[SnowCheetos]

Summary

kore-lua's VM bridge and kore-c's program host now speak kore-rt's bridge, the one seam for a synchronous engine on a worker thread served by its async host. Kore's tcc and its Lua REPL speak the same seam upstream. Each engine keeps only its payload and its dispatch. The word's states, the park-and-kick ordering, the cell's hand-over and the worker's end are kore-rt's.

This is stacked on ft/fervent-shannon-egp5pt (kore-c, libkore.so), which is #32; this branch merges it at 98186bf. This lands after it, or this pull request's base moves to alpha to land both. The Kore half is MicroPerceptron/kore#1536, stacked on MicroPerceptron/kore#1494, which pins this branch at e4c3905.

Why

The two copies here had drifted from each other and from TCC's:

• kore-lua:
  • A VM that could not be built stored WORKER_GONE over a host-held word, which the first evaluation could overwrite. Thread 0 then parked forever.
  • A park refused mid-call returned into Lua while thread 0 still read the call's input, a borrow of the Lua frame.
  • A VM-thread panic was never reported to thread 0.
  • eval handed the VM thread a pointer into the caller's script. A dropped eval future ended that borrow while the VM went on compiling from it: a use-after-free reachable from safe code.
• kore-c: it kept its own session states, park loops, race and fatal path beside them.

What changed

• native/ is re-exported byte for byte with tools/sync-native.py at Kore 6a8c754bc959e9489a6fb18be642fcc881a65c48. That commit carries the bridge and merges MicroPerceptron/kore#1494's branch at f2644e5b, so the export also has everything the kore-c branch exported since: the parking controller, threads that found taking a founder's arena, Kore's C library, and the link window's free span. Against the base's export, the closure keeps 27 packages and gains kore-rt's bridge (402 files), with:

  • ThreadBlock's hosted_bridge tail slot;
  • a bridge-worker notice in kore-rt's panic paths;
  • the worker's exit hook, so a worker that ends its own thread without its last word has it said for it;
  • a side source the host serves beside the worker (Side, serve_beside), armed and re-read with the word;
  • a fix to a flaky kore-rt test (6a8c754b). The futex sweep test judged every row of the wait table while the suite's other tests held rows of their own. It failed 8 runs in 300 of futex::tests, and once in this branch's make test. MicroPerceptron/kore#1534 (a4ab7234), which ffi: a cancellation wakes its target, and no cancellable wait polls #33 exports, carries the same fix.

  No exported manifest changed, so native/Cargo.lock did not.

• kore-lua:

  • The VM is the Interpreter engine. Its first item carries E::LIBRARIES and E::POLICY, so the engine is not generic over the Extension. That keeps Extension free of a 'static bound, as its contract requires.
  • Host keeps its API (start::<E>, eval::<E>, quit).
  • A worker gone for any reason but a failed start is now Fatal. It used to answer the last evaluation's stale outcome.
  • eval is sound under cancellation (57c57d7). The evaluation runs on its own copy of the script, in a buffer reused across evaluations: one bounded memcpy, or Outcome::ResourceRefused with nothing posted. The next eval finishes an abandoned one first. The bridge cannot close this from below, since a host future may always be dropped.

• kore-c:

  • The main thread is the bridge's worker, and its one item is the program. It is founded through WorkerHost::spawn, holding the channel-space grant b9eb3c2 gave it.

  • What the program's other threads hand thread 0 is the bridge's side source. Thread 0 serves it between the main thread's sessions and beside one in flight:

    • the output ring 0460f5c brought, drained a pass at a time. The stream is finished before the main thread is retired, since the main thread may still be waiting for room;
    • a thread's mmap or munmap, which c876e43 brought. Thread 0 carries it out, since it holds the supply's root. A pass answers it before it drains the ring, so a pass dropped beside a session cannot cut the answer short. Only the ring is armed, since a mapping's caller always kicks.

    The base's own park, race and end-wait are gone, since the bridge owns those.

  • Thread 0 serves the session with serve_beside, stopping on the exit word, so an end requested mid-session still does not wait for the session.

  • mmap refuses a program with no host through program::hosted, which is the bridge's is_hosted: true from the founding's claim until the host joins the main thread.

  • The exit word, the roles and the join-or-abandon decision stay this crate's, since they are the program's lifecycle. A main thread that ends itself also leaves the bridge, so the host can join it for a clean barrier.

