Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.claude/workflows/lifetime-classify.workflow.js:
- Line 11: The REPO constant is hardcoded to "/root/bun-5" making the workflow
environment-specific; change the code that defines REPO so it reads from a
configurable source (e.g., process.env.REPO_PATH or a workflow input like
inputs.repo) with a sensible fallback and a clear warning/error if neither is
provided. Specifically replace the literal const REPO = "/root/bun-5"; with
logic that checks process.env.REPO_PATH || workflow input (e.g., inputs.repo) ||
a default, and ensure any code that uses REPO still works; add
validation/logging so missing configuration fails fast or logs the chosen path.
- Around line 139-141: The consensus selection can become undefined when
votes.find(... )?.correct_class returns undefined; update the logic that
computes consensus so it falls back to the original f.class when no valid
correct_class is found. Concretely, inside the block that computes const refutes
= votes.filter(...).length and const consensus = ..., replace the ternary branch
that uses votes.find(v => v && v.refuted)?.correct_class with a safe selection
(e.g., assign foundCorrect = votes.find(v => v && v.refuted)?.correct_class and
then set consensus = refutes >= 2 ? (foundCorrect ?? f.class) : f.class) so
final_class is never undefined; ensure you update usages of consensus and return
{ ...f, refutes, final_class: consensus, verified: true } unchanged.
- Line 106: The current then handler assumes r.fields exists and calls
r.fields.map(...), which can throw if r is an object without fields; update the
handler that returns fields for the promise (the arrow function using r and
f.zig/f.crate) to guard/normalize r.fields first — e.g., check
Array.isArray(r.fields) or use optional chaining/defaulting so you only call
.map when r.fields is an array and otherwise return an empty array; keep the
mapping that spreads each field and adds file: f.zig and crate: f.crate.
- Around line 157-165: The return block can produce NaN when final.length === 0
and repeats the same unsafe toFixed usage noted earlier; change the computation
of unknown_rate to guard against division-by-zero by computing unknown_rate =
final.length === 0 ? "0.000" : ((byClass.UNKNOWN || 0) /
final.length).toFixed(3), and ensure the returned value is a string/number
consistently; keep the rest of the fields (total_fields, by_class,
verified_count, overturned, tsv_preview, tsv) unchanged and reference the
variables final, byClass, unknown_rate, verified and tsv_preview when applying
the fix.

In @.claude/workflows/phase-b0-movein.workflow.js:
- Line 37: The workflow currently references hardcoded line ranges in PORTING.md
which can become stale; update the workflow that reads PORTING.md to locate
sections by header names instead of fixed line ranges (search for the
"§Dispatch" and "§Concurrency" headers), or add a validation step that confirms
the text found at the referenced ranges contains the expected "§Dispatch" and
"§Concurrency" headers and fails with a clear error if not, or alternatively
document that the PORTING.md line numbers must remain stable—implement one of
these fixes and ensure the code uses the "§Dispatch" and "§Concurrency" markers
to locate content reliably.
- Line 36: The workflow references the grep against movein-skipped.txt but
there's no producer for that file; update the phase-b0 move-in workflow to
either (A) add a setup step that materializes the move-out `skipped` array into
the expected movein-skipped file (so the grep -iE
'\b(${t.name}|${t.cyclebreak_key}|bun_${t.cyclebreak_key})\b' has real data), or
(B) add robust error-handling before the grep (ensure the file exists or create
an empty placeholder from the move-out `skipped` data, or short-circuit the grep
with a safe fallback) so explicit move-out requests aren’t silently missed.
Ensure you modify the step that runs the grep command and/or the move-out
producer that exposes the `skipped` array to produce the expected artifact.

In @.claude/workflows/phase-b1-tier.workflow.js:
- Line 10: The code assumes all input crates share the same tier by using
CRATES[0].tier for the batch log and final output; add a validation in the
beginning of the workflow to verify homogeneity (e.g., compute a set of tiers
from args.crates/CRATES and if its size > 1 throw or normalize), and then use a
safe value (the single tier) only after validation; update references where
CRATES[0].tier is used (the initial log call and the final batch summary around
line 53) to either compute the tier from the validated set or to report that
multiple tiers were received if you choose to error instead.

In @.claude/workflows/phase-b2-fill.workflow.js:
- Line 21: The dir_for helper currently maps a few special crate names and
otherwise strips a bun_ prefix, which can produce incorrect directories for
unexpected crate names; update dir_for to validate inputs and document the
mapping: add a short comment explaining the special cases (bun_str→"string",
bun_core, bun_alloc) and the fallback behavior, and implement explicit
validation in the dir_for function to either (a) check the crate name against an
allowed set of known crate keys and throw or log an error when unknown, or (b)
return a clearly marked fallback only after confirming the name begins with
"bun_"—use the existing dir_for identifier to locate and change the mapping
logic and add the comment nearby.

In @.claude/workflows/phase-b2-fix-bugs.workflow.js:
- Line 7: The comment referencing a possible input "bugs_path: \"/tmp/...\"" is
inconsistent with the actual code which only reads args.bugs; either remove that
misleading comment or implement support for loading bugs from a file: add
handling for args.bugs_path in the workflow's argument parsing (check
args.bugs_path, read and parse the file into the same data structure as
args.bugs), or delete the alternate example from the comment so it matches the
existing behavior (update the comment where "// args: { bugs_path: \"/tmp/...\",
or bugs: [{module,fn,what,fix}] }" appears to only show supported inputs).
- Around line 38-39: The template currently injects the full bugs array via
"${JSON.stringify(bugs, null, 2)}", which can exceed token limits for large
lists; modify the workflow to check bugs.length and either truncate or summarize
before embedding: e.g., if bugs.length > MAX_BUGS include a short summary ("N
bugs, showing first M") plus JSON.stringify of the first M entries, or call a
helper like summarizeBugs(bugs) to produce a condensed text; update the template
insertion to use the truncated/summarized string instead of the full JSON and
ensure MAX_BUGS and summarizeBugs are defined/adjustable.
- Line 23: Validate b.module before using b.module.split("/") to compute crate:
ensure b.module is a non-empty string and contains the expected "/" delimiter
(or match a regex like /^[^\/]+\/.+$/) and handle failures (e.g., log a warning
and skip grouping, throw, or default to a safe value) instead of blindly doing
const crate = b.module.split("/")[0]; update the code around the crate
extraction to perform the check, use the validated part when present, and add a
clear log message documenting the expected "crate/..." format when invalid.

