castrum 0.9.9 → 0.9.11

package/Cargo.lock

@@ -2,12 +2,6 @@
 # It is not intended for manual editing.
 version = 4
 
-[[package]]
-name = "adler2"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
-
 [[package]]
 name = "ahash"
 version = "0.8.12"
@@ -78,9 +72,9 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.17.3"
+version = "1.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00bdb5da18dac48ca2cc7cd4a98e533e8635a58e2361d13a1a4ee3888e0d72f1"
+checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
 dependencies = [
  "aws-lc-sys",
  "untrusted",
@@ -89,9 +83,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.43.0"
+version = "0.45.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43103168cc76fe62678a375e722fc9cb3a0146159ac5828bc4f0dfd755c2224c"
+checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27"
 dependencies = [
  "cc",
  "cmake",
@@ -100,12 +94,6 @@ dependencies = [
  "pkg-config",
 ]
 
-[[package]]
-name = "base64"
-version = "0.22.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
-
 [[package]]
 name = "base64"
 version = "0.23.1"
@@ -120,13 +108,13 @@ checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
 name = "bcrypt"
-version = "0.16.0"
+version = "0.19.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b1866ecef4f2d06a0bb77880015fdf2b89e25a1c2e5addacb87e459c86dc67e"
+checksum = "a0cd0bd35a28836d528d2b58ad499bc3c5641d59379421b1be9eeb0c2f2b912a"
 dependencies = [
- "base64 0.22.1",
+ "base64",
  "blowfish",
- "getrandom 0.2.17",
+ "getrandom 0.4.3",
  "subtle",
  "zeroize",
 ]
@@ -146,6 +134,12 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
 
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
 [[package]]
 name = "bitflags"
 version = "2.13.1"
@@ -172,9 +166,9 @@ dependencies = [
 
 [[package]]
 name = "blowfish"
-version = "0.9.1"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e412e2cd0f2b2d93e02543ceae7917b3c70331573df19ee046bcbc35e45e87d7"
+checksum = "62ce3946557b35e71d1bbe07ec385073ce9eda05043f95de134eb578fcf1a298"
 dependencies = [
  "byteorder",
  "cipher",
@@ -233,11 +227,11 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "castrum"
-version = "0.9.9"
+version = "0.9.11"
 dependencies = [
  "argon2",
  "aws-lc-rs",
- "base64 0.23.1",
+ "base64",
  "bcrypt",
  "brotli",
  "core_affinity",
@@ -245,6 +239,7 @@ dependencies = [
  "email_address",
  "fancy-regex",
  "fast_chemail",
+ "faster-hex",
  "flate2",
  "fraction",
  "getrandom 0.4.3",
@@ -296,11 +291,11 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "cipher"
-version = "0.4.4"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
 dependencies = [
- "crypto-common",
+ "crypto-common 0.2.2",
  "inout",
 ]
 
@@ -315,9 +310,9 @@ dependencies = [
 
 [[package]]
 name = "convert_case"
-version = "0.11.0"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "affbf0190ed2caf063e3def54ff444b449371d55c58e513a95ab98eca50adb49"
+checksum = "1af709f1f33454bf52eadfc8c78b3b9ef9cb26fb54d16dc9cd9a7299f899fd1b"
 dependencies = [
  "unicode-segmentation",
 ]
@@ -386,6 +381,15 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "ctor"
 version = "1.0.10"
@@ -398,6 +402,46 @@ version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
 
+[[package]]
+name = "defmt"
+version = "0.3.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0963443817029b2024136fc4dd07a5107eb8f977eaf18fcd1fdeb11306b64ad"
+dependencies = [
+ "defmt 1.1.1",
+]
+
+[[package]]
+name = "defmt"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1"
+dependencies = [
+ "bitflags 1.3.2",
+ "defmt-macros",
+]
+
+[[package]]
+name = "defmt-macros"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8"
+dependencies = [
+ "defmt-parser",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "defmt-parser"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
+dependencies = [
+ "thiserror",
+]
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -405,7 +449,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer",
- "crypto-common",
+ "crypto-common 0.1.7",
  "subtle",
 ]
 
@@ -477,6 +521,18 @@ dependencies = [
  "ascii_utils",
 ]
 
