## Summary

This is the first PR in the #10104 stack. It adds the test infrastructure and core integration coverage before the implementation changes production behavior.

The key harness change is fail-closed support for known runtime failures. A fixture may declare `expectExecutionFailure` with an explicit reason and required output fragments. The runner accepts only a matching nonzero runtime exit: an unexpected pass, a different runtime error, an invalid configuration, or a bundler-creation failure still fails the test.

This PR changes no production bundler code and adds no inline tests to production modules. All strict-order assertions live in integration fixtures or the Rolldown integration-test tree.

## What is covered

- Adds 30 Rolldown fixture directories: 24 directed strict-order regressions, 2 fixture graphs used by the strict-order invariant suite, and 4 top-level-await fixtures.
- Adds 12 integration tests that exercise real `Bundler` instances for entry facades, emitted entries, runtime-helper closure, flag-off compatibility, output-file validation, hazard-free on-demand output, and wrap-all behavior.
- Adds an executable runtime oracle to the existing `issue_4684` fixture.
- Adds a shared console-capture helper used by 12 runtime order oracles; it supports async callbacks and restores `console.log` in `finally`.
- Adds schema and config-variant support for base-level and per-variant expected execution failures.
- Adds 9 self-tests for the failure harness, including matching failure, mismatched failure, XPASS, variant scoping, blank reason/matcher rejection, bundler-creation errors, and manual API coverage.

The fixture graphs cover CJS carriers and cross-chunk cycles, manual groups, user/dynamic/emitted entry facades, retained re-export paths, namespace reads, top-level-await output legality, and external-module boundaries.

Known failures are marked only so this test-first layer can pass on `main`. The markers include exact output signatures and are removed by #10104 only after the implementation makes the corresponding cells pass.

## Review guide

1. Review `crates/rolldown_testing/src/integration_test.rs` together with `crates/rolldown_testing/tests/expected_execution_failure.rs`; this is the fail-closed contract that makes the test-first stack possible.
2. Review `crates/rolldown/tests/rolldown/function/strict_execution_order_invariants/mod.rs`; these are integration tests over real bundler output, not production inline tests.
3. Review each new fixture's `_test.mjs` before its snapshot. Runtime behavior is the primary oracle; snapshots pin the associated chunk and facade shape.
4. Review the four `topics/tla/strict_*` fixtures as output-legality coverage. They do not broaden the semantic guarantee of `strictExecutionOrder`.

## Stack

Merge and review in this order:

1. #10253 (this PR): fail-closed runtime-failure harness and core integration regressions.
2. #10252: additional hardening fixtures and paired wrap-all/on-demand coverage.
3. #10104: on-demand implementation, removal of all temporary failure markers, and final output baselines.

## Validation

Validated at `9063159cb3bb99da98a7d6cec1a214ee45f708cb`:

- Expected-execution-failure harness: 9/9 passed.
- Strict execution-order fixture tests: 63/63 passed on this layer, including the expected-failure cells.
- GitHub required checks pass, including Rust Validation, Cargo Test, Node Validation, repository validation, and the Ubuntu Node matrices.
- The PR contains 250 changed files: 241 new files and 9 modified files, limited to Rolldown tests and test infrastructure.

## Summary

- Give every declared strict-execution-order fixture cell an explicit config name. All 190 cells across 93 fixtures now identify the wrapping mode as `wrap-all` / `on-demand`, with any orthogonal setting included as a prefix.
- Normalize the naming outliers called out in the #10252 review without changing the base, variant, or generated extended-test matrices.
- Complete the `emergent_cycle_excluded_forwarder_import` comment with the projection/fixpoint path that makes the regression green.

## Why

This follows up on [review feedback from #10252](#10252 (comment)). Unnamed cells left `globalThis.__configName` unset, while labels such as `strict`, `minify`, or `cjs` did not consistently say whether the cell used wrap-all or on-demand wrapping.

Relative to `main`, every changed `_config.json` is identical after removing `configName` / `_configName`; the fixture matrix and expected-execution-failure markers are unchanged. Generated output is also unchanged. The 21 updated snapshots only rename 35 `# Variant:` headings.

