wasm-idle 1.0.0-next.0 → 1.0.0

package/README.md

@@ -2,12 +2,18 @@
 
 ![wasm-idle](static/image.jpeg)
 
-Executes C, C++, Python, Java, Rust, Go, D, C#, F#, VB.NET, Elixir, Erlang, Prolog,
-Gleam, Perl, Tcl, AWK, Pascal, Forth, J, BQN, Janet, Julia, Nim, Bash, ClojureScript, TinyGo, OCaml, JavaScript, TypeScript,
+Executes C, C++, Objective-C, Fortran, COBOL, Python, Java, Rust, Go, D, C#, F#, VB.NET, Elixir, Erlang, Prolog,
+Gleam, Perl, Tcl, AWK, Pascal, Forth, J, BQN, Janet, Julia, Nim, Bash, ClojureScript, OCaml, JavaScript, TypeScript,
 AssemblyScript, WAT, WASM, Lua, Zig, Scheme, Ruby, Haskell, R, Octave, SQLite, DuckDB,
 and PHP code.
 
-Refer to src/lib/clang.
+Experimental LFortran execution is available separately from f2c Fortran; see
+[the LFortran consumer contract and local setup](docs/lfortran.md).
+
+The browser-side C-family host is provided by [`@wasm-idle/llvm-core`](packages/llvm-core).
+Compiler source pins, patches, and reproducible asset builds live in
+[`seo-rii/wasm-llvm`](https://github.com/seo-rii/wasm-llvm); wasm-idle loads the generated
+artifacts from external URLs instead of embedding them in npm packages.
 
 ## Language support policy
 
@@ -21,17 +27,18 @@ documented stdin limitation, is covered by tests.
 
 All execution entries run in the browser through real runtime, compiler, or interpreter
 implementations. `Editor support` lists browser LSP/compiler diagnostics when wired; `syntax`
-means Monaco syntax highlighting only. `Debug` means wasm-idle's trace/debug controls, not a
-native debugger.
+means Monaco syntax highlighting only. C, C++, and `wasm32-wasip1` Rust use the browser LLDB/WAMR
+debug runtime; the remaining debug-enabled languages retain wasm-idle's trace controls.
 
 | Language       | Browser runtime/compiler                | Stdin | Editor support       | Debug |
 | -------------- | --------------------------------------- | ----- | -------------------- | ----- |
-| C              | @wasm-idle/llvm-core / Clang WASI       | Yes   | clangd               | Trace |
-| C++            | @wasm-idle/llvm-core / Clang WASI       | Yes   | clangd               | Trace |
+| C3             | C3 0.8.3 + LLVM/lld WASM (byte ABI)     | Yes   | compiler diagnostics | -     |
+| C              | @wasm-idle/llvm-core / Clang WASI       | Yes   | clangd               | LLDB  |
+| C++            | @wasm-idle/llvm-core / Clang WASI       | Yes   | clangd               | LLDB  |
 | Objective-C    | GNUstep libobjc2 + @wasm-idle/llvm-core | Yes   | clangd               | Trace |
 | Python         | Pyodide                                 | Yes   | Python LSP           | Trace |
 | Java           | TeaVM                                   | Yes   | syntax               | -     |
-| Rust           | wasm-rust / browser rustc               | Yes   | rustc diagnostics    | Trace |
+| Rust           | wasm-rust / browser rustc               | Yes   | rustc diagnostics    | LLDB  |
 | Go             | wasm-go / browser Go compiler           | Yes   | compiler diagnostics | Trace |
 | D              | wasm-d                                  | Yes   | syntax               | -     |
 | C#             | wasm-dotnet                             | Yes   | compiler diagnostics | -     |
@@ -49,7 +56,7 @@ native debugger.
 | J              | J playground WASM worker                | Yes   | syntax               | -     |
 | BQN            | CBQN WASM worker                        | Yes   | syntax               | -     |
 | Janet          | Janet VM WASM worker                    | Yes   | syntax               | -     |
-| Julia          | Julia 1.0.4 WASM worker                 | Yes   | syntax               | -     |
+| Julia          | Julia 1.3.0-DEV.560 legacy WASM worker  | Yes   | syntax               | -     |
 | Nim            | Nim 2.2.4 WASM + clang/lld WASM         | Yes   | syntax               | -     |
 | Bash           | GNU Bash WASIX / Wasmer SDK             | Yes   | syntax               | -     |
 | ClojureScript  | cljs.js self-hosted compiler            | Yes   | syntax               | -     |
@@ -65,6 +72,7 @@ native debugger.
 | Scheme         | Puppy Scheme / wasm-lisp                | Yes   | syntax               | -     |
 | Ruby           | CRuby WASI                              | Yes   | syntax               | -     |
 | Haskell        | ghc-in-browser                          | Yes   | syntax               | -     |
+| LFortran       | LFortran LLVM evaluator (experimental)  | Yes   | compiler diagnostics | -     |
 | Fortran        | f2c + @wasm-idle/llvm-core              | Yes   | Fortran LSP          | -     |
 | COBOL          | GnuCOBOL 3.2 + @wasm-idle/llvm-core     | Yes   | syntax               | -     |
 | R              | WebR                                    | Yes   | syntax               | -     |
@@ -73,6 +81,133 @@ native debugger.
 | SQLite         | sql.js                                  | n/a   | syntax               | -     |
 | PHP            | PHP 8.4 / php-wasm                      | Yes   | syntax               | -     |
 
+## Browser LLDB debug runtime
+
+Normal execution still compiles and instantiates the user module with the browser WebAssembly
+engine and the existing WASI host. C, C++, and `wasm32-wasip1` Rust debug sessions use a separate,
+lazy-loaded path:
+
+```text
+Monaco / debug UI
+  ↕ DAP over a SharedArrayBuffer byte stream
+LLDB worker (ProcessWasm + DWARF)
+  ↕ GDB RSP over a separate SharedArrayBuffer byte stream
+WAMR target worker (classic interpreter + source-debug stub)
+  ↕
+program.wasm + embedded DWARF + WASI
+```
+
+The compiler writes stable `/workspace/...` paths and embedded DWARF at `-O0`. The target is loaded
+before LLDB attaches; breakpoints and `configurationDone` are completed before WAMR starts the
+guest. Program output, input, lifecycle control, DAP, and RSP use separate logical streams.
+Breakpoints are retained per source path, so switching between C/C++ workspace files does not leak
+line numbers into another file and changes made while compilation is in flight are applied when the
+debug target connects.
+`@wasm-idle/debug` remains a code-only UI/adapter package, while
+`@wasm-idle/llvm-core/debug` owns the browser session and `wasm-llvm` owns the pinned LLDB/WAMR
+producers and binary manifests.
+
+Debugging requires `SharedArrayBuffer` and a cross-origin-isolated deployment. Because verified
+runtime bytes are executed through Blob-backed ES modules and nested pthread Workers, the deployed
+Content Security Policy's `script-src`, `worker-src`, and `connect-src` must permit `blob:`. The
+LLDB and WAMR assets are not downloaded until a supported debug session starts. The bundled raw manifest is
+checked against its release receipt before parsing, and custom runtime locations must provide an
+explicit expected manifest SHA-256. The six executable assets are then streamed, bounded, and
+hash-verified exactly once before their owned bytes are transferred to the Workers. Workers do not
+re-fetch executable runtime URLs. Clean Pages builds fetch the exact pinned producer revision and
+manifest receipt through the shared release profile before the application build. The deployment
+refuses publication when any logical LLDB/WAMR asset is missing or mismatched after re-verifying
+raw or compressed logical bytes. If transactional publication cannot safely restore or identify an
+owned generation, its `.wasm-debug.next-*` and `.wasm-debug.previous-*` recovery artifacts are
+preserved for operator inspection. Later synchronization and the final Pages verifier fail closed
+until those artifacts (or a leftover `.wasm-debug.sync.lock*`) are manually inspected and resolved;
+they are never silently deleted or published. This build-time preparation does not change lazy browser loading:
+clients fetch the debugger payload only when a supported debug session starts. If the LLDB manifest
+is absent, invalid, or does not advertise
+the required breakpoint/step/stack/local capabilities, the
+playground labels that run as a trace fallback and keeps the existing instrumentation debugger
+available. LLDB-designated browser fixtures reject trace fallback, while a separate missing-asset
+fixture qualifies the pre-session trace alternative. Build and verify both producers
+using [`producer/lldb-browser`](../wasm-llvm/producer/lldb-browser) and
+[`producer/wamr-browser`](../wasm-llvm/producer/wamr-browser), then assemble them with the Clang
+release:
+
+Stable v1 is release-qualified on 64-bit desktop Chromium on Linux. It supports one active debug
+session for `wasm32-wasi` Preview 1 C/C++ and `wasm32-wasip1` Rust artifacts produced by the
+pinned toolchains at `-O0` with embedded DWARF. Debug starts a new, single-threaded WAMR classic
+interpreter instance; it does not attach to a browser-engine run or preserve that run's live state,
+and runtime-specific behavior can differ. Trace fallback is selected only before an LLDB session is
+established; an LLDB or WAMR failure ends that session instead of silently changing debugger
+semantics.
+
+Stable v2 inherits that exact release boundary: 64-bit desktop Chromium on Linux, a
+cross-origin-isolated deployment, one active session, pinned C/C++ and `wasm32-wasip1` Rust
+producer artifacts at `-O0` with embedded DWARF, and a new WAMR debug execution rather than an
+attachment to an existing browser-engine run. DAP is an internal product protocol boundary; v2
+does not claim compatibility with arbitrary third-party DAP clients or arbitrary externally
+produced Wasm/DWARF artifacts.
+
+Pause is bounded but is not guaranteed to yield an inspectable stop while WAMR is blocked in a
+synchronous host call. In particular, a synchronous WAMR stdin read may time out instead of
+producing an inspectable pause. After that explicit timeout, **Stop Debug** still performs bounded
+Worker cleanup and permits a fresh debug execution; the session never remains indefinitely pending.
+
+Stable v2 adds bounded variable-path watches and a paused-target memory inspector.
+Watch fallback accepts identifiers, nested fields, and non-negative indexes without enabling general
+expression evaluation. The memory panel can select a variable's DAP `memoryReference`, reads at most
+256 bytes per request, pages by the selected byte count, renders hexadecimal/ASCII data and unreadable
+bytes as `??`, and discards a response when the target resumes or the selected frame changes. While
+paused, it also accepts 1–256 two-digit hexadecimal bytes for a raw target-memory write and refreshes
+the displayed range after a successful write. This edits memory only; it does not provide typed
+`setVariable` semantics, validate that a value is safe for the guest, or preserve the mutation after
+restart. The complete UI write path is qualified in real Chromium with `wasm32-wasi` C/C++ and
+`wasm32-wasip1` Rust programs.
+While paused, the same panel can install one session-scoped LLDB data breakpoint over a 1–256 byte
+memory range. The browser gate qualifies `wasm32-wasi` C write, C++ read/write, and
+`wasm32-wasip1` Rust read access. Setting a new data breakpoint replaces the previous set, and
+**Clear** sends an empty replacement set to the target. Its opaque DAP data ID is never persisted
+across restart or a new debug execution. Because WAMR reports a completed memory access, the stopped
+source location can be the next executable line after the watched instruction.
+If a replacement or clear request times out, is rejected, or returns malformed DAP data, the debug
+execution stops and disposes both Workers so the UI cannot continue with an uncertain watchpoint
+set; **Restart Debug** then starts a clean execution. A successful but unverified replacement remains
+nonfatal and is reported as unverified.
+The Chromium qualification includes an indexed one-byte watched subrange that overlaps a four-byte scalar store.
+LLDB uses modify semantics for write mode: a write data breakpoint stops when at least one watched byte changes;
+a same-value store is reported by WAMR but automatically resumed by LLDB.
+Data breakpoints cover scalar classic-interpreter loads and stores only.
+Bulk-memory operations and host-side memory writes do not trigger data breakpoints; guest threads
+and memories outside the supported linear-memory configuration remain out of scope. Trace fallback
+does not advertise or emulate data breakpoints.
+The v2 **Restart Debug** action fully disposes the active LLDB and WAMR Workers, waits for the old
+execution to settle, and launches a fresh debug execution from the current workspace. It does not
+preserve target state or advertise the DAP `restart` capability.
+
+Full expression evaluation, conditional/log breakpoints, typed variable mutation through DAP
+`setVariable`, DAP in-session restart, standalone terminate, optimized-debug guarantees, C++
+exception support, STL pretty-printers, `wasm64`, guest threads, reverse debugging, SIMD,
+multi-module guests, and Rust WASI Preview 2/3 debugging remain outside the supported boundary.
+
+```sh
+cd ../wasm-llvm
+WASM_LLVM_LLDB_ARTIFACT_DIR=/path/to/lldb-artifacts \
+WASM_LLVM_WAMR_ARTIFACT_DIR=/path/to/wamr-artifacts \
+pnpm prepare:clang-release
+
+cd ../wasm-idle
+WASM_RUST_PRODUCER_OUTPUT_ROOT=/path/to/rust-producer-output \
+pnpm --dir runtimes/wasm-rust build:producer
+pnpm sync:wasm-rust
+pnpm sync:wasm-debug ../wasm-llvm/out/clang-browser
+WASM_IDLE_BROWSER_SERVER_MODE=dev pnpm test:browser:debug:lldb
+```
+
+The synchronized manifest rejects missing hashes, incompatible Clang/LLDB revisions, and stale
+worker sidecars. The strict browser test covers real C, C++, and Rust breakpoint, step, output, and
+termination paths and rejects trace fallback or a missing debug asset. The Rust producer build is
+required for LLDB metadata; the historical split-runtime build intentionally lacks exact compiler
+provenance and is rejected instead of starting a potentially incompatible debugger.
+
 ### Runtime details
 
 `Package/version base` names the deployed static module or manifest and its producer package,
@@ -83,54 +218,56 @@ targets and flags wasm-idle applies, plus the public per-run options that change
 `Customization` lists the `runtimeAssets` fields and matching `PUBLIC_WASM_*` env overrides
 when they exist.
 