+[[package]]
+name = "faster-hex"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04839bdf9d8c10f66806fad16b852fc72aab80873aebc3cb69d85b4fa41543ed"
+dependencies = [
+ "autocfg",
+ "defmt 0.3.100",
+ "heapless",
+ "serde",
+]
+
 [[package]]
 name = "fastrand"
 version = "2.5.0"
@@ -503,11 +559,11 @@ checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
 [[package]]
 name = "flate2"
-version = "1.1.9"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
 dependencies = [
- "miniz_oxide",
+ "crc32fast",
  "zlib-rs",
 ]
 
@@ -648,17 +704,6 @@ dependencies = [
  "version_check",
 ]
 
-[[package]]
-name = "getrandom"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi",
-]
-
 [[package]]
 name = "getrandom"
 version = "0.3.4"
@@ -684,6 +729,15 @@ dependencies = [
  "r-efi 6.0.0",
 ]
 
+[[package]]
+name = "hash32"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d60b12902ba28e2730cd37e95b8c9223af2808df9e902d4df49588d1470606"
+dependencies = [
+ "byteorder",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.17.1"
@@ -695,6 +749,16 @@ dependencies = [
  "foldhash",
 ]
 
+[[package]]
+name = "heapless"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bfb9eb618601c89945a70e254898da93b13be0388091d42117462b265bb3fad"
+dependencies = [
+ "hash32",
+ "stable_deref_trait",
+]
+
 [[package]]
 name = "heck"
 version = "0.5.0"
@@ -722,6 +786,15 @@ version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
+[[package]]
+name = "hybrid-array"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
+dependencies = [
+ "typenum",
+]
+
 [[package]]
 name = "icu_collections"
 version = "2.2.0"
@@ -837,18 +910,18 @@ dependencies = [
 
 [[package]]
 name = "inout"
-version = "0.1.4"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
 dependencies = [
- "generic-array",
+ "hybrid-array",
 ]
 
 [[package]]
 name = "ipnet"
-version = "2.12.0"
+version = "2.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
 
 [[package]]
 name = "itoa"
@@ -983,9 +1056,9 @@ dependencies = [
 
 [[package]]
 name = "lru"
-version = "0.18.4"
+version = "0.18.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff9840bcc50b71349309900da0ce7279aa336ae71d73250b07998932c7d97c25"
+checksum = "ef9ac18847474e638e3702b76c65d4eb93428471a74778ef0f1be711717f89b5"
 dependencies = [
  "hashbrown",
 ]
@@ -1035,24 +1108,14 @@ dependencies = [
 
 [[package]]
 name = "minijinja"
-version = "2.22.0"
+version = "2.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef84a52be188a1d4124bd717903fdde96ca4705f2b56adfe2d91fcc57fcb6987"
+checksum = "86886cf6dbf4e614b19c9a1eec9775f021869d7eadde0fc73921a81b90c9b4c9"
 dependencies = [
  "memo-map",
  "serde",
 ]
 
-[[package]]
-name = "miniz_oxide"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
-dependencies = [
- "adler2",
- "simd-adler32",
-]
-
 [[package]]
 name = "munge"
 version = "0.4.7"
@@ -1075,11 +1138,11 @@ dependencies = [
 
 [[package]]
 name = "napi"
-version = "3.12.2"
+version = "3.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58c5f4d5375213fdb7be2655e152386e82f026f9a5ba36a75556e11359aafe09"
+checksum = "3b12638855cec016784a7e17cc4ecbdee7ca8b0a3456aa50640d0ee5ed1a42f8"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.1",
  "ctor",
  "futures",
  "libc",
@@ -1093,15 +1156,15 @@ dependencies = [
 
 [[package]]
 name = "napi-build"
-version = "2.4.1"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60fdf9b392c50e7c4170fa633bd909490ed7835cea4c046776d1a4dd8d2ae0ab"
+checksum = "b899b545d3aa6dca985939059f258c5488d34e4ecf39c274e20009748f4b846d"
 
 [[package]]
 name = "napi-derive"
-version = "3.6.0"
+version = "3.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a49c513341a61a16a10af6efcce46b30d0822ba2d4fb197d24d33dfc199c78d5"
+checksum = "350057056a30368aa76c11a0d406b0aa61321710be2c36656ab4f6efe0b785a2"
 dependencies = [
  "convert_case",
  "ctor",
@@ -1113,9 +1176,9 @@ dependencies = [
 
