@scriptc/runtime 0.0.35 → 0.0.36

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@scriptc/runtime",
-  "version": "0.0.35",
-  "description": "scriptc native runtime — C sources, compiled into every scriptc binary",
+  "version": "0.0.36",
+  "description": "scriptc native runtime sources and vendored dependencies",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
   "repository": {

package/src/scr_async.c

@@ -32,7 +32,7 @@
  * same thread, own stack); the idle sleep is nanosleep (mingw-w64 ships
  * it, over Sleep). poll(2) has no Windows arm — see the sleep seam in
  * scr_loop_run: the poller-backed units (net/dgram/watch) are not built
- * for win32 targets (cc.ts gates them), so their fds never appear; the
+ * for win32 targets (native-toolchain.ts gates them), so their fds never appear; the
  * events unit DOES cross-compile (scr_events.c's win32 arm) and is
  * served by a capped nanosleep — dispatch at the next turn's top, the
  * cap bounding signal/stdin latency instead of a pollable wake fd. */

package/src/scr_async_dyn.c

@@ -1,4 +1,4 @@
-/* Checked-dynamic ASYNC surfaces (gated — cc.ts links this TU only when
+/* Checked-dynamic ASYNC surfaces (gated — native-toolchain.ts links this TU only when
  * the IR carries the crossing libCalls or dyn dispatch: the scr_dc.c
  * size-class precedent). Everything here rides scr_async.c's public
  * machinery: the checked-dynamic tree-promise reaction helpers (.then/.catch/.finally

package/src/scr_console.c

@@ -71,6 +71,8 @@ static void scr_flush_at_exit(void) { fflush(stdout); }
 
 static void scr_collect_cycles_at_exit(void) { scr_collect_cycles(); }
 
+void scr_runtime_abi_v1(void) {}
+
 void scr_init(void) {
 #ifdef _WIN32
   /* The CRT opens std streams in TEXT mode, which writes \n as \r\n. Node

package/src/scr_dc.c

@@ -1,6 +1,6 @@
 /* node:diagnostics_channel — the in-process pub/sub core (scr_runtime.h
  * has the API contract). Linked only when the IR carries dc.* libCalls
- * (cc.ts; the zlib gating precedent), pure data structure over the checked-dynamic tree —
+ * (native-toolchain.ts; the zlib gating precedent), pure data structure over the checked-dynamic tree —
  * no loop hooks, no platform seams, cross-compiles everywhere.
  *
  * - The registry is process-global and append-only (Node's channels are

package/src/scr_dyn_handle.c

@@ -6,7 +6,7 @@
  * validators call them too), and the runtime-built listener adapter
  * closures whose fire thunks box event tuples back into the checked-dynamic tree. Split
  * out of scr_json.c so handle-free binaries keep their exact size
- * class: cc.ts compiles this unit exactly when a user of it links (the
+ * class: native-toolchain.ts compiles this unit exactly when a user of it links (the
  * net or emitter gate — http implies net).
  */
 #include "scr_runtime.h"

package/src/scr_dyn_invoke.c

@@ -2,7 +2,7 @@
  * and its companions: JS String() over the checked-dynamic tree (scr_dyn_display — join
  * and the error texts need it standalone) and Object.defineProperties
  * over dyn values (scr_dyn_define_props). Linked only when the IR
- * carries dynInvoke nodes or dyn.defineProps calls (cc.ts gates on
+ * carries dynInvoke nodes or dyn.defineProps calls (native-toolchain.ts gates on
  * moduleUsesDynInvoke — the scr_assert.c precedent), so dispatch-free
  * binaries keep their exact size class. The checked-dynamic tree itself lives in
  * scr_json.c; this unit uses only its public surface plus ScrJsonBuf.

package/src/scr_fetch.c

@@ -7195,7 +7195,7 @@ void scr_fetch_install(void) {
    * the loop alive nor dispatch. */
   scr_net_install();
   /* The island's node:http/https client bridge rides the same units and
-   * is always compiled beside the native fetch (cc.ts) — embedded graphs
+   * is always compiled beside the native fetch (native-toolchain.ts) — embedded graphs
    * that require node:http/https get working clients, not refusals. */
   scr_net_island_install();
   scr_island_set_fetch(fx_boot, NULL, NULL, fx_teardown);

package/src/scr_fetch_curl.c

@@ -2,7 +2,7 @@
  * REFERENCE implementation. The default fetch is scr_fetch.c (scriptc's
  * own net stack: scr_net + scr_tls + scr_http's client parser + zlib);
  * this file stays compilable for one release behind SCRIPTC_FETCH_CURL=1
- * (cc.ts selects exactly one of the two — same scr_fetch_install symbol,
+ * (native-toolchain.ts selects exactly one of the two — same scr_fetch_install symbol,
  * same island surface, same fixture contract) as the flip's reference,
  * the C-backend-vs-LLVM precedent. Compiled and linked ONLY into
  * --dynamic builds whose embedded npm graph references fetch (emit gates

package/src/scr_inspect_island.c

@@ -1,6 +1,6 @@
 /* util.inspect over island `any` values — the one translation unit that
  * references BOTH the inspect engine (scr_inspect.c) and the island
- * (scr_island.c), so cc.ts links it exactly when a --dynamic build's IR
+ * (scr_island.c), so native-toolchain.ts links it exactly when a --dynamic build's IR
  * carries insp.* libCalls (each half alone stays independent: static
  * inspect builds never pull engine symbols, inspect-free dynamic builds
  * never pull the renderer).

package/src/scr_lib.c

@@ -114,17 +114,39 @@ static SCR_TL ScrStr *scr_arch_str = NULL;      /* interned process.arch */
 static SCR_TL ScrStr *scr_versions_node_str = NULL; /* interned process.versions.node */
 static SCR_TL ScrStr *scr_versions_openssl_str = NULL; /* interned process.versions.openssl */
 