-| Language / IDs                     | Package/version base                                                                                                                                                           | Execution defaults / flags                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | Customization                                                                                                                                                                                                                                                                                                                       |
-| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| C<br>`C`                           | @wasm-idle/llvm-core@1.0.0-next.0 / Clang 22.1.8 WASI sysroot from the `wasm-llvm` producer                                                                                    | `clang` for `wasm32-wasi`; default `-std=gnu11`; native gzip delivery for compiler Wasm and sysroot tar assets; trace debug uses wasm-idle controls; WASI preview1 execution supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                         | `runtimeAssets.clang.baseUrl`/`loader` or `rootUrl`; `compileArgs`, `programArgs`, `cVersion`, `activePath`, `workspaceFiles`, `debug`, `breakpoints`, `pauseOnEntry`                                                                                                                                                               |
-| C++<br>`CPP`                       | @wasm-idle/llvm-core@1.0.0-next.0 / Clang 22.1.8 WASI sysroot from the `wasm-llvm` producer                                                                                    | `clang++` for `wasm32-wasi`; default `-std=gnu++2a`; native gzip delivery for compiler Wasm and sysroot tar assets; trace debug uses wasm-idle controls; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                             | `runtimeAssets.clang.baseUrl`/`loader` or `rootUrl`; `compileArgs`, `programArgs`, `cppVersion`, `activePath`, `workspaceFiles`, `debug`, `breakpoints`, `pauseOnEntry`                                                                                                                                                             |
-| Objective-C<br>`OBJC`              | GNUstep libobjc2 v2.3 assets from the `wasm-llvm` producer + @wasm-idle/llvm-core@1.0.0-next.0                                                                                 | `clang -x objective-c -fobjc-runtime=gnustep-2.0 -fblocks` for `wasm32-wasi`; links `libobjc.a`, `libgnustep-base.a`, and `libffi.a` when Foundation is imported; Foundation headers are inlined from `foundation-headers.json`; includes a constructor wrapper for Objective-C class registration; auto-compiles `.m` and `.c` workspace sources; trace debug instruments active source and uses wasm-idle controls; supports `stdin` and `programArgs`; large Objective-C assets may be served as gzip-only `.gz` files through the service worker or worker fallback | `runtimeAssets.objectivec.baseUrl`/`libobjcUrl`/`headersUrl`/`libgnustepBaseUrl`/`libgnustepBaseObjectUrl`/`foundationHeadersUrl`/`libffiUrl` or `PUBLIC_WASM_OBJECTIVEC_*`; `runtimeAssets.clang.baseUrl`/`loader` for the clang toolchain; `activePath`, `workspaceFiles`, `compileArgs`, `debug`, `breakpoints`, `pauseOnEntry`  |
-| Python<br>`PYTHON3`, `PYPY3`       | static ESM `static/pyodide/pyodide.mjs` / pyodide@0.29.3                                                                                                                       | loads `pyodide.mjs`, `pyodide.asm.js`, `pyodide.asm.wasm`, and `python_stdlib.zip` from the configured static asset tree on demand; supports `stdin`, workspace files, and trace debugging                                                                                                                                                                                                                                                                                                                                                                              | `runtimeAssets.python.baseUrl`/`loader` or `rootUrl`; `stdin`, `activePath`, `workspaceFiles`, `debug`, `breakpoints`, `pauseOnEntry`, `debugPath`                                                                                                                                                                                  |
-| Java<br>`JAVA`                     | @wasm-idle/runtime-teavm@0.0.0 / TeaVM compiler assets                                                                                                                         | `compiler.wasm` compiles Java to browser WASM/JS; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `runtimeAssets.java.baseUrl`/`loader` or `rootUrl`                                                                                                                                                                                                                                                                                  |
-| Rust<br>`RUST`                     | wasm-rust@0.1.0 / rust-1.99.0-browser-integrated-v1 + integrated LLVM/LLD 22.1.8 from the `wasm-llvm` producer; `debug-instrumenter.js` is a separately generated static asset | browser host `wasm32-wasip1-threads`; `rustc -Zthreads=1 -Zcodegen-backend=llvm --crate-type=bin --edition=2024 -Cpanic=abort -Ccodegen-units=1 --emit=link`; default target `wasm32-wasip1`, selectable `wasm32-wasip1`, `wasm32-wasip2`, `wasm32-wasip3`; Preview 1 emits core Wasm and Preview 2/3 are component-encoded; supports `stdin` and `programArgs`; the debug instrumenter is fetched only for debug runs                                                                                                                                                  | `runtimeAssets.rust.compilerUrl`, `runtimeAssets.rust.debugModuleUrl`, or `PUBLIC_WASM_RUST_COMPILER_URL`; `rootUrl`, `rustTargetTriple`, `programArgs`; compiler requests accept `edition`, `crateType`, `extendedTimeout`, `log`, and `onProgress`; runtime manifest controls compiler memory, timeout, and shared workspace size |
-| Go<br>`GO`                         | wasm-go@0.1.0 / go1.26.1                                                                                                                                                       | default target `wasip1/wasm`; selectable `wasip1/wasm`, `wasip2/wasm`, `wasip3/wasm`, `js/wasm`; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                     | `runtimeAssets.go.compilerUrl` or `PUBLIC_WASM_GO_COMPILER_URL`; `goTarget`, `programArgs`                                                                                                                                                                                                                                          |
-| D<br>`D`                           | wasm-d@0.1.0 / ldc-1.42.0-wasi-smoke                                                                                                                                           | `ldc2 -conf=/toolchain/etc/ldc2.conf -mtriple=wasm32-wasi -c` then `wasm-ld` to WASI preview1; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                       | `runtimeAssets.d.moduleUrl` or `PUBLIC_WASM_D_MODULE_URL`; `activePath`, `programArgs`                                                                                                                                                                                                                                              |
-| C#<br>`CSHARP`                     | wasm-dotnet@0.1.0 / .NET 9.0.16 browser-wasm / Roslyn C# 4.14.0                                                                                                                | `CSharpCompilationOptions(OutputKind.ConsoleApplication)`; `concurrentBuild=false`; target `browser-wasm`; language-specific AOT bundle `runtime/csharp/`; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                           | `runtimeAssets.dotnet.moduleUrl` or `PUBLIC_WASM_DOTNET_MODULE_URL`; `programArgs`, LSP on/off                                                                                                                                                                                                                                      |
-| F#<br>`FSHARP`                     | wasm-dotnet@0.1.0 / .NET 9.0.16 browser-wasm / FCS 43.12.204 / FSharp.Core 10.1.204                                                                                            | `fsc.exe --target:exe --targetprofile:netcore --noframework --simpleresolution --nowin32manifest --debug- --optimize-`; language-specific AOT bundle `runtime/fsharp/`; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                              | `runtimeAssets.dotnet.moduleUrl` or `PUBLIC_WASM_DOTNET_MODULE_URL`; `programArgs`, LSP on/off                                                                                                                                                                                                                                      |
-| VB.NET<br>`VBNET`                  | wasm-dotnet@0.1.0 / .NET 9.0.16 browser-wasm / Roslyn Visual Basic 4.14.0                                                                                                      | `VisualBasicCompilationOptions(OutputKind.ConsoleApplication)`; `concurrentBuild=false`, `OptionStrict=Off`, `OptionInfer=On`, `OptionExplicit=On`; target `browser-wasm`; language-specific AOT bundle `runtime/vbnet/`; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                            | `runtimeAssets.dotnet.moduleUrl` or `PUBLIC_WASM_DOTNET_MODULE_URL`; `programArgs`, LSP on/off                                                                                                                                                                                                                                      |
-| Elixir<br>`ELIXIR`                 | wasm-elixir asset bundle / @swmansion/popcorn@0.2.2                                                                                                                            | Popcorn/AtomVM bundle `bundle.avm`; supports `stdin`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `runtimeAssets.elixir.bundleUrl` or `PUBLIC_WASM_ELIXIR_BUNDLE_URL`                                                                                                                                                                                                                                                                 |
-| Erlang<br>`ERLANG`                 | wasm-elixir asset bundle / @swmansion/popcorn@0.2.2                                                                                                                            | Popcorn/AtomVM bundle `bundle.avm`; supports `stdin`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `runtimeAssets.erlang.bundleUrl` or `PUBLIC_WASM_ERLANG_BUNDLE_URL`; falls back to Elixir bundle URL                                                                                                                                                                                                                                |
-| Prolog<br>`PROLOG`                 | swipl-wasm@8.0.1 synced into `static/wasm-prolog`                                                                                                                              | static worker runs SWI-Prolog; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `runtimeAssets.prolog.baseUrl`/`runtimeAssets.prolog.workerUrl` or `PUBLIC_WASM_PROLOG_BASE_URL`/`PUBLIC_WASM_PROLOG_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                     |
-| Gleam<br>`GLEAM`                   | @live-codes/gleam-precompiled@0.5.0 static worker                                                                                                                              | Gleam worker compiles/runs browser output with source manifest; supports `stdin`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `runtimeAssets.gleam.baseUrl`/`workerUrl`/`manifestUrl` or `PUBLIC_WASM_GLEAM_*`; `programArgs`, `workspaceFiles`                                                                                                                                                                                                                   |
-| Perl<br>`PERL`                     | WebPerl v0.09-beta (webperl_prebuilt_v0.09-beta.zip)                                                                                                                           | static worker runs `emperl`; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `runtimeAssets.perl.baseUrl`/`runtimeAssets.perl.workerUrl` or `PUBLIC_WASM_PERL_BASE_URL`/`PUBLIC_WASM_PERL_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                             |
-| Tcl<br>`TCL`                       | Wacl Tcl 2017-05-29 (wacl.zip)                                                                                                                                                 | static worker runs Wacl Tcl; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `runtimeAssets.tcl.baseUrl`/`runtimeAssets.tcl.workerUrl` or `PUBLIC_WASM_TCL_BASE_URL`/`PUBLIC_WASM_TCL_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                                 |
-| AWK<br>`AWK`                       | GoAWK v1.31.0 / go1.25.3                                                                                                                                                       | static worker runs `goawk.wasm`; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `runtimeAssets.awk.baseUrl`/`runtimeAssets.awk.workerUrl` or `PUBLIC_WASM_AWK_BASE_URL`/`PUBLIC_WASM_AWK_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                                 |
-| Pascal<br>`PASCAL`                 | pas2js 3.2.1 (9ac46614dc82)                                                                                                                                                    | static worker compiles with pas2js then runs JS; supports `stdin`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `runtimeAssets.pascal.baseUrl`/`runtimeAssets.pascal.workerUrl` or `PUBLIC_WASM_PASCAL_BASE_URL`/`PUBLIC_WASM_PASCAL_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                     |
-| Forth<br>`FORTH`                   | waforth@0.20.1 / static worker                                                                                                                                                 | WAForth worker; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `runtimeAssets.forth.baseUrl`/`runtimeAssets.forth.workerUrl` or `PUBLIC_WASM_FORTH_BASE_URL`/`PUBLIC_WASM_FORTH_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                         |
-| J<br>`J`                           | jsoftware-j-playground static worker                                                                                                                                           | J playground worker; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `runtimeAssets.j.baseUrl`/`runtimeAssets.j.workerUrl` or `PUBLIC_WASM_J_BASE_URL`/`PUBLIC_WASM_J_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                                         |
-| BQN<br>`BQN`                       | CBQN static worker / Emscripten 3.1.8                                                                                                                                          | CBQN worker; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `runtimeAssets.bqn.baseUrl`/`runtimeAssets.bqn.workerUrl` or `PUBLIC_WASM_BQN_BASE_URL`/`PUBLIC_WASM_BQN_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                                 |
-| Janet<br>`JANET`                   | Janet static worker / Emscripten 3.1.8                                                                                                                                         | Janet VM worker; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `runtimeAssets.janet.baseUrl`/`runtimeAssets.janet.workerUrl` or `PUBLIC_WASM_JANET_BASE_URL`/`PUBLIC_WASM_JANET_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                         |
-| Julia<br>`JULIA`                   | @chriskoch/julia-wasm@1.0.4                                                                                                                                                    | Julia WASM worker; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `runtimeAssets.julia.baseUrl`/`runtimeAssets.julia.workerUrl` or `PUBLIC_WASM_JULIA_BASE_URL`/`PUBLIC_WASM_JULIA_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                         |
-| Nim<br>`NIM`                       | Nim 2.2.4 / benagastov Nim-WASM-Compiler with clang/lld WASM                                                                                                                   | static worker compiles Nim to C, then clang/lld to WASM; supports `stdin`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `runtimeAssets.nim.baseUrl`/`runtimeAssets.nim.workerUrl` or `PUBLIC_WASM_NIM_BASE_URL`/`PUBLIC_WASM_NIM_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                                 |
-| Bash<br>`BASH`                     | @wasm-idle/runtime-bash@0.1.0 / GNU Bash WASIX + static ESM `static/wasm-bash/sdk/index.mjs` produced from @wasmer/sdk@0.9.0                                                   | runs the pinned `bash.webc` locally through the on-demand Wasmer SDK asset; invokes `bash -c <code> <activePath> ...programArgs` and supports `stdin`, `programArgs`, `activePath`, and `workspaceFiles`                                                                                                                                                                                                                                                                                                                                                                | `runtimeAssets.bash.moduleUrl`/`workerUrl`/`webcUrl` or `rootUrl`; `stdin`, `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                                                                           |
