pcbjam/tests/kicad/occ-export.spec.ts

273 lines
14 KiB
TypeScript
Raw Normal View History

feat(wasm): occ-split — lazy occ_service worker; kicad_editor drops OCC (−31%) Move OpenCASCADE out of the merged editor image into occ_service: a separate emscripten module (-sASYNCIFY=0, MODULARIZE, in-container -Oz finalize, 2N+8 pre-warmed pthread pool) booted lazily in a dedicated Web Worker on the first STEP export or STEP/IGES model parse. kicad_editor.wasm ~190 MB -> 130 MB; sessions that never touch OCC never fetch its 57 MB. STEP export works in the browser for the first time: the unchanged desktop dialog runs EXPORTER_STEP, whose wasm shadow suspends into globalThis.occService and the export bytes go straight to a browser download (never entering the editor heap). STEP/IGES 3D models parse in the worker via the oce shadow (S3D WriteCache/ReadCache wire). - wasm/occ-service/: service CMake target (hooked from the kicad fork's top-level CMakeLists, wasm/editor pattern), embind entry (occExport/occLoadModel), wxConfig pre-js. - wasm/stubs/{exporter_step,oce_plugin}_stub.cpp: EM_ASYNC_JS worker bridges (callee-shadowing; no caller #ifdefs). - web/standalone: provider installed whenever the kicad_editor bundle boots (cross-face safe); ONE shared worker-boot source occ-worker.js (vite ?raw; the e2e stub reads the same file) — blob worker with locateFile absolutized against the glue URL; export download-name guard. - deps: OCC builds with RapidJSON so its glTF/GLB writer exists — pinned to the vcpkg master snapshot 2025-02-26 (24b5e7a8b27f), the same code official KiCad consumes via vcpkg.json's opencascade[rapidjson]; rapidjson's latest tag (v1.1.0, 2016) is ill-formed under modern clang. - tests: occ-export dialog e2e (lazy-fetch boundary + STEP download bytes), occ-probe incl. a 9-format matrix (step/stpz/brep/xao/ply/stl/glb/u3d/pdf), 3d-viewer-models hard-asserts the worker parse; occ provider stub installed ambiently by the kicad fixtures. Validated against desktop kicad-cli 10.0.4: geometric exact equality (bbox delta 0 um, volume delta 0.0000%) for STEP/GLB/STL/BREP/STPZ across three boards and option sweeps — with desktop OCC 7.9 vs wasm OCC 7.8; PLY/XAO/PDF structurally equal; U3D same-size (quantizer float LSBs differ). Full kicad e2e green on Firefox and Chromium; standalone verified end to end (lazy fetch only on the Export click; export.step 60,628 B ISO-10303-21; loadModel 700 KB STEP -> 569 KB scenegraph cache). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 12:39:58 +02:00
import type { Page } from '@playwright/test';
findings(E-5,E-8,E-9): module-identity ngspice events + runWaitCompletion admission gate E-8 (re-implemented for JSPI — the codex gate is entangled with the dropped execution owner; under JSPI a fresh non-suspending JS→wasm entry while another activation is suspended is structurally safe on its own stack, so the admission boundary for worker completions is liveness + trap state, not execution ownership): - jspi-scheduler.js grows `terminal` (trapped instance; distinct from `dead`), canTouchNative(), _terminalizeNativeTrap() (WebAssembly.RuntimeError + cross-realm string classification), and runWaitCompletion(site, token, prepare, inertResult): prepare runs immediately and owns ALL native work; stale tokens and dead/terminal instances drop loudly without resolving (resolving would resume the parked frame inside the damaged module); a trap latches terminal; a plain JS bug resolves inertResult so the wait fails instead of stranding. beginWait refuses (token 0) when dead/terminal. - all four delayed completion sites route their native work through the gate: 'OCC export completion' (exporter_step_stub), 'OCC model completion' (oce_plugin_stub — the MEMFS cache write moves inside the gate too), 'ngspice request completion' and 'ngspice vector completion' (sharedspice_client — every HEAP32/HEAPF64/malloc write inside prepare, inertResult 1 = transport error). Every wxWasmBeginWait caller in the stubs bails on token <= 0. - deliberately NOT ported from codex: ownerModule, enqueueNativeCompletion, executionBarrier, the byte-credit native-entry FIFO — completions are one-shot per wait token and stream volume is bounded at the E-6 transport credit window. Cross-refs logged for group M (M-2/M-6/M-8). E-5 (re-implemented; codex shape kept, owner APIs replaced with the E-8 gate): js_ngspice_install_events binds the handler to the EXACT installing module (handler.__pcbjamNgspiceOwnerModule stamp; presence is not identity), re-installation replaces a foreign module's handler, a superseded handler disarms itself, native entry goes through installingModule._malloc/ ._pcbjam_ngspice_event (never lexical Module), each dispatch checks canTouchNative() (loud drop on a dead/terminal module), and a trap on the per-line entry latches the terminal gate. Tests: scheduler-shim.test.ts +7 (gate happy/stale/dead/terminal/cross-realm/ js-bug/beginWait-refusal). e2e specs updated from the codex line: occ-export decode-fault recovery (real onmessageerror transition via failDecode, J-4), ngspice-probe direct-service coverage, eeschema-sim rewritten onto the E-7 applied-generation receipt (codex's executionBarrier await replaced with a pendingWaits('ngspice') drain poll — the JSPI-line equivalent). Also bumps the kicad submodule to the E-7/E-9 commit (dd5751038f7). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-19 16:03:16 +02:00
import * as fs from 'fs';
import * as path from 'path';
feat(wasm): occ-split — lazy occ_service worker; kicad_editor drops OCC (−31%) Move OpenCASCADE out of the merged editor image into occ_service: a separate emscripten module (-sASYNCIFY=0, MODULARIZE, in-container -Oz finalize, 2N+8 pre-warmed pthread pool) booted lazily in a dedicated Web Worker on the first STEP export or STEP/IGES model parse. kicad_editor.wasm ~190 MB -> 130 MB; sessions that never touch OCC never fetch its 57 MB. STEP export works in the browser for the first time: the unchanged desktop dialog runs EXPORTER_STEP, whose wasm shadow suspends into globalThis.occService and the export bytes go straight to a browser download (never entering the editor heap). STEP/IGES 3D models parse in the worker via the oce shadow (S3D WriteCache/ReadCache wire). - wasm/occ-service/: service CMake target (hooked from the kicad fork's top-level CMakeLists, wasm/editor pattern), embind entry (occExport/occLoadModel), wxConfig pre-js. - wasm/stubs/{exporter_step,oce_plugin}_stub.cpp: EM_ASYNC_JS worker bridges (callee-shadowing; no caller #ifdefs). - web/standalone: provider installed whenever the kicad_editor bundle boots (cross-face safe); ONE shared worker-boot source occ-worker.js (vite ?raw; the e2e stub reads the same file) — blob worker with locateFile absolutized against the glue URL; export download-name guard. - deps: OCC builds with RapidJSON so its glTF/GLB writer exists — pinned to the vcpkg master snapshot 2025-02-26 (24b5e7a8b27f), the same code official KiCad consumes via vcpkg.json's opencascade[rapidjson]; rapidjson's latest tag (v1.1.0, 2016) is ill-formed under modern clang. - tests: occ-export dialog e2e (lazy-fetch boundary + STEP download bytes), occ-probe incl. a 9-format matrix (step/stpz/brep/xao/ply/stl/glb/u3d/pdf), 3d-viewer-models hard-asserts the worker parse; occ provider stub installed ambiently by the kicad fixtures. Validated against desktop kicad-cli 10.0.4: geometric exact equality (bbox delta 0 um, volume delta 0.0000%) for STEP/GLB/STL/BREP/STPZ across three boards and option sweeps — with desktop OCC 7.9 vs wasm OCC 7.8; PLY/XAO/PDF structurally equal; U3D same-size (quantizer float LSBs differ). Full kicad e2e green on Firefox and Chromium; standalone verified end to end (lazy fetch only on the Export click; export.step 60,628 B ISO-10303-21; loadModel 700 KB STEP -> 569 KB scenegraph cache). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 12:39:58 +02:00
import { test, expect } from './fixtures';
findings(E-10..E-22): fix the defects a code review found in the E-1..E-9 work A review of the group-E fixes found 13 further defects; ten were introduced by those fixes, two pre-existed and were merely relocated, one is deferred. Services / transport E-10 retireWorker synthesized no bg/exit frame, so sharedspice's s_bgRunning mirror stayed latched true after a mid-run worker death: Run stayed disabled and the promised fresh-worker restart was unreachable for the whole session. Retirement now dispatches a synthetic controlled-exit straight to the installed handler (never through dispatchEvt — a fabricated frame must not touch the credit ledger). Driving the repro exposed two further defects, both fixed here: a replacement worker trapped on pre-init engine reads, and the rerun's cm_input_path/circ hit that uninitialized engine before KiCad's validate() re-init (the native flow assumes a crashed engine survives in-process — true for the dll, false for a dead worker). Reads now answer their empty shapes pre-init, writes lazy-init, and init is idempotent per worker engine. E-19 dispatchEvt acked only AFTER handler(evt) returned, and the sharedspice client deliberately rethrows non-trap errors — so each throw leaked one unit of the 64-frame credit window until the stream died with a misattributed "transport exceeded". The ack moves to a finally in both service copies; the throw still propagates (the trap machinery needs it). E-20 the oversize-line path promises to transfer the accepted prefix, but with the window full that flush only DEFERS, and stopEventStream wiped the deferred queue — losing the diagnostics that explain the failure. The terminal notice now carries them as pendingEvents; both hosts deliver them in order, unacked (the fatal frame is outside the credit protocol). E-21 the 30s prefetch deadline discarded every model already collected and reported nothing. A caller-owned progress sink ships the partials and the omission reaches the export report. (Awaiting the aborted collection was rejected: an in-flight source fetch is not abortable — E-4's original disease.) Plus a serving-candidate memo, so a .wrl ref served by its .step fallback stops re-probing the miss on every export. Scheduler E-14 _terminalizeNativeTrap classified by message substring, so any plain JS error QUOTING 'Aborted(' or 'out of bounds' permanently bricked a healthy instance. Now structural only: instanceof RuntimeError plus a duck-typed name check (verified in this build's glue that abort() throws a genuine RuntimeError both pre- and post-runtime-init). Module.onAbort now latches the gate — the authoritative notification, previously ignored. E-15 the shim half: _pumpResume gates on terminal (catching wakes already queued at latch time) and resolveWait refuses on terminal WITHOUT consuming the entry, so a frame stays visibly parked rather than resuming inside a trapped module. E-16 the E-5 handler read the realm-global scheduler at dispatch instead of its installing module's; also frees the per-line buffer on the non-trap rethrow path. E-11 get_vec trusted the worker's res.length over the transferred arrays. Observed death shape: a 4 GiB std::vector threw an unhandled std::length_error that exited the editor's main loop. Now clamped, with the buffers freed on every failure path. Guardrails (replacing two deferred refactors: e2e→production-code injection and collapsing the four copies of the worker-lifecycle machinery) E-18 the source contract asserted comment-string counts — rewording failed CI while moving a guard outside its #ifdef passed. It now parses the #ifdef regions and asserts on code. service-stub-parity.ts pins what the four lifecycle copies must share: credit-window equality parsed from source, the finally-ack, boot deadlines, terminal-notice consumption. The transport numbers are now single-sourced from the worker. CI actually runs the gates: the web/standalone vitest suites (which had NEVER run in CI), the reducer, the source contract and the parity tool — with a NON_PLAYWRIGHT_GATES check so deleting a step re-fails the lint. E-22 the e2e occ stub's 60s boot watchdog, deleted in a66e109, is restored in the ngspice-stub shape with a wedgeNextBoot() repro hook. Every behavioral fix has red-then-green evidence (the reds were captured first). E-17 (a stale RUNNING cross-stamping the next run's generation under E-6's transport deferral) is DEFERRED with its analysis recorded — a real fix needs run identity on the bg frames. Test hygiene: the dwell lint now requires the mandated ": <why>" and all 47 bare markers carry their reason; three export-report dwells became modal-lease polls; exact-ledger assertions became relative deltas; the dead data-wx-dom-id branch, an unused fault hook and unused receipt plumbing are gone; abort scans, wx dialog drivers, the sim harness and the vitest FakeWorker are each one copy now. Bumps kicad and wxwidgets to their findings-group-e tips. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-27 12:27:12 +02:00
import { waitForEditorReady, stableShot, settledShot } from '../e2e/utils/element-tracker';
feat(wasm): occ-split — lazy occ_service worker; kicad_editor drops OCC (−31%) Move OpenCASCADE out of the merged editor image into occ_service: a separate emscripten module (-sASYNCIFY=0, MODULARIZE, in-container -Oz finalize, 2N+8 pre-warmed pthread pool) booted lazily in a dedicated Web Worker on the first STEP export or STEP/IGES model parse. kicad_editor.wasm ~190 MB -> 130 MB; sessions that never touch OCC never fetch its 57 MB. STEP export works in the browser for the first time: the unchanged desktop dialog runs EXPORTER_STEP, whose wasm shadow suspends into globalThis.occService and the export bytes go straight to a browser download (never entering the editor heap). STEP/IGES 3D models parse in the worker via the oce shadow (S3D WriteCache/ReadCache wire). - wasm/occ-service/: service CMake target (hooked from the kicad fork's top-level CMakeLists, wasm/editor pattern), embind entry (occExport/occLoadModel), wxConfig pre-js. - wasm/stubs/{exporter_step,oce_plugin}_stub.cpp: EM_ASYNC_JS worker bridges (callee-shadowing; no caller #ifdefs). - web/standalone: provider installed whenever the kicad_editor bundle boots (cross-face safe); ONE shared worker-boot source occ-worker.js (vite ?raw; the e2e stub reads the same file) — blob worker with locateFile absolutized against the glue URL; export download-name guard. - deps: OCC builds with RapidJSON so its glTF/GLB writer exists — pinned to the vcpkg master snapshot 2025-02-26 (24b5e7a8b27f), the same code official KiCad consumes via vcpkg.json's opencascade[rapidjson]; rapidjson's latest tag (v1.1.0, 2016) is ill-formed under modern clang. - tests: occ-export dialog e2e (lazy-fetch boundary + STEP download bytes), occ-probe incl. a 9-format matrix (step/stpz/brep/xao/ply/stl/glb/u3d/pdf), 3d-viewer-models hard-asserts the worker parse; occ provider stub installed ambiently by the kicad fixtures. Validated against desktop kicad-cli 10.0.4: geometric exact equality (bbox delta 0 um, volume delta 0.0000%) for STEP/GLB/STL/BREP/STPZ across three boards and option sweeps — with desktop OCC 7.9 vs wasm OCC 7.8; PLY/XAO/PDF structurally equal; U3D same-size (quantizer float LSBs differ). Full kicad e2e green on Firefox and Chromium; standalone verified end to end (lazy fetch only on the Export click; export.step 60,628 B ISO-10303-21; loadModel 700 KB STEP -> 569 KB scenegraph cache). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 12:39:58 +02:00
import { injectFromSubmodule } from './utils/fs-inject';
