feat(binary-object): admit trusted scalar scripts

Author: doodlewind

README.md

@@ -52,6 +52,10 @@ The file loader follows QuickJS policy: `.json` is strict JSON,
 file without that attribute remains a JavaScript module. Main files and
 dependencies are read as explicitly sized byte buffers.
 
+Rust embedders can also use `Context::read_trusted_scalar_script` for the
+current verified subset of QuickJS 2026-06-04 BC5 Script bytecode. It is a
+narrow pre-parity API, not a general untrusted-bytecode loader.
+
 ## Status
 
 - [Current implementation status](docs/status.md)

dev-support/quickjs-c-oracles.tsv

@@ -7,7 +7,7 @@ function-bytecode-nested-closure	function-bytecode	tests/fixtures/function_bytec
 function-bytecode-non-string-properties	function-bytecode	tests/fixtures/function_bytecode_non_string_properties.c	3d15e8f1f88a08c6fa4e36dc07d53a6e8c23c1ca6151468140255115325a7dda	tests/fixtures/function_bytecode_non_string_properties.quickjs-2026-06-04.txt	db6592def2d6533912f15e56b6498ff70a4d32cd69ac0f96b774653e7ab99e78	enumerable symbol and private property filtering before value traversal in bytecode writes
 function-bytecode-reference-boundary	function-bytecode	tests/fixtures/function_bytecode_reference_boundary.c	fd31889a9404350cec51d2e6dd16ab886475cb46067296ab8d516fa6446e5116	tests/fixtures/function_bytecode_reference_boundary.quickjs-2026-06-04.txt	392c993f7f48103e3cb4a7b7140c1fe5fec554e75262f79d5a7bbf99157251ea	shared object-reference table across nested function constant-pool boundaries
 function-bytecode-sab-reference	function-bytecode	tests/fixtures/function_bytecode_sab_reference.c	548f92e81c14f0ceb6e75ba11a2d09c161b8d2f19e39d7e360d32aff15fa887c	tests/fixtures/function_bytecode_sab_reference.quickjs-2026-06-04.txt	7b8f31ef9d6e7b9b8720ebc5b34f9b0f01a147dced381e219d8245b8160a6366	whole-image FunctionBytecode, TypedArray, and SharedArrayBuffer reference and redacted side-table contract
-function-bytecode-wire	function-bytecode	tests/fixtures/function_bytecode_wire.c	c3f3d0907093a3d9285b3cf4989567adbbeee76005336f880decc160a95b6630	tests/fixtures/function_bytecode_wire.quickjs-2026-06-04.txt	f6f4d9650a37529815e7228a5438cb1051190961b2b3771b0465e0f7eb26dfb8	stripped return-42 function bytecode wire and fresh-runtime evaluation contract
+function-bytecode-wire	function-bytecode	tests/fixtures/function_bytecode_wire.c	e24109dd0409795227a569266123dc86cec1c5ef3ee0f566f55cd2f976bae502	tests/fixtures/function_bytecode_wire.quickjs-2026-06-04.txt	47b96b15904b1ede1c9e853cb74d66ee63cabd0e14053100ce93c1c3292c6047	stripped return-42 function bytecode wire, compatible scope metadata, fresh-runtime evaluation, and malformed ULEB, atom, string, bytecode length, ArrayBuffer, and TypedArray read diagnostics
 function-bytecode-writer-flags	function-bytecode	tests/fixtures/function_bytecode_writer_flags.c	d5494b0bce19e530d8c6f2a8b5a8ae20476e17b03c34335ae58c56544ff367d1	tests/fixtures/function_bytecode_writer_flags.quickjs-2026-06-04.txt	95665dc04cb18780505d0a8c592d8ce66b601c77049aa9eb7f1925b1fda73d95	keep-source, strip-source, and strip-debug nested function bytecode writer and BSWAP identity contract
 import-attributes	module	tests/fixtures/module_import_attributes_loader2.c	d243a74b07d59d60f4d811c66447087547a43c5541baf60eb48b7d4c337e2863	tests/fixtures/module_import_attributes_loader2.quickjs-2026-06-04.txt	31121aad6e62055f7389392c83c09efaa225fa126b27bb9c08db6d8daca41e28	loader2 import-attributes contract
 import-meta	module	tests/fixtures/module_import_meta_host.c	e695e55164c6c07440e5f05135f14fe959367836e5380f7fc245d409130b503d	tests/fixtures/module_import_meta_host.quickjs-2026-06-04.txt	928013ebd2080271e69a56516d5dd024e76cdd94fdb9bdc8fc27c08ece0efc8f	canonical host import.meta contract

docs/status.md

@@ -62,6 +62,10 @@ The exact profile, inputs, summary, line counts, and report hashes live in
   `import.meta` `url`/`main`; qjs-compatible side-effect-free structured
   `print`/`console.log` output with byte-exact WTF-8 String transport; plus a
   Rust/WASM browser playground
+- a narrow trusted-bytecode Rust API for the pinned BC5 branch-free scalar
+  Script cohort; it completes the compatible whole-image read, translates an
+  inert DTO to typed Rust instructions, and enters the ordinary verifier and
+  transactional publication path before execution
 