## Validation

- Audited all 95 config files containing `strictExecutionOrder`: 190 declared strict cells, with zero unnamed cells, mode mismatches, or fixture-local duplicate names.
- Ran `just t-run` for all 95 config files twice; both passes completed 95/95 and the snapshot diff stayed stable.
- Ran the five fixtures whose base mode affects generated extended variants twice with `NEEDS_EXTENDED=true cargo run-fixture`.
- `just lint-repo`
- `git diff --check origin/main`

## Summary

This PR isolates the review-only test layout changes requested for #10104.

- Apply the final base/variant ordering and explicit names used by the implementation PR.
- Remove 44 temporary `snapshot: false` gates and record the current `main` output in those positions.
- Keep all 44 expected-execution-failure markers attached to the same semantic configuration cells. No known failure is fixed in this layer.

Only `_config.json` and `artifacts.snap` files change: 86 configs and 85 snapshots. There are no production-code, test-input, harness, or runtime-assertion changes.

## Why this is separate

The previous #10104 diff changed variant order while also changing generated output. GitHub's positional diff then compared wrap-all output on one side with on-demand output on the other, which made unchanged behavior look like a large regression.

With this PR as the base, #10104 compares the same named configurations in the same order. Its config diff only removes expected-failure markers, and its snapshot diff shows the implementation result at the corresponding positions.

## Test-first sequence

The earlier test-first layers are already merged into `main`:

1. #10253 added the fail-closed runtime-failure harness and core integration regressions.
2. #10252 added the later hardening fixtures and paired-mode coverage.

The remaining Graphite stack is:

1. #10287 (this PR) establishes the final review layout and current-`main` snapshots while preserving every known failure.
2. #10104 adds the implementation, removes the failure markers, and records the implementation output.

## Validation

Validation ran on `main` at `c4e25974b8ff7598bf507ae4a2d7602cbcbc86fd`.

- All 86 changed fixture configs passed twice on the old implementation.
- The second pass was snapshot-stable.
- Structural audit: 96 strict-enabled fixture configs, 200 named strict executions, no missing or duplicate names, and 44 expected-failure cells preserved.
- Layout audit: all 87 target config layouts match the final #10104 layout after ignoring names and expected-failure metadata.
- `just lint-repo` passed.

## Summary

This PR isolates the review-only test layout changes requested for
#10104.

- Apply the final base/variant ordering and explicit names used by the
implementation PR.
- Remove 44 temporary `snapshot: false` gates and record the current
`main` output in those positions.
- Keep all 44 expected-execution-failure markers attached to the same
semantic configuration cells. No known failure is fixed in this layer.

Only `_config.json` and `artifacts.snap` files change: 86 configs and 85
snapshots. There are no production-code, test-input, harness, or
runtime-assertion changes.

## Why this is separate

The previous #10104 diff changed variant order while also changing
generated output. GitHub's positional diff then compared wrap-all output
on one side with on-demand output on the other, which made unchanged
behavior look like a large regression.

With this PR as the base, #10104 compares the same named configurations
in the same order. Its config diff only removes expected-failure
markers, and its snapshot diff shows the implementation result at the
corresponding positions.

## Test-first sequence

The earlier test-first layers are already merged into `main`:

1. #10253 added the fail-closed runtime-failure harness and core
integration regressions.
2. #10252 added the later hardening fixtures and paired-mode coverage.

The remaining Graphite stack is:

1. #10287 (this PR) establishes the final review layout and
current-`main` snapshots while preserving every known failure.
2. #10104 adds the implementation, removes the failure markers, and
records the implementation output.

## Validation

Validation ran on `main` at `c4e25974b8ff7598bf507ae4a2d7602cbcbc86fd`.

- All 86 changed fixture configs passed twice on the old implementation.
- The second pass was snapshot-stable.
- Structural audit: 96 strict-enabled fixture configs, 200 named strict
executions, no missing or duplicate names, and 44 expected-failure cells
preserved.
- Layout audit: all 87 target config layouts match the final #10104
layout after ignoring names and expected-failure metadata.
- `just lint-repo` passed.

