Confine restricted engines before launch and preserve the reader recovery baseline

restricted-execution/service.test.mjs

@@ -50,7 +50,16 @@ async function fixture(source, options = {}) {
     }
   };
   const service = await serveRestrictedRegistry(
-    { workerd, worker, module, registryExport: "registry", exports: ["test"], sdk: [], ...options },
+    {
+      workerd,
+      worker,
+      module,
+      sandbox: process.env.QUIXOS_TEST_SANDBOX,
+      registryExport: "registry",
+      exports: ["test"],
+      sdk: [],
+      ...options,
+    },
     io,
   );
   assert.deepEqual(await receive(), { abi, kind: "ready", exports: ["test"] });
@@ -86,6 +95,27 @@ async function fixture(source, options = {}) {
 }
 const registry = (code) => `export const registry={exports:['test'],async invoke(request,channel){${code}}};`;
 
+test("uncertain OS cleanup cannot release engine capacity", async () => {
+  const budget = new RestrictedEngineBudget(1, async () => ({
+    async release() {
+      throw Error("kernel cleanup not confirmed");
+    },
+  }));
+  const release = await budget.acquire(
+    () => false,
+    async () => {},
+  );
+  await assert.rejects(release(), /cleanup not confirmed/);
+  assert.equal(budget.stats().engines, 1);
+  await assert.rejects(
+    budget.acquire(
+      () => false,
+      async () => {},
+    ),
+    { code: "RESTRICTED_ENGINE_LIMIT" },
+  );
+});
+
 test("parallel frames route independently and cancellation cannot retire a neighbor", async () => {
   const f = await fixture(
     registry("return await channel({portId:'read',action:{kind:'state',primitive:'read'},input:request.input});"),