findings(E-5,E-8,E-9): module-identity ngspice events + runWaitCompletion admission gate E-8 (re-implemented for JSPI — the codex gate is entangled with the dropped execution owner; under JSPI a fresh non-suspending JS→wasm entry while another activation is suspended is structurally safe on its own stack, so the admission boundary for worker completions is liveness + trap state, not execution ownership): - jspi-scheduler.js grows `terminal` (trapped instance; distinct from `dead`), canTouchNative(), _terminalizeNativeTrap() (WebAssembly.RuntimeError + cross-realm string classification), and runWaitCompletion(site, token, prepare, inertResult): prepare runs immediately and owns ALL native work; stale tokens and dead/terminal instances drop loudly without resolving (resolving would resume the parked frame inside the damaged module); a trap latches terminal; a plain JS bug resolves inertResult so the wait fails instead of stranding. beginWait refuses (token 0) when dead/terminal. - all four delayed completion sites route their native work through the gate: 'OCC export completion' (exporter_step_stub), 'OCC model completion' (oce_plugin_stub — the MEMFS cache write moves inside the gate too), 'ngspice request completion' and 'ngspice vector completion' (sharedspice_client — every HEAP32/HEAPF64/malloc write inside prepare, inertResult 1 = transport error). Every wxWasmBeginWait caller in the stubs bails on token <= 0. - deliberately NOT ported from codex: ownerModule, enqueueNativeCompletion, executionBarrier, the byte-credit native-entry FIFO — completions are one-shot per wait token and stream volume is bounded at the E-6 transport credit window. Cross-refs logged for group M (M-2/M-6/M-8). E-5 (re-implemented; codex shape kept, owner APIs replaced with the E-8 gate): js_ngspice_install_events binds the handler to the EXACT installing module (handler.__pcbjamNgspiceOwnerModule stamp; presence is not identity), re-installation replaces a foreign module's handler, a superseded handler disarms itself, native entry goes through installingModule._malloc/ ._pcbjam_ngspice_event (never lexical Module), each dispatch checks canTouchNative() (loud drop on a dead/terminal module), and a trap on the per-line entry latches the terminal gate. Tests: scheduler-shim.test.ts +7 (gate happy/stale/dead/terminal/cross-realm/ js-bug/beginWait-refusal). e2e specs updated from the codex line: occ-export decode-fault recovery (real onmessageerror transition via failDecode, J-4), ngspice-probe direct-service coverage, eeschema-sim rewritten onto the E-7 applied-generation receipt (codex's executionBarrier await replaced with a pendingWaits('ngspice') drain poll — the JSPI-line equivalent). Also bumps the kicad submodule to the E-7/E-9 commit (dd5751038f7). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-19 16:03:16 +02:00
import { openBoardProgrammatically } from './utils/board-ready';
findings(E-10..E-22): fix the defects a code review found in the E-1..E-9 work A review of the group-E fixes found 13 further defects; ten were introduced by those fixes, two pre-existed and were merely relocated, one is deferred. Services / transport E-10 retireWorker synthesized no bg/exit frame, so sharedspice's s_bgRunning mirror stayed latched true after a mid-run worker death: Run stayed disabled and the promised fresh-worker restart was unreachable for the whole session. Retirement now dispatches a synthetic controlled-exit straight to the installed handler (never through dispatchEvt — a fabricated frame must not touch the credit ledger). Driving the repro exposed two further defects, both fixed here: a replacement worker trapped on pre-init engine reads, and the rerun's cm_input_path/circ hit that uninitialized engine before KiCad's validate() re-init (the native flow assumes a crashed engine survives in-process — true for the dll, false for a dead worker). Reads now answer their empty shapes pre-init, writes lazy-init, and init is idempotent per worker engine. E-19 dispatchEvt acked only AFTER handler(evt) returned, and the sharedspice client deliberately rethrows non-trap errors — so each throw leaked one unit of the 64-frame credit window until the stream died with a misattributed "transport exceeded". The ack moves to a finally in both service copies; the throw still propagates (the trap machinery needs it). E-20 the oversize-line path promises to transfer the accepted prefix, but with the window full that flush only DEFERS, and stopEventStream wiped the deferred queue — losing the diagnostics that explain the failure. The terminal notice now carries them as pendingEvents; both hosts deliver them in order, unacked (the fatal frame is outside the credit protocol). E-21 the 30s prefetch deadline discarded every model already collected and reported nothing. A caller-owned progress sink ships the partials and the omission reaches the export report. (Awaiting the aborted collection was rejected: an in-flight source fetch is not abortable — E-4's original disease.) Plus a serving-candidate memo, so a .wrl ref served by its .step fallback stops re-probing the miss on every export. Scheduler E-14 _terminalizeNativeTrap classified by message substring, so any plain JS error QUOTING 'Aborted(' or 'out of bounds' permanently bricked a healthy instance. Now structural only: instanceof RuntimeError plus a duck-typed name check (verified in this build's glue that abort() throws a genuine RuntimeError both pre- and post-runtime-init). Module.onAbort now latches the gate — the authoritative notification, previously ignored. E-15 the shim half: _pumpResume gates on terminal (catching wakes already queued at latch time) and resolveWait refuses on terminal WITHOUT consuming the entry, so a frame stays visibly parked rather than resuming inside a trapped module. E-16 the E-5 handler read the realm-global scheduler at dispatch instead of its installing module's; also frees the per-line buffer on the non-trap rethrow path. E-11 get_vec trusted the worker's res.length over the transferred arrays. Observed death shape: a 4 GiB std::vector threw an unhandled std::length_error that exited the editor's main loop. Now clamped, with the buffers freed on every failure path. Guardrails (replacing two deferred refactors: e2e→production-code injection and collapsing the four copies of the worker-lifecycle machinery) E-18 the source contract asserted comment-string counts — rewording failed CI while moving a guard outside its #ifdef passed. It now parses the #ifdef regions and asserts on code. service-stub-parity.ts pins what the four lifecycle copies must share: credit-window equality parsed from source, the finally-ack, boot deadlines, terminal-notice consumption. The transport numbers are now single-sourced from the worker. CI actually runs the gates: the web/standalone vitest suites (which had NEVER run in CI), the reducer, the source contract and the parity tool — with a NON_PLAYWRIGHT_GATES check so deleting a step re-fails the lint. E-22 the e2e occ stub's 60s boot watchdog, deleted in a66e109, is restored in the ngspice-stub shape with a wedgeNextBoot() repro hook. Every behavioral fix has red-then-green evidence (the reds were captured first). E-17 (a stale RUNNING cross-stamping the next run's generation under E-6's transport deferral) is DEFERRED with its analysis recorded — a real fix needs run identity on the bg frames. Test hygiene: the dwell lint now requires the mandated ": <why>" and all 47 bare markers carry their reason; three export-report dwells became modal-lease polls; exact-ledger assertions became relative deltas; the dead data-wx-dom-id branch, an unused fault hook and unused receipt plumbing are gone; abort scans, wx dialog drivers, the sim harness and the vitest FakeWorker are each one copy now. Bumps kicad and wxwidgets to their findings-group-e tips. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-27 12:27:12 +02:00
import { findWxButton, clickWxButton, openStepExportDialog, dismissReportDialog } from './utils/wx-dialogs';
feat(wasm): occ-split — lazy occ_service worker; kicad_editor drops OCC (−31%) Move OpenCASCADE out of the merged editor image into occ_service: a separate emscripten module (-sASYNCIFY=0, MODULARIZE, in-container -Oz finalize, 2N+8 pre-warmed pthread pool) booted lazily in a dedicated Web Worker on the first STEP export or STEP/IGES model parse. kicad_editor.wasm ~190 MB -> 130 MB; sessions that never touch OCC never fetch its 57 MB. STEP export works in the browser for the first time: the unchanged desktop dialog runs EXPORTER_STEP, whose wasm shadow suspends into globalThis.occService and the export bytes go straight to a browser download (never entering the editor heap). STEP/IGES 3D models parse in the worker via the oce shadow (S3D WriteCache/ReadCache wire). - wasm/occ-service/: service CMake target (hooked from the kicad fork's top-level CMakeLists, wasm/editor pattern), embind entry (occExport/occLoadModel), wxConfig pre-js. - wasm/stubs/{exporter_step,oce_plugin}_stub.cpp: EM_ASYNC_JS worker bridges (callee-shadowing; no caller #ifdefs). - web/standalone: provider installed whenever the kicad_editor bundle boots (cross-face safe); ONE shared worker-boot source occ-worker.js (vite ?raw; the e2e stub reads the same file) — blob worker with locateFile absolutized against the glue URL; export download-name guard. - deps: OCC builds with RapidJSON so its glTF/GLB writer exists — pinned to the vcpkg master snapshot 2025-02-26 (24b5e7a8b27f), the same code official KiCad consumes via vcpkg.json's opencascade[rapidjson]; rapidjson's latest tag (v1.1.0, 2016) is ill-formed under modern clang. - tests: occ-export dialog e2e (lazy-fetch boundary + STEP download bytes), occ-probe incl. a 9-format matrix (step/stpz/brep/xao/ply/stl/glb/u3d/pdf), 3d-viewer-models hard-asserts the worker parse; occ provider stub installed ambiently by the kicad fixtures. Validated against desktop kicad-cli 10.0.4: geometric exact equality (bbox delta 0 um, volume delta 0.0000%) for STEP/GLB/STL/BREP/STPZ across three boards and option sweeps — with desktop OCC 7.9 vs wasm OCC 7.8; PLY/XAO/PDF structurally equal; U3D same-size (quantizer float LSBs differ). Full kicad e2e green on Firefox and Chromium; standalone verified end to end (lazy fetch only on the Export click; export.step 60,628 B ISO-10303-21; loadModel 700 KB STEP -> 569 KB scenegraph cache). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 12:39:58 +02:00
/**
* STEP export through the occ_service worker (docs/features/occ-split/):
* pcbnew.wasm carries no OCC — DIALOG_EXPORT_STEP's browser branch runs
* EXPORTER_STEP, whose WASM shadow suspends via EM_ASYNC_JS and hands the
* job to `globalThis.occService` (worker with its own OCC-linked module).
*
* Asserted end to end:
* 1. occ_service.{js,wasm} is NOT fetched at boot or board load — only the
* export click triggers it (the lazy-load boundary).
* 2. The (unchanged) export dialog drives the whole chain: menu → dialog →
* Export button → worker → STEP bytes.
* 3. The result is a real STEP file (ISO-10303-21 magic, non-trivial size),
* captured by the provider stub where the app would download it.
*/
const KICAD_VERSION_DIR = '10.0';
const PROJECT_DIR_MEMFS = `/home/kicad/documents/kicad/${KICAD_VERSION_DIR}/projects`;
const DEMO = { name: 'pic_programmer', dir: 'pic_programmer', stem: 'pic_programmer' } as const;
async function loadBoard(page: Page, testLogger: { consoleLogs: string[]; errors: string[] }): Promise<void> {
const pcbFilename = `${DEMO.stem}.kicad_pcb`;
const proFilename = `${DEMO.stem}.kicad_pro`;
await injectFromSubmodule(page, `kicad/demos/${DEMO.dir}/${pcbFilename}`,
`${PROJECT_DIR_MEMFS}/${pcbFilename}`);
await injectFromSubmodule(page, `kicad/demos/${DEMO.dir}/${proFilename}`,
`${PROJECT_DIR_MEMFS}/${proFilename}`);
findings(E-5,E-8,E-9): module-identity ngspice events + runWaitCompletion admission gate E-8 (re-implemented for JSPI — the codex gate is entangled with the dropped execution owner; under JSPI a fresh non-suspending JS→wasm entry while another activation is suspended is structurally safe on its own stack, so the admission boundary for worker completions is liveness + trap state, not execution ownership): - jspi-scheduler.js grows `terminal` (trapped instance; distinct from `dead`), canTouchNative(), _terminalizeNativeTrap() (WebAssembly.RuntimeError + cross-realm string classification), and runWaitCompletion(site, token, prepare, inertResult): prepare runs immediately and owns ALL native work; stale tokens and dead/terminal instances drop loudly without resolving (resolving would resume the parked frame inside the damaged module); a trap latches terminal; a plain JS bug resolves inertResult so the wait fails instead of stranding. beginWait refuses (token 0) when dead/terminal. - all four delayed completion sites route their native work through the gate: 'OCC export completion' (exporter_step_stub), 'OCC model completion' (oce_plugin_stub — the MEMFS cache write moves inside the gate too), 'ngspice request completion' and 'ngspice vector completion' (sharedspice_client — every HEAP32/HEAPF64/malloc write inside prepare, inertResult 1 = transport error). Every wxWasmBeginWait caller in the stubs bails on token <= 0. - deliberately NOT ported from codex: ownerModule, enqueueNativeCompletion, executionBarrier, the byte-credit native-entry FIFO — completions are one-shot per wait token and stream volume is bounded at the E-6 transport credit window. Cross-refs logged for group M (M-2/M-6/M-8). E-5 (re-implemented; codex shape kept, owner APIs replaced with the E-8 gate): js_ngspice_install_events binds the handler to the EXACT installing module (handler.__pcbjamNgspiceOwnerModule stamp; presence is not identity), re-installation replaces a foreign module's handler, a superseded handler disarms itself, native entry goes through installingModule._malloc/ ._pcbjam_ngspice_event (never lexical Module), each dispatch checks canTouchNative() (loud drop on a dead/terminal module), and a trap on the per-line entry latches the terminal gate. Tests: scheduler-shim.test.ts +7 (gate happy/stale/dead/terminal/cross-realm/ js-bug/beginWait-refusal). e2e specs updated from the codex line: occ-export decode-fault recovery (real onmessageerror transition via failDecode, J-4), ngspice-probe direct-service coverage, eeschema-sim rewritten onto the E-7 applied-generation receipt (codex's executionBarrier await replaced with a pendingWaits('ngspice') drain poll — the JSPI-line equivalent). Also bumps the kicad submodule to the E-7/E-9 commit (dd5751038f7). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-19 16:03:16 +02:00
const result = await openBoardProgrammatically(
page,
`${PROJECT_DIR_MEMFS}/${pcbFilename}`,
DEMO.stem,
testLogger,
60000,
);
feat(wasm): occ-split — lazy occ_service worker; kicad_editor drops OCC (−31%) Move OpenCASCADE out of the merged editor image into occ_service: a separate emscripten module (-sASYNCIFY=0, MODULARIZE, in-container -Oz finalize, 2N+8 pre-warmed pthread pool) booted lazily in a dedicated Web Worker on the first STEP export or STEP/IGES model parse. kicad_editor.wasm ~190 MB -> 130 MB; sessions that never touch OCC never fetch its 57 MB. STEP export works in the browser for the first time: the unchanged desktop dialog runs EXPORTER_STEP, whose wasm shadow suspends into globalThis.occService and the export bytes go straight to a browser download (never entering the editor heap). STEP/IGES 3D models parse in the worker via the oce shadow (S3D WriteCache/ReadCache wire). - wasm/occ-service/: service CMake target (hooked from the kicad fork's top-level CMakeLists, wasm/editor pattern), embind entry (occExport/occLoadModel), wxConfig pre-js. - wasm/stubs/{exporter_step,oce_plugin}_stub.cpp: EM_ASYNC_JS worker bridges (callee-shadowing; no caller #ifdefs). - web/standalone: provider installed whenever the kicad_editor bundle boots (cross-face safe); ONE shared worker-boot source occ-worker.js (vite ?raw; the e2e stub reads the same file) — blob worker with locateFile absolutized against the glue URL; export download-name guard. - deps: OCC builds with RapidJSON so its glTF/GLB writer exists — pinned to the vcpkg master snapshot 2025-02-26 (24b5e7a8b27f), the same code official KiCad consumes via vcpkg.json's opencascade[rapidjson]; rapidjson's latest tag (v1.1.0, 2016) is ill-formed under modern clang. - tests: occ-export dialog e2e (lazy-fetch boundary + STEP download bytes), occ-probe incl. a 9-format matrix (step/stpz/brep/xao/ply/stl/glb/u3d/pdf), 3d-viewer-models hard-asserts the worker parse; occ provider stub installed ambiently by the kicad fixtures. Validated against desktop kicad-cli 10.0.4: geometric exact equality (bbox delta 0 um, volume delta 0.0000%) for STEP/GLB/STL/BREP/STPZ across three boards and option sweeps — with desktop OCC 7.9 vs wasm OCC 7.8; PLY/XAO/PDF structurally equal; U3D same-size (quantizer float LSBs differ). Full kicad e2e green on Firefox and Chromium; standalone verified end to end (lazy fetch only on the Export click; export.step 60,628 B ISO-10303-21; loadModel 700 KB STEP -> 569 KB scenegraph cache). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 12:39:58 +02:00
console.log(`[TEST] ${DEMO.name} board-ready result: ${result}`);
}
test.describe('OCC export via occ_service worker', () => {
test.describe.configure({ mode: 'serial' });
test.setTimeout(240000);
test('export dialog produces a valid STEP; occ_service fetches lazily', async ({ page, testLogger }) => {
// Track occ_service fetches from the very start — the lazy boundary is
// the core assertion.
