[leehack]

Part of leehack/llamadart#1025 (0.19.10 plan leehack/llamadart#1995). Fixes #215 and #218. #216 (memory64 reason) and #217 (Safari GPU cap/probe) stay open.

Changes

• B1 (Fail fast with a typed error when the page is not cross-origin isolated #215): _ensureCore probes MessageChannel.postMessage(new WebAssembly.Memory({shared:true})) before loading a coreModuleUrl core. When it throws, the load rejects at once with CrossOriginIsolationError (code: 'CROSS_ORIGIN_ISOLATION_REQUIRED'), naming COOP/COEP require-corp and that credentialless does not isolate Safari. The error survives the worker protocol. It probes the post, not crossOriginIsolated, so Chrome with SharedArrayBuffer enabled by flag still loads.
• Opt-out: allowSingleThreadCore: true is for a core built without pthreads (WEBGPU_BRIDGE_PTHREADS=0). It loads on a non-isolated page, capped to one thread, with the threads_capped_no_coi note. A custom coreModuleFactory skips the gate, so a custom pthread core still waits for coreInitTimeoutMs (documented).
• B4 (Do not create or initialise the WebGPU backend when nGpuLayers is 0 #218): load_model_internal passes an empty devices list when n_gpu_layers == 0, so the model and context never get the WebGPU backend. splitMode: 3 (TENSOR) falls back to LAYER there, since the empty list has no device.
• GPU fallback note: a load with nGpuLayers > 0 that ends on the CPU adds gpu_unavailable:<reason> (no_webgpu, no_adapter, adapter_missing_shader_f16, unknown) and one warning. Chrome hides shader-f16 on NVIDIA drivers older than 615.71 and ggml-webgpu then registers no device.
• Public: CrossOriginIsolationError and allowSingleThreadCore exported/declared; docs/api.md and changelog updated.

Validation

Check	Result
npm run check:js	606 pass, 4 skipped (python-only), 0 fail
New tests	cross_origin_isolation_test.mjs, cpu_only_devices_native_test.mjs, gpu_unavailable_reason_test.mjs; each failed before its fix
Mutations	gate, isolated-page, worker code, 0-layer devices, opt-out, thread cap, cap note, TENSOR fallback, and 6 GPU-note mutations: all killed
state_persistence.mjs wasm32 and wasm64	ok

Browser (stories15M, 0 layers)	main	this PR
Chrome, not isolated	20.2 s timeout (two attempts at 10 s)	CrossOriginIsolationError at 0.09-0.16 s
Firefox 160, not isolated	20.3 s	0.24 s
Safari 27, not isolated	20.0 s	0.03 s
Firefox 160, isolated, direct and worker	10 tok/s	220-340 tok/s (WebGPU off: 225-330)
Chrome, isolated / 99 layers	works	works, WebGPU active
Pthread-off core, not isolated	loads	rejects; loads, 1 thread, with allowSingleThreadCore
splitMode: 3 at 0 layers	loads	loads

Audits (local evidence): first audit at 515582e and delta re-audit at efbf0ae, both no-block, in llamadart-evidence/bridge-pr-219/ and llamadart-evidence/bridge-pr-219/delta-efbf0aea/.