brain

One binary, six operating systems, two ISAs. The APE format and cosmocc toolchain.

Tiny systems language built on QBE, deliberately constrained, BSD/Linux-only, manual memory.

cgo, c-shared, c-archive: keep vm3 in Go and call into it from native code.

JIT-first scientific language adding a real AOT path via juliac and a trimming-based static binary mechanism.

Statically-typed Go-influenced language that defaults to emitting C, with experimental native and LLVM backends and a multi-mode memory model.

Mike Pall's preprocessor-driven assembler with runtime patching; LuaJIT's secret weapon.

Go's internal assembler exported as a library, already used by Mochi's vm2jit.

Stencil-based binary stitching from OOPSLA 2021, now shipping in CPython 3.13/3.14.

The default Linux libc, and the reasons "fully static linking" is officially unsupported.

Rui Ueyama's ~10k LOC C compiler that emits x86-64 GAS assembly directly from a recursive-descent parser. The clearest published example of a single-pass codegen pipeline that produces correct code with no IR, no SSA, no register allocator.

GCC as a shared library, used by Emacs native compilation, GCC Rust, GDC, Cython.

The general-purpose 64-bit RISC-V baseline plus vector and recent extensions.

The general pattern that Sparkplug, Liftoff, JSC Baseline, and the HotSpot template interpreter all instantiate. Per-op native template, fixed register convention, stub calls for slow paths, optional inline caches as patchable code regions.

Wasm 3.0 (2025) as the stable target, plus WASI Preview 2/3 and the component model.

The static-friendly C library that makes "build once, ship anywhere" actually work on Linux.

Survey of niche or specialized architectures that MEP-42 should be aware of but probably defer.

A converged design pattern across three independent implementations: per-opcode template emission, a virtual operand stack with lazy register promotion, no IR, no global optimization. The current state of the art in "fast and simple" Wasm code generation.

Windows 11 on Snapdragon X / X2 Elite, Surface Pro X lineage, and ARM64EC interop.

Emitting a self-contained executable from the compiler, no external linker required.

Stencil-driven code generation that harvests pre-compiled opcode snippets at build time and stitches them into native code at runtime via relocation patches. No IR, no register allocator, no instruction selector. The technique CPython 3.13+ ships in production.

Ruby-syntax statically-typed language with global type inference, LLVM backend, and Boehm GC.

Systems language rebuilding its compiler around its own native backends, with LLVM demoted to an optional path.

Tree-walk to tuples to native assembly. The textbook recipe from the Dragon Book and Cooper/Torczon, still the right starting point when you want correctness before performance.

Closed-world AOT compilation that turns a managed JVM application into a self-contained native executable.

Microsoft's production successor to CoreRT: trimmed CoreCLR plus RyuJIT-as-AOT, shipping single-file native binaries.

The workhorse SSA infrastructure, version 20 era, evaluated for MEP-42.

Vladimir Makarov's lightweight JIT+AOT, fast compile times, lazy basic-block versioning.

The historical Linux workhorse and its dying sibling.

Quentin Carbonneaux's deliberately tiny SSA backend, "70% of LLVM in 10% of the code."

The closed-source Mach-O linker that ships in Xcode 15 and later.

Bytecode Alliance's Rust-native SSA backend, ISLE-driven, ~10x faster compile than LLVM.

The default 64-bit Unix ABI: Linux, macOS, FreeBSD, OpenBSD, NetBSD, illumos.

The fastest production ELF linker, single-author, MIT licensed.

The 4-register fast-call convention used by every Windows-on-AMD64 binary.

The base 64-bit Arm calling standard, with Apple and Microsoft deltas called out.

A single-pass, IR-free transpiler from Ignition bytecode to native machine code, designed to add a fast tier between an interpreter and an optimizer with minimal engineering cost.

Apple WebKit's original template-style baseline compiler, the longest-running production baseline JIT for a dynamic language, and the design template for every modern four-tier VM.