const occFetches: string[] = [];
page.on('request', (r) => {
if (r.url().includes('occ_service')) occFetches.push(r.url());
});
await page.goto('/kicad/pcbnew.html');
test(determinism): deterministic waits + stableShot screenshots; drop blind sleeps/ifs/retries Make the Playwright e2e + kicad suites deterministic so screenshot flake stops tracing to timing races. - Blind page.waitForTimeout -> condition waits (expect.poll, web-first assertions, waitUntil) + readiness helpers (waitForWxApp, waitForCanvasApp). Remaining sleeps are documented interaction dwells (annotated). - Defensive "if element exists" branches -> loud asserts; label-fallback chains -> normalized clickMenuItemByText. First-run wizard for/if loops removed by seeding calculator/gerbview/pcbnew HTMLs. - Screenshots: new stableShot(page, name) settles the render in-page (canvas hash over rAF) then writes a raw PNG to test-results/ for the existing offline gate (tools/screenshots vs baseline-screenshots). Replaces toHaveScreenshot, which did inline compare + its own baselines and had decoupled the specs from the real gate. scale:'css' pinned. - retries: 0 in both configs. - Guard: tests/tools/lint-determinism.ts (npm run lint:determinism) bans blind sleeps / toHaveScreenshot / inline retries / swallowed catches in specs; documented exceptions carry a marker. Rules in tests/TESTING.md. Assertions, coverage, and renders unchanged (semantic-equivalence reviewed; captures pixel-identical modulo inherent timer/timestamp/3d-raytrace variance). Both suites green at retries:0 (e2e 340, kicad 92); ~35-61% faster. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BVX1pHMvRPYHdp6ZfEawrk
2026-07-07 10:50:24 +02:00
await waitForEditorReady(page);
feat(wasm): occ-split — lazy occ_service worker; kicad_editor drops OCC (−31%) Move OpenCASCADE out of the merged editor image into occ_service: a separate emscripten module (-sASYNCIFY=0, MODULARIZE, in-container -Oz finalize, 2N+8 pre-warmed pthread pool) booted lazily in a dedicated Web Worker on the first STEP export or STEP/IGES model parse. kicad_editor.wasm ~190 MB -> 130 MB; sessions that never touch OCC never fetch its 57 MB. STEP export works in the browser for the first time: the unchanged desktop dialog runs EXPORTER_STEP, whose wasm shadow suspends into globalThis.occService and the export bytes go straight to a browser download (never entering the editor heap). STEP/IGES 3D models parse in the worker via the oce shadow (S3D WriteCache/ReadCache wire). - wasm/occ-service/: service CMake target (hooked from the kicad fork's top-level CMakeLists, wasm/editor pattern), embind entry (occExport/occLoadModel), wxConfig pre-js. - wasm/stubs/{exporter_step,oce_plugin}_stub.cpp: EM_ASYNC_JS worker bridges (callee-shadowing; no caller #ifdefs). - web/standalone: provider installed whenever the kicad_editor bundle boots (cross-face safe); ONE shared worker-boot source occ-worker.js (vite ?raw; the e2e stub reads the same file) — blob worker with locateFile absolutized against the glue URL; export download-name guard. - deps: OCC builds with RapidJSON so its glTF/GLB writer exists — pinned to the vcpkg master snapshot 2025-02-26 (24b5e7a8b27f), the same code official KiCad consumes via vcpkg.json's opencascade[rapidjson]; rapidjson's latest tag (v1.1.0, 2016) is ill-formed under modern clang. - tests: occ-export dialog e2e (lazy-fetch boundary + STEP download bytes), occ-probe incl. a 9-format matrix (step/stpz/brep/xao/ply/stl/glb/u3d/pdf), 3d-viewer-models hard-asserts the worker parse; occ provider stub installed ambiently by the kicad fixtures. Validated against desktop kicad-cli 10.0.4: geometric exact equality (bbox delta 0 um, volume delta 0.0000%) for STEP/GLB/STL/BREP/STPZ across three boards and option sweeps — with desktop OCC 7.9 vs wasm OCC 7.8; PLY/XAO/PDF structurally equal; U3D same-size (quantizer float LSBs differ). Full kicad e2e green on Firefox and Chromium; standalone verified end to end (lazy fetch only on the Export click; export.step 60,628 B ISO-10303-21; loadModel 700 KB STEP -> 569 KB scenegraph cache). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 12:39:58 +02:00
await loadBoard(page, testLogger);
e2e/CI: dual-engine suites, per-engine screenshots, SwiftShader retired, prod web suite, CI-coverage gate Squash of experiment/ff-big-modules vs main. Big-module routing removed: native-EH shrank kicad_editor below SpiderMonkey's x86-64 code budget (runs 29355049705/29356152413 green on stock Firefox), so BIG_MODULE_SPECS routing and the baseline-only-JIT crutch are gone — kicad-firefox and kicad-chromium both run the full suite, with the module compiled the way real users' browsers compile it. Per-engine screenshots end to end: stableShot/shotPath write test-results/<engine>/<name>.png; baselines move to baseline-screenshots/{chromium,firefox}/ and the whole tools/screenshots pipeline (compare/promote/manifest/spec-map/changelog/Discord) keys on <engine>/<name>. Previously Firefox and Chromium renders of one spec overwrote each other and Firefox renders were never actually gated. Seeded from CI run 29421380806 (92 new firefox baselines, +24 chromium web-suite shots); manifest generated from the baseline tree. One merged playwright.config.ts (kicad/asyncify/coroutine/perf as projects); ~25 dead npm scripts dropped. The web suite is gated in CI for the first time ever (4 rotted specs fixed, 5 broken lib-bridge specs triaged as fixme in docs/features/web-e2e-rot/); cheap lint step after npm ci; last 26 blind-sleep violations fixed. SwiftShader retired: CI Chromium renders WebGL on ANGLE → Mesa llvmpipe (--use-gl=angle --use-angle=gl --ignore-gpu-blocklist; the blocklist flag is mandatory — llvmpipe is blocklisted and WebGL is silently unavailable without it) in BOTH configs. Under WORKERS=4 congestion SwiftShader transiently failed the first post-board-load draw and the recovery cascade ended in a silent permanent Cairo fallback — that engine flip was the "~1.2% changedRatio both directions" occ-export baseline flake. Validated 160/160 across two 80-repeat rigs; full analysis in docs/features/wx-parity-bugs/occ-export-context-eviction.md. Chromium baselines shift slightly on llvmpipe — promote once from the first green run. Deflakes the new coverage exposed: presence baselines settle before capture; presence fixtures declare current file formats; perf gets its own outputDir so CI evidence survives; occ-export settles the board paint before the export dialog; menu-item waits (waitForRenderedByLabel before clickMenuItem) in 4 specs + the TESTING.md rule. Web suite runs the PROD build, in parallel: webServer becomes backend `start` + the standalone's e2e:preview (build-preview.mjs: link-wasm → stash the public/wasm symlink aside during vite build, build-demo.mjs's move — then vite preview as the persistent server). The wasm middleware serves /wasm/* in preview and emits COOP/COEP/CORP itself (a pthread worker script's own response must carry COEP or Chrome kills it with ERR_BLOCKED_BY_RESPONSE). VITE_* flags bake at build time; VITE_ALLOW_USER_OVERRIDE joins turbo globalEnv. fullyParallel + default workers: 5.2m → 1.4m. Determinism fixes the parallel run exposed: shared-page specs become serial groups; locks.spec grabs alice's exact item via the new kicadCollabTestSelectByUuid hook (cross-tab "first footprint" order is not a ysync invariant); quit specs poll page.url() (quit supersedes its own navigation — NS_BINDING_ABORTED on Firefox). Suite: 51 passed / 12 skipped / 0 failed in 1.6m. CI-coverage gate (lint:ci-coverage): every tests/**/*.spec.ts must be reachable from the npm scripts the workflows invoke — scraped from .github/workflows/, resolved through package.json, coverage asked from playwright --list itself. Rules: uncovered-spec + orphan-project (with a documented LOCAL_ONLY_PROJECTS allowlist). Gating next to lint:determinism; 138 spec files / 13 projects accounted for. Product fixes kept from the investigations (reachable on real GPUs too): wx 7799fd1be5 — paint flags clear before dispatch + Invalidate always propagates; kicad 3dcfea5e45 — SwiftShader pass-boundary flush + per-instance font texture + first-frame GL-error drain (GAL recovery recovers instead of falling back to Cairo) + the user-facing eeschema switch navigates again under __EMSCRIPTEN__ (project-sync's FaceRegistered gate had rerouted it into the hidden sync player; caught by the newly-gated web suite). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018eUxiPApHgGiu9NFyQfhAq
2026-07-17 12:10:40 +02:00
// Board-loaded ≠ board-painted: once the export dialog's modal pump takes
// over, the GAL may never repaint behind it — whichever paint state the
// canvas had at menu-open time is what the dialog screenshots freeze.
// Settle the pixels first so occ-export-{dialog,done}.png always capture
// the painted board (this bistability flagged occ-export-done between two
// identical-code CI runs).
await settledShot(page.locator('#canvas'), expect);
feat(wasm): occ-split — lazy occ_service worker; kicad_editor drops OCC (−31%) Move OpenCASCADE out of the merged editor image into occ_service: a separate emscripten module (-sASYNCIFY=0, MODULARIZE, in-container -Oz finalize, 2N+8 pre-warmed pthread pool) booted lazily in a dedicated Web Worker on the first STEP export or STEP/IGES model parse. kicad_editor.wasm ~190 MB -> 130 MB; sessions that never touch OCC never fetch its 57 MB. STEP export works in the browser for the first time: the unchanged desktop dialog runs EXPORTER_STEP, whose wasm shadow suspends into globalThis.occService and the export bytes go straight to a browser download (never entering the editor heap). STEP/IGES 3D models parse in the worker via the oce shadow (S3D WriteCache/ReadCache wire). - wasm/occ-service/: service CMake target (hooked from the kicad fork's top-level CMakeLists, wasm/editor pattern), embind entry (occExport/occLoadModel), wxConfig pre-js. - wasm/stubs/{exporter_step,oce_plugin}_stub.cpp: EM_ASYNC_JS worker bridges (callee-shadowing; no caller #ifdefs). - web/standalone: provider installed whenever the kicad_editor bundle boots (cross-face safe); ONE shared worker-boot source occ-worker.js (vite ?raw; the e2e stub reads the same file) — blob worker with locateFile absolutized against the glue URL; export download-name guard. - deps: OCC builds with RapidJSON so its glTF/GLB writer exists — pinned to the vcpkg master snapshot 2025-02-26 (24b5e7a8b27f), the same code official KiCad consumes via vcpkg.json's opencascade[rapidjson]; rapidjson's latest tag (v1.1.0, 2016) is ill-formed under modern clang. - tests: occ-export dialog e2e (lazy-fetch boundary + STEP download bytes), occ-probe incl. a 9-format matrix (step/stpz/brep/xao/ply/stl/glb/u3d/pdf), 3d-viewer-models hard-asserts the worker parse; occ provider stub installed ambiently by the kicad fixtures. Validated against desktop kicad-cli 10.0.4: geometric exact equality (bbox delta 0 um, volume delta 0.0000%) for STEP/GLB/STL/BREP/STPZ across three boards and option sweeps — with desktop OCC 7.9 vs wasm OCC 7.8; PLY/XAO/PDF structurally equal; U3D same-size (quantizer float LSBs differ). Full kicad e2e green on Firefox and Chromium; standalone verified end to end (lazy fetch only on the Export click; export.step 60,628 B ISO-10303-21; loadModel 700 KB STEP -> 569 KB scenegraph cache). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 12:39:58 +02:00
expect(occFetches, 'occ_service must NOT be fetched before the export').toHaveLength(0);
findings(E-5,E-8,E-9): module-identity ngspice events + runWaitCompletion admission gate E-8 (re-implemented for JSPI — the codex gate is entangled with the dropped execution owner; under JSPI a fresh non-suspending JS→wasm entry while another activation is suspended is structurally safe on its own stack, so the admission boundary for worker completions is liveness + trap state, not execution ownership): - jspi-scheduler.js grows `terminal` (trapped instance; distinct from `dead`), canTouchNative(), _terminalizeNativeTrap() (WebAssembly.RuntimeError + cross-realm string classification), and runWaitCompletion(site, token, prepare, inertResult): prepare runs immediately and owns ALL native work; stale tokens and dead/terminal instances drop loudly without resolving (resolving would resume the parked frame inside the damaged module); a trap latches terminal; a plain JS bug resolves inertResult so the wait fails instead of stranding. beginWait refuses (token 0) when dead/terminal. - all four delayed completion sites route their native work through the gate: 'OCC export completion' (exporter_step_stub), 'OCC model completion' (oce_plugin_stub — the MEMFS cache write moves inside the gate too), 'ngspice request completion' and 'ngspice vector completion' (sharedspice_client — every HEAP32/HEAPF64/malloc write inside prepare, inertResult 1 = transport error). Every wxWasmBeginWait caller in the stubs bails on token <= 0. - deliberately NOT ported from codex: ownerModule, enqueueNativeCompletion, executionBarrier, the byte-credit native-entry FIFO — completions are one-shot per wait token and stream volume is bounded at the E-6 transport credit window. Cross-refs logged for group M (M-2/M-6/M-8). E-5 (re-implemented; codex shape kept, owner APIs replaced with the E-8 gate): js_ngspice_install_events binds the handler to the EXACT installing module (handler.__pcbjamNgspiceOwnerModule stamp; presence is not identity), re-installation replaces a foreign module's handler, a superseded handler disarms itself, native entry goes through installingModule._malloc/ ._pcbjam_ngspice_event (never lexical Module), each dispatch checks canTouchNative() (loud drop on a dead/terminal module), and a trap on the per-line entry latches the terminal gate. Tests: scheduler-shim.test.ts +7 (gate happy/stale/dead/terminal/cross-realm/ js-bug/beginWait-refusal). e2e specs updated from the codex line: occ-export decode-fault recovery (real onmessageerror transition via failDecode, J-4), ngspice-probe direct-service coverage, eeschema-sim rewritten onto the E-7 applied-generation receipt (codex's executionBarrier await replaced with a pendingWaits('ngspice') drain poll — the JSPI-line equivalent). Also bumps the kicad submodule to the E-7/E-9 commit (dd5751038f7). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-19 16:03:16 +02:00
// File → Export → STEP/GLB/… and the unchanged export dialog.
await openStepExportDialog(page);
test(determinism): deterministic waits + stableShot screenshots; drop blind sleeps/ifs/retries Make the Playwright e2e + kicad suites deterministic so screenshot flake stops tracing to timing races. - Blind page.waitForTimeout -> condition waits (expect.poll, web-first assertions, waitUntil) + readiness helpers (waitForWxApp, waitForCanvasApp). Remaining sleeps are documented interaction dwells (annotated). - Defensive "if element exists" branches -> loud asserts; label-fallback chains -> normalized clickMenuItemByText. First-run wizard for/if loops removed by seeding calculator/gerbview/pcbnew HTMLs. - Screenshots: new stableShot(page, name) settles the render in-page (canvas hash over rAF) then writes a raw PNG to test-results/ for the existing offline gate (tools/screenshots vs baseline-screenshots). Replaces toHaveScreenshot, which did inline compare + its own baselines and had decoupled the specs from the real gate. scale:'css' pinned. - retries: 0 in both configs. - Guard: tests/tools/lint-determinism.ts (npm run lint:determinism) bans blind sleeps / toHaveScreenshot / inline retries / swallowed catches in specs; documented exceptions carry a marker. Rules in tests/TESTING.md. Assertions, coverage, and renders unchanged (semantic-equivalence reviewed; captures pixel-identical modulo inherent timer/timestamp/3d-raytrace variance). Both suites green at retries:0 (e2e 340, kicad 92); ~35-61% faster. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BVX1pHMvRPYHdp6ZfEawrk
2026-07-07 10:50:24 +02:00
await stableShot(page, 'occ-export-dialog.png');
feat(wasm): occ-split — lazy occ_service worker; kicad_editor drops OCC (−31%) Move OpenCASCADE out of the merged editor image into occ_service: a separate emscripten module (-sASYNCIFY=0, MODULARIZE, in-container -Oz finalize, 2N+8 pre-warmed pthread pool) booted lazily in a dedicated Web Worker on the first STEP export or STEP/IGES model parse. kicad_editor.wasm ~190 MB -> 130 MB; sessions that never touch OCC never fetch its 57 MB. STEP export works in the browser for the first time: the unchanged desktop dialog runs EXPORTER_STEP, whose wasm shadow suspends into globalThis.occService and the export bytes go straight to a browser download (never entering the editor heap). STEP/IGES 3D models parse in the worker via the oce shadow (S3D WriteCache/ReadCache wire). - wasm/occ-service/: service CMake target (hooked from the kicad fork's top-level CMakeLists, wasm/editor pattern), embind entry (occExport/occLoadModel), wxConfig pre-js. - wasm/stubs/{exporter_step,oce_plugin}_stub.cpp: EM_ASYNC_JS worker bridges (callee-shadowing; no caller #ifdefs). - web/standalone: provider installed whenever the kicad_editor bundle boots (cross-face safe); ONE shared worker-boot source occ-worker.js (vite ?raw; the e2e stub reads the same file) — blob worker with locateFile absolutized against the glue URL; export download-name guard. - deps: OCC builds with RapidJSON so its glTF/GLB writer exists — pinned to the vcpkg master snapshot 2025-02-26 (24b5e7a8b27f), the same code official KiCad consumes via vcpkg.json's opencascade[rapidjson]; rapidjson's latest tag (v1.1.0, 2016) is ill-formed under modern clang. - tests: occ-export dialog e2e (lazy-fetch boundary + STEP download bytes), occ-probe incl. a 9-format matrix (step/stpz/brep/xao/ply/stl/glb/u3d/pdf), 3d-viewer-models hard-asserts the worker parse; occ provider stub installed ambiently by the kicad fixtures. Validated against desktop kicad-cli 10.0.4: geometric exact equality (bbox delta 0 um, volume delta 0.0000%) for STEP/GLB/STL/BREP/STPZ across three boards and option sweeps — with desktop OCC 7.9 vs wasm OCC 7.8; PLY/XAO/PDF structurally equal; U3D same-size (quantizer float LSBs differ). Full kicad e2e green on Firefox and Chromium; standalone verified end to end (lazy fetch only on the Export click; export.step 60,628 B ISO-10303-21; loadModel 700 KB STEP -> 569 KB scenegraph cache). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 12:39:58 +02:00
expect(await clickWxButton(page, 'Export'), 'Export button click').toBe(true);
// The provider stub captures the bytes where the app would download.
