Adapt method overrides across ABI differences, write Error codes, and close wrapper-reachable gaps

[cramforce]

Stacked on #1433. This PR lets method overrides differ from the method they override in parameter and result types, as long as each value converts. It also handles writes and presence tests of properties on Error values, and fixes several smaller gaps found in code behind generic wrappers.

Summary

• Method override variance. An override no longer has to match the inherited signature exactly.
  • Which overrides qualify: each inherited argument must convert into the override's parameter: equal, wider (contravariant), or a checked extraction from an any slot. The override's result must convert into the inherited result: narrower, a union that converts, a Promise whose payload widens, or any convertible value over an any base. Examples: an async acquire(): Promise<void> over a base that returns any, over an untyped async JavaScript method, or over an async base. A toString(): string | undefined over Error's string.
  • How it lowers: the class keeps the inherited slot %C.m, so virtual dispatch and base-typed callers are unchanged. The slot converts the arguments in and the result out around the override's own body, %C.m$own. When nothing overrides below, TypeScript callers typed with the subclass call $own directly and see the declared result.
  • JavaScript overrides of builtin or TypeScript bases take the same path. One example is zod's ZodError.toString() { return this.message } over Error.prototype.toString. Their callers keep the slot, because a JavaScript result type is only inferred.
  • toString slots hand on what a ToString consumer would make of the result: a toString that returns undefined reads as "undefined" in String(err) and in templates, as in Node.
• err.code = value on Error values typed with an intersection (Error & { code?: string }).
  • String values set the runtime error's code slot, which typed reads, 'code' in err and inspection use. If the error is already reflected as a checked-dynamic object, that object is updated too.
  • Other values clear the slot and keep the dynamic own property.
  • What changed for users: before, err.code = "E1" landed on a dynamic property while err.code read the empty slot, so the read was undefined.
• 'key' in err on Error values, with any receiver: a value narrowed from unknown by instanceof Error, a call result, a caught value.
  • A key the static class declares is true.
  • Otherwise the answer combines two checks: a class test over the subclasses that declare the key, and a runtime lookup of the error's own properties. That covers properties set by Object.assign, by throw sites, or through dynamic writes.
  • stack stays fenced: Node has one, a compiled error has none.
• Object.assign(err, ...sources) onto an Error target, the Object.assign(new Error(message), details) idiom. The sources' own properties land on the error, message, name and code feed back into the typed slots, and the call returns the error itself.
• Error & { status: number; ... } intersections, the type of that idiom's result, are Error values. Members beyond Error's own and the system-error metadata read and write the error's own properties, and each read is checked at its declared type. The intersection is admitted only when every extra member has a type a checked read can produce.
• Catch bindings:
  • catch (e: any) (and catch clauses compiled with useUnknownInCatchVariables off) reads the binding as its checked-dynamic value, like unknown. This covers member reads and writes (e.message = ...; throw e) and assertions (e as Error & { code?: string }).
  • A type guard with more than one statement over a catch binding (isFetchError(err), with an unknown parameter) is called with the caught value, instead of being refused.
  • Error members such as message on a binding narrowed to an interface that extends Error read through the same value.
• Lambda parameters typed any only by their default ((n = lookup() ?? 5) => ...) are checked-dynamic slots, like any parameters of function declarations since Compile event-loop metrics, predicate-narrowed catch bindings and other wrapper-reachable gaps #1433.
• Forwarded rest tuples with optional positions ((...args: Parameters<F>) => fn(...args) for such an F) forward their slots; an omitted argument arrives as undefined, which a default treats as omitted. If the wrapper reads args.length, the existing refusal stays.
• value as never flowing into a typed parameter, from an any or unknown value, takes the checked extraction to the parameter's type, as value as T would. Before, the value was checked as a number.
• Lexical this in a generic function instance no longer resolves to the receiver of whichever caller triggered the instantiation. An instance lowers as if alone. Before, a JavaScript constructor function compiled per call site (readable-stream's CorkedRequest, iconv-lite's stream constructors) hit the fence "the binding 'this' captured through a plain nested function" when first reached from code with its own receiver. That fence now points at the this keyword instead of the entry file's first line.

Forms not covered keep their refusals, or keep running as before:

• Remaining override refusals: overrides whose results do not convert (for example a record over an unrelated record), and generator overrides.
• 'code' in err after an explicit err.code = undefined answers false; Node answers true. Changing the code presence test would change existing programs.
• In JavaScript files, err.code = value keeps the existing dynamic write. Routing it to the code slot changed how the runtime's Readable.from destroy path combines errors (5614-readable-from-iterable-errors), so that file kind keeps its current behavior.
• zod's ZodError constructor now compiles but still contains two runtime fences, previously hidden behind the class-level refusal: new.target.prototype and Object.setPrototypeOf. Constructing a ZodError throws the fence.

Evidence

• New corpus programs (Node vs native, byte-identical, plain and sanitized lanes):
  • 6400: override over an any base
  • 6401: parameter variance
  • 6402: overrides of an untyped JavaScript base
  • 6403: Error code writes
  • 6404: in, Object.assign and Error & {...} intersections
  • 6405: wrapped lambdas with any defaults, optional forwarded tuples, as never arguments
  • 6406: a package constructor function reading its receiver
  • 6407: JavaScript toString overrides of Error
  • 6408: overrides of an untyped async JavaScript base
  • 6409: catch bindings typed any, multi-statement guards, writes into caught errors
• Zero-cost gate against Compile event-loop metrics, predicate-narrowed catch bindings and other wrapper-reachable gaps #1433 (scripts/zero-cost-gate.mjs, bench, the self-hosted compiler and all corpus entries, sharded over three sandboxes):
  • IR, LLVM and release executables are identical for every pre-existing program except three, each an intended change:
    • 5807-worker-error-values and 6390-catch-binding-predicate write err.code = "..." on Error & { code?: string }. The write now lands in the code slot (−8 B).
    • 6394-in-key-error-subclasses adds the runtime own-property lookup to 'key' in err (+0.21%).
  • The new corpus programs are refused by the baseline or are new.
  • Compile time: bench geomean −0.15% (95% CI −1.45% to +0.61%), self-hosted compiler −1.20%.
  • Earlier runs caught three issues, each fixed and re-checked:
    • A "code" literal in the always-linked scr_error.c shifted .rodata in every executable.
    • Functions placed in the middle of scr_json.c changed its emission order, which moved scr_dyn_assign_all. The new C functions now sit at the end of scr_json.c, which already has the literal.
    • JavaScript files writing err.code changed 5614-readable-from-iterable-errors.
• Checks: pnpm manifest and pnpm node-compat (no change), pnpm node-compat:check, lint, format, pnpm test:ts7 --baselines-only (baselines added for 6400–6409), diagnostics, frontend and IR unit tests, and the self-hosted IR build all pass.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
scriptc	Ready	Preview, v0	Oct 20, 2026 5:07pm UTC

[vercel]

Additional findings

1. packages/compiler/src/frontend/lowering/builtins/promisify-callback.ts:284-287 — The typed callback promisify wrapper drops the caller's this receiver, so a promisified unbound method rejects when invoked as a method of its original instance.