rusty_racer 0.1.1 → 0.1.3

data/ext/rusty_racer/src/lib.rs

@@ -41,14 +41,23 @@ use std::collections::HashMap;
 use std::ffi::c_void;
 use std::ptr::null_mut;
 use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::{Arc, Condvar, Mutex, Once, Weak};
-use std::time::{Duration, Instant};
+use std::sync::{Arc, Mutex, Once, Weak};
 
 use magnus::block::Proc;
 use magnus::value::{BoxValue, ReprValue};
 use magnus::{
-    function, method, prelude::*, Error, Exception, ExceptionClass, IntoValue, RArray, RHash,
-    RString, Ruby, TryConvert, Value,
+    function, method, prelude::*, Error, Exception, ExceptionClass, RHash, Ruby, TryConvert, Value,
+};
+
+mod marshal;
+use marshal::{js_to_jsval, jsval_to_js, jsval_to_ruby, ruby_to_jsval, JsVal};
+mod ops;
+use ops::{run_source, service_request, Compiled, Request, VmReply};
+mod stack;
+use stack::{discover_scan_start_field, set_v8_stack_limit, STACK_DEBUG};
+mod watchdog;
+use watchdog::{
+    arm_watchdog, disarm_watchdog, run_js_bracketed, watchdog_loop, WatchdogShared, WATCHDOG_DEBUG,
 };
 
 // A Ruby Proc rooted for as long as the Core holds it. BoxValue registers a
@@ -110,6 +119,7 @@ macro_rules! istate {
             .expect("IsolateState missing from isolate slot")
     };
 }
+pub(crate) use istate;
 
 // One attach()'d host fn: the realm it was attached into — so resetting or
 // disposing that realm can release the GC root — and the rooted proc itself
@@ -166,56 +176,6 @@ fn err_class(ruby: &Ruby, name: &str) -> ExceptionClass {
         .unwrap_or_else(|_| ruby.exception_runtime_error())
 }
 
-// ---------------------------------------------------------------------------
-// Values crossing threads: plain Rust data. No Ruby allocation off the Ruby
-// thread, no V8 handles off the V8 thread, no wire format. Replaces serde.c.
-// ---------------------------------------------------------------------------
-#[derive(Debug, Clone)]
-enum JsVal {
-    Undefined,
-    Null,
-    Bool(bool),
-    Int(i64),
-    Num(f64),
-    Str(String),
-    // Binary bytes: a JS Uint8Array / ArrayBuffer (view) <-> a Ruby ASCII-8BIT
-    // (binary-tagged) String. The encoding tag IS the type declaration, so the
-    // round-trip is symmetric and faithful (Uint8Array -> binary String ->
-    // Uint8Array), like BigInt/Date/Map/Set — no lossy text coercion. |id| (when
-    // Some) registers it in the Ref table so a binary blob aliased in a graph
-    // keeps ONE identity instead of being duplicated; None = not identity-tracked
-    // (e.g. a to_str result).
-    Bytes { id: Option<u32>, bytes: Vec<u8> },
-    // Arbitrary-precision integer (JS BigInt <-> Ruby Integer). Carried as V8's
-    // word representation: sign + little-endian u64 limbs. Both ends speak this
-    // natively (V8 BigInt words; Ruby Integer via a hex string), so no value is
-    // truncated — unlike routing a big int through f64.
-    BigInt { negative: bool, words: Vec<u64> },
-    // JS Date <-> Ruby Time, carried as milliseconds since the Unix epoch
-    // (v8::Date::value_of's unit). mini_racer marshals Date to Time.
-    Date(f64),
-    // Containers carry a serialization id so shared/cyclic graphs survive the
-    // round-trip: the first time an object is seen it is emitted with its id,
-    // and any later occurrence (a sibling sharing it, or a cycle back to an
-    // ancestor) is emitted as Ref(id) instead of being re-expanded.
-    Array { id: u32, items: Vec<JsVal> },
-    // JS object / Ruby Hash with string keys. Insertion order preserved.
-    Obj { id: u32, entries: Vec<(String, JsVal)> },
-    // JS Map <-> Ruby Hash. Keys are arbitrary values (not just strings), so
-    // this is distinct from Obj. Insertion order preserved.
-    Map { id: u32, pairs: Vec<(JsVal, JsVal)> },
-    // JS Set <-> Ruby Set (stdlib).
-    Set { id: u32, items: Vec<JsVal> },
-    // Back-reference to an already-emitted container (preserves identity; makes
-    // cycles representable instead of truncating at a depth cap).
-    Ref(u32),
-}
-
-// Cycles and sharing are handled by the Ref table (see JsVal::Ref), so this is
-// purely a native-stack backstop against a pathologically deep (but acyclic)
-// graph — set well above any realistic nesting.
-const MAX_MARSHAL_DEPTH: u32 = 256;
-
 #[derive(Debug)]
 enum VmError {
     Parse(String),   // compile-time failure -> RustyRacer::ParseError
@@ -226,149 +186,52 @@ enum VmError {
         message: String,
         backtrace: Vec<String>,
     },
-    Terminated, // watchdog/stop -> RustyRacer::ScriptTerminatedError
-}
-
-// One VM operation, built by a magnus method and run inline by Core::run ->
-// service_request -> dispatch_one. |context_id| selects which realm the op runs
-// in: 0 = the main realm (Context's own globalThis, swappable by reset_realm),
-// N >= 1 = an extra realm made by create_context.
-enum Request {
-    Eval {
-        context_id: i32,
-        source: String,
-        filename: String,
-        timeout_ms: u64,
-    },
-    // Resolve a dotted function path on globalThis and invoke it with marshalled
-    // args (v8::Function::call), preserving the holder as `this`. Distinct from
-    // Eval so args keep full type/identity fidelity instead of a JSON literal.
-    Call {
-        context_id: i32,
-        name: String,
-        args: Vec<JsVal>,
-        // void = don't marshal the return (fire-and-forget): the called fn may
-        // return a huge/cyclic JS object the caller never reads.
-        void: bool,
-        timeout_ms: u64,
-    },
-    // Drain the isolate's microtask queue once (no auto event loop).
-    DrainMicrotasks {
-        timeout_ms: u64,
-    },
-    Attach {
-        context_id: i32,
-        name: String,
-        host_fn_id: usize,
-        timeout_ms: u64,
-    },
-    // Batch attach: install many (name, host_fn_id) host fns in one round-trip
-    // (a fresh realm needs ~dozens). Same semantics as Attach, applied in order.
-    AttachMany {
-        context_id: i32,
-        entries: Vec<(String, usize)>,
-        timeout_ms: u64,
-    },
-    // reset: swap globalThis for a fresh v8::Context, reusing the same warm
-    // isolate — csim's per-visit reset. Applies to the named context.
-    Reset {
-        context_id: i32,
-    },
-    // create_context: build a fresh, persistent v8::Context in the isolate and
-    // return its id (the multi-realm model). DisposeContext frees one.
-    CreateContext,
-    DisposeContext {
-        context_id: i32,
-    },
-    // Thin ES-module primitives (V8's raw compile/instantiate/evaluate). The
-    // embedder owns the url->Module registry and the resolve policy; the binding
-    // just exposes the steps. A compiled module is addressed by an id (like a
-    // realm) since a v8::Local handle can't outlive the op's scope.
-    CompileModule {
-        // The context to compile the module in (modules are realm-bound).
-        context_id: i32,
-        source: String,
-        filename: String,
-        // Bytecode cache to consume (skip reparse); None compiles fresh.
-        cached_data: Option<Vec<u8>>,
-        // Produce a fresh bytecode cache to hand back (Module#cached_data).
-        produce_cache: bool,
-        // Eager-compile every function up front (CompileOptions::EagerCompile)
-        // instead of V8's default lazy top-level-only compile. Ignored when
-        // cached_data is set (V8 forbids ConsumeCodeCache + EagerCompile).
-        eager: bool,
-    },
-    // instantiate: V8 walks imports, calling back to the Ruby resolve block
-    // (parked in the slot for the op) per edge via resolve_imported.
-    InstantiateModule {
-        module_id: i32,
-    },
-    EvaluateModule {
-        module_id: i32,
-        timeout_ms: u64,
-    },
-    ModuleNamespace {
-        module_id: i32,
-    },
-    // The module's v8::Module::Status, as a lowercase name ("uninstantiated",
-    // "instantiated", ...) the Ruby wrapper symbolizes.
-    ModuleStatus {
-        module_id: i32,
-    },
-    DisposeModule {
-        module_id: i32,
-    },
-    // Classic <script> primitives (V8 ScriptCompiler::CompileUnboundScript): an
-    // unbound script, compiled in a context, runnable repeatedly, with the same
-    // bytecode-cache options as modules. Addressed by id like a module.
-    CompileScript {
-        context_id: i32,
-        source: String,
-        filename: String,
-        cached_data: Option<Vec<u8>>,
-        produce_cache: bool,
-        eager: bool,
-    },
-    // Bind the script to its context and run it; returns the completion value.
-    RunScript {
-        script_id: i32,
-        timeout_ms: u64,
-    },
-    DisposeScript {
-        script_id: i32,
-    },
-    // Serialize a bytecode cache from a compiled handle's CURRENT compile state
-    // (Script#create_code_cache / Module#create_code_cache). Called after run/
-    // evaluate, it captures the inner functions V8 lazily compiled while running
-    // — the only way (as of V8-150) to get inner-function bytecode into a cache,
-    // since create_code_cache at compile time only sees the top level.
-    ScriptCodeCache {
-        script_id: i32,
-    },
-    ModuleCodeCache {
-        module_id: i32,
-    },
-}
-
-// compile_module result: the module's id plus any produced bytecode cache and
-// whether a supplied cache was rejected.
-struct Compiled {
-    id: i32,
-    cached_data: Option<Vec<u8>>,
-    cache_rejected: bool,
-}
-
-// The terminal reply of an op: service_request returns it straight up to
-// Core::run (no channel). Host callbacks and module resolvers don't round-trip
-// through here — they run inline (with_gvl).
-enum VmReply {
-    Done(Result<JsVal, VmError>),
-    // compile_module / compile's richer reply (id + produced cache + rejected).
-    ModuleCompiled(Result<Compiled, VmError>),
-    ScriptCompiled(Result<Compiled, VmError>),
-    // Script#/Module#create_code_cache: the serialized bytes, or None when V8
-    // can't produce a cache (or the handle's realm is gone).
-    CodeCache(Result<Option<Vec<u8>>, VmError>),
+    Terminated,  // watchdog/stop -> RustyRacer::ScriptTerminatedError
+    OutOfMemory, // memory_limit hit -> RustyRacer::V8OutOfMemoryError
+}
+
+// V8's near-heap-limit callback (registered per isolate when memory_limit > 0).
+// V8 calls this, synchronously on the owner thread, when a GC still leaves the
+// heap about to exceed the configured ceiling — i.e. the script is running away
+// on memory. `data` is the isolate ptr we registered (Core.iso_ptr). We flag the
+// isolate and terminate the running JS so it unwinds with a catchable error
+// rather than V8 aborting the process. The return value becomes V8's new ceiling:
+// hand it a DOUBLED limit so the unwind itself (and any pending finalizers) has
+// room to allocate without tripping a hard OOM abort mid-unwind. Core::run, once
+// the op has unwound, forces a GC to reclaim and resets the ceiling — see the OOM
+// recovery there. The bump is a no-op-after-the-fact: doubling here, GC + reset
+// after, so the limit keeps protecting later ops.
+unsafe extern "C" fn near_heap_limit_cb(data: *mut c_void, current_heap_limit: usize, _initial: usize) -> usize {
+    let isolate = unsafe { &mut *(data as *mut v8::Isolate) };
+    // get_slot_mut (not istate!): this runs as an extern "C" callback from V8's
+    // C++ allocator, where a panic would unwind across the FFI boundary. The slot
+    // is always present once an op can run (set in Isolate::new before any JS), but
+    // skip flagging rather than .expect()-panic in the impossible absent case.
+    // Setting the flag releases the &mut borrow before terminate_execution (&self).
+    if isolate.get_slot_mut::<IsolateState>().map(|s| s.oom_fired = true).is_some() {
+        isolate.terminate_execution();
+    }
+    current_heap_limit.saturating_mul(2)
+}
+
+// After an OOM the running op's outcome is a bare Terminated (the terminate the
+// callback fired). Swap it for OutOfMemory so it surfaces as V8OutOfMemoryError,
+// preserving the reply's variant (the caller dispatches on it). Only the error
+// arm changes; a Terminated from a real timeout/stop never reaches here because
+// this runs only when oom_fired was set.
+fn relabel_oom(reply: VmReply) -> VmReply {
+    fn fix<T>(r: Result<T, VmError>) -> Result<T, VmError> {
+        match r {
+            Err(VmError::Terminated) => Err(VmError::OutOfMemory),
+            other => other,
+        }
+    }
+    match reply {
+        VmReply::Done(r) => VmReply::Done(fix(r)),
+        VmReply::ModuleCompiled(r) => VmReply::ModuleCompiled(fix(r)),
+        VmReply::ScriptCompiled(r) => VmReply::ScriptCompiled(fix(r)),
+        VmReply::CodeCache(r) => VmReply::CodeCache(fix(r)),
+    }
 }
 
 // ---------------------------------------------------------------------------
@@ -449,644 +312,6 @@ fn error_to_exception(e: &Error) -> Option<Exception> {
     None
 }
 
