4 flakes in 6 CI runs on 2026-08-01, all with clean traces: no guard beacons,
A demonstrably landed (the 208cb67 sequencing gate passed), B just never got
the one-shot rect applied within 30s while two wasm instances starved the CI
box. Awareness re-broadcasts state periodically, so a 90s condition-poll
converges on re-delivery; local runs stay fast (converge in <2s).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019SE4o46Lnq3hF574FFq8x4
kicadTestFiberParkStartSecond/PokeSecond: a second coroutine started while
the first body is asyncify-parked reproduces the misattributed jump that
launders the parked fiber past the C++ guard (the v0.1.21 prod bypass).
Spec scenario 2 stages it and asserts the JS stale-rewind guard quarantines
the laundered resume (exactly one fiber-resume-refused beacon), the parked
body completes undisturbed, and both coroutines finish cleanly.
Doc: async/16 rounds 2 + WSOD section.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019SE4o46Lnq3hF574FFq8x4
v0.1.21 still trapped with ZERO jump-refused beacons: the fatal swap PASSED
the C++ swap_suspended guard. Mechanism (async/16 round 2): a fresh JS entry
executing while g_current_context still points at a parked fiber gets
attributed to that fiber — fiber_swap writes a fresh, valid-LOOKING foreign
suspension into the parked fiber's struct and re-marks the flag. The flag
lies; the resume rewinds garbage.
This guard tracks truth at the emscripten-fiber layer (handlesleep.js wraps
Fibers.finishContextSwitch):
- valid suspensions = real swap-outs (currData == oldFiber+20 when the
trampoline runs), consumed on rewind;
- internally-parked = an entered slice that ended in a handleSleep park
(currData set, no nextFiber) — quarantined until a GENUINE swap-out,
where genuine means the fiber's pending sleep has resolved
(__pendingSleepContexts), so a laundering write cannot lift it;
- entering a quarantined or suspension-less fiber is REFUSED
([wx-asyncify] fiber-resume-refused, ghost contract).
The ROOT context is exempt from quarantine and refusal: its rewound
continuation runs the whole main loop, whose routine yield park says nothing
about a fiber body — the first build of this guard quarantined main off that
signal and starved every coroutine return (19 collab e2e reds, empty
results). Root = the old side of the first switch ever.
.ci-cache-epoch 2→3: the wasm output cache key omits scripts/**.
Red/green: fiber-resume-park.spec.ts scenario 2 (laundered resume → exactly
one refusal beacon, both coroutines complete); full fiber-heavy sweep green
(21 passed).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019SE4o46Lnq3hF574FFq8x4
All three prod crash cascades (v0.1.19–21) ended white for the same reason:
the final trap lands inside a child's EFFECT (an embind call reached through
a react-query subscription), React unmounts the entire root, and the fatal
overlay + console panel die with the tree they were built to survive.
- WasmErrorBoundary: crash-capable children live inside it; the fatal screen
and the console panel live OUTSIDE and keep rendering. WasmTool state
(logs included) survives a descendant render/effect throw.
- The fatal screen is now an actual blue screen (:( + solid blue), and every
promotion path (window error, unhandled rejection, worker error, boundary)
auto-opens the console — the log is the only account of what was loading.
- tests/web/fatal-overlay.spec.ts pins the contract: a terminal uncaught
error after boot ⇒ visible fatal overlay + open console with the [fatal]
record. Green locally (23.9s).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019SE4o46Lnq3hF574FFq8x4
"B never tracked the second viewport move" ate three v0.1.21 release
attempts (2026-08-01) while the same build passed 10/10 locally, including
under 4-worker contention. The T2 block asserted B's convergence without
first confirming A's second fit LANDED — the T1 block has that sequencing
point, T2 didn't — so on a starved CI box any A-side fit delay was
misreported as a B-side tracking failure, and B's 30s window burned while A
was still moving. Mirror the T1 pattern: poll A onto its target, then start
B's clock.
