[vicmcorrea]

Problem and fix

Malformed IPv4 addresses and out-of-range ports passed to TCP.connect should return Fail(22, ...). Emitted JS instead aborts on Node because it initializes bun:ffi before validating those arguments.

Move the existing io_sys() declaration below the existing address guard, matching TCP.listen and UDP.bind. Reuse io_addr and io_fail; no new fallback or exception handling.

Blast radius

One statement moves in bend2/effs/tcp_connect.js; two JS-specific regression files are added under tests/io. The compatibility change is limited to invalid arguments returning the declared failure instead of terminating when FFI is unavailable. Valid Node TCP remains unsupported. Valid Bun networking, descriptor ownership, native C, public signatures and the compiler are unchanged.

Regression evidence

The new foreign twin makes FFI initialization throw once and restores the previous global property descriptor before throwing. The same test fails on main and passes with this fix in source execution and standalone JS under Bun and Node. Both shared --checkup orders preserve subsequent networking tests.

Ordinary programs without fault injection reproduce the Node failure for malformed IPv4, an oversized port and a NUL-containing host; each now prints 22. Bun/native results remain 22 before and after.

Checks

• Focused regression and valid TCP loopback pass in source and emitted Bun; the regression also passes in emitted Node.
• Present/absent FFI-state restoration and valid-address socket controls pass under Bun and Node. Generated C is byte-identical for four input cases; native behavior matches main.
• Both JS syntax checks and git diff --check pass.
• Repository gate in CI: 54/54 on the unchanged PR head, using main's 66,000-token compiler cap from #1626. This PR does not change comp.ts.

Validation limits

Local checks ran on macOS arm64 with Bun 1.3.11 and Node 26.8.2. The full IO suite and mini-cluster/Linux/GPU gates were not run. The regression exercises FFI absence in the Bun lane; it does not add a Node CI lane or support valid Node TCP.