-// ---------------------------------------------------------------------------
-// V8 stack limit (in-thread: V8 runs on the calling Ruby thread's stack)
-// ---------------------------------------------------------------------------
-// rusty_v8 doesn't wrap the runtime `v8::Isolate::SetStackLimit(uintptr_t)`, so
-// link the public V8 symbol directly (stable across V8 versions). It sets the
-// lowest address V8's stack may reach before it throws RangeError.
-unsafe extern "C" {
-    #[link_name = "_ZN2v87Isolate13SetStackLimitEm"]
-    fn v8__Isolate__SetStackLimit(isolate: *mut c_void, stack_limit: usize);
-    // V8's own (exported) accessors down to the conservative-GC-scan Stack
-    // object, so we can re-point its stack_start per op when V8 runs on a Ruby
-    // Fiber (see set_fiber_scan_start / discover_scan_start_field). Member fns:
-    // the first arg is `this`. The public v8::Isolate* IS i::Isolate*.
-    #[link_name = "_ZN2v88internal7Isolate4heapEv"]
-    fn v8__internal__Isolate__heap(isolate: *mut c_void) -> *mut c_void;
-    #[link_name = "_ZN2v88internal4Heap5stackEv"]
-    fn v8__internal__Heap__stack(heap: *mut c_void) -> *mut c_void;
-    // Sets the scan stack_start to v8::base::Stack::GetStackStart() (the native
-    // pthread top) — used only to positively identify the field during discovery.
-    #[link_name = "_ZN2v88internal4Heap13SetStackStartEv"]
-    fn v8__internal__Heap__SetStackStart(heap: *mut c_void);
-    #[link_name = "_ZN2v84base5Stack13GetStackStartEv"]
-    fn v8__base__Stack__GetStackStart() -> usize;
-}
-
-// Locate V8's conservative-GC-scan stack_start field
-// (heap::base::Stack::current_segment_.start) so set_fiber_scan_start can
-// re-point it per op. The scanner walks [SP, stack_start); on a Ruby Fiber V8's
-// stack_start is still the NATIVE thread top, a different region, so the walk
-// runs off the fiber's mapped top into the guard page and SEGVs (the residual
-// after the limit fix). We reach the Stack via V8's exported Isolate::heap()/
-// Heap::stack(); the field is the first word of Stack (current_segment_ is its
-// first member, .start the first field), but we VERIFY rather than trust the
-// layout: Heap::SetStackStart() writes that field to base::Stack::GetStackStart(),
-// so if poking a sentinel and re-calling SetStackStart restores the value at
-// offset 0, that word IS the field. Any mismatch returns 0 (override disabled —
-// V8 keeps its native start, i.e. the rare pre-fix crash, NEVER corruption).
-// Must run with the isolate ENTERED. `real_isolate` is the raw v8::Isolate*.
-fn discover_scan_start_field(real_isolate: *mut c_void) -> usize {
-    const SENTINEL: usize = 0xA5A5_A5A5_A5A5_A5A5;
-    unsafe {
-        let heap = v8__internal__Isolate__heap(real_isolate);
-        if heap.is_null() {
-            return 0;
-        }
-        let stack = v8__internal__Heap__stack(heap);
-        if stack.is_null() {
-            return 0;
-        }
-        let nt = v8__base__Stack__GetStackStart();
-        if nt == 0 {
-            return 0;
-        }
-        v8__internal__Heap__SetStackStart(heap); // start := nt
-        let field = stack as *mut usize; // expected &current_segment_.start
-        if field.read() != nt {
-            return 0; // offset 0 isn't the field (layout changed) — disable
-        }
-        field.write(SENTINEL);
-        v8__internal__Heap__SetStackStart(heap); // must rewrite the same word
-        if field.read() != nt {
-            return 0; // SetStackStart doesn't own offset 0 — disable
-        }
-        stack as usize
-    }
-}
-
-// The native thread's stack bounds are stable per NATIVE thread, but querying
-// them (pthread, which reads /proc/self/maps for the main thread on Linux) is
-// far too slow per op. Cache (bottom, top) in a native-thread-local — correct
-// under M:N (each native thread caches its own stack) and ~free after the first
-// op on a thread. (0, 0) if it can't be queried.
-thread_local! {
-    static STACK_BOUNDS: std::cell::Cell<(usize, usize)> =
-        const { std::cell::Cell::new((0, 0)) };
-}
-
-fn native_stack_bounds_cached() -> (usize, usize) {
-    STACK_BOUNDS.with(|c| {
-        let cached = c.get();
-        if cached.0 != 0 {
-            return cached;
-        }
-        let bounds = native_stack_bounds();
-        c.set(bounds);
-        bounds
-    })
-}
-
-// (bottom, top) of the CURRENT native thread's stack via pthread (uncached —
-// callers go through native_stack_bounds_cached). The stack grows DOWN from top
-// toward bottom. (0, 0) if it can't be queried. NB: this is the NATIVE thread's
-// pthread stack; a Ruby Fiber runs on a separate mmap'd stack invisible here.
-#[cfg(target_os = "linux")]
-fn native_stack_bounds() -> (usize, usize) {
-    unsafe {
-        let mut attr: libc::pthread_attr_t = std::mem::zeroed();
-        if libc::pthread_getattr_np(libc::pthread_self(), &mut attr) != 0 {
-            return (0, 0);
-        }
-        let mut addr: *mut c_void = null_mut();
-        let mut size: libc::size_t = 0;
-        let rc = libc::pthread_attr_getstack(&attr, &mut addr, &mut size);
-        libc::pthread_attr_destroy(&mut attr);
-        if rc != 0 {
-            return (0, 0);
-        }
-        (addr as usize, addr as usize + size)
-    }
-}
-
-#[cfg(target_os = "macos")]
-fn native_stack_bounds() -> (usize, usize) {
-    unsafe {
-        let top = libc::pthread_get_stackaddr_np(libc::pthread_self()) as usize;
-        let size = libc::pthread_get_stacksize_np(libc::pthread_self());
-        (top.saturating_sub(size), top)
-    }
-}
-
-#[cfg(not(any(target_os = "linux", target_os = "macos")))]
-fn native_stack_bounds() -> (usize, usize) {
-    (0, 0)
-}
-
-// Lower bound (and upper, for caching) of the memory region containing `addr`
-// — i.e. the BOTTOM of the stack `addr` is on. Used for a Ruby Fiber, whose
-// mmap'd stack pthread can't see: V8's limit must sit ABOVE this bottom or a
-// deep fiber recursion overflows the real stack and SEGVs the unmapped guard.
-// Cached per native thread keyed by the region (parsing /proc/self/maps is
-// slow): reused while successive ops stay on the same fiber. (0, 0) if unknown.
-thread_local! {
-    static FIBER_REGION: std::cell::Cell<(usize, usize)> = const { std::cell::Cell::new((0, 0)) };
-}
-
-fn current_region_bounds_cached(addr: usize) -> (usize, usize) {
-    FIBER_REGION.with(|c| {
-        let (lo, hi) = c.get();
-        if lo != 0 && addr >= lo && addr < hi {
-            return (lo, hi);
-        }
-        let bounds = query_region_bounds(addr);
-        if bounds.0 != 0 {
-            c.set(bounds);
-        }
-        bounds
-    })
-}
-
-// The [start, end) of the /proc/self/maps mapping containing `addr`. Linux only;
-// (0, 0) elsewhere (and the caller falls back). Reads the file fresh — slow, so
-// only called on a cache miss (a new fiber).
-#[cfg(target_os = "linux")]
-fn query_region_bounds(addr: usize) -> (usize, usize) {
-    use std::io::Read;
-    let mut buf = String::new();
-    if std::fs::File::open("/proc/self/maps")
-        .and_then(|mut f| f.read_to_string(&mut buf))
-        .is_err()
-    {
-        return (0, 0);
-    }
-    for line in buf.lines() {
-        // e.g. "7f6a...000-7f6a...000 rw-p 00000000 00:00 0 ..."
-        let Some((range, _)) = line.split_once(' ') else {
-            continue;
-        };
-        let Some((lo, hi)) = range.split_once('-') else {
-            continue;
-        };
-        if let (Ok(lo), Ok(hi)) = (
-            usize::from_str_radix(lo, 16),
-            usize::from_str_radix(hi, 16),
-        ) {
-            if addr >= lo && addr < hi {
-                return (lo, hi);
-            }
-        }
-    }
-    (0, 0)
-}
-
-#[cfg(not(target_os = "linux"))]
-fn query_region_bounds(_addr: usize) -> (usize, usize) {
-    (0, 0)
-}
-
-// Set from RUSTY_RACER_STACK_DEBUG at init; gates the per-op stack diagnostics.
-static STACK_DEBUG: AtomicBool = AtomicBool::new(false);
-
-// Re-point V8's stack limit at the CURRENT stack each op. In-thread V8 runs
-// wherever the Ruby code is: usually the native thread's pthread stack, but also
-// a Ruby Fiber's separate mmap'd stack (Capybara::Result is an Enumerator) that
-// pthread can't see. The limit MUST sit between the current SP and the real
-// bottom of whatever stack we're on:
-//   * Too high (above SP) and V8 declares a FALSE overflow on entry.
-//   * Too low (below the real bottom) and a deep recursion grows past the
-//     mapped stack and SEGVs the unmapped guard page below it.
-// So detect the stack by comparing the SP to the cached native bounds: on the
-// native stack, anchor to its pthread bottom; on a fiber, find the bottom of the
-// /proc/self/maps region holding the SP (the fiber's real bottom — anchoring to
-// SP minus a fixed guard punched through the bottom of Avo's small/deep Capybara
-// fibers and SEGV'd). Must be called with the isolate ENTERED. `real_isolate` is
-// the raw v8::Isolate* read out of iso_ptr.
-//
-// On a fiber it ALSO re-points V8's conservative-GC-scan stack_start (via
-// scan_start_field, discovered once per isolate) to `stack_top`: Enter just set
-// it to the native top, but the scanner walks [marker, stack_start), so a native
-// start runs the scan off the fiber's mapped stack into unmapped memory and
-// SEGVs (Avo's Capybara filter chain). scan_start_field is 0 when discovery
-// failed (override disabled).
-//
-// LIMITATION (worker-thread fibers): the GC and a thrown exception ALSO
-// `CHECK(IsOnCentralStack(SP))`, which tests the SP against
-// `base::Stack::GetStackStart()` — the pthread top, cached per native thread,
-// with no API to retarget — NOT the scan start we re-point above. A fiber mmap'd
-// ABOVE that top (the common case on a NON-main native thread, whose stack sits
-// below later fiber mmaps) fails the CHECK, so V8 aborts on the next GC or throw.
-// We can fix the scan (the SEGV) but not that CHECK. On the main thread the
-// process stack is the highest address, so every fiber is below it and both the
-// scan and the CHECK are safe — the Capybara/Avo case. See README.
-fn set_v8_stack_limit(real_isolate: *mut c_void, scan_start_field: usize, stack_top: usize) {
-    let sp_marker = 0u8;
-    let sp = &sp_marker as *const u8 as usize;
-    let (nbottom, ntop) = native_stack_bounds_cached();
-    let on_native = nbottom != 0 && sp > nbottom && sp <= ntop;
-    // Reserve below the limit for V8's own RangeError-throw frames.
-    const NATIVE_GUARD: usize = 128 * 1024;
-    // V8 throws when SP descends to the limit, then needs some real stack BELOW
-    // it to build the RangeError (and V8 itself allows growing a little past the
-    // limit — its overflow slack). On a fiber that reserve must NOT cross the
-    // fiber's real bottom (the mapping below it is an unmapped guard -> SEGV), so
-    // keep it comfortably above V8's slack.
-    const FIBER_RESERVE: usize = 64 * 1024;
-    let mut region = (0usize, 0usize);
-    let limit = if on_native {
-        nbottom + NATIVE_GUARD
-    } else {
-        // Anchor to the FIBER's real bottom (the /proc/self/maps region holding
-        // the SP), not the SP: SP - fixed_guard can punch through the bottom of a
-        // small/deep fiber stack and SEGV (Avo's deep Capybara filter chain).
-        // Reserve FIBER_RESERVE above the bottom for the throw, but keep the
-        // limit below the SP so we don't false-overflow; on a nearly-full fiber
-        // that clamps the headroom down (an early but CLEAN RangeError).
-        region = current_region_bounds_cached(sp);
-        if region.0 != 0 {
-            (region.0 + FIBER_RESERVE).min(sp.saturating_sub(8 * 1024))
-        } else {
-            sp.saturating_sub(64 * 1024) // region unknown (non-linux) — best effort
-        }
-    };
-    if limit == 0 {
-        return; // couldn't determine a sane limit — leave V8's default
-    }
-    unsafe { v8__Isolate__SetStackLimit(real_isolate, limit) };
-    // On a fiber, re-point V8's conservative-GC-scan stack_start to `stack_top`
-    // — a live address captured by the caller ABOVE every V8 frame of this op.
-    // Enter() set the start to the NATIVE top (a different region); the scanner
-    // walks [marker, start), so a native start runs it off the fiber's mapped
-    // top into unmapped memory and SEGVs. Anchoring to stack_top keeps the whole
-    // scan range between two real stack pointers (marker..stack_top), so it's
-    // guaranteed mapped, and every V8 root (all below stack_top) is still found.
-    // (We can't use the /proc/maps region top here: that mapping isn't reliably
-    // contiguous, so the scan could still hit a hole below it.)
-    if !on_native && stack_top != 0 && scan_start_field != 0 {
-        unsafe { (scan_start_field as *mut usize).write(stack_top) };
-    }
-    // Opt-in diagnostics (RUSTY_RACER_STACK_DEBUG): the SP vs the native stack
-    // [nbottom, ntop], the fiber region (if any), the per-op limit, and whether
-    // the SP is above the limit. A crash with sp_above_limit=false means the
-    // limit is wrong for the current stack.
-    if STACK_DEBUG.load(Ordering::Relaxed) {
-        eprintln!(
-            "[rusty stack] sp={sp:#x} nbottom={nbottom:#x} ntop={ntop:#x} \
-             region=[{:#x},{:#x}) limit={limit:#x} fiber={} sp_above_limit={} \
-             fiber_above_native={}",
-            region.0,
-            region.1,
-            !on_native,
-            sp > limit,
-            !on_native && nbottom != 0 && sp > ntop,
-        );
-    }
-}
-
-// Little-endian u64 limbs -> big-endian hex magnitude (no sign, no "0x"). The
-// shared currency between V8 BigInt words and Ruby Integer(str, 16).
-fn words_to_hex(words: &[u64]) -> String {
-    let mut hex = String::new();
-    for w in words.iter().rev() {
-        if hex.is_empty() {
-            hex.push_str(&format!("{w:x}")); // top limb: no leading zeros
-        } else {
-            hex.push_str(&format!("{w:016x}")); // lower limbs: full width
-        }
-    }
-    if hex.is_empty() {
-        hex.push('0');
-    }
-    hex
-}
-
-// Big-endian hex magnitude -> little-endian u64 limbs (inverse of words_to_hex).
-fn hex_to_words(hex: &str) -> Vec<u64> {
-    let mut words = Vec::new();
-    let mut end = hex.len();
-    while end > 0 {
-        let start = end.saturating_sub(16);
-        words.push(u64::from_str_radix(&hex[start..end], 16).unwrap_or(0));
-        end = start;
-    }
-    if words.is_empty() {
-        words.push(0);
-    }
-    words
-}
-
-// Tracks objects already emitted this marshal so a re-encounter becomes a
-// Ref instead of re-expansion. Buckets by V8 identity hash (which can collide),
-// disambiguated by Local equality — the same trick the module registry uses.
-#[derive(Default)]
-struct JsSeen {
-    next_id: u32,
-    map: HashMap<i32, Vec<(v8::Global<v8::Object>, u32)>>,
-}
-
-// Decide how to emit a container object: Ok(id) = first sighting, register it
-// and recurse; Err(jsval) = emit this directly and stop (a Ref to an already-
-// seen object, or a truncated Str at the depth backstop). Centralising this in
-// one place keeps the four container arms (array/object/map/set) in lockstep —
-// and crucially orders the checks so a depth-truncated object is NEVER assigned
-// an id (which would leave a sibling Ref dangling).
-fn js_container_id(
-    scope: &mut v8::PinScope<'_, '_>,
-    seen: &mut JsSeen,
-    value: v8::Local<v8::Value>,
-    obj: v8::Local<v8::Object>,
-    depth: u32,
-) -> Result<u32, JsVal> {
-    let hash = obj.get_identity_hash().get();
-    if let Some(bucket) = seen.map.get(&hash) {
-        for (g, id) in bucket {
-            if v8::Local::new(scope, g) == obj {
-                return Err(JsVal::Ref(*id));
-            }
-        }
-    }
-    // First sighting but too deep: truncate WITHOUT registering, so no later
-    // Ref can target a container that was never emitted.
-    if depth >= MAX_MARSHAL_DEPTH {
-        return Err(JsVal::Str(value.to_rust_string_lossy(scope)));
-    }
-    let id = seen.next_id;
-    seen.next_id += 1;
-    let g = v8::Global::new(scope, obj);
-    seen.map.entry(hash).or_default().push((g, id));
-    Ok(id)
-}
-
-// Copy |len| bytes from a V8 (Shared)ArrayBuffer backing pointer into an owned
-// Vec, with one allocation and no zero-fill (data is fully overwritten). |data|
-// is None only for a zero-length buffer, where the empty Vec is already right.
-fn copy_buffer_bytes(data: Option<std::ptr::NonNull<c_void>>, len: usize) -> Vec<u8> {
-    let mut buf = Vec::with_capacity(len);
-    if let Some(p) = data {
-        unsafe {
-            std::ptr::copy_nonoverlapping(p.as_ptr() as *const u8, buf.as_mut_ptr(), len);
-            buf.set_len(len);
-        }
-    }
-    buf
-}
-
-fn js_to_jsval(scope: &mut v8::PinScope<'_, '_>, value: v8::Local<v8::Value>) -> JsVal {
-    let mut seen = JsSeen::default();
-    js_to_jsval_d(scope, value, &mut seen, 0)
-}
-
-fn js_to_jsval_d(
-    scope: &mut v8::PinScope<'_, '_>,
-    value: v8::Local<v8::Value>,
-    seen: &mut JsSeen,
-    depth: u32,
-) -> JsVal {
-    if value.is_undefined() {
-        return JsVal::Undefined;
-    }
-    if value.is_null() {
-        return JsVal::Null;
-    }
-    if value.is_boolean() {
-        return JsVal::Bool(value.boolean_value(scope));
-    }
-    if value.is_int32() {
-        return JsVal::Int(value.integer_value(scope).unwrap_or(0));
-    }
-    if value.is_number() {
-        return JsVal::Num(value.number_value(scope).unwrap_or(f64::NAN));
-    }
-    if value.is_big_int() {
-        if let Ok(bi) = v8::Local::<v8::BigInt>::try_from(value) {
-            let mut words = vec![0u64; bi.word_count()];
-            let (negative, _) = bi.to_words_array(&mut words);
-            return JsVal::BigInt { negative, words };
-        }
-    }
-    // Date before the generic object branch (a Date *is* an object).
-    if value.is_date() {
-        if let Ok(date) = v8::Local::<v8::Date>::try_from(value) {
-            return JsVal::Date(date.value_of());
-        }
-    }
-    // Binary buffers before the generic object branch (they are objects too).
-    // A TypedArray/DataView copies its VIEWED window; a bare ArrayBuffer or
-    // SharedArrayBuffer copies the whole buffer. All become a Ruby binary
-    // String. (Without the SharedArrayBuffer arm a bare SAB would fall through
-    // to the plain-object branch and marshal as an empty Hash — silent loss.)
-    if value.is_array_buffer_view() {
-        if let Ok(view) = v8::Local::<v8::ArrayBufferView>::try_from(value) {
-            let obj = v8::Local::<v8::Object>::try_from(value).unwrap();
-            // depth 0: a buffer is a leaf (no recursion into children), so it
-            // never risks native-stack overflow and must stay faithful bytes
-            // even when deeply nested — only the identity (Ref) check applies,
-            // never the depth-truncation-to-lossy-string the generic path uses.
-            let id = match js_container_id(scope, seen, value, obj, 0) {
-                Ok(id) => id,
-                Err(jsval) => return jsval, // a Ref to the same buffer
-            };
-            let len = view.byte_length();
-            let mut buf: Vec<u8> = Vec::with_capacity(len);
-            // copy_contents_uninit writes into the UNINITIALIZED spare capacity
-            // (a &mut [MaybeUninit<u8>]) — never forming a &mut [u8] over uninit
-            // memory the way copy_contents would (that's UB). set_len to exactly
-            // what it wrote so a detached/short view never exposes uninit bytes.
-            let n = view.copy_contents_uninit(&mut buf.spare_capacity_mut()[..len]);
-            unsafe { buf.set_len(n) };
-            return JsVal::Bytes { id: Some(id), bytes: buf };
-        }
-    }
-    if value.is_array_buffer() {
-        if let Ok(ab) = v8::Local::<v8::ArrayBuffer>::try_from(value) {
-            let obj = v8::Local::<v8::Object>::try_from(value).unwrap();
-            // depth 0 — a buffer is a leaf; see the view arm above.
-            let id = match js_container_id(scope, seen, value, obj, 0) {
-                Ok(id) => id,
-                Err(jsval) => return jsval,
-            };
-            return JsVal::Bytes {
-                id: Some(id),
-                bytes: copy_buffer_bytes(ab.data(), ab.byte_length()),
-            };
-        }
-    }
-    if value.is_shared_array_buffer() {
-        if let Ok(sab) = v8::Local::<v8::SharedArrayBuffer>::try_from(value) {
-            let obj = v8::Local::<v8::Object>::try_from(value).unwrap();
-            // depth 0 — a buffer is a leaf; see the view arm above.
-            let id = match js_container_id(scope, seen, value, obj, 0) {
-                Ok(id) => id,
-                Err(jsval) => return jsval,
-            };
-            let store = sab.get_backing_store();
-            return JsVal::Bytes {
-                id: Some(id),
-                bytes: copy_buffer_bytes(store.data(), sab.byte_length()),
-            };
-        }
-    }
-    // Map/Set before the generic object branch (both are objects).
-    if value.is_map() {
-        let obj = v8::Local::<v8::Object>::try_from(value).unwrap();
-        let id = match js_container_id(scope, seen, value, obj, depth) {
-            Ok(id) => id,
-            Err(jsval) => return jsval,
-        };
-        let map = v8::Local::<v8::Map>::try_from(value).unwrap();
-        let arr = map.as_array(scope); // [k0, v0, k1, v1, ...]
-        let mut pairs = Vec::with_capacity((arr.length() / 2) as usize);
-        let mut i = 0;
-        while i + 1 < arr.length() {
-            let k = arr.get_index(scope, i).unwrap_or_else(|| v8::undefined(scope).into());
-            let v = arr.get_index(scope, i + 1).unwrap_or_else(|| v8::undefined(scope).into());
-            let kj = js_to_jsval_d(scope, k, seen, depth + 1);
-            let vj = js_to_jsval_d(scope, v, seen, depth + 1);
-            pairs.push((kj, vj));
-            i += 2;
-        }
-        return JsVal::Map { id, pairs };
-    }
-    if value.is_set() {
-        let obj = v8::Local::<v8::Object>::try_from(value).unwrap();
-        let id = match js_container_id(scope, seen, value, obj, depth) {
-            Ok(id) => id,
-            Err(jsval) => return jsval,
-        };
-        let set = v8::Local::<v8::Set>::try_from(value).unwrap();
-        let arr = set.as_array(scope);
-        let mut items = Vec::with_capacity(arr.length() as usize);
-        for i in 0..arr.length() {
-            let el = arr.get_index(scope, i).unwrap_or_else(|| v8::undefined(scope).into());
-            items.push(js_to_jsval_d(scope, el, seen, depth + 1));
-        }
-        return JsVal::Set { id, items };
-    }
-    if value.is_array() {
-        let obj = v8::Local::<v8::Object>::try_from(value).unwrap();
-        let id = match js_container_id(scope, seen, value, obj, depth) {
-            Ok(id) => id,
-            Err(jsval) => return jsval,
-        };
-        let arr = v8::Local::<v8::Array>::try_from(value).unwrap();
-        let mut items = Vec::with_capacity(arr.length() as usize);
-        for i in 0..arr.length() {
-            let el = arr
-                .get_index(scope, i)
-                .unwrap_or_else(|| v8::undefined(scope).into());
-            items.push(js_to_jsval_d(scope, el, seen, depth + 1));
-        }
-        return JsVal::Array { id, items };
-    }
-    // Plain object -> string-keyed Obj. Functions/Date/etc. fall through to
-    // their toString (the spike's primitive escape hatch).
-    if value.is_object() && !value.is_function() {
-        let obj = v8::Local::<v8::Object>::try_from(value).unwrap();
-        let id = match js_container_id(scope, seen, value, obj, depth) {
-            Ok(id) => id,
-            Err(jsval) => return jsval,
-        };
-        if let Some(names) = obj.get_own_property_names(scope, Default::default()) {
-            let mut entries = Vec::with_capacity(names.length() as usize);
-            for i in 0..names.length() {
-                let Some(key) = names.get_index(scope, i) else {
-                    continue;
-                };
-                let key_str = key.to_rust_string_lossy(scope);
-                let val = obj
-                    .get(scope, key)
-                    .unwrap_or_else(|| v8::undefined(scope).into());
-                entries.push((key_str, js_to_jsval_d(scope, val, seen, depth + 1)));
-            }
-            return JsVal::Obj { id, entries };
-        }
-    }
-    JsVal::Str(value.to_rust_string_lossy(scope))
-}
-
-// Owned-by-value (not &JsVal): a JsVal::Bytes hands its Vec straight to V8's
-// backing store with no copy of the payload, so a large binary blob crosses
-// Ruby->JS with zero extra allocation.
-fn jsval_to_js<'s>(scope: &mut v8::PinScope<'s, '_>, val: JsVal) -> v8::Local<'s, v8::Value> {
-    let mut built: HashMap<u32, v8::Local<'s, v8::Value>> = HashMap::new();
-    jsval_to_js_d(scope, val, &mut built)
-}
-
-fn jsval_to_js_d<'s>(
-    scope: &mut v8::PinScope<'s, '_>,
-    val: JsVal,
-    built: &mut HashMap<u32, v8::Local<'s, v8::Value>>,
-) -> v8::Local<'s, v8::Value> {
-    match val {
-        JsVal::Undefined => v8::undefined(scope).into(),
-        JsVal::Null => v8::null(scope).into(),
-        JsVal::Bool(b) => v8::Boolean::new(scope, b).into(),
-        JsVal::Int(i) => v8::Number::new(scope, i as f64).into(),
-        JsVal::Num(n) => v8::Number::new(scope, n).into(),
-        JsVal::Str(s) => v8::String::new(scope, &s)
-            .map(|s| s.into())
-            .unwrap_or_else(|| v8::undefined(scope).into()),
-        // Bytes -> Uint8Array, moving the Vec into V8's backing store (no copy
-        // of the payload). Registered under |id| so an aliased blob resolves to
-        // the same Uint8Array via Ref.
-        JsVal::Bytes { id, bytes } => {
-            let len = bytes.len();
-            let store = v8::ArrayBuffer::new_backing_store_from_vec(bytes).make_shared();
-            let ab = v8::ArrayBuffer::with_backing_store(scope, &store);
-            let arr: v8::Local<v8::Value> = v8::Uint8Array::new(scope, ab, 0, len)
-                .map(|a| a.into())
-                .unwrap_or_else(|| v8::undefined(scope).into());
-            if let Some(id) = id {
-                built.insert(id, arr);
-            }
-            arr
-        }
-        JsVal::BigInt { negative, words } => v8::BigInt::new_from_words(scope, negative, &words)
-            .map(|b| b.into())
-            .unwrap_or_else(|| v8::undefined(scope).into()),
-        JsVal::Date(ms) => v8::Date::new(scope, ms)
-            .map(|d| d.into())
-            .unwrap_or_else(|| v8::undefined(scope).into()),
-        // Register the container under its id BEFORE filling it, so a Ref from
-        // a descendant (a cycle back to here) resolves to this same object.
-        JsVal::Array { id, items } => {
-            let arr = v8::Array::new(scope, items.len() as i32);
-            built.insert(id, arr.into());
-            for (i, it) in items.into_iter().enumerate() {
-                let v = jsval_to_js_d(scope, it, built);
-                arr.set_index(scope, i as u32, v);
-            }
-            arr.into()
-        }
-        JsVal::Obj { id, entries } => {
-            let obj = v8::Object::new(scope);
-            built.insert(id, obj.into());
-            for (k, it) in entries {
-                let Some(key) = v8::String::new(scope, &k) else {
-                    continue;
-                };
-                let v = jsval_to_js_d(scope, it, built);
-                obj.set(scope, key.into(), v);
-            }
-            obj.into()
-        }
-        JsVal::Map { id, pairs } => {
-            let map = v8::Map::new(scope);
-            built.insert(id, map.into());
-            for (k, v) in pairs {
-                let kk = jsval_to_js_d(scope, k, built);
-                let vv = jsval_to_js_d(scope, v, built);
-                map.set(scope, kk, vv);
-            }
-            map.into()
-        }
-        JsVal::Set { id, items } => {
-            let set = v8::Set::new(scope);
-            built.insert(id, set.into());
-            for it in items {
-                let v = jsval_to_js_d(scope, it, built);
-                set.add(scope, v);
-            }
-            set.into()
-        }
-        JsVal::Ref(id) => built
-            .get(&id)
-            .copied()
-            .unwrap_or_else(|| v8::undefined(scope).into()),
-    }
-}
-
 // JS called a host function. We are on the owner thread with the GVL RELEASED
 // (the runner's without_gvl). Reacquire the GVL via with_gvl, run the Ruby proc
 // inline, and set the JS return — no channel, no other thread. A VM op the proc
@@ -1242,103 +467,6 @@ fn capture_js_error(
     VmError::JsError { message, backtrace }
 }
 
