@sproutboat/toolchain 0.4.24 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @sproutboat/toolchain
 
+## 0.6.0
+
+### Minor Changes
+
+- Pin and vendor Porffor alpha-16 (43087d4). Enable Proxy and revocable Proxy in handler validation, add native regression coverage for traps and iterators, and drop three typed-array patches now implemented upstream. See PORFFOR_ALPHA16.md for the complete change audit and remaining package compatibility limits.
+
+## 0.5.0
+
+### Minor Changes
+
+- 16f9b79: Pin and vendor Porffor alpha-15 (`72d048d`). Alpha-14 and alpha-15 bring stackless coroutines, iterator support, class hoisting and typed-array fixes. Three Sproutboat patches are dropped because upstream now covers them: the typed-array store and `~` conversions (#238) and the coroutine stack size (#178). The #241 write-bounds guard is re-anchored. uWebSockets stays on the same commit and the compatibility suite is unchanged at 30/32. See `PORFFOR_ALPHA15.md`.
+
+### Patch Changes
+
+- bf4ac00: Named class expressions work inside handlers again (baronunread/sproutboat#256). Inside a function, Porffor gave a class expression's own name, as seen from its methods, a new function object instead of the class, so `var R = class l { static lex() { return new l() } }` failed with "value is not a constructor". Every handler has run inside a function since #238, and bundlers emit this shape for any class whose static members refer to themselves, so marked and similar packages broke. A parse-time rewrite turns such a class into the equivalent `(() => { const l = class { ... }; return l; })()`, which Porffor handles correctly.
+  
+  The ISO date parser no longer reads one byte past the end of the string. When that byte happened to be `+` or `-`, a timezone offset's sign flipped, so `-00:30` could parse as `+00:30` depending on what sat next in memory.
+
 ## 0.4.24
 
 ### Patch Changes

package/PORFFOR_ALPHA15.md

@@ -0,0 +1,9 @@
+# Porffor alpha-15 upgrade audit
+
+The source pin moves from alpha-13 (`547c781`) to the [alpha-15 release](https://github.com/CanadaHonk/porffor/releases/tag/alpha-15), commit `72d048d73d49e217631ac8a1bc4fa9070d22fbc9`, published October 2, 2026. The vendored codeload archive has SHA-256 `1e12be943b29691ad84bb25baecffa810655dcf7d9a490b8399352509da7a1d5`.
+
+Alpha-14 and alpha-15 bring stackless coroutines (async functions compile to state machines), initial iterator support, hoisting of referenced classes, a fix for function-expression self-references, integer typed-array stores that wrap, `~` built on ToUint32, a `parseInt` length check, `Map#forEach` seeing added entries, and ANSI colour only on a TTY. `compiler/uwebsockets.js` still pins uWebSockets `360c276d609d59af56ae6932adb95154ace9f15f`.
+
+Three patches are dropped because upstream now does the same thing: the typed-array store conversion and `~` from #238 (upstream emits the same `toUint32` code), and the coroutine stack size from #178 (there are no coroutine stacks any more). The #241 write-bounds guard is re-anchored on upstream's new store line. Two fixes ride along and also apply to alpha-13: the class self-name rewrite for #256 (alpha-15's self-reference fix covers function expressions, not class expressions), and the ISO date parser no longer reads past the end of its string, which flipped an offset's sign whenever the next byte in memory was `+` or `-`. That last bug surfaced on alpha-15 because its memory layout puts a `+` there in the date test.
+
+The package suite passed 173 tests, plus the native crypto and UTF-8 suites. Linked to this toolchain, the CLI passed 101 of 102 tests (`SURFACE.md` only needs the new provenance stamp) and both kitchen-sink harnesses: 35 broker checks and 38 standalone checks. The platform's 32-handler comparison compiled all 32 and matched Bun on 30, unchanged; the two misses are still non-ISO date parsing in `15-date-iso.js` and `16-date-parts.js`. `bench/pin-compare.ts` against alpha-13 showed equal binary size, compile time and cold start. Its throughput reading swung between runs; ten alternating runs of each binary afterwards put both at about 25,000 requests a second.

