@scriptc/compiler 0.0.34 → 0.0.36

package/dist/backend/{cc.js → native-toolchain.js}

@@ -1,13 +1,25 @@
+import { InternalCompilerError } from "../errors.js";
 import { execFile, spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { constants as fsConstants, existsSync, readdirSync } from "node:fs";
 import { createRequire } from "node:module";
-import { access, chmod, copyFile, link, lstat, mkdir, mkdtemp, readdir, readFile, realpath, rename, rm, stat, unlink, utimes, writeFile } from "node:fs/promises";
+import { access, chmod, copyFile, link, lstat, mkdir, mkdtemp, readdir, readFile, realpath, rename, rm, stat, utimes, writeFile } from "node:fs/promises";
 import { availableParallelism, homedir, tmpdir } from "node:os";
 import { basename, delimiter, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
+import { performance } from "node:perf_hooks";
+import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { localizeElfObject, mergeAndLocalizeCoffObjects } from "./object-localize.js";
+import { createVendorArchives, MBEDTLS_VERSION, QJS_COMMIT, ZLIB_VERSION, } from "./vendor-archives.js";
+import { cacheDigestPath, cacheRootDir, copyValidCachedFile, ensurePrivateCacheRoot, fileDigest, fileExists, installArtifact, privateSiblingPath, protectCachedArtifact, pruneCache, publishCachedFile, validCachedFile, } from "./build-cache.js";
+export { buildCacheRoot, prepareBuildCacheRoot, pruneBuildCache, resolveBuildCacheRoot, } from "./build-cache.js";
 const execFileAsync = promisify(execFile);
+const NATIVE_TOOLCHAIN_IMPLEMENTATION_PATH = fileURLToPath(import.meta.url);
+const NATIVE_RECIPE_IMPLEMENTATION_PATHS = [
+    NATIVE_TOOLCHAIN_IMPLEMENTATION_PATH,
+    join(dirname(NATIVE_TOOLCHAIN_IMPLEMENTATION_PATH), `build-cache${extname(NATIVE_TOOLCHAIN_IMPLEMENTATION_PATH)}`),
+    join(dirname(NATIVE_TOOLCHAIN_IMPLEMENTATION_PATH), `vendor-archives${extname(NATIVE_TOOLCHAIN_IMPLEMENTATION_PATH)}`),
+];
 /** Test lanes run against one immutable checkout and one immutable toolchain
  * for the lifetime of each Vitest worker. Production deliberately rediscovers
  * compiler/linker inputs on every invocation, but doing that thousands of
@@ -32,22 +44,43 @@ function stableTestMemo(cache, key, probe) {
     });
     return pending;
 }
-const RUNTIME_SOURCES = ["scr_number.c", "scr_string.c", "scr_array.c", "scr_bytes.c", "scr_bytes_io.c", "scr_map.c", "scr_closure.c", "scr_ffi.c", "scr_object.c", "scr_union.c", "scr_exception.c", "scr_error.c", "scr_console.c", "scr_lib.c", "scr_path.c", "scr_url.c", "scr_json.c", "scr_async.c", "scr_child.c", "scr_cycle.c"];
-/** The pinned quickjs-ng snapshot under packages/runtime/vendor/quickjs-ng
- * (see vendor/README.md — update both together). Keys the archive cache so
- * a vendor bump can never reuse a stale engine build. */
-const QJS_COMMIT = "3c8f3d68953955950074c41c6e4d999562ae82a7";
-/** The pinned mbedTLS snapshot under packages/runtime/vendor/mbedtls (see
- * vendor/README.md — update both together). Keys the archive cache so a
- * vendor bump can never reuse a stale TLS build, and joins the runtime
- * fingerprint so cached binaries re-key too. */
-const MBEDTLS_VERSION = "3.6.7";
-/** The pinned zlib snapshot under packages/runtime/vendor/zlib (see
- * vendor/README.md — update both together). Keys the per-target object
- * cache and joins the runtime fingerprint. Host builds never compile it —
- * they keep the historical system `-lz` link; the vendored copy exists so
- * zlib-using programs CROSS-compile (zig has no target sysroot libz). */
-const ZLIB_VERSION = "1.3.1";
+export const EXECUTABLE_RUNTIME_SOURCES = ["scr_number.c", "scr_string.c", "scr_array.c", "scr_bytes.c", "scr_bytes_io.c", "scr_map.c", "scr_closure.c", "scr_ffi.c", "scr_object.c", "scr_union.c", "scr_exception.c", "scr_error.c", "scr_console.c", "scr_lib.c", "scr_path.c", "scr_url.c", "scr_json.c", "scr_async.c", "scr_child.c", "scr_cycle.c"];
+/**
+ * Per-executable section-elimination recipe. This belongs beside the native
+ * driver rather than a particular build path: one-shot compilation, cached
+ * runtime objects, external object recipes, and runtime packs must all agree
+ * on what their final executable linker is allowed to discard.
+ *
+ * Archives and compile-only object/library recipes deliberately do not use
+ * the link half. In particular, `--lib` preserves its established object and
+ * archive contract; section GC is an executable-link optimization only.
+ */
+export function executableSectionEliminationFlags(platform) {
+    switch (platform) {
+        case "darwin":
+            // ld64's symbol subsections make this sufficient for ordinary C/LLVM
+            // objects. Do not attach it only to --dynamic: static programs have the
+            // same unreachable runtime sections.
+            return { compile: [], link: ["-Wl,-dead_strip"] };
+        case "linux":
+            return {
+                compile: ["-ffunction-sections", "-fdata-sections"],
+                link: ["-Wl,--gc-sections"],
+            };
+        case "win32":
+            // clang's MinGW driver forwards this to GNU-flavor ld/lld. A direct
+            // local lld-link invocation instead uses /OPT:REF, but scriptc only
+            // drives the compiler's GNU-flavor route here.
+            return {
+                compile: ["-ffunction-sections", "-fdata-sections"],
+                link: ["-Wl,--gc-sections"],
+            };
+        // WASI has a distinct linker/runtime contract. Keep its existing object
+        // layout until its linker invocation is validated separately.
+        default:
+            return { compile: [], link: [] };
+    }
+}
 /** Environment variables consumed by clang, its linker/subtools, or the
  * platform SDK selection. They are implicit command-line inputs: changing one
  * must never reuse an artifact produced under the old toolchain posture. */
@@ -118,17 +151,6 @@ const MUTABLE_COMPILE_ENV_KEYS = [
     "CCC_ADD_ARGS",
     "CLANG_CONFIG_FILE_SYSTEM_DIR",
     "CLANG_CONFIG_FILE_USER_DIR",
-    // The direct runtime build does not consume the conventional Make/CMake
-    // variables, but the lazily-built QuickJS prerequisite does. Their values
-    // can name mutable tools, headers, libraries, and toolchain files, so a
-    // stable spelling is not a safe persistent-cache identity.
-    "CC",
-    "CFLAGS",
-    "CPPFLAGS",
-    "LDFLAGS",
-    "AR",
-    "RANLIB",
-    "CMAKE_TOOLCHAIN_FILE",
     // `zig cc` resolves its bundled headers/runtime through ZIG_LIB_DIR and a
     // caller-selected native libc description through ZIG_LIBC. Both values name
     // mutable compiler inputs whose contents can change behind a stable path.
@@ -155,6 +177,41 @@ export function toolchainEnvironmentFingerprint(env = process.env) {
     }
     return hash.digest("hex");
 }
+/** Inputs that can change which native tool/runtime implementation an
+ * executable build selects before compileC has a chance to rediscover it.
+ * The early whole-program cache keys this exact posture before restoring a
+ * final binary; compileC retains its deeper inode/content validation. */
+export async function executableNativeEnvironmentFingerprint(env = process.env) {
+    const configuredCompiler = env["SCRIPTC_CC"] ?? "";
+    let compilerIdentity;
+    try {
+        compilerIdentity = await effectiveCompilerEnvironmentIdentity(resolveCc(env), env);
+    }
+    catch {
+        // A failed trace cannot safely describe a reusable native posture. Keep
+        // the build working, but make this invocation miss every persistent early
+        // entry so compileC performs its full discovery and validation.
+        compilerIdentity = `<unavailable:${configuredCompiler}:${randomUUID()}>`;
+    }
+    const hash = createHash("sha256")
+        .update("executable-native-environment-v2\0")
+        .update(toolchainEnvironmentFingerprint(env)).update("\0")
+        // PATH text alone is not a resolution proof, and on Darwin /usr/bin/clang
+        // is a stable shim whose selected Xcode compiler can change underneath it.
+        // Re-resolve and trace the effective driver on every early lookup.
+        .update(compilerIdentity).update("\0");
+    for (const name of [
+        "PATH",
+        "SCRIPTC_FETCH_CURL",
+        "SCRIPTC_TEST_RUNTIME_SRC_DIR",
+        "SCRIPTC_TEST_VENDOR_CACHE_DIR",
+        "SCRIPTC_TEST_TRUST_COMPILER_WRAPPER",
+    ]) {
+        const value = env[name];
+        hash.update(name).update(value === undefined ? "\0unset\0" : "\0set\0").update(value ?? "").update("\0");
+    }
+    return hash.digest("hex");
+}
 /** Structured compiler-driver failure. Most callers still let this surface
  * as an internal build error; the TypeScript compiler pipeline recognizes it
  * when an outbound FFI profile is active and turns user-controlled native
@@ -200,6 +257,12 @@ export function runtimeSrcDir() {
     const require = createRequire(import.meta.url);
     return join(dirname(require.resolve("@scriptc/runtime/package.json")), "src");
 }
+/** Whether the selected compiler driver is Zig. This is deliberately based on
+ * the executable prefix rather than target presence: targetless Zig is still
+ * a Zig build, while target presence is only the platform/target contract. */
+export function isZigDriver(driver) {
+    return driver.argv[0] === "zig";
+}
 /* ── mobile targets (library mode) ─────────────────────────────────────────
  * Three mobile triples are admitted, and only for LIBRARY-MODE archive
  * builds — the consuming pattern is an embedding app linking the archive,
@@ -397,9 +460,9 @@ export function resolveCc(env = process.env, hostPlatform = process.platform) {
     }
     if (target === "")
         return { argv: ["zig", "cc"], target: null, zigTarget: null, ...hostArgs };
-    if (target.includes("wasi") && target !== "wasm32-wasi") {
-        throw new Error(`unsupported WASI target '${target}' (supported: wasm32-wasi)`);
-    }
+    // Validate the target spelling before any SDK/sysroot discovery. Source
+    // emission uses the same pure classifier without resolving this driver.
+    configuredTargetPlatform(env, hostPlatform);
     const mobileRefusal = mobileTargetRefusal(target, hostPlatform);
     if (mobileRefusal !== null)
         throw new Error(mobileRefusal);
@@ -470,7 +533,7 @@ export function resolveCc(env = process.env, hostPlatform = process.platform) {
 }
 /** Musl intentionally has no predefined libc macro. The explicit Zig target
  * is therefore the source of truth for selecting its small runtime shim. */
-export function isMuslTarget(driver) {
+function isMuslTarget(driver) {
     return driver.target?.includes("linux-musl") ?? false;
 }
 /** The OS the produced binary runs on: the triple's OS under SCRIPTC_TARGET,
@@ -479,21 +542,37 @@ export function isMuslTarget(driver) {
  * analyze(): the FRONTEND consults it too (path.sep / os.EOL literals and
  * the path-module binding follow the target — a win32 triple compiles
  * Node-on-Windows semantics, path.win32 backing the bare module). */
-export function targetPlatform(driver) {
-    if (driver.target === null)
-        return process.platform;
-    if (driver.target.includes("wasi"))
+export function configuredTargetPlatform(env = process.env, hostPlatform = process.platform) {
+    const target = env["SCRIPTC_TARGET"] ?? "";
+    if (target === "")
+        return hostPlatform;
+    if (target === "wasm32-wasi")
         return "wasi";
+    if (target.includes("wasi")) {
+        throw new Error(`unsupported WASI target '${target}' (supported: wasm32-wasi)`);
+    }
     // iOS is a darwin-family target: Mach-O objects, ld64 localization,
     // POSIX path/EOL semantics. Android falls to the linux arm below —
     // bionic is a linux libc and its archives are ordinary ELF.
-    if (isIosTarget(driver.target))
+    if (isIosTarget(target))
         return "darwin";
-    if (driver.target.includes("linux"))
+    if (isAndroidTarget(target))
         return "linux";
-    if (driver.target.includes("windows"))
+    if (/(?:^|-)(?:ios|tvos|watchos|visionos|android)/.test(target)) {
+        throw new Error(`unsupported mobile target '${target}' (supported: ${MOBILE_LIBRARY_TARGETS.join(", ")})`);
+    }
+    if (target.includes("linux"))
+        return "linux";
+    if (target.includes("windows"))
         return "win32";
-    return driver.target.includes("macos") || driver.target.includes("darwin") ? "darwin" : "other";
+    if (target.includes("macos") || target.includes("darwin"))
+        return "darwin";
+    throw new Error(`unsupported target '${target}' (supported OS families: linux, windows, macos/darwin, wasm32-wasi)`);
+}
+export function targetPlatform(driver) {
+    if (driver.target === null)
+        return process.platform;
+    return configuredTargetPlatform({ SCRIPTC_TARGET: driver.target });
 }
 /** Architecture identity for host-native cache entries. Explicit cross targets
  * already name their complete target triple; native builds need the process
@@ -502,455 +581,6 @@ export function targetPlatform(driver) {
 export function cacheTargetIdentity(driver, hostPlatform = process.platform, hostArch = process.arch) {
     return driver.target === null ? `native:${hostPlatform}:${hostArch}` : `cross:${driver.target}`;
 }
-function vendorEngineDir() {
-    return join(runtimeSrcDir(), "..", "vendor", "quickjs-ng");
-}
-/** Vendor prerequisites have historically lived beside their source trees.
- * The test-only override gives cache-ordering tests a disposable root without
- * renaming package-local artifacts that parallel workers may be using. */
-function vendorBuildCacheRoot() {
-    const testRoot = process.env["SCRIPTC_TEST_VENDOR_CACHE_DIR"];
-    return testRoot === undefined
-        ? join(runtimeSrcDir(), "..", "vendor", ".cache")
-        : resolve(testRoot);
-}
-/** Cross targets already carry their architecture in the explicit triple.
- * Host-native prerequisites need the same separation: a checkout/package can
- * be used by both arm64 Node and Rosetta/x64 Node on macOS. */
-export function vendorCacheTargetFlavor(driver, hostPlatform = process.platform, hostArch = process.arch) {
-    return driver.target === null ? `native-${hostPlatform}-${hostArch}` : driver.target;
-}
-/** Vendor prerequisites live outside the content-addressed build root, so
- * their directory name must carry the same environment and resolved compiler
- * identity as the artifacts that consume them. The short digest keeps the
- * package-local path readable while preventing build-order contamination. */
-export function vendorCacheBuildIdentity(environmentFingerprint, compilerIdentity) {
-    return createHash("sha256")
-        .update("vendor-toolchain-v1\0")
-        .update(environmentFingerprint)
-        .update("\0")
-        .update(compilerIdentity)
-        .digest("hex")
-        .slice(0, 20);
-}
-const vendorCompilerIdentityFallbacks = new Map();
-async function currentVendorCacheBuildIdentity(driver, environmentFingerprint) {
-    // Native vendor recipes additionally use bare clang/ar and CMake; cross
-    // recipes use the zig driver for compilation and `zig ar`. Include every
-    // executable that can affect the package-local prerequisite, not just the
-    // final program's driver.
-    const commands = [
-        driver.argv[0] ?? "clang",
-        ...(driver.target === null ? ["clang", "cc", "ar", "ranlib", "cmake"] : []),
-    ].filter((command, index, all) => all.indexOf(command) === index);
-    const identities = await Promise.all(commands.map(async (command) => {
-        const spellingKey = `${environmentFingerprint}\0${command}`;
-        const resolved = await resolvedToolIdentity(command);
-        if (resolved !== null)
-            vendorCompilerIdentityFallbacks.set(spellingKey, resolved);
-        return [
-            command,
-            resolved ??
-                vendorCompilerIdentityFallbacks.get(spellingKey) ??
-                `<unresolved>\0${command}`,
-        ].join("\0");
-    }));
-    return vendorCacheBuildIdentity(environmentFingerprint, identities.join("\x1f"));
-}
-function engineArchivePath(sanitize, driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    const flavor = `${sanitize ? "asan" : "plain"}-${vendorCacheTargetFlavor(driver)}-${buildIdentity}`;
-    return join(cacheRoot, `${QJS_COMMIT.slice(0, 12)}-${flavor}`, "libqjs.a");
-}
-async function fileExists(path) {
-    return stat(path).then((s) => s.isFile(), () => false);
-}
-function privateSiblingPath(destination, label) {
-    // Keep the temporary component independent of the caller's basename. A
-    // destination can validly consume the filesystem's entire NAME_MAX budget;
-    // appending or prepending that basename would make the atomic install fail.
-    return join(dirname(destination), `.scriptc-${label}-${process.pid}-${Math.random().toString(36).slice(2)}`);
-}
-/** Copy an artifact through a private sibling name, then atomically install it.
- * The source can live on another filesystem (cache/temp roots commonly do), so
- * a direct rename is not portable. */
-async function installArtifact(source, destination, mode) {
-    await mkdir(dirname(destination), { recursive: true });
-    const tmp = privateSiblingPath(destination, "install");
-    try {
-        await copyFile(source, tmp);
-        if (mode !== undefined)
-            await chmod(tmp, mode);
-        await rename(tmp, destination);
-    }
-    finally {
-        await rm(tmp, { force: true }).catch(() => undefined);
-    }
-}
-/** The engine archive for one flavor, built lazily on the first --dynamic
- * compile (~10s) and cached under vendor/.cache/<commit>-<flavor>-<target>-<toolchain>/ — unlike
- * the runtime's own sources (recompiled every build, ~100ms), the engine is
- * far too big to rebuild per compile. The plain flavor is ALWAYS MinSizeRel
- * regardless of the program's optimization level: measured binary delta is
- * ~620KB vs ~900KB at -O2, and eval-in-an-island workloads don't earn the
- * difference. The asan flavor (Debug + QJS_ENABLE_ASAN) exists so the
- * sanitized test lane checks engine interop under instrumentation.
- *
- * Concurrency: parallel first builds (e.g. test workers) each build in a
- * private temp dir and publish with an atomic rename — first one wins,
- * losers discard their work and use the winner's archive.
