Beagle SCM

JAB-008: binding calls C ops raw, skipping call() — BASS scratch never rewinds, the 1GB arena drains, everything dies as "out full?"

PRO.h's contract (dog/abc/PRO.h:20-40,73-83): a callee's a_carve scratch dies when the CALLER's call()/try() rewinds ABC_BASS; sane() alone rewinds nothing. The jab binding breaks the contract at the C++/C boundary: every JABC_FN (weave.hpp WEAVENext/WEAVEMerge/WEAVEAlive…, pack.hpp, hunk.hpp) invokes the C op RAW — no call() equivalent — and ABC_BASS is mapped ONCE in main.cpp:281 and never rewound for the process lifetime. So every binding invocation leaks its whole carve set into the arena. Probe 2026-07-16 (in work/PATCH-012): fold the SAME 1MB blob from scratch in one process → DIED at iteration 240, weave.fold: failed (out full?) — ~4.3MB/fold (WEAVEFromBlob's a_carve(u32, toks, len+16) ≈4MB + anchors), 1GB/4.3MB ≈ 240. The C op's internal SNOROOM surfaces under the SAME "out full?" message as a dest overflow, so the leak masquerades as PATCH-012's cap bug. Hypothesis credit: gritzko.

Input

Context

One long-lived process + zero rewinds = every C-op invocation is a permanent allocation; hypothesis by gritzko, confirmed by probe.

• Probe: jab --eval loop, abc.ram("WEAVE",16MB).fold(null, blob1MB, "txt", hash) ×2000 → DIED at iter 240: weave.fold: failed (out full?); a single fold in a fresh process is fine.
• grep -c 'call(' weave.hpp → 0; same raw-invocation shape across the JABC_FN surface (pack.hpp pidx/scan, hunk.hpp dogenize/render, weave.hpp all ops).
• Blast radius is EVERY BASS-carving op reachable from JS in a long session: whole-tree get/patch weave-reconstruction (fold per commit LAYER per file — the amplifier), why: blame, diff renders, pack scans — and the jab PAGER, which lives for hours.
• Probably the REAL cause of the PATCH-012 incident: the silently-reverted files (~35-60KB) were UNDER the old 256KB fold caps; a whole-tree get's accumulated folds draining the arena mid-reconcile fits the multi-file failure far better than per-file caps. Likely also idxmaint: pack.scan: scan (out full? corrupt?) on the big clone (same day, same class).
• PATCH-012's fix is still correct but now MASKS arena exhaustion as spurious per-file con rows (its residual-"full" catch); once drained, every later BASS op in the process fails too.
• The binding CAN'T use PRO.h's call() literally (it is a statement macro over __/return); the needed primitive is its BASS bracket: dup u8bDataC(ABC_BASS) heads on entry, restore DATA+IDLE on exit (PRO.h:77-93 shows the exact 4 lines).

Goals

Restore the PRO.h ownership contract at the JS/C boundary: a binding invocation leaks nothing.

• A RAII BASS guard (or macro) in the binding layer bracketing EVERY C-op invocation that may carve — snapshot heads, invoke, rewind; exception-safe (JABC_THROW paths must rewind too).
• Sweep the whole JABC_FN surface (weave.hpp, pack.hpp, hunk.hpp, and any other .hpp/.cpp invoking abc/dog ops) — the guard at each boundary, ONE implementation.
• Repro-first: the 1MB×2000 fold loop as a test — dies at ~240 pre-fix, SURVIVES 2000 post-fix; add a merge/scan variant if cheap.
• Mind ops with LEGITIMATE BASS-surviving returns (anything handing carved memory back to the caller — e.g. a_cquired slices): the guard must not free live results; audit before bracketing blindly.
• After landing: revisit whether PATCH-012's incident repro still needs the caps story amended, and whether pack.scan errors clear up.

Constraints

The guard is the binding's job; the C ops and the JS layer stay untouched.

• No JS-visible API change; no dog/abc changes (their PRO.h discipline is correct — the binding is the caller that skipped its duty).
• Per-invocation rewind, not periodic reset: a timer/GC-hook "flush" would leave the same class of transient spikes and racy lifetimes.
• ~/bin/jab is an ASAN build — keep the probe test under the suite timeout; LSan "Suppressions used" trailer on stderr is noise, not a failure.

WIP

Design decisions

• Guard at the REGISTRATION path, not per call site: JABC.hpp RAII JABCBassGuard (saves/restores ABC_BASS[1]/[2], exception-safe) + a JABCBassGuarded<F> trampoline wired into JABC_API_FN — the single registration macro, so ALL 142 native leaves (io 32, pack 16, ulog 15, weave 12, pol 12, codec 10, net 10, hunk 9, …) and future ones inherit it.
• Audit found NO leaf returning BASS-resident memory to JS (hunk toks copy out in-call; io ram/mmap own their maps; ulog handles live in file/heap maps; POL queue is heap) — no copy-outs needed.

TODOs

• repro test test/bass.js (JABCbass): fold ×2000 + fork/merge ×2000; pre-fix DIED at iter 240, post-fix passes
• RAII BASS guard + audit (see design decisions)
• sweep: one trampoline covers the whole JABC_FN surface (verified no other registration path exists)
• suites: jab 96/96 post-fix; probe SURVIVED 2000 on the new binary (orchestrator re-ran); beagle-ext smoke = zero delta pre/post-fix (172-name failure sets byte-identical — vintage mismatch, see bummers)
• link back: amend PATCH-012 incident analysis (leak vs caps) once this lands; recheck pack.scan on a big clone with the fixed binary

Blockers and bummers

• The clone is STALE: the jab.be store tip is b58be37a (Jul 7) while git ~/src/jab HEAD is 332e404 — missing a5cf85b (GIT-041) and 332e404 (the jsrc rename), hence 172 vintage beagle-ext failures under a jsrc symlink (failure sets identical pre/post-fix; system jab passes 240/242). The two missing commits touch require.cpp/main.cpp/CMakeLists — NOT JABC.hpp — so the guard rebases trivially; jab.be needs a manual sync from git first.

Outcome

• FILED 2026-07-16 off gritzko's hypothesis + a confirming probe (240-iteration death).
• 2026-07-16 fix + repro in work/JAB-008 (uncommitted): JABC.hpp guard + CMake test wiring; jab suite 96/96 at the stale base.
• 2026-07-16 SALVAGED into work/JAB-008b (tip 016be1b3, uncommitted): guard verbatim (old files carried NO weave damage); test resized per gritzko's 10s-cap order — 256KB×1500 folds + fork/merge×500, TIMEOUT 10 (pre-fix dies at iter 963 in 3.7s; post-fix 5.8s, probe survives 2000×1MB too). SIDE-FINDS fixed in-tree (both in the dog sub-tree — land route = gritzko's call): (1) dog/abc/Bx.h:516-517 (ABC-006) used _Alignof — C11-only, breaks every C++ TU under g++15; → alignof (siblings :460/:491 already use it). (2) DOGtest red at pristine tip = ABC-008 contract drift, not a leak: RONu8sFeedPad now auto-advances the cursor, so dog_pup_path's manual advance (dog/DOG.c:559) double-advanced → 10 pad bytes in the pup filename → PATHBAD before any leak scan; stale advance removed (the only non-test caller). Suite 101/101 incl. DOGtest + JABCbass 5.7s. work/JAB-008 is superseded, rm-rf-able on land.