-fn run_source(scope: &mut v8::PinScope<'_, '_>, source: &str, filename: &str) -> Result<JsVal, VmError> {
-    v8::tc_scope!(let tc, scope);
-    // Compile and run as distinct phases so a compile failure maps to
-    // ParseError and a thrown exception to RuntimeError (csim rescues both).
-    let Some(code) = v8::String::new(tc, source) else {
-        return Err(VmError::Parse("source too large".into()));
-    };
-    let origin = script_origin(tc, filename);
-    let script = match v8::Script::compile(tc, code, Some(&origin)) {
-        Some(script) => script,
-        None if tc.has_terminated() => return Err(VmError::Terminated),
-        None => {
-            let msg = tc
-                .exception()
-                .map(|e| e.to_rust_string_lossy(tc))
-                .unwrap_or_else(|| "parse error".to_string());
-            // Append the location V8 recorded; always name the file, add the
-            // line when V8 reports one.
-            let message = tc.message();
-            let res = message
-                .and_then(|m| m.get_script_resource_name(tc))
-                .filter(|v| v.is_string())
-                .map(|v| v.to_rust_string_lossy(tc))
-                .unwrap_or_else(|| filename.to_string());
-            let loc = match message.and_then(|m| m.get_line_number(tc)) {
-                Some(line) => format!(" at {res}:{line}"),
-                None => format!(" at {res}"),
-            };
-            return Err(VmError::Parse(format!("{msg}{loc}")));
-        }
-    };
-    match script.run(tc) {
-        Some(value) => Ok(js_to_jsval(tc, value)),
-        None if tc.has_terminated() => Err(VmError::Terminated),
-        None => {
-            let exc = tc.exception();
-            let stack = tc.stack_trace();
-            Err(capture_js_error(tc, exc, stack))
-        }
-    }
-}
-
-// Resolve a dotted property path on globalThis to a function and invoke it via
-// v8::Function::call, with the property's holder as `this` (so `a.b.f` gets the
-// right receiver). Args/result marshal through the ref-preserving paths.
-fn call_function(
-    scope: &mut v8::PinScope<'_, '_>,
-    name: &str,
-    args: Vec<JsVal>,
-    void: bool,
-) -> Result<JsVal, VmError> {
-    v8::tc_scope!(let tc, scope);
-    let context = tc.get_current_context();
-    let global = context.global(tc);
-    let mut recv: v8::Local<v8::Value> = global.into();
-    let mut target: v8::Local<v8::Value> = global.into();
-    for part in name.split('.') {
-        let Some(obj) = target.to_object(tc) else {
-            // The holder of `part` (a preceding segment) was null/undefined, so
-            // there's nothing to read `part` from — name the holder, not `part`.
-            return Err(VmError::Runtime(format!(
-                "`{name}`: cannot read `{part}` (a preceding path segment is not an object)"
-            )));
-        };
-        let Some(key) = v8::String::new(tc, part) else {
-            return Err(VmError::Runtime("property name too large".into()));
-        };
-        let Some(next) = obj.get(tc, key.into()) else {
-            if tc.has_terminated() {
-                return Err(VmError::Terminated);
-            }
-            let msg = tc
-                .exception()
-                .map(|e| e.to_rust_string_lossy(tc))
-                .unwrap_or_else(|| format!("cannot read `{part}` of `{name}`"));
-            return Err(VmError::Runtime(msg));
-        };
-        recv = target;
-        target = next;
-    }
-    let Ok(func) = v8::Local::<v8::Function>::try_from(target) else {
-        return Err(VmError::Runtime(format!("`{name}` is not a function")));
-    };
-    let argv: Vec<v8::Local<v8::Value>> = args.into_iter().map(|a| jsval_to_js(tc, a)).collect();
-    match func.call(tc, recv, &argv) {
-        // void: skip marshalling the return so a huge/cyclic result is never walked.
-        Some(_) if void => Ok(JsVal::Undefined),
-        Some(value) => Ok(js_to_jsval(tc, value)),
-        None if tc.has_terminated() => Err(VmError::Terminated),
-        None => {
-            let exc = tc.exception();
-            let stack = tc.stack_trace();
-            Err(capture_js_error(tc, exc, stack))
-        }
-    }
-}
-
 // ---------------------------------------------------------------------------
 // ES modules: V8's raw compile/instantiate/evaluate steps, with the embedder
 // owning the url->Module registry (MODULES) and the resolve policy.
@@ -1350,30 +478,6 @@ fn module_origin<'s>(scope: &v8::PinScope<'s, '_>, url: &str) -> v8::ScriptOrigi
     )
 }
 
