Parent: #479 Related: #478, #531, #532
Evidence
After #597 removes embedded-root GC owner classification, current production cold attribution still records 31,242 Environment binding-lock acquisitions during one representative configuration: 27,297 reads and 3,945 writes, of which 27,289 reads and 3,942 writes are on the Context-embedded root. The context is created with precise GC but no threads, parallel mutators, or concurrent marker; its root Environment is creator-thread-owned for its immutable lifetime.
The existing process-global binding_locks_enabled gate intentionally starts true because changing one global flag while another context holds a lock made paired lock/unlock unsafe. That history rules out toggling the global gate. It does not require every independent Environment to share one mutable policy.
Scope
- Add an immutable per-Environment synchronization ruling, set before publication.
- Keep root locking enabled for thread-enabled, parallel-GC/JS, and concurrent-marker contexts.
- Allow only provably single-owner realm roots (including owner-thread-affine C API realms) to skip the mutex.
- Retain the existing process-global fail-safe and all managed/captured/private-activation protocols.
- Add creation-policy, parallel-context, concurrent-marker, and focused TSan witnesses.
Correctness constraints
- No process-global disable, runtime false-to-true policy transition, GIL substitution, or benchmark-specific path.
- Any Environment reachable by peer mutators or a concurrent marker must remain locked.
- Context options are immutable; publication/revocation must not depend on later inference.
- GC tracing, moving relocation, direct/indirect eval, modules, C API sibling realms, and teardown must remain exact.
- Do not touch stacks, queues, jobs, Promise, microtask, or Worker lifecycle implementation.
Acceptance
- Exact-parent production cold medians improve with identical checksum and allocation/execution counters.
- Root Environment lock attribution falls to zero only for single-owner contexts and stays nonzero in shared/concurrent witnesses.
- Relevant test262, focused TSan/GC/C API tests, and full units pass without leaks.