[congwang-mk]

Supersedes #337. Its chroot unix socket fix is the first commit here unchanged; the rest replaces its off-loop dispatch with a smaller model.

Problem

Supervised connects, FFI callbacks and chroot/COW filesystem handlers ran on the notification loop, so one slow peer, callback or copy stalled every trapped syscall in the sandbox. The existing escape hatch, NotifAction::Defer, made a terminal decision: its Continue skipped later handlers, it was refused on fork and exec, and it failed with EAGAIN past a fixed cap.

Design

• Park replaces Defer and resumes where it was returned. A parked handler's Continue runs the next handler; any other result ends the chain. The outcome then takes the same path as an inline decision (pinned opens, fork accounting, policy event, argv freeze), so parking on fork or exec is safe. All parks of a notification share one deadline.
• No admission failures. Each trapped task has at most one outstanding notification, so parked work is already bounded by the task count. Synchronous work runs as NotifAction::native(lane, closure) in per-sandbox lane slots (Local for filesystem work, External for peers and callbacks) on a process-wide runtime kept apart from the embedder's. A full lane queues; it never returns EAGAIN.
• Child-memory writes are ordered against exec at the write itself. write_child_mem and write_child_mem_force hold the shared side of a per-sandbox gate for each write made by parked work; the exec freeze holds the exclusive side until the kernel has copied argv. Exec waits microseconds instead of failing, and no call site has to remember a guard.
• Fork accounting runs once the chain settles on Continue, so no handler can park a fork after it was counted, and a failed response rolls the slot back.
• Chroot and COW handlers are synchronous functions parked on the local lane. A native closure runs to completion, so a COW copy keeps main's copy-outside-the-lock shape and its bookkeeping always runs. A failed pre-copy now fails the write with EIO instead of continuing onto the lower file.
• The listener stays open until the last native closure using its fd number returns.
• Every FFI callback is native External work. sandlock_handler_set_deferred is removed (pre-1.0 hard break). A per-handler run guard waits for running callbacks before the FFI run returns, and callbacks still queued fail with EIO instead of touching freed userdata. Python handlers, sync or async, run off the loop with no flag.

Behavior changes

• A parked or async handler that returns Continue now hands the syscall to the next handler instead of ending the chain.
• An FFI run waits for running callbacks before returning; a callback that never returns prevents the run from completing.
• sandlock_handler_set_deferred is gone from the C ABI and the Python SDK.

Not measured

Every chroot and COW syscall now takes a hop to a worker thread and back to the loop. Hot-path latency for chroot open/stat has not been benchmarked.

Test plan

• CI run 41534869770 green on all 25 jobs (Rust tests, feature matrix, low-ABI, musl, riscv64 cross-build, cbindgen header, Python, Go)
• New unit tests: chain resume and termination after a park, park deadline and nesting, lane queueing and abandoned-work slot retention, gate exclusion, FFI run guard drain and queued-callback EIO
• Python e2e: an async handler's continue_() reaches the next handler on the syscall

🤖 Generated with Claude Code