await page.waitForFunction(
() => ((window as any).__occExports?.length ?? 0) > 0,
null, { timeout: 180000 });
const exports = await page.evaluate(() => (window as any).__occExports as Array<{
name: string; size: number; magic: string;
}>);
console.log(`[TEST] captured exports: ${JSON.stringify(exports)}`);
expect(exports).toHaveLength(1);
expect(exports[0].name, 'download name comes from the dialog')
.toMatch(/\.step$/i);
expect(exports[0].magic.startsWith('ISO-10303-21'), 'STEP magic').toBe(true);
expect(exports[0].size, 'non-trivial STEP body').toBeGreaterThan(10_000);
expect(occFetches.length, 'occ_service was fetched lazily by the export')
.toBeGreaterThan(0);
findings(E-10..E-22): fix the defects a code review found in the E-1..E-9 work A review of the group-E fixes found 13 further defects; ten were introduced by those fixes, two pre-existed and were merely relocated, one is deferred. Services / transport E-10 retireWorker synthesized no bg/exit frame, so sharedspice's s_bgRunning mirror stayed latched true after a mid-run worker death: Run stayed disabled and the promised fresh-worker restart was unreachable for the whole session. Retirement now dispatches a synthetic controlled-exit straight to the installed handler (never through dispatchEvt — a fabricated frame must not touch the credit ledger). Driving the repro exposed two further defects, both fixed here: a replacement worker trapped on pre-init engine reads, and the rerun's cm_input_path/circ hit that uninitialized engine before KiCad's validate() re-init (the native flow assumes a crashed engine survives in-process — true for the dll, false for a dead worker). Reads now answer their empty shapes pre-init, writes lazy-init, and init is idempotent per worker engine. E-19 dispatchEvt acked only AFTER handler(evt) returned, and the sharedspice client deliberately rethrows non-trap errors — so each throw leaked one unit of the 64-frame credit window until the stream died with a misattributed "transport exceeded". The ack moves to a finally in both service copies; the throw still propagates (the trap machinery needs it). E-20 the oversize-line path promises to transfer the accepted prefix, but with the window full that flush only DEFERS, and stopEventStream wiped the deferred queue — losing the diagnostics that explain the failure. The terminal notice now carries them as pendingEvents; both hosts deliver them in order, unacked (the fatal frame is outside the credit protocol). E-21 the 30s prefetch deadline discarded every model already collected and reported nothing. A caller-owned progress sink ships the partials and the omission reaches the export report. (Awaiting the aborted collection was rejected: an in-flight source fetch is not abortable — E-4's original disease.) Plus a serving-candidate memo, so a .wrl ref served by its .step fallback stops re-probing the miss on every export. Scheduler E-14 _terminalizeNativeTrap classified by message substring, so any plain JS error QUOTING 'Aborted(' or 'out of bounds' permanently bricked a healthy instance. Now structural only: instanceof RuntimeError plus a duck-typed name check (verified in this build's glue that abort() throws a genuine RuntimeError both pre- and post-runtime-init). Module.onAbort now latches the gate — the authoritative notification, previously ignored. E-15 the shim half: _pumpResume gates on terminal (catching wakes already queued at latch time) and resolveWait refuses on terminal WITHOUT consuming the entry, so a frame stays visibly parked rather than resuming inside a trapped module. E-16 the E-5 handler read the realm-global scheduler at dispatch instead of its installing module's; also frees the per-line buffer on the non-trap rethrow path. E-11 get_vec trusted the worker's res.length over the transferred arrays. Observed death shape: a 4 GiB std::vector threw an unhandled std::length_error that exited the editor's main loop. Now clamped, with the buffers freed on every failure path. Guardrails (replacing two deferred refactors: e2e→production-code injection and collapsing the four copies of the worker-lifecycle machinery) E-18 the source contract asserted comment-string counts — rewording failed CI while moving a guard outside its #ifdef passed. It now parses the #ifdef regions and asserts on code. service-stub-parity.ts pins what the four lifecycle copies must share: credit-window equality parsed from source, the finally-ack, boot deadlines, terminal-notice consumption. The transport numbers are now single-sourced from the worker. CI actually runs the gates: the web/standalone vitest suites (which had NEVER run in CI), the reducer, the source contract and the parity tool — with a NON_PLAYWRIGHT_GATES check so deleting a step re-fails the lint. E-22 the e2e occ stub's 60s boot watchdog, deleted in a66e109, is restored in the ngspice-stub shape with a wedgeNextBoot() repro hook. Every behavioral fix has red-then-green evidence (the reds were captured first). E-17 (a stale RUNNING cross-stamping the next run's generation under E-6's transport deferral) is DEFERRED with its analysis recorded — a real fix needs run identity on the bg frames. Test hygiene: the dwell lint now requires the mandated ": <why>" and all 47 bare markers carry their reason; three export-report dwells became modal-lease polls; exact-ledger assertions became relative deltas; the dead data-wx-dom-id branch, an unused fault hook and unused receipt plumbing are gone; abort scans, wx dialog drivers, the sim harness and the vitest FakeWorker are each one copy now. Bumps kicad and wxwidgets to their findings-group-e tips. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-27 12:27:12 +02:00
// Dismiss the "Export complete" report dialog: it opens on top of the
// export dialog's modal lease (1 → 2), which IS its observable signal.
await dismissReportDialog(page, 1, 'export complete');
feat(wasm): occ-split — lazy occ_service worker; kicad_editor drops OCC (−31%) Move OpenCASCADE out of the merged editor image into occ_service: a separate emscripten module (-sASYNCIFY=0, MODULARIZE, in-container -Oz finalize, 2N+8 pre-warmed pthread pool) booted lazily in a dedicated Web Worker on the first STEP export or STEP/IGES model parse. kicad_editor.wasm ~190 MB -> 130 MB; sessions that never touch OCC never fetch its 57 MB. STEP export works in the browser for the first time: the unchanged desktop dialog runs EXPORTER_STEP, whose wasm shadow suspends into globalThis.occService and the export bytes go straight to a browser download (never entering the editor heap). STEP/IGES 3D models parse in the worker via the oce shadow (S3D WriteCache/ReadCache wire). - wasm/occ-service/: service CMake target (hooked from the kicad fork's top-level CMakeLists, wasm/editor pattern), embind entry (occExport/occLoadModel), wxConfig pre-js. - wasm/stubs/{exporter_step,oce_plugin}_stub.cpp: EM_ASYNC_JS worker bridges (callee-shadowing; no caller #ifdefs). - web/standalone: provider installed whenever the kicad_editor bundle boots (cross-face safe); ONE shared worker-boot source occ-worker.js (vite ?raw; the e2e stub reads the same file) — blob worker with locateFile absolutized against the glue URL; export download-name guard. - deps: OCC builds with RapidJSON so its glTF/GLB writer exists — pinned to the vcpkg master snapshot 2025-02-26 (24b5e7a8b27f), the same code official KiCad consumes via vcpkg.json's opencascade[rapidjson]; rapidjson's latest tag (v1.1.0, 2016) is ill-formed under modern clang. - tests: occ-export dialog e2e (lazy-fetch boundary + STEP download bytes), occ-probe incl. a 9-format matrix (step/stpz/brep/xao/ply/stl/glb/u3d/pdf), 3d-viewer-models hard-asserts the worker parse; occ provider stub installed ambiently by the kicad fixtures. Validated against desktop kicad-cli 10.0.4: geometric exact equality (bbox delta 0 um, volume delta 0.0000%) for STEP/GLB/STL/BREP/STPZ across three boards and option sweeps — with desktop OCC 7.9 vs wasm OCC 7.8; PLY/XAO/PDF structurally equal; U3D same-size (quantizer float LSBs differ). Full kicad e2e green on Firefox and Chromium; standalone verified end to end (lazy fetch only on the Export click; export.step 60,628 B ISO-10303-21; loadModel 700 KB STEP -> 569 KB scenegraph cache). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 12:39:58 +02:00
test(determinism): deterministic waits + stableShot screenshots; drop blind sleeps/ifs/retries Make the Playwright e2e + kicad suites deterministic so screenshot flake stops tracing to timing races. - Blind page.waitForTimeout -> condition waits (expect.poll, web-first assertions, waitUntil) + readiness helpers (waitForWxApp, waitForCanvasApp). Remaining sleeps are documented interaction dwells (annotated). - Defensive "if element exists" branches -> loud asserts; label-fallback chains -> normalized clickMenuItemByText. First-run wizard for/if loops removed by seeding calculator/gerbview/pcbnew HTMLs. - Screenshots: new stableShot(page, name) settles the render in-page (canvas hash over rAF) then writes a raw PNG to test-results/ for the existing offline gate (tools/screenshots vs baseline-screenshots). Replaces toHaveScreenshot, which did inline compare + its own baselines and had decoupled the specs from the real gate. scale:'css' pinned. - retries: 0 in both configs. - Guard: tests/tools/lint-determinism.ts (npm run lint:determinism) bans blind sleeps / toHaveScreenshot / inline retries / swallowed catches in specs; documented exceptions carry a marker. Rules in tests/TESTING.md. Assertions, coverage, and renders unchanged (semantic-equivalence reviewed; captures pixel-identical modulo inherent timer/timestamp/3d-raytrace variance). Both suites green at retries:0 (e2e 340, kicad 92); ~35-61% faster. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BVX1pHMvRPYHdp6ZfEawrk
2026-07-07 10:50:24 +02:00
await stableShot(page, 'occ-export-done.png');
feat(wasm): occ-split — lazy occ_service worker; kicad_editor drops OCC (−31%) Move OpenCASCADE out of the merged editor image into occ_service: a separate emscripten module (-sASYNCIFY=0, MODULARIZE, in-container -Oz finalize, 2N+8 pre-warmed pthread pool) booted lazily in a dedicated Web Worker on the first STEP export or STEP/IGES model parse. kicad_editor.wasm ~190 MB -> 130 MB; sessions that never touch OCC never fetch its 57 MB. STEP export works in the browser for the first time: the unchanged desktop dialog runs EXPORTER_STEP, whose wasm shadow suspends into globalThis.occService and the export bytes go straight to a browser download (never entering the editor heap). STEP/IGES 3D models parse in the worker via the oce shadow (S3D WriteCache/ReadCache wire). - wasm/occ-service/: service CMake target (hooked from the kicad fork's top-level CMakeLists, wasm/editor pattern), embind entry (occExport/occLoadModel), wxConfig pre-js. - wasm/stubs/{exporter_step,oce_plugin}_stub.cpp: EM_ASYNC_JS worker bridges (callee-shadowing; no caller #ifdefs). - web/standalone: provider installed whenever the kicad_editor bundle boots (cross-face safe); ONE shared worker-boot source occ-worker.js (vite ?raw; the e2e stub reads the same file) — blob worker with locateFile absolutized against the glue URL; export download-name guard. - deps: OCC builds with RapidJSON so its glTF/GLB writer exists — pinned to the vcpkg master snapshot 2025-02-26 (24b5e7a8b27f), the same code official KiCad consumes via vcpkg.json's opencascade[rapidjson]; rapidjson's latest tag (v1.1.0, 2016) is ill-formed under modern clang. - tests: occ-export dialog e2e (lazy-fetch boundary + STEP download bytes), occ-probe incl. a 9-format matrix (step/stpz/brep/xao/ply/stl/glb/u3d/pdf), 3d-viewer-models hard-asserts the worker parse; occ provider stub installed ambiently by the kicad fixtures. Validated against desktop kicad-cli 10.0.4: geometric exact equality (bbox delta 0 um, volume delta 0.0000%) for STEP/GLB/STL/BREP/STPZ across three boards and option sweeps — with desktop OCC 7.9 vs wasm OCC 7.8; PLY/XAO/PDF structurally equal; U3D same-size (quantizer float LSBs differ). Full kicad e2e green on Firefox and Chromium; standalone verified end to end (lazy fetch only on the Export click; export.step 60,628 B ISO-10303-21; loadModel 700 KB STEP -> 569 KB scenegraph cache). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 12:39:58 +02:00
});
findings(E-5,E-8,E-9): module-identity ngspice events + runWaitCompletion admission gate E-8 (re-implemented for JSPI — the codex gate is entangled with the dropped execution owner; under JSPI a fresh non-suspending JS→wasm entry while another activation is suspended is structurally safe on its own stack, so the admission boundary for worker completions is liveness + trap state, not execution ownership): - jspi-scheduler.js grows `terminal` (trapped instance; distinct from `dead`), canTouchNative(), _terminalizeNativeTrap() (WebAssembly.RuntimeError + cross-realm string classification), and runWaitCompletion(site, token, prepare, inertResult): prepare runs immediately and owns ALL native work; stale tokens and dead/terminal instances drop loudly without resolving (resolving would resume the parked frame inside the damaged module); a trap latches terminal; a plain JS bug resolves inertResult so the wait fails instead of stranding. beginWait refuses (token 0) when dead/terminal. - all four delayed completion sites route their native work through the gate: 'OCC export completion' (exporter_step_stub), 'OCC model completion' (oce_plugin_stub — the MEMFS cache write moves inside the gate too), 'ngspice request completion' and 'ngspice vector completion' (sharedspice_client — every HEAP32/HEAPF64/malloc write inside prepare, inertResult 1 = transport error). Every wxWasmBeginWait caller in the stubs bails on token <= 0. - deliberately NOT ported from codex: ownerModule, enqueueNativeCompletion, executionBarrier, the byte-credit native-entry FIFO — completions are one-shot per wait token and stream volume is bounded at the E-6 transport credit window. Cross-refs logged for group M (M-2/M-6/M-8). E-5 (re-implemented; codex shape kept, owner APIs replaced with the E-8 gate): js_ngspice_install_events binds the handler to the EXACT installing module (handler.__pcbjamNgspiceOwnerModule stamp; presence is not identity), re-installation replaces a foreign module's handler, a superseded handler disarms itself, native entry goes through installingModule._malloc/ ._pcbjam_ngspice_event (never lexical Module), each dispatch checks canTouchNative() (loud drop on a dead/terminal module), and a trap on the per-line entry latches the terminal gate. Tests: scheduler-shim.test.ts +7 (gate happy/stale/dead/terminal/cross-realm/ js-bug/beginWait-refusal). e2e specs updated from the codex line: occ-export decode-fault recovery (real onmessageerror transition via failDecode, J-4), ngspice-probe direct-service coverage, eeschema-sim rewritten onto the E-7 applied-generation receipt (codex's executionBarrier await replaced with a pendingWaits('ngspice') drain poll — the JSPI-line equivalent). Also bumps the kicad submodule to the E-7/E-9 commit (dd5751038f7). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-19 16:03:16 +02:00
test('worker decode fault settles concurrent native wait and the next export recovers', async ({ page, testLogger }) => {
await page.goto('/kicad/pcbnew.html');
await waitForEditorReady(page);
await loadBoard(page, testLogger);
// The exact open Promise and title/paint helper have completed. Keep a
// byte-stable baseline before opening a nested submenu.
await settledShot(page.locator('#canvas'), expect);
await openStepExportDialog(page);
const probeBoard = fs.readFileSync(
path.resolve(__dirname, '..', 'fixtures', 'demo', 'demo.kicad_pcb'),
'utf8',
);
// Start one direct service request before the dialog's native request.
// Both wait on the same lazy worker boot, then both post without a host
// mutex. The harness injects a messageerror only when both are in the
// generation's pending map, and the real worker is then terminated.
await page.evaluate((boardText: string) => {
const runtime = globalThis as any;
runtime.__occServiceTestHooks.messageErrorWhenPendingAtLeast(2);
runtime.__occParallelResult = null;
void runtime.occService.request({
kind: 'export',
board: new TextEncoder().encode(boardText),
jobJson: JSON.stringify({ format: 'step', export_components: false }),
fileName: 'parallel-probe.step',
}).then((res: unknown) => { runtime.__occParallelResult = res; });
}, probeBoard);
expect(await clickWxButton(page, 'Export'), 'first native Export button click').toBe(true);
await page.waitForFunction(
() => (globalThis as any).__occParallelResult !== null,
null,
{ timeout: 30000 },
);
const parallelResult = await page.evaluate(
() => (globalThis as any).__occParallelResult as { ok: boolean; report?: string },
);
expect(parallelResult.ok, 'the parallel request must settle on generation failure').toBe(false);
expect(parallelResult.report, 'the exact messageerror reason reaches the caller')
.toContain('message decode failed');
// The C++ Export() request was the second request in the same failed
// generation. Its exact wx wait must close and show the native failure
// dialog instead of leaving the export handler parked.
