   export function realpathSync(path: string): string | null;
+  /** Node's `mtimeMs` for the path, or NaN when it cannot be stat'd. */
+  export function statMtimeSync(path: string): f64;
 }
 
 declare module "nish:process" {
@@ -238,6 +306,10 @@ declare module "nish:process" {
    * difference between two reads is meaningful.
    */
   export function monotonicNanos(): i64;
+  /** A descriptor readable when SIGTERM or SIGINT arrives; the same one every call, or -1. */
+  export function signalFd(): i32;
+  /** Block until SIGTERM or SIGINT arrives: 15 or 2, or -1 for a descriptor that is not `signalFd()`'s. */
+  export function readSignal(fd: i32): i32;
   /** The command line; `argv[0]` is the program path, as in C. Read-only. */
   export const argv: readonly string[];
   /** The operating system the program runs on: `"linux"`, `"darwin"`, or `"unknown"`. */
@@ -284,6 +356,18 @@ declare interface CPtr {
   readonly __nishForeignPointer: unique symbol;
 }
 
+// ---- `set` on an array ----------------------------------------------------------
+//
+// `dst.set(src, offset)` copies all of `src` into `dst` from `offset` on, with
+// `TypedArray.prototype.set`'s meaning (WP34 N2). A `u8[]` is an `Array` to
+// `tsc`, and `lib.es5.d.ts` gives `Array` a `fill` of the same meaning but no
+// `set`, so this is the one method added to it; `runtime/nish.mjs` installs it
+// under Node. Nish admits it on an array of numbers only.
+
+interface Array<T> {
+  set(source: readonly T[], offset?: number): void;
+}
+
 // ---- What this file cannot say ----------------------------------------------
 //
 // The typed-array aliases (`Int32Array`, `Float32Array`, `Float64Array`,

package/runtime/nish.h

@@ -2,10 +2,10 @@
  *
  * Include this from C drivers, N-API shims, or any other host that links the C
  * runtime next to compiled Nish modules. Everything here is a contract shared
- * with `self/runtime.ts` (the IR side) and the implementation, which is
+ * with `src/runtime.ts` (the IR side) and the implementation, which is
  * two translation units: `runtime/runtime.c` holds the core every program
  * touches — the arena, strings, arrays, number formatting, the panics — and
- * `runtime/runtime_os.c` holds everything that wraps a system call: the file
+ * `runtime/runtime-os.c` holds everything that wraps a system call: the file
  * functions, the directory and subprocess calls, `nish_getenv`, the monotonic
  * clock, `nish_platform` / `nish_arch`. They are separate so that each carries
  * its own measured code-size ceiling (docs/wp7-runtime.md, "Runtime additions
@@ -41,7 +41,7 @@ extern "C" {
  * ELF refuses to link that against a non-TLS definition. `scripts/build.sh
  * --threads` passes the macro to every input, which is how `nish --threads
  * --link` keeps the two halves in step. The same definition is in
- * runtime/runtime.c and runtime/runtime_wasm.c. */
+ * runtime/runtime.c and runtime/runtime-wasm.c. */
 #ifdef NISH_THREADS
 #define NISH_TLS _Thread_local
 #else
@@ -73,7 +73,7 @@ typedef struct nish_str {
  * `off` and `cap` are `uint64_t` and not `size_t` because that `i64` is what
  * the inlined fast path bumps and compares on every target: under wasm32 a
  * `size_t` pair would put them at bytes 4 and 8 while compiled code reads 8
- * and 16. runtime.c and runtime_wasm.c static-assert these offsets. */
+ * and 16. runtime.c and runtime-wasm.c static-assert these offsets. */
 struct nish_arena {
   char *buf;
   uint64_t off;
@@ -140,7 +140,7 @@ nish_str *nish_str_from_u64(uint64_t v);
 
