fix: NaN-abort in cap_ffi/bytes, cap_fs named-string, generic-struct dunder dispatch; consolidate duplicated float-to-int/div-guard/dial code

Four-way audit (VM/opcode layer, native capability modules, compiler
parsing/type-checking, GBC+runtime state) for duplication that had
already drifted or was one edit away from drifting.

Real bugs fixed:
- cap_ffi.zig's extractI64 was missing the isFinite NaN guard cap_net.zig
  already had; bytes.zig's argAsI64 had the same gap but reachable with no
  capability at all (std.bytes.u8(1e300) aborted the host process).
  Consolidated with vm.floatToIntSafe/core.zig's floatToIntChecked into one
  common.safeI64FromFloat used by all five call sites.
- cap_fs_write's content argument used a hand-rolled string-extraction
  switch with no .named_value case, unlike every other string arg in the
  file (which use vms.asStringValue) — rejected named string types.
- structInstanceLitAfterValue (generic-instantiation/type-alias struct
  literals) left no ExprPrimInfo on its result, unlike its sibling
  structInstanceLit — a dunder operator on a generic struct was
  unreachable from a literal built directly in an expression. Fixing this
  needed lookupDunderCallee to fall back to a type name stripped of its
  "[...]" suffix, since generic methods are registered under the
  template's name but field-compatibility checking needs the concrete
  instantiated name.
- Runtime.init() was missing fs_state.setActive, unlike its sibling
  initWithConfig() and unlike every other per-runtime global it pins
  inline in the same function.

Also consolidated (no behavior change): vm.zig's four copies of the
minInt(i64)/-1 division-overflow guard into one divModOverflows helper;
vm_bigint.zig's addBi/subBi into one addSubBi; cap_net.zig's
cap_net_dial/cap_net_dial_tls into one dialImpl.

Verified under standard, -Dpreset=stress, and -Dgc_stress=true builds.

Author: ganehag

CHANGELOG.md

@@ -2,6 +2,69 @@
 
 This changelog tracks notable language/runtime changes by implementation date.
 
