chore: main's own checks green again (sorted compile env list and its audit, file-size counts, GC header registry, held/named length unit tests) - #14526

What

Main's own checks were red in several places that no lane PR owned. This PR makes them green again. No lowering, fact or runtime code changes.

1. COMPILE_ENV_VARS is sorted again, and the audit behind it runs

The list is documented "sorted and unique", and compile_env::tests::codegen_env_vars_are_build_cache_inputs asserts it, but lane switches had been appended by topic (20 adjacent pairs out of order). The assert sits in front of the unregistered-read check, so that check had not run for days.

• The list is sorted (byte order, as the test's < compares) and unique: 302 names.

• With the sort in place the audit reported 11 compiler env reads that were neither keyed nor excluded. Five change emitted code and are now cache inputs:

  • PERRY_FACTS_DCE (dead bodies become traps),
  • PERRY_INDEX_RAW_I32 (the raw $i32 body of indexed clones),
  • PERRY_SNAP_CENSUS (census compiles declare and link the TLS anchors and entry hooks),
  • PERRY_WP_ELEMENT_READS (withholds the proven element reads),
  • PERRY_WP_REP_P2 (typed parameters).

  Before this, a build with one of them set could reuse an object or a finished build made without it.

• Six only print or dump and are excluded with a one-line reason each: PERRY_ARRAY_BASE_DIAG, PERRY_FACTS_ZERO_SIGN_WHY, PERRY_REST_DIAG, PERRY_SNAP_FACTS, PERRY_TEST_IR_OUT (read only by perry-codegen unit tests), PERRY_VALUE_RECORDS_TRACE.

Cache keys. Both consumers walk the list in order: object_cache::compute_object_cache_key hashes name=value per entry, and build_cache::current_env stores a Vec that is compared with !=. So the order is part of both keys: every existing object-cache entry and build-cache manifest misses once after this PR and is rebuilt. Nothing depends on a position in the list, so nothing else changes.

2. scripts/check_file_size.sh: six stale allowlist counts re-recorded

--update semantics; what grew each file since its count was last set:

runner.rs grew by 1103 lines in three commits. Its entry already says "split after #14259 lands (snap census owner)"; this PR only re-records the count. gen_expr.rs (over the cap, not allowlisted) was split in #14525.

3. scripts/check_gc_header_constants.py: the registry follows the mask split of 39359ae

The script reported GC_OBJECT_METHOD_GUARD_MASK_I32 = 0x80FF against a derivation that includes OBJ_FLAG_HAS_DESCRIPTORS (0x080080FF), and GC_OBJECT_FIELD_GUARD_MASK_I32 as unregistered. The compiler is right and the script was stale:

• 39359ae (2026-11-04, "method guards stop reading the descriptor bit") split the one mask in two on purpose. A method-identity guard needs no attribute bit: an own key named like the method is in the key list, so the class/ShapeId word or the family word already misses. Field-layout guards (raw slot loads and stores) keep the bit under the new GC_OBJECT_FIELD_GUARD_MASK_I32. The commit changed codegen, the runtime and the unit test gc_header_mask_preserves_the_direct_method_contract (which pins both values and asserts that the method mask ignores the bit and the field mask does not), but not this script's registry.
• Runtime side unchanged: GC_FLAG_FORWARDED = 0x80 (byte 1), OBJ_FLAG_HAS_DESCRIPTORS = 0x800 (the reserved half), so 0x80FF and 0x080080FF are exactly the two documented masks.
• Probe (qb10, main 3cd7ef9): a 36-line program that calls a class method through a warmed direct-method site and then, on the same receiver, defines an own accessor / non-writable data property of the method's name, a descriptor on another key, freezes / seals / prevents extensions, assigns and deletes a shadow, defines the shadow in the constructor, and redefines the prototype's method as an accessor and as non-writable data. Its IR has 28 guards with the 0x80FF mask; output equals node in default and check mode.

The registry now holds both masks with their derivations; the check and its self-test pass.

4. Negative unit tests that passed for the wrong reason

perry-wpfacts tests/held_lengths.rs: the three negative cases (handed, closed, Holder.walk) bore their Arrays at one site (mk), and a token is its birth site. The closure of one case and the field of another therefore refused that token for all three (probe on main: each of them, and grow's parameter, prints refused=captured:local+…+heap:field:tok24), so handed never reached the hand-over rule and each test would have passed with its own construct removed. The fact is also asked only of Rep::Arr locals, which no test asserted. Now every case bears its Arrays at its own site, and

• a positive case asserts Rep::Arr and the fact;
• a negative case asserts Rep::Arr, the missing fact and the rule that refused it, read off the # held_len … refused= dump line: event:own (the function pushes), passed:own (handed to a call), captured (a closure), heap (a field);
• each negative case has a positive twin that differs only in the refused construct (grow(xs) / touch(xs.length), a closure over xs / over a module let, this.items / a frame local, a.push(1) / a.length).

tests/named_lengths.rs (from #14521) gets the same treatment: every case asserts Rep::Arr first, the three negative cases assert refused=event:other-name(, and picked and Bag.walk get twins that change the length through the local's own name.

5. Two more red gates with a mechanical fix

• scripts/runtime_abi_check.py --check-wasm-abi: crates/perry-codegen/src/wasm32/runtime_abi.tsv was stale; regenerated with --emit-wasm-abi (16 new runtime exports: record arrays, deferred namespaces, snap census sites, setenv/unsetenv/gettimeofday; one changed signature, js_snap_entry_module). The table feeds the wasm32 target only.
• scripts/unrooted_local_shape.py --check: stale baseline (a file reached zero findings); --update-baseline ratchets it down, 208 -> 178.

Other static gates that are red on main and are not touched here are listed in the comment below.

Switch: none (no lowering change; the five registrations are existing switches becoming cache inputs).

Checks

Head 3c83e9f on main 3cd7ef9.

• qb10 cargo test --release -p perry compile_env: 33 passed, 0 failed (on main: codegen_env_vars_are_build_cache_inputs fails at the sort assert; with only the sort applied it fails with the 11 names above).
• qb10 cargo test --release -p perry-wpfacts --lib -- held_lengths named_lengths: 16 passed, 0 failed.
• qb10 scripts/check_file_size.sh: rc 0. scripts/check_gc_header_constants.py and its --self-test: rc 0. runtime_abi_check.py --check-wasm-abi, unrooted_local_shape.py --check: OK.
• Mac cargo check with tests: -p perry --tests, -p perry-wpfacts --lib --tests, -p perry-codegen --lib --tests: clean.
• Chess, base (main 3cd7ef9) vs this PR, one release build each on qb10: in the comment below.

Long gates (IR census, vf, tssrc, Supabase, skin size, full suites): not run.