-| ClojureScript<br>`CLOJURESCRIPT`   | @wasm-idle/runtime-clojurescript@0.1.0 / ClojureScript 1.12.134                                                                                                                | static worker compiles and evaluates with the official `cljs.js` self-hosted compiler; supports `stdin`, `programArgs`, `activePath`, and `workspaceFiles`                                                                                                                                                                                                                                                                                                                                                                                                              | `runtimeAssets.clojurescript.baseUrl`/`runtimeAssets.clojurescript.workerUrl` or `PUBLIC_WASM_CLOJURESCRIPT_BASE_URL`/`PUBLIC_WASM_CLOJURESCRIPT_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                         |
-| TinyGo<br>`TINYGO`                 | wasm-tinygo@0.0.0 / TinyGo 0.40.1 browser toolchain                                                                                                                            | default target `wasm`; selectable `wasm`, `wasip1`, `wasip2`, `wasip3`; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `runtimeAssets.tinygo.moduleUrl`/`appUrl`/`assetLoader`/`assetPacks`; `PUBLIC_WASM_TINYGO_*`, `tinygoTarget`, `programArgs`                                                                                                                                                                                                         |
-| OCaml<br>`OCAML`                   | wasm-of-js-of-ocaml@0.1.0 / js_of_ocaml + wasm_of_ocaml                                                                                                                        | default backend `wasm`; selectable `wasm`, `js`; `ocamlWasmBinaryenMode` `fast`, `full`; supports `stdin`                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `runtimeAssets.ocaml.moduleUrl`/`manifestUrl` or `PUBLIC_WASM_OCAML_*`; `ocamlBackend`                                                                                                                                                                                                                                              |
-| JavaScript<br>`JAVASCRIPT`         | wasm-typescript@0.1.0 / @swc/wasm-typescript@1.15.33                                                                                                                           | TypeScript service transpiles JS/TS and runs in browser sandbox; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `runtimeAssets.typescript.moduleUrl`/`libUrl` or `PUBLIC_WASM_TYPESCRIPT_MODULE_URL`                                                                                                                                                                                                                                                |
-| TypeScript<br>`TYPESCRIPT`         | wasm-typescript@0.1.0 / @swc/wasm-typescript@1.15.33                                                                                                                           | TypeScript service transpiles then runs in browser sandbox; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `runtimeAssets.typescript.moduleUrl`/`libUrl` or `PUBLIC_WASM_TYPESCRIPT_MODULE_URL`                                                                                                                                                                                                                                                |
-| AssemblyScript<br>`ASSEMBLYSCRIPT` | static ESM `static/wasm-assemblyscript/runtime.mjs` produced from assemblyscript@0.28.17 + @assemblyscript/loader@0.28.17                                                      | `asc <activePath> --outFile module.wasm --runtime incremental --bindings raw --optimize --exportRuntime`; runs the emitted WASM through WASI/browser imports and supports `stdin`                                                                                                                                                                                                                                                                                                                                                                                       | `runtimeAssets.assemblyscript.moduleUrl` or `PUBLIC_WASM_ASSEMBLYSCRIPT_MODULE_URL` or `rootUrl`; `stdin`, `activePath`, `workspaceFiles`                                                                                                                                                                                           |
-| WAT<br>`WAT`                       | wasm-wat@0.1.0 / wabt@1.0.39                                                                                                                                                   | WABT parses WAT to WASM then runs through WASI shim; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `runtimeAssets.wat.moduleUrl` or `PUBLIC_WASM_WAT_MODULE_URL`; `programArgs`                                                                                                                                                                                                                                                        |
-| WASM<br>`WASM`                     | Browser WebAssembly + @bjorn3/browser_wasi_shim@0.4.2                                                                                                                          | loads provided WASM bytes and executes with WASI preview1 imports; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `programArgs`, `stdin`, `activePath`                                                                                                                                                                                                                                                                                                |
-| Lua<br>`LUA`                       | wasm-lua@0.1.0 / wasmoon@1.16.0                                                                                                                                                | Wasmoon Lua VM; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `runtimeAssets.lua.moduleUrl` or `PUBLIC_WASM_LUA_MODULE_URL`; `programArgs`                                                                                                                                                                                                                                                        |
-| Zig<br>`ZIG`                       | static wasm-zig assets / `zig_small.wasm` + `std.tar.gz`                                                                                                                       | native gzip delivery for the tar standard library; default target `wasm64-wasi`; Zig compile args are appended; supports `stdin`, `compileArgs`, `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                          | `runtimeAssets.zig.compilerUrl`/`stdlibUrl` or `PUBLIC_WASM_ZIG_*`; `zigTargetTriple`, `activePath`, `workspaceFiles`                                                                                                                                                                                                               |
-| Scheme<br>`LISP`                   | wasm-lisp@0.1.0 / Puppy Scheme WASM component                                                                                                                                  | Puppy Scheme compiler/runtime; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `runtimeAssets.lisp.moduleUrl` or `PUBLIC_WASM_LISP_MODULE_URL`; `programArgs`                                                                                                                                                                                                                                                      |
-| Ruby<br>`RUBY`                     | static ESM `static/wasm-ruby/runtime.mjs` produced from @ruby/3.4-wasm-wasi@2.9.3-2.9.4 + @ruby/wasm-wasi@2.9.3-2.9.4                                                          | CRuby 3.4 WASI runtime loads `ruby+stdlib.wasm` on demand; supports `stdin`, `programArgs`, and workspace files                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `runtimeAssets.ruby.moduleUrl`/`wasmUrl` or `PUBLIC_WASM_RUBY_MODULE_URL`/`PUBLIC_WASM_RUBY_WASM_URL` or `rootUrl`; `stdin`, `programArgs`, `workspaceFiles`                                                                                                                                                                        |
-| Haskell<br>`HASKELL`               | ghc-in-browser / GHC 9.14.0.20251031 WASI rootfs                                                                                                                               | loads `dyld.mjs`, `rootfs.tar.zst`, `bsdtar.wasm`; `compileArgs` become GHC args, otherwise legacy `args` become GHC args                                                                                                                                                                                                                                                                                                                                                                                                                                               | `runtimeAssets.haskell.moduleUrl`/`rootfsUrl`/`bsdtarUrl`; `mainSoPath`, `searchDirs`, `activePath`, `workspaceFiles`                                                                                                                                                                                                               |
-| Fortran<br>`FORTRAN`               | Netlib f2c 2022-09-09 + `@cowasm/f2c 1.0.0` libf2c + @wasm-idle/llvm-core@1.0.0-next.0                                                                                         | runs `f2c.wasm` in WASI, compiles generated C with the llvm-core Clang host, links `libf2c.a`, then executes the resulting WASI module with `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                   | `runtimeAssets.fortran.baseUrl`/`f2cWasmUrl`/`libf2cUrl`/`f2cHeaderUrl`/`analyzerUrl` or `PUBLIC_WASM_FORTRAN_*`; `runtimeAssets.clang.baseUrl`/`loader` for the C backend; `activePath`, `workspaceFiles`, `compileArgs`                                                                                                           |
-| COBOL<br>`COBOL`                   | GnuCOBOL 3.2 + GMP 6.3.0 assets from the `wasm-llvm` producer + @wasm-idle/llvm-core@1.0.0-next.0                                                                              | native gzip delivery for the frontend Wasm and filesystem tar assets; translates free-format COBOL with the real GnuCOBOL `cobc` frontend, compiles the generated C with the llvm-core Clang host, links libcob/GMP, and executes the resulting WASI module with `stdin` and `programArgs`                                                                                                                                                                                                                                                                              | `runtimeAssets.cobol.baseUrl` or `PUBLIC_WASM_COBOL_BASE_URL`; `runtimeAssets.clang.baseUrl`/`loader` for the C backend; `activePath`, `workspaceFiles`, `compileArgs`                                                                                                                                                              |
-| R<br>`R`                           | versioned static `static/webr/<hash>/webr.js` / webr@0.6.0                                                                                                                     | loads the browser ESM entry `webr.js` and its WebR runtime files from the configured static asset tree on demand; supports `stdin`, `programArgs`, and workspace files                                                                                                                                                                                                                                                                                                                                                                                                  | `runtimeAssets.r.baseUrl` or `PUBLIC_WASM_R_BASE_URL`; `stdin`, `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                                                                                       |
-| Octave<br>`OCTAVE`                 | Octave 10.3.0 (octave-10.3.0-pl5321h996e327_3.tar.bz2)                                                                                                                         | Octave CLI Emscripten worker; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `runtimeAssets.octave.baseUrl`/`workerUrl`/`manifestUrl` or `PUBLIC_WASM_OCTAVE_*`                                                                                                                                                                                                                                                  |
-| DuckDB<br>`DUCKDB`                 | static ESM `static/wasm-duckdb/runtime.mjs` produced from @duckdb/duckdb-wasm@1.33.1-dev45.0                                                                                   | selects the best DuckDB-Wasm MVP/EH bundle on demand and creates a fresh in-memory database per run; `stdin` is registered as `stdin.txt` and `/dev/stdin` rather than terminal stdin                                                                                                                                                                                                                                                                                                                                                                                   | `runtimeAssets.duckdb.moduleUrl` or `PUBLIC_WASM_DUCKDB_MODULE_URL` or `rootUrl`; `stdin`, `activePath`, `workspaceFiles`                                                                                                                                                                                                           |
-| SQLite<br>`SQLITE`                 | static ESM `static/wasm-sqlite/runtime.mjs` produced from sql.js@1.14.1                                                                                                        | sql.js loads `sql-wasm.wasm` on demand and executes SQL in a fresh in-memory database; terminal stdin is not applicable                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `runtimeAssets.sqlite.moduleUrl`/`wasmUrl` or `PUBLIC_WASM_SQLITE_MODULE_URL`/`PUBLIC_WASM_SQLITE_WASM_URL` or `rootUrl`; `workspaceFiles`                                                                                                                                                                                          |
-| PHP<br>`PHP`                       | static ESM `static/wasm-php/runtime.mjs` prebuilt by the standalone `producers/wasm-php` producer from @php-wasm/web-8-4@3.1.34 + @php-wasm/universal@3.1.34                   | fixed PHP `8.4` php-wasm runtime; injects `$argv`/`$argc` and runs the active workspace script with `php.run`; supports `stdin` and `programArgs`; there is no runtime version selector                                                                                                                                                                                                                                                                                                                                                                                 | `runtimeAssets.php.moduleUrl` or `PUBLIC_WASM_PHP_MODULE_URL` or `rootUrl`; `stdin`, `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                                                                  |
+| Language / IDs                     | Package/version base                                                                                                                                                           | Execution defaults / flags                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | Customization                                                                                                                                                                                                                                                                                                                                    |
+| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| C3<br>`C3`                         | wasm-llvm/c3-browser: C3 0.8.3 / LLVM 22.1.8                                                                                                                                   | Verified c3c and builtin LLD compile real C3 in a fresh browser Worker; UTF-8 env.readByte/env.writeByte ABI and exported main; std::io and WASI unavailable                                                                                                                                                                                                                                                                                                                                                                                                            | `runtimeAssets.c3.baseUrl`, `stdin`, `activePath`, `workspaceFiles`; fixed compiler flags and bounded Wasm memories                                                                                                                                                                                                                              |
+| C<br>`C`                           | @wasm-idle/llvm-core@1.0.0 / Clang 22.1.8 WASI sysroot from the `wasm-llvm` producer                                                                                           | `clang` for `wasm32-wasi`; default `-std=gnu11`; LLDB mode compiles untouched source with embedded DWARF at `-g -O0` and runs it in WAMR; normal runs still use the browser WASI host; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                               | `runtimeAssets.clang.baseUrl`/`loader` or `rootUrl`; `compileArgs`, `programArgs`, `cVersion`, `activePath`, `workspaceFiles`, `debugMode`, `breakpoints`, `pauseOnEntry`                                                                                                                                                                        |
+| C++<br>`CPP`                       | @wasm-idle/llvm-core@1.0.0 / Clang 22.1.8 WASI sysroot from the `wasm-llvm` producer                                                                                           | `clang++` for `wasm32-wasi`; default `-std=gnu++20`; LLDB mode compiles untouched source with embedded DWARF at `-g -O0` and runs it in WAMR; normal runs still use the browser WASI host; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                           | `runtimeAssets.clang.baseUrl`/`loader` or `rootUrl`; `compileArgs`, `programArgs`, `cppVersion`, `activePath`, `workspaceFiles`, `debugMode`, `breakpoints`, `pauseOnEntry`                                                                                                                                                                      |