-// The (Source, CompileOptions) pair shared by the module and script compile
-// handlers: consume a supplied bytecode cache (skip reparse), else eager-compile
-// every function up front, else compile lazily (V8's default — only the top
-// level). A supplied cache wins over `eager`: V8's CompileOptionsIsValid forbids
-// ConsumeCodeCache + EagerCompile together, so `eager` is ignored on the consume
-// path. (Source is an owned struct — V8 copies the origin in — so returning it
-// across this fn boundary keeps the same handle-lifetime contract as inlining.)
-fn compile_source<'s>(
-    code: v8::Local<'s, v8::String>,
-    origin: &v8::ScriptOrigin<'s>,
-    cached_data: &Option<Vec<u8>>,
-    eager: bool,
-) -> (v8::script_compiler::Source, v8::script_compiler::CompileOptions) {
-    use v8::script_compiler::{CompileOptions, Source};
-    match cached_data {
-        Some(bytes) => (
-            Source::new_with_cached_data(code, Some(origin), v8::script_compiler::CachedData::new(bytes)),
-            CompileOptions::ConsumeCodeCache,
-        ),
-        None if eager => (Source::new(code, Some(origin)), CompileOptions::EagerCompile),
-        None => (Source::new(code, Some(origin)), CompileOptions::NoCompileOptions),
-    }
-}
-
 // Registry for the thin compile_module/instantiate API: each compiled module is
 // addressed by an id, with its url kept for the resolve round-trip and a
 // hash bucket to map a referrer Local<Module> back to its id.
@@ -1463,6 +567,12 @@ struct IsolateState {
     instantiate_resolve: Option<RootedProc>,
     instantiate_resolve_err: Option<BoxValue<Exception>>,
     watchdog: Arc<WatchdogShared>,
+    // Set by near_heap_limit_cb when the configured memory_limit is hit: it
+    // terminates the running JS, and Core::run reads this after the op to relabel
+    // the terminate as OutOfMemory and recover the heap (GC + reset the ceiling).
+    // Plain bool (no atomic): the callback fires synchronously on the owner thread,
+    // never concurrently with the bracket that reads it.
+    oom_fired: bool,
 }
 
 impl IsolateState {
@@ -1483,15 +593,8 @@ impl IsolateState {
             core_ptr: std::ptr::null(),
             instantiate_resolve: None,
             instantiate_resolve_err: None,
-            watchdog: Arc::new(WatchdogShared {
-                inner: Mutex::new(WatchdogInner {
-                    frames: Vec::new(),
-                    next_generation: 0,
-                    fired_generation: None,
-                    shutdown: false,
-                }),
-                cv: Condvar::new(),
-            }),
+            watchdog: WatchdogShared::new(),
+            oom_fired: false,
         }
     }
 }
@@ -1557,32 +660,6 @@ fn auto_drain(scope: &mut v8::PinScope<'_, '_>, outermost: bool) {
     }
 }
 
-// The shared bracket every JS-running request (Eval/Call/Attach/RunScript/
-// EvaluateModule) needs: arm the watchdog, run |body|, then on a watchdog
-// timeout flag the leftover terminate for the outermost sweep and — only if
-// |body| actually ran JS (the bool it returns) — override its outcome to
-// Terminated. |body| owns its ContextScope, JS call, and auto_drain, and
-// returns (ran_js, outcome); the realm-disposed/unknown paths return
-// (false, Err(..)) so a raced watchdog can't poison an error for work that ran
-// no JS. Collapsing the five arms onto this keeps the terminate discipline in
-// ONE place.
-fn run_js_bracketed(
-    scope: &mut v8::PinScope<'_, '_, ()>,
-    outermost: bool,
-    timeout_ms: u64,
-    body: impl FnOnce(&mut v8::PinScope<'_, '_, ()>, bool) -> (bool, Result<JsVal, VmError>),
-) -> Result<JsVal, VmError> {
-    let watchdog = arm_watchdog(scope, timeout_ms);
-    let (ran_js, mut outcome) = body(scope, outermost);
-    if disarm_watchdog(scope, watchdog) {
-        istate!(scope).watchdog_fired = true;
-        if ran_js {
-            outcome = Err(VmError::Terminated);
-        }
-    }
-    outcome
-}
-
 // Drop every module AND script compiled in `context_id` (its v8::Context is
 // going away — on reset or dispose — so those handles are now dead).
 fn drop_context_artifacts(state: &mut IsolateState, context_id: i32) {
@@ -1920,853 +997,6 @@ fn finish_dynamic_import(
     }
 }
 
