I'm a bit worried this is applying RAII patterns to GC'd objects.

JSG promises don't have a notion of cancellation. If the promise never resolves, the attachment might just be held forever or might be destroyed during GC at an unpredictable time. It would be unsafe to attach any I/O objects in this way unless they are wrapped in IoOwn (and I believe the TraceContext objects you're attaching are I/O objects, so this is broken).

Could the attachment itself hold GC references? If so this creates cycles. There doesn't appear to be any mechanism to make the attachment visitable.