Own actor loopbacks at the runtime boundary

[MiguelsPizza]

Why

The pre-production review found that Rook's loopback shortcut treated hasCurrent() as caller identity. It is only lock state: during a facet → parent call, both actors can report a current lock, so the parent can run ungated inside the wrong transaction.

The runtime already knew the required three-way distinction—exact self-call, lock-holding continuation, or external entry—but only documented it. That left each host to reproduce gate policy using internals it could not fully access.

What changed

• Add ActorContainer.resolveLoopback() as the single owner of in-realm routing. Exact self-calls use the raw instance; cross-actor calls enter the target and resume through the exact current, transformed, or structurally supplied caller.
• Publish transformed continuation identity across separately bundled runtime copies, scoped to the captured lock's checkpoint.
• Use named { input, signal } options inside IoContext.run(); expose cancellation on entry() and run(), and remove abort listeners when waits settle.
• Reject failed blockConcurrencyWhile() calls with the same BrokenActorError that breaks and aborts the placement; export it and CanceledError from the package root.
• Check await-transform coverage against Rollup's final module graph, fail production builds on uncovered included awaits, and warn once per module when development reaches the fail-open path.
• Align the cloudflare-workers declaration path with its JavaScript entrypoint, verify the packed surface, and remove the ineffective WAL pragma from the single-connection SAH scheduler database.

The public entry(target) and run(event) calls remain source-compatible; their signals are optional. The intentional behavior change is that a failed blockConcurrencyWhile() now rejects a reachable same-realm caller instead of leaving it pending forever.

Validation

• 814 unit tests
• 145 conformance tests across workerd, Node, and Chromium
• root, conformance, and example typechecks
• both example builds and browser E2E suites
• publish build and package smoke test
• publint and Are The Types Wrong

Sources and follow-up

• Related investigation: pre-production runtime report
• Upstream semantics: workerd IoContext and io-context.h
• Platform contract: Cloudflare blockConcurrencyWhile() documentation
• Build verification hook: Rollup buildEnd
• Browser SQLite substrate: SQLite WASM persistence/VFS documentation

Rook can replace its private loopback predicate once this patch is released.