- *
- * SCRIPTC_TARGET adds a per-target cache flavor built WITHOUT CMake (the
- * mbedTLS recipe): the qjs library target is just four TUs
- * (QJS_ENGINE_SOURCES) compiled with `zig cc -target <triple>` under the
- * same flags CMake's MinSizeRel/Debug+ASan configurations apply, packed
- * with `zig ar`. Host builds keep the exact historical CMake recipe. */
-async function ensureEngineArchive(sanitize, driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    const flavor = `${sanitize ? "asan" : "plain"}-${vendorCacheTargetFlavor(driver)}-${buildIdentity}`;
-    const vendor = vendorEngineDir();
-    const archive = engineArchivePath(sanitize, driver, buildIdentity, cacheRoot);
-    const cacheDir = dirname(archive);
-    if (await fileExists(archive))
-        return archive;
-    if (driver.target !== null)
-        return buildEngineArchiveCross(sanitize, driver, cacheRoot, cacheDir);
-    await mkdir(cacheRoot, { recursive: true });
-    const buildDir = await mkdtemp(join(cacheRoot, `build-${flavor}-`));
-    const stageDir = `${buildDir}.stage`;
-    try {
-        const configureArgs = [
-            "-S", vendor,
-            "-B", buildDir,
-            ...(sanitize
-                ? ["-DCMAKE_BUILD_TYPE=Debug", "-DQJS_ENABLE_ASAN=ON"]
-                : ["-DCMAKE_BUILD_TYPE=MinSizeRel"]),
-            "-DQJS_BUILD_EXAMPLES=OFF",
-            "-DQJS_ENABLE_INSTALL=OFF",
-        ];
-        try {
-            await execFileAsync("cmake", configureArgs);
-        }
-        catch (err) {
-            if (err.code === "ENOENT") {
-                throw new Error("--dynamic builds the embedded engine once with CMake, which was not found on PATH.\n" +
-                    "Install cmake (e.g. `brew install cmake`) and retry. Static builds do not need it.");
-            }
-            throw new Error(`cmake failed configuring the embedded engine (${vendor}).\n\n` +
-                subprocessFailureDetail(err));
-        }
-        await execFileAsync("cmake", [
-            "--build", buildDir,
-            "--target", "qjs",
-            `-j${availableParallelism()}`,
-        ]);
-        // Publish only the archive, atomically: rename fails if a concurrent
-        // build won the race, and the winner's archive is just as good.
-        await mkdir(stageDir);
-        await copyFile(join(buildDir, "libqjs.a"), join(stageDir, "libqjs.a"));
-        await rename(stageDir, cacheDir).catch(() => undefined);
-    }
-    finally {
-        await rm(buildDir, { recursive: true, force: true });
-        await rm(stageDir, { recursive: true, force: true });
-    }
-    return archive;
-}
-/** The qjs library target's source list (CMakeLists.txt `qjs_sources` with
- * QJS_BUILD_LIBC off — cutils is header-only): the cross-build recipe
- * compiles exactly these. */
-const QJS_ENGINE_SOURCES = ["dtoa.c", "libregexp.c", "libunicode.c", "quickjs.c"];
-/** The engine archive for a CROSS target, per-TU `zig cc` compiles + `zig
- * ar` (no CMake — the mbedTLS recipe). The flags mirror what the CMake
- * configurations apply to the qjs library target: gnu11 (CMAKE_C_EXTENSIONS
- * ON), hidden visibility, -funsigned-char, -DQUICKJS_NG_BUILD and
- * -D_GNU_SOURCE (qjs_defines; linux targetArgs already carry the latter),
- * then MinSizeRel (-Os -DNDEBUG) for plain or Debug+QJS_ENABLE_ASAN
- * (-O0 -ggdb -fno-omit-frame-pointer -fsanitize=address
- * -fno-sanitize-recover=all) for asan. Same atomic-rename publish as every
- * vendor cache. */
-async function buildEngineArchiveCross(sanitize, driver, cacheRoot, cacheDir) {
-    const vendor = vendorEngineDir();
-    const archive = join(cacheDir, "libqjs.a");
-    const arArgv = [...driver.argv.slice(0, 1), "ar"];
-    const cflags = [
-        "-std=gnu11",
-        ...driver.targetArgs,
-        "-fvisibility=hidden",
-        "-funsigned-char",
-        "-DQUICKJS_NG_BUILD",
-        "-D_GNU_SOURCE",
-        // CMake's qjs_defines on WIN32 (quickjs.c's own _WIN32 arms cover the
-        // rest — timezoneapi, intrin, cutils.h's _msize usable-size probe).
-        ...(targetPlatform(driver) === "win32" ? ["-DWIN32_LEAN_AND_MEAN", "-D_WIN32_WINNT=0x0601"] : []),
-        ...(sanitize
-            ? ["-O0", "-ggdb", "-fno-omit-frame-pointer", "-fsanitize=address", "-fno-sanitize-recover=all", "-DQJS_ENABLE_ASAN"]
-            : ["-Os", "-DNDEBUG"]),
-        "-I", vendor,
-    ];
-    await mkdir(cacheRoot, { recursive: true });
-    const buildDir = await mkdtemp(join(cacheRoot, `build-qjs-${driver.target ?? "host"}-`));
-    try {
-        const width = Math.min(QJS_ENGINE_SOURCES.length, availableParallelism());
-        for (let i = 0; i < QJS_ENGINE_SOURCES.length; i += width) {
-            await Promise.all(QJS_ENGINE_SOURCES.slice(i, i + width).map((src) => execFileAsync(driver.argv[0] ?? "clang", [...driver.argv.slice(1), ...cflags, "-c", join(vendor, src), "-o", join(buildDir, `${basename(src, ".c")}.o`)], { cwd: buildDir })));
-        }
-        await execFileAsync(arArgv[0] ?? "ar", [...arArgv.slice(1), "rcs", join(buildDir, "libqjs.a"), ...QJS_ENGINE_SOURCES.map((s) => join(buildDir, `${basename(s, ".c")}.o`))]);
-        // Atomic publish: rename fails if a concurrent build won the race, and
-        // the winner's archive is just as good.
-        const stageDir = `${buildDir}.stage`;
-        await mkdir(stageDir);
-        await copyFile(join(buildDir, "libqjs.a"), join(stageDir, "libqjs.a"));
-        await rename(stageDir, cacheDir).catch(async () => {
-            await rm(stageDir, { recursive: true, force: true });
-        });
-    }
-    finally {
-        await rm(buildDir, { recursive: true, force: true });
-    }
-    return archive;
-}
-/** The vendor sources behind static-build regex support: quickjs-ng's
- * libregexp and its unicode tables (cutils is header-only). Deliberately
- * NOT the engine — a regex-using static binary links ~110KB of matcher,
- * never the ~620KB island. */
-const LRE_SOURCES = ["libregexp.c", "libunicode.c"];
-function lreObjectPaths(sanitize, driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    const flavor = (sanitize ? "asan" : "plain") +
-        (driver.argv.length === 1 && driver.argv[0] === "clang" ? "" : "-zigcc") +
-        `-${vendorCacheTargetFlavor(driver)}-${buildIdentity}`;
-    const cacheDir = join(cacheRoot, `${QJS_COMMIT.slice(0, 12)}-lre-${flavor}`);
-    return LRE_SOURCES.map((f) => join(cacheDir, f.replace(/\.c$/, ".o")));
-}
-/** The libregexp objects for one flavor, compiled lazily on the first
- * regex-using static build (~1s) and cached like the engine archive —
- * vendor/.cache/<commit>-lre-<flavor>-<target>-<toolchain>/*.o — with the same atomic-rename
- * publish (parallel first builds race safely; losers discard their work).
- * Plain is -Os (size class matters: the regex fence pins regex-using
- * binaries well under the engine class); asan matches the final link so
- * the sanitized lane instruments the matcher too. Cross targets get their
- * own flavor directory, compiled with the SCRIPTC_CC driver and its target
- * args — libregexp/libunicode are plain C11, so the cross story is exactly
- * the runtime sources' (no host-built inputs); vendored SOURCES are
- * untouched, only the build wiring knows about targets. */
-async function ensureLreObjects(sanitize, driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    // The flavor keys the DRIVER as well as the target: a zig-cc-built object
-    // set must never be handed to a clang link (or vice versa) off a shared
-    // cache directory. Native targets include host platform + architecture so
-    // arm64 and Rosetta processes never exchange Mach-O objects.
-    const flavor = (sanitize ? "asan" : "plain") +
-        (driver.argv.length === 1 && driver.argv[0] === "clang" ? "" : "-zigcc") +
-        `-${vendorCacheTargetFlavor(driver)}-${buildIdentity}`;
-    const vendor = vendorEngineDir();
-    const objects = lreObjectPaths(sanitize, driver, buildIdentity, cacheRoot);
-    const cacheDir = dirname(objects[0]);
-    if ((await Promise.all(objects.map(fileExists))).every(Boolean))
-        return objects;
-    await mkdir(cacheRoot, { recursive: true });
-    const buildDir = await mkdtemp(join(cacheRoot, `build-lre-${flavor}-`));
-    try {
-        // One -c per invocation: zig's COFF driver rejects multiple -c inputs
-        // in a single command ("coff does not support linking multiple
-        // objects"); per-file compiles produce the identical objects on every
-        // target.
-        for (const f of LRE_SOURCES) {
-            await execFileAsync(driver.argv[0] ?? "clang", [
-                ...driver.argv.slice(1),
-                "-std=c11",
-                ...driver.targetArgs,
-                ...(sanitize ? ["-O1", "-fsanitize=address"] : ["-Os"]),
-                "-I", vendor,
-                "-c", join(vendor, f),
-                "-o", join(buildDir, f.replace(/\.c$/, ".o")),
-            ], { cwd: buildDir });
-        }
-        // Atomic publish: rename fails if a concurrent build won the race, and
-        // the winner's objects are just as good.
-        await rename(buildDir, cacheDir).catch(() => undefined);
-    }
-    finally {
-        await rm(buildDir, { recursive: true, force: true });
-    }
-    return objects;
-}
-function vendorZlibDir() {
-    return join(runtimeSrcDir(), "..", "vendor", "zlib");
-}
-/** The vendored zlib TUs behind CROSS-target zlib support: every root *.c
- * except the gzFile file-I/O units (gz*.c — nothing in scr_zlib.c
- * references the gzFile API, and those TUs alone want unistd/io headers).
- * Host builds never touch this list — they link the system libz. */
-const ZLIB_SOURCES = ["adler32.c", "compress.c", "crc32.c", "deflate.c", "infback.c", "inffast.c", "inflate.c", "inftrees.c", "trees.c", "uncompr.c", "zutil.c"];
-function zlibObjectPaths(sanitize, driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    const flavor = (sanitize ? "asan" : "plain") +
-        (driver.argv.length === 1 && driver.argv[0] === "clang" ? "" : "-zigcc") +
-        `-${vendorCacheTargetFlavor(driver)}-${buildIdentity}`;
-    const cacheDir = join(cacheRoot, `zlib-${ZLIB_VERSION}-${flavor}`);
-    return ZLIB_SOURCES.map((f) => join(cacheDir, f.replace(/\.c$/, ".o")));
-}
-/** The zlib objects for one flavor, compiled lazily on the first zlib-using
- * CROSS build (~1s) and cached like the lre objects —
- * vendor/.cache/zlib-<version>-<flavor>-<target>-<toolchain>/*.o — with the same atomic-rename
- * publish (parallel first builds race safely; losers discard their work).
- * Plain is -Os, asan matches the final link so the sanitized lane
- * instruments the codec too. The flavor keys the driver and target exactly
- * like the lre flavor: only cross builds call this today, but the keying
- * must never hand a zig-built object set to a clang link off a shared
- * directory. */
-async function ensureZlibObjects(sanitize, driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    const flavor = (sanitize ? "asan" : "plain") +
-        (driver.argv.length === 1 && driver.argv[0] === "clang" ? "" : "-zigcc") +
-        `-${vendorCacheTargetFlavor(driver)}-${buildIdentity}`;
-    const vendor = vendorZlibDir();
-    const objects = zlibObjectPaths(sanitize, driver, buildIdentity, cacheRoot);
-    const cacheDir = dirname(objects[0]);
-    if ((await Promise.all(objects.map(fileExists))).every(Boolean))
-        return objects;
-    await mkdir(cacheRoot, { recursive: true });
-    const buildDir = await mkdtemp(join(cacheRoot, `build-zlib-${flavor}-`));
-    try {
-        // One -c per invocation, the lre recipe (zig's COFF driver rejects
-        // multiple -c inputs in a single command).
-        for (const f of ZLIB_SOURCES) {
-            await execFileAsync(driver.argv[0] ?? "clang", [
-                ...driver.argv.slice(1),
-                "-std=c11",
-                ...driver.targetArgs,
-                ...(sanitize ? ["-O1", "-fsanitize=address"] : ["-Os"]),
-                "-I", vendor,
-                "-c", join(vendor, f),
-                "-o", join(buildDir, f.replace(/\.c$/, ".o")),
-            ], { cwd: buildDir });
-        }
-        // Atomic publish: rename fails if a concurrent build won the race, and
-        // the winner's objects are just as good.
-        await rename(buildDir, cacheDir).catch(() => undefined);
-    }
-    finally {
-        await rm(buildDir, { recursive: true, force: true });
-    }
-    return objects;
-}
-function vendorCurlDir() {
-    return join(runtimeSrcDir(), "..", "vendor", "curl");
-}
-/** Every libcurl function scr_fetch_curl.c references — the generated import
- * stub defines exactly these. A new curl call in scr_fetch_curl.c that is
- * missing here fails the CROSS link immediately with the symbol's name
- * (host builds resolve it from the real system libcurl and never look). */
-const CURL_STUB_SYMBOLS = [
-    "curl_easy_cleanup", "curl_easy_getinfo", "curl_easy_init", "curl_easy_setopt", "curl_easy_strerror",
-    "curl_free", "curl_global_cleanup", "curl_global_init",
-    "curl_multi_add_handle", "curl_multi_cleanup", "curl_multi_info_read", "curl_multi_init",
-    "curl_multi_perform", "curl_multi_poll", "curl_multi_remove_handle",
-    "curl_slist_append", "curl_slist_free_all",
-    "curl_url", "curl_url_cleanup", "curl_url_get", "curl_url_set",
-];
-function curlStubDirPath(driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    return join(cacheRoot, `curl-stub-${driver.target}-${buildIdentity}`);
-}
-/** The libcurl import stub for one CROSS target, generated lazily on the
- * first fetch-using cross build and cached like the zlib objects —
- * vendor/.cache/curl-stub-<target>-<toolchain>/libcurl.so, atomic-rename publish. The
- * stub is empty definitions of CURL_STUB_SYMBOLS compiled `-shared` with
- * `-soname libcurl.so.4`: linking against it satisfies scr_fetch_curl.c's
- * references and records a plain `DT_NEEDED libcurl.so.4`, which the
- * TARGET system's real libcurl satisfies at load time (curl's unversioned
- * exports make the classic import-stub technique sound here — nothing
- * from the stub's bodies ever ships in the binary). One stub per target,
- * no sanitize flavor: the stub's code is never executed or instrumented,
- * and asan links against plain shared libraries freely. */
-async function ensureCurlStub(driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    const cacheDir = curlStubDirPath(driver, buildIdentity, cacheRoot);
-    const lib = join(cacheDir, "libcurl.so");
-    if (await fileExists(lib))
-        return cacheDir;
-    await mkdir(cacheRoot, { recursive: true });
-    const buildDir = await mkdtemp(join(cacheRoot, `build-curl-stub-`));
-    try {
-        const src = join(buildDir, "stub.c");
-        await writeFile(src, CURL_STUB_SYMBOLS.map((s) => `void ${s}(void) {}\n`).join(""));
-        await execFileAsync(driver.argv[0] ?? "clang", [
-            ...driver.argv.slice(1),
-            ...driver.targetArgs,
-            "-shared", "-fPIC",
-            "-Wl,-soname,libcurl.so.4",
-            src,
-            "-o", join(buildDir, "libcurl.so"),
-        ]);
-        // Atomic publish: rename fails if a concurrent build won the race, and
-        // the winner's stub is just as good.
-        const stageDir = `${buildDir}.stage`;
-        await mkdir(stageDir);
-        await copyFile(join(buildDir, "libcurl.so"), join(stageDir, "libcurl.so"));
-        await rename(stageDir, cacheDir).catch(async () => {
-            await rm(stageDir, { recursive: true, force: true });
-        });
-    }
-    finally {
-        await rm(buildDir, { recursive: true, force: true });
-    }
-    return cacheDir;
-}
-function vendorTlsDir() {
-    return join(runtimeSrcDir(), "..", "vendor", "mbedtls");
-}
-function tlsArchivePath(sanitize, driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    const flavor = `${sanitize ? "asan" : "plain"}-${vendorCacheTargetFlavor(driver)}-${buildIdentity}`;
-    return join(cacheRoot, `mbedtls-${MBEDTLS_VERSION}-${flavor}`, "libmbedtls.a");
-}
-/** The mbedTLS archive for one flavor, compiled lazily on the first
- * TLS-using build (~15s over ~110 TUs, parallelized) and cached like the
- * engine archive — vendor/.cache/mbedtls-<version>-<flavor>-<target>-<toolchain>/libmbedtls.a —
- * with the same atomic-rename publish (parallel first builds race safely;
- * losers discard their work). Plain is -Os (the TLS stack is link-gated
- * but still wants its size class small); asan matches the final link so
- * the sanitized lane instruments every TLS path too. No CMake: the stock
- * config builds every library/*.c standalone with clang, so the recipe is
- * per-TU `-c` compiles plus one `ar rcs` — vendored-build machinery the
- * lre-objects cache already established.
- *
- * SCRIPTC_TARGET adds a per-target cache flavor (the lre-objects story):
- * TUs compile with `zig cc -target <triple>` and the archive is packed
- * with `zig ar` (llvm-ar — the host BSD ar has no business indexing ELF
- * objects). Host builds keep the exact historical clang + ar recipe. */
-async function ensureTlsArchive(sanitize, driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    const flavor = `${sanitize ? "asan" : "plain"}-${vendorCacheTargetFlavor(driver)}-${buildIdentity}`;
-    const compileArgv = driver.target !== null ? driver.argv : ["clang"];
-    const arArgv = driver.target !== null ? [...driver.argv.slice(0, 1), "ar"] : ["ar"];
-    const vendor = vendorTlsDir();
-    const archive = tlsArchivePath(sanitize, driver, buildIdentity, cacheRoot);
-    const cacheDir = dirname(archive);
-    if (await fileExists(archive))
-        return archive;
-    await mkdir(cacheRoot, { recursive: true });
-    const buildDir = await mkdtemp(join(cacheRoot, `build-mbedtls-${flavor}-`));
-    try {
-        const sources = (await readdir(join(vendor, "library"))).filter((n) => n.endsWith(".c")).sort();
-        const cflags = [
-            "-std=c11",
-            ...driver.targetArgs,
-            ...(sanitize ? ["-O1", "-fsanitize=address"] : ["-Os"]),
-            "-I", join(vendor, "include"),
-            "-I", join(vendor, "library"),
-        ];
-        const width = availableParallelism();
-        for (let i = 0; i < sources.length; i += width) {
-            await Promise.all(sources.slice(i, i + width).map((src) => execFileAsync(compileArgv[0] ?? "clang", [...compileArgv.slice(1), ...cflags, "-c", join(vendor, "library", src), "-o", join(buildDir, `${basename(src, ".c")}.o`)])));
-        }
-        await execFileAsync(arArgv[0] ?? "ar", [...arArgv.slice(1), "rcs", join(buildDir, "libmbedtls.a"), ...sources.map((s) => join(buildDir, `${basename(s, ".c")}.o`))]);
-        // Atomic publish: rename fails if a concurrent build won the race, and
-        // the winner's archive is just as good.
