chore(release): v1.9.0 — changelog, version bump, and CI-parity guard

CHANGELOG carries the release; build.zig.zon moves to 1.9.0.

Rides with it, found by checking CI before tagging: budget_thread_ownership.sh
used a bare `timeout` and python3 clock, and the CI macOS runner ships neither
GNU timeout nor gtimeout — exit 127, the step failed at 0s. Locally green, red
on push, the SECOND time this exact class has bitten (check_doc_coverage.sh,
2026-08-04), both times with the in-repo `run_bounded` fix sitting unused.

So the fix is mechanical this time: scripts/check_portable_timeout.sh fails
the gate (smoke included) on any bare `timeout` in a gate-reachable script —
every test/e2e/*.sh plus every scripts/*.sh named by run_all.sh — with the
clj-requiring dev tools exempt by explicit list. The e2e itself moves to
run_bounded + bash SECONDS. Local-vs-CI parity is a check, not a memory.

run_gate's default timeout rises 600 -> 900 s: a cold-cache serial full gate
measured over 600 (the two zig build test steps alone were 271 s), and a
timeout that kills a healthy gate teaches the wrong lesson. Warm gate: 283 s.

Pre-tag cadence run: full gate 429/0, lib_conformance --all regenerated
COVERAGE.md, verify_projects 19/19.

Smell-audited: 2: the user asked whether CI was actually green — it was not,
and the divergence class already had a precedent and an unused in-repo fix.
The guard makes the class mechanical rather than remembered, per the same
posture as check_epipe_head / gate_parity.

Author: chaploud

.dev/handover.md

@@ -13,13 +13,16 @@
   `1ecc7a8a` (zwasm main; carries #157 component export index space + #158/#159
   the WASI capture cap — both load-bearing for cljw, unlike the v2.4.0 tag it
   replaced. Tagging zwasm is user-only, its ADR-0156). Latest release:
-  **v1.8.0** (2026-08-04; multi-export components load, `wasm/run` gains
-  output + wall-clock bounds, `clojure.core.reducers` lands, and `(doc reduce)`
-  finally prints something). CHANGELOG is the release-history SSOT.
-- **First task on resume**: the remaining distribution repos —
-  `cw-playground`, `cw-serverless-demo`, `cw-arcade`. The homebrew tap is DONE
-  (cljw 1.8.0 + zwasm 2.4.1, `brew audit` clean after dropping the redundant
-  explicit `version` — Homebrew scans it from the release URL).
+  **v1.9.0** (2026-08-05; the eval budget bounds blocking calls and follows
+  spawned work, data errors are catchable, regex gains named groups /
+  lookbehind / `\A\z\Z` / class algebra, multidim aget/aset, and the GC
+  stops taxing long-running programs 2-4x — D-571/573/446/447 discharged).
+  CHANGELOG is the release-history SSOT.
+- **First task on resume**: re-pin the demo repos (`cw-playground`,
+  `cw-serverless-demo`) to v1.9.0 via their `check_version_pins.sh
+  --set-cljw` and verify the fly deploys — the playground's malformed-JSON
+  400 handler only takes effect with the new pin. Homebrew tap: bump to
+  1.9.0 (same flow as 1.8.0, which is DONE and `brew audit` clean).
   Release-process note worth keeping: **cutting the GitHub release by hand
   before the tag workflow runs breaks the artifact upload**. zwasm's workflow
   did an unconditional `gh release create`, which failed on "already exists"

CHANGELOG.md

@@ -7,6 +7,67 @@ first stable `1.0.0` tag; pre-1.0 `alpha` / `rc` tags may still change surfaces.
 