await page.waitForFunction(() => {
const registry = window.wxElementRegistry;
if (!registry) return false;
const dialogs = registry.findAll({ visible: true })
.filter((el) => /Dialog/.test(el.typeName ?? ''));
return dialogs.length >= 2;
}, null, { timeout: 30000 });
await expect.poll(
() => page.evaluate(() => {
const scheduler = (globalThis as any).__wxScheduler;
return scheduler?.pendingWaits?.('occ') ?? -1;
}),
{ message: 'the native OCC wait must be completed by fail-all', timeout: 10000 },
).toBe(0);
const failed = await page.evaluate(() => {
const runtime = globalThis as any;
const rendered = runtime.wxElementRegistry?.findAllRendered?.({}) ?? [];
return {
labels: rendered.map((el: any) => el.label ?? el.text ?? '').filter(Boolean),
service: runtime.__occServiceTestHooks.snapshot(),
};
});
expect(failed.service.maxPending,
'two requests must coexist in one generation; worker requests are not serialized')
.toBeGreaterThanOrEqual(2);
expect(failed.service.requestsPosted,
findings(E-10..E-22): fix the defects a code review found in the E-1..E-9 work A review of the group-E fixes found 13 further defects; ten were introduced by those fixes, two pre-existed and were merely relocated, one is deferred. Services / transport E-10 retireWorker synthesized no bg/exit frame, so sharedspice's s_bgRunning mirror stayed latched true after a mid-run worker death: Run stayed disabled and the promised fresh-worker restart was unreachable for the whole session. Retirement now dispatches a synthetic controlled-exit straight to the installed handler (never through dispatchEvt — a fabricated frame must not touch the credit ledger). Driving the repro exposed two further defects, both fixed here: a replacement worker trapped on pre-init engine reads, and the rerun's cm_input_path/circ hit that uninitialized engine before KiCad's validate() re-init (the native flow assumes a crashed engine survives in-process — true for the dll, false for a dead worker). Reads now answer their empty shapes pre-init, writes lazy-init, and init is idempotent per worker engine. E-19 dispatchEvt acked only AFTER handler(evt) returned, and the sharedspice client deliberately rethrows non-trap errors — so each throw leaked one unit of the 64-frame credit window until the stream died with a misattributed "transport exceeded". The ack moves to a finally in both service copies; the throw still propagates (the trap machinery needs it). E-20 the oversize-line path promises to transfer the accepted prefix, but with the window full that flush only DEFERS, and stopEventStream wiped the deferred queue — losing the diagnostics that explain the failure. The terminal notice now carries them as pendingEvents; both hosts deliver them in order, unacked (the fatal frame is outside the credit protocol). E-21 the 30s prefetch deadline discarded every model already collected and reported nothing. A caller-owned progress sink ships the partials and the omission reaches the export report. (Awaiting the aborted collection was rejected: an in-flight source fetch is not abortable — E-4's original disease.) Plus a serving-candidate memo, so a .wrl ref served by its .step fallback stops re-probing the miss on every export. Scheduler E-14 _terminalizeNativeTrap classified by message substring, so any plain JS error QUOTING 'Aborted(' or 'out of bounds' permanently bricked a healthy instance. Now structural only: instanceof RuntimeError plus a duck-typed name check (verified in this build's glue that abort() throws a genuine RuntimeError both pre- and post-runtime-init). Module.onAbort now latches the gate — the authoritative notification, previously ignored. E-15 the shim half: _pumpResume gates on terminal (catching wakes already queued at latch time) and resolveWait refuses on terminal WITHOUT consuming the entry, so a frame stays visibly parked rather than resuming inside a trapped module. E-16 the E-5 handler read the realm-global scheduler at dispatch instead of its installing module's; also frees the per-line buffer on the non-trap rethrow path. E-11 get_vec trusted the worker's res.length over the transferred arrays. Observed death shape: a 4 GiB std::vector threw an unhandled std::length_error that exited the editor's main loop. Now clamped, with the buffers freed on every failure path. Guardrails (replacing two deferred refactors: e2e→production-code injection and collapsing the four copies of the worker-lifecycle machinery) E-18 the source contract asserted comment-string counts — rewording failed CI while moving a guard outside its #ifdef passed. It now parses the #ifdef regions and asserts on code. service-stub-parity.ts pins what the four lifecycle copies must share: credit-window equality parsed from source, the finally-ack, boot deadlines, terminal-notice consumption. The transport numbers are now single-sourced from the worker. CI actually runs the gates: the web/standalone vitest suites (which had NEVER run in CI), the reducer, the source contract and the parity tool — with a NON_PLAYWRIGHT_GATES check so deleting a step re-fails the lint. E-22 the e2e occ stub's 60s boot watchdog, deleted in a66e109, is restored in the ngspice-stub shape with a wedgeNextBoot() repro hook. Every behavioral fix has red-then-green evidence (the reds were captured first). E-17 (a stale RUNNING cross-stamping the next run's generation under E-6's transport deferral) is DEFERRED with its analysis recorded — a real fix needs run identity on the bg frames. Test hygiene: the dwell lint now requires the mandated ": <why>" and all 47 bare markers carry their reason; three export-report dwells became modal-lease polls; exact-ledger assertions became relative deltas; the dead data-wx-dom-id branch, an unused fault hook and unused receipt plumbing are gone; abort scans, wx dialog drivers, the sim harness and the vitest FakeWorker are each one copy now. Bumps kicad and wxwidgets to their findings-group-e tips. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-27 12:27:12 +02:00
'every provider entry must reach the real worker transport')
.toBe(failed.service.requestsStarted);
findings(E-5,E-8,E-9): module-identity ngspice events + runWaitCompletion admission gate E-8 (re-implemented for JSPI — the codex gate is entangled with the dropped execution owner; under JSPI a fresh non-suspending JS→wasm entry while another activation is suspended is structurally safe on its own stack, so the admission boundary for worker completions is liveness + trap state, not execution ownership): - jspi-scheduler.js grows `terminal` (trapped instance; distinct from `dead`), canTouchNative(), _terminalizeNativeTrap() (WebAssembly.RuntimeError + cross-realm string classification), and runWaitCompletion(site, token, prepare, inertResult): prepare runs immediately and owns ALL native work; stale tokens and dead/terminal instances drop loudly without resolving (resolving would resume the parked frame inside the damaged module); a trap latches terminal; a plain JS bug resolves inertResult so the wait fails instead of stranding. beginWait refuses (token 0) when dead/terminal. - all four delayed completion sites route their native work through the gate: 'OCC export completion' (exporter_step_stub), 'OCC model completion' (oce_plugin_stub — the MEMFS cache write moves inside the gate too), 'ngspice request completion' and 'ngspice vector completion' (sharedspice_client — every HEAP32/HEAPF64/malloc write inside prepare, inertResult 1 = transport error). Every wxWasmBeginWait caller in the stubs bails on token <= 0. - deliberately NOT ported from codex: ownerModule, enqueueNativeCompletion, executionBarrier, the byte-credit native-entry FIFO — completions are one-shot per wait token and stream volume is bounded at the E-6 transport credit window. Cross-refs logged for group M (M-2/M-6/M-8). E-5 (re-implemented; codex shape kept, owner APIs replaced with the E-8 gate): js_ngspice_install_events binds the handler to the EXACT installing module (handler.__pcbjamNgspiceOwnerModule stamp; presence is not identity), re-installation replaces a foreign module's handler, a superseded handler disarms itself, native entry goes through installingModule._malloc/ ._pcbjam_ngspice_event (never lexical Module), each dispatch checks canTouchNative() (loud drop on a dead/terminal module), and a trap on the per-line entry latches the terminal gate. Tests: scheduler-shim.test.ts +7 (gate happy/stale/dead/terminal/cross-realm/ js-bug/beginWait-refusal). e2e specs updated from the codex line: occ-export decode-fault recovery (real onmessageerror transition via failDecode, J-4), ngspice-probe direct-service coverage, eeschema-sim rewritten onto the E-7 applied-generation receipt (codex's executionBarrier await replaced with a pendingWaits('ngspice') drain poll — the JSPI-line equivalent). Also bumps the kicad submodule to the E-7/E-9 commit (dd5751038f7). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-19 16:03:16 +02:00
expect(failed.service.workerGenerationsStarted,
findings(E-10..E-22): fix the defects a code review found in the E-1..E-9 work A review of the group-E fixes found 13 further defects; ten were introduced by those fixes, two pre-existed and were merely relocated, one is deferred. Services / transport E-10 retireWorker synthesized no bg/exit frame, so sharedspice's s_bgRunning mirror stayed latched true after a mid-run worker death: Run stayed disabled and the promised fresh-worker restart was unreachable for the whole session. Retirement now dispatches a synthetic controlled-exit straight to the installed handler (never through dispatchEvt — a fabricated frame must not touch the credit ledger). Driving the repro exposed two further defects, both fixed here: a replacement worker trapped on pre-init engine reads, and the rerun's cm_input_path/circ hit that uninitialized engine before KiCad's validate() re-init (the native flow assumes a crashed engine survives in-process — true for the dll, false for a dead worker). Reads now answer their empty shapes pre-init, writes lazy-init, and init is idempotent per worker engine. E-19 dispatchEvt acked only AFTER handler(evt) returned, and the sharedspice client deliberately rethrows non-trap errors — so each throw leaked one unit of the 64-frame credit window until the stream died with a misattributed "transport exceeded". The ack moves to a finally in both service copies; the throw still propagates (the trap machinery needs it). E-20 the oversize-line path promises to transfer the accepted prefix, but with the window full that flush only DEFERS, and stopEventStream wiped the deferred queue — losing the diagnostics that explain the failure. The terminal notice now carries them as pendingEvents; both hosts deliver them in order, unacked (the fatal frame is outside the credit protocol). E-21 the 30s prefetch deadline discarded every model already collected and reported nothing. A caller-owned progress sink ships the partials and the omission reaches the export report. (Awaiting the aborted collection was rejected: an in-flight source fetch is not abortable — E-4's original disease.) Plus a serving-candidate memo, so a .wrl ref served by its .step fallback stops re-probing the miss on every export. Scheduler E-14 _terminalizeNativeTrap classified by message substring, so any plain JS error QUOTING 'Aborted(' or 'out of bounds' permanently bricked a healthy instance. Now structural only: instanceof RuntimeError plus a duck-typed name check (verified in this build's glue that abort() throws a genuine RuntimeError both pre- and post-runtime-init). Module.onAbort now latches the gate — the authoritative notification, previously ignored. E-15 the shim half: _pumpResume gates on terminal (catching wakes already queued at latch time) and resolveWait refuses on terminal WITHOUT consuming the entry, so a frame stays visibly parked rather than resuming inside a trapped module. E-16 the E-5 handler read the realm-global scheduler at dispatch instead of its installing module's; also frees the per-line buffer on the non-trap rethrow path. E-11 get_vec trusted the worker's res.length over the transferred arrays. Observed death shape: a 4 GiB std::vector threw an unhandled std::length_error that exited the editor's main loop. Now clamped, with the buffers freed on every failure path. Guardrails (replacing two deferred refactors: e2e→production-code injection and collapsing the four copies of the worker-lifecycle machinery) E-18 the source contract asserted comment-string counts — rewording failed CI while moving a guard outside its #ifdef passed. It now parses the #ifdef regions and asserts on code. service-stub-parity.ts pins what the four lifecycle copies must share: credit-window equality parsed from source, the finally-ack, boot deadlines, terminal-notice consumption. The transport numbers are now single-sourced from the worker. CI actually runs the gates: the web/standalone vitest suites (which had NEVER run in CI), the reducer, the source contract and the parity tool — with a NON_PLAYWRIGHT_GATES check so deleting a step re-fails the lint. E-22 the e2e occ stub's 60s boot watchdog, deleted in a66e109, is restored in the ngspice-stub shape with a wedgeNextBoot() repro hook. Every behavioral fix has red-then-green evidence (the reds were captured first). E-17 (a stale RUNNING cross-stamping the next run's generation under E-6's transport deferral) is DEFERRED with its analysis recorded — a real fix needs run identity on the bg frames. Test hygiene: the dwell lint now requires the mandated ": <why>" and all 47 bare markers carry their reason; three export-report dwells became modal-lease polls; exact-ledger assertions became relative deltas; the dead data-wx-dom-id branch, an unused fault hook and unused receipt plumbing are gone; abort scans, wx dialog drivers, the sim harness and the vitest FakeWorker are each one copy now. Bumps kicad and wxwidgets to their findings-group-e tips. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-27 12:27:12 +02:00
'the two parallel requests must share one worker generation').toHaveLength(1);
findings(E-5,E-8,E-9): module-identity ngspice events + runWaitCompletion admission gate E-8 (re-implemented for JSPI — the codex gate is entangled with the dropped execution owner; under JSPI a fresh non-suspending JS→wasm entry while another activation is suspended is structurally safe on its own stack, so the admission boundary for worker completions is liveness + trap state, not execution ownership): - jspi-scheduler.js grows `terminal` (trapped instance; distinct from `dead`), canTouchNative(), _terminalizeNativeTrap() (WebAssembly.RuntimeError + cross-realm string classification), and runWaitCompletion(site, token, prepare, inertResult): prepare runs immediately and owns ALL native work; stale tokens and dead/terminal instances drop loudly without resolving (resolving would resume the parked frame inside the damaged module); a trap latches terminal; a plain JS bug resolves inertResult so the wait fails instead of stranding. beginWait refuses (token 0) when dead/terminal. - all four delayed completion sites route their native work through the gate: 'OCC export completion' (exporter_step_stub), 'OCC model completion' (oce_plugin_stub — the MEMFS cache write moves inside the gate too), 'ngspice request completion' and 'ngspice vector completion' (sharedspice_client — every HEAP32/HEAPF64/malloc write inside prepare, inertResult 1 = transport error). Every wxWasmBeginWait caller in the stubs bails on token <= 0. - deliberately NOT ported from codex: ownerModule, enqueueNativeCompletion, executionBarrier, the byte-credit native-entry FIFO — completions are one-shot per wait token and stream volume is bounded at the E-6 transport credit window. Cross-refs logged for group M (M-2/M-6/M-8). E-5 (re-implemented; codex shape kept, owner APIs replaced with the E-8 gate): js_ngspice_install_events binds the handler to the EXACT installing module (handler.__pcbjamNgspiceOwnerModule stamp; presence is not identity), re-installation replaces a foreign module's handler, a superseded handler disarms itself, native entry goes through installingModule._malloc/ ._pcbjam_ngspice_event (never lexical Module), each dispatch checks canTouchNative() (loud drop on a dead/terminal module), and a trap on the per-line entry latches the terminal gate. Tests: scheduler-shim.test.ts +7 (gate happy/stale/dead/terminal/cross-realm/ js-bug/beginWait-refusal). e2e specs updated from the codex line: occ-export decode-fault recovery (real onmessageerror transition via failDecode, J-4), ngspice-probe direct-service coverage, eeschema-sim rewritten onto the E-7 applied-generation receipt (codex's executionBarrier await replaced with a pendingWaits('ngspice') drain poll — the JSPI-line equivalent). Also bumps the kicad submodule to the E-7/E-9 commit (dd5751038f7). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-19 16:03:16 +02:00
expect(failed.service.pending, 'fail-all must drain the failed generation').toBe(0);
findings(E-10..E-22): fix the defects a code review found in the E-1..E-9 work A review of the group-E fixes found 13 further defects; ten were introduced by those fixes, two pre-existed and were merely relocated, one is deferred. Services / transport E-10 retireWorker synthesized no bg/exit frame, so sharedspice's s_bgRunning mirror stayed latched true after a mid-run worker death: Run stayed disabled and the promised fresh-worker restart was unreachable for the whole session. Retirement now dispatches a synthetic controlled-exit straight to the installed handler (never through dispatchEvt — a fabricated frame must not touch the credit ledger). Driving the repro exposed two further defects, both fixed here: a replacement worker trapped on pre-init engine reads, and the rerun's cm_input_path/circ hit that uninitialized engine before KiCad's validate() re-init (the native flow assumes a crashed engine survives in-process — true for the dll, false for a dead worker). Reads now answer their empty shapes pre-init, writes lazy-init, and init is idempotent per worker engine. E-19 dispatchEvt acked only AFTER handler(evt) returned, and the sharedspice client deliberately rethrows non-trap errors — so each throw leaked one unit of the 64-frame credit window until the stream died with a misattributed "transport exceeded". The ack moves to a finally in both service copies; the throw still propagates (the trap machinery needs it). E-20 the oversize-line path promises to transfer the accepted prefix, but with the window full that flush only DEFERS, and stopEventStream wiped the deferred queue — losing the diagnostics that explain the failure. The terminal notice now carries them as pendingEvents; both hosts deliver them in order, unacked (the fatal frame is outside the credit protocol). E-21 the 30s prefetch deadline discarded every model already collected and reported nothing. A caller-owned progress sink ships the partials and the omission reaches the export report. (Awaiting the aborted collection was rejected: an in-flight source fetch is not abortable — E-4's original disease.) Plus a serving-candidate memo, so a .wrl ref served by its .step fallback stops re-probing the miss on every export. Scheduler E-14 _terminalizeNativeTrap classified by message substring, so any plain JS error QUOTING 'Aborted(' or 'out of bounds' permanently bricked a healthy instance. Now structural only: instanceof RuntimeError plus a duck-typed name check (verified in this build's glue that abort() throws a genuine RuntimeError both pre- and post-runtime-init). Module.onAbort now latches the gate — the authoritative notification, previously ignored. E-15 the shim half: _pumpResume gates on terminal (catching wakes already queued at latch time) and resolveWait refuses on terminal WITHOUT consuming the entry, so a frame stays visibly parked rather than resuming inside a trapped module. E-16 the E-5 handler read the realm-global scheduler at dispatch instead of its installing module's; also frees the per-line buffer on the non-trap rethrow path. E-11 get_vec trusted the worker's res.length over the transferred arrays. Observed death shape: a 4 GiB std::vector threw an unhandled std::length_error that exited the editor's main loop. Now clamped, with the buffers freed on every failure path. Guardrails (replacing two deferred refactors: e2e→production-code injection and collapsing the four copies of the worker-lifecycle machinery) E-18 the source contract asserted comment-string counts — rewording failed CI while moving a guard outside its #ifdef passed. It now parses the #ifdef regions and asserts on code. service-stub-parity.ts pins what the four lifecycle copies must share: credit-window equality parsed from source, the finally-ack, boot deadlines, terminal-notice consumption. The transport numbers are now single-sourced from the worker. CI actually runs the gates: the web/standalone vitest suites (which had NEVER run in CI), the reducer, the source contract and the parity tool — with a NON_PLAYWRIGHT_GATES check so deleting a step re-fails the lint. E-22 the e2e occ stub's 60s boot watchdog, deleted in a66e109, is restored in the ngspice-stub shape with a wedgeNextBoot() repro hook. Every behavioral fix has red-then-green evidence (the reds were captured first). E-17 (a stale RUNNING cross-stamping the next run's generation under E-6's transport deferral) is DEFERRED with its analysis recorded — a real fix needs run identity on the bg frames. Test hygiene: the dwell lint now requires the mandated ": <why>" and all 47 bare markers carry their reason; three export-report dwells became modal-lease polls; exact-ledger assertions became relative deltas; the dead data-wx-dom-id branch, an unused fault hook and unused receipt plumbing are gone; abort scans, wx dialog drivers, the sim harness and the vitest FakeWorker are each one copy now. Bumps kicad and wxwidgets to their findings-group-e tips. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-27 12:27:12 +02:00
expect(failed.service.retiredGenerations, 'the shared generation must be retired')
.toContain(failed.service.workerGenerationsStarted[0]);
findings(E-5,E-8,E-9): module-identity ngspice events + runWaitCompletion admission gate E-8 (re-implemented for JSPI — the codex gate is entangled with the dropped execution owner; under JSPI a fresh non-suspending JS→wasm entry while another activation is suspended is structurally safe on its own stack, so the admission boundary for worker completions is liveness + trap state, not execution ownership): - jspi-scheduler.js grows `terminal` (trapped instance; distinct from `dead`), canTouchNative(), _terminalizeNativeTrap() (WebAssembly.RuntimeError + cross-realm string classification), and runWaitCompletion(site, token, prepare, inertResult): prepare runs immediately and owns ALL native work; stale tokens and dead/terminal instances drop loudly without resolving (resolving would resume the parked frame inside the damaged module); a trap latches terminal; a plain JS bug resolves inertResult so the wait fails instead of stranding. beginWait refuses (token 0) when dead/terminal. - all four delayed completion sites route their native work through the gate: 'OCC export completion' (exporter_step_stub), 'OCC model completion' (oce_plugin_stub — the MEMFS cache write moves inside the gate too), 'ngspice request completion' and 'ngspice vector completion' (sharedspice_client — every HEAP32/HEAPF64/malloc write inside prepare, inertResult 1 = transport error). Every wxWasmBeginWait caller in the stubs bails on token <= 0. - deliberately NOT ported from codex: ownerModule, enqueueNativeCompletion, executionBarrier, the byte-credit native-entry FIFO — completions are one-shot per wait token and stream volume is bounded at the E-6 transport credit window. Cross-refs logged for group M (M-2/M-6/M-8). E-5 (re-implemented; codex shape kept, owner APIs replaced with the E-8 gate): js_ngspice_install_events binds the handler to the EXACT installing module (handler.__pcbjamNgspiceOwnerModule stamp; presence is not identity), re-installation replaces a foreign module's handler, a superseded handler disarms itself, native entry goes through installingModule._malloc/ ._pcbjam_ngspice_event (never lexical Module), each dispatch checks canTouchNative() (loud drop on a dead/terminal module), and a trap on the per-line entry latches the terminal gate. Tests: scheduler-shim.test.ts +7 (gate happy/stale/dead/terminal/cross-realm/ js-bug/beginWait-refusal). e2e specs updated from the codex line: occ-export decode-fault recovery (real onmessageerror transition via failDecode, J-4), ngspice-probe direct-service coverage, eeschema-sim rewritten onto the E-7 applied-generation receipt (codex's executionBarrier await replaced with a pendingWaits('ngspice') drain poll — the JSPI-line equivalent). Also bumps the kicad submodule to the E-7/E-9 commit (dd5751038f7). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-19 16:03:16 +02:00
expect(failed.service.activeGeneration, 'the failed slot must be cleared').toBeNull();
expect(failed.service.armed, 'the one-shot fault must be consumed').toBe(false);
console.log(`[TEST-OCC] native fault dialog labels: ${JSON.stringify(failed.labels)}`);
// Resolve the parent action before dismissing the child, then reuse its
// exact DOM identity. This prevents a label/geometry re-query from
// turning the handback race into a click on some replacement control.
