findings(E-10..E-22): fix the defects a code review found in the E-1..E-9 work

A review of the group-E fixes found 13 further defects; ten were introduced by
those fixes, two pre-existed and were merely relocated, one is deferred.

Services / transport
  E-10  retireWorker synthesized no bg/exit frame, so sharedspice's s_bgRunning
        mirror stayed latched true after a mid-run worker death: Run stayed
        disabled and the promised fresh-worker restart was unreachable for the
        whole session. Retirement now dispatches a synthetic controlled-exit
        straight to the installed handler (never through dispatchEvt — a
        fabricated frame must not touch the credit ledger). Driving the repro
        exposed two further defects, both fixed here: a replacement worker
        trapped on pre-init engine reads, and the rerun's cm_input_path/circ hit
        that uninitialized engine before KiCad's validate() re-init (the native
        flow assumes a crashed engine survives in-process — true for the dll,
        false for a dead worker). Reads now answer their empty shapes pre-init,
        writes lazy-init, and init is idempotent per worker engine.
  E-19  dispatchEvt acked only AFTER handler(evt) returned, and the sharedspice
        client deliberately rethrows non-trap errors — so each throw leaked one
        unit of the 64-frame credit window until the stream died with a
        misattributed "transport exceeded". The ack moves to a finally in both
        service copies; the throw still propagates (the trap machinery needs it).
  E-20  the oversize-line path promises to transfer the accepted prefix, but
        with the window full that flush only DEFERS, and stopEventStream wiped
        the deferred queue — losing the diagnostics that explain the failure.
        The terminal notice now carries them as pendingEvents; both hosts
        deliver them in order, unacked (the fatal frame is outside the credit
        protocol).
  E-21  the 30s prefetch deadline discarded every model already collected and
        reported nothing. A caller-owned progress sink ships the partials and
        the omission reaches the export report. (Awaiting the aborted collection
        was rejected: an in-flight source fetch is not abortable — E-4's
        original disease.) Plus a serving-candidate memo, so a .wrl ref served
        by its .step fallback stops re-probing the miss on every export.

Scheduler
  E-14  _terminalizeNativeTrap classified by message substring, so any plain JS
        error QUOTING 'Aborted(' or 'out of bounds' permanently bricked a
        healthy instance. Now structural only: instanceof RuntimeError plus a
        duck-typed name check (verified in this build's glue that abort() throws
        a genuine RuntimeError both pre- and post-runtime-init). Module.onAbort
        now latches the gate — the authoritative notification, previously
        ignored.
  E-15  the shim half: _pumpResume gates on terminal (catching wakes already
        queued at latch time) and resolveWait refuses on terminal WITHOUT
        consuming the entry, so a frame stays visibly parked rather than
        resuming inside a trapped module.
  E-16  the E-5 handler read the realm-global scheduler at dispatch instead of
        its installing module's; also frees the per-line buffer on the non-trap
        rethrow path.
  E-11  get_vec trusted the worker's res.length over the transferred arrays.
        Observed death shape: a 4 GiB std::vector threw an unhandled
        std::length_error that exited the editor's main loop. Now clamped, with
        the buffers freed on every failure path.

Guardrails (replacing two deferred refactors: e2e→production-code injection and
collapsing the four copies of the worker-lifecycle machinery)
  E-18  the source contract asserted comment-string counts — rewording failed
        CI while moving a guard outside its #ifdef passed. It now parses the
        #ifdef regions and asserts on code.
        service-stub-parity.ts pins what the four lifecycle copies must share:
        credit-window equality parsed from source, the finally-ack, boot
        deadlines, terminal-notice consumption. The transport numbers are now
        single-sourced from the worker.
        CI actually runs the gates: the web/standalone vitest suites (which had
        NEVER run in CI), the reducer, the source contract and the parity tool —
        with a NON_PLAYWRIGHT_GATES check so deleting a step re-fails the lint.
  E-22  the e2e occ stub's 60s boot watchdog, deleted in a66e109, is restored in
        the ngspice-stub shape with a wedgeNextBoot() repro hook.

Every behavioral fix has red-then-green evidence (the reds were captured first).
E-17 (a stale RUNNING cross-stamping the next run's generation under E-6's
transport deferral) is DEFERRED with its analysis recorded — a real fix needs
run identity on the bg frames.

Test hygiene: the dwell lint now requires the mandated ": <why>" and all 47 bare
markers carry their reason; three export-report dwells became modal-lease polls;
exact-ledger assertions became relative deltas; the dead data-wx-dom-id branch,
an unused fault hook and unused receipt plumbing are gone; abort scans, wx
dialog drivers, the sim harness and the vitest FakeWorker are each one copy now.