 ## [Unreleased]
 
+## [1.9.0] - 2026-08-05
+
+**Upgrade if you run untrusted code under `cljw.eval/with-budget`, parse
+untrusted JSON/EDN, use long-running programs (the GC got a lot faster on
+them), or want named groups / lookbehind / `\A \z \Z` / class algebra in
+regexes.** MINOR rather than PATCH because behaviour changes: code that
+relied on a blocking call outliving its budget now raises.
+
+### Changed
+
+- **The eval budget's wall-clock deadline now bounds blocking calls — all of
+  them.** `(Thread/sleep 25000)` under a 3 s deadline used to return normally
+  after 25 s; `@(promise)` under a deadline used to park forever. Every
+  blocking primitive (`future`/`promise` deref, timed deref, `Thread/sleep`,
+  `await`) now waits on a latch bounded by `min(caller timeout, budget
+  deadline)`.
+- **The budget follows the work, not the thread.** A `Thread.`, `future` or
+  agent action spawned inside a `with-budget` extent inherits the budget —
+  same absolute deadline, same shared (atomic) step ceiling — and keeps it
+  even if it outlives the extent. A spawned 60 s sleep under a 500 ms
+  deadline used to hold the process for the full 60 s; it now dies at the
+  deadline. A compute loop cannot escape the step ceiling by moving onto a
+  spawned thread.
+- **A rejection caused by bad DATA is now catchable.** Malformed JSON/EDN
+  input, wrong-typed arguments (`clojure.string/replace`, `deliver`, walk
+  callbacks, `*out*` bindings), malformed form shapes under `eval` /
+  `read-string` (libspecs, destructuring, `ns` directives, reader
+  conditionals) and malformed regex patterns all raise catchable errors, as
+  JVM Clojure does — ~60 sites reclassified, each verified against the
+  oracle. Genuinely unsupported features stay deliberately uncatchable.
+  Messages improve with it: "deliver: expected a promise, got integer"
+  instead of "… is not supported in ClojureWasm".
+
+### Added
+
+- **Regex: named groups** `(?<name>e)` (with `(.group m "name")`),
+  **lookbehind** `(?<=)` / `(?<!)`, **`\A` `\z` `\Z` anchors**, **nested
+  character-class unions** `[a[b]]` and **`&&` intersection**
+  (`[a-z&&[^m-p]]`), and empty alternatives/groups (`()`, `a|`).
+  Backreferences are declined by design — the matcher guarantees linear-time
+  matching (the RE2 posture), and a backreference would force backtracking.
+- **Multi-dimensional `aget` / `aset`** and the 8 typed `aset-*` multidim
+  arms: `(aget a i j)`, `(aset a i j v)` on nested arrays, exactly clj's
+  variadic recursion.
+
+### Fixed
+
+- **Long-running programs stopped paying a 2-4x GC tax.** The collection
+  trigger is steered by the measured GC time share (the same control variable
+  SubstrateVM sizes its heap with), and live-set accounting now counts what
+  an object owns (string payloads, array elements, bignum limbs) instead of
+  only its 32-byte record. A breadth-first search went 58.9 s → 17.7 s
+  (1624 → 114 collections); a 200k-string workload went 263 → 55 collections.
+  Short scripts and benchmarks are unchanged.
+- **`@(future (Thread/sleep 2000))` ran 17% long** (2321-2358 ms) with no
+  budget armed at all — the cancel poll sliced every worker sleep. Waits are
+  latch-based now: 2000-2001 ms, and `future-cancel` wakes a sleeping worker
+  in 0 ms instead of up to 20 ms.
+- **`(Thread/sleep <huge long>)` aborted the process** with an integer
+  overflow; it now sleeps, as clj does.
+
 ## [1.8.0] - 2026-08-04
 
 **Upgrade if you use Wasm components, or if you use `doc` / `find-doc`.**

build.zig.zon

@@ -1,6 +1,6 @@
 .{
     .name = .cljw,
-    .version = "1.8.0",
+    .version = "1.9.0",
     .fingerprint = 0x1869d207073beffa,
     .minimum_zig_version = "0.16.0",
     .dependencies = .{

scripts/check_portable_timeout.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# check_portable_timeout.sh — no bare `timeout` in anything the gate runs.
+#
+# The CI macOS runner ships neither GNU `timeout` nor coreutils `gtimeout`:
+# a bare `timeout 30 cmd` exits 127 there, so the step fails at 0s — locally
+# green, red on every push. This class has now bitten twice:
+#   2026-08-04  scripts/check_doc_coverage.sh   (fixed with run_bounded)
+#   2026-08-05  test/e2e/budget_thread_ownership.sh
+# Both times the fix already existed in-repo (`run_bounded`: timeout, else
+# gtimeout, else unbounded) and was not used because nothing enforced it.
+# This check is the enforcement: local-vs-CI parity must be mechanical, not
+# a thing each author remembers (same posture as check_epipe_head.sh and
+# gate_parity for their classes).
+#
+# Scope = what the gate executes: every test/e2e/*.sh, plus every
+# scripts/*.sh referenced by test/run_all.sh. Dev-machine tools that REQUIRE
+# a JVM clj (clj_diff_sweep, lib_conformance, extract_core_meta,
+# verify_projects) never run on CI and are exempt — listed explicitly so a
+# new gate reference to one of them trips this check and forces the
+# decision.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+EXEMPT='clj_diff_sweep.sh|lib_conformance.sh|extract_core_meta.sh|verify_projects.sh|run_remote_ubuntu.sh|run_gate.sh'
+
+# Gate-reachable scripts: e2e + scripts named in run_all.sh.
+files=(test/e2e/*.sh)
+while IFS= read -r f; do
+    [[ -f "$f" ]] && files+=("$f")
+done < <(grep -oE 'scripts/[a-z_0-9]+\.sh' test/run_all.sh | sort -u)
+
+fail=0
+for f in "${files[@]}"; do
+    base=$(basename "$f")
+    [[ "$base" =~ ^($EXEMPT)$ ]] && continue
+    # A bare invocation is `timeout <digits>` at a command position, outside
+    # the `command -v timeout` feature-probe line of a run_bounded helper.
+    hits=$(grep -nE '(^|[ \t(;&|])g?timeout +[0-9]' "$f" | grep -v 'command -v' || true)
+    if [[ -n "$hits" ]]; then
+        echo "check_portable_timeout: bare timeout in $f (CI macOS has none — use a run_bounded helper):" >&2
+        sed 's/^/    /' <<< "$hits" >&2
+        fail=1
+    fi
+done
+
+if [[ "$fail" -eq 0 ]]; then
+    echo "check_portable_timeout: ok — no bare timeout in gate-reachable scripts"
+fi
+exit "$fail"