package/PORFFOR_ALPHA16.md

@@ -0,0 +1,67 @@
+# Porffor alpha-16 upgrade audit
+
+Source: [alpha-16](https://github.com/CanadaHonk/porffor/releases/tag/alpha-16), published October 10, 2026, commit `43087d42f0b90d14f04f3cddac034822560aefad`. The vendored codeload archive has SHA-256 `84398fd214183801d252a78e69a44fac1baeba7cafc7dbbcfd5c6ec3b0372032`. The [complete alpha-15 comparison](https://github.com/CanadaHonk/porffor/compare/alpha-15...alpha-16) contains 32 commits. uWebSockets stays at `360c276d609d59af56ae6932adb95154ace9f15f`.
+
+## Supported changes
+
+The runtime accepts `new Proxy` and `Proxy.revocable`. Native output matches Bun for get/set/has/deleteProperty, ownKeys/getOwnPropertyDescriptor through Object.keys, apply, construct, revocation, and a frozen-property invariant. This is regression coverage for these operations, not certification of all Proxy invariants or exotic targets.
+
+Array and Map iterators and lazy matchAll now expose next/done, and Set spread works. Sproutboat's URLSearchParams and FormData shims now provide live, self-iterable keys/values/entries and default iteration. Appending after creating an iterator is observed on its next step, duplicate fields remain intact, and FormData filenames do not become iterator values.
+
+Three local patches are removed because the shared typed-array implementation handles array-like from(), an omitted set() offset and join()/toString(). Builtin precompilation remains necessary for the date, promise, replaceAll and Unicode patches. Existing typed-array bounds and class self-name patches still apply. New native regressions cover clamped ties-to-even, class static this, null-prototype __proto__, binary evaluation order and Unicode console output.
+
+## Package probes and opportunities
+
+Native standalone HTTP probes on macOS arm64, pinned dependencies:
+
+| Package | Operation | Result |
+| --- | --- | --- |
+| qs 6.16.0 | Nested parse and stringify, including array parameters | Passed |
+| @trpc/server 11.19.0 | initTRPC, router and createCaller().hello() | Passed; HTTP adapters, clients, middleware and subscriptions untested |
+| itty-router 5.0.24 Router | Parameter route, POST and fallback handler | Compiler error: labelled break crossing iterator cleanup (`target.brk`) |
+| itty-router 5.0.24 IttyRouter | Parameter route, POST and fallback handler | Passed GET parameters, Unicode POST and 404 fallback after adding live Web API iterators |
+
+Proxy-based object facades, method dispatch and server callers are now practical candidates. tRPC's basic caller path is verified, so a fetch-adapter and middleware matrix is a useful next step. Reactive stores and schema libraries must be tested on their own inputs before being listed as supported. Better Auth still needs a separate crypto and framework compatibility evaluation; Proxy alone does not establish auth support. Streams and WebSockets remain separate host API gaps.
+
+String iteration still splits astral characters into UTF-16 halves: Array.from("🚤x") produces two surrogate entries and x rather than one emoji and x. Unicode console output itself works. Standard itty-router Router also remains blocked by a separate compiler control-flow bug. No upstream issue was filed.
+
+## Complete change review
+
+| Commit | Upstream change | Sproutboat impact |
+| --- | --- | --- |
+| [c730268](https://github.com/CanadaHonk/porffor/commit/c730268d087766a87502de0045eb08b1f966d7d2) | codegen: evaluate binary lhs before rhs statements | Fixes operand side-effect order; native regression. |
+| [d24dc0a](https://github.com/CanadaHonk/porffor/commit/d24dc0ad569bfd73a2dd6e3627c0cc21619bffc2) | codegen: balance template literal concats | Balances concatenation trees; compiler improvement, no new API. |
+| [4598bec](https://github.com/CanadaHonk/porffor/commit/4598becfc46865d9ea18ad338a650c98f354af51) | precompile: store builtin table as arrays | Changes builtin table representation; patched builtins still precompile. |
+| [f9eb038](https://github.com/CanadaHonk/porffor/commit/f9eb038c3aa4856d861530beb2423236536beb77) | builtins: bucket auto func keys by prefix | Compiler lookup optimization; no new API. |
+| [fd8f58a](https://github.com/CanadaHonk/porffor/commit/fd8f58a8374f6adf308056b40cae8d59fc31dcb0) | builtins: check builtin existence without decoding | Compiler lookup optimization; no new API. |
+| [b7b8ba2](https://github.com/CanadaHonk/porffor/commit/b7b8ba2fdd4fd12340aba048c578ac2b5c3d3aef) | builtins: add constructor to all builtin prototypes | Builtin prototype constructor identity becomes available; do not infer subclass compatibility. |
+| [95522a4](https://github.com/CanadaHonk/porffor/commit/95522a421ddedb5b6801d4c1f7c6706fab3cebe0) | selfhost: label bench old/new with --compare | Upstream benchmark reporting only. |
+| [860485e](https://github.com/CanadaHonk/porffor/commit/860485e9821894864fb88389f7aba5750c9f09a6) | builtins/console: print strings as utf-8 | Native Unicode console strings; native regression. |
+| [2213f53](https://github.com/CanadaHonk/porffor/commit/2213f531bda917ee3ec865c1dd92b9709dfd0d27) | codegen: include String.prototype methods for bytestrings | String method dispatch on bytestrings; existing handler tests cover common methods. |
+| [3502f8a](https://github.com/CanadaHonk/porffor/commit/3502f8a213b7de2479ba8673a92fc4eb8013fe51) | codegen: generate reassigned hoisted function bodies later | Hoisted function reassignment codegen fix; no new host API. |
+| [77ee767](https://github.com/CanadaHonk/porffor/commit/77ee767b6c8c1ea59ff82e59d7b660c942b75047) | semantic: class static blocks and fields use the class as this | Static fields and blocks see the class as this; native regression. |
+| [2e28260](https://github.com/CanadaHonk/porffor/commit/2e28260bc77048324437e53406c6a7041dba12e0) | fetch: treat null response body as empty | Null Response body becomes empty; native HTTP regression. |
+| [641cd59](https://github.com/CanadaHonk/porffor/commit/641cd5911142d65d7f00d70f39360139349f707c) | builtins: call builtin Symbol directly for well-known symbols | Well-known symbol identity; enables iterator protocols. |
+| [e684407](https://github.com/CanadaHonk/porffor/commit/e68440705a35a2d5e1bee9c67586523f281e80f6) | builtins: add statics to builtin constructors used as values | Builtin constructors used as values retain static methods. |
+| [1e3428e](https://github.com/CanadaHonk/porffor/commit/1e3428e167505f969167f70d1ed0bd3c049256af) | codegen: only type computed string reads with number keys as strings | More accurate computed-string read types; no new API. |
+| [a52e55b](https://github.com/CanadaHonk/porffor/commit/a52e55b59db43170db7831905afb3450c8404d71) | builtins/console: print maps and sets from the hashtable | Console Map/Set formatting follows hashtable representation. |
+| [9579dbb](https://github.com/CanadaHonk/porffor/commit/9579dbb6379617ac8d35dc5177e035b4c6aa7127) | builtins/array: spread sets and maps directly | Map/Set spread; native Set regression. |
+| [fceed9a](https://github.com/CanadaHonk/porffor/commit/fceed9a7f84afc5619da34938f89475f05f7b63d) | builtins: return iterators from array, map, set and string iterator methods | Real collection iterators; native next/done and Map keys regressions. Astral string iteration remains incorrect. |
+| [532d8f8](https://github.com/CanadaHonk/porffor/commit/532d8f85f3961037d2673aaf06fbf008ec57ff07) | builtins/generator: add Symbol.iterator and Symbol.asyncIterator | Generator iterator protocol; infrastructure for iterable libraries. Async generator coverage remains unestablished. |
+| [872edc0](https://github.com/CanadaHonk/porffor/commit/872edc027a220f18baa82edff4166e5e38e9ded3) | builtins/regexp: make matchAll a lazy iterator | Lazy matchAll next/done; native regression. |
+| [64f5299](https://github.com/CanadaHonk/porffor/commit/64f529913c3ea39a162da9516b0371665107347e) | builtins: add Proxy | Proxy implementation; lift source ban and test object/call/construct/revocation behavior. |
+| [2056abb](https://github.com/CanadaHonk/porffor/commit/2056abb1b8c8fad65f50f0ad4b0ccf00f2799150) | repl: force new line | Upstream REPL formatting only. |
+| [905b193](https://github.com/CanadaHonk/porffor/commit/905b193b2d5626fe796dda1290b39f176f4ba191) | builtins/hashtable: allocate the container after its arrays | Allocation ordering fix; exercise Map/Set in native regression. |
+| [1f6959b](https://github.com/CanadaHonk/porffor/commit/1f6959b82c2479a4c003be03d6ac829ccf3f9c7d) | codegen: round half to even in Uint8ClampedArray stores | Uint8ClampedArray ties-to-even stores; native regression. |
+| [8e76e7b](https://github.com/CanadaHonk/porffor/commit/8e76e7b8f0ea64a30974cc116bbe9c9671e7c9f4) | builtins: define builtin $get funcs as accessors | Builtin getters become accessors; typed-array prototype rewrite replaces old generation anchors. |
+| [05199be](https://github.com/CanadaHonk/porffor/commit/05199be91c124f5936c2e40d5164227ddb9b0fb9) | builtins: get builtin constructors via their getters | Builtin constructors are obtained through getters; source patches reviewed. |
+| [79bb578](https://github.com/CanadaHonk/porffor/commit/79bb5789b4fe9d1892ca322be6327984f2d40ca5) | builtins/typedarray: share %TypedArray% and %TypedArray%.prototype | Shared typed-array methods/prototypes; drop from, set-offset and join patches, retain behavioral regressions. |
+| [0a22e14](https://github.com/CanadaHonk/porffor/commit/0a22e1494ddf793fb3bb0c4b0b3740531931f3ef) | codegen: sort builtin proto call cases by type | Codegen case ordering optimization; no new API. |
+| [d5e95d0](https://github.com/CanadaHonk/porffor/commit/d5e95d0a7f91c9cc64b7766980109b8d862b4470) | codegen: only set prototype for plain __proto__ props in object literals | Only plain __proto__ literal keys change prototypes; dictionary semantics improve. |
+| [1b51d58](https://github.com/CanadaHonk/porffor/commit/1b51d58b859741688b87551470d2260606ab9698) | builtins/object: treat __proto__ as a normal key on null prototype objects | Null-prototype __proto__ is an ordinary key; native regression. |
+| [7a6ca5d](https://github.com/CanadaHonk/porffor/commit/7a6ca5d32f56ff7d9b1fbaaf59fafede5a496771) | parser: drop __proto__ scope slot workaround | Removes parser workaround after __proto__ fixes; class self-name patch still needed. |
+| [43087d4](https://github.com/CanadaHonk/porffor/commit/43087d42f0b90d14f04f3cddac034822560aefad) | ci: update expected test262 harness passes | Upstream conformance expectation update; does not establish Sproutboat support. |
+
+## Validation
+
+The isolated release package suite passed 174 tests, and the CLI release suite passed 103. Both release kitchen-sink harnesses passed: 35 broker checks and 38 standalone checks. All 21 small examples passed on alpha-16. Native crypto, Unicode broker round trips and live Web API iterator checks passed. All 32 compatibility fixtures compile and 30 match Bun; the two existing non-ISO date parsing mismatches remain. The full native feature regression is in src/alpha16-native.test.ts; live Web API iterator coverage is in ../runtime/test/native-iterators.ts. The scorecard ties compatibility results to this exact source pin and patch inventory.

package/PORFFOR_SCORECARD.md

@@ -1,29 +1,32 @@
 # Porffor pin scorecard
 
-Pin: alpha-13 (547c7815125b6f02474591950f8b0dd7031a03f0). Compatibility report: 2026-10-01T10:57:31.463Z.
+Pin: alpha-16 (43087d42f0b90d14f04f3cddac034822560aefad). Compatibility report: 2026-10-10T08:51:03.637Z.
 
 | Measure | Result |
 | --- | ---: |
 | Fixtures compiled | 32/32 |
 | Behavior matches | 30/32 |
-| Median / p95 compile, ms | 3212 / 4703 |
-| Median / p95 binary, bytes | 966864 / 999936 |
-| Patch markers | 28 |
-| Upstream files written | 6 |
+| Median / p95 compile, ms | 13266 / 33619 |
+| Median / p95 binary, bytes | 1082960 / 1099536 |
+| Patch markers | 35 |
+| Upstream files written | 9 |
 | Fresh patch application | pass |
 
-Previous snapshot: alpha-10-08ac7ee.json. Matches 30/32 to 30/32; patch markers 27 to 28.
+Previous snapshot: alpha-15-72d048d.json. Matches 30/32 to 30/32; patch markers 38 to 35.
 
