Design: script-to-C FFI, tape-first (ext_ffi + sqlite3 as the forcing binding) — blocked until a consumer forces it

[InauguralPhysicist]

Why file it now. The design constraint must be on record before anyone (including future-us) builds the tempting version: an UNTRACED FFI would be the first hole in the deterministic-replay guarantee — every un-taped foreign call makes EIGS_REPLAY silently lie. Worse than absent. When FFI arrives, tape participation is the definition, not a feature.

Design (accepted in principle).

• ffi_open / ffi_call over dlopen, explicit signature strings restricted to the actual value model (num / str / buffer) — no automatic header binding, no general marshaling.
• EVERY foreign call's result recorded as a tape nondet input, so replay works without the C library present, on a different machine — replayable interop, which no incumbent language has (their FFI calls are unrecordable black holes).
• Lives in the opt-in full build like http/db; builtins-not-syntax keeps the language surface frozen.
• First and only initial binding: sqlite3 — it simultaneously covers the "additional DB drivers" roadmap item and is the classic embeddable forcing function.

Status: BLOCKED on a consumer actually needing it (the forcing-function rule — no speculative implementation). When a consumer repo hits the wall, this design is ready.

Effort when unblocked: weeks. Source: 2026-07-04 survey (embedding dimension).