Verified 4/4 green locally (web-chromium, 2 workers). Reminder that cost 20
minutes tonight: web/standalone/.env poisons local web e2e (untitled/title
mismatches) — stash it before local runs (standalone-env-e2e-poison).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019SE4o46Lnq3hF574FFq8x4
Companion to kicad f0ce20ef64 (libcontext swap_suspended guard), which this
pins. The v0.1.20 diagnostics decoded the crash that survived v0.1.13–19:
TOOL_MANAGER Resume()s a coroutine whose body is asyncify-parked inside
handleSleep, the swap rewinds the stale fiber suspension, and the runtime is
poisoned. Full chain of evidence in docs/features/async/16-fiber-resume-guard.md
(+ round-3 addendum in 15-timer-park-repro.md).
- wasm/bindings/fiber_park.h + kicadTestFiberPark{Start,Prime,Poke,State}
exports (pcbnew + merged kicad_editor): stages Call→yield→legitimate
resume→sleep park→mid-park Resume, the exact prod state machine. The
first yield matters: it primes a real (then stale) suspension, matching
long-lived tool loops rather than a first-slice park.
- tests/kicad/fiber-resume-park.spec.ts: asserts the healthy contract on
polled state only (embind returns across fiber swaps are unwind
placeholders). RED on the unguarded build — fiber/sleep buffer
cross-restores, a jump-ghost beacon, the parked body zombified. GREEN with
the guard: mid-park poke refused ([collab-fcontext] jump-refused beacon),
park completes, post-yield resume works, no trap signatures.
- Regression sweep green: timer-park-repro, collab-load-fuzz, load-pcb,
pcbnew-collab, collab-undo, eeschema-collab (19 passed).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019SE4o46Lnq3hF574FFq8x4
kicadTestArmTimerPark(delayMs, parkMs): a one-shot wxTimer whose Notify()
emscripten_sleep()s, entering through the exact GAL-refresh-timer path
(emscripten_async_call → TimerCallbackFunc::Run → dispatch guard → Notify) —
the fresh-entry-that-parks the prod board-load trap family needs. Pollable
kicadTestTimerParkState(); inert unless armed. Registered beside
kicadTestSetOpenPark in pcbnew + the merged kicad_editor image.
tests/kicad/timer-park-repro.spec.ts drives four escalating cycles (park
only, 2× + fiber hammering, + 256MB heap growth mid-park) and asserts the
runtime survives every rewind AND that the [wx-asyncify] diagnostics observed
the window — engagement is asserted, so a run where the lever never created
the overlap cannot pass vacuously.
Result so far (docs/features/async/15-timer-park-repro.md): GREEN through
both rounds — genuine double-parks, live currData cross-restores, fiber
swaps, and mid-park heap growth are all handled by the shim + runtime. The
prod trap needs an ingredient this window still lacks (ranked in the doc);
the spec stays as the regression gate for whatever the eventual fix is.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019SE4o46Lnq3hF574FFq8x4
The shim has been silently restoring Asyncify.currData across overlapping
parks since it was written — so a prod console dump could never say whether
the #9153 family fired, mislinked, or was bypassed. Rate-limited [wx-asyncify]
reporting, calibrated against the timer-park e2e (2 rounds, 2026-07-31):
- concurrent-park: a FRESH park (state 0) starting while another chain's
currData is live. state-2 entries are NOT reported — every legal resume
re-enters handleSleep while Rewinding (~100/s measured on a healthy run).
- reentrant-state: handleSleep entered mid-unwind (state 1) — never observed;
if it ever fires it IS the bug.
- aliased-wake-live / overlapped-wake: the restore actually repairing —
dangerous (other chain still parked) vs benign (other chain done). The
e2e observed 8 live cross-restores in one run, all survived.
Console.log only, no printf plumbing needed; stacks name the parker
(__asyncjs__wxWasmYieldToBrowser vs _emscripten_sleep etc.).
.ci-cache-epoch 1→2: the wasm output cache key omits scripts/**.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019SE4o46Lnq3hF574FFq8x4
The v0.1.19 prod crash (console-export-2026-7-31_17-49-20.log) opened with
Firefox's bare "index out of bounds" — no "RuntimeError" prefix, no "table" —
which the terminal-signature regex only knew in Chrome's spelling, so the
overlay this feature exists for never promoted on the very trap it was built
against. Match the bare form (+ "null function or function signature", the
other Firefox spelling in this family).