+/* Keep lazy process values out of the startup cleanup root.  The executable
+ * linker can discard an otherwise-unused getter, but an unconditional atexit
+ * callback that mentions every cache would still retain each cache cell (and
+ * its symbol) in a tiny hello-world.  Each getter below instead registers its
+ * own cleanup only when the value is first materialized.  That is equivalent
+ * at process exit and retains the RC-audit cleanup guarantee for the values a
+ * program actually observes. */
 static void scr_lib_cleanup(void) {
   scr_arr_release(scr_argv_arr);
   scr_argv_arr = NULL;
+}
+
+static void scr_process_platform_cleanup(void) {
   scr_str_release(scr_platform_str);
   scr_platform_str = NULL;
+}
+
+static void scr_process_exec_path_cleanup(void) {
   scr_str_release(scr_exec_path_str);
   scr_exec_path_str = NULL;
+}
+
+static void scr_process_arch_cleanup(void) {
   scr_str_release(scr_arch_str);
   scr_arch_str = NULL;
+}
+
+static void scr_process_versions_node_cleanup(void) {
   scr_str_release(scr_versions_node_str);
   scr_versions_node_str = NULL;
+}
+
+static void scr_process_versions_openssl_cleanup(void) {
   scr_str_release(scr_versions_openssl_str);
   scr_versions_openssl_str = NULL;
 }
@@ -165,7 +187,14 @@ void scr_lib_init(int argc, char **argv) {
  * atexit handlers); the interned process values above still intern lazily
  * on first read, so the library reset seam releases them here instead —
  * scr_library_reset (scr_library.c) calls this every session reset. */
-void scr_lib_session_cleanup(void) { scr_lib_cleanup(); }
+void scr_lib_session_cleanup(void) {
+  scr_lib_cleanup();
+  scr_process_platform_cleanup();
+  scr_process_exec_path_cleanup();
+  scr_process_arch_cleanup();
+  scr_process_versions_node_cleanup();
+  scr_process_versions_openssl_cleanup();
+}
 #endif
 
 /* Raw argv accessors for the island's process shim (scr_island.c): the
@@ -204,6 +233,9 @@ ScrStr *scr_process_platform(void) {
     scr_platform_str = scr_str_new("win32", 5);
 #else
     scr_platform_str = scr_str_new("unknown", 7);
+#endif
+#ifndef SCR_LIB
+    atexit(scr_process_platform_cleanup);
 #endif
   }
   return scr_str_retain(scr_platform_str);
@@ -223,6 +255,9 @@ ScrStr *scr_process_arch(void) {
     scr_arch_str = scr_str_new("x64", 3);
 #else
     scr_arch_str = scr_str_new("unknown", 7);
+#endif
+#ifndef SCR_LIB
+    atexit(scr_process_arch_cleanup);
 #endif
   }
   return scr_str_retain(scr_arch_str);
@@ -237,6 +272,9 @@ ScrStr *scr_process_versions_node(void) {
   if (!scr_versions_node_str) {
     scr_versions_node_str =
         scr_str_new(SCR_NODE_COMPAT_VERSION, sizeof(SCR_NODE_COMPAT_VERSION) - 1);
+#ifndef SCR_LIB
+    atexit(scr_process_versions_node_cleanup);
+#endif
   }
   return scr_str_retain(scr_versions_node_str);
 }
@@ -253,6 +291,9 @@ ScrStr *scr_process_versions_openssl(void) {
   if (!scr_versions_openssl_str) {
     scr_versions_openssl_str =
         scr_str_new(SCR_OPENSSL_COMPAT_VERSION, sizeof(SCR_OPENSSL_COMPAT_VERSION) - 1);
+#ifndef SCR_LIB
+    atexit(scr_process_versions_openssl_cleanup);
+#endif
   }
   return scr_str_retain(scr_versions_openssl_str);
 }
@@ -289,6 +330,9 @@ ScrStr *scr_process_exec_path(void) {
     const char *use = realpath(raw, resolved) != NULL ? resolved : raw;
 #endif
     scr_exec_path_str = scr_str_new(use, strlen(use));
+#ifndef SCR_LIB
+    atexit(scr_process_exec_path_cleanup);
+#endif
   }
   return scr_str_retain(scr_exec_path_str);
 }

package/src/scr_library.c

@@ -64,6 +64,10 @@ void scr_library_set_sink(ScrLibSinkFn fn, void *ctx) {
 
 static SCR_TL ScrLibCbFn scr_library_cb_fns[SCR_LIB_MAX_CALLBACKS];
 static SCR_TL void *scr_library_cb_ctxs[SCR_LIB_MAX_CALLBACKS];
+/* A typed host callback runs synchronously inside one ABI entry. Like the
+ * sink, slots, poison, arena, and current-entry symbol, this belongs to the
+ * localized / thread-instanced library copy rather than the process. */
+static SCR_TL size_t scr_library_callback_depth = 0;
 
 void scr_library_cb_set(size_t slot, ScrLibCbFn fn, void *ctx) {
   /* A pure store, the sink registration's rule: latest wins, NULL clears,
@@ -82,6 +86,15 @@ ScrLibCbFn scr_library_cb_require(size_t slot, const char *trap_msg) {
 
 void *scr_library_cb_ctx(size_t slot) { return scr_library_cb_ctxs[slot]; }
 
+void scr_library_callback_begin(void) { scr_library_callback_depth++; }
+
+void scr_library_callback_end(void) {
+  /* Generated calls pair this only with a normally returned host callback.
+   * A callback that illegally unwinds leaves the depth set, so a later ABI
+   * entry fails deterministically instead of silently reusing the instance. */
+  if (scr_library_callback_depth != 0) scr_library_callback_depth--;
+}
+
 /* ── the trap funnel, library expansion ───────────────────────────────────
  * Poison first (the sink may longjmp to a host frame below the entry — the
  * conforming survival pattern), then deliver exactly once, then abort:
@@ -111,8 +124,9 @@ void *scr_library_cb_ctx(size_t slot) { return scr_library_cb_ctxs[slot]; }
  * external symbol before dispatching into core code. A single static slot
  * is sound — exactly one core is live per copy of this state (the sole
  * core in a classic process; each archive's own instance under
- * abi.localize_runtime, where this slot is a per-instance local), entries
- * never nest, and a trap can only fire while an entry is on the stack.
+ * abi.localize_runtime, where this slot is a per-instance local), re-entry
+ * from a host callback is rejected before core work begins, and a trap can
+ * only fire while an entry is on the stack.
  * NULL (never entered) renders as the empty symbol field. */
 static SCR_TL const char *scr_library_entry_symbol = NULL;
 
@@ -134,6 +148,7 @@ static const struct {
   {"scriptc: out of memory", "SC4017"},     /* allocation failure */
   {"scriptc: internal error: ", "SC4018"},  /* internal invariant failure */
   {"scriptc: library callback ", "SC4025"}, /* unregistered host callback */
+  {"scriptc: library entry ", "SC4026"},    /* host callback re-entry */
 };
 
 static const char *scr_library_trap_code(const char *msg, size_t len) {
@@ -229,11 +244,28 @@ __attribute__((noinline)) _Noreturn void scr_trap_fmt(const char *fmt, ...) {
 