In @.claude/workflows/phase-b2-keystone.workflow.js:
- Line 17: The file contains top-level return statements (e.g., the check "if
(!TASK) return { error: 'args.task required' }") which are invalid in ES
modules; wrap the executable workflow code in a function or immediately-invoked
async function (IIFE) that the workflow runtime expects, move all top-level
logic (including checks at TASK and the other return sites referenced) into that
function, and replace those top-level "return" statements with returns from that
function (or throw errors/resolve values from the function) so no return appears
at module top-level; update the checks around the TASK variable and the other
early-exit points so they return from the newly created function scope.

In @.claude/workflows/phase-d-blocked-on-resolve.workflow.js:
- Around line 81-85: The workflow contains literal placeholders in the
PortUpstream command steps (e.g., '<method_name>', '<crate>', '<caller_crate>')
which make automated grep and cargo checks unusable; update the commands in the
PortUpstream steps to interpolate the actual variables (use ${g.symbol} for the
method name, ${g.upstream_crate} or a fallback for the upstream crate instead of
'<crate>', and a computed ${g.caller_crate} or caller list instead of
'<caller_crate>'), so step 1 runs grep -rn "${g.symbol}" src/**/*.zig, step 3
runs cargo check -p ${g.upstream_crate} (or resolved crate name), and step 4
runs cargo check -p for each resolved caller crate; ensure all placeholder
tokens in those commands are replaced with the corresponding ${g.*} variables
used elsewhere in the workflow.

In @.claude/workflows/phase-d-build-queue.workflow.js:
- Line 65: The workflow string in the HARD constant currently stages all of
'src/' and uses git merge with -X ours which can silently discard concurrent
agents' changes; update the commit/push command in
.claude/workflows/phase-d-build-queue.workflow.js (HARD) to stage and commit
only the exact touched paths (not "src/") and remove the `-X ours` merge flag so
merges are not force-resolved locally; instead have the orchestrator perform the
final merge or require each agent to operate on an isolated branch/worktree
before pushing.

In @.claude/workflows/phase-d-bundler-shard.workflow.js:
- Line 102: The prompt currently returns a key named blocks_on which mismatches
the FIX_S schema's blocked_on field; update the template string "Return
{file:\"${u.file}\", before:${u.n}, fns_touched:[...], blocks_on:[...], notes}."
to use blocked_on instead of blocks_on so agents produce the recognized key
(referencing FIX_S).
- Around line 51-114: The agent prompt returns a field named "blocks_on" but the
schema expects "blocked_on": update the return template inside the inner agent
call (the agent invoked for each unit with label starting with "fix:")—replace
"blocks_on:[...]" with "blocked_on:[...]" in the final Return {...} string (the
template that currently reads Return {file:"${u.file}", before:${u.n},
fns_touched:[...], blocks_on:[...], notes}) so the returned object matches the
FIX_S schema.

In @.claude/workflows/phase-d-recursive-ungate.workflow.js:
- Line 100: The HARD rule string currently contains an embedded "Commit+push
with retry" shell snippet that runs git pull -X ours and pushes, which allows
concurrent workers to merge/clobber siblings; update the HARD constant (the
template string assigned to HARD in
.claude/workflows/phase-d-recursive-ungate.workflow.js) to remove the
pull/merge/push steps and only include commit-only instructions (e.g.,
add/commit retry loop without git pull or git push), or otherwise document that
workers must not perform pull/merge/push and that a single orchestrator will
serialize branch integration; keep the rest of the HARD text intact and ensure
the offending git pull -X ours / push sequence is not present.

In @.claude/workflows/phase-e-body-port.workflow.js:
- Line 63: The workflow's HARD constant contains a commit command that does git
-c core.hooksPath=/dev/null add -A 'src/' which can accidentally stage unrelated
edits; change the worker so it tracks exactly which files it modifies and
replace that command with one that git-adds only the recorded paths (e.g., git
-c core.hooksPath=/dev/null add <each-recorded-path> && git -c
core.hooksPath=/dev/null commit -q -m "phase-e(port): <file> real bodies").
Update the code that builds the HARD string (reference the HARD constant in
.claude/workflows/phase-e-body-port.workflow.js) to remove the add -A 'src/' and
instead use the recorded-files list when invoking git, ensuring hooksPath
behavior is preserved and only the touched files are committed.
- Line 78: The module contains top-level return statements (e.g., the line with
"if (!survey || survey.total === 0) return { rounds: round, done: true, history
};" and other returns inside the same module-scope loop) which are invalid in ES
modules; wrap the entire executable logic block (the loop and surrounding code
currently at module scope) inside a named async function (for example
runPhaseEBodyPort or executeWorkflow) and export or invoke that function from
the module entry point, or alternatively replace those top-level return
statements with control-flow that sets a result variable and breaks the loop;
update any callers to call the new function name (e.g., runPhaseEBodyPort) so no
return remains at top-level.