Bumps kicad and wxwidgets to their findings-group-e tips.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Istvan Matejcsok 2026-08-27 12:27:12 +02:00
commit c421d724b0
48 changed files with 2071 additions and 694 deletions

View file

@ -2,22 +2,10 @@ import type { Page } from '@playwright/test';
import * as fs from 'fs';
import * as path from 'path';
import { test, expect } from './fixtures';
import { clickMenuBarItem, clickMenuItem, waitForEditorReady, waitForRenderedByLabel, waitUntil, stableShot, settledShot } from '../e2e/utils/element-tracker';
import { waitForEditorReady, stableShot, settledShot } from '../e2e/utils/element-tracker';
import { injectFromSubmodule } from './utils/fs-inject';
import { openBoardProgrammatically } from './utils/board-ready';
/** Wait for a rendered popup menu to have its items (replaces a fixed post-menu-click sleep). */
async function waitForMenuItems(page: Page): Promise<void> {
await waitUntil(
page,
() => {
const r = window.wxElementRegistry;
if (!r?.findAllRendered) return false;
return r.findAllRendered({ elementType: 'menuitem' }).length > 3;
},
'popup menu items rendered',
);
}
import { findWxButton, clickWxButton, openStepExportDialog, dismissReportDialog } from './utils/wx-dialogs';
/**
* STEP export through the occ_service worker (docs/features/occ-split/):
@ -58,59 +46,6 @@ async function loadBoard(page: Page, testLogger: { consoleLogs: string[]; errors
console.log(`[TEST] ${DEMO.name} board-ready result: ${result}`);
}
type WxButtonTarget = { x: number; y: number; domId: number | null };
/** Resolve one visible wx button to its stable DOM identity and fallback point. */
async function findWxButton(page: Page, label: string): Promise<WxButtonTarget | null> {
return page.evaluate((wanted: string) => {
const registry = window.wxElementRegistry;
if (!registry) return null;
const el = registry.findAll({ visible: true })
.find((e) => (e.label === wanted || e.label === `&${wanted}`)
&& (e.typeName ?? '').includes('Button'));
// domId is present only for DOM-backed controls on lines that expose
// it; this line's registry may omit it — the coordinate fallback in
// clickWxButtonTarget is the supported path then.
const domId = (el as { domId?: number } | undefined)?.domId;
return el
? { x: el.centerX, y: el.centerY, domId: domId && domId > 0 ? domId : null }
: null;
}, label);
}
async function clickWxButtonTarget(page: Page, target: WxButtonTarget): Promise<void> {
if (target.domId) {
await page.locator(`[data-wx-dom-id="${target.domId}"]`).click();
return;
}
await page.mouse.click(target.x, target.y);
}
/** Click a visible wx button by label; returns whether it was found. */
async function clickWxButton(page: Page, label: string): Promise<boolean> {
const target = await findWxButton(page, label);
if (!target) return false;
await clickWxButtonTarget(page, target);
return true;
}
async function openStepExportDialog(page: Page): Promise<void> {
expect(await clickMenuBarItem(page, 'File'), 'File menu').toBe(true);
await waitForMenuItems(page);
await waitForRenderedByLabel(page, 'Export', { elementType: 'menuitem' });
expect(await clickMenuItem(page, 'Export'), 'Export submenu').toBe(true);
await waitForRenderedByLabel(page, 'STEP/GLB/BREP/XAO/PLY/STL...', { elementType: 'menuitem' });
expect(await clickMenuItem(page, 'STEP/GLB/BREP/XAO/PLY/STL...'),
'STEP export menu item').toBe(true);
await page.waitForFunction(() => {
const registry = window.wxElementRegistry;
return !!registry && registry.findAll({ visible: true })
.some((el) => (el.label === 'Export' || el.label === '&Export')
&& (el.typeName ?? '').includes('Button'));
}, null, { timeout: 20000 });
}
test.describe('OCC export via occ_service worker', () => {
test.describe.configure({ mode: 'serial' });
test.setTimeout(240000);
@ -161,11 +96,9 @@ test.describe('OCC export via occ_service worker', () => {
expect(occFetches.length, 'occ_service was fetched lazily by the export')
.toBeGreaterThan(0);
// Dismiss the "Export complete" report dialog if present. Its appearance after
// the worker returns has no distinct registry signal to poll — a short documented
// dwell, then click OK if present.
await page.waitForTimeout(1000); // eslint-disable-line -- documented interaction dwell
await clickWxButton(page, 'OK');
// Dismiss the "Export complete" report dialog: it opens on top of the
// export dialog's modal lease (1 → 2), which IS its observable signal.
