Rust dropped every KjOwn<T> as a kj::Own<void>. kj::Own<T>::~Own() hands the
disposer the address of the complete object (dynamic_cast<void*> for a
polymorphic T); kj::Own<void> passes the T subobject's address unchanged. When T
is a base at a nonzero offset of the object it points into (multiple
inheritance: RequestObserverWithTracer's WorkerInterface base, kj::NullStream's
AsyncOutputStream base), the object was deleted at the wrong address.

The cxx bridge now generates a per-type drop, as it does for UniquePtr<T>: a C++
function running kj::Own<T>::~Own() and a Rust OwnTarget implementation calling
it, for every T the bridge declares and holds in a KjOwn. A bridge that only
aliases a type asks its declaring bridge for the implementation with
`impl KjOwn<T> {}`. The primitive types a KjOwn may hold are implemented in
kj-rs itself.

The new own-test reproduces the miscomputed address with a two-base class
handed to Rust as a kj::Own of its second base.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

About 20% of automatic Bonk reviews hung until the 30-minute job
timeout and then posted "Bonk workflow was cancelled". opencode was
waiting on a permission prompt for a path outside the checkout, which
nothing can answer in CI. Separately, pushes after the first review
were never re-reviewed, and manual /bonk re-reviews started from
scratch each time.

Reliability:
- Deny reads outside the checkout instead of prompting.
- Give ask-bonk a 25-minute timeout, inside the job timeout, so a stuck
  run finishes on its own.
- Rename bigbonk.yml's workflow so it no longer shares Bonk's
  concurrency group and replaces its pending runs.

Re-reviews:
- Run ask-bonk from a SHA-pinned fork (danlapid/ask-bonk@4768a8b) until
  Cloudflare-Studio/ask-bonk#228 lands upstream.
- Review every push. Re-reviews see Bonk's previous review, its threads,
  and only the author's changes since then.
- Keep one Bonk summary comment per PR, edited in place on every
  review, with findings posted inline. Bonk replies to and resolves its
  own threads once they are fixed or declined.
- Start every review with a verdict line, and hand findings to ask-bonk
  instead of posting them from the model.

Review quality:
- Run specialist reviewers in parallel before the main review, which
  then acts as judge. .github/bonk/specialists/ adds workerd's own:
  security, memory and thread safety, API compatibility, compat flags,
  JSG/GC, KJ style, design simplicity and Rust-first.
- Tag findings by severity. Only blocking and warning findings go inline;
  the rest are listed in the summary.
- Raise the job timeout to 45 minutes to fit the specialists, and skip
  types/generated-snapshot/.

Cleanup:
- Use the opencode nightly (opencode_dev), and drop the version pin it
  overrode along with the weekly updater for that pin.
- Trigger on /bonk in review summaries, fetch full history for /bonk,
  review drafts once they are ready, and skip Dependabot PRs.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Tune Bonk from its first live reviews and from maintainer pushback, so
that a finding reads as "oh yeah, that's right" rather than noise.

- Keep the rules every review follows in one place,
  .github/bonk/specialists/SHARED.md: never report what CI checks
  (builds, lints, formatting, tests) or performance micro-costs, hold
  test code only to "can it pass while the code is broken, is it flaky",
  and mark hypothetical or follow-up issues info at most.
- Turn off the built-in performance specialist, and add workerd versions
  of the correctness, tests and docs specialists.
- Stop asking for compatibility flags where they are not needed: code
  behind $experimental flags, Node.js and spec conformance fixes,
  unobservable changes, and additive exports of import-only modules.
- Tighten specialist calibration from the first reviews: copyright
  headers only where siblings have them, compare with kj before
  flagging protocol deviations, test-only unsafety capped at info, and
  verify design suggestions before raising them.
- Drop the jokes and boilerplate from review summaries.
- Correct src/rust/AGENTS.md: a C++ exception through an infallible
  extern "C++" shim becomes a Rust panic, not an abort.
- Pin danlapid/ask-bonk@4f53fb3 (Cloudflare-Studio/ask-bonk#228), which
  fixes the pipeline issues those reviews exposed and adds SHARED.md and
  disabling built-in specialists.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>