Last of #739's items. Item 1 (trace tape) → #761, item 2 (exit request) → #762, item 3 (task suspend) → #763.

Each of these is a resource the runtime scopes per state or per thread everywhere else, held in one process-wide slot.

s_osr_threshold — a function static froze per-state JIT tuning

It was filled by whichever state crossed a back edge first, then frozen for the life of the process — defeating the tuning eigenscript.h explicitly advertises ("so two co-located embedded states can tune independently"). Entry and iter thresholds were already per-state; only OSR opted out. It now reads g_osr_threshold directly.

eigs_jit_get_osr_threshold() existed only to fill that cache and is deleted. Its comment claimed the value was read "once per thread" — never true; it was once per process, which is precisely the bug.

g_sandbox_* — one budget shared by every concurrent state

g_sandbox_active / _bytes_used / _byte_max / g_sandbox_loop_max are now per-thread. The save/restore in builtin_sandbox_run is correct for one thread's nesting, but the premise it documented — "sandbox_run is synchronous" — holds per thread and breaks the moment two states run concurrently, which ext_http does per connection. One worker entering a sandbox capped every other worker's loops and charged their allocations against its budget.

g_stream_file — one FILE* per process

Now per-thread, closed at eigs_thread_detach. stream_open unconditionally closes whatever is already open, so two states streaming at once tore down each other's file mid-write. An unclosed stream also lost its buffered tail at exit; verified 24 bytes now reach disk where they previously did not.

The freestanding symbol gate caught fclose leaving the allowlist, so the cleanup is carved out under !EIGENSCRIPT_FREESTANDING alongside the stream_* builtins themselves. Worth noting the gate did exactly its job here.

g_db_conn — per-state, and actually closed

Moved onto EigsState, closed by a new ext_db_state_destroy called from eigs_state_destroy — the same shape ext_http_state_destroy already had. One worker's db_connect used to replace the connection another worker was querying through, and nothing ever closed it.

⚠️ Not built or run. This box has no libpq at all — no headers, no library — so ext_db.c and state.c with EXT_DB=1 are syntax-checked against a local stub header only. That catches compile errors and proves nothing about behavior. This is the one hunk that deserves real review.

Deliberately unchanged: g_model

Its allocations are reachable from a global at exit, so they are still-reachable, not leaked — LSan does not report them and the OS reclaims them. The genuine defect would be cross-state clobber (one state's eigen_model_load replacing another's weights), and the fix for that is per-state transformer weights, which multiplies memory by the number of states. That is a design decision about model isolation, not a mechanical scope move, so I left it rather than trade a non-leak for a memory regression. Same for g_model_age / g_training_samples.

Validation

• release 3274/3274; asan+ubsan 3278/3278, leak tally 0
• TSan 11/11 including its seeded-race self-validation (17 warnings — the gate is live, not silently dead)
• freestanding symbol gate stage 1+2 OK after the carve-out; jit-smoke; sandbox, task, and HTTP suites pass

One transient to record rather than hide: a single test_http_server.sh run showed 41/1 during this work. I did not capture which check, and five consecutive runs since are 42/0. Logging it as an observed transient, not as nothing.

Refs #739 — with this, all four items are addressed. The intermittent db extension RSS-growth failure is not explained by any of them; I retracted my earlier hypothesis in the issue thread and proposed the diagnostic that separates the two variables that job conflates.

🤖 Generated with Claude Code