## [1.2.0] - 2026-07-15

### 🚀 Features

- dev: skip shipping factories for newly imported top-level modules (#10223) by @h-a-n-a
- dev: per-client ship map for HMR patch sizing (#10208) by @h-a-n-a
- dev: client-side HMR (#10164) by @h-a-n-a
- dev: send a full-reload update to clients when a tsconfig changes (#10262) by @shulaoda
- treat `import.meta['url']` and `import.meta['ROLLUP_FILE_URL_*']` as side-effect free (#10267) by @sapphi-red
- rewrite `import.meta['url']` (#10251) by @sapphi-red
- add `FILE_NOT_FOUND` error (#10220) by @sapphi-red
- treat `import.meta.ROLLUP_FILE_URL_*` as side-effect free (#10217) by @sapphi-red

### 🐛 Bug Fixes

- sourcemap: preserve unmapped boundaries during composition (#10254) by @hyfdev
- `[format]` in `*FileNames` option for ESM format should be `es` instead of `esm` (#10214) by @sapphi-red
- sourcemap: preserve coarse mappings during composition (#10249) by @hyfdev
- rolldown_plugin_vite_import_glob: support tsconfig paths with `import.meta.glob` (#10167) by @sapphi-red
- dev: clear tsconfig caches for bare full builds (#10276) by @shulaoda
- dev: force a full rebuild when a tsconfig changes (#10261) by @shulaoda
- treat rooted drive-less module ids as absolute in preserveModules naming (#10235) by @IWANABETHATGUY
- watch: rebuild when tsconfig files change (#10258) by @shulaoda
- watch: drop tsconfig-merged transform options on each rebuild (#10257) by @shulaoda
- incorrect `EMPTY_IMPORT_META` warning for `import.meta.ROLLUP_FILE_URL_*` for CJS output (#10221) by @sapphi-red
- deconflict: rename CJS locals shadowing wrapped-ESM namespace objects (#9970) by @IWANABETHATGUY
- rolldown: drop the unused runtime module after entry-level external flattening (#10237) by @IWANABETHATGUY
- rolldown: re-propagate has_dynamic_exports to transitive star importers (#10239) by @IWANABETHATGUY
- tree-shaking: tree-shake destructured dynamic import namespace bindings (#10213) by @logaretm
- s390x: use json-escape-simd 3.1.1 for big-endian JSON escaping fix (#10211) by @satyamg1620

### 🚜 Refactor

- dev: move full-reload to client side (#10207) by @h-a-n-a
- readability follow-ups to the ReplaceWith migration (#10286) by @IWANABETHATGUY
- replace take_in-then-write-back with ReplaceWith and by-value moves (#10285) by @Boshen
- share the main resolver's cache with the transformer's tsconfig lookups (#10205) by @shulaoda
- rolldown: extract the ns star-external __reExport emission rule into LinkingMetadata (#10238) by @IWANABETHATGUY
- rolldown: unify link/generate diagnostics into a Diagnostics accumulator (#10234) by @IWANABETHATGUY
- sourcemap_filenames: drop dead sourcemap-filename plumbing (#10189) by @IWANABETHATGUY
- extract external import symbol merging into a method (#10224) by @IWANABETHATGUY
- rolldown: skip CJS namespace merging under strict execution order (#10203) by @hyfdev
- resolve the manual tsconfig per file instead of once at startup (#10200) by @shulaoda
- rolldown: route interop ESM init emission through a shared init-target view (#10202) by @hyfdev
- rolldown: collapse vestigial wrap-kind state and share chunk sort helper (#10201) by @hyfdev

### 📚 Documentation

- show plugin kinds in JSDoc and each hook's description (#10218) by @sapphi-red
- add an explanation about removing imports from external modules without any messages (#10215) by @sapphi-red

### ⚡ Performance

- sourcemap: owned merge in SourceJoiner::join (4005->5 allocs/chunk) (#10250) by @Boshen
- avoid redundant sourcemap string copies in collapse and minify paths (#10093) by @Boshen

### 🧪 Testing

- code-splitting: establish strict-order review baselines (#10287) by @hyfdev
- dev: add hot API test cases (#10181) by @h-a-n-a
- code-splitting: normalize strict execution order variants (#10277) by @hyfdev
- code-splitting: harden strict execution order coverage (#10252) by @hyfdev
- code-splitting: add strict execution order regressions (#10253) by @hyfdev