+| Objective-C<br>`OBJC`              | GNUstep libobjc2 v2.3 assets from the `wasm-llvm` producer + @wasm-idle/llvm-core@1.0.0                                                                                        | `clang -x objective-c -fobjc-runtime=gnustep-2.0 -fblocks` for `wasm32-wasi`; links `libobjc.a`, `libgnustep-base.a`, and `libffi.a` when Foundation is imported; Foundation headers are inlined from `foundation-headers.json`; includes a constructor wrapper for Objective-C class registration; auto-compiles `.m`/`.mm`/`.c` workspace files; trace debug instruments active source and uses wasm-idle controls; supports `stdin` and `programArgs`; large Objective-C assets may be served as gzip-only `.gz` files through the service worker or worker fallback | `runtimeAssets.objectivec.baseUrl`/`libobjcUrl`/`headersUrl`/`libgnustepBaseUrl`/`libgnustepBaseObjectUrl`/`foundationHeadersUrl`/`libffiUrl` or `PUBLIC_WASM_OBJECTIVEC_*`; `runtimeAssets.clang.baseUrl`/`loader` for the clang toolchain; `activePath`, `workspaceFiles`, `compileArgs`, `debug`, `breakpoints`, `pauseOnEntry`               |
+| Python<br>`PYTHON3`                | static ESM `static/pyodide/pyodide.mjs` / pyodide@0.29.3                                                                                                                       | loads `pyodide.mjs`, `pyodide.asm.js`, `pyodide.asm.wasm`, and `python_stdlib.zip` from the configured static asset tree on demand; supports `stdin`, workspace files, and trace debugging                                                                                                                                                                                                                                                                                                                                                                              | `runtimeAssets.python.baseUrl`/`loader` or `rootUrl`; `stdin`, `activePath`, `workspaceFiles`, `debug`, `breakpoints`, `pauseOnEntry`, `debugPath`                                                                                                                                                                                               |
+| Java<br>`JAVA`                     | @wasm-idle/runtime-teavm@0.0.0 / TeaVM compiler assets                                                                                                                         | `compiler.wasm` compiles Java to browser WASM/JS; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `runtimeAssets.java.baseUrl`/`loader` or `rootUrl`                                                                                                                                                                                                                                                                                               |
+| Rust<br>`RUST`                     | wasm-rust@0.1.0 / rust-1.99.0-browser-integrated-v1 + integrated LLVM/LLD 22.1.8 from the `wasm-llvm` producer; exact rustc/LLVM provenance is recorded for LLDB compatibility | browser host `wasm32-wasip1-threads`; default target `wasm32-wasip1`, selectable `wasm32-wasip1`, `wasm32-wasip2`, `wasm32-wasip3`; LLDB mode is currently limited to `wasm32-wasip1` and emits embedded DWARF with `-C debuginfo=2 -C opt-level=0`; normal Preview 1/2/3 execution remains unchanged; supports `stdin` and `programArgs`                                                                                                                                                                                                                               | `runtimeAssets.rust.compilerUrl`, `runtimeAssets.rust.debugModuleUrl`, or `PUBLIC_WASM_RUST_COMPILER_URL`; `rootUrl`, `rustTargetTriple`, `programArgs`, `debugMode`; compiler requests accept `edition`, `crateType`, `extendedTimeout`, `log`, and `onProgress`; runtime manifest controls compiler memory, timeout, and shared workspace size |
+| Go<br>`GO`                         | wasm-go@0.1.0 / go1.26.1                                                                                                                                                       | default target `wasip1/wasm`; selectable `wasip1/wasm`, `wasip2/wasm`, `wasip3/wasm`, `js/wasm`; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                     | `runtimeAssets.go.compilerUrl` or `PUBLIC_WASM_GO_COMPILER_URL`; `goTarget`, `programArgs`                                                                                                                                                                                                                                                       |
+| D<br>`D`                           | wasm-d@0.1.0 / ldc-1.42.0-wasi-smoke                                                                                                                                           | `ldc2 -conf=/toolchain/etc/ldc2.conf -mtriple=wasm32-wasi -c` then `wasm-ld` to WASI preview1; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                       | `runtimeAssets.d.moduleUrl` or `PUBLIC_WASM_D_MODULE_URL`; `activePath`, `programArgs`                                                                                                                                                                                                                                                           |
+| C#<br>`CSHARP`                     | wasm-dotnet@0.1.0 / .NET 9.0.16 browser-wasm / Roslyn C# 4.14.0                                                                                                                | `CSharpCompilationOptions(OutputKind.ConsoleApplication)`; `concurrentBuild=false`; target `browser-wasm`; language-specific AOT bundle `runtime/csharp/`; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                           | `runtimeAssets.dotnet.moduleUrl` or `PUBLIC_WASM_DOTNET_MODULE_URL`; `programArgs`, LSP on/off                                                                                                                                                                                                                                                   |
+| F#<br>`FSHARP`                     | wasm-dotnet@0.1.0 / .NET 9.0.16 browser-wasm / FCS 43.12.204 / FSharp.Core 10.1.204                                                                                            | `fsc.exe --target:exe --targetprofile:netcore --noframework --simpleresolution --nowin32manifest --debug- --optimize-`; language-specific AOT bundle `runtime/fsharp/`; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                              | `runtimeAssets.dotnet.moduleUrl` or `PUBLIC_WASM_DOTNET_MODULE_URL`; `programArgs`, LSP on/off                                                                                                                                                                                                                                                   |
+| VB.NET<br>`VBNET`                  | wasm-dotnet@0.1.0 / .NET 9.0.16 browser-wasm / Roslyn Visual Basic 4.14.0                                                                                                      | `VisualBasicCompilationOptions(OutputKind.ConsoleApplication)`; `concurrentBuild=false`, `OptionStrict=Off`, `OptionInfer=On`, `OptionExplicit=On`; target `browser-wasm`; language-specific AOT bundle `runtime/vbnet/`; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                            | `runtimeAssets.dotnet.moduleUrl` or `PUBLIC_WASM_DOTNET_MODULE_URL`; `programArgs`, LSP on/off                                                                                                                                                                                                                                                   |
+| Elixir<br>`ELIXIR`                 | wasm-elixir asset bundle / @swmansion/popcorn@0.2.2                                                                                                                            | Popcorn/AtomVM bundle `bundle.avm`; supports `stdin`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `runtimeAssets.elixir.bundleUrl` or `PUBLIC_WASM_ELIXIR_BUNDLE_URL`                                                                                                                                                                                                                                                                              |
+| Erlang<br>`ERLANG`                 | wasm-elixir asset bundle / @swmansion/popcorn@0.2.2                                                                                                                            | Popcorn/AtomVM bundle `bundle.avm`; supports `stdin`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `runtimeAssets.erlang.bundleUrl` or `PUBLIC_WASM_ERLANG_BUNDLE_URL`; falls back to Elixir bundle URL                                                                                                                                                                                                                                             |
+| Prolog<br>`PROLOG`                 | swipl-wasm@8.0.1 synced into `static/wasm-prolog`                                                                                                                              | static worker runs SWI-Prolog; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `runtimeAssets.prolog.baseUrl`/`runtimeAssets.prolog.workerUrl` or `PUBLIC_WASM_PROLOG_BASE_URL`/`PUBLIC_WASM_PROLOG_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                                  |
+| Gleam<br>`GLEAM`                   | @live-codes/gleam-precompiled@0.5.0 static worker                                                                                                                              | Gleam worker compiles/runs browser output with source manifest; supports `stdin`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `runtimeAssets.gleam.baseUrl`/`workerUrl`/`manifestUrl` or `PUBLIC_WASM_GLEAM_*`; `programArgs`, `workspaceFiles`                                                                                                                                                                                                                                |
+| Perl<br>`PERL`                     | WebPerl v0.09-beta (webperl_prebuilt_v0.09-beta.zip)                                                                                                                           | host-verifies the manifest, stored assets, logical hashes, and profile-bound one-shot runner before executing `emperl`; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                              | explicit `runtimeAssets.perl.baseUrl`/`workerUrl`/`manifestUrl` overrides require one complete profile-and-runner receipt bundle; URL-only `PUBLIC_WASM_PERL_*` overrides fail closed; `programArgs`, `activePath`, `workspaceFiles`                                                                                                             |
+| Tcl<br>`TCL`                       | Wacl Tcl 2017-05-29 (wacl.zip)                                                                                                                                                 | host-verifies the manifest, stored assets, logical hashes, and profile-bound one-shot runner before executing Wacl Tcl; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                              | bundled mirrors may set `runtimeAssets.tcl.baseUrl`/`workerUrl`/`manifestUrl` or `PUBLIC_WASM_TCL_BASE_URL`/`PUBLIC_WASM_TCL_WORKER_URL`; custom executable bytes require one complete profile-and-runner receipt bundle; `programArgs`, `activePath`, `workspaceFiles`                                                                          |
+| AWK<br>`AWK`                       | GoAWK v1.31.0 / go1.25.3                                                                                                                                                       | static worker runs `goawk.wasm`; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `runtimeAssets.awk.baseUrl`/`runtimeAssets.awk.workerUrl` or `PUBLIC_WASM_AWK_BASE_URL`/`PUBLIC_WASM_AWK_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                                              |
+| Pascal<br>`PASCAL`                 | pas2js 3.2.1 (9ac46614dc82)                                                                                                                                                    | static worker compiles with pas2js then runs JS; supports `stdin`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `runtimeAssets.pascal.baseUrl`/`runtimeAssets.pascal.workerUrl` or `PUBLIC_WASM_PASCAL_BASE_URL`/`PUBLIC_WASM_PASCAL_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                                  |
+| Forth<br>`FORTH`                   | waforth@0.20.1 / static worker                                                                                                                                                 | WAForth worker; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `runtimeAssets.forth.baseUrl`/`runtimeAssets.forth.workerUrl` or `PUBLIC_WASM_FORTH_BASE_URL`/`PUBLIC_WASM_FORTH_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                                      |
+| J<br>`J`                           | jsoftware-j-playground static worker                                                                                                                                           | J playground worker; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `runtimeAssets.j.baseUrl`/`runtimeAssets.j.workerUrl` or `PUBLIC_WASM_J_BASE_URL`/`PUBLIC_WASM_J_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                                                      |
+| BQN<br>`BQN`                       | CBQN static worker / Emscripten 3.1.8                                                                                                                                          | CBQN worker; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `runtimeAssets.bqn.baseUrl`/`runtimeAssets.bqn.workerUrl` or `PUBLIC_WASM_BQN_BASE_URL`/`PUBLIC_WASM_BQN_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                                              |
+| Janet<br>`JANET`                   | Janet 1.41.3-dev / Emscripten 3.1.8 opaque vendored bundle                                                                                                                     | host-verifies the manifest, stored assets, logical hashes, and profile-bound one-shot runner before executing the Janet VM; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                          | explicit `runtimeAssets.janet.baseUrl`/`workerUrl`/`manifestUrl` overrides require one complete profile-and-runner receipt bundle; URL-only `PUBLIC_WASM_JANET_*` overrides fail closed; `programArgs`, `activePath`, `workspaceFiles`                                                                                                           |
+| Julia<br>`JULIA`                   | @chriskoch/julia-wasm@1.0.4                                                                                                                                                    | host-verifies the manifest, stored assets, logical hashes, and profile-bound one-shot runner before executing the legacy Julia VM; supports `stdin` and `activePath`                                                                                                                                                                                                                                                                                                                                                                                                    | explicit `runtimeAssets.julia.baseUrl`/`workerUrl`/`manifestUrl` overrides require one complete profile-and-runner receipt bundle; URL-only `PUBLIC_WASM_JULIA_*` overrides fail closed; `activePath`                                                                                                                                            |
+| Nim<br>`NIM`                       | Nim 2.2.4 / benagastov Nim-WASM-Compiler with clang/lld WASM                                                                                                                   | host-verifies the manifest, eight stored assets, logical hashes, and profile-bound one-shot runner before compiling Nim to C and linking with clang/lld WASM in a disposable worker; supports `stdin`, `programArgs`, and `activePath`                                                                                                                                                                                                                                                                                                                                  | explicit `runtimeAssets.nim.baseUrl`/`workerUrl`/`manifestUrl` overrides require one complete profile-and-runner receipt bundle; URL-only `PUBLIC_WASM_NIM_*` overrides fail closed; `programArgs`, `activePath`                                                                                                                                 |
+| Bash<br>`BASH`                     | @wasm-idle/runtime-bash@0.1.0 / GNU Bash WASIX + receipt-pinned @wasmer/sdk@0.9.0 profile                                                                                      | host-verifies one profile manifest, the stored SDK JavaScript, Wasmer Wasm, and WEBc before starting a fixed worker generation with no runtime-asset fetches; invokes `bash -c <code> <activePath> ...programArgs` and supports `stdin`, `programArgs`, `activePath`, and `workspaceFiles`                                                                                                                                                                                                                                                                              | `rootUrl` mirrors reuse the bundled profile; explicit `runtimeAssets.bash.baseUrl`/`manifestUrl`/`moduleUrl`/`wasmerWasmUrl`/`webcUrl` overrides require one complete profile; `workerUrl` is rejected; `stdin`, `programArgs`, `activePath`, `workspaceFiles`                                                                                   |