-        const stageDir = `${buildDir}.stage`;
-        await mkdir(stageDir);
-        await copyFile(join(buildDir, "libmbedtls.a"), join(stageDir, "libmbedtls.a"));
-        await rename(stageDir, cacheDir).catch(async () => {
-            await rm(stageDir, { recursive: true, force: true });
-        });
-    }
-    finally {
-        await rm(buildDir, { recursive: true, force: true });
-    }
-    return archive;
-}
 /* ── library mode: the static-archive artifact ────────────────────────────
  * One `scriptc build --lib` invocation produces <name>.lib.a: the program TU
  * object plus exactly the runtime objects the program's IR gates in, every
@@ -958,6 +588,11 @@ async function ensureTlsArchive(sanitize, driver, buildIdentity, cacheRoot = ven
  * objects apart from executable-lane objects). Persistent builds cache the
  * completed archive by program-TU content and cache runtime objects separately,
  * so an edit recompiles only the changed program object before re-archiving.
+ * Large LLVM dev TUs split further into stable symbol-hash shards: compile
+ * those in parallel, cache each object independently, then relocatably merge
+ * them back into the archive's one canonical program member. A localized edit
+ * recompiles only the changed buckets; exact repeats use the merged-object or
+ * completed-archive tiers and never repeat the merge.
  * The base set narrows from the executable lane's unconditional sources:
  * scr_async.c (fibers, timers, the loop) and scr_child.c drop — the
  * async_free refusal already guarantees nothing references them — and
@@ -974,12 +609,98 @@ async function ensureTlsArchive(sanitize, driver, buildIdentity, cacheRoot = ven
 /** The library base: the executable lane's unconditional sources minus the
  * fiber/loop and child-process units, plus the library-mode TU. */
 const LIB_RUNTIME_SOURCES = [
-    ...RUNTIME_SOURCES.filter((f) => f !== "scr_async.c" && f !== "scr_child.c" && f !== "scr_ffi.c"),
+    ...EXECUTABLE_RUNTIME_SOURCES.filter((f) => f !== "scr_async.c" && f !== "scr_child.c" && f !== "scr_ffi.c"),
     "scr_library.c",
 ];
+function updateProgramShardCacheIdentity(hash, shards, publicSymbols, mergeIdentity) {
+    hash.update("\0program-shards\0");
+    if (shards === undefined) {
+        hash.update("<none>\0");
+    }
+    else {
+        hash.update("<present>\0");
+        for (const shard of shards) {
+            hash.update(shard.name).update("\0").update(shard.source).update("\0");
+        }
+    }
+    hash.update("\0program-public-symbols\0");
+    if (publicSymbols === undefined) {
+        hash.update("<none>\0");
+    }
+    else {
+        hash.update("<present>\0");
+        for (const symbol of publicSymbols)
+            hash.update(symbol).update("\0");
+    }
+    hash.update("\0program-shard-merge\0");
+    hash.update(mergeIdentity === undefined ? "<none>\0" : `<present>\0${mergeIdentity}\0`);
+}
+/** Identity of the machinery that turns LLVM shard objects back into the
+ * canonical program member, or null when the target cannot do so. Sharding is
+ * only a build optimization: a missing host tool or unsupported object class
+ * retains the ordinary single-TU compile. The identity joins every cache tier
+ * that contains merged bytes; raw shard-object keys deliberately omit it. */
+async function resolveProgramShardMergeIdentity(driver) {
+    const platform = targetPlatform(driver);
+    // Mach-O merging uses the host's ld64. A Darwin target produced from a
+    // non-Darwin host can still compile as one canonical Zig TU, but the host's
+    // ELF/COFF linker cannot combine those objects.
+    if (platform === "darwin") {
+        if (process.platform !== "darwin")
+            return null;
+        const ld = await resolvedTool("ld");
+        return ld === null
+            ? null
+            : rememberFingerprintDependencies(`program-shard-merge-darwin-v1\0${ld.cacheIdentity}`, [ld.canonicalPath]);
+    }
+    if (platform === "linux") {
+        if (driver.target === null) {
+            const [ld, objcopy] = await Promise.all([
+                resolvedTool("ld"),
+                resolvedTool("objcopy"),
+            ]);
+            return ld === null || objcopy === null
+                ? null
+                : rememberFingerprintDependencies(`program-shard-merge-linux-v1\0${ld.cacheIdentity}\0${objcopy.cacheIdentity}`, [ld.canonicalPath, objcopy.canonicalPath]);
+        }
+        const arch = driver.target.split("-", 1)[0];
+        if (arch !== "x86_64" && arch !== "aarch64")
+            return null;
+        const compiler = await resolvedTool(driver.argv[0] ?? "zig");
+        return compiler === null
+            ? null
+            : rememberFingerprintDependencies(`program-shard-merge-cross-elf-v1\0${arch}\0${compiler.cacheIdentity}`, [compiler.canonicalPath]);
+    }
+    if (platform === "win32") {
+        const arch = driver.target?.split("-", 1)[0] ?? process.arch;
+        return arch === "x86_64" || arch === "x64"
+            ? `program-shard-merge-coff-v1\0${arch}`
+            : null;
+    }
+    return null;
+}
 export async function compileLibArchive(opts) {
+    clearCcCaches();
     const rtDir = runtimeSrcDir();
     const driver = resolveCc();
+    const shardNames = new Set();
+    const programShardsValid = opts.programShards?.every((shard) => {
+        if (basename(shard.name) !== shard.name || !shard.name.endsWith(".ll") ||
+            shardNames.has(shard.name))
+            return false;
+        shardNames.add(shard.name);
+        return true;
+    }) === true;
+    const programShardsRequested = opts.cPath.endsWith(".ll") &&
+        programShardsValid && opts.programShards !== undefined && opts.programShards.length > 1 &&
+        opts.programPublicSymbols !== undefined
+        ? opts.programShards
+        : null;
+    const programShardMergeIdentity = programShardsRequested === null
+        ? null
+        : await resolveProgramShardMergeIdentity(driver);
+    const programShards = programShardMergeIdentity === null ? null : programShardsRequested;
+    const programPublicSymbols = programShards === null ? undefined : opts.programPublicSymbols;
     const sanitize = opts.sanitize ?? false;
     const optimization = opts.optimization ?? "release";
     const regex = opts.regex ?? false;
@@ -1026,7 +747,7 @@ export async function compileLibArchive(opts) {
         ? [...cflags, "-Wno-override-module"]
         : cflags;
     const programSourceExtension = opts.cPath.endsWith(".ll") ? ".ll" : ".c";
-    const arArgv = driver.argv[0] === "zig" ? [driver.argv[0], "ar"] : ["ar"];
+    const arArgv = isZigDriver(driver) ? [driver.argv[0], "ar"] : ["ar"];
     const cachePolicy = toolchainEnvironmentCachePolicy();
     const configuredCacheRoot = cacheRootDir();
     const toolchainEnv = toolchainEnvironmentFingerprint();
@@ -1037,31 +758,35 @@ export async function compileLibArchive(opts) {
     // search variables cannot affect it, but any mutable compilation input or
     // opaque compiler wrapper makes every persistent tier unsafe to reuse. An
     // opaque archiver narrows only the completed-archive tier below.
-    let root = opts.cacheIdentity === undefined || !persistentDriverCache
+    const cacheIdentity = opts.cacheIdentity;
+    let persistentCache = cacheIdentity === undefined || configuredCacheRoot === null || !persistentDriverCache
         ? null
-        : configuredCacheRoot;
-    if (root !== null) {
+        : { root: configuredCacheRoot, identity: cacheIdentity };
+    if (persistentCache !== null) {
         try {
-            await ensurePrivateCacheRoot(root, process.env["SCRIPTC_CACHE_DIR"] === undefined);
+            await ensurePrivateCacheRoot(persistentCache.root, process.env["SCRIPTC_CACHE_DIR"] === undefined);
         }
         catch {
-            root = null;
+            persistentCache = null;
         }
     }
     let implicitToolchain = null;
+    let implicitCompileToolchain = null;
     let runtimeCompilerInvocation = null;
     let programCompilerInvocation = null;
     if (persistentDriverCache) {
         try {
-            implicitToolchain = await implicitToolchainFingerprint(driver, toolchainEnv);
+            const fingerprints = await implicitToolchainFingerprints(driver, toolchainEnv);
+            implicitToolchain = fingerprints.complete;
+            implicitCompileToolchain = fingerprints.compile;
         }
         catch {
             // An identity probe is cache machinery, never a reason a valid native
             // compile should fail. Disable every persistent tier for this invocation.
-            root = null;
+            persistentCache = null;
         }
     }
-    if (root !== null) {
+    if (persistentCache !== null) {
         try {
             runtimeCompilerInvocation = await effectiveCompilerInvocationFingerprint(driver, toolchainEnv, cflags);
             programCompilerInvocation = programSourceExtension === ".ll"
@@ -1071,7 +796,7 @@ export async function compileLibArchive(opts) {
         catch {
             // A wrapper that cannot expose its effective invocation can still build,
             // but its outputs cannot safely participate in a persistent cache.
-            root = null;
+            persistentCache = null;
         }
     }
     const vendorBuildIdentity = await currentVendorCacheBuildIdentity(driver, `${toolchainEnv}\0${implicitToolchain ?? "<uncached>"}`);
@@ -1081,7 +806,7 @@ export async function compileLibArchive(opts) {
     // fingerprint. The runtime-object tier still serves them (localization
     // consumes the same per-flavor objects).
     const cacheCompleteArchive = opts.localizeSymbols === undefined &&
-        root !== null && await archiverSupportsPersistentCache(arArgv, driver);
+        persistentCache !== null && await archiverSupportsPersistentCache(arArgv, driver);
     let cachedArchive = null;
     let compilerVersion = "";
     let archiverVersion = "";
@@ -1093,10 +818,10 @@ export async function compileLibArchive(opts) {
     const identityBytes = opts.identityCSource === undefined
         ? null
         : Buffer.from(opts.identityCSource, "utf8");
-    if (root !== null) {
+    if (persistentCache !== null) {
         try {
             const [cv, fingerprint, programBytes] = await Promise.all([
-                ccVersionOnce(driver.argv, toolchainEnv, true),
+                ccVersion(driver.argv, toolchainEnv, true),
                 runtimeFingerprint(rtDir),
                 cachedProgramBytes === null ? readFile(opts.cPath) : Promise.resolve(cachedProgramBytes),
             ]);
@@ -1108,16 +833,18 @@ export async function compileLibArchive(opts) {
                 const av = await toolVersionOnce(arArgv, toolchainEnv, true);
                 archiverVersion = av;
                 const key = createHash("sha256")
-                    // v7 adds effective compiler-wrapper invocations for the real runtime
-                    // and program compile flavors.
-                    .update("lib-v7\0")
+                    // v10 adds the shard-merge implementation/tool identity. The
+                    // canonical TU still keys source semantics; shard, keep, and merge
+                    // bytes key the exact merged program object so ABI projections,
+                    // tool replacements, and single-/multi-TU producers never collide.
+                    .update("lib-v10\0")
                     .update(cacheTargetIdentity(driver)).update("\0")
                     .update(toolchainEnv).update("\0")
                     .update(implicitToolchain).update("\0")
                     .update(runtimeCompilerInvocation).update("\0")
                     .update(programCompilerInvocation).update("\0")
                     .update(programDependencyHash).update("\0")
-                    .update(opts.cacheIdentity).update("\0")
+                    .update(persistentCache.identity).update("\0")
                     .update(driver.argv.join("\x1f")).update("\0")
                     .update(cv).update("\0")
                     .update(fingerprint).update("\0")
@@ -1130,12 +857,14 @@ export async function compileLibArchive(opts) {
                     // latter. Archive members also inherit the TU's basename.
                     .update(opts.cPath).update("\0")
                     .update(resolve(opts.cPath)).update("\0")
-                    .update(programBytes)
+                    .update(programBytes);
+                updateProgramShardCacheIdentity(key, programShards ?? undefined, programPublicSymbols, programShardMergeIdentity ?? undefined);
+                const keyHex = key
                     .update("\0identity\0")
                     .update(identityBytes === null ? "<none>" : "<generated>").update("\0")
                     .update(identityBytes ?? Buffer.alloc(0))
                     .digest("hex");
-                cachedArchive = join(root, "lib", key);
+                cachedArchive = join(persistentCache.root, "lib", keyHex);
                 const tmpOut = privateSiblingPath(opts.outPath, "lib-hit");
                 try {
                     await mkdir(dirname(opts.outPath), { recursive: true });
@@ -1160,19 +889,19 @@ export async function compileLibArchive(opts) {
             cachedArchive = null;
         }
     }
-    const transientVendorRoot = persistentDriverCache && implicitToolchain !== null
+    const transientVendorRoot = persistentCache !== null && implicitToolchain !== null
         ? null
         : join(tmpdir(), `scriptc-lib-vendor-${process.pid}-${Math.random().toString(36).slice(2)}`);
-    const vendorCacheRoot = transientVendorRoot ?? vendorBuildCacheRoot();
+    const vendorCacheRoot = transientVendorRoot ?? vendorBuildCacheRoot(persistentCache?.root);
     try {
-        const lreObjects = regex
-            ? await ensureLreObjects(sanitize, driver, vendorBuildIdentity, vendorCacheRoot)
-            : [];
-        const zlibObjects = opts.zlib
-            ? await ensureZlibObjects(sanitize, driver, vendorBuildIdentity, vendorCacheRoot)
-            : [];
         const buildDir = await mkdtemp(join(tmpdir(), "scriptc-lib-"));
         try {
+            const lreObjects = regex
+                ? await stageVendorInputs(() => ensureLreObjects(sanitize, driver, vendorBuildIdentity, vendorCacheRoot), join(buildDir, "vendor-lre"))
+                : [];
+            const zlibObjects = opts.zlib
+                ? await stageVendorInputs(() => ensureZlibObjects(sanitize, driver, vendorBuildIdentity, vendorCacheRoot), join(buildDir, "vendor-zlib"))
+                : [];
             const compileOne = async (src, objName, compilerVisibleSource) => {
                 const obj = join(buildDir, objName);
                 const args = [
@@ -1203,18 +932,19 @@ export async function compileLibArchive(opts) {
             const programSource = cachedProgramBytes === null
                 ? opts.cPath
                 : join(buildDir, `program${opts.cPath.endsWith(".ll") ? ".ll" : ".c"}`);
-            if (cachedProgramBytes !== null)
+            if (cachedProgramBytes !== null && programShards === null) {
                 await writeFile(programSource, cachedProgramBytes);
+            }
             let cachedProgramObject = null;
-            if (root !== null && cachedProgramBytes !== null && compilerVersion !== "" &&
+            if (persistentCache !== null && cachedProgramBytes !== null && compilerVersion !== "" &&
                 implicitToolchain !== null && programCompilerInvocation !== null) {
                 const programKey = createHash("sha256")
-                    .update("lib-program-obj-v1\0")
+                    .update("lib-program-obj-v3\0")
                     .update(cacheTargetIdentity(driver)).update("\0")
                     .update(toolchainEnv).update("\0")
                     .update(implicitToolchain).update("\0")
                     .update(programCompilerInvocation).update("\0")
-                    .update(opts.cacheIdentity).update("\0")
+                    .update(persistentCache.identity).update("\0")
                     .update(driver.argv.join("\x1f")).update("\0")
                     .update(compilerVersion).update("\0")
                     .update(runtimeHash).update("\0")
@@ -1222,16 +952,120 @@ export async function compileLibArchive(opts) {
                     .update(programCompilerArgs.join("\x1f")).update("\0")
                     .update(opts.cPath).update("\0")
                     .update(resolve(opts.cPath)).update("\0")
-                    .update(cachedProgramBytes)
-                    .digest("hex");
-                cachedProgramObject = join(root, "program-obj", programKey);
+                    .update(cachedProgramBytes);
+                updateProgramShardCacheIdentity(programKey, programShards ?? undefined, programPublicSymbols, programShardMergeIdentity ?? undefined);
+                const programKeyHex = programKey.digest("hex");
+                cachedProgramObject = join(persistentCache.root, "program-obj", programKeyHex);
             }
             const stagedProgramObject = join(buildDir, `${stem}.program.o`);
             let programObject;
+            let programShardFallback = false;
             if (cachedProgramObject !== null &&
                 await copyValidCachedFile(cachedProgramObject, stagedProgramObject)) {
                 programObject = stagedProgramObject;
             }
+            else if (programShards !== null) {
+                try {
+                    const shardEntries = programShards.map((shard, index) => {
+                        const sourcePath = join(buildDir, shard.name);
+                        const staged = join(buildDir, `${stem}.program-${index.toString().padStart(3, "0")}.o`);
+                        let cachePath = null;
+                        if (persistentCache !== null && compilerVersion !== "" &&
+                            implicitCompileToolchain !== null && programCompilerInvocation !== null) {
+                            const key = createHash("sha256")
+                                // v2 removes the broad implicit-toolchain fingerprint: it
+                                // includes the linker selected by the driver, but raw shard
+                                // objects are compile-only outputs. The compile-only toolchain
+                                // identity retains compiler/config/header/assembler inputs;
+                                // the effective program invocation pins this exact flag lane.
+                                // Merge-tool identity belongs only to the merged-object and
+                                // completed-archive tiers.
+                                .update("lib-program-shard-v2\0")
+                                .update(cacheTargetIdentity(driver)).update("\0")
+                                .update(toolchainEnv).update("\0")
+                                .update(implicitCompileToolchain).update("\0")
+                                .update(programCompilerInvocation).update("\0")
+                                .update(persistentCache.identity).update("\0")
+                                .update(driver.argv.join("\x1f")).update("\0")
+                                .update(compilerVersion).update("\0")
+                                .update(runtimeHash).update("\0")
+                                .update(programDependencyHash).update("\0")
+                                .update(programCompilerArgs.join("\x1f")).update("\0")
+                                .update(opts.cPath).update("\0")
+                                .update(resolve(opts.cPath)).update("\0")
+                                .update(shard.name).update("\0")
+                                .update(shard.source)
+                                .digest("hex");
+                            cachePath = join(persistentCache.root, "program-shard", key);
+                        }
+                        return { ...shard, sourcePath, staged, cachePath, missed: false };
+                    });
+                    const shardWidth = Math.min(8, availableParallelism());
+                    for (let i = 0; i < shardEntries.length; i += shardWidth) {
+                        await Promise.all(shardEntries.slice(i, i + shardWidth).map(async (entry) => {
+                            await writeFile(entry.sourcePath, entry.source);
+                            if (entry.cachePath !== null &&
+                                await copyValidCachedFile(entry.cachePath, entry.staged))
+                                return;
+                            entry.missed = true;
+                            await compileOne(entry.sourcePath, basename(entry.staged), opts.cPath);
+                        }));
+                    }
+                    const publishable = shardEntries.filter((entry) => entry.missed && entry.cachePath !== null);
+                    const mergedProgramObject = await localizeLibraryObjects(driver, arArgv, buildDir, shardEntries.map((entry) => entry.staged), [], programPublicSymbols, `${stem}.program`);
+                    // Keep the canonical archive member spelling. The fact that native
+                    // compilation used shards is an implementation detail; consumers and
+                    // deterministic cache tests continue to see `<stem>.program.o`.
