[proggeramlug]

Summary

A CJS module that rebinds module/exports — var module = X, module = X, or exports = X — silently failed under Perry's CJS→ESM wrapper, which declared them as const. The reassignment collided with the const and was dropped, so reads still saw the wrapper's original object. This fixes that, advancing the #3527 Express compile past iconv-lite.

Root cause

The wrapper template was:

const _cjs = (function() {
  const module = { exports: {} };
  const exports = module.exports;
  ...body...
  return module.exports;
})();

iconv-lite's encodings/index.js does:

for (var i = 0; i < modules.length; i++) {
  var module = modules[i]            // ← collides with `const module`, dropped
  mergeModules(exports, module)      // reads module.<key>
}

module stayed the wrapper object (no cesu8 key), so module["cesu8"] read undefined → TypeError: Cannot read properties of undefined (reading 'cesu8') during init. (Minimal repro: var module = src; module.cesu8 → undefined.)

Fix

In Node, module/exports are wrapper-function parameters — freely reassignable, and rebinding the local is harmless because Node reads the real exports from its own module reference. Mirror that:

const __cjs_module = { exports: {} };   // stable ref, read back at the end
var module = __cjs_module;              // reassignable
var exports = __cjs_module.exports;     // reassignable
...body...
return __cjs_module.exports;

A body reassigning its module local can no longer clobber what the module exports, and var module = X binds as expected.

Verification

• Minimal var module = X; module.cesu8 repro and the iconv-lite shape now correct; the Express tree advances past iconv-lite.
• No regression: module.exports = X, exports.foo = …, module.exports.bar = … all unchanged (the return __cjs_module.exports reads the stable ref).
• New unit test asserts the reassignable-var + stable-ref wrapper shape; all 53 cjs_wrap tests pass. cargo fmt --check clean.

Part of the #3527 chain (prior: #3537/#3543/#3546 codegen, #3551 wildcard, #3733 SIGBUS, #3751 Object.hasOwn). No version bump / changelog — folded in at merge per the worktree-PR convention.