[theduke]

A large young-generation object can overshoot V8's old-generation limit before the near-limit callback runs. Returning a small fixed grant or refusing a grant could then enter V8's fatal process OOM path and abort all tenants.

Account already-committed overshoot when granting heap growth. On refusal, terminate the isolate and expose a single emergency headroom allowance so the tested allocation paths can finish and unwind. Poll for a settle turn at JavaScript return boundaries so retained overshoot reaches the budget even when the isolate goes idle. Report emergency grants, exhaustion and live headroom separately from charged tenant memory.

The two heap-statistics/settle hooks are private snapi_private_* entries shared by the bridge and providers. No new declaration is added to include/unofficial_napi.h or to Node-API headers.

The default emergency allowance is 1,088 MiB per stopping isolate, outside the tenant budget. Concurrent workers or tenants can multiply that temporary exposure. V8 may still abort if an isolate exhausts its one allowance before termination lands. This is a mitigation backed by the included allocation regressions, not a universal host-survival or process-memory guarantee. Hosts must account for this exposure in their existing node memory isolation and admission policy.

This PR precedes enabling metered nested WebAssembly because WebAssembly table allocation also exercises the V8 heap.

Stack and provenance

#93 → #94 → #95 → #96 → #97 → #98 → #99 → #100 → #101

Part 5 of the audited split of #84, reconstructed on current main eac0a13fa65a4d6103864d875ed76ab7efb1816e. Review against split/napi-04-asmjs; predecessor branches are required. Original PR #84 remains unchanged. The stack preserves newer main host-JS behavior and deliberately excludes the unused frozen 0.0.1 ABI adapter.

Validation

Six v8_heap_limit regressions: retained/transient allocations, benign concurrent tenant, worker isolate, simultaneous exhaustion and release/soft backing-store behavior; heap grant arithmetic and headroom unit tests; public-header equality check.

Earlier six heap regressions passed on the original legacy-containing PR plus private-hook patch. After excluding the legacy adapter, final heap fixtures were converted to the supported versioned environment ABI without changing allocations or assertions. Those corrected final fixtures have not run locally: execution stopped at the user’s request, and the new native Rust CI job owns them. Keep draft until CI completes.

Latest-main rebase

Rebased the dependency stack onto eac0a13fa65a4d6103864d875ed76ab7efb1816e after main merged PR #92. This preserves unsigned guest IDs, pointers and lengths, bounded result/argv writes, host-JS buffer failure cleanup and the high-pointer/high-ID regressions. Conflicts received independent native and host-JS source review. All historical local results above predate this rebase; no local tests or builds were run for it, as requested. Updated-head validation belongs to CI and may be pending. This PR keeps its prerequisite branch as its base to preserve the focused diff.