 /* ── entry prologues ──────────────────────────────────────────────────── */
 
+static _Noreturn void scr_library_callback_reentry(const char *entry_symbol) {
+  /* Attribute the detected trap to the attempted INNER ABI symbol. Clear
+   * depth before delivery: a conforming sink may longjmp to a host recovery
+   * frame, and its poisoned instance must not retain stale callback-active
+   * state that would change the established pure-registration behavior. */
+  scr_library_entry_symbol = entry_symbol;
+  scr_library_callback_depth = 0;
+  scr_trap_fmt("scriptc: library entry '%s' invoked from a host callback\n", entry_symbol);
+}
+
+void scr_library_callback_entry_guard(const char *entry_symbol) {
+  if (scr_library_callback_depth != 0) scr_library_callback_reentry(entry_symbol);
+}
+
 void scr_library_entry(bool reset_arena, const char *entry_symbol) {
   /* Record the entry symbol FIRST so even a poisoned-abort's core dump
-   * names the entry; a trap anywhere below (the arena reset's OOM
-   * included) then reports the right symbol. */
+  * names the entry; a trap anywhere below (the arena reset's OOM
+  * included) then reports the right symbol. */
   scr_library_entry_symbol = entry_symbol;
+  /* Re-entry must win over poison and reset: no inner ABI entry may mutate
+   * globals, release arena data, collect, or replace state from a callback. */
+  if (scr_library_callback_depth != 0) scr_library_callback_reentry(entry_symbol);
   /* A poisoned library's entries abort deterministically — never through the
    * sink again (it received its exactly-once message when the trap fired),
    * never into a heap whose invariants already failed. */

package/src/scr_loop_epoll.c

@@ -1,6 +1,6 @@
 /* The Linux backend of the platform readiness contract (scr_platform.h):
  * epoll for fd readiness, one timerfd per armed one-shot timer. This is
- * the LIVE Linux poller behind scr_net.c and scr_dgram.c (cc.ts links it
+ * the LIVE Linux poller behind scr_net.c and scr_dgram.c (native-toolchain.ts links it
  * alongside scr_loop_kqueue.c whenever those units compile; each TU is
  * empty off its platform). Child-exit wakeups are NOT here: scr_child.c
  * keeps its narrow seam inline (kqueue EVFILT_PROC on BSD, pidfd_open +

package/src/scr_loop_wsapoll.c

@@ -1,7 +1,7 @@
 /* The Windows backend of the platform readiness contract (scr_platform.h):
  * WSAPoll for socket readiness, deadline bookkeeping for the one-shot
  * timers (no timerfd analogue — scrp_drain expires due keys against the
- * loop's scr_now_ms clock). cc.ts links this TU alongside the kqueue and
+ * loop's scr_now_ms clock). native-toolchain.ts links this TU alongside the kqueue and
  * epoll backends whenever a poller-using unit compiles; each is empty off
  * its platform.
  *

package/src/scr_musl.c

@@ -1,4 +1,4 @@
-/* musl libc shim — compiled into linux-musl target builds only (cc.ts adds
+/* musl libc shim — compiled into linux-musl target builds only (native-toolchain.ts adds
  * this TU together with -DSCR_MUSL). musl deliberately provides no libc
  * identification macro, so the target-selected project macro is the guard.
  *

package/src/scr_net.c

@@ -107,6 +107,20 @@
 #include <netinet/in.h>
 #include <netinet/tcp.h>
 #include <sys/socket.h>
+#if defined(__FreeBSD__) || defined(__DragonFly__) || defined(_AIX) || defined(__sun)
+#include <sys/param.h>
+#endif
+#endif
+
+/* MinGW's errno headers do not expose ENOTSUP on every supported toolchain.
+ * Keep a stable internal value for the Node/libuv unsupported reuse-port
+ * result, while preserving the platform's EOPNOTSUPP spelling when present. */
+#ifndef ENOTSUP
+#ifdef EOPNOTSUPP
+#define ENOTSUP EOPNOTSUPP
+#else
+#define ENOTSUP 4095
+#endif
 #endif
 
 static void scr_net_oom(void) {
@@ -275,6 +289,10 @@ static const char *scr_net_errname(int err) {
   case EHOSTDOWN: return "EHOSTDOWN"; /* absent from the win32 CRT */
 #endif
   case EINVAL: return "EINVAL";
+  case ENOTSUP: return "ENOTSUP";
+#if defined(EOPNOTSUPP) && (!defined(ENOTSUP) || EOPNOTSUPP != ENOTSUP)
+  case EOPNOTSUPP: return "EOPNOTSUPP";
+#endif
   default: return "EUNKNOWN";
   }
 }
@@ -710,6 +728,63 @@ static void scr_net_listen_reuseaddr(int fd) {
 #endif
 }
 
