findings(E-1,E-2,E-3,E-6): ngspice service generations + credit-bounded event transport

Adapted from codex/asyncify-execution-owner-core 3753320. Service side mirrors
the occ-service shape (E-1 watchdogs, E-2 fail-all + boot-death fix — onerror
now rejects the in-flight boot waiter instead of stranding it, E-3
onmessageerror terminal, Blob URL revoked, per-generation evtQueue cleared on
retirement).

E-6 transport bounds (worker hunks re-applied inside the emscripten-6
em-pthread else-branch — the codex file predates that split, so this is a
re-application, not a cherry-pick):
- batch cut at 512 lines / 1 MiB exact JSON-UTF-8 bytes, measured before a
  line is retained; a single line > 1 MiB flushes the accepted prefix then
  stops the event stream terminally (never retained);
- posting gated by a 64-frame / 8 MiB unacked credit window; each frame
  carries { eventSequence, eventBytes } and is released only by an exact
  { sequence, bytes } ack; any mismatched ack is terminal;
- the service mirrors the same 64-frame / 8 MiB bound on its pre-handler
  queue, acks after handing a frame to __ngspiceOnEvent, and retires the
  generation on invalid credit; { fatal } frames retire the worker.

Tests: ngspice-service.test.ts (11, ported) — watchdogs, crash/bootError/
decode-fault settlement + recovery, out-of-order ids, sync postMessage throw,
stale-generation event drops, fatal-frame retirement. tests/tools/
ngspice-worker-batch-unit.ts (node:vm over the production worker source;
`npm run ngspice:worker-batch`) — bounded ordered chunks, byte-pressure
flush, 100k-chunk credit storm, over-limit line, exact ack lease. e2e harness
twin updated to speak the ack protocol (adds __ngspiceServiceTestHooks).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/tools/ngspice-worker-batch-unit.ts