scripts/run_gate.sh

@@ -18,7 +18,7 @@
 #   2. Reap `cljw` probes orphaned to PID 1 (re-parented when their gate
 #      died) — precise: ppid==1 only, so a live gate's children and any
 #      legitimate interactive `cljw` are untouched.
-#   3. Run exactly ONE gate under a bounded timeout (default 300 s —
+#   3. Run exactly ONE gate under a bounded timeout (default 900 s —
 #      generous for a ~190 s parallel / ~350 s serial gate once nothing
 #      contends; a gate that exceeds it is stuck, not slow. Raised to 600 with
 #      --serial-e2e now the default here: the serial path is ~2x the parallel
@@ -38,7 +38,7 @@ set -uo pipefail
 cd "$(dirname "$0")/.."
 
 SELF=$$
-TIMEOUT="${GATE_TIMEOUT:-600}"
+TIMEOUT="${GATE_TIMEOUT:-900}"
 
 reap_gates() {
     local pid ppid n

test/e2e/budget_thread_ownership.sh

@@ -26,44 +26,56 @@ BIN="zig-out/bin/cljw"
 [ -n "${CLJW_SKIP_BUILD:-}" ] || zig build -Dwasm -Doptimize="${CLJW_OPT:-ReleaseSafe}" >/dev/null
 
 fail() { echo "FAIL $1" >&2; exit 1; }
-now_ms() { python3 -c 'import time; print(int(time.time()*1000))'; }
+
+# Portable bounded run: GNU `timeout`, else macOS coreutils `gtimeout`, else
+# unbounded (the CI macOS runner ships NEITHER — a bare `timeout` exits 127
+# there and fails the step at 0s, which is exactly how this file broke CI on
+# 2026-08-05; scripts/check_portable_timeout.sh now guards the class). Every
+# case's expressions are deadline-bounded by the feature under test, so the
+# unbounded fallback cannot hang past the budget it asserts.
+run_bounded() {
+    local secs="$1"; shift
+    if command -v timeout >/dev/null 2>&1; then timeout "$secs" "$@"
+    elif command -v gtimeout >/dev/null 2>&1; then gtimeout "$secs" "$@"
+    else "$@"; fi
+}
 
 # --- (a) a sleeping Thread dies at the deadline; the process is not held ---
 # Before: the process hung for the worker's full 60 s sleep (the join-at-exit
 # barrier waited on an unmetered non-daemon thread).
-t0=$(now_ms)
-got=$(timeout 30 "$BIN" - <<'EOF' 2>/dev/null
+SECONDS=0
+got=$(run_bounded 30 "$BIN" - <<'EOF' 2>/dev/null
 (println (cljw.eval/with-budget {:deadline-ms 500}
   (fn [] (.start (Thread. (fn [] (Thread/sleep 60000)))) :spawned)))
 EOF
 ) || fail "thread_sleep_dies_at_deadline: non-zero exit"
-elapsed=$(( $(now_ms) - t0 ))
+elapsed=$SECONDS
 grep -qx ':spawned' <<< "$got" || fail "thread_sleep_dies_at_deadline: got '$got'"
 # Order-of-magnitude bound (test_taxonomy.md): catches "waited out the 60 s
-# sleep", not scheduling noise.
-[ "$elapsed" -lt 15000 ] || fail "thread_sleep_dies_at_deadline: process held ${elapsed}ms (worker not bounded)"
-echo "PASS thread_sleep_dies_at_deadline (${elapsed}ms)"
+# sleep", not scheduling noise. Bash SECONDS — no external clock needed.
+[ "$elapsed" -lt 15 ] || fail "thread_sleep_dies_at_deadline: process held ${elapsed}s (worker not bounded)"
+echo "PASS thread_sleep_dies_at_deadline (${elapsed}s)"
 
