Parents: #493, #495 Related: #759, #762
Problem
Private ABI borrowed ZigString views and heap-snapshot string tables still place runtime/host-controlled exact bytes in default-seeded native string maps. Predictable placement lets adversarial property names, URLs, source text, and diagnostic edge names force collision-heavy work at private embedding and heap-inspection boundaries.
Scope
- Generalize the C/private-ABI lazy secure exact-byte map introduced by #762 so memberships and value maps share one reviewed implementation.
- Give each context-group borrowed-view store, the mutex-protected context-free borrowed-view store, and each heap-snapshot string table its own lazily installed unpredictable Wyhash context.
- Keep empty/look-up-only paths entropy- and allocation-free; publish a context only after the first successful native-table mutation.
- Preserve borrowed-view pointer stability, Latin-1/UTF-16 tagging and ownership, embedded-NUL equality, snapshot string indices/order/schema, and existing OOM/error publication.
- Make duplicate insertion cleanup and snapshot item/map rollback explicit and leak-free.
No-workaround rules
- No input/property/depth caps, deterministic fallback seeds, hash-only equality, skipped strings/edges, reordered output, swallowed allocation failure, or weakened ABI lifetime behavior.
- No stack, queue, job, Promise, Worker, or Map/Set iterator implementation changes.
Acceptance
- All three private ABI string-map lifetimes use lazy independent secure contexts through one exact-byte primitive.
- Empty, duplicate, embedded-NUL, non-Latin-1, and 4 KiB cases preserve exact behavior and stable borrowed results.
- Entropy and allocation failures leave the first mutation unpublished and all owned buffers reclaimed.
- Focused normal and TSan tests pass with zero leaks/races.
- Exact-parent private ABI fixtures and relevant heap-snapshot/property-name tests have nonzero accounting and zero regressions.