 /* Process and file I/O (WP7). `nish_exit` never returns; the file functions
  * print a message to stderr and exit(1) on a fatal error. Everything from here
- * to the end of the clock section below is implemented in runtime_os.c, with
+ * to the end of the clock section below is implemented in runtime-os.c, with
  * `nish_random` and `nish_argv_init` the exceptions: neither asks the operating
  * system anything (the clock only seeds the first, and the entry point hands the
  * second its arguments), so both stay with the core. `nish_random` keeps one seed
@@ -181,11 +181,11 @@ void nish_append_file(const nish_str *path, const nish_str *data);
  * A returned array lives in the arena (valid until the next reset/release):
  * copy `len` elements out of `data` before recycling.
  *
- * An array field stored inside its object (`self/inline_arrays.ts`) is this
+ * An array field stored inside its object (`src/inline-arrays.ts`) is this
  * header followed by its `K` slots, `struct { nish_array h; T slots[K]; }`
- * with `h.data == (char *)slots` and `h.cap == K`; `self/runtime.ts`'s
- * `ARRAY_TYPE` and `self/structs.ts`'s `INLINE_HEADER_BYTES` are the same 24
- * bytes, and `tests/layout/inline_array.c` holds the three to it. It only
+ * with `h.data == (char *)slots` and `h.cap == K`; `src/runtime.ts`'s
+ * `ARRAY_TYPE` and `src/structs.ts`'s `INLINE_HEADER_BYTES` are the same 24
+ * bytes, and `tests/layout/inline-array.c` holds the three to it. It only
  * happens where no header, `.d.ts` or N-API shim describes the class, so a
  * host that includes a generated header never meets one. */
 typedef struct nish_array { uint64_t len; uint64_t cap; char *data; } nish_array;
@@ -243,6 +243,12 @@ bool nish_is_dir(const nish_str *path);
  * under WASI: `fd_readdir` lists a preopened directory rather than a path, so
  * porting this there is a different contract and not a translation. */
 nish_array *nish_readdir(const nish_str *path);
+/* `readFileBytesSync(path)` (WP34 N2): the file's bytes as a `u8[]` with
+ * `len == cap`, zero bytes and bytes of 0x80 and above kept as they are, or
+ * NULL for every path `nish_read_file_or_null` answers NULL for. The header
+ * and the bytes live in the arena, so copy what you keep before the next reset
+ * or release. */
+nish_array *nish_read_file_bytes(const nish_str *path);
 /* `spawnSync(argv)`: run element 0 of `argv` (searched on `PATH`) with `argv`
  * as its argument vector, wait for it, and answer its exit status, or
  * `128 + n` when signal `n` killed it. -1 when `argv` is empty, when the
@@ -260,7 +266,7 @@ int32_t nish_spawn(const nish_array *argv);
  * paths must differ: each is opened separately with its own offset, so naming
  * one file twice makes the streams overwrite each other instead of
  * interleaving; capture them apart and concatenate to merge them. One `static`
- * implementation in runtime_os.c backs both spawn builtins, which is what keeps
+ * implementation in runtime-os.c backs both spawn builtins, which is what keeps
  * the argument vector, the wait and the signal convention written once. */
 int32_t nish_spawn_to(const nish_array *argv, const nish_str *out, const nish_str *err);
 
@@ -306,6 +312,31 @@ const nish_str *nish_arch(void);
  * region into one and measure zero. */
 int64_t nish_monotonic_nanos(void);
 
