test(binding): validate native addon coverage on Linux (spike)

.changepacks/changepack_log_binding_argument_validation.json

@@ -0,0 +1,7 @@
+{
+  "changes": {
+    "bindings/devup-ui-wasm/package.json": "Patch"
+  },
+  "note": "Validate native and WASM compiler binding arguments with matching TypeErrors before state changes, preserve existing user exceptions and seed-array observations, and use the performance-accepted extraction wrappers. Invalid binding arguments now report the function, parameter and required type; located source build errors are unchanged.",
+  "date": "2026-10-27T00:00:00.000Z"
+}

.changepacks/changepack_log_binding_entries_length.json

@@ -0,0 +1,7 @@
+{
+  "changes": {
+    "bindings/devup-ui-wasm/package.json": "Patch"
+  },
+  "note": "Batch native entries and snapshot-length access, stream WASM file maps without trusting allocation hints, and reject seed copies with unvalidated trailing holes before either engine runs. Malformed seed headers now use the existing canonical TypeError; no new source build errors. Separately fix target-dependent demanded-name resolver callback order in the shared extractor: native and WASM now resolve demanded local names lexically while preserving pass order and callback multiplicity.",
+  "date": "2026-10-27T00:00:00.000Z"
+}

.changepacks/changepack_log_native_binding.json

@@ -0,0 +1,7 @@
+{
+  "changes": {
+    "bindings/devup-ui-wasm/package.json": "Patch"
+  },
+  "note": "Exercise the production native adapter in the root Rust coverage report without preparation for plain Cargo tests, and deterministically order namespace resolver traversal and changed-constant diagnostics. Reduce native per-call control costs while preserving callbacks and public outputs; prevent private Number coercions, global String use for BigInts, Array.from use for byte diagnostics, and incorrect Symbol.iterator exception conversion. No newly rejected source or styling runtime.",
+  "date": "2026-10-28T00:00:00.000Z"
+}

.changepacks/changepack_log_portable_binding_state.json

@@ -0,0 +1,8 @@
+{
+  "changes": {
+    "bindings/devup-ui-wasm/package.json": "Patch",
+    "packages/components/package.json": "Patch"
+  },
+  "note": "Canonicalize complete exported property records, use portable content keyframe identities and short debug keyframe counters, and advance atomNamingVersion to 3. No new build errors.",
+  "date": "2026-10-20T00:00:00.000Z"
+}

.github/workflows/W74a-binding-coverage-spike.yml

@@ -0,0 +1,90 @@
+name: W74a native coverage SPIKE
+
+# Replace/remove this SPIKE workflow before the binding PR leaves Draft.
+on:
+  push:
+    branches: [feat/napi-binding]
+    paths:
+      - 'e2e/binding/coverage-spike/**'
+      - '.github/workflows/W74a-binding-coverage-spike.yml'
+  pull_request:
+    branches: [fix/portable-binding-state]
+    paths:
+      - 'e2e/binding/coverage-spike/**'
+      - '.github/workflows/W74a-binding-coverage-spike.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  scratch-controls:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    env:
+      CARGO_BUILD_JOBS: '2'
+      CARGO_TERM_COLOR: never
+    defaults:
+      run:
+        shell: bash
+        working-directory: e2e/binding/coverage-spike
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Prepare private evidence directory
+        run: |
+          echo "W74A_EVIDENCE=$RUNNER_TEMP/W74a-evidence" >> "$GITHUB_ENV"
+          mkdir -p "$RUNNER_TEMP/W74a-evidence"
+      - uses: actions/setup-node@v7
+        with:
+          node-version: latest
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - uses: actions-rust-lang/setup-rust-toolchain@v2
+        with:
+          toolchain: stable
+          components: rustfmt, clippy
+          cache: false
+          rustflags: ''
+      - name: Resolve latest official GNU x64 tarpaulin release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          mkdir -p "$W74A_EVIDENCE" "$RUNNER_TEMP/W74a-tools"
+          gh api repos/xd009642/tarpaulin/releases/latest > "$W74A_EVIDENCE/tarpaulin-release.json"
+          tag=$(node -p "JSON.parse(require('node:fs').readFileSync(process.env.W74A_EVIDENCE + '/tarpaulin-release.json')).tag_name")
+          asset=cargo-tarpaulin-x86_64-unknown-linux-gnu.tar.gz
+          gh release download "$tag" --repo xd009642/tarpaulin --pattern "$asset" --dir "$W74A_EVIDENCE"
+          node --input-type=module <<'NODE'
+          import assert from 'node:assert/strict'
+          import { createHash } from 'node:crypto'
+          import { readFileSync, writeFileSync } from 'node:fs'
+          const root = process.env.W74A_EVIDENCE
+          const release = JSON.parse(readFileSync(`${root}/tarpaulin-release.json`))
+          const asset = release.assets.find(({ name }) => name === 'cargo-tarpaulin-x86_64-unknown-linux-gnu.tar.gz')
+          assert.ok(asset)
+          const digest = 'sha256:' + createHash('sha256').update(readFileSync(`${root}/${asset.name}`)).digest('hex')
+          assert.equal(digest, asset.digest, 'Official asset digest mismatch')
+          writeFileSync(`${root}/tarpaulin-asset.json`, JSON.stringify({ tag: release.tag_name, name: asset.name, digest }, null, 2))
+          NODE
+          tar -xzf "$W74A_EVIDENCE/$asset" -C "$RUNNER_TEMP/W74a-tools"
+          echo "$RUNNER_TEMP/W74a-tools" >> "$GITHUB_PATH"
+      - name: Record resolved tools and runner
+        run: |
+          printf '%s\n' "$GITHUB_SHA" "$GITHUB_REF" "$GITHUB_RUN_ID" "$GITHUB_RUN_ATTEMPT" > "$W74A_EVIDENCE/source-run.txt"
+          { uname -a; printf '%s\n' "$ImageOS" "$ImageVersion"; rustc +stable -Vv; cargo +stable -V; cargo +stable tarpaulin --version; node --version; bun --version; } 2>&1 | tee "$W74A_EVIDENCE/versions.log"
+      - name: Scratch source formatting and strict clippy
+        run: |
+          cargo +stable fmt --all -- --check 2>&1 | tee "$W74A_EVIDENCE/fmt.log"
+          cargo +stable clippy --locked --workspace --all-targets --all-features --target-dir "$RUNNER_TEMP/W74a-clippy-target" --jobs 2 -- -D warnings 2>&1 | tee "$W74A_EVIDENCE/clippy.log"
+      - name: Serial Node coverage controls and direct Bun addon execution
+        run: node run.mjs "$W74A_EVIDENCE" 2>&1 | tee "$W74A_EVIDENCE/runner.log"
+      - name: Preserve raw SPIKE evidence even on failure
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: W74a-native-coverage-SPIKE-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/W74a-evidence
+          retention-days: 30
+          if-no-files-found: warn

Cargo.toml

@@ -1,6 +1,6 @@
 [workspace]
 resolver = "2"
-members = ["libs/extractor", "bindings/devup-ui-wasm", "libs/sheet", "libs/css"]
+members = ["libs/extractor", "bindings/devup-ui-wasm", "libs/sheet", "libs/css", "libs/binding", "bindings/devup-ui-binding"]
 
 [workspace.lints.rust]
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(tarpaulin_include)'] }
@@ -59,3 +59,7 @@ codegen-units = 1
 strip = true
 # Abort on panic: smaller binary, no unwinding overhead
 panic = "abort"
+
+[profile.native]
+inherits = "release"
+opt-level = 3