From 39277a0583f01a56fd3a7d41904b5f5992f8722b Mon Sep 17 00:00:00 2001
From: Nicolas Maman <nicolasmd87@gmail.com>
Date: Sun, 1 Nov 2026 13:28:51 -0300
Subject: [PATCH 01/17] fix: compile time linear in the program again (#3499)

The release's macOS x86_64 leg failed twice on order_effects_scaling
(8000 chained functions in 22-25 s against a 20 s bound). Sampled with
gdb, the compile was quadratic through four lookups by name that scanned
the program per call or per top-level node:

- typechecker effect_find_func and call_extern_decl (every call's
  declaration, from the check_frees and @keep walks): now answered from
  the checker's clause index, which also indexes externs;
- codegen lookup_fnptr_global (every call): now in the program index;
- codegen rename_locals_shadowing_functions: its NameSet was a list
  scanned per reference; now a StrMap, and externs by name;
- module merge rewrite_import_prefixes: the program's imports were
  collected again for each top-level node; now once.

8000 functions: 957 -> 325 ms here; 16000: 3691 -> 651 ms; 32000:
about 20 s -> 1.3 s. The test now compares 4000 and 16000 functions on
the same runner (linear is 4x; main's compile was 13x, which fails it).
---
 compiler/aether_module.c                      |  53 +++++---
 compiler/analysis/typechecker.c               | 107 +++++++++------
 compiler/codegen/codegen.c                    |  77 +++++------
 compiler/codegen/codegen_internal.h           |   2 +
 ...T120000Z-fixed-3499-compile-time-linear.md |  12 ++
 .../test_order_effects_scaling.sh             | 126 +++++++++++-------
 6 files changed, 229 insertions(+), 148 deletions(-)
 create mode 100644 new_changelogs/20261101T120000Z-fixed-3499-compile-time-linear.md

diff --git a/compiler/aether_module.c b/compiler/aether_module.c
index 897e1f550..6efa2aa9a 100644
--- a/compiler/aether_module.c
+++ b/compiler/aether_module.c
@@ -3662,16 +3662,20 @@ static const char* import_written_prefix(ASTNode* imp) {
  * and `vg.region`, both renamed off "region" by module_assign_namespaces)
  * doesn't have the first one's rewrite blindly consume every "region.name"
  * in the body before the second's ever runs — see
- * rewrite_qualified_prefix_ambiguous. */
-static void rewrite_import_prefixes(ASTNode* body, ASTNode* scope_ast,
-                                    const char* self_name) {
-    if (!body || !scope_ast) return;
-
+ * rewrite_qualified_prefix_ambiguous. The imports are collected once per
+ * scope (#3499): collected again for each of a program's top-level nodes,
+ * the merge grew with the square of the program. */
 #define REWRITE_MAX_IMPORTS 64
+typedef struct {
     const char* writtens[REWRITE_MAX_IMPORTS];
     AetherModule* mods[REWRITE_MAX_IMPORTS];
-    int n = 0;
-    for (int i = 0; i < scope_ast->child_count && n < REWRITE_MAX_IMPORTS; i++) {
+    int n;
+} ImportPrefixes;
+
+static void import_prefixes_collect(ImportPrefixes* ip, ASTNode* scope_ast,
+                                    const char* self_name) {
+    ip->n = 0;
+    for (int i = 0; scope_ast && i < scope_ast->child_count && ip->n < REWRITE_MAX_IMPORTS; i++) {
         ASTNode* imp = scope_ast->children[i];
         if (!imp || imp->type != AST_IMPORT_STATEMENT || !imp->value) continue;
         if (imp->annotation && strcmp(imp->annotation, "synthetic") == 0) continue;
@@ -3679,31 +3683,42 @@ static void rewrite_import_prefixes(ASTNode* body, ASTNode* scope_ast,
         const char* ns = module_namespace_of(imp->value);
         if (strcmp(written, ns) == 0) continue;
         if (self_name && strcmp(written, module_last_segment(self_name)) == 0) continue;
-        writtens[n] = written;
-        mods[n] = module_find(imp->value);
-        n++;
+        ip->writtens[ip->n] = written;
+        ip->mods[ip->n] = module_find(imp->value);
+        ip->n++;
     }
+}
 
+static void import_prefixes_rewrite(const ImportPrefixes* ip, ASTNode* body) {
+    if (!body) return;
     int done[REWRITE_MAX_IMPORTS] = {0};
-    for (int i = 0; i < n; i++) {
+    for (int i = 0; i < ip->n; i++) {
         if (done[i]) continue;
         AetherModule* candidates[REWRITE_MAX_IMPORTS];
         int ncand = 0;
-        candidates[ncand++] = mods[i];
+        candidates[ncand++] = ip->mods[i];
         done[i] = 1;
-        for (int j = i + 1; j < n; j++) {
-            if (!done[j] && strcmp(writtens[i], writtens[j]) == 0) {
-                candidates[ncand++] = mods[j];
+        for (int j = i + 1; j < ip->n; j++) {
+            if (!done[j] && strcmp(ip->writtens[i], ip->writtens[j]) == 0) {
+                candidates[ncand++] = ip->mods[j];
                 done[j] = 1;
             }
         }
         if (ncand == 1) {
-            if (mods[i]) rewrite_qualified_prefix(body, writtens[i], module_namespace_of(mods[i]->name), NULL, 0);
+            if (ip->mods[i]) rewrite_qualified_prefix(body, ip->writtens[i], module_namespace_of(ip->mods[i]->name), NULL, 0);
         } else {
-            rewrite_qualified_prefix_ambiguous(body, writtens[i], candidates, ncand, NULL, 0);
+            rewrite_qualified_prefix_ambiguous(body, ip->writtens[i], candidates, ncand, NULL, 0);
         }
     }
+}
 #undef REWRITE_MAX_IMPORTS
+
+static void rewrite_import_prefixes(ASTNode* body, ASTNode* scope_ast,
+                                    const char* self_name) {
+    if (!body || !scope_ast) return;
+    ImportPrefixes ip;
+    import_prefixes_collect(&ip, scope_ast, self_name);
+    import_prefixes_rewrite(&ip, body);
 }
 
 /* The registered module whose parsed AST is `mod_ast`, or NULL. */
@@ -4421,10 +4436,12 @@ void module_merge_into_program(ASTNode* program) {
     /* #2209: the program's own code names its imports by alias or last
      * segment; point each at the imported module's namespace before any
      * module body is cloned in beside it. */
+    ImportPrefixes prog_imports;
+    import_prefixes_collect(&prog_imports, program, NULL);
     for (int i = 0; i < program->child_count; i++) {
         ASTNode* child = program->children[i];
         if (!child || child->type == AST_IMPORT_STATEMENT) continue;
-        rewrite_import_prefixes(child, program, NULL);
+        import_prefixes_rewrite(&prog_imports, child);
     }
 
     // Find insertion point: just before AST_MAIN_FUNCTION
diff --git a/compiler/analysis/typechecker.c b/compiler/analysis/typechecker.c
index d159dbe3b..f751e3640 100644
--- a/compiler/analysis/typechecker.c
+++ b/compiler/analysis/typechecker.c
@@ -6367,6 +6367,8 @@ static void order_const_declarations(ASTNode* program) {
 }
 
 static void tc_clauses_reset(void);
+static ASTNode* tc_first_def(ASTNode* program, const char* name);
+static ASTNode* tc_first_extern(ASTNode* program, const char* name, const char* merged);
 
 /* ---- qualified type names: `mod.T`, `*mod.T` ---------------------------
  *
@@ -9855,13 +9857,7 @@ static ASTNode* call_extern_decl(ASTNode* program, const char* name) {
         for (size_t i = 0; i < n; i++) merged[i] = name[i] == '.' ? '_' : name[i];
         merged[n] = '\0';
     }
-    for (int c = 0; c < program->child_count; c++) {
-        ASTNode* e = program->children[c];
-        if (!e || e->type != AST_EXTERN_FUNCTION || !e->value) continue;
-        if (!strcmp(e->value, name)) return e;
-        if (dotted && (e->is_imported || e->origin_module) && !strcmp(e->value, merged)) return e;
-    }
-    return NULL;
+    return tc_first_extern(program, name, dotted ? merged : NULL);
 }
 
 /* The declaration a call is checked against: an Aether function, or an
@@ -11811,15 +11807,12 @@ static const char* effect_call_capability(const char* ns) {
     return NULL;
 }
 
+/* The first definition named `name`, from the checker's index (#3499): a
+ * scan of the program per call made checking grow with the square of its
+ * size. */
 static ASTNode* effect_find_func(ASTNode* program, const char* name) {
     if (!program || !name) return NULL;
-    for (int i = 0; i < program->child_count; i++) {
-        ASTNode* c = program->children[i];
-        if ((c->type == AST_FUNCTION_DEFINITION || c->type == AST_BUILDER_FUNCTION) &&
-            c->value && strcmp(c->value, name) == 0)
-            return c;
-    }
-    return NULL;
+    return tc_first_def(program, name);
 }
 
 /* The definition a call names, or NULL when the walk cannot see one (a
@@ -19361,6 +19354,10 @@ typedef struct {
 } TcClauses;
 
 static StrMap g_tc_clauses;
+/* #3499: the externs of the program by name, the first in program order,
+ * and of those a module brought, each as its position + 1. */
+static StrMap g_tc_externs;
+static StrMap g_tc_imported_externs;
 static ASTNode* g_tc_clauses_program = NULL;
 static int g_tc_clauses_child_count = -1;
 
@@ -19370,38 +19367,72 @@ static void tc_clauses_reset(void) {
         if (tc) { free(tc->nodes); free(tc); }
     }
     strmap_free(&g_tc_clauses);
+    strmap_free(&g_tc_externs);
+    strmap_free(&g_tc_imported_externs);
     g_tc_clauses_program = NULL;
     g_tc_clauses_child_count = -1;
 }
 
+/* Index `program`'s definitions and externs, once per program shape: the
+ * checker adds top-level nodes (derived functions, a clause set's join) but
+ * renames and frees none, and an addition changes the count. */
+static void tc_decls_index(ASTNode* program) {
+    if (g_tc_clauses_program == program && g_tc_clauses_child_count == program->child_count)
+        return;
+    tc_clauses_reset();
+    for (int i = 0; i < program->child_count; i++) {
+        ASTNode* c = program->children[i];
+        if (c && c->value && c->type == AST_EXTERN_FUNCTION) {
+            void* at = (void*)(intptr_t)(i + 1);
+            if (!strmap_has(&g_tc_externs, c->value)) strmap_put(&g_tc_externs, c->value, at);
+            if ((c->is_imported || c->origin_module) &&
+                !strmap_has(&g_tc_imported_externs, c->value))
+                strmap_put(&g_tc_imported_externs, c->value, at);
+            continue;
+        }
+        if (!c || !c->value ||
+            (c->type != AST_FUNCTION_DEFINITION && c->type != AST_BUILDER_FUNCTION)) continue;
+        TcClauses* tc = strmap_get(&g_tc_clauses, c->value);
+        if (!tc) {
+            tc = calloc(1, sizeof(TcClauses));
+            if (!tc) continue;
+            strmap_put(&g_tc_clauses, c->value, tc);
+        }
+        if (tc->count == tc->cap) {
+            int cap = tc->cap ? tc->cap * 2 : 2;
+            ASTNode** nn = realloc(tc->nodes, sizeof(ASTNode*) * (size_t)cap);
+            if (!nn) continue;
+            tc->nodes = nn;
+            tc->cap = cap;
+        }
+        tc->nodes[tc->count++] = c;
+    }
+    g_tc_clauses_program = program;
+    g_tc_clauses_child_count = program->child_count;
+}
+
+/* #3499: the first function or builder named `name` in `program`. */
+static ASTNode* tc_first_def(ASTNode* program, const char* name) {
+    tc_decls_index(program);
+    const TcClauses* tc = strmap_get(&g_tc_clauses, name);
+    return (tc && tc->count > 0) ? tc->nodes[0] : NULL;
+}
+
+/* #3499: the first extern in `program` named `name`, or, when `merged` is
+ * given, a module's extern named `merged`, whichever comes first. */
+static ASTNode* tc_first_extern(ASTNode* program, const char* name, const char* merged) {
+    tc_decls_index(program);
+    intptr_t a = (intptr_t)strmap_get(&g_tc_externs, name);
+    intptr_t b = merged ? (intptr_t)strmap_get(&g_tc_imported_externs, merged) : 0;
+    intptr_t at = (a && b) ? (a < b ? a : b) : (a ? a : b);
+    return at ? program->children[at - 1] : NULL;
+}
+
 /* The clauses of the set `fn` is one of, or NULL for a single definition. */
 static const TcClauses* tc_clauses_of(ASTNode* fn) {
     ASTNode* program = g_typecheck_program;
     if (!program || !fn || !fn->value) return NULL;
-    if (g_tc_clauses_program != program || g_tc_clauses_child_count != program->child_count) {
-        tc_clauses_reset();
-        for (int i = 0; i < program->child_count; i++) {
-            ASTNode* c = program->children[i];
-            if (!c || !c->value ||
-                (c->type != AST_FUNCTION_DEFINITION && c->type != AST_BUILDER_FUNCTION)) continue;
-            TcClauses* tc = strmap_get(&g_tc_clauses, c->value);
-            if (!tc) {
-                tc = calloc(1, sizeof(TcClauses));
-                if (!tc) continue;
-                strmap_put(&g_tc_clauses, c->value, tc);
-            }
-            if (tc->count == tc->cap) {
-                int cap = tc->cap ? tc->cap * 2 : 2;
-                ASTNode** nn = realloc(tc->nodes, sizeof(ASTNode*) * (size_t)cap);
-                if (!nn) continue;
-                tc->nodes = nn;
-                tc->cap = cap;
-            }
-            tc->nodes[tc->count++] = c;
-        }
-        g_tc_clauses_program = program;
-        g_tc_clauses_child_count = program->child_count;
-    }
+    tc_decls_index(program);
     const TcClauses* tc = strmap_get(&g_tc_clauses, fn->value);
     if (!tc || tc->count < 2) return NULL;
     for (int i = 0; i < tc->count; i++)
diff --git a/compiler/codegen/codegen.c b/compiler/codegen/codegen.c
index b87a90661..35deae9d6 100644
--- a/compiler/codegen/codegen.c
+++ b/compiler/codegen/codegen.c
@@ -833,16 +833,11 @@ Type* lookup_fnptr_local(CodeGenerator* gen, const char* name) {
  * on a `void*`), which C rejects. NULL when `name` is not such a global. */
 Type* lookup_fnptr_global(CodeGenerator* gen, const char* name) {
     if (!gen || !gen->program || !name) return NULL;
-    for (int i = 0; i < gen->program->child_count; i++) {
-        ASTNode* c = gen->program->children[i];
-        if (c && c->type == AST_EXPORT_STATEMENT && c->child_count > 0) c = c->children[0];
-        if (!c || c->type != AST_CONST_DECLARATION || !c->value) continue;
-        if (!(c->annotation && strcmp(c->annotation, "global_var") == 0) &&
-            !is_fnptr_const_decl(c)) continue;
-        if (strcmp(c->value, name) != 0) continue;
-        return is_fnptr_type(c->node_type) ? c->node_type : NULL;
-    }
-    return NULL;
+    /* From the program index (#3499): asked for every call, a scan of the
+     * program made codegen grow with the square of its size. */
+    ProgramIndex* ix = program_index(gen->program);
+    ASTNode* c = ix ? strmap_get(&ix->fn_globals, name) : NULL;
+    return (c && is_fnptr_type(c->node_type)) ? c->node_type : NULL;
 }
 
 /* #2648: a module-level `const` of a typed fn-pointer type. It holds a
@@ -1308,6 +1303,13 @@ static void program_index_build(ProgramIndex* ix, ASTNode* program) {
     for (int i = 0; i < program->child_count; i++) {
         ASTNode* c = program->children[i];
         if (!c) continue;
+        /* #3499: the module `var`s and fn-pointer `const`s a call may go
+         * through (lookup_fnptr_global), the first of each name. */
+        ASTNode* g = (c->type == AST_EXPORT_STATEMENT && c->child_count > 0) ? c->children[0] : c;
+        if (g && g->type == AST_CONST_DECLARATION && g->value &&
+            ((g->annotation && strcmp(g->annotation, "global_var") == 0) || is_fnptr_const_decl(g)) &&
+            !strmap_has(&ix->fn_globals, g->value))
+            strmap_put(&ix->fn_globals, g->value, g);
         if ((c->type == AST_FUNCTION_DEFINITION || c->type == AST_BUILDER_FUNCTION) && c->value) {
             DefClauses* dc = strmap_get(&ix->defs, c->value);
             if (!dc) {
@@ -1391,6 +1393,7 @@ void program_index_reset(void) {
     strmap_free(&ix->clause_scopes);
     strmap_free(&ix->def_children);
     strmap_free(&ix->def_sets);
+    strmap_free(&ix->fn_globals);
     ix->program = NULL;
     ix->child_count = 0;
     ix->main_fn = NULL;
@@ -6374,30 +6377,22 @@ static void mangle_keyword_value_idents(ASTNode* program) {
  * a program can see. A write to a module variable or an actor's state is
  * not a local, and keeps its name. Both walks visit a node's children before
  * the node, so a binding's initializer comes before the binding. */
-typedef struct {
-    const char** names;  /* interned (cg_intern), never freed one by one */
-    int count, cap;
-} NameSet;
+/* A set of names in insertion order, hashed (#3499): a list scanned per
+ * reference made this pass grow with the square of the program, since
+ * every reference is checked against every function. */
+typedef StrMap NameSet;
 
 static int nameset_has(const NameSet* s, const char* name) {
-    for (int i = 0; name && i < s->count; i++)
-        if (strcmp(s->names[i], name) == 0) return 1;
-    return 0;
+    return name && strmap_has(s, name);
 }
 
 static void nameset_add(NameSet* s, const char* name) {
-    if (!name || !name[0] || nameset_has(s, name)) return;
-    if (s->count == s->cap) {
-        s->cap = s->cap ? s->cap * 2 : 16;
-        s->names = (const char**)aether_xrealloc((void*)s->names, (size_t)s->cap * sizeof(*s->names));
-    }
-    s->names[s->count++] = cg_intern(name);
+    if (!name || !name[0] || strmap_has(s, name)) return;
+    strmap_put(s, name, NULL);
 }
 
 static void nameset_free(NameSet* s) {
-    free((void*)s->names);
-    s->names = NULL;
-    s->count = s->cap = 0;
+    strmap_free(s);
 }
 
 static int is_value_name_node(const ASTNode* n) {
@@ -6416,33 +6411,23 @@ static int is_binding_node(const ASTNode* n) {
  * as the extern declarations below emit them). */
 typedef struct {
     NameSet names;      /* every function and extern, by its Aether name */
-    ASTNode** externs;
-    int extern_count, extern_cap;
+    StrMap externs;     /* the first extern of each name */
 } ShadowFns;
 
 static void shadow_fns_add_extern(ShadowFns* f, ASTNode* ext) {
     if (!ext || !ext->value) return;
     nameset_add(&f->names, ext->value);
-    if (f->extern_count == f->extern_cap) {
-        f->extern_cap = f->extern_cap ? f->extern_cap * 2 : 32;
-        f->externs = (ASTNode**)aether_xrealloc((void*)f->externs,
-                                                (size_t)f->extern_cap * sizeof(*f->externs));
-    }
-    f->externs[f->extern_count++] = ext;
+    if (!strmap_has(&f->externs, ext->value)) strmap_put(&f->externs, ext->value, ext);
 }
 
 static void shadow_fns_free(ShadowFns* f) {
     nameset_free(&f->names);
-    free((void*)f->externs);
-    f->externs = NULL;
-    f->extern_count = f->extern_cap = 0;
+    strmap_free(&f->externs);
 }
 
 /* The extern named `name`, or NULL. */
 static ASTNode* shadow_fns_extern(const ShadowFns* f, const char* name) {
-    for (int i = 0; name && i < f->extern_count; i++)
-        if (strcmp(f->externs[i]->value, name) == 0) return f->externs[i];
-    return NULL;
+    return name ? (ASTNode*)strmap_get(&f->externs, name) : NULL;
 }
 
 /* Every C spelling a reference to `v` could have that names one of `fns`,
@@ -6512,8 +6497,8 @@ static void rename_locals_shadowing_functions_in(ASTNode* scope, const ShadowFns
                                                  const NameSet* fixed) {
     LocalShadowScan s = {fns, fixed, {0}, {0}, {0}};
     scan_local_shadows(scope, &s);
-    for (int i = 0; i < s.renamed.count; i++) {
-        const char* from = s.renamed.names[i];
+    for (int i = 0; i < strmap_count(&s.renamed); i++) {
+        const char* from = strmap_key_at(&s.renamed, i);
         char* to = prefixed_name("ae_local_", from);
         int active = 0;
         rename_local_after_binding(scope, from, to, &active);
@@ -6527,7 +6512,7 @@ static void rename_locals_shadowing_functions_in(ASTNode* scope, const ShadowFns
 static void rename_locals_shadowing_functions(ASTNode* program) {
     if (!program) return;
     NameSet globals = {0};
-    ShadowFns fns = {{0}, NULL, 0, 0};
+    ShadowFns fns = {{0}, {0}};
     for (int i = 0; i < program->child_count; i++) {
         ASTNode* c = program->children[i];
         if (!c || !c->value) continue;
@@ -6545,7 +6530,7 @@ static void rename_locals_shadowing_functions(ASTNode* program) {
             }
         }
     }
-    for (int i = 0; fns.names.count > 0 && i < program->child_count; i++) {
+    for (int i = 0; strmap_count(&fns.names) > 0 && i < program->child_count; i++) {
         ASTNode* c = program->children[i];
         if (!c) continue;
         if (c->type == AST_FUNCTION_DEFINITION || c->type == AST_MAIN_FUNCTION ||
@@ -6553,7 +6538,7 @@ static void rename_locals_shadowing_functions(ASTNode* program) {
             rename_locals_shadowing_functions_in(c, &fns, &globals);
         } else if (c->type == AST_ACTOR_DEFINITION) {
             NameSet fixed = {0};
-            for (int g = 0; g < globals.count; g++) nameset_add(&fixed, globals.names[g]);
+            for (int g = 0; g < strmap_count(&globals); g++) nameset_add(&fixed, strmap_key_at(&globals, g));
             for (int k = 0; k < c->child_count; k++) {
                 ASTNode* st = c->children[k];
                 if (st && st->type == AST_STATE_DECLARATION && st->value)
@@ -6689,7 +6674,7 @@ static void rename_scoped_bindings(ASTNode* program) {
         } else if (c->type == AST_ACTOR_DEFINITION) {
             /* An actor's state is `self->name`, no local. */
             NameSet fixed = {0};
-            for (int g = 0; g < globals.count; g++) nameset_add(&fixed, globals.names[g]);
+            for (int g = 0; g < strmap_count(&globals); g++) nameset_add(&fixed, strmap_key_at(&globals, g));
             for (int k = 0; k < c->child_count; k++) {
                 ASTNode* st = c->children[k];
                 if (st && st->type == AST_STATE_DECLARATION && st->value)
diff --git a/compiler/codegen/codegen_internal.h b/compiler/codegen/codegen_internal.h
index 0f7fe7c9a..7659a0402 100644
--- a/compiler/codegen/codegen_internal.h
+++ b/compiler/codegen/codegen_internal.h
@@ -820,6 +820,8 @@ typedef struct {
                                 * parameter) -> the definition (#2897) */
     StrMap def_sets;           /* `<ptr>` of a definition -> the DefClauses it
                                 * is one of (#2897, fn_def_clause_set) */
+    StrMap fn_globals;         /* name -> the first module `var`/`const` that may
+                                * hold a fn pointer (#3499, lookup_fnptr_global) */
 } ProgramIndex;
 
