http.ServerResponse and stream.Readable have empty prototypes: subclasses built with util.inherits + Base.call(this), setPrototypeOf or class extends ServerResponse have no setHeader/end/push (light-my-request / fastify inject() never settles) #10454

Found by the package audit (compiling real npm packages from source instead of Perry's native bindings) on
Perry e6dcb62 (v0.5.1587), Linux x64. http.ServerResponse.prototype and stream.Readable.prototype have none of their methods, and ServerResponse.call(this, req) / Readable.call(this, opts) install nothing
on this. Any function-style subclass (util.inherits, Object.setPrototypeOf), and even a CJS
class extends http.ServerResponse, gets instances with no setHeader/writeHead/end (or no push/pipe/on).
new http.ServerResponse(req) itself works. For ServerResponse this also happens with an ESM
import { ServerResponse } from "node:http"; class X extends ServerResponse. Calls to the missing methods also return silently instead of throwing,
so light-my-request's inject() hangs instead of failing.

Reproduction

package.json

{"name":"str6","private":true,"type":"module"}

lib.cjs

'use strict';
const http = require('node:http');
const util = require('node:util');
const { EventEmitter } = require('node:events');
const { Readable } = require('node:stream');

// light-my-request's shape
function Response(req) { http.ServerResponse.call(this, req); }
util.inherits(Response, http.ServerResponse);

function SetProto(req) { http.ServerResponse.call(this, req); }
Object.setPrototypeOf(SetProto.prototype, http.ServerResponse.prototype);

class Sub extends http.ServerResponse {}

function Emitter() { EventEmitter.call(this); }
util.inherits(Emitter, EventEmitter);

function Request(opts) { Readable.call(this, opts); }
util.inherits(Request, Readable);

module.exports = { http, Response, SetProto, Sub, Emitter, Request };

main.ts

import { http, Response, SetProto, Sub, Emitter, Request } from "./lib.cjs";
const req = { method: "GET", httpVersionMajor: 1, httpVersionMinor: 1, headers: {} };
const H: any = http;
const show = (label: string, o: any) =>
  console.log(label, "setHeader:", typeof o.setHeader, "writeHead:", typeof o.writeHead, "end:", typeof o.end);
console.log("ServerResponse.prototype.setHeader:", typeof H.ServerResponse.prototype.setHeader);
show("new ServerResponse(req)         ", new H.ServerResponse(req));
show("util.inherits + .call(this)     ", new (Response as any)(req));
show("setPrototypeOf + .call(this)    ", new (SetProto as any)(req));
show("class Sub extends ServerResponse", new (Sub as any)(req));
const res: any = new (Response as any)(req);
try { res.setHeader("x-a", "1"); console.log("res.setHeader(...) returned; getHeader:", typeof res.getHeader); } catch (e: any) { console.log("res.setHeader(...) threw:", e.message); }
const e: any = new (Emitter as any)();
let n = 0; e.on("x", () => n++); e.emit("x");
console.log("util.inherits(Fn, EventEmitter): on:", typeof e.on, "emitted:", n);
const r: any = new (Request as any)({ read() {} });
console.log("util.inherits(Fn, Readable): push:", typeof r.push, "pipe:", typeof r.pipe, "on:", typeof r.on);

node main.ts
perry compile main.ts -o out && ./out      # default (auto-optimize) build

Expected (Node 26.5.1)

ServerResponse.prototype.setHeader: function
new ServerResponse(req)          setHeader: function writeHead: function end: function
util.inherits + .call(this)      setHeader: function writeHead: function end: function
setPrototypeOf + .call(this)     setHeader: function writeHead: function end: function
class Sub extends ServerResponse setHeader: function writeHead: function end: function
res.setHeader(...) returned; getHeader: function
util.inherits(Fn, EventEmitter): on: function emitted: 1
util.inherits(Fn, Readable): push: function pipe: function on: function

Actual (Perry, default auto-optimize build)

ServerResponse.prototype.setHeader: undefined
new ServerResponse(req)          setHeader: function writeHead: function end: function
util.inherits + .call(this)      setHeader: undefined writeHead: undefined end: undefined
setPrototypeOf + .call(this)     setHeader: undefined writeHead: undefined end: undefined
class Sub extends ServerResponse setHeader: undefined writeHead: undefined end: undefined
res.setHeader(...) returned; getHeader: undefined
util.inherits(Fn, EventEmitter): on: function emitted: 1
util.inherits(Fn, Readable): push: undefined pipe: undefined on: undefined

Note the line res.setHeader(...) returned: calling a method whose typeof is undefined did not throw
TypeError: res.setHeader is not a function.