 [[package]]
 name = "napi-derive-backend"
-version = "6.0.0"
+version = "6.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4747005fa3e2c9989ac45a723a514c5db2411238b72981a3cda4c701a9dfea17"
+checksum = "4c1c87a71568f3fe5c736b10878ff55064b250bb4ea4b48c8055713e07b9e463"
 dependencies = [
  "convert_case",
  "proc-macro2",
@@ -1126,9 +1189,9 @@ dependencies = [
 
 [[package]]
 name = "napi-sys"
-version = "3.3.0"
+version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85fbf1fa9f1babfe396d74bbbf52b3643770243e8f5b0b46715d4caf7f0dfc9a"
+checksum = "e22a4f25c16a5c5411d987cd6fbd48313522ae1789ade2d6dd3efdc6d40a0fc8"
 dependencies = [
  "libloading",
 ]
@@ -1379,7 +1442,7 @@ checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
 dependencies = [
  "bit-set",
  "bit-vec",
- "bitflags",
+ "bitflags 2.13.1",
  "num-traits",
  "rand",
  "rand_chacha",
@@ -1516,7 +1579,7 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
@@ -1632,7 +1695,7 @@ version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.1",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -1730,12 +1793,6 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
-[[package]]
-name = "simd-adler32"
-version = "0.3.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
-
 [[package]]
 name = "simdutf8"
 version = "0.1.5"
@@ -2012,12 +2069,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "wasi"
-version = "0.11.1+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
-
 [[package]]
 name = "wasip2"
 version = "1.0.4+wasi-0.2.12"

package/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "castrum"
 # Keep in sync with package.json "version" (single source of truth: the npm package).
-version = "0.9.9"
+version = "0.9.11"
 edition = "2021"
 # Keep in sync with package.json "license" (cargo-deny rejects a crate with no
 # license expression).
@@ -45,8 +45,11 @@ sonic-rs = { version = "0.5", features = ["sort_keys"] }
 # validators (email etc.) are built-in and NOT feature-gated in 0.48.
 jsonschema = { version = "0.49", default-features = false, features = ["resolve-file"] }
 aws-lc-rs = "1"
-# NOTE: base64 0.23 enables SIMD (SSE/AVX) by default via the `simd-unsafe`
-# feature (part of `default`); no explicit feature is needed.
+# NOTE: base64 0.23 compiles its SIMD `engine::simd::Simd` (AVX2/NEON, Muła
+# kernels) by default via the `simd-unsafe` feature (part of `default`). Our
+# `rust/crypto/base64.rs` selects that engine for the hot cores on x86_64 /
+# aarch64, with the scalar `GeneralPurpose` fallback elsewhere; the wire
+# contract (PAD/NO_PAD configs, byte-identical output) is unchanged.
 base64 = "0.23"
 crc32fast = "1"
 httparse = "1"
@@ -72,7 +75,21 @@ mimalloc = { version = "0.1", features = ["local_dynamic_tls"] }
 core_affinity = "0.8"
 