+/* Node/libuv's TCP reuse-port matrix. SO_REUSEPORT is deliberately NOT
+ * selected merely because a platform header happens to expose it: macOS's
+ * meaning is not the required TCP load-balancing contract, and Windows'
+ * SO_REUSEADDR is port hijacking rather than reuse-port support. FreeBSD's
+ * ordinary SO_REUSEPORT does not distribute connections, so FreeBSD 12+
+ * uses the load-balancing spelling instead. A setsockopt failure is returned
+ * to the caller so an unsupported kernel cannot silently become a singleton. */
+static int scr_net_listen_reuseport(int fd) {
+  int rc;
+#if defined(__FreeBSD__) && defined(__FreeBSD_version) && \
+    __FreeBSD_version >= 1200000 && defined(SO_REUSEPORT_LB)
+  int one = 1;
+  rc = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT_LB, &one, sizeof one);
+#elif (defined(__linux__) || defined(_AIX73) || \
+       (defined(__DragonFly__) && defined(__DragonFly_version) && __DragonFly_version >= 300600) || \
+       (defined(__sun) && !defined(__illumos__) && defined(SO_FLOW_NAME))) && \
+      defined(SO_REUSEPORT)
+  int one = 1;
+  rc = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof one);
+#else
+  (void)fd;
+  errno = ENOTSUP;
+  return -1;
+#endif
+#if defined(__linux__) && defined(ENOPROTOOPT)
+  /* Linux kernels predating 3.9 expose no reuse-port TCP support. Keep
+   * Node's stable unsupported result instead of leaking ENOPROTOOPT. */
+  if (rc != 0 && errno == ENOPROTOOPT) errno = ENOTSUP;
+#endif
+  return rc;
+}
+
+/* Shared bind setup for both host-less and explicit-interface listeners.
+ * SO_REUSEADDR remains first, reuse-port is requested next, and both are
+ * complete before bind/listen. The returned errno is the native failure. */
+static int scr_net_bind_listen(int fd, const struct sockaddr *sa, socklen_t salen,
+                               bool reuse_port) {
+  scr_net_listen_reuseaddr(fd);
+  if (reuse_port && scr_net_listen_reuseport(fd) != 0) return -1;
+  scr_net_nonblock(fd);
+  int rc = bind(fd, sa, salen);
+  if (rc == 0) rc = listen(fd, 511); /* Node's default backlog */
+  return rc;
+}
+
+static const char *scr_net_listen_reason(int err, bool explicit_host) {
+  if (err == EADDRINUSE) return "address already in use";
+#ifdef EADDRNOTAVAIL
+  if (explicit_host && err == EADDRNOTAVAIL) return "address not available";
+#endif
+  if (err == ENOTSUP) return "operation not supported";
+#if defined(EOPNOTSUPP) && (!defined(ENOTSUP) || EOPNOTSUPP != ENOTSUP)
+  if (err == EOPNOTSUPP) return "operation not supported";
+#endif
+  return "permission denied";
+}
+
 /* write(2) to a socket with SIGPIPE suppressed. macOS sets SO_NOSIGPIPE
  * per fd above (send() path unchanged: write, exactly the historical
  * call); Linux has no SO_NOSIGPIPE — MSG_NOSIGNAL on each send is the
@@ -1280,7 +1355,8 @@ ScrNetServer *scr_net_create_server(ScrClosure *handler /*moves, nullable*/, Scr
  * 'error'); success defers the listen callback ('listening') to the next
  * dispatch pass, Node's next-tick emit. Binds like Node's host-less
  * listen: IPv6 any with dual-stack when the kernel allows, IPv4 fallback. */
-void scr_net_listen(ScrNetServer *s, double port, ScrClosure *cb /*moves, nullable*/) {
+static void scr_net_listen_any(ScrNetServer *s, double port, bool reuse_port,
+                               ScrClosure *cb /*moves, nullable*/) {
   if (cb) scr_net_ls_add(&s->listening_cbs, cb, NULL, true);
   if (s->listening || s->close_emitted) return;
   if (!scr_net_poller_init()) {
@@ -1300,8 +1376,6 @@ void scr_net_listen(ScrNetServer *s, double port, ScrClosure *cb /*moves, nullab
     fputs("scriptc: socket() failed\n", stderr);
     abort();
   }
-  scr_net_listen_reuseaddr(fd);
-  scr_net_nonblock(fd);
   int rc;
   if (v6) {
     struct sockaddr_in6 addr;
@@ -1309,23 +1383,22 @@ void scr_net_listen(ScrNetServer *s, double port, ScrClosure *cb /*moves, nullab
     addr.sin6_family = AF_INET6;
     addr.sin6_addr = in6addr_any;
     addr.sin6_port = htons((uint16_t)p);
-    rc = bind(fd, (struct sockaddr *)&addr, sizeof addr);
+    rc = scr_net_bind_listen(fd, (struct sockaddr *)&addr, sizeof addr, reuse_port);
   } else {
     struct sockaddr_in addr;
     memset(&addr, 0, sizeof addr);
     addr.sin_family = AF_INET;
     addr.sin_addr.s_addr = INADDR_ANY;
     addr.sin_port = htons((uint16_t)p);
-    rc = bind(fd, (struct sockaddr *)&addr, sizeof addr);
+    rc = scr_net_bind_listen(fd, (struct sockaddr *)&addr, sizeof addr, reuse_port);
   }
-  if (rc == 0) rc = listen(fd, 511); /* Node's default backlog */
   if (rc != 0) {
     int err = errno;
     close(fd);
     char msg[128];
     /* Node: "listen EADDRINUSE: address already in use :::4000" */
     snprintf(msg, sizeof msg, "listen %s: %s %s:%d", scr_net_errname(err),
-             err == EADDRINUSE ? "address already in use" : "permission denied",
+             scr_net_listen_reason(err, false),
              v6 ? "::" : "0.0.0.0", p);
     if (!s->pending_err) s->pending_err = scr_str_new(msg, strlen(msg));
     scr_net_server_register(s); /* the sweep delivers the failure */
@@ -1347,7 +1420,11 @@ void scr_net_listen(ScrNetServer *s, double port, ScrClosure *cb /*moves, nullab
   scr_net_server_register(s);
 }
 
-/* listen({ port, host, ipv6Only }) — the explicit-interface bind
+void scr_net_listen(ScrNetServer *s, double port, ScrClosure *cb /*moves, nullable*/) {
+  scr_net_listen_any(s, port, false, cb);
+}
+
+/* listen({ port, host, ipv6Only, reusePort }) — the explicit-interface bind
  * (portless's listenOnProxyInterface): host is an IP literal ("" = the
  * host-less dual-stack default above; "localhost" pins to 127.0.0.1, the
  * connect-side divergence); ipv6Only sets IPV6_V6ONLY before the bind
@@ -1355,10 +1432,11 @@ void scr_net_listen(ScrNetServer *s, double port, ScrClosure *cb /*moves, nullab
  * listener, exactly the portless pair). Failures are the async 'error'
  * with Node's listen message naming the requested host; a non-IP host is
  * the async getaddrinfo ENOTFOUND (no resolver in this slice). */
-void scr_net_listen_opts(ScrNetServer *s, double port, ScrStr *host /*borrowed*/,
-                          bool ipv6_only, ScrClosure *cb /*moves, nullable*/) {
+static void scr_net_listen_opts_impl(ScrNetServer *s, double port, ScrStr *host /*borrowed*/,
+                                     bool ipv6_only, bool reuse_port,
+                                     ScrClosure *cb /*moves, nullable*/) {
   if (host == NULL || host->len == 0) {
-    scr_net_listen(s, port, cb);
+    scr_net_listen_any(s, port, reuse_port, cb);
     return;
   }
   if (cb) scr_net_ls_add(&s->listening_cbs, cb, NULL, true);
@@ -1406,18 +1484,13 @@ void scr_net_listen_opts(ScrNetServer *s, double port, ScrStr *host /*borrowed*/
     int only = ipv6_only ? 1 : 0;
     setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &only, sizeof only);
   }
-  scr_net_listen_reuseaddr(fd);
-  scr_net_nonblock(fd);
-  int rc = bind(fd, sa, salen);
-  if (rc == 0) rc = listen(fd, 511); /* Node's default backlog */
+  int rc = scr_net_bind_listen(fd, sa, salen, reuse_port);
   if (rc != 0) {
     int err = errno;
     close(fd);
     char msg[160];
     snprintf(msg, sizeof msg, "listen %s: %s %s:%d", scr_net_errname(err),
-             err == EADDRINUSE      ? "address already in use"
-             : err == EADDRNOTAVAIL ? "address not available"
-                                    : "permission denied",
+             scr_net_listen_reason(err, true),
              h, p);
     if (!s->pending_err) s->pending_err = scr_str_new(msg, strlen(msg));
     scr_net_server_register(s);
@@ -1440,6 +1513,17 @@ void scr_net_listen_opts(ScrNetServer *s, double port, ScrStr *host /*borrowed*/
   scr_net_server_register(s);
 }
 
