Parents: #493, #495 Related: #866 Follow-up: #868
Problem
The process-global ScriptExecutionContextIdentifier registry stores live
32-bit context IDs in std.AutoHashMapUnmanaged(u32, ...). Home may supply
those IDs through Zig__GlobalObject__create, so native boundary input controls
the key set while bucket placement remains process-default and predictable.
This is an algorithmic-complexity surface in a long-lived process registry. The IDs are stable identities, not authority tokens: callers depend on exact explicit assignment and same-VM isolation transfer, so randomizing or replacing their externally visible values would be the wrong fix.
Required design
- Preserve the exact nonzero 32-bit identifier ABI, sequential lazy allocation, explicit Home assignment, and same-VM test-isolation transfer semantics.
- Store live mappings in a separately and securely seeded exact-integer map under the existing process lock.
- Initialize the map lazily and publish its hash context only after the first backing allocation succeeds.
- Make first registration, explicit assignment, and transfer failure-atomic: entropy/allocation failure must not publish an ID, owner, or partial map state.
- Preserve natural teardown and explicit remove behavior; zero, unknown, duplicate, retired, and forged IDs remain inert.
- Keep lookup exact under collisions and concurrent creation/removal.
No-workaround rules
- No randomized externally visible IDs, address-derived IDs/seeds, predictable entropy fallback, hash-only equality, ID cap/reduced range, linear fallback, leaked tombstones, disabled explicit assignment, weakened teardown, signature or pinned-layout change, or lock removal.
Acceptance
- Default-seed integer collision families disperse under independently keyed exact hashing; lookup/removal remain exact.
- Context-entropy and first-allocation failures leave the registry empty, unseeded, leak-free, and retryable.
- Stable lazy IDs, exact explicit assignment, and isolation transfer preserve the current observable ABI and publish only complete mappings.
- Duplicate/zero/unknown/retired/forged IDs and concurrent lifecycle races remain inert and cannot resolve a different live context.
- Focused script-execution-context tests pass in Debug, ReleaseSafe, and TSan; full units and public C plus pinned Home/Bun ABI/runtime gates pass.