+## 2026-08-21
+
+### Audit — duplication/DRY sweep across native modules, VM arithmetic, and the compiler
+
+Four parallel audits (VM/opcode layer, native capability modules, compiler
+parsing/type-checking, GBC+runtime state) went looking for copy-pasted code
+whose copies had already drifted, or were one edit away from drifting, plus
+opportunities to consolidate safely. Confirmed and fixed:
+
+- **cap_ffi.zig's `extractI64`** was missing the `isFinite` NaN guard its
+  sibling `cap_net.zig` copy already had fixed — a NaN passed as an FFI
+  call's int argument reached `@intFromFloat` unchecked (safety-checked
+  illegal behavior, process abort).
+- **bytes.zig's `argAsI64`** had the same gap, and unlike the FFI case is
+  reachable with **no capability required at all** — `std.bytes.u8(1e300)`
+  aborted the whole host process from any script.
+- Both, plus `vm.floatToIntSafe` and `core.zig`'s separate
+  `floatToIntChecked`, were four independent hand-written copies of the
+  same NaN/Infinity/out-of-i64-range check. Consolidated into one
+  `common.safeI64FromFloat`, called from all four sites (`vm.zig`,
+  `core.zig`, `cap_net.zig`, `cap_ffi.zig`, `bytes.zig`).
+- **cap_fs.zig's `cap_fs_write`** extracted its content argument through a
+  hand-rolled `.string`/`.dyn_string`/`.string_view` switch with no
+  `.named_value` case, unlike every other string argument in the file
+  (which already go through `vms.asStringValue`, which does unwrap
+  `.named_value`) — a value of a named string type (`type Path string`)
+  passed as `fs.write`'s content raised a spurious `TypeError`. Now calls
+  `vms.asStringValue` directly, like its neighbors.
+- **`structInstanceLitAfterValue`** (the struct-literal path used for
+  generic instantiations and type aliases of them, e.g. `Box[int]{...}`)
+  left no `ExprPrimInfo` on its result at all, unlike its sibling
+  `structInstanceLit` (plain `Name{...}`) — so a dunder operator
+  (`__add__` etc.) declared on a generic struct was unreachable when the
+  literal was built directly in an expression rather than read back out of
+  a variable first. Fixing this surfaced a second, subtler issue:
+  `lookupDunderCallee` only ever tried the literal's *concrete* qualified
+  name (e.g. `"Box[int]"`), but a generic struct's methods are registered
+  once, type-erased, under the *template's* qualified name (`"Box"`) —
+  while `checkFieldValueCompatibility`'s struct_t case needs the concrete
+  form to validate a field of generic type. `lookupDunderCallee` now falls
+  back to the name stripped of its `[...]` suffix when the direct lookup
+  misses, so both consumers are satisfied from the same value.
+- **`Runtime.init()`** was missing `fs_state.setActive(&rt.fs_mounts)` —
+  every other per-runtime process-global (chunk/globals/heap/vm/tasks/net/
+  http) was pinned inline in this function, just not this one.
+  `initWithConfig()` (its heap-init sibling) already had it.
+- Minor consolidations with no behavior change: `vm.zig`'s four independent
+  copies of the `minInt(i64)/-1` division-overflow guard (already the exact
+  bug class that caused a prior `.mod` bug) now share one `divModOverflows`
+  helper; `vm_bigint.zig`'s `addBi`/`subBi` (identical but for `r.add` vs
+  `r.sub`) now share one `addSubBi` body; `cap_net.zig`'s `cap_net_dial`/
+  `cap_net_dial_tls` (identical but for the scope-check message and which
+  `net_state` function connects) now share one `dialImpl`.
+
+Flagged but deliberately not acted on (real duplication, but perf-critical
+or disproportionate to fix): `fusion_pass.zig`/`vm_defuse.zig`'s mirrored
+per-opcode width tables (encode vs. decode, ~30 opcodes, nothing enforces
+agreement but tests); `gbc_writer.zig`/`gbc_reader.zig`'s hand-rolled
+symmetric section read/write pairs (inherent to a hand-rolled binary
+format); `vm.zig`'s `.div`/`.int_div`/`.rem`/`.mod` int/int fast-path
+guards (already correct, but a function-call indirection in the hottest
+per-instruction dispatch path isn't worth the risk for a one-line check).
+
 ## 2026-08-20
 
 ### Fix — REPL: a string global (bare, or nested in an array/map) silently corrupted on the next line

src/compiler_test.zig

@@ -3177,6 +3177,28 @@ test "compiler: std.bytes decode family matches the native-call path byte for by
 // catchable RangeError like every other out-of-bounds offset — decodeAt's
 // multi-byte variants (everything but byte_at) cast straight to usize
 // without checking the sign first. Fixed with offsetToUsize (bytes.zig).
+// bytes.zig's argAsI64 (backing std.bytes.u8/u16be/pack/slice/etc.) fed a
+// NaN or out-of-i64-range float straight into @intFromFloat, which is
+// safety-checked illegal behavior (process abort) for either — reachable
+// from any script with no capability required, unlike vm.zig/core.zig's
+// analogous conversions which already guarded against this.
+test "compiler: std.bytes.u8 raises RangeError (not a crash) on NaN/Inf/huge float" {
+    var rt = try setup();
+    defer rt.deinit();
+    try runSrc(&rt,
+        \\std := import("std")
+        \\func viaNan() string { return std.bytes.u8(std.math.nan()) }
+        \\func viaInf() string { return std.bytes.u8(std.math.inf) }
+        \\func viaHuge() string { return std.bytes.u8(1e300) }
+        \\func viaOk() string { return std.bytes.u8(65) }
+    );
+    try std.testing.expectError(error.RangeError, rt.callGlobal("viaNan", &.{}));
+    try std.testing.expectError(error.RangeError, rt.callGlobal("viaInf", &.{}));
+    try std.testing.expectError(error.RangeError, rt.callGlobal("viaHuge", &.{}));
+    const ok = try rt.callGlobal("viaOk", &.{});
+    try std.testing.expectEqualStrings("A", try vms.asStringValue(ok));
+}
+
 test "compiler: std.bytes decode family raises RangeError (not a crash) on a negative offset" {
     var rt = try setup();
     defer rt.deinit();
@@ -4325,6 +4347,27 @@ test "compiler: multiple methods on the same generic struct receiver" {
     try std.testing.expectEqual(@as(i64, 3), result.int);
 }
 