+| ClojureScript<br>`CLOJURESCRIPT`   | @wasm-idle/runtime-clojurescript@0.1.0 / ClojureScript 1.12.134                                                                                                                | static worker compiles and evaluates with the official `cljs.js` self-hosted compiler; supports `stdin`, `programArgs`, `activePath`, and `workspaceFiles`                                                                                                                                                                                                                                                                                                                                                                                                              | `runtimeAssets.clojurescript.baseUrl`/`runtimeAssets.clojurescript.workerUrl` or `PUBLIC_WASM_CLOJURESCRIPT_BASE_URL`/`PUBLIC_WASM_CLOJURESCRIPT_WORKER_URL`; `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                      |
+| TinyGo<br>`TINYGO`                 | wasm-tinygo@0.0.0 / upstream TinyGo 0.40.1 browser toolchain                                                                                                                   | receipt-verifies and runs upstream `cmd/go` plus TinyGo in a disposable capped Worker; targets `wasip1`; supports `stdin`, `programArgs`, `workspaceFiles`, hosted C++ without exceptions/RTTI, and offline `vendor/modules.txt`                                                                                                                                                                                                                                                                                                                                        | `runtimeAssets.tinygo.moduleUrl`/`assetLoader`; `PUBLIC_WASM_TINYGO_MODULE_URL`, execution/workspace resource limits, `programArgs`                                                                                                                                                                                                              |
+| OCaml<br>`OCAML`                   | wasm-of-js-of-ocaml@0.1.0 / js_of_ocaml + wasm_of_ocaml                                                                                                                        | default backend `wasm`; selectable `wasm`, `js`; `ocamlWasmBinaryenMode` `fast`, `full`; supports `stdin`; outer module and manifest are size/SHA-256 verified before use                                                                                                                                                                                                                                                                                                                                                                                               | `runtimeAssets.ocaml.moduleUrl`/`manifestUrl` plus `moduleReceipt`/`manifestReceipt` for a custom generation, or `PUBLIC_WASM_OCAML_*` for a mirror of the bundled generation; `ocamlBackend`                                                                                                                                                    |
+| JavaScript<br>`JAVASCRIPT`         | wasm-typescript@0.1.0 / @swc/wasm-typescript@1.15.33                                                                                                                           | TypeScript service transpiles JS/TS and runs in browser sandbox; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `runtimeAssets.typescript.moduleUrl`/`libUrl` or `PUBLIC_WASM_TYPESCRIPT_MODULE_URL`                                                                                                                                                                                                                                                             |
+| TypeScript<br>`TYPESCRIPT`         | wasm-typescript@0.1.0 / @swc/wasm-typescript@1.15.33                                                                                                                           | TypeScript service transpiles then runs in browser sandbox; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `runtimeAssets.typescript.moduleUrl`/`libUrl` or `PUBLIC_WASM_TYPESCRIPT_MODULE_URL`                                                                                                                                                                                                                                                             |
+| AssemblyScript<br>`ASSEMBLYSCRIPT` | static ESM `static/wasm-assemblyscript/runtime.mjs` produced from assemblyscript@0.28.17 + @assemblyscript/loader@0.28.17                                                      | `asc <activePath> --outFile module.wasm --runtime incremental --bindings raw --optimize --exportRuntime`; runs the emitted WASM through WASI/browser imports and supports `stdin`                                                                                                                                                                                                                                                                                                                                                                                       | `runtimeAssets.assemblyscript.moduleUrl` or `PUBLIC_WASM_ASSEMBLYSCRIPT_MODULE_URL` or `rootUrl`; `stdin`, `activePath`, `workspaceFiles`                                                                                                                                                                                                        |
+| WAT<br>`WAT`                       | wasm-wat@0.1.0 / wabt@1.0.39                                                                                                                                                   | WABT parses WAT to WASM then runs through WASI shim; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `runtimeAssets.wat.moduleUrl` or `PUBLIC_WASM_WAT_MODULE_URL`; `programArgs`                                                                                                                                                                                                                                                                     |
+| WASM<br>`WASM`                     | Browser WebAssembly + @bjorn3/browser_wasi_shim@0.4.2                                                                                                                          | loads provided WASM bytes and executes with WASI preview1 imports; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `programArgs`, `stdin`, `activePath`                                                                                                                                                                                                                                                                                                             |
+| Lua<br>`LUA`                       | wasm-lua@0.1.0 / wasmoon@1.16.0                                                                                                                                                | Wasmoon Lua VM; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `runtimeAssets.lua.moduleUrl` or `PUBLIC_WASM_LUA_MODULE_URL`; `programArgs`                                                                                                                                                                                                                                                                     |
+| Zig<br>`ZIG`                       | static wasm-zig assets / `zig_small.wasm` + `std.tar.gz`                                                                                                                       | native gzip delivery for the tar standard library; default target `wasm64-wasi`; Zig compile args are appended; supports `stdin`, `compileArgs`, `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                          | `runtimeAssets.zig.compilerUrl`/`stdlibUrl` or `PUBLIC_WASM_ZIG_*`; `zigTargetTriple`, `activePath`, `workspaceFiles`                                                                                                                                                                                                                            |
+| Scheme<br>`LISP`                   | wasm-lisp@0.1.0 / Puppy Scheme WASM component                                                                                                                                  | receipt-verified Puppy Scheme compiler/runtime; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `runtimeAssets.lisp.{moduleUrl,manifestUrl,manifestFingerprint}` or `PUBLIC_WASM_LISP_{MODULE_URL,MANIFEST_URL,MANIFEST_FINGERPRINT}`; `programArgs`                                                                                                                                                                                             |
+| Ruby<br>`RUBY`                     | receipt-pinned `static/wasm-ruby` profile produced from @ruby/3.4-wasm-wasi@2.9.3-2.9.4 + @ruby/wasm-wasi@2.9.3-2.9.4                                                          | host-verifies the manifest, canonical stored module and gzip bytes, and logical WASM before transferring three owned buffers to a no-fetch CRuby 3.4 worker; supports `stdin`, `programArgs`, and workspace files                                                                                                                                                                                                                                                                                                                                                       | `rootUrl` mirrors reuse the bundled profile; explicit `runtimeAssets.ruby` overrides require one complete profile and same-origin canonical paths; URL-only `PUBLIC_WASM_RUBY_*` overrides fail closed; `stdin`, `programArgs`, `workspaceFiles`                                                                                                 |
+| Haskell<br>`HASKELL`               | ghc-in-browser / GHC 9.14.0.20251031 WASI rootfs                                                                                                                               | loads `dyld.mjs`, `rootfs.tar.zst`, `bsdtar.wasm`; `compileArgs` become GHC args, otherwise legacy `args` become GHC args                                                                                                                                                                                                                                                                                                                                                                                                                                               | `runtimeAssets.haskell.moduleUrl`/`rootfsUrl`/`bsdtarUrl`; `mainSoPath`, `searchDirs`, `activePath`, `workspaceFiles`                                                                                                                                                                                                                            |
+| LFortran<br>`LFORTRAN`             | receipt-pinned `wasm-llvm/producer/lfortran-browser` artifacts in `static/wasm-lfortran`                                                                                       | real LFortran 0.65.0-97-gab867a23 LLVM evaluator compiles and executes Emscripten side modules in a fresh Worker; shared-ring stdin supports delayed READ and EOF; experimental Fortran feature coverage                                                                                                                                                                                                                                                                                                                                                                | `runtimeAssets.lfortran.baseUrl` relocates the reviewed bundle; `stdin`, `activePath`, workspace data/include files, cancellation and execution limits; no program arguments or multi-file module build orchestration                                                                                                                            |
+| Fortran<br>`FORTRAN`               | Netlib f2c 2022-09-09 + `@cowasm/f2c 1.0.0` libf2c + @wasm-idle/llvm-core@1.0.0                                                                                                | runs `f2c.wasm` in WASI, compiles generated C with the llvm-core Clang host, links `libf2c.a`, then executes the resulting WASI module with `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                   | `runtimeAssets.fortran.baseUrl`/`f2cWasmUrl`/`libf2cUrl`/`f2cHeaderUrl`/`analyzerUrl` or `PUBLIC_WASM_FORTRAN_*`; `runtimeAssets.clang.baseUrl`/`loader` for the C backend; `activePath`, `workspaceFiles`, `compileArgs`                                                                                                                        |
+| COBOL<br>`COBOL`                   | GnuCOBOL 3.2 + GMP 6.3.0 assets from the `wasm-llvm` producer + @wasm-idle/llvm-core@1.0.0                                                                                     | native gzip delivery for the frontend Wasm and filesystem tar assets; translates free-format COBOL with the real GnuCOBOL `cobc` frontend, compiles the generated C with the llvm-core Clang host, links libcob/GMP, and executes the resulting WASI module with `stdin` and `programArgs`                                                                                                                                                                                                                                                                              | `runtimeAssets.cobol.baseUrl` or `PUBLIC_WASM_COBOL_BASE_URL`; `runtimeAssets.clang.baseUrl`/`loader` for the C backend; `activePath`, `workspaceFiles`, `compileArgs`                                                                                                                                                                           |
+| R<br>`R`                           | versioned static `static/webr/<hash>/webr.js` / webr@0.6.0                                                                                                                     | loads the browser ESM entry `webr.js` and its WebR runtime files from the configured static asset tree on demand; supports `stdin`, `programArgs`, and workspace files                                                                                                                                                                                                                                                                                                                                                                                                  | `runtimeAssets.r.baseUrl` or `PUBLIC_WASM_R_BASE_URL`; `stdin`, `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                                                                                                    |
+| Octave<br>`OCTAVE`                 | Octave 10.3.0 (octave-10.3.0-pl5321h996e327_3.tar.bz2)                                                                                                                         | Octave CLI Emscripten worker; supports `stdin` and `programArgs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `runtimeAssets.octave.baseUrl`/`workerUrl`/`manifestUrl` or `PUBLIC_WASM_OCTAVE_*`                                                                                                                                                                                                                                                               |
+| DuckDB<br>`DUCKDB`                 | static ESM `static/wasm-duckdb/runtime.mjs` produced from @duckdb/duckdb-wasm@1.33.1-dev45.0                                                                                   | selects the best DuckDB-Wasm MVP/EH bundle on demand and creates a fresh in-memory database per run; `stdin` is registered as `stdin.txt` and `/dev/stdin` rather than terminal stdin                                                                                                                                                                                                                                                                                                                                                                                   | `runtimeAssets.duckdb.moduleUrl` or `PUBLIC_WASM_DUCKDB_MODULE_URL` or `rootUrl`; `stdin`, `activePath`, `workspaceFiles`                                                                                                                                                                                                                        |
+| SQLite<br>`SQLITE`                 | static ESM `static/wasm-sqlite/runtime.mjs` produced from sql.js@1.14.1                                                                                                        | sql.js loads `sql-wasm.wasm` on demand and executes SQL in a fresh in-memory database; terminal stdin is not applicable                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `runtimeAssets.sqlite.moduleUrl`/`wasmUrl` or `PUBLIC_WASM_SQLITE_MODULE_URL`/`PUBLIC_WASM_SQLITE_WASM_URL` or `rootUrl`; `workspaceFiles`                                                                                                                                                                                                       |
+| PHP<br>`PHP`                       | static ESM `static/wasm-php/runtime.mjs` prebuilt by the standalone `producers/wasm-php` producer from @php-wasm/web-8-4@3.1.34 + @php-wasm/universal@3.1.34                   | fixed PHP `8.4` php-wasm runtime; injects `$argv`/`$argc` and runs the active workspace script with `php.run`; supports `stdin` and `programArgs`; there is no runtime version selector                                                                                                                                                                                                                                                                                                                                                                                 | `runtimeAssets.php.moduleUrl` or `PUBLIC_WASM_PHP_MODULE_URL` or `rootUrl`; `stdin`, `programArgs`, `activePath`, `workspaceFiles`                                                                                                                                                                                                               |
 