+                    await rename(mergedProgramObject, stagedProgramObject);
+                    programObject = stagedProgramObject;
+                    if (cachedProgramObject !== null || publishable.length > 0) {
+                        try {
+                            const [currentRuntime, currentInvocation, currentDependencies, currentCompiler] = await Promise.all([
+                                runtimeFingerprint(rtDir),
+                                effectiveCompilerInvocationFingerprint(driver, toolchainEnv, programCompilerArgs, programSourceExtension),
+                                translationUnitDependencyFingerprint(driver, cflags, opts.cPath, cachedProgramBytes, toolchainEnv),
+                                ccVersion(driver.argv, toolchainEnv, true),
+                            ]);
+                            const shardInputsStillMatch = currentRuntime === runtimeHash &&
+                                currentInvocation === programCompilerInvocation &&
+                                currentDependencies === programDependencyHash && currentCompiler === compilerVersion;
+                            const currentFingerprints = shardInputsStillMatch
+                                ? await implicitToolchainFingerprints(driver, toolchainEnv)
+                                : null;
+                            const compileInputsStillMatch = shardInputsStillMatch &&
+                                currentFingerprints?.compile === implicitCompileToolchain;
+                            let mergedInputsStillMatch = false;
+                            if (compileInputsStillMatch && cachedProgramObject !== null) {
+                                const currentMerge = await resolveProgramShardMergeIdentity(driver).catch(() => null);
+                                mergedInputsStillMatch =
+                                    currentFingerprints?.complete === implicitToolchain &&
+                                        currentMerge === programShardMergeIdentity;
+                            }
+                            if (compileInputsStillMatch) {
+                                await Promise.all([
+                                    ...(mergedInputsStillMatch
+                                        ? [publishCachedFile(programObject, cachedProgramObject)]
+                                        : []),
+                                    ...publishable.map((entry) => publishCachedFile(entry.staged, entry.cachePath)),
+                                ]);
+                            }
+                        }
+                        catch {
+                            // Best-effort: the merged program object is already valid.
+                        }
+                    }
+                }
+                catch {
+                    // Sharding is only an optimization. A present but incompatible or
+                    // failing merge tool (or a shard-only compiler failure) must not
+                    // turn a valid canonical LLVM TU into a failed library build. Do not
+                    // publish this retry under shard-derived object/archive cache keys.
+                    programShardFallback = true;
+                    if (cachedProgramBytes !== null)
+                        await writeFile(programSource, cachedProgramBytes);
+                    programObject = await compileOne(programSource, `${stem}.program.o`, cachedProgramBytes === null ? undefined : opts.cPath);
+                }
+            }
             else {
                 programObject = await compileOne(programSource, `${stem}.program.o`, cachedProgramBytes === null ? undefined : opts.cPath);
                 if (cachedProgramObject !== null) {
@@ -1241,7 +1075,7 @@ export async function compileLibArchive(opts) {
                             implicitToolchainFingerprint(driver, toolchainEnv),
                             effectiveCompilerInvocationFingerprint(driver, toolchainEnv, programCompilerArgs, programSourceExtension),
                             translationUnitDependencyFingerprint(driver, cflags, opts.cPath, cachedProgramBytes, toolchainEnv),
-                            ccVersionOnce(driver.argv, toolchainEnv, true),
+                            ccVersion(driver.argv, toolchainEnv, true),
                         ]);
                         if (currentRuntime === runtimeHash &&
                             currentImplicit === implicitToolchain &&
@@ -1274,10 +1108,10 @@ export async function compileLibArchive(opts) {
                     currentInvocation === runtimeCompilerInvocation, () => false);
                 return objectImplicitVerification;
             };
-            if (root !== null && compilerVersion !== "" && runtimeHash !== "") {
+            if (persistentCache !== null && compilerVersion !== "" && runtimeHash !== "") {
                 try {
                     const sourcePaths = sources.map((f) => join(rtDir, f));
-                    const cached = await ensureRuntimeObjects(root, driver.argv, cflags, sourcePaths, `lib-obj-v5\0${cacheTargetIdentity(driver)}\0${toolchainEnv}\0${implicitToolchain}\0${runtimeCompilerInvocation}\0${driver.argv.join(" ")}\0${compilerVersion}\0${runtimeHash}\0`, async () => (await runtimeFingerprint(rtDir)) === runtimeHash &&
+                    const cached = await ensureRuntimeObjects(persistentCache.root, driver.argv, cflags, sourcePaths, `lib-obj-v5\0${cacheTargetIdentity(driver)}\0${toolchainEnv}\0${implicitToolchain}\0${runtimeCompilerInvocation}\0${driver.argv.join(" ")}\0${compilerVersion}\0${runtimeHash}\0`, async () => (await runtimeFingerprint(rtDir)) === runtimeHash &&
                         (await objectImplicitToolchainStillMatches()));
                     const staged = await stageRuntimeObjects(cached, join(buildDir, "cached-runtime"));
                     runtimeObjects = sourcePaths.map((path) => staged.get(path));
@@ -1324,31 +1158,36 @@ export async function compileLibArchive(opts) {
                 await installArtifact(archiveOutput, opts.outPath);
             let runtimeStillMatchesKey = false;
             if (cachedArchive !== null &&
-                root !== null &&
+                persistentCache !== null &&
                 runtimeHash !== "" &&
                 programDependencyHash !== "" &&
                 compilerVersion !== "" &&
                 archiverVersion !== "") {
-                const [currentRuntime, currentImplicit, currentRuntimeInvocation, currentProgramInvocation, currentProgramDependencies, currentCompiler, currentArchiver] = await Promise.all([
+                const [currentRuntime, currentImplicit, currentRuntimeInvocation, currentProgramInvocation, currentProgramDependencies, currentCompiler, currentArchiver, currentProgramShardMerge] = await Promise.all([
                     runtimeFingerprint(rtDir).catch(() => null),
                     implicitToolchainFingerprint(driver, toolchainEnv).catch(() => null),
                     effectiveCompilerInvocationFingerprint(driver, toolchainEnv, cflags).catch(() => null),
                     effectiveCompilerInvocationFingerprint(driver, toolchainEnv, programCompilerArgs, programSourceExtension).catch(() => null),
                     translationUnitDependencyFingerprint(driver, cflags, opts.cPath, cachedProgramBytes, toolchainEnv).catch(() => null),
-                    ccVersionOnce(driver.argv, toolchainEnv, true).catch(() => null),
+                    ccVersion(driver.argv, toolchainEnv, true).catch(() => null),
                     toolVersionOnce(arArgv, toolchainEnv, true).catch(() => null),
+                    programShards === null
+                        ? Promise.resolve(null)
+                        : resolveProgramShardMergeIdentity(driver).catch(() => null),
                 ]);
                 runtimeStillMatchesKey =
                     cacheInputsStable &&
+                        !programShardFallback &&
                         currentRuntime === runtimeHash &&
                         currentImplicit === implicitToolchain &&
                         currentRuntimeInvocation === runtimeCompilerInvocation &&
                         currentProgramInvocation === programCompilerInvocation &&
                         currentProgramDependencies === programDependencyHash &&
                         currentCompiler === compilerVersion &&
-                        currentArchiver === archiverVersion;
+                        currentArchiver === archiverVersion &&
+                        currentProgramShardMerge === programShardMergeIdentity;
             }
-            if (cachedArchive !== null && root !== null && runtimeStillMatchesKey) {
+            if (cachedArchive !== null && persistentCache !== null && runtimeStillMatchesKey) {
                 try {
                     await publishCachedFile(archiveOutput, cachedArchive);
                 }
@@ -1366,8 +1205,9 @@ export async function compileLibArchive(opts) {
             await rm(transientVendorRoot, { recursive: true, force: true }).catch(() => undefined);
         }
     }
-    if (root !== null)
-        await pruneCache(root).catch(() => undefined);
+    if (persistentCache !== null) {
+        await pruneCache(persistentCache.root).catch(() => undefined);
+    }
 }
 /* Multi-instance library mode's localization step: combine the program
  * object with exactly the runtime/vendor members it reaches into ONE
@@ -1456,14 +1296,17 @@ async function localizeLibraryObjects(driver, arArgv, buildDir, rootObjects, sup
         }
         return combined;
     }
-    await run([arArgv[0] ?? "ar", ...arArgv.slice(1), "rcs", staging, ...supportObjects]);
+    const supportArgs = supportObjects.length === 0 ? [] : [staging];
+    if (supportObjects.length > 0) {
+        await run([arArgv[0] ?? "ar", ...arArgv.slice(1), "rcs", staging, ...supportObjects]);
+    }
     if (platform === "darwin") {
         await writeFile(keepFile, keepSymbols.map((s) => `_${s}\n`).join(""));
-        await run(["ld", "-r", ...rootObjects, staging, "-o", combined, "-exported_symbols_list", keepFile]);
+        await run(["ld", "-r", ...rootObjects, ...supportArgs, "-o", combined, "-exported_symbols_list", keepFile]);
     }
     else if (platform === "linux" && driver.target === null) {
         await writeFile(keepFile, keepSymbols.map((s) => `${s}\n`).join(""));
-        await run(["ld", "-r", "--force-group-allocation", ...rootObjects, staging, "-o", combined]);
+        await run(["ld", "-r", "--force-group-allocation", ...rootObjects, ...supportArgs, "-o", combined]);
         await run(["objcopy", `--keep-global-symbols=${keepFile}`, combined]);
     }
     else if (platform === "linux") {
@@ -1478,7 +1321,7 @@ async function localizeLibraryObjects(driver, arArgv, buildDir, rootObjects, sup
             ...driver.argv.slice(1),
             "-target", driver.zigTarget ?? driver.target,
             "-nostdlib",
-            "-r", ...rootObjects, staging,
+            "-r", ...rootObjects, ...supportArgs,
             "-o", combined,
         ]);
         try {
@@ -1489,7 +1332,7 @@ async function localizeLibraryObjects(driver, arArgv, buildDir, rootObjects, sup
         }
     }
     else {
-        throw new Error(`runtime symbol localization (abi.localize_runtime) has no ${platform} arm; compileLibrary admits darwin, linux, and win32 builds only`);
+        throw new InternalCompilerError(`runtime symbol localization (abi.localize_runtime) has no ${platform} arm; compileLibrary admits darwin, linux, and win32 builds only`);
     }
     return combined;
 }
@@ -1497,7 +1340,7 @@ async function localizeLibraryObjects(driver, arArgv, buildDir, rootObjects, sup
  * Content-addressed caches that let repeat builds of unchanged programs skip
  * payload code generation/linking — the test lanes' dominant cost. Executable
  * lookups still run lightweight dependency and link-input metadata probes.
- * Three keyspaces under the cache root:
+ * Principal keyspaces under the cache root:
  *
  *   bin/<key>       — whole program binaries. key = sha256(resolved clang
  *                     identity/version, target + compiler/linker environment,
@@ -1527,6 +1370,14 @@ async function localizeLibraryObjects(driver, arArgv, buildDir, rootObjects, sup
  *                     identity, TU path, and program-TU bytes.
  *                     Checksum-verified hits skip native code generation and ar.
  *
+ *   program-obj/<key> — the canonical library program object, after any LLVM
+ *                     shard merge. Exact TU repeats reuse it directly.
+ *
+ *   program-shard/<key> — stable LLVM dev-library buckets keyed by their IR
+ *                     text and complete toolchain/TU identity. Local edits
+ *                     retain every bucket whose definitions/declarations did
+ *                     not change.
+ *
  *   obj/<set>/<f>.o — per-flavor runtime objects for cache-miss builds. The
  *                     historical single invocation recompiles every runtime
  *                     TU per program (~1.3s at -O2); with cached objects a
@@ -1567,81 +1418,53 @@ async function localizeLibraryObjects(driver, arArgv, buildDir, rootObjects, sup
  * oracle cache lives under the same root and is swept by the same pass. Cache
  * trouble is never a build failure — every cache error falls back to a real
  * compile. */
-/** Resolve the build cache without touching the filesystem. Exported from this
- * internal module so its platform and override behavior can be pinned directly. */
-export function resolveBuildCacheRoot(env = process.env, platform = process.platform, userHome = homedir()) {
-    if (env["SCRIPTC_NO_CACHE"] === "1")
-        return null;
-    const configured = env["SCRIPTC_CACHE_DIR"];
-    if (configured !== undefined)
-        return configured === "" ? null : resolve(configured);
-    const xdg = env["XDG_CACHE_HOME"];
-    if (xdg !== undefined && xdg !== "")
-        return resolve(xdg, "scriptc", "build");
-    if (platform === "win32") {
-        const local = env["LOCALAPPDATA"];
-        if (local !== undefined && local !== "")
-            return resolve(local, "scriptc", "cache", "build");
-    }
-    return platform === "darwin"
-        ? resolve(userHome, "Library", "Caches", "scriptc", "build")
-        : resolve(userHome, ".cache", "scriptc", "build");
-}
-/** Shared persistent-cache root for compiler-level tiers.  The early library
- * cache deliberately follows the native cache's activation and hard-disable
- * contract, while native compilation retains ownership of toolchain safety. */
-export function buildCacheRoot() {
-    return resolveBuildCacheRoot();
-}
-/** Harden/create a compiler-level cache root using the same privacy policy as
- * the artifact caches.  Failure disables only the optional caller's tier. */
-export async function prepareBuildCacheRoot(root) {
-    if (root === null)
-        return null;
+const ccVersionMemos = new Map();
+/** Identity of the compiler implementation and configuration selected by a
+ * fresh driver invocation. In particular, Darwin's stable /usr/bin/clang shim
+ * exposes the currently selected Xcode clang only in its `-###` trace. The
+ * normalized trace also covers output-affecting default driver configuration
+ * that can change while argv[0] and PATH retain the same spelling. */
+async function effectiveCompilerEnvironmentIdentity(driver, env) {
+    const compiler = driver.argv[0] ?? "clang";
+    const resolvedDriver = await resolvedTool(compiler, env);
+    if (resolvedDriver === null)
+        return `<unresolved:${compiler}>`;
+    const probeDir = await mkdtemp(join(tmpdir(), "scriptc-early-cc-probe-"));
     try {
-        await ensurePrivateCacheRoot(root, process.env["SCRIPTC_CACHE_DIR"] === undefined);
-        return root;
-    }
-    catch {
-        return null;
-    }
-}
-/** Register a successful compiler-level cache write with the shared bounded
- * LRU policy. */
-export async function pruneBuildCache(root) {
-    if (root !== null)
-        await pruneCache(root).catch(() => undefined);
-}
-function cacheRootDir() {
-    return resolveBuildCacheRoot();
-}
-/** The production cache can contain complete user executables/archives with
- * embedded source literals or comptime values. Its root is therefore private
- * regardless of the caller's ordinary output umask. Windows inherits the
- * per-user LOCALAPPDATA ACL. POSIX platform-default roots are hardened for
- * upgrades; an arbitrary existing SCRIPTC_CACHE_DIR override is never chmod'd
- * and participates only when its caller-provided mode is already private. */
-async function ensurePrivateCacheRoot(root, hardenExisting) {
-    const existing = await stat(root).then((info) => info, (error) => {
-        if (error.code === "ENOENT")
-            return null;
-        throw error;
-    });
-    if (existing !== null && !existing.isDirectory()) {
-        throw new Error("native cache root is not a directory");
-    }
-    if (process.platform !== "win32" &&
-        existing !== null &&
-        !hardenExisting &&
-        (existing.mode & 0o077) !== 0) {
-        throw new Error("existing native cache override is not private");
+        const source = join(probeDir, "empty.c");
+        const object = join(probeDir, "empty.o");
+        await writeFile(source, "int scriptc_early_driver_probe;\n");
+        const trace = await execFileAsync(compiler, [
+            ...driver.argv.slice(1),
+            ...driver.targetArgs,
+            "-###",
+            "-std=c11",
+            "-c",
+            source,
+            "-o",
+            object,
+        ], { cwd: probeDir, env, maxBuffer: 16 * 1024 * 1024 });
+        const effectiveSpellings = [];
+        for (const line of `${trace.stdout}\n${trace.stderr}`.split(/\r?\n/)) {
+            const tokens = driverTraceCandidates(line);
+            const cc1 = tokens.indexOf("-cc1");
+            if (cc1 > 0)
+                effectiveSpellings.push(tokens[cc1 - 1]);
+        }
+        const effective = effectiveSpellings.length === 1
+            ? await resolvedTool(effectiveSpellings[0], env)
+            : null;
+        return createHash("sha256")
+            .update("effective-compiler-environment-v1\0")
+            .update(resolvedDriver.cacheIdentity).update("\0")
+            .update(normalizedProbeInvocation(trace, probeDir)).update("\0")
+            .update(effective?.cacheIdentity ?? `<unresolved-effective:${effectiveSpellings.join("\x1f")}>`)
+            .digest("hex");
     }
-    await mkdir(root, { recursive: true, mode: 0o700 });
-    if (process.platform !== "win32" && (existing === null || hardenExisting)) {
-        await chmod(root, 0o700);
+    finally {
+        await rm(probeDir, { recursive: true, force: true }).catch(() => undefined);
     }
 }
-const ccVersionMemos = new Map();
 /** Resolve the executable the OS will select for an argv[0] spelling. The
  * path and inode metadata join the version output below: two PATH postures
  * must not share cache entries merely because both drivers call themselves
@@ -1721,7 +1544,7 @@ function isAppleSystemClangHandoff(driver, effectiveCompiler) {
  * can safely represent that behavior. Accept direct Clang/Zig drivers (plus
  * Apple's system shim) and conservatively keep wrapper-driven builds on the
  * uncached path. */
-async function compilerDriverSupportsPersistentCache(driver, environmentFingerprint) {
+export async function compilerDriverSupportsPersistentCache(driver, environmentFingerprint) {
     // Cache-race tests exercise publication below an intentionally instrumented
     // wrapper. This is deliberately undocumented and test-scoped.
     if (process.env["SCRIPTC_TEST_TRUST_COMPILER_WRAPPER"] === "1")
@@ -1807,7 +1630,7 @@ async function archiverSupportsPersistentCache(arArgv, driver) {
     return process.platform === "darwin" &&
         /^\/Applications\/Xcode[^/]*\.app\/Contents\/Developer\/Toolchains\/[^/]+\.xctoolchain\/usr\/bin\/[^/]*ar$/.test(archiver.canonicalPath);
 }
-export async function ccVersionOnce(argv, environmentFingerprint = toolchainEnvironmentFingerprint(), fresh = false) {
+export async function ccVersion(argv, environmentFingerprint = toolchainEnvironmentFingerprint(), fresh = false) {
     const spellingKey = `${environmentFingerprint}\0${argv.join("\x1f")}`;
     const executableIdentity = await resolvedToolIdentity(argv[0] ?? "clang");
     const key = `${spellingKey}\0${executableIdentity ?? "<unresolved>"}`;
@@ -2174,7 +1997,7 @@ function translationUnitDependencyFingerprint(driver, cflags, sourcePath, source
  * change that redirects includes cannot hide behind an unchanged old path
  * list. Dependency discovery must succeed on every cache-enabled invocation;
  * a prior path list cannot reveal a new higher-priority header. */
-async function implicitToolchainFingerprintFresh(driver, environmentFingerprint) {
+async function implicitToolchainFingerprintsFresh(driver, environmentFingerprint) {
     let probe;
     const compiler = driver.argv[0] ?? "clang";
     const compilerIdentity = await resolvedToolIdentity(compiler);
@@ -2227,7 +2050,8 @@ async function implicitToolchainFingerprintFresh(driver, environmentFingerprint)
                 // executable/version and dependency set.