One binary, four object formats, cross-link from any host.

The state of Rust's borrow checker as the Polonius "alpha" lands behind a nightly feature gate, and what a non-ownership language can still steal from it.

A direct ancestor of vm3's 32-bit slab index. V8 squeezes 64-bit pointers down to 32-bit offsets within a per-isolate 4 GB virtual region (the "cage"). Cut V8's heap by 43%, Chrome renderer memory by 20%.

Capability tracking in the type system. Each value's type may carry a capture set listing which capabilities it could reference. Foundation for capability-based effects, separation checking (System Capybara), and ownership for resources.

What every shipping JIT must do on day 1 to be production-grade: never have a code page that is both writable and executable to the same thread at the same time.

Speculative-execution attacks haven't gone away. As of May 2026, every shipping JIT either implements index masking + bounds-check hardening, or relies on process-level Site Isolation, or both.

"Garbage-free" precise reference counting with reuse — in-place updates without locks, statically inserted at compile time.

A WebAssembly extension that replaces linear memory with segments and handles. Handles are unforgeable, typed pointers carrying bounds and provenance — closely modelled on CHERI capabilities but pure software.

Microsoft Research's experimental concurrent-ownership language. Ownership is over **regions** (groups of objects) instead of individual objects. Cowns (concurrent owners) serialise access; behaviours schedule work over multiple cowns atomically.

The CG-track answer to "what's beyond a single 4 GB linear memory?" Multiple memories shipped in Wasm 3.0 (Sep 2025). Memory64 shipped at the same time. A formal "segmented memory" proposal in the MSWasm vein has not yet entered the CG track but is influencing design.

Native GC primitives in a portable bytecode. Ratified in Wasm 3.0 (Sep 2025), shipped in all major browsers by Dec 2024. Dart, Kotlin, OCaml, Java/Scala/Scheme can now compile to Wasm without bundling a GC.

The production-grade formally verified C compiler, the CompCertO / Owlang line, and why it matters for JIT verification.

Stenberg's curl CVE data, the Hyper / Rust experiment, and the unresolved 2026 question of whether memory-safe languages are the whole answer.

Single ownership with deterministic destruction, multiple simultaneous borrows allowed, runtime borrow-count enforcement. No GC, no compile-time borrow checker, no lifetime variables. Concurrency uses `uni T` (unique values) for safe inter-process transfer.

The CRA's 2026-2027 enforcement timeline and the implicit pressure toward memory-safe languages.

Iris-based separation logics with space credits, tracing GC, and the 2025 IrisFit + Nextgen-Modality lines.

A pragmatic language by Wouter van Oortmerssen that elides 95% of refcount ops at compile time through flow-typed lifetime analysis. Cycles handled by a cleanup at program exit.

Rust verification by functional translation: compile Rust to a pure lambda calculus, verify there.

MTE in a Managed Runtime

MarkUs and quarantine-style UAF prevention

Java's flagship low-latency collector. Sub-millisecond pauses on multi-TB heaps via colored 64-bit pointers and concurrent everything.

The voluntary US federal pledge that has set the de-facto industry baseline for memory-safety roadmaps.

The DoD's evolving acquisition posture on memory-safe languages, the SWFT framework, and aerospace coding standards.

The bootstrapping verified ML compiler, its 2024 PLDI agenda, and the FM-JIT verified-JIT effort that builds on it.

CHERIoT

Google's published 2022-2026 data on memory-safety progress — Android's 76% → <20% trajectory, the CVE-2025-48530 near-miss, the V8 sandbox.

The White House Office of the National Cyber Director's memory-safety report and the C/C++-adverse federal stance.

CHERI (Next Generation)

Intel CET Shadow Stack + IBT

The 2024-2026 industry picture on temporal memory safety, kernel mitigations, and the convergence of UAF defences.

Mutable value semantics with subscript-based projection borrowing, no lifetime variables, and the Law of Exclusivity enforced at call sites.