 ### Blocked candidates
 
@@ -138,11 +275,12 @@ These languages are intentionally not part of the execution support matrix yet.
 out of `supportedLanguages` until the blocker is resolved with a real browser runtime/compiler and
 stdin/stdout coverage.
 
-| Candidate      | Candidate IDs | Current evidence                                                                                                                                                                                         | Blocker                                                                                                                                                                                  | Required follow-up                                                                                                                                                            |
-| -------------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Modern Fortran | `F90`, `F95`  | `FORTRAN` now runs through f2c/libf2c, while `static/wasm-fortran` still packages LFortran analyzer assets                                                                                               | LFortran WASM/WAT stdin codegen still aborts and the C backend reports `visit_FileRead() not implemented`; f2c covers Fortran 77-style code but is not a full modern Fortran compiler    | Package a real browser modern Fortran compiler/runtime with stdin-capable codegen before advertising F90/F95 as first-class runtimes                                          |
-| Crystal        | `CRYSTAL`     | No browser Crystal compiler/runtime assets are packaged in this repository                                                                                                                               | Crystal cannot be treated as syntax-only or as a wasm-idle-authored translator/subset                                                                                                    | Find or build a browser-hosted real Crystal compiler/runtime path with stdin/stdout coverage before registering the language                                                  |
-| Swift          | `SWIFT`       | Swift.org documents Wasm support through a native Swift 6.x toolchain plus a Wasm SDK, and SwiftWasm Pad uses a backend compile service; no browser-hosted swiftc/SwiftPM runtime asset is packaged here | Swift cannot be implemented as a wasm-idle-authored parser/runtime subset or as a remote compile service; the playground needs a redistributable browser-hosted real Swift compiler path | Build or source a browser-hosted Swift compiler/SwiftPM runtime bundle, prove stdin/stdout execution for generated WASI modules, then register SWIFT as a first-class runtime |
+| Candidate      | Candidate IDs | Current evidence                                                                                                                                                                                                                        | Blocker                                                                                                                                                                               | Required follow-up                                                                                                                                                                                       |
+| -------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Odin           | `ODIN`        | [Pinned native WASI baseline](https://github.com/seo-rii/wasm-llvm/pull/2) compiles real multi-file Odin and passes stdin, EOF and nonzero-exit cases; the consumer target probe exercises the production WASM Worker                   | The compiler-host Emscripten probe fails in upstream gb.h on unsupported OS/CPU definitions and missing sys/sendfile.h; no browser-hosted Odin compiler exists in the bundle          | [Complete the compiler host port and consumer acceptance](docs/language-ports/odin.md) before registering ODIN; native target execution does not enable source compilation                               |
+| Modern Fortran | `F90`, `F95`  | `FORTRAN` now runs through f2c/libf2c, while `static/wasm-fortran` still packages LFortran analyzer assets                                                                                                                              | LFortran WASM/WAT stdin codegen still aborts and the C backend reports `visit_FileRead() not implemented`; f2c covers Fortran 77-style code but is not a full modern Fortran compiler | Package a real browser modern Fortran compiler/runtime with stdin-capable codegen before advertising F90/F95 as first-class runtimes                                                                     |
+| Crystal        | `CRYSTAL`     | [Pinned Crystal 1.21.0 producer](https://github.com/seo-rii/wasm-llvm/pull/3) emits a real WASI object; the consumer probe links that target with verified WASI libc and exercises standard input and EOF in the production WASM Worker | Cross-compiling the compiler fails at Crystal::System::Process.prepare_args in the upstream WASI process implementation; no browser-hosted Crystal compiler bundle is available       | [Implement the compiler host and consumer source-execution contract](docs/language-ports/crystal.md) before registering CRYSTAL; a native object or linked target does not establish browser compilation |
+| Swift          | `SWIFT`       | Native Swift 6.3.3 and the full Wasm SDK produce a target that passes Chromium stdin/UTF-8/EOF checks through the production WASM worker with explicit and shared-buffer input; browser-hosted swiftc/SwiftPM assets remain unavailable | Target execution evidence does not supply a browser-hosted real Swift compiler or SwiftPM; SWIFT remains unregistered                                                                 | Produce a browser-hosted Swift compiler/SwiftPM bundle and pass source compilation, diagnostics, arguments, and workspace contracts before registering SWIFT                                             |
 
 ## Monorepo layout
 
@@ -158,7 +296,7 @@ toolchains can be consumed from pinned external runtime repositories:
   an explicit HTTP(S) URL.
 - `packages/lsp`: code-only browser language-server hosts. TypeScript libraries, SQL engines,
   clangd, and other language-tool assets are supplied through explicit runtime URLs.
-- `wasm-llvm`: external producer repository for compiler source pins, patches, reproducible builds,
+- [`seo-rii/wasm-llvm`](https://github.com/seo-rii/wasm-llvm): external producer repository for compiler source pins, patches, reproducible builds,
   manifests, and asset verification. Its `producer/rust-browser` source build owns the current Rust
   1.99 compiler, matching LLVM 22 code generator, and in-process LLD; it is not consumed as an npm
   runtime package.
@@ -169,10 +307,13 @@ toolchains can be consumed from pinned external runtime repositories:
 - `packages/vue`: Vue composables around `@wasm-idle/core`.
 - `packages/node`: Node.js host helpers for Node-capable sandbox loaders.
 - `runtimes/*`: imported runtime/compiler packages such as `wasm-rust`,
-  `wasm-of-js-of-ocaml`, `wasm-go`, `wasm-tinygo`, `wasm-dotnet`, `wasm-typescript`,
+  `wasm-of-js-of-ocaml`, `wasm-go`, `wasm-dotnet`, `wasm-typescript`,
   `wasm-wat`, `wasm-lua`, `wasm-lisp`, `wasm-elixir`, `wasm-tcl`, `wasm-awk`,
   `wasm-forth`, `wasm-j`, `wasm-bqn`, `wasm-janet`,
   `pyodide`, `teavm`, `assemblyscript`, `ruby`, `r`, and `js-sandbox`.
+- `runtimes/wasm-tinygo`: the public `TINYGO` browser compiler consumer plus an explicitly labeled
+  legacy AST-to-C development harness. Static releases publish only the receipt-verified upstream
+  consumer and its source-pinned toolchain assets.
 - `producers/wasm-php`: standalone, locked producer for the checked-in PHP 8.4 page asset. It is
   outside the root workspace and is never published as an npm package.
 - `static/wasm-zig`, `static/wasm-haskell`, `static/wasm-julia`, and `static/wasm-nim`: bundled browser runtime and
@@ -215,8 +356,9 @@ pnpm run build:static-runtime-modules
 
 This producer step writes `runtime.mjs` trees under `static/wasm-assemblyscript/`,
 `static/wasm-duckdb/`, `static/wasm-ruby/`, and `static/wasm-sqlite/`. It also writes the Wasmer SDK
-module, worker, and WASM payload under `static/wasm-bash/sdk/`. The browser loads each module on
-demand when its language is selected; these files are deployed page assets, not npm package
+compatibility files and the unified Bash runtime profile under `static/wasm-bash/` through the same
+rollback-capable Bash producer used by `sync:wasm-bash`. The browser consumes only the profile's
+opaque, receipt-pinned storage paths; these files are deployed page assets, not npm package
 contents.
 
 PHP is built independently under `producers/wasm-php`, with its own lockfile and exact
@@ -272,8 +414,10 @@ handwritten wasm-idle subset, but it inherits AtomVM/Popcorn runtime limits and
 Erlang/OTP ERTS coverage. Some OTP paths that rely on missing NIFs can fail in the current bundle,
 so the browser starter and stdin coverage use `io:get_line`/`io:format` only.
 
-Julia browser execution uses the `@chriskoch/julia-wasm` Julia 1.0.4 asset bundle under
-`static/wasm-julia/`. Refresh the vendored worker/runtime assets with:
+Julia browser execution uses the `@chriskoch/julia-wasm@1.0.4` asset bundle under
+`static/wasm-julia/`. Despite the package and bundled README version, the verified runtime reports
+`VERSION == v"1.3.0-DEV.560"`; wasm-idle therefore labels it as a legacy development runtime.
+Refresh the vendored worker/runtime assets with:
 
 ```bash
 cd wasm-idle
@@ -291,14 +435,28 @@ pnpm run sync:wasm-nim
 
 ## Rust browser integration
 
-The demo app bundles the workspace `wasm-rust` browser compiler under `static/wasm-rust/` and points
-the example `Terminal` at `/wasm-rust/index.js` by default. Refresh it with:
+The demo app publishes the workspace `wasm-rust` compiler as a receipt-pinned executable graph
+under `static/wasm-rust/`. The example `Terminal` uses `/wasm-rust/index.js` as the graph's logical
+base URL; that logical JavaScript path is never fetched or imported. Verified module bytes are
+served from inert `.js.bin`/`.js.gz.bin` storage and execute only through owned Blob URLs. Refresh
+the receipts for the checked static publication with the command below. Publication removes raw or
+precompressed JavaScript outside the verified graph; the separately scoped debug instrumenter is
+the only explicit raw-JavaScript allowlist.
 
 ```bash
-pnpm --dir runtimes/wasm-rust build
 pnpm run sync:wasm-rust
 ```
 
+Publishing a newly built producer dist is an explicit operation and succeeds only when both graph
+authorities match `scripts/wasm-rust-assets.lock.json`. It replaces the complete published runtime
+tree, including WASI sysroot/link packs, so first verify that the producer dist contains the exact
+pack generation intended for publication:
+
+```bash
+pnpm --dir runtimes/wasm-rust build
+pnpm run sync:wasm-rust -- runtimes/wasm-rust/dist
+```
+
 The built-in Rust route supports `wasm32-wasip1`, `wasm32-wasip2`, and `wasm32-wasip3`. The page
 exposes a target selector when Rust is active, defaults to `wasm32-wasip1`, and persists that choice
 in local storage. The compiler module, rustc, sysroot, and component tooling remain unloaded until
@@ -306,25 +464,49 @@ Rust is selected; LSP assets remain unloaded until the LSP toggle is enabled.
 
 ## TinyGo browser integration
 
-The demo app can also vendor the workspace `wasm-tinygo` browser build under `static/wasm-tinygo/`
-and load its `runtime.js` entry directly inside the TinyGo playground sandbox. The example page
-uses the bundled browser runtime by default, including on `localhost` during `vite dev` /
-`vite preview`. Refresh the
-bundled runtime assets after rebuilding the workspace project with:
+`TINYGO` is a public `wasip1` playground language backed by the independent `upstream.js`
+consumer. It never falls back to wasm-idle's older Go AST-to-C porting harness: the static sync
+allowlist excludes `runtime.js`, its runtime chunks, emception, and the legacy compiler payload.
+The legacy code remains in `runtimes/wasm-tinygo` only for local compiler-port development and is
+explicitly classified as `wasm-idle-go-ast-to-c-subset`.
+
+The sibling `wasm-llvm/producer/tinygo-browser` producer pins upstream TinyGo 0.40.1, go-llvm,
+TinyGo LLVM 20.1.1, Go 1.24.6, and WASI SDK 33. The public consumer hash-verifies both producer
+receipts, the upstream compiler, reduced TinyGo/Go root, `cmd/go` WASI package-graph provider, and
+raw LLD before compiling. It derives package JSON from the supplied module workspace, validates
+every compiler/link-plan handoff, links with raw LLD, and finalizes with pinned Binaryen 129.
+
+Compile protocol v6 covers generated `go:embed` objects, CGo C, hosted libc++/libc++abi C++17
+without exceptions/RTTI/global constructors, preprocessed Clang assembly, exact allowed
+`CXXFLAGS`, and restricted `#cgo LDFLAGS`. Offline external modules require a complete
+`vendor/modules.txt` tree; there is no network module fallback. Package-graph and compile work run
+inside disposable Workers with fail-closed phase deadlines and a capped WebAssembly memory
+declaration. Separate producer and consumer fixtures cover maps, slices, structs, methods,
+interfaces, generics, package initialization, goroutines, channels, stdin, CGo, C++, and assembly.
+Go/Plan 9 assembly is still not loaded by upstream TinyGo 0.40.1 and is documented as an upstream
+limitation rather than emulated by a browser-only subset.
+
+Prepare a verified asset directory, build the runtime, and publish the upstream-only static tree
+with:
 