 ProgramIndex* program_index(ASTNode* program);
diff --git a/new_changelogs/20261101T120000Z-fixed-3499-compile-time-linear.md b/new_changelogs/20261101T120000Z-fixed-3499-compile-time-linear.md
new file mode 100644
index 000000000..f0592ba08
--- /dev/null
+++ b/new_changelogs/20261101T120000Z-fixed-3499-compile-time-linear.md
@@ -0,0 +1,12 @@
+- **Compile time grows linearly with a program's size again (#3499).**
+  Three lookups by name scanned the whole program for each call or each
+  top-level node: the checker's callee and extern lookups, codegen's
+  function-pointer globals and its set of function names that a local may
+  shadow, and the merge's import prefixes. A chain of 8000 functions took
+  1 s here and 22 to 25 s on the release's macOS x86_64 runner, which
+  failed the release twice. Each lookup is now answered from an index
+  (the checker's clause index, codegen's program index, a hashed name set),
+  and the same chain compiles in a third of a second; at 32000 functions,
+  1.3 s instead of about 20. `order_effects_scaling` now compares 4000 and
+  16000 functions on the same runner, so it no longer depends on the
+  runner's speed.
diff --git a/tests/integration/order_effects_scaling/test_order_effects_scaling.sh b/tests/integration/order_effects_scaling/test_order_effects_scaling.sh
index 3d43d01f1..c48454b7e 100755
--- a/tests/integration/order_effects_scaling/test_order_effects_scaling.sh
+++ b/tests/integration/order_effects_scaling/test_order_effects_scaling.sh
@@ -3,12 +3,20 @@
 # evaluation-order rule of #2478) is solved over the call graph in time
 # linear in its size.
 #
-# A chain of 8000 functions, each calling the next and only the last
-# writing through its pointer parameter, asked about once
-# (`show(q.n, f0(p, 3))`): one fixed point over every reached function took
-# a pass per level, 90 s for this chain, and the recursive solve before it
-# ran out of stack. Solved by strongly connected component it takes well
-# under a second; the bound here is generous for slow runners.
+# A chain of functions, each calling the next and only the last writing
+# through its pointer parameter, asked about once (`show(q.n, f0(p, 3))`):
+# one fixed point over every reached function took a pass per level, 90 s
+# for 8000 of them, and the recursive solve before it ran out of stack.
+#
+# #3499: the whole compile is linear too. Three lookups by name scanned the
+# program once per call or per top-level node (the checker's callee and
+# extern lookups, codegen's fn-pointer globals and shadowed names, the
+# merge's import prefixes), so the compile still grew with the square of the
+# chain: 8000 functions took 22 to 25 s on the release's macOS x86_64
+# runner. The chain is compiled at 4000 and at 16000 functions on the same
+# machine: four times the functions must cost less than eight times the time
+# (linear is four, the quadratic compile was thirteen), whatever the
+# runner's speed.
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
@@ -19,62 +27,88 @@ if [ ! -x "$AETHERC" ]; then
     echo "  [SKIP] order_effects_scaling: aetherc not built"
     exit 0
 fi
+if ! perl -MTime::HiRes -e 1 2>/dev/null; then
+    echo "  [SKIP] order_effects_scaling: no perl Time::HiRes to time the compiles"
+    exit 0
+fi
 
 TMPDIR="$(mktemp -d)"
 trap 'rm -rf "$TMPDIR"' EXIT
 
-N=8000
-LIMIT=20
+# A sanity ceiling on the larger compile, far above what a linear one takes
+# on any runner.
+LIMIT_MS=60000
 
-awk -v n="$N" 'BEGIN {
-    print "extern malloc(size: int) -> ptr"
-    print ""
-    print "struct Box {"
-    print "    n: int"
-    print "}"
-    print ""
-    print "show(a: int, b: int) -> int {"
-    print "    return a * 1000 + b"
-    print "}"
-    for (i = 0; i < n; i++) {
+now_ms() { perl -MTime::HiRes=time -e 'printf "%d\n", time * 1000'; }
+
+# chain <n>: write the chain of n functions to $TMPDIR/chain<n>.ae.
+chain() {
+    awk -v n="$1" 'BEGIN {
+        print "extern malloc(size: int) -> ptr"
         print ""
-        print "f" i "(b: *Box, d: int) -> int {"
-        if (i + 1 < n) {
-            print "    return f" (i + 1) "(b, d + 1)"
-        } else {
-            print "    b.n = 5"
-            print "    return 2"
+        print "struct Box {"
+        print "    n: int"
+        print "}"
+        print ""
+        print "show(a: int, b: int) -> int {"
+        print "    return a * 1000 + b"
+        print "}"
+        for (i = 0; i < n; i++) {
+            print ""
+            print "f" i "(b: *Box, d: int) -> int {"
+            if (i + 1 < n) {
+                print "    return f" (i + 1) "(b, d + 1)"
+            } else {
+                print "    b.n = 5"
+                print "    return 2"
+            }
+            print "}"
         }
+        print ""
+        print "main() {"
+        print "    p = malloc(sizeof(Box)) as *Box"
+        print "    q = p"
+        print "    p.n = 1"
+        print "    r = show(q.n, f0(p, 3))"
+        print "    println(\"${r}\")"
         print "}"
-    }
-    print ""
-    print "main() {"
-    print "    p = malloc(sizeof(Box)) as *Box"
-    print "    q = p"
-    print "    p.n = 1"
-    print "    r = show(q.n, f0(p, 3))"
-    print "    println(\"${r}\")"
-    print "}"
-}' > "$TMPDIR/chain.ae"
+    }' > "$TMPDIR/chain$1.ae"
+}
+
+# compile_ms <n>: compile the chain of n functions; its time in ms in $MS.
+compile_ms() {
+    start=$(now_ms)
+    "$AETHERC" "$TMPDIR/chain$1.ae" "$TMPDIR/chain$1.c" > "$TMPDIR/aetherc$1.log" 2>&1
+    rc=$?
+    MS=$(( $(now_ms) - start ))
+    if [ "$rc" -ne 0 ]; then
+        echo "  [FAIL] order_effects_scaling: aetherc failed (exit $rc) on a chain of $1 calls"
+        tail -5 "$TMPDIR/aetherc$1.log" | sed 's/^/    /'
+        exit 1
+    fi
+}
 
-start=$(date +%s)
-"$AETHERC" "$TMPDIR/chain.ae" "$TMPDIR/chain.c" > "$TMPDIR/aetherc.log" 2>&1
-rc=$?
-elapsed=$(( $(date +%s) - start ))
+chain 4000
+chain 16000
+compile_ms 4000
+small=$MS
+compile_ms 16000
+large=$MS
 
-if [ "$rc" -ne 0 ]; then
-    echo "  [FAIL] order_effects_scaling: aetherc failed (exit $rc) on a chain of $N calls"
-    tail -5 "$TMPDIR/aetherc.log" | sed 's/^/    /'
+if [ "$large" -gt "$LIMIT_MS" ]; then
+    echo "  [FAIL] order_effects_scaling: a chain of 16000 calls took ${large} ms to compile (ceiling ${LIMIT_MS} ms)"
     exit 1
 fi
-if [ "$elapsed" -gt "$LIMIT" ]; then
-    echo "  [FAIL] order_effects_scaling: a chain of $N calls took ${elapsed}s to compile (limit ${LIMIT}s)"
+# Below 50 ms the timer's grain and the process start decide; both are fast.
+[ "$small" -lt 50 ] && small=50
+if [ "$large" -ge $(( small * 8 )) ]; then
+    echo "  [FAIL] order_effects_scaling: 4000 calls compiled in ${small} ms, 16000 in ${large} ms: four times the functions cost $(( large / small ))x the time (linear is 4x)"
     exit 1
 fi
 # The read of q.n comes first, ahead of the call that writes it.
-if ! grep -q "_eo[0-9]* = \|_AE_SEQ_LET" "$TMPDIR/chain.c"; then
+if ! grep -q "_eo[0-9]* = \|_AE_SEQ_LET" "$TMPDIR/chain16000.c"; then
     echo "  [FAIL] order_effects_scaling: q.n is not evaluated ahead of f0(p, 3)"
     exit 1
 fi
-echo "  [PASS] order_effects_scaling: a chain of $N calls solved in ${elapsed}s"
+echo "  [PASS] order_effects_scaling: 4000 calls in ${small} ms, 16000 in ${large} ms"
 exit 0

From 243e9031378cb1d92879907497417f7f699b1cce Mon Sep 17 00:00:00 2001
From: Nicolas Maman <nicolasmd87@gmail.com>
Date: Sun, 1 Nov 2026 13:34:04 -0300
Subject: [PATCH 02/17] ci: every ubuntu-latest job runs on ubuntu-26.04;
 actions off Node 20 (#3500)

GitHub moves ubuntu-latest from 24.04 to 26.04 between 2026-10-19 and
2026-11-19, so until then a job lands on either image from one run to the
next (contrib.sqlite's cross build failed on a 26.04 runner and passed on
the next run; Paul's 4861daaa fixed its package). The jobs that used
ubuntu-latest (ci.yml six, memory-check.yml, windows.yml two, release.yml
six, changelog-collect.yml) now name ubuntu-26.04, so each run gets the
image this PR checks them on. The release's Linux build stays on 22.04
for its glibc floor.

The actions GitHub flags as Node 20 move to the releases that declare
node24: checkout v5, cache restore/save v5, upload-artifact v6,
download-artifact v7, setup-emsdk v15, action-gh-release v3, and in the
benchmarks setup-java v5 and setup-go v6. mlugg/setup-zig and
ilammy/msvc-dev-cmd have no node24 release yet and stay (GitHub runs them
on Node 24).
---
 .github/workflows/benchmarks.yml        |  8 +--
 .github/workflows/changelog-collect.yml |  4 +-
 .github/workflows/ci.yml                | 86 ++++++++++++-------------
 .github/workflows/memory-check.yml      | 30 ++++-----
 .github/workflows/release.yml           | 38 +++++------
 .github/workflows/ubsan.yml             |  4 +-
 .github/workflows/windows.yml           | 34 +++++-----
 7 files changed, 102 insertions(+), 102 deletions(-)

diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
index b1ed009c2..ec70ba1dd 100644
--- a/.github/workflows/benchmarks.yml
+++ b/.github/workflows/benchmarks.yml
@@ -58,7 +58,7 @@ jobs:
     timeout-minutes: ${{ github.event_name == 'workflow_dispatch' && 120 || 30 }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     # gcc and g++ for C, C++ and Aether; GNU time for CPU time and memory.
     - name: Install C, C++ and GNU time
@@ -66,12 +66,12 @@ jobs:
         sudo rm -f /etc/apt/sources.list.d/google-chrome.list; sudo apt-get update
         sudo apt-get install -y gcc g++ make time
 
-    - uses: actions/setup-go@v5
+    - uses: actions/setup-go@v6
       with:
         go-version: stable
         cache: false
 
-    - uses: actions/setup-java@v4
+    - uses: actions/setup-java@v5
       with:
         distribution: temurin
         java-version: '21'
@@ -129,7 +129,7 @@ jobs:
 
     - name: Upload results
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: benchmark-results
         path: |
diff --git a/.github/workflows/changelog-collect.yml b/.github/workflows/changelog-collect.yml
index b5b85e437..192782234 100644
--- a/.github/workflows/changelog-collect.yml
+++ b/.github/workflows/changelog-collect.yml
@@ -42,9 +42,9 @@ concurrency:
 jobs:
   collect:
     name: Fold settled fragments
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         # The collector reads each fragment's commit time to decide whether
         # it has settled, so it needs the history, not a shallow clone.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9f6a5ad5d..564d1b03a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -136,7 +136,7 @@ jobs:
             target: ci-sweep
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Install toolchain
       if: matrix.install != ''
@@ -159,7 +159,7 @@ jobs:
     # correctness never depends on a cache hit.
     - name: Restore miniaudio object cache
       id: audio_cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: .ci-cache
         key: audio-obj-${{ matrix.os }}-${{ matrix.cc }}-h${{ matrix.harden }}-${{ hashFiles('std/audio/miniaudio.h', 'std/audio/stb_vorbis.c', 'std/audio/aether_audio.c', 'std/audio/aether_audio.h') }}
@@ -241,7 +241,7 @@ jobs:
         github.event_name == 'push' && github.ref == 'refs/heads/main'
         && steps.audio_cache.outputs.cache-hit != 'true'
         && (matrix.target != 'ci-sweep' || matrix.unit == '1')
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v5
       with:
         path: .ci-cache
         key: audio-obj-${{ matrix.os }}-${{ matrix.cc }}-h${{ matrix.harden }}-${{ hashFiles('std/audio/miniaudio.h', 'std/audio/stb_vorbis.c', 'std/audio/aether_audio.c', 'std/audio/aether_audio.h') }}
@@ -273,12 +273,12 @@ jobs:
         shard: ["1/2", "2/2"]
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     # The ARM64 leg's miniaudio object (same OS, compiler and build
     # variant, so the same key); restore only, the leg saves it.
     - name: Restore miniaudio object cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: .ci-cache
         key: audio-obj-macos-latest-clang-h0-${{ hashFiles('std/audio/miniaudio.h', 'std/audio/stb_vorbis.c', 'std/audio/aether_audio.c', 'std/audio/aether_audio.h') }}
@@ -319,11 +319,11 @@ jobs:
   # ============================================================
   ci-changelog:
     name: CHANGELOG entry present
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     if: github.event_name == 'pull_request'
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         fetch-depth: 0
 
@@ -412,11 +412,11 @@ jobs:
 
   ci-freebsd-cross:
     name: FreeBSD / cross-compile (x86_64)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Install toolchain
       run: sudo rm -f /etc/apt/sources.list.d/google-chrome.list; sudo apt-get update && sudo apt-get install -y gcc make bc curl xz-utils
@@ -424,7 +424,7 @@ jobs:
     # zig cc bundles no FreeBSD libc, so the base sysroot is what makes the
     # FreeBSD headers visible. Same source as the release leg.
     - name: Checkout aether-crossbuild
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         repository: aether-lang-dev/aether-crossbuild
         path: crossbuild
@@ -434,7 +434,7 @@ jobs:
     # dir every run. deps.lock pins both URLs and checksums.
     - name: Restore cross-toolchain download cache
       id: cross_cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: |
           .zig
@@ -459,7 +459,7 @@ jobs:
       if: >-
         github.event_name == 'push' && github.ref == 'refs/heads/main'
         && steps.cross_cache.outputs.cache-hit != 'true'
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v5
       with:
         path: |
           .zig
@@ -484,10 +484,10 @@ jobs:
   # (no shm_open, no pthread_setaffinity_np, ...) on the PR, not at release.
   ci-android-cross:
     name: Android / cross-compile (aarch64)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Cross-build for Android (ANDROID=1)
       run: |
         NDK="${ANDROID_NDK_LATEST_HOME:-${ANDROID_NDK_HOME:-}}"
@@ -534,18 +534,18 @@ jobs:
   # ============================================================
   ci-sqlite-cross:
     name: contrib.sqlite / self-contained cross builds
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Install toolchain
       run: sudo rm -f /etc/apt/sources.list.d/google-chrome.list; sudo apt-get update && sudo apt-get install -y gcc make bc curl xz-utils file qemu-user
 
     - name: Restore zig + SQLite cross object cache
       id: sqlite_xcache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: |
           .zig
@@ -577,7 +577,7 @@ jobs:
       if: >-
         github.event_name == 'push' && github.ref == 'refs/heads/main'
         && steps.sqlite_xcache.outputs.cache-hit != 'true'
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v5
       with:
         path: |
           .zig
@@ -586,11 +586,11 @@ jobs:
 
   ci-freebsd-native:
     name: FreeBSD / native build + unit tests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     # vmactions/freebsd-vm installs qemu with apt, under apt's default
     # connect timeout. When the runner's Azure mirror stopped answering, its
@@ -633,7 +633,7 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Install host language dev libraries
       run: |
@@ -688,7 +688,7 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Install build deps
       run: |
@@ -737,7 +737,7 @@ jobs:
     # only ever supply the right one. Split restore/save as above.
     - name: Restore SQLite amalgamation object cache
       id: sqlite_obj_cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: .ci-cache/sqlite
         key: sqlite-obj-ubuntu-22.04-${{ hashFiles('contrib/sqlite/amalgamation.lock', 'tests/scripts/contrib_build.sh') }}
@@ -759,7 +759,7 @@ jobs:
       if: >-
         github.event_name == 'push' && github.ref == 'refs/heads/main'
         && steps.sqlite_obj_cache.outputs.cache-hit != 'true'
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v5
       with:
         path: .ci-cache/sqlite
         key: sqlite-obj-ubuntu-22.04-${{ hashFiles('contrib/sqlite/amalgamation.lock', 'tests/scripts/contrib_build.sh') }}
@@ -883,7 +883,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Install build deps, lavapipe and gdb
       run: |
@@ -1001,7 +1001,7 @@ jobs:
         shell: bash
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     # Metal ships with macOS. Vulkan does not: the headers build
     # contrib.vulkan, the loader is what it opens at runtime, and MoltenVK is
@@ -1077,7 +1077,7 @@ jobs:
         shell: msys2 {0}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - uses: msys2/setup-msys2@v2
       with:
@@ -1179,7 +1179,7 @@ jobs:
         shell: msys2 {0}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - uses: msys2/setup-msys2@v2
       with:
@@ -1246,7 +1246,7 @@ jobs:
     # (#1372); keep its object between runs, as on the Linux contrib leg.
     - name: Restore SQLite amalgamation object cache
       id: sqlite_obj_cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: .ci-cache/sqlite
         key: sqlite-obj-windows-${{ hashFiles('contrib/sqlite/amalgamation.lock', 'tests/scripts/contrib_build.sh') }}
@@ -1295,7 +1295,7 @@ jobs:
       if: >-
         github.event_name == 'push' && github.ref == 'refs/heads/main'
         && steps.sqlite_obj_cache.outputs.cache-hit != 'true'
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v5
       with:
         path: .ci-cache/sqlite
         key: sqlite-obj-windows-${{ hashFiles('contrib/sqlite/amalgamation.lock', 'tests/scripts/contrib_build.sh') }}
@@ -1354,7 +1354,7 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Install toolchain
       run: sudo rm -f /etc/apt/sources.list.d/google-chrome.list; sudo apt-get update && sudo apt-get install -y gcc make bc
@@ -1374,7 +1374,7 @@ jobs:
     # could rot to a stub and stay green everywhere. OPENSSL=0 forces the
     # detection off regardless of what is installed on the runner.
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Install toolchain
       run: sudo rm -f /etc/apt/sources.list.d/google-chrome.list; sudo apt-get update && sudo apt-get install -y gcc make bc
@@ -1418,11 +1418,11 @@ jobs:
   # case that is skipped or does not agree, with the reason.
   ci-crypto-ct:
     name: Crypto constant-time (Valgrind) and conformance corpora
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Install toolchain
       run: sudo rm -f /etc/apt/sources.list.d/google-chrome.list; sudo apt-get update && sudo apt-get install -y gcc make bc valgrind
@@ -1439,7 +1439,7 @@ jobs:
     - name: Restore the conformance corpora
       id: conformance_cache
       if: success() || failure()
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: ~/.cache/aether-conformance
         key: conformance-${{ hashFiles('tests/conformance/*/run.sh') }}
@@ -1457,7 +1457,7 @@ jobs:
         (success() || failure())
         && github.event_name == 'push' && github.ref == 'refs/heads/main'
         && steps.conformance_cache.outputs.cache-hit != 'true'
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v5
       with:
         path: ~/.cache/aether-conformance
         key: conformance-${{ hashFiles('tests/conformance/*/run.sh') }}
@@ -1467,10 +1467,10 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Install Emscripten
-      uses: mymindstorm/setup-emsdk@v14
+      uses: mymindstorm/setup-emsdk@v15
       with:
         version: 3.1.51
 
@@ -1551,7 +1551,7 @@ jobs:
     timeout-minutes: 15
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     # --no-install-recommends: Recommends pulls libstdc++-arm-none-eabi-newlib,
     # 347 MB of C++ library this C-only build never links, and a slow Azure
@@ -1577,7 +1577,7 @@ jobs:
     timeout-minutes: 45
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Free disk space for the ESP-IDF image
       run: |
@@ -1610,7 +1610,7 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Install RISC-V cross-toolchain + qemu
       run: |
@@ -1634,7 +1634,7 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Install tools
       run: |
@@ -1680,7 +1680,7 @@ jobs:
 
     - name: Upload memory reports
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: memory-reports
         path: |
diff --git a/.github/workflows/memory-check.yml b/.github/workflows/memory-check.yml
index 6c0e71aea..29ec888c4 100644
--- a/.github/workflows/memory-check.yml
+++ b/.github/workflows/memory-check.yml
@@ -41,7 +41,7 @@ concurrency:
 jobs:
   valgrind-test:
     name: Valgrind Memory Leak Check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     # A healthy run takes about a minute: 66 s on PR #2601, 25 s of it the
     # Valgrind run itself. It used to take an hour, while idle actor threads
     # spun (#2592) and Valgrind's default lock starved the threads they waited
@@ -51,7 +51,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Install dependencies
       run: |
@@ -133,7 +133,7 @@ jobs:
 
     - name: Upload Valgrind report
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: valgrind-report
         path: |
@@ -147,14 +147,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest]
+        os: [ubuntu-26.04, macos-latest]
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Setup GCC
-      if: matrix.os == 'ubuntu-latest'
+      if: matrix.os == 'ubuntu-26.04'
       run: |
         sudo rm -f /etc/apt/sources.list.d/google-chrome.list; sudo apt-get update
         sudo apt-get install -y gcc make
@@ -167,7 +167,7 @@ jobs:
     - name: Build with AddressSanitizer
       run: |
         make clean
-        if [ "${{ matrix.os }}" = "ubuntu-latest" ]; then
+        if [ "${{ matrix.os }}" = "ubuntu-26.04" ]; then
           # Linux supports LeakSanitizer
           make compiler CFLAGS="-fsanitize=address -fsanitize=leak -fno-omit-frame-pointer -O1 -g" \
                         LDFLAGS="-fsanitize=address -fsanitize=leak -pthread -lm"
@@ -183,7 +183,7 @@ jobs:
 
