Visitor.isManaged() is now membership-based and tolerates stale/wild maybe-managed roots (fixed in 984ae51), but the write-barrier path still documents child-only barrier calls as safe with any pointer while some internals still derive a header from the candidate address before proving heap membership.
Why this matters:
- Embedders use barrier(cell) and barrierFrom(owner, cell) at ownership boundaries where legacy/raw pointers may appear.
- The mid-script parallel-GC crash in zig-js showed that one unsafe header peek is enough to take down the collector under stress.
- Backward compatibility is not important yet; the API contract should be made robust before consumers depend on it.
Acceptance criteria:
- Audit writeBarrier, writeBarrierFrom, writeBarrierWeak, rememberStrongStore, incrementalBarrier, and nursery remembered-set paths for untrusted pointer inputs.
- Decide which APIs require precise managed payloads and which are maybe-managed compatibility APIs.
- For maybe-managed APIs, prove heap membership without dereferencing the candidate address first, or split out explicit safe/unsafe variants.
- Add regression coverage with live heap pointers, stack/arena pointers, and deliberately wild aligned pointer values.
- Keep the hot precise path available if needed, but make the public compatibility contract impossible to violate by accident.