@scriptc/runtime 0.0.16 → 0.0.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/runtime",
-  "version": "0.0.16",
+  "version": "0.0.18",
   "description": "scriptc native runtime — C sources, compiled into every scriptc binary",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",

package/src/scr_async.c

@@ -106,7 +106,7 @@ struct ScrPromise {
   size_t ncbs, cbs_cap;
   /* Unhandled-rejection tracking: set when rejected, cleared on await. */
   bool rejection_observed;
-  /* Set when the loop-end report delivered THIS promise to
+  /* Set when the checkpoint report delivered THIS promise to
    * 'unhandledRejection' listeners — a handler attached after that is
    * Node's 'rejectionHandled' moment (scr_prom_observe below). */
   bool reported_unhandled;
@@ -193,7 +193,7 @@ ScrPromise *scr_promise_new(void) {
 
 /* The 'rejectionHandled' hook (scr_async_dyn.c installs it at listener
  * registration — the scr_urj_deliver_fn pattern, so listener-free
- * binaries keep their size class): called when a promise the loop-end
+ * binaries keep their size class): called when a promise the checkpoint
  * report already delivered as unhandled gains a handler. */
 void (*scr_rjh_notify_fn)(ScrPromise *p) = NULL;
 
@@ -212,12 +212,15 @@ static void scr_prom_observe(ScrPromise *p) {
 }
 
 /* The attach-time handled mark (scr_async_dyn.c's dyn then/catch with a
- * rejection handler): Node marks a rejection handled at ATTACH, not when
- * the reaction runs — and the loop-exhaustion window (a .catch inside an
- * 'unhandledRejection' listener) has no later fiber turn whose await
- * could observe it. */
+ * rejection handler, plus the module loader's ownership of every module
+ * evaluation promise): Node marks a promise handled at ATTACH, including
+ * while it is still pending, not when a later reaction runs. The pending
+ * mark is essential for a module dependency whose importer aborts while
+ * evaluating a later sibling — the loader still owns that dependency's
+ * eventual rejection, so it must never surface as an unrelated unhandled
+ * rejection. */
 void scr_promise_mark_handled(ScrPromise *p) {
-  if (p->state == SCR_PROM_REJECTED) scr_prom_observe(p);
+  scr_prom_observe(p);
 }
 
 ScrPromise *scr_promise_retain(ScrPromise *p) {
@@ -1229,24 +1232,31 @@ static void scr_await_yield(void) {
  * turn — the same hop a settled promise takes. */
 void scr_await_hop(void) { scr_await_yield(); }
 
-/* Await result extraction. Rejection re-throws into the awaiter (payload
- * RETAINED, not moved — a promise can be awaited more than once). */
+/* Copies a rejection into the active execution context's exception cell.
+ * The payload is RETAINED, not moved — a promise can be awaited more than
+ * once, and the executable's top-level completion probe consumes the same
+ * settlement from the main stack after the loop drains. */
+static void scr_promise_rethrow(ScrPromise *p) {
+  switch (p->payload_kind) {
+  case SCR_EXC_F64: scr_throw_f64(p->f64); break;
+  case SCR_EXC_BOOL: scr_throw_bool(p->b); break;
+  case SCR_EXC_STR: scr_throw_str(scr_str_retain((ScrStr *)p->payload)); break;
+  case SCR_EXC_REF: scr_throw_ref(p->retain_fn(p->payload), p->retain_fn, p->release_fn, p->trace_fn); break;
+  case SCR_EXC_OBJ: scr_throw_obj(p->retain_fn(p->payload), p->retain_fn, p->release_fn, p->trace_fn); break;
+  case SCR_EXC_NONE:
+  case SCR_EXC_GENRET: /* unreachable: the sentinel never settles a promise */
+    scr_throw_str(scr_str_new("undefined", 9));
+    break;
+  }
+}
+
+/* Await result extraction. Rejection re-throws into the awaiter. */
 static bool scr_await_settled(ScrPromise *p) {
   if (p->state != SCR_PROM_PENDING) scr_await_yield();
   while (p->state == SCR_PROM_PENDING) scr_await_park(p);
   scr_prom_observe(p);
   if (p->state == SCR_PROM_REJECTED) {
-    switch (p->payload_kind) {
-    case SCR_EXC_F64: scr_throw_f64(p->f64); break;
-    case SCR_EXC_BOOL: scr_throw_bool(p->b); break;
-    case SCR_EXC_STR: scr_throw_str(scr_str_retain((ScrStr *)p->payload)); break;
-    case SCR_EXC_REF: scr_throw_ref(p->retain_fn(p->payload), p->retain_fn, p->release_fn, p->trace_fn); break;
-    case SCR_EXC_OBJ: scr_throw_obj(p->retain_fn(p->payload), p->retain_fn, p->release_fn, p->trace_fn); break;
-    case SCR_EXC_NONE:
-    case SCR_EXC_GENRET: /* unreachable: the sentinel never settles a promise */
-      scr_throw_str(scr_str_new("undefined", 9));
-      break;
-    }
+    scr_promise_rethrow(p);
     return false;
   }
   return true;
@@ -1263,6 +1273,32 @@ void *scr_await_ref(ScrPromise *p) {
 }
 void scr_await_void(ScrPromise *p) { scr_await_settled(p); }
 
+/* ECMAScript's INTERNAL module-dependency wait. Unlike a user-authored
+ * await, an already-completed dependency does not introduce a promise-job
+ * hop: the evaluator continues synchronously into the importer. A pending
+ * dependency still parks this module fiber, and rejection propagates into
+ * it exactly like an ordinary await. */
+void scr_module_await(ScrPromise *p) {
+  while (p->state == SCR_PROM_PENDING) scr_await_park(p);
+  scr_prom_observe(p);
+  if (p->state == SCR_PROM_REJECTED) scr_promise_rethrow(p);
+}
+
+int scr_promise_finish_top_level(ScrPromise *p) {
+  if (p->state == SCR_PROM_PENDING) {
+    /* ECMAScript module evaluation is still pending, but Node's ref'd
+     * event-loop work is exhausted. Node exits with its dedicated
+     * unsettled-top-level-await status. */
+    scr_exit_code_note(13);
+    return 13;
+  }
+  scr_prom_observe(p);
+  return p->state == SCR_PROM_REJECTED ? 1 : 0;
+}
+
+void scr_promise_rethrow_top_level(ScrPromise *p) {
+  if (p->state == SCR_PROM_REJECTED) scr_promise_rethrow(p);
+}
 
 
 
@@ -1704,7 +1740,7 @@ void scr_loop_set_stream(bool (*pending)(void), void (*dispatch)(void)) {
  * microtask checkpoints between macrotasks). */
 bool scr_loop_has_ready(void) { return scr_ready_len > 0; }
 