     - name: Run tests with ASAN
       run: |
-        if [ "${{ matrix.os }}" = "ubuntu-latest" ]; then
+        if [ "${{ matrix.os }}" = "ubuntu-26.04" ]; then
           export ASAN_OPTIONS="detect_leaks=1:halt_on_error=1:abort_on_error=1"
           export LSAN_OPTIONS="report_objects=1"
         else
@@ -196,7 +196,7 @@ jobs:
     # nothing checked that, and every program leaked. Linux only: LeakSanitizer
     # is the whole point and macOS has no LSan.
     - name: Compiler leak gate
-      if: matrix.os == 'ubuntu-latest'
+      if: matrix.os == 'ubuntu-26.04'
       run: bash tests/scripts/check_compiler_leaks.sh
 
     # The C unit tests under UBSan, on macOS (Apple clang). On Linux they run
@@ -222,11 +222,11 @@ jobs:
 
   memory-profiling:
     name: Memory Usage Profiling
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Install dependencies
       run: |
@@ -269,7 +269,7 @@ jobs:
         echo "SUCCESS: Peak memory usage acceptable"
 
     - name: Upload profiling report
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: memory-profile
         path: |
@@ -282,11 +282,11 @@ jobs:
 
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest]
+        os: [ubuntu-26.04, macos-latest]
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     # Linux only, as the setup steps above. The macOS runner already has
     # clang and make; the brew fallback that ran there installed nothing the
@@ -294,7 +294,7 @@ jobs:
     # `brew update` failed the job whenever a tap preinstalled on the runner
     # could not be fetched (#2895).
     - name: Setup GCC
-      if: matrix.os == 'ubuntu-latest'
+      if: matrix.os == 'ubuntu-26.04'
       run: |
         sudo rm -f /etc/apt/sources.list.d/google-chrome.list; sudo apt-get update
         sudo apt-get install -y gcc make
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 508c075e0..00fb682eb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,7 +40,7 @@ jobs:
   # ================================================================== #
   prepare:
     name: Prepare release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     if: github.ref == 'refs/heads/main'
 
     # `pull-requests: read` lets the decide step query PR state via gh,
@@ -57,7 +57,7 @@ jobs:
       tag:     ${{ steps.decide.outputs.tag }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         fetch-depth: 0
         fetch-tags: true
@@ -166,14 +166,14 @@ jobs:
     name: Auto-bump version
     needs: prepare
     if: needs.prepare.outputs.action == 'bump' || needs.prepare.outputs.action == 'refresh'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     permissions:
       contents: write
       pull-requests: write
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         fetch-depth: 0
         fetch-tags: true
@@ -383,7 +383,7 @@ jobs:
     name: Tag release
     needs: prepare
     if: needs.prepare.outputs.action == 'tag'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     permissions:
       contents: write
@@ -393,7 +393,7 @@ jobs:
       version: ${{ steps.t.outputs.version }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         fetch-depth: 0
         fetch-tags: true
@@ -494,7 +494,7 @@ jobs:
             timeout: 80
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         ref: ${{ needs.tag.outputs.tag || github.ref }}
         # Full history + all tags. A shallow checkout of a tag does not
@@ -678,7 +678,7 @@ jobs:
         cd release && TZ=UTC+12 zip -r ../aether-${VERSION}-${{ matrix.target }}.zip *
 
     - name: Upload artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: aether-${{ matrix.target }}
         path: |
@@ -711,11 +711,11 @@ jobs:
         (needs.tag.result == 'success' && needs.tag.outputs.tag != '') ||
         startsWith(github.ref, 'refs/tags/')
       )
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         ref: ${{ needs.tag.outputs.tag || github.ref }}
         # Full history + all tags. A shallow checkout of a tag does not
@@ -733,7 +733,7 @@ jobs:
     # libc) comes from the sibling aether-crossbuild repo, which fetches
     # FreeBSD's published base.txz (BSD-licensed, freely redistributable).
     - name: Checkout aether-crossbuild
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         repository: aether-lang-dev/aether-crossbuild
         path: crossbuild
@@ -908,7 +908,7 @@ jobs:
           || { echo "::error::the sysroot probe did not produce a FreeBSD binary"; exit 1; }
 
     - name: Upload artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: aether-freebsd-x86_64
         path: |
@@ -938,11 +938,11 @@ jobs:
         (needs.tag.result == 'success' && needs.tag.outputs.tag != '') ||
         startsWith(github.ref, 'refs/tags/')
       )
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         ref: ${{ needs.tag.outputs.tag || github.ref }}
         fetch-depth: 0
@@ -1008,7 +1008,7 @@ jobs:
         ls -la "aether-${VERSION}-android-aarch64-sysroot.tar.xz"
 
     - name: Upload artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: aether-android-aarch64
         path: |
@@ -1021,7 +1021,7 @@ jobs:
     # quietly drops a platform because its build broke is worse than no
     # release, and dropping it silently is what hid the last FreeBSD break.
     needs: [tag, build, build-freebsd, build-android]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     if: |
       always() && needs.build.result == 'success'
       && needs.build-freebsd.result == 'success'
@@ -1034,12 +1034,12 @@ jobs:
       contents: write
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         ref: ${{ needs.tag.outputs.tag || github.ref }}
 
     - name: Download all artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v7
       with:
         merge-multiple: true
 
@@ -1058,7 +1058,7 @@ jobs:
       run: python3 .github/scripts/build_release_body.py ${{ steps.tag.outputs.version }}
 
     - name: Create GitHub Release
-      uses: softprops/action-gh-release@v2
+      uses: softprops/action-gh-release@v3
       with:
         tag_name:   ${{ steps.tag.outputs.tag }}
         name:       Aether ${{ steps.tag.outputs.version }}
diff --git a/.github/workflows/ubsan.yml b/.github/workflows/ubsan.yml
index d33d421c3..a73cfd8b4 100644
--- a/.github/workflows/ubsan.yml
+++ b/.github/workflows/ubsan.yml
@@ -56,7 +56,7 @@ jobs:
     timeout-minutes: 35
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Install toolchain
       run: sudo rm -f /etc/apt/sources.list.d/google-chrome.list; sudo apt-get update && sudo apt-get install -y gcc make bc pkg-config libgtk-4-dev; pip install --retries 10 --timeout 120 --break-system-packages websockets 2>/dev/null || pip install --retries 10 --timeout 120 websockets
@@ -66,7 +66,7 @@ jobs:
 
     - name: Upload the UBSan reports
       if: failure()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: ubsan-reports
         path: build/ubsan/reports/
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 4712e833b..430eef3ae 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -92,11 +92,11 @@ jobs:
   # ============================================================
   windows-cross:
     name: Windows / cross-build (x86_64)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 25
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Install toolchain
       run: sudo rm -f /etc/apt/sources.list.d/google-chrome.list; sudo apt-get update && sudo apt-get install -y gcc make bc curl xz-utils
@@ -105,7 +105,7 @@ jobs:
     # mingw-w64 headers + CRT sources, so there is no sysroot to fetch.
     - name: Restore zig toolchain cache
       id: zig_cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: |
           .zig
@@ -124,7 +124,7 @@ jobs:
       if: >-
         github.event_name == 'push' && github.ref == 'refs/heads/main'
         && steps.zig_cache.outputs.cache-hit != 'true'
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v5
       with:
         path: |
           .zig
@@ -159,7 +159,7 @@ jobs:
 
     - name: Upload cross-built binaries
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: aether-windows-cross-x86_64
         path: |
@@ -181,7 +181,7 @@ jobs:
   # ============================================================
   windows-wine:
     name: Windows / runtime under Wine (x86_64)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     # Dependency installation can take 20 minutes on hosted runners; leave
     # time for the complete cross-build and runtime sweep after setup.
     timeout-minutes: 60
@@ -189,7 +189,7 @@ jobs:
     # a gate, so it must not add latency to an otherwise green run.
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Install toolchain
       run: |
@@ -263,7 +263,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Set up MSYS2 / MinGW-w64
       uses: msys2/setup-msys2@v2
@@ -293,7 +293,7 @@ jobs:
     # key already embeds the source hash).
     - name: Restore miniaudio object cache
       id: audio_cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: .ci-cache
         key: audio-obj-windows-${{ matrix.root }}-${{ hashFiles('std/audio/miniaudio.h', 'std/audio/stb_vorbis.c', 'std/audio/aether_audio.c', 'std/audio/aether_audio.h') }}
@@ -322,14 +322,14 @@ jobs:
       if: >-
         github.event_name == 'push' && github.ref == 'refs/heads/main'
         && steps.audio_cache.outputs.cache-hit != 'true' && matrix.target == 'ci'
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v5
       with:
         path: .ci-cache
         key: audio-obj-windows-${{ matrix.root }}-${{ hashFiles('std/audio/miniaudio.h', 'std/audio/stb_vorbis.c', 'std/audio/aether_audio.c', 'std/audio/aether_audio.h') }}
 
     - name: Upload Windows binaries
       if: matrix.target == 'ci'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: aether-windows-${{ matrix.root }}
         path: |
@@ -383,7 +383,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     # MINGW64 (msvcrt), the C runtime the baseline was measured on: a heap
     # count is the C runtime's own.
@@ -420,7 +420,7 @@ jobs:
     # failure is read from.
     - name: Upload the grid's report
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: ownership-grid-${{ matrix.slot }}
         path: |
@@ -446,7 +446,7 @@ jobs:
         shell: msys2 {0}
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     - name: Set up MSYS2 / MinGW-w64
       uses: msys2/setup-msys2@v2
       with:
@@ -470,7 +470,7 @@ jobs:
       run: make ownership-grid-check OWNERSHIP_GRID_ARGS="--mode both --update-baseline"
     - name: Upload the baseline
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: ownership-grid-baseline
         path: |
@@ -491,7 +491,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Set up Visual Studio developer environment
       uses: ilammy/msvc-dev-cmd@v1
@@ -533,7 +533,7 @@ jobs:
     # is the one the windows-cross job built; the script runs under Git Bash,
     # with cl.exe on PATH from msvc-dev-cmd.
     - name: Download the cross-built aetherc
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v7
       with:
         name: aether-windows-cross-x86_64
         path: build/cross

From 56c9261e6281725221d58f400a924a7c1923524b Mon Sep 17 00:00:00 2001
From: Nicolas Maman <nicolasmd87@gmail.com>
Date: Sun, 1 Nov 2026 13:42:40 -0300
Subject: [PATCH 03/17] fix: an if used as a value parses when its condition
 ends in a call (#3478)

The expression form of `if` parsed its condition without the in_condition
guard the if statement, while and match use, so a call at its end took
the then arm's `{` as a trailing block ("Expected LEFT_BRACE, got
ELSE"). The condition is parsed under the guard and the arms without it,
so a call inside an arm still takes a trailing block. Regression test
covers a lone call, a call ending an &&, an else-if chain of calls, and a
trailing closure in an arm.
---
 compiler/parser/parser.c                      | 39 ++++++++++++-------
 ...fixed-3478-if-expression-call-condition.md |  5 +++
 .../test_if_expression_call_condition.ae      | 37 ++++++++++++++++++
 3 files changed, 66 insertions(+), 15 deletions(-)
 create mode 100644 new_changelogs/20261101T130000Z-fixed-3478-if-expression-call-condition.md
 create mode 100644 tests/regression/test_if_expression_call_condition.ae

diff --git a/compiler/parser/parser.c b/compiler/parser/parser.c
index 051a3cfff..640ab4ef0 100644
--- a/compiler/parser/parser.c
+++ b/compiler/parser/parser.c
@@ -1872,24 +1872,33 @@ static ASTNode* parse_primary_expression_inner(Parser* parser) {
             // chain of any length is nested two-armed if-expressions and
             // types as they do, the last `else` still required.
             Token* t = advance_token(parser); // consume 'if'
+            /* #3478: the `{` after the condition opens the then arm, so a
+             * call that ends the condition takes no trailing block, as in an
+             * `if` statement or a `match` (the in_condition guard). The arms
+             * sit inside braces, where a call may take one again. */
+            int saved_in_condition = parser->in_condition;
+            parser->in_condition = 1;
             ASTNode* cond = parse_expression(parser);
-            if (!cond) return NULL;
-            if (!expect_token(parser, TOKEN_LEFT_BRACE)) return NULL;
-            ASTNode* then_expr = parse_expression(parser);
-            if (!then_expr) return NULL;
-            if (!expect_token(parser, TOKEN_RIGHT_BRACE)) return NULL;
-            if (!expect_token(parser, TOKEN_ELSE)) return NULL;
+            parser->in_condition = 0;
+            ASTNode* then_expr = NULL;
             ASTNode* else_expr = NULL;
-            Token* after_else = peek_token(parser);
-            if (after_else && after_else->type == TOKEN_IF) {
-                else_expr = parse_primary_expression(parser);
-                if (!else_expr) return NULL;
-            } else {
-                if (!expect_token(parser, TOKEN_LEFT_BRACE)) return NULL;
-                else_expr = parse_expression(parser);
-                if (!else_expr) return NULL;
-                if (!expect_token(parser, TOKEN_RIGHT_BRACE)) return NULL;
+            int ok = cond && expect_token(parser, TOKEN_LEFT_BRACE) &&
+                     (then_expr = parse_expression(parser)) != NULL &&
+                     expect_token(parser, TOKEN_RIGHT_BRACE) &&
+                     expect_token(parser, TOKEN_ELSE);
+            if (ok) {
+                Token* after_else = peek_token(parser);
+                if (after_else && after_else->type == TOKEN_IF) {
+                    else_expr = parse_primary_expression(parser);
+                    ok = else_expr != NULL;
+                } else {
+                    ok = expect_token(parser, TOKEN_LEFT_BRACE) &&
+                         (else_expr = parse_expression(parser)) != NULL &&
+                         expect_token(parser, TOKEN_RIGHT_BRACE);
+                }
             }
+            parser->in_condition = saved_in_condition;
+            if (!ok) return NULL;
 
             ASTNode* if_expr = create_ast_node(AST_IF_EXPRESSION, NULL, t->line, t->column);
             if_expr->node_type = create_type(TYPE_UNKNOWN);
diff --git a/new_changelogs/20261101T130000Z-fixed-3478-if-expression-call-condition.md b/new_changelogs/20261101T130000Z-fixed-3478-if-expression-call-condition.md
new file mode 100644
index 000000000..72201c1ee
--- /dev/null
+++ b/new_changelogs/20261101T130000Z-fixed-3478-if-expression-call-condition.md
@@ -0,0 +1,5 @@
+- **An `if` used as a value parses when its condition ends in a call
+  (#3478).** `s = if leap(year) { "leap" } else { "common" }` failed with
+  "Expected LEFT_BRACE, got ELSE": the expression form parsed its condition
+  without the guard the `if` statement uses, so the call took the then
+  arm's `{` as a trailing block. A call inside an arm still takes one.
diff --git a/tests/regression/test_if_expression_call_condition.ae b/tests/regression/test_if_expression_call_condition.ae
new file mode 100644
index 000000000..eaad3bdcf
--- /dev/null
+++ b/tests/regression/test_if_expression_call_condition.ae
@@ -0,0 +1,37 @@
+// Regression (#3478): an `if` used as a value parses when its condition
+// ends in a call.
+//
+// The expression form parsed its condition without the guard the `if`
+// statement, `while` and `match` use, so the call at its end took the then
+// arm's `{` as a trailing block, and the `else` after it was "Expected
+// LEFT_BRACE, got ELSE". The condition is now parsed under that guard, and
+// the arms inside their braces without it, so a call there may still take
+// a block.
+
+extern exit(code: int)
+
+yes(x: int) -> bool -> x > 0
+
+twice(f: fn) -> int {
+    return call(f) * 2
+}
+
+check(got: int, want: int, what: string) {
+    if got != want {
+        println("FAIL: ${what}: ${got}, want ${want}")
+        exit(1)
+    }
+}
+
+main() {
+    s = if yes(1) { "yes" } else { "no" }
+    if s != "yes" {
+        println("FAIL: a call alone as the condition: ${s}")
+        exit(1)
+    }
+    check(if 1 < 2 && yes(1) { 1 } else { 2 }, 1, "a call that ends the condition")
+    check(if yes(-1) { 1 } else if yes(2) { 2 } else { 3 }, 2, "an else-if chain of calls")
+    // A call inside an arm still takes a trailing block.
+    check(if yes(1) { twice() || -> 21 } else { 0 }, 42, "a trailing block in the then arm")
+    println("ok")
+}

From 723eafde3b9f6c9643edd2fbd1428221781b48a4 Mon Sep 17 00:00:00 2001
From: Nicolas Maman <nicolasmd87@gmail.com>
Date: Sun, 1 Nov 2026 13:42:40 -0300
Subject: [PATCH 04/17] fix: s[i] on a string is a checked byte (#3479)

The checker gave a string index no type, so a local bound to it warned
"unresolved type in codegen, defaulting to int". The generated C read a
plain char (signed on x86: a UTF-8 byte past 127 read negative there and
positive on ARM), and nothing checked the index: s[100000] on "Az" read
past the string. The read is now typed byte in the inference pass and the
checker, the value string.bytes(s)[i] has, and codegen reads it through
_aether_str_at, which checks it against the string's length and panics
"string index i out of range for length n" (aether_string_fail_index),
as a slice index does. The language reference says so.
---
 compiler/analysis/type_inference.c            |  4 ++
 compiler/analysis/typechecker.c               |  8 +++
 compiler/codegen/codegen.c                    |  8 +++
 compiler/codegen/codegen_expr.c               | 12 ++++
 docs/language-reference.md                    |  2 +-
 ...01T130100Z-fixed-3479-string-index-byte.md |  7 +++
 runtime/aether_slice.h                        |  8 +++
 tests/regression/test_string_index_byte.ae    | 55 +++++++++++++++++++
 8 files changed, 103 insertions(+), 1 deletion(-)
 create mode 100644 new_changelogs/20261101T130100Z-fixed-3479-string-index-byte.md
 create mode 100644 tests/regression/test_string_index_byte.ae

diff --git a/compiler/analysis/type_inference.c b/compiler/analysis/type_inference.c
index e90031a10..1295c53b5 100644
--- a/compiler/analysis/type_inference.c
+++ b/compiler/analysis/type_inference.c
@@ -1091,6 +1091,10 @@ void collect_expression_constraints(ASTNode* node, InferenceContext* ctx) {
                 if (array_type && array_type->kind == TYPE_ARRAY && array_type->element_type) {
                     free_type(node->node_type);
                     node->node_type = clone_type(array_type->element_type);
+                } else if (array_type && array_type->kind == TYPE_STRING) {
+                    /* #3479: `s[i]` reads one byte of the string. */
+                    free_type(node->node_type);
+                    node->node_type = create_type(TYPE_BYTE);
                 }
             }
             break;
diff --git a/compiler/analysis/typechecker.c b/compiler/analysis/typechecker.c
index f751e3640..80e9db4ae 100644
--- a/compiler/analysis/typechecker.c
+++ b/compiler/analysis/typechecker.c
@@ -17835,6 +17835,14 @@ int typecheck_expression(ASTNode* expr, SymbolTable* table) {
                     if (expr->node_type) free_type(expr->node_type);
                     expr->node_type = clone_type(arr_type->element_type);
                 }
+                /* #3479: `s[i]` on a string reads one byte, the type
+                 * `string.bytes(s)[i]` has; a local bound to it was left to
+                 * codegen's `int` default. */
+                if (arr_type && arr_type->kind == TYPE_STRING &&
+                    (!expr->node_type || expr->node_type->kind != TYPE_BYTE)) {
+                    if (expr->node_type) free_type(expr->node_type);
+                    expr->node_type = create_type(TYPE_BYTE);
+                }
 