+void scr_net_listen_opts(ScrNetServer *s, double port, ScrStr *host /*borrowed*/,
+                          bool ipv6_only, ScrClosure *cb /*moves, nullable*/) {
+  scr_net_listen_opts_impl(s, port, host, ipv6_only, false, cb);
+}
+
+void scr_net_listen_opts_reuse_port(ScrNetServer *s, double port, ScrStr *host /*borrowed*/,
+                                    bool ipv6_only, bool reuse_port,
+                                    ScrClosure *cb /*moves, nullable*/) {
+  scr_net_listen_opts_impl(s, port, host, ipv6_only, reuse_port, cb);
+}
+
 double scr_net_server_port(ScrNetServer *s) { return (double)s->port; }
 
 double scr_net_server_timeout_get(ScrNetServer *s, double field) {

package/src/scr_net_island.c

@@ -1,6 +1,6 @@
 /* The island's node:http/node:https CLIENT ↔ the socket units — the one
  * translation unit referencing BOTH scr_http/scr_tls and the engine (the
- * scr_zlib_island.c precedent): cc.ts compiles it exactly when a
+ * scr_zlib_island.c precedent): native-toolchain.ts compiles it exactly when a
  * --dynamic build links the socket units, and the emitted main calls
  * scr_net_island_install before any island entry. Builds without it keep
  * the island's "does not provide the 'node:http' builtin" refusal.

package/src/scr_platform.h

@@ -12,7 +12,7 @@
  * child-exit filter, and the zero-timeout drains. This header names that
  * plumbing so each unit can call one spelling and link either backend.
  *
- * STATUS: LIVE. scr_net.c and scr_dgram.c call this contract; cc.ts
+ * STATUS: LIVE. scr_net.c and scr_dgram.c call this contract; native-toolchain.ts
  * links BOTH backends whenever either unit compiles (scr_loop_kqueue.c —
  * a stateless spelling of the units' historical inline syscall
  * sequences, byte-identical on macOS by construction — and

package/src/scr_regex.c

@@ -4,7 +4,7 @@
  * implementation the dynamic island uses — compiled standalone (libregexp.c
  * + libunicode.c; cutils is header-only) and linked ONLY into programs that
  * contain a regex literal. This file is likewise regex-only: it is NOT in
- * the always-compiled runtime source list (see cc.ts), so regex-free
+ * the always-compiled runtime source list (see native-toolchain.ts), so regex-free
  * programs keep a byte-identical link line.
  *
  * - Every ScrRegex today is an immortal interned literal (the compiler

package/src/scr_runtime.h

@@ -18,7 +18,7 @@
 /* ── libc shims ─────────────────────────────────────────────────────────
  * Win32's missing POSIX/BSD functions live in scr_win.c. Zig's musl sysroot
  * additionally lacks arc4random_buf; scr_musl.c supplies it from Linux's
- * getrandom syscall. Both files are selected by cc.ts only for their target. */
+ * getrandom syscall. Both files are selected by native-toolchain.ts only for their target. */
 #ifdef _WIN32
 #include <time.h> /* time_t / struct tm for the gmtime_r shim */
 char *stpcpy(char *dst, const char *src);
@@ -53,6 +53,10 @@ void arc4random_buf(void *buf, size_t n);
  * flush-at-exit, RC audit registration (when built with -DSCR_RC_AUDIT).
  * JavaScript-visible writes flush before returning. */
 void scr_init(void);
+/* Program objects emitted by the bundled LLVM helper reference this symbol.
+ * Its versioned spelling makes a mismatched manual runtime link fail before
+ * the program can start. */
+void scr_runtime_abi_v1(void);
 
 /* ── the trap funnel (scr_console.c; scr_library.c under -DSCR_LIB) ──────
  * Every unrecoverable runtime trap — OOM, semantic range traps, internal-
@@ -104,7 +108,8 @@ typedef struct ScrBytes ScrBytes;
  * Every trap the runtime DETECTS arrives structured: the funnel assembles
  * the baseline human line into field 0 unchanged, a stable code for the
  * trap kind (the compiler registry's runtime family — SC4013–SC4019 plus
- * the SC4025 unregistered-callback trap, classified in scr_library.c), the
+ * the SC4025 unregistered-callback and SC4026 callback-re-entry traps,
+ * classified in scr_library.c), the
  * entry symbol recorded by the trapping
  * entry's prologue, and the profile's remediation for that code when the
  * program TU's overlay table declares one (the whole fourth field is
@@ -129,16 +134,23 @@ void scr_library_set_sink(ScrLibSinkFn fn, void *ctx); /* latest wins */
  *
  * Registration is a pure store like the sink's (no entry prologue, no
  * poison guard, legal before init); latest wins, NULL clears, and
- * registrations persist across init/reset. Slots are per-copy of this
+ * registrations persist across init/reset. While a host callback is active,
+ * its registration entry is rejected before name dispatch or a store, just
+ * like every runtime-touching ABI entry. Slots are per-copy of this
  * state, exactly the sink's story: per-archive under abi.localize_runtime,
  * per-thread instance under abi.instance_per_thread (SCR_TL) — a callback
  * registered on thread T fires only for T's instance. The host's callback
  * runs on the calling thread inside the entry's dynamic extent and must
- * NOT call back into any library entry (registration symbols included) or
- * unwind/longjmp across library frames: read the borrowed buffers, copy
- * what outlives the call, return. Buffer parameters are borrowed for the
- * duration of the call only. */
-#define SCR_LIB_MAX_CALLBACKS 32 /* keep in step with LIB_MAX_CALLBACKS (library/profile.ts) */
+ * NOT call back into any library entry (exports, init, reset, collect, sink
+ * registration, or callback registration) or unwind/longjmp across library
+ * frames: read the borrowed buffers, copy what outlives the call, return.
+ * A re-entry is a detected SC4026 trap: it poisons only this library
+ * instance, delivers exactly once to the already-registered sink, names the
+ * attempted inner ABI symbol in structured field 2, then aborts if the sink
+ * returns. A later host-loop turn may enter normally after the callback has
+ * returned. Buffer parameters are borrowed for the duration of the call
+ * only. */
+#define SCR_LIB_MAX_CALLBACKS 32 /* keep in step with LIB_MAX_CALLBACKS (library/library-profile.ts) */
 /* The stored shape: generated call sites cast a slot's pointer to the
  * channel's typed shape before calling. */
 typedef void (*ScrLibCbFn)(void);
@@ -147,6 +159,15 @@ void scr_library_cb_set(size_t slot, ScrLibCbFn fn, void *ctx);
  * trap_msg (never returns NULL). */
 ScrLibCbFn scr_library_cb_require(size_t slot, const char *trap_msg);
 void *scr_library_cb_ctx(size_t slot);
+/* Generated typed call sites bracket only the actual host-function call.
+ * End is reached only after a normal return; an illegal unwind deliberately
+ * leaves the depth active so the next ABI entry is rejected. */
+void scr_library_callback_begin(void);
+void scr_library_callback_end(void);
+/* Registration wrappers bypass scr_library_entry because their normal path
+ * is a pure store. They call this first so callback-time registration is
+ * rejected before dispatch, NULL handling, or mutation. */
+void scr_library_callback_entry_guard(const char *entry_symbol);
 