-void scr_loop_run(void) {
+bool scr_loop_run(ScrPromise *top_level) {
   /* The FIRST checkpoint after the synchronous main body runs promise
    * jobs BEFORE the first tick drain: Node's main-module evaluation is
    * itself awaited (the runMain continuation is a microtask queued after
@@ -1712,7 +1748,9 @@ void scr_loop_run(void) {
    * scheduled during the body exactly once, at startup — differentially
    * pinned. Every later checkpoint drains ticks first. */
   bool first_checkpoint = true;
+  bool rejection_failed = false;
   for (;;) {
+    if (top_level != NULL && top_level->state == SCR_PROM_REJECTED) break;
     /* process.nextTick callbacks BEFORE promise jobs (Node's checkpoint
      * order): the tick queue to exhaustion, then the microtask queue to
      * exhaustion, and back while either has work — a microtask's
@@ -1733,7 +1771,7 @@ void scr_loop_run(void) {
         } else {
           raw(); /* one stream tick, FIFO with the user ticks around it */
         }
-        if (scr_exc_pending()) return;
+        if (scr_exc_pending()) return false;
       }
     }
     /* Microtasks to exhaustion (Node: promise jobs before timers). */
@@ -1743,7 +1781,26 @@ void scr_loop_run(void) {
       scr_resume_fiber(f);
     }
     first_checkpoint = false;
+    /* The ESM loader observes a rejected entry evaluation at a promise-job
+     * checkpoint and terminates before later ref'd timers or I/O can run.
+     * Wait until this checkpoint's ready queue is drained — the root's
+     * rejection handler is itself promise-job ordered — then leave through
+     * the normal teardown below. A fulfilled root deliberately does not
+     * stop the loop. */
+    if (top_level != NULL && top_level->state == SCR_PROM_REJECTED) break;
     if (scr_nt_head != NULL) continue;
+    /* Node decides unhandled rejections at the END of each complete
+     * nextTick/microtask checkpoint, before advancing to timers or I/O.
+     * A rejected executable module root wins over OTHER rejections from
+     * this same checkpoint (the root check above); rejections from an
+     * earlier checkpoint have already delivered here. Handled listeners
+     * may enqueue more jobs or ref'd work, so return to the checkpoint
+     * head instead of declaring the loop exhausted underneath them. */
+    if (scr_report_unhandled_rejections()) {
+      rejection_failed = true;
+      break;
+    }
+    if (scr_ready_len > 0 || scr_nt_head != NULL || scr_nunhandled > 0) continue;
     /* Quiescent between turns (microtasks drained, nothing running):
      * collect any cycles the turn left behind. No-op on an empty buffer. */
     scr_collect_cycles();
@@ -1754,7 +1811,7 @@ void scr_loop_run(void) {
      * so those drain first. */
     if (scr_stream_dispatch_fn != NULL) {
       scr_stream_dispatch_fn();
-      if (scr_exc_pending()) return; /* uncaught throw in a listener */
+      if (scr_exc_pending()) return false; /* uncaught throw in a listener */
       if (scr_ready_len > 0) continue;
       if (scr_stream_pending_fn != NULL && scr_stream_pending_fn()) continue;
     }
@@ -1765,7 +1822,7 @@ void scr_loop_run(void) {
      * microtasks — restart the turn so those drain first. */
     if (scr_events_dispatch_fn != NULL) {
       scr_events_dispatch_fn();
-      if (scr_exc_pending()) return; /* uncaught throw in a listener */
+      if (scr_exc_pending()) return false; /* uncaught throw in a listener */
       if (scr_ready_len > 0) continue;
     }
     /* Net dispatch (scr_net.c, when linked): accepts, arrived data,
@@ -1774,7 +1831,7 @@ void scr_loop_run(void) {
      * microtasks — restart the turn so those drain first. */
     if (scr_net_dispatch_fn != NULL) {
       scr_net_dispatch_fn();
-      if (scr_exc_pending()) return; /* uncaught throw in a listener */
+      if (scr_exc_pending()) return false; /* uncaught throw in a listener */
       if (scr_ready_len > 0) continue;
     }
     /* Dgram dispatch (scr_dgram.c, when linked): arrived datagrams and
@@ -1782,7 +1839,7 @@ void scr_loop_run(void) {
      * dns.lookup callbacks) fire now — the net hook's exact station. */
     if (scr_dgram_dispatch_fn != NULL) {
       scr_dgram_dispatch_fn();
-      if (scr_exc_pending()) return; /* uncaught throw in a listener */
+      if (scr_exc_pending()) return false; /* uncaught throw in a listener */
       if (scr_ready_len > 0) continue;
     }
     /* Watch dispatch (scr_watch.c, when linked): file events queued on
@@ -1790,7 +1847,7 @@ void scr_loop_run(void) {
      * net hook's exact station. */
     if (scr_watch_dispatch_fn != NULL) {
       scr_watch_dispatch_fn();
-      if (scr_exc_pending()) return; /* uncaught throw in a listener */
+      if (scr_exc_pending()) return false; /* uncaught throw in a listener */
       if (scr_ready_len > 0) continue;
     }
     /* Reap spawned children and fire their listeners (before timers,
@@ -1817,7 +1874,7 @@ void scr_loop_run(void) {
           (scr_watch_pending_fn != NULL && scr_watch_pending_fn());
       if (held) {
         scr_children_poll();
-        if (scr_exc_pending()) return; /* uncaught throw in a listener */
+        if (scr_exc_pending()) return false; /* uncaught throw in a listener */
         if (scr_ready_len > 0) continue;
       }
     }
@@ -2018,7 +2075,7 @@ void scr_loop_run(void) {
         scr_closure_release(t.cb);
       }
       scr_firing_id = 0;
-      if (scr_exc_pending()) return; /* uncaught throw in a callback: main handles it */
+      if (scr_exc_pending()) return false; /* uncaught throw in a callback: main handles it */
       if (scr_ready_len > 0) break; /* drain microtasks before more timers */
     }
     /* The check phase: immediates queued BEFORE this phase started run
@@ -2042,12 +2099,13 @@ void scr_loop_run(void) {
         }
         ((void (*)(ScrClosure *))cb->fn)(cb);
         scr_closure_release(cb);
-        if (scr_exc_pending()) return; /* uncaught throw: main handles it */
+        if (scr_exc_pending()) return false; /* uncaught throw: main handles it */
         while (scr_ready_len > 0) {
           ScrFiber *f = scr_ready[scr_ready_head++];
           scr_ready_len--;
           scr_resume_fiber(f);
         }
+        if (top_level != NULL && top_level->state == SCR_PROM_REJECTED) break;
       }
       /* Fully drained: reset the cursor so the array reuses its slots. */
       if (scr_immediates_head == scr_nimmediates) {
@@ -2056,12 +2114,11 @@ void scr_loop_run(void) {
       }
     }
   }
-  /* Normal exit can now leave UNREF'd timers armed in the heap (the loop
-   * stopped keeping itself alive for them, Node's unref semantics) — they
-   * never fire, so release their closures here or the RC audit counts them
-   * as leaks. Timers left on the uncaught/unhandled paths (the loop
-   * `return`s above, skipping this) are covered by the abandoned-fiber
-   * audit skip. */
+  /* Exit can now leave UNREF'd timers armed in the heap (ordinary
+   * exhaustion, a fatal module root, or an unhandled rejection). They
+   * never fire, so release their closures here or the RC audit counts
+   * them as leaks. Uncaught callback throws still return above for main
+   * to report through the existing exceptional teardown path. */
   scr_timers_teardown();
   /* Same story for unref'd children the loop never reaped: release the
    * registry's references (their listeners never fire — the process is
@@ -2069,6 +2126,7 @@ void scr_loop_run(void) {
   scr_children_teardown();
   scr_fibers_abandoned = scr_fibers_live;
   scr_note_abandoned_fibers(scr_fibers_abandoned);
+  return rejection_failed;
 }
 
