v0.5.0 — Mojo dev2026072306 migration (get_function → get_symbol)

Adopts Mojo/MAX nightly 26.5.0.dev2026072306, a one-month jump from dev2026062306.

Minor bump — read before upgrading. The published src/ tree is what downstream packages compile against, and it now requires 26.5.0.dev2026072306. On an older nightly it will not build. The JavaScript surface is unchanged; this is a source-consumer break, which in 0.x is what a minor bump signals.

(Numbering note: v0.4.0 was tagged back in April for the GPU addon generation that this release removes. It was never published — hence npm showing 0.3.3 — and it is left pointing at its original commit rather than being retagged.)

Toolchain migration

• OwnedDLHandle.get_function is no longer usable for C FFI. Its parameter became the return type and it returns an origin-carrying _DLCallable, which cannot live in a struct field — architecturally incompatible with the cached-bindings design, independent of its documented non-abi("C") argument passing. All 274 call sites moved to get_symbol: a _sym[F] helper where a callable is needed, and a direct _slot assignment for the 142 cache slots. That second form removes the old address-of-local reinterpret, eliminating a failure mode that could have stored a wrong word and still compiled.
• Implicit UnsafePointer → Mut/ImmutAnyOrigin conversion was removed. C-FFI signatures fix their origin, so 351 sites across 23 files now spell as_unsafe_any_origin() explicitly. Same widening, made explicit — semantics unchanged.
• Span(ptr=) → Span(unsafe_ptr=); init_pointee_move → unsafe_write; destroy_pointee → unsafe_deinit_pointee; ImplicitlyDestructible → ImplicitlyDeletable. The build is warning-clean (down from 439).

Added

• Env-only JsUndefined.create(env) and JsBoolean.create(env, bval) overloads. Every comparable Js* type had both forms; these two didn't, so addons built with ModuleBuilder(env, exports) — the no-bindings style — couldn't reach them.

Fixed

• parallelize_safe() no longer segfaults the host process. Its contract claimed parallelize() degraded on its own; it does not — on an uninitialized async runtime it dereferences it and kills Node. It now genuinely runs sequentially instead.
• All three examples/ addons compile and run again, and now build in CI — they had rotted across several nightlies because nothing built them. Two were additionally broken in a way compiling would never have revealed: none called ModuleBuilder.flush(), so they registered nothing at runtime.

Removed

• The gpu/ scaffold. GPU work lives in @qkstat/rag, which already had the complete surface. napi-mojo stays framework-shaped.

Verified

Build 0 errors / 0 warnings · 609 tests + 6 GC finalizer tests on macOS and Linux · codegen reproducibility gate · clean under Guard Malloc with MALLOC_STRICT_SIZE=1 · per-call overhead 208–251 ns, within the 173–389 ns baseline.