 /* Entry prologue: aborts deterministically when the library is poisoned (a
  * trap already fired — no profile entry may run again; recovery is process
@@ -155,10 +176,11 @@ void *scr_library_cb_ctx(size_t slot);
  * entry_symbol is the generated entry's external symbol exactly as the
  * host linked it (a static string in the program TU): the prologue records
  * it in the funnel's current-entry slot so a detected trap's structured
- * message can name the trapping entry — sound as a single static slot
- * because exactly one core is ever live and entries never nest. Init and
- * the mode entries (reset, collect) record theirs too; the identity
- * getters and sink registration touch no runtime and never trap. */
+ * message can name the trapping entry. A host callback's attempted nested
+ * entry is rejected first and replaces this slot with that inner symbol.
+ * Init and the mode entries (reset, collect) record theirs too. The two
+ * profile identity getters are the explicit pure-data exception: they touch
+ * no mutable runtime state and remain callable before init and after poison. */
 void scr_library_entry(bool reset_arena, const char *entry_symbol);
 void scr_library_arena_reset(void);
 /* The mode-provided collect entry's body: arena reset + a full cycle
@@ -196,7 +218,8 @@ _Noreturn void scr_trap_len(const char *msg, size_t len);
  * (both emissions emit identical data) and consumed by the funnel when it
  * assembles a detected trap's structured message: flat triples of
  * (code, teaching-or-NULL, remediation-or-NULL), one per runtime trap code
- * (the SC4013–SC4019 family plus SC4025) the profile declares text for;
+ * (the SC4013–SC4019 family plus SC4025 and SC4026) the profile declares
+ * text for;
  * _len counts triples. A declared teaching replaces the baseline human line as field 0;
  * a declared remediation becomes the optional fourth field. */
 extern const char *const scr_library_trap_overlays[];
@@ -1001,7 +1024,7 @@ ScrStr *scr_arr_join(ScrArr *a, ScrStr *sep);
 ScrStr *scr_str_raw(ScrArr *raw, ScrArr *subs);
 
 /* ── regular expressions (scr_regex.c — linked ONLY when the program
- * contains a regex literal; see cc.ts) ────────────────────────────────
+ * contains a regex literal; see native-toolchain.ts) ────────────────────────────────
  * The engine is quickjs-ng's libregexp (the same bytecode interpreter the
  * dynamic island uses), compiled standalone. A ScrRegex is today ALWAYS an
  * immortal interned literal: the compiler emits one static per distinct
@@ -4368,7 +4391,7 @@ void scr_island_set_fetch(void (*boot)(void *jsctx), bool (*pending)(void),
 
 /* ── the island's node:http/https client bridge (scr_net_island.c) ────
  * The one TU referencing BOTH the socket units and the island (the
- * scr_zlib_island.c precedent): cc.ts compiles it exactly when a
+ * scr_zlib_island.c precedent): native-toolchain.ts compiles it exactly when a
  * --dynamic build links the socket units, and the emitted main calls
  * scr_net_island_install before any island entry. `attach` runs while
  * the island builds its bootstrap host object (jsctx and host_obj are
@@ -5064,7 +5087,7 @@ ScrBytes *scr_bytes_concat_len(const ScrArr *list, double total);
 ScrBytes *scr_bytes_concat(const ScrArr *list); /* +1 */
 
 /* ── util.inspect (scr_inspect.c — linked ONLY when the program calls
- * util.inspect/format; see cc.ts) ─────────────────────────────────────
+ * util.inspect/format; see native-toolchain.ts) ─────────────────────────────────────
  * The runtime half of the static inspect rendering: the compiler
  * synthesizes one traversal helper per static type; these entries own
  * Node's exact scalar formatting and the layout engine (frames,
@@ -5176,7 +5199,7 @@ bool scr_process_stderr_write_bytes(const ScrBytes *b, const ScrStr *encoding);
 void scr_fs_throw(int e, const char *op, const ScrStr *path);
 
 /* ── zlib (scr_zlib.c — compiled and linked with -lz only when the
- * program uses zlib, like scr_regex.c/libregexp; see cc.ts) ──────────
+ * program uses zlib, like scr_regex.c/libregexp; see native-toolchain.ts) ──────────
  * deflateSync/inflateSync over u8 bytes with Node's default options
  * (zlib format, default level/windowBits). deflate never throws (OOM
  * aborts); inflate of corrupt input THROWS Node's error catchably
@@ -5191,7 +5214,7 @@ ScrBytes *scr_zlib_inflate_mode(const ScrBytes *data, double mode);
 void scr_zlib_island_install(void);
 
 /* ── node:net (scr_net.c — compiled and linked ONLY when the program
- * uses the net surface, like scr_events.c; see cc.ts) ─────────────────
+ * uses the net surface, like scr_events.c; see native-toolchain.ts) ─────────────────
  * TCP servers and sockets over the unit's own readiness poller
  * (scr_platform.h: kqueue on macOS/BSD, epoll on Linux): refcounted handles
  * whose listeners MOVE in and drop at settlement (the ScrChild ownership
@@ -5294,10 +5317,18 @@ void scr_net_sock_release_v(void *p);
 
 ScrNetServer *scr_net_create_server(ScrClosure *handler /*moves, nullable*/, ScrNetConnFn fn); /* +1 */
 void scr_net_listen(ScrNetServer *s, double port, ScrClosure *cb /*moves, nullable*/);
-/* listen({ port, host, ipv6Only }): host is an IP literal ("" = the
- * dual-stack any default); ipv6Only sets IPV6_V6ONLY before the bind. */
+/* listen({ port, host, ipv6Only, reusePort }): host is an IP literal ("" =
+ * the dual-stack any default); ipv6Only sets IPV6_V6ONLY before the bind.
+ * The old entry point ignores reusePort and is retained for old IR. */
 void scr_net_listen_opts(ScrNetServer *s, double port, ScrStr *host /*borrowed*/,
                           bool ipv6_only, ScrClosure *cb /*moves, nullable*/);
+/* Additive ABI for listen({ port, host, ipv6Only, reusePort }): reuse_port
+ * requests the platform matrix documented in scr_net.c. Unsupported
+ * platforms and kernels fail asynchronously; they never fall back to an
+ * ordinary single listener. */
+void scr_net_listen_opts_reuse_port(ScrNetServer *s, double port, ScrStr *host /*borrowed*/,
+                                    bool ipv6_only, bool reuse_port,
+                                    ScrClosure *cb /*moves, nullable*/);
 double scr_net_server_port(ScrNetServer *s); /* address().port */
 /* Writable http.Server timeout property storage. `field` is the compiler
  * ABI selector: timeout, keepAliveTimeout, headersTimeout, requestTimeout,
@@ -5594,7 +5625,7 @@ long scr_secure_ctx_live_count(void);
 
