fix(runtime): validate spread sources; full handle band + no type-pun on the dynamic set path

CHANGELOG.md

@@ -1,3 +1,7 @@
+## v0.5.1227 — spread sources validated; full handle band + no type-pun on the dynamic set path (#5943)
+
+First slice of the 2026-07-02 audit's write-path family (the GET side was hardened by the #5429 fix; the write/spread side was not). `{...expr}` (js_object_copy_own_fields) deref'd ANY value ≥0x10000 as an ObjectHeader via a `top16 >= 0x7FF8` catch-all — spreading a fetch-band handle or SSO string hit non-heap memory (Linux SIGSEGV), spreading a Map walked MapHeader bytes as object fields; sources are now POINTER-tagged, outside the handle band, and try_read_gc_header-verified GC_TYPE_OBJECT (documented safe-now gap: string spread should yield index props). js_object_set_field_by_name routed handles with a `< 0x10000` guard — one zero short of HANDLE_BAND_MAX — so POINTER-tagged fetch/zlib ids skipped handle dispatch and hit the raw GcHeader deref (`response.myProp = v` deref'd the id as memory); both routing sites now use addr_class::is_small_handle. The object_type pun is closed: a one-entry Map has MapHeader.size aliasing OBJECT_TYPE_REGULAR, so `m.customProp = 5` corrupted the Map's bytes — recognized non-object gc_types now return early (Map/Set expando writes are safely dropped; ExoticKind::Map/Set stores are the tracked follow-up, with the ~30-file 0x10000-idiom sweep). e2e: spread_and_setpath_band_safety.rs.
+
 ## v0.5.1226 — per-invocation object staging; per-run parity scratch dir (#5940)
 
 The two concurrent-compile contamination P0s from the 2026-07-02 audit (the documented events.once-era trap, critical now that multiple dev agents compile in sibling worktrees daily). Per-module objects landed at CWD-relative name-only paths (object_output_dir = current_dir()), so two concurrent compiles sharing a working directory overwrote each other's <module>.o mid-link and each deleted the other's intermediates — deterministically wrong binaries on any object-cache bypass — and the fixed-name _perry_stubs.o/_perry_failed_stubs.o collided even with the cache ON. Objects now stage under temp_dir()/perry-objs-<pid>-<nanos> (the linker.rs #509 discipline; embedded-asset objects inherit the fix; dir removed with the intermediates). run_parity_tests.sh compiled every test to a fixed /tmp/perry_parity_<id> path — two concurrent suite runs executed each other's compiler output; binaries now live in a per-run mktemp dir (trap-cleaned). Follow-ups: shared cache-key env allowlist; port-parameterize the TLS-upgrade fixture's 17892.

CLAUDE.md

@@ -8,7 +8,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 Perry is a native TypeScript compiler written in Rust that compiles TypeScript source code directly to native executables. It uses SWC for TypeScript parsing and LLVM for code generation.
 
-**Current Version:** 0.5.1226
+**Current Version:** 0.5.1227
 
 
 ## TypeScript Parity Status