                 execFileAsync(compiler, [...prefix, "-std=c11", "-###", "-c", driverSource, "-o", driverOutput], { cwd: probeDir, maxBuffer: 16 * 1024 * 1024 }),
             ]);
-            const toolSpellings = [linker.stdout.trim(), assembler.stdout.trim()].filter((value, index, all) => value !== "" && all.indexOf(value) === index);
+            const assemblerSpelling = assembler.stdout.trim();
+            const toolSpellings = [linker.stdout.trim(), assemblerSpelling].filter((value, index, all) => value !== "" && all.indexOf(value) === index);
             const sourceSet = new Set(sources);
             const dependencyPaths = [
                 ...new Set(dependencyResults
@@ -2248,44 +2072,56 @@ async function implicitToolchainFingerprintFresh(driver, environmentFingerprint)
                         path: resolved?.canonicalPath ?? null,
                     };
                 })),
+                compileToolSpellings: assemblerSpelling === "" ? [] : [assemblerSpelling],
             };
         }
         finally {
             await rm(probeDir, { recursive: true, force: true }).catch(() => undefined);
         }
     }
-    const hash = createHash("sha256")
-        .update("implicit-toolchain-v2\0")
-        .update(environmentFingerprint)
-        .update("\0")
-        .update(probe.compilerIdentity)
-        .update("\0")
-        .update(probe.compilerInvocation)
-        .update("\0")
-        .update(driver.argv.join("\x1f"))
-        .update("\0")
-        .update(driver.targetArgs.join("\x1f"))
-        .update("\0")
-        .update(probe.dependencies.join("\x1f"))
-        .update("\0")
-        .update(probe.dependencyFingerprint)
-        .update("\0");
-    for (const tool of probe.tools) {
-        const currentIdentity = await resolvedToolIdentity(tool.spelling);
-        hash
-            .update(tool.spelling)
+    const tools = await Promise.all(probe.tools.map(async (tool) => ({
+        ...tool,
+        currentIdentity: await resolvedToolIdentity(tool.spelling),
+    })));
+    const fingerprint = (domain, selectedTools) => {
+        const hash = createHash("sha256")
+            .update(domain)
+            .update(environmentFingerprint)
+            .update("\0")
+            .update(probe.compilerIdentity)
+            .update("\0")
+            .update(probe.compilerInvocation)
             .update("\0")
-            .update(currentIdentity ?? tool.identity ?? "<unresolved>")
+            .update(driver.argv.join("\x1f"))
+            .update("\0")
+            .update(driver.targetArgs.join("\x1f"))
+            .update("\0")
+            .update(probe.dependencies.join("\x1f"))
+            .update("\0")
+            .update(probe.dependencyFingerprint)
             .update("\0");
-    }
-    return rememberFingerprintDependencies(hash.digest("hex"), [
-        ...probe.dependencies,
-        ...probe.invocationPaths,
-        ...probe.tools.flatMap((tool) => tool.path === null ? [] : [tool.path]),
-    ], probe.dependencies, probe.dependencyFingerprint);
+        for (const tool of selectedTools) {
+            hash
+                .update(tool.spelling)
+                .update("\0")
+                .update(tool.currentIdentity ?? tool.identity ?? "<unresolved>")
+                .update("\0");
+        }
+        return rememberFingerprintDependencies(hash.digest("hex"), [
+            ...probe.dependencies,
+            ...probe.invocationPaths,
+            ...selectedTools.flatMap((tool) => tool.path === null ? [] : [tool.path]),
+        ], probe.dependencies, probe.dependencyFingerprint);
+    };
+    const compileSpellingSet = new Set(probe.compileToolSpellings);
+    return {
+        // Preserve the established complete fingerprint domain and byte stream.
+        complete: fingerprint("implicit-toolchain-v2\0", tools),
+        compile: fingerprint("implicit-compile-toolchain-v1\0", tools.filter((tool) => compileSpellingSet.has(tool.spelling))),
+    };
 }
 const stableImplicitToolchainMemos = new Map();
-function implicitToolchainFingerprint(driver, environmentFingerprint) {
+function implicitToolchainFingerprints(driver, environmentFingerprint) {
     const key = [
         environmentFingerprint,
         driver.argv.join("\x1f"),
@@ -2293,7 +2129,10 @@ function implicitToolchainFingerprint(driver, environmentFingerprint) {
         driver.targetArgs.join("\x1f"),
         runtimeSrcDir(),
     ].join("\0");
-    return stableTestMemo(stableImplicitToolchainMemos, key, () => implicitToolchainFingerprintFresh(driver, environmentFingerprint));
+    return stableTestMemo(stableImplicitToolchainMemos, key, () => implicitToolchainFingerprintsFresh(driver, environmentFingerprint));
+}
+function implicitToolchainFingerprint(driver, environmentFingerprint) {
+    return implicitToolchainFingerprints(driver, environmentFingerprint).then((fingerprints) => fingerprints.complete);
 }
 function linkTraceCandidate(line) {
     const trimmed = line.trim().replace(/^(?:LOAD|load)\s+/, "");
@@ -2514,24 +2353,41 @@ function implicitLinkerFingerprint(driver, environmentFingerprint, linkArgs, eff
     ].join("\0");
     return stableTestMemo(stableImplicitLinkerMemos, key, () => implicitLinkerFingerprintFresh(driver, environmentFingerprint, linkArgs, effectiveInvocationArgs, traceInvocationArgs));
 }
+/** Resolve the exact files consumed by one compiler-driver link invocation.
+ * Runtime packs reuse the native toolchain's strict dry-run plus real linker
+ * trace so a PATH-selected Clang carries its own linker, SDK, compiler
+ * runtime, and injected inputs into the executable cache proof. */
+export async function nativeLinkerDependencyPaths(linker, linkArgs) {
+    const fingerprint = await implicitLinkerFingerprint({ argv: [linker], targetArgs: [], target: null }, toolchainEnvironmentFingerprint(), linkArgs);
+    return fingerprintDependencyPaths(fingerprint);
+}
 let ccacheMemo = null;
+/** Reset process observations whose validity is bounded to one public native
+ * build. A long-lived caller may change PATH or install/remove ccache between
+ * invocations; the next build must probe that environment again. */
+export function clearCcCaches() {
+    ccacheMemo = null;
+}
 function ccacheAvailable() {
     ccacheMemo ??= execFileAsync("ccache", ["--version"]).then(() => true, () => false);
     return ccacheMemo;
 }
-/** Content hash of every .c/.h in the runtime src tree, the Ryū sources
- * textually included by scr_number.c, and the separately-built vendor pins —
- * everything a binary links that the emitted C bytes don't already cover
- * (npm-embedded C rides inside the emitted C; the engine and standalone
- * vendor archives are pinned by their version constants). The small source
- * tree is hashed on every identity calculation: recursive enumeration is
- * required because a newly added nested header can begin shadowing a system
- * include without changing any previously selected dependency, while content
- * hashing catches same-size edits whose timestamp was preserved by a copy/sync
- * tool. */
+/** Content hash of every owned native source/header plus this backend's build
+ * recipe implementation. It keys complete artifacts, runtime objects, and the
+ * separately built vendor prerequisites, so two installed scriptc versions or
+ * worktrees can share a user cache without exchanging outputs produced from
+ * different vendored bytes or compile/archive recipes. Recursive enumeration
+ * also catches a newly added nested header that begins shadowing a system
+ * include, while content hashing catches same-size timestamp-preserving edits. */
 async function runtimeFingerprintFresh(rtDir) {
     const groups = await runtimeFingerprintInputGroups(rtDir);
-    const h = createHash("sha256").update(QJS_COMMIT).update(MBEDTLS_VERSION).update(ZLIB_VERSION);
+    const h = createHash("sha256")
+        .update("native-owned-inputs-v2\0")
+        .update(QJS_COMMIT).update(MBEDTLS_VERSION).update(ZLIB_VERSION)
+        .update("\0backend-recipe\0");
+    for (const path of NATIVE_RECIPE_IMPLEMENTATION_PATHS) {
+        h.update(basename(path)).update("\0").update(await readFile(path)).update("\0");
+    }
     for (const group of groups) {
         for (const n of group.names) {
             h.update(group.label).update("/").update(n).update("\0").update(await readFile(join(group.dir, n))).update("\0");
@@ -2543,6 +2399,10 @@ async function runtimeFingerprintInputGroups(rtDir) {
     return Promise.all([
         { label: "runtime", dir: rtDir },
         { label: "ryu", dir: join(rtDir, "..", "vendor", "ryu") },
+        { label: "quickjs-ng", dir: join(rtDir, "..", "vendor", "quickjs-ng") },
+        { label: "mbedtls", dir: join(rtDir, "..", "vendor", "mbedtls") },
+        { label: "zlib", dir: join(rtDir, "..", "vendor", "zlib") },
+        { label: "curl", dir: join(rtDir, "..", "vendor", "curl") },
     ].map(async (group) => {
         const names = (await nativeSourceFiles(group.dir, true))
             .map((path) => relative(group.dir, path))
@@ -2551,96 +2411,30 @@ async function runtimeFingerprintInputGroups(rtDir) {
     }));
 }
 async function runtimeFingerprintInputPaths(rtDir) {
-    return (await runtimeFingerprintInputGroups(rtDir)).flatMap((group) => group.names.map((name) => join(group.dir, name)));
+    return [
+        ...(await runtimeFingerprintInputGroups(rtDir)).flatMap((group) => group.names.map((name) => join(group.dir, name))),
+        ...NATIVE_RECIPE_IMPLEMENTATION_PATHS,
+    ];
 }
 const stableRuntimeFingerprintMemos = new Map();
 export function runtimeFingerprint(rtDir) {
     const key = resolve(rtDir);
     return stableTestMemo(stableRuntimeFingerprintMemos, key, () => runtimeFingerprintFresh(rtDir));
 }
+const { vendorEngineDir, vendorTlsDir, vendorCurlDir, vendorBuildCacheRoot, vendorCacheTargetFlavor, vendorCacheBuildIdentity, currentVendorCacheBuildIdentity, engineArchivePath, stageVendorInputs, ensureEngineArchive, lreObjectPaths, ensureLreObjects, vendorZlibDir, zlibObjectPaths, ensureZlibObjects, curlStubDirPath, ensureCurlStub, tlsArchivePath, ensureTlsArchive, QJS_ENGINE_SOURCES, LRE_SOURCES, ZLIB_SOURCES, } = createVendorArchives({
+    runtimeSrcDir,
+    targetPlatform,
+    isZigDriver,
+    resolvedToolIdentity,
+    runtimeFingerprint,
+});
+export { vendorCacheBuildIdentity, vendorCacheTargetFlavor };
 class CacheInputsChangedError extends Error {
     constructor() {
         super("runtime inputs changed while populating the native object cache");
         this.name = "CacheInputsChangedError";
     }
 }
-function cacheDigestPath(path) {
-    return `${path}.sha256`;
-}
-async function fileDigest(path) {
-    return createHash("sha256").update(await readFile(path)).digest("hex");
-}
-/** Cache entries are disposable data, not trusted compiler output. Atomic
- * rename prevents ordinary partial writes, while the adjacent digest catches
- * disk damage, manual truncation, and entries left by an interrupted/older
- * publisher before they reach clang, the linker, or `ar`. */
-async function validCachedFile(object) {
-    try {
-        const digestPath = cacheDigestPath(object);
-        const expected = (await readFile(digestPath, "utf8")).trim();
-        const valid = /^[0-9a-f]{64}$/.test(expected) && (await fileDigest(object)) === expected;
-        if (valid) {
-            const now = new Date();
-            await Promise.all([
-                utimes(object, now, now).catch(() => undefined),
-                utimes(digestPath, now, now).catch(() => undefined),
-            ]);
-        }
-        return valid;
-    }
-    catch {
-        return false;
-    }
-}
-/** Copy a cache entry and verify the private copy before it can become a
- * caller-visible artifact. Verifying after the copy closes the gap between a
- * source-side digest check and a concurrent replacement/truncation. */
-async function copyValidCachedFile(source, destination) {
-    try {
-        const digestPath = cacheDigestPath(source);
-        const expected = (await readFile(digestPath, "utf8")).trim();
-        if (!/^[0-9a-f]{64}$/.test(expected))
-            return false;
-        await copyFile(source, destination);
-        if ((await fileDigest(destination)) !== expected) {
-            await rm(destination, { force: true }).catch(() => undefined);
-            return false;
-        }
-        const now = new Date();
-        await Promise.all([
-            utimes(source, now, now).catch(() => undefined),
-            utimes(digestPath, now, now).catch(() => undefined),
-        ]);
-        return true;
-    }
-    catch {
-        await rm(destination, { force: true }).catch(() => undefined);
-        return false;
-    }
-}
-/** Publish a complete executable/archive and its digest through private names.
- * Data is installed before its verifier, so a racing reader can only observe
- * an invalid/missing digest and take the fresh-build path. */
-async function publishCachedFile(source, destination) {
-    const directory = dirname(destination);
-    await mkdir(directory, { recursive: true });
-    const nonce = `${process.pid}-${Math.random().toString(36).slice(2)}`;
-    const tmp = join(directory, `.tmp-${basename(destination).slice(0, 8)}-${nonce}`);
-    const tmpDigest = `${tmp}.sha256`;
-    try {
-        await copyFile(source, tmp);
-        await chmod(tmp, 0o600);
-        await writeFile(tmpDigest, `${await fileDigest(tmp)}\n`, { mode: 0o600 });
-        await rename(tmp, destination);
-        await rename(tmpDigest, cacheDigestPath(destination));
-    }
-    finally {
-        await Promise.all([
-            rm(tmp, { force: true }).catch(() => undefined),
-            rm(tmpDigest, { force: true }).catch(() => undefined),
-        ]);
-    }
-}
 async function directoryTreeDigest(root, excludedPaths = []) {
     const hash = createHash("sha256").update("native-dependency-tree-v1\0");
     const visited = new Set();
@@ -2737,7 +2531,28 @@ async function snapshotLocalArtifactDependencies(dependencyPaths, recursiveDirec
     const recursive = new Set(recursiveDirectories.map((path) => resolve(path)));
     return Promise.all([...new Set(dependencyPaths)].sort().map((path) => snapshotLocalArtifactDependency(path, recursive.has(resolve(path)) ? recursiveExclusions : null)));
 }
-async function localArtifactDependenciesStillMatch(dependencies) {
+/** Capture exact filesystem identities for inputs produced outside the C
+ * toolchain but consumed by its cache proofs. Callers carry this snapshot
+ * forward so later stages can prove the same inputs remained installed. */
+export async function snapshotNativeArtifactDependencies(dependencyPaths) {
+    return snapshotLocalArtifactDependencies(dependencyPaths);
+}
+export async function nativeArtifactDependenciesStillMatch(dependencies) {
+    if (!dependencies.every((dependency) => dependency !== null && typeof dependency === "object" &&
+        typeof dependency.path === "string" &&
+        (dependency.kind === "file" || dependency.kind === "directory" || dependency.kind === "symlink") &&
+        typeof dependency.dev === "number" && typeof dependency.ino === "number" &&
+        typeof dependency.size === "number" && typeof dependency.mtimeMs === "number" &&
+        typeof dependency.ctimeMs === "number" &&
+        (dependency.treeDigest === undefined || typeof dependency.treeDigest === "string") &&
+        (dependency.treeExclusions === undefined || (Array.isArray(dependency.treeExclusions) &&
+            dependency.treeExclusions.every((path) => typeof path === "string"))) &&
+        (dependency.kind !== "symlink" || (typeof dependency.targetPath === "string" &&
+            (dependency.targetKind === "file" || dependency.targetKind === "directory") &&
+            typeof dependency.targetDev === "number" && typeof dependency.targetIno === "number" &&
+            typeof dependency.targetSize === "number" && typeof dependency.targetMtimeMs === "number" &&
+            typeof dependency.targetCtimeMs === "number"))))
+        return false;
     return (await Promise.all(dependencies.map(async (dependency) => {
         const current = await snapshotLocalArtifactDependency(dependency.path, dependency.treeDigest === undefined ? null : dependency.treeExclusions ?? []).catch(() => null);
         return current !== null && JSON.stringify(current) === JSON.stringify(dependency);
@@ -2767,7 +2582,7 @@ async function readNativeMetadataStamp(root, key) {
                 values: stamp.values,
                 dependencies: stamp.dependencies,
             }) !== stamp.integrity ||
-            !(await localArtifactDependenciesStillMatch(stamp.dependencies))) {
+            !(await nativeArtifactDependenciesStillMatch(stamp.dependencies))) {
             return null;
         }
         return stamp;
@@ -2813,12 +2628,19 @@ function nativeMetadataKey(kind, parts) {
  * The generated TU bytes, every scriptc runtime source, the selected direct
  * compiler inode, target/options/environment, and the output path all join the
  * key. A digest rejects a modified/truncated output before the no-op hit. */
-function localArtifactIdentity(opts, driver, environmentFingerprint, compilerIdentity, runtimeHash, programBytes) {
+function localArtifactIdentity(opts, driver, environmentFingerprint, compilerIdentity, runtimeHash, programBytes, programShardMerge) {
     const normalizedOptions = Object.fromEntries(Object.entries(opts)
-        .filter(([, value]) => value !== undefined)
+        // Shard source can be tens of megabytes. Hash it incrementally below
+        // instead of materializing a second giant JSON string solely for this
+        // output-local fast-path identity.
+        .filter(([key, value]) => value !== undefined && key !== "programShards" && key !== "programPublicSymbols")
         .sort(([a], [b]) => a.localeCompare(b)));
-    return createHash("sha256")
-        .update("local-artifact-v1\0")
+    const executableSectionFlags = executableSectionEliminationFlags(targetPlatform(driver));
+    const hash = createHash("sha256")
+        // v2 adds the executable section-GC recipe. A v1 output-local stamp can
+        // name a same-source binary from before unused runtime sections were
+        // eliminated, so it must never short-circuit the new linker invocation.