 /* The island's half of the unhandled-rejection report (scr_island.c
@@ -2077,21 +2135,18 @@ void scr_loop_run(void) {
  * first-unhandled-rejection death. Returns whether the island had any.
  * Static builds never set it. */
 static bool (*scr_island_rejections_fn)(bool print) = NULL;
+static int (*scr_island_jobs_drain_fn)(void) = NULL;
 
-void scr_loop_set_island_rejections(bool (*fn)(bool print)) {
+void scr_loop_set_island_rejections(bool (*fn)(bool print),
+                                    int (*drain_jobs)(void)) {
   scr_island_rejections_fn = fn;
+  scr_island_jobs_drain_fn = drain_jobs;
 }
 
 /* ── process.on('unhandledRejection') ─────────────────────────────────
- * dyn listeners called per never-observed rejection instead of the
- * default report below. Node fires the event at end-of-turn; the
- * compiled runtime fires at loop exhaustion, where the ledger is
- * decided — the same values, later (SEMANTICS.md; mustCall-style
- * assertions and reason identity observe no difference, cross-turn
- * interleaving would). A registered listener suppresses the report and
- * the exit-1, exactly Node's handled-event contract. */
-
-
+ * Dyn listeners are called per never-observed rejection at the completed
+ * nextTick/microtask checkpoint. A registered listener suppresses the
+ * default report and exit 1, exactly Node's handled-event contract. */
 
 /* The unhandled-rejection LISTENER hook (scr_async_dyn.c installs it at
  * registration — the loop-hook pattern, so listener-free binaries keep
@@ -2099,11 +2154,25 @@ void scr_loop_set_island_rejections(bool (*fn)(bool print)) {
  * listener threw (the uncaught crash path). */
 bool (*scr_urj_deliver_fn)(ScrPromise *p) = NULL;
 
-/* Unhandled rejections at loop end: Node prints an error and exits 1. */
+/* Unhandled rejections at a completed nextTick/microtask checkpoint:
+ * Node prints an error and exits 1 when no listener handles the event.
+ * Snapshot the ledger: a listener can reject another promise, but that
+ * new rejection belongs to the NEXT checkpoint rather than this report. */
 bool scr_report_unhandled_rejections(void) {
+  /* Static fibers drain before engine jobs in this runtime's documented
+   * island ordering. Complete BOTH halves of that microtask checkpoint
+   * before deciding either rejection ledger; engine reactions can attach
+   * a handler to a rejection that would otherwise look unhandled here.
+   * A host callback can wake a static fiber/tick, in which case the loop
+   * must drain that work before reporting too. */
+  if (scr_island_jobs_drain_fn != NULL) {
+    scr_island_jobs_drain_fn();
+    if (scr_ready_len > 0 || scr_nt_head != NULL) return false;
+  }
   bool any = false;
   bool crashed = false;
-  for (size_t i = 0; i < scr_nunhandled; i++) {
+  size_t report_count = scr_nunhandled;
+  for (size_t i = 0; i < report_count; i++) {
     ScrPromise *p = scr_maybe_unhandled[i];
     if (p->state == SCR_PROM_REJECTED && !p->rejection_observed && !crashed) {
       if (scr_urj_deliver_fn != NULL) {
@@ -2145,7 +2214,12 @@ bool scr_report_unhandled_rejections(void) {
     }
     scr_promise_release(p);
   }
-  scr_nunhandled = 0;
+  size_t remaining = scr_nunhandled - report_count;
+  if (remaining > 0) {
+    memmove(scr_maybe_unhandled, scr_maybe_unhandled + report_count,
+            remaining * sizeof *scr_maybe_unhandled);
+  }
+  scr_nunhandled = remaining;
   if (crashed) {
     scr_exc_print_uncaught();
     scr_exit_code_note(1);
@@ -2155,20 +2229,22 @@ bool scr_report_unhandled_rejections(void) {
     bool island = scr_island_rejections_fn(!any);
     any = any || island;
   }
-  /* An 'unhandledRejection' listener can spawn fibers the exhausted loop
-   * will never run (a .catch attach mints a reaction fiber): they are
-   * abandoned by construction — re-note them so the RC audit's skip
-   * covers their parked state, exactly the loop-teardown accounting. */
-  if (scr_fibers_live > scr_fibers_abandoned) {
-    scr_fibers_abandoned = scr_fibers_live;
-    scr_note_abandoned_fibers(scr_fibers_abandoned);
-  }
   /* main returns 1 on a reported rejection — the 'exit' listeners (atexit)
    * must see that code, like Node's. */
   if (any) scr_exit_code_note(1);
   return any;
 }
 
+/* A fatal executable-module rejection suppresses unrelated rejections
+ * created in the SAME checkpoint. Drop their retained ledger references
+ * without delivering process events or a competing default report. */
+void scr_discard_unhandled_rejections(void) {
+  for (size_t i = 0; i < scr_nunhandled; i++) {
+    scr_promise_release(scr_maybe_unhandled[i]);
+  }
+  scr_nunhandled = 0;
+}
+
 /* ── new Promise(executor) ────────────────────────────────────────────── */
 
 /* resolve closures: caps[0] is a box whose slot holds the promise (+1). */

package/src/scr_async_dyn.c

@@ -403,7 +403,7 @@ ScrDyn *scr_dyn_promise_then(ScrPromise *src, ScrDyn *onf, ScrDyn *onr, ScrDyn *
   /* A rejection HANDLER marks the source handled at attach (Node's
    * moment; the reaction fiber's await re-marks harmlessly) — this is
    * also what lets a .catch inside an 'unhandledRejection' listener fire
-   * 'rejectionHandled' when no fiber turn remains. */
+   * 'rejectionHandled' immediately at the attach point. */
   if (onr != NULL) scr_promise_mark_handled(src);
   ScrDynThenPack *a = malloc(sizeof *a);
   if (!a) scr_ad_oom();
@@ -720,4 +720,3 @@ ScrDyn *scr_dyn_new_promise_adapting(ScrPromise *src,
 ScrPromise *scr_dyn_promise_of(const ScrDyn *d) {
   return d->kind == SCR_DYN_PROMISE ? d->v.promise : NULL;
 }
-

package/src/scr_bytes.c

@@ -1503,4 +1503,3 @@ double scr_bytes_write_var(ScrBytes *b, double value, double offset, double byte
   }
   return offset + (double)width;
 }
-

