Embedding: poll VM-wide termination at execution checkpoints

[chrisbbreuer]

Parents: #495, #493. Related: #908, #896, #474.

Measured boundary

During #908 validation on macOS arm64 with Zig 0.17.0-dev.1441, an independent C host linked to the current Debug private/public archive:

1. Creates a JSGlobalContextCreate realm and obtains its VM.
2. Calls JSC__VM__notifyNeedTermination(vm).
3. Evaluates let total=0; for(let i=0;i<10000;i++) total+=i; total.

Observed output:

requested=1 result=value exception=null number=49995000

The request is set, but the script crosses many engine checkpoints and returns success. This is a measured lost termination boundary, not a sanitizer race report. The tested candidate is based on 8d7a3b7a with #908 exception-slot ownership changes; the termination/checkpoint sources were unchanged. No introducing revision has been attributed.

Source finding

• privateExecutionWatchdog publishes group.termination_requested and calls group.primary.requestTermination().
• JSGlobalContextCreateInGroup installs the shared termination_request_flag in each sibling.
• Each sibling Interpreter's stop_flag points to its own Context's stop flag/teardown_stop.
• Interpreter.serviceVmTraps writes the shared request when a watchdog or shell trap fires, but never reads an already-published VM termination request. The tree walker and VM poll the realm-local stop flag.

The Home native fixture's watchdog test only requires an exception plus the VM's request bit. It never checks that the exception is termination rather than RangeError: evaluation step budget exceeded. The TSan fixture spent minutes inside the unbounded VM loop while watchdog threads slept, then reported success. A sampled stack is consistent with the fallback budget ending the loop; the standalone probe above supplies the direct functional evidence.

Required work

• Poll VM-owned termination consistently at existing tree-walker, VM, quickened, and native checkpoint boundaries without conflating it with permanent Context teardown.
• Preserve clear/rearm semantics, sibling isolation for realm-only teardown, VM-wide termination, and first pending exception ownership.
• Make the native watchdog witness distinguish termination from budget exhaustion; do not lower the workload/budget, add retries/sleeps, or accept a different exception as evidence.
• Add deterministic already-requested and asynchronous host-request witnesses, including a cleared request and sibling realms, across relevant execution tiers.
• Verify Debug, ReleaseSafe, suppression-free TSan, private ABI fixtures, and full units.