Scope membrane wrapper caches to each sandbox instance

[rafaeljbgomes]

Problem or use case

Forward and reverse membrane wrapper caches are currently module-scoped. When two sandbox instances receive the same mutable host object identity through permitted capability graphs, they can reuse one wrapper. The prototype therefore does not guarantee independent wrapper ownership in this shared-object scenario.

Proposed change

Move forward and reverse membrane cache ownership to the sandbox or Arena created by buildSandbox(). Ensure sandbox disposal releases the associated state.

Alternatives considered

Keeping module-scoped caches preserves broad reuse but couples independent QuickJS contexts. A globally keyed cache would retain the same ownership ambiguity. Per-sandbox caches match the documented one-context-per-library isolation model.

Security and compatibility impact

The change strengthens boundary independence for shared mutable host objects. It must preserve expected identity reuse within one sandbox and not expose new host capabilities.

Primary scope

QuickJS runtime, membrane, or marshalling.

Acceptance criteria

• Two sandbox instances receiving the same mutable host object receive distinct membrane wrappers.
• Calls through each wrapper remain bound to the owning sandbox/Arena.
• Existing repeated-reference behavior within a single sandbox is preserved.
• Disposal releases the corresponding per-sandbox membrane state.
• Focused regression coverage exercises two sandboxes and one shared host object.
• The canonical specification and cache-scope limitation documentation are updated.

Would you like to contribute an implementation?

Implementation contributions are welcome. Please include a narrow reproducer before changing cache ownership or lifecycle behavior.