 ## Patch inventory
 
-- `compiler/render.js`: PORT_MARKER, CONSOLE_MARKER, BYTESTRING_MARKER, READ_RAW_MARKER, CORO_STACK_MARKER
-- `compiler/index.js`: LINK_MARKER, CFLAGS_MARKER
-- `compiler/builtins/typedarray.js`: TYPED_ARRAY_FROM_MARKER
+- `compiler/render.js`: PORT_MARKER, CONSOLE_MARKER, BYTESTRING_MARKER, READ_RAW_MARKER
+- `compiler/index.js`: LINK_MARKER, CFLAGS_MARKER, FP_CONTRACT_MARKER, HTTP10_IMPORT_MARKER, HTTP10_CALL_MARKER
 - `compiler/builtins/date.ts`: DATE_PARSER_MARKER
-- `compiler/uwebsockets.js`: BODY_MARKER, STATUS_SIG_MARKER, STATUS_303_MARKER, STATUS_DEFAULT_MARKER, HDR_SIG_MARKER, HDR_CALL_MARKER, HDR_CAP_MARKER, HDR_SKIP_MARKER, HDR_APPEND_MARKER, READ_RAW_DECL_MARKER, FORBIDDEN_HDR_MARKER, WRITE_RESPONSE_MARKER, R2_TRANSFER_MARKER, R2_TRANSFER_CALL_MARKER, R2_DOWNLOAD_CACHE_MARKER, R2_RANGE_CACHE_MARKER, R2_CONDITIONAL_CACHE_MARKER, R2_STREAMING_CACHE_MARKER, R2_RANGE_HEADER_CACHE_MARKER
+- `compiler/builtins/promise.ts`: PROMISE_NULL_MARKER
+- `compiler/builtins/string.ts`: REPLACE_ALL_MARKER
+- `compiler/codegen.js`: TA_GET_MARKER, TA_SET_BOUNDS_MARKER
+- `compiler/parse.js`: CLASS_SELF_MARKER
+- `compiler/uwebsockets.js`: HTTP10_SHIM_MARKER, BODY_MARKER, STATUS_SIG_MARKER, STATUS_303_MARKER, STATUS_DEFAULT_MARKER, HDR_SIG_MARKER, HDR_CALL_MARKER, HDR_CAP_MARKER, HDR_SKIP_MARKER, HDR_APPEND_MARKER, READ_RAW_DECL_MARKER, FORBIDDEN_HDR_MARKER, WRITE_RESPONSE_MARKER, R2_TRANSFER_MARKER, R2_TRANSFER_CALL_MARKER, R2_DOWNLOAD_CACHE_MARKER, R2_RANGE_CACHE_MARKER, R2_CONDITIONAL_CACHE_MARKER, R2_STREAMING_CACHE_MARKER, R2_RANGE_HEADER_CACHE_MARKER
 - `compiler/builtins_precompiled.js`: regenerated builtin table
 
-Patch source SHA-256: `6f607ac6b66fc4a51c2bf9e9525d0ab7f4e9b9dd3f942a820bbad46b7e3dbf56`.
+Patch source SHA-256: `65a48b098fb6bd355785684774be43524d31491c89be1f6b0dee17f24b9cdd20`.
 
 ## Known behavior gaps
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/toolchain",
-  "version": "0.4.24",
+  "version": "0.6.0",
   "license": "MIT",
   "type": "module",
   "repository": {

package/scorecards/alpha-15-72d048d.json

@@ -0,0 +1,77 @@
+{
+  "pin": "alpha-15 (72d048d73d49e217631ac8a1bc4fa9070d22fbc9)",
+  "reportGeneratedAt": "2026-10-05T00:30:02.525Z",
+  "fixtures": 32,
+  "compiled": 32,
+  "matched": 30,
+  "medianCompileMs": 420,
+  "p95CompileMs": 822,
+  "medianBinaryBytes": 1033344,
+  "p95BinaryBytes": 1049904,
+  "patchSourceSha256": "849997ab545a760019941886780b3fc70c89b67581cc9acf2b51ca6ff8a37d17",
+  "patchMarkerCount": 38,
+  "patchTargets": {
+    "compiler/render.js": [
+      "PORT_MARKER",
+      "CONSOLE_MARKER",
+      "BYTESTRING_MARKER",
+      "READ_RAW_MARKER"
+    ],
+    "compiler/index.js": [
+      "LINK_MARKER",
+      "CFLAGS_MARKER",
+      "FP_CONTRACT_MARKER",
+      "HTTP10_IMPORT_MARKER",
+      "HTTP10_CALL_MARKER"
+    ],
+    "compiler/builtins/typedarray.js": [
+      "TYPED_ARRAY_FROM_MARKER",
+      "TA_SET_OFFSET_MARKER",
+      "TA_JOIN_MARKER"
+    ],
+    "compiler/builtins/date.ts": [
+      "DATE_PARSER_MARKER"
+    ],
+    "compiler/builtins/promise.ts": [
+      "PROMISE_NULL_MARKER"
+    ],
+    "compiler/builtins/string.ts": [
+      "REPLACE_ALL_MARKER"
+    ],
+    "compiler/codegen.js": [
+      "TA_GET_MARKER",
+      "TA_SET_BOUNDS_MARKER"
+    ],
+    "compiler/parse.js": [
+      "CLASS_SELF_MARKER"
+    ],
+    "compiler/uwebsockets.js": [
+      "HTTP10_SHIM_MARKER",
+      "BODY_MARKER",
+      "STATUS_SIG_MARKER",
+      "STATUS_303_MARKER",
+      "STATUS_DEFAULT_MARKER",
+      "HDR_SIG_MARKER",
+      "HDR_CALL_MARKER",
+      "HDR_CAP_MARKER",
+      "HDR_SKIP_MARKER",
+      "HDR_APPEND_MARKER",
+      "READ_RAW_DECL_MARKER",
+      "FORBIDDEN_HDR_MARKER",
+      "WRITE_RESPONSE_MARKER",
+      "R2_TRANSFER_MARKER",
+      "R2_TRANSFER_CALL_MARKER",
+      "R2_DOWNLOAD_CACHE_MARKER",
+      "R2_RANGE_CACHE_MARKER",
+      "R2_CONDITIONAL_CACHE_MARKER",
+      "R2_STREAMING_CACHE_MARKER",
+      "R2_RANGE_HEADER_CACHE_MARKER"
+    ],
+    "compiler/builtins_precompiled.js": []
+  },
+  "patchApplication": "pass",
+  "mismatches": [
+    "15-date-iso.js: request 3 mismatch: expected {\"status\":200,\"body\":\"2008-03-04T23:00:00.000Z\",\"content-type\":null}, got {\"status\":200,\"body\":\"0003-05-08T00:00:00.000Z\",\"content-type\":null}",
+    "16-date-parts.js: request 3 mismatch: expected {\"status\":200,\"body\":\"{\\\"year\\\":2008,\\\"month\\\":3,\\\"day\\\":4}\",\"content-type\":\"application/json;charset=utf-8\"}, got {\"status\":200,\"body\":\"{\\\"year\\\":3,\\\"month\\\":5,\\\"day\\\":8}\",\"content-type\":\"application/json;charset=utf-8\"}"
+  ]
+}