### ⚙️ Miscellaneous Tasks

- deps: update github actions (#10241) by @renovate[bot]
- deps: update oxc to 0.140.0 (#10274) by @shulaoda
- update Yunfei's GitHub username (#10275) by @hyfdev
- deps: update napi (#10260) by @renovate[bot]
- deps: update test262 submodule for tests (#10266) by @rolldown-guard[bot]
- deps: update dependency vite-plus to v0.2.4 (#10256) by @renovate[bot]
- deps: update napi (#10240) by @renovate[bot]
- deps: update oxc resolver to v11.24.2 (#10245) by @renovate[bot]
- deps: update rust crates (#10244) by @renovate[bot]
- disable Renovate updates for idna_adapter (#10248) by @shulaoda
- deps: update oxc resolver to v11.24.1 (#10232) by @renovate[bot]
- deps: update rust crate oxc_sourcemap to v8.1.1 (#10233) by @renovate[bot]
- deps: update dependency rolldown-plugin-dts to ^0.27.0 (#10206) by @renovate[bot]
- deps: upgrade sugar_path to v3 (#10230) by @hyfdev
- add `dist-*` to `.gitignore` in sourcemap-filenames/hash-final-content fixture (#10216) by @sapphi-red
- deps: update dependency rust to v1.97.0 (#10209) by @renovate[bot]

### ❤️ New Contributors

* @satyamg1620 made their first contribution in [#10211](#10211)

Co-authored-by: shulaoda <[email protected]>

…10104)

## Summary

This PR adds an opt-in on-demand planner for `output.strictExecutionOrder` while preserving both the flag-off path and strict mode's existing wrap-all default.

| Configuration | Execution-order behavior |
| --- | --- |
| `strictExecutionOrder: false` | No execution-order wrapping |
| `strictExecutionOrder: true` | Wrap every eligible module (wrap-all, the conservative default) |
| `strictExecutionOrder: true` + `experimental.onDemandWrapping: true` | Derive a conservative wrapping plan from the generated chunk graph |

The on-demand plan is deliberately conservative rather than minimal. It begins with predicted source-order versus chunk-order hazards, then closes over importers, trigger hosts, retained re-export paths, and cyclic chunks where eager evaluation cannot be proven safe.

This PR does not change the default behavior of `strictExecutionOrder` and does not enable strict execution order globally.

Fixes #10236.

> [!IMPORTANT]
> Strict-order output may change the entry-chunk shape. When an entry implementation must remain inert while another chunk is evaluated, Rolldown emits a small entry facade that calls the relevant `init_*()` function and moves the implementation into a separate chunk. Reviewers and downstream tooling should expect this facade/implementation split.

## Why the analysis runs after chunking

Interop wrapping answers how a module is represented and remains a link-stage decision. Execution-order wrapping answers when an already-included module body may run, which depends on generated chunk placement, manual groups, facade elimination, shared entries, and chunk cycles.

This PR keeps link-owned `WrapKind` and user-code liveness immutable, computes an `OrderWrapPlan` after provisional chunking, and lowers that plan into a separate `OrderWrapState`. Lowering may add synthetic wrappers, init calls, runtime symbols, entry facades, and topology state; it cannot make an excluded user statement or binding live.

The on-demand path then projects imports added by lowering back into the chunk graph. If those imports create a new chunk cycle, every eligible module in the cyclic chunks is added to the plan and projection repeats until stable. The process is monotone and bounded by the module count.

## Correctness hardening

- Preserve init obligations through re-export barrels without reviving tree-shaken imports or unrelated exports.
- Share init-obligation enumeration between emission, cross-chunk registration, and fixpoint projection so their record gates cannot drift.
- Preserve the same link-stage tree-shaking result in wrap-all and on-demand, including consumer-local named and namespace re-export paths.
- Keep cross-chunk `init_*` bindings live and deconflicted for both ESM and CJS output.
- Restore user, dynamic, and emitted entry facades after strict lowering changes chunk topology.
- Recompute topology-derived metadata and final output validation after lowering.

Tree-shaking parity here is specifically between wrap-all and on-demand. It does not claim byte identity with flag-off output and does not include the separate `wrappedModuleTreeshaking` work.