+/* ---- The host (WP34 N3), runtime/runtime-host.c --------------------------
+ * `Date.now()`: the wall clock, `CLOCK_REALTIME`, in whole milliseconds since
+ * the epoch, as JavaScript answers it. Unlike `nish_monotonic_nanos` it can go
+ * backwards when the clock is corrected; it is for a time a person or a
+ * certificate means, not for measuring an interval. */
+double nish_date_now(void);
+/* `crypto.getRandomValues(bytes)`: fills `bytes->len` bytes from the kernel's
+ * CSPRNG (`getrandom` on Linux, `getentropy` elsewhere). More than 65,536
+ * bytes, the Web API's limit for one call, and a failing entropy source both
+ * print a message and exit 1; nothing weaker is ever substituted. */
+void nish_random_fill(nish_array *bytes);
+/* `statMtimeSync(path)`: the modification time in milliseconds with its
+ * sub-millisecond fraction, computed as Node's `mtimeMs` is, or NaN when
+ * `stat` fails. Follows a symbolic link. */
+double nish_stat_mtime(const nish_str *path);
+/* `signalFd()`: a descriptor that becomes readable when SIGTERM or SIGINT
+ * arrives: the read end of a pipe that a `sigaction` handler writes each
+ * signal's number to, whichever thread the signal lands on. Nothing is
+ * blocked. Made once; every call answers the same descriptor, and -1 when it
+ * could not be made. `readSignal(fd)`: block until one arrives and
+ * answer its number (15 or 2), or -1 for any `fd` that is not that descriptor
+ * or a read that fails. */
+int32_t nish_signal_fd(void);
+int32_t nish_read_signal(int32_t fd);
+
 /* String to number (WP7), ASCII whitespace only. mode 0 is `parseFloat`
  * (longest JS decimal literal or `Infinity`, else NaN), mode 1 is `Number`
  * (the whole string, trimmed; blank is 0; `0x` hex accepted, as in JS),
@@ -316,7 +347,7 @@ double nish_parse_number(const nish_str *s, int32_t mode);
 /* Checked integer division (Rust semantics): the failed-check path. */
 void nish_panic_div(bool by_zero);
 
-/* ---- Parallel work (WP20 T1 / wp29 stage P1), runtime/runtime_parallel.c ----
+/* ---- Parallel work (WP20 T1 / wp29 stage P1), runtime/runtime-parallel.c ----
  *
  * One region of work, divided. `nish_parallel_range` calls `body(lo, hi, ctx)`
  * once per chunk of a partition of `[0, len)`: contiguous chunks, at most one
@@ -341,6 +372,26 @@ typedef void (*nish_par_body)(int64_t lo, int64_t hi, void *ctx);
 int64_t nish_cpu_count(void);
 void nish_parallel_range(nish_par_body body, void *ctx, int64_t len, int64_t grain);
 
+/* ---- A scope's tasks (wp29 stage P2), runtime/runtime-parallel.c ----
+ *
+ * `nish_scope_spawn` files one task under `scope`, an address the caller keeps
+ * alive until it joins: it copies `size` bytes of `payload` and keeps them with
+ * `run` and `finish`, and runs nothing yet. `nish_scope_join` takes every task
+ * filed under `scope`, runs `run(payload)` for each -- the first on the calling
+ * thread and each other on a thread of its own, which frees its arena before it
+ * exits -- waits for all of them, and then calls `finish(payload)` for each on
+ * the calling thread, in the order they were filed. Without `-DNISH_THREADS`,
+ * or when a thread cannot be created, a task runs on the calling thread, so
+ * running short of threads costs speed and never an answer.
+ *
+ * The preconditions are the language's (docs/LANGUAGE.md, "Scoped tasks"):
+ * `run` writes nothing another task or the caller can see, its result is a
+ * scalar it writes into its own payload, and only `finish`, on the calling
+ * thread, stores into memory the caller owns. */
+typedef void (*nish_task_fn)(void *payload);
+void nish_scope_spawn(void *scope, nish_task_fn run, nish_task_fn finish, const void *payload, int64_t size);
+void nish_scope_join(void *scope);
+
 #ifdef __cplusplus
 }
 #endif