Also wrap the Worker constructor attach-only: a pthread worker's uncaught
error fires an ErrorEvent on the Worker OBJECT, never on window, so worker
crashes (raytracer pool etc.) were invisible to both listeners. The editor's
main()/wx run on the page thread (no PROXY_TO_PTHREAD on the link line) — the
tap is defense-in-depth, not the primary fix.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019SE4o46Lnq3hF574FFq8x4
Bump web/pcbjam-shared: hot-path zod parses replaced with a hand-rolled
structural validator; ydoc→sexpr materialization ~12x faster on big boards.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LPYYvNtRgyAFq9EScSxKYr
Under realtime "shared-only" a board/schematic session holds no socket per
org lib — which silently broke the lib-update toast (a peer editing a
PLACED symbol never reached the open session live). Complete the design
with the deferred-realtime upgrade: after open, scan the staged target
document for lib-table nicknames (lib_id / footprint / lib_symbols tokens)
and promote exactly those libs' stacks to realtime via the new
LibsSource.enableRealtime. One socket per lib the document actually uses
(typically 0-5) instead of one per lib in scope (60+); every other lib
still catches up on the next load via the descriptor digests.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W4EzyhjhDzLdNZsFAYjz7X
The onItems handler let unwrapWireItem's throw unwind through embind into the
C++ emitter — a bare pageerror, the whole batch lost, and flushDiff already
rebaselined so the dropped items could never be re-sent. Field-seen case:
Update PCB from Schematic emitted 67 changed entries, one an item-less board
envelope (pcbnew writes nothing for a standalone footprint field); all 67 were
dropped and two new footprints existed only on the syncing tab.
The conversion now skips un-resolvable entries per-entry (shared items-wire
fix), every conversion site warns via warnSkip, and the handler body is
wrapped so nothing escapes into the C++ caller again. The tests/web spec
drives the real serializer's empty envelope through onItems and holds that a
good entry batched with it still reaches the peer (proven red before the fix).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019daWLdW5xrRhjUvCUWoSAe
Presence-scoped sibling restage: every tab announces the document it is
actively editing in the project presence room (PresenceState.sheetPath,
re-published on eeschema sheet navigation), and a pcbnew session connects a
sibling schematic's board-room only while a peer announces it open — instead
of eagerly holding one socket per sheet for the whole session. Works because
/files/ materializes from the ydoc, so the boot MEMFS snapshot is room-fresh;
a sheet can only drift while someone is editing it, and that someone is in
the roster. On leave the watch lingers 30s, flushes the pending restage, and
closes; without a presence room the eager mode remains as fallback.
A solo board session now holds 3 sockets (doc, presence, lib-mirror mux) —
down from 92 on an 8-project repo before this series.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W4EzyhjhDzLdNZsFAYjz7X
Refreshing ANY editor URL navigated to the management app's project overview
instead of reloading. Not related to spaces in paths — verified path-independent
by reproducing it on a fileless `-/pcbnew` route with no file path at all.
Mechanism, from probing the actual ordering rather than reading the code: the wx
port registers its unload handler via emscripten_set_beforeunload_callback,
which lands in the CAPTURE phase and so runs before any bubble-phase listener
regardless of registration order. It closes the top frame -> fires
wxAppTopWindowClosed -> the quit dispatcher -> location.assign(exitUrl), and
that navigation overrode the in-flight reload (the reload itself failed with
NS_ERROR_FAILURE).
The quit hook already latched off for our OWN navigations
(markDeliberateNavigation) and on pagehide — which the existing comment notes
fires too late, at commit time. Nothing covered a browser-INITIATED unload:
reload, Back, closing the tab. This adds that latch, in the capture phase so it
precedes emscripten's handler; a bubble-phase listener registered at module
scope was NOT enough, which the probe showed directly.
Tradeoff, documented at the call site: if a beforeunload prompt appears and the
user stays, the latch remains set and a later File->Quit won't self-navigate.
That is strictly better than a page that cannot be refreshed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0137pGo8W7asomGUTRMB7RzM
Module.print feeds only the in-page log panel; it echoes to the JS console
solely under ?trace=. That is right for ordinary wasm chatter and wrong for the
two diagnostics wxwidgets now emits: production crash reports reach us as SAVED
BROWSER CONSOLE DUMPS, so a diagnostic that never leaves the page is invisible
in the one artifact we actually receive — and the in-page buffer is capped at
800 lines, so a long load can evict it before anyone reads it.
