Found by the 2026-08-19 merged-PR audit (exposed by the #4348 review). Preventive hardening — no field occurrences observed to date.
Any Rust panic inside the FFI layer currently propagates to the extern "C" boundary and hard-aborts the process (SIGABRT on Android) with no Java exception and no usable telemetry — the JNI guard cannot intercept a panic-unwind. On a large, growing Rust surface this turns any future logic bug into an undiagnosable native crash instead of a reportable error.
A complete fix exists on branch fix/ffi-panic-unwind-guard (former PR #4424, closed to keep the open-PR queue focused on migration-critical work): panics caught before the abort shim; fallible guarded runtime init via a zero-sized RuntimeHandle + runtime_checked(); an FFI-local FfiOutcome/GuardedError carrier (no Display, so payloads cannot leak into user-facing strings — the no-Display trick surfaced 7 additional leak sites, all fixed); InternalPanic kept out of the public error enum; reservation release via lifecycle_gate_or_release so a panicking operation cannot strand reserved inputs.
Open review items to pick up on reopen (round-4 gate suggestions, all classification-level): return the local txid on an unknown panic outcome; keep the reservation recoverable when abandon itself panics; don't cache transient runtime-construction failures for the process lifetime; label runtime-construction failures distinctly from operation panics; don't classify cancelled workers as internal panics.
Found by the 2026-08-19 merged-PR audit (exposed by the #4348 review). Preventive hardening — no field occurrences observed to date.
Any Rust panic inside the FFI layer currently propagates to the
extern "C"boundary and hard-aborts the process (SIGABRT on Android) with no Java exception and no usable telemetry — the JNI guard cannot intercept a panic-unwind. On a large, growing Rust surface this turns any future logic bug into an undiagnosable native crash instead of a reportable error.A complete fix exists on branch
fix/ffi-panic-unwind-guard(former PR #4424, closed to keep the open-PR queue focused on migration-critical work): panics caught before the abort shim; fallible guarded runtime init via a zero-sizedRuntimeHandle+runtime_checked(); an FFI-localFfiOutcome/GuardedErrorcarrier (noDisplay, so payloads cannot leak into user-facing strings — the no-Display trick surfaced 7 additional leak sites, all fixed);InternalPanickept out of the public error enum; reservation release vialifecycle_gate_or_releaseso a panicking operation cannot strand reserved inputs.Open review items to pick up on reopen (round-4 gate suggestions, all classification-level): return the local txid on an unknown panic outcome; keep the reservation recoverable when
abandonitself panics; don't cache transient runtime-construction failures for the process lifetime; label runtime-construction failures distinctly from operation panics; don't classify cancelled workers as internal panics.