package/runtime/nish.mjs

@@ -28,9 +28,9 @@
  *     so is every string offset. ASCII agrees; nothing else does.
  *   - **`a[i]` is unchecked**: out of range is `undefined` here and an exit-1
  *     panic natively. Only a program that indexes out of range can tell.
- *   - **Method dispatch is virtual under Node** and static natively, so an
- *     override reached through a base-typed value differs (LANGUAGE.md,
- *     "Method dispatch is static").
+ *   - **A record put into an array is shared here** and copied natively, and
+ *     `slice`, `new Array<T>(n)` and the typed-array names each differ too;
+ *     the document lists them.
  *   - **`orReturn()` does not propagate.** It throws a marker the rewriter's
  *     `try`/`catch` turns into an early `return`; unmodified there is no
  *     `catch`, so it escapes. `Ok`/`Err`/`isOk`/`isErr`/`value`/`error`/
@@ -84,6 +84,7 @@ provide("writeError", shim.writeError);
 provide("panic", shim.panic);
 provide("readFileSync", shim.readFileSync);
 provide("readFileSyncOrNull", shim.readFileSyncOrNull);
+provide("readFileBytesSync", shim.readFileBytesSync);
 provide("writeFileSync", shim.writeFileSync);
 provide("appendFileSync", shim.appendFileSync);
 provide("mkdirSync", shim.mkdirSync);
@@ -93,6 +94,35 @@ provide("realpathSync", shim.realpathSync);
 provide("spawnSync", shim.spawnSync);
 provide("spawnSyncTo", shim.spawnSyncTo);
 provide("getenv", shim.getenv);
+provide("statMtimeSync", shim.statMtimeSync);
+provide("signalFd", shim.signalFd);
+provide("readSignal", shim.readSignal);
+
+// `crypto.getRandomValues(bytes)` (WP34 N3). Node has the global, but it
+// takes only a typed array and a `u8[]` is a plain `Array` here, so the one
+// method is replaced on Node's own `crypto` object by one that fills a plain
+// array too (and hands a typed array to the original).
+Object.defineProperty(globalThis.crypto, "getRandomValues", {
+  value: shim.getRandomValues,
+  writable: true,
+  configurable: true,
+});
+
+// `dst.set(src, offset)` (WP34 N2). A `u8[]` is a plain `Array` here, which
+// has `fill` with the typed array's meaning already but no `set`, so the one
+// method is added to `Array.prototype` — non-enumerable, as a builtin method is,
+// so no `for...in` sees it — unless something got there first. It copies the
+// source before writing, as the native `memmove` does, and fails a range past
+// the end with the native panic.
+if (!("set" in Array.prototype)) {
+  Object.defineProperty(Array.prototype, "set", {
+    value: function set(source, offset) {
+      shim.arraySet(this, source, offset);
+    },
+    writable: true,
+    configurable: true,
+  });
+}
 
 // The clock. `monotonicNanos()` answers an `i64`, so the value is a BigInt here
 // as it is in the rewritten runner — and unusually for the i64 surface that is
@@ -117,6 +147,11 @@ provide("toU64", (x) => shim.convert(x, "f64", "u64"));
 provide("f64ToBits", shim.f64ToBits);
 provide("bitsToF64", shim.bitsToF64);
 
+// Constant time (WP34 N6). Pure functions of their operands, so the answers
+// agree with a native run; the timing does not, and is not claimed here.
+provide("ctSelect", shim.ctSelect);
+provide("ctEq", shim.ctEq);
+
 // `Result`. Everything works but `orReturn`, which needs the caller's control
 // flow and therefore the rewriter; see the header.
 provide("Ok", shim.Ok);

