Native TLS: port SNI suspension, callback errors and ALPN selection

Completed checkpoint

Published a9a95f6a4 on codex/runtime-port as Chris Breuer without coauthors; not merged to main. This completes the native SNI suspension and ALPN callback checkpoint against Bun pin 4982b91e3702094330f3be3883354c52b8c01323.

The complete unchanged test/js/node/tls/node-tls-server.test.ts now passes 38/38 tests / 147 assertions in Home, exactly matching the pinned Bun release. The seven previously reproduced failures are repaired: synchronous and asynchronous SNI errors, asynchronous selected-context resumption, same-host callback precedence, non-Error rejection, ALPN selection, and ALPN error propagation.

Home now carries protected listener and socket handlers, generated resumeSNI bindings, BoringSSL pending-certificate suspension/resumption, raw ClientHello SNI parsing, owned context transfer, static-tree fallback, callback-safe BIO routing, and deferred socket teardown. Dynamic ALPN selection validates the offered list and remains installed when synchronous, asynchronous, or addContext() SNI changes SSL_CTX. The checked-in Home uSockets source compiles cleanly using the pinned release compile flags after only source/include/output/escaped-define path reconstruction; the debug executable still links the pinned Bun object.

Verification

• New native SNI/ALPN lifecycle regression: 20/20 independent processes, plus VM destruction and JSC exception validation.
• Seven-file unchanged TLS sweep: 120 pass / 1 skip / 3 TODO / 2 fail / 380 assertions. Both failures query live bun.sh OCSP metadata and reproduce in pinned Bun.
• Native debug build: 17/17 steps.
• Scoped runtime units: 1,828 pass / 19 skips / 0 failures, 19/19 build steps.
• Sequential runtime regression commands: 63/63, including every native regression, full spawn, and full child-process.
• Final executable SHA-256: febb4ccec5d7b99ae893c2501f88ace9585f4e45a2743b28a9055049060e5a3d.

Evidence is recorded in docs/docs/NATIVE_RUNTIME_BINDINGS.md and the local zig-out/tls542-* artifacts. Original test assertions, workloads, and deadlines were preserved. Verification is Darwin-only; branch integration, other platforms, skipped/TODO behavior, full native dependency ownership, and 100% suite parity remain under #66.

Historical reproduction

Before this checkpoint, the unchanged server file was 31 pass / 7 fail / 122 assertions versus pinned Bun 38 pass / 0 fail / 147 assertions. Four cases exhausted their original five-second deadline. The failure boundary and ownership requirements were reproduced on the published #532/#543 parents before implementation.

Parent: #66. Follow-up to #532 and #543.

Published fbdfbf890 on codex/runtime-port as Chris Breuer without coauthors; not merged to main.

The final complete server replay remains 31 pass / 7 fail / 122 assertions, versus pinned Bun 38/38 / 147. Publishing #532 does not implement the SNI/ALPN callback and suspension behavior tracked here. The updated issue links the exact artifact and evidence; this issue stays open.

New published parent: 04569d8f9 on codex/runtime-port. #543 is complete and closed; its adjacent TLS replay leaves exactly the seven unchanged SNI/ALPN failures tracked here (47 pass / 2 skip / 7 fail / 424 assertions across the seven-file slice). This is the next active native TLS checkpoint under #66.

Published a9a95f6a4 on codex/runtime-port as Chris Breuer without coauthors; not merged to main.

The unchanged TLS server corpus is now 38/38 / 147 assertions, exactly matching pinned Bun. The new combined SNI+ALPN native lifecycle regression passes 20/20 independent processes plus VM destruction; build is 17/17, scoped units are 1,828 pass / 19 skips / 0 fail, and sequential runtime regressions are 63/63. The issue body now records the full verification and remaining platform/integration boundary. Closing #542 as implemented; overall parity remains open in #66.