fix(sidecar): release kernel socket slots when guest sockets close

[NathanFlurry]

Closed guest loopback sockets never released their kernel socket-table slots
until process exit (measured: vm_sockets highWater 81 for a workload whose
true concurrency is ~9), so connection-churning guests hit EAGAIN 'maximum
socket count reached' at ~250 cumulative sockets.

• Bridge: natural FIN close finalization now releases the sidecar/kernel
  handle (idempotent, once), deferred until JS readable buffers drain so
  buffered data is never dropped.
• Sidecar: net.poll close handling closes the underlying TCP/Unix handle when
  removing map entries; explicit close paths funnel through an idempotent
  kernel close (ENOENT tolerated); the TLS-mode close path no longer skips
  kernel close for kernel-backed sockets.
• Guest fetch() now uses a bounded per-call undici dispatcher instead of the
  process singleton whose pooled clients went stale against released sockets
  and hung (also fixes a pre-existing hang: repeated fetch over a kept-alive
  loopback connection). Revisit pooling when host->guest socket event push
  (perf: push socket events host→guest instead of guest wait=0 polling #178) lands.
• Regression test: guest churns 3x max_sockets connections with closes.

Full net family at 30 iterations passes (previously EAGAIN at tcp_concurrent_4):
fetch 2.59ms, tcp_echo 3.57ms, tcp_concurrent_4 4.91ms guest p50; leak probe
highWater 81 -> 17 with depth returning to 0.

[NathanFlurry]

Stack for rivet-dev/secure-exec

• fix(browser): cover raw fs bridge globals and regenerate the wasi polyfill #197 yxplzzou · 2026-07-02 10:02:17
• fix(sidecar): release kernel socket slots when guest sockets close #196 pympklxu · 2026-07-02 10:00:53 👈
• main

Get stack: forklift get 196
Push local edits: forklift submit
Merge when ready: forklift merge 196