[theduke]

A tenant executing JavaScript or collecting garbage held the bridge's process-wide mutex, blocking unrelated environments. Guest napi_fatal_error aborted the host, and callback-capable Node-API operations could swallow a guest WASIX exit.

Acquire counted per-environment leases for ordinary bridge calls and keep registry locks short. Control operations can interrupt a running environment; isolate construction alone stays serialized, using V8's default isolate group. Convert fatal guest calls to WASIX exits with the correct void import signature, and propagate exits from callback-capable Node-API calls.

The change includes the matching private external-buffer ownership observer: a Buffer prototype getter can exit after V8 has taken ownership, so Rust must not free the same allocation again. Reject reentrant environment release before unregistering Rust state or disposing an entered isolate. No public native header or guest import is added.

A native Rust CI job is included from the first layer so each subsequent PR runs its available WAT/native-FFI suites, library unit tests, formatting and clippy. Existing C++ and host-JS workflows remain active. The new job uses the existing locked public SDK without private credentials; it does not claim coverage of CLI guest execution on the internal Edge SDK.

Audit focused on lease lifetime, lock ordering, callback reentry, fatal import ABI, external-buffer ownership and preserving current main's host-JS fixes. Regression coverage uses the existing versioned guest ABI, without depending on the optional EdgeJS 0.0.1 compatibility adapter.

Stack and provenance

#93 → #94 → #95 → #96 → #97 → #98 → #99 → #100 → #101

Part 1 of the audited split of #84, reconstructed on current main eac0a13fa65a4d6103864d875ed76ab7efb1816e. Review against main; predecessor branches are required. Original PR #84 remains unchanged. The stack preserves newer main host-JS behavior and deliberately excludes the unused frozen 0.0.1 ABI adapter.

Validation

Pure-WAT core_callbacks regressions (property callbacks and reentrant release), native external_transfer, and concurrent GC/termination/fatal cases in v8_host_control. Exact executed results are recorded below before readiness.

Completed locally before the request to stop local tests: native cargo check, formatting and clippy (warnings), 2 callback regressions, 1 external-transfer regression, and 30 fresh concurrent processes running both callback tests. The pre-fix reconstruction crashed within six fresh processes; moving both JIT permission resets and the capability-based isolate-group selection into this first layer removed that reproduction. wasm32+JS cargo check also passed. New CI results remain pending; keep draft.

Latest-main rebase

Rebased the dependency stack onto eac0a13fa65a4d6103864d875ed76ab7efb1816e after main merged PR #92. This preserves unsigned guest IDs, pointers and lengths, bounded result/argv writes, host-JS buffer failure cleanup and the high-pointer/high-ID regressions. Conflicts received independent native and host-JS source review. All historical local results above predate this rebase; no local tests or builds were run for it, as requested. Updated-head validation belongs to CI and may be pending. This first PR targets main; later PRs keep their prerequisite branches as bases to preserve focused diffs.