                 // Indexing a bare `ptr` (void*, element_type == NULL) has no
                 // element type: it lowers to a C index on `void*` and leaks
diff --git a/compiler/codegen/codegen.c b/compiler/codegen/codegen.c
index 35deae9d6..690383cb8 100644
--- a/compiler/codegen/codegen.c
+++ b/compiler/codegen/codegen.c
@@ -9815,6 +9815,14 @@ void generate_program(CodeGenerator* gen, ASTNode* program) {
     print_line(gen, "    if (!s) return \"\";");
     print_line(gen, "    return aether_string_data(s);");
     print_line(gen, "}");
+    /* #3479: `s[i]` is the string's byte i, read unsigned (a plain char is
+     * signed on some targets), and checked against the string's length as a
+     * slice index is against the slice's; past the end it read past it. */
+    print_line(gen, "static inline uint8_t _aether_str_at(const void* s, int64_t i, const char* file, int line) {");
+    print_line(gen, "    uint64_t n = s ? (uint64_t)aether_string_length(s) : 0;");
+    print_line(gen, "    if ((uint64_t)i >= n) aether_string_fail_index(i, n, file, line);");
+    print_line(gen, "    return (uint8_t)_aether_safe_str(s)[i];");
+    print_line(gen, "}");
     /* Owned-print helpers: a heap-producing CALL in bare print/println
      * argument position (`println(string.concat(a, b))`) is a temporary
      * nothing else owns; these print it and free it in one composable
diff --git a/compiler/codegen/codegen_expr.c b/compiler/codegen/codegen_expr.c
index 7c39f3d9c..5e10e4678 100644
--- a/compiler/codegen/codegen_expr.c
+++ b/compiler/codegen/codegen_expr.c
@@ -11981,6 +11981,18 @@ void generate_expression(CodeGenerator* gen, ASTNode* expr) {
                 }
                 int str_base = base && base->node_type &&
                                base->node_type->kind == TYPE_STRING;
+                /* #3479: a read of a string's byte, checked and unsigned
+                 * (a store through `s[i]` is refused by the checker). */
+                if (str_base && !gen->generating_lvalue) {
+                    fprintf(gen->output, "_aether_str_at(");
+                    generate_expression(gen, base);
+                    fprintf(gen->output, ", (int64_t)(");
+                    generate_read(gen, expr->children[1]);
+                    fprintf(gen->output, "), ");
+                    emit_slice_diag_file(gen, expr);
+                    fprintf(gen->output, ", %d)", expr->line);
+                    break;
+                }
                 /* #3113: an index into a fixed-size `T[N]` is checked
                  * against N, as a slice's is against its length: a local,
                  * a field, a parameter, an actor's state or a `const`
diff --git a/docs/language-reference.md b/docs/language-reference.md
index 8cb8447ad..9241c8883 100644
--- a/docs/language-reference.md
+++ b/docs/language-reference.md
@@ -413,7 +413,7 @@ main() {
 - **`s[i]` is bounds-checked.** An index outside `0 ..< s.len` is a runtime panic naming the source line, the index and the length (`slice index 5 out of range for length 3`). It is an ordinary panic: `try` catches it, and an actor step that trips it dies cleanly. A negative index is out of range, never a read before the buffer. An index into a fixed-size `T[N]` array is checked the same way, against `N` ([Array Types](#array-types)).
 - **`s[lo..hi]`** is the half-open sub-slice `[lo, hi)`, checked the same way (`lo <= hi <= s.len`). `s[lo..]` runs to the end, `s[..hi]` from the start, `s[..]` is the whole thing. The base may be a slice or a `T[N]` array; the result is always a `T[]` over the *same* elements, so a write through it is visible through the original.
 - **A `T[N]` array converts to `T[]` implicitly** wherever a slice is expected: a parameter, a `T[]`-typed binding or field, a `return` from a `-> T[]` function. The length travels with it. `null`, and the empty literal `[]`, convert to the empty slice: `.len` is `0`, it views no storage, and it compares equal to `null`. So `s == []` is `s == null` (it asks whether `s` views any storage; test `s.len == 0` for emptiness), a C function's `T[]` parameter takes `[]` as the null pointer, and an if-expression or a `match` given to a `T[]` converts each arm on its own. A module-level `var` or `const` of type `T[]` takes either as its initial value.
-- **A string is not a slice.** Passing one where a `T[]` is expected (a parameter, a binding, a `return`) is a type error; `string.bytes(s)` is the bounded, read-only `byte[]` view of a string's bytes, and it decays to their pointer at a C extern like any slice. Reading it costs what any slice's read does; a store through it (an element store, `+=`, `++`), or through any view made from it (a sub-slice, a pattern's tail), in this function or one it is given to, panics with "a write through a read-only view of a string", and one the checker can see through a local bound to it is a compile error (E0200) (#3025). A string's own bytes are read-only too: `s[i]` reads one, and a write (`s[i] = v`, `s[i] += v`, `s[i]++`) is a compile error (E0200). Build the new text as a new string, or work on the bytes in a `byte[N]` array of your own.
+- **A string is not a slice.** Passing one where a `T[]` is expected (a parameter, a binding, a `return`) is a type error; `string.bytes(s)` is the bounded, read-only `byte[]` view of a string's bytes, and it decays to their pointer at a C extern like any slice. Reading it costs what any slice's read does; a store through it (an element store, `+=`, `++`), or through any view made from it (a sub-slice, a pattern's tail), in this function or one it is given to, panics with "a write through a read-only view of a string", and one the checker can see through a local bound to it is a compile error (E0200) (#3025). A string's own bytes are read-only too: `s[i]` reads one, a `byte` (the value `string.bytes(s)[i]` has, 0 to 255), checked against the string's length as a slice index is against its own: an index outside `0 ..< length` is the panic `string index 5 out of range for length 3`. A write (`s[i] = v`, `s[i] += v`, `s[i]++`) is a compile error (E0200). Build the new text as a new string, or work on the bytes in a `byte[N]` array of your own.
 - **A slice decays to its pointer** wherever a `ptr` is expected, exactly as a `T[N]` array does: a `ptr` parameter, a C extern's parameter (including one declared `T[]`), a comparison against `null`, and pointer arithmetic (`s + n` is a `ptr` to element `n`). `s as ptr` spells the same conversion explicitly, for a `ptr` return or binding. The length is dropped at that boundary; nothing else about the extern ABI changes.
 - **`make([]T, n)`** allocates `n` zeroed elements and returns them as a bounded slice. The local that holds it releases it when it goes out of scope ([Slice ownership](#slice-ownership)), and `free(s)` releases it early, and first what the elements hold: each element is a place a store into it takes a reference for (a string, a closure, a struct that holds one), so the free gives each back, as a struct's destroy does its fields (#3159). The elements of C memory viewed as a slice hold no reference, and its free releases only the memory. Only the slice that holds such a buffer, or a view of a raw pointer the program owns from its start (`(p as T[])[0..n]`), may be freed: a view owns nothing. `free` of a sub-slice (`b[2..4]`, `b[1..]`, a list pattern's tail), of an array viewed as a slice, of `string.bytes(s)`, or of an array `T[N]`, is a compile error where the checker sees it (a local bound once to one, or the expression itself), and a named panic at run time anywhere else (`free of a view of elements another slice or an array holds, which owns nothing`). Before, the allocator was given a pointer it never handed out. In a module that defines a `free` of its own (`bignum.free`, `json.free`), `free(s)` of a slice is still this release, unless the module's `free` itself takes a slice: the module's function would only see the slice's pointer (#3116).
 - **`T[][]` is a slice of slices**, and `T[][][]` one deeper: each further `[]` wraps the type once more, in any position a type is written (a parameter, a return type, a field, a typed local, a function type). `make([]int[], n)` builds one; `g[i] = row` stores a row, `g[i][j]` reads an element and `g[i].len` is a row's length. The outer slice owns its rows: a store into `g[i]` releases the row it replaces, and releasing the outer slice (its owner's scope exit, or `free(g)`) releases every row first; `free(g[i])` releases a row early and leaves it empty. A row read out (`r = g[i]`) is a view of it. Only the empty `[]` repeats; there is no `T[][3]`.
diff --git a/new_changelogs/20261101T130100Z-fixed-3479-string-index-byte.md b/new_changelogs/20261101T130100Z-fixed-3479-string-index-byte.md
new file mode 100644
index 000000000..1acff45fa
--- /dev/null
+++ b/new_changelogs/20261101T130100Z-fixed-3479-string-index-byte.md
@@ -0,0 +1,7 @@
+- **`s[i]` on a string is a checked `byte` (#3479).** A local bound to it
+  warned that its type was left to codegen; the read was a plain `char`, so
+  a byte past 127 (any non-ASCII UTF-8 byte) was negative on x86 and
+  positive on ARM; and an index past the end read past the string. It now
+  has the type and the value `string.bytes(s)[i]` has, 0 to 255, and an
+  index outside `0 ..< length` is the panic `string index 5 out of range for
+  length 3`, which a `try` catches, as a slice index's is.
diff --git a/runtime/aether_slice.h b/runtime/aether_slice.h
index 03bedf955..f505f2762 100644
--- a/runtime/aether_slice.h
+++ b/runtime/aether_slice.h
@@ -164,6 +164,14 @@ static inline void aether_array_fail_index(int64_t idx, uint64_t len,
                         file, line, (long long)idx, (unsigned long long)len);
 }
 
+/* #3479: `s[i]` on a string outside `0 ..< length`, the slice's panic with
+ * the string's length. */
+static inline void aether_string_fail_index(int64_t idx, uint64_t len,
+                                            const char* file, int line) {
+    aether_slice_panicf("%s:%d: string index %lld out of range for length %llu",
+                        file, line, (long long)idx, (unsigned long long)len);
+}
+
 /* #3113: `a[i]` on a `T[N]`: `i`, checked against N, for the generated C
  * to index with (`a[aether_array_index(i, N, ...)]`), so the element stays
  * an lvalue and `i` is evaluated once. A negative index is out of range.
diff --git a/tests/regression/test_string_index_byte.ae b/tests/regression/test_string_index_byte.ae
new file mode 100644
index 000000000..47d715c3c
--- /dev/null
+++ b/tests/regression/test_string_index_byte.ae
@@ -0,0 +1,55 @@
+// Regression (#3479): `s[i]` on a string is its byte i, typed `byte`,
+// read unsigned and checked against the string's length.
+//
+// The checker gave the read no type, so a local bound to it warned
+// "unresolved type in codegen, defaulting to int"; the generated C read a
+// plain `char`, which is signed on x86, so a byte past 127 (any non-ASCII
+// UTF-8 byte) read negative there and positive on ARM; and an index past
+// the end read past the string. The read now has the type
+// `string.bytes(s)[i]` has, and the value it has, and an index outside
+// `0 ..< length` panics, as a slice index does, where a `try` catches it.
+
+import std.string
+
+extern exit(code: int)
+
+check(got: int, want: int, what: string) {
+    if got != want {
+        println("FAIL: ${what}: ${got}, want ${want}")
+        exit(1)
+    }
+}
+
+first(text: string) -> int {
+    c = text[0]
+    return c
+}
+
+main() {
+    s = "é"
+    c = s[0]
+    check(c, 195, "a lead byte bound to a local")
+    check(s[1], 169, "a continuation byte")
+    check(s[0], string.bytes(s)[0], "the byte string.bytes reads")
+    check(first("A"), 65, "a parameter's byte")
+    t = "Az"
+    check(t[1] - t[0], 57, "arithmetic on two bytes")
+    caught = 0
+    i = 2
+    while i < 5 {
+        try {
+            x = t[i]
+            println("FAIL: no panic at ${i} (${x})")
+            exit(1)
+        } catch e {
+            if string.ends_with(e, "string index ${i} out of range for length 2") == 0 {
+                println("FAIL: message: ${e}")
+                exit(1)
+            }
+            caught = caught + 1
+        }
+        i = i + 1
+    }
+    check(caught, 3, "indexes past the end caught")
+    println("ok")
+}

From f52e0e756ea51341e398e4f1e06f7734a9d72f6e Mon Sep 17 00:00:00 2001
From: Nicolas Maman <nicolasmd87@gmail.com>
Date: Sun, 1 Nov 2026 13:45:23 -0300
Subject: [PATCH 05/17] fix: a refused binary import removes its stub directory
 (#3485)

The refusals (ae_lib_check_compat, ae_refuse_split_ownership) called
exit(1) from inside ae_generate_binimport_stub, with the stub's FILE still
open. C runs atexit handlers before it closes streams, so the cleanup that
removes the stub directory ran against an open file, which Windows will
not delete: every refused build left ae-binimport-<pid>-<n> behind (1,168
on one machine). The refusals now return 2; the caller closes the stub,
removes it and exits, and the atexit cleanup finds nothing open. The
ownership test runs each refused build in a temp directory of its own and
checks it is empty after (failed before, on Windows).

Also removes ae_source_module_exists, which nothing calls (#3486): clang's
-Wall -Werror refused the file for it.
---
 ...00Z-fixed-3485-refused-import-cleans-up.md |  6 ++++
 .../test_binary_import_ownership.sh           | 11 ++++++-
 tools/ae.c                                    | 30 ++++++++++---------
 3 files changed, 32 insertions(+), 15 deletions(-)
 create mode 100644 new_changelogs/20261101T140000Z-fixed-3485-refused-import-cleans-up.md

diff --git a/new_changelogs/20261101T140000Z-fixed-3485-refused-import-cleans-up.md b/new_changelogs/20261101T140000Z-fixed-3485-refused-import-cleans-up.md
new file mode 100644
index 000000000..2915fc5d0
--- /dev/null
+++ b/new_changelogs/20261101T140000Z-fixed-3485-refused-import-cleans-up.md
@@ -0,0 +1,6 @@
+- **A refused binary import leaves nothing in the temp directory (#3485).**
+  `ae` refused it from inside the stub it was writing, so on Windows the
+  open file kept its `ae-binimport-<pid>-<n>` directory from being
+  removed: one more for every refused build, over a thousand on one
+  development machine. The stub is now closed and removed before `ae`
+  exits.
diff --git a/tests/integration/binary_import_ownership/test_binary_import_ownership.sh b/tests/integration/binary_import_ownership/test_binary_import_ownership.sh
index d3253f35c..5ad24b6e8 100644
--- a/tests/integration/binary_import_ownership/test_binary_import_ownership.sh
+++ b/tests/integration/binary_import_ownership/test_binary_import_ownership.sh
@@ -62,11 +62,20 @@ build_app() {
 # refused <app> <what> <label>: importing the library is refused, naming
 # what crosses and the rebuild.
 refused() {
-    if AETHER_HOME="$ROOT" "$AE" build "$1.ae" -o "$1" >"$1.log" 2>&1; then
+    # #3485: in a temp directory of its own, so what the refusal leaves there
+    # can be seen: the stub directory the import wrote is removed.
+    tmp="$PWD/tmp_$1"
+    mkdir -p "$tmp"
+    tmp_env="$tmp"
+    command -v cygpath >/dev/null 2>&1 && tmp_env="$(cygpath -m "$tmp")"
+    if TMPDIR="$tmp_env" TEMP="$tmp_env" TMP="$tmp_env" \
+       AETHER_HOME="$ROOT" "$AE" build "$1.ae" -o "$1" >"$1.log" 2>&1; then
         fail "$3: importing it was not refused" "$1.log"
     fi
     grep -qF "$2" "$1.log" || fail "$3: the refusal does not say \"$2\"" "$1.log"
     grep -qF "ae build --emit=lib --shared-runtime" "$1.log" || fail "$3: the refusal does not name the rebuild" "$1.log"
+    left="$(ls -d "$tmp"/ae-binimport-* 2>/dev/null)"
+    [ -z "$left" ] || fail "$3: the refused import left its stub directory ($left)" "$1.log"
 }
 
 # duty <library> <names own_runtime: 1 or 0> <label>
diff --git a/tools/ae.c b/tools/ae.c
index 238951997..cc6c1ff41 100644
--- a/tools/ae.c
+++ b/tools/ae.c
@@ -5816,8 +5816,9 @@ static const char* ae_signature_string_struct(const _AeLibInfoMeta* m, int minor
  * library's strings) and a builder's config the library uses have no copy,
  * so a library that keeps its own runtime (every platform since #3481: on
  * ELF it no longer binds to the program's) has such an import refused,
- * naming the rebuild that gives both one runtime. */
-static void ae_refuse_split_ownership(const _AeLibInfoMeta* m, int minor, const char* module,
+ * naming the rebuild that gives both one runtime. 1 when it refused (the
+ * caller ends the build, after closing the stub it was writing, #3485). */
+static int ae_refuse_split_ownership(const _AeLibInfoMeta* m, int minor, const char* module,
                                       const char* so_path) {
     char ty[200];
     int refused = 0;
@@ -5858,8 +5859,8 @@ static void ae_refuse_split_ownership(const _AeLibInfoMeta* m, int minor, const
         fprintf(stderr, "       Each copy of the runtime frees only what it made. Rebuild the "
                         "library with\n       `ae build --emit=lib --shared-runtime` so it runs "
                         "on the program's runtime.\n");
-        exit(1);
     }
+    return refused;
 }
 
 /* `module` NULL: the whole catalog (a bare import of a one-module
@@ -5873,8 +5874,11 @@ static int ae_generate_binimport_stub(const char* so_path, const char* module, F
     if (!mf) { ae_lib_close(h); return -1; }
     const _AeLibInfoMeta* m = mf();
     if (!m) { ae_lib_close(h); return -1; }
-    /* #2957: refused before anything of it is used or declared. */
-    if (ae_lib_check_compat(m, so_path) != 0) exit(1);
+    /* #2957: refused before anything of it is used or declared. A refusal
+     * returns 2, and the caller ends the build once the stub it was writing
+     * is closed and removed (#3485: exiting here left the file open, so
+     * Windows could not remove its directory). */
+    if (ae_lib_check_compat(m, so_path) != 0) { ae_lib_close(h); return 2; }
 
     fprintf(out, "// Auto-generated Aether interface for %s\n", so_path);
     fprintf(out, "// Synthesized by `ae` from the artifact's aether_lib_meta\n");
@@ -5944,7 +5948,10 @@ static int ae_generate_binimport_stub(const char* so_path, const char* module, F
 
     /* #2931: a string an export returns is handed over (schema >= 1.9). */
     int shared_rt = minor >= 5 && m->runtime && strcmp(m->runtime, "shared") == 0;
-    if (!shared_rt) ae_refuse_split_ownership(m, minor, module, so_path);
+    if (!shared_rt && ae_refuse_split_ownership(m, minor, module, so_path)) {
+        ae_lib_close(h);
+        return 2;
+    }
     int strings_handed = minor >= 9 && m->string_release && m->string_release[0];
     if (strings_handed && !shared_rt) {
         fprintf(out, "@extern(\"aether_string_import\") __aes_import(s: @aether ptr) -> string @heap\n");
@@ -6141,13 +6148,6 @@ static char* ae_source_module_path(const char* mod) {
     return NULL;
 }
 
-static int ae_source_module_exists(const char* mod) {
-    char* p = ae_source_module_path(mod);
-    int found = p != NULL;
-    free(p);
-    return found;
-}
-
 // Locate a binary artifact for module `mod` (libMOD.so / MOD.so /
 // libMOD.dylib / MOD.dylib) on the search path. Both extensions are
 // tried on every POSIX platform: a shared object is identified by its
@@ -6323,7 +6323,9 @@ static int ae_emit_binimport_stub(const char* mod, const char* so_path,
     if (!sf) return 0;   /* best-effort: leave the build to fail later */
     int rc = ae_generate_binimport_stub(so_path, dotted ? mod : NULL, sf);
     fclose(sf);
-    if (rc != 0) { remove(stub_path); return 0; }
+    if (rc != 0) remove(stub_path);
+    if (rc == 2) exit(1);   /* refused, and said why; atexit removes the stub dir */
+    if (rc != 0) return 0;
 
     // Make the stub resolvable and link the artifact (absolute path +
     // rpath so the produced binary finds it at run time). The .so runs on

From b9709af88dc764d3938429093a31b93b95072d19 Mon Sep 17 00:00:00 2001
From: Nicolas Maman <nicolasmd87@gmail.com>
Date: Sun, 1 Nov 2026 13:54:16 -0300
Subject: [PATCH 06/17] bench: the Aether entries link std from libaether.a
 without its runtime

The benchmarks compile the runtime from source with -O3 -march=native
-flto and took std from the whole libaether.a. On ELF the link then
defined the runtime twice: GCC's LTO plugin does not list what top-level
asm defines, and the rendezvous records are such asm (#3445,
runtime/aether_rv_mark.h), so the link took the archive's
aether_resource_caps.o for g_accounts_mark beside the compiled one. Every
Aether entry has been 'did not build' on Linux since #3445 (the workflow
runs on benchmark changes and on Mondays; this PR's workflow bump ran it).
std now comes from a copy of libaether.a with the runtime members the
MANIFEST lists taken out, so the runtime is linked once, still with the
benchmark's own flags.
---
 benchmarks/cross-language/aether/Makefile | 41 +++++++++++++++--------
 1 file changed, 27 insertions(+), 14 deletions(-)

diff --git a/benchmarks/cross-language/aether/Makefile b/benchmarks/cross-language/aether/Makefile
index d6d130ee4..0ecf1bfce 100644
--- a/benchmarks/cross-language/aether/Makefile
+++ b/benchmarks/cross-language/aether/Makefile
@@ -16,20 +16,28 @@ AETHER_INCLUDES := $(shell $(AETHER_CLI) cflags --cflags 2>/dev/null)
 OPT = -O3 -march=native -flto -fno-plt
 CFLAGS = $(OPT) $(AETHER_INCLUDES)
 # The generated C calls std as well as the runtime (string_retain and
-# string_release for string values, aether_write_bytes for println), so the
-# link takes the rest from libaether, by the toolchain's own `ae cflags
-# --libs`, as the include set above does. The runtime compiled below defines
-# its symbols first, so only std members come from the archive.
-AETHER_LIBS := $(shell $(AETHER_CLI) cflags --libs 2>/dev/null)
-LDFLAGS = -flto -pthread -lm $(AETHER_LIBS)
+# string_release for string values, aether_write_bytes for println). std is
+# taken from libaether.a, built with the defines its sources need (PCRE2,
+# OpenSSL, zlib), with the archive's own runtime members taken out: the
+# runtime is the one compiled below, and only it. `ae cflags --libs` gives the
+# system libraries, less libaether itself.
+#
+# With the whole archive on the line the runtime was defined twice on ELF:
+# GCC's LTO plugin does not list what top-level asm defines, and the
+# rendezvous records are such asm (runtime/aether_rv_mark.h), so the link
+# took the archive's aether_resource_caps.o for its anchor, beside the
+# compiled one, and every symbol in it was then defined twice.
+STD_LIB := ../build/aether-std/libaether_std.a
+AETHER_LIBS := $(filter-out -laether,$(shell $(AETHER_CLI) cflags --libs 2>/dev/null))
+LDFLAGS = -flto -pthread -lm $(STD_LIB) $(AETHER_LIBS)
 # Runtime sources, taken from the build MANIFEST (regenerated on every
 # `make stdlib`, the same set linked into libaether.a) so this list never
 # drifts as the runtime grows. A hand-maintained subset went stale and the
 # link broke on a newly-emitted symbol (`aether_capsicum_autosandbox`), which
 # surfaced only as "Aether [SKIP] Build failed" in the suite. Compiled from
 # source (not libaether.a) so the runtime gets the same `-O3 -march=native
-# -flto` as the benchmark, for a fair comparison. Only `runtime/` entries are
-# needed — these actor microbenchmarks don't touch std.
+# -flto` as the benchmark, for a fair comparison; std comes from the archive
+# above.
 MANIFEST := ../../../build/MANIFEST
 RUNTIME_SRCS := $(addprefix ../../../,$(shell grep '^runtime/' $(MANIFEST) 2>/dev/null))
 
@@ -37,38 +45,43 @@ RUNTIME_SRCS := $(addprefix ../../../,$(shell grep '^runtime/' $(MANIFEST) 2>/de
 
 all: ping_pong counting thread_ring fork_join skynet
 
-ping_pong: ping_pong.ae
+$(STD_LIB): ../../../build/libaether.a $(MANIFEST)
+	@mkdir -p $(dir $@)
+	@cp ../../../build/libaether.a $@
+	@ar d $@ $(notdir $(RUNTIME_SRCS:.c=.o))
+
+ping_pong: ping_pong.ae $(STD_LIB)
 	@echo "Compiling Aether ping_pong..."
 	@$(AETHER_COMPILER) ping_pong.ae /tmp/ping_pong_aether.c
 	@$(CC) $(CFLAGS) /tmp/ping_pong_aether.c $(RUNTIME_SRCS) -o ping_pong $(LDFLAGS)
 	@echo "Done: ./ping_pong"
 
-counting: counting.ae
+counting: counting.ae $(STD_LIB)
 	@echo "Compiling Aether counting..."
 	@$(AETHER_COMPILER) counting.ae /tmp/counting_aether.c
 	@$(CC) $(CFLAGS) /tmp/counting_aether.c $(RUNTIME_SRCS) -o counting $(LDFLAGS)
 	@echo "Done: ./counting"
 
-thread_ring: thread_ring.ae
+thread_ring: thread_ring.ae $(STD_LIB)
 	@echo "Compiling Aether thread_ring..."
 	@$(AETHER_COMPILER) thread_ring.ae /tmp/thread_ring_aether.c
 	@$(CC) $(CFLAGS) /tmp/thread_ring_aether.c $(RUNTIME_SRCS) -o thread_ring $(LDFLAGS)
 	@echo "Done: ./thread_ring"
 
-fork_join: fork_join.ae
+fork_join: fork_join.ae $(STD_LIB)
 	@echo "Compiling Aether fork_join..."
 	@$(AETHER_COMPILER) fork_join.ae /tmp/fork_join_aether.c
 	@$(CC) $(CFLAGS) /tmp/fork_join_aether.c $(RUNTIME_SRCS) -o fork_join $(LDFLAGS)
 	@echo "Done: ./fork_join"
 