Narrow by construction: only the "[wx-dispatch]" and "[wx-timer]" prefixes, both
rate-limited in C++ and silent on a healthy load, so this cannot become noise.
Verified by driving Module.print directly in a real browser: the two prefixes
reach console.log / console.warn and an ordinary line does not.
Also bumps wxwidgets for those diagnostics.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0137pGo8W7asomGUTRMB7RzM
Every production report of the board-load crash so far has been a console dump
with no timing and no state, which is why five theories died slowly and none
reproduced locally. This records the few facts that would actually discriminate
between the ones still standing, and nothing else.
Marks: fs:wait, fs:ready, stage:done, open:start, open:settled, presync:settled,
ui:ready — on one monotonic clock, each carrying the wasm heap size, with growth
called out explicitly.
Why these:
- The open window is where the crash lives: OpenProjectFiles runs the footprint
library preload INLINE on the main thread in the WASM build. Bracketing it
lets a crash be placed inside or outside that window instead of inferred from
log order.
- ui:ready is first paint. The symbolized trap needs !m_gal->IsInitialized(),
so a report containing this mark rules that mechanism out and one stopping
before it does not.
- Heap size at every mark, because growing wasm memory detaches JS-side views,
and a stale view writing into a detached buffer is one of the few mechanisms
that yields a bad function-table index much later. Already earning its keep:
a local Leonardo load grows 256MB -> 443MB during staging, immediately before
the open. Locally that is survivable; production should not be guessed at.
dump() prints the whole timeline and is wired into all three fatal paths (boot
catch, window error, unhandled rejection), so one paste from a user carries the
full load shape. Bounded at 200 entries; unit-tested including eviction.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0137pGo8W7asomGUTRMB7RzM
Measured on a real Leonardo load against the local platform stack:
per-lib sync-stack POSTs : 174-200 -> 0
batch sync-stacks POSTs : 0 -> 1 (216 stacks in one request)
file GETs negotiating ydoc: 0 -> 107 of 133
Lib resolve: syncedScopeLibsSource now resolves every stack up front through
the shared paged batch client and feeds them to the per-lib sources, which skip
their own POST on a hit. Best-effort throughout — a failure (older backend
without the route, a network blip) leaves the map empty and every lib resolves
exactly as before, so this can only remove requests, never break a load. A
batched `null` is recorded as "backend says unresolvable" so a stale pin isn't
then retried one-by-one.
File downloads: fetchFileBytes sends Accept: application/x-pcbjam-ydoc and
converts client-side with the converters shared already exports, moving the
per-request materialize cost off the metered Worker. A backend that doesn't
negotiate answers with text and the branch never fires; a ydoc we fail to
convert re-fetches without negotiating rather than making the file
undownloadable.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0137pGo8W7asomGUTRMB7RzM
The boot overlay only renders while `!ready`, so anything that killed the
runtime AFTER the editor came up — a wasm trap, an abort, a staging fetch
failing late — unmounted the last thing on screen and left a white page with
no explanation.
Adds a `fatal` state rendered INDEPENDENTLY of `ready`, set both from the boot
catch and from window error / unhandledrejection listeners that promote only
genuinely terminal signatures (RuntimeError, abort, table index out of bounds,
indirect call signature, unreachable). Ordinary app errors must not hijack a
working editor, so anything else is ignored.
The console panel moves from z-20 to z-40, above both overlays, and is forced
visible on a fatal even with chrome hidden: when a load fails, that log is the
only account of what was loading when it happened, and it was being covered by
the very overlay reporting the failure.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0137pGo8W7asomGUTRMB7RzM
React Router 6.30 decodes named params but leaves the `*` splat
percent-encoded, so a deep-link like
/:scope/projects/arduino/Repo-main/KiCad%20Projects/Mega.kicad_pcb
reached ToolPage as `name: "arduino"` (decoded) alongside a splat still
reading `KiCad%20Projects/...`. Every consumer of the resulting targetPath
expects the decoded form: the project file list carries real spaces, and
project-source's encodePath re-encodes per segment when building API URLs,
so a %20 target double-encodes to %2520.
