findings(E-10..E-22): fix the defects a code review found in the E-1..E-9 work

[matejcsok-pcb]

A code review of the group-E fixes (E-1..E-9, landed 2026-08-19) found 13 further defects. Ten were introduced by those fixes, two pre-existed and were only relocated, one is deferred. Sibling PRs: wxWidgets#5, kicad-source-mirror#9, pcbjam-private.

Services / transport

E-10 — Run died for the whole session after a worker death. retireWorker synthesized no bg/exit frame, so sharedspice's s_bgRunning mirror stayed latched true: ENABLE(!simRunning) kept Run disabled and the promised fresh-worker restart was unreachable. Retirement now dispatches a synthetic controlled-exit straight to the installed handler — never through dispatchEvt, since a fabricated frame must not touch the credit ledger.

Driving that repro end to end exposed two further defects, both fixed here: a replacement worker trapped on pre-init engine reads, and the rerun's cm_input_path/circ hit that uninitialized engine before KiCad's validate() re-init. The native flow assumes a crashed engine survives in-process — true for the dll, false for a dead worker. Reads now answer their empty shapes pre-init, writes lazy-init, and init is idempotent per worker engine.

E-19 — one throw leaked one credit unit. dispatchEvt acked only after handler(evt) returned, and the sharedspice client deliberately rethrows non-trap errors — so each throw leaked a frame of the 64-frame window until the stream died with a misattributed "transport exceeded". The ack moves to a finally in both copies; the throw still propagates, because the trap machinery needs to see it.

E-20 — the terminal stop discarded the diagnostics. The oversize-line path promises to transfer the accepted prefix, but with the window full that flush only defers, and stopEventStream wiped the deferred queue — losing the very lines explaining the failure. The fatal notice now carries them as pendingEvents; both hosts deliver them in order, unacked (the fatal frame sits outside the credit protocol).

E-21 — the prefetch timeout was all-or-nothing and silent. The 30 s deadline discarded every model already collected and reported nothing. A caller-owned progress sink ships the partials and the omission reaches the export report. Awaiting the aborted collection was rejected: an in-flight source fetch isn't abortable — E-4's original disease. Plus a serving-candidate memo, so a .wrl ref served by its .step fallback stops re-probing the miss on every export.

Scheduler

E-14 — a message substring could brick a healthy instance. _terminalizeNativeTrap classified by text, so any plain JS error quoting Aborted( or out of bounds latched the one-way terminal gate permanently. Now structural only: instanceof RuntimeError plus a duck-typed name check — verified in this build's glue that abort() throws a genuine RuntimeError both pre- and post-runtime-init, so the message arm bought nothing. Module.onAbort now latches the gate; it was previously ignored entirely.

E-15 (shim half) — _pumpResume gates on terminal, catching wakes already queued at latch time, and resolveWait refuses on terminal without consuming the entry, so a frame stays visibly parked in dump() rather than resuming inside a trapped module.

E-16 — the E-5 handler read the realm-global scheduler at dispatch instead of its installing module's; also frees the per-line buffer on the non-trap rethrow path.

E-11 — a corrupted worker answer killed the editor. get_vec trusted res.length over the transferred arrays. Observed death shape: a 4 GiB std::vector threw an unhandled std::length_error that exited the main loop — nastier than the predicted OOB trap. Now clamped, with buffers freed on every failure path.

Guardrails

Two review recommendations were deferred by maintainer decision — making the e2e suite drive production service code instead of the stub mirrors, and collapsing the four copies of the worker-lifecycle machinery. These stand in:

• service-stub-parity.ts pins what all four copies must share: credit-window equality parsed from source, the finally-ack, boot deadlines, terminal-notice consumption. Transport numbers are single-sourced from the worker.
• E-18 — the source contract asserted comment-string counts, so rewording failed CI while moving a guard outside its #ifdef passed. It now parses #ifdef regions and asserts on code.
• CI actually runs the gates: the web/standalone vitest suites (which had never run in CI), the reducer, the source contract and the parity tool — with a NON_PLAYWRIGHT_GATES check so deleting a step re-fails the lint.
• E-22 — the e2e occ stub's 60 s boot watchdog, deleted in a66e109, restored with a wedgeNextBoot() repro hook.

Deferred

E-17 — a stale RUNNING cross-stamping the next run's generation under E-6's transport deferral. Analysis recorded; a real fix needs run identity on the bg frames. Explicitly not "not-a-bug".

Verification

Every behavioral fix has red-then-green evidence, reds captured first. Vitest 404/404; reducer 9/9; source contract and parity tool green with false-green audits in both directions; clean kicad suite (both engines) 348 passed / 1 pre-existing marginal dark-mode rendering-ratio failure (0.2004 vs 0.2; nothing here touches rendering).

Live-collab gate passed on the real dev stack: a real UI tool dispatch moved a board item exactly 5 mm, a dialog parked the opener on an E-15-guarded nested wait and resolved cleanly on Cancel, and both clients stayed non-terminal with clean rings and zero parked waits across all nine kinds.

Note for CI: wx-chromium, jspi-firefox and coroutine-firefox cannot run locally in this worktree — the standalone wx test apps aren't built here — so CI is their first real coverage.

🤖 Generated with Claude Code