 ```bash
-pnpm --dir runtimes/wasm-tinygo build
+pnpm --dir runtimes/wasm-tinygo prepare:wasm-llvm-upstream -- \
+  --compiler /path/to/tinygo-compiler.wasm \
+  --root-archive /path/to/tinygoroot.tar.gz \
+  --producer-receipt /path/to/producer-receipt.json \
+  --package-graph /path/to/tinygo-package-graph.wasm \
+  --package-graph-receipt /path/to/package-graph-provider-receipt.json \
+  --lld /path/to/lld.wasm \
+  --output-dir public/tools/upstream
+pnpm --dir runtimes/wasm-tinygo build:upstream
 pnpm run sync:wasm-tinygo
 ```
 
-TinyGo exposes `wasm`, `wasip1`, `wasip2`, and `wasip3` targets through the example page. The
-browser pipeline still lives inside `wasm-tinygo`; `wasm-idle` imports its reusable `runtime.js`
-library entry directly, forwards the selected target into the build request, then runs the emitted
-artifact with browser WASI so terminal stdin/EOF behavior stays consistent with the other runtimes.
-The default bundled browser path loads the vendored TinyGo runtime in `direct` mode, skips the old
-bootstrap-only compile step, and runs runnable WASI artifacts locally. The `wasip2` and `wasip3`
-entries use the preview target profiles shipped by the bundled `wasm-tinygo` runtime, so they may
-produce non-runnable preview artifacts until the matching execution path is available.
+`PUBLIC_WASM_TINYGO_MODULE_URL` or `runtimeAssets.tinygo.moduleUrl` may point at a separately hosted
+`upstream.js`; its sibling chunks and `tools/upstream/` assets must be served from the same relative
+tree. `PUBLIC_WASM_TINYGO_APP_URL` remains a compatibility alias used only to derive that module
+URL. Custom hosts may provide `runtimeAssets.tinygo.assetLoader`, while normal execution and
+workspace limits continue to apply.
 
 ## C# / F# / VB.NET / .NET browser integration
 
@@ -353,35 +535,59 @@ browser UI thread.
 
 ## Browser regression commands
 
-Browser-level Rust and TinyGo checks are reproducible from this repo:
+C3 local asset setup, byte I/O ABI, and its 1 GiB default memory budget are documented in
+[C3 browser integration](docs/c3-browser.md).
+
+Clean checkouts can prepare the ignored Clang, clangd, and OCaml browser payloads from one
+receipt-verified manifest:
+
+```bash
+pnpm run prepare:test-assets -- clangd
+pnpm run prepare:test-assets -- clang ocaml
+```
+
+`scripts/browser-test-assets.v1.json` pins one existing Git snapshot of the published asset graph
+and every downloaded file's exact size and SHA-256 digest. CI downloads that immutable snapshot
+from GitHub without WAF credentials. Update the snapshot URL and all changed receipts together;
+do not replace a receipt with bytes from a mutable deployment URL. Receipt failures report both
+expected and actual byte counts and SHA-256 digests.
+
+OCaml preparation keeps these verified download inputs in a separate receipt-keyed cache,
+compiles the tracked TypeScript browser adapter with the producer's locked compiler, and syncs
+that adapter together with the verified native bundle. The sync derives the final
+`wasmOcamlVersion.ts` profile; downloaded input receipts remain unchanged. This makes adapter
+fixes reproducible in clean CI without rebuilding or publishing the native OCaml toolchain.
+Gzip-only Binaryen inputs are checked against their expanded manifest receipts before sync.
+At runtime, raw gzip packs retain compressed and expanded receipt checks; HTTP-decoded packs
+are bounded and verified against the exact expanded size and SHA-256.
+
+The preparer rejects source or target paths outside their configured roots, checks each redirect
+before following it, writes atomically, and reuses only matching files. With no group argument,
+it prepares both the Clang delivery bundle and the complete OCaml browser compiler graph.
+`WASM_IDLE_TEST_ASSET_BASE_URL` can select a compatible mirror with the same receipt-verified bytes.
+For protected local browser tests, provide `WASM_IDLE_TEST_BYPASS_COOKIE` through the environment
+in `dev_bypass_waf=<value>` form; the browser cookie jar scopes it to the test origin. Asset
+downloads forward this optional cookie only to the trusted `https://seorii.page` origin and never
+to GitHub or another mirror. There is no built-in credential fallback.
+
+Browser-level Rust checks are reproducible from this repo:
 
 ```bash
 cd wasm-idle
 pnpm run probe:rust-browser
 pnpm run test:browser:playwright
-pnpm run probe:tinygo-browser
-pnpm run test:browser:tinygo
 
 WASM_IDLE_BROWSER_URL='http://localhost:5173/absproxy/5173/' \
 WASM_IDLE_REUSE_LOCAL_PREVIEW=1 \
 pnpm run probe:rust-browser
 
-WASM_IDLE_BROWSER_URL='http://localhost:5173/absproxy/5173/' \
-WASM_IDLE_REUSE_LOCAL_PREVIEW=1 \
-pnpm run probe:tinygo-browser
-
 WASM_IDLE_RUN_REAL_BROWSER_RUST=1 \
 WASM_IDLE_BROWSER_URL='http://localhost:5173/absproxy/5173/' \
 WASM_IDLE_REUSE_LOCAL_PREVIEW=1 \
 pnpm exec vitest run src/lib/playground/rust.playwright.test.ts
-
-WASM_IDLE_RUN_REAL_BROWSER_TINYGO=1 \
-WASM_IDLE_BROWSER_URL='http://localhost:5173/absproxy/5173/' \
-WASM_IDLE_REUSE_LOCAL_PREVIEW=1 \
-pnpm exec vitest run src/lib/playground/tinygo.playwright.test.ts
 ```
 
-Both runtime probes exercise the real Chromium page path. The default Rust probe now feeds stdin with a
+The runtime probe exercises the real Chromium page path. The default Rust probe now feeds stdin with a
 single line (`5\n`) and expects the page to finish without sending EOF, which keeps the regression
 aligned with the default Rust sample and proves that pressing Enter is enough for line-based stdin.
 Programs that intentionally read stdin until EOF can still be finished with `Ctrl+D` or the toolbar
@@ -389,9 +595,6 @@ Programs that intentionally read stdin until EOF can still be finished with `Ctr
 The browser helper writes stdin through the page-owned `window.__wasmIdleDebug.writeTerminalInput(...)`
 hook instead of trying to click xterm's hidden helper textarea, which proved too flaky for repeatable
 Playwright runs.
-The TinyGo probe follows the same pattern. The browser path should load the vendored runtime in
-`direct` mode and avoid the old bootstrap compile command altogether.
-The TinyGo browser commands currently default to `vite dev`.
 If Rust ever reports `invalid metadata files for crate core` or `Unsupported archive identifier`,
 the browser almost always fetched a stale or wrong `wasm-rust` sysroot asset. Hard refresh the page
 and rebuild then resync `static/wasm-rust/` from `runtimes/wasm-rust/dist/`.
@@ -409,6 +612,13 @@ session; the repo-owned regression target is the local preview path above.
 
 ## Runtime expectations
 
+The BQN, Forth, and Tcl static Workers use a shared stdin ring. Its write counter and EOF/cancel
+flags are separate atomic values: notifying a waiter does not change its expected write counter.
+Their Worker-only waits therefore recheck these flags at least every 100 ms while scheduled, even
+when an EOF/cancel notification arrives just before the wait starts. This is not an input deadline;
+an open, empty stdin remains available for later input. `staticStdinRingWorker.test.ts` forces that
+check-to-wait ordering for both EOF and cancellation without relying on scheduling luck.
+
 `@wasm-idle/terminal` is an optional browser UI package:
 
 ```bash
@@ -456,9 +666,11 @@ loaded for compatibility instead of participating in the default runtime path.
 
 `@wasm-idle/lsp` keeps its host and provider JS in the package. Heavy compiler/runtime modules are
 external static assets loaded only after LSP is enabled: Python uses `pyodide/pyodide.mjs`, R uses
-the versioned `webr/<hash>/webr.js`, and the AssemblyScript, DuckDB/SQLite SQL, and Ruby providers
-reuse their `static/wasm-*/runtime.mjs` trees. Other compiler-backed providers follow the same
-external URL model through their language-server asset configuration.
+the versioned `webr/<hash>/webr.js`, and the AssemblyScript and DuckDB/SQLite SQL providers reuse
+their `static/wasm-*/runtime.mjs` trees. Ruby instead requires a complete identity-and-receipt
+profile; the page host verifies its manifest, module, and compressed Wasm before creating the LSP
+worker. Other compiler-backed providers follow the same external URL model through their
+language-server asset configuration.
 
 Pure-JavaScript provider engines for TypeScript, GraphQL, WAT, and document languages are optional
 peers of `@wasm-idle/lsp`, not mandatory production dependencies. The Pages application keeps
@@ -467,17 +679,16 @@ and its language is selected. Vite emits those providers into lazy worker chunks
 fetched before they are needed. Library consumers using one of those providers must install its
 optional peer set, while compiler and language-runtime payloads still come only from external URLs.
 