Decodes per SEGMENT so an encoded separator can never silently become a path
boundary, and keeps a malformed segment verbatim rather than throwing during
a route render. The unit test drives matchPath directly so a future router
upgrade that changes this behaviour fails loudly instead of silently.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0137pGo8W7asomGUTRMB7RzM
- kicadOpenFile now holds wxWasmDispatchGuard (open_gate.h). It enters through
embind, so the interlock read "nothing parked" for the whole load and wx timers
dispatched into the half-built board — the residual prod "index out of bounds"
that survived the settle gate.
- new wasm/bindings/gerbview_embind.cpp (the bundle had no embind surface at all):
kicadOpenFile / kicadOpenFiles / kicadOpenFileBusy. Clicking one gerber opens the
whole fabrication set in its folder, since a lone layer is not a useful view.
- cross-app presence rejoins in the boot fan-out (network-only; the wasm-bound half
still waits for the open to settle) — it had been pushed behind the board load.
- tests: gerber-set selection units + a gerbview multi-file open e2e.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0137pGo8W7asomGUTRMB7RzM
The 7/29 "presync after open" reorder misdiagnosed the slow board open: the
problem was ordering/serialization (libs awaited before serially-fetched
project files), not bandwidth — the ~155 lib requests are latency-bound. It
also regressed the symbol editor, whose frame eagerly enumerates every lib
through the mutex-serialized bridge crossings: with no warm-up running during
the wasm download, each cold lib fetched one-at-a-time inside its own serial
crossing.
- WasmTool: at consent-OK start in parallel — wasm boot, doc-room connect
(websocket up BEFORE any file fetch; errors captured and rethrown at the
await), lib presync (concurrency 8, presyncSettled never rejects), and
project-file staging (the glue runs FS.staticInit() at script-eval, so
MEMFS staging always overlapped the download).
- Lib editors (fileless): installLibsProvider enumerateGate parks the whole
"list" op (a plain name list also cold-fetches the bundle) until the
presync settles, and the boot overlay waits for it before waitForWxUi —
downloads run 8-wide in JS, the serialized crossings become IDB read +
parse. pcbnew/eeschema stay ungated (a silent mid-session park would read
as a hang). The reentry-guard mutex itself is untouched.
- Overlay: "Project files — n/m" staging line (DriveOptions.onFileProgress),
and the lib line returns worded "Checking <kind> libraries — n/155" (the
walk checks every lib but downloads only new or changed ones).
- boot: hasWritableLib accepts lib type "org" (the private platform's rename
of "user") — boot re-created "My Symbols" on every load and the backend
409'd.
typecheck clean; 239/239 standalone tests; web e2e tools-open 7/7 +
chrome-toggle 2/2 + comments 1/1 (web-firefox).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N925iFAdnVcMCdvS4pzXER
The partykit provider splices the room into the WS URL verbatim, so it now
travels as ONE percent-encoded path segment (the sync worker decodes it at
its edge); bumps pcbjam-shared for the injective key scheme.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CfEPcy9dStnSfm1hmaiTe4
The v0.1.14.1 release gate died in "Build wxWidgets (wxUniversal WASM)" with
"No rule to make target 3rdparty/pcre/src/pcre2_chartables.c". Nothing in the
tree changed wx — the submodule is the same SHA that released fine as v0.1.13
— and the two main CI runs on this tree built wx and went on to run e2e. The
restored build-wasm/wxwidgets cache is the variable: pcre's makefile rm's that
path and re-links it to pcre2_chartables.c.dist at configure time, so a cache
captured around that window restores a tree whose pcre rule cannot be
satisfied from a clean checkout.
CI's wx cache key hashes scripts/build-wx-wasm.sh, so a header edit is the
lever that discards it. Documented as an explicit epoch counter there, since
the next person hitting this will not guess that editing a build script is how
you evict a cache.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H8jo7zz1ZwzYpjJ64UZKN4
Two fixes to the same complaint — opening a board took minutes and the dialog
explaining why was misleading.
Ordering: the scope-wide lib presync ran "in PARALLEL with the wasm download",
so ~155 libraries' worth of requests competed with the 26MB+ bundle and the
project's own files — the things the user is actually blocked on. It now
starts after driveProjectIntoTool, warming IndexedDB behind an editor that is
already open. Still fire-and-forget and best-effort (the SyncStack dedups, so
a lib the wasm reaches mid-presync awaits the same in-flight fetch), now
abortable on unmount, and no longer shown on the boot overlay as a counter the
user is waiting on — the background indicator owns it.