package/scorecards/alpha-16-43087d4.json

@@ -0,0 +1,72 @@
+{
+  "pin": "alpha-16 (43087d42f0b90d14f04f3cddac034822560aefad)",
+  "reportGeneratedAt": "2026-10-10T08:51:03.637Z",
+  "fixtures": 32,
+  "compiled": 32,
+  "matched": 30,
+  "medianCompileMs": 13266,
+  "p95CompileMs": 33619,
+  "medianBinaryBytes": 1082960,
+  "p95BinaryBytes": 1099536,
+  "patchSourceSha256": "65a48b098fb6bd355785684774be43524d31491c89be1f6b0dee17f24b9cdd20",
+  "patchMarkerCount": 35,
+  "patchTargets": {
+    "compiler/render.js": [
+      "PORT_MARKER",
+      "CONSOLE_MARKER",
+      "BYTESTRING_MARKER",
+      "READ_RAW_MARKER"
+    ],
+    "compiler/index.js": [
+      "LINK_MARKER",
+      "CFLAGS_MARKER",
+      "FP_CONTRACT_MARKER",
+      "HTTP10_IMPORT_MARKER",
+      "HTTP10_CALL_MARKER"
+    ],
+    "compiler/builtins/date.ts": [
+      "DATE_PARSER_MARKER"
+    ],
+    "compiler/builtins/promise.ts": [
+      "PROMISE_NULL_MARKER"
+    ],
+    "compiler/builtins/string.ts": [
+      "REPLACE_ALL_MARKER"
+    ],
+    "compiler/codegen.js": [
+      "TA_GET_MARKER",
+      "TA_SET_BOUNDS_MARKER"
+    ],
+    "compiler/parse.js": [
+      "CLASS_SELF_MARKER"
+    ],
+    "compiler/uwebsockets.js": [
+      "HTTP10_SHIM_MARKER",
+      "BODY_MARKER",
+      "STATUS_SIG_MARKER",
+      "STATUS_303_MARKER",
+      "STATUS_DEFAULT_MARKER",
+      "HDR_SIG_MARKER",
+      "HDR_CALL_MARKER",
+      "HDR_CAP_MARKER",
+      "HDR_SKIP_MARKER",
+      "HDR_APPEND_MARKER",
+      "READ_RAW_DECL_MARKER",
+      "FORBIDDEN_HDR_MARKER",
+      "WRITE_RESPONSE_MARKER",
+      "R2_TRANSFER_MARKER",
+      "R2_TRANSFER_CALL_MARKER",
+      "R2_DOWNLOAD_CACHE_MARKER",
+      "R2_RANGE_CACHE_MARKER",
+      "R2_CONDITIONAL_CACHE_MARKER",
+      "R2_STREAMING_CACHE_MARKER",
+      "R2_RANGE_HEADER_CACHE_MARKER"
+    ],
+    "compiler/builtins_precompiled.js": []
+  },
+  "patchApplication": "pass",
+  "mismatches": [
+    "15-date-iso.js: request 3 mismatch: expected {\"status\":200,\"body\":\"2008-03-04T23:00:00.000Z\",\"content-type\":null}, got {\"status\":200,\"body\":\"0003-05-08T00:00:00.000Z\",\"content-type\":null}",
+    "16-date-parts.js: request 3 mismatch: expected {\"status\":200,\"body\":\"{\\\"year\\\":2008,\\\"month\\\":3,\\\"day\\\":4}\",\"content-type\":\"application/json;charset=utf-8\"}, got {\"status\":200,\"body\":\"{\\\"year\\\":3,\\\"month\\\":5,\\\"day\\\":8}\",\"content-type\":\"application/json;charset=utf-8\"}"
+  ]
+}

package/src/acquire.test.ts

@@ -27,8 +27,14 @@ async function fixture(): Promise<{ archive: string; sha256: string }> {
       "    return 0;\n" +
       "  }\n" +
       "  return -1;\n" +
-      "}\n" +
-      "#define PORF_CORO_STACK_SIZE (256u * 1024u)\n",
+      "}\n",
+    "compiler/parse.js":
+      "import link from './modules.js';\n" +
+      "export default (input) => {\n" +
+      "  const ast = parse(input);\n" +
+      "  if (ast._ts) globalThis.typedInput = Prefs.optTypes;\n" +
+      "  return ast;\n" +
+      "};\n",
     "compiler/index.js":
       "import { hashId } from './modules.js';\n" +
       "      const uwsDir = uwebsockets.ensureUWebSockets();\n" +
@@ -123,8 +129,7 @@ async function fixture(): Promise<{ archive: string; sha256: string }> {
     "compiler/builtins/json.ts": "// sb_json_utf16_v1\n",
     "runtime/fetch-globals.js": "// sb_text_encoder_scalar_v1\n",
     "compiler/codegen.js":
-      "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, f) : Convert(T.u32, f, 0)));\n" +
-      "      return Box(Convert(T.f64, Un('~', T.i32, Convert(T.i32, numValue(toNumeric())))), Const(T.i32, TYPES.number));\n" +
+      "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : toUint32(scope, f)));\n" +
       "  const taGet = (ctype, size, signed = true) => () => {\n" +
       "    const loaded = Load(ctype, taAddr(size), 4);\n" +
       "    const f = ctype === 'f32' || ctype === 'f64' ? loaded : Convert(T.f64, loaded, signed ? CONVERT_SIGNED : 0);\n" +
@@ -220,22 +225,21 @@ test("the default call (no url/expectedSha256 override) never touches the networ
   expect(await readFile(join(dir, "runtime/index.js"), "utf8")).not.toBe("");
   // #242: generated typed-array join/toString keep a plain-array `parts`.
   expect(await readFile(join(dir, "compiler/builtins/typedarray.js"), "utf8")).toContain(
-    ".replaceAll('const parts: ' + name + ' =', 'const parts: any[] =')",
+    "return Porffor.callThis(__Array_prototype_join, out, sep);",
   );
   // #238: TypedArray.prototype.set(source) with no offset copies to index 0.
   expect(await readFile(join(dir, "compiler/builtins/typedarray.js"), "utf8")).toContain(
-    "offset = ecma262.ToIntegerOrInfinity(offset);",
+    "const targetOffsetNum: number = ecma262.ToIntegerOrInfinity(offset);",
   );
-  // #238: ~ wraps (ToInt32), and out-of-range typed-array reads are undefined.
+  // #238: out-of-range typed-array reads are undefined. (The store and `~`
+  // conversions #238 also patched are upstream's own code since alpha-14.)
   const codegen = await readFile(join(dir, "compiler/codegen.js"), "utf8");
-  expect(codegen).toContain("Convert(T.i32, toUint32(scope, numValue(toNumeric())), CONVERT_RANGE_KNOWN | CONVERT_SIGNED)");
   expect(codegen).toContain("Box(f, Const(T.i32, TYPES.number)), valUndefined());");
   // #241: out-of-range typed-array writes are ignored in user code.
   expect(codegen).toContain("if (globalThis.precompile) store();");
-  // #238: integer typed-array stores wrap modulo 2^n instead of saturating.
-  expect(await readFile(join(dir, "compiler/codegen.js"), "utf8")).toContain(
-    "signed ? Convert(T.i32, toUint32(scope, f), CONVERT_RANGE_KNOWN | CONVERT_SIGNED) : toUint32(scope, f)",
-  );
+  // #256: named class expressions inside functions are rewritten at parse time.
+  expect(await readFile(join(dir, "compiler/parse.js"), "utf8")).toContain("sbClassSelf(ast); // sproutboat #256");
+  expect(await readFile(join(dir, "compiler/sb-class-self.js"), "utf8")).toContain("sproutboat #256");
   // #237: replaceAll joins its pieces once instead of a strcat per match.
   expect(await readFile(join(dir, "compiler/builtins/string.ts"), "utf8")).toContain(
     "return Porffor.callThis(__Array_prototype_join, pieces, '');",
@@ -251,7 +255,7 @@ test("the default call (no url/expectedSha256 override) never touches the networ
   expect(await readFile(join(dir, "compiler/builtins/promise.ts"), "utf8")).toContain(
     "if (Porffor.type(value) == Porffor.TYPES.object && value != null) {",
   );
-});
+}, 60_000);
 
 test("a corrupted warm cache is replaced from the verified archive", async () => {
   const { archive, sha256 } = await fixture();