-// The watchdog runs on ONE persistent thread per isolate rather than a fresh
-// std::thread per request: spawning + joining a thread on every op cost ~16µs
-// (5.5x) when a timeout was set, dwarfing the actual work. The thread sleeps on
-// a condvar until a deadline is armed, terminates execution once the deadline
-// passes, then goes back to sleep.
-struct WatchdogShared {
-    inner: Mutex<WatchdogInner>,
-    cv: Condvar,
-}
-
-// One armed request's deadline. `run_js_bracketed` is RE-ENTRANT — a host fn
-// called from JS can issue a nested op that arms again while the outer op is
-// still running — so the armed deadlines form a LIFO stack, not a single slot.
-// (The old per-op design gave each op its own watchdog thread; collapsing onto
-// one thread must not let a nested arm/disarm clobber the outer op's deadline,
-// or the outer op would run unbounded after the nested call returns.)
-#[derive(Clone, Copy)]
-struct WatchdogFrame {
-    generation: u64,
-    deadline: Instant,
-}
-
-struct WatchdogInner {
-    // Every currently-armed op (with timeout_ms > 0), pushed on arm and removed
-    // on disarm. The loop honours the EARLIEST deadline across all frames: the
-    // most urgent timeout fires first, and since TerminateExecution is
-    // isolate-global it tears down whatever is running (escalating outward).
-    frames: Vec<WatchdogFrame>,
-    // Monotonic; each arm takes the next value as its frame's id.
-    next_generation: u64,
-    // The generation whose deadline the loop terminated on — consumed (and
-    // cleared) by that op's disarm so it can map its outcome to Terminated.
-    fired_generation: Option<u64>,
-    // Set at isolate teardown to break the loop.
-    shutdown: bool,
-}
-
-// The persistent watchdog loop. Runs off a Send IsolateHandle so it never
-// borrows the isolate the V8 thread owns.
-fn watchdog_loop(shared: Arc<WatchdogShared>, handle: v8::IsolateHandle) {
-    let mut inner = shared.inner.lock().unwrap();
-    loop {
-        if inner.shutdown {
-            return;
-        }
-        // The earliest deadline among all armed frames is the one to enforce.
-        match inner.frames.iter().min_by_key(|f| f.deadline).copied() {
-            // Idle: sleep until a frame is armed (or shutdown).
-            None => inner = shared.cv.wait(inner).unwrap(),
-            Some(frame) => {
-                let now = Instant::now();
-                if now >= frame.deadline {
-                    handle.terminate_execution();
-                    inner.fired_generation = Some(frame.generation);
-                    // Drop the fired frame so the loop moves on to the next
-                    // deadline instead of re-firing this one every wakeup.
-                    inner.frames.retain(|f| f.generation != frame.generation);
-                } else {
-                    let (next, _) = shared.cv.wait_timeout(inner, frame.deadline - now).unwrap();
-                    inner = next;
-                }
-            }
-        }
-    }
-}
-
-// (The watchdog Arc now lives in IsolateState; arm/disarm reach it via istate!.)
-
-// Arm the watchdog for this request: push a frame with its own deadline and
-// wake the loop. Returns the generation token to hand to `disarm_watchdog`
-// (None when timeout_ms is 0 — no watchdog for this request).
-fn arm_watchdog(scope: &mut v8::PinScope<'_, '_, ()>, timeout_ms: u64) -> Option<u64> {
-    if timeout_ms == 0 {
-        return None;
-    }
-    let shared = &istate!(scope).watchdog;
-    let mut inner = shared.inner.lock().unwrap();
-    inner.next_generation += 1;
-    let generation = inner.next_generation;
-    inner.frames.push(WatchdogFrame {
-        generation,
-        deadline: Instant::now() + Duration::from_millis(timeout_ms),
-    });
-    shared.cv.notify_one();
-    Some(generation)
-}
-
-// Disarm: drop THIS request's frame (leaving any outer frame still armed) and
-// report whether its deadline fired. On fire the caller maps the outcome to
-// Terminated and the outermost frame sweeps the leftover terminate via
-// WATCHDOG_FIRED; removing only this frame keeps a late terminate from
-// poisoning the next request without clobbering a still-running outer op.
-fn disarm_watchdog(scope: &mut v8::PinScope<'_, '_, ()>, generation: Option<u64>) -> bool {
-    let Some(generation) = generation else {
-        return false;
-    };
-    let shared = &istate!(scope).watchdog;
-    let mut inner = shared.inner.lock().unwrap();
-    inner.frames.retain(|f| f.generation != generation);
-    let fired = inner.fired_generation == Some(generation);
-    if fired {
-        inner.fired_generation = None;
-    }
-    shared.cv.notify_one();
-    fired
-}
-
-// Service ONE request inline on the owner thread and RETURN its terminal reply.
-// This is the single dispatcher for BOTH a top-level op and a re-entrant one (a
-// host proc / module resolver that issues another op), so EVERY op — not just
-// eval/call — works re-entrantly. `outermost` (depth == 0, computed by Core::run
-// before it bumped the depth) owns the terminate-flag cleanup; a nested op
-// passes false.
-fn service_request(scope: &mut v8::PinScope<'_, '_, ()>, request: Request, outermost: bool) -> VmReply {
-    // Clear any terminate left over from BEFORE this request. An
-    // Isolate#terminate fired while no JS was running arms the isolate-global
-    // flag but no watchdog_fired, so the end-of-request sweep would miss it and
-    // the next eval would abort spuriously — and an idle terminate isn't even
-    // observable via is_execution_terminating() yet, so cancel unconditionally.
-    // Only at the outermost frame: a terminate aimed at a SUSPENDED outer frame
-    // must survive a nested request.
-    if outermost {
-        scope.cancel_terminate_execution();
-    }
-    // Mark the realm this request runs in active while it is on the stack, so
-    // Reset/DisposeContext can refuse to pull a live realm out from under a
-    // suspended frame.
-    let realm = request_realm(istate!(scope), &request);
-    if let Some(id) = realm {
-        istate!(scope).active_realms.push(id);
-    }
-    let reply = dispatch_one(scope, request, outermost);
-    if realm.is_some() {
-        istate!(scope).active_realms.pop();
-    }
-    // Sweep a leftover terminate flag once the whole request stack has
-    // unwound (see watchdog_fired for why nested frames must not cancel).
-    if outermost && istate!(scope).watchdog_fired {
-        istate!(scope).watchdog_fired = false;
-        scope.cancel_terminate_execution();
-    }
-    reply
-}
-
-// The realm a request will run in (None for realm-independent ops); feeds
-// ACTIVE_REALMS above.
-fn request_realm(state: &IsolateState, request: &Request) -> Option<i32> {
-    match request {
-        Request::Eval { context_id, .. }
-        | Request::Call { context_id, .. }
-        | Request::Attach { context_id, .. }
-        | Request::AttachMany { context_id, .. }
-        | Request::CompileModule { context_id, .. }
-        | Request::CompileScript { context_id, .. } => Some(*context_id),
-        Request::DrainMicrotasks { .. } => Some(0),
-        Request::InstantiateModule { module_id, .. }
-        | Request::EvaluateModule { module_id, .. }
-        | Request::ModuleNamespace { module_id, .. } => {
-            module_handle(state, *module_id).map(|(_, cid)| cid)
-        }
-        Request::RunScript { script_id, .. } => script_handle(state, *script_id).map(|(_, cid)| cid),
-        Request::Reset { .. }
-        | Request::CreateContext
-        | Request::DisposeContext { .. }
-        | Request::ModuleStatus { .. }
-        | Request::DisposeModule { .. }
-        | Request::DisposeScript { .. }
-        | Request::ScriptCodeCache { .. }
-        | Request::ModuleCodeCache { .. } => None,
-    }
-}
-
-fn dispatch_one(scope: &mut v8::PinScope<'_, '_, ()>, request: Request, outermost: bool) -> VmReply {
-    // A request-scoped handle scope, so handles created while servicing a
-    // nested request don't pile up in the suspended callback's scope.
-    v8::scope!(let scope, &mut *scope);
-    {
-        match request {
-            Request::Eval {
-                context_id,
-                source,
-                filename,
-                timeout_ms,
-            } => {
-                let outcome = run_js_bracketed(scope, outermost, timeout_ms, |scope, outermost| {
-                    let realm = context_for(istate!(scope), context_id);
-                    match realm {
-                        Some(ctx) => {
-                            let context = v8::Local::new(scope, &ctx);
-                            let scope = &mut v8::ContextScope::new(scope, context);
-                            let out = run_source(scope, &source, &filename);
-                            auto_drain(scope, outermost);
-                            (true, out)
-                        }
-                        None => (false, Err(VmError::Runtime("realm disposed or unknown".into()))),
-                    }
-                });
-                VmReply::Done(outcome)
-            }
-            Request::Call {
-                context_id,
-                name,
-                args,
-                void,
-                timeout_ms,
-            } => {
-                // A host fn invoked by the called function runs inline
-                // (host_fn_callback, with_gvl) — no routing setup needed.
-                let outcome = run_js_bracketed(scope, outermost, timeout_ms, |scope, outermost| {
-                    let realm = context_for(istate!(scope), context_id);
-                    match realm {
-                        Some(ctx) => {
-                            let context = v8::Local::new(scope, &ctx);
-                            let scope = &mut v8::ContextScope::new(scope, context);
-                            let out = call_function(scope, &name, args, void);
-                            auto_drain(scope, outermost);
-                            (true, out)
-                        }
-                        None => (false, Err(VmError::Runtime("realm disposed or unknown".into()))),
-                    }
-                });
-                VmReply::Done(outcome)
-            }
-            Request::DrainMicrotasks { timeout_ms } => {
-                // A microtask may call an attached host fn (a Promise .then ->
-                // ruby), which runs inline via host_fn_callback — no routing
-                // setup needed any more.
-                let watchdog = arm_watchdog(scope, timeout_ms);
-                let main = context_for(istate!(scope), 0);
-                if let Some(ctx) = main {
-                    let context = v8::Local::new(scope, &ctx);
-                    let scope = &mut v8::ContextScope::new(scope, context);
-                    checkpoint_draining(scope);
-                }
-                let fired = disarm_watchdog(scope, watchdog);
-                if fired {
-                    istate!(scope).watchdog_fired = true;
-                }
-                let outcome = if fired {
-                    Err(VmError::Terminated)
-                } else {
-                    Ok(JsVal::Undefined)
-                };
-                VmReply::Done(outcome)
-            }
-            Request::Attach {
-                context_id,
-                name,
-                host_fn_id,
-                timeout_ms,
-            } => {
-                // attach_at_path writes onto globalThis (and walks a dotted
-                // path), which can fire a user-defined accessor or Proxy trap —
-                // arbitrary JS. So it goes through the same bracket as Eval: a
-                // host fn the trap calls routes back, and a looping trap is
-                // time-capped.
-                let outcome = run_js_bracketed(scope, outermost, timeout_ms, |scope, outermost| {
-                    let realm = context_for(istate!(scope), context_id);
-                    match realm {
-                        Some(ctx) => {
-                            let context = v8::Local::new(scope, &ctx);
-                            let scope = &mut v8::ContextScope::new(scope, context);
-                            let external = v8::External::new(scope, host_fn_id as *mut c_void);
-                            let out = match v8::Function::builder(host_fn_callback)
-                                .data(external.into())
-                                .build(scope)
-                            {
-                                // A dotted name (e.g. "MiniRacer.foo") attaches
-                                // under a namespace object, creating missing
-                                // intermediates, so host fns needn't pollute the
-                                // bare global.
-                                Some(function) => attach_at_path(scope, context, &name, function),
-                                None => Err(VmError::Runtime("failed to build function".into())),
-                            };
-                            auto_drain(scope, outermost);
-                            (true, out)
-                        }
-                        None => (false, Err(VmError::Runtime("realm disposed or unknown".into()))),
-                    }
-                });
-                VmReply::Done(outcome)
-            }
-            Request::AttachMany {
-                context_id,
-                entries,
-                timeout_ms,
-            } => {
-                // Same as Attach (arbitrary JS via accessors/Proxy traps), but
-                // installs every entry under one bracket/drain. Applied in order;
-                // stops at the first failure and reports its (name-tagged) error.
-                // NOT transactional: entries before the failure stay attached —
-                // the realm is not rolled back (matches single Attach, which also
-                // commits its one write or fails it).
-                let outcome = run_js_bracketed(scope, outermost, timeout_ms, |scope, outermost| {
-                    let realm = context_for(istate!(scope), context_id);
-                    match realm {
-                        Some(ctx) => {
-                            let context = v8::Local::new(scope, &ctx);
-                            let scope = &mut v8::ContextScope::new(scope, context);
-                            let mut out = Ok(JsVal::Undefined);
-                            for (name, host_fn_id) in &entries {
-                                let external = v8::External::new(scope, *host_fn_id as *mut c_void);
-                                out = match v8::Function::builder(host_fn_callback)
-                                    .data(external.into())
-                                    .build(scope)
-                                {
-                                    Some(function) => attach_at_path(scope, context, name, function),
-                                    None => Err(VmError::Runtime(format!(
-                                        "failed to build function for `{name}`"
-                                    ))),
-                                };
-                                if out.is_err() {
-                                    break;
-                                }
-                            }
-                            auto_drain(scope, outermost);
-                            (true, out)
-                        }
-                        None => (false, Err(VmError::Runtime("realm disposed or unknown".into()))),
-                    }
-                });
-                VmReply::Done(outcome)
-            }
-            Request::Reset { context_id } => {
-                let known =
-                    context_id == 0 || istate!(scope).realms.contexts.contains_key(&context_id);
-                if istate!(scope).draining {
-                    // A microtask from ANY realm may be mid-flight on the stack;
-                    // swapping a v8::Context out from under it corrupts state.
-                    VmReply::Done(Err(VmError::Runtime(
-                        "cannot reset a realm during a microtask checkpoint".into(),
-                    )))
-                } else if !known {
-                    VmReply::Done(Err(VmError::Runtime(
-                        "context disposed or unknown".into(),
-                    )))
-                } else if istate!(scope).active_realms.contains(&context_id) {
-                    // Swapping the v8::Context behind a suspended frame would
-                    // drop its in-flight modules/scripts and let the realm id
-                    // refer to a different context than the one on the stack
-                    // (defeating the cross-context import guards).
-                    VmReply::Done(Err(VmError::Runtime(
-                        "cannot reset a realm while a request for it is suspended on the V8 stack"
-                            .into(),
-                    )))
-                } else {
-                    let fresh = new_realm(scope, context_id);
-                    {
-                        let realms = &mut istate!(scope).realms;
-                        if context_id == 0 {
-                            realms.main_context = Some(fresh);
-                        } else {
-                            realms.contexts.insert(context_id, fresh);
-                        }
-                    }
-                    // Drop modules bound to this context — their realm just changed.
-                    drop_context_artifacts(istate!(scope), context_id);
-                    VmReply::Done(Ok(JsVal::Undefined))
-                }
-            }
-            Request::CreateContext => {
-                let id = {
-                    let realms = &mut istate!(scope).realms;
-                    let id = realms.next_context_id;
-                    realms.next_context_id += 1;
-                    id
-                };
-                let fresh = new_realm(scope, id);
-                istate!(scope).realms.contexts.insert(id, fresh);
-                VmReply::Done(Ok(JsVal::Int(id as i64)))
-            }
-            Request::DisposeContext { context_id } => {
-                if istate!(scope).draining {
-                    // Same hazard as Reset: a microtask from any realm may be live.
-                    VmReply::Done(Err(VmError::Runtime(
-                        "cannot dispose a realm during a microtask checkpoint".into(),
-                    )))
-                } else if istate!(scope).active_realms.contains(&context_id) {
-                    // Same hazard as Reset: a suspended frame still runs in it.
-                    VmReply::Done(Err(VmError::Runtime(
-                        "cannot dispose a realm while a request for it is suspended on the V8 stack"
-                            .into(),
-                    )))
-                } else {
-                    // Dropping the Global lets V8 collect the context. id 0 is the
-                    // default context and never disposed independently.
-                    istate!(scope).realms.contexts.remove(&context_id);
-                    // Reclaim the modules compiled in it (else they leak until
-                    // isolate teardown).
-                    drop_context_artifacts(istate!(scope), context_id);
-                    VmReply::Done(Ok(JsVal::Undefined))
-                }
-            }
-            Request::CompileModule {
-                context_id,
-                source,
-                filename,
-                cached_data,
-                produce_cache,
-                eager,
-            } => {
-                let ctx = context_for(istate!(scope), context_id);
-                let outcome = match ctx {
-                    None => Err(VmError::Runtime("context disposed or unknown".into())),
-                    Some(cx) => {
-                    let context = v8::Local::new(scope, &cx);
-                    let scope = &mut v8::ContextScope::new(scope, context);
-                    v8::tc_scope!(let tc, scope);
-                    match v8::String::new(tc, &source) {
-                        None => Err(VmError::Runtime("module source too large".into())),
-                        Some(code) => {
-                            let origin = module_origin(tc, &filename);
-                            // Consume a supplied bytecode cache (skip reparse),
-                            // eager-compile every function, or compile fresh
-                            // (lazy). cached_data wins: V8 forbids combining
-                            // ConsumeCodeCache with EagerCompile.
-                            let (mut src, opts) = compile_source(code, &origin, &cached_data, eager);
-                            let compiled = v8::script_compiler::compile_module2(
-                                tc,
-                                &mut src,
-                                opts,
-                                v8::script_compiler::NoCacheReason::NoReason,
-                            );
-                            match compiled {
-                                Some(module) => {
-                                    // V8 marks a stale/incompatible supplied cache
-                                    // rejected; the embedder recompiles & re-caches.
-                                    let cache_rejected = cached_data.is_some()
-                                        && src.get_cached_data().is_some_and(|c| c.rejected());
-                                    // Produce a fresh cache from the unbound script.
-                                    let produced = if produce_cache {
-                                        module
-                                            .get_unbound_module_script(tc)
-                                            .create_code_cache()
-                                            .map(|c| c.to_vec())
-                                    } else {
-                                        None
-                                    };
-                                    let hash = module.get_identity_hash().get();
-                                    let g = v8::Global::new(tc, module);
-                                    let id = {
-                                        let m = &mut istate!(tc).modules;
-                                        let id = m.next_id;
-                                        m.next_id += 1;
-                                        m.by_id
-                                            .insert(id, (g.clone(), filename.clone(), context_id));
-                                        m.by_hash.entry(hash).or_default().push((g, id));
-                                        id
-                                    };
-                                    Ok(Compiled {
-                                        id,
-                                        cached_data: produced,
-                                        cache_rejected,
-                                    })
-                                }
-                                None if tc.has_terminated() => Err(VmError::Terminated),
-                                // A module compile failure is a parse error
-                                // (compile-time), not a thrown exception.
-                                None => {
-                                    let msg = tc
-                                        .exception()
-                                        .map(|e| e.to_rust_string_lossy(tc))
-                                        .unwrap_or_else(|| "module parse error".to_string());
-                                    let message = tc.message();
-                                    let res = message
-                                        .and_then(|m| m.get_script_resource_name(tc))
-                                        .filter(|v| v.is_string())
-                                        .map(|v| v.to_rust_string_lossy(tc))
-                                        .unwrap_or_else(|| filename.clone());
-                                    let loc = match message.and_then(|m| m.get_line_number(tc)) {
-                                        Some(line) => format!(" at {res}:{line}"),
-                                        None => format!(" at {res}"),
-                                    };
-                                    Err(VmError::Parse(format!("{msg}{loc}")))
-                                }
-                            }
-                        }
-                    }
-                    }
-                };
-                VmReply::ModuleCompiled(outcome)
-            }
-            Request::InstantiateModule { module_id } => {
-                // V8's module instantiation is NOT re-entrant: a nested
-                // instantiate issued from a resolve block walks the outer,
-                // half-built module graph and SEGVs the process. Refuse it
-                // cleanly — a resolve block may COMPILE dependencies lazily
-                // and return them; the outer instantiate links them.
-                if istate!(scope).instantiating {
-                    VmReply::Done(Err(VmError::Runtime(
-                        "instantiate is not re-entrant: another module is currently \
-                         instantiating (compile the dependency and return it; the outer \
-                         instantiate links it)"
-                            .into(),
-                    )))
-                } else {
-                    istate!(scope).instantiating = true;
-                    let handle = module_handle(istate!(scope), module_id);
-                    let outcome = match handle {
-                        None => Err(VmError::Runtime("unknown module".into())),
-                        Some((g, cid)) => match context_for(istate!(scope), cid) {
-                            None => Err(VmError::Runtime("module's context is gone".into())),
-                            Some(cx) => {
-                                let context = v8::Local::new(scope, &cx);
-                                let scope = &mut v8::ContextScope::new(scope, context);
-                                let module = v8::Local::new(scope, &g);
-                                match module.get_status() {
-                                    // Already linked (or further along): a no-op,
-                                    // not an error — instantiate is idempotent.
-                                    v8::ModuleStatus::Instantiated
-                                    | v8::ModuleStatus::Evaluating
-                                    | v8::ModuleStatus::Evaluated => Ok(JsVal::Undefined),