Wording: the dialog quoted the compressed size with no hint that it was
compressed ("~35 MB" for a bundle whose progress bar then counts ~150 MB raw),
and quoted only the count of libs whose BODIES need downloading — while the
progress bar went to 155, because every warm lib still costs a sync-stack
resolve plus a manifest GET to find nothing changed. It now reads "~35 MB
compressed / ~150 MB uncompressed" and "downloads 1 library, checks all 155
for updates". Every existing degradation path is kept: unknown sizes still
say "large", sizesKnown:false degrades to "at least ~X MB", and the
no-warmth-answer case now says "fetched in the background" rather than the
newly-false "downloaded now".
Investigated and NOT changed: the symbol path is not structurally more
deferred than footprints — both enumerateLibrary() implementations are already
no-ops, so neither face does bridge crossings at boot. The perceived
schematic-vs-board difference was this presync timing plus set size.
typecheck clean; 233/233 standalone tests pass.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H8jo7zz1ZwzYpjJ64UZKN4
Opening a large board could kill the editor runtime outright: "index out of
bounds" / "unreachable executed" / "indirect call signature mismatch", after
which every later focus/key event trapped. Reported in prod against a big
uploaded board, and correlated by the reporter with the moment the presence
WebSocket connects.
That correlation is the tell. Presence/collab work enters the wasm through
runOnFiber -> COROUTINE::Call, i.e. emscripten_fiber_swap, whose stop_unwind
corrupts Asyncify's single currData slot when ANOTHER context is already
parked there. docs/features/async/13 pins the invariant: exactly one
unwind/rewind transition in flight, and prescribes "a single shared is-a-
transition-in-flight guard the pumps consult before re-driving".
Normally the slot is free when fibers drain: the main loop's per-frame
wxWasmYieldToBrowser completes every frame, so drainFibers runs between
yields. It is NOT free when a nested/modal pump tick drives ProcessEvents
while the chain that opened the modal is parked deeper down — precisely a big
board open (progress dialog over a parked load). The wx dispatch interlock
does not cover this: the modal parks deliberately zero its count so their own
pump may dispatch.
So gate the swap itself: drainFibers defers (re-CallAfter) while
asyncifyInFlight(). Bodies are viewport/overlay/apply work, so waiting out the
park costs latency, never correctness.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H8jo7zz1ZwzYpjJ64UZKN4
The boot-time MEMFS staging fetched one file per round-trip, serially, so a
many-file project (an uploaded repo) paid full request latency per file before
the editor could open anything — the dominant cost of opening such a project.
Fetch with a bounded pool (8, same as the lib presync) and write as each
lands; the writes are synchronous FS calls on distinct paths, so completion
order does not matter. A failed fetch still rejects the stage, after the
in-flight siblings settle so none can write into MEMFS behind the caller.
Tests cover all three properties: every file lands under reverse-staggered
fetch delays, the overlap is >1 and <=8, and a failing fetch rejects.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H8jo7zz1ZwzYpjJ64UZKN4
Bump wxwidgets to fd30c08b18. The interlock landed in 4c7839e turned the
clipboard test app's pre-existing Emscripten abort ("cannot start an async
operation when one is already in flight" — its EM_ASYNC_JS park suspends
inside the synchronous wx_dom_event ccall) into a permanent input wedge: the
dead chain's guard never unwound, so every later event deferred behind it and
4 clipboard specs timed out. The dead chain is now released explicitly from
the JS catch that sees it die.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H8jo7zz1ZwzYpjJ64UZKN4
Bump wxwidgets to 8a80bad7ef (cherry-pick of 5526b599c6 from
fix/wasm-dispatch-interlock): gated event pump (paint-only while a chain is
Asyncify-parked), queue-when-parked input events, deferred timer fire, and
pause/restore around the long-lived modal parks.