 parking_lot = "0.12"
+# xxhash-rust: seeded streaming Xxh3 (ingress ip_trust rate_key, tiny 1-17
+# byte IPs) AND the public one-shot xxh3_64. Measured: the scalar core
+# sustains a FLAT ~30GB/s from 64B to 1MB (no size pathology); the ~2x gap to
+# Bun.hash.xxHash3 at >= 1KB is Bun's AVX2 width, not a scaling issue, and
+# ignex already delegates the public hash to Bun under Bun — see
+# docs/bun-builtins-decision-matrix.md.
 xxhash-rust = { version = "0.8", features = ["xxh3"] }
+# faster-hex: SIMD (runtime-dispatched SSE -> AVX2) lowercase hex encode/decode
+# with byte-exact semantics parity vs our HEX_VAL_LUT (case-insensitive decode,
+# reject [^0-9a-fA-F], odd-length error) — verified exhaustively (65,536 pairs).
+# Replaces the per-byte table loops that lost ~3-6x to Buffer.toString("hex").
+# 0.10.1+ carries the RUSTSEC-2026-0306 fix (the unbounded AVX2 read in
+# `hex_decode_unchecked`; 0.3.0..=0.10.0 are affected); keep this requirement at
+# or above the fixed release so `cargo deny` / OSV stay green.
+faster-hex = "0.10.1"
 ipnet = "2"
 # 0.18.2+ carries the RUSTSEC-2026-0253 fix (0.16.x is affected); keep this
 # requirement at or above the fixed release so `cargo deny` / OSV stay green.
@@ -95,7 +112,7 @@ num-cmp = "0.1"
 # argon2id password hashing (password-hash/rand features are default-on).
 argon2 = "0.5"
 # bcrypt password hashing (pure-Rust, Blowfish-based).
-bcrypt = "0.16"
+bcrypt = "0.19"
 # PBKDF2-HMAC-SHA256 (RustCrypto) — pure-Rust KDF.
 pbkdf2 = "0.12"
 # sha2 is consumed ONLY by pbkdf2 (digest 0.10). Do NOT bump to 0.11: that
@@ -106,7 +123,14 @@ sha2 = "0.10"
 # HTML templating (fast, safe, no eval).
 minijinja = "2"
 # gzip via the memory-safe zlib-rs backend (pure Rust, no C).
-flate2 = { version = "1", default-features = false, features = ["zlib-rs"] }
+# `runtime_detection` is REQUIRED: flate2 1.1.10 moved `zlib-rs/std` (zlib-rs's
+# runtime CPU-feature detection, i.e. its SIMD dispatch) behind this opt-in
+# feature, which only `default` enables. Building with `default-features =
+# false` and `zlib-rs` alone silently drops to zlib-rs's scalar path — measured
+# 5.5x slower gzipCompress (16 MiB: ~2.2 s vs ~0.4 s in a debug build). Do NOT
+# remove it, and do NOT lower the version: 1.1.9 did not have the feature (it
+# hard-enabled `zlib-rs/std`).
+flate2 = { version = "1.1.10", default-features = false, features = ["zlib-rs", "runtime_detection"] }
 # brotli compression (pure Rust port).
 brotli = "8"
 

package/README.md

@@ -187,8 +187,11 @@ For coverage floors, the typecheck/test configs, and the full test matrix, see
 ## Publishing
 
 The package ships **all platform addons in a single tarball**. Push a `v*` tag
-and CI builds + publishes every platform to npm; or use `bun run release:manual`
-for a quick single-platform release:
+and `.github/workflows/release.yml` verifies the tag against
+`package.json`/`Cargo.toml`, runs the quality gates, builds every platform
+through the reusable `build-addons.yml`, publishes to npm with provenance, and
+attaches the same `.node` files + `SHA256SUMS` to a GitHub release. Or use
+`bun run release:manual` for a quick single-platform release:
 
 ```bash
 bun run release minor          # bump + verify + commit + tag (CI publishes)

package/docs/FFI_BUN_GUIDE.md

@@ -351,10 +351,14 @@ callbacks — keep it that way.
 These are not optional — they are what make the C-ABI surface safe on Bun (no
 napi-style unwind guard exists for raw `extern "C"`).
 
-1. **`panic_guard` every fallible/allocating core** (`std::panic::catch_unwind`
-   in `rust/ffi/`, `AssertUnwindSafe` for captured `&mut [u8]`). An uncaught
-   panic unwinding through `extern "C"` kills the whole Bun process — this is
-   what happened under `11-concurrent-burst`.
+1. **Guard every export body with `c_abi!`** (`rust/ffi/util.rs`, which wraps
+   `panic_guard` / `std::panic::catch_unwind`; `AssertUnwindSafe` for captured
+   `&mut [u8]`). An uncaught panic unwinding through `extern "C"` is undefined
+   behaviour and kills the whole Bun process — this is what happened under
+   `11-concurrent-burst`. Use `panic_guard` directly only for a sub-expression
+   that should fall back while the rest of the body continues. The
+   `every_c_abi_export_is_panic_guarded` test fails the build if a new
+   `#[no_mangle]` export has neither.
 2. **Bind-time self-test for EVERY new symbol** (`src/native/ffi/selfTest`).
    `bun:ffi` is experimental upstream; the self-test + napi fallback is the
    safety net. No symbol ships without a self-test vector.

package/docs/HOW_TO_ADD_AN_OP.md

@@ -84,9 +84,13 @@ mod tests {
 ## 2. Expose it over the C ABI (bun:ffi primary)
 
 Add the `#[no_mangle] extern "C"` export in `rust/ffi/<domain>.rs`. Every
-fallible / allocating export **must** route its core through `panic_guard`
-(defined in `rust/ffi/util.rs`) so an uncaught panic can't unwind through
-`extern "C"` and kill the process.
+export body **must** be wrapped in the `c_abi!(fallback, { ... })` macro
+(`rust/ffi/util.rs`), which runs it under `panic_guard`/`catch_unwind` so an
+uncaught panic can't unwind through `extern "C"` and kill the process. Use
+`panic_guard` directly only for a sub-expression that should fall back while the
+rest of the body continues. `ffi/tests.rs`'s
+`every_c_abi_export_is_panic_guarded` fails the build if a new export is
+unprotected.
 
 Rules (see `docs/FFI_BUN_GUIDE.md` for the full contract):
 - Keep signatures **scalar + `(ptr,len)`** — no struct-by-value, no variadics.
@@ -117,10 +121,9 @@ Rules (see `docs/FFI_BUN_GUIDE.md` for the full contract):
 #[no_mangle]
 pub unsafe extern "C" fn castrum_fnv1a64(data: *const u8, len: usize) -> u64 {
     if data.is_null() { return 0; }
-    panic_guard(
-        || crate::crypto::hashing::fnv1a64_bytes(std::slice::from_raw_parts(data, len)),
-        0,
-    )
+    c_abi!(0, {
+        crate::crypto::hashing::fnv1a64_bytes(std::slice::from_raw_parts(data, len))
+    })
 }
 ```
 