const retryExport = await findWxButton(page, 'Export');
expect(retryExport, 'the original parent Export button must remain registered').not.toBeNull();
findings(E-5,E-6): validation-round fixes — live e2e falsified two ported shapes E-5: the module-identity bridge called installingModule._malloc, but this build exposes _malloc only as a bare glue-closure export (Module._malloc is absent) — every char/stat event entry threw TypeError, which also starved the E-6 credit window (thrown dispatches never acked) and wedged the queued bg-finished frame behind them. The bridge now uses the bare closure exports (identity is still exact: the EM_JS body IS the installing module's closure; the __ngspiceOnEvent self-disarm covers supersession). E-6 (codex reference design corrected — its validation matrix never ran): a FULL credit window was terminal (stopEventStream at 64 in-flight frames). Under live e2e that killed a real simulation: bg-thread emissions proxy one per task, so each line ships as its own frame and a normal transient outruns a busy main thread. A full window now DEFERS into a bounded FIFO (512 events / 4 MiB) drained in order as acks free credit; only true overload or an invalid ack is terminal. Retention stays bounded (8 MiB in flight + 4 MiB deferred + 1 MiB open batch). And the service/harness mirror queue now acks at ENQUEUE — placing a frame in the bounded pre-handler queue is taking ownership; without that, a stream starting before the C++ handler installs (the ngspice-probe page) starves the worker window forever. Test updates: worker-batch reducer — new "a full credit window defers and drains in order, never terminal" case pinning the regression; the storm case now proves the deferred caps are the terminal edge. board-ready.ts gains the owner-free openBoardProgrammatically (codex helper the ported occ-export spec needs; the barrier-based waitForUiBoardReady was NOT taken). occ-export.spec: domId is optional on this line's registry (coordinate fallback is the supported path). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-19 17:53:11 +02:00
expect(retryExport!.x, 'the retry target has stable geometry').toBeGreaterThan(0);
expect(retryExport!.y, 'the retry target has stable geometry').toBeGreaterThan(0);
findings(E-5,E-8,E-9): module-identity ngspice events + runWaitCompletion admission gate E-8 (re-implemented for JSPI — the codex gate is entangled with the dropped execution owner; under JSPI a fresh non-suspending JS→wasm entry while another activation is suspended is structurally safe on its own stack, so the admission boundary for worker completions is liveness + trap state, not execution ownership): - jspi-scheduler.js grows `terminal` (trapped instance; distinct from `dead`), canTouchNative(), _terminalizeNativeTrap() (WebAssembly.RuntimeError + cross-realm string classification), and runWaitCompletion(site, token, prepare, inertResult): prepare runs immediately and owns ALL native work; stale tokens and dead/terminal instances drop loudly without resolving (resolving would resume the parked frame inside the damaged module); a trap latches terminal; a plain JS bug resolves inertResult so the wait fails instead of stranding. beginWait refuses (token 0) when dead/terminal. - all four delayed completion sites route their native work through the gate: 'OCC export completion' (exporter_step_stub), 'OCC model completion' (oce_plugin_stub — the MEMFS cache write moves inside the gate too), 'ngspice request completion' and 'ngspice vector completion' (sharedspice_client — every HEAP32/HEAPF64/malloc write inside prepare, inertResult 1 = transport error). Every wxWasmBeginWait caller in the stubs bails on token <= 0. - deliberately NOT ported from codex: ownerModule, enqueueNativeCompletion, executionBarrier, the byte-credit native-entry FIFO — completions are one-shot per wait token and stream volume is bounded at the E-6 transport credit window. Cross-refs logged for group M (M-2/M-6/M-8). E-5 (re-implemented; codex shape kept, owner APIs replaced with the E-8 gate): js_ngspice_install_events binds the handler to the EXACT installing module (handler.__pcbjamNgspiceOwnerModule stamp; presence is not identity), re-installation replaces a foreign module's handler, a superseded handler disarms itself, native entry goes through installingModule._malloc/ ._pcbjam_ngspice_event (never lexical Module), each dispatch checks canTouchNative() (loud drop on a dead/terminal module), and a trap on the per-line entry latches the terminal gate. Tests: scheduler-shim.test.ts +7 (gate happy/stale/dead/terminal/cross-realm/ js-bug/beginWait-refusal). e2e specs updated from the codex line: occ-export decode-fault recovery (real onmessageerror transition via failDecode, J-4), ngspice-probe direct-service coverage, eeschema-sim rewritten onto the E-7 applied-generation receipt (codex's executionBarrier await replaced with a pendingWaits('ngspice') drain poll — the JSPI-line equivalent). Also bumps the kicad submodule to the E-7/E-9 commit (dd5751038f7). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-19 16:03:16 +02:00
expect(await clickWxButton(page, 'OK'), 'dismiss native export failure').toBe(true);
// page.mouse.click() completes when the browser has delivered the OK
// input, not when the nested native modal has unwound. The parent
// export dialog is intentionally non-interactive until that exact
// child lease closes. Wait for the scheduler's observable modal
// count to return from {export + failure} to {export} before clicking
// through to the parent.
await expect.poll(
() => page.evaluate(() => {
const scheduler = (globalThis as any).__wxScheduler;
return scheduler?.pendingWaits?.('modal') ?? -1;
}),
{ message: 'the failure child must retire before retrying its parent', timeout: 10000 },
).toBe(1);
// The export dialog remains open. Its next request must create a fresh
findings(E-10..E-22): fix the defects a code review found in the E-1..E-9 work A review of the group-E fixes found 13 further defects; ten were introduced by those fixes, two pre-existed and were merely relocated, one is deferred. Services / transport E-10 retireWorker synthesized no bg/exit frame, so sharedspice's s_bgRunning mirror stayed latched true after a mid-run worker death: Run stayed disabled and the promised fresh-worker restart was unreachable for the whole session. Retirement now dispatches a synthetic controlled-exit straight to the installed handler (never through dispatchEvt — a fabricated frame must not touch the credit ledger). Driving the repro exposed two further defects, both fixed here: a replacement worker trapped on pre-init engine reads, and the rerun's cm_input_path/circ hit that uninitialized engine before KiCad's validate() re-init (the native flow assumes a crashed engine survives in-process — true for the dll, false for a dead worker). Reads now answer their empty shapes pre-init, writes lazy-init, and init is idempotent per worker engine. E-19 dispatchEvt acked only AFTER handler(evt) returned, and the sharedspice client deliberately rethrows non-trap errors — so each throw leaked one unit of the 64-frame credit window until the stream died with a misattributed "transport exceeded". The ack moves to a finally in both service copies; the throw still propagates (the trap machinery needs it). E-20 the oversize-line path promises to transfer the accepted prefix, but with the window full that flush only DEFERS, and stopEventStream wiped the deferred queue — losing the diagnostics that explain the failure. The terminal notice now carries them as pendingEvents; both hosts deliver them in order, unacked (the fatal frame is outside the credit protocol). E-21 the 30s prefetch deadline discarded every model already collected and reported nothing. A caller-owned progress sink ships the partials and the omission reaches the export report. (Awaiting the aborted collection was rejected: an in-flight source fetch is not abortable — E-4's original disease.) Plus a serving-candidate memo, so a .wrl ref served by its .step fallback stops re-probing the miss on every export. Scheduler E-14 _terminalizeNativeTrap classified by message substring, so any plain JS error QUOTING 'Aborted(' or 'out of bounds' permanently bricked a healthy instance. Now structural only: instanceof RuntimeError plus a duck-typed name check (verified in this build's glue that abort() throws a genuine RuntimeError both pre- and post-runtime-init). Module.onAbort now latches the gate — the authoritative notification, previously ignored. E-15 the shim half: _pumpResume gates on terminal (catching wakes already queued at latch time) and resolveWait refuses on terminal WITHOUT consuming the entry, so a frame stays visibly parked rather than resuming inside a trapped module. E-16 the E-5 handler read the realm-global scheduler at dispatch instead of its installing module's; also frees the per-line buffer on the non-trap rethrow path. E-11 get_vec trusted the worker's res.length over the transferred arrays. Observed death shape: a 4 GiB std::vector threw an unhandled std::length_error that exited the editor's main loop. Now clamped, with the buffers freed on every failure path. Guardrails (replacing two deferred refactors: e2e→production-code injection and collapsing the four copies of the worker-lifecycle machinery) E-18 the source contract asserted comment-string counts — rewording failed CI while moving a guard outside its #ifdef passed. It now parses the #ifdef regions and asserts on code. service-stub-parity.ts pins what the four lifecycle copies must share: credit-window equality parsed from source, the finally-ack, boot deadlines, terminal-notice consumption. The transport numbers are now single-sourced from the worker. CI actually runs the gates: the web/standalone vitest suites (which had NEVER run in CI), the reducer, the source contract and the parity tool — with a NON_PLAYWRIGHT_GATES check so deleting a step re-fails the lint. E-22 the e2e occ stub's 60s boot watchdog, deleted in a66e109, is restored in the ngspice-stub shape with a wedgeNextBoot() repro hook. Every behavioral fix has red-then-green evidence (the reds were captured first). E-17 (a stale RUNNING cross-stamping the next run's generation under E-6's transport deferral) is DEFERRED with its analysis recorded — a real fix needs run identity on the bg frames. Test hygiene: the dwell lint now requires the mandated ": <why>" and all 47 bare markers carry their reason; three export-report dwells became modal-lease polls; exact-ledger assertions became relative deltas; the dead data-wx-dom-id branch, an unused fault hook and unused receipt plumbing are gone; abort scans, wx dialog drivers, the sim harness and the vitest FakeWorker are each one copy now. Bumps kicad and wxwidgets to their findings-group-e tips. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-27 12:27:12 +02:00
// generation and complete through the actual OCC module. Reuse the
// captured geometry so a re-query can't land on a replacement control.
findings(E-5,E-8,E-9): module-identity ngspice events + runWaitCompletion admission gate E-8 (re-implemented for JSPI — the codex gate is entangled with the dropped execution owner; under JSPI a fresh non-suspending JS→wasm entry while another activation is suspended is structurally safe on its own stack, so the admission boundary for worker completions is liveness + trap state, not execution ownership): - jspi-scheduler.js grows `terminal` (trapped instance; distinct from `dead`), canTouchNative(), _terminalizeNativeTrap() (WebAssembly.RuntimeError + cross-realm string classification), and runWaitCompletion(site, token, prepare, inertResult): prepare runs immediately and owns ALL native work; stale tokens and dead/terminal instances drop loudly without resolving (resolving would resume the parked frame inside the damaged module); a trap latches terminal; a plain JS bug resolves inertResult so the wait fails instead of stranding. beginWait refuses (token 0) when dead/terminal. - all four delayed completion sites route their native work through the gate: 'OCC export completion' (exporter_step_stub), 'OCC model completion' (oce_plugin_stub — the MEMFS cache write moves inside the gate too), 'ngspice request completion' and 'ngspice vector completion' (sharedspice_client — every HEAP32/HEAPF64/malloc write inside prepare, inertResult 1 = transport error). Every wxWasmBeginWait caller in the stubs bails on token <= 0. - deliberately NOT ported from codex: ownerModule, enqueueNativeCompletion, executionBarrier, the byte-credit native-entry FIFO — completions are one-shot per wait token and stream volume is bounded at the E-6 transport credit window. Cross-refs logged for group M (M-2/M-6/M-8). E-5 (re-implemented; codex shape kept, owner APIs replaced with the E-8 gate): js_ngspice_install_events binds the handler to the EXACT installing module (handler.__pcbjamNgspiceOwnerModule stamp; presence is not identity), re-installation replaces a foreign module's handler, a superseded handler disarms itself, native entry goes through installingModule._malloc/ ._pcbjam_ngspice_event (never lexical Module), each dispatch checks canTouchNative() (loud drop on a dead/terminal module), and a trap on the per-line entry latches the terminal gate. Tests: scheduler-shim.test.ts +7 (gate happy/stale/dead/terminal/cross-realm/ js-bug/beginWait-refusal). e2e specs updated from the codex line: occ-export decode-fault recovery (real onmessageerror transition via failDecode, J-4), ngspice-probe direct-service coverage, eeschema-sim rewritten onto the E-7 applied-generation receipt (codex's executionBarrier await replaced with a pendingWaits('ngspice') drain poll — the JSPI-line equivalent). Also bumps the kicad submodule to the E-7/E-9 commit (dd5751038f7). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-19 16:03:16 +02:00
if (!retryExport) throw new Error('parent Export button disappeared before retry');
findings(E-10..E-22): fix the defects a code review found in the E-1..E-9 work A review of the group-E fixes found 13 further defects; ten were introduced by those fixes, two pre-existed and were merely relocated, one is deferred. Services / transport E-10 retireWorker synthesized no bg/exit frame, so sharedspice's s_bgRunning mirror stayed latched true after a mid-run worker death: Run stayed disabled and the promised fresh-worker restart was unreachable for the whole session. Retirement now dispatches a synthetic controlled-exit straight to the installed handler (never through dispatchEvt — a fabricated frame must not touch the credit ledger). Driving the repro exposed two further defects, both fixed here: a replacement worker trapped on pre-init engine reads, and the rerun's cm_input_path/circ hit that uninitialized engine before KiCad's validate() re-init (the native flow assumes a crashed engine survives in-process — true for the dll, false for a dead worker). Reads now answer their empty shapes pre-init, writes lazy-init, and init is idempotent per worker engine. E-19 dispatchEvt acked only AFTER handler(evt) returned, and the sharedspice client deliberately rethrows non-trap errors — so each throw leaked one unit of the 64-frame credit window until the stream died with a misattributed "transport exceeded". The ack moves to a finally in both service copies; the throw still propagates (the trap machinery needs it). E-20 the oversize-line path promises to transfer the accepted prefix, but with the window full that flush only DEFERS, and stopEventStream wiped the deferred queue — losing the diagnostics that explain the failure. The terminal notice now carries them as pendingEvents; both hosts deliver them in order, unacked (the fatal frame is outside the credit protocol). E-21 the 30s prefetch deadline discarded every model already collected and reported nothing. A caller-owned progress sink ships the partials and the omission reaches the export report. (Awaiting the aborted collection was rejected: an in-flight source fetch is not abortable — E-4's original disease.) Plus a serving-candidate memo, so a .wrl ref served by its .step fallback stops re-probing the miss on every export. Scheduler E-14 _terminalizeNativeTrap classified by message substring, so any plain JS error QUOTING 'Aborted(' or 'out of bounds' permanently bricked a healthy instance. Now structural only: instanceof RuntimeError plus a duck-typed name check (verified in this build's glue that abort() throws a genuine RuntimeError both pre- and post-runtime-init). Module.onAbort now latches the gate — the authoritative notification, previously ignored. E-15 the shim half: _pumpResume gates on terminal (catching wakes already queued at latch time) and resolveWait refuses on terminal WITHOUT consuming the entry, so a frame stays visibly parked rather than resuming inside a trapped module. E-16 the E-5 handler read the realm-global scheduler at dispatch instead of its installing module's; also frees the per-line buffer on the non-trap rethrow path. E-11 get_vec trusted the worker's res.length over the transferred arrays. Observed death shape: a 4 GiB std::vector threw an unhandled std::length_error that exited the editor's main loop. Now clamped, with the buffers freed on every failure path. Guardrails (replacing two deferred refactors: e2e→production-code injection and collapsing the four copies of the worker-lifecycle machinery) E-18 the source contract asserted comment-string counts — rewording failed CI while moving a guard outside its #ifdef passed. It now parses the #ifdef regions and asserts on code. service-stub-parity.ts pins what the four lifecycle copies must share: credit-window equality parsed from source, the finally-ack, boot deadlines, terminal-notice consumption. The transport numbers are now single-sourced from the worker. CI actually runs the gates: the web/standalone vitest suites (which had NEVER run in CI), the reducer, the source contract and the parity tool — with a NON_PLAYWRIGHT_GATES check so deleting a step re-fails the lint. E-22 the e2e occ stub's 60s boot watchdog, deleted in a66e109, is restored in the ngspice-stub shape with a wedgeNextBoot() repro hook. Every behavioral fix has red-then-green evidence (the reds were captured first). E-17 (a stale RUNNING cross-stamping the next run's generation under E-6's transport deferral) is DEFERRED with its analysis recorded — a real fix needs run identity on the bg frames. Test hygiene: the dwell lint now requires the mandated ": <why>" and all 47 bare markers carry their reason; three export-report dwells became modal-lease polls; exact-ledger assertions became relative deltas; the dead data-wx-dom-id branch, an unused fault hook and unused receipt plumbing are gone; abort scans, wx dialog drivers, the sim harness and the vitest FakeWorker are each one copy now. Bumps kicad and wxwidgets to their findings-group-e tips. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-27 12:27:12 +02:00
await page.mouse.click(retryExport.x, retryExport.y);
