findings(E-5,E-6): validation-round fixes — live e2e falsified two ported shapes

E-5: the module-identity bridge called installingModule._malloc, but this
build exposes _malloc only as a bare glue-closure export (Module._malloc is
absent) — every char/stat event entry threw TypeError, which also starved
the E-6 credit window (thrown dispatches never acked) and wedged the queued
bg-finished frame behind them. The bridge now uses the bare closure exports
(identity is still exact: the EM_JS body IS the installing module's closure;
the __ngspiceOnEvent self-disarm covers supersession).

E-6 (codex reference design corrected — its validation matrix never ran):
a FULL credit window was terminal (stopEventStream at 64 in-flight frames).
Under live e2e that killed a real simulation: bg-thread emissions proxy one
per task, so each line ships as its own frame and a normal transient outruns
a busy main thread. A full window now DEFERS into a bounded FIFO (512 events
/ 4 MiB) drained in order as acks free credit; only true overload or an
invalid ack is terminal. Retention stays bounded (8 MiB in flight + 4 MiB
deferred + 1 MiB open batch). And the service/harness mirror queue now acks
at ENQUEUE — placing a frame in the bounded pre-handler queue is taking
ownership; without that, a stream starting before the C++ handler installs
(the ngspice-probe page) starves the worker window forever.

Test updates: worker-batch reducer — new "a full credit window defers and
drains in order, never terminal" case pinning the regression; the storm case
now proves the deferred caps are the terminal edge. board-ready.ts gains the
owner-free openBoardProgrammatically (codex helper the ported occ-export
spec needs; the barrier-based waitForUiBoardReady was NOT taken).
occ-export.spec: domId is optional on this line's registry (coordinate
fallback is the supported path).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/tools/ngspice-worker-batch-unit.ts

@@ -18,7 +18,7 @@ const workerSource = readFileSync(
 
 type Frame = {
   id?: number;
-  evt?: { kind: string; lines?: string[] };
+  evt?: { kind: string; lines?: string[]; finished?: boolean };
   fatal?: string;
   res?: { error?: string };
   eventSequence?: number;
@@ -150,9 +150,35 @@ assert.ok(
     <= 8 * 1024 * 1024,
 );
 assert.equal(storm.frames.filter((frame) => frame.fatal).length, 1);
-assert.match(storm.frames.find((frame) => frame.fatal)!.fatal!, /unacknowledged/);
+assert.match(storm.frames.find((frame) => frame.fatal)!.fatal!, /deferred/);
 console.log("ok   100,000 synchronous chunk attempts cannot exceed transport credit");
 
+// A FULL credit window is backpressure, not a fault: frames beyond the window
+// defer (bounded) and drain IN ORDER as acks free credit. The regression this
+// pins: the first shipped shape terminally stopped the stream at 64 in-flight
+// frames, killing a live simulation whenever the main thread lagged one
+// window behind (observed as "event transport exceeded 64 frames" ending the
+// eeschema second-run spec).
+const paced = await createWorkerHarness();
+for (let i = 0; i < 80; ++i) {
+  paced.emit(2, "", i % 2, 0); // bg toggles: one frame per emit, no batching
+}
+await Promise.resolve();
+assert.equal(paced.frames.filter((f) => f.fatal).length, 0,
+  "a full window with a live consumer must not be terminal");
+assert.equal(paced.frames.filter((f) => f.evt).length, 64,
+  "exactly the credit window is in flight");
+await acknowledgeAll(paced);
+await Promise.resolve();
+const pacedEvents = paced.frames.filter((f) => f.evt);
+assert.equal(pacedEvents.length, 80, "deferred frames drained after acks");
+assert.deepEqual(
+  pacedEvents.map((f) => f.evt!.finished),
+  Array.from({ length: 80 }, (_, i) => !(i % 2 === 0)),
+  "deferred frames preserve emission order",
+);
+console.log("ok   a full credit window defers and drains in order, never terminal");
+
 const oversize = await createWorkerHarness();
 assert.throws(
   () => oversize.emit(0, "y".repeat(1024 * 1024), 0, 0),