 The public API and Test262 runner now report the same engine diagnostics.
 Detached public bytecode/VM execution has been retired, the Test262 runner
@@ -199,14 +203,22 @@ Ordinary-object writes match `JS_WriteObjectTag` by omitting enumerable symbol
 and private-name properties before their values can affect atoms, traversal,
 references, or resource accounting. A complete encoded-size proof precedes
 the final bounded little-endian emission; failed authentication never returns
-a partial buffer. This remains an internal archival codec, not an execution or
-public bytecode-loading path.
+a partial buffer. The canonical writer and general whole-image model remain
+internal archival facilities rather than a general public bytecode surface.
+The one public read path is deliberately narrower: it accepts only a stripped
+Script root with one completion local and the release-pinned
+`push_i8; set_loc0; return` family, after the entire image has decoded in
+QuickJS-compatible mode.
 The decoder and writer planner are physically split into shared-driver,
 Function, and Module files while retaining one frame/task stack and one set of
 atom, reference, preorder, and budget state. All binary-object submodules are
 private. A self-testing architecture gate rejects VM/compiler and executable
 bytecode dependencies, runtime consumers, crate-surface exports, and widened
-module visibility before fast CI or the parity slice can proceed.
+module visibility before fast CI or the parity slice can proceed. Its sole
+runtime-facing facade exposes an inert scalar draft to one sibling bridge; a
+self-testing consumer gate rejects any second reader, raw image leak, heap/VM
+dependency, verifier bypass, direct bytecode root construction, or alternate
+publication path.
 The same gate rejects shared-memory runtime types, `unsafe`, raw pointers,
 `NonNull`, and native raw-ownership bridges anywhere in the archival codec.
 An authenticated SharedArrayBuffer C oracle pins writer side-table order,
@@ -216,7 +228,17 @@ tests consume those three exact shapes with non-zero typed tokens and prove
 that changing the native token leaves the completed archive identical.
 An authenticated public-C-API oracle pins stripped `42;` as a 25-byte
 BC5 vector, reads it in a fresh QuickJS runtime, evaluates it to 42, and gates
-the Rust prefix codec against the exact bytes. A second authenticated 110-byte
+both the Rust codec and trusted scalar execution path against the exact bytes.
+The same oracle pins compatible 32-bit `scope_next` wrapping, exact
+`SyntaxError` diagnostics for wrong-version, truncated, malformed-ULEB, and
+invalid-atom inputs, `InternalError` for an oversized string declaration and
+the allocation failure from a signed high-bit bytecode length, and the
+`TypeError`/`RangeError` branches for malformed ArrayBuffer and
+TypedArray layouts. Rust maps these authenticated reader branches without
+collapsing them into one error class; compatible high-bit metadata that
+QuickJS accepts but this cohort cannot model, including Module indices,
+remains non-JavaScript `Unsupported` with no pending exception. A second
+authenticated 110-byte
 vector pins a root-to-outer-to-inner constant-pool chain, the captured closure
 descriptor, and fresh-runtime evaluation to 42. A third authenticated 75-byte
 reference vector proves that neither the outer nor nested FunctionBytecode
@@ -241,8 +263,10 @@ and retains the function code, view/backing identity, reference numbering, and
 one backing descriptor in a single `ArchivedBytecodeImage`. Additional
 whole-image vectors prove that two complete SAB records with the same token
 share one archive backing while distinct tokens retain two ordered backings.
-Rust does not execute that archived function; the return-42 receipt remains
-the pinned QuickJS C-oracle result. Authenticated negative vectors also pin
+Rust does not execute the transport archive's embedded function; its return-42
+receipt remains the pinned QuickJS C-oracle result. The separate ordinary
+25-byte scalar image is now translated and executed by Rust through the full
+verified publication path. Authenticated negative vectors also pin
 QuickJS's
 three diagnostic classes when FunctionBytecode appears as the
 child of ObjectValue, Date, or
@@ -296,14 +320,15 @@ FunctionBytecode, and Module before their payloads; only its inseparable
 transport-aware counterpart admits SAB into `ArchivedWireGraph`. The ordinary
 `BytecodeImage` reader still rejects SharedArrayBuffer, while its separate
 transport-aware counterpart atomically binds the completed image to the
-authenticated occurrence table as `ArchivedBytecodeImage`. Neither archive
-exposes a bare graph/image or descriptor-table split, and neither reader is a
-public binary-object API. The canonical image writer continues to reject every
+authenticated occurrence table as `ArchivedBytecodeImage`. Neither transport
+archive exposes a bare graph/image or descriptor-table split, and neither
+transport reader is a public binary-object API. The scalar API cannot consume
+or expose either archive. The canonical image writer continues to reject every
 reachable archived SAB because there is no live backing capability, ownership
 callback bridge, or occurrence-side-table output; this milestone is decode,
-not encode or round-trip support. A heap materializer, native-code semantic
-verifier/translator, public read/write flags, and a public authenticated
-whole-image host bridge remain future milestones.
+not encode or round-trip support. A general heap materializer, broader
+native-code translation, public QuickJS-compatible read/write flags, and a
+public authenticated whole-image host bridge remain future milestones.
 In addition,
 `num-bigint` lacks fallible construction, so heap materialization, decoder OOM
 mapping, and allocator fault-injection remain hardening gates before untrusted