When a guest calls swactor.send() then traps, the outbox entries from
the incomplete operation survived and leaked into the next successful
handle() call, delivering messages from a failed context. Now clears
the outbox on trap, consistent with the "drop everything from failed
operations" semantics.
Authored by Claude, lovingly guided by Zachery Aaron Shores-Chmielewski
When a guest calls swactor.send then traps, the outbox entry survives
and leaks into the next successful handle() call. The outbox should be
cleared when handle traps, since the guest's operation was incomplete.
Also adds: invalid WASM bytes test, zero-length payload send test,
multiple sequential traps test (all passing).
Authored by Claude, lovingly guided by Zachery Aaron Shores-Chmielewski
StopSignal interception in tick_all set stopping=true but did not push
to the deaths vector, so phase 5b watch notifications never fired for
externally-stopped actors (via rt.stop_actor()). Now pushes
(addr, ExitReason::Stopped) to deaths, consistent with the
ctx.stop_self() path.
Authored by Claude, lovingly guided by Zachery Aaron Shores-Chmielewski
Native watcher watching a WASM actor does not receive ActorExited when
the target is stopped via rt.stop_actor(). Root cause: StopSignal
interception in tick_all (worker.rs:734) sets stopping=true but does
not push to the deaths vector, so phase 5b watch notifications never
fire for externally-stopped actors.
Also adds P0-2 through P1-7 test scenarios (all passing):
- empty message, oversized message, allocator exhaustion
- nonexistent address send, wrong export signature/name
- graceful stop, negative payload_len, independent stores
- WASM-to-WASM relay
Authored by Claude, lovingly guided by Zachery Aaron Shores-Chmielewski
Guest alloc could return a pointer where ptr+len exceeds linear memory
size, causing a Rust panic that permanently poisoned the actor. Now
validates ptr+len <= memory.len() before writing, dropping the message
on OOB (consistent with other allocation failure handling).
Authored by Claude, lovingly guided by Zachery Aaron Shores-Chmielewski
Guest alloc returning a pointer near the end of linear memory
(ptr + msg_len > memory_size) causes a Rust panic in copy_from_slice,
which poisons the actor permanently instead of dropping the message
and keeping the actor alive.
Authored by Claude, lovingly guided by Zachery Aaron Shores-Chmielewski
