fix(hir): give each evaluation of a dynamic-heritage class expression its own class (#11042)

[proggeramlug]

Part of #11042 — fixes the reported client.on("error", …) TypeError; the real package then stops on #11120 and #11121 (see Tests), so this does not close the issue.

Root cause

A class expression with dynamic heritage (class extends <runtime value> {}) evaluated inside a function was one shared class across every evaluation. It had one class id, one parent edge (the last evaluation's extends won) and one Class.prototype[name] = … table. arm_class.rs sent a function-body class expression through the per-evaluation ClassExprFresh path only when it also carried statics, computed keys, captures, private elements or a used self-binding. #10622 widened that to one shape: an exported factory whose whole body is return class extends X {}. Same-module direct call sites are cloned by specialize_captured_class_factories. Everything else kept the shared template.

@redis/client's commander.js attachConfig falls outside all of those. It is a comma declarator (const RESP = …, Class = class extends BaseClass {}) followed by a Class.prototype[name] = … loop, and it is called across modules. RedisClient.factory evaluates it for RedisClient, then for RedisClientMultiCommand (Client.prototype.Multi = …extend(config)), and only then runs new Client(options). So:

• The client ran the Multi class's constructor.
• It lost its EventEmitter ancestry.
• client.on("error", cb) resolved to the events module's static on(emitter, name), which threw The "emitter" argument must be an instance of EventEmitter. Received type string ('error').

The earlier diagnosis on the issue was right about the symptom: the receiver reaching js_native_call_method's namespace fast path was the real events namespace object. The fast path is correct for a genuine namespace. The defect is upstream, in the clobbered class.

Fix

• crates/perry-hir/src/lower/lower_expr/arm_class.rs: every function-body class expression with a dynamic extends_expr now takes the ClassExprFresh path. That path already existed, with a per-evaluation heritage pin (effect: HttpApi server dies at startup with "TypeError: undefined is not iterable" (logger/fork already work) #6438/SIGSEGV: factory returning class D extends <param>, chained two levels, then instantiated (zod v4 $constructor shape) #9364/instanceof against a ClassExprFresh parent resolves by shared class id, so an earlier evaluation's class can fail instanceof after a later evaluation #10624) and a per-evaluation .prototype. A statically resolved parent (extends_expr == None) cannot differ between evaluations, so it keeps the cheaper shared template. Module-top expressions are unchanged.
• New perry_hir::class_value_template_name (ir/class_value.rs) recognizes such a bare ClassExprFresh (no statics, keys, captures or self-binding) as naming its template. factory_specialize.rs and lower/misc.rs now use it where they read a factory's returned ClassRef. This keeps same-module per-call-site specialization and static extends Factory(...) parent hoisting exactly as before.
• crates/perry-runtime/src/builtins/formatting.rs: routing more classes through the fresh path exposed a pre-existing leak. console.log/util.inspect printed the internal __perry_ctor_class_object/__perry_parent_class pin keys, which every other reflective surface already hides. The first A/B run caught it as a regression in test_gap_9440_error_name_ownership. The formatter now skips is_internal_runtime_key_bytes keys.

Tests

Command and result for each check:

• New gap test test_gap_11042_class_expr_dynamic_heritage_per_evaluation.ts (+ gap_11042_…_helper.ts, a cross-module attachConfig). Stdout is byte-identical to Node 26.5.1 (/opt/node-v26.5.1-linux-x64) with the fix. On origin/main d8f24f1 (built the same way, --profile perry-dev, PERRY_NO_AUTO_OPTIMIZE=1) it fails: distinct classes: false, then TypeError: a is not a function.
• Gap A/B, 196 tests: every test_gap_* whose source contains extends, plus names matching class_expr|mixin|factory|event|emitter|inspect|console|util_|format|weak|map_set|private|error. Each was compiled by the baseline and by this branch and compared to Node 26.5.1. 190 pass on both arms. The other 6 fail identically on both arms (console_methods differs only in a console.time reading). Zero regressions. I ran my own loop, not run_parity_tests.sh: the harness's fixed port collides with other agents' sweeps on the shared host.
• Real package, redis@6.1.0 (pinned) against a live redis-server: the client.on("error", …) TypeError from this issue is gone. The fixture then stops on two separate pre-existing defects, filed as Subclass field initializer 'new events_1()' with a private-field parent throws 'Cannot initialize a private field twice' (blocks redis createClient) #11120 and redis: RedisClient.parseURL throws 'Value of URL.prototype.hostname called on an incompatible receiver' (new node_url_1.URL(...) in @redis/client) #11121. Both reproduce byte-identically on origin/main once the .on crash is out of the way. So this PR fixes the reported error, but the fixture does not yet run end-to-end.
  • Subclass field initializer 'new events_1()' with a private-field parent throws 'Cannot initialize a private field twice' (blocks redis createClient) #11120: createClient({ socket }) fails with Cannot initialize a private field twice on the same object. The cause is a subclass field initializer events = new events_1() over a parent with private fields, in linked-list.js. It has a package-free repro.
  • redis: RedisClient.parseURL throws 'Value of URL.prototype.hostname called on an incompatible receiver' (new node_url_1.URL(...) in @redis/client) #11121: createClient({ url }) fails because RedisClient.parseURL throws Value of URL.prototype.hostname called on an incompatible receiver. It reproduces with no server.
• cargo test --profile perry-dev -p perry-hir -p perry-transform: all pass.
• RUSTFLAGS="-D warnings" cargo check -p perry-hir -p perry-transform -p perry-runtime --all-targets (dev profile): clean.
• cargo fmt --all -- --check, scripts/check_file_size.sh: clean.
• SKIP_COMPILE_GATES=1 scripts/run_lint_gates.sh: 87 of 88 script gates pass. The one failure is cargo xwin check, because cargo-xwin is not installed on the Linux host (environmental). The compile tier was not run. git diff --stat was empty afterwards.

Known remaining (pre-existing, not changed here)

Instances still carry their template's class id. A class-id-keyed lookup can therefore still see a sibling evaluation's parent:

• A mk(A) instance reading a method that only mk(B)'s base defines gets it, where Node gives undefined.
• Object.create(new (mk(R))()) instanceof R is false after a later evaluation.

These were already true for fresh class expressions with statics. Giving each evaluation its own class id would fix them, but that touches every cid-keyed runtime table, so it is not attempted here.

Not run

• cargo test --workspace and perry-runtime's own suite (only a formatter branch changed there).
• The full gap sweep.
• The run_lint_gates.sh compile tier and the Windows cargo xwin check.
• The perf/instruction-count A/B. The change is a lowering-route change for dynamic-heritage class expressions only. Construction of such classes now goes through the class-object replay path instead of the shared template, which was the wrong class anyway.
• No other integration suite should be affected. The perry-transform factory-specialization tests pass unchanged.

[proggeramlug]

Heads-up while this is being reduced: #11014's version of the util.inspect fix landed on main in merge train 268 (v0.5.1651, 36892b7194). So dropping this PR's formatting.rs half is now a rebase requirement, not just a courtesy — keeping it will conflict.

The landed version is worth a look before you rebase, because the diagnosis went past "hide two keys":

• The leak pre-dates both PRs. format_object_as_json walks object_keys_array directly and was the only enumeration path that never applied is_internal_runtime_key — Object.keys, for…in, getOwnPropertyNames, JSON.stringify, hasOwnProperty and spread all do. The fix is "apply the existing allowlist here too", not a new hide-list.
• Neither PR caused it; both merely route a covered fixture onto the latent bug. Yours via ClassExprFresh, fix: preserve Effect tagged error names across class evaluations #11014's via its arm_class.rs hunk.
• showHidden deliberately still does not reveal them — it exposes non-enumerable JS properties, and these are runtime bookkeeping.
• It came with formatting/internal_key_hiding_tests.rs: three cases, each asserting its key spelling really is in the allowlist first, so a renamed constant fails the precondition rather than passing vacuously.

Your perry-hir class-expression half is independent and still wanted — send the reduced head and it goes in the next train.

[proggeramlug]

Closing as superseded. Main fixed the #11042 client.on error independently in 86cb666 ("preserve tagged error names across class evaluations"), which changes the same arm_class.rs condition and deliberately excludes class expressions with static methods.

Rebased onto main, this PR's extra class_value_template_name helper would make a C.prototype[k] = v write unreadable on instances, so it should not land.

The remaining per-evaluation prototype leak is filed as #11134, and the fix will carry this PR's gap test as coverage.