+// structInstanceLitAfterValue (the struct-literal path used for generic
+// instantiations, e.g. Box[int]{...}, and type aliases of them) used to
+// leave no ExprPrimInfo on its result at all, unlike its sibling
+// structInstanceLit (plain Name{...}) — so a dunder operator declared on a
+// generic struct was unreachable when the literal was used directly in an
+// expression (not read back out of a variable first, whose static type is
+// tracked separately from ExprPrimInfo).
+test "compiler: dunder operator dispatches on a generic struct literal built directly in an expression" {
+    var rt = try setup();
+    defer rt.deinit();
+    try runSrc(&rt,
+        \\type Box[T] struct { v T }
+        \\func (a Box[T]) __add__(b Box[T]) Box[T] { return Box[T]{ v: a.v + b.v } }
+        \\func direct() int {
+        \\    return (Box[int]{ v: 1 } + Box[int]{ v: 2 }).v
+        \\}
+    );
+    const result = try rt.callGlobal("direct", &.{});
+    try std.testing.expectEqual(@as(i64, 3), result.int);
+}
+
 test "compiler: generic receiver method works for multiple instantiations of same type" {
     var rt = try setup();
     defer rt.deinit();

src/lang/common.zig

@@ -13,6 +13,25 @@ pub fn hashBytes(s: []const u8) u64 {
 
 const std = @import("std");
 
+// @intFromFloat is safety-checked illegal behavior (process abort) for NaN,
+// +/-Infinity, or any magnitude outside i64's range, so every float-to-int
+// conversion anywhere in the engine must reject those first. This exact
+// check was independently reimplemented in vm.zig, core.zig, cap_net.zig,
+// cap_ffi.zig, and bytes.zig — one of those copies (bytes.zig's argAsI64)
+// was missing the `isFinite` guard entirely, letting `bytes.u8(1e300)`
+// abort the whole host process with no capability required. Kept here as
+// the single shared implementation so a future fix (or bounds change)
+// lands once instead of needing to be copied to every call site again.
+pub fn safeI64FromFloat(n: f64) !i64 {
+    if (!std.math.isFinite(n) or
+        n < @as(f64, @floatFromInt(std.math.minInt(i64))) or
+        n >= @as(f64, @floatFromInt(std.math.maxInt(i64)))) return error.RangeError;
+    const t = @trunc(n);
+    const as_i64: i64 = @intFromFloat(t);
+    if (@as(f64, @floatFromInt(as_i64)) != t) return error.RangeError;
+    return as_i64;
+}
+
 pub fn parseFloat(s: []const u8) ?f64 {
     if (s.len == 0) return null;
     var i: usize = 0;