+        .update("local-artifact-v2\0")
         .update(cacheTargetIdentity(driver)).update("\0")
         .update(environmentFingerprint).update("\0")
         .update(compilerIdentity).update("\0")
@@ -2826,6 +2648,12 @@ function localArtifactIdentity(opts, driver, environmentFingerprint, compilerIde
         .update(driver.argv.join("\x1f")).update("\0")
         .update(driver.targetArgs.join("\x1f")).update("\0")
         .update(driver.linkArgs.join("\x1f")).update("\0")
+        .update(executableSectionFlags.compile.join("\x1f")).update("\0")
+        .update(executableSectionFlags.link.join("\x1f")).update("\0");
+    if (programShardMerge !== null) {
+        updateProgramShardCacheIdentity(hash, opts.programShards, opts.programPublicSymbols, programShardMerge);
+    }
+    return hash
         .update(process.env["SCRIPTC_FETCH_CURL"] === "1" ? "fetch-curl" : "fetch-native").update("\0")
         .update(JSON.stringify(normalizedOptions)).update("\0")
         .update(resolve(opts.cPath)).update("\0")
@@ -2880,16 +2708,16 @@ async function localArtifactHit(stampPath, outPath, key) {
                     typeof dependency.targetSize !== "number" ||
                     typeof dependency.targetMtimeMs !== "number" ||
                     typeof dependency.targetCtimeMs !== "number")) ||
-            !(await localArtifactDependenciesStillMatch(stamp.dependencies)) ||
+            !(await nativeArtifactDependenciesStillMatch(stamp.dependencies)) ||
             await fileDigest(outPath) !== stamp.digest) {
-            return false;
+            return null;
         }
         const now = new Date();
         await utimes(stampPath, now, now).catch(() => undefined);
-        return true;
+        return stamp;
     }
     catch {
-        return false;
+        return null;
     }
 }
 async function publishLocalArtifactStamp(stampPath, outPath, key, dependencyPaths, recursiveDirectories = [], recursiveExclusions = []) {
@@ -2909,6 +2737,7 @@ async function publishLocalArtifactStamp(stampPath, outPath, key, dependencyPath
         };
         await writeFile(tmp, `${JSON.stringify(stamp)}\n`, { mode: 0o600 });
         await rename(tmp, stampPath);
+        return stamp;
     }
     finally {
         await rm(tmp, { force: true }).catch(() => undefined);
@@ -2919,7 +2748,7 @@ async function publishLocalArtifactStamp(stampPath, outPath, key, dependencyPath
  * per-file atomic renames make every winner equivalent. Publication is held
  * until verifyInputs confirms that the source/header fingerprint used by the
  * key still describes the bytes clang just read. */
-async function ensureRuntimeObjects(root, ccArgv, cflags, sources, keyPrefix, verifyInputs) {
+async function ensureRuntimeObjects(root, ccArgv, cflags, sources, keyPrefix, verifyInputs, protectedPaths) {
     const setKey = createHash("sha256")
         .update(keyPrefix)
         .update(cflags.join("\x1f"))
@@ -2927,6 +2756,13 @@ async function ensureRuntimeObjects(root, ccArgv, cflags, sources, keyPrefix, ve
         .slice(0, 24);
     const objDir = join(root, "obj", setKey);
     const objOf = (src) => join(objDir, `${basename(src, ".c")}.o`);
+    if (protectedPaths !== undefined) {
+        for (const source of sources) {
+            const object = objOf(source);
+            protectedPaths.add(object);
+            protectedPaths.add(cacheDigestPath(object));
+        }
+    }
     const present = await Promise.all(sources.map((s) => validCachedFile(objOf(s))));
     const missing = sources.filter((_, i) => !present[i]);
     if (missing.length > 0) {
@@ -2937,7 +2773,7 @@ async function ensureRuntimeObjects(root, ccArgv, cflags, sources, keyPrefix, ve
             ccArgv[0] === "clang" &&
             (await ccacheAvailable());
         await mkdir(objDir, { recursive: true });
-        const tmpDir = await mkdtemp(join(root, "obj", "build-"));
+        const tmpDir = await mkdtemp(join(tmpdir(), "scriptc-cache-obj-"));
         try {
             const compiled = new Map();
             // Modest parallelism: a flavor's objects build once, but several cold
@@ -2963,7 +2799,7 @@ async function ensureRuntimeObjects(root, ccArgv, cflags, sources, keyPrefix, ve
                             },
                         }
                         : undefined);
-                    compiled.set(src, { object: tmpObj, digest: await fileDigest(tmpObj) });
+                    compiled.set(src, tmpObj);
                 }));
             }
             // The fingerprint was computed before these subprocesses started. Do
@@ -2973,12 +2809,7 @@ async function ensureRuntimeObjects(root, ccArgv, cflags, sources, keyPrefix, ve
                 throw new CacheInputsChangedError();
             for (const [src, built] of compiled) {
                 const destination = objOf(src);
-                const tmpDigest = `${built.object}.sha256`;
-                await writeFile(tmpDigest, `${built.digest}\n`);
-                // Publish data first and its verifier second. A concurrent reader in
-                // the tiny gap sees a missing/mismatched digest and falls back safely.
-                await rename(built.object, destination);
-                await rename(tmpDigest, cacheDigestPath(destination));
+                await publishCachedFile(built, destination);
             }
         }
         finally {
@@ -3017,71 +2848,24 @@ export async function stageRuntimeObjects(objects, stageDir) {
     }));
     return new Map(staged);
 }
-/** Size-capped LRU sweep of the whole cache root. A caller-configured cap is
- * enforced after every successful cache write. The 4 GiB default is checked on
- * the first and every 64th write in a long-lived process: a full tree walk per
- * corpus program would otherwise become quadratic as the cache grows. Oldest-
- * mtime files go first until the tree is back under 75% of the cap; reads bump
- * mtimes. Active links use private staged names/hard links, so cache names can
- * be unlinked safely. */
-const rootWriteCounts = new Map();
-async function pruneCache(root) {
-    const configuredCap = process.env["SCRIPTC_CACHE_MAX_MB"];
-    const writes = (rootWriteCounts.get(root) ?? 0) + 1;
-    rootWriteCounts.set(root, writes);
-    if (configuredCap === undefined && writes !== 1 && writes % 64 !== 0)
-        return;
-    const capBytes = Number(configuredCap ?? "4096") * 1024 * 1024;
-    if (!Number.isFinite(capBytes) || capBytes <= 0)
-        return;
-    const files = [];
-    const walk = async (dir) => {
-        const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
-        for (const ent of entries) {
-            const p = join(dir, ent.name);
-            if (ent.isDirectory())
-                await walk(p);
-            else if (ent.isFile()) {
-                const s = await stat(p).catch(() => null);
-                if (s !== null)
-                    files.push({ path: p, size: s.size, mtimeMs: s.mtimeMs });
-            }
-        }
-    };
-    await walk(root);
-    let total = files.reduce((n, f) => n + f.size, 0);
-    if (total <= capBytes)
-        return;
-    files.sort((a, b) => a.mtimeMs - b.mtimeMs);
-    for (const f of files) {
-        if (total <= capBytes * 0.75)
-            break;
-        try {
-            await unlink(f.path);
-            total -= f.size;
-        }
-        catch {
-            // A concurrent reader/publisher may already have moved the name.
-        }
-    }
-}
 /** Compiles one C program together with the runtime sources.
  * With caching disabled, the runtime (a dozen small files) is recompiled on
- * every build in one historical clang invocation — no cached-archive
+ * every build in one clang invocation — no cached-archive
  * staleness bugs. --dynamic additionally compiles
  * scr_island.c under SCR_DYNAMIC and links the cached engine archive (built
  * lazily, see above); regex-using programs additionally compile scr_regex.c
  * and link libregexp (the cached objects, or the archive's own copy under
- * --dynamic). Without either, the command line is exactly the historical
- * one — regex-free static builds must stay byte-identical.
+ * --dynamic). Executable links use the target's section-elimination recipe
+ * independently of those feature gates.
  *
  * With a caller-supplied dependency identity and an enabled cache root,
  * unchanged programs skip payload code generation/linking via the binary
  * cache after lightweight metadata probes, and misses link the program's own
  * TU against cached per-flavor runtime objects. */
-export async function compileC(opts) {
+async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
     const rtDir = runtimeSrcDir();
     const sanitize = opts.sanitize ?? false;
+    const optimization = opts.optimization ?? "release";
     const dynamic = opts.dynamic ?? false;
     const regex = opts.regex ?? false;
     // fetch's implementation switch: the default is the NATIVE bridge
@@ -3105,6 +2889,24 @@ export async function compileC(opts) {
     const tls = (opts.tls ?? false) || nativeFetch || netIsland;
     const tlsCa = (opts.tlsCa ?? false) || tls;
     const driver = resolveCc();
+    const shardNames = new Set();
+    const programShardsValid = opts.programShards?.every((shard) => {
+        if (basename(shard.name) !== shard.name || !shard.name.endsWith(".ll") ||
+            shardNames.has(shard.name))
+            return false;
+        shardNames.add(shard.name);
+        return true;
+    }) === true;
+    const programShardsRequested = optimization === "dev" && !sanitize && opts.cPath.endsWith(".ll") &&
+        programShardsValid && opts.programShards !== undefined && opts.programShards.length > 1 &&
+        opts.programPublicSymbols !== undefined
+        ? opts.programShards
+        : null;
+    const programShardMergeIdentity = programShardsRequested === null
+        ? null
+        : await resolveProgramShardMergeIdentity(driver);
+    const programShards = programShardMergeIdentity === null ? null : programShardsRequested;
+    const programPublicSymbols = programShards === null ? undefined : opts.programPublicSymbols;
     // Mobile triples produce library archives, never standalone executables:
     // the executable-lane runtime (event loop, sockets, child processes) is
     // not verified on those device classes. compile() reports the SC3002
@@ -3114,8 +2916,9 @@ export async function compileC(opts) {
             `compile with a library profile (SCRIPTC_CC=zigcc scriptc build --lib --profile <profile.json>) and link the archive from the app project.`);
     }
     const runtimeSources = targetPlatform(driver) === "wasi"
-        ? RUNTIME_SOURCES.filter((source) => source !== "scr_child.c")
-        : RUNTIME_SOURCES;
+        ? EXECUTABLE_RUNTIME_SOURCES.filter((source) => source !== "scr_child.c")
+        : EXECUTABLE_RUNTIME_SOURCES;
+    const executableSectionFlags = executableSectionEliminationFlags(targetPlatform(driver));
     // scr_async.c submits callback-style filesystem work to a native worker.
     // POSIX drivers need the thread compile/link mode; win32 uses CreateThread.
     const threadArgs = targetPlatform(driver) === "win32" || targetPlatform(driver) === "wasi"
@@ -3125,7 +2928,7 @@ export async function compileC(opts) {
         // See the resolveCc block: these inputs are built on and for the HOST
         // (vendored archives, system libs). Regex, zlib, and the engine archive
         // are NOT here: their vendored sources are plain C that ensureLreObjects
-        // / ensureZlibObjects / buildEngineArchiveCross compile per target with
+        // / ensureZlibObjects / buildEngineArchiveDirect compile per target with
         // the driver itself — win32 included (the Windows lane runs the
         // @dynamic corpus and the zlib program against the box's Node). The
         // NATIVE fetch rides the socket units and cross-compiles with them —
@@ -3163,15 +2966,24 @@ export async function compileC(opts) {
     // inputs may include caller-owned headers whose contents are not otherwise
     // represented in this key, so they retain the fully uncached historical
     // path unless the caller supplies its own complete dependency identity.
-    let root = opts.cacheIdentity === undefined || !persistentDriverCache
+    const cacheIdentity = opts.cacheIdentity;
+    let persistentCache = cacheIdentity === undefined || configuredCacheRoot === null || !persistentDriverCache
         ? null
-        : configuredCacheRoot;
-    if (root !== null) {
+        : { root: configuredCacheRoot, identity: cacheIdentity };
+    if (cacheWarmOnly && persistentCache === null) {
+        throw new Error("native cache warming requires a persistently cacheable compiler environment");
+    }
+    if (persistentCache !== null) {
         try {
-            await ensurePrivateCacheRoot(root, process.env["SCRIPTC_CACHE_DIR"] === undefined);
+            await ensurePrivateCacheRoot(persistentCache.root, process.env["SCRIPTC_CACHE_DIR"] === undefined);
         }
-        catch {
-            root = null;
+        catch (error) {
+            if (cacheWarmOnly) {
+                throw new Error("native cache warming could not prepare the persistent cache root", {
+                    cause: error,
+                });
+            }
+            persistentCache = null;
         }
     }
     let localArtifact = null;
@@ -3180,9 +2992,10 @@ export async function compileC(opts) {
     // broader cross-output CAS performs its compiler/SDK/linker rediscovery.
     // FFI/native-input builds and the public arbitrary-C cache API stay on the
     // strict path because their dependency graphs are caller-owned.
-    if (root !== null &&
+    if (!cacheWarmOnly &&
+        persistentCache !== null &&
         cachePolicy.completeArtifacts &&
-        opts.cacheIdentity === "scriptc-generated-v1" &&
+        persistentCache.identity === "scriptc-generated-v1" &&
         (opts.linkInputs?.length ?? 0) === 0 &&
         (opts.systemLibraries?.length ?? 0) === 0 &&
         process.env["SCRIPTC_TEST_TRUST_COMPILER_WRAPPER"] !== "1") {
@@ -3194,8 +3007,8 @@ export async function compileC(opts) {
             ]);
             if (compiler !== null) {
                 const effectiveCompiler = directCompilerSelections.get(compilerDriverProbeKey(driver, toolchainEnv)) ?? compiler;
-                const key = localArtifactIdentity(opts, driver, toolchainEnv, `${compiler.cacheIdentity}\0${effectiveCompiler.cacheIdentity}`, runtimeHash, programBytes);
-                const stampPath = localArtifactStampPath(root, opts.outPath);
+                const key = localArtifactIdentity(opts, driver, toolchainEnv, `${compiler.cacheIdentity}\0${effectiveCompiler.cacheIdentity}`, runtimeHash, programBytes, programShardMergeIdentity);
+                const stampPath = localArtifactStampPath(persistentCache.root, opts.outPath);
                 localArtifact = {
                     stampPath,
                     key,
@@ -3203,8 +3016,11 @@ export async function compileC(opts) {
                     programBytes,
                     compilerPath: effectiveCompiler.canonicalPath,
                 };
-                if (await localArtifactHit(stampPath, opts.outPath, key))
+                const hit = await localArtifactHit(stampPath, opts.outPath, key);
+                if (hit !== null) {
+                    await opts.onArtifactReady?.({ dependencies: hit.dependencies }).catch(() => undefined);
                     return;
+                }
             }
         }
         catch {
@@ -3214,12 +3030,13 @@ export async function compileC(opts) {
         }
     }
     let implicitToolchain = null;
+    let implicitCompileToolchain = null;
     let toolchainMetadataStamp = null;
-    const metadataCompiler = root === null
+    const metadataCompiler = persistentCache === null
         ? null
         : await resolvedTool(driver.argv[0] ?? "clang");
     const metadataEffectiveCompiler = directCompilerSelections.get(compilerDriverProbeKey(driver, toolchainEnv)) ?? metadataCompiler;
-    const toolchainMetadataKey = root === null ||
+    const toolchainMetadataKey = persistentCache === null ||
         metadataCompiler === null ||
         metadataEffectiveCompiler === null ||
         process.env["SCRIPTC_TEST_TRUST_COMPILER_WRAPPER"] === "1"
@@ -3236,86 +3053,143 @@ export async function compileC(opts) {
     if (persistentDriverCache) {
         try {
             toolchainMetadataStamp =
-                root === null || toolchainMetadataKey === null
+                persistentCache === null || toolchainMetadataKey === null
                     ? null
-                    : await readNativeMetadataStamp(root, toolchainMetadataKey);
-            implicitToolchain = toolchainMetadataStamp?.values["implicitToolchain"] ??
-                await implicitToolchainFingerprint(driver, toolchainEnv);
+                    : await readNativeMetadataStamp(persistentCache.root, toolchainMetadataKey);
+            implicitToolchain = toolchainMetadataStamp?.values["implicitToolchain"] ?? null;
+            implicitCompileToolchain =
+                toolchainMetadataStamp?.values["implicitCompileToolchain"] ?? null;
+            if (implicitToolchain === null ||
+                (programShards !== null && implicitCompileToolchain === null)) {
+                const fingerprints = await implicitToolchainFingerprints(driver, toolchainEnv);
+                implicitToolchain = fingerprints.complete;
+                implicitCompileToolchain = fingerprints.compile;
+                toolchainMetadataStamp = null;
+            }
             let compilerVersion = toolchainMetadataStamp?.values["compilerVersion"];
             if (compilerVersion === undefined) {
-                compilerVersion = await ccVersionOnce(driver.argv, toolchainEnv, true);
+                compilerVersion = await ccVersion(driver.argv, toolchainEnv, true);
             }
             if (toolchainMetadataStamp === null &&
-                root !== null &&
+                persistentCache !== null &&
                 toolchainMetadataKey !== null) {
                 if (metadataCompiler !== null && metadataEffectiveCompiler !== null) {
-                    toolchainMetadataStamp = await publishNativeMetadataStamp(root, toolchainMetadataKey, { implicitToolchain, compilerVersion }, [
+                    toolchainMetadataStamp = await publishNativeMetadataStamp(persistentCache.root, toolchainMetadataKey, {
+                        implicitToolchain,
+                        ...(implicitCompileToolchain === null ? {} : { implicitCompileToolchain }),
+                        compilerVersion,
+                    }, [
                         metadataCompiler.canonicalPath,
                         metadataEffectiveCompiler.canonicalPath,
                         ...fingerprintDependencyPaths(implicitToolchain),
-                    ], [implicitToolchain]);
+                        ...(implicitCompileToolchain === null
+                            ? []
+                            : fingerprintDependencyPaths(implicitCompileToolchain)),
+                    ], [
+                        implicitToolchain,
+                        ...(implicitCompileToolchain === null ? [] : [implicitCompileToolchain]),
+                    ]);
                 }
             }
         }
-        catch {
+        catch (error) {
             // Cache discovery is best-effort. In particular, a compiler wrapper can
             // compile successfully without implementing the metadata probes.
-            root = null;
+            if (cacheWarmOnly) {
+                throw new Error("native cache warming could not validate the compiler toolchain", {
+                    cause: error,
+                });
+            }
+            persistentCache = null;
         }
     }
     const vendorBuildIdentity = await currentVendorCacheBuildIdentity(driver, `${toolchainEnv}\0${implicitToolchain ?? "<uncached>"}`);
     // Mutable include/SDK/config inputs can change behind a stable environment
     // spelling. The complete/runtime cache is disabled below; vendor objects
-    // must follow the same rule instead of silently surviving in package-local
-    // .cache. A private root gives this invocation the usual vendor build recipe
+    // must follow the same rule instead of silently surviving in the user cache.
+    // A private root gives this invocation the usual vendor build recipe
     // without publishing or reusing those prerequisites.
-    const transientVendorRoot = persistentDriverCache && implicitToolchain !== null
+    const transientVendorRoot = persistentCache !== null && implicitToolchain !== null
         ? null
         : join(tmpdir(), `scriptc-vendor-${process.pid}-${Math.random().toString(36).slice(2)}`);
-    const vendorCacheRoot = transientVendorRoot ?? vendorBuildCacheRoot();
+    const vendorCacheRoot = transientVendorRoot ?? vendorBuildCacheRoot(persistentCache?.root);
     // Every vendor output path is deterministic from pins, flags, driver, and
     // target. Build the command/key from those paths now, but do not materialize
     // them until a complete-binary lookup has missed.
-    const engineArchive = dynamic
+    let engineArchive = dynamic
         ? engineArchivePath(sanitize, driver, vendorBuildIdentity, vendorCacheRoot)
         : null;
-    const tlsArchive = tls
+    let tlsArchive = tls
         ? tlsArchivePath(sanitize, driver, vendorBuildIdentity, vendorCacheRoot)
         : null;
     // --dynamic + regex shares the archive's libregexp (its host hooks and
     // ours would collide; see scr_regex.c) — the standalone objects are for
     // static builds only.