In @.claude/workflows/phase-e-test-bringup.workflow.js:
- Line 126: The workflow hard-coded policy (HARD constant) instructs parallel
agents to pull and push to the same branch using the merge strategy `-X ours`
inside the retry loop (the commit+push retry snippet referencing
`origin/claude/phase-a-port`), which allows sibling fixes to be silently
overwritten; change the workflow to avoid `-X ours` and instead give each agent
a unique branch or commit ref (e.g., include an agent/PR-specific suffix) and
push to that branch, or make pulls fail on conflict so the agent rebases/merges
locally before pushing; update the retry loop logic that references the `commit
-m`/`pull --no-rebase --no-edit -X ours`/`push origin claude/phase-a-port`
sequence to use agent-scoped branch names and remove `-X ours` (or switch to
explicit rebase/merge conflict handling) to prevent nondeterministic overwrites.
- Around line 200-206: The reproduction command is hard-coded using the ternary
on u.sample.name (the `${u.sample.name.startsWith("e3") ? "test /tmp/e3/" :
"test /tmp/e1.test.ts"}` expression), so it may not re-run the actual failing
probe; update the workflow step in
.claude/workflows/phase-e-test-bringup.workflow.js to use the real recorded
probe command (use the probe/failure command field produced when the probe
failed — e.g. replace the ternary with the failing probe command variable such
as u.probe.command or u.sample.probeCommand, with a safe fallback to the current
expression) so the "After fix" rebuild actually re-runs the exact failing case.
- Around line 131-224: The workflow body must be moved into an exported async
entry function so the top-level return statements become valid; wrap the entire
loop and subsequent logic (the for loop that uses phase(), agent(), probes/fixes
calculation, and the final return) inside an exported async function (e.g.,
export async function runWorkflow() or export default async function main()) and
ensure any module-level constants/metadata remain outside; update any internal
references (phase, agent, MAX_ROUNDS, TARGET_RUNG, history, etc.) to use the
same scope and replace the top-level returns with returns from that function so
callers import/await the exported async function.

In @.claude/workflows/phase-f-accessor-sweep.workflow.js:
- Around line 106-114: The workflow's Step 3 is overprescriptive: it assumes
every pointer accessor returns &T and rewrites unsafe usages to self.x(), which
is incorrect for accessors that return Option<&T> or raw pointers; update the
guidance so that when Step 2 chooses Option<&T> or a raw-pointer accessor (e.g.
x() -> Option<&T>, x_ptr() -> *mut T) the caller-rewrite guidance uses the
corresponding safe pattern (handle Option via match/unwrap or map, and keep
raw-pointer uses as-is or document unsafe deref patterns) and only suggest
replacing unsafe { &*self.x } with self.x() for the specific case where the
accessor is defined as fn x(&self) -> &T; mention x_mut() and x_ptr() by name so
reviewers know which rewrite applies to which accessor shape.
- Around line 179-181: The code marks every surveyed struct as completed by
doing for (const s of survey.structs) done_structs.add(s.struct) before the
pipeline succeeds; move this mutation so structs are only added to done_structs
after the accessor/retry/fix pipeline actually succeeds. Remove or defer the
loop that adds to done_structs from this location and instead add each s.struct
to done_structs in the success branch of the pipeline handler (the code path
that confirms review accepted and fix step completed), leaving history.push({
round, structs: survey.structs.length, derefs_targeted: removed }) unchanged or
adjust it to reflect only attempted vs completed counts as needed. Ensure you
update any unit tests that check done_structs state to assert addition happens
only on pipeline success.

In @.claude/workflows/phase-f-test-swarm.workflow.js:
- Around line 64-77: The workflow uses the nonstandard runner
"./target/debug/bun-rs test ${area.glob}" for pass/fail and conflict resolution
which can diverge from repo expectations; replace all invocations of that exact
command with "bun bd test ${area.glob}" (and likewise use "bun bd test" wherever
./target/debug/bun-rs test is used in the loop or BUGHUNT steps) so decisions
use the repo's debug-test path, and keep the existing verification guidance
around USE_SYSTEM_BUN=1 bun test vs bun bd test; ensure the git pull/cherry-pick
loop still runs but bases its pass/fail checks on bun bd test rather than
./target/debug/bun-rs test.
- Line 122: The top-level return causes a parse error because this file is an ES
module; wrap the executable body into an exported async function (e.g., export
async function runPhaseTest()) that contains the phase() calls, the await
parallel(...) call, the for loop, and the final return statement; ensure the
function returns the object { areas: AREAS.length, all_pass: ok.length, partial:
partial.length, results, cherry } and keep references to AREAS, ok, partial,
results, cherry and calls to phase() and parallel() unchanged so callers can
invoke the exported function from the workflow runtime.

In @.claude/workflows/phase-g-mega-swarm.workflow.js:
- Line 113: The build-wait step currently reads global files
/tmp/mega-diag/.built and /tmp/mega-diag/.build.log which conflicts across
swarms; change the command to use the workflow's GDIAG namespace (replace
hardcoded /tmp/mega-diag paths with ${GDIAG}/.built and ${GDIAG}/.build.log) and
update the inline message string accordingly (the template using GDIAG and the
backtick command that contains `mkdir -p ${GDIAG}; for i in $(seq 1 60); do test
-f /tmp/mega-diag/.built && break; sleep 5; done; test -f /tmp/mega-diag/.built
&& tail -3 /tmp/mega-diag/.build.log`) so the sentinel and log are created/read
under ${GDIAG} instead of the global /tmp path.
- Line 163: The file contains top-level return statements inside a module-scope
loop (returning { rounds: round, done: true, passing: survey.passing, total:
survey.total, history }) which makes the module syntactically invalid; fix by
removing the top-level returns and either (A) wrap the loop and its logic in a
function (e.g., async function runPhaseGMegaSwarm() { ... } and return the
result from that function) or (B) build the result object (rounds/round, done,
passing, total, history) into a variable and export it (export const result =
...) instead of returning at module scope so the module parses as a valid ES
module. Ensure you update both places that currently use top-level return so
they follow the same approach.