package/runtime/runtime-host.c

@@ -0,0 +1,178 @@
+/* Nish runtime, the host half: the wall clock, entropy, a file's modification
+ * time and a descriptor that becomes readable when SIGTERM or SIGINT arrives
+ * (WP34 N3) — the four facts a program that runs for days asks of the machine
+ * it runs on.
+ *
+ * A translation unit of its own for the reason runtime-os.c is one: each file
+ * carries its own measured `.text*` ceiling in tests/run.js. runtime-os.c had
+ * 143 bytes of its ceiling left when these arrived, the four measure more than
+ * that, and a ceiling is not raised to make room (docs/MASTER_PLAN.md §2 has
+ * the numbers). Section GC still means a program that calls none of them pays
+ * for none of them, and scripts/build.sh pairs this file with runtime.c like
+ * the other two halves, so a link line still names one runtime.
+ *
+ * Every function here is platform code, and the two platforms differ in three
+ * places: `getrandom` on Linux and `getentropy` elsewhere, `st_mtim`
+ * against Darwin's `st_mtimespec`, and `pipe2` against `pipe` for the signal
+ * descriptor. A WASI build has none of this
+ * (the checker refuses all four under a wasm target), so there the file is
+ * empty.
+ */
+#if defined(__wasi__) || defined(__wasm__)
+/* ISO C wants at least one declaration in a translation unit. */
+typedef int nish_host_unused;
+#else
+#if defined(__linux__)
+/* glibc declares `clock_gettime`, `sigaction` and `pipe2` under `-std=c11`
+   only with a feature macro, and `pipe2` only with this one. Darwin declares
+   everything by default and hides `getentropy` and the `st_mtimespec`
+   spelling behind a strict feature level, so it gets none. */
+#define _GNU_SOURCE
+#endif
+#include <errno.h>
+#include <signal.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <sys/stat.h>
+#include <time.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/random.h>
+
+#include "nish.h"
+
+/* The spelling runtime.c and runtime-os.c use for their cold paths. */
+#define NISH_COLD __attribute__((noreturn, cold, noinline))
+
+/* `Date.now()`: `CLOCK_REALTIME` in whole milliseconds since the epoch, as
+   JavaScript answers it — the milliseconds are counted in integers and then
+   converted, so the answer is exact until the year 287,396 and a negative
+   time floors the way `Date.now` does rather than rounding towards zero. */
+double nish_date_now(void) {
+  struct timespec ts;
+  clock_gettime(CLOCK_REALTIME, &ts);
+  return (double)((int64_t)ts.tv_sec * 1000 + ts.tv_nsec / 1000000);
+}
+
+static NISH_COLD void nish_entropy_fail(uint64_t asked) {
+  if (asked > 65536) {
+    dprintf(2, "crypto.getRandomValues: %llu bytes asked for, and one call fills at most 65536\n",
+            (unsigned long long)asked);
+  } else {
+    dprintf(2, "crypto.getRandomValues: the system's entropy source failed\n");
+  }
+  _exit(1);
+}
+
+/* `crypto.getRandomValues(bytes)`: every byte of `bytes` from the kernel's
+   CSPRNG, or a panic. There is no fallback to a weaker source, because a
+   program handed predictable bytes for a key or a nonce cannot tell. The Web
+   API's limit of 65,536 bytes a call is kept, so a program behaves the same
+   under Node. `getrandom` without flags blocks only until the pool is first
+   initialised at boot and can return short or be interrupted, so it loops;
+   `getentropy` fills at most 256 bytes a call and retries nothing itself. */
+void nish_random_fill(nish_array *bytes) {
+  uint64_t n = bytes->len;
+  char *p = bytes->data;
+  if (n > 65536) nish_entropy_fail(n);
+  while (n > 0) {
+#if defined(__linux__)
+    ssize_t got = getrandom(p, n, 0);
+    if (got < 0) {
+      if (errno == EINTR) continue;
+      nish_entropy_fail(0);
+    }
+#else
+    size_t got = n < 256 ? n : 256;