 # --- (b) a compute-loop Thread trips the SHARED step ceiling and dies ---
 # The ceiling is high enough that the worker cannot trip before the extent
 # exits — before the fix it then span forever unmetered and the process hung.
-t0=$(now_ms)
-got=$(timeout 60 "$BIN" - <<'EOF' 2>&1
+SECONDS=0
+got=$(run_bounded 60 "$BIN" - <<'EOF' 2>&1
 (println (cljw.eval/with-budget {:max-steps 30000000}
   (fn [] (.start (Thread. (fn [] (loop [i 0] (recur (inc i)))))) :done)))
 EOF
 ) || fail "thread_loop_trips_shared_steps: non-zero exit"
-elapsed=$(( $(now_ms) - t0 ))
+elapsed=$SECONDS
 grep -qx ':done' <<< "$got" || fail "thread_loop_trips_shared_steps: got '$got'"
 grep -q 'step budget' <<< "$got" || fail "thread_loop_trips_shared_steps: worker did not trip the shared ceiling: '$got'"
-[ "$elapsed" -lt 45000 ] || fail "thread_loop_trips_shared_steps: process held ${elapsed}ms"
-echo "PASS thread_loop_trips_shared_steps (${elapsed}ms)"
+[ "$elapsed" -lt 45 ] || fail "thread_loop_trips_shared_steps: process held ${elapsed}s"
+echo "PASS thread_loop_trips_shared_steps (${elapsed}s)"
 
 # --- (c) a future spawned in the extent dies at the deadline ---
 # The process does not wait on future workers at exit, so assert in-process:
 # 1.5 s after a 400 ms deadline the future must be realised (dead), not still
 # sleeping out its 60 s. This is the long-lived-server case (the playground).
-got=$(timeout 30 "$BIN" - <<'EOF' 2>/dev/null
+got=$(run_bounded 30 "$BIN" - <<'EOF' 2>/dev/null
 (def f (atom nil))
 (cljw.eval/with-budget {:deadline-ms 400}
   (fn [] (reset! f (future (Thread/sleep 60000))) :spawned))
@@ -77,7 +89,7 @@ echo "PASS future_dies_at_deadline"
 # --- (d) an agent action sent in the extent dies at the deadline ---
 # The action sleeps 60 s; 1.5 s after the 400 ms deadline the agent must be
 # failed (the budget raise is the action's error), not still parked.
-got=$(timeout 30 "$BIN" - <<'EOF' 2>/dev/null
+got=$(run_bounded 30 "$BIN" - <<'EOF' 2>/dev/null
 (def a (agent 0))
 (cljw.eval/with-budget {:deadline-ms 400}
   (fn [] (send-off a (fn [_] (Thread/sleep 60000) 1)) :sent))
@@ -89,7 +101,7 @@ grep -qx '\[:failed true\]' <<< "$got" || fail "agent_action_dies_at_deadline: g
 echo "PASS agent_action_dies_at_deadline"
 
 # --- (e) no budget => spawned threads stay unmetered (the default is unchanged) ---
-got=$(timeout 30 "$BIN" - <<'EOF' 2>/dev/null
+got=$(run_bounded 30 "$BIN" - <<'EOF' 2>/dev/null
 (def done (promise))
 (.start (Thread. (fn [] (Thread/sleep 200) (deliver done :ok))))
 (prn [:joined @done])
@@ -101,7 +113,7 @@ echo "PASS no_budget_unmetered"
 # --- (f) after the extent exits cleanly, NEW spawns are not metered by it ---
 # The budget follows work spawned INSIDE the extent; work spawned after must
 # not inherit a stale reference.
-got=$(timeout 30 "$BIN" - <<'EOF' 2>/dev/null
+got=$(run_bounded 30 "$BIN" - <<'EOF' 2>/dev/null
 (cljw.eval/with-budget {:deadline-ms 300} (fn [] :done))
 (Thread/sleep 400)
 (def done (promise))

test/run_all.sh

@@ -415,6 +415,7 @@ run_step "doc_coverage"         "bash scripts/check_doc_coverage.sh"
 # producer takes SIGPIPE, the script dies before printing its diagnostic, and it
 # only bites on a loaded machine. ab84126b fixed four sites and left 24.
 run_step "epipe_head"           "bash scripts/check_epipe_head.sh"
+run_step "portable_timeout"      "bash scripts/check_portable_timeout.sh"
 # The local full gate and CI's must be the SAME run. ci_gate.sh claimed they
 # were; nothing checked, and they were not (parallel vs serial e2e).
 run_step "gate_parity"          "bash scripts/check_gate_parity.sh"