• make miri also runs kore-rt's bridge suite, which drives the state machine on real threads, so Miri checks every hand-over.

• Docs: docs/languages.md, crates/lua/src/lib.rs's Extension contract, and docs/provenance.md.

History

The branch merges its moved base instead of rebasing onto it, since its history was already pushed. Each merge re-exports native/ at the Kore commit that carries both halves:

• 9d1d43d superseded a0e452e's export at 61ae1ace.
• 26115b2 took the base at 0460f5c, after it had moved through exports at Kore 2a0730dd, 6c57f344 and 2d4998ba.
• e4c3905 takes the base at 98186bf: an export at Kore 10c7b400, c876e43's descriptors and mmap, and rustix 1.1.6 (RUSTSEC-2026-0486).

Each export's Kore commits are on MicroPerceptron/kore#1494's branch, so each export carries them beside the bridge.

Verification

Locally, with the pinned nightly:

• make fmt test check docs owners cross miri bindings-check: PASS at e4c3905, on the export at Kore 6a8c754b. That covers:

  • the native kore-rt suite (477, the bridge's 13 among them), kore-dagfs and kore-vol;
  • clippy and rustdoc with warnings denied;
  • cross: the three Kore user-target checks, which compile kore-lua's and kore-c's bridges and the metal half of kore-rt's for all three ISAs;
  • check-program: libkore.so links for all three ISAs with exactly its declared 129 exports, the five c876e43 brought (open, close, mmap, munmap, kore_fd_describe) among them;
  • Miri over the bridge suite (14 tests with erased_poll_and_drop);
  • cbindgen and Zig for the bindings.

• The futex fix: 8 of 300 runs of futex::tests failed before it, and 0 of 1000 after.

• This repo's CI on e4c3905:

  • host and miri pass.
  • The three targets jobs passed every build and check up to apt-get install llvm, which failed both times they ran: their runners could not resolve Ubuntu's archives. So CI has not yet run the allocator-symbol check or the ABI check after it, which pass locally (make cross).

• On Kore's side, MicroPerceptron/kore#1536 pins this branch at e4c3905 (6187e3ea), sealed in c27b20ba. Its sealed production x86 image passed these under QEMU 8.2 TCG, booting the seal's own bytes:

  • make keytest-tcc-x86:
    • its libkore tour runs to exit 42 on kore-c's host over the bridge;
    • hello.c prints every line through the output ring the side source drains;
    • memory.c opens /kore/memory, maps a zeroed megabyte, maps a second one elsewhere, reuses an unmapped region, and has its meaningless requests refused. Each of its mmap and munmap calls reaches thread 0 through the side source.
  • make keytest-lua-x86: Kore's own REPL, the same seam.
  • make exec-boot-gate-x86: all 19 services founded.

  lua-tool-worker, which runs kore-lua, builds from this revision and drops its own copy of the script; no keytest drives it. Kore's make test passes (223 cargo suites, 8436 tests), and make check-x86, check-aarch64 and check-riscv report 0 errors.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ACHC7fL57uG16rZrxzpedi

[SnowCheetos]

targets (x86_64), targets (aarch64) and targets (riscv64gc) failed on e4c3905 because their runners lost DNS while installing llvm. It is not this branch's code.

• Every build and check in the three jobs passed up to that step. riscv64gc, for instance, reached entry: riscv64gc: 7 linked programs; 3 invalid return types rejected.
• The next step, sudo apt-get install -y llvm for tools/check-alloc-symbols.py, failed in each job with Temporary failure resolving 'security.ubuntu.com' (and archive.ubuntu.com, azure.archive.ubuntu.com), exit 100. So the allocator-symbol check, and the libkore.so ABI check after it, never ran.
• The base's run on 98186bf (13:11–13:22 UTC) installed llvm in the same step without trouble, so the outage began after it.
• Locally, make cross passed on this head for all three ISAs. It covers the allocator-symbol check, and check-program linked libkore.so for each ISA with exactly its declared 129 exports.

Update: I re-ran the failed jobs once (attempt 2, 14:15–14:22 UTC). All three failed again at the same step with the same resolver errors, while host and miri stayed green. That was this PR's one re-run, so I am not re-running again. The jobs will run again with this branch's next push. A re-run once the runners resolve Ubuntu's archives again would also settle it.

---

Generated by Claude Code