fix(runtime): clear the gates that #12109 left red

[steinybot]

Merge in this order:

1. fix(docs): the my-bindings fixture reads buffers inside a no-GC scope #12112
2. fix(ext): ext-crate tests root values through RuntimeHandleScope #12113
3. fix(runtime): audit the new raw stores and classify addresses with addr_class #12114
4. ci: register the dark GC witnesses and isolate the new test counters #12115
5. refactor: split five files back under the 2000-line cap #12116
6. fix(runtime): root raw handles across calls and correct the handle ratchets #12117
7. fix(runtime): instanceof never mints a class object for a builtin id #12118
8. fix(gc_effects): exempt aHash's random-source init from the indirect-call taint #12119
9. docs: regenerate the API reference #12120
10. fix(runtime): clear the gates that #12109 left red #12121 (this PR)
11. fix(runtime): match node on the gap-suite regressions #12149

Problem

CI on main is red again after #12025. Commits since then broke check, warnings, cargo-test, gc-call-effects, self-test-checkers, gap-suite and fourteen lint steps, so no PR can show a green build. Each later failure in a job was hidden behind an earlier one.

Solution

Fix each breakage in its own PR. Each PR targets main and holds every fix above it in the order list, so the last PR is the one that can run fully green. Merge in order: each diff then shrinks to its own fix.

In this PR

Fixes the checks that #12109 (node:sqlite on native payloads) broke after the rest of this chain was written, the thread-local ratchet in self-test-checkers, the generated tables that only CI can build, and the flaky z8 stream test.

Changes

1. See one-line per_test_global! statics in the holder census (diff). The census matched a static only at the start of a line, so the macro form was invisible although it is a real static outside tests. The thread-exit audit shares the census and now sees the timer STORE map, whose entry names its exit hook.

   perry/scripts/gc_runtime_root_holders.py

   Lines 364 to 365 in 8d867d4

   	r"^\s*(?:(?:crate::|\$crate::)?per_test_global!\s*\(\s*)?"
   	r"(?:#\[[^\]]*\]\s*)*(?:pub(?:\([^)]*\))?\s+)?static\s+(?:ref\s+)?(?:mut\s+)?"

2. Move the hidden JS-state group out of native_payload.rs (diff). It brings the file under the 2000-line cap. The public paths are re-exported.

3. Let the ledger floor follow the ledger (diff). node:sqlite on native payloads; cheaper native callback path; statements own their sqlite3_stmt #12109 removed three sqlite handle tables, so the census fell below the fixed floor of 200. The census may not drop below 90% of the recorded totals or below 150.

   perry/scripts/native_handle_ledger.py

   Lines 299 to 316 in 8d867d4

   	# The census floor guards against a scan that silently stops matching, not
   	# against conversions: #11919 removes tables and producers on purpose, so the
   	# floor follows the reviewed ledger rather than a fixed count. A fall of more
   	# than a tenth below the recorded totals needs a reviewed --update first. The
   	# absolute minimum stops an --update run by a broken scan from lowering the
   	# ledger, and with it the relative floor, to nothing.
   	CENSUS_LEDGER_FRACTION = (9, 10)
   	CENSUS_MINIMUM = (150, 150)
   	def census_too_small(census: tuple[int, int], recorded: tuple[int, int]) -> bool:
   	num, den = CENSUS_LEDGER_FRACTION
   	return any(
   	actual < minimum or actual * den < ledger * num
   	for actual, ledger, minimum in zip(census, recorded, CENSUS_MINIMUM)
   	)

4. Classify four holders that lost accidental coverage (diff). They were covered only through the deleted sqlite scanner's bare-name path. Each is a flag, a counter or a weak address-keyed table.

5. Root the native-payload test handles (diff). The raw handles pass through with_mut_ptr and with_const_ptr. keys_array.rs guards with is_handle_band, and the warnings fixes drop an unsafe block and two unused imports.

6. Move the new thread-locals onto the hot cache (diff). Fourteen raw thread_local! declarations become perry_thread_local!. The two in alloc_census.rs stay raw and are recorded: the allocator hook reads them before the runtime's TLS exists.

7. Regenerate the wasm32 ABI table (diff). It lacked the scoped byte API and native-payload stream entry points.

8. Take CI's fresh Windows call-effects table (diff). The Windows archives cross-build with cargo-xwin, so the table comes from the CI job's output.

9. Bound what z8 retains after a collection, not RSS (diff). z8 failed on main too: mimalloc commits and purges in 5 to 11 MB steps, and the test bounded RSS at 4 MiB. It now bounds the thread's retained heap at 64 KiB above the warm batch, and a new retain_chunk sabotage proves it still fails on a leak.

🤖 Generated with Claude Code

https://claude.ai/code/session_01V5MSmMLJm6sMdSS5r64ds7

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}