findings(E-5,E-8,E-9): module-identity ngspice events + runWaitCompletion admission gate E-8 (re-implemented for JSPI — the codex gate is entangled with the dropped execution owner; under JSPI a fresh non-suspending JS→wasm entry while another activation is suspended is structurally safe on its own stack, so the admission boundary for worker completions is liveness + trap state, not execution ownership): - jspi-scheduler.js grows `terminal` (trapped instance; distinct from `dead`), canTouchNative(), _terminalizeNativeTrap() (WebAssembly.RuntimeError + cross-realm string classification), and runWaitCompletion(site, token, prepare, inertResult): prepare runs immediately and owns ALL native work; stale tokens and dead/terminal instances drop loudly without resolving (resolving would resume the parked frame inside the damaged module); a trap latches terminal; a plain JS bug resolves inertResult so the wait fails instead of stranding. beginWait refuses (token 0) when dead/terminal. - all four delayed completion sites route their native work through the gate: 'OCC export completion' (exporter_step_stub), 'OCC model completion' (oce_plugin_stub — the MEMFS cache write moves inside the gate too), 'ngspice request completion' and 'ngspice vector completion' (sharedspice_client — every HEAP32/HEAPF64/malloc write inside prepare, inertResult 1 = transport error). Every wxWasmBeginWait caller in the stubs bails on token <= 0. - deliberately NOT ported from codex: ownerModule, enqueueNativeCompletion, executionBarrier, the byte-credit native-entry FIFO — completions are one-shot per wait token and stream volume is bounded at the E-6 transport credit window. Cross-refs logged for group M (M-2/M-6/M-8). E-5 (re-implemented; codex shape kept, owner APIs replaced with the E-8 gate): js_ngspice_install_events binds the handler to the EXACT installing module (handler.__pcbjamNgspiceOwnerModule stamp; presence is not identity), re-installation replaces a foreign module's handler, a superseded handler disarms itself, native entry goes through installingModule._malloc/ ._pcbjam_ngspice_event (never lexical Module), each dispatch checks canTouchNative() (loud drop on a dead/terminal module), and a trap on the per-line entry latches the terminal gate. Tests: scheduler-shim.test.ts +7 (gate happy/stale/dead/terminal/cross-realm/ js-bug/beginWait-refusal). e2e specs updated from the codex line: occ-export decode-fault recovery (real onmessageerror transition via failDecode, J-4), ngspice-probe direct-service coverage, eeschema-sim rewritten onto the E-7 applied-generation receipt (codex's executionBarrier await replaced with a pendingWaits('ngspice') drain poll — the JSPI-line equivalent). Also bumps the kicad submodule to the E-7/E-9 commit (dd5751038f7). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-19 16:03:16 +02:00
await expect.poll(
() => page.evaluate(() => (globalThis as any)
.__occServiceTestHooks.snapshot().requestsStarted),
{
message: 'the exact parent retry must enter the OCC provider once',
timeout: 10000,
},
).toBe(failed.service.requestsStarted + 1);
await expect.poll(
() => page.evaluate(() => (globalThis as any)
.__occServiceTestHooks.snapshot().activeGeneration),
{ message: 'the retry must boot a replacement worker generation', timeout: 30000 },
).toBe(2);
await page.waitForFunction(
() => ((window as any).__occExports?.length ?? 0) === 1,
null,
{ timeout: 180000 },
);
const recovered = await page.evaluate(() => {
const runtime = globalThis as any;
return {
exports: runtime.__occExports,
service: runtime.__occServiceTestHooks.snapshot(),
schedulerDead: runtime.__wxScheduler?.dead === true,
occWaits: runtime.__wxScheduler?.pendingWaits?.('occ') ?? -1,
};
});
expect(recovered.exports).toHaveLength(1);
expect(recovered.exports[0].magic.startsWith('ISO-10303-21'), 'retry returns real STEP bytes')
.toBe(true);
expect(recovered.exports[0].size, 'retry returns a non-trivial STEP file')
.toBeGreaterThan(10_000);
expect(recovered.service.activeGeneration, 'retry must own a replacement generation').toBe(2);
expect(recovered.service.requestsStarted,
findings(E-10..E-22): fix the defects a code review found in the E-1..E-9 work A review of the group-E fixes found 13 further defects; ten were introduced by those fixes, two pre-existed and were merely relocated, one is deferred. Services / transport E-10 retireWorker synthesized no bg/exit frame, so sharedspice's s_bgRunning mirror stayed latched true after a mid-run worker death: Run stayed disabled and the promised fresh-worker restart was unreachable for the whole session. Retirement now dispatches a synthetic controlled-exit straight to the installed handler (never through dispatchEvt — a fabricated frame must not touch the credit ledger). Driving the repro exposed two further defects, both fixed here: a replacement worker trapped on pre-init engine reads, and the rerun's cm_input_path/circ hit that uninitialized engine before KiCad's validate() re-init (the native flow assumes a crashed engine survives in-process — true for the dll, false for a dead worker). Reads now answer their empty shapes pre-init, writes lazy-init, and init is idempotent per worker engine. E-19 dispatchEvt acked only AFTER handler(evt) returned, and the sharedspice client deliberately rethrows non-trap errors — so each throw leaked one unit of the 64-frame credit window until the stream died with a misattributed "transport exceeded". The ack moves to a finally in both service copies; the throw still propagates (the trap machinery needs it). E-20 the oversize-line path promises to transfer the accepted prefix, but with the window full that flush only DEFERS, and stopEventStream wiped the deferred queue — losing the diagnostics that explain the failure. The terminal notice now carries them as pendingEvents; both hosts deliver them in order, unacked (the fatal frame is outside the credit protocol). E-21 the 30s prefetch deadline discarded every model already collected and reported nothing. A caller-owned progress sink ships the partials and the omission reaches the export report. (Awaiting the aborted collection was rejected: an in-flight source fetch is not abortable — E-4's original disease.) Plus a serving-candidate memo, so a .wrl ref served by its .step fallback stops re-probing the miss on every export. Scheduler E-14 _terminalizeNativeTrap classified by message substring, so any plain JS error QUOTING 'Aborted(' or 'out of bounds' permanently bricked a healthy instance. Now structural only: instanceof RuntimeError plus a duck-typed name check (verified in this build's glue that abort() throws a genuine RuntimeError both pre- and post-runtime-init). Module.onAbort now latches the gate — the authoritative notification, previously ignored. E-15 the shim half: _pumpResume gates on terminal (catching wakes already queued at latch time) and resolveWait refuses on terminal WITHOUT consuming the entry, so a frame stays visibly parked rather than resuming inside a trapped module. E-16 the E-5 handler read the realm-global scheduler at dispatch instead of its installing module's; also frees the per-line buffer on the non-trap rethrow path. E-11 get_vec trusted the worker's res.length over the transferred arrays. Observed death shape: a 4 GiB std::vector threw an unhandled std::length_error that exited the editor's main loop. Now clamped, with the buffers freed on every failure path. Guardrails (replacing two deferred refactors: e2e→production-code injection and collapsing the four copies of the worker-lifecycle machinery) E-18 the source contract asserted comment-string counts — rewording failed CI while moving a guard outside its #ifdef passed. It now parses the #ifdef regions and asserts on code. service-stub-parity.ts pins what the four lifecycle copies must share: credit-window equality parsed from source, the finally-ack, boot deadlines, terminal-notice consumption. The transport numbers are now single-sourced from the worker. CI actually runs the gates: the web/standalone vitest suites (which had NEVER run in CI), the reducer, the source contract and the parity tool — with a NON_PLAYWRIGHT_GATES check so deleting a step re-fails the lint. E-22 the e2e occ stub's 60s boot watchdog, deleted in a66e109, is restored in the ngspice-stub shape with a wedgeNextBoot() repro hook. Every behavioral fix has red-then-green evidence (the reds were captured first). E-17 (a stale RUNNING cross-stamping the next run's generation under E-6's transport deferral) is DEFERRED with its analysis recorded — a real fix needs run identity on the bg frames. Test hygiene: the dwell lint now requires the mandated ": <why>" and all 47 bare markers carry their reason; three export-report dwells became modal-lease polls; exact-ledger assertions became relative deltas; the dead data-wx-dom-id branch, an unused fault hook and unused receipt plumbing are gone; abort scans, wx dialog drivers, the sim harness and the vitest FakeWorker are each one copy now. Bumps kicad and wxwidgets to their findings-group-e tips. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-27 12:27:12 +02:00
'the parent retry must add exactly one provider entry')
.toBe(failed.service.requestsStarted + 1);
findings(E-5,E-8,E-9): module-identity ngspice events + runWaitCompletion admission gate E-8 (re-implemented for JSPI — the codex gate is entangled with the dropped execution owner; under JSPI a fresh non-suspending JS→wasm entry while another activation is suspended is structurally safe on its own stack, so the admission boundary for worker completions is liveness + trap state, not execution ownership): - jspi-scheduler.js grows `terminal` (trapped instance; distinct from `dead`), canTouchNative(), _terminalizeNativeTrap() (WebAssembly.RuntimeError + cross-realm string classification), and runWaitCompletion(site, token, prepare, inertResult): prepare runs immediately and owns ALL native work; stale tokens and dead/terminal instances drop loudly without resolving (resolving would resume the parked frame inside the damaged module); a trap latches terminal; a plain JS bug resolves inertResult so the wait fails instead of stranding. beginWait refuses (token 0) when dead/terminal. - all four delayed completion sites route their native work through the gate: 'OCC export completion' (exporter_step_stub), 'OCC model completion' (oce_plugin_stub — the MEMFS cache write moves inside the gate too), 'ngspice request completion' and 'ngspice vector completion' (sharedspice_client — every HEAP32/HEAPF64/malloc write inside prepare, inertResult 1 = transport error). Every wxWasmBeginWait caller in the stubs bails on token <= 0. - deliberately NOT ported from codex: ownerModule, enqueueNativeCompletion, executionBarrier, the byte-credit native-entry FIFO — completions are one-shot per wait token and stream volume is bounded at the E-6 transport credit window. Cross-refs logged for group M (M-2/M-6/M-8). E-5 (re-implemented; codex shape kept, owner APIs replaced with the E-8 gate): js_ngspice_install_events binds the handler to the EXACT installing module (handler.__pcbjamNgspiceOwnerModule stamp; presence is not identity), re-installation replaces a foreign module's handler, a superseded handler disarms itself, native entry goes through installingModule._malloc/ ._pcbjam_ngspice_event (never lexical Module), each dispatch checks canTouchNative() (loud drop on a dead/terminal module), and a trap on the per-line entry latches the terminal gate. Tests: scheduler-shim.test.ts +7 (gate happy/stale/dead/terminal/cross-realm/ js-bug/beginWait-refusal). e2e specs updated from the codex line: occ-export decode-fault recovery (real onmessageerror transition via failDecode, J-4), ngspice-probe direct-service coverage, eeschema-sim rewritten onto the E-7 applied-generation receipt (codex's executionBarrier await replaced with a pendingWaits('ngspice') drain poll — the JSPI-line equivalent). Also bumps the kicad submodule to the E-7/E-9 commit (dd5751038f7). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-19 16:03:16 +02:00
expect(recovered.service.requestsPosted,
findings(E-10..E-22): fix the defects a code review found in the E-1..E-9 work A review of the group-E fixes found 13 further defects; ten were introduced by those fixes, two pre-existed and were merely relocated, one is deferred. Services / transport E-10 retireWorker synthesized no bg/exit frame, so sharedspice's s_bgRunning mirror stayed latched true after a mid-run worker death: Run stayed disabled and the promised fresh-worker restart was unreachable for the whole session. Retirement now dispatches a synthetic controlled-exit straight to the installed handler (never through dispatchEvt — a fabricated frame must not touch the credit ledger). Driving the repro exposed two further defects, both fixed here: a replacement worker trapped on pre-init engine reads, and the rerun's cm_input_path/circ hit that uninitialized engine before KiCad's validate() re-init (the native flow assumes a crashed engine survives in-process — true for the dll, false for a dead worker). Reads now answer their empty shapes pre-init, writes lazy-init, and init is idempotent per worker engine. E-19 dispatchEvt acked only AFTER handler(evt) returned, and the sharedspice client deliberately rethrows non-trap errors — so each throw leaked one unit of the 64-frame credit window until the stream died with a misattributed "transport exceeded". The ack moves to a finally in both service copies; the throw still propagates (the trap machinery needs it). E-20 the oversize-line path promises to transfer the accepted prefix, but with the window full that flush only DEFERS, and stopEventStream wiped the deferred queue — losing the diagnostics that explain the failure. The terminal notice now carries them as pendingEvents; both hosts deliver them in order, unacked (the fatal frame is outside the credit protocol). E-21 the 30s prefetch deadline discarded every model already collected and reported nothing. A caller-owned progress sink ships the partials and the omission reaches the export report. (Awaiting the aborted collection was rejected: an in-flight source fetch is not abortable — E-4's original disease.) Plus a serving-candidate memo, so a .wrl ref served by its .step fallback stops re-probing the miss on every export. Scheduler E-14 _terminalizeNativeTrap classified by message substring, so any plain JS error QUOTING 'Aborted(' or 'out of bounds' permanently bricked a healthy instance. Now structural only: instanceof RuntimeError plus a duck-typed name check (verified in this build's glue that abort() throws a genuine RuntimeError both pre- and post-runtime-init). Module.onAbort now latches the gate — the authoritative notification, previously ignored. E-15 the shim half: _pumpResume gates on terminal (catching wakes already queued at latch time) and resolveWait refuses on terminal WITHOUT consuming the entry, so a frame stays visibly parked rather than resuming inside a trapped module. E-16 the E-5 handler read the realm-global scheduler at dispatch instead of its installing module's; also frees the per-line buffer on the non-trap rethrow path. E-11 get_vec trusted the worker's res.length over the transferred arrays. Observed death shape: a 4 GiB std::vector threw an unhandled std::length_error that exited the editor's main loop. Now clamped, with the buffers freed on every failure path. Guardrails (replacing two deferred refactors: e2e→production-code injection and collapsing the four copies of the worker-lifecycle machinery) E-18 the source contract asserted comment-string counts — rewording failed CI while moving a guard outside its #ifdef passed. It now parses the #ifdef regions and asserts on code. service-stub-parity.ts pins what the four lifecycle copies must share: credit-window equality parsed from source, the finally-ack, boot deadlines, terminal-notice consumption. The transport numbers are now single-sourced from the worker. CI actually runs the gates: the web/standalone vitest suites (which had NEVER run in CI), the reducer, the source contract and the parity tool — with a NON_PLAYWRIGHT_GATES check so deleting a step re-fails the lint. E-22 the e2e occ stub's 60s boot watchdog, deleted in a66e109, is restored in the ngspice-stub shape with a wedgeNextBoot() repro hook. Every behavioral fix has red-then-green evidence (the reds were captured first). E-17 (a stale RUNNING cross-stamping the next run's generation under E-6's transport deferral) is DEFERRED with its analysis recorded — a real fix needs run identity on the bg frames. Test hygiene: the dwell lint now requires the mandated ": <why>" and all 47 bare markers carry their reason; three export-report dwells became modal-lease polls; exact-ledger assertions became relative deltas; the dead data-wx-dom-id branch, an unused fault hook and unused receipt plumbing are gone; abort scans, wx dialog drivers, the sim harness and the vitest FakeWorker are each one copy now. Bumps kicad and wxwidgets to their findings-group-e tips. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-27 12:27:12 +02:00
'the parent retry must post exactly once to the replacement worker')
.toBe(failed.service.requestsPosted + 1);
expect(recovered.service.workerGenerationsStarted,
'the retry must create exactly one replacement generation')
.toHaveLength(failed.service.workerGenerationsStarted.length + 1);
findings(E-5,E-8,E-9): module-identity ngspice events + runWaitCompletion admission gate E-8 (re-implemented for JSPI — the codex gate is entangled with the dropped execution owner; under JSPI a fresh non-suspending JS→wasm entry while another activation is suspended is structurally safe on its own stack, so the admission boundary for worker completions is liveness + trap state, not execution ownership): - jspi-scheduler.js grows `terminal` (trapped instance; distinct from `dead`), canTouchNative(), _terminalizeNativeTrap() (WebAssembly.RuntimeError + cross-realm string classification), and runWaitCompletion(site, token, prepare, inertResult): prepare runs immediately and owns ALL native work; stale tokens and dead/terminal instances drop loudly without resolving (resolving would resume the parked frame inside the damaged module); a trap latches terminal; a plain JS bug resolves inertResult so the wait fails instead of stranding. beginWait refuses (token 0) when dead/terminal. - all four delayed completion sites route their native work through the gate: 'OCC export completion' (exporter_step_stub), 'OCC model completion' (oce_plugin_stub — the MEMFS cache write moves inside the gate too), 'ngspice request completion' and 'ngspice vector completion' (sharedspice_client — every HEAP32/HEAPF64/malloc write inside prepare, inertResult 1 = transport error). Every wxWasmBeginWait caller in the stubs bails on token <= 0. - deliberately NOT ported from codex: ownerModule, enqueueNativeCompletion, executionBarrier, the byte-credit native-entry FIFO — completions are one-shot per wait token and stream volume is bounded at the E-6 transport credit window. Cross-refs logged for group M (M-2/M-6/M-8). E-5 (re-implemented; codex shape kept, owner APIs replaced with the E-8 gate): js_ngspice_install_events binds the handler to the EXACT installing module (handler.__pcbjamNgspiceOwnerModule stamp; presence is not identity), re-installation replaces a foreign module's handler, a superseded handler disarms itself, native entry goes through installingModule._malloc/ ._pcbjam_ngspice_event (never lexical Module), each dispatch checks canTouchNative() (loud drop on a dead/terminal module), and a trap on the per-line entry latches the terminal gate. Tests: scheduler-shim.test.ts +7 (gate happy/stale/dead/terminal/cross-realm/ js-bug/beginWait-refusal). e2e specs updated from the codex line: occ-export decode-fault recovery (real onmessageerror transition via failDecode, J-4), ngspice-probe direct-service coverage, eeschema-sim rewritten onto the E-7 applied-generation receipt (codex's executionBarrier await replaced with a pendingWaits('ngspice') drain poll — the JSPI-line equivalent). Also bumps the kicad submodule to the E-7/E-9 commit (dd5751038f7). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-19 16:03:16 +02:00