Arm MTE

Cerise, the CHERI-C Coq memory model, and capability-safety logical relations as the formal model behind handle-based runtimes.

The canonical industry data point on memory-safety vulnerability prevalence, and every follow-up through 2026.

AWS's bit-precise bounded model checker for Rust, deployed in CI on Firecracker and the standard library.

Swift 6.x has shipped a complete move-only/noncopyable system layered on top of ARC. Parameter conventions are explicit; the law of exclusivity (Swift's variant from 2017) supplies the static aliasing discipline.

Foundational separation-logic verification of Rust's safe / unsafe core, and its 2024-2026 RefinedRust successor.

WebKit's retreating-wavefront concurrent garbage collector. Marks objects while JS runs, throttles allocation when it falls behind, and uses logical versioning to skip clearing bitmaps.

A purely software in-process sandbox for the V8 JS heap. Ban raw pointers, replace with offsets into a 1 TB sandbox region and indices into out-of-sandbox pointer tables. About 1% perf cost, enabled by default in Chrome 123. Every modern JIT is moving this direction.

MEP-41 Research Substrate: Memory Safety Advances 2023–May 2026

The NSA's formal language-level guidance, the named-language list, and the joint CISA reissue.

A Rust-like ownership system with simpler call-site syntax, taped onto a Python-shaped surface, sitting on MLIR, headed to open source in fall 2026.

Linearity attached to function arrows, not to types. Backwards-compatible: ordinary code continues to type-check unchanged. Experimental since GHC 9.0; still labelled experimental in 9.12 / 9.15 (2024–2026).

A research framework that cleanly separates GC plans from policies, plus the LXR collector that proves a stop-the-world RC+mark-region design can beat industrial concurrent GCs on tail latency.

Stacked Borrows, the 2025 Tree Borrows replacement, and the trajectory of NLL / two-phase formalisation.

Microsoft Research's SMT-backed Rust verifier, the leading tool for verified systems software at scale in 2025-2026.

Six capabilities (iso, trn, ref, val, box, tag) make actor-based concurrency data-race-free at compile time. Production at WallarooLabs and Microsoft; foundation for Verona's region work.

A deductive verifier for safe Rust that compiles to Why3 and discharges to off-the-shelf SMT solvers.

Arm PAC + BTI

Intel LAM (Linear Address Masking) and the x86 top-byte-tag story

Chrome Security's published per-quarter memory-safety data for 2024-2026, the JSON / PNG / fonts Rust rollouts, and the V8 sandbox.

Strict linear types as the load-bearing primitive for memory and protocol safety, plus capability-based effect control. Spec-and-compiler-small enough to read in a weekend.

Orthogonal modes layered onto OCaml's type system. Mode is a property of a value, separate from its type, tracked through inference. Production in Jane Street; open-sourced as OxCaml in 2025.

Scudo & friends: hardened allocators in production

Arm Morello

The direct intellectual ancestor of vm3's handle design: a per-allocation generation counter, a per-reference remembered generation, and a check on every dereference. Same idea, different layer.

Chrome's two cooperating collectors. Orinoco runs V8's young-generation JS heap in parallel; Oilpan is Blink's traced C++ GC, recently hosted inside V8 as a library, learning to do generational collection with conservative stack scanning.

The canonical "secure allocator inside a managed runtime." Scudo is Android's hardened native heap, used for ART's non-managed allocations (JIT code, off-heap buffers, JNI). Pairs with ARM MTE on Armv9 hardware for hardware-checked tagging.

The biggest real-world deployment of Perceus reference counting, layered with Morphic alias analysis and "seamless slices" so functional code rarely allocates.

This book describes the Zig programming language as of Zig 0.16.

A

These are short answers or sketches for selected exercises from the book. Many exercises have several reasonable solutions. The important part is clarity and correctness.

This appendix records the kinds of changes that matter when moving older Zig code to Zig 0.16. It is a practical checklist, not a full release history.