-skynet: skynet.ae
+skynet: skynet.ae $(STD_LIB)
 	@echo "Compiling Aether skynet..."
 	@$(AETHER_COMPILER) skynet.ae /tmp/skynet_aether.c
 	@$(CC) $(CFLAGS) /tmp/skynet_aether.c $(RUNTIME_SRCS) -o skynet $(LDFLAGS)
 	@echo "Done: ./skynet"
 
 clean:
-	rm -f ping_pong counting thread_ring fork_join skynet /tmp/*_aether.c*
+	rm -rf ping_pong counting thread_ring fork_join skynet /tmp/*_aether.c* $(dir $(STD_LIB))
 
 # What the runner records with the results (run_benchmarks.ae).
 flags:

From 1bfe11c6c9cf70e530cff2a38a23fa3f2bf01cb1 Mon Sep 17 00:00:00 2001
From: Nicolas Maman <nicolasmd87@gmail.com>
Date: Sun, 1 Nov 2026 13:58:37 -0300
Subject: [PATCH 07/17] test: ask relief waits for D's messages, not a 400 ms
 pause (#3483)

'The waiting core's other actors run' had B pause 400 ms and counted
what D, on A's waiting core, handled meanwhile: on a slow runner (macOS
ASan, Valgrind) the pause ended with 11 of the 20 handled. B now holds
its reply until D has handled its 20 (bounded by 3 s, as the overflow
cases in the file hold theirs), and D's messages go out once B has A's
ask, so A is waiting. A relief that does not run D still fails it: B
answers after 3 s with D's count short. The checks read the counts
first and free the actors before asserting, so a failure leaks nothing
(Valgrind reported them definitely lost). 47-62 ms here instead of 416.
---
 tests/runtime/test_ask_relief.c | 37 ++++++++++++++++++++++++++-------
 1 file changed, 29 insertions(+), 8 deletions(-)

diff --git a/tests/runtime/test_ask_relief.c b/tests/runtime/test_ask_relief.c
index fac81fad0..b2b0f708e 100644
--- a/tests/runtime/test_ask_relief.c
+++ b/tests/runtime/test_ask_relief.c
@@ -46,6 +46,8 @@ typedef struct {
     ActorBase* ask;        // asked on every message when set
     ActorBase* watch;      // its count is read when the ask returns
     int pause_ms;          // slept before replying
+    ActorBase* hold_for;   // the reply waits until this has handled hold_want
+    int hold_want;
     atomic_int got;        // messages handled
     atomic_int result;     // what the ask returned
     atomic_int watched;    // `watch`'s count when it did
@@ -76,6 +78,14 @@ static void relief_step(ReliefActor* self) {
         atomic_store(&self->done, 1);
     }
     if (self->pause_ms) relief_sleep_ms(self->pause_ms);
+    /* #3483: the reply waits for an event, not a pause a slow runner
+     * outlasts: until `hold_for` has handled `hold_want`, or 3 s. */
+    if (self->hold_for) {
+        uint64_t until = aether_now_ns() + 3000ULL * 1000000ULL;
+        while (atomic_load(&((ReliefActor*)self->hold_for)->got) < self->hold_want &&
+               aether_now_ns() < until)
+            relief_sleep_ms(1);
+    }
     scheduler_reply((ActorBase*)self, &value, sizeof value);   // no asker: nothing
     atomic_store_explicit(&self->active, self->mailbox.count > 0, memory_order_relaxed);
 }
@@ -130,32 +140,43 @@ static void test_ask_relief_chain_back_to_waiting_core(void) {
 }
 
 /* An actor of a core waiting in an ask runs meanwhile: D, on A's core, is
- * sent 20 messages (they fit its mailbox, #3241) while A waits 400 ms for
- * B. They waited for A's reply. */
+ * sent 20 messages (they fit its mailbox, #3241) once A waits for B, and B
+ * holds its reply until D has handled them (or 3 s pass). They waited for
+ * A's reply. #3483: B paused 400 ms instead, and on a slow runner (macOS
+ * ASan, Valgrind) the pause ended with 11 of the 20 handled. */
 static void test_ask_relief_other_actor_runs(void) {
     scheduler_init(3);
     ReliefActor* b = relief_actor(1);
     ReliefActor* d = relief_actor(0);
     ReliefActor* a = relief_actor(0);
-    b->pause_ms = 400;
+    b->hold_for = (ActorBase*)d;
+    b->hold_want = 20;
     a->ask = (ActorBase*)b;
     a->watch = (ActorBase*)d;
     scheduler_start();
 
     relief_send(a);
-    relief_sleep_ms(50);
+    /* B has A's ask, so A is waiting for it. */
+    uint64_t until = aether_now_ns() + 3000ULL * 1000000ULL;
+    while (atomic_load(&b->got) < 1 && aether_now_ns() < until) relief_sleep_ms(1);
+    int asked = atomic_load(&b->got) >= 1;
     for (int i = 0; i < 20; i++) relief_send(d);
     int done = relief_wait_done(a, 6000);
     scheduler_shutdown();
     scheduler_cleanup();
 
-    ASSERT_TRUE(done);
-    ASSERT_EQ(43, atomic_load(&a->result));
-    ASSERT_EQ(20, atomic_load(&a->watched));
-    ASSERT_EQ(20, atomic_load(&d->got));
+    /* Read before the actors are freed, so a failed check leaks nothing. */
+    int result = atomic_load(&a->result);
+    int watched = atomic_load(&a->watched);
+    int got = atomic_load(&d->got);
     free(a);
     free(b);
     free(d);
+    ASSERT_TRUE(asked);
+    ASSERT_TRUE(done);
+    ASSERT_EQ(43, result);
+    ASSERT_EQ(20, watched);
+    ASSERT_EQ(20, got);
 }
 
 /* An ask to an actor of the same core whose message is still in the batch

From 63124aefb891a83277971084fe3174d9d6cd3692 Mon Sep 17 00:00:00 2001
From: Nicolas Maman <nicolasmd87@gmail.com>
Date: Sun, 1 Nov 2026 13:58:37 -0300
Subject: [PATCH 08/17] test: an account's free is timed by the thread's CPU
 clock (#3488)

accounts_free_is_linear_in_its_blocks compared wall-clock frees of
10,000 and 40,000 blocks, and on a loaded macOS ASan runner one 40,000
free took 22 times one of 10,000 (5.13 against 0.23 ms): the clock
counted time the thread was not running. The free's cost is CPU work, so
on POSIX it is now timed by CLOCK_THREAD_CPUTIME_ID, the best of five
runs instead of three. Windows keeps the performance counter (its thread
times tick at 15.6 ms). Here: 0.12 against 0.48 ms, three runs alike.
---
 tests/runtime/test_exec_accounts.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/tests/runtime/test_exec_accounts.c b/tests/runtime/test_exec_accounts.c
index d234e0b27..95e8e0790 100644
--- a/tests/runtime/test_exec_accounts.c
+++ b/tests/runtime/test_exec_accounts.c
@@ -23,7 +23,13 @@
 #ifdef _WIN32
 #include <windows.h>
 #define ea_sleep_ms(ms) Sleep(ms)
-static double ea_now_ms(void) {
+/* #3488: a free's cost is CPU work, so it is timed by the thread's own CPU
+ * clock where there is one fine enough: a wall clock counts the time the
+ * thread was not running, and on a loaded runner (macOS ASan) one 40,000-
+ * block free took 22 times one of 10,000. Windows' thread times tick at
+ * 15.6 ms, too coarse for a free of a few milliseconds: there it is the
+ * performance counter, as before. */
+static double ea_cpu_ms(void) {
     LARGE_INTEGER f, c;
     QueryPerformanceFrequency(&f);
     QueryPerformanceCounter(&c);
@@ -33,9 +39,9 @@ static double ea_now_ms(void) {
 #include <unistd.h>
 #include <time.h>
 #define ea_sleep_ms(ms) usleep((ms) * 1000)
-static double ea_now_ms(void) {
+static double ea_cpu_ms(void) {
     struct timespec t;
-    clock_gettime(CLOCK_MONOTONIC, &t);
+    clock_gettime(CLOCK_THREAD_CPUTIME_ID, &t);
     return (double)t.tv_sec * 1000.0 + (double)t.tv_nsec / 1e6;
 }
 #endif
@@ -235,20 +241,20 @@ TEST_CATEGORY(accounts_active_time_many_nested, TEST_CATEGORY_RUNTIME) {
     ASSERT_EQ(EA_DEEP, charged);
 }
 /* #3410: freeing an account of 4n blocks takes about four times as long as
- * one of n, not sixteen. The best of three runs of each, with another
+ * one of n, not sixteen. The best of five runs of each, with another
  * account live, so the table outlives the free. */
 static double ea_free_ms(int n) {
     double best = 1e18;
     AetherExecAccount* keep = ea_new(0, 0, AETHER_DEADLINE_ELAPSED, NULL);
     void** blocks = (void**)malloc(sizeof(void*) * (size_t)n);
-    for (int run = 0; run < 3; run++) {
+    for (int run = 0; run < 5; run++) {
         AetherExecAccount* a = ea_new(0, 0, AETHER_DEADLINE_ELAPSED, NULL);
         aether_exec_use(a, NULL);
         for (int i = 0; i < n; i++) blocks[i] = aether_caps_malloc(32);
         aether_exec_use(NULL, NULL);
-        double t0 = ea_now_ms();
+        double t0 = ea_cpu_ms();
         aether_exec_account_free(a);
-        double t = ea_now_ms() - t0;
+        double t = ea_cpu_ms() - t0;
         if (t < best) best = t;
         for (int i = 0; i < n; i++) aether_caps_free(blocks[i], 32);
     }

From 6917acf8993edc8a4fe4797979f755a39e49c144 Mon Sep 17 00:00:00 2001
From: Nicolas Maman <nicolasmd87@gmail.com>
Date: Sun, 1 Nov 2026 13:59:56 -0300
Subject: [PATCH 09/17] docs: three reference statements say what the runtime
 does (#3480)

- language reference, Reply Statement: a handler that returns without a
  reply ends the ask at once (AETHER_ASK_NO_REPLY, "the handler returned
  without replying"); the timeout is for one that has not returned.
- stdlib reference, std.cryptography: constant-time comparison points to
  ct.bytes_eq and ct.bytes_eq_slice, which exist.
- emit-lib.md and libaether.h: the call deadline is one instant per
  thread, now + ms when set, cutting every later call until a fresh one
  or 0, not a per-call budget; and the memory cap is process-wide, not
  one of two TLS knobs.
---
 docs/emit-lib.md                                     | 12 +++++++++---
 docs/language-reference.md                           |  8 +++++---
 docs/stdlib-reference.md                             |  2 +-
 include/libaether.h                                  |  8 +++++---
 ...261101T150000Z-fixed-3480-reference-statements.md |  9 +++++++++
 5 files changed, 29 insertions(+), 10 deletions(-)
 create mode 100644 new_changelogs/20261101T150000Z-fixed-3480-reference-statements.md

diff --git a/docs/emit-lib.md b/docs/emit-lib.md
index 17be4eeb4..5234edc92 100644
--- a/docs/emit-lib.md
+++ b/docs/emit-lib.md
@@ -596,13 +596,14 @@ worked Python round-trip, that helper included.
 ## Per-call resource caps
 
 Hosts loading untrusted Aether scripts bound the script's
-resource use via two TLS-backed knobs in `include/libaether.h`:
+resource use via two knobs in `include/libaether.h`, a process-wide memory
+cap and a per-thread deadline:
 
 ```c
 #include <libaether.h>
 
 aether_set_memory_cap(64 * 1024 * 1024);   // 64 MiB ceiling
-aether_set_call_deadline(50);              // 50 ms wall-clock
+aether_set_call_deadline(50);              // this thread's deadline: 50 ms from now
 
 call_into_aether();                        // returns inside both bounds
 
@@ -645,7 +646,12 @@ process, inside an export or not: a message the scheduler has no memory to
 queue behind an actor's earlier messages, since it has no place that keeps
 their order.
 
-**Wall-clock deadline.** Per-thread monotonic (`CLOCK_MONOTONIC`).
+**Wall-clock deadline.** One instant per thread, on the monotonic clock
+(`CLOCK_MONOTONIC`): `aether_set_call_deadline(ms)` sets it to `ms` from the
+moment it is called. It is not a budget each call gets: every call the thread
+makes after that instant is cut at its first safe point, until the host sets
+a fresh deadline or `0`. A host that wants each call bounded sets the
+deadline before each one.
 The codegen emits a safe point, `if (aether_caps_armed && aether_exec_poll())
 { __aether_abort_call(); break; }`, at every `for` / `while` loop head
 under `--emit=lib` not under `--emit=exe` (zero overhead on
diff --git a/docs/language-reference.md b/docs/language-reference.md
index 9241c8883..8bb5674ab 100644
--- a/docs/language-reference.md
+++ b/docs/language-reference.md
@@ -3722,9 +3722,11 @@ each sender's messages still arrive in the order they were sent (#3241).
 
 ### Reply Statement
 
-The `reply` statement sends a response back to the waiting `?` caller. Omitting
-`reply` in a handler that was invoked via `?` causes the caller to time out
-(`err` is `"ask timed out after 5000 ms"` in the two-name form above).
+The `reply` statement sends a response back to the waiting `?` caller. A
+handler invoked via `?` that returns without a `reply` ends the ask at once:
+`err` is `"the handler returned without replying"` in the two-name form
+above, and the caller does not wait out its timeout. The timeout
+(`"ask timed out after 5000 ms"`) is for a handler that has not returned.
 
 Actors respond using the `reply` statement:
 
diff --git a/docs/stdlib-reference.md b/docs/stdlib-reference.md
index b0bc55562..754112e5f 100644
--- a/docs/stdlib-reference.md
+++ b/docs/stdlib-reference.md
@@ -1971,7 +1971,7 @@ Coming from Java's `java.security`, Python's `cryptography`, or Go's `crypto/*`,
 
 - **Public-key crypto (RSA, ECDSA, Ed25519, X25519), symmetric ciphers (AES, ChaCha20-Poly1305), and key derivation (KDFs).** These live under [`std.cryptography`](../std/cryptography/) (`rsa`, `aes`, `chacha20poly1305`, `ed25519`, `x25519`, `p256`, `secp256k1`, `pem`, `asn1`, ...), pure-Aether ports with no OpenSSL dependency. Each family is a separate sub-module you import explicitly.
 - **URL-safe Base64 (RFC 4648 §5).** Standard alphabet only; URL-safe (`-` / `_` instead of `+` / `/`) is a separate variant the wrappers don't expose.
-- **Constant-time comparison.** Equality checks via `string.equals` are not constant-time; callers comparing hashes for security-sensitive cases need their own constant-time helper.
+- **Constant-time comparison.** Equality checks via `string.equals` are not constant-time. Compare a MAC tag, a hash or any other secret-derived bytes with `std.cryptography.ct`: `ct.bytes_eq(a, b, n)` for two buffers, or `ct.bytes_eq_slice(a, b)` for two `byte[]` (1 when equal; slices of different lengths are unequal), which take the same time wherever the bytes differ (`examples/03-std/11-cryptography.ae` checks an HMAC tag this way).
 
 Raw externs: `cryptography_sha1_hex_raw`, `cryptography_sha256_hex_raw` return a fresh counted string the caller owns, or NULL on failure. The Go-style wrappers translate the NULL into `("", "openssl unavailable")`.
 
diff --git a/include/libaether.h b/include/libaether.h
index 8dfca5171..40f122e86 100644
--- a/include/libaether.h
+++ b/include/libaether.h
@@ -63,9 +63,11 @@ extern "C" {
  * Thread-safe: relaxed atomic store. */
 AETHER_API void aether_set_memory_cap(uint64_t bytes);
 
-/* Per-thread wall-clock deadline. After this call, every safe point
- * (every loop head in `--emit=lib` builds, and every 4096 values a
- * JSON parse reads) checks `now >= deadline_at`. Inside an export the
+/* Per-thread wall-clock deadline: one instant, `deadline_at = now + ms`
+ * when this is called, not a budget each call gets. After this call,
+ * every safe point (every loop head in `--emit=lib` builds, and every
+ * 4096 values a JSON parse reads) of every call on this thread checks
+ * `now >= deadline_at`, until a fresh deadline or 0. Inside an export the
  * first one past the deadline ends the call (#2956): the export returns
  * its zero value with the outcome AETHER_DEADLINE, its defers and owned
  * locals released on the way, and a `try` in the script does not catch
diff --git a/new_changelogs/20261101T150000Z-fixed-3480-reference-statements.md b/new_changelogs/20261101T150000Z-fixed-3480-reference-statements.md
new file mode 100644
index 000000000..c954bf011
--- /dev/null
+++ b/new_changelogs/20261101T150000Z-fixed-3480-reference-statements.md
@@ -0,0 +1,9 @@
+- **Three reference statements now say what the runtime does (#3480).** A
+  handler that takes an ask and returns without a `reply` ends the ask at
+  once with "the handler returned without replying"; the language
+  reference said the caller timed out. std.cryptography's note on
+  constant-time comparison now points to `ct.bytes_eq` and
+  `ct.bytes_eq_slice` instead of telling callers to write their own. And
+  `aether_set_call_deadline(ms)` sets one instant per thread, `ms` from
+  when it is called, which every later call is cut at until a fresh
+  deadline, not a budget per call (emit-lib.md and libaether.h).

From cc788e5113d839166460710b3c4f4e3d5a6c97fe Mon Sep 17 00:00:00 2001
From: Nicolas Maman <nicolasmd87@gmail.com>
Date: Sun, 1 Nov 2026 14:05:46 -0300
Subject: [PATCH 10/17] fix: script_gateway refuses a script on its own runtime
 on POSIX too (#3501)

Since #3481 a script built the default way keeps its own runtime on every
platform; Windows refused that at mount, POSIX mounted it unchecked: two
runtimes, each with its own caps, config and panic frames, while the
script filled objects the host's runtime frees. The owner chose the
Windows rule for POSIX.

sg_script_runtime_check now runs everywhere. On POSIX it reads which
image gives the script's handle aether_runtime_abi (dlsym, dladdr)
against the image holding the host's own:
- none (runtime calls left unresolved, bound to the host at dlopen) or
  the host's: one runtime, mounted;
- the script's own image: refused, KIND_IO, naming --shared-runtime;
- the shared runtime while the host is static: mounted on ELF, where the
  global scope binds the script to the -rdynamic program's runtime, and
  refused on macOS, where each import binds to its library.

The gateway test gains the POSIX cases (an own-runtime script refused; a
--shared-runtime script on the static host mounts on ELF and is refused
on macOS). The module docs, the header and the stdlib reference build
scripts with --shared-runtime.
---
 docs/stdlib-reference.md                      | 18 +++--
 ...Z-fixed-3501-script-gateway-one-runtime.md | 10 +++
 .../script_gateway/aether_script_gateway.c    | 65 +++++++++++++++--
 .../script_gateway/aether_script_gateway.h    | 19 ++---
 std/http/script_gateway/module.ae             | 39 +++++-----
 .../test_http_script_gateway.sh               | 72 ++++++++++++++++++-
 6 files changed, 188 insertions(+), 35 deletions(-)
 create mode 100644 new_changelogs/20261101T160000Z-fixed-3501-script-gateway-one-runtime.md

diff --git a/docs/stdlib-reference.md b/docs/stdlib-reference.md
index 754112e5f..cddf16b9f 100644
--- a/docs/stdlib-reference.md
+++ b/docs/stdlib-reference.md
@@ -1356,7 +1356,7 @@ if kind == fs.KIND_OK {
 
 ## In-process script gateway (`std.http.script_gateway`)
 
-CGI-style ergonomics, one `.ae` script file per route, without paying the per-request fork/exec cost. The script is pre-compiled with `aetherc --emit=lib --with=net script.ae -o script.so` to a shared library; the host server `dlopen()`s it once at mount time and dispatches matched requests via a direct indirect call. Empirically ~50× faster than the equivalent subprocess-spawn dispatch.
+CGI-style ergonomics, one `.ae` script file per route, without paying the per-request fork/exec cost. The script is pre-compiled with `ae build --emit=lib --shared-runtime --with=net script.ae -o script.so` to a shared library; the host server `dlopen()`s it once at mount time and dispatches matched requests via a direct indirect call. Empirically ~50× faster than the equivalent subprocess-spawn dispatch.
 
 ### Script shape
 
@@ -1373,10 +1373,10 @@ import std.http
 }
 ```
 
-Build it as a shared library, `--with=net` is required because `std.http` is the `net` capability and `--emit=lib` is capability-empty by default:
+Build it as a shared library on the shared runtime (below). `--with=net` is required because `std.http` is the `net` capability and `--emit=lib` is capability-empty by default:
 
 ```sh
-aetherc --emit=lib --with=net greeting.ae -o /var/aether/scripts/greeting.so
+ae build --emit=lib --shared-runtime --with=net greeting.ae -o /var/aether/scripts/greeting.so
 ```
 
 ### Mount in the host
@@ -1398,14 +1398,20 @@ main() {
 
 Now `GET /greet/anything` runs `aether_script_handle` from `greeting.so` directly on the connection thread.
 
-On Linux, FreeBSD and macOS a script built the default way carries a runtime of its own and runs on it (#3481); built with `--shared-runtime`, it shares the host's. On Windows the script is a DLL loaded with `LoadLibrary`, which cannot bind to the host executable's runtime, so the host and each script are built on the shared runtime (`aether.dll`) and run on it together:
+The script and the host run on one runtime: the script fills request and response objects the host's runtime frees. A script built the default way (`ae build --emit=lib`) carries a runtime of its own and keeps it (#3481), so it is refused at mount on every platform with `KIND_IO` and a message naming `--shared-runtime` (#3501). Build scripts on the shared runtime:
+
+```sh
+ae build --emit=lib --shared-runtime --with=net greeting.ae -o greeting.so
+```
+
+On Linux and FreeBSD such a script runs on the host's runtime whatever the host was built with: an `ae build` program is linked `-rdynamic`, and the script's calls bind to its runtime. On macOS a script binds to the shared runtime it links, so the host is built with `ae build --shared-runtime` too. On Windows the script is a DLL loaded with `LoadLibrary`, which cannot bind to the host executable's runtime, so the host and each script are built on the shared runtime (`aether.dll`) and run on it together:
 
 ```sh
 ae build --emit=lib --shared-runtime --with=net greeting.ae -o greeting.dll
 ae build --shared-runtime host.ae -o host
 ```
 
-A host or script on its own static runtime is refused at mount with `KIND_IO` and a message naming `--shared-runtime`.
+A host or script that would run on a runtime of its own is refused at mount with `KIND_IO` and a message naming `--shared-runtime`.
 