Fixes the prod board-load trap (2026-07-29, editor v0.1.12/Firefox): the GAL
refresh timer fired via emscripten_async_call into wx dispatch while the slow
board open was parked in wxWasmYieldToBrowser, corrupting asyncify state
("index out of bounds" → "unreachable executed" in the fiber rewind →
permanently poisoned runtime). Same family as the flaky CI fp-selector trap
the branch was originally written for.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H8jo7zz1ZwzYpjJ64UZKN4
Two consecutive publish-libs runs died on runner-side CF API flakiness (a 502
mid-put, then 'terminated' on the first probe). Gets and puts now retry with
backoff; a definitive missing-object error still returns null immediately.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011CC8aAnUUHcnHy3QCJtUwb
A CF API 502 on the manifest.json probe made publish-libs misdetect an
already-published tag as unpublished and start a full republish (byte-identical
immutable content, so harmless — but ~30 min of redundant uploads before a
second 502 killed it). Only wrangler's definitive missing-object error now
reads as absent; anything else throws.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011CC8aAnUUHcnHy3QCJtUwb
Cold loads on versioned CDN deploys now show a consent card (editor MB +
symbol/footprint lib figures, downloaded-now vs on-demand) and wait for OK
before any big fetch; warm loads skip it and show truthful stages (loading
from cache / Compiling / Starting KiCad) instead of the first-download line.
- wasm-assets: resolveWasmMeta (bundle/ver/sizes), download-completion marker
keyed by content-addressed bundle/ver, update wording, auto-download opt-out,
HEAD size fallback
- boot: manifest raw size as the progress total (fixes the br/gzip
Content-Length mismatch), marker written after download+instantiate succeed
- cdn-source: syncState() — IDB warmth peek + sizes.json cold sums
- synced-source: syncState() from the backend envelope's sync refs (private
platform); remote-source passes libSchema.sync through
- publish-wasm: manifest schema 2 with per-bundle sizes (registry-persisted,
reuse + snapshot modes); publish-libs: sizes.json sibling key + top-up mode
- fixed 4 stale unit tests (bundle mapping, session-identity email)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011CC8aAnUUHcnHy3QCJtUwb
Self-asserting wx app (tests/apps/standalone/uipolish) with 8 checks:
clip-clear / clip-empty / clip-box (DC clip box reaches the canvas — the
collapsed wire-properties-panel bug), blit-origin (wxBufferedDC device
origin), mask-alpha (ConvertToImage carries wxMask — infobar close button),
scaled-dims (physical size for scaled bitmaps), checkbox-floor (selection-
filter density) and statbmp-best (bundle logical size — layer-panel icons).
The spec runs a default-DPR pass plus a deviceScaleFactor:2 pass that also
asserts the statbmp <img> ships the 32px asset at 16 CSS px.
Bumps wxwidgets for the CloneGDIRefData SOURCE_NONE fix the @2x pass
surfaced (empty statbmp data URL on hi-DPI).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mh188aysvgeaTRYh6syztQ
brotli q11 over the ~320MB wasm set ran serially on one core (~0.4MB/s),
dominating the release publish job. Compress every to-be-uploaded file
concurrently on the libuv threadpool (compressBytesAsync + UV_THREADPOOL_SIZE
sized to the machine), so wall time drops from sum-of-files to roughly the
largest single file (kicad_editor.wasm): 329s for the full set locally vs
~11.5min of CPU. Upload ordering invariants unchanged: meta.json still last
per tool, registry last overall; moved-tag guard and reuse path untouched.
Also adds BROTLI_PARAM_SIZE_HINT and moves the publish-wasm job to
ubicloud-standard-8 so there is a core per file.
Verified byte-identical CDN layout vs the old script (local driver, pinned
builtAt), blob roundtrip to source sha, reuse + --from-registry modes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JQ9npuB6uLvkv6gzBV5GPh
Redirects from emergence-engineering still work, but fresh clones and CI
checkouts should reference the real home.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y32etYBCKV6t1qDoLoGmgF
The WRL→STEP migration notice auto-dismisses after 10 s
(pcb_edit_frame.cpp ShowMessageFor); when the timer fired between the
pre-hide GL-box baseline and the post-restore comparison, the canvas
shifted by the bar's height and the ±3 px restore-exactness check could
never pass (CI 30289317464, web-firefox — pure timing, the wx dark
form-control bump on that run was innocent). Gate the baseline on the
notice being HIDDEN — its DOM node outlives the dismiss, so absence
never happens.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y32etYBCKV6t1qDoLoGmgF
Since comments-ux 0002, WasmTool re-sends the shell theme through
kicadSetColorTheme on every boot; setColorTheme ran CommonSettingsChanged
unconditionally, which recreates the menubar/toolbars — and they come back
SHOWN, undoing the kicadