fix: recover main's red CI gates + perry check false pass

CONTRIBUTING.md

@@ -22,10 +22,12 @@ Prerequisites match what CI installs — see [`.github/workflows/test.yml`](.git
 
 | Component | Version | Needed for |
 |---|---|---|
-| Rust | stable | Everything |
+| Rust | stable (≥ 1.94) | Everything. The workspace pins no toolchain, so an older `stable` fails deep in the dependency graph with a `sqlx@0.9.0 requires rustc 1.94.0` MSRV error rather than a clear message — `rustup update stable` fixes it. |
 | Rust nightly + `rust-src` | latest | tvOS / watchOS cross-compile only (`-Zbuild-std`) |
-| Node.js | 22 | Parity tests (`run_parity_tests.sh`) |
+| Node.js | see [`.node-version`](.node-version) | Parity tests (`run_parity_tests.sh`). Use that exact version — an older Node makes the harness classify tests `node_fail` and silently DROP them from the gate instead of failing. |
 | C linker | any | Linking compiled binaries (`xcode-select --install` / `build-essential` / MSVC) |
+| **libclang** | any | `bindgen`, via the `libsqlite3-sys` build script. Without it the build dies with `Unable to find libclang`. Debian/Ubuntu: `libclang-dev`; Fedora: `clang-devel`; Arch: `clang`. If it lives somewhere non-standard, point at it with `LIBCLANG_PATH=/path/to/dir` (and, if bindgen then can't find `stdarg.h`, `BINDGEN_EXTRA_CLANG_ARGS="-isystem /path/to/clang/<ver>/include"`). |
+| clang | ≥ 15 | Perry's own LLVM codegen shells out to `clang -c`. Separate from the linker above — see the [installation guide](docs/src/getting-started/installation.md). `perry doctor` verifies it. |
 
 Platform-specific extras — only required if you're touching that backend:
 

changelog.d/6891-linux-verification-sweep.md

@@ -0,0 +1,11 @@
+**`perry check` no longer passes unparseable code:** a file that failed to parse was reported only under `-v` and then skipped without recording a diagnostic, so `error_count()` stayed 0 and the command printed `All checks passed! - 0 file(s) checked` and exited 0 — while `perry compile` rejected the same file. Parse failures are now recorded as a `P001` diagnostic, so the text summary, the JSON `success` field and the exit code agree. (`perry check` had no exit-code test coverage; found while verifying a fresh Linux checkout.)
+
+**Recovered three red CI gates on `main`:** split `perry-runtime/src/object/mod.rs` (2039 → 1709 lines) by extracting the #6812 spill/overflow storage into `object/spill.rs`, and `perry-stdlib/src/readline.rs` (2066 → 1994) by extracting the drain/pump + keypress decoding into `readline/pump.rs`, with visibility widened only enough to keep the existing `use super::*` sites resolving. Fixed the lone `cargo fmt --check` diff in `collect_modules.rs`, and refreshed the stale addr-class ratchet baseline.
+
+**Readline correctness fixes (review findings on the moved code):** raw-mode arrow keys work — the reader queues one byte per chunk, so `\x1b[A` arrived as three chunks and could never match the 3-byte CSI branch; the pump now reassembles escape sequences across chunks/ticks (a bare ESC flushes one tick later). `'readable'` listeners fire only when a tick delivers new data (plus once at EOF) instead of on every event-loop iteration forever. `rl.write()` actually writes to the output stream; `rl.pause()/resume()` now gate the stdin-backed interface (queued lines hold while paused); `rl.close()` stops subsequent `'line'` delivery; `process.stdin.destroy()` clears `readable` listeners too. GC hardening: line dispatch and prompt/write no longer run JS inside the `READLINE_INTERFACES` borrow (re-entrancy panic + skipped root scan), iterator/keypress/listener-attach paths root values in `RuntimeHandleScope` across allocating calls, and the readline root scanner is registered from every entry point that stores GC-visible state. Closed custom interfaces release their slot (handles are not reused). In `object/spill.rs`, the learned-inline-width hook moved off the steady-state write path (only high-water-raising writes probe TLS, learned widths unchanged).
+
+**Fixed three stale test assertions** (each verified byte-for-byte against Node 26.5.0 first — none was a real defect): perry-hir expected the `??=` RHS store as `PutValueSet` when lowering emits `PropertySet` for a plain member target; perry-codegen sliced only `fast.inner.body`..`fast.inner.exit` for the numeric stores, which #6812's spill lanes moved into the `fast.store.spill.*` / `fast.store.inline.*` successors (it now collects every `object_array_write.loop.fast.*` block); and perry-stdlib asserted `randomBytes` fires its callback synchronously after #6430 deliberately deferred it to a macrotask to match Node's libuv timing. Two of the three live in `crates/*/tests/*.rs`, which only run nightly/on tags — the #5960 blind spot.
+
+**`run_parity_tests.sh` no longer reports false gap regressions under `PERRY_NO_AUTO_OPTIMIZE`:** the default `test-files/` suite linked the prebuilt `full` stdlib, which carries none of the `external-*` pump features, so every `events`/`http`/`net`/`fetch` test failed and surfaced as an untriaged NEW gap failure (7 of them, all passing with auto-optimize). `node-suite` already compensated; the default suite now builds the same wrapper crates and pump features. This matters locally because a cold auto-optimize run mints a ThinLTO variant per feature combination — measured at 12 variants / 71 GB after only 30 of 411 tests.
+
+**Documented two build prerequisites that hard-fail a fresh checkout:** `libclang` (bindgen, via the `libsqlite3-sys` build script) and rustc ≥ 1.94 (sqlx 0.9.0's MSRV, which nothing in the workspace pins). `installation.md` also required "clang ≥ 15 for codegen" while every per-distro command below it installed no clang at all; the Node row now points at `.node-version` instead of a stale "22".