With PERRY_NO_AUTO_OPTIMIZE=1 the output is the same except that new ServerResponse(req) also has no methods.
In that mode node:http constructors reached through require are inert anyway (the same mechanism as closed #8547),
so this issue is about the auto-optimize build.

Impact

• fastify 5.10.0 app.inject() / light-my-request 6.6.0: lib/response.js:9-10,85 is
  function Response (req, onEnd, reject) { http.ServerResponse.call(this, req) … } with
  util.inherits(Response, http.ServerResponse). lib/request.js:93-94,273 does the same with Readable. Checked with
  light-my-request alone (inject(dispatch, { url: '/x' })) and with fastify 5.10.0 (the audit's two other fastify
  workarounds applied): the Request and Response constructors run, typeof res.setHeader/end and typeof req.push are
  undefined, and the dispatch function runs. res.writeHead(...) and res.end(...) return silently, 'finish'
  never fires, and the inject() promise neither resolves nor rejects. The process exits 0 with no output.
• Any util.inherits-era library that subclasses ServerResponse/IncomingMessage/Readable is likely affected,
  for example test injectors (light-my-request, @hapi/shot), mock req/res libraries and the classic stream
  modules written before ES classes.

Notes

• util.inherits(Fn, EventEmitter) + EventEmitter.call(this) works, so util.inherits itself is fine. The failures
  are specific to bases that Perry models natively.
• The same checks from a TS/ESM file (auto-optimize) give typeof Readable.prototype.push === 'undefined'
  (EventEmitter.prototype.on is a function), import { ServerResponse } from "node:http"; class X extends ServerResponse { constructor(r) { super(r) } } with setHeader/end both undefined, and util.inherits(Fn, Readable) +
  Readable.call(this, opts) with push undefined (on is a function there, unlike in the CJS file).
• Second contributing factor (observed, cause not investigated): calls to the missing methods (this.setHeader('foo','bar')
  in light-my-request's Response constructor, res.writeHead(...), res.end(...)) do not throw. A thrown
  TypeError would have surfaced as an inject() rejection, so this turns a crash into a silent hang. In a
  .cjs-only variant of the repro, r.setHeader('x-a','1') did throw setHeader is not a function, (a
  ServerResponse.call-built instance, but called inside the .cjs module), and on Object.create(ServerResponse.prototype)
  in a TS file writeHead(200) threw writeHead is not a function. So far the silent return has been seen when the call
  is made from the TS entry module on an instance from a .cjs module, and inside compiled light-my-request. The
  deciding factor is not isolated (inferred: name-based native method dispatch for http method names).
• The audit note said "Response ctor marker never prints". That did not reproduce on this build: with fastify 5.10.0
  plus the audit's workarounds, inject() reaches new Response, the fastify ready callback (no error) and the
  dispatch, then hangs as described above. No second hang cause was found before the missing methods.
• Suspected cause (inferred from reading the code, not instrumented): http.ServerResponse is modeled as a
  handle factory, not an initializer of this. new ServerResponse(req) reached as a value is forwarded to
  JS_NATIVE_HTTP_DISPATCH (crates/perry-runtime/src/object/class_registry/construct.rs:368-405) →
  js_node_http_server_response_standalone_new (crates/perry-stdlib/src/common/dispatch/init.rs:281-290), which
  returns a fresh native handle whose methods come from handle dispatch (crates/perry-ext-http/src/server/handle_dispatch.rs).
  ServerResponse.call(this, req) therefore builds a handle and discards it, and the exported constructor's
  .prototype carries no methods for util.inherits/setPrototypeOf/extends to inherit. Readable.call(this) has
  the same problem: stream methods are installed on the instance by the subclass-init shims, which only
  class extends Readable with a recognized heritage reaches (compare node:stream subclass overrides (_transform/_write/_read) ignored when the heritage is a local binding (const { Transform } = require('stream'), const T = Transform) #10448).
• Related: node:stream subclass overrides (_transform/_write/_read) ignored when the heritage is a local binding (const { Transform } = require('stream'), const T = Transform) #10448 and class X extends AsyncResource throws "Class constructor AsyncResource cannot be invoked without 'new'" unless the heritage is a bare import { AsyncResource } binding #10453 (the ES-class heritage forms of the same "native base" gap), closed class extending EventEmitter/Map/Set/Event loses its native base when constructed from another module (blocks the OpenCode TUI) #10300 and runtime: indirect subclass of a native base inherits nothing (class D extends B, class B extends EventEmitter) #6326.
• No existing issue found (searched "util.inherits ServerResponse", "light-my-request inject", "ServerResponse setHeader undefined").