* fix(sqlite): validate Bun libraries without JIT-only FFI
* fix(sqlite): keep probe bootstrap self-contained
* test(sqlite): preserve probe module exports
* fix(sqlite): isolate Bun library probes from project config
Run the bounded same-executable probe from its private directory with an empty Bun config and dotenv loading disabled. Resolve relative library candidates before changing the child working directory, and retain finally-owned cleanup.
A real Bun regression reproduces the inherited preload failure on the prior head and passes with this fix. Owner, parser, worker, and launcher tests pass; generated runtime copies are refreshed.
* fix(runtime): gate dynamic execution in AOT hosts
Select execution capabilities from standalone build facts and reject unsupported host evaluation or non-embedded plugin modules with actionable guidance. Preserve dynamic Node/Bun hosts and expose the same policy through the plugin SDK.
* fix(runtime): use immutable standalone profile facts
* fix: preserve standalone CLI commands across startup respawns
Resolve launcher-bound runtime arguments at the CLI invocation owner. Consume a one-child parent PID signal in compiled runtimes while preserving the loose preload and detached worker lifetimes.
* test: keep respawn transport guard independent of local names
* test: include respawn owner dependencies in CLI fixtures
Resolve installed host links from the selected standalone runtime and admit equivalent signed artifact manifests across bundle-to-seed relocation. Keep audits read-only and explicit install/Doctor repair responsible for rebinding links; reject different artifacts with host-compatible repair guidance.
* fix(plugins): retain npm runtime for standalone installs
Declare npm and its bundled runtime closure as standalone resources, record its size and file count, and run it through the compiled executable in Bun mode. Preserve npm configuration, lockfile integrity checks, and script-free installation semantics for on-demand plugins.
* test(build): declare absent package manager in manifest fixture
* fix(build): map installed plugin SDK loads into standalone image
Preserve explicit profiles across standalone CLI respawns through one bootstrap-safe invocation owner. Select loose runtime/script arguments or direct compiled arguments from the embedded builder fact or adjacent manifest. Include the owner and compile-cache workers in packaged launchers and standalone builds.
Settle worker execution and native resource closure independently after snapshot failure. Release startup-refused broker claims only after native process and pipe closure, retain cleanup transport on operation failure, propagate Doctor snapshot errors, and cancel further inspections without losing maintenance restoration.
Document the private Unix-domain bind/connect allowance required by both loose and standalone snapshot workers. Keep network, home, Keychain, launchctl, and host-SQLite denials in the relocated verifier.
Validation: signed production-pinned JIT and bytecode artifacts at 4aa64f9ddc passed explicit-profile Doctor, Gateway/agent/restart campaigns, denied-IPC failure, and SIGTERM settlement in 364/375 ms with unchanged deadlines. Later source repairs passed owning-boundary regressions, scoped checks, and independent review. Signed artifact identity is preserved separately from the final CI head.
Exact-head CI for 9617855492767: 172 successful jobs, 19 skipped, zero failures (run 38833042547). Tested merge 58c3b87a8594 has the same tree as the prepared PR head. No CI exception, rerun, or timeout increase.