package/src/scr_copying.c

@@ -0,0 +1,157 @@
+#include "scr_runtime.h"
+
+#include <math.h>
+#include <stdio.h>
+#include <stdint.h>
+
+/* ES2023 Array/TypedArray copying methods and the typed-array-to-number[]
+ * bridge live in their own archive member. Programs that do not use this
+ * surface therefore pull in none of it — the static binary size contract. */
+
+static uint64_t copying_slot_from_ptr(void *p) {
+  return (uint64_t)(uintptr_t)p;
+}
+
+static void *copying_slot_to_ptr(uint64_t slot) {
+  return (void *)(uintptr_t)slot;
+}
+
+static bool copying_elem_is_ref(ScrElemKind kind) {
+  return kind == SCR_ELEM_STR || kind == SCR_ELEM_ARR ||
+         kind == SCR_ELEM_BYTES || kind == SCR_ELEM_REF;
+}
+
+static ScrArr *copying_arr_new_like(const ScrArr *a, size_t cap) {
+  return a->elem == SCR_ELEM_REF
+             ? scr_arr_new_ref(a->elem_retain, a->elem_release,
+                               a->elem_trace, cap ? cap : 1)
+             : scr_arr_new(a->elem, cap ? cap : 1);
+}
+
+static uint64_t copying_arr_retain_slot(const ScrArr *a, uint64_t slot) {
+  if (!copying_elem_is_ref(a->elem)) return slot;
+  void *p = copying_slot_to_ptr(slot);
+  if (a->elem == SCR_ELEM_STR) p = scr_str_retain((ScrStr *)p);
+  else if (a->elem == SCR_ELEM_ARR) p = scr_arr_retain((ScrArr *)p);
+  else if (a->elem == SCR_ELEM_BYTES) p = scr_bytes_retain((ScrBytes *)p);
+  else p = a->elem_retain(p);
+  return copying_slot_from_ptr(p);
+}
+
+static void copying_arr_copy_slot(ScrArr *out, const ScrArr *src, size_t i) {
+  out->data[out->len++] = copying_arr_retain_slot(src, src->data[i]);
+}
+
+ScrArr *scr_arr_to_reversed(const ScrArr *a) {
+  ScrArr *out = copying_arr_new_like(a, a->len);
+  for (size_t i = a->len; i > 0; i--) {
+    copying_arr_copy_slot(out, a, i - 1);
+  }
+  return out;
+}
+
+ScrArr *scr_arr_to_spliced(const ScrArr *a, double start,
+                           double delete_count, const ScrArr *items) {
+  double len = (double)a->len;
+  double s0 = isnan(start) ? 0 : trunc(start);
+  if (s0 < 0) s0 += len;
+  size_t from = s0 <= 0 ? 0 : s0 >= len ? a->len : (size_t)s0;
+  double avail = len - (double)from;
+  double d0 = isnan(delete_count) ? 0 : trunc(delete_count);
+  size_t ndelete =
+      d0 <= 0 ? 0 : d0 >= avail ? (size_t)avail : (size_t)d0;
+  if (items->len > SIZE_MAX - (a->len - ndelete)) {
+    scr_trap("scriptc: out of memory\n");
+  }
+  size_t out_len = a->len - ndelete + items->len;
+  ScrArr *out = copying_arr_new_like(a, out_len);
+  for (size_t i = 0; i < from; i++) copying_arr_copy_slot(out, a, i);
+  for (size_t i = 0; i < items->len; i++) {
+    out->data[out->len++] =
+        copying_arr_retain_slot(a, items->data[i]);
+  }
+  for (size_t i = from + ndelete; i < a->len; i++) {
+    copying_arr_copy_slot(out, a, i);
+  }
+  return out;
+}
+
+static bool copying_arr_with_index(const ScrArr *a, double index,
+                                   size_t *out) {
+  double rel = isnan(index) ? 0 : trunc(index);
+  double actual = rel >= 0 ? rel : (double)a->len + rel;
+  if (!(actual >= 0) || actual >= (double)a->len) {
+    char num[32];
+    size_t numlen = scr_f64_to_str(index, num);
+    char msg[80];
+    int mlen = snprintf(msg, sizeof msg, "Invalid index : %.*s",
+                        (int)numlen, num);
+    scr_throw_error_msg(SCR_ERR_RANGE, msg, (size_t)mlen);
+    return false;
+  }
+  *out = (size_t)actual;
+  return true;
+}
+
+ScrArr *scr_arr_with_f64(ScrArr *a, double index, double value) {
+  size_t i;
+  if (!copying_arr_with_index(a, index, &i)) return NULL;
+  ScrArr *out = scr_arr_slice(a, 0, INFINITY);
+  scr_arr_set_f64(out, (double)i, value);
+  return out;
+}
+
+ScrArr *scr_arr_with_bool(ScrArr *a, double index, bool value) {
+  size_t i;
+  if (!copying_arr_with_index(a, index, &i)) return NULL;
+  ScrArr *out = scr_arr_slice(a, 0, INFINITY);
+  scr_arr_set_bool(out, (double)i, value);
+  return out;
+}
+
+ScrArr *scr_arr_with_ref(ScrArr *a, double index, void *value) {
+  size_t i;
+  if (!copying_arr_with_index(a, index, &i)) return NULL;
+  ScrArr *out = scr_arr_slice(a, 0, INFINITY);
+  uint64_t retained =
+      copying_arr_retain_slot(a, copying_slot_from_ptr(value));
+  scr_arr_set_ref(out, (double)i, copying_slot_to_ptr(retained));
+  return out;
+}
+
+ScrBytes *scr_bytes_to_reversed(const ScrBytes *b) {
+  ScrBytes *out = scr_bytes_new(b->elem, (double)b->len);
+  for (size_t i = 0; i < b->len; i++) {
+    scr_bytes_set(out, (double)i,
+                  scr_bytes_get(b, (double)(b->len - i - 1)));
+  }
+  return out;
+}
+
+ScrBytes *scr_bytes_with(const ScrBytes *b, double index, double value) {
+  double rel = isnan(index) ? 0 : trunc(index);
+  double actual = rel >= 0 ? rel : (double)b->len + rel;
+  if (!(actual >= 0) || actual >= (double)b->len) {
+    static const char msg[] = "Invalid typed array index";
+    scr_throw_error_msg(SCR_ERR_RANGE, msg, sizeof msg - 1);
+    return NULL;
+  }
+  ScrBytes *out = scr_bytes_copy(b);
+  scr_bytes_set(out, actual, value);
+  return out;
+}
+
+ScrArr *scr_bytes_to_arr(const ScrBytes *b) {
+  ScrArr *out = scr_arr_new(SCR_ELEM_F64, b->len ? b->len : 1);
+  for (size_t i = 0; i < b->len; i++) {
+    scr_arr_push_f64(out, scr_bytes_get(b, (double)i));
+  }
+  return out;
+}
+
+ScrStr *scr_bytes_join(const ScrBytes *b, const ScrStr *separator) {
+  ScrArr *values = scr_bytes_to_arr(b);
+  ScrStr *out = scr_arr_join(values, (ScrStr *)separator);
+  scr_arr_release(values);
+  return out;
+}

