[nicolas-maman]

Every open bug, and four high-priority issues the owner chose for this batch.

Scope

Fixed at the start. Anything found on the way that is outside it is filed for the next batch, unless it is a security, crash or data-loss problem.

Bugs:

• An if used as a value does not parse when its condition ends in a call: s = if f(x) { a } else { b } #3478 An if used as a value does not parse when its condition ends in a call
• c = s[i] on a string warns 'unresolved type in codegen, defaulting to int' #3479 c = s[i] on a string warns that its type was left to codegen
• test_ask_relief: 'the waiting core's other actors run' races a 400 ms pause (11 of 20 under macOS ASan) #3483 test_ask_relief races a 400 ms pause
• A refused binary import leaves its stub directory in the temp dir #3485 A refused binary import leaves its stub directory in the temp dir
• ae_source_module_exists in tools/ae.c is unused, which clang -Werror rejects #3486 ae_source_module_exists is unused, which clang -Werror rejects
• accounts_free_is_linear_in_its_blocks failed once on macOS ASan (22x for 4x the blocks) #3488 accounts_free_is_linear_in_its_blocks failed once on macOS ASan

Four more, critical or high priority:

• Release blocked: aetherc compile time is quadratic in the number of functions (order_effects_scaling 22-25 s on macOS x86_64) #3499 Release blocker: compile time was quadratic in the number of functions
• CI: ubuntu-latest is moving to 26.04 (qemu-user-static is gone; Node 20 actions deprecated) #3500 CI: ubuntu-latest is moving to 26.04
• script_gateway: on POSIX a script on its own runtime is mounted unchecked (Windows refuses it) #3501 script_gateway: on POSIX a script on its own runtime was mounted unchecked
• Docs: three reference statements disagree with the runtime (reply, constant-time compare, call deadline) #3480 Three reference statements disagreed with the runtime

What changed

#3499, compile time. The release's macOS x86_64 leg failed twice on order_effects_scaling: 8000 chained functions took 22 to 25 s to compile, against a 20 s bound. Sampling the compile with gdb found four lookups by name that scanned the whole program, once per call or once per top-level node:

• the checker's callee and extern lookups;
• codegen's function-pointer globals;
• codegen's set of function names a local may shadow;
• the merge's import prefixes.

Each is now answered from an index the compiler already keeps: the checker's clause index, codegen's program index, or a hashed name set.

functions	before	after
4000	282 ms	170 ms
8000	957 ms	325 ms
16000	3691 ms	651 ms
32000	about 20 s	1319 ms

The test now compares 4000 and 16000 functions on the same runner instead of a wall-clock bound: four times the functions must cost less than eight times the time. Main's compiler fails it at 13 times; this one passes at 3.7.

#3478. The expression form of if parsed its condition without the guard the if statement, while and match use, so a call at its end took the then arm's { as a trailing block. A call inside an arm still takes one. A call's arguments now parse with the guard cleared, since inside the parentheses a { cannot open the body: a struct literal argument in a condition was refused, in the if statement, while and match too.

#3479. s[i] on a string had no type, so a local bound to it was left to codegen's int default. Two more defects in the same expression:

• The C read a plain char, which is signed on x86: a byte past 127, any non-ASCII UTF-8 byte, read negative there and positive on ARM.
• Nothing checked the index: s[100000] on "Az" read past the string, a memory-safety defect, fixed here for that reason.

s[i] is now an int from 0 to 255, the type codegen always gave such a local and the value string.bytes(s)[i] has. s[length] is the terminator, 0, as a C-style scan reads it. An index below 0 or past the terminator is the panic string index i out of range for length n, which a try catches, as a slice index's is. (A byte type, the first version here, refused uint32 u = s[i] and wrapped c - 100; the review caught it.)

#3485. The refusals called exit(1) from inside the stub writer, with the stub file still open. C runs atexit handlers before it closes streams, and Windows will not delete an open file, so every refused build left an ae-binimport-* directory: 1,168 on one machine. The refusals now return to the caller, which closes and removes the stub before exiting. #3486 removes the unused function.

#3483 and #3488, both timing-bound tests:

• Ask relief now holds B's reply until D has handled its 20 messages, instead of pausing 400 ms. A relief that does not run D still fails it. The test frees its actors before asserting, so a failure leaks nothing.
• The account-free scaling test times the free by the thread's CPU clock on POSIX, the best of five runs, so a preempted run no longer reads as superlinear.

#3500.