 ### API
 
@@ -1418,7 +1424,7 @@ A host or script on its own static runtime is refused at mount with `KIND_IO` an
 | `KIND_OK` | 0 | mount succeeded |
 | `KIND_NOT_FOUND` | 1 | `so_path` is missing or unreadable |
 | `KIND_INVALID` | 6 | null arg, or `.so` missing the `aether_script_handle` entrypoint |
-| `KIND_IO` | 5 | `dlopen` / `LoadLibrary` failure (incompatible ABI, etc.); on Windows also a host or script not built with `--shared-runtime` |
+| `KIND_IO` | 5 | `dlopen` / `LoadLibrary` failure (incompatible ABI, etc.); also a script that carries a runtime of its own, and on macOS and Windows a host not on the shared runtime (the message names `--shared-runtime`) |
 | `KIND_UNAVAILABLE` | 99 | a platform with no dynamic loader; no supported platform returns it |
 
 ### Sandbox
diff --git a/new_changelogs/20261101T160000Z-fixed-3501-script-gateway-one-runtime.md b/new_changelogs/20261101T160000Z-fixed-3501-script-gateway-one-runtime.md
new file mode 100644
index 000000000..c4ca26122
--- /dev/null
+++ b/new_changelogs/20261101T160000Z-fixed-3501-script-gateway-one-runtime.md
@@ -0,0 +1,10 @@
+- **`script_gateway.mount` refuses a script that carries a runtime of its
+  own on Linux, FreeBSD and macOS too (#3501).** Since #3481 a script built
+  the default way (`ae build --emit=lib`) keeps its own runtime on every
+  platform, and on POSIX it was mounted unchecked: two runtimes, each with
+  its own caps, config and panic frames, while the script filled objects
+  the host's runtime frees. It is now refused at mount with `KIND_IO` and a
+  message naming `--shared-runtime`, as Windows refuses it. A
+  `--shared-runtime` script mounts on Linux and FreeBSD whatever the host
+  was built with; on macOS the host is built with `--shared-runtime` too.
+  The module's documentation now builds scripts with `--shared-runtime`.
diff --git a/std/http/script_gateway/aether_script_gateway.c b/std/http/script_gateway/aether_script_gateway.c
index d39210765..e6b991be3 100644
--- a/std/http/script_gateway/aether_script_gateway.c
+++ b/std/http/script_gateway/aether_script_gateway.c
@@ -4,8 +4,8 @@
  *   1. Load the library through std.dl: dlopen(RTLD_NOW | RTLD_LOCAL) on
  *      POSIX, LoadLibrary on Windows.
  *   2. Look up "aether_script_handle" in it.
- *   3. On Windows, check that the host and the script run on one runtime
- *      (see sg_host_runtime_check and sg_script_runtime_check).
+ *   3. Check that the host and the script run on one runtime
+ *      (sg_script_runtime_check; on Windows sg_host_runtime_check too).
  *   4. Allocate a ScriptMount struct holding (path_prefix, fn).
  *   5. Register a middleware on the host server that fires the fn
  *      when req->path starts with path_prefix.
@@ -14,10 +14,15 @@
  * fork, no exec, no IPC.
  */
 
+#if !defined(_WIN32) && !defined(_GNU_SOURCE)
+#define _GNU_SOURCE    /* glibc declares dladdr under it (#3501) */
+#endif
+
 #include "aether_script_gateway.h"
 #include "../../net/aether_http_server.h"
 #include "../../dl/aether_dl.h"
 #include "../../../runtime/aether_sandbox.h"
+#include "../../../runtime/aether_abi.h"              /* aether_runtime_abi, #3501 */
 #include "../../../runtime/utils/aether_compiler.h"  /* AETHER_TLS */
 
 #include <stdlib.h>
@@ -29,6 +34,7 @@
 #include <io.h>        /* _access */
 #else
 #include <unistd.h>    /* access */
+#include <dlfcn.h>     /* dladdr, #3501 */
 #endif
 
 /* (handle, kind, message) tuple: same ABI as fs.copy's tuple but
@@ -157,6 +163,59 @@ static const char* sg_script_runtime_check(void* script, const char* so_path) {
              so_path, rt_name);
     return g_sg_err;
 }
+#else  /* POSIX */
+/* #3501: on POSIX a host shares its runtime with a script when the script
+ * carries none (its runtime calls left unresolved, bound to the host's at
+ * dlopen: an `ae build` program is linked -rdynamic) or links the shared
+ * runtime the host runs on. One built the default way carries a runtime of
+ * its own and keeps it (on ELF `ae` links it -Bsymbolic, #3481): two runtimes,
+ * each with its own caps, config and panic frames, while the script fills
+ * objects the host's runtime frees. It is refused at mount, as on Windows.
+ *
+ * What runtime the script gets is read from where its loader finds one: the
+ * image that defines the runtime's `aether_runtime_abi` for the script's
+ * handle, against the image that holds this runtime's (the host's). */
+
+/* The reason a script was refused, per thread like std.dl's last error. */
+static AETHER_TLS char g_sg_err[512];
+
+static const void* sg_image_of(const void* addr) {
+    Dl_info info;
+    if (!addr || !dladdr(addr, &info)) return NULL;
+    return info.dli_fbase;
+}
+
+static const char* sg_script_runtime_check(void* script, const char* so_path) {
+    const void* host_rt = sg_image_of((const void*)&aether_runtime_abi);
+    void* abi = aether_dl_symbol_raw(script, "aether_runtime_abi");
+    /* No runtime in the script or what it links: its calls bind to the host's. */
+    if (!abi || !host_rt) return NULL;
+    const void* script_rt = sg_image_of(abi);
+    if (!script_rt || script_rt == host_rt) return NULL;
+    const void* script_img = sg_image_of(aether_dl_symbol_raw(script, "aether_script_handle"));
+    if (script_rt == script_img) {
+        snprintf(g_sg_err, sizeof(g_sg_err),
+                 "script_gateway: %s carries a runtime of its own, not the host's; "
+                 "build it with `ae build --emit=lib --shared-runtime`",
+                 so_path);
+        return g_sg_err;
+    }
+#if defined(__APPLE__)
+    /* The shared runtime, while the host runs on its own: a Mach-O image binds
+     * each import to the library that provides it, so the script runs on the
+     * shared runtime and the host on another. */
+    snprintf(g_sg_err, sizeof(g_sg_err),
+             "script_gateway: %s runs on the shared runtime and the host on its own; "
+             "build the host with `ae build --shared-runtime` too",
+             so_path);
+    return g_sg_err;
+#else
+    /* The shared runtime, while the host's is the program's own: on ELF the
+     * script's calls bind to the first definition in the global scope, the
+     * program's (linked -rdynamic), so both run on the host's. */
+    return NULL;
+#endif
+}
 #endif  /* _WIN32 */
 
 _aether_sg_tuple script_gateway_mount_so_raw(void* server,
@@ -228,7 +287,6 @@ _aether_sg_tuple script_gateway_mount_so_raw(void* server,
         return out;
     }
 
-#ifdef _WIN32
     const char* script_err = sg_script_runtime_check(h, so_path);
     if (script_err) {
         /* Its runtime is not the host's, so nothing of it may run here. */
@@ -236,7 +294,6 @@ _aether_sg_tuple script_gateway_mount_so_raw(void* server,
         _aether_sg_tuple out = { 0, AETHER_SCRIPT_GATEWAY_KIND_IO, script_err };
         return out;
     }
-#endif
 
     ScriptMount* m = (ScriptMount*)calloc(1, sizeof(ScriptMount));
     if (!m) {
diff --git a/std/http/script_gateway/aether_script_gateway.h b/std/http/script_gateway/aether_script_gateway.h
index 1c6a679db..8423bed1d 100644
--- a/std/http/script_gateway/aether_script_gateway.h
+++ b/std/http/script_gateway/aether_script_gateway.h
@@ -15,14 +15,17 @@
  * with RTLD_LOCAL so symbols don't pollute the host process's
  * global namespace.
  *
- * On POSIX a script built the default way carries a runtime of its own and
- * runs on it (on Linux and FreeBSD too since #3481, where `ae` links it
- * -Bsymbolic); one built with --shared-runtime shares the host's. On
- * Windows the library is a DLL loaded with LoadLibrary, and the host and
- * the script must both be built with `ae build --shared-runtime`: a DLL
- * cannot bind to the host executable's runtime, so they share aether.dll
- * instead. A mismatch is refused at mount with KIND_IO
- * (sg_host_runtime_check and sg_script_runtime_check in the .c).
+ * A script built the default way carries a runtime of its own and keeps it
+ * (on Linux and FreeBSD too since #3481, where `ae` links it -Bsymbolic): it
+ * is refused at mount with KIND_IO on every platform (#3501), and a script
+ * is built with `ae build --emit=lib --shared-runtime`. On Linux and FreeBSD
+ * such a script runs on the host's runtime whatever the host was built with
+ * (the program is linked -rdynamic); on macOS the host is built with
+ * --shared-runtime too. On Windows the library is a DLL loaded with
+ * LoadLibrary, and the host and the script must both be built with
+ * `ae build --shared-runtime`: a DLL cannot bind to the host executable's
+ * runtime, so they share aether.dll instead. A mismatch is refused at mount
+ * with KIND_IO (sg_host_runtime_check and sg_script_runtime_check in the .c).
  *
  * Lifetime: dlopen handles are intentionally not dlclose()d. The
  * gateway is a long-lived hosting feature; the .so stays mapped
diff --git a/std/http/script_gateway/module.ae b/std/http/script_gateway/module.ae
index 191d136cd..a13706e7b 100644
--- a/std/http/script_gateway/module.ae
+++ b/std/http/script_gateway/module.ae
@@ -25,10 +25,11 @@
 // }
 // ```
 //
-// Build it as a shared library:
+// Build it as a shared library on the shared runtime, so it runs on the
+// host's (see "One runtime" below):
 //
 // ```sh
-// ae build --emit=lib greeting.ae -o /var/aether/scripts/greeting.so
+// ae build --emit=lib --shared-runtime --with=net greeting.ae -o /var/aether/scripts/greeting.so
 // ```
 //
 // And mount in the host:
@@ -51,24 +52,29 @@
 // Now `GET /greet/anything` runs `aether_script_handle` from
 // greeting.so directly on the connection thread.
 //
-// ### Windows
+// ### One runtime
 //
-// The library is a DLL, loaded with LoadLibrary. On Linux, FreeBSD and
-// macOS a script built the default way carries a runtime of its own and runs
-// on it (#3481); one built with --shared-runtime shares the host's. Windows
-// has no way for a DLL to bind to the host executable, so there the host and
-// every script are built on the shared runtime (aether.dll) and run on it
-// together:
+// A script fills request and response objects the host's runtime frees, so
+// the two run on one runtime. A script built the default way
+// (`ae build --emit=lib`) carries a runtime of its own and keeps it (#3481):
+// it is refused at mount, on every platform, with KIND_IO and a message
+// naming `--shared-runtime`, rather than run on two runtimes that each keep
+// their own caps, config and panic frames (#3501).
+//
+// On Linux and FreeBSD a `--shared-runtime` script runs on the host's
+// runtime whatever the host was built with: an `ae build` program is linked
+// -rdynamic, and the script's calls bind to its runtime. On macOS a script
+// binds to the shared runtime it links, so the host is built with
+// `ae build --shared-runtime` too (a static host is refused, naming that).
+// On Windows the library is a DLL, loaded with LoadLibrary, which cannot
+// bind to the host executable: there too the host and every script are
+// built on the shared runtime (aether.dll) and run on it together:
 //
 // ```sh
 // ae build --emit=lib --shared-runtime --with=net greeting.ae -o greeting.dll
 // ae build --shared-runtime host.ae -o host
 // ```
 //
-// A host or a script on its own static runtime is refused at mount with
-// KIND_IO and a message naming `--shared-runtime`, rather than run on two
-// runtimes that each keep their own caps, config and panic frames.
-//
 // ### Lifetime
 //
 // The dlopen handle is intentionally long-lived (process-lifetime).
@@ -111,9 +117,10 @@ extern script_gateway_mount_so_raw(server: ptr, path_prefix: string, so_path: st
 //
 //   KIND_NOT_FOUND:    `so_path` is missing or unreadable
 //   KIND_INVALID:      null arg, or .so missing the entrypoint
-//   KIND_IO:           dlopen failure (incompatible ABI, etc.), or on
-//                      Windows a host or script not built with
-//                      --shared-runtime
+//   KIND_IO:           dlopen failure (incompatible ABI, etc.), or a
+//                      script that carries a runtime of its own (and on
+//                      macOS and Windows a host not on the shared runtime):
+//                      the message names --shared-runtime
 mount(server: ptr, path_prefix: string, so_path: string) -> {
     return script_gateway_mount_so_raw(server, path_prefix, so_path)
 }
diff --git a/tests/integration/http_script_gateway/test_http_script_gateway.sh b/tests/integration/http_script_gateway/test_http_script_gateway.sh
index 41561ce37..fd723105f 100755
--- a/tests/integration/http_script_gateway/test_http_script_gateway.sh
+++ b/tests/integration/http_script_gateway/test_http_script_gateway.sh
@@ -23,6 +23,13 @@
 #   5. a script built on its own static runtime
 #   6. a host built on its own static runtime
 #
+# On POSIX (#3501) the same refusal holds for a script that carries a runtime
+# of its own (`ae build --emit=lib`, the default):
+#   5. it is refused with KIND_IO naming --shared-runtime;
+#   6. a --shared-runtime script on the static host mounts on ELF, where its
+#      calls bind to the host's runtime, and is refused on macOS, where it
+#      would run on the shared runtime beside the host's.
+#
 # DESIGN — same defensive shape the proxy_pool tests landed in:
 #   - No `set -e` (transient curl flakes shouldn't kill the script
 #     silently; explicit `fail` calls do the right thing).
@@ -265,5 +272,68 @@ if [ "$WINDOWS" = "1" ]; then
     fi
     echo "  [PASS] http_script_gateway: 6/6 (happy path, static fallback, missing .dll, no entrypoint, static script, static host)"
 else
-    echo "  [PASS] http_script_gateway: 4/4 (happy path, static fallback, missing .so, no entrypoint)"
+    # --- Test 5 (#3501): a script built the default way carries a runtime of
+    # its own and keeps it (-Bsymbolic on ELF, #3481): refused at mount with
+    # KIND_IO naming --shared-runtime, as on Windows ---
+    OWN_SO="$TMPDIR/own_runtime$SO_EXT"
+    if ! AETHER_HOME="$ROOT" "$AE" build --emit=lib --with=net \
+            "$SCRIPT_DIR/script.ae" -o "$OWN_SO" >"$TMPDIR/own_script.build.log" 2>&1; then
+        echo "  [FAIL] ae build --emit=lib script.ae (its own runtime):"
+        head -30 "$TMPDIR/own_script.build.log"
+        exit 1
+    fi
+    "$TMPDIR/host" "$BAD_PORT" "$OWN_SO" >"$TMPDIR/host_own.log" 2>&1
+    RC=$?
+    [ "$RC" != "0" ] || fail "own-runtime script: host exited 0 (expected non-zero)"
+    if ! grep -q "kind=5" "$TMPDIR/host_own.log" ||
+       ! grep -q -- "--shared-runtime" "$TMPDIR/host_own.log"; then
+        echo "  [FAIL] own-runtime script: expected kind=5 (KIND_IO) naming --shared-runtime:"
+        head -10 "$TMPDIR/host_own.log"
+        exit 1
+    fi
+
+    # --- Test 6: a --shared-runtime script on this static host. On ELF its
+    # calls bind to the host's runtime (the program is linked -rdynamic, and
+    # the global scope finds its definitions first): it mounts. A Mach-O
+    # image binds each import to its library, so on macOS it would run on
+    # the shared runtime beside the host's own: refused, naming the host's
+    # rebuild. Only where this toolchain built the shared runtime. ---
+    if [ -d "$ROOT/build/shared" ]; then
+        SHARED_SO="$TMPDIR/shared_script$SO_EXT"
+        if ! AETHER_HOME="$ROOT" "$AE" build --emit=lib --shared-runtime --with=net \
+                "$SCRIPT_DIR/script.ae" -o "$SHARED_SO" >"$TMPDIR/shared_script.build.log" 2>&1; then
+            echo "  [FAIL] ae build --emit=lib --shared-runtime script.ae:"
+            head -30 "$TMPDIR/shared_script.build.log"
+            exit 1
+        fi
+        if [ "$(uname -s)" = Darwin ]; then
+            "$TMPDIR/host" "$BAD_PORT" "$SHARED_SO" >"$TMPDIR/host_shared.log" 2>&1
+            RC=$?
+            [ "$RC" != "0" ] || fail "shared script, static host: host exited 0 (expected non-zero on macOS)"
+            if ! grep -q "kind=5" "$TMPDIR/host_shared.log" ||
+               ! grep -q -- "--shared-runtime" "$TMPDIR/host_shared.log"; then
+                echo "  [FAIL] shared script, static host: expected kind=5 naming --shared-runtime:"
+                head -10 "$TMPDIR/host_shared.log"
+                exit 1
+            fi
+        else
+            "$TMPDIR/host" "$BAD_PORT" "$SHARED_SO" >"$TMPDIR/host_shared.log" 2>&1 &
+            HOST_PID=$!
+            deadline=$(($(date +%s) + 15))
+            while [ "$(date +%s)" -lt "$deadline" ] && ! grep -q '^READY$' "$TMPDIR/host_shared.log" 2>/dev/null; do
+                kill -0 "$HOST_PID" 2>/dev/null || break
+                sleep 0.1
+            done
+            grep -q '^READY$' "$TMPDIR/host_shared.log" 2>/dev/null || {
+                echo "  [FAIL] shared script, static host: the mount was refused on ELF:"
+                head -10 "$TMPDIR/host_shared.log"
+                exit 1
+            }
+            kill_server "$HOST_PID"
+            HOST_PID=""
+        fi
+        echo "  [PASS] http_script_gateway: 6/6 (happy path, static fallback, missing .so, no entrypoint, own-runtime script, shared script)"
+    else
+        echo "  [PASS] http_script_gateway: 5/5 (happy path, static fallback, missing .so, no entrypoint, own-runtime script; no shared runtime built here)"
+    fi
 fi

From bf1f998fc27cec0039aca26b0820032117d15317 Mon Sep 17 00:00:00 2001
From: Nicolas Maman <nicolasmd87@gmail.com>
Date: Sun, 1 Nov 2026 14:35:56 -0300
Subject: [PATCH 11/17] fix: script_gateway's POSIX check builds on WASI; docs
 say what macOS refuses (#3501)

The review of the batch: wasm32-wasi has <dlfcn.h> but no Dl_info or
dladdr, so the POSIX branch broke the WebAssembly job. WASI has no
dynamic loader (a mount fails at the load), so the check is none there.
The docs said a static macOS host is refused; it is refused only for a
--shared-runtime script, and a script with no runtime of its own mounts.
---
 docs/stdlib-reference.md                        |  4 ++--
 std/http/script_gateway/aether_script_gateway.c | 10 ++++++++++
 std/http/script_gateway/aether_script_gateway.h |  2 +-
 std/http/script_gateway/module.ae               | 12 +++++++-----
 4 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/docs/stdlib-reference.md b/docs/stdlib-reference.md
index cddf16b9f..ec5b5c138 100644
--- a/docs/stdlib-reference.md
+++ b/docs/stdlib-reference.md
@@ -1404,7 +1404,7 @@ The script and the host run on one runtime: the script fills request and respons
 ae build --emit=lib --shared-runtime --with=net greeting.ae -o greeting.so
 ```
 
-On Linux and FreeBSD such a script runs on the host's runtime whatever the host was built with: an `ae build` program is linked `-rdynamic`, and the script's calls bind to its runtime. On macOS a script binds to the shared runtime it links, so the host is built with `ae build --shared-runtime` too. On Windows the script is a DLL loaded with `LoadLibrary`, which cannot bind to the host executable's runtime, so the host and each script are built on the shared runtime (`aether.dll`) and run on it together:
+On Linux and FreeBSD such a script runs on the host's runtime whatever the host was built with: an `ae build` program is linked `-rdynamic`, and the script's calls bind to its runtime. On macOS a script binds to the shared runtime it links, so its host is built with `ae build --shared-runtime` too (with a static host it is refused, naming that). On Windows the script is a DLL loaded with `LoadLibrary`, which cannot bind to the host executable's runtime, so the host and each script are built on the shared runtime (`aether.dll`) and run on it together:
 
 ```sh
 ae build --emit=lib --shared-runtime --with=net greeting.ae -o greeting.dll
@@ -1424,7 +1424,7 @@ A host or script that would run on a runtime of its own is refused at mount with
 | `KIND_OK` | 0 | mount succeeded |
 | `KIND_NOT_FOUND` | 1 | `so_path` is missing or unreadable |
 | `KIND_INVALID` | 6 | null arg, or `.so` missing the `aether_script_handle` entrypoint |
-| `KIND_IO` | 5 | `dlopen` / `LoadLibrary` failure (incompatible ABI, etc.); also a script that carries a runtime of its own, and on macOS and Windows a host not on the shared runtime (the message names `--shared-runtime`) |
+| `KIND_IO` | 5 | `dlopen` / `LoadLibrary` failure (incompatible ABI, etc.); also a script that carries a runtime of its own, on Windows a host not on the shared runtime, and on macOS a `--shared-runtime` script whose host is not on it (the message names `--shared-runtime`) |
 | `KIND_UNAVAILABLE` | 99 | a platform with no dynamic loader; no supported platform returns it |
 
 ### Sandbox
diff --git a/std/http/script_gateway/aether_script_gateway.c b/std/http/script_gateway/aether_script_gateway.c
index e6b991be3..63becde0a 100644
--- a/std/http/script_gateway/aether_script_gateway.c
+++ b/std/http/script_gateway/aether_script_gateway.c
@@ -176,6 +176,15 @@ static const char* sg_script_runtime_check(void* script, const char* so_path) {
  * image that defines the runtime's `aether_runtime_abi` for the script's
  * handle, against the image that holds this runtime's (the host's). */
 
+#if defined(__wasi__)
+/* WASI has no dynamic loader (and no dladdr): a mount fails at the load,
+ * before there is a script to check. */
+static const char* sg_script_runtime_check(void* script, const char* so_path) {
+    (void)script;
+    (void)so_path;
+    return NULL;
+}
+#else
 /* The reason a script was refused, per thread like std.dl's last error. */
 static AETHER_TLS char g_sg_err[512];
 
@@ -216,6 +225,7 @@ static const char* sg_script_runtime_check(void* script, const char* so_path) {
     return NULL;
 #endif
 }
+#endif  /* __wasi__ */
 #endif  /* _WIN32 */
 