In @.claude/workflows/phase-g-test-swarm-v3.workflow.js:
- Around line 201-206: The workflow currently replays hard-coded paths (/tmp/e3/
for e3* failures and /tmp/e1.test.ts for everything else) which skips many
failing cases; change the reproduction step to derive the replay path from the
actual failing probe identifier instead of those fallbacks—use the failing-test
variable/argument (the probe name, pattern or file provided by the test harness)
to construct the replay path and fall back only if that variable is empty, and
update the logic that checks for "e3*" / "e1" to instead use the real
failingProbe/failingTestPath value so cases like e1-fail, e1-hooks, e2-multi,
etc. are re-run.
- Around line 146-159: The shard slice is only described but never written to
disk or a variable, so the probe loop's "for f in $(cat your-slice)" has nothing
to read; materialize the slice before the probe by running the sed selection
used in the prompt and saving it (e.g., write the sed range expression from the
original selection into a file like ${DIAG}/your-slice or into a shell
variable), then have the probe loop iterate that concrete file/variable; update
references to "your files"/"your-slice" to the same identifier (e.g.,
${DIAG}/your-slice) so the for loop actually enumerates the selected test
filenames.

In @.claude/workflows/phase-g-test-swarm.workflow.js:
- Line 99: The module contains top-level return statements (e.g., the return
that produces { rounds: round, done: true, completing: survey.completing.length,
total: survey.total, history } and the other return near the end) which are
invalid in ES modules; wrap the logic that performs the loop and computes
rounds/round/history/survey into a function (sync or async) and return from that
function, or instead build the result into a local variable and export it (or
export an async function that returns it), ensuring all references to round,
rounds, survey, history now live inside that function body so no return occurs
at module scope.

In @.claude/workflows/phase-h-deep-dive.workflow.js:
- Line 91: The top-level "return { results: results.filter(Boolean) }" is
invalid in an ES module; move the return into a function that the workflow
runtime calls (for example wrap the workflow body in an exported async function
like runPhaseDeepDive or an exported handler function) so that the line becomes
a return inside that function; update any references to the workflow entrypoint
accordingly so the workflow runtime invokes the new function (look for the
top-level return and the symbol "results" to relocate into the new function).

In @.claude/workflows/phase-h-idioms-audit.workflow.js:
- Around line 144-183: The 2-vote unanimity is too strict: change the post-vote
logic around real_votes in the Verify phase (the code building the returned
object where verified is currently set using real_votes >= 2) to distinguish
"verified" (real_votes >= 2) from a new "disputed" state when real_votes === 1
(or add a status enum like verified|disputed|rejected). Update the returned
object produced in the pipeline promise (the block that computes real_votes,
votes, refutes, perf, better_fix) to keep verified: real_votes >= 2 and add
disputed: real_votes === 1 (or status: real_votes >=2 ? "verified" : real_votes
===1 ? "disputed" : "rejected") so a single-yes case is recorded rather than
silently treated as rejected.
- Around line 119-125: The key normalization for grouping patterns (variable
byPattern and computed key from f.pattern) is too aggressive—removing all
non-letters and truncating causes different phrases to collide; update the
normalization to preserve word boundaries and spaces before truncation (e.g.,
extract/keep word tokens, collapse multiple spaces, trim, then slice) so
distinct phrases like "*mut T fields with no invariant" and "*mut T fields with
no lifetime" remain distinct; apply this change where key is computed (the
expression using f.pattern.toLowerCase().replace(...).slice(...)) so downstream
grouping uses the word-preserving normalized key.
- Around line 218-222: Add an inline comment immediately above the git command
that uses "-c core.hooksPath=/dev/null" in
.claude/workflows/phase-h-idioms-audit.workflow.js explaining why hooks are
being bypassed for this automated workflow (e.g., to avoid local developer hooks
blocking CI-generated commits, ensure reproducible automation, and note that
this is intentional and reviewed); reference the exact command string "git -c
core.hooksPath=/dev/null add 'docs/' && git commit -q -m ..." so reviewers can
find it, and keep the comment concise and clear about the safety/approval
rationale and any intended exceptions or follow-up (no code changes beyond the
comment).
- Around line 86-91: The workflow hardcodes the repo path "/root/bun-5" inside
the agent prompt (and elsewhere); update the prompt construction to use a
configurable path instead (e.g., read from an environment variable like
process.env.REPO_DIR with a sensible default such as '.' or the repository root)
so the agent call in phase("Scan") and other agent prompts use that variable;
search for the string "/root/bun-5" referenced near the agent(...) calls and
replace with the variable/interpolated value so SCAN_S, TOP_N_CRATES and other
uses remain unchanged while the repo path becomes portable across environments.

In @.claude/workflows/porting-md-zigleakage.workflow.js:
- Around line 90-134: The comment and runtime log are out of sync with the SEED
array: SEED has three entries but the surrounding comment says "two user-flagged
issues" and the log formats "2 seed". Update the human-facing comment near the
SEED declaration to reflect three seeds (e.g., "three user-flagged issues" or
pluralize), and update the log call that prints `audit: ${all.length} raw
findings (incl. 2 seed)` to use the correct seeded count or pluralized wording
(e.g., "(incl. 3 seed)" or better "(incl. 3 seeds)"); locate and change the text
near the SEED constant and the log(...) call in this file to keep them
consistent.
- Around line 198-212: The module currently mixes a top-level export (export
const meta) with top-level await and a bare return; wrap all executable workflow
logic (the phase(...), agent(...) calls, any awaits and the final return object
that builds raw_findings/confirmed/by_dimension/refuted/patch/confirmed_detail)
inside an exported async function: add export default async function() { /* move
all code that uses await, phase(), agent(), and the return {...} into this
function */ } while keeping export const meta at module scope so the runtime can
import metadata and then invoke the default async function to execute the
workflow.