@@ -204,8 +207,8 @@ bun run bench:startup                       # if you touched the transport/loade
 ## Checklist
 
 - [ ] Pure-Rust core in the right domain folder with `#[cfg(test)] mod tests`
-- [ ] `#[no_mangle] extern "C"` export with `panic_guard` + null checks +
-      correct `u64_fast`/cstring ABI
+- [ ] `#[no_mangle] extern "C"` export with `c_abi!` + null checks + correct
+      `u64_fast`/cstring ABI
 - [ ] Symbol in the `ffi.ts` dlopen map + `BunFFI` interface method
 - [ ] Per-domain `selfTest*` vector in the same `ffi/build/*.ts` file
 - [ ] Public `rust.*` wrapper with JSDoc (+ `*Into` pooled variant if hot)

package/docs/REPO_MAP.md

@@ -291,12 +291,16 @@ consumed.
 
 - Package name `castrum` (unscoped, public). Native binary name `castrum`
   (declared in package.json `napi.binaryName` + Cargo.toml — keep in sync).
-- **Multi-platform (recommended)**: push a `v*` tag → `.github/workflows/ci.yml`
-  builds each platform addon, the `publish` job downloads them into
-  `./artifacts`, stages them, and runs `npm publish` (npm Trusted Publishing /
-  OIDC — preferred, no long-lived token; the job also targets the `NPM_TOKEN`
-  environment as a fallback secret. Needs the Trusted Publisher configured on
-  npmjs.com).
+- **Multi-platform (recommended)**: push a `v*` tag → `.github/workflows/release.yml`.
+  It verifies the tag matches `package.json`/`Cargo.toml`/`Cargo.lock`, runs
+  fmt/clippy/tests + the JS gates, then calls the reusable
+  `.github/workflows/build-addons.yml` (the same matrix CI uses) to build every
+  platform addon. The `publish` job downloads them into `./artifacts`, stages
+  them, and runs `npm publish` (npm Trusted Publishing / OIDC — preferred, no
+  long-lived token; the job also targets the `NPM_TOKEN` environment as a
+  fallback secret. Needs the Trusted Publisher configured on npmjs.com).
+  A final job creates the GitHub release with the `.node` files + `SHA256SUMS`.
+  CI itself no longer publishes (or runs on tags), so the two cannot race.
 - **Manual single-platform**: `bun run release:manual`
   (syncs package.json ↔ Cargo.toml ↔ CHANGELOG, tags, builds, publishes with
   `CASTRUM_PUBLISH_ALLOW_PARTIAL=1`). `--dry-run` plans only.