 _aether_sg_tuple script_gateway_mount_so_raw(void* server,
diff --git a/std/http/script_gateway/aether_script_gateway.h b/std/http/script_gateway/aether_script_gateway.h
index 8423bed1d..8dc79f481 100644
--- a/std/http/script_gateway/aether_script_gateway.h
+++ b/std/http/script_gateway/aether_script_gateway.h
@@ -20,7 +20,7 @@
  * is refused at mount with KIND_IO on every platform (#3501), and a script
  * is built with `ae build --emit=lib --shared-runtime`. On Linux and FreeBSD
  * such a script runs on the host's runtime whatever the host was built with
- * (the program is linked -rdynamic); on macOS the host is built with
+ * (the program is linked -rdynamic); on macOS its host is built with
  * --shared-runtime too. On Windows the library is a DLL loaded with
  * LoadLibrary, and the host and the script must both be built with
  * `ae build --shared-runtime`: a DLL cannot bind to the host executable's
diff --git a/std/http/script_gateway/module.ae b/std/http/script_gateway/module.ae
index a13706e7b..a56238fe1 100644
--- a/std/http/script_gateway/module.ae
+++ b/std/http/script_gateway/module.ae
@@ -63,9 +63,10 @@
 //
 // On Linux and FreeBSD a `--shared-runtime` script runs on the host's
 // runtime whatever the host was built with: an `ae build` program is linked
-// -rdynamic, and the script's calls bind to its runtime. On macOS a script
-// binds to the shared runtime it links, so the host is built with
-// `ae build --shared-runtime` too (a static host is refused, naming that).
+// -rdynamic, and the script's calls bind to its runtime. On macOS such a
+// script binds to the shared runtime it links, so its host is built with
+// `ae build --shared-runtime` too (with a static host it is refused, naming
+// that).
 // On Windows the library is a DLL, loaded with LoadLibrary, which cannot
 // bind to the host executable: there too the host and every script are
 // built on the shared runtime (aether.dll) and run on it together:
@@ -118,8 +119,9 @@ extern script_gateway_mount_so_raw(server: ptr, path_prefix: string, so_path: st
 //   KIND_NOT_FOUND:    `so_path` is missing or unreadable
 //   KIND_INVALID:      null arg, or .so missing the entrypoint
 //   KIND_IO:           dlopen failure (incompatible ABI, etc.), or a
-//                      script that carries a runtime of its own (and on
-//                      macOS and Windows a host not on the shared runtime):
+//                      script that carries a runtime of its own, on Windows
+//                      a host not on the shared runtime, on macOS a
+//                      --shared-runtime script whose host is not on it:
 //                      the message names --shared-runtime
 mount(server: ptr, path_prefix: string, so_path: string) -> {
     return script_gateway_mount_so_raw(server, path_prefix, so_path)

From 2bd1e95adef52502ccc2f137963b5ca8edc45952 Mon Sep 17 00:00:00 2001
From: Nicolas Maman <nicolasmd87@gmail.com>
Date: Sun, 1 Nov 2026 14:35:56 -0300
Subject: [PATCH 12/17] test: ask relief's B on core 2, its hold inside the
 asker's timeout (#3483)

The review of the batch: with B on core 1 the relief could move D to
B's core (relief_destination ranks cores by queued work, and a core in a
long step with an empty queue looks idle), behind B's step, which waited
for D: three CI legs saw A's ask time out. B is now on core 2, as in the
overflow cases, so core 1 is the relief's choice for D, and B holds at
most 2 s, inside A's 3 s timeout, so a relief that fails shows as a short
count rather than a timeout.
---
 tests/runtime/test_ask_relief.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/tests/runtime/test_ask_relief.c b/tests/runtime/test_ask_relief.c
index b2b0f708e..ffcaed3ec 100644
--- a/tests/runtime/test_ask_relief.c
+++ b/tests/runtime/test_ask_relief.c
@@ -79,9 +79,10 @@ static void relief_step(ReliefActor* self) {
     }
     if (self->pause_ms) relief_sleep_ms(self->pause_ms);
     /* #3483: the reply waits for an event, not a pause a slow runner
-     * outlasts: until `hold_for` has handled `hold_want`, or 3 s. */
+     * outlasts: until `hold_for` has handled `hold_want`, or 2 s, inside
+     * the asker's 3 s timeout so a relief that fails shows as a short count. */
     if (self->hold_for) {
-        uint64_t until = aether_now_ns() + 3000ULL * 1000000ULL;
+        uint64_t until = aether_now_ns() + 2000ULL * 1000000ULL;
         while (atomic_load(&((ReliefActor*)self->hold_for)->got) < self->hold_want &&
                aether_now_ns() < until)
             relief_sleep_ms(1);
@@ -139,14 +140,17 @@ static void test_ask_relief_chain_back_to_waiting_core(void) {
     free(c);
 }
 
-/* An actor of a core waiting in an ask runs meanwhile: D, on A's core, is
- * sent 20 messages (they fit its mailbox, #3241) once A waits for B, and B
- * holds its reply until D has handled them (or 3 s pass). They waited for
- * A's reply. #3483: B paused 400 ms instead, and on a slow runner (macOS
- * ASan, Valgrind) the pause ended with 11 of the 20 handled. */
+/* An actor of a core waiting in an ask runs meanwhile: D, on A's core 0, is
+ * sent 20 messages (they fit its mailbox, #3241) once A waits for B, and B,
+ * on core 2, holds its reply until D has handled them (or 2 s pass). They
+ * waited for A's reply. #3483: B paused 400 ms instead, and on a slow runner
+ * (macOS ASan, Valgrind) the pause ended with 11 of the 20 handled. B is on
+ * core 2, as in the overflow cases below, so core 1 is the relief's choice
+ * for D: on core 1 B's long step was a core D could be moved behind, and B
+ * waited for D while D waited for B. */
 static void test_ask_relief_other_actor_runs(void) {
     scheduler_init(3);
-    ReliefActor* b = relief_actor(1);
+    ReliefActor* b = relief_actor(2);
     ReliefActor* d = relief_actor(0);
     ReliefActor* a = relief_actor(0);
     b->hold_for = (ActorBase*)d;

From 235ea27f3e9c39d5f8383b678294bfb9d78fa271 Mon Sep 17 00:00:00 2001
From: Nicolas Maman <nicolasmd87@gmail.com>
Date: Sun, 1 Nov 2026 14:35:57 -0300
Subject: [PATCH 13/17] fix: s[i] on a string is an int from 0 to 255;
 s[length] is the terminator (#3479)

The review of the batch: typed byte, s[i] refused uint32 u = s[i] and
the uint8/uint16 widths, and wrapped c = s[i]; c = c - 100 (205 for -51);
and the bounds check panicked on s[length], which a C-style scan
(while s[j] != 0) and s[0] on an empty or null string read. The read is
now an int, the type codegen always gave such a local, still unsigned
(0 to 255, string.bytes(s)[i]'s value); index length reads 0 (returned,
not loaded); below 0 or past it panics. The regression test covers the
terminator, a scan, the empty string, one past the terminator, a far
index and a negative one.
---
 compiler/analysis/type_inference.c            |  5 +-
 compiler/analysis/typechecker.c               | 12 ++--
 compiler/codegen/codegen.c                    | 15 +++--
 docs/language-reference.md                    |  2 +-
 ...01T130100Z-fixed-3479-string-index-byte.md | 15 ++---
 runtime/aether_slice.h                        |  4 +-
 tests/regression/test_string_index_byte.ae    | 58 ++++++++++++-------
 7 files changed, 66 insertions(+), 45 deletions(-)

diff --git a/compiler/analysis/type_inference.c b/compiler/analysis/type_inference.c
index 1295c53b5..e75bc2c16 100644
--- a/compiler/analysis/type_inference.c
+++ b/compiler/analysis/type_inference.c
@@ -1092,9 +1092,10 @@ void collect_expression_constraints(ASTNode* node, InferenceContext* ctx) {
                     free_type(node->node_type);
                     node->node_type = clone_type(array_type->element_type);
                 } else if (array_type && array_type->kind == TYPE_STRING) {
-                    /* #3479: `s[i]` reads one byte of the string. */
+                    /* #3479: `s[i]` reads one byte of the string, as an
+                     * `int` from 0 to 255. */
                     free_type(node->node_type);
-                    node->node_type = create_type(TYPE_BYTE);
+                    node->node_type = create_type(TYPE_INT);
                 }
             }
             break;
diff --git a/compiler/analysis/typechecker.c b/compiler/analysis/typechecker.c
index 80e9db4ae..0c0386b72 100644
--- a/compiler/analysis/typechecker.c
+++ b/compiler/analysis/typechecker.c
@@ -17835,13 +17835,15 @@ int typecheck_expression(ASTNode* expr, SymbolTable* table) {
                     if (expr->node_type) free_type(expr->node_type);
                     expr->node_type = clone_type(arr_type->element_type);
                 }
-                /* #3479: `s[i]` on a string reads one byte, the type
-                 * `string.bytes(s)[i]` has; a local bound to it was left to
-                 * codegen's `int` default. */
+                /* #3479: `s[i]` on a string reads one byte as an `int`
+                 * from 0 to 255, the type codegen always gave a local bound
+                 * to it, now the checker's: the local was left to codegen's
+                 * default with a warning. Not a `byte`, which would refuse
+                 * `uint32 u = s[i]` and wrap `c = s[i]; c = c - 100`. */
                 if (arr_type && arr_type->kind == TYPE_STRING &&
-                    (!expr->node_type || expr->node_type->kind != TYPE_BYTE)) {
+                    (!expr->node_type || expr->node_type->kind != TYPE_INT)) {
                     if (expr->node_type) free_type(expr->node_type);
-                    expr->node_type = create_type(TYPE_BYTE);
+                    expr->node_type = create_type(TYPE_INT);
                 }
 
                 // Indexing a bare `ptr` (void*, element_type == NULL) has no
diff --git a/compiler/codegen/codegen.c b/compiler/codegen/codegen.c
index 690383cb8..c3857b668 100644
--- a/compiler/codegen/codegen.c
+++ b/compiler/codegen/codegen.c
@@ -9815,13 +9815,16 @@ void generate_program(CodeGenerator* gen, ASTNode* program) {
     print_line(gen, "    if (!s) return \"\";");
     print_line(gen, "    return aether_string_data(s);");
     print_line(gen, "}");
-    /* #3479: `s[i]` is the string's byte i, read unsigned (a plain char is
-     * signed on some targets), and checked against the string's length as a
-     * slice index is against the slice's; past the end it read past it. */
-    print_line(gen, "static inline uint8_t _aether_str_at(const void* s, int64_t i, const char* file, int line) {");
+    /* #3479: `s[i]` is the string's byte i as an int from 0 to 255, read
+     * unsigned (a plain char is signed on some targets). Index `length` is
+     * the terminator, 0, as a C-style scan (`while s[j] != 0`) reads it; one
+     * below 0 or past it panics, as a slice index outside its length does:
+     * it read past the string. */
+    print_line(gen, "static inline int _aether_str_at(const void* s, int64_t i, const char* file, int line) {");
     print_line(gen, "    uint64_t n = s ? (uint64_t)aether_string_length(s) : 0;");
-    print_line(gen, "    if ((uint64_t)i >= n) aether_string_fail_index(i, n, file, line);");
-    print_line(gen, "    return (uint8_t)_aether_safe_str(s)[i];");
+    print_line(gen, "    if ((uint64_t)i > n) aether_string_fail_index(i, n, file, line);");
+    print_line(gen, "    if ((uint64_t)i == n) return 0;");
+    print_line(gen, "    return (int)(unsigned char)_aether_safe_str(s)[i];");
     print_line(gen, "}");
     /* Owned-print helpers: a heap-producing CALL in bare print/println
      * argument position (`println(string.concat(a, b))`) is a temporary
diff --git a/docs/language-reference.md b/docs/language-reference.md
index 8bb5674ab..550dcda1e 100644
--- a/docs/language-reference.md
+++ b/docs/language-reference.md
@@ -413,7 +413,7 @@ main() {
 - **`s[i]` is bounds-checked.** An index outside `0 ..< s.len` is a runtime panic naming the source line, the index and the length (`slice index 5 out of range for length 3`). It is an ordinary panic: `try` catches it, and an actor step that trips it dies cleanly. A negative index is out of range, never a read before the buffer. An index into a fixed-size `T[N]` array is checked the same way, against `N` ([Array Types](#array-types)).
 - **`s[lo..hi]`** is the half-open sub-slice `[lo, hi)`, checked the same way (`lo <= hi <= s.len`). `s[lo..]` runs to the end, `s[..hi]` from the start, `s[..]` is the whole thing. The base may be a slice or a `T[N]` array; the result is always a `T[]` over the *same* elements, so a write through it is visible through the original.
 - **A `T[N]` array converts to `T[]` implicitly** wherever a slice is expected: a parameter, a `T[]`-typed binding or field, a `return` from a `-> T[]` function. The length travels with it. `null`, and the empty literal `[]`, convert to the empty slice: `.len` is `0`, it views no storage, and it compares equal to `null`. So `s == []` is `s == null` (it asks whether `s` views any storage; test `s.len == 0` for emptiness), a C function's `T[]` parameter takes `[]` as the null pointer, and an if-expression or a `match` given to a `T[]` converts each arm on its own. A module-level `var` or `const` of type `T[]` takes either as its initial value.
-- **A string is not a slice.** Passing one where a `T[]` is expected (a parameter, a binding, a `return`) is a type error; `string.bytes(s)` is the bounded, read-only `byte[]` view of a string's bytes, and it decays to their pointer at a C extern like any slice. Reading it costs what any slice's read does; a store through it (an element store, `+=`, `++`), or through any view made from it (a sub-slice, a pattern's tail), in this function or one it is given to, panics with "a write through a read-only view of a string", and one the checker can see through a local bound to it is a compile error (E0200) (#3025). A string's own bytes are read-only too: `s[i]` reads one, a `byte` (the value `string.bytes(s)[i]` has, 0 to 255), checked against the string's length as a slice index is against its own: an index outside `0 ..< length` is the panic `string index 5 out of range for length 3`. A write (`s[i] = v`, `s[i] += v`, `s[i]++`) is a compile error (E0200). Build the new text as a new string, or work on the bytes in a `byte[N]` array of your own.
+- **A string is not a slice.** Passing one where a `T[]` is expected (a parameter, a binding, a `return`) is a type error; `string.bytes(s)` is the bounded, read-only `byte[]` view of a string's bytes, and it decays to their pointer at a C extern like any slice. Reading it costs what any slice's read does; a store through it (an element store, `+=`, `++`), or through any view made from it (a sub-slice, a pattern's tail), in this function or one it is given to, panics with "a write through a read-only view of a string", and one the checker can see through a local bound to it is a compile error (E0200) (#3025). A string's own bytes are read-only too: `s[i]` reads one, an `int` from 0 to 255 (the value `string.bytes(s)[i]` has), checked against the string's length as a slice index is against its own: `s[length]` is the terminator, 0, and an index below 0 or past it is the panic `string index 5 out of range for length 3`. A write (`s[i] = v`, `s[i] += v`, `s[i]++`) is a compile error (E0200). Build the new text as a new string, or work on the bytes in a `byte[N]` array of your own.
 - **A slice decays to its pointer** wherever a `ptr` is expected, exactly as a `T[N]` array does: a `ptr` parameter, a C extern's parameter (including one declared `T[]`), a comparison against `null`, and pointer arithmetic (`s + n` is a `ptr` to element `n`). `s as ptr` spells the same conversion explicitly, for a `ptr` return or binding. The length is dropped at that boundary; nothing else about the extern ABI changes.
 - **`make([]T, n)`** allocates `n` zeroed elements and returns them as a bounded slice. The local that holds it releases it when it goes out of scope ([Slice ownership](#slice-ownership)), and `free(s)` releases it early, and first what the elements hold: each element is a place a store into it takes a reference for (a string, a closure, a struct that holds one), so the free gives each back, as a struct's destroy does its fields (#3159). The elements of C memory viewed as a slice hold no reference, and its free releases only the memory. Only the slice that holds such a buffer, or a view of a raw pointer the program owns from its start (`(p as T[])[0..n]`), may be freed: a view owns nothing. `free` of a sub-slice (`b[2..4]`, `b[1..]`, a list pattern's tail), of an array viewed as a slice, of `string.bytes(s)`, or of an array `T[N]`, is a compile error where the checker sees it (a local bound once to one, or the expression itself), and a named panic at run time anywhere else (`free of a view of elements another slice or an array holds, which owns nothing`). Before, the allocator was given a pointer it never handed out. In a module that defines a `free` of its own (`bignum.free`, `json.free`), `free(s)` of a slice is still this release, unless the module's `free` itself takes a slice: the module's function would only see the slice's pointer (#3116).
 - **`T[][]` is a slice of slices**, and `T[][][]` one deeper: each further `[]` wraps the type once more, in any position a type is written (a parameter, a return type, a field, a typed local, a function type). `make([]int[], n)` builds one; `g[i] = row` stores a row, `g[i][j]` reads an element and `g[i].len` is a row's length. The outer slice owns its rows: a store into `g[i]` releases the row it replaces, and releasing the outer slice (its owner's scope exit, or `free(g)`) releases every row first; `free(g[i])` releases a row early and leaves it empty. A row read out (`r = g[i]`) is a view of it. Only the empty `[]` repeats; there is no `T[][3]`.
diff --git a/new_changelogs/20261101T130100Z-fixed-3479-string-index-byte.md b/new_changelogs/20261101T130100Z-fixed-3479-string-index-byte.md
index 1acff45fa..4b72581dd 100644
--- a/new_changelogs/20261101T130100Z-fixed-3479-string-index-byte.md
+++ b/new_changelogs/20261101T130100Z-fixed-3479-string-index-byte.md
@@ -1,7 +1,8 @@
-- **`s[i]` on a string is a checked `byte` (#3479).** A local bound to it
-  warned that its type was left to codegen; the read was a plain `char`, so
-  a byte past 127 (any non-ASCII UTF-8 byte) was negative on x86 and
-  positive on ARM; and an index past the end read past the string. It now
-  has the type and the value `string.bytes(s)[i]` has, 0 to 255, and an
-  index outside `0 ..< length` is the panic `string index 5 out of range for
-  length 3`, which a `try` catches, as a slice index's is.
+- **`s[i]` on a string is a checked `int` from 0 to 255 (#3479).** A local
+  bound to it warned that its type was left to codegen; the read was a
+  plain `char`, so a byte past 127 (any non-ASCII UTF-8 byte) was negative
+  on x86 and positive on ARM; and an index past the end read past the
+  string. It is now an `int` with the value `string.bytes(s)[i]` has.
+  `s[length]` is the terminator, 0, as a C-style scan reads it, and an
+  index below 0 or past the terminator is the panic `string index 5 out of
+  range for length 3`, which a `try` catches, as a slice index's is.
diff --git a/runtime/aether_slice.h b/runtime/aether_slice.h
index f505f2762..54fb09d62 100644
--- a/runtime/aether_slice.h
+++ b/runtime/aether_slice.h
@@ -164,8 +164,8 @@ static inline void aether_array_fail_index(int64_t idx, uint64_t len,
                         file, line, (long long)idx, (unsigned long long)len);
 }
 
-/* #3479: `s[i]` on a string outside `0 ..< length`, the slice's panic with
- * the string's length. */
+/* #3479: `s[i]` on a string outside `0 ..= length` (`length` is its
+ * terminator, 0), the slice's panic with the string's length. */
 static inline void aether_string_fail_index(int64_t idx, uint64_t len,
                                             const char* file, int line) {
     aether_slice_panicf("%s:%d: string index %lld out of range for length %llu",
diff --git a/tests/regression/test_string_index_byte.ae b/tests/regression/test_string_index_byte.ae
index 47d715c3c..fd7c0a273 100644
--- a/tests/regression/test_string_index_byte.ae
+++ b/tests/regression/test_string_index_byte.ae
@@ -1,13 +1,15 @@
-// Regression (#3479): `s[i]` on a string is its byte i, typed `byte`,
-// read unsigned and checked against the string's length.
+// Regression (#3479): `s[i]` on a string is its byte i, an `int` from 0 to
+// 255, checked against the string's length.
 //
 // The checker gave the read no type, so a local bound to it warned
 // "unresolved type in codegen, defaulting to int"; the generated C read a
 // plain `char`, which is signed on x86, so a byte past 127 (any non-ASCII
 // UTF-8 byte) read negative there and positive on ARM; and an index past
-// the end read past the string. The read now has the type
-// `string.bytes(s)[i]` has, and the value it has, and an index outside
-// `0 ..< length` panics, as a slice index does, where a `try` catches it.
+// the terminator read past the string. The read is now an `int`, the type
+// codegen gave such a local, with the value `string.bytes(s)[i]` has;
+// `s[length]` is the terminator, 0, as a C-style scan reads it; and an index
+// below 0 or past the terminator panics, as a slice index outside its
+// length does, where a `try` catches it.
 
 import std.string
 
@@ -25,31 +27,43 @@ first(text: string) -> int {
     return c
 }
 
+// A C-style scan: stops at the terminator.
+scan_len(text: string) -> int {
+    j = 0
+    while text[j] != 0 {
+        j = j + 1
+    }
+    return j
+}
+
+// `s[i]` at `i`, or -1 when the index panics; the panic's message is checked.
+read_or_caught(s: string, i: int, n: int) -> int {
+    try {
+        return s[i]
+    } catch e {
+        if string.ends_with(e, "string index ${i} out of range for length ${n}") == 0 {
+            println("FAIL: message: ${e}")
+            exit(1)
+        }
+    }
+    return -1
+}
+
 main() {
     s = "é"
     c = s[0]
     check(c, 195, "a lead byte bound to a local")
     check(s[1], 169, "a continuation byte")
     check(s[0], string.bytes(s)[0], "the byte string.bytes reads")
+    check(c - 200, -5, "arithmetic on the local, as an int")
     check(first("A"), 65, "a parameter's byte")
     t = "Az"
     check(t[1] - t[0], 57, "arithmetic on two bytes")
-    caught = 0
-    i = 2
-    while i < 5 {
-        try {
-            x = t[i]
-            println("FAIL: no panic at ${i} (${x})")
-            exit(1)
-        } catch e {
-            if string.ends_with(e, "string index ${i} out of range for length 2") == 0 {
-                println("FAIL: message: ${e}")
-                exit(1)
-            }
-            caught = caught + 1
-        }
-        i = i + 1
-    }
-    check(caught, 3, "indexes past the end caught")
+    check(t[2], 0, "the terminator")
+    check(scan_len("hello"), 5, "a scan to the terminator")
+    check(read_or_caught("", 0, 0), 0, "the empty string's terminator")
+    check(read_or_caught(t, 3, 2), -1, "one past the terminator")
+    check(read_or_caught(t, 100000, 2), -1, "far past the end")
+    check(read_or_caught(t, -1, 2), -1, "a negative index")
     println("ok")
 }

From 7240ffac0c9ebd9f9dda9e12a714b62ee8630603 Mon Sep 17 00:00:00 2001
From: Nicolas Maman <nicolasmd87@gmail.com>
Date: Sun, 1 Nov 2026 14:35:57 -0300
Subject: [PATCH 14/17] fix: a call's arguments parse as anywhere inside a
 condition (#3478)

