fix(rivetkit): isolate engine envoys and propagate startup failures

[NathanFlurry]

Description

Please include a summary of the changes and the related issue. Please also include relevant motivation and context.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[NathanFlurry]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• chore(engine): publish engine bases in ci #4649 : 3 dependent PRs (#4650 , #4652 , #4659 )
• chore: lockfile lefthook #4647
• fix(rivetkit): surface native sqlite kv errors to callers #4645
• fix(rivetkit): prevent sleep races during disconnect and db work #4644
• fix(rivetkit): isolate engine envoys and propagate startup failures #4643 👈 (View in Graphite)
• test(rivetkit): remove wasm sqlite-only fixtures and coverage #4642
• chore(sqlite-vfs): remove wasm sqlite packages and workspace wiring #4641
• chore(rivetkit): remove wasm sqlite runtime #4614
• fix(sqlite-native): restore native startup kv preload #4639
• fix(sqlite-native): delete metadata before chunk range #4638
• fix(sqlite-native): keep truncate cache coherent #4637
• fix(sqlite-vfs): use delete range for truncate cleanup #4636
• fix(sqlite-native): restore kv error hook #4635
• perf(sqlite-native): avoid cloning cached read chunks #4634
• perf(sqlite-native): gate kv operation labels #4633
• perf(sqlite-native): reuse read cache for partial writes #4632
• perf(sqlite-native): remove delete file existence probe #4631
• fix(sqlite-native): gate native read cache behind env var #4630
• fix(pegboard): isolate runner config dc lookup failures #4625 : 1 other dependent PR (#4626 )
• docs(pegboard): note runner config upsert split write risk #4624
• fix(pegboard): unpack global runner config keys correctly #4623
• fix(pegboard-gateway): enforce tunnel message state #4622
• fix(pegboard-runner): clear terminal tunnel routes #4621
• fix(pegboard): skip protocol version keys in runner pool backfill #4620
• fix(pegboard): create missing normal runner configs #4619
• fix(epoxy): reuse cached optimistic value #4618
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[claude]

PR Review: fix(rivetkit): isolate engine envoys and propagate startup failures

Two focused fixes: isolated per-driver-instance envoys (notGlobal: true) and proper startup failure propagation across all three layers (Rust, NAPI bridge, TypeScript).

What the PR does

1. Envoy isolation (notGlobal: true): Each EngineActorDriver instance now creates its own envoy instead of sharing the process-wide global singleton. Prevents state cross-contamination when multiple driver instances coexist.

2. Startup failure propagation: handle.started() previously returned () and silently swallowed RecvError (sender dropped = background task exited before signaling startup). The error now flows correctly through all three layers.

Layer-by-layer analysis

handle.rs: Core fix is correct. watch::Receiver::changed() returns Err(RecvError) only when all senders are dropped, which happens exactly when the background envoy task exits before sending the startup signal. The previous let _ = changed().await discarded this. The new anyhow::Result<()> return is the right shape.

envoy.rs: start_envoy uses .expect() rather than returning Result<EnvoyHandle>. This is a process-level panic on startup failure. If a failed envoy start is always fatal (which appears to be the case at current callsites), the panic is defensible and the message is clear. A comment noting the intentional panic would help future readers.

envoy_handle.rs (NAPI bridge): The two-level map_err chain is now correct. Previously the inner .map_err was mapping () from started() -> (), making it a dead no-op on JoinError. It now correctly converts the inner anyhow::Error from started() -> anyhow::Result<()>.

actor-driver.ts: The previous .then(onFulfilled) with no rejection handler left #envoyStarted permanently pending on failure. The new .then(resolve, reject) correctly handles both paths.

Potential issues

• Envoy cleanup on driver destroy: notGlobal: true allocates a new envoy per driver instance. Confirm the envoy is shut down when the driver is destroyed (e.g., in a destroy/dispose lifecycle) to avoid goroutine/thread leaks in long-running processes that create many driver instances.

• Fake channel in actor.rs: Line 120 creates an EnvoyHandle with tokio::sync::watch::channel(()).1 -- a receiver from a channel whose sender is immediately dropped. Calling started().await on this handle would immediately return Err(RecvError). The comment 'Fake channel, don't care' suggests this is intentional, but it is a landmine if new code calls started() on actor-context handles after this signature change.

• No tests added: A test verifying that a startup failure surfaces as a rejected promise on the TypeScript side (rather than hanging indefinitely) would validate the propagation chain end-to-end.

Minor

• PR description and checklist are empty -- worth filling in before merge for traceability.

Summary

The changes are correct and fix real, silent failure modes. The main open question is envoy cleanup on driver destroy to avoid leaks with the new per-instance envoy allocation.