[cramforce]

Stacked on #3201 (probe order) and #3212 (unset environment variables, which now holds #3222's single evaluation mode); the two merge first. This PR's own commits are "Evaluate island-closed module-level constants inside the island", the review fixes on top of it ("Address review feedback", "Record a refusal the island package catches, and keep one form of the closed constants"), and the two merges that bring in the heads of #3201 and #3212.

What changes

import { Type } from "schema-pkg"; // an island package
const item = Type.Object({ id: Type.String() });
export const list = Type.Array(item);

Lowered call by call, each initializer crosses into the island once per call with its literal arguments, and the first of them starts Node while the program's modules still initialize, whatever the build deferred. An initializer built only from literals, island imports, other such constants, and member reads, calls and new on those holds no native value, so the island can evaluate it itself. The build now writes each such initializer into an island module of its own, which ships in the module tree:

// .scriptc/closed/main.<digest>.0.mjs
import { Type } from "../../node_modules/schema-pkg/index.mjs";
export const item = Type.Object({ id: Type.String() });

// .scriptc/closed/main.<digest>.1.mjs
import { Type } from "../../node_modules/schema-pkg/index.mjs";
import { item } from "./main.<digest>.0.mjs";
export const list = Type.Array(item);

The module loads where its constant is declared, through nodeIsland.defer, and the constant's initializer becomes a read of its export, met with the conversion the original expression's value met. Everything after that is the existing deferral of a static island import: the build-time probe decides whether the module evaluates there or on first use, the interface snapshot stands in until Node starts, and reconciliation gives the stub its identity. The native constant is unchanged: the same global, type, exports and initialization flag, so a read before the declaration still throws Node's ReferenceError.

A program that declares such constants and does not use them on a run no longer starts Node for them.

What counts as closed

A top-level const statement of an ES module written in TypeScript that declares one constant, an identifier, whose initializer is:

• built from: literals; undefined, NaN, Infinity; island imports (named, default, an ES module's namespace, also through a native module's export { x } from "<island>"); other closed constants; a.b, a[k], calls, new; object and array literals of those (shorthand of a closed constant, spreads of closed parts). Type syntax is dropped;
• itself an island operation (the existing islandRooted) with at least one call or new;
• of a type whose value is the island's own value on both sides: an island handle or an immutable primitive. A constant of the program's own record type (unsafe<Colors>({ fg: "red" })) is converted from native data, which an island literal is not, so it stays as it is;
• with operands that are initialized before it in every execution: an earlier statement of the same module, or another module's binding without an initialization flag (an operand of an import cycle is refused: Node throws at an early read, the island would evaluate the operand instead).

Anything else keeps the call-by-call lowering: let/var/destructuring, a native binding, an enum or namespace member, a global such as JSON, this, await, closures, operators, conditionals, templates with substitutions, optional chains, a statement that declares more than one constant, CommonJS and JavaScript source modules.

One module per constant: each initializer evaluates between the native statements around it exactly as before. A native statement between two closed constants still runs between them, and when a later initializer makes the island call back into the program (a listener the program registered), that code finds the earlier constants assigned (node-island-closed-const-callback).

Why it is the same program

When the load is eager it evaluates the initializer against the same island objects, at the position the statement had. Deferring it is decided by the probe as for any island module (no throw, no effect, no input). Two things are specific to generated modules, because their code, unlike a package's top level, computes from state other island code left behind (registry.count(), an id counter):

• They defer only where the program reaches them at one fixed point of its start: before anything awaited, outside every condition, in a module initializer that only the static import graph calls. There the modules that evaluated before it in the probe are exactly the ones that evaluate before it in the program (Probe deferred island modules in the order the program evaluates them #3201's order). In a dynamically imported module, after a top-level await, or under a condition, the module evaluates where its constants are declared.
• The build does not perform the program's effects, nor read its inputs. The probe evaluates the program's own calls here, so for these modules the recorder refuses what it would otherwise record and perform: the first effect or input (output, a file write or an open for writing, a read of a file, a timer, a child process, the network, process.exit) is recorded and then thrown, and the module is not deferred. Recorded first, so that a package that catches the refusal and goes on with a fallback does not have its fallback taken for the constant (8932-node-island-closed-const-caught-refusal). Harness tests check that a file an initializer writes, or only opens for writing, does not exist after the build and does after the run.