package/src/acquire.ts

@@ -5,7 +5,7 @@ import { homedir } from "node:os";
 import { resolve } from "node:path";
 // @ts-expect-error Bun's file loader supplies a path; see the pinned-commit
 // check below for why this is safe to trust unconditionally.
-import vendoredPorfforArchive from "../vendor/porffor-547c781.tar.gz" with { type: "file" };
+import vendoredPorfforArchive from "../vendor/porffor-43087d4.tar.gz" with { type: "file" };
 import { ensurePorfforPatched } from "./patch";
 import { PORFFOR_ARCHIVE_SHA256, PORFFOR_ARCHIVE_URL, PORFFOR_COMMIT_FULL } from "./pin";
 // Folded into the cache manifest below so a toolchain release that changes

package/src/alpha16-native.test.ts

@@ -0,0 +1,83 @@
+import { expect, test } from "bun:test";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { resolve } from "node:path";
+import { ensurePorffor } from "./acquire";
+
+// Compare native output with Bun, including trap effects and iterator state.
+const program = `
+const target = { x: 1 };
+let calls = 0;
+const proxy = new Proxy(target, {
+  get(t, key, receiver) { calls++; return key === "virtual" ? 7 : Reflect.get(t, key, receiver); },
+  set(t, key, value) { t[key] = value * 2; return true; },
+  has(t, key) { return key === "virtual" || key in t; },
+  deleteProperty(t, key) { delete t[key]; return true; }
+});
+proxy.x = 3;
+console.log(proxy.x, proxy.virtual, calls, "virtual" in proxy);
+delete proxy.x;
+console.log("x" in target);
+const keys = new Proxy({ a: 1 }, {
+  ownKeys() { return ["a"]; },
+  getOwnPropertyDescriptor(t, key) { return Object.getOwnPropertyDescriptor(t, key); }
+});
+console.log(Object.keys(keys).join(","));
+const fn = new Proxy(function (x) { return x + 1; }, {
+  apply(t, self, args) { return t(args[0]) * 2; }
+});
+console.log(fn(3));
+const ctor = new Proxy(function Item(x) { this.x = x; }, {
+  construct(t, args) { return { x: args[0] * 3 }; }
+});
+console.log(new ctor(4).x);
+const revocable = Proxy.revocable({ x: 1 }, {});
+console.log(revocable.proxy.x);
+revocable.revoke();
+try { console.log(revocable.proxy.x); } catch (e) { console.log(e instanceof TypeError); }
+const frozen = Object.freeze({ x: 1 });
+try { console.log(new Proxy(frozen, { get() { return 2; } }).x); } catch (e) { console.log(e instanceof TypeError); }
+const iterator = [1, 2].values();
+console.log(iterator.next().value, iterator.next().value, iterator.next().done);
+console.log(Array.from(new Map([["a", 1], ["b", 2]]).keys()).join(","));
+console.log([...new Set([1, 2, 1])].join(","));
+console.log(Array.from("ab").join(","));
+const matches = "a1a2".matchAll(/a(\\d)/g);
+console.log(matches.next().value[1], matches.next().value[1], matches.next().done);
+console.log(Uint8Array.from({ length: 3 }, (_, i) => i + 1).join("-"));
+const bytes = new Uint8Array(3); bytes.set([4, 5]); console.log(bytes.toString());
+console.log(new Uint8ClampedArray([0.5, 1.5, 2.5, 3.5]).join(","));
+class Static { static value = this; static { this.x = 9; } }
+console.log(Static.value === Static, Static.x);
+const dict = Object.create(null); dict.__proto__ = 5;
+console.log(dict.__proto__, Object.getPrototypeOf(dict) === null);
+let order = "";
+function left() { order += "l"; return 1; }
+function right() { order += "r"; return 2; }
+console.log(left() + right(), order);
+console.log("caffè 東京 🚤");
+`;
+
+test("alpha-16: native Proxy, iterators and upstream fixes match Bun", async () => {
+  const root = await mkdtemp(resolve(tmpdir(), "sb-alpha16-native-"));
+  try {
+    const porffor = await ensurePorffor();
+    const source = resolve(root, "features.js");
+    const binary = resolve(root, "features");
+    await writeFile(source, program);
+    const reference = Bun.spawnSync(["bun", source], { stdout: "pipe", stderr: "pipe" });
+    expect(reference.exitCode).toBe(0);
+    await rm(binary, { force: true });
+    const compile = Bun.spawnSync(["bun", resolve(porffor, "runtime/index.js"), "native", source, "-o", binary, "-s"], {
+      cwd: root, stdout: "pipe", stderr: "pipe",
+    });
+    expect(compile.exitCode, Buffer.from(compile.stderr).toString()).toBe(0);
+    const run = Bun.spawnSync([binary], { stdout: "pipe", stderr: "pipe", timeout: 10_000 });
+    expect(run.exitCode, Buffer.from(run.stderr).toString()).toBe(0);
+    const ansi = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, "g");
+    const output = Buffer.from(run.stdout).toString().replace(ansi, "");
+    expect(output).toBe(Buffer.from(reference.stdout).toString());
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+}, 60_000);

package/src/class-self-native.test.ts

@@ -0,0 +1,43 @@
+import { expect, test } from "bun:test";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { resolve } from "node:path";
+import { ensurePorffor } from "./acquire";
+
+// baronunread/sproutboat#256: inside a function, a named class expression's own
+// name must be the class itself. marked's minified Lexer has exactly this shape.
+const program = `function inner() {
+  var R = class l { constructor(o) { this.o = o || E; } static make(o) { return new l(o); } lex(s) { return s.length; } static lex(s) { return new l().lex(s); } };
+  var E = { d: 1 };
+  var C = class k extends R { lex(s) { return super.lex(s) + 1; } static make() { return new k(); } };
+  var plain = class { static make() { return 7; } };
+  return [R === new R().constructor, R.make().o.d, R.lex("abc"), C.make().lex("ab"), C.name, plain.make()].join(" ");
+}
+async function viaAwait() {
+  var A = class m { static async load() { await null; return new m(); } ok() { return "ok"; } };
+  return (await A.load()).ok();
+}
+console.log(inner());
+viaAwait().then((v) => console.log(v));
+`;
+
+test("#256: a named class expression inside a function sees itself", async () => {
+  const root = await mkdtemp(resolve(tmpdir(), "sb-class-self-"));
+  try {
+    const porffor = await ensurePorffor();
+    const source = resolve(root, "classes.js");
+    const binary = resolve(root, "classes");
+    await writeFile(source, program);
+    const compile = Bun.spawnSync(["bun", resolve(porffor, "runtime/index.js"), "native", source, "-o", binary, "-s"], {
+      cwd: root,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    expect(compile.exitCode, Buffer.from(compile.stderr).toString()).toBe(0);
+    const run = Bun.spawnSync([binary], { stdout: "pipe", stderr: "pipe" });
+    const lines = Buffer.from(run.stdout).toString().replace(/\u001b\[[0-9;]*m/g, "").trim().split("\n");
+    expect(lines).toEqual(["true 1 3 3 k 7", "ok"]);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+}, 60_000);

package/src/patch.test.ts

@@ -36,7 +36,6 @@ int porf_native_fetch_read_value(jsval value, const char** out_buf, size_t* out_
   return -1;
 }
 
-#define PORF_CORO_STACK_SIZE (256u * 1024u)
 #define PORF_CORO_MAX 16384
 `;
 
@@ -294,10 +293,6 @@ test("#165: render.js routes console output to stderr, unbuffered, idempotently"
       "int porf_native_fetch_read_value(jsval value, const char** out_buf, size_t* out_len, char** out_owned) {",
     );
 
-    // #178: fiber stacks big enough for -O0 frames in a few nested awaits.
-    expect(once).toContain("#define PORF_CORO_STACK_SIZE (8u * 1024u * 1024u)");
-    expect(once).not.toContain("(256u * 1024u)");
-
     await patchRenderJs(root);
     expect(await readFile(join(root, "compiler/render.js"), "utf8")).toBe(once);
   } finally {

package/src/patch.ts

@@ -1,7 +1,7 @@
 /**
  * Idempotent, marker-guarded in-place edits to Porffor's generated C
  * (`compiler/render.js`, `compiler/index.js`, `compiler/uwebsockets.js`,
- * `compiler/builtins/typedarray.js`, `compiler/builtins/date.ts`). Run
+ * `compiler/builtins/date.ts`). Run
  * from the build path, not a `postinstall` hook: package managers block
  * dependency lifecycle scripts by default, so a published `postinstall` would
  * silently not run.
@@ -131,24 +131,6 @@ const READ_RAW_INJECT =
   READ_RAW_ANCHOR;
 const READ_RAW_MARKER = "porf_native_fetch_read_raw_bytes(jsval value";
 