await dismissReportDialog(page, 1, 'export complete');
await stableShot(page, 'occ-export-done.png');
});
@ -243,14 +176,14 @@ test.describe('OCC export via occ_service worker', () => {
expect(failed.service.maxPending,
'two requests must coexist in one generation; worker requests are not serialized')
.toBeGreaterThanOrEqual(2);
expect(failed.service.requestsStarted,
'the direct probe and one native export must be the only provider entries').toBe(2);
expect(failed.service.requestsPosted,
'both failed-generation requests must reach the real worker transport').toBe(2);
'every provider entry must reach the real worker transport')
.toBe(failed.service.requestsStarted);
expect(failed.service.workerGenerationsStarted,
'the two parallel requests must share one worker generation').toEqual([1]);
'the two parallel requests must share one worker generation').toHaveLength(1);
expect(failed.service.pending, 'fail-all must drain the failed generation').toBe(0);
expect(failed.service.retiredGenerations, 'generation 1 must be retired').toEqual([1]);
expect(failed.service.retiredGenerations, 'the shared generation must be retired')
.toContain(failed.service.workerGenerationsStarted[0]);
expect(failed.service.activeGeneration, 'the failed slot must be cleared').toBeNull();
expect(failed.service.armed, 'the one-shot fault must be consumed').toBe(false);
console.log(`[TEST-OCC] native fault dialog labels: ${JSON.stringify(failed.labels)}`);
@ -260,9 +193,6 @@ test.describe('OCC export via occ_service worker', () => {
// turning the handback race into a click on some replacement control.
const retryExport = await findWxButton(page, 'Export');
expect(retryExport, 'the original parent Export button must remain registered').not.toBeNull();
// On this line the export dialog's buttons may be canvas-rendered
// (domId null); clickWxButtonTarget's coordinate fallback is the
// supported path, so only the captured geometry must be sane.
expect(retryExport!.x, 'the retry target has stable geometry').toBeGreaterThan(0);
expect(retryExport!.y, 'the retry target has stable geometry').toBeGreaterThan(0);
@ -283,9 +213,10 @@ test.describe('OCC export via occ_service worker', () => {
).toBe(1);
// The export dialog remains open. Its next request must create a fresh
// generation and complete through the actual OCC module.
// generation and complete through the actual OCC module. Reuse the
// captured geometry so a re-query can't land on a replacement control.
if (!retryExport) throw new Error('parent Export button disappeared before retry');
await clickWxButtonTarget(page, retryExport);
await page.mouse.click(retryExport.x, retryExport.y);
await expect.poll(
() => page.evaluate(() => (globalThis as any)
.__occServiceTestHooks.snapshot().requestsStarted),
@ -321,16 +252,22 @@ test.describe('OCC export via occ_service worker', () => {
.toBeGreaterThan(10_000);
expect(recovered.service.activeGeneration, 'retry must own a replacement generation').toBe(2);
expect(recovered.service.requestsStarted,
'the parent retry must add exactly one provider entry').toBe(3);
'the parent retry must add exactly one provider entry')
.toBe(failed.service.requestsStarted + 1);
expect(recovered.service.requestsPosted,
'the parent retry must post exactly once to the replacement worker').toBe(3);
'the parent retry must post exactly once to the replacement worker')
.toBe(failed.service.requestsPosted + 1);
expect(recovered.service.workerGenerationsStarted,
'the retry must create exactly one replacement generation').toEqual([1, 2]);
'the retry must create exactly one replacement generation')
.toHaveLength(failed.service.workerGenerationsStarted.length + 1);
expect(recovered.service.workerGenerationsStarted,
'the replacement generation must be the active one').toContain(2);
expect(recovered.service.pending, 'replacement generation must quiesce').toBe(0);
expect(recovered.schedulerDead, 'the worker failure must not terminalize the editor').toBe(false);
expect(recovered.occWaits, 'the replacement native OCC wait must quiesce').toBe(0);
await page.waitForTimeout(1000); // eslint-disable-line -- documented interaction dwell
await clickWxButton(page, 'OK');
// Dismiss the retry's "Export complete" report dialog via its modal
// lease (export dialog holds 1; the report raises it to 2).
await dismissReportDialog(page, 1, 'retry export complete');
});
});