package/src/scr_island.c

@@ -267,14 +267,14 @@ void scr_island_set_netmod(void (*attach)(void *jsctx, void *host_obj), void (*t
  * false when a promise rejects with no reaction attached (tracked here,
  * promise and reason retained), is_handled == true when a handler is
  * attached to it later (the rescission: unlinked and freed — a
- * handled-later rejection never reports). At loop exit the ledger joins
- * scr_report_unhandled_rejections through the hook registered at boot:
- * the FIRST never-observed rejection prints in the static runtime's exact
- * voice ("Unhandled promise rejection: <String(reason)>", stderr, exit 1
- * — an Error reason renders "name: message" through its toString, same
- * as the static ledger). Retaining the promise value keeps its identity
- * stable for the rescission (the engine cannot recycle the object while
- * the ledger holds it). */
+ * handled-later rejection never reports). At the completed microtask
+ * checkpoint the ledger joins scr_report_unhandled_rejections through
+ * the hook registered at boot: the FIRST never-observed rejection prints
+ * in the static runtime's exact voice ("Unhandled promise rejection:
+ * <String(reason)>", stderr, exit 1 — an Error reason renders "name:
+ * message" through its toString, same as the static ledger). Retaining
+ * the promise value keeps its identity stable for the rescission (the
+ * engine cannot recycle the object while the ledger holds it). */
 typedef struct IslRejection {
   JSValue promise; /* owned; identity for the rescission */
   JSValue reason;  /* owned */
@@ -555,10 +555,13 @@ static void isl_init(void) {
    * progress exactly where Node runs its microtasks. */
   scr_loop_set_io(isl_io_pending, isl_io_poll);
   /* Unhandled island rejections: tracked as they happen (and rescinded
-   * when handled later), reported at loop exit through the SAME report the
-   * static promise ledger uses — one voice, exit 1, like Node. */
+   * when handled later), reported at the same completed microtask
+   * checkpoint as the static promise ledger — one voice, exit 1, like
+   * Node. The report hook drains engine jobs first so a same-checkpoint
+   * handler attachment gets its chance to rescind. */
   JS_SetHostPromiseRejectionTracker(isl_rt, isl_rejection_tracker, NULL);
-  scr_loop_set_island_rejections(isl_report_rejections);
+  scr_loop_set_island_rejections(isl_report_rejections,
+                                 scr_island_drain_jobs);
   /* Armed island timers (AbortSignal.timeout) cap the loop's idle sleep
    * so they fire on time while the poller waits on socket readiness —
    * without keeping the loop alive by themselves (Node's unref'd timer).
@@ -2743,8 +2746,10 @@ static JSValue isl_host_exit(JSContext *ctx, JSValueConst this_val, int argc,
  * mirrored here by the shim's setter, read by the emitted main after the
  * loop drains — Node's a-program-that-sets-it-and-returns contract. */
 static int isl_exit_code = 0;
+static size_t isl_exit_code_version = 0;
 
 int scr_island_exit_code(void) { return isl_exit_code; }
+size_t scr_island_exit_code_version(void) { return isl_exit_code_version; }
 
 static JSValue isl_host_set_exit_code(JSContext *ctx, JSValueConst this_val,
                                       int argc, JSValueConst *argv) {
@@ -2753,6 +2758,7 @@ static JSValue isl_host_set_exit_code(JSContext *ctx, JSValueConst this_val,
   int32_t code = 0;
   JS_ToInt32(ctx, &code, argv[0]);
   isl_exit_code = code;
+  isl_exit_code_version++;
   return JS_UNDEFINED;
 }
 

package/src/scr_lib.c

@@ -3503,6 +3503,170 @@ ScrStr *scr_num_to_fixed0(double x) {
   return r;
 }
 
+/* The explicit-fraction-digits toFixed needs the exact binary value, not
+ * the shortest decimal that round-trips to it: (1.005).toFixed(2) is
+ * "1.00", for example. Represent abs(x) * 10^f as
+ *
+ *     mantissa * 5^f * 2^(binary_exponent + f)
+ *
+ * in a tiny base-2^32 integer, then shift right with the spec's
+ * round-half-up rule. The largest value handled here is below 1e21 with
+ * f=100, so the rounded integer is below 1e121 (402 bits); sixteen limbs
+ * leave comfortable headroom without heap allocation. */
+#define SCR_FIXED_LIMBS 16
+typedef struct {
+  uint32_t limb[SCR_FIXED_LIMBS]; /* little-endian */
+  int len;
+} ScrFixedInt;
+
+static void scr_fixed_normalize(ScrFixedInt *v) {
+  while (v->len > 1 && v->limb[v->len - 1] == 0) v->len--;
+}
+
+static void scr_fixed_mul5(ScrFixedInt *v) {
+  uint64_t carry = 0;
+  for (int i = 0; i < v->len; i++) {
+    uint64_t p = (uint64_t)v->limb[i] * 5 + carry;
+    v->limb[i] = (uint32_t)p;
+    carry = p >> 32;
+  }
+  if (carry != 0) v->limb[v->len++] = (uint32_t)carry;
+}
+
+static bool scr_fixed_bit(const ScrFixedInt *v, int bit) {
+  int word = bit / 32;
+  return word < v->len && ((v->limb[word] >> (bit % 32)) & 1u) != 0;
+}
+
+static void scr_fixed_shr(ScrFixedInt *v, int bits) {
+  int words = bits / 32;
+  int rem = bits % 32;
+  if (words >= v->len) {
+    v->limb[0] = 0;
+    v->len = 1;
+    return;
+  }
+  int n = v->len - words;
+  for (int i = 0; i < n; i++) {
+    uint32_t lo = v->limb[i + words] >> rem;
+    uint32_t hi =
+        rem != 0 && i + words + 1 < v->len
+            ? v->limb[i + words + 1] << (32 - rem)
+            : 0;
+    v->limb[i] = lo | hi;
+  }
+  v->len = n;
+  scr_fixed_normalize(v);
+}
+
+static void scr_fixed_shl(ScrFixedInt *v, int bits) {
+  uint32_t out[SCR_FIXED_LIMBS] = {0};
+  int words = bits / 32;
+  int rem = bits % 32;
+  for (int i = 0; i < v->len; i++) {
+    int at = i + words;
+    out[at] |= v->limb[i] << rem;
+    if (rem != 0) out[at + 1] |= v->limb[i] >> (32 - rem);
+  }
+  int n = v->len + words + (rem != 0 ? 1 : 0);
+  memcpy(v->limb, out, sizeof out);
+  v->len = n;
+  scr_fixed_normalize(v);
+}
+
+static void scr_fixed_inc(ScrFixedInt *v) {
+  uint64_t carry = 1;
+  for (int i = 0; i < v->len && carry != 0; i++) {
+    uint64_t s = (uint64_t)v->limb[i] + carry;
+    v->limb[i] = (uint32_t)s;
+    carry = s >> 32;
+  }
+  if (carry != 0) v->limb[v->len++] = (uint32_t)carry;
+}
+
+/* Divide in place by 1e9; each quotient limb still fits uint32_t because
+ * the carried remainder is below the divisor. Returns the remainder. */
+static uint32_t scr_fixed_div1e9(ScrFixedInt *v) {
+  uint64_t rem = 0;
+  for (int i = v->len - 1; i >= 0; i--) {
+    uint64_t cur = (rem << 32) | v->limb[i];
+    v->limb[i] = (uint32_t)(cur / 1000000000u);
+    rem = cur % 1000000000u;
+  }
+  scr_fixed_normalize(v);
+  return (uint32_t)rem;
+}
+
+/* Number.prototype.toFixed(fractionDigits), with the argument already
+ * number-typed by the frontend. ToIntegerOrInfinity validation precedes
+ * the receiver's non-finite arm, as ECMA-262 requires. Invalid precision
+ * raises V8's catchable RangeError text; otherwise the result is +1. */
+ScrStr *scr_num_to_fixed(double x, double fraction_digits) {
+  double fd = isnan(fraction_digits) ? 0 : trunc(fraction_digits);
+  if (!(fd >= 0 && fd <= 100)) {
+    static const char msg[] =
+        "toFixed() digits argument must be between 0 and 100";
+    scr_throw_error_msg(SCR_ERR_RANGE, msg, sizeof msg - 1);
+    return NULL;
+  }
+  int f = (int)fd;
+  if (!isfinite(x) || fabs(x) >= 1e21) return scr_f64_to_scrstr(x);
+
+  bool neg = x < 0; /* false for -0, exactly like the spec's sign arm */
+  double a = neg ? -x : x;
+  uint64_t bits;
+  memcpy(&bits, &a, sizeof bits);
+  uint64_t mantissa = bits & ((1ull << 52) - 1);
+  int ieee_exp = (int)((bits >> 52) & 0x7ffu);
+  int binary_exp;
+  if (ieee_exp == 0) {
+    binary_exp = -1074;
+  } else {
+    mantissa |= 1ull << 52;
+    binary_exp = ieee_exp - 1023 - 52;
+  }
+
+  ScrFixedInt n = {{(uint32_t)mantissa, (uint32_t)(mantissa >> 32)}, 2};
+  scr_fixed_normalize(&n);
+  for (int i = 0; i < f; i++) scr_fixed_mul5(&n);
+  int shift = binary_exp + f;
+  if (shift >= 0) {
+    scr_fixed_shl(&n, shift);
+  } else {
+    int right = -shift;
+    bool round_up = scr_fixed_bit(&n, right - 1);
+    scr_fixed_shr(&n, right);
+    if (round_up) scr_fixed_inc(&n);
+  }
+
+  /* Render the exact rounded integer through base-1e9 chunks, then place
+   * the decimal point f digits from the right (padding through zero). */
+  uint32_t chunks[SCR_FIXED_LIMBS];
+  int chunk_count = 0;
+  do {
+    chunks[chunk_count++] = scr_fixed_div1e9(&n);
+  } while (!(n.len == 1 && n.limb[0] == 0));
+
+  char digits[128];
+  int dlen = snprintf(digits, sizeof digits, "%u", chunks[chunk_count - 1]);
+  for (int i = chunk_count - 2; i >= 0; i--) {
+    dlen += snprintf(digits + dlen, sizeof digits - (size_t)dlen,
+                     "%09u", chunks[i]);
+  }
+
+  char out[128];
+  int o = 0;
+  if (neg) out[o++] = '-';
+  int padded = dlen > f + 1 ? dlen : f + 1;
+  int integer_digits = padded - f;
+  int leading_zeros = padded - dlen;
+  for (int i = 0; i < padded; i++) {
+    if (f != 0 && i == integer_digits) out[o++] = '.';
+    out[o++] = i < leading_zeros ? '0' : digits[i - leading_zeros];
+  }
+  return scr_str_new(out, (size_t)o);
+}
+
 /* Increment a decimal digit string in place. Returns true on overflow —
  * the value becomes 1 followed by len zeros (the caller folds the zeros
  * into its scale); an EMPTY string increments to "1" the same way (the