-Rust still supports an external browser compiler module for library consumers. Point
-`PUBLIC_WASM_RUST_COMPILER_URL` at a built `wasm-rust` ESM entry such as
-`.../wasm-rust/dist/index.js`, or pass `runtimeAssets.rust.compilerUrl` at runtime. Rust source
-instrumentation is emitted as the separate `debug-instrumenter.js` static asset and is imported
-only for debug executions. Override it with `runtimeAssets.rust.debugModuleUrl`; otherwise
-wasm-idle resolves it beside the configured compiler module and preserves the compiler URL version
-query.
-TinyGo expects a browser-loadable `wasm-tinygo` runtime module. Point
-`PUBLIC_WASM_TINYGO_MODULE_URL` at a built entry such as `.../wasm-tinygo/dist/runtime.js`, or
-pass `runtimeAssets.tinygo.moduleUrl` at runtime. The older `PUBLIC_WASM_TINYGO_APP_URL` /
-`runtimeAssets.tinygo.appUrl` document path is still accepted and normalized to `runtime.js`.
+Rust supports an external mirror of the pinned compiler graph for library consumers. Set
+`PUBLIC_WASM_RUST_COMPILER_URL` or `runtimeAssets.rust.compilerUrl` to the logical `index.js` URL
+with the exact generated runtime-manifest query, and mirror every `.bin` delivery path and receipt
+from `WASM_RUST_EXECUTABLE_GRAPH_PROFILE`. An arbitrary browser-loadable ESM entry or a raw
+`dist/index.js` is rejected. Rust source instrumentation remains a separate static asset.
+TinyGo uses the public receipt-verified `static/wasm-tinygo/upstream.js` compiler by default.
+Override it with `PUBLIC_WASM_TINYGO_MODULE_URL` or `runtimeAssets.tinygo.moduleUrl`; a custom
+`runtimeAssets.tinygo.assetLoader` can serve the module's verified sibling toolchain files. The
+public route supports only `wasip1` and rejects unsupported targets instead of selecting the legacy
+subset.
 WAT uses the bundled `static/wasm-wat/` WABT browser module by default. Override it with
 `PUBLIC_WASM_WAT_MODULE_URL`, or pass `runtimeAssets.wat.moduleUrl`.
 WASM executes binary WebAssembly modules directly through the browser WebAssembly API. The editor
@@ -499,9 +710,13 @@ environment-based version selector. Override only the module location with
 `PUBLIC_WASM_PHP_MODULE_URL` or `runtimeAssets.php.moduleUrl`. A custom host must serve the entry's
 sibling chunks and assets with compatible CORS and cross-origin isolation headers; a cross-origin
 host cannot use wasm-idle's same-origin gzip service worker.
-Bash dynamically imports the Wasmer SDK from `static/wasm-bash/sdk/index.mjs`, initializes its
-static worker, and then loads `bash.webc`. Override these three URLs with
-`runtimeAssets.bash.moduleUrl`, `workerUrl`, and `webcUrl`, or derive all of them from `rootUrl`.
+Bash verifies one unified manifest plus the stored Wasmer SDK JavaScript, Wasmer Wasm, and WEBc
+before it starts the outer worker. The worker imports only the verified SDK bytes and uses a fixed
+application-owned nested bootstrap; SDK, worker, Wasm, WEBc, sentinel, and registry network
+fallbacks are not part of the normal execution path. A `rootUrl` mirror reuses the bundled profile.
+Explicit `runtimeAssets.bash.baseUrl`, `manifestUrl`, `moduleUrl`, `wasmerWasmUrl`, or `webcUrl`
+overrides require a complete matching profile and receipts. Arbitrary `workerUrl` overrides are
+rejected because executable nested-worker substitution is outside the trust contract.
 Lua uses the bundled `static/wasm-lua/` wasmoon browser module plus its local `glue.wasm`
 payload by default. Override it with `PUBLIC_WASM_LUA_MODULE_URL`, or pass
 `runtimeAssets.lua.moduleUrl`.
@@ -510,12 +725,30 @@ standard library by default. Override them with `PUBLIC_WASM_ZIG_COMPILER_URL` a
 `PUBLIC_WASM_ZIG_STDLIB_URL`, or pass `runtimeAssets.zig.compilerUrl` and
 `runtimeAssets.zig.stdlibUrl`. The compiler runs under browser WASI, emits a `wasm64-wasi`
 artifact with the self-hosted backend, and wasm-idle executes that artifact locally in the worker.
-Scheme uses the bundled `static/wasm-lisp/` Puppy Scheme compiler module by default. Override it
-with `PUBLIC_WASM_LISP_MODULE_URL`, or pass `runtimeAssets.lisp.moduleUrl`.
-Ruby dynamically imports `static/wasm-ruby/runtime.mjs`, which exposes CRuby 3.4 and its default
-`ruby+stdlib.wasm` URL. Override the module or WASM payload with
-`runtimeAssets.ruby.moduleUrl`/`wasmUrl` or `PUBLIC_WASM_RUBY_MODULE_URL`/
-`PUBLIC_WASM_RUBY_WASM_URL`.
+Scheme uses the bundled `static/wasm-lisp/` Puppy Scheme compiler profile by default. The execution
+and LSP workers verify its pinned manifest, stored bytes, decompressed size, and logical asset hashes
+before importing code. A custom profile must provide `runtimeAssets.lisp.moduleUrl`, `manifestUrl`,
+and `manifestFingerprint`, or the corresponding `PUBLIC_WASM_LISP_*` variables.
+Tcl uses the bundled `static/wasm-tcl/` Wacl profile by default. The host verifies the manifest and
+all transport receipts, manually decompresses the canonical `.gz.bin` assets with exact output
+limits, and transfers only verified logical bytes to a runner that pins the same manifest
+fingerprint and closes after one run. URL-only overrides may mirror the bundled bytes. Authorizing
+different executable bytes requires all Tcl identity fields, manifest and asset receipts, plus the
+matching `workerReceipt` in the same `runtimeAssets.tcl` object; omitted trust fields never fall back
+to bundled values. The pinned Wacl/RequireJS payload remains trusted executable code: its verified
+bootstrap needs no follow-up asset fetch, but the worker is not a general network sandbox. Hosts
+must serve `.gz.bin` as opaque bytes without `Content-Encoding: gzip`; legacy `.gz` aliases are not
+referenced by the current manifest.
+Ruby uses the receipt-pinned `static/wasm-ruby/` CRuby 3.4 profile. Before creating a worker, the
+page host verifies `runtime-manifest.v2.json`, canonical `runtime.mjs.bin` storage, compressed
+`ruby_stdlib-*.wasm.gz.bin` storage, the decompressed WASM receipt, and the complete provenance
+fingerprint. It then transfers exactly those three verified logical buffers to a persistent worker
+that performs no runtime-asset fetches. A `rootUrl` mirror reuses the bundled profile. Any explicit
+`runtimeAssets.ruby` override must provide one complete identity-and-receipt profile and use its
+same-origin canonical paths with absent or exact receipt query pins. URL-only
+`PUBLIC_WASM_RUBY_*` overrides intentionally fail closed. The producer receipt covers every
+package-owned Vite file but excludes pnpm-generated nested `node_modules/.bin/` launch shims, whose
+installation paths are not reproducible package content.
 AssemblyScript dynamically imports `static/wasm-assemblyscript/runtime.mjs`, produced from the
 pinned AssemblyScript compiler and loader. Override it with
 `PUBLIC_WASM_ASSEMBLYSCRIPT_MODULE_URL` or `runtimeAssets.assemblyscript.moduleUrl`. Compilation
@@ -537,7 +770,7 @@ the Rust worker:
 - `wasm32-wasip1` runs as preview1 core wasm through `@bjorn3/browser_wasi_shim`
 - `wasm32-wasip2` runs as a preview2 component through `preview2-shim` plus transpiled `jco` output
 
-The generic `src/lib/clang/app.ts` host remains in place for other runtimes, but Rust now delegates
+C-family compilation remains hosted by `@wasm-idle/llvm-core`, while Rust delegates artifact
 execution to `wasm-rust` so the selected target and returned artifact format stay aligned.
 
 `Terminal` and `playground(...).load(...)` support either the legacy shared `path`/`rootUrl` or per-runtime asset config:
@@ -556,17 +789,9 @@ const runtimeAssets: PlaygroundRuntimeAssets = {
 	php: {
 		moduleUrl: 'https://cdn.example.com/repl/wasm-php/runtime.mjs'
 	},
-	ruby: {
-		moduleUrl: 'https://cdn.example.com/repl/wasm-ruby/runtime.mjs'
-	},
 	sqlite: {
 		moduleUrl: 'https://cdn.example.com/repl/wasm-sqlite/runtime.mjs'
 	},
-	bash: {
-		moduleUrl: 'https://cdn.example.com/repl/wasm-bash/sdk/index.mjs',
-		workerUrl: 'https://cdn.example.com/repl/wasm-bash/sdk/worker.mjs',
-		webcUrl: 'https://cdn.example.com/repl/wasm-bash/bash.webc'
-	},
 	python: {
 		loader: async ({ asset }) => ({ url: `https://cdn.example.com/repl/pyodide/${asset}` })
 	},
@@ -583,14 +808,12 @@ const runtimeAssets: PlaygroundRuntimeAssets = {
 		loader: async ({ asset }) => ({ url: `https://cdn.example.com/repl/clangd/${asset}` })
 	},
 	rust: {
-		compilerUrl: 'https://cdn.example.com/wasm-rust/index.js'
+		compilerUrl:
+			'https://cdn.example.com/wasm-rust/index.js?v=<runtime-manifest-sha256>&rustManifestBytes=<runtime-manifest-bytes>&rustManifestSha256=<runtime-manifest-sha256>'
 	},
 	dotnet: {
 		moduleUrl: 'https://cdn.example.com/wasm-dotnet/index.js'
 	},
-	tinygo: {
-		moduleUrl: 'https://cdn.example.com/wasm-tinygo/runtime.js'
-	},
 	wat: {
 		moduleUrl: 'https://cdn.example.com/wasm-wat/index.js'
 	},
@@ -609,14 +832,6 @@ const runtimeAssets: PlaygroundRuntimeAssets = {
 		rootfsUrl: 'https://cdn.example.com/wasm-haskell/rootfs.tar.zst',
 		bsdtarUrl: 'https://cdn.example.com/wasm-haskell/bsdtar.wasm'
 	},
-	janet: {
-		baseUrl: 'https://cdn.example.com/wasm-janet/',
-		workerUrl: 'https://cdn.example.com/wasm-janet/runner-worker.js'
-	},
-	julia: {
-		baseUrl: 'https://cdn.example.com/wasm-julia/',
-		workerUrl: 'https://cdn.example.com/wasm-julia/runner-worker.js'
-	},
 	nim: {
 		baseUrl: 'https://cdn.example.com/wasm-nim/',
 		workerUrl: 'https://cdn.example.com/wasm-nim/runner-worker.js'
@@ -629,7 +844,12 @@ file. Mirror its complete sibling asset tree at the same relative paths. Cross-o
 must provide compatible CORS and COEP/CORP headers and cannot rely on wasm-idle's same-origin gzip
 service worker.
 
-Python custom loaders receive file names under the Pyodide asset root and can serve both core assets and package files. TeaVM custom loaders receive file names under the TeaVM asset root. Clang custom loaders receive `bin/memfs.wasm.gz`, `bin/clang.wasm.gz`, `bin/lld.wasm.gz`, and `bin/sysroot.tar.gz`; COBOL loaders receive `cobc.wasm.gz`, `rootfs.tar.gz`, and `c-sysroot.tar.gz`. The shared loader pipes these gzip response bodies through native `DecompressionStream`. Legacy external manifests that still reference ZIP assets remain supported through the dynamically loaded `fflate` compatibility path. Zig custom loaders receive `zig_small.wasm` and `std.tar.gz`; an explicitly configured legacy `std.zip` URL remains compatible. Clangd custom loaders receive `clangd.js` and `clangd.wasm.gz`, with the worker decompressing the gzip payload before instantiation. Rust expects a browser-loadable compiler module URL; that module is responsible for serving its own nested runtime assets. C#, F#, and VB.NET expect a browser-loadable `wasm-dotnet` module with its language-specific static .NET `browser-wasm` runtime assets. TinyGo expects a browser-loadable runtime module. The browser runtime now ships a direct-mode execution path that can produce and run the bundled TinyGo WASI artifact locally, alongside `tools/go-probe.wasm` and vendored emception assets. TinyGo also accepts a runtime asset loader + pack bundle in `runtimeAssets.tinygo` when you need to serve runtime assets out of a single compressed archive. Compressed TeaVM runtime assets are no longer unpacked inside the library; provide the final file URL or handle decompression in your own loader.
+Verified static runtimes such as Janet and Julia intentionally omit URL-only examples: a custom
+`baseUrl`, `manifestUrl`, or `workerUrl` must be accompanied by every identity and asset-receipt
+field declared by that runtime's asset config, including the matching `workerReceipt`. Partial
+trust bundles fail closed instead of borrowing receipts from bundled executable bytes.
+
+Python custom loaders receive file names under the Pyodide asset root and can serve both core assets and package files. TeaVM custom loaders receive file names under the TeaVM asset root. Clang custom loaders receive `bin/memfs.wasm.gz`, `bin/clang.wasm.gz`, `bin/lld.wasm.gz`, and `bin/sysroot.tar.gz`; COBOL loaders receive `cobc.wasm.gz`, `rootfs.tar.gz`, and `c-sysroot.tar.gz`. The shared loader pipes these gzip response bodies through native `DecompressionStream`. Legacy external manifests that still reference ZIP assets remain supported through the dynamically loaded `fflate` compatibility path. Zig custom loaders receive `zig_small.wasm` and `std.tar.gz`; an explicitly configured legacy `std.zip` URL remains compatible. Clangd custom loaders receive `clangd.js` and `clangd.wasm.gz`, with the worker decompressing the gzip payload before instantiation. Rust expects a logical, profile-pinned graph entry URL whose sibling inert storage exactly matches the generated receipts; it does not import that HTTP entry directly. C#, F#, and VB.NET expect a browser-loadable `wasm-dotnet` module with its language-specific static .NET `browser-wasm` runtime assets. Compressed TeaVM runtime assets are no longer unpacked inside the library; provide the final file URL or handle decompression in your own loader.
 
 To reuse the same runtime asset configuration for both `<Terminal>` and direct `playground(...)`
 access, bind it once:
@@ -641,21 +861,11 @@ import { createPlaygroundBinding } from 'wasm-idle';
 const wasmIdle = createPlaygroundBinding({
 	rootUrl: 'https://cdn.example.com/repl',
 	rust: {
-		compilerUrl: 'https://cdn.example.com/wasm-rust/index.js'
+		compilerUrl:
+			'https://cdn.example.com/wasm-rust/index.js?v=<runtime-manifest-sha256>&rustManifestBytes=<runtime-manifest-bytes>&rustManifestSha256=<runtime-manifest-sha256>'
 	},
 	dotnet: {
 		moduleUrl: 'https://cdn.example.com/wasm-dotnet/index.js'
-	},
-	tinygo: {
-		moduleUrl: 'https://cdn.example.com/wasm-tinygo/runtime.js',
-		assetPacks: [
-			{
-				index: 'https://cdn.example.com/wasm-tinygo/runtime-pack/runtime-pack.index.json',
-				asset: 'https://cdn.example.com/wasm-tinygo/runtime-pack/runtime-pack.bin',
-				fileCount: 12,
-				totalBytes: 123456
-			}
-		]
 	}
 });
 
@@ -669,5 +879,5 @@ await sandbox.load('print("hi")', false);
 
 Compiler assets produced by [`wasm-llvm`](https://github.com/seo-rii/wasm-llvm) are deployed to
 external static hosting and loaded by `@wasm-idle/llvm-core`. Also powered by Pyodide, TeaVM, `wasm-rust`,
-`wasm-tinygo`, `wasm-dotnet`, `wasm-of-js-of-ocaml`, `wasm-typescript`, `wasm-lisp`,
+`wasm-dotnet`, `wasm-of-js-of-ocaml`, `wasm-typescript`, `wasm-lisp`,
 `wasm-wat`, `wasm-lua`, `wasm-zig`, CBQN, Janet, AtomVM/Popcorn, and `ghc-in-browser`.