crates/perry-codegen/tests/native_proof_regressions.rs

@@ -13723,14 +13723,37 @@ fn nested_same_shape_object_writes_version_one_through_four_fields() {
                 && ir.contains("object_array_write.loop.slow.preheader"),
             "the proof must retain distinct call-free and semantic fallback clones:\n{ir}"
         );
-        let fast_body = ir
-            .split("\nobject_array_write.loop.fast.inner.body")
-            .nth(1)
-            .and_then(|tail| {
-                tail.split("\nobject_array_write.loop.fast.inner.exit")
-                    .next()
-            })
-            .expect("fast inner-loop block");
+        // Collect EVERY basic block of the fast clone rather than slicing the
+        // single `fast.inner.body` block. #6812's spill lanes made the inner
+        // body end in a `br` to `fast.store.spill.*` / `fast.store.inline.*`
+        // successors, so the numeric stores no longer live in the block the
+        // old `inner.body`..`inner.exit` slice captured — the assertions below
+        // then read a store-free body and failed even though the emitted code
+        // was correct. Keying on the `object_array_write.loop.fast.` label
+        // prefix keeps both invariants (call-free, N direct stores) checked
+        // across the whole fast region and is stable under block reordering.
+        let fast_body = {
+            let mut collected = String::new();
+            let mut in_fast_block = false;
+            for line in ir.lines() {
+                if let Some(label) = line.strip_suffix(':') {
+                    if !label.starts_with(char::is_whitespace) && !label.contains(' ') {
+                        in_fast_block = label.starts_with("object_array_write.loop.fast.");
+                        continue;
+                    }
+                }
+                if in_fast_block {
+                    collected.push_str(line);
+                    collected.push('\n');
+                }
+            }
+            assert!(
+                !collected.is_empty(),
+                "expected at least one object_array_write.loop.fast.* block:\n{ir}"
+            );
+            collected
+        };
+        let fast_body = fast_body.as_str();
         assert!(
             !fast_body.contains("call "),
             "the successful raw-pointer clone must stay call/GC-free:\n{fast_body}"

crates/perry-hir/tests/c262_parity.rs

@@ -575,9 +575,16 @@ fn logical_property_assignment_short_circuits_the_store_4586() {
             "expected a property read on the LHS for `{src}`, got {left:?}"
         );
         // The single store lives on the RHS, so it is only evaluated when the
-        // short-circuit does NOT hold.
+        // short-circuit does NOT hold. Both store shapes satisfy that
+        // invariant: a plain member target lowers to `PropertySet`, while a
+        // parenthesized / `as`-cast target routes through `PutValueSet` so the
+        // const-immutability check runs (#6300). The property being asserted
+        // here is *where* the store sits, not which node encodes it.
         assert!(
-            matches!(right.as_ref(), Expr::PutValueSet { .. }),
+            matches!(
+                right.as_ref(),
+                Expr::PutValueSet { .. } | Expr::PropertySet { .. }
+            ),
             "expected the store to live on the short-circuit RHS for `{src}`, got {right:?}"
         );
     }