A load reached while Node already runs evaluates at its position (#3222's single mode, in #3212), so a constant declared after the program's own island calls sees them: registry.add("x"); const n = registry.count(); reads 1 (8939-node-island-closed-const-after-call).

One difference from main, loud and narrow

A literal in a closed initializer is now made by the island instead of crossing as a native dynamic object. If the island hands it back through an untyped value and the program asserts it to a native record type (registry.get("k") as Config), the checked conversion throws a TypeError where it converted before. This is what main does for every object island code made, and #3029 removes it for all of them. Reads typed by the island's declarations are unaffected (#3093: a program type that receives island values there is a live view of the handle); 6899-node-island-unsafe-record and 6900-node-island-merged-record-in pin the two neighbouring cases and pass.

Before Node starts

• typeof X: the stub's kind, no Node.
• X === Y: stub identity; the probe numbers objects across all modules of its run, so two constants bound to one island object are one stub, and reconciliation keeps it.
• X instanceof C: starts Node.
• a primitive-typed constant (const major: number = semver.major("1.2.3")): the snapshot's value through the checked conversion, no Node; none when the evaluation read the clock or random numbers (then the declaration starts Node, as today).

Files

• frontend/lowering/closed-island-init.ts (new): the analysis, the printer of closed expressions, the load and the initializer's read, and SCRIPTC_NODE_ISLANDS_TRACE=closed (one line per module-level constant whose initializer is an island operation: closed, or what keeps it native).
• lower-node-island.ts: five exports and one call at the top of lowerIslandExpr. lower-modules.ts: one call in lowerFileInit. lowerer.ts: two memos, and generated loads get their tree path.
• node-islands/generated.ts (new), modules.ts: generated files in the module tree; the IR's tree entry carries their text (generated), codec regenerated.
• node-islands/snapshot.ts: probe copies in a private temporary directory, the fixed-point rule, no boot guard for a copy. probe-recorder.ts: the generated files the probe may evaluate, and the withholding.
• No runtime change.

After review

Four findings of the review bot on this PR, each reproduced with a program first. The maintainer's commit on this branch (64fea0b) is kept and built on.

• An open for writing was performed during the build (fs.openSync(path, "w") went through a recorder wrapper that records only after the call). Fixed in 64fea0b; reproduced on e66fcd9: the file exists after the build. Harness test effects-open.
• A callback saw earlier constants of the same run unassigned. bus.on(() => { seen = first.label; }); const first = make("first"); const count = bus.emit(); printed first 1 under Node and died with "Cannot access 'first' before initialization" natively. Fixed in 64fea0b by one module per constant (node-island-closed-const-callback); 9e542a7 deletes the run type that was left with one element.
• A refusal the island package catches. 64fea0b's two wrappers refused without recording, so try { return fs.readFileSync(file) } catch { return "no motto" } completed with an empty record and the executable printed the fallback (reproduced at 64fea0b). 9e542a7 routes every refusal through the function that records before it throws (8932-node-island-closed-const-caught-refusal, a recorder unit test, a harness test).
• From Probe deferred island modules in the order the program evaluates them #3201's review, merged here: a module is not deferred when a probed load it shares a file with has effects, and each load's file list is complete. For this PR that means a generated module that names one whose evaluation has effects stays with it (8918: all three modules evaluate where their constants are declared).

Proof

The focused suites ran on the head (ccc383a). The gate and the lanes ran on dff0374, two merges earlier: what came after is 700632c (one condition in the recorder and its test) and #3201's 41f67e2 (where the walk places the conditional part of an expression), each covered by the focused suites.