-                                    // V8 CHECK-aborts on instantiating an errored
-                                    // module; surface its exception instead.
-                                    v8::ModuleStatus::Errored => Err(VmError::JsError {
-                                        message: module
-                                            .get_exception()
-                                            .to_rust_string_lossy(scope),
-                                        backtrace: vec![],
-                                    }),
-                                    _ => {
-                                        v8::tc_scope!(let tc, scope);
-                                        match module.instantiate_module(tc, resolve_imported) {
-                                            Some(true) => Ok(JsVal::Undefined),
-                                            _ if tc.has_terminated() => Err(VmError::Terminated),
-                                            // A resolver that RAISED is re-raised with its
-                                            // real class by instantiate_module (via the
-                                            // stashed exception); this generic link error
-                                            // is only used when no resolver exception was
-                                            // stashed.
-                                            _ => {
-                                                let exc = tc.exception();
-                                                let stack = tc.stack_trace();
-                                                Err(capture_js_error(tc, exc, stack))
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    };
-                    istate!(scope).instantiating = false;
-                    VmReply::Done(outcome)
-                }
-            }
-            Request::EvaluateModule { module_id, timeout_ms } => {
-                // Top-level module code (and, under :auto, the microtasks its
-                // TLA continuation drains) can loop, so it runs in the same
-                // watchdog bracket as Eval/Call/RunScript.
-                let outcome = run_js_bracketed(scope, outermost, timeout_ms, |scope, outermost| {
-                let handle = module_handle(istate!(scope), module_id);
-                match handle {
-                    None => (false, Err(VmError::Runtime("unknown module".into()))),
-                    Some((g, cid)) => match context_for(istate!(scope), cid) {
-                        None => (false, Err(VmError::Runtime("module's context is gone".into()))),
-                        Some(cx) => {
-                            let context = v8::Local::new(scope, &cx);
-                            let scope = &mut v8::ContextScope::new(scope, context);
-                            let module = v8::Local::new(scope, &g);
-                            // A top-level-await module's evaluate() returns a
-                            // PENDING promise that only settles once the drain
-                            // runs its continuation — remember it so we can read
-                            // its post-drain state instead of reporting a stale Ok.
-                            let mut eval_promise: Option<v8::Global<v8::Promise>> = None;
-                            // ran_js is true ONLY for the Instantiated arm that
-                            // actually calls evaluate(); the Errored/Evaluated/
-                            // non-instantiated arms run no JS, so a raced watchdog
-                            // must not override their real outcome to Terminated.
-                            let mut did_eval = false;
-                            // V8 CHECK-aborts the process if evaluate runs on a
-                            // module that isn't exactly Instantiated, so guard
-                            // status explicitly rather than crash.
-                            let out = match module.get_status() {
-                                v8::ModuleStatus::Errored => {
-                                    Err(VmError::JsError {
-                                        message: module
-                                            .get_exception()
-                                            .to_rust_string_lossy(scope),
-                                        backtrace: vec![],
-                                    })
-                                }
-                                v8::ModuleStatus::Evaluated => Ok(JsVal::Undefined),
-                                v8::ModuleStatus::Instantiated => {
-                                    did_eval = true;
-                                    v8::tc_scope!(let tc, scope);
-                                    match module.evaluate(tc) {
-                                        // A synchronous top-level throw yields a
-                                        // *rejected* promise (not None); a pending
-                                        // (TLA) or fulfilled one is remembered and
-                                        // re-checked after the drain.
-                                        Some(value) => match v8::Local::<v8::Promise>::try_from(value) {
-                                            Ok(p) if p.state() == v8::PromiseState::Rejected => {
-                                                let reason = p.result(tc);
-                                                Err(VmError::JsError {
-                                                    message: reason.to_rust_string_lossy(tc),
-                                                    backtrace: vec![],
-                                                })
-                                            }
-                                            Ok(p) => {
-                                                eval_promise = Some(v8::Global::new(tc, p));
-                                                Ok(JsVal::Undefined)
-                                            }
-                                            _ => Ok(JsVal::Undefined),
-                                        },
-                                        None if tc.has_terminated() => Err(VmError::Terminated),
-                                        None => {
-                                            let exc = tc.exception();
-                                            let stack = tc.stack_trace();
-                                            Err(capture_js_error(tc, exc, stack))
-                                        }
-                                    }
-                                }
-                                _ => Err(VmError::Runtime(
-                                    "module must be instantiated before evaluate".into(),
-                                )),
-                            };
-                            auto_drain(scope, outermost);
-                            // The drain may have settled a TLA module's promise to
-                            // rejected — surface that instead of the provisional Ok.
-                            let result = if let (true, Some(g)) = (out.is_ok(), eval_promise) {
-                                let p = v8::Local::new(scope, &g);
-                                if p.state() == v8::PromiseState::Rejected {
-                                    let reason = p.result(scope);
-                                    Err(VmError::JsError {
-                                        message: reason.to_rust_string_lossy(scope),
-                                        backtrace: vec![],
-                                    })
-                                } else {
-                                    out
-                                }
-                            } else {
-                                out
-                            };
-                            (did_eval, result)
-                        }
-                    }
-                }
-                });
-                VmReply::Done(outcome)
-            }
-            Request::ModuleNamespace { module_id } => {
-                let handle = module_handle(istate!(scope), module_id);
-                let outcome = match handle {
-                    None => Err(VmError::Runtime("unknown module".into())),
-                    Some((g, cid)) => match context_for(istate!(scope), cid) {
-                        None => Err(VmError::Runtime("module's context is gone".into())),
-                        Some(cx) => {
-                            let context = v8::Local::new(scope, &cx);
-                            let scope = &mut v8::ContextScope::new(scope, context);
-                            let module = v8::Local::new(scope, &g);
-                            // get_module_namespace CHECK-aborts unless the module
-                            // is at least Instantiated.
-                            match module.get_status() {
-                                v8::ModuleStatus::Uninstantiated
-                                | v8::ModuleStatus::Instantiating => Err(VmError::Runtime(
-                                    "module must be instantiated before namespace".into(),
-                                )),
-                                _ => {
-                                    let ns = module.get_module_namespace();
-                                    Ok(js_to_jsval(scope, ns))
-                                }
-                            }
-                        }
-                    }
-                };
-                VmReply::Done(outcome)
-            }
-            Request::ModuleStatus { module_id } => {
-                let handle = module_handle(istate!(scope), module_id);
-                let outcome = match handle {
-                    None => Err(VmError::Runtime("unknown module".into())),
-                    Some((g, _cid)) => {
-                        let module = v8::Local::new(scope, &g);
-                        let name = match module.get_status() {
-                            v8::ModuleStatus::Uninstantiated => "uninstantiated",
-                            v8::ModuleStatus::Instantiating => "instantiating",
-                            v8::ModuleStatus::Instantiated => "instantiated",
-                            v8::ModuleStatus::Evaluating => "evaluating",
-                            v8::ModuleStatus::Evaluated => "evaluated",
-                            v8::ModuleStatus::Errored => "errored",
-                        };
-                        Ok(JsVal::Str(name.into()))
-                    }
-                };
-                VmReply::Done(outcome)
-            }
-            Request::DisposeModule { module_id } => {
-                let m = &mut istate!(scope).modules;
-                m.by_id.remove(&module_id);
-                for bucket in m.by_hash.values_mut() {
-                    bucket.retain(|(_, id)| *id != module_id);
-                }
-                VmReply::Done(Ok(JsVal::Undefined))
-            }
-            Request::CompileScript {
-                context_id,
-                source,
-                filename,
-                cached_data,
-                produce_cache,
-                eager,
-            } => {
-                let ctx = context_for(istate!(scope), context_id);
-                let outcome = match ctx {
-                    None => Err(VmError::Runtime("context disposed or unknown".into())),
-                    Some(cx) => {
-                        let context = v8::Local::new(scope, &cx);
-                        let scope = &mut v8::ContextScope::new(scope, context);
-                        v8::tc_scope!(let tc, scope);
-                        match v8::String::new(tc, &source) {
-                            None => Err(VmError::Runtime("script source too large".into())),
-                            Some(code) => {
-                                let origin = script_origin(tc, &filename);
-                                let (mut src, opts) = compile_source(code, &origin, &cached_data, eager);
-                                match v8::script_compiler::compile_unbound_script(
-                                    tc,
-                                    &mut src,
-                                    opts,
-                                    v8::script_compiler::NoCacheReason::NoReason,
-                                ) {
-                                    Some(unbound) => {
-                                        let cache_rejected = cached_data.is_some()
-                                            && src.get_cached_data().is_some_and(|c| c.rejected());
-                                        let produced = if produce_cache {
-                                            unbound.create_code_cache().map(|c| c.to_vec())
-                                        } else {
-                                            None
-                                        };
-                                        let g = v8::Global::new(tc, unbound);
-                                        let id = {
-                                            let s = &mut istate!(tc).scripts;
-                                            let id = s.next_id;
-                                            s.next_id += 1;
-                                            s.by_id.insert(id, (g, context_id));
-                                            id
-                                        };
-                                        Ok(Compiled {
-                                            id,
-                                            cached_data: produced,
-                                            cache_rejected,
-                                        })
-                                    }
-                                    None if tc.has_terminated() => Err(VmError::Terminated),
-                                    // Compile failure = a parse error (with location).
-                                    None => {
-                                        let msg = tc
-                                            .exception()
-                                            .map(|e| e.to_rust_string_lossy(tc))
-                                            .unwrap_or_else(|| "script parse error".to_string());
-                                        let message = tc.message();
-                                        let res = message
-                                            .and_then(|m| m.get_script_resource_name(tc))
-                                            .filter(|v| v.is_string())
-                                            .map(|v| v.to_rust_string_lossy(tc))
-                                            .unwrap_or_else(|| filename.clone());
-                                        let loc = match message.and_then(|m| m.get_line_number(tc)) {
-                                            Some(line) => format!(" at {res}:{line}"),
-                                            None => format!(" at {res}"),
-                                        };
-                                        Err(VmError::Parse(format!("{msg}{loc}")))
-                                    }
-                                }
-                            }
-                        }
-                    }
-                };
-                VmReply::ScriptCompiled(outcome)
-            }
-            Request::RunScript {
-                script_id,
-                timeout_ms,
-            } => {
-                let outcome = run_js_bracketed(scope, outermost, timeout_ms, |scope, outermost| {
-                    let handle = script_handle(istate!(scope), script_id);
-                    match handle {
-                        None => (false, Err(VmError::Runtime("unknown script".into()))),
-                        Some((g, cid)) => match context_for(istate!(scope), cid) {
-                            None => (false, Err(VmError::Runtime("script's context is gone".into()))),
-                            Some(cx) => {
-                            let context = v8::Local::new(scope, &cx);
-                            let scope = &mut v8::ContextScope::new(scope, context);
-                            let unbound = v8::Local::new(scope, &g);
-                            let script = unbound.bind_to_current_context(scope);
-                            let out = {
-                                v8::tc_scope!(let tc, scope);
-                                match script.run(tc) {
-                                    Some(value) => Ok(js_to_jsval(tc, value)),
-                                    None if tc.has_terminated() => Err(VmError::Terminated),
-                                    None => {
-                                        let exc = tc.exception();
-                                        let stack = tc.stack_trace();
-                                        Err(capture_js_error(tc, exc, stack))
-                                    }
-                                }
-                            };
-                            auto_drain(scope, outermost);
-                            (true, out)
-                            }
-                        }
-                    }
-                });
-                VmReply::Done(outcome)
-            }
-            Request::DisposeScript { script_id } => {
-                istate!(scope).scripts.by_id.remove(&script_id);
-                VmReply::Done(Ok(JsVal::Undefined))
-            }
-            // Serialize the script's CURRENT compile state. The stored handle is
-            // the UnboundScript, which V8 fills in with inner-function bytecode as
-            // run() lazily compiles them — so calling this after run() captures
-            // the functions that actually executed (a warm cache). None when V8
-            // can't serialize, or when the realm was reset/disposed out from under
-            // the script (its handle is gone): produce nil, not an error.
-            Request::ScriptCodeCache { script_id } => {
-                let handle = script_handle(istate!(scope), script_id);
-                let outcome = match handle {
-                    None => Ok(None),
-                    Some((g, _cid)) => {
-                        let unbound = v8::Local::new(scope, &g);
-                        Ok(unbound.create_code_cache().map(|c| c.to_vec()))
-                    }
-                };
-                VmReply::CodeCache(outcome)
-            }
-            // Same, for a module: get_unbound_module_script gives the shared
-            // compiled script, which evaluate() fills with inner-function bytecode.
-            // It needs the module's context entered (unlike UnboundScript), so
-            // a gone realm yields nil.
-            Request::ModuleCodeCache { module_id } => {
-                let mh = module_handle(istate!(scope), module_id);
-                let handle = mh.and_then(|(g, cid)| context_for(istate!(scope), cid).map(|cx| (g, cx)));
-                let outcome = match handle {
-                    None => Ok(None),
-                    Some((g, cx)) => {
-                        let context = v8::Local::new(scope, &cx);
-                        let scope = &mut v8::ContextScope::new(scope, context);
-                        let module = v8::Local::new(scope, &g);
-                        let unbound = module.get_unbound_module_script(scope);
-                        Ok(unbound.create_code_cache().map(|c| c.to_vec()))
-                    }
-                };
-                VmReply::CodeCache(outcome)
-            }
-        }
-    }
-}
-
 // The id of |context|, read O(1) from the realm-id stamped in by new_realm.
 // None when the context is not a LIVE realm of this isolate — a context reset
 // away still carries its old stamp, so confirm the id currently maps back to
@@ -2855,6 +1085,11 @@ struct Core {
     // Default per-eval/call timeout (ms); 0 = none. eval(timeout_ms:)'s explicit
     // value overrides it. Guards against an in-V8 infinite loop without a watchdog.
     default_timeout_ms: u64,
+    // Per-isolate heap ceiling (bytes); 0 = none. When set, the isolate is created
+    // with this as V8's max heap and near_heap_limit_cb is registered; Core::run's
+    // OOM recovery resets the ceiling back to this after each OOM. Space-axis twin
+    // of default_timeout_ms.
+    memory_limit: usize,
     // Set by Context#dynamic_import_resolver=; called for a JS import() to map
     // (specifier, referrer) to an already-loaded Module. GC-rooted like procs.
     dynamic_import_resolver: Mutex<Option<RootedProc>>,
@@ -2925,6 +1160,10 @@ fn init_v8() {
             std::env::var_os("RUSTY_RACER_STACK_DEBUG").is_some(),
             Ordering::Relaxed,
         );
+        WATCHDOG_DEBUG.store(
+            std::env::var_os("RUSTY_RACER_WATCHDOG_DEBUG").is_some(),
+            Ordering::Relaxed,
+        );
         let platform = v8::new_default_platform(0, false).make_shared();
         v8::V8::initialize_platform(platform);
         v8::V8::initialize();
@@ -3275,6 +1514,9 @@ fn build_snapshot(code: &str, base: Option<Vec<u8>>, warmup: bool) -> Result<Vec
                         VmError::Parse(m) | VmError::Runtime(m) => m,
                         VmError::JsError { message, .. } => message,
                         VmError::Terminated => "snapshot code was terminated".to_string(),
+                        // Unreachable: the snapshot-creator isolate carries no
+                        // memory_limit, so near_heap_limit_cb is never registered.
+                        VmError::OutOfMemory => "snapshot code ran out of memory".to_string(),
                     });
                 }
             }
@@ -3310,16 +1552,22 @@ impl Isolate {
         host_namespace: Option<String>,
         snapshot: Option<magnus::typed_data::Obj<Snapshot>>,
         timeout_ms: u64,
+        memory_limit: usize,
         explicit_microtasks: bool,
     ) -> Result<Self, Error> {
         init_v8();
         // A snapshot blob bakes globalThis state in: the first Context::new (in
         // new_realm below) deserializes that default context for free.
         let snapshot_bytes = snapshot.map(|s| s.blob.borrow().clone());
-        let create_params = match snapshot_bytes {
+        let mut create_params = match snapshot_bytes {
             Some(bytes) => v8::CreateParams::default().snapshot_blob(v8::StartupData::from(bytes)),
             None => Default::default(),
         };
+        // Cap V8's heap at the configured limit so its near-heap-limit callback
+        // fires as the script approaches it (initial 0 = V8's default initial heap).
+        if memory_limit > 0 {
+            create_params = create_params.heap_limits(0, memory_limit);
+        }
         let mut isolate = v8::Isolate::new(create_params);
         // Always Explicit at the V8 level; the binding performs the kAuto
         // end-of-script drain itself (auto_drain) so it stays inside the
@@ -3359,6 +1607,12 @@ impl Isolate {
         // registry moves only the 8-byte pointer; the boxed OwnedIsolate stays put.
         let mut boxed = Box::new(isolate);
         let iso_ptr = IsoPtr(&mut **boxed as *mut v8::Isolate);
+        // Arm the memory limit now that iso_ptr is stable: the callback's data IS
+        // this ptr (it reads the slot's oom_fired and terminates through it), and
+        // Core::run resets the ceiling through the same ptr on recovery.
+        if memory_limit > 0 {
+            boxed.add_near_heap_limit_callback(near_heap_limit_cb, iso_ptr.0 as *mut c_void);
+        }
         let iso_id = NEXT_ISOLATE_ID.fetch_add(1, Ordering::SeqCst);
         isolates().lock().unwrap().insert(iso_id, SendIso(boxed));
         // Root the owner Thread VALUE so its address can't be reused while this
@@ -3377,6 +1631,7 @@ impl Isolate {
             depth: std::sync::atomic::AtomicU32::new(0),
             procs: Mutex::new(ProcTable::default()),
             default_timeout_ms: timeout_ms,
+            memory_limit,
             dynamic_import_resolver: Mutex::new(None),
             watchdog,
             watchdog_join: Mutex::new(Some(watchdog_join)),
@@ -3472,11 +1727,37 @@ impl Core {
                     self.scan_start_field.load(Ordering::Relaxed),
                     stack_top,
                 );
-                let reply = std::panic::catch_unwind(AssertUnwindSafe(|| {
+                let mut reply = std::panic::catch_unwind(AssertUnwindSafe(|| {
                     v8::scope!(let scope, unsafe { &mut *iso });
                     service_request(scope, request, true)
                 }))
                 .ok();
+                // OOM recovery. The near-heap-limit callback bumped the ceiling and
+                // terminated the op so it could unwind; the scope is closed and JS has
+                // stopped now. Reclaim the runaway allocation (a forced GC) and reset
+                // the ceiling back to memory_limit so the limit keeps protecting later
+                // ops, then relabel the terminate as OutOfMemory. watchdog_fired stays
+                // false for an OOM, so the request's end-sweep left the terminate flag
+                // set — cancel it here.
+                if self.memory_limit > 0 && std::mem::take(&mut istate!(unsafe { &mut *iso }).oom_fired) {
+                    let iso_ref = unsafe { &mut *iso };
+                    // Reclaim the runaway allocation, then reset the ceiling from the
+                    // doubled bump back to memory_limit (V8 clamps it no lower than the
+                    // live heap — a genuinely-retained set above the limit necessarily
+                    // loosens it, inherent to recovering the isolate rather than
+                    // discarding it), and re-arm the callback for the next op.
+                    iso_ref.low_memory_notification();
+                    iso_ref.remove_near_heap_limit_callback(near_heap_limit_cb, self.memory_limit);
+                    iso_ref.add_near_heap_limit_callback(near_heap_limit_cb, iso as *mut c_void);
+                    // Clear the terminate the OOM set (the request end-sweep skips it —
+                    // that only sweeps watchdog_fired). Do this AFTER the GC: the forced
+                    // GC above runs with the callback still armed, so a still-huge live
+                    // set can re-fire it mid-GC, re-setting both terminate and oom_fired;
+                    // clearing both here keeps either from leaking into the next op.
+                    iso_ref.cancel_terminate_execution();
+                    istate!(iso_ref).oom_fired = false;
+                    reply = reply.map(relabel_oom);
+                }
                 unsafe { (*iso).exit() };
                 reply
             } else {
@@ -3692,6 +1973,7 @@ impl Core {
     }
 