-/**
- * baronunread/sproutboat#178: every async function runs on its own fiber
- * stack, and Porffor (alpha-10 through alpha-13) fixes those at 256 KiB. A
- * large handler compiled at -O0 (what `sproutboat dev` builds) spends ~40 KiB
- * of stack per call into the biggest generated functions, so a few nested
- * awaits run off the end into the guard page and the sprout dies with SIGBUS
- * on its first request, no log.
- * -O3 frames are smaller, which only raises the threshold: a deep enough
- * async chain hits it in a release build too.
- *
- * Match a thread's usual 8 MiB. The reservation is MAP_NORESERVE with a guard
- * page, so only touched pages cost memory and a shallow handler pays nothing.
- */
-const CORO_STACK_ANCHOR = "#define PORF_CORO_STACK_SIZE (256u * 1024u)";
-const CORO_STACK_INJECT =
-  "// sproutboat #178: 256 KiB overflows -O0 frames in a few nested awaits.\n" +
-  "#define PORF_CORO_STACK_SIZE (8u * 1024u * 1024u)";
-const CORO_STACK_MARKER = "sproutboat #178";
 
 /**
  * render.js full-block replacements: `[marker, anchor, inject, what]`, each a
@@ -158,7 +140,6 @@ const CORO_STACK_MARKER = "sproutboat #178";
 const RENDER_REPLACEMENTS = [
   [BYTESTRING_MARKER, BYTESTRING_ANCHOR, BYTESTRING_INJECT, "bytestring UTF-8 encoding (#172)"],
   [READ_RAW_MARKER, READ_RAW_ANCHOR, READ_RAW_INJECT, "raw bytestring passthrough function (#176)"],
-  [CORO_STACK_MARKER, CORO_STACK_ANCHOR, CORO_STACK_INJECT, "coroutine stack size (#178)"],
 ] as const;
 
 // #15 — no `--port` flag: Porffor's native-fetch entry point calls
@@ -180,6 +161,95 @@ const LINK_INJECT =
   "        ...(process.env.SB_EXTRA_LINK ? process.env.SB_EXTRA_LINK.split(' ').filter(Boolean) : []),\n";
 const LINK_MARKER = "SB_EXTRA_LINK";
 
+/**
+ * baronunread/sproutboat#256: inside a function, Porffor gives a named class
+ * expression's own name, as seen from its methods, a fresh function object
+ * instead of the class. So `var R = class l { static lex() { return new l() } }`
+ * builds an object with none of the class's methods ("value is not a
+ * constructor"). Top level is fine. Since #238 every handler runs inside a
+ * function, and bundlers emit exactly this shape for classes whose static
+ * members refer to themselves (marked's Lexer and Parser, esbuild's
+ * `class _X`).
+ *
+ * The rewrite keeps the meaning: the name becomes an ordinary const, which
+ * Porffor captures correctly, and `const l = class {}` still names it "l".
+ *
+ *   class l { ... }  ->  (() => { const l = class { ... }; return l; })()
+ *
+ * Only named class expressions inside a function whose body refers to the name.
+ * Skipped when `extends` or a computed key holds await/yield, which an arrow
+ * would change.
+ */
+const CLASS_SELF_HELPER = String.raw`// sproutboat #256: a named class expression's own name inside a function.
+const isFn = (n) => n.type === 'FunctionDeclaration' || n.type === 'FunctionExpression' || n.type === 'ArrowFunctionExpression';
+
+const mentions = (node, name) => {
+  if (node == null || typeof node !== 'object') return false;
+  if (Array.isArray(node)) return node.some((x) => mentions(x, name));
+  if (node.type === 'Identifier') return node.name === name;
+  for (const key in node) {
+    if (key[0] === '_' || key === 'start' || key === 'end' || key === 'loc' || key === 'range') continue;
+    if (mentions(node[key], name)) return true;
+  }
+  return false;
+};
+
+const suspends = (node) => {
+  if (node == null || typeof node !== 'object') return false;
+  if (Array.isArray(node)) return node.some(suspends);
+  if (node.type === 'AwaitExpression' || node.type === 'YieldExpression') return true;
+  if (isFn(node) || node.type === 'ClassExpression' || node.type === 'ClassDeclaration') return false;
+  for (const key in node) {
+    if (key[0] === '_' || key === 'start' || key === 'end' || key === 'loc' || key === 'range') continue;
+    if (suspends(node[key])) return true;
+  }
+  return false;
+};
+
+const rewrite = (cls) => {
+  const name = cls.id.name;
+  const at = { start: cls.start, end: cls.end };
+  const id = () => ({ type: 'Identifier', name, ...at });
+  return {
+    type: 'CallExpression', optional: false, arguments: [], ...at,
+    callee: {
+      type: 'ArrowFunctionExpression', id: null, params: [], async: false, generator: false, expression: false, ...at,
+      body: {
+        type: 'BlockStatement', ...at,
+        body: [
+          { type: 'VariableDeclaration', kind: 'const', ...at, declarations: [
+            { type: 'VariableDeclarator', id: id(), init: { ...cls, id: null }, ...at },
+          ] },
+          { type: 'ReturnStatement', argument: id(), ...at },
+        ],
+      },
+    },
+  };
+};
+
+const walk = (node, inFn) => {
+  if (node == null || typeof node !== 'object') return node;
+  if (Array.isArray(node)) {
+    for (let i = 0; i < node.length; i++) node[i] = walk(node[i], inFn);
+    return node;
+  }
+  const childInFn = inFn || isFn(node);
+  for (const key in node) {
+    if (key[0] === '_' || key === 'start' || key === 'end' || key === 'loc' || key === 'range') continue;
+    const value = node[key];
+    if (value && typeof value === 'object') node[key] = walk(value, childInFn);
+  }
+  if (
+    inFn && node.type === 'ClassExpression' && node.id?.name &&
+    mentions(node.body, node.id.name) &&
+    !suspends(node.superClass) && !node.body.body.some((m) => m.computed && suspends(m.key))
+  ) return rewrite(node);
+  return node;
+};
+
+export default (ast) => (globalThis.precompile ? ast : walk(ast, false));
+`;
+
 /**
  * #15 — and the same for the compile step, so the prelude's inline C can
  * `#include <bearssl.h>`. The link patch alone is not enough: Porffor's
@@ -291,30 +361,6 @@ const REPLACE_ALL_EDITS = [
 ] as const;
 const REPLACE_ALL_MARKER = "sproutboat #237: pieces joined once";
 
