regression: GET /api/hello segfaults the compiled Next.js standalone server (2026-07-04 main window; was byte-identical at #5932 validation) #5990

Summary

Fresh regression on main (window: 2026-07-04's commits): GET /api/hello on the compiled Next.js 16 App Router standalone server segfaults the server process (SIGSEGV, empty reply, server dead). At the #5932 validation earlier the same day (main @ ~a0a542fae era), both /api/hello GET and POST were byte-identical vs node v26.

Repro

• Standalone Next.js 16 App Router build (/tmp/nx-mine2 on the internal box; app source is the Next.js standalone: deferred-require binding captured by-value (as unresolved thunk) by a class constructor → 'undefined is not a constructor' #5437 matrix app — API route is a trivial JSON echo handler with GET+POST).
• Compile server.js with current main (perry-dev profile is fine), boot with PERRY_ALLOW_UNIMPLEMENTED=1 PERRY_ALLOW_DYNAMIC_STDLIB=1 PERRY_ALLOW_EVAL=1 PORT=<p> HOSTNAME=127.0.0.1 NODE_ENV=production.
• First curl http://127.0.0.1:<p>/api/hello → curl exit 52 (empty reply), server process dead with Segmentation fault: 11. Deterministic (2/2 boots). Static routes (/, /about, /counter) render byte-identical before the crash, so boot + static serving are unaffected.
• Verified NOT caused by PR fix(runtime,transform): #5941 — eliminate the async-step deadlock class (shared-promise adoption severing + swallowed step-resume rejections + id-scan param-default gap) #5988's changes: reproduces on an unmodified main build (632e68e).

Crash data

macOS crash reports captured (e.g. ~/Library/Logs/DiagnosticReports/nx-5941-base-2026-07-04-173207.ips on the box) — 11 frames, all in the compiled binary, unsymbolized on a default build. Recompiling the bundle with PERRY_DEBUG_SYMBOLS=1 and re-symbolizing via atos -l <__TEXT base> will name the frames (the standard #5437-era technique).

Suspect window

The ~25 commits merged 2026-07-04 between the #5932 validation and 632e68e. Categorical suspects touching request/write paths: 8f6db5f (spread-source validation / handle band on the set path), 53d23ad (write-path hardening slice 2: transition_fast, structuredClone, rejection printer), 4de47ef (frozen/non-writable length on mutating array methods). Untriaged — a bundle-compile bisect over that window (API route only, ~10 min per round) should pin it quickly.

References

#5932 (the 5/8 validation this regressed from), #5437 (tracking), PR #5988 (where it was observed while validating).