 /* ── node:tls, the CA-store introspection slice (scr_tls_ca.c — its own
  * unit and link gate; NO mbedTLS, so a getCACertificates-only binary never
- * builds the archive; cc.ts also compiles it whenever scr_tls.c does). The
+ * builds the archive; native-toolchain.ts also compiles it whenever scr_tls.c does). The
  * HOST roots (Windows' system certificate stores, the established bundle probe on
  * POSIX) stand in for both Node's compiled-in Mozilla roots ('bundled',
  * rootCertificates) and the platform store ('system') — the established

package/src/scr_string.c

@@ -83,12 +83,12 @@ ScrStr *scr_str_new(const char *bytes, size_t len) {
   return s;
 }
 
-/* One-slot free-block cache for append loops: `s += x` compiles to
- * concat + release-of-the-old-string every iteration, so the block freed
- * on iteration n is (with the geometric slack below) big enough for the
- * allocation on iteration n+1 — the loop ping-pongs between two warm
- * blocks instead of paging in fresh zero-filled memory 40k times. Disabled
- * in the audit lane so ASan sees every logical free as a real free. */
+/* One-slot free-block cache for concat callers that must copy: observable
+ * aliases, `s = s + s`, and non-canonical concat shapes still allocate a
+ * replacement result. The compiler's canonical self-assignment handoff
+ * leaves its left snapshot uniquely owned, so it instead uses the in-place
+ * path below; this cache remains useful for the copy cases. Disabled in the
+ * audit lane so ASan sees every logical free as a real free. */
 #ifndef SCR_RC_AUDIT
 static SCR_TL ScrStr *scr_str_spare;
 #endif
@@ -166,12 +166,11 @@ ScrStr *scr_str_concat(ScrStr *a, ScrStr *b) {
     a->rc = 2; /* +1 for the returned reference, beside the caller's borrow */
     return a;
   }
-  /* Copy path. Geometric slack keeps appenders amortized: a uniquely-owned
-   * left side that outgrew its capacity is a concat chain, and any sizable
-   * result is presumed an append loop's accumulator (`s += x` reaches here
-   * with rc == 2 — the variable plus the emitted temp — every iteration;
-   * the slack is what lets the free-block cache above satisfy the next
-   * iteration's slightly-larger allocation). */
+  /* Copy path. Geometric slack keeps uniquely-owned concat chains and the
+   * optimized self-assignment handoff amortized when they outgrow capacity.
+   * Aliases and `s = s + s` deliberately arrive with rc > 1 and stay on this
+   * path, preserving string immutability; their sizable replacement results
+   * can still benefit from the spare-block cache above. */
   size_t newcap = newlen;
   if (a->rc == 1) {
     size_t grown = a->cap + (a->cap >> 1) + 16;

package/src/scr_test.c

@@ -1,5 +1,5 @@
 /* node:test — the in-process test runner (linked only when the program
- * imports node:test; cc.ts gates on moduleUsesNodeTest like dgram/net).
+ * imports node:test; native-toolchain.ts gates on moduleUsesNodeTest like dgram/net).
  *
  * Registration (test/it/describe/suite/hooks) builds a tree under an
  * implicit root while the module bodies run: describe callbacks execute

package/src/scr_tls_ca.c

@@ -4,7 +4,7 @@
  * of mbedTLS: everything here is PEM-BLOCK bookkeeping over the host
  * roots (plus crypt32 store access on Windows), so a program that only
  * inspects the CA store never builds the TLS archive. scr_tls.c (when it
- * links — cc.ts compiles this unit alongside it) consults
+ * links — native-toolchain.ts compiles this unit alongside it) consults
  * scr_tls_ca_default_override for its client trust anchors, which is what
  * makes setDefaultCACertificates LIVE semantics: the next https/tls dial
  * verifies against the replaced set.

package/src/scr_win.c

@@ -1,6 +1,6 @@
 /* win32 libc shims — the POSIX/BSD functions the runtime calls that
  * mingw-w64's CRT does not provide (declared in scr_runtime.h's _WIN32
- * block). Compiled into win32-target builds only (cc.ts adds this TU and
+ * block). Compiled into win32-target builds only (native-toolchain.ts adds this TU and
  * -ladvapi32 for windows triples); an empty TU anywhere else, so POSIX
  * builds cannot change by a byte. */
 #ifdef _WIN32
@@ -69,7 +69,7 @@ char *strcasestr(const char *hay, const char *needle) {
 
 #else /* !_WIN32 */
 
-/* Empty TU off-Windows: cc.ts only compiles this file for windows triples,
+/* Empty TU off-Windows: native-toolchain.ts only compiles this file for windows triples,
  * but an accidental link elsewhere must stay harmless. */
 typedef int scr_win_unused;
 

package/src/scr_zlib.c

@@ -1,9 +1,9 @@
 /* node:zlib, the lowered slice: deflateSync/inflateSync over u8 bytes with
  * Node's DEFAULT options (zlib format, Z_DEFAULT_COMPRESSION, windowBits
- * 15). Compiled ONLY when the program uses zlib (cc.ts gates it exactly
+ * 15). Compiled ONLY when the program uses zlib (native-toolchain.ts gates it exactly
  * like scr_regex.c/libregexp), so zlib-free binaries keep their
  * historical link line. Host builds link the system -lz; cross targets
- * link the vendored zlib built per target (ensureZlibObjects in cc.ts).
+ * link the vendored zlib built per target (ensureZlibObjects in native-toolchain.ts).
  *
  * Compressed OUTPUT bytes are zlib-version-dependent — the differential
  * corpus tests round-trips and fixed-blob inflation, never raw deflate

package/src/scr_zlib_island.c

@@ -1,5 +1,5 @@
 /* The zlib ↔ island bridge — the one translation unit referencing BOTH
- * scr_zlib.c and the island (the scr_inspect_island.c precedent): cc.ts
+ * scr_zlib.c and the island (the scr_inspect_island.c precedent): native-toolchain.ts
  * compiles it exactly when a --dynamic build's embedded npm graph
  * imports node:zlib, and the emitted main calls scr_zlib_island_install
  * before any island entry. zlib-free dynamic builds keep the island's

package/vendor/README.md

@@ -35,7 +35,7 @@ The engine archive (libqjs.a) is prebuilt best-effort during npm installation (o
 - Version: 1.3.1 (release tarball zlib-1.3.1.tar.gz, sha256 9a93b2b7dfdac77ceba5a558a580e74667dd6fede4585b91eefb60f03b72df23)
 - License: zlib (see zlib/LICENSE)
 