     // Thin ESM primitives. compile_module returns the new module's id.
+    #[allow(clippy::too_many_arguments)]
     fn compile_module(
         &self,
         ruby: &Ruby,
@@ -3785,6 +2067,7 @@ impl Core {
     }
 
     // Classic script: compile, run, dispose.
+    #[allow(clippy::too_many_arguments)]
     fn compile_script(
         &self,
         ruby: &Ruby,
@@ -3865,11 +2148,7 @@ impl Core {
     fn teardown(&self) {
         // Stop + join the watchdog before we touch the isolate, so its handle
         // can't fire a terminate into an isolate we're mid-disposing.
-        {
-            let mut inner = self.watchdog.inner.lock().unwrap();
-            inner.shutdown = true;
-        }
-        self.watchdog.cv.notify_one();
+        self.watchdog.request_shutdown();
         if let Some(join) = self.watchdog_join.lock().unwrap().take() {
             let _ = join.join();
         }
@@ -3890,6 +2169,13 @@ impl Core {
             st.scripts = ScriptReg::default();
             st.instantiate_resolve = None;
         }
+        // Unregister the near-heap-limit callback before disposal: dropping the box
+        // runs V8's teardown GC, which could otherwise re-invoke near_heap_limit_cb
+        // (touching the just-reset slot of an isolate being destroyed). The watchdog
+        // is already stopped above; this closes the matching space-axis hole.
+        if self.memory_limit > 0 {
+            unsafe { &mut *self.iso_ptr.0 }.remove_near_heap_limit_callback(near_heap_limit_cb, 0);
+        }
         // Remove (and drop) the OwnedIsolate — V8 disposal runs here — AFTER the
         // watchdog joined and the Globals were cleared, while the isolate is
         // entered (above). Drop outside the lock so V8 teardown can't deadlock on
@@ -3946,11 +2232,7 @@ impl Drop for Core {
             // explicitly on the owner thread before the last wrapper drops avoids
             // this leak; the counter makes it observable (RustyRacer.leaked_isolate_count).
             LEAKED_ISOLATES.fetch_add(1, Ordering::Relaxed);
-            {
-                let mut inner = self.watchdog.inner.lock().unwrap();
-                inner.shutdown = true;
-            }
-            self.watchdog.cv.notify_one();
+            self.watchdog.request_shutdown();
         }
     }
 }
@@ -4348,6 +2630,10 @@ fn vm_err(ruby: &Ruby, e: VmError) -> Error {
             err_class(ruby, "ScriptTerminatedError"),
             "JavaScript was terminated (timeout or stop)",
         ),
+        VmError::OutOfMemory => Error::new(
+            err_class(ruby, "V8OutOfMemoryError"),
+            "JavaScript exceeded the isolate memory_limit",
+        ),
     }
 }
 
@@ -4418,387 +2704,6 @@ fn resolve_module_via_ruby(
     Ok(Some(obj.module_id))
 }
 