src/lang/compiler.zig

@@ -1205,7 +1205,21 @@ pub const Compiler = struct {
         const dname = dunderMethodName(op);
         if (is_struct) {
             const candidate = std.fmt.bufPrint(buf, "{s}.{s}", .{ type_name, dname }) catch return null;
-            return if (self.registry.hasGlobalFunc(candidate)) candidate else null;
+            if (self.registry.hasGlobalFunc(candidate)) return candidate;
+            // type_name here is a struct literal's ExprPrimInfo.struct_type,
+            // which for a generic instantiation is the CONCRETE qualified
+            // name (e.g. "Stack[int]") — checkFieldValueCompatibility's own
+            // generic-args fallback (this file, struct_t case) needs that
+            // exact form to validate a field assignment. But a generic
+            // struct's methods are registered once, type-erased, under the
+            // bare template name (methodDecl's qrecv_type, computed before
+            // the receiver's `[T]` is parsed) — so retry stripped down to
+            // the part before '[' when the direct lookup misses.
+            if (std.mem.indexOfScalar(u8, type_name, '[')) |bi| {
+                const base_candidate = std.fmt.bufPrint(buf, "{s}.{s}", .{ type_name[0..bi], dname }) catch return null;
+                return if (self.registry.hasGlobalFunc(base_candidate)) base_candidate else null;
+            }
+            return null;
         }
         var lookup: ?[]const u8 = type_name;
         while (lookup) |cur| {

src/lang/compiler_expr.zig

@@ -462,7 +462,7 @@ pub fn infixExpr(c: anytype, tt: TT) anyerror!void {
         if (c.check(.lbrace) and looksLikeStructLiteral(
             c,
         )) {
-            try structInstanceLitAfterValue(c, prop.line, null);
+            try structInstanceLitAfterValue(c, prop.line, null, null);
         }
         // Propagate named_type through field access (e.g. enum member reads).
         if (receiver_named_type) |nt| {
@@ -1094,7 +1094,26 @@ pub fn structInstanceLit(c: anytype, type_name: Token) !void {
 // through a cross-module field access), in which case this behaves exactly
 // as before: the runtime check in vm.zig's build_struct_instance handler
 // is the only one that runs.
-pub fn structInstanceLitAfterValue(c: anytype, line: u32, resolved_type: ?*value_mod.Object) !void {
+//
+// dunder_type_name: the qualified name to tag onto this literal's
+// ExprPrimInfo so a dunder method (__add__ etc.) declared on the type is
+// reachable when the literal is used directly in an expression (not read
+// back out of a variable first) — AND so checkFieldValueCompatibility can
+// validate this literal against a generic-typed struct field elsewhere
+// (its struct_t case matches a concrete instantiated name like "Box[int]"
+// against a field's bare-template-plus-generic_args spec). Always the
+// concrete instantiated qualified_name (same as resolved_type's own, when
+// present) — never the bare generic template name — because that
+// compatibility check needs the concrete form. A generic struct's methods
+// are nonetheless registered once, type-erased, under the *template's*
+// qualified name (e.g. "Box", from methodDecl's `qualifyTypeName(recv_type)`
+// where recv_type is the bare receiver name before its `[T]` is parsed), so
+// lookupDunderCallee (compiler.zig) has its own fallback that strips a
+// "[...]" suffix off this same name when the direct lookup misses — keeping
+// both consumers satisfied from one value instead of two conflicting ones.
+// Pass null when the caller has no dunder-eligible name at hand (e.g. the
+// cross-module field-access case) — same as before this parameter existed.
+pub fn structInstanceLitAfterValue(c: anytype, line: u32, resolved_type: ?*value_mod.Object, dunder_type_name: ?[]const u8) !void {
     try c.consume(.lbrace);
     var count: u8 = 0;
     var key_toks: [255]Token = undefined;
@@ -1127,11 +1146,20 @@ pub fn structInstanceLitAfterValue(c: anytype, line: u32, resolved_type: ?*value
         }
     }
     try c.consume(.rbrace);
+    // See structInstanceLit's identical comment above: without this, a
+    // dunder method declared on the struct is unreachable from a literal
+    // built directly through this path (generic instantiation, or a type
+    // alias of one) — this sibling function was missing it entirely.
     if (resolved_type) |t| {
         if (t.* == .struct_type) {
             try validateStructLiteralFieldNames(c, t.struct_type.fields, key_toks[0..count], val_infos[0..count], t.struct_type.name);
         }
     }
+    if (dunder_type_name) |dtn| {
+        c.setCurrentExprPrimInfo(.{ .struct_type = dtn });
+    } else {
+        c.clearCurrentExprPrimInfo();
+    }
     try c.cs.emit2(@intFromEnum(Op.build_struct_instance), count, line);
 }
 
