feat(native): adopt Myna binding ABI 2 and refresh toolchains

.elide-version

@@ -1 +1 @@
-1.6.1
+1.6.2

.github/actions/setup/action.yml

@@ -26,6 +26,19 @@ runs:
       with:
         version: ${{ steps.versions.outputs.elide }}
         channel: release
+    - name: Preserve the native compiler for direct Cargo commands
+      shell: bash
+      run: |
+        python3 - <<'PY'
+        import os, sys
+        sys.path.insert(0, "tools")
+        import native_tools
+        previous = os.environ["PATH"]
+        native_tools.configure()
+        if os.environ["PATH"] != previous:
+          with open(os.environ["GITHUB_PATH"], "a") as output:
+            output.write(os.environ["PATH"].split(os.pathsep)[0] + "\n")
+        PY
     - name: Bootstrap Rust from the repository toolchain pin
       shell: bash
       run: |

.github/workflows/job.build.yml

@@ -26,7 +26,7 @@ jobs:
         run: python3 -c 'import json; print("version=" + json.load(open("tools/versions.json"))["llvm"]["toolchain_version"])' >> "$GITHUB_OUTPUT"
       - name: Install Elide native toolchain
         id: native-toolchain
-        uses: elide-dev/toolchain/action@171eb7cde379e17822e042cfbda26c9740c10b03
+        uses: elide-dev/toolchain/action@4677dd77b520b609bb0e548e6e7a4dadadbb2d14
         with:
           version: ${{ steps.native-version.outputs.version }}
           target: ${{ runner.os == 'Linux' && 'x86_64-unknown-linux-gnu' || 'arm64-apple-darwin' }}

docs/generated-seam.md

@@ -20,10 +20,10 @@ make test
 make test-native-image
 ```
 
-The build pins Myna 0.6.0 and Elide 1.6.1 in `tools/versions.json`.
+The build pins Myna 0.8.0 and Elide 1.6.2 in `tools/versions.json`.
 `make test-native-image` provisions the checksummed GraalVM
-`25.5.5-elide.21` distribution matching the SDK dependencies. The SDK artifacts
-come from `https://maven.elide.dev/gvm-elide/25.5.5-elide.21`; Native Image
+`25.5.5-elide.24` distribution matching the SDK dependencies. The SDK artifacts
+come from `https://maven.elide.dev/gvm-elide/25.5.5-elide.24`; Native Image
 consumers must configure this Maven repository. API and FFM artifacts remain
 independent of GraalVM.
 It compiles only the dependency-free generator CLI’s tracked sources through
@@ -45,6 +45,34 @@ supported seam targets have the same scalar widths and record layouts.
 Native classifiers carry the actual target's `seam.json`, `seam.abi`, and
 `seam.ll`. This keeps common Java JARs identical across platform builds.
 
+## Binding ABI 2 call audit
+
+Myna's binding ABI is 2; Bemo's public transport protocol stays at ABI 3.
+Every import declares its call policy explicitly, so new imports cannot silently
+inherit Myna's leaf default. Twelve imports use generated typed function pointers
+and relocated symbols:
+
+- ABI versions and capabilities return constants; allocation accounting reads one atomic.
+- Last-error access reads and clears a constant-initialized thread-local cell.
+- HTTP method, version, header count, keep-alive, and view read a live exchange
+  lease without registry locks or allocation. Spans copies at most 404 integers,
+  bounded by the HTTP/1 and HTTP/2 parsers' 100-header limit.
+- Helper-token capture reads thread-local state and retains one atomic reference.
+
+Helper-token release uses a normal transition because its retirement CAS loop can
+retry under contention. Allocation, cleanup, registry operations, I/O, TLS,
+callbacks, and other unreviewed operations also retain normal transitions. No new
+LLVM memory-effect promises are made. FFM uses critical downcalls without heap
+access for the corresponding bounded metadata operations; its existing TLS heap
+adapters retain their separate contracts.
+
+The Native Image module compiles against three distribution jars (`svm-shared`,
+`svm-guest-staging`, and `svm-guest`) without packaging them or adding them to the
+application runtime classpath. Generated `META-INF/native-image` metadata travels
+with the classes and JAR; it exports the compiler API and separates build-time
+symbol metadata from runtime pointer-holder initialization. Native Image consumers
+must use the matching Elide Graal distribution. API and FFM need none of these jars.
+
 ## Bitcode archive variant
 
 ```sh
@@ -76,8 +104,8 @@ Use compatible LLVM tools for building, application, and final linkage.
 on `PATH` (for example, Homebrew's separately installed LLD).
 The build requires matching LLVM majors between Rust and the native toolchain,
 and exact pinned versions for Clang, LLD, and LLVM helper libraries. Package CI
-uses the commit-pinned `elide-dev/toolchain/action` with release `2026.10.0`
-(LLVM 23.1.2). The action verifies bundle checksums and supplies target compiler,
+uses the commit-pinned `elide-dev/toolchain/action` with release `2026.11.1`
+(LLVM 23.1.4). The action verifies bundle checksums and supplies target compiler,
 linker, and SDK settings. Its native library archives also carry ThinLTO
 bitcode. `tools/setup_llvm.py` can provision the same release locally using
 the SHA-256 digests in `tools/versions.json`. Activate the bundle’s target

mise.toml

@@ -1,7 +1,7 @@
 min_version = "2026.8.3"
 
 [tools]
-"github:elide-dev/elide" = "1.6.1"
+"github:elide-dev/elide" = "1.6.2"
 java = "openjdk-25.0.2"
 "aqua:EmbarkStudios/cargo-deny" = "0.20.2"
 hk = "1.55.0"

packages/ffm/src/main/java/dev/elide/bemo/ffm/FfmTransportNative.java

@@ -38,12 +38,14 @@ public FfmTransportNative(Path library) {
       version =
           linker.downcallHandle(
               symbols.find("bemo_abi_version").orElseThrow(),
-              FunctionDescriptor.of(ValueLayout.JAVA_INT));
+              FunctionDescriptor.of(ValueLayout.JAVA_INT),
+              Linker.Option.critical(false));
       requireCompatible();
       capabilities =
           linker.downcallHandle(
               symbols.find("bemo_capabilities").orElseThrow(),
-              FunctionDescriptor.of(ValueLayout.JAVA_LONG));
+              FunctionDescriptor.of(ValueLayout.JAVA_LONG),
+              Linker.Option.critical(false));
     } catch (Throwable failure) {
       arena.close();
       throw failure;

packages/ffm/src/main/java/dev/elide/bemo/transport/FfmTransportNative.java

@@ -833,10 +833,26 @@ public FfmTransportNative(Path library) {
 
   private static MethodHandle bind(
       SymbolLookup symbols, String name, ValueLayout result, ValueLayout... args) {
+    // Match the bounded, nonblocking imports audited in seams/bemo.seam.
+    boolean leaf =
+        switch (name) {
+          case "abi_version",
+              "last_error",
+              "serving_helper_prepare",
+              "http_method",
+              "http_version",
+              "http_header_count",
+              "http_keep_alive",
+              "http_view",
+              "http_spans" ->
+              true;
+          default -> false;
+        };
     return Linker.nativeLinker()
         .downcallHandle(
             symbols.find("elide_transport_" + name).orElseThrow(),
-            FunctionDescriptor.of(result, args));
+            FunctionDescriptor.of(result, args),
+            leaf ? new Linker.Option[] {Linker.Option.critical(false)} : new Linker.Option[0]);
   }
 
   @Override