-fn jsval_to_ruby(ruby: &Ruby, val: &JsVal) -> Result<Value, Error> {
-    let mut built: HashMap<u32, Value> = HashMap::new();
-    jsval_to_ruby_d(ruby, val, &mut built)
-}
-
-// `built` is a HashMap<u32, Value> — the same "bare Values in a heap container,
-// hidden from the GC mark phase" shape that's a use-after-free in call_proc. It
-// is safe HERE only because every entry is, at every allocating safepoint, ALSO
-// reachable from a live stack local: each container arm (Array/Obj/Map/Set)
-// keeps its arr/h/set as a live local while its children recurse and grafts each
-// child into it (push/aset), so the child is marked transitively; Bytes inserts
-// then immediately returns its live local `s`. So `built` never holds the sole
-// reference. This invariant is load-bearing: do NOT refactor an arm to stash a
-// value in `built` without keeping it rooted by a live local until it's grafted.
-
-fn jsval_to_ruby_d(
-    ruby: &Ruby,
-    val: &JsVal,
-    built: &mut HashMap<u32, Value>,
-) -> Result<Value, Error> {
-    Ok(match val {
-        JsVal::Undefined | JsVal::Null => ruby.qnil().as_value(),
-        JsVal::Bool(b) => (*b).into_value_with(ruby),
-        JsVal::Int(i) => (*i).into_value_with(ruby),
-        JsVal::Num(n) => (*n).into_value_with(ruby),
-        JsVal::Str(s) => s.clone().into_value_with(ruby),
-        // Bytes -> a binary (ASCII-8BIT) String: str_from_slice uses rb_str_new,
-        // which tags the result ASCII-8BIT — so it round-trips back to bytes.
-        // Registered under |id| so an aliased blob stays one String via Ref.
-        JsVal::Bytes { id, bytes } => {
-            let s = ruby.str_from_slice(bytes).as_value();
-            if let Some(id) = id {
-                built.insert(*id, s);
-            }
-            s
-        }
-        // Reconstruct the Ruby Integer from the hex magnitude (arbitrary
-        // precision); negate via Ruby so bignums stay exact.
-        JsVal::BigInt { negative, words } => {
-            let mag: Value = ruby
-                .str_new(&words_to_hex(words))
-                .funcall("to_i", (16i64,))?;
-            if *negative {
-                mag.funcall("-@", ())?
-            } else {
-                mag
-            }
-        }
-        // Time.at takes seconds; carry sub-second precision as the Float. An
-        // invalid Date (value_of NaN) raises RangeError, matching csim's
-        // des_date — never a silent nil.
-        JsVal::Date(ms) => {
-            if !ms.is_finite() {
-                return Err(Error::new(ruby.exception_range_error(), "invalid Date"));
-            }
-            ruby.class_object()
-                .const_get::<_, magnus::RClass>("Time")?
-                .funcall::<_, _, Value>("at", (*ms / 1000.0,))?
-        }
-        // Register before filling so a Ref from a descendant resolves to the
-        // same Ruby object (shared/cyclic graphs keep their identity).
-        JsVal::Array { id, items } => {
-            let arr = ruby.ary_new();
-            built.insert(*id, arr.as_value());
-            for it in items {
-                let _ = arr.push(jsval_to_ruby_d(ruby, it, built)?);
-            }
-            arr.as_value()
-        }
-        // JS objects -> string-keyed Hashes.
-        JsVal::Obj { id, entries } => {
-            let h = ruby.hash_new();
-            built.insert(*id, h.as_value());
-            for (k, it) in entries {
-                let _ = h.aset(k.as_str(), jsval_to_ruby_d(ruby, it, built)?);
-            }
-            h.as_value()
-        }
-        // JS Map -> Ruby Hash (arbitrary marshalled keys, not just strings).
-        JsVal::Map { id, pairs } => {
-            let h = ruby.hash_new();
-            built.insert(*id, h.as_value());
-            for (k, v) in pairs {
-                let kk = jsval_to_ruby_d(ruby, k, built)?;
-                let vv = jsval_to_ruby_d(ruby, v, built)?;
-                let _ = h.aset(kk, vv);
-            }
-            h.as_value()
-        }
-        // JS Set -> Ruby Set (stdlib); build empty then add so a cyclic Set
-        // (a Set containing itself) resolves through the Ref table.
-        JsVal::Set { id, items } => {
-            let set: Value = ruby
-                .class_object()
-                .const_get::<_, magnus::RClass>("Set")?
-                .funcall("new", ())?;
-            built.insert(*id, set);
-            for it in items {
-                let v = jsval_to_ruby_d(ruby, it, built)?;
-                let _: Value = set.funcall("add", (v,))?;
-            }
-            set
-        }
-        JsVal::Ref(id) => built
-            .get(id)
-            .copied()
-            .unwrap_or_else(|| ruby.qnil().as_value()),
-    })
-}
-
-// A Ruby String marshalled by its encoding TAG (the tag is the type):
-//   - ASCII-8BIT (binary) -> JsVal::Bytes (a JS Uint8Array);
-//   - any text encoding   -> JsVal::Str (UTF-8). Already-UTF-8 text is taken
-//     as-is; other text encodings transcode (Ruby raises on unmappable bytes).
-//     Either way the bytes must be VALID UTF-8 — invalid bytes RAISE, never
-//     silently degrade to U+FFFD (loud failure beats silent corruption). A
-//     text String mis-tagged binary surfaces loudly too (it becomes a Uint8Array).
-fn string_to_jsval(ruby: &Ruby, s: RString) -> Result<JsVal, Error> {
-    use magnus::encoding::EncodingCapable;
-    if s.enc_get() == ruby.ascii8bit_encindex() {
-        // Binary: the bytes ARE the value (O(n) copy, no inflation). id: None —
-        // the identity-tracked path is the direct-String branch in
-        // ruby_to_jsval_d; a to_str result reaching here is transient.
-        return Ok(JsVal::Bytes {
-            id: None,
-            bytes: unsafe { s.as_slice() }.to_vec(),
-        });
-    }
-    // Text. encode('UTF-8') on an already-UTF-8 source is a no-op that does NOT
-    // validate, so skip it (one fewer copy) and let the from_utf8 check below
-    // catch invalid bytes; other encodings transcode (raising on unmappable).
-    let utf8: RString = if s.enc_get() == ruby.utf8_encindex() {
-        s
-    } else {
-        s.funcall("encode", ("UTF-8",))?
-    };
-    // Build the Rust String with a real UTF-8 check (not lossy): invalid bytes
-    // in a text-tagged String are an error, not silent U+FFFD substitution.
-    match String::from_utf8(unsafe { utf8.as_slice() }.to_vec()) {
-        Ok(s) => Ok(JsVal::Str(s)),
-        Err(_) => Err(Error::new(
-            ruby
-                .class_object()
-                .const_get::<_, ExceptionClass>("EncodingError")
-                .unwrap_or_else(|_| ruby.exception_runtime_error()),
-            "text-tagged String contains invalid UTF-8 bytes",
-        )),
-    }
-}
-
-// A JS object key must be a string. A Ruby String key crosses by its bytes as
-// UTF-8 — but unlike a binary VALUE (which becomes a Uint8Array), a key has
-// nowhere to put raw bytes, so invalid UTF-8 RAISES rather than silently
-// degrading to U+FFFD. None for a non-String (the caller then tries to_s).
-fn string_key(ruby: &Ruby, val: Value) -> Option<Result<String, Error>> {
-    let s = RString::from_value(val)?;
-    let bytes = unsafe { s.as_slice() }.to_vec();
-    Some(String::from_utf8(bytes).map_err(|_| {
-        Error::new(
-            ruby.class_object()
-                .const_get::<_, ExceptionClass>("EncodingError")
-                .unwrap_or_else(|_| ruby.exception_runtime_error()),
-            "hash key is not valid UTF-8",
-        )
-    }))
-}
-
-// A Ruby String's bytes interpreted as UTF-8 (invalid sequences become U+FFFD),
-// regardless of the encoding tag. Used for the depth-truncation to_s fallback,
-// where the value is already being lossily summarised.
-fn lossy_string(val: Value) -> Option<String> {
-    let s = RString::from_value(val)?;
-    // Copy the bytes out before any further Ruby call can move/free them.
-    let bytes = unsafe { s.as_slice() }.to_vec();
-    Some(String::from_utf8_lossy(&bytes).into_owned())
-}
-
-// Tracks Ruby containers already emitted this marshal (by object_id, which is
-// exact — no collision handling needed) so shared/cyclic structures become Refs.
-#[derive(Default)]
-struct RbSeen {
-    next_id: u32,
-    map: HashMap<usize, u32>,
-}
-
-fn ruby_to_jsval(val: Value) -> Result<JsVal, Error> {
-    let mut seen = RbSeen::default();
-    ruby_to_jsval_d(val, &mut seen, 0)
-}
-
-fn ruby_to_jsval_d(val: Value, seen: &mut RbSeen, depth: u32) -> Result<JsVal, Error> {
-    let ruby = Ruby::get().unwrap();
-    if val.is_nil() {
-        return Ok(JsVal::Null);
-    }
-    // NB: bool::try_convert is RTEST (truthiness) — it returns Ok(true) for
-    // ANY non-false value — so check the actual true/false singletons by
-    // identity instead, or every Integer/String/Array would marshal as `true`.
-    if val.eql(ruby.qtrue()).unwrap_or(false) {
-        return Ok(JsVal::Bool(true));
-    }
-    if val.eql(ruby.qfalse()).unwrap_or(false) {
-        return Ok(JsVal::Bool(false));
-    }
-    // Ruby Time -> JS Date. Must precede the numeric checks: magnus's
-    // i64/f64 TryConvert coerces a Time via to_i/to_f, so it would otherwise
-    // marshal as a bare epoch number. Time#to_f is epoch seconds; Date wants ms.
-    if let Ok(time_class) = ruby.class_object().const_get::<_, magnus::RClass>("Time") {
-        if val.is_kind_of(time_class) {
-            let sec = val.funcall::<_, _, f64>("to_f", ())?;
-            return Ok(JsVal::Date(sec * 1000.0));
-        }
-    }
-    // Integer. A JS Number is an f64, so only integers exactly representable
-    // there (|n| <= 2^53) become Int/Number; anything larger (the rest of the
-    // i64 range AND true bignums) becomes a BigInt so no precision is lost.
-    // Use a strict Integer type check, NOT magnus::Integer::try_convert, which
-    // coerces a Float / to_int object — that would turn e.g. 1e300 into a BigInt
-    // instead of a Number.
-    if let Ok(int_class) = ruby.class_object().const_get::<_, magnus::RClass>("Integer") {
-        if val.is_kind_of(int_class) {
-            if let Ok(i) = i64::try_convert(val) {
-                if i.unsigned_abs() <= (1u64 << 53) {
-                    return Ok(JsVal::Int(i));
-                }
-            }
-            let abs: Value = val.funcall("abs", ())?;
-            let hex: String = abs.funcall("to_s", (16i64,))?;
-            let negative = val.funcall::<_, _, bool>("negative?", ())?;
-            return Ok(JsVal::BigInt {
-                negative,
-                words: hex_to_words(&hex),
-            });
-        }
-    }
-    if let Ok(n) = f64::try_convert(val) {
-        return Ok(JsVal::Num(n));
-    }
-    // Bare Symbol -> JS string (one-way: it comes back as a Ruby String). A
-    // binary-encoded symbol surfaces the same curated EncodingError as a text
-    // String with invalid UTF-8, not magnus's raw "expected utf-8" message.
-    if let Some(sym) = magnus::Symbol::from_value(val) {
-        let name = sym.name().map_err(|_| {
-            Error::new(
-                ruby.class_object()
-                    .const_get::<_, ExceptionClass>("EncodingError")
-                    .unwrap_or_else(|_| ruby.exception_runtime_error()),
-                "symbol name is not valid UTF-8",
-            )
-        })?;
-        return Ok(JsVal::Str(name.into_owned()));
-    }
-    // Real Strings: the encoding tag is the type declaration. A binary
-    // (ASCII-8BIT) String -> bytes (JS Uint8Array), identity-tracked so an
-    // aliased blob stays one Uint8Array; any text encoding -> a JS string.
-    if let Some(rstr) = RString::from_value(val) {
-        use magnus::encoding::EncodingCapable;
-        if rstr.enc_get() == ruby.ascii8bit_encindex() {
-            // depth 0 — a binary blob is a leaf, so it stays faithful bytes even
-            // when deeply nested (never the depth-truncation-to-lossy-string);
-            // only the identity (Ref) check applies. Frozen/interned binary
-            // Strings share an object_id, so two `-"x".b` literals deliberately
-            // collapse to ONE Uint8Array (they ARE the same Ruby object).
-            let id = match rb_container_id(seen, val, 0)? {
-                RbId::New(id) => id,
-                RbId::Reuse(jv) => return Ok(jv),
-            };
-            return Ok(JsVal::Bytes {
-                id: Some(id),
-                bytes: unsafe { rstr.as_slice() }.to_vec(),
-            });
-        }
-        return string_to_jsval(&ruby, rstr);
-    }
-    // A String-like (to_str) gets the same tag-driven treatment, but its result
-    // is transient so it is not identity-tracked.
-    if val.respond_to("to_str", false).unwrap_or(false) {
-        let s: Value = val.funcall("to_str", ())?;
-        if let Some(rstr) = RString::from_value(s) {
-            return string_to_jsval(&ruby, rstr);
-        }
-    }
-    // Ruby Set -> JS Set. Before the Array/Hash checks (a Set is neither).
-    if let Ok(set_class) = ruby.class_object().const_get::<_, magnus::RClass>("Set") {
-        if val.is_kind_of(set_class) {
-            let id = match rb_container_id(seen, val, depth)? {
-                RbId::New(id) => id,
-                RbId::Reuse(jv) => return Ok(jv),
-            };
-            let arr: RArray = val.funcall("to_a", ())?;
-            let mut items = Vec::with_capacity(arr.len());
-            for i in 0..arr.len() {
-                let el: Value = arr.entry::<Value>(i as isize)?;
-                items.push(ruby_to_jsval_d(el, seen, depth + 1)?);
-            }
-            return Ok(JsVal::Set { id, items });
-        }
-    }
-    if let Ok(arr) = RArray::try_convert(val) {
-        let id = match rb_container_id(seen, val, depth)? {
-            RbId::New(id) => id,
-            RbId::Reuse(jv) => return Ok(jv),
-        };
-        let mut items = Vec::with_capacity(arr.len());
-        for i in 0..arr.len() {
-            let el: Value = arr.entry::<Value>(i as isize)?;
-            items.push(ruby_to_jsval_d(el, seen, depth + 1)?);
-        }
-        return Ok(JsVal::Array { id, items });
-    }
-    if let Ok(hash) = RHash::try_convert(val) {
-        let id = match rb_container_id(seen, val, depth)? {
-            RbId::New(id) => id,
-            RbId::Reuse(jv) => return Ok(jv),
-        };
-        let entries = RefCell::new(Vec::new());
-        hash.foreach(|k: Value, v: Value| {
-            // String/Symbol keys -> a UTF-8 String; anything else via to_s. A JS
-            // object key has nowhere to put raw bytes, so unlike a binary VALUE
-            // (-> Uint8Array) a binary KEY with invalid UTF-8 RAISES (string_key),
-            // and a to_s returning a non-String is a loud error, not a silent "".
-            let key = match string_key(&ruby, k) {
-                Some(r) => r?,
-                None => {
-                    // A non-String key (Symbol, Integer, ...) -> to_s, then the
-                    // same UTF-8 rule.
-                    let s: Value = k.funcall("to_s", ())?;
-                    match string_key(&ruby, s) {
-                        Some(r) => r?,
-                        None => {
-                            return Err(Error::new(
-                                ruby.exception_type_error(),
-                                "hash key's to_s did not return a String",
-                            ))
-                        }
-                    }
-                }
-            };
-            entries
-                .borrow_mut()
-                .push((key, ruby_to_jsval_d(v, seen, depth + 1)?));
-            Ok(magnus::r_hash::ForEach::Continue)
-        })?;
-        return Ok(JsVal::Obj {
-            id,
-            entries: entries.into_inner(),
-        });
-    }
-    Err(Error::new(
-        ruby.exception_type_error(),
-        "unsupported type crossing into JS",
-    ))
-}
-
-enum RbId {
-    New(u32),
-    Reuse(JsVal),
-}
-
-// Ruby-side mirror of js_container_id: New(id) to register and recurse, or
-// Reuse(jsval) to emit directly (a Ref to an already-seen object, or a
-// depth-truncated Str). Computes object_id once.
-fn rb_container_id(seen: &mut RbSeen, val: Value, depth: u32) -> Result<RbId, Error> {
-    let oid = val.funcall::<_, _, usize>("object_id", ())?;
-    if let Some(id) = seen.map.get(&oid) {
-        return Ok(RbId::Reuse(JsVal::Ref(*id)));
-    }
-    if depth >= MAX_MARSHAL_DEPTH {
-        let ruby = Ruby::get().unwrap();
-        let s: Value = val.funcall("to_s", ())?;
-        let s = lossy_string(s).ok_or_else(|| {
-            Error::new(ruby.exception_type_error(), "to_s did not return a String")
-        })?;
-        return Ok(RbId::Reuse(JsVal::Str(s)));
-    }
-    let id = seen.next_id;
-    seen.next_id += 1;
-    seen.map.insert(oid, id);
-    Ok(RbId::New(id))
-}
-
 #[magnus::init]
 fn init(ruby: &Ruby) -> Result<(), Error> {
     let module = ruby.define_module("RustyRacer")?;
@@ -4806,7 +2711,7 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
     // The isolate (VM) + its isolate-level ops; hands out Contexts.
     let isolate = module.define_class("Isolate", ruby.class_object())?;
     // keyword-arg wrapper Isolate.new(snapshot:, ...) lives in lib/rusty_racer.rb
-    isolate.define_singleton_method("_new", function!(Isolate::new, 4))?;
+    isolate.define_singleton_method("_new", function!(Isolate::new, 5))?;
     isolate.define_method("context", method!(Isolate::context, 0))?;
     isolate.define_method("create_context", method!(Isolate::create_context, 0))?;
     isolate.define_method("terminate", method!(Isolate::terminate, 0))?;