expect(recovered.service.workerGenerationsStarted,
findings(E-10..E-22): fix the defects a code review found in the E-1..E-9 work A review of the group-E fixes found 13 further defects; ten were introduced by those fixes, two pre-existed and were merely relocated, one is deferred. Services / transport E-10 retireWorker synthesized no bg/exit frame, so sharedspice's s_bgRunning mirror stayed latched true after a mid-run worker death: Run stayed disabled and the promised fresh-worker restart was unreachable for the whole session. Retirement now dispatches a synthetic controlled-exit straight to the installed handler (never through dispatchEvt — a fabricated frame must not touch the credit ledger). Driving the repro exposed two further defects, both fixed here: a replacement worker trapped on pre-init engine reads, and the rerun's cm_input_path/circ hit that uninitialized engine before KiCad's validate() re-init (the native flow assumes a crashed engine survives in-process — true for the dll, false for a dead worker). Reads now answer their empty shapes pre-init, writes lazy-init, and init is idempotent per worker engine. E-19 dispatchEvt acked only AFTER handler(evt) returned, and the sharedspice client deliberately rethrows non-trap errors — so each throw leaked one unit of the 64-frame credit window until the stream died with a misattributed "transport exceeded". The ack moves to a finally in both service copies; the throw still propagates (the trap machinery needs it). E-20 the oversize-line path promises to transfer the accepted prefix, but with the window full that flush only DEFERS, and stopEventStream wiped the deferred queue — losing the diagnostics that explain the failure. The terminal notice now carries them as pendingEvents; both hosts deliver them in order, unacked (the fatal frame is outside the credit protocol). E-21 the 30s prefetch deadline discarded every model already collected and reported nothing. A caller-owned progress sink ships the partials and the omission reaches the export report. (Awaiting the aborted collection was rejected: an in-flight source fetch is not abortable — E-4's original disease.) Plus a serving-candidate memo, so a .wrl ref served by its .step fallback stops re-probing the miss on every export. Scheduler E-14 _terminalizeNativeTrap classified by message substring, so any plain JS error QUOTING 'Aborted(' or 'out of bounds' permanently bricked a healthy instance. Now structural only: instanceof RuntimeError plus a duck-typed name check (verified in this build's glue that abort() throws a genuine RuntimeError both pre- and post-runtime-init). Module.onAbort now latches the gate — the authoritative notification, previously ignored. E-15 the shim half: _pumpResume gates on terminal (catching wakes already queued at latch time) and resolveWait refuses on terminal WITHOUT consuming the entry, so a frame stays visibly parked rather than resuming inside a trapped module. E-16 the E-5 handler read the realm-global scheduler at dispatch instead of its installing module's; also frees the per-line buffer on the non-trap rethrow path. E-11 get_vec trusted the worker's res.length over the transferred arrays. Observed death shape: a 4 GiB std::vector threw an unhandled std::length_error that exited the editor's main loop. Now clamped, with the buffers freed on every failure path. Guardrails (replacing two deferred refactors: e2e→production-code injection and collapsing the four copies of the worker-lifecycle machinery) E-18 the source contract asserted comment-string counts — rewording failed CI while moving a guard outside its #ifdef passed. It now parses the #ifdef regions and asserts on code. service-stub-parity.ts pins what the four lifecycle copies must share: credit-window equality parsed from source, the finally-ack, boot deadlines, terminal-notice consumption. The transport numbers are now single-sourced from the worker. CI actually runs the gates: the web/standalone vitest suites (which had NEVER run in CI), the reducer, the source contract and the parity tool — with a NON_PLAYWRIGHT_GATES check so deleting a step re-fails the lint. E-22 the e2e occ stub's 60s boot watchdog, deleted in a66e109, is restored in the ngspice-stub shape with a wedgeNextBoot() repro hook. Every behavioral fix has red-then-green evidence (the reds were captured first). E-17 (a stale RUNNING cross-stamping the next run's generation under E-6's transport deferral) is DEFERRED with its analysis recorded — a real fix needs run identity on the bg frames. Test hygiene: the dwell lint now requires the mandated ": <why>" and all 47 bare markers carry their reason; three export-report dwells became modal-lease polls; exact-ledger assertions became relative deltas; the dead data-wx-dom-id branch, an unused fault hook and unused receipt plumbing are gone; abort scans, wx dialog drivers, the sim harness and the vitest FakeWorker are each one copy now. Bumps kicad and wxwidgets to their findings-group-e tips. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-27 12:27:12 +02:00
'the replacement generation must be the active one').toContain(2);
findings(E-5,E-8,E-9): module-identity ngspice events + runWaitCompletion admission gate E-8 (re-implemented for JSPI — the codex gate is entangled with the dropped execution owner; under JSPI a fresh non-suspending JS→wasm entry while another activation is suspended is structurally safe on its own stack, so the admission boundary for worker completions is liveness + trap state, not execution ownership): - jspi-scheduler.js grows `terminal` (trapped instance; distinct from `dead`), canTouchNative(), _terminalizeNativeTrap() (WebAssembly.RuntimeError + cross-realm string classification), and runWaitCompletion(site, token, prepare, inertResult): prepare runs immediately and owns ALL native work; stale tokens and dead/terminal instances drop loudly without resolving (resolving would resume the parked frame inside the damaged module); a trap latches terminal; a plain JS bug resolves inertResult so the wait fails instead of stranding. beginWait refuses (token 0) when dead/terminal. - all four delayed completion sites route their native work through the gate: 'OCC export completion' (exporter_step_stub), 'OCC model completion' (oce_plugin_stub — the MEMFS cache write moves inside the gate too), 'ngspice request completion' and 'ngspice vector completion' (sharedspice_client — every HEAP32/HEAPF64/malloc write inside prepare, inertResult 1 = transport error). Every wxWasmBeginWait caller in the stubs bails on token <= 0. - deliberately NOT ported from codex: ownerModule, enqueueNativeCompletion, executionBarrier, the byte-credit native-entry FIFO — completions are one-shot per wait token and stream volume is bounded at the E-6 transport credit window. Cross-refs logged for group M (M-2/M-6/M-8). E-5 (re-implemented; codex shape kept, owner APIs replaced with the E-8 gate): js_ngspice_install_events binds the handler to the EXACT installing module (handler.__pcbjamNgspiceOwnerModule stamp; presence is not identity), re-installation replaces a foreign module's handler, a superseded handler disarms itself, native entry goes through installingModule._malloc/ ._pcbjam_ngspice_event (never lexical Module), each dispatch checks canTouchNative() (loud drop on a dead/terminal module), and a trap on the per-line entry latches the terminal gate. Tests: scheduler-shim.test.ts +7 (gate happy/stale/dead/terminal/cross-realm/ js-bug/beginWait-refusal). e2e specs updated from the codex line: occ-export decode-fault recovery (real onmessageerror transition via failDecode, J-4), ngspice-probe direct-service coverage, eeschema-sim rewritten onto the E-7 applied-generation receipt (codex's executionBarrier await replaced with a pendingWaits('ngspice') drain poll — the JSPI-line equivalent). Also bumps the kicad submodule to the E-7/E-9 commit (dd5751038f7). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-19 16:03:16 +02:00
expect(recovered.service.pending, 'replacement generation must quiesce').toBe(0);
expect(recovered.schedulerDead, 'the worker failure must not terminalize the editor').toBe(false);
expect(recovered.occWaits, 'the replacement native OCC wait must quiesce').toBe(0);
findings(E-10..E-22): fix the defects a code review found in the E-1..E-9 work A review of the group-E fixes found 13 further defects; ten were introduced by those fixes, two pre-existed and were merely relocated, one is deferred. Services / transport E-10 retireWorker synthesized no bg/exit frame, so sharedspice's s_bgRunning mirror stayed latched true after a mid-run worker death: Run stayed disabled and the promised fresh-worker restart was unreachable for the whole session. Retirement now dispatches a synthetic controlled-exit straight to the installed handler (never through dispatchEvt — a fabricated frame must not touch the credit ledger). Driving the repro exposed two further defects, both fixed here: a replacement worker trapped on pre-init engine reads, and the rerun's cm_input_path/circ hit that uninitialized engine before KiCad's validate() re-init (the native flow assumes a crashed engine survives in-process — true for the dll, false for a dead worker). Reads now answer their empty shapes pre-init, writes lazy-init, and init is idempotent per worker engine. E-19 dispatchEvt acked only AFTER handler(evt) returned, and the sharedspice client deliberately rethrows non-trap errors — so each throw leaked one unit of the 64-frame credit window until the stream died with a misattributed "transport exceeded". The ack moves to a finally in both service copies; the throw still propagates (the trap machinery needs it). E-20 the oversize-line path promises to transfer the accepted prefix, but with the window full that flush only DEFERS, and stopEventStream wiped the deferred queue — losing the diagnostics that explain the failure. The terminal notice now carries them as pendingEvents; both hosts deliver them in order, unacked (the fatal frame is outside the credit protocol). E-21 the 30s prefetch deadline discarded every model already collected and reported nothing. A caller-owned progress sink ships the partials and the omission reaches the export report. (Awaiting the aborted collection was rejected: an in-flight source fetch is not abortable — E-4's original disease.) Plus a serving-candidate memo, so a .wrl ref served by its .step fallback stops re-probing the miss on every export. Scheduler E-14 _terminalizeNativeTrap classified by message substring, so any plain JS error QUOTING 'Aborted(' or 'out of bounds' permanently bricked a healthy instance. Now structural only: instanceof RuntimeError plus a duck-typed name check (verified in this build's glue that abort() throws a genuine RuntimeError both pre- and post-runtime-init). Module.onAbort now latches the gate — the authoritative notification, previously ignored. E-15 the shim half: _pumpResume gates on terminal (catching wakes already queued at latch time) and resolveWait refuses on terminal WITHOUT consuming the entry, so a frame stays visibly parked rather than resuming inside a trapped module. E-16 the E-5 handler read the realm-global scheduler at dispatch instead of its installing module's; also frees the per-line buffer on the non-trap rethrow path. E-11 get_vec trusted the worker's res.length over the transferred arrays. Observed death shape: a 4 GiB std::vector threw an unhandled std::length_error that exited the editor's main loop. Now clamped, with the buffers freed on every failure path. Guardrails (replacing two deferred refactors: e2e→production-code injection and collapsing the four copies of the worker-lifecycle machinery) E-18 the source contract asserted comment-string counts — rewording failed CI while moving a guard outside its #ifdef passed. It now parses the #ifdef regions and asserts on code. service-stub-parity.ts pins what the four lifecycle copies must share: credit-window equality parsed from source, the finally-ack, boot deadlines, terminal-notice consumption. The transport numbers are now single-sourced from the worker. CI actually runs the gates: the web/standalone vitest suites (which had NEVER run in CI), the reducer, the source contract and the parity tool — with a NON_PLAYWRIGHT_GATES check so deleting a step re-fails the lint. E-22 the e2e occ stub's 60s boot watchdog, deleted in a66e109, is restored in the ngspice-stub shape with a wedgeNextBoot() repro hook. Every behavioral fix has red-then-green evidence (the reds were captured first). E-17 (a stale RUNNING cross-stamping the next run's generation under E-6's transport deferral) is DEFERRED with its analysis recorded — a real fix needs run identity on the bg frames. Test hygiene: the dwell lint now requires the mandated ": <why>" and all 47 bare markers carry their reason; three export-report dwells became modal-lease polls; exact-ledger assertions became relative deltas; the dead data-wx-dom-id branch, an unused fault hook and unused receipt plumbing are gone; abort scans, wx dialog drivers, the sim harness and the vitest FakeWorker are each one copy now. Bumps kicad and wxwidgets to their findings-group-e tips. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-27 12:27:12 +02:00
// Dismiss the retry's "Export complete" report dialog via its modal
// lease (export dialog holds 1; the report raises it to 2).
await dismissReportDialog(page, 1, 'retry export complete');
findings(E-5,E-8,E-9): module-identity ngspice events + runWaitCompletion admission gate E-8 (re-implemented for JSPI — the codex gate is entangled with the dropped execution owner; under JSPI a fresh non-suspending JS→wasm entry while another activation is suspended is structurally safe on its own stack, so the admission boundary for worker completions is liveness + trap state, not execution ownership): - jspi-scheduler.js grows `terminal` (trapped instance; distinct from `dead`), canTouchNative(), _terminalizeNativeTrap() (WebAssembly.RuntimeError + cross-realm string classification), and runWaitCompletion(site, token, prepare, inertResult): prepare runs immediately and owns ALL native work; stale tokens and dead/terminal instances drop loudly without resolving (resolving would resume the parked frame inside the damaged module); a trap latches terminal; a plain JS bug resolves inertResult so the wait fails instead of stranding. beginWait refuses (token 0) when dead/terminal. - all four delayed completion sites route their native work through the gate: 'OCC export completion' (exporter_step_stub), 'OCC model completion' (oce_plugin_stub — the MEMFS cache write moves inside the gate too), 'ngspice request completion' and 'ngspice vector completion' (sharedspice_client — every HEAP32/HEAPF64/malloc write inside prepare, inertResult 1 = transport error). Every wxWasmBeginWait caller in the stubs bails on token <= 0. - deliberately NOT ported from codex: ownerModule, enqueueNativeCompletion, executionBarrier, the byte-credit native-entry FIFO — completions are one-shot per wait token and stream volume is bounded at the E-6 transport credit window. Cross-refs logged for group M (M-2/M-6/M-8). E-5 (re-implemented; codex shape kept, owner APIs replaced with the E-8 gate): js_ngspice_install_events binds the handler to the EXACT installing module (handler.__pcbjamNgspiceOwnerModule stamp; presence is not identity), re-installation replaces a foreign module's handler, a superseded handler disarms itself, native entry goes through installingModule._malloc/ ._pcbjam_ngspice_event (never lexical Module), each dispatch checks canTouchNative() (loud drop on a dead/terminal module), and a trap on the per-line entry latches the terminal gate. Tests: scheduler-shim.test.ts +7 (gate happy/stale/dead/terminal/cross-realm/ js-bug/beginWait-refusal). e2e specs updated from the codex line: occ-export decode-fault recovery (real onmessageerror transition via failDecode, J-4), ngspice-probe direct-service coverage, eeschema-sim rewritten onto the E-7 applied-generation receipt (codex's executionBarrier await replaced with a pendingWaits('ngspice') drain poll — the JSPI-line equivalent). Also bumps the kicad submodule to the E-7/E-9 commit (dd5751038f7). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-19 16:03:16 +02:00
});
feat(wasm): occ-split — lazy occ_service worker; kicad_editor drops OCC (−31%) Move OpenCASCADE out of the merged editor image into occ_service: a separate emscripten module (-sASYNCIFY=0, MODULARIZE, in-container -Oz finalize, 2N+8 pre-warmed pthread pool) booted lazily in a dedicated Web Worker on the first STEP export or STEP/IGES model parse. kicad_editor.wasm ~190 MB -> 130 MB; sessions that never touch OCC never fetch its 57 MB. STEP export works in the browser for the first time: the unchanged desktop dialog runs EXPORTER_STEP, whose wasm shadow suspends into globalThis.occService and the export bytes go straight to a browser download (never entering the editor heap). STEP/IGES 3D models parse in the worker via the oce shadow (S3D WriteCache/ReadCache wire). - wasm/occ-service/: service CMake target (hooked from the kicad fork's top-level CMakeLists, wasm/editor pattern), embind entry (occExport/occLoadModel), wxConfig pre-js. - wasm/stubs/{exporter_step,oce_plugin}_stub.cpp: EM_ASYNC_JS worker bridges (callee-shadowing; no caller #ifdefs). - web/standalone: provider installed whenever the kicad_editor bundle boots (cross-face safe); ONE shared worker-boot source occ-worker.js (vite ?raw; the e2e stub reads the same file) — blob worker with locateFile absolutized against the glue URL; export download-name guard. - deps: OCC builds with RapidJSON so its glTF/GLB writer exists — pinned to the vcpkg master snapshot 2025-02-26 (24b5e7a8b27f), the same code official KiCad consumes via vcpkg.json's opencascade[rapidjson]; rapidjson's latest tag (v1.1.0, 2016) is ill-formed under modern clang. - tests: occ-export dialog e2e (lazy-fetch boundary + STEP download bytes), occ-probe incl. a 9-format matrix (step/stpz/brep/xao/ply/stl/glb/u3d/pdf), 3d-viewer-models hard-asserts the worker parse; occ provider stub installed ambiently by the kicad fixtures. Validated against desktop kicad-cli 10.0.4: geometric exact equality (bbox delta 0 um, volume delta 0.0000%) for STEP/GLB/STL/BREP/STPZ across three boards and option sweeps — with desktop OCC 7.9 vs wasm OCC 7.8; PLY/XAO/PDF structurally equal; U3D same-size (quantizer float LSBs differ). Full kicad e2e green on Firefox and Chromium; standalone verified end to end (lazy fetch only on the Export click; export.step 60,628 B ISO-10303-21; loadModel 700 KB STEP -> 569 KB scenegraph cache). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 12:39:58 +02:00
});