Parent: #134 Profile umbrella: #140 Home inventory: #163 Bun inventory: #164 Builds on: #215
Implement the remaining pinned core JSBuffer allocation/ownership symbols:
JSBuffer__bufferFromLengthJSBuffer__bufferFromPointerAndLengthAndDeinitJSBuffer__fromMmap
Acceptance criteria:
- Length construction returns a live Buffer-identified Uint8Array and rejects negative/oversized lengths through the private pending RangeError boundary.
- Pointer construction adopts non-empty bytes without copying and invokes the supplied deallocator/context exactly once.
- Zero-length pointer construction invokes a supplied deallocator immediately, matching the pinned Bun ownership fix, and still returns an empty Buffer.
- Invalid non-empty pointer/deallocator combinations fail explicitly without creating a dangling view.
- Mmap construction adopts the mapping without copying and unmaps it exactly once at GC/realm teardown.
- Allocation failures release transferred external storage and publish the private pending exception.
- Focused engine tests and the Home consumer fixture cover Buffer identity, range failures, pointer identity, callback context, zero length, and mmap teardown.
- Inventories, ABI docs, README scorecard, and parent trackers publish the verified counts without changing benchmark scores for this ABI-only slice.
Completed evidence
Implemented in 90372f3f and documented in f55ec3a8. Focused tests passed 3/3 with zero leaks; the engine and all audits passed; the corrected Home consumer fixture passed 195/195. Home is 196/431 implemented (235 pending), Bun core is 190/421 (231 pending), and the public classifier reports 117 public, 19 extensions, and 200 private/support exports.