[Jemmy (JemmyIndex)]

Fixes #65451

stringTable.add tries to reuse source text by deriving a start offset from the length of a literal's normalized text. For inputs such as .1, 1e3, and 1e9, the normalized text is longer than the source and the derived start is negative. Slicing the source at that offset panics before the existing string-table fallback can run.

Check that the start is nonnegative before comparing the source slice. Text that cannot be reused then follows the existing fallback without changing numeric normalization or the wire format.

The regression test parses, encodes, and decodes ten inputs, checking both the original source text and the normalized numeric literal text. It covers the three reported crashes, ordinary integers, equal-length normalization, leading trivia, numeric separators, and hexadecimal notation.

Validation:

• Before the fix, the new .1 regression panics with slice bounds out of range [-1:].
• The encoder package passes after the fix, including all ten new cases.
• Twenty sync/async API smoke checks pass using a newly built native binary.
• Ran node node_modules/hereby/bin/hereby.js validate --all (equivalent to npx hereby validate --all): native and WASM builds, extension tests (57), native API tests (1,077), WASM async API tests (405 passed, 1 skipped), WASM sync API tests (564 passed, 1 skipped), API declarations, Herebyfile, tools tests, options tests, CLI smoke tests, lint, and formatting all pass.
• The full Go test run reports 170,042 tests, 2,150 skipped, and four failure records: TestSubscribeSymlinkCreate/windows, TestSubscribeSymlinkDelete/windows, and their parent tests. Both underlying failures are this Windows host's inability to create symlinks (A required privilege is not held by the client.); no tests were changed or skipped to suppress them. Consequently, the full validation command exits 1.
• Separately ran the check:format and tidy tasks with the same Hereby entry point; both pass. Dependency files remain unchanged; git diff --check passes.

Checklist:

• The associated issue is in the Backlog milestone (not yet assigned as of November 13, 2026).
• Based on upstream main at 056d69edb807d4cd4351059f084a7f191c6aea0f.
• Added regression coverage; the .1 case panics before the fix and the encoder package passes after it.
• Full validation completed successfully (blocked only by the two host symlink permission failures described above).
• Lint and formatting checks passed.

AI assistance: Codex authored the patch and regression test after I selected this specific issue. I will review the changes and personally follow up on review feedback.