• 15 corpus programs, each matching Node in stdout, stderr and exit status, plain and sanitized, in the differential and llvm-differential suites: constants never used (8910: libnode is never mapped) and used (8911); a chain across two modules (8915); one constant seen through two importers, identical before and after Node starts (8916); an initializer whose island function prints, between two native console.log (8918); one that throws, uncaught, exit 1 (8919); process.exit before any use, exit 3 (8920); a read before the declaration, ReferenceError as in Node (8930); a refusal the island package catches (8932); primitive constants from a CommonJS package (8935); constants declared before and after the program's own island calls (8939); a native operand and an island array changed through its handle (8940); constants of a dynamically imported module (8941); a listener that reads an earlier constant (node-island-closed-const-callback).
• tests/harness/node-island-closed-init.test.ts, 9 tests, from the build's traces and the run's boot trace: deferred generated modules and Node never starts when the constants are unused; primitive constants without Node; exit before use; initializers with effects evaluate in place; a file an initializer writes, or only opens for writing, does not exist after the build and exists after the run; a caught refusal does not make the fallback the constant; the closed trace names what keeps a constant native; a constant declared after Node started evaluates there, not from its snapshot.
• Unit tests in node-islands (the generated text and its probe copy, the decisions for generated modules, the recorder's refusals and file lists): 220 of 220.
• The whole island corpus under the libnode pack: 133 of 133, plain (in both suites) and sanitized. Island harness suites: 109 of 109.
• Zero-cost gate with --gate-corpus=all against 75cca60 (the commit below this PR's first one; the candidate also holds the heads of Probe deferred island modules in the order the program evaluates them #3201 and Defer island modules that read only unset environment variables, and evaluate deferred modules in Node's order #3212): PASS, 5,237 programs identical, 108 fail to build on both sides, none differ; compile time within tolerance (bench +0.21%, fixtures -0.17%; self +0.75% with a confidence interval that spans zero). The gate builds without a libnode pack, so the programs this change touches are the island programs, which it leaves out; they are the corpus programs above.
• Both test lanes with the libnode pack: plain 22,069 passed, 0 failed, including the plain native bootstrap; sanitized 18,832 passed, 1 failed: 2963-child-fork-dispatch in the sanitized llvm-differential suite, the known flake of Stop two corpus programs racing, and set three harness budgets from measured times #3300 (the program prints at 'close', which Node may emit before 'disconnect' on a busy machine); alone on this head it passes 3 of 3. The sanitized native bootstrap of this run was still going when this was written; its result follows in a comment.
• pnpm lint, pnpm format:check, pnpm test:ts7 --baselines-only, the IR codec check: clean.

After merging main

Head 70aae07 holds main at 97d3722. The one conflict was the generated IR codec (main's file, regenerated with this branch's generated field). On the merged head: lint, format, the codec check and the baselines are clean; unit tests in node-islands 220 of 220; the closed-constants harness file 9 of 9; the island corpus 139 of 139, plain (both suites) and sanitized; the island harness suites 112 of 113, the one being node-island-deferral.test.ts "all of them when Node starts…", a test of #3222 that compares a whole boot trace and meets main's new first-run line "installing the module tree" (#3216). It fails on any tree with both; the last commit leaves that line out of the comparison, and the file passes on a fresh and on a warm cache. The island value matrix shows main's five known cells (#3298) and nothing else. The gate and the lanes were not repeated on the merged head.