-The CROSS-target arm of node:zlib (see packages/runtime/src/scr_zlib.c): host builds keep the historical system `-lz` link (macOS ships libz), but zig's cross sysroots have no libz, so SCRIPTC_TARGET builds compile this vendored copy per target instead. Only the flat `*.c`/`*.h` at the distribution root are vendored (LICENSE beside them) — contrib, tests, build machinery, and docs are not. No vendored file is modified; the gz* file-I/O TUs are vendored for faithfulness but never compiled (nothing references the gzFile API — see ZLIB_SOURCES in packages/compiler/src/backend/cc.ts). To update, re-fetch the release tarball, copy the same flat set, and bump `ZLIB_VERSION` in cc.ts.
+The CROSS-target arm of node:zlib (see packages/runtime/src/scr_zlib.c): host builds keep the historical system `-lz` link (macOS ships libz), but zig's cross sysroots have no libz, so SCRIPTC_TARGET builds compile this vendored copy per target instead. Only the flat `*.c`/`*.h` at the distribution root are vendored (LICENSE beside them) — contrib, tests, build machinery, and docs are not. No vendored file is modified; the gz* file-I/O TUs are vendored for faithfulness but never compiled (nothing references the gzFile API — see ZLIB_SOURCES in packages/compiler/src/backend/vendor-archives.ts). To update, re-fetch the release tarball, copy the same flat set, and bump `ZLIB_VERSION` in vendor-archives.ts.
 
 The objects build lazily on the first zlib-using cross compile into the per-user build cache's `vendor/zlib-<version>-<flavor>-<target>-<toolchain>/` directory — one flavor per driver/target and compiler environment/identity (the lre-objects pattern). Zlib-free binaries never compile any of this; compressed OUTPUT bytes are zlib-version-dependent, which is why the corpus only compares round-trips and fixed-blob inflation.
 
@@ -45,7 +45,7 @@ The objects build lazily on the first zlib-using cross compile into the per-user
 - Version: 7.88.1 (headers copied byte-for-byte from `node:24.15.0-bookworm`'s `/usr/include/aarch64-linux-gnu/curl/`; the arch-specific include dir is Debian multiarch layout — the headers themselves are architecture-independent, `system.h` selects per-arch typedefs at preprocessing time)
 - License: curl (see curl/COPYRIGHT — the Debian machine-readable copyright file for the package the headers came from)
 
-HEADERS ONLY — no curl C source is vendored and none is ever compiled. These headers now serve ONLY the RETIRED curl reference implementation of fetch (packages/runtime/src/scr_fetch_curl.c, selected by `SCRIPTC_FETCH_CURL=1`; kept compilable for one release as the native flip's reference — see scr_fetch.c, the default, which rides scr_net/scr_tls/scr_http/zlib and touches nothing here). Under the flag: host builds link the system `-lcurl` (macOS ships libcurl), and linux-gnu CROSS builds compile scr_fetch_curl.c against these headers, then link against a generated STUB `libcurl.so` (soname `libcurl.so.4`, empty definitions of exactly the symbols scr_fetch_curl.c calls — see CURL_STUB_SYMBOLS in packages/compiler/src/backend/cc.ts) so the produced binary records a plain `DT_NEEDED libcurl.so.4` that the TARGET system's real libcurl satisfies at load time, the standard cross-link import-stub technique. The 7.88.1 pin is a floor, not a lock: scr_fetch_curl.c's newest requirement is CURLOPT_PROTOCOLS_STR (7.85.0) and the unversioned symbol references bind to any libcurl.so.4. This whole directory leaves with scr_fetch_curl.c when the reference retires for good.
+HEADERS ONLY — no curl C source is vendored and none is ever compiled. These headers now serve ONLY the RETIRED curl reference implementation of fetch (packages/runtime/src/scr_fetch_curl.c, selected by `SCRIPTC_FETCH_CURL=1`; kept compilable for one release as the native flip's reference — see scr_fetch.c, the default, which rides scr_net/scr_tls/scr_http/zlib and touches nothing here). Under the flag: host builds link the system `-lcurl` (macOS ships libcurl), and linux-gnu CROSS builds compile scr_fetch_curl.c against these headers, then link against a generated STUB `libcurl.so` (soname `libcurl.so.4`, empty definitions of exactly the symbols scr_fetch_curl.c calls — see CURL_STUB_SYMBOLS in packages/compiler/src/backend/vendor-archives.ts) so the produced binary records a plain `DT_NEEDED libcurl.so.4` that the TARGET system's real libcurl satisfies at load time, the standard cross-link import-stub technique. The 7.88.1 pin is a floor, not a lock: scr_fetch_curl.c's newest requirement is CURLOPT_PROTOCOLS_STR (7.85.0) and the unversioned symbol references bind to any libcurl.so.4. This whole directory leaves with scr_fetch_curl.c when the reference retires for good.
 
 The stub builds lazily on the first flag-selected fetch cross compile into the per-user build cache's `vendor/curl-stub-<target>-<toolchain>/` directory (the zlib-objects pattern). Default builds never see any of this, and no build ever compiles curl itself.
 
@@ -55,6 +55,6 @@ The stub builds lazily on the first flag-selected fetch cross compile into the p
 - Version: mbedtls-3.6.7 (the 3.6 LTS line — 4.x moved the crypto core into the separate TF-PSA-Crypto repository; the self-contained LTS is what a vendored tree wants)
 - License: Apache-2.0 (see mbedtls/LICENSE)
 
-The TLS provider behind node:tls/node:https (see the design note atop packages/runtime/src/scr_tls.c for why mbedTLS over SecureTransport/BoringSSL/libtls). Only `include/` and `library/` are vendored (LICENSE beside them) — tests, docs, programs, scripts, and CMake machinery are not. No vendored file is modified and no custom config is applied (the stock `mbedtls_config.h` builds every `library/*.c` standalone with clang); to update, re-fetch the release tarball, copy the same two directories, and bump `MBEDTLS_VERSION` in packages/compiler/src/backend/cc.ts.
+The TLS provider behind node:tls/node:https (see the design note atop packages/runtime/src/scr_tls.c for why mbedTLS over SecureTransport/BoringSSL/libtls). Only `include/` and `library/` are vendored (LICENSE beside them) — tests, docs, programs, scripts, and CMake machinery are not. No vendored file is modified and no custom config is applied (the stock `mbedtls_config.h` builds every `library/*.c` standalone with clang); to update, re-fetch the release tarball, copy the same two directories, and bump `MBEDTLS_VERSION` in packages/compiler/src/backend/vendor-archives.ts.
 
 The archive (libmbedtls.a) is prebuilt best-effort during npm installation (or explicitly by `scriptc cache warm`) and otherwise built lazily on the first TLS-using compile. It lives under the per-user build cache's `vendor/mbedtls-<version>-<flavor>-<target>-<toolchain>/` directory — one flavor per lane (plain, asan), native platform/architecture or explicit cross target, and compiler environment/identity, the libqjs.a pattern. TLS-free binaries never compile or link any of this.