@@ -1270,7 +1298,16 @@ pub fn varExpr(c: anytype, name: Token) !void {
             c,
         )) {
             const resolved_obj = if (c.registry.getCachedInstByQname(qname)) |e| e.obj else null;
-            try structInstanceLitAfterValue(c, name.line, resolved_obj);
+            // Use the CONCRETE instantiated qname (e.g. "Box[int]"), not the
+            // bare template name: checkFieldValueCompatibility's struct_t
+            // case needs this exact form (it strips the "[...]" itself when
+            // checking a field of generic type), and lookupDunderCallee
+            // (compiler.zig) now has its own fallback that strips this same
+            // suffix if the direct lookup misses, so both consumers of this
+            // ExprPrimInfo are satisfied without a second, differently-named
+            // value. See structInstanceLitAfterValue's doc comment.
+            const dunder_type_name: ?[]const u8 = if (resolved_obj != null and resolved_obj.?.* == .struct_type) qname else null;
+            try structInstanceLitAfterValue(c, name.line, resolved_obj, dunder_type_name);
         }
         return;
     }
@@ -1308,7 +1345,17 @@ pub fn varExpr(c: anytype, name: Token) !void {
                 // so build_struct_instance gets the type with the correct field definitions.
                 try c.cs.emitGetGlobal(alias.target_qname, name.line);
                 const resolved_obj = if (c.registry.getCachedInstByQname(alias.target_qname)) |e| e.obj else null;
-                try structInstanceLitAfterValue(c, name.line, resolved_obj);
+                // Unlike the bare-generic-instantiation case above, a type
+                // alias's methods ARE registered under the concrete
+                // instantiation's own qualified name (methodDecl resolves
+                // the alias receiver to ta.target_qname), so the resolved
+                // object's qualified_name is the correct dunder lookup key
+                // here. See structInstanceLitAfterValue's doc comment.
+                const dunder_type_name: ?[]const u8 = if (resolved_obj != null and resolved_obj.?.* == .struct_type)
+                    alias.target_qname
+                else
+                    null;
+                try structInstanceLitAfterValue(c, name.line, resolved_obj, dunder_type_name);
             } else {
                 try structInstanceLit(c, name);
             }

src/lang/native/bytes.zig

@@ -5,6 +5,7 @@ const vmgc = @import("../vm_gc.zig");
 const Value = @import("../value.zig").Value;
 const NativeFnId = @import("native_ids.zig").NativeFnId;
 const NativeFuncObj = @import("../value.zig").NativeFuncObj;
+const common = @import("../common.zig");
 
 fn makeBinaryString(ctx: VMContext, bytes: []const u8) !Value {
     const obj = try vmgc.allocTempRooted(ctx, .{ .dyn_string = &[_]u8{} });
@@ -20,10 +21,13 @@ fn makeBinaryString(ctx: VMContext, bytes: []const u8) !Value {
     return .{ .object = obj };
 }
 
+// found via `bytes.u8(1e300)`, reachable from any script with no capability
+// required, aborting the whole host process before the isFinite/bounds
+// check below was added — see common.safeI64FromFloat's doc comment.
 fn argAsI64(v: Value) !i64 {
     return switch (v) {
         .int => |n| n,
-        .float => |n| @as(i64, @intFromFloat(n)),
+        .float => |n| common.safeI64FromFloat(n) catch return error.RangeError,
         else => error.TypeError,
     };
 }

src/lang/native/cap_ffi.zig

@@ -23,6 +23,7 @@ const Object = vmod.Object;
 const MapEntry = vmod.MapEntry;
 const NativeFnId = @import("native_ids.zig").NativeFnId;
 const NativeFuncObj = @import("../value.zig").NativeFuncObj;
+const common = @import("../common.zig");
 