-// baronunread/sproutboat#238: an integer typed-array element store converted
-// its value with a saturating f64 -> int Convert, so a negative value stored
-// into a Uint32Array became 0 and 4e9 into an Int32Array became 2147483647.
-// ECMA-262 (IntegerIndexedElementSet -> ToUint32 / ToInt32 / ToUint16 ...) wraps
-// modulo 2^n instead. noble-hashes' SHA-256 stores `x | 0` into a Uint32Array,
-// so every negative schedule word was zeroed and the digest came out wrong.
-// Route the store through codegen's own modular toUint32 (what bitwise ops use);
-// narrower stores keep the low bits, which is exactly the modular result.
-const TA_STORE_ANCHOR =
-  "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, f) : Convert(T.u32, f, 0)));";
-const TA_STORE_INJECT =
-  "      // sproutboat #238: typed-array stores wrap modulo 2^n (ToUint32), not saturate.\n" +
-  "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, toUint32(scope, f), CONVERT_RANGE_KNOWN | CONVERT_SIGNED) : toUint32(scope, f)));";
-const TA_STORE_MARKER = "sproutboat #238: typed-array stores wrap";
-// baronunread/sproutboat#238: unary `~` had the same saturating conversion, so
-// ~x for x >= 2^31 (or ~~x, the common truncation idiom) clamped to
-// +/-2147483648, and ~Infinity gave -2147483648 instead of -1. uuid's SHA-1
-// computes `x & y ^ ~x & z` on words above 2^31, so every v5 UUID was wrong.
-const BITNOT_ANCHOR =
-  "      return Box(Convert(T.f64, Un('~', T.i32, Convert(T.i32, numValue(toNumeric())))), Const(T.i32, TYPES.number));";
-const BITNOT_INJECT =
-  "      // sproutboat #238: ~ applies ToInt32 (wrap modulo 2^32), not a saturating cast.\n" +
-  "      return Box(Convert(T.f64, Un('~', T.i32, Convert(T.i32, toUint32(scope, numValue(toNumeric())), CONVERT_RANGE_KNOWN | CONVERT_SIGNED))), Const(T.i32, TYPES.number));";
-const BITNOT_MARKER = "sproutboat #238: ~ applies ToInt32";
 // baronunread/sproutboat#238: typed-array element reads and writes had no
 // bounds check. A read past the end returned whatever sat in the next
 // allocation instead of undefined (uuid's SHA-1 reads past its buffer, so v5
@@ -350,12 +396,13 @@ const TA_GET_MARKER = "sproutboat #238: only a valid in-range integer index read
 // whatever memory followed it (and a[-1] = x wrote a[0], via the saturating
 // index conversion). ECMA-262 ignores the write. Same check as taGet, in user
 // code only: builtins such as the constructor store elements before they set
-// the length, and they only write in bounds anyway. Applies after TA_STORE,
-// whose output line is the anchor.
+// the length, and they only write in bounds anyway. Alpha-14 fixed the store's
+// conversion upstream (ToUint32, which our #238 patch used to add); the bounds
+// check is still missing there.
 const TA_SET_BOUNDS_ANCHOR =
-  "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, toUint32(scope, f), CONVERT_RANGE_KNOWN | CONVERT_SIGNED) : toUint32(scope, f)));";
+  "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : toUint32(scope, f)));";
 const TA_SET_BOUNDS_INJECT =
-  "      const store = () => stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, toUint32(scope, f), CONVERT_RANGE_KNOWN | CONVERT_SIGNED) : toUint32(scope, f)));\n" +
+  "      const store = () => stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : toUint32(scope, f)));\n" +
   "      // sproutboat #241: a write outside the array is ignored, not stored into the next allocation.\n" +
   "      if (globalThis.precompile) store();\n" +
   "      else {\n" +
@@ -364,50 +411,6 @@ const TA_SET_BOUNDS_INJECT =
   "      }";
 const TA_SET_BOUNDS_MARKER = "sproutboat #241: a write outside the array is ignored";
 
-// baronunread/sproutboat#238: TypedArray.prototype.set(source) with no offset
-// ran `offset = Math.trunc(undefined)`, which is NaN. The same-type fast path
-// then copied to `base + NaN * BYTES_PER_ELEMENT`: nothing landed where it
-// should (noble's HMAC lost its key in `pad.set(key)`), and the write went
-// somewhere else in memory. ECMA-262 uses ToIntegerOrInfinity, which maps
-// undefined and NaN to 0; subarray right below already does.
-const TA_SET_OFFSET_ANCHOR = "  offset = Math.trunc(offset);\n  if (Porffor.fastOr(offset < 0, offset > len)) throw new RangeError('Offset out of bounds');";
-const TA_SET_OFFSET_INJECT =
-  "  offset = ecma262.ToIntegerOrInfinity(offset); // sproutboat #238: undefined offset is 0, not NaN\n  if (Porffor.fastOr(offset < 0, offset > len)) throw new RangeError('Offset out of bounds');";
-const TA_SET_OFFSET_MARKER = "sproutboat #238: undefined offset is 0";
-
-// baronunread/sproutboat#242: typedarray.js generates each TypedArray method
-// from array.ts with `.replaceAll('any[]', name)`. That also retyped join's and
-// toString's internal `const parts: any[]` helper as e.g. a Uint8Array, so the
-// joined strings were stored into a "typed array": Uint8Array join returned
-// garbage and Uint16Array join crashed. Put `parts` back to a plain array after
-// the replacement; map/filter's intentionally typed `out` is untouched.
-const TA_JOIN_ANCHOR = ".replaceAll('Array', name).replaceAll('any[]', name) + '\\n\\n'";
-const TA_JOIN_INJECT =
-  ".replaceAll('Array', name).replaceAll('any[]', name).replaceAll('const parts: ' + name + ' =', 'const parts: any[] =') /* sproutboat #242 */ + '\\n\\n'";
-const TA_JOIN_MARKER = "sproutboat #242";
-
-// Porffor's TypedArray.from only handles iterables. An array-like input such
-// as { length: 16 } silently becomes an empty typed array, including HMAC
-// keys made with Uint8Array.from({ length: 16 }, mapFn). The compiler uses a
-// precompiled builtin table, so the edited source must be precompiled again.
-const TYPED_ARRAY_FROM_ANCHOR =
-  "    len = i;\n  }\n\n  arr.length = len;\n\n  return new ${name}(arr);\n};";
-const TYPED_ARRAY_FROM_INJECT =
-  "    len = i;\n" +
-  "  } else {\n" +
-  "    // sproutboat: TypedArray.from accepts array-like objects.\n" +
-  "    let count = ecma262.ToIntegerOrInfinity(Porffor.object.get(arg, 'length'));\n" +
-  "    if (count < 0) count = 0;\n" +
-  "    if (count > 2147483643) throw new RangeError('Invalid TypedArray length (over maximum supported length)');\n" +
-  "    if (Porffor.type(mapFn) != Porffor.TYPES.undefined && Porffor.type(mapFn) != Porffor.TYPES.function)\n" +
-  "      throw new TypeError('Called TypedArray.from with a non-function mapFn');\n" +
-  "    for (let i: i32 = 0; i < count; i++) {\n" +
-  "      arr[i] = Porffor.type(mapFn) == Porffor.TYPES.undefined ? arg[i] : mapFn(arg[i], i);\n" +
-  "    }\n" +
-  "    len = count;\n" +
-  "  }\n\n  arr.length = len;\n\n  return new ${name}(arr);\n};";
-const TYPED_ARRAY_FROM_MARKER = "sproutboat: TypedArray.from accepts array-like objects";
-
 // Porffor alpha 9 treats +02:00 as two milliseconds and adds offset hours
 // instead of subtracting them. Count fields even when they contain zero, and
 // apply the signed offset after parsing the local wall-clock fields.
@@ -459,8 +462,12 @@ const DATE_PARSER_INJECT = `  // sproutboat: ISO timezone offset
   const endPtr: i32 = Porffor.IR.ptr(string) + len;
   let ptr: i32 = Porffor.IR.ptr(string);
 
+  // Loop once past the last character to flush the final number, but read a
+  // 0 there, not the byte after the string: if that byte happened to be '+' or
+  // '-' it flipped the offset's sign.
   while (ptr <= endPtr) {
-    const chr: i32 = Porffor.IR.loadU8(ptr++, 4);
+    const chr: i32 = ptr < endPtr ? Porffor.IR.loadU8(ptr, 4) : 0;
+    ptr++;
     if (Porffor.fastAnd(chr >= 48, chr <= 57)) {
       n = n * 10 + chr - 48;
       digits++;
@@ -1132,6 +1139,28 @@ export async function patchUwebsockets(root: string): Promise<void> {
   if (changed) await writeFile(file, src);
 }
 