In `@bench/bundle/index.ts`:
- Around line 1-100: The file exports Three1..Three100 from non-existent
packages (Three1..Three100 symbols in bench/bundle/index.ts) while package.json
only provides "three"; change the exports to reference the actual installed
module instead of non-existent packages—e.g., re-export the real "three" module
for the intended number of copies (per README, export Ten aliases like
Three1..Three10 from 'three' and remove or stop exporting Three11..Three100), or
else add proper aliases/path mappings if you truly need distinct package names;
update bench/bundle/index.ts accordingly so all export statements import from
'three' (or match your tsconfig/packaging aliases).

In `@CLAUDE.md`:
- Line 1: Add a top-level H1 heading as the very first line of the file to
satisfy markdownlint MD041: insert a line like "# Bun" (or another appropriate
project title) above the existing body text so the file begins with an H1
header; ensure you update the first line in CLAUDE.md (where the current body
text starts) rather than appending the heading later.

In `@docs/BABYLIST_REPLACEMENT.md`:
- Line 3: The docs file BABYLIST_REPLACEMENT.md contains a host-specific repo
path `/root/bun-5`; replace that machine-local path with a repo-relative
reference (e.g., `.` or the repository name) and optionally include the commit
hash or tag for reproducibility, ensuring the shared document no longer contains
any absolute filesystem paths.
- Around line 39-41: Add a blank line immediately before the fenced Rust block
that contains the `pub type Arena = bumpalo::Bump;` (and related `pub type
MimallocArena` alias) so the fenced code block has a preceding empty line to
satisfy markdownlint MD031; ensure the fence keeps the language tag (```rust)
and the existing lines `pub type Arena = bumpalo::Bump;` and `pub type
MimallocArena = bumpalo::Bump;` remain unchanged.

In `@docs/CI_RUST_MIGRATION.md`:
- Around line 55-58: The fenced code block showing artifact paths (lines
containing "rust-target/<triple>/<profile>/libbun_rust.a.gz" and
"rust-target/<triple>/<profile>/bun_rust.lib") should include a language
specifier (e.g., "text") on the opening triple-backtick; update the block
delimiter from ``` to ```text so the example is treated as plain text in
rendered docs.

In `@docs/LAYERING_AUDIT.md`:
- Around line 30-324: The markdown headings in the audit section lack blank
lines before and after the level-3 headings (the lines starting with "###" such
as "### `src/bun_core/util.rs:1018` — `__bun_fd_path` / `__bun_fd_path_w`" and
all subsequent `###` entries), which triggers MD022; fix by inserting a single
blank line before and after each "### ..." heading throughout the document so
each heading is separated from surrounding paragraphs and lists, and re-run
markdownlint to verify the MD022 warnings are resolved.

In `@docs/rust-migration-spine.html`:
- Line 2: The root HTML element is missing a document language attribute; update
the root <html> element in the docs/rust-migration-spine.html file to include
lang="en" (i.e., change <html> to <html lang="en">) so assistive technologies
and the HTML linter recognize the document language.

In `@docs/rust-migration-tree.md`:
- Around line 59-64: The fenced code block containing the three file mapping
lines (starting with "src/http/HTTPThread.zig ←→ crates/bun_http/src/thread.rs"
and including "src/runtime/api/glob.zig ..." and "src/jsc/JSRef.zig ...") is
missing a language identifier; update the opening fence to include a language
(e.g., use ```text) so the block becomes a labeled fenced code block to enable
proper syntax highlighting and satisfy the markdownlint rule.