@@ -0,0 +1,196 @@
+/**
+ * Behavioral reducer for ngspice-worker.js output batching and transport
+ * credits. It executes the production worker source in a VM with a synchronous
+ * fake native module, where queued microtasks cannot hide retained bursts.
+ */
+import { strict as assert } from "node:assert";
+import { readFileSync } from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import vm from "node:vm";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const repo = path.resolve(here, "../..");
+const workerSource = readFileSync(
+  path.join(repo, "web/standalone/src/wasm/ngspice-worker.js"),
+  "utf8",
+);
+
+type Frame = {
+  id?: number;
+  evt?: { kind: string; lines?: string[] };
+  fatal?: string;
+  res?: { error?: string };
+  eventSequence?: number;
+  eventBytes?: number;
+};
+
+type WorkerHarness = {
+  frames: Frame[];
+  emit(kind: number, text: string, a: number, b: number): void;
+  message(data: unknown): Promise<void>;
+};
+
+async function createWorkerHarness(): Promise<WorkerHarness> {
+  const frames: Frame[] = [];
+  let messageHandler!: (event: { data: unknown }) => Promise<void>;
+  const module: Record<string, any> = {
+    init: () => 0,
+    circ: () => 0,
+    command: () => 0,
+    getVecInfo: () => ({ found: false }),
+    curPlot: () => "",
+    allPlots: () => [],
+    allVecs: () => [],
+    running: () => false,
+    cmInputPath: () => undefined,
+  };
+  const workerGlobal: Record<string, unknown> = {
+    NGSPICE_GLUE_URL: "https://pcbjam.test/ngspice_service.js",
+    addEventListener: () => undefined,
+  };
+  Object.defineProperty(workerGlobal, "onmessage", {
+    set(value) { messageHandler = value as typeof messageHandler; },
+  });
+  const context = vm.createContext({
+    self: workerGlobal,
+    console,
+    Blob,
+    URL,
+    RangeError,
+    String,
+    Number,
+    Map,
+    JSON,
+    Promise,
+    queueMicrotask,
+    importScripts: () => undefined,
+    NgspiceService: () => Promise.resolve(module),
+    postMessage: (frame: Frame) => frames.push(structuredClone(frame)),
+    structuredClone,
+  });
+
+  vm.runInContext(workerSource, context, { filename: "ngspice-worker.js" });
+  await Promise.resolve();
+  assert.equal(typeof module.ngspiceEmit, "function");
+  assert.equal(typeof messageHandler, "function");
+  frames.length = 0; // discard ready
+  return {
+    frames,
+    emit: module.ngspiceEmit,
+    message: (data) => messageHandler({ data }),
+  };
+}
+
+async function acknowledgeAll(harness: WorkerHarness): Promise<void> {
+  for (const frame of harness.frames) {
+    if (!frame.eventSequence) continue;
+    await harness.message({
+      eventAck: {
+        sequence: frame.eventSequence,
+        bytes: frame.eventBytes,
+      },
+    });
+  }
+}
+
+async function main(): Promise<void> {
+const bounded = await createWorkerHarness();
+// 1,025 synchronous lines cannot wait for a microtask: 512, 512 flush on the
+// line bound, and the final line flushes at the queued microtask.
+for (let i = 0; i < 1_025; ++i) bounded.emit(0, `line-${i}`, 0, 0);
+assert.deepEqual(
+  bounded.frames.map((frame) => frame.evt?.lines?.length),
+  [512, 512],
+);
+await Promise.resolve();
+assert.deepEqual(
+  bounded.frames.map((frame) => frame.evt?.lines?.length),
+  [512, 512, 1],
+);
+assert.deepEqual(
+  bounded.frames.flatMap((frame) => frame.evt?.lines ?? []),
+  Array.from({ length: 1_025 }, (_, i) => `line-${i}`),
+);
+await acknowledgeAll(bounded);
+console.log("ok   synchronous output flushes in bounded ordered line chunks");
+
+bounded.frames.length = 0;
+const wide = "x".repeat(400_000);
+bounded.emit(0, `${wide}-0`, 0, 0);
+bounded.emit(0, `${wide}-1`, 0, 0);
+bounded.emit(0, `${wide}-2`, 0, 0); // crossing line flushes first two
+assert.equal(bounded.frames.length, 1);
+assert.deepEqual(
+  bounded.frames[0]!.evt!.lines!.map((line) => line.at(-1)),
+  ["0", "1"],
+);
+assert.ok(bounded.frames[0]!.eventBytes! <= 1024 * 1024);
+await Promise.resolve();
+assert.equal(bounded.frames[1]!.evt!.lines!.length, 1);
+assert.ok(bounded.frames[1]!.eventBytes! <= 1024 * 1024);
+await acknowledgeAll(bounded);
+console.log("ok   UTF-8 byte pressure flushes before retaining the crossing line");
+
+const storm = await createWorkerHarness();
+const chunk = "z".repeat(900_000);
+for (let i = 0; i < 100_000; ++i) {
+  try {
+    storm.emit(0, `${chunk}-${i}`, 0, 0);
+  } catch {
+    // Continue attempts deliberately: terminal state must remain inert and
+    // must never post another retained frame.
+  }
+}
+await Promise.resolve();
+const stormEvents = storm.frames.filter((frame) => frame.evt);
+assert.ok(stormEvents.length <= 64);
+assert.ok(
+  stormEvents.reduce((sum, frame) => sum + frame.eventBytes!, 0)
+    <= 8 * 1024 * 1024,
+);
+assert.equal(storm.frames.filter((frame) => frame.fatal).length, 1);
+assert.match(storm.frames.find((frame) => frame.fatal)!.fatal!, /unacknowledged/);
+console.log("ok   100,000 synchronous chunk attempts cannot exceed transport credit");
+
+const oversize = await createWorkerHarness();
+assert.throws(
+  () => oversize.emit(0, "y".repeat(1024 * 1024), 0, 0),
+  /ngspice event line exceeds 1048576 UTF-8 bytes/,
+);
+assert.deepEqual(oversize.frames, [{
+  fatal: "ngspice event line exceeds 1048576 UTF-8 bytes",
+}]);
+assert.throws(
+  () => oversize.emit(0, "late", 0, 0),
+  /ngspice event line exceeds 1048576 UTF-8 bytes/,
+);
+await oversize.message({ id: 91, req: { kind: "running" } });
+assert.deepEqual(oversize.frames.at(-1), {
+  id: 91,
+  res: { error: "ngspice event line exceeds 1048576 UTF-8 bytes" },
+});
+console.log("ok   a single over-limit line is never retained and terminalizes requests");
+
+const ackMismatch = await createWorkerHarness();
+ackMismatch.emit(2, "", 0, 0);
+const credited = ackMismatch.frames[0]!;
+await assert.rejects(
+  ackMismatch.message({
+    eventAck: {
+      sequence: credited.eventSequence,
+      bytes: credited.eventBytes! + 1,
+    },
+  }),
+  /acknowledgment did not match an exact frame/,
+);
+assert.equal(ackMismatch.frames.filter((frame) => frame.fatal).length, 1);
+console.log("ok   acknowledgment must match the exact sequence and byte lease");
+
+console.log("ngspice-worker-batch-unit: all green");
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});