The review of the batch: under the condition guard a struct literal
among a call's arguments was refused ("Expected RIGHT_PAREN, got
LEFT_BRACE"), new for the if expression and long standing for if,
while and match. Inside the parentheses a `{` cannot open the body, so
the arguments parse with the guard cleared, restored at the `)` before
the trailing-block check (and on every error path).
---
 compiler/parser/parser.c                       | 11 +++++++++++
 .../test_if_expression_call_condition.ae       | 18 +++++++++++++++++-
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/compiler/parser/parser.c b/compiler/parser/parser.c
index 640ab4ef0..6f2b6d3ad 100644
--- a/compiler/parser/parser.c
+++ b/compiler/parser/parser.c
@@ -3053,6 +3053,13 @@ static ASTNode* parse_postfix_expression(Parser* parser) {
             }
 
             // Parse arguments
+            /* Inside the parentheses a `{` cannot open the body of an if, a
+             * while or a match whose condition the call is part of, so the
+             * arguments parse as they do anywhere: a struct literal, a call
+             * with a trailing block (#3478 review; the `if` expression and the
+             * statements alike). */
+            int saved_args_in_condition = parser->in_condition;
+            parser->in_condition = 0;
             if (!match_token(parser, TOKEN_RIGHT_PAREN)) {
                 /* #2998: the `(` or `,` an argument has to follow, for the
                  * error when it is missing: `x = f(` used to compile. */
@@ -3073,6 +3080,7 @@ static ASTNode* parse_postfix_expression(Parser* parser) {
                             if (peek_token(parser) &&
                                 peek_token(parser)->type == TOKEN_RIGHT_PAREN)
                                 advance_token(parser);   /* as below */
+                            parser->in_condition = saved_args_in_condition;
                             free_ast_node(func_call);
                             return NULL;
                         }
@@ -3094,6 +3102,7 @@ static ASTNode* parse_postfix_expression(Parser* parser) {
                             if (peek_token(parser) &&
                                 peek_token(parser)->type == TOKEN_RIGHT_PAREN)
                                 advance_token(parser);
+                            parser->in_condition = saved_args_in_condition;
                             free_ast_node(func_call);
                             return NULL;
                         }
@@ -3103,10 +3112,12 @@ static ASTNode* parse_postfix_expression(Parser* parser) {
                 } while (match_token(parser, TOKEN_COMMA));
 
                 if (!expect_token(parser, TOKEN_RIGHT_PAREN)) {
+                    parser->in_condition = saved_args_in_condition;
                     free_ast_node(func_call);
                     return NULL;
                 }
             }
+            parser->in_condition = saved_args_in_condition;
 
             // Capture the closing paren's line for the trailing-block
             // line check below. Both arg-list paths (empty via
diff --git a/tests/regression/test_if_expression_call_condition.ae b/tests/regression/test_if_expression_call_condition.ae
index eaad3bdcf..b4057d3ac 100644
--- a/tests/regression/test_if_expression_call_condition.ae
+++ b/tests/regression/test_if_expression_call_condition.ae
@@ -6,12 +6,21 @@
 // arm's `{` as a trailing block, and the `else` after it was "Expected
 // LEFT_BRACE, got ELSE". The condition is now parsed under that guard, and
 // the arms inside their braces without it, so a call there may still take
-// a block.
+// a block. A call's arguments parse as they do anywhere, a struct literal
+// among them, in the expression form and the statement form alike: inside
+// the parentheses a `{` cannot open the body.
 
 extern exit(code: int)
 
+struct Point {
+    x: int
+    y: int
+}
+
 yes(x: int) -> bool -> x > 0
 
+same(p: Point, q: Point) -> bool -> p.x == q.x && p.y == q.y
+
 twice(f: fn) -> int {
     return call(f) * 2
 }
@@ -33,5 +42,12 @@ main() {
     check(if yes(-1) { 1 } else if yes(2) { 2 } else { 3 }, 2, "an else-if chain of calls")
     // A call inside an arm still takes a trailing block.
     check(if yes(1) { twice() || -> 21 } else { 0 }, 42, "a trailing block in the then arm")
+    p = Point { x: 1, y: 2 }
+    check(if same(p, Point { x: 1, y: 2 }) == true { 1 } else { 0 }, 1, "a struct literal argument in the condition")
+    hit = 0
+    if same(p, Point { x: 1, y: 2 }) {
+        hit = 1
+    }
+    check(hit, 1, "a struct literal argument in an if statement's condition")
     println("ok")
 }

From cf912d765f683151d4e656689fb80756a9c0e36e Mon Sep 17 00:00:00 2001
From: Nicolas Maman <nicolasmd87@gmail.com>
Date: Sun, 1 Nov 2026 14:35:57 -0300
Subject: [PATCH 15/17] fix: a panic while a return inside a try computes its
 value is caught

Found while fixing #3479's review: a return with no defers to run
popped the try frames before it computed the value, so
try { return xs[i] } catch e { ... } with i out of range, or a returned
call that panics, ended the process ("panic outside any try/catch").
The single-value and tuple paths now compute into a temporary inside the
frames and pop after, as the defer-aware path already did, and main's
return assigns main_exit_ret before its pops. Regression test: an index,
a panicking call and a tuple, in range and out.
---
 compiler/codegen/codegen_stmt.c               | 51 ++++++++++---
 ...170000Z-fixed-return-inside-try-catches.md |  7 ++
 .../test_return_inside_try_catches.ae         | 72 +++++++++++++++++++
 3 files changed, 120 insertions(+), 10 deletions(-)
 create mode 100644 new_changelogs/20261101T170000Z-fixed-return-inside-try-catches.md
 create mode 100644 tests/regression/test_return_inside_try_catches.ae

diff --git a/compiler/codegen/codegen_stmt.c b/compiler/codegen/codegen_stmt.c
index b53950dc5..08ea229ce 100644
--- a/compiler/codegen/codegen_stmt.c
+++ b/compiler/codegen/codegen_stmt.c
@@ -12454,15 +12454,21 @@ static void generate_statement_body(CodeGenerator* gen, ASTNode* stmt) {
                  * main() doesn't leak the panic frame.  goto and
                  * return are both non-local exits as far as the
                  * try-frame stack is concerned. */
-                emit_try_pops_for_nonlocal_exit(gen);
-                print_indent(gen);
                 if (stmt->child_count > 0 && stmt->children[0] &&
                     stmt->children[0]->type != AST_PRINT_STATEMENT) {
+                    /* The value is read inside the try frames it was written
+                     * in, then they are popped: popped first, a panic while
+                     * reading it escaped the `try` around it. */
+                    print_indent(gen);
                     fprintf(gen->output, "main_exit_ret = ");
                     generate_expression(gen, stmt->children[0]);
-                    fprintf(gen->output, "; goto main_exit;\n");
+                    fprintf(gen->output, ";\n");
+                    emit_try_pops_for_nonlocal_exit(gen);
+                    print_line(gen, "goto main_exit;");
                     gen->main_exit_targeted = 1;
                 } else {
+                    emit_try_pops_for_nonlocal_exit(gen);
+                    print_indent(gen);
                     if (stmt->child_count > 0 && stmt->children[0] &&
                         stmt->children[0]->type == AST_PRINT_STATEMENT) {
                         generate_statement(gen, stmt->children[0]);
@@ -12656,10 +12662,11 @@ static void generate_statement_body(CodeGenerator* gen, ASTNode* stmt) {
                     print_line(gen, "return;");
                 } else if (stmt->child_count > 1) {
                     // Multi-value return: return a, b → return (_tuple_X_Y){a, b}
-                    /* Issue #501: drain try frames first; the
-                     * print_indent below is for the `return ...`
-                     * line, which lands after the drained pops. */
-                    emit_try_pops_for_nonlocal_exit(gen);
+                    /* Issue #501: drain try frames. Inside a `try` the
+                     * tuple is built first, into `_ae_tr`, and the frames
+                     * popped after, so a panic while building it is the
+                     * try's to catch. */
+                    int in_try = gen->try_frame_depth > 0;
                     print_indent(gen);
                     // Use the function's known return type if it's a tuple
                     // (avoids UNKNOWN types from unresolved identifiers)
@@ -12685,18 +12692,42 @@ static void generate_statement_body(CodeGenerator* gen, ASTNode* stmt) {
                     /* #2478: the positions are evaluated left to right. */
                     order_prelude_begin(gen, stmt->children, stmt->child_count, NULL);
                     int arrays = tuple_return_has_array(gen, stmt);
-                    if (arrays) fprintf(gen->output, "{ %s _ae_tr = (%s){", tname, tname);
+                    if (arrays || in_try) fprintf(gen->output, "{ %s _ae_tr = (%s){", tname, tname);
                     else fprintf(gen->output, "return (%s){", tname);
                     for (int j = 0; j < stmt->child_count; j++) {
                         if (j > 0) fprintf(gen->output, ", ");
                         emit_tuple_return_position(gen, stmt->children[j], j);
                     }
                     fprintf(gen->output, "};\n");
-                    if (arrays) {
-                        emit_tuple_array_fills(gen, stmt, "_ae_tr");
+                    if (arrays || in_try) {
+                        if (arrays) emit_tuple_array_fills(gen, stmt, "_ae_tr");
+                        emit_try_pops_for_nonlocal_exit(gen);
                         print_line(gen, "return _ae_tr; }");
                     }
                     if (owned) free_type(tuple);
+                } else if (gen->try_frame_depth > 0 && stmt->child_count > 0) {
+                    /* Inside a `try`: the value is computed inside its frames
+                     * and they are popped after, as the defer-aware path
+                     * does. Popped first, a panic while computing it (an
+                     * index out of range, a call that panics) escaped the
+                     * `try` written around it and ended the process. */
+                    print_line(gen, "{");
+                    gen->indent_level++;
+                    Type* fn_ret = gen->current_func_return_type;
+                    Type* ret_type = (fn_ret && fn_ret->kind != TYPE_VOID &&
+                                      fn_ret->kind != TYPE_UNKNOWN)
+                                     ? fn_ret : stmt->children[0]->node_type;
+                    const char* ret_c_type =
+                        (ret_type && ret_type->kind != TYPE_VOID && ret_type->kind != TYPE_UNKNOWN)
+                        ? c_result_type(ret_type) : "int";
+                    print_indent(gen);
+                    fprintf(gen->output, "%s _builder_ret = ", ret_c_type);
+                    emit_return_value(gen, stmt);
+                    fprintf(gen->output, ";\n");
+                    emit_try_pops_for_nonlocal_exit(gen);
+                    print_line(gen, "return _builder_ret;");
+                    gen->indent_level--;
+                    print_line(gen, "}");
                 } else {
                     /* Issue #501: drain try frames before the
                      * print_indent for the `return <expr>;` line. */
diff --git a/new_changelogs/20261101T170000Z-fixed-return-inside-try-catches.md b/new_changelogs/20261101T170000Z-fixed-return-inside-try-catches.md
new file mode 100644
index 000000000..e8117ddb7
--- /dev/null
+++ b/new_changelogs/20261101T170000Z-fixed-return-inside-try-catches.md
@@ -0,0 +1,7 @@
+- **A panic while a `return` inside a `try` computes its value is caught.**
+  A `return` with no defers to run popped the try frames before it
+  computed the value, so `try { return xs[i] } catch e { ... }` with `i`
+  out of range, or a returned call that panics, ended the process with
+  "panic outside any try/catch". The value is now computed inside the
+  frames and they are popped after, for a single value, a tuple and
+  `main`'s return alike, as a return with defers already did.
diff --git a/tests/regression/test_return_inside_try_catches.ae b/tests/regression/test_return_inside_try_catches.ae
new file mode 100644
index 000000000..0dd6688cc
--- /dev/null
+++ b/tests/regression/test_return_inside_try_catches.ae
@@ -0,0 +1,72 @@
+// Regression: a panic while a `return` inside a `try` computes its value is
+// the try's to catch.
+//
+// Found while fixing #3479: a return with no defers to run popped the try
+// frames before it computed the value, so `try { return xs[i] } catch e`
+// with `i` out of range, or a call that panics, ended the process with
+// "panic outside any try/catch". The value is now computed inside the
+// frames and they are popped after, as the defer-aware return already did:
+// a single value, a tuple, and the program's own `main` alike.
+
+import std.string
+
+extern exit(code: int)
+
+boom(n: int) -> int {
+    if n > 2 {
+        panic("boom ${n}")
+    }
+    return n
+}
+
+// One value, no defer to run.
+pick(i: int) -> int {
+    xs = [10, 20, 30]
+    try {
+        return xs[i]
+    } catch e {
+        if string.contains(e, "out of range") == 0 {
+            println("FAIL: pick: ${e}")
+            exit(1)
+        }
+    }
+    return -1
+}
+
+// A call that panics, returned as the value.
+through(n: int) -> int {
+    try {
+        return boom(n)
+    } catch e {
+        return -n
+    }
+}
+
+// A tuple.
+pair(i: int) -> (int, int) {
+    xs = [1, 2]
+    try {
+        return i, xs[i]
+    } catch e {
+        return -1, -1
+    }
+}
+
+check(got: int, want: int, what: string) {
+    if got != want {
+        println("FAIL: ${what}: ${got}, want ${want}")
+        exit(1)
+    }
+}
+
+main() {
+    check(pick(1), 20, "an index in range")
+    check(pick(7), -1, "an index out of range, caught")
+    check(through(1), 1, "a call that returns")
+    check(through(5), -5, "a call that panics, caught")
+    a, b = pair(1)
+    check(a + b, 3, "a tuple in range")
+    c, d = pair(9)
+    check(c + d, -2, "a tuple out of range, caught")
+    println("ok")
+}

From d14c36fb76990ddb9a40808997fd065f9948708d Mon Sep 17 00:00:00 2001
From: Nicolas Maman <nicolasmd87@gmail.com>
Date: Sun, 1 Nov 2026 15:08:15 -0300
Subject: [PATCH 16/17] fix: main computes what it returns before its defers
 run

The review of the fix round: main ran its defers (the program's and the
release of its owned locals) before computing its return value. A value
reading a released local read freed memory (return string.length(s)
exited 0, not 3), and now that a panic in the value is caught by a try
around it, main went on with its defers run and its locals released,
and ran the defers again at its end. main_exit_ret is computed first,
then the defers, then the try pops, as every other function's return.
Regression test: a defer that must run once, a local read after the
caught panic, and an exit code read from a local.

Also from that review: on WASI, where no runtime can be read, the
gateway refuses a script rather than mount it unchecked (fail closed;
unreachable today, as the load fails first).
---
 compiler/codegen/codegen_stmt.c               | 25 ++++++---
 ...170000Z-fixed-return-inside-try-catches.md | 18 +++---
 .../script_gateway/aether_script_gateway.c    |  5 +-
 .../regression/test_main_return_inside_try.ae | 55 +++++++++++++++++++
 4 files changed, 85 insertions(+), 18 deletions(-)
 create mode 100644 tests/regression/test_main_return_inside_try.ae

diff --git a/compiler/codegen/codegen_stmt.c b/compiler/codegen/codegen_stmt.c
index 08ea229ce..646cf8a4d 100644
--- a/compiler/codegen/codegen_stmt.c
+++ b/compiler/codegen/codegen_stmt.c
@@ -12446,6 +12446,21 @@ static void generate_statement_body(CodeGenerator* gen, ASTNode* stmt) {
             }
             // In main(), all returns go through main_exit so scheduler_wait() always runs
             if (gen->in_main_function) {
+                /* The value is computed first, while the locals it reads
+                 * are live and inside the try frames it was written in;
+                 * then the defers run and the frames are popped, as any
+                 * other function's return does. The defers ran first: a
+                 * value read a released local (`return string.length(s)`
+                 * after `s`'s release), and once a panic in it was caught,
+                 * main went on with its defers run, and ran them again. */
+                int main_value = stmt->child_count > 0 && stmt->children[0] &&
+                                 stmt->children[0]->type != AST_PRINT_STATEMENT;
+                if (main_value) {
+                    print_indent(gen);
+                    fprintf(gen->output, "main_exit_ret = ");
+                    generate_expression(gen, stmt->children[0]);
+                    fprintf(gen->output, ";\n");
+                }
                 if (gen->defer_count > 0) {
                     emit_all_defers(gen);
                 }
@@ -12454,15 +12469,7 @@ static void generate_statement_body(CodeGenerator* gen, ASTNode* stmt) {
                  * main() doesn't leak the panic frame.  goto and
                  * return are both non-local exits as far as the
                  * try-frame stack is concerned. */
-                if (stmt->child_count > 0 && stmt->children[0] &&
-                    stmt->children[0]->type != AST_PRINT_STATEMENT) {
-                    /* The value is read inside the try frames it was written
-                     * in, then they are popped: popped first, a panic while
-                     * reading it escaped the `try` around it. */
-                    print_indent(gen);
-                    fprintf(gen->output, "main_exit_ret = ");
-                    generate_expression(gen, stmt->children[0]);
-                    fprintf(gen->output, ";\n");
+                if (main_value) {
                     emit_try_pops_for_nonlocal_exit(gen);
                     print_line(gen, "goto main_exit;");
                     gen->main_exit_targeted = 1;
diff --git a/new_changelogs/20261101T170000Z-fixed-return-inside-try-catches.md b/new_changelogs/20261101T170000Z-fixed-return-inside-try-catches.md
index e8117ddb7..db3b056b4 100644
--- a/new_changelogs/20261101T170000Z-fixed-return-inside-try-catches.md
+++ b/new_changelogs/20261101T170000Z-fixed-return-inside-try-catches.md
@@ -1,7 +1,11 @@
-- **A panic while a `return` inside a `try` computes its value is caught.**
-  A `return` with no defers to run popped the try frames before it
-  computed the value, so `try { return xs[i] } catch e { ... }` with `i`
-  out of range, or a returned call that panics, ended the process with
-  "panic outside any try/catch". The value is now computed inside the
-  frames and they are popped after, for a single value, a tuple and
-  `main`'s return alike, as a return with defers already did.
+- **A panic while a `return` inside a `try` computes its value is caught,
+  and `main` computes what it returns before its defers run.** A `return`
+  with no defers to run popped the try frames before it computed the
+  value, so `try { return xs[i] } catch e { ... }` with `i` out of range,
+  or a returned call that panics, ended the process with "panic outside
+  any try/catch". The value is now computed inside the frames and they are
+  popped after, for a single value and a tuple, as a return with defers
+  already did. `main` ran its defers, and released its owned locals,
+  before computing the value it returns: `return string.length(s)` read a
+  released `s`. It now computes the value first, as every other function
+  does.
diff --git a/std/http/script_gateway/aether_script_gateway.c b/std/http/script_gateway/aether_script_gateway.c
index 63becde0a..194026f60 100644
--- a/std/http/script_gateway/aether_script_gateway.c
+++ b/std/http/script_gateway/aether_script_gateway.c
@@ -178,11 +178,12 @@ static const char* sg_script_runtime_check(void* script, const char* so_path) {
 
 #if defined(__wasi__)
 /* WASI has no dynamic loader (and no dladdr): a mount fails at the load,
- * before there is a script to check. */
+ * before there is a script to check. Should a loader load one, what its
+ * runtime is cannot be read, so it is refused rather than run unchecked. */
 static const char* sg_script_runtime_check(void* script, const char* so_path) {
     (void)script;
     (void)so_path;
-    return NULL;
+    return "script_gateway: no way to tell which runtime a script runs on here (WASI)";
 }
 #else
 /* The reason a script was refused, per thread like std.dl's last error. */
diff --git a/tests/regression/test_main_return_inside_try.ae b/tests/regression/test_main_return_inside_try.ae
new file mode 100644
index 000000000..4d34d3a08
--- /dev/null
+++ b/tests/regression/test_main_return_inside_try.ae
@@ -0,0 +1,55 @@
+// Regression: main's `return` computes its value before main's defers run.
+//
+// Found by the review of a fix to returns inside a `try`: main ran its
+// defers (the program's own and the release of its owned locals) before it
+// computed the value it returns. A value reading a released local read
+// freed memory, and once a panic in the value was caught by a `try` around
+// it, main went on with its defers run, its locals released, and ran the
+// defers again at its end. The value is now computed first, as every other
+// function's return does.
+
+import std.string
+
+extern exit(code: int)
+
+var deferred = 0
+
+boom(n: int) -> int {
+    if n > 2 {
+        panic("boom ${n}")
+    }
+    return n
+}
+
+once() {
+    deferred = deferred + 1
+    if deferred > 1 {
+        println("FAIL: main's defer ran twice")
+        exit(1)
+    }
+}
+
+main() {
+    s = string.concat("he", "llo")
+    defer once()
+    caught = 0
+    try {
+        return boom(5)
+    } catch e {
+        caught = 1
+    }
+    if caught != 1 {
+        println("FAIL: the panic in main's returned value was not caught")
+        exit(1)
+    }
+    if deferred != 0 {
+        println("FAIL: main's defer ran before main returned")
+        exit(1)
+    }
+    if string.length(s) != 5 {
+        println("FAIL: a local was released before main returned")
+        exit(1)
+    }
+    println("ok ${s}")
+    return string.length(s) - 5
+}

From 335ef52db6f945c98005114d0709351bc3c7fc4a Mon Sep 17 00:00:00 2001
From: Nicolas Maman <nicolasmd87@gmail.com>
Date: Sun, 1 Nov 2026 15:11:50 -0300
Subject: [PATCH 17/17] test: order_effects_scaling takes the best of three
 runs of each size (#3499)

macOS ARM64 measured a single 4000-function compile at 220 ms and a
single 16000 one at 3263 ms (14x) on cf912d76, where the same commit
measures 3.7x here and the leg passed on the commit before. One timed
run of each let a busy moment on the runner decide the comparison: the
sizes are now compiled in turn three times and the best of each is
compared. A compile that is really quadratic is 13x at its best too.
---
 .../test_order_effects_scaling.sh                 | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/tests/integration/order_effects_scaling/test_order_effects_scaling.sh b/tests/integration/order_effects_scaling/test_order_effects_scaling.sh
index c48454b7e..b4ce41d9f 100755
--- a/tests/integration/order_effects_scaling/test_order_effects_scaling.sh
+++ b/tests/integration/order_effects_scaling/test_order_effects_scaling.sh
@@ -90,10 +90,17 @@ compile_ms() {
 
 chain 4000
 chain 16000
-compile_ms 4000
-small=$MS
-compile_ms 16000
-large=$MS
+# The best of three of each, taken in turn, so a moment the runner is busy
+# slows one run, not the comparison (a single run each on macOS ARM64 once
+# measured 220 ms and 3263 ms, 14x, where this machine measures 3.7x).
+small=""
+large=""
+for run in 1 2 3; do
+    compile_ms 4000
+    if [ -z "$small" ] || [ "$MS" -lt "$small" ]; then small=$MS; fi
+    compile_ms 16000
+    if [ -z "$large" ] || [ "$MS" -lt "$large" ]; then large=$MS; fi
+done
 
 if [ "$large" -gt "$LIMIT_MS" ]; then
     echo "  [FAIL] order_effects_scaling: a chain of 16000 calls took ${large} ms to compile (ceiling ${LIMIT_MS} ms)"