In `@docs/rust-rewrite-plan.md`:
- Around line 97-107: The fenced ASCII diagram blocks in
docs/rust-rewrite-plan.md (the block showing "C++ JSCell wrapper ... C-ABI
extern fns ... Native struct") and the other fenced blocks around lines 613-667
are missing a language tag and trigger MD040; update those backtick-fenced
blocks by adding a language identifier (e.g. text or rust) after the opening ```
so the diagram and any code sections (search for the ASCII diagram and other
```...``` blocks) are explicitly marked (e.g. ```text or ```rust) to satisfy
markdownlint and improve rendering.
- Around line 304-311: Several table cells contain literal pipe characters which
break the Markdown table; update the affected rows (the ones describing
hasPendingActivity, JSRef {weak, strong, finalized}, Strong / OptionalStrong,
JSValue.protect/unprotect, Async.KeepAlive / jsc.Ref, and MarkedArgumentBuffer)
to escape each '|' inside cell content (e.g., replace '|' with '\|' or use an
equivalent HTML entity) so the table keeps its column structure; ensure you edit
the exact cell texts that include `hasPendingActivity`, `JSRef {weak, strong,
finalized}`, `Strong`/`OptionalStrong`, `JSValue.protect`/`unprotect`,
`KeepAlive`/`ActiveTaskRef` and `MarkedArgumentBuffer` occurrences (and apply
the same fix to the other occurrences mentioned) without changing surrounding
formatting.

In `@docs/SPAWN_SYS_PROPOSAL.md`:
- Around line 24-76: The Markdown code fences in this file (the crate-graph
block that starts with "bun_libuv_sys  (already exists...)" and the Cargo deps
block that begins with "libc, bstr, scopeguard" / the ```toml snippet) need
explicit fence languages and surrounding blank lines; change the unlabeled
triple-backticks to labeled fences (e.g., ```text for the crate-graph/diagram
block and ```toml for the Cargo deps section) and ensure there is a blank line
before and after each fenced block so markdownlint and GitHub syntax
highlighting stop flagging them.

In `@docs/zig-restructure-plan.md`:
- Around line 1028-1030: The markdown table rows for `zigGeneratedClasses`,
`cxx`, and `c` contain raw pipe characters (e.g. the substitution snippets like
`s|src/bun.js/bindings|src/jsc/bindings|g`) that break the table; either escape
each `|` as `\|` inside those table cells or convert those rows into bullet list
items so the substitution strings aren’t parsed as column separators — update
the rows referencing `zigGeneratedClasses` (`:45`), `cxx` (`:79-95`) and `c`
(`:100-109`) (and the similar rows at 1042-1043) to use escaped pipes or bullets
consistently.
- Around line 944-945: The table and sections use inconsistent module paths
(e.g., references to bun.schema/bun.Semver pointing to ./api/schema.zig,
./api_schema/schema.zig, ./semver.zig and ./semver/semver.zig) which drift from
Section 2 that moves src/api/schema.zig into src/options_types/schema.zig; make
the document consistent by choosing one canonical directory layout (either
options_types or api_schema/cli_types) and update all occurrences of the symbols
`bun.schema` and `bun.Semver` and their file path examples to that layout, and
also update the other affected locations (the two additional occurrences noted)
so every reference points to the same directory names and filenames used in
Section 2.

In `@scripts/b2-aggregate-blocked.ts`:
- Line 6: Replace the hardcoded TASKS constant with a parameterized value: read
the tasks directory from a CLI argument or environment variable (e.g.,
process.argv or process.env.TASKS_DIR) in the script, validate that the path
exists and is a directory before scanning (fs.existsSync/fs.statSync or
fs.promises.stat), and if invalid log an error and exit; update any references
to the TASKS constant to use the new variable so the script works across
different runs/sessions.

In `@scripts/b2-cycle-args.ts`:
- Around line 92-97: The loop currently calls readdirSync("src") and join("src",
d) which assume the current working directory is the repo root; resolve the
repository src directory once to an absolute path and use that everywhere
instead. Create a resolvedSrc (or similar) using path.resolve/path.join with
__dirname to point at the repo's src directory, call readdirSync(resolvedSrc),
use statSync(path.join(resolvedSrc, d)) and pass absolute paths into gateCount
and any other functions (instead of join("src", d)) so the script works
regardless of the caller's CWD; keep KEYSTONE, crates push, and tier(d) logic
unchanged except to pass the correct path or basename as needed.

In `@scripts/build/bun.ts`:
- Around line 877-890: The escape detection fails on Windows when realBuild is
on a different drive because relative(realCwd, realBuild) can return an absolute
path; update the escapes calculation to treat an absolute rel as escaping (i.e.,
make escapes true when rel startsWith("..") or rel === "" or
path.isAbsolute(rel)). Modify the code around realpathSync/relative (variables
rel and escapes) and ensure you reference/import path.isAbsolute (the Node
path.isAbsolute function) so the assert still correctly detects symlinked build
directories outside the source tree.

In `@scripts/build/codegen.ts`:
- Around line 600-635: The filter building rsInputs in emitHostExports fails on
Windows because it compares absolute paths with platform backslashes; change the
filter on sources.rust to normalize each input to a forward-slash relative path
(e.g. path.relative(cfg.cwd, p).replace(/\\/g, "/")) and then test that relative
path startsWith "src/runtime/" or "src/jsc/" and does not end with
"generated_host_exports.rs" (keep the existing exclusion). Update references to
the test from p.includes(...) to use the normalized relative path so rsInputs is
populated correctly on Windows.

In `@scripts/build/rust.ts`:
- Around line 105-116: The array allRustTargets is missing the two triples that
rustTarget() and rustCanCrossFromLinux() treat as supported, causing
rust:check-all to skip them; update the allRustTargets constant to include
"x86_64-linux-android" and "aarch64-unknown-freebsd" (in the same format as the
other entries) so it matches the supported triples modelled by rustTarget() and
rustCanCrossFromLinux().
- Around line 333-337: The CARGO_TARGET_<TRIPLE>_LINKER env var is always set to
cfg.cxx but for Windows MSVC targets it must use cfg.msvcLinker to avoid
PATH-based linker resolution; update the code that builds the env object (the
entry that sets `CARGO_TARGET_${triple.toUpperCase().replace(/-/g,
"_")}_LINKER`) to choose cfg.msvcLinker when cfg.windows is true and
cfg.msvcLinker is defined, otherwise fall back to cfg.cxx (refer to symbols:
`cfg.msvcLinker`, `cfg.cxx`, `triple`, and the `CARGO_TARGET_${...}_LINKER`
key); follow the same guard logic used in source.ts to ensure Windows MSVC cargo
invocations use the explicit msvc linker.

In `@scripts/build/stream.ts`:
- Around line 40-45: The usage/help string emitted by scripts/build/stream.ts is
missing the documented flags --console and --stamp=PATH; update the script's
usage text (the runtime usage string printed by the help/usage routine in
stream.ts) to include both --console and --stamp=PATH so the built-in help
matches the comment block, and ensure any code paths that format or validate
arguments reference the same canonical usage string to keep them in sync.

In `@scripts/build/tools.ts`:
- Around line 562-594: The code in findRustLld currently chooses the LLD wrapper
based on the build-machine os parameter, which breaks cross-compilation; change
the selection to inspect the extracted hostTriple (from vv.match) instead of os
when constructing candidate, e.g. detect Windows/Darwin/Linux by checking
hostTriple for substrings like "windows" or "darwin" (and fall back to os only
if hostTriple is missing/ambiguous), and then pick "rust-lld.exe",
"gcc-ld/ld64.lld" or "gcc-ld/ld.lld" accordingly so the search in bin uses the
target host triple rather than the local os.

In `@scripts/fix-imports.ts`:
- Around line 11-12: The script currently uses process.cwd() via the root
variable which makes git pathspecs and readFileSync/writeFileSync calls relative
to the current working directory; replace that by resolving the repository root
once (via running git rev-parse --show-toplevel) into a repoRoot constant and
use path.resolve(repoRoot, ...) for all file I/O and any git pathspecs. Update
the declaration of root to repoRoot, change every readFileSync/writeFileSync and
any child_process/git invocation that previously used root or relative paths
(the code around the current root usage and the blocks that read/write files) to
build absolute paths from repoRoot, and ensure the git command is executed from
repoRoot (or passed the resolved path) so discovery and writes are anchored to
the repository root.

In `@scripts/fix-mod-paths.ts`:
- Around line 47-49: The script currently uses a relative target
(process.argv[2] || "src") which is resolved from the caller's cwd; instead,
compute an absolute path anchored at the repository root and pass that into
walk() so file mutations always operate on the repo tree. Replace how target is
computed by resolving the repo root (e.g., based on __dirname or known repo
layout) and join/resolve the user argument or default "src" into an absolute
path, then call walk(absTarget) and keep the final console message using the
same absolute/normalized target and the fixed counter.

In `@scripts/fix-vm-import.ts`:
- Around line 10-13: The cleanup loop that builds the Glob list omits the
valkey_jsc tree, so misplaced or duplicate imports like "use
bun_jsc::virtual_machine::VirtualMachine;" in that tree are never visited;
update the array of Glob patterns used with Glob(...).scanSync by adding the
pattern "src/valkey_jsc/**/*.rs" alongside the existing "src/runtime/**/*.rs"
and "src/sql_jsc/**/*.rs" entries so the scanSync loop covers that directory and
removes the stray imports.

In `@scripts/gen-cargo.ts`:
- Around line 164-167: The generated lib.rs template in scripts/gen-cargo.ts
currently inserts a blanket allow line (`#![allow(unused, non_snake_case,
non_camel_case_types, non_upper_case_globals, clippy::all)]`) which should be
annotated for future cleanup; update the template string (the multi-line string
that contains the allow attributes and the `${mods.map(...).join("\n")}`
insertion) to include a clear TODO comment such as `// TODO(port): remove
blanket allows in Phase B` immediately above or on the same line as the allow
attribute so the generated files explicitly document that these suppressions are
temporary and must be removed in Phase B.

In `@scripts/gen-link-stubs.sh`:
- Around line 24-29: The script gen-link-stubs.sh currently pipes grep on
"$UNDEFS" and treats “file missing” as no matches; add an explicit
existence/readability check for the UNDEFS input before the pipeline (e.g. test
-f or -r "$UNDEFS") and if the file is absent, emit a clear error message and
exit nonzero so the failure is visible; update the block that builds the tmp
file (the pipeline referencing CAT1, UNDEFS, and the grep filters for JS2Zig__,
Sink__, bindgen_) to rely on an ensured UNDEFS file or short-circuit early with
the error, so you no longer silently ignore a missing UNDEFS.
- Line 67: The script currently writes generated Rust directly to "$OUT" (the
command ending with ' "$tmp" > "$OUT"'), which can leave a partial file if
interrupted; change the flow to write into a safe temporary file (use "$tmp" or
create one with mktemp), ensure successful generation and any required
validations complete, then atomically replace "$OUT" by moving the temp file
into place with mv -f "$tmp" "$OUT" (and clean up the temp on errors); update
gen-link-stubs.sh to follow this write-then-mv pattern so link_stubs.rs is
replaced atomically.
- Line 19: The OUT assignment uses dirname "$0" which can be wrong depending on
invocation; change the OUT default assignment (variable OUT) to resolve script
path via ${BASH_SOURCE[0]} and canonicalize it (e.g., resolve to an absolute
path once) before appending /../src/runtime/link_stubs.rs so all file operations
use an absolute, canonical path; update the assignment that sets OUT to use
BASH_SOURCE[0] and a canonicalization step instead of dirname "$0".

In `@scripts/migrate-hostfn-vm.ts`:
- Around line 189-195: The current import-detection uses a too-broad regex (/use
.*VirtualMachine/) and can false-match or miss multiline/grouped imports; update
the check in scripts/migrate-hostfn-vm.ts to mirror scripts/fix-vm-import.ts by
testing for a whole-word, semicolon-terminated import of VirtualMachine (e.g.,
ensure the pattern matches strings like "use ...::VirtualMachine;" and accounts
for grouped imports or exact word boundaries) before deciding to inject use
bun_jsc::virtual_machine::VirtualMachine; so you neither skip needed injections
nor create duplicates; adjust the condition that examines txt (the file content)
and reuse the same regex logic/symbols (VirtualMachine, txt) as the referenced
script.

In `@scripts/patch-genclasses-paths.ts`:
- Around line 10-12: The GEN constant currently uses a relative path; change it
to an absolute path resolved from the repository root (derived from
import.meta.url / fileURLToPath and path.resolve or a repoRoot variable) and use
that absolute GEN for both the git show execSync call and