## Review guide

1. Start with `internal-docs/code-splitting/design.md` for the invariants, mode split, conservative decisions, and projected/omitted edge inventory.
2. Read `order_analysis.rs` for source-order versus chunk-order prediction and the emergent-cycle fixpoint.
3. Read `order_wrap_state.rs` and `order_wrapping.rs` for the late synthetic state and lowering boundary.
4. Read `esm_init_obligations.rs` together with the module finalizers and cross-chunk-link pass for the shared emit/register/project contract.
5. Review #10287 for config/variant normalization and the current-main output baseline.
6. Review this PR's test diff for removal of every temporary expected-failure marker and the same-position snapshots of the final facade/runtime/chunk layouts.

## Test-first sequence

The earlier test-first layers are already merged into `main`:

1. #10253 adds the fail-closed runtime-failure harness and core integration regressions.
2. #10252 adds the later hardening fixtures and paired-mode coverage.

The remaining Graphite stack is:

1. #10287 establishes the final config/variant review layout and current-`main` snapshots while preserving all expected-failure markers.
2. #10104 (this PR) adds the implementation, removes all temporary failure markers, and records the implementation output.

The final tree contains 96 strict-enabled fixture configs and 200 named strict executions. Between #10287 and #10104, 21 config files only delete 44 expected-failure markers, and all 93 changed snapshots retain identical variant-heading order.

## Validation

Local validation ran on rebased head `79efe909bb3f0bcd2abcc76dcd33e58069c3474c`, based on `main` at `c4e25974b8ff7598bf507ae4a2d7602cbcbc86fd`.

- The 86 changed fixtures passed twice on #10287 with the old implementation; the second pass was snapshot-stable.
- All 96 strict-enabled fixture configs passed twice on this implementation, with a snapshot-stable final pass.
- Full Rust workspace tests passed with `just test-rust`.
- Rolldown Node tests passed: 793 main tests and 38 watcher tests.
- The Rollup compatibility suite passed 1,213 tests with 0 failures.
- `cargo check --workspace --all-features --all-targets --locked` and `cargo fmt --all --check` passed.
- Clippy passed with `--deny warnings` for every changed Rust crate: `rolldown`, `rolldown_common`, and `rolldown_ecmascript_utils`.
- `just lint-node` and `just lint-repo` passed.
- Full-workspace `just lint-rust` is locally blocked on Rust 1.97 by `clippy::ignore-without-reason` in the unchanged `rolldown_plugin_isolated_declaration/tests/mod.rs`; the failing path is byte-identical to `main`.

## Frozen closure evidence

The broader correctness campaign was frozen on one build of `42628c18b`:

- Differential fuzzer full matrix: 3,000/3,000 passed (ESM/CJS/mixed inputs × wrap-all/on-demand × 500 cases).
- Directed barrel/definer family: 600/600 passed; the same generated shapes failed about 23.7% of the time before the fix.
- Directed eager-barrel family: 20/20 passed in wrap-all and 20/20 in on-demand.
- #9887 strict-path bracket passed on the branch and failed 20/20 on released `[email protected]`. This PR restores strict mode as an escape hatch; the non-strict path remains a separate issue, so this PR does not close #9887.
- #10236 CJS-output/on-demand bracket passed on the branch and failed all 8 directed seeds on released `[email protected]`.
- ComfyUI, Camunda, shadcn-admin, and vue-vben-admin passed the flag-off/on-demand/wrap-all browser-probed matrix.

Fuzzer source and machine-readable evidence: https://github.com/hyf0/rolldown-order-fuzzer/tree/853fb775d1e949ced567deb0c163d044a031ba4f/.agents/evidence

## Boundaries and known residuals

- Top-level-await output remains legal, but this PR does not promise stronger TLA scheduling semantics than the default build.
- External-module evaluation order remains outside the strict-order guarantee; generated output must still be legal.
- #9998 is a separate bug in the non-strict/default code-splitting path and is not fixed here. The strict path covered by this PR passes its directed controls.
- Camunda still emits two `init_*` functions with no call site (`OverflowMenu$1` and `RadioButton$1`). They were harmless on all probed routes and have no synthetic reproduction.
- The partial-forwarder per-obligation refinement is present in the shared contract, but no constructible corpus shape currently exercises that narrower branch directly.
- On vue-vben-admin, the emergent-cycle fixpoint converged in two rounds and added 141 wrappers over the one-shot plan. `ROLLDOWN_ORDER_DEBUG=1` reproduces the per-round trace.