+    if (getentropy(p, got) != 0) nish_entropy_fail(0);
+#endif
+    p += got;
+    n -= (uint64_t)got;
+  }
+}
+
+/* `statMtimeSync(path)`: the modification time in milliseconds, with the
+   sub-millisecond part the file system keeps, or NaN when `stat` fails. The
+   arithmetic is Node's `mtimeMs` operation for operation — seconds times 1e3
+   plus nanoseconds over 1e6, in doubles — so the two readings print the same
+   digits. `stat` follows a symbolic link, as `fs.statSync` does. */
+double nish_stat_mtime(const nish_str *path) {
+  struct stat st;
+  if (stat(path->data, &st) != 0) return __builtin_nan("");
+#if defined(__APPLE__)
+  struct timespec t = st.st_mtimespec;
+#else
+  struct timespec t = st.st_mtim;
+#endif
+  return (double)t.tv_sec * 1e3 + (double)t.tv_nsec / 1e6;
+}
+
+/* ---- Signals: `signalFd()` and `readSignal(fd)`
+ *
+ * A descriptor rather than a handler in the language, because a handler would
+ * be a function value the language does not have, and because a descriptor is
+ * what a loop waiting in `epoll` or `poll` can wait on beside its sockets.
+ *
+ * Underneath it is a C handler writing each signal's number, one byte, to a
+ * pipe. It is not a `signalfd` on Linux, deliberately: a `signalfd` only
+ * hears a signal that is blocked in **every** thread, and a mask reaches only
+ * the calling thread, so a `scope()` task or a parallel worker already
+ * running when `signalFd()` was called would take the signal at its default
+ * action and end the process. A handler runs in whichever thread the kernel
+ * picks, so no thread's mask matters, and nothing is blocked for a child
+ * `spawnSync` starts to inherit: `exec` resets a caught signal to its
+ * default. Installing the handler also overrides a disposition the process
+ * was started with, so a signal its parent ignored is heard, as
+ * `process.on('SIGTERM')` hears it under Node.
+ *
+ * The handler is the whole of what runs in signal context, and `write` is
+ * async-signal-safe. The write end is non-blocking, so a thousand unread
+ * signals lose the newest rather than wedge the handler, and `errno` is put
+ * back for the code the signal interrupted. The descriptor is made once and
+ * every later `signalFd()` answers the same one. */
+static int nish_signal_read_end = -1;
+static int nish_signal_write_end = -1;
+
+static void nish_on_signal(int sig) {
+  int saved = errno;
+  unsigned char b = (unsigned char)sig;
+  (void)!write(nish_signal_write_end, &b, 1);
+  errno = saved;
+}
+
+int32_t nish_signal_fd(void) {
+  if (nish_signal_read_end >= 0) return nish_signal_read_end;
+  int p[2];
+#if defined(__linux__)
+  /* Both ends close-on-exec from the moment they exist, so a child a sibling
+     thread spawns meanwhile cannot inherit either. */
+  if (pipe2(p, O_CLOEXEC) != 0) return -1;
+#else
+  /* Darwin has no `pipe2`, so there is a window between `pipe` and the two
+     `fcntl`s in which a child spawned by another thread inherits the ends. */
+  if (pipe(p) != 0) return -1;
+  fcntl(p[0], F_SETFD, FD_CLOEXEC);
+  fcntl(p[1], F_SETFD, FD_CLOEXEC);
+#endif
+  fcntl(p[1], F_SETFL, O_NONBLOCK);
+  nish_signal_write_end = p[1];
+  struct sigaction sa;
+  sa.sa_handler = nish_on_signal;
+  sa.sa_flags = SA_RESTART;
+  sigemptyset(&sa.sa_mask);
+  sigaction(SIGINT, &sa, 0);
+  sigaction(SIGTERM, &sa, 0);
+  return nish_signal_read_end = p[0];
+}
+
+/* Block until a signal's byte arrives and answer it: 15 or 2, or -1 for any
+   `fd` that is not the signal descriptor and for a read that fails. */
+int32_t nish_read_signal(int32_t fd) {
+  if (fd != nish_signal_read_end) return -1;
+  unsigned char b;
+  ssize_t n;
+  do n = read(fd, &b, 1);
+  while (n < 0 && errno == EINTR);
+  return n == 1 ? (int32_t)b : -1;
+}
+#endif