Closing the control pipe after the result rejected outstanding birpc
calls; an unawaited binding promise then crashed the child and its trace
reached the result logs. Once the result is returned or the pipe closes,
binding calls now never settle, including those the closure rejects.
Move the identical in-memory child used by the per-call and persistent
host specs into tests/fake-child.ts, and move readProgramResult next to
the ProgramResult type it validates in protocol.ts.
Keep the stream side owned here: line bounds, the leading-brace check,
the write-queue limit and closure. On the birpc side, drop the strict
envelope validation, falsy-rejection normalization and fatal UTF-8
decoding. Calls to methods an endpoint does not own are answered with
birpc's error and unknown messages are ignored; the resolver still runs
only own methods and none after the endpoint closes.
- Reject a control line that does not start with "{", so another
release's length-prefixed frame fails as a protocol error instead of
waiting for a newline until the deadline.
- Bump SSH_PROTOCOL_VERSION to 3: executable helpers embed the PTC
worker, so an older helper is now rejected while connecting.
- Send a small error instead of a late binding result from a finished
persistent evaluation, so it cannot overflow the pipe shared with
the next evaluation.
- Leave per-call binding waits pending after the result instead of
rejecting them; unawaited calls crashed the child and leaked the
trace into the result logs.
- Pin birpc to 4.2.0 so the host and the bundled child agree, and
regenerate THIRD_PARTY_NOTICES.md.
- Update stale frame wording.
One pipe delivers each evaluation's messages before its result, and the
child refuses calls from finished evaluations, so the per-message
evaluation id protected nothing. Remove it with the checks, counters and
helpers it required, measure outgoing messages only when posting, and
replace rethrowing validation blocks with early refusals.
Replace the length-prefixed JsonChannel and hand-written request/reply
correlation with typed birpc methods over newline-delimited JSON. The
host calls the child's run(); bindings call the host's invoke(); logs
and output-limit reports are notifications. The transport bounds
incoming lines and queued writes, validates UTF-8 and exposed methods,
and rejects outstanding calls when the pipe closes.
Drop logic made obsolete by the new transport, including the 32-bit
frame-length bound on maxMessageBytes.
Hold cleanup of an older retained process while a newer call is waiting, then unload the provider. Require the pending call to reject after disposal without starting another process.
Validation: 305 focused tests passed, one skipped; persistent.ts, index.ts, and policy-processes.ts have 100% statements, branches, functions, and lines. Removing the shutdown guard makes the new regression fail.
Preserve the persistent runtime package description with master's alpha.2 version and locale exports. Refresh the two PTC prompt snapshots for the current plan-tool result type.
Validation: full build, 434 focused tests (one skipped), two built-runtime tests, two selected snapshots, package metadata, and all 43 doc-sync checks passed.
Move `docs/defensive-patterns.md` into `docs/defensive-patterns/`, one page per
artifact plus a README router, and state each rule as its requirement, the
condition a reviewer judges it by, its boundary and approver, and a correct and
a wrong example.
- `general.md` (the moved page): the existing bug-class rules plus timing,
value representation, shared-state ownership, decentralization, performance
evidence, and migrations.
- `package-surface.md`, `remote-and-api.md`, `client-components.md`,
`conversation-and-session.md`: the review requirements for those artifacts,
linking type definitions and semantics to `docs/subsystems/` instead of
restating them.
- `README.md`: the habits behind the rules and the route from artifact to page.
- `dsh-code-review` reads the owning pages before judging a diff; the
`dsh-architecture-discipline` routing skill is retired in favour of the
directory, and every inbound reference is repaired.
- Chinese counterparts, pairing records, and the documentation tier table are
updated together.
imccyu