 pub const LibQualifiedName = "@cap_type:ffi.Lib";
 pub const CallableQualifiedName = "@cap_type:ffi.Callable";
@@ -213,10 +214,7 @@ fn callTrampoline(frame: *FfiCall) void {
 fn extractI64(v: Value) !i64 {
     return switch (v) {
         .int => |n| n,
-        .float => |n| blk: {
-            if (n < @as(f64, @floatFromInt(std.math.minInt(i64))) or n >= std.math.pow(f64, 2.0, 63.0)) return error.TypeError;
-            break :blk @as(i64, @intFromFloat(n));
-        },
+        .float => |n| common.safeI64FromFloat(n) catch return error.TypeError,
         else => return error.TypeError,
     };
 }

src/lang/native/cap_fs.zig

@@ -135,12 +135,7 @@ pub fn dispatch(ctx: VMContext, nf: NativeFuncObj, argc: u8) !void {
         .cap_fs_write => {
             if (argc != 2) return error.ArityMismatch;
             const path = vms.asStringValue(try ctx.vs.vmPeek(1)) catch return error.TypeError;
-            const arg1 = try ctx.vs.vmPeek(0);
-            const content: []const u8 = switch (arg1) {
-                .string => |s| s.bytes,
-                .object => |o| if (o.* == .dyn_string) o.dyn_string else if (o.* == .string_view) o.string_view.bytes else return error.TypeError,
-                else => return error.TypeError,
-            };
+            const content = vms.asStringValue(try ctx.vs.vmPeek(0)) catch return error.TypeError;
 
             const lr = try fs_state.lookup(ctx.vs.fs_es, path);
             if (lr.mount.kind == .driver) {
@@ -323,3 +318,36 @@ test "cap_fs path extraction accepts string and dyn_string" {
     const ds = vms.asStringValue(dyn) catch return error.TestFailed;
     try std.testing.expectEqualStrings("test.txt", ds);
 }
+
+// Regression: cap_fs_write's content argument used to be extracted through a
+// hand-rolled .string/.dyn_string/.string_view switch with no .named_value
+// case, unlike every other string-accepting argument in this file (which go
+// through vms.asStringValue, which does unwrap .named_value). A value of a
+// named string type (e.g. `type Path string`) passed as fs.write's content
+// raised a spurious TypeError. cap_fs_write now calls vms.asStringValue
+// directly, so this exercises the same unwrap the fix relies on.
+test "cap_fs write content accepts a named string-type value" {
+    const Runtime = @import("../../runtime/runtime.zig").Runtime;
+    var rt: Runtime = undefined;
+    rt.initWithPolicy(.{ .allow_io = false }) catch return error.TestFailed;
+    defer rt.deinit();
+
+    const ctx = vms.VMContext.fromActive();
+    const vmtyp = @import("../vm_types.zig");
+
+    const typ_obj = try vmgc.vmAllocObject(ctx);
+    typ_obj.* = .{ .named_type = .{ .name = "Content", .qualified_name = "Content", .base = .string } };
+    // Root typ_obj before the further allocations below (makeNamedValue's
+    // own vmAllocObject, internStr): under -Dgc_stress=true every
+    // allocation can trigger a GC pass, and typ_obj isn't reachable from
+    // any root yet (no global, no VM stack slot) until it's wrapped into
+    // the named value it backs.
+    try ctx.vs.pushTempRoot(.{ .object = typ_obj });
+    defer ctx.vs.popTempRoot();
+
+    const inner = try ctx.cs.internStr("hello named content");
+    const named = vmtyp.makeNamedValue(ctx, typ_obj, .{ .string = inner }) catch return error.TestFailed;
+
+    const content = vms.asStringValue(named) catch return error.TestFailed;
+    try std.testing.expectEqualStrings("hello named content", content);
+}