readFileSync/writeFileSync operations so the script works when invoked outside
the repo root; update the GEN declaration and the two usages (the execSync(`git
show HEAD:${GEN}`) call and readFileSync(GEN, ...)) to reference the resolved
absolute path.

In `@scripts/port-batch.ts`:
- Around line 8-14: The code calls readFileSync to build the manifest (const
manifest = readFileSync(...).trim().split(...)) without checking for the file's
existence or catching errors; wrap the readFileSync call in a guard (e.g., check
fs.existsSync("/tmp/port-manifest-filtered.tsv") or try/catch around
readFileSync) and, if the file is missing or reading fails, log a clear error
message including the path and error details (use processLogger or
console.error) and terminate (e.g., process.exit(1)) before attempting to parse
into manifest.

In `@scripts/port-cycle.sh`:
- Around line 14-17: The script currently counts and commits the entire index;
restrict both the staged-file count and the commit to only the Rust pathspecs by
changing the N computation to list cached names filtered to the intended
pathspecs (e.g., use git diff --cached --name-only -- 'src/**/*.rs' 'src/*.rs'
when computing N) and invoke git commit with those same pathspecs (e.g., git
commit ... -- 'src/**/*.rs' 'src/*.rs') so only the files the script manages are
counted and committed; update the commands in scripts/port-cycle.sh where N is
set and where git commit is invoked.
- Around line 4-12: The script currently can continue on errors (missing
/tmp/port-results, cd, cp, printf) because it lacks errexit; update the top of
the script to fail fast (add -e to the existing set -uo pipefail) and ensure the
artifact dir exists before use by creating /tmp/port-results (mkdir -p
/tmp/port-results) and aborting if that fails; also ensure critical commands (cd
"$(dirname "$0")/..", command cp -f "$OUT" "/tmp/port-results/$NAME.json", and
the printf append to /tmp/port-results/log.tsv) are allowed to propagate errors
(rely on set -e) or explicitly check their exit codes so the script stops on
failure, referencing variables NAME, OUT and the target files
/tmp/port-results/$NAME.json and /tmp/port-results/log.tsv.

In `@scripts/rust-check-all.ts`:
- Around line 25-27: The rustup output split leaves CRLFs on Windows so entries
can have trailing "\r" and never match `triple`; update the check around the
`installed` result (the `spawnSync("rustup", ["target", "list", "--installed"],
...)` call and the subsequent `installed.stdout.split("\n").includes(triple)`
logic) to normalize line endings and whitespace before matching (e.g., split on
CRLF-aware pattern or map and trim each entry) so `triple` is matched correctly
across platforms.

In `@scripts/test-scoreboard.sh`:
- Around line 43-56: The script runs the xargs loop over "$DIAG/all.txt" without
guarding the zero-case which can produce misleading output; before invoking the
xargs blocks (the pipelines that read "$DIAG/all.txt" and append to
"$DIAG/results.txt"), add an explicit check for an empty or non-existent
"$DIAG/all.txt" (e.g. test -s or wc -l) and short-circuit: write a clear
empty-results / zero-tests marker to "$DIAG/results.txt" (or exit 0) and skip
the xargs/unshare/timeout invocation (the block that executes '"$BIN"' test "{}"
> '"$DIAG"'/"$slug".log and its duplicate later) so totals and reporting aren’t
produced when there are no tests to run.
- Line 5: Replace the hardcoded "cd /root/bun-5" with robust repo-root detection
and ensure the script exits on failure: compute REPO_ROOT (e.g. via git
rev-parse --show-toplevel || realpath "$(dirname "$0")/.."), then run cd
"$REPO_ROOT" || { echo "Failed to change directory to $REPO_ROOT" >&2; exit 1;
}; also enable failing on errors if not already (add set -e or use set -euo
pipefail) so a failed cd stops execution.
- Around line 29-30: The pids.max cgroup is being set to "max" which disables
PID limiting and contradicts the fork-bomb containment intent; change the write
to "$CG/pids.max" to a sensible numeric cap (e.g., 1024 or another value based
on expected load) instead of "max" so the script enforces a PID limit for the
cgroup (locate the echo that writes to "$CG/pids.max" and replace the "max"
token with the chosen numeric limit and optionally document the chosen value in
the comment).

In `@scripts/utils.mjs`:
- Around line 2665-2669: The blank-line sentinel passed to readUntil is matching
immediately because originalLines contains newline tokens; replace the call
readUntil(/^$/, 30) with a pattern that matches an actual newline token (for
example readUntil(/^\r?\n$/, 30)) so the function readUntil will consume the
full rustc diagnostic body (span, caret, help/note lines) after the --> line
(see the surrounding use of readUntil and locMatch to locate the diagnostic
header).

In `@src/aio/ParentDeathWatchdog.rs`:
- Line 568: The cast from info.pbi_ppid (u32) to libc::pid_t currently uses
libc::pid_t::try_from(info.pbi_ppid).expect("int cast"), which can panic on
overflow; change it to safely handle overflow by using .unwrap_or(0) (or
equivalent non-panicking fallback) so an out-of-range parent PID becomes 0
instead of causing a panic—update the expression around info.pbi_ppid /
libc::pid_t::try_from in ParentDeathWatchdog.rs to use unwrap_or(0) and return
that value.
- Line 362: Replace the explicit to_visit.swap_remove(to_visit.len() - 1) with
to_visit.pop() and handle the returned Option; either use
to_visit.pop().expect("...")/unwrap() if empty is impossible in this context, or
match/if-let to handle None safely. This change targets the code that removes
the last element from the Vec (the variable to_visit) so update the call site
accordingly to use pop() and adjust for the Option return type.

---

Outside diff comments:
In `@docs/RUST_PATTERNS.md`:
- Around line 486-488: The file ends without a trailing newline; add a single
newline character at EOF to terminate the file. Open docs/RUST_PATTERNS.md,
locate the table rows such as the line containing "`ptr::read(self) to clone`"
(near the `*mut c_void` ctx callback / `ptr::read(self)` entries) and ensure the
file ends with a newline, then save and commit the change.

In `@src/aio/Cargo.toml`:
- Around line 1-28: The crate manifest for package "bun_aio" (Cargo.toml) is
missing the workspace lints opt-in so workspace-defined Clippy lints like
ptr_as_ptr won’t apply; update the Cargo.toml for the bun_aio crate by adding a
top-level [lints] table with workspace = true (i.e., add `[lints]` followed by
`workspace = true`) so the workspace lints declared in the root are opt‑in for
this member crate.