Keep the dynamic handle members and error nodes out of typed net, HTTP and child programs

A fully typed net server, HTTP server or child-process program linked the dynamic object model: about 290 KB of a 616 KB HTTP server. Three kinds of reference held it, and none was the program's doing. This cuts them. 117 corpus programs now link no dynamic-tier symbol at all, and none gains one.

What held it

Traced with lld's --why-live and a pass over the live relocations of each link (one chain per symbol hides every root but one).

1. The emitted main installed the handle ops of every unit the program links (scr_net_dyn_install, scr_http_dyn_install, scr_child_dyn_install). The ops tables name every *_dynh_* function.
2. scr_error_set_prop built the error's dynamic node at the throw site. A connect error's address and port, an exec error's status, output and pid: each call ran scr_dyn_from_error, so any program that could raise such an error linked the node builder and everything behind it. With the installs gone this alone kept 185 KB.
3. Typed paths that named a dynamic entry directly: the request settle path called a signal option's disposer through scr_dyn_call; the accept path built the 'drop' event's data object; setHeader with a typed string went through the dynamic coercion; a request without an agent boxed the global agent; the zero-argument write callback shared a binder with the dynamic one.

What changed

• Units install their handle ops where a handle is first boxed. scr_net_socket_to_dyn, scr_net_server_to_dyn, scr_http_req_to_dyn, scr_http_res_to_dyn, scr_http_client_to_dyn and scr_child_to_dyn install on first use, the compiler's to-dyn helpers call them (DYN_HANDLE_BOX_FN, the mechanism scr_dgram_to_dyn already uses), and every internal box goes through them. The linker keeps a unit's dynamic members exactly when linked code can box one of its handles. In a program that links the HTTP unit, net handles box through scr_http_server_to_dyn / scr_http_socket_to_dyn, so a boxed HTTP server always has its 'request' hook.
• The receiver is the one box no unit sees coming: a typed fire pushes (pointer, tag) and scr_dyn_this_get boxes by tag when dynamic code reads this. New runtime feature dynReceiver (the module has dyn.this or dyn.generatorThis, or converts a dynamic value to a function type); main installs before %main only then. Entry points that take a dynamic listener, and the stream bridge that reads a child's stdio through its dynamic members, install too.
• An error's attached properties wait for its node. scr_error_set_prop records (key, value); scr_dyn_from_error applies the recorded ones when it builds the node, in the throw site's order. A recorded code keeps its position (sites that stamp the code slot and then set code after library and reason rely on it). 'key' in err from typed code answers from the record without building the node; util.inspect builds it. Every call site keeps its call; scr_child_error_self uses the new scr_error_set_prop_self.
• The typed paths go through a pointer their dynamic entry sets (scr_http_client_add_abort_signal, scr_net_server_on_drop) or a typed helper (scr_http_validate_header_text, scr_http_request_global). The pointers have external linkage: the compiler folds a static one with a single stored value back into a direct call.

The new functions in scr_json.c sit at the end of the file and are named in the middle only through a constant table, so the unit's existing functions are emitted in their existing order and programs that link none of this keep their bytes.

Behaviour

No change, with one exception that moves towards Node: an error's node is built at the first dynamic read instead of at the throw site, so typed code that assigns err.message before any dynamic read now sees the new message through any as well (the node used to hold the throw site's message). Pinned in 8896-net-error-properties.ts.

New corpus programs, differential against Node in both lanes:

• 8885-net-typed-server-echo.ts, 8886-http-typed-server.ts, 8898-child-typed-exec.ts: fully typed. tests/harness/corpus-dynamic-tier.test.ts holds them to zero dynamic-tier symbols, as bench-dynamic-tier.test.ts holds the benchmarks.
• 8887-net-handles-reach-unknown.ts, 8888-http-handles-reach-unknown.ts: typed handles that reach unknown code late, after typed listeners were registered, and a dynamic 'request' listener on a typed HTTP server.
• 8889-js-net-listener-receiver.js: listeners whose only way to the handle is this.
• 8896-net-error-properties.ts, 8897-child-error-properties.ts: the attached properties through any, in, Object.keys and JSON.stringify, in Node's order.

Numbers (Linux x86-64, release)

The first three were measured on 714482d49 against this branch; the rest are gate rows against e8c933e5d.

Zero-cost gate, --corpus=all, PASS, with --allow for sources that import net, http, https, http2, tls, child_process or assert (and the Intl programs, whose ICU check needs the pattern when their bytes change): 5,350 programs, 2,379 identical, 463 allowed, 2,405 runtime-only, 0 differ.

• 292 executables shrank: median 102 KB, 149 of them by more than 100 KB, 35.6 MB in all. 117 programs (68 child-process, 43 HTTP, 6 net) dropped every dynamic-tier symbol. No program gained one.
• 2,575 executables grew, every one a program that links dynamic-tier symbols before and after: median +256 bytes, 90th percentile +376 bytes, largest +4,496 bytes (0.42%, a dynamic HTTP program). This is the cost of the second change: scr_dyn_from_error tests whether a recorded property waits for the node it builds, and the dynamic HTTP and net programs also take the box functions. A dynamic program that builds no error node is byte-identical.
• Benchmarks: 42 of 58 byte-identical, including every fully typed one. 15 dynamic workloads +192 to +320 bytes. bench-runtime: 65 workloads, 64 neutral, geomean -0.3%; the one outside tolerance (optional-fields +1.7% [+0.2%, +10.2%]) is a typed workload whose executable is byte-identical.
• Full lanes in Sandboxes: plain 21,601 passed, sanitized 18,368 passed; the failures are test timeouts (three.js, an Effect pilot, two Test262 compile timeouts, one npm case that passes when rerun alone, a vendor-cache test and a beforeAll compile). Plain and sanitized native bootstraps pass.
• DYNAMIC_WORKLOADS is unchanged: bench/http-api is the one workload this change touches, and typed JSON.parse still holds it.

🤖 Generated with Claude Code