• Every ubuntu-latest job now names ubuntu-26.04. GitHub moves the label between Oct 19 and Nov 19, so until then a job could land on either image from one run to the next. Paul's 4861daa already fixed the qemu package.
• The actions GitHub flags as Node 20 move to the releases that declare node24: checkout v5, cache v5, upload-artifact v6, download-artifact v7, setup-emsdk v15, action-gh-release v3, setup-java v5, setup-go v6.
• mlugg/setup-zig and ilammy/msvc-dev-cmd have no Node 24 release yet; GitHub runs them on Node 24.
• The release workflow's own jobs only run after a merge. Its two cross builds are the same steps ci.yml's FreeBSD and Android jobs run here on 26.04.

#3501. The owner chose Windows' rule for POSIX. script_gateway.mount reads which image gives the script its runtime (dlsym on the script's handle, dladdr), against the image that holds the host's:

• Mounted: a script with no runtime of its own, or one on the host's runtime.
• Refused, naming --shared-runtime: a script that carries its own.
• A --shared-runtime script on a static host: mounted on ELF, where the global scope binds it to the program's runtime; refused on macOS, where each import binds to its library.

The docs build scripts with --shared-runtime.

#3480.

• A handler that returns without a reply ends the ask at once.
• Constant-time comparison points to ct.bytes_eq and ct.bytes_eq_slice.
• The call deadline is one instant per thread, not a per-call budget.
• The memory cap is process-wide.

Found by this PR's CI and fixed here

The benchmarks workflow ran because this PR changes it, and every Aether entry was "did not build" on Linux. The link compiled the runtime from source with -flto beside the whole libaether.a. GCC's LTO plugin does not list what top-level asm defines, and the rendezvous records from #3445 are such asm. So the link took the archive's aether_resource_caps.o for its anchor, and every symbol in it was then defined twice. It has been broken on main since #3445; the workflow runs only on benchmark changes and on Mondays. std now comes from a copy of libaether.a with the runtime members the MANIFEST lists taken out. The benchmark run on b9709af passed.

Reviews

One fresh review of the whole diff found six things, all fixed:

• the gateway's POSIX check broke the wasm32-wasi build: there is no dladdr there, and no dynamic loader either, so there is no check;
• the rewritten ask-relief test could deadlock: with B on core 1 the relief moved D behind B's own step, which waited for D. B is now on core 2, as in the file's overflow cases;
• s[i] as a byte refused or changed programs that compiled, and the bounds check broke s[length] scans: it is an int now, as above;
• a struct literal argument in an if expression's condition was refused (An if used as a value does not parse when its condition ends in a call: s = if f(x) { a } else { b } #3478, as above);
• the docs overstated what a static macOS host refuses;
• a strlen per s[i] on a C string without a length header. This is left as is: string.length(s) on such a string already costs the same in a loop's condition.

While fixing them, a main bug turned up and is fixed here, since it ends the process: a return inside a try with no defers popped the try frames before computing its value. So try { return xs[i] } catch e { ... }, or a returned call that panics, escaped the try. The value is now computed inside the frames, for a single value, a tuple and main's return, as the defer-aware path already did (test_return_inside_try_catches).

The review of those fixes, the last one, found four of the five correct, checked with probes for every return type, nested trys, and conditions with nested calls and struct literals. It found one regression, now fixed:

• main ran its defers before computing its return value. That was an older bug: return string.length(s) read a released s. With the panic now caught, main also went on with its defers already run, and ran them twice. main now computes the value first, as every other function does (test_main_return_inside_try, which fails before the fix).
• On WASI, where a script's runtime cannot be read, the gateway now refuses rather than mounts. This is unreachable today, since the load fails first.

Also from CI: order_effects_scaling on macOS ARM64 measured one 16000-function compile at 14 times one of 4000, where the same commit measures 3.7x here and the leg passed one commit before. The test now takes the best of three runs of each size, interleaved.

Checks

Local, Windows x86_64 (MSYS2 MINGW64):

• every emit_lib_* and binary_import_* integration test, abi_policy, sandbox_nested_libraries, order_effects_scaling (fails on main), http_script_gateway;
• the C runner 653/653, three runs alike;
• the full make test-ae sweep on cf912d7: 1980 passed, 0 failed, 108 skipped (Windows skips); again on the final head before merge;
• check-docs, check-api-docs, check-changelog, check-tests, check-examples;
• the regressions test_if_expression_call_condition, test_string_index_byte, test_return_inside_try_catches and test_main_return_inside_try.

The changed C compiles with -Werror for x86_64 Linux, aarch64 macOS and FreeBSD (zig).

Closes #3478, closes #3479, closes #3480, closes #3483, closes #3485
Closes #3486, closes #3488, closes #3499, closes #3500, closes #3501