What it does for start-up, and what it does not do yet

Neutral programs (corpus programs of this PR; main 979a652 against this branch at e66fcd9, Intel Xeon @ 2.90GHz, 8 vCPU, 30 warm runs each):

program	before	after
three closed constants, never used (8910)	58.5 ms, 90 MB, Node starts	0.9 ms, 13 MB, Node never starts
three primitive closed constants, used (8935)	49.7 ms, 90 MB, Node starts	0.6 ms, 13 MB, Node never starts
closed constants whose values the program uses (8911)	52.4 ms	55.7 ms (same, within the spread)

pi's start-up does not move with this PR. Measured on the pi run tree (a scratch tree with the open pi PRs, not this branch; Intel Xeon @ 2.50GHz, 32 vCPU), both binaries with #3201 and #3212: pi --version warm 1,160 and 1,300 ms before, 1,300 and 1,250 ms after (two measurements each, alternating); cold 2,530 and 2,680 ms before, 2,720 and 2,550 ms after. Crossings made by native initializers during start go from 337 to 297 function-value calls, 391 to 332 method calls and 1,014 to 893 property reads. Two reasons, both visible with the traces this PR adds:

• 20 of pi's module-level constants are closed (16 generated modules when consecutive constants still shared one, which is when this was measured; 20 now); 32 more are island operations that stay native, because an operand is a native constant (an array of literals, or a "properties" object such as { a: Type.Number() } held as a native record), or a template has substitutions. SCRIPTC_NODE_ISLANDS_TRACE=closed prints one line per such constant, closed or what keeps it native.
• None of pi's 16 generated modules defers. Every one of them sits in a module that a dynamically imported module also imports, so the build cannot promise the point at which the program reaches it, and each evaluates where its constants are declared (in one crossing instead of several). The follow-up replaces the build-time rule with a guard checked at run time (the loads registered before the module must be the ones the probe evaluated before it), which is exact in every run; it is stacked on this PR.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
scriptc	Ready	Preview, v0	Nov 7, 2026 4:11pm UTC

[vercel-internal-security-reviewer]

Security review details

[cramforce]

The sanitized native bootstrap of the validation run named in the description (dff0374 against 75cca60) finished: passed. Final lane totals of that run: plain 22,069 passed, 0 failed; sanitized 18,835 passed, 1 failed, which is the known flake 2963-child-fork-dispatch (#3300), 3 of 3 alone on the head.

[cramforce]

Pushed 04d0005: main merged in (the wrapper helper #3254 renamed, used here by closed-island-init.ts and islandRooted; the IR codec regenerated for the merged ir.ts), and one conformance entry.

The red "Node island conformance 3/4" job (npm/hono-zod-validator > island:zod) was this PR's, not main's. Reproduced on 70aae07 against main's build of the same program with --node-island=zod:

• main: 0 closed constants; the program exits 1 at its first schema with "this native object cannot cross into a Node island yet" and prints nothing.
• this branch: the three schemas (Book, ListQuery, IdParam) are island-closed constants, so the island builds them from its own literals. The program prints 11 of its lines and then exits 1 where a handler receives zod's parsed value, an island object, as the program's own record type: "expected object at $, got Object from a Node island".

So the forced-island build still fails, one step later, at the boundary's rule for every object an island makes (the difference this PR's description accepts; #3029 lifts it). The entry in known-failures.json is now the lane's own output for this head (SCRIPTC_ISLAND_CONFORMANCE=update for the program, then check mode: 4 of 4 ways pass).

Checked on the pushed tree in a Sandbox: pnpm build, codec, lint, format and baselines clean; unit tests of node-islands, outer-expressions and executable-cache 297 of 297; the closed-init, deferral, order and island harness suites 94 of 94; the island corpus 149 of 149; the conformance lane for hono-zod-validator and hono-zod-default-hook 8 of 8. packages/semver > island:semver is main's entry (re-pinned on main after the commit merged here); CI's merge with main has it.

[cramforce]

Closing as superseded by #3350, the startup landing train, which carries this PR's commits merged with eight related PRs and current main (train head 14771d5234; validated once as a whole: zero-cost gate PASS with every benchmark byte-identical, both lanes, both native bootstraps, the island conformance lane with every moved entry explained). Review and merge happen there. If #3350 is abandoned, this PR is reopened.

🤖 Generated with Claude Code