+const CLASS_SELF_IMPORT_ANCHOR = "import link from './modules.js';";
+const CLASS_SELF_IMPORT_INJECT = "import link from './modules.js';\nimport sbClassSelf from './sb-class-self.js';";
+const CLASS_SELF_CALL_ANCHOR = "  if (ast._ts) globalThis.typedInput = Prefs.optTypes;";
+const CLASS_SELF_CALL_INJECT = "  sbClassSelf(ast); // sproutboat #256\n  if (ast._ts) globalThis.typedInput = Prefs.optTypes;";
+const CLASS_SELF_MARKER = "sproutboat #256";
+
+/** #256 — see CLASS_SELF_HELPER. */
+export async function patchClassSelfName(root: string): Promise<void> {
+  await writeFile(resolve(root, "compiler/sb-class-self.js"), CLASS_SELF_HELPER);
+  const file = resolve(root, "compiler/parse.js");
+  let src = await readFile(file, "utf8");
+  if (src.includes(CLASS_SELF_MARKER)) return;
+  for (const [anchor, what] of [
+    [CLASS_SELF_IMPORT_ANCHOR, "import"],
+    [CLASS_SELF_CALL_ANCHOR, "call"],
+  ] as const) {
+    if (!src.includes(anchor)) throw new Error(`could not patch Porffor's class self-name rewrite (${what}): anchor not found in ${file}`);
+  }
+  src = src.replace(CLASS_SELF_IMPORT_ANCHOR, CLASS_SELF_IMPORT_INJECT).replace(CLASS_SELF_CALL_ANCHOR, CLASS_SELF_CALL_INJECT);
+  await writeFile(file, src);
+}
+
 async function patchCompilerArgs(root: string): Promise<void> {
   await writeFile(resolve(root, "compiler/sb-http10.js"), HTTP10_HELPER);
   const file = resolve(root, "compiler/index.js");
@@ -1176,7 +1205,7 @@ export async function patchDateParser(root: string): Promise<void> {
   await writeFile(file, src.slice(0, start) + parser.replace(DATE_PARSER_ANCHOR, DATE_PARSER_INJECT) + src.slice(end));
 }
 
-/** #168: keep a promise resolving to null out of the `then` probe. Precompiled by patchTypedArrayFrom. */
+/** #168: keep a promise resolving to null out of the `then` probe. */
 export async function patchPromiseResolveNull(root: string): Promise<void> {
   const file = resolve(root, "compiler/builtins/promise.ts");
   const src = await readFile(file, "utf8");
@@ -1186,7 +1215,7 @@ export async function patchPromiseResolveNull(root: string): Promise<void> {
   await writeFile(file, src.replace(PROMISE_NULL_ANCHOR, PROMISE_NULL_INJECT));
 }
 
-/** #237: linear String.prototype.replaceAll. Precompiled by patchTypedArrayFrom. */
+/** #237: linear String.prototype.replaceAll. Precompiled by precompileBuiltins. */
 export async function patchReplaceAll(root: string): Promise<void> {
   const file = resolve(root, "compiler/builtins/string.ts");
   let src = await readFile(file, "utf8");
@@ -1209,8 +1238,6 @@ export async function patchTypedArrayStore(root: string): Promise<void> {
   let src = await readFile(file, "utf8");
   let changed = false;
   for (const [marker, anchor, inject, what] of [
-    [TA_STORE_MARKER, TA_STORE_ANCHOR, TA_STORE_INJECT, "typed-array store conversion"],
-    [BITNOT_MARKER, BITNOT_ANCHOR, BITNOT_INJECT, "bitwise NOT conversion"],
     [TA_GET_MARKER, TA_GET_ANCHOR, TA_GET_INJECT, "typed-array read bounds"],
     [TA_SET_BOUNDS_MARKER, TA_SET_BOUNDS_ANCHOR, TA_SET_BOUNDS_INJECT, "typed-array write bounds"],
   ] as const) {
@@ -1222,27 +1249,8 @@ export async function patchTypedArrayStore(root: string): Promise<void> {
   if (changed) await writeFile(file, src);
 }
 
-export async function patchTypedArrayFrom(root: string): Promise<void> {
-  const file = resolve(root, "compiler/builtins/typedarray.js");
-  const src = await readFile(file, "utf8");
-  if (!src.includes(TYPED_ARRAY_FROM_MARKER) && !src.includes(TYPED_ARRAY_FROM_ANCHOR)) {
-    throw new Error(`could not patch Porffor's TypedArray.from: anchor not found in ${file}`);
-  }
-  let edited = src;
-  if (!edited.includes(TYPED_ARRAY_FROM_MARKER)) edited = edited.replace(TYPED_ARRAY_FROM_ANCHOR, TYPED_ARRAY_FROM_INJECT);
-  if (!edited.includes(TA_JOIN_MARKER)) {
-    if (!edited.includes(TA_JOIN_ANCHOR))
-      throw new Error(`could not patch Porffor's typed-array method generator: anchor not found in ${file}`);
-    edited = edited.replace(TA_JOIN_ANCHOR, TA_JOIN_INJECT);
-  }
-  if (!edited.includes(TA_SET_OFFSET_MARKER)) {
-    if (!edited.includes(TA_SET_OFFSET_ANCHOR))
-      throw new Error(`could not patch Porffor's TypedArray.prototype.set offset: anchor not found in ${file}`);
-    edited = edited.replace(TA_SET_OFFSET_ANCHOR, TA_SET_OFFSET_INJECT);
-  }
-  if (edited !== src) await writeFile(file, edited);
+export async function precompileBuiltins(root: string): Promise<void> {
   const table = resolve(root, "compiler/builtins_precompiled.js");
-  const before = await readFile(table);
   // Porffor only writes the table when import.meta.url matches argv[1].
   // macOS's /var -> /private/var symlink makes a noncanonical argv[1] skip it.
   const precompile = await realpath(resolve(root, "compiler/precompile.js"));
@@ -1256,9 +1264,8 @@ export async function patchTypedArrayFrom(root: string): Promise<void> {
     new Response(child.stdout).text(),
     new Response(child.stderr).text(),
   ]);
-  if (code !== 0) throw new Error(`could not precompile Porffor's TypedArray.from: ${stderr || stdout}`);
-  if (edited !== src && before.equals(await readFile(table)))
-    throw new Error(`Porffor precompile did not update ${table}`);
+  if (code !== 0) throw new Error(`could not precompile Porffor's patched builtins: ${stderr || stdout}`);
+  if ((await readFile(table)).length === 0) throw new Error(`Porffor precompile produced an empty ${table}`);
 }
 
 /** The native-fetch server source: $PORT support + the #165 console sink. Exported for tests. */
@@ -1305,6 +1312,7 @@ export async function patchRenderJs(root: string): Promise<void> {
 export async function ensurePorfforPatched(root: string): Promise<void> {
   if (done.has(root)) return;
   await patchCompilerArgs(root);
+  await patchClassSelfName(root);
   await patchUwebsockets(root);
   await patchRenderJs(root);
   await patchDateParser(root);
@@ -1313,7 +1321,7 @@ export async function ensurePorfforPatched(root: string): Promise<void> {
   await patchTypedArrayStore(root);
   // Last of the builtin edits: its precompile picks up the date, promise and
   // replaceAll patches above too.
-  await patchTypedArrayFrom(root);
+  await precompileBuiltins(root);
   await patchUnicode(root);
   done.add(root);
 }

package/src/pin.ts

@@ -11,14 +11,14 @@
  * uWebSockets archive in `sproutboat-cli/vendor/` — then run both repos'
  * test + conformance suites. See sproutboat-cli/MIGRATION.md.
  */
-export const PORFFOR_CHANNEL = "alpha-13";
-export const PORFFOR_COMMIT_FULL = "547c7815125b6f02474591950f8b0dd7031a03f0";
+export const PORFFOR_CHANNEL = "alpha-16";
+export const PORFFOR_COMMIT_FULL = "43087d42f0b90d14f04f3cddac034822560aefad";
 export const PORFFOR_COMMIT = PORFFOR_COMMIT_FULL.slice(0, 7);
 export const PORFFOR_ARCHIVE_SHA256 =
-  "d0ff4bf7778f85445ff99bb8f6b2e07f2b83a33a109612f9eba6f2e5cba291b5";
+  "84398fd214183801d252a78e69a44fac1baeba7cafc7dbbcfd5c6ec3b0372032";
 export const PORFFOR_ARCHIVE_URL = `https://codeload.github.com/CanadaHonk/porffor/tar.gz/${PORFFOR_COMMIT_FULL}`;
 
-/** A compact identity string for a manifest / report (`alpha-13 (547c781)`). */
+/** A compact identity string for a manifest / report (`alpha-16 (43087d4)`). */
 export function porfforVersion(): string {
   return process.env.PORFFOR_VERSION || `${PORFFOR_CHANNEL} (${PORFFOR_COMMIT})`;
 }