package/src/scr_runtime.h

@@ -317,6 +317,10 @@ bool scr_str_eq(ScrStr *a, ScrStr *b);
  * <0, 0, >0. */
 int scr_str_cmp(ScrStr *a, ScrStr *b);
 
+/* ECMAScript string-list ordering: compare UTF-16 code units even though
+ * ScrStr stores well-formed UTF-8. Returns <0, 0, >0. */
+int scr_str_cmp_u16(ScrStr *a, ScrStr *b);
+
 /* ── class objects (classes as first-class values) ────────────────────
  * The class STATIC side as a runtime value: one emitted IMMORTAL static
  * per class the program takes as a value (`const X = C`, class
@@ -818,6 +822,16 @@ void scr_arr_set_ref(ScrArr *a, double i, void *v);
  * elements retain into the copy. Borrows a. */
 ScrArr *scr_arr_slice(ScrArr *a, double start, double end);
 
+/* ES2023 copying methods. All borrow their inputs and return fresh +1
+ * shallow copies. with() raises Node's catchable RangeError for an invalid
+ * relative index; the ref variant retains the borrowed replacement. */
+ScrArr *scr_arr_to_reversed(const ScrArr *a);
+ScrArr *scr_arr_to_spliced(const ScrArr *a, double start,
+                           double delete_count, const ScrArr *items);
+ScrArr *scr_arr_with_f64(ScrArr *a, double index, double value);
+ScrArr *scr_arr_with_bool(ScrArr *a, double index, bool value);
+ScrArr *scr_arr_with_ref(ScrArr *a, double index, void *value);
+
 /* push returns the new length (JS-exact); _ref takes ownership. */
 double scr_arr_push_f64(ScrArr *a, double v);
 double scr_arr_push_bool(ScrArr *a, bool v);
@@ -3338,6 +3352,18 @@ bool scr_await_bool(ScrPromise *p);
 ScrStr *scr_await_str(ScrPromise *p); /* +1 */
 void *scr_await_ref(ScrPromise *p);   /* +1 via the stored retain */
 void scr_await_void(ScrPromise *p);
+/* Internal ESM dependency wait: parks while pending but, unlike a
+ * JavaScript await expression, does not hop when already settled. */
+void scr_module_await(ScrPromise *p);
+/* After the root-aware event loop returns, inspect the executable's async
+ * module-root promise without another microtask hop: 0 = fulfilled,
+ * 1 = rejected, 13 = still pending with no ref'd work capable of settling
+ * it (Node's unsettled top-level-await exit status). A rejected root is
+ * marked observed here but re-thrown separately; earlier-checkpoint
+ * rejections were already decided by the loop and same-checkpoint
+ * competitors are suppressed by the executable-module verdict. */
+int scr_promise_finish_top_level(ScrPromise *p);
+void scr_promise_rethrow_top_level(ScrPromise *p);
 /* The checked-dynamic tree-crossing await (SCR_DYN_PROMISE's boundary contract): the
  * payload as a dyn value (+1; void fulfillments answer the undefined
  * value), or NULL with the rejection re-thrown into the awaiter. */
@@ -3388,23 +3414,19 @@ ScrDyn *scr_als_run(double id, ScrDyn *value, ScrDyn *fn, ScrDyn *args);
 ScrDyn *scr_als_exit_run(double id, ScrDyn *fn, ScrDyn *args);
 
 /* process.on/once('unhandledRejection', fn): dyn listeners dispatched
- * per never-observed rejection at loop end — (reason, promise),
- * suppressing the default report and the exit-1 (Node's handled-event
- * contract; the end-of-turn vs loop-end timing is a SEMANTICS.md
- * divergence). `once` auto-removes after one delivery; off removes by
- * closure identity (the warning registry's story). Throws Node's
+ * per never-observed rejection at the end of its nextTick/microtask
+ * checkpoint — (reason, promise), suppressing the default report and the
+ * exit-1. `once` auto-removes after one delivery; off removes by closure
+ * identity (the warning registry's story). Throws Node's
  * ERR_INVALID_ARG_TYPE on a non-function. */
 void scr_process_on_unhandled_rejection(ScrDyn *fn, bool once);
 void scr_process_off_unhandled_rejection(ScrDyn *fn);
-/* process.on/once/off('rejectionHandled', fn): the sibling registry.
- * Under the loop-exhaustion model the event's ONE firing window is a
- * handler attached DURING an unhandledRejection listener (a rejection
- * handled any earlier never enters the report at all — the same
- * documented divergence); dispatch is synchronous at the attach, with
- * the promise, Node's payload. */
+/* process.on/once/off('rejectionHandled', fn): the sibling registry. A
+ * promise handled after its unhandledRejection delivery fires once, with
+ * the promise as Node's payload. */
 void scr_process_on_rejection_handled(ScrDyn *fn, bool once);
 void scr_process_off_rejection_handled(ScrDyn *fn);
-/* The loop-end delivery hook the registration above installs
+/* The checkpoint delivery hook the registration above installs
  * (scr_async_dyn.c → scr_report_unhandled_rejections; NULL = default
  * report). Runtime-internal. */
 extern bool (*scr_urj_deliver_fn)(ScrPromise *p);
@@ -3414,9 +3436,10 @@ extern bool (*scr_urj_deliver_fn)(ScrPromise *p);
  * Runtime-internal. */
 extern void (*scr_rjh_notify_fn)(ScrPromise *p);
 /* The attach-time handled mark (a dyn then/catch carrying a rejection
- * handler): marks an already-rejected source observed — Node's attach
- * moment — firing the late-handled hook when the report already
- * delivered it. Runtime-internal. */
+ * handler, or the module loader taking ownership of an evaluation
+ * promise): marks pending and rejected sources observed at Node's attach
+ * moment, firing the late-handled hook when the report already delivered
+ * it. Runtime-internal. */
 void scr_promise_mark_handled(ScrPromise *p);
 /* A rejected promise's reason as a dyn value (identity-preserving for
  * dyn payloads and %Error instances). +1. */
@@ -3646,7 +3669,13 @@ int scr_exit_code_hint_get(void);
  * poll(2) sleep, or -1 when it can't wake for every pending child. */
 int scr_children_wake_fd(void);
 double scr_now_ms(void); /* the loop's monotonic clock, in ms */
-void scr_loop_run(void);
+/* Run to ordinary loop exhaustion, except that a non-NULL executable
+ * module-root promise stops the loop as soon as it is rejected at a
+ * microtask checkpoint. Fulfilled roots do not stop the loop: Node keeps
+ * running ref'd work scheduled by a successfully evaluated module.
+ * Returns true when a default/listener-crashing unhandled rejection
+ * already selected and reported exit status 1. */
+bool scr_loop_run(ScrPromise *top_level);
 /* External I/O hook, polled at loop quiescence like the child registry:
  * `pending` keeps the loop alive; `poll` makes progress and may SLEEP up
  * to max_wait_ms (on real fds — socket readiness wakes it early), so the
@@ -3655,12 +3684,14 @@ void scr_loop_run(void);
  * never set it. */
 void scr_loop_set_io(bool (*pending)(void), void (*poll)(double max_wait_ms));
 bool scr_report_unhandled_rejections(void); /* true = exit 1 */
+void scr_discard_unhandled_rejections(void);
 /* The island's unhandled-rejection ledger joins the report above (one
  * registrant, set at engine boot; static builds never set it): called with
  * print=true when the static ledger reported nothing, prints its FIRST
  * never-observed rejection in the same voice, frees the ledger either way,
  * and returns whether it had any. */
-void scr_loop_set_island_rejections(bool (*fn)(bool print));
+void scr_loop_set_island_rejections(bool (*fn)(bool print),
+                                    int (*drain_jobs)(void));
 /* The island's earliest armed timer deadline (scr_island_timers_deadline;
  * HUGE_VAL when none) joins the loop's sleep computation: an armed
  * AbortSignal.timeout must fire on time while the loop sleeps on socket
@@ -3874,8 +3905,10 @@ bool scr_zlib_inflate_exact(const unsigned char *src, size_t src_len,
 
 /* The island process shim's implicit exit status (process.exitCode):
  * Node's set-it-and-return-normally contract. The emitted main returns
- * this after the loop drains; 0 when never set. */
+ * this after the loop drains; 0 when never set. The version advances on
+ * every assignment so an exit listener can override a provisional status. */
 int scr_island_exit_code(void);
+size_t scr_island_exit_code_version(void);
 
 /* ── web-platform globals (scr_web.c) ─────────────────────────────────
  * The pure-JS prelude defining the island's WHATWG subset (streams et
@@ -4243,12 +4276,14 @@ bool scr_num_is_finite(double x);
 bool scr_num_is_nan(double x);
 bool scr_num_is_integer(double x);
 bool scr_num_is_safe_integer(double x);
-/* The fraction-digits-free Number.prototype formatters: toExponential()
- * (shortest correctly-rounded mantissa, "7e+0" exponent shape) and
- * toFixed() (closest integer, ties toward +∞ on the magnitude, "-0" for
- * negative fractions, ToString at |x| ≥ 1e21). +1 results; never throw. */
+/* Number.prototype formatters: toExponential() is the fraction-digits-free
+ * shortest correctly-rounded mantissa; toFixed0 is the non-throwing omitted
+ * argument form. toFixed implements an explicit 0..100 fractionDigits with
+ * exact binary-value rounding and THROWS V8's catchable RangeError outside
+ * that range. All successful results are +1. */
 ScrStr *scr_num_to_exponential(double x);
 ScrStr *scr_num_to_fixed0(double x);
+ScrStr *scr_num_to_fixed(double x, double fraction_digits);
 
 /* Object.is over two numbers — the spec's SameValue on doubles: NaN
  * equals NaN, +0 differs from -0, everything else is ==. Never throws. */
@@ -4439,6 +4474,17 @@ void scr_bytes_set(ScrBytes *b, double i, double v);
  * result is a fresh same-kind copy. Never throws. */
 ScrBytes *scr_bytes_slice(const ScrBytes *b, double start, double end); /* +1 */
 
+/* ES2023 typed-array copying methods. Both preserve the receiver's element
+ * kind and return a fresh +1 owner. with() raises Node's catchable
+ * "Invalid typed array index" RangeError for an invalid relative index. */
+ScrBytes *scr_bytes_to_reversed(const ScrBytes *b); /* +1 */
+ScrBytes *scr_bytes_with(const ScrBytes *b, double index, double value); /* +1 */
+
+/* Numeric typed-array iteration drained into number[], and Uint8Array.join.
+ * Inputs borrowed; results fresh +1. */
+ScrArr *scr_bytes_to_arr(const ScrBytes *b); /* +1 */
+ScrStr *scr_bytes_join(const ScrBytes *b, const ScrStr *separator); /* +1 */
+
 /* TypedArray.prototype.fill on non-u8 receivers: per-element fill with
  * the element write's coercion, slice-clamped relative indices; answers
  * the receiver +1 (chaining). Never throws. */

package/src/scr_string.c

@@ -198,6 +198,64 @@ int scr_str_cmp(ScrStr *a, ScrStr *b) {
   return a->len < b->len ? -1 : (a->len > b->len ? 1 : 0);
 }
 
+/* UTF-16 code-unit comparison over well-formed UTF-8 (the default
+ * Array.sort/toSorted and URLSearchParams.sort order). Byte order ALMOST
+ * matches — the exception is U+E000..U+FFFF (3-byte UTF-8, single high code
+ * units) vs supplementary code points (4-byte UTF-8, surrogate pairs
+ * 0xD800..0xDFFF): bytes put the 4-byte form last, code units put it first.
+ * Decode code points and compare their leading UTF-16 units. */
+static uint32_t scr_str_lead_u16(const unsigned char *s, size_t len,
+                                size_t *adv) {
+  unsigned char b = s[0];
+  uint32_t cp;
+  size_t n;
+  if (b < 0x80) {
+    cp = b; n = 1;
+  } else if ((b & 0xe0) == 0xc0) {
+    cp = b & 0x1fu; n = 2;
+  } else if ((b & 0xf0) == 0xe0) {
+    cp = b & 0x0fu; n = 3;
+  } else {
+    cp = b & 0x07u; n = 4;
+  }
+  if (n > len) n = len; /* defensive: strings are well-formed by contract */
+  for (size_t i = 1; i < n; i++) cp = (cp << 6) | (s[i] & 0x3fu);
+  *adv = n;
+  if (cp >= 0x10000) return 0xd800 + ((cp - 0x10000) >> 10);
+  return cp;
+}
+
+int scr_str_cmp_u16(ScrStr *a, ScrStr *b) {
+  size_t ia = 0, ib = 0;
+  while (ia < a->len && ib < b->len) {
+    size_t na, nb;
+    uint32_t ua = scr_str_lead_u16(
+        (const unsigned char *)a->data + ia, a->len - ia, &na);
+    uint32_t ub = scr_str_lead_u16(
+        (const unsigned char *)b->data + ib, b->len - ib, &nb);
+    if (ua != ub) return ua < ub ? -1 : 1;
+    /* Equal leading units: equal whole code points (both single units or
+     * both pairs with equal highs — lows only differ if cps differ). */
+    if (na == 4 && nb == 4) {
+      uint32_t cpa = 0, cpb = 0;
+      for (size_t i = 0; i < 4; i++) {
+        cpa = (cpa << 6) |
+              (i == 0 ? (unsigned char)a->data[ia] & 0x07u
+                      : (unsigned char)a->data[ia + i] & 0x3fu);
+        cpb = (cpb << 6) |
+              (i == 0 ? (unsigned char)b->data[ib] & 0x07u
+                      : (unsigned char)b->data[ib + i] & 0x3fu);
+      }
+      if (cpa != cpb) return cpa < cpb ? -1 : 1;
+    }
+    ia += na;
+    ib += nb;
+  }
+  if (ia < a->len) return 1;
+  if (ib < b->len) return -1;
+  return 0;
+}
+
 /* ── interned strings ─────────────────────────────────────────────────
  * The empty string and every single-character ASCII string are immortal
  * statics (same layout the emitter uses for literals): charAt/slice churn
@@ -1272,4 +1330,3 @@ ScrStr *scr_str_decode_uri_component(ScrStr *s) {
   }
   return out;
 }
-

package/src/scr_url_params.c

@@ -467,57 +467,6 @@ bool scr_sp_has_value(ScrSearchParams *sp, ScrStr *name, ScrStr *value) {
   return false;
 }
 
-/* UTF-16 code-unit comparison over well-formed UTF-8 (the spec's sort
- * order). Byte order ALMOST matches — the exception is U+E000..U+FFFF
- * (3-byte UTF-8, single high code units) vs supplementary code points
- * (4-byte UTF-8, surrogate pairs 0xD800..0xDFFF): bytes put the 4-byte
- * form last, code units put it first. Decode code points and compare
- * their leading UTF-16 units. */
-static uint32_t sp_lead_unit(const unsigned char *s, size_t len, size_t *adv) {
-  unsigned char b = s[0];
-  uint32_t cp;
-  size_t n;
-  if (b < 0x80) {
-    cp = b; n = 1;
-  } else if ((b & 0xe0) == 0xc0) {
-    cp = b & 0x1fu; n = 2;
-  } else if ((b & 0xf0) == 0xe0) {
-    cp = b & 0x0fu; n = 3;
-  } else {
-    cp = b & 0x07u; n = 4;
-  }
-  if (n > len) n = len; /* defensive: strings are well-formed by contract */
-  for (size_t i = 1; i < n; i++) cp = (cp << 6) | (s[i] & 0x3fu);
-  *adv = n;
-  if (cp >= 0x10000) return 0xd800 + ((cp - 0x10000) >> 10); /* high surrogate leads */
-  return cp;
-}
-
-static int sp_cmp_u16(const ScrStr *a, const ScrStr *b) {
-  size_t ia = 0, ib = 0;
-  while (ia < a->len && ib < b->len) {
-    size_t na, nb;
-    uint32_t ua = sp_lead_unit((const unsigned char *)a->data + ia, a->len - ia, &na);
-    uint32_t ub = sp_lead_unit((const unsigned char *)b->data + ib, b->len - ib, &nb);
-    if (ua != ub) return ua < ub ? -1 : 1;
-    /* Equal LEADING units: equal whole code points (both single units or
-     * both pairs with equal highs — lows only differ if cps differ). */
-    if (na == 4 && nb == 4) {
-      uint32_t cpa = 0, cpb = 0;
-      for (size_t i = 0; i < 4; i++) {
-        cpa = (cpa << 6) | ((i == 0 ? a->data[ia] & 0x07 : a->data[ia + i] & 0x3f));
-        cpb = (cpb << 6) | ((i == 0 ? b->data[ib] & 0x07 : b->data[ib + i] & 0x3f));
-      }
-      if (cpa != cpb) return cpa < cpb ? -1 : 1;
-    }
-    ia += na;
-    ib += nb;
-  }
-  if (ia < a->len) return 1;
-  if (ib < b->len) return -1;
-  return 0;
-}
-
 /* Stable insertion sort by name (lists are small; equal names keep their
  * relative order — the spec's stability requirement). */
 void scr_sp_sort(ScrSearchParams *sp) {
@@ -525,7 +474,7 @@ void scr_sp_sort(ScrSearchParams *sp) {
     ScrStr *n = sp->names[i];
     ScrStr *v = sp->vals[i];
     size_t j = i;
-    while (j > 0 && sp_cmp_u16(sp->names[j - 1], n) > 0) {
+    while (j > 0 && scr_str_cmp_u16(sp->names[j - 1], n) > 0) {
       sp->names[j] = sp->names[j - 1];
       sp->vals[j] = sp->vals[j - 1];
       j--;