-    const lreObjects = regex && !dynamic
+    let lreObjects = regex && !dynamic
         ? lreObjectPaths(sanitize, driver, vendorBuildIdentity, vendorCacheRoot)
         : [];
-    // Vendored zlib is the CROSS story only — host builds keep the exact
+    // Vendored zlib is the Zig story — default host-clang builds keep the exact
     // historical `-lz` system link (see CcOptions.zlib). The native fetch's
     // gzip decoder rides the same objects/link.
-    const zlibObjects = ((opts.zlib ?? false) || nativeFetch) && driver.target !== null
+    let zlibObjects = ((opts.zlib ?? false) || nativeFetch) && isZigDriver(driver)
         ? zlibObjectPaths(sanitize, driver, vendorBuildIdentity, vendorCacheRoot)
         : [];
     // The libcurl import stub is likewise CROSS-only — host builds keep the
     // exact historical system `-lcurl` link (see CcOptions.fetch). Curl
     // reference builds only.
-    const curlStubDir = curlFetch && driver.target !== null
+    let curlStubDir = curlFetch && driver.target !== null
         ? curlStubDirPath(driver, vendorBuildIdentity, vendorCacheRoot)
         : null;
-    const materializeVendorPrerequisites = async () => {
-        // Preserve the historical order to avoid multiplying first-build resource
+    const materializeVendorPrerequisites = async (stageRoot, materializeCacheRoot = vendorCacheRoot) => {
+        // Preserve source order to avoid multiplying first-build resource
         // pressure when several large vendor sets are cold simultaneously.
         if (dynamic) {
-            await ensureEngineArchive(sanitize, driver, vendorBuildIdentity, vendorCacheRoot);
+            const cachedArchive = engineArchivePath(sanitize, driver, vendorBuildIdentity, materializeCacheRoot);
+            protectCachedArtifact(cacheWarmPaths, cachedArchive);
+            const materialize = async () => [
+                await ensureEngineArchive(sanitize, driver, vendorBuildIdentity, materializeCacheRoot),
+            ];
+            const paths = stageRoot === undefined
+                ? await materialize()
+                : await stageVendorInputs(materialize, join(stageRoot, "engine"));
+            engineArchive = paths[0];
+        }
+        if (tls) {
+            const cachedArchive = tlsArchivePath(sanitize, driver, vendorBuildIdentity, materializeCacheRoot);
+            protectCachedArtifact(cacheWarmPaths, cachedArchive);
+            const materialize = async () => [
+                await ensureTlsArchive(sanitize, driver, vendorBuildIdentity, materializeCacheRoot),
+            ];
+            const paths = stageRoot === undefined
+                ? await materialize()
+                : await stageVendorInputs(materialize, join(stageRoot, "tls"));
+            tlsArchive = paths[0];
         }
-        if (tls)
-            await ensureTlsArchive(sanitize, driver, vendorBuildIdentity, vendorCacheRoot);
         if (regex && !dynamic) {
-            await ensureLreObjects(sanitize, driver, vendorBuildIdentity, vendorCacheRoot);
+            for (const object of lreObjectPaths(sanitize, driver, vendorBuildIdentity, materializeCacheRoot))
+                protectCachedArtifact(cacheWarmPaths, object);
+            const materialize = async () => await ensureLreObjects(sanitize, driver, vendorBuildIdentity, materializeCacheRoot);
+            lreObjects = stageRoot === undefined
+                ? await materialize()
+                : await stageVendorInputs(materialize, join(stageRoot, "lre"));
         }
         if (zlibObjects.length > 0) {
-            await ensureZlibObjects(sanitize, driver, vendorBuildIdentity, vendorCacheRoot);
+            for (const object of zlibObjectPaths(sanitize, driver, vendorBuildIdentity, materializeCacheRoot))
+                protectCachedArtifact(cacheWarmPaths, object);
+            const materialize = async () => await ensureZlibObjects(sanitize, driver, vendorBuildIdentity, materializeCacheRoot);
+            zlibObjects = stageRoot === undefined
+                ? await materialize()
+                : await stageVendorInputs(materialize, join(stageRoot, "zlib"));
         }
         if (curlStubDir !== null) {
-            await ensureCurlStub(driver, vendorBuildIdentity, vendorCacheRoot);
+            protectCachedArtifact(cacheWarmPaths, join(curlStubDirPath(driver, vendorBuildIdentity, materializeCacheRoot), "libcurl.so"));
+            const materialize = async () => [
+                join(await ensureCurlStub(driver, vendorBuildIdentity, materializeCacheRoot), "libcurl.so"),
+            ];
+            const paths = stageRoot === undefined
+                ? await materialize()
+                : await stageVendorInputs(materialize, join(stageRoot, "curl"));
+            curlStubDir = dirname(paths[0]);
         }
     };
     // rt() maps each runtime source's path on the command line: identity for
@@ -3326,7 +3200,8 @@ export async function compileC(opts) {
         ...threadArgs,
         ...(sanitize
             ? ["-O1", "-fsanitize=address", "-DSCR_RC_AUDIT"]
-            : ["-O2"]),
+            : [optimization === "dev" ? "-O0" : "-O2"]),
+        ...executableSectionFlags.compile,
         ...(opts.textDecoderLegacy ? ["-DSCR_TEXT_DECODER_LEGACY"] : []),
         "-fno-math-errno",
         // The emitted object model is deliberately type-punned C: a hierarchy
@@ -3368,14 +3243,14 @@ export async function compileC(opts) {
         ...(opts.dc ? [rt(join(rtDir, "scr_dc.c"))] : []),
         ...(opts.dynAsync || opts.dynInvoke || opts.dc || nativeFetch ? [rt(join(rtDir, "scr_async_dyn.c"))] : []),
         // The zlib UNIT (scr_zlib.c) gates on zlib.* IR use; the LINK (system
-        // libz on hosts, the vendored per-target objects on cross builds)
+        // libz on the default host-clang build, vendored objects on Zig builds)
         // also serves the native fetch's gzip decoder — spread exactly once.
         ...(opts.zlib
-            ? driver.target !== null
+            ? isZigDriver(driver)
                 ? ["-I", vendorZlibDir(), rt(join(rtDir, "scr_zlib.c")), ...zlibObjects]
                 : [rt(join(rtDir, "scr_zlib.c"))]
             : nativeFetch
-                ? driver.target !== null
+                ? isZigDriver(driver)
                     ? ["-I", vendorZlibDir(), ...zlibObjects]
                     : []
                 : []),
@@ -3467,11 +3342,6 @@ export async function compileC(opts) {
                 // left-to-right archive resolution. Other dynamic targets keep
                 // the historical engine-adjacent spelling.
                 ...(driver.linkArgs.includes("-lm") ? [] : ["-lm"]),
-                // ld64 dead-stripping claws back a chunk of the engine archive;
-                // harmless elsewhere but only spelled this way on macOS. Keyed on
-                // the TARGET platform (= the host on the default path, where this
-                // expression is byte-identical to the historical one).
-                ...(targetPlatform(driver) === "darwin" ? ["-Wl,-dead_strip"] : []),
                 // The PE stack reserve, pinned to the 8MB POSIX main-stack
                 // geometry ISL_MAIN_STACK_BUDGET is sized against (4MB engine
                 // budget + 4MB excursion margin) — quickjs-ng's own CMake makes
@@ -3499,16 +3369,17 @@ export async function compileC(opts) {
         ...(opts.linkInputs ?? []),
         ...(opts.systemLibraries ?? []).map((name) => `-l${name}`),
         // GNU ld resolves libraries from left to right and commonly enables
-        // --as-needed: host libz must follow scr_zlib.c/scr_fetch.c and every
+        // --as-needed: host-clang libz must follow scr_zlib.c/scr_fetch.c and every
         // generated/native input that references inflate symbols. Cross
-        // builds use vendored zlib objects in the input section above.
-        ...(((opts.zlib ?? false) || nativeFetch) && driver.target === null
+        // and targetless Zig builds use vendored zlib objects in the input section above.
+        ...(((opts.zlib ?? false) || nativeFetch) && !isZigDriver(driver)
             ? ["-lz"]
             : []),
         // glibc keeps libm separate from libc. This must trail the generated
         // program and every native FFI input because GNU ld resolves archives
         // from left to right.
         ...driver.linkArgs,
+        ...executableSectionFlags.link,
         "-o", build.outPath ?? opts.outPath,
     ];
     // Compile-only flags shared by runtime-object population and the caller-TU
@@ -3520,7 +3391,8 @@ export async function compileC(opts) {
         ...threadArgs,
         ...(sanitize
             ? ["-O1", "-fsanitize=address", "-DSCR_RC_AUDIT"]
-            : ["-O2"]),
+            : [optimization === "dev" ? "-O0" : "-O2"]),
+        ...executableSectionFlags.compile,
         ...(opts.textDecoderLegacy ? ["-DSCR_TEXT_DECODER_LEGACY"] : []),
         "-fno-math-errno",
         "-fno-strict-aliasing", // the emitted object model type-puns — see buildArgs
@@ -3553,11 +3425,21 @@ export async function compileC(opts) {
                 `${guidance}\n\n${stderr}`);
         }
     };
+    const runUncachedBuild = async () => {
+        const privateVendorRoot = transientVendorRoot ?? join(tmpdir(), `scriptc-vendor-fallback-${process.pid}-${Math.random().toString(36).slice(2)}`);
+        try {
+            await materializeVendorPrerequisites(undefined, privateVendorRoot);
+            await runClang(buildArgs((p) => p));
+        }
+        finally {
+            await rm(privateVendorRoot, { recursive: true, force: true }).catch(() => undefined);
+        }
+    };
     let runtimeCompilerInvocation = null;
     let programCompilerInvocation = null;
     let payloadMetadata = null;
     let compileMetadataStamp = null;
-    const compileMetadataKey = root === null || process.env["SCRIPTC_TEST_TRUST_COMPILER_WRAPPER"] === "1"
+    const compileMetadataKey = persistentCache === null || process.env["SCRIPTC_TEST_TRUST_COMPILER_WRAPPER"] === "1"
         ? null
         : nativeMetadataKey("compile", [
             cacheTargetIdentity(driver),
@@ -3568,14 +3450,14 @@ export async function compileC(opts) {
             programCompilerArgs,
             programSourceExtension,
         ]);
-    if (root !== null) {
+    if (persistentCache !== null) {
         try {
             // These probes inspect disjoint inputs. Start the payload reads here as
             // well so runtime hashing and clang's dry-run traces overlap instead of
             // forming a serial prelude before every cache lookup.
             payloadMetadata = Promise.all([
                 Promise.resolve(toolchainMetadataStamp?.values["compilerVersion"] ??
-                    ccVersionOnce(driver.argv, toolchainEnv, true)),
+                    ccVersion(driver.argv, toolchainEnv, true)),
                 localArtifact === null
                     ? runtimeFingerprint(rtDir)
                     : Promise.resolve(localArtifact.runtimeHash),
@@ -3585,7 +3467,7 @@ export async function compileC(opts) {
             ]);
             compileMetadataStamp = compileMetadataKey === null
                 ? null
-                : await readNativeMetadataStamp(root, compileMetadataKey);
+                : await readNativeMetadataStamp(persistentCache.root, compileMetadataKey);
             if (compileMetadataStamp !== null) {
                 runtimeCompilerInvocation = compileMetadataStamp.values["runtimeInvocation"] ?? null;
                 programCompilerInvocation = compileMetadataStamp.values["programInvocation"] ?? null;
@@ -3603,7 +3485,7 @@ export async function compileC(opts) {
                 runtimeCompilerInvocation = runtimeInvocation;
                 programCompilerInvocation = programInvocation ?? runtimeInvocation;
                 if (compileMetadataKey !== null) {
-                    compileMetadataStamp = await publishNativeMetadataStamp(root, compileMetadataKey, {
+                    compileMetadataStamp = await publishNativeMetadataStamp(persistentCache.root, compileMetadataKey, {
                         runtimeInvocation: runtimeCompilerInvocation,
                         programInvocation: programCompilerInvocation,
                     }, [
@@ -3613,23 +3495,20 @@ export async function compileC(opts) {
                 }
             }
         }
-        catch {
+        catch (error) {
             // Preserve the uncached build for wrappers that compile successfully but
             // cannot provide a dry-run trace for the real build flavor.
-            root = null;
-        }
-    }
-    if (root === null) {
-        // The exact historical command line, byte for byte.
-        try {
-            await materializeVendorPrerequisites();
-            await runClang(buildArgs((p) => p));
-        }
-        finally {
-            if (transientVendorRoot !== null) {
-                await rm(transientVendorRoot, { recursive: true, force: true }).catch(() => undefined);
+            if (cacheWarmOnly) {
+                throw new Error("native cache warming could not validate the compiler invocation", {
+                    cause: error,
+                });
             }
+            persistentCache = null;
         }
+    }
+    if (persistentCache === null) {
+        // The direct uncached command is the source-of-truth executable recipe.
+        await runUncachedBuild();
         return;
     }
     let cv;
@@ -3637,17 +3516,21 @@ export async function compileC(opts) {
     let cBytes;
     try {
         [cv, fingerprint, cBytes] = await (payloadMetadata ?? Promise.all([
-            ccVersionOnce(driver.argv, toolchainEnv, true),
+            ccVersion(driver.argv, toolchainEnv, true),
             runtimeFingerprint(rtDir),
             readFile(opts.cPath),
         ]));
     }
-    catch {
+    catch (error) {
         // A version/fingerprint probe is an optimization boundary. If the compiler
         // itself can still compile, preserve the pre-cache behavior instead of
         // surfacing a metadata command's failure as the build result.
-        await materializeVendorPrerequisites();
-        await runClang(buildArgs((p) => p));
+        if (cacheWarmOnly) {
+            throw new Error("native cache warming could not validate cache inputs", {
+                cause: error,
+            });
+        }
+        await runUncachedBuild();
         return;
     }
     // Caller-supplied native inputs can all hide mutable dependencies: `-l`
@@ -3655,7 +3538,8 @@ export async function compileC(opts) {
     // script can retain identical top-level bytes as its referenced files are
     // rebuilt. Keep the safe runtime-object cache, but force a fresh final link
     // whenever the caller supplies either form.
-    let cacheCompleteArtifact = cachePolicy.completeArtifacts &&
+    let cacheCompleteArtifact = !cacheWarmOnly &&
+        cachePolicy.completeArtifacts &&
         (opts.linkInputs?.length ?? 0) === 0 &&
         (opts.systemLibraries?.length ?? 0) === 0;
     let programDependencies = null;
@@ -3669,8 +3553,9 @@ export async function compileC(opts) {
         ...(tlsCa && targetPlatform(driver) === "win32" ? ["-lcrypt32"] : []),
         ...(curlFetch && driver.target === null ? ["-lcurl"] : []),
         ...(dynamic && !driver.linkArgs.includes("-lm") ? ["-lm"] : []),
-        ...(((opts.zlib ?? false) || nativeFetch) && driver.target === null ? ["-lz"] : []),
+        ...(((opts.zlib ?? false) || nativeFetch) && !isZigDriver(driver) ? ["-lz"] : []),
         ...driver.linkArgs,
+        ...executableSectionFlags.link,
     ];
     // Both the wrapper dry run and dependency trace need the real build's
     // compile/link flag shape: wrappers commonly inject flags or native inputs
@@ -3685,12 +3570,12 @@ export async function compileC(opts) {
         ...(curlStubDir !== null ? [`-L${curlStubDir}`] : []),
         ...(curlFetch && driver.target === null ? ["-lcurl"] : []),
         ...(dynamic && !driver.linkArgs.includes("-lm") ? ["-lm"] : []),
-        ...(dynamic && targetPlatform(driver) === "darwin" ? ["-Wl,-dead_strip"] : []),
         ...(dynamic && targetPlatform(driver) === "win32"
             ? ["-Wl,--stack,8388608"]
             : []),
-        ...(((opts.zlib ?? false) || nativeFetch) && driver.target === null ? ["-lz"] : []),
+        ...(((opts.zlib ?? false) || nativeFetch) && !isZigDriver(driver) ? ["-lz"] : []),
         ...driver.linkArgs,
+        ...executableSectionFlags.link,
     ];
     // A complete hit is checked before cross-target curl's generated import stub
     // is materialized. Its -L spelling still joins the dry-run identity, while
@@ -3702,7 +3587,7 @@ export async function compileC(opts) {
     let preBuildDependencies = null;
     let localArtifactDependencyPaths = null;
     let linkMetadataStamp = null;
-    const linkMetadataKey = root === null || process.env["SCRIPTC_TEST_TRUST_COMPILER_WRAPPER"] === "1"
+    const linkMetadataKey = process.env["SCRIPTC_TEST_TRUST_COMPILER_WRAPPER"] === "1"
         ? null
         : nativeMetadataKey("link", [
             cacheTargetIdentity(driver),
@@ -3714,6 +3599,7 @@ export async function compileC(opts) {
             linkProbeArgs,
             effectiveLinkInvocationArgs,
             linkTraceInvocationArgs,
+            ...(programShardMergeIdentity === null ? [] : [programShardMergeIdentity]),
         ]);
     if (cacheCompleteArtifact) {
         try {
@@ -3722,7 +3608,7 @@ export async function compileC(opts) {
             // cache hits and ordinary edit/build misses without changing either key.
             linkMetadataStamp = linkMetadataKey === null
                 ? null
-                : await readNativeMetadataStamp(root, linkMetadataKey);
+                : await readNativeMetadataStamp(persistentCache.root, linkMetadataKey);
             if (linkMetadataStamp !== null) {
                 implicitLinker = linkMetadataStamp.values["implicitLinker"] ?? null;
                 if (implicitLinker === null)
@@ -3735,7 +3621,7 @@ export async function compileC(opts) {
                     : Promise.resolve(implicitLinker),
             ]);
             if (linkMetadataStamp === null && linkMetadataKey !== null) {
-                linkMetadataStamp = await publishNativeMetadataStamp(root, linkMetadataKey, { implicitLinker }, fingerprintDependencyPaths(implicitLinker), [implicitLinker]);
+                linkMetadataStamp = await publishNativeMetadataStamp(persistentCache.root, linkMetadataKey, { implicitLinker }, fingerprintDependencyPaths(implicitLinker), [implicitLinker]);
             }
             preBuildDependencies = await snapshotLocalArtifactDependencies([
                 ...(await runtimeFingerprintInputPaths(rtDir)),
@@ -3745,6 +3631,9 @@ export async function compileC(opts) {
                 ...(linkMetadataStamp?.dependencies.map((dependency) => dependency.path) ??
                     fingerprintDependencyPaths(implicitLinker)),
                 ...fingerprintDependencyPaths(programDependencies),
+                ...(programShardMergeIdentity === null
+                    ? []
+                    : fingerprintDependencyPaths(programShardMergeIdentity)),
             ]);
             // Every content-bearing fingerprint was computed before this metadata
             // snapshot. Re-read those exact files now so the snapshot cannot certify
@@ -3755,11 +3644,12 @@ export async function compileC(opts) {
                 programCompilerInvocation,
                 implicitLinker,
                 programDependencies,
+                ...(programShardMergeIdentity === null ? [] : [programShardMergeIdentity]),
             ])) ||
                 await runtimeFingerprint(rtDir).catch(() => null) !== fingerprint ||
                 !(await Promise.all([toolchainMetadataStamp, compileMetadataStamp, linkMetadataStamp]
                     .filter((stamp) => stamp !== null)
-                    .map((stamp) => localArtifactDependenciesStillMatch(stamp.dependencies)))).every(Boolean)) {
+                    .map((stamp) => nativeArtifactDependenciesStillMatch(stamp.dependencies)))).every(Boolean)) {
                 throw new CacheInputsChangedError();
             }
             if (localArtifact !== null) {
@@ -3784,7 +3674,26 @@ export async function compileC(opts) {
             localArtifactDependencyPaths = null;
         }
     }
-    const binDir = join(root, "bin");
+    // Warm-only builds deliberately do not need linker/header identity for a
+    // complete executable, but they still need a stable runtime-object key.
+    // The ordinary complete-artifact path computes these values above.
+    if (cacheWarmOnly && preBuildDependencies === null) {
+        try {
+            const [dependencies, invocation] = await Promise.all([
+                translationUnitDependencyFingerprint(driver, cflags, opts.cPath, cBytes, toolchainEnv),
+                effectiveCompilerInvocationFingerprint(driver, toolchainEnv, cflags),
+            ]);
+            programDependencies = dependencies;
+            if (runtimeCompilerInvocation === null)
+                runtimeCompilerInvocation = invocation;
+        }
+        catch (error) {
+            throw new Error("native cache warming could not validate runtime-object inputs", {
+                cause: error,
+            });
+        }
+    }
+    const binDir = join(persistentCache.root, "bin");
     let keyHex = null;
     let cachedBin = null;
     if (cacheCompleteArtifact) {
@@ -3795,9 +3704,10 @@ export async function compileC(opts) {
         // the fingerprint and the pin.
         const identityArgs = buildArgs((p) => p).map((a) => a === opts.cPath ? "<program.c>" : a === opts.outPath ? "<out>" : a);
         const key = createHash("sha256")
-            // v9 adds effective compiler-wrapper invocations for the real runtime,
-            // program, and link flavors.
-            .update("bin-v9\0")
+            // Sharded dev builds need the v10 identity below. Canonical single-TU
+            // builds retain v9 so adding the opt-in mode does not evict release
+            // binaries compiled by an earlier scriptc.
+            .update(programShards === null ? "bin-v9\0" : "bin-v10\0")
             .update(cacheTargetIdentity(driver)).update("\0")
             .update(toolchainEnv).update("\0")
             .update(implicitToolchain).update("\0")
@@ -3805,7 +3715,7 @@ export async function compileC(opts) {
             .update(programCompilerInvocation).update("\0")
             .update(implicitLinker).update("\0")
             .update(programDependencies).update("\0")
-            .update(opts.cacheIdentity).update("\0")
+            .update(persistentCache.identity).update("\0")
             // Preserve both the spelling clang sees (__FILE__) and the location used
             // to resolve relative includes. The top-level bytes are not sufficient.
             .update(opts.cPath).update("\0")
@@ -3819,6 +3729,9 @@ export async function compileC(opts) {
             .update(fingerprint).update("\0")
             .update(identityArgs.join("\x1f")).update("\0")
             .update(cBytes);
+        if (programShards !== null) {
+            updateProgramShardCacheIdentity(key, programShards, programPublicSymbols, programShardMergeIdentity ?? undefined);
+        }
         keyHex = key.digest("hex");
         cachedBin = join(binDir, keyHex);
         const tmpOut = privateSiblingPath(opts.outPath, "bin-hit");
@@ -3835,7 +3748,10 @@ export async function compileC(opts) {
             await chmod(tmpOut, 0o777 & ~process.umask());
             await rename(tmpOut, opts.outPath);
             if (localArtifact !== null && localArtifactDependencyPaths !== null) {
-                await publishLocalArtifactStamp(localArtifact.stampPath, opts.outPath, localArtifact.key, localArtifactDependencyPaths, [dirname(resolve(opts.cPath))], [root]).catch(() => undefined);
+                const stamp = await publishLocalArtifactStamp(localArtifact.stampPath, opts.outPath, localArtifact.key, localArtifactDependencyPaths, [dirname(resolve(opts.cPath))], [persistentCache.root]).catch(() => null);
+                if (stamp !== null) {
+                    await opts.onArtifactReady?.({ dependencies: stamp.dependencies }).catch(() => undefined);
+                }
             }
             return; // hit: the program/runtime payload compile and link were skipped
         }
@@ -3844,7 +3760,6 @@ export async function compileC(opts) {
             /* miss — build below, then publish */
         }
     }
-    await materializeVendorPrerequisites();
     // Miss: link the program's own TU against cached per-flavor runtime objects.
     // Collect the runtime sources this build actually compiles (the same
     // conditionals as the command line, by construction).
@@ -3855,12 +3770,13 @@ export async function compileC(opts) {
     });
     const buildDir = await mkdtemp(join(tmpdir(), "scriptc-cache-build-"));
     try {
+        await materializeVendorPrerequisites(join(buildDir, "vendor-inputs"));
         // Freeze the exact bytes used for the key. Generated TUs live at stable
         // paths under .scriptc/, so two builds can otherwise overwrite that path
         // between hashing and clang and publish one invocation's code under the
         // other's key. The prefix map preserves the original __FILE__/debug-file
         // spelling while clang reads this invocation-private snapshot.
-        const programPath = join(buildDir, `program${opts.cPath.endsWith(".ll") ? ".ll" : ".c"}`);
+        const programPath = join(buildDir, `program${programSourceExtension}`);
         // Preserve the caller-visible basename while keeping Darwin builds on a
         // private inode: ld uses this spelling as the embedded ad-hoc signing
         // identifier. Other targets retain the basename-independent cache key.
@@ -3875,7 +3791,7 @@ export async function compileC(opts) {
         let strictObjectVerification = null;
         const objectImplicitToolchainStillMatches = () => {
             if (preBuildDependencies !== null) {
-                return localArtifactDependenciesStillMatch(preBuildDependencies);
+                return nativeArtifactDependenciesStillMatch(preBuildDependencies);
             }
             // Complete-artifact caching can be disabled by caller-owned native
             // inputs while the safe runtime-object tier remains active. Preserve its
@@ -3890,15 +3806,116 @@ export async function compileC(opts) {
             return strictObjectVerification;
         };
         try {
-            const cached = await ensureRuntimeObjects(root, driver.argv, cflags, rtInputs, `obj-v5\0${cacheTargetIdentity(driver)}\0${toolchainEnv}\0${implicitToolchain}\0${runtimeCompilerInvocation}\0${ccName}\0${cv}\0${fingerprint}\0`, async () => await objectImplicitToolchainStillMatches());
+            const cached = await ensureRuntimeObjects(persistentCache.root, driver.argv, cflags, rtInputs, `obj-v5\0${cacheTargetIdentity(driver)}\0${toolchainEnv}\0${implicitToolchain}\0${runtimeCompilerInvocation}\0${ccName}\0${cv}\0${fingerprint}\0`, async () => await objectImplicitToolchainStillMatches(), cacheWarmPaths);
             objects = await stageRuntimeObjects(cached, join(buildDir, "runtime-objects"));
         }
         catch (err) {
             if (err instanceof CacheInputsChangedError)
                 cacheInputsStable = false;
+            if (cacheWarmOnly) {
+                throw new Error("native cache warming could not persist runtime objects", {
+                    cause: err,
+                });
+            }
             objects = null; // cache trouble is never a build failure
         }
-        await runClang(buildArgs((p) => objects?.get(p) ?? p, { programPath, outPath: privateOut, compilerVisibleSource: opts.cPath }));
+        const compileShardedProgram = async () => {
+            if (programShards === null || programPublicSymbols === undefined ||
+                programCompilerInvocation === null || implicitCompileToolchain === null)
+                return null;
+            try {
+                const programDependencyHash = programDependencies ??
+                    await translationUnitDependencyFingerprint(driver, cflags, opts.cPath, cBytes, toolchainEnv);
+                const stem = basename(opts.cPath, ".ll");
+                const entries = programShards.map((shard, index) => {
+                    const sourcePath = join(buildDir, shard.name);
+                    const staged = join(buildDir, `${stem}.program-${index.toString().padStart(3, "0")}.o`);
+                    const key = createHash("sha256")
+                        .update("exe-program-shard-v1\0")
+                        .update(cacheTargetIdentity(driver)).update("\0")
+                        .update(toolchainEnv).update("\0")
+                        .update(implicitCompileToolchain).update("\0")
+                        .update(programCompilerInvocation).update("\0")
+                        .update(persistentCache.identity).update("\0")
+                        .update(driver.argv.join("\x1f")).update("\0")
+                        .update(cv).update("\0")
+                        .update(fingerprint).update("\0")
+                        .update(programDependencyHash).update("\0")
+                        .update(programCompilerArgs.join("\x1f")).update("\0")
+                        .update(opts.cPath).update("\0")
+                        .update(resolve(opts.cPath)).update("\0")
+                        .update(shard.name).update("\0")
+                        .update(shard.source)
+                        .digest("hex");
+                    return {
+                        ...shard,
+                        sourcePath,
+                        staged,
+                        cachePath: join(persistentCache.root, "program-shard", key),
+                        missed: false,
+                    };
+                });
+                const shardWidth = Math.min(8, availableParallelism());
+                for (let i = 0; i < entries.length; i += shardWidth) {
+                    await Promise.all(entries.slice(i, i + shardWidth).map(async (entry) => {
+                        await writeFile(entry.sourcePath, entry.source);
+                        if (await copyValidCachedFile(entry.cachePath, entry.staged))
+                            return;
+                        entry.missed = true;
+                        await runClang([
+                            ...programCompilerArgs,
+                            `-ffile-prefix-map=${entry.sourcePath}=${opts.cPath}`,
+                            "-c",
+                            entry.sourcePath,
+                            "-o",
+                            entry.staged,
+                        ]);
+                    }));
+                }
+                const arArgv = isZigDriver(driver) ? [driver.argv[0], "ar"] : ["ar"];
+                const merged = await localizeLibraryObjects(driver, arArgv, buildDir, entries.map((entry) => entry.staged), [], programPublicSymbols, `${stem}.program`);
+                const publishable = entries.filter((entry) => entry.missed);
+                if (publishable.length > 0) {
+                    try {
+                        const [currentRuntime, currentFingerprints, currentInvocation, currentDependencies, currentCompiler, currentMerge] = await Promise.all([
+                            runtimeFingerprint(rtDir),
+                            implicitToolchainFingerprints(driver, toolchainEnv),
+                            effectiveCompilerInvocationFingerprint(driver, toolchainEnv, programCompilerArgs, ".ll"),
+                            translationUnitDependencyFingerprint(driver, cflags, opts.cPath, cBytes, toolchainEnv),
+                            ccVersion(driver.argv, toolchainEnv, true),
+                            resolveProgramShardMergeIdentity(driver),
+                        ]);
+                        if (currentRuntime === fingerprint &&
+                            currentFingerprints.compile === implicitCompileToolchain &&
+                            currentInvocation === programCompilerInvocation &&
+                            currentDependencies === programDependencyHash &&
+                            currentCompiler === cv &&
+                            currentMerge === programShardMergeIdentity) {
+                            await Promise.all(publishable.map((entry) => publishCachedFile(entry.staged, entry.cachePath)));
+                        }
+                    }
+                    catch {
+                        // The merged object is valid for this invocation; publication is
+                        // only an optimization for later edits.
+                    }
+                }
+                return merged;
+            }
+            catch {
+                // Sharding is an optimization. Compile/link the canonical TU below if
+                // a target tool, one shard, or relocatable merge is unavailable.
+                return null;
+            }
+        };
+        const shardedProgramObject = await compileShardedProgram();
+        if (programShards !== null && shardedProgramObject === null) {
+            // The canonical TU fallback is valid output, but it must not populate a
+            // cache key describing a successful shard projection/merge.
+            cacheInputsStable = false;
+        }
+        await runClang(buildArgs((p) => objects?.get(p) ?? p, shardedProgramObject === null
+            ? { programPath, outPath: privateOut, compilerVisibleSource: opts.cPath }
+            : { programPath: shardedProgramObject, outPath: privateOut }));
         await installArtifact(privateOut, opts.outPath);
         if (cachedBin !== null && keyHex !== null) {
             // Metadata comparison catches ordinary changes cheaply, but cannot by
@@ -3906,26 +3923,30 @@ export async function compileC(opts) {
             // the key. Recompute every content-bearing identity after the final link
             // so a header/SDK/compiler change in either pre-build gap cannot publish
             // new output under an old key.
-            const [currentRuntime, currentImplicit, currentRuntimeInvocation, currentProgramInvocation, currentProgramDependencies, currentLinker, currentCompiler] = await Promise.all([
+            const [currentRuntime, currentImplicit, currentRuntimeInvocation, currentProgramInvocation, currentProgramDependencies, currentLinker, currentCompiler, currentProgramShardMerge] = await Promise.all([
                 runtimeFingerprint(rtDir).catch(() => null),
                 implicitToolchainFingerprint(driver, toolchainEnv).catch(() => null),
                 effectiveCompilerInvocationFingerprint(driver, toolchainEnv, cflags).catch(() => null),
                 effectiveCompilerInvocationFingerprint(driver, toolchainEnv, programCompilerArgs, programSourceExtension).catch(() => null),
                 translationUnitDependencyFingerprint(driver, cflags, opts.cPath, cBytes, toolchainEnv).catch(() => null),
                 implicitLinkerFingerprint(driver, toolchainEnv, linkProbeArgs, effectiveLinkInvocationArgs, linkTraceInvocationArgs).catch(() => null),
-                ccVersionOnce(driver.argv, toolchainEnv, true).catch(() => null),
+                ccVersion(driver.argv, toolchainEnv, true).catch(() => null),
+                programShards === null
+                    ? Promise.resolve(null)
+                    : resolveProgramShardMergeIdentity(driver).catch(() => null),
             ]);
             cacheInputsStable =
                 cacheInputsStable &&
                     preBuildDependencies !== null &&
-                    await localArtifactDependenciesStillMatch(preBuildDependencies) &&
+                    await nativeArtifactDependenciesStillMatch(preBuildDependencies) &&
                     currentRuntime === fingerprint &&
                     currentImplicit === implicitToolchain &&
                     currentRuntimeInvocation === runtimeCompilerInvocation &&
                     currentProgramInvocation === programCompilerInvocation &&
                     currentProgramDependencies === programDependencies &&
                     currentLinker === implicitLinker &&
-                    currentCompiler === cv;
+                    currentCompiler === cv &&
+                    currentProgramShardMerge === programShardMergeIdentity;
         }
         if (cachedBin !== null && keyHex !== null && cacheInputsStable) {
             try {
@@ -3942,7 +3963,10 @@ export async function compileC(opts) {
             localArtifactDependencyPaths !== null &&
             cacheCompleteArtifact &&
             cacheInputsStable) {
-            await publishLocalArtifactStamp(localArtifact.stampPath, opts.outPath, localArtifact.key, localArtifactDependencyPaths, [dirname(resolve(opts.cPath))], [root]).catch(() => undefined);
+            const stamp = await publishLocalArtifactStamp(localArtifact.stampPath, opts.outPath, localArtifact.key, localArtifactDependencyPaths, [dirname(resolve(opts.cPath))], [persistentCache.root]).catch(() => null);
+            if (stamp !== null) {
+                await opts.onArtifactReady?.({ dependencies: stamp.dependencies }).catch(() => undefined);
+            }
         }
     }
     finally {
@@ -3950,6 +3974,80 @@ export async function compileC(opts) {
     }
     // Runtime-object population is itself a cache write, including on builds
     // whose native link inputs disable complete-artifact publication.
-    await pruneCache(root).catch(() => undefined);
+    await pruneCache(persistentCache.root, cacheWarmPaths).catch(() => undefined);
+}
+export async function compileC(opts) {
+    clearCcCaches();
+    await compileCInternal(opts, false);
+}
+export function supportedNativeCacheWarmProfiles(driver) {
+    if (isMobileTarget(driver.target) || targetPlatform(driver) === "wasi")
+        return [];
+    return ["runtime", "tls", "dynamic"];
+}
+/** Populate expensive native prerequisites against the current compiler,
+ * target, SDK, and environment. The resulting entries use the exact same
+ * identities and validators as ordinary builds; this merely pays their cost
+ * before a developer's first program asks for them. Synthetic link products
+ * are discarded and never enter the complete-executable cache. */
+export async function warmNativeCaches(options = {}) {
+    clearCcCaches();
+    const cacheRoot = cacheRootDir();
+    if (cacheRoot === null) {
+        throw new Error("the native build cache is disabled (unset SCRIPTC_NO_CACHE and use a non-empty SCRIPTC_CACHE_DIR)");
+    }
+    await ensurePrivateCacheRoot(cacheRoot, process.env["SCRIPTC_CACHE_DIR"] === undefined);
+    const known = new Set(["runtime", "tls", "dynamic"]);
+    for (const profile of options.profiles ?? []) {
+        if (!known.has(profile))
+            throw new Error(`unknown native cache warm profile '${profile}'`);
+    }
+    if (options.profiles?.length === 0)
+        return { cacheRoot, profiles: [] };
+    const mobileTarget = mobileLibraryTarget();
+    if (mobileTarget !== null) {
+        throw new Error(`native cache warming targets executable builds and is unsupported for SCRIPTC_TARGET=${mobileTarget}`);
+    }
+    const driver = resolveCc();
+    const supported = supportedNativeCacheWarmProfiles(driver);
+    if (supported.length === 0) {
+        throw new Error(`native cache warming targets persistently cached native executables and is unsupported for SCRIPTC_TARGET=${driver.target}`);
+    }
+    const profiles = [...new Set(options.profiles ?? supported)];
+    for (const profile of profiles) {
+        if (!supported.includes(profile)) {
+            throw new Error(`native cache warm profile '${profile}' is unsupported for SCRIPTC_TARGET=${driver.target}`);
+        }
+    }
+    const workDir = await mkdtemp(join(tmpdir(), "scriptc-cache-warm-"));
+    const cPath = join(workDir, "warm.c");
+    await writeFile(cPath, "int main(void) { return 0; }\n");
+    const protectedPaths = new Set();
+    try {
+        const results = await Promise.all(profiles.map(async (profile) => {
+            const started = performance.now();
+            await compileCInternal({
+                cPath,
+                outPath: join(workDir, process.platform === "win32" ? `${profile}.exe` : profile),
+                cacheIdentity: "scriptc-native-cache-warm-v1",
+                optimization: options.optimization ?? "release",
+                sanitize: options.sanitize ?? false,
+                ...(profile === "tls" ? { fetch: true } : {}),
+                ...(profile === "dynamic" ? { dynamic: true } : {}),
+            }, true, protectedPaths);
+            return {
+                profile,
+                elapsedMs: Math.round((performance.now() - started) * 10) / 10,
+            };
+        }));
+        await pruneCache(cacheRoot).catch(() => undefined);
+        if (!(await Promise.all([...protectedPaths].map(fileExists))).every(Boolean)) {
+            throw new Error(`SCRIPTC_CACHE_MAX_MB is too small to retain the requested native cache warm profiles (${profiles.join(", ")})`);
+        }
+        return { cacheRoot, profiles: results };
+    }
+    finally {
+        await rm(workDir, { recursive: true, force: true }).catch(() => undefined);
+    }
 }
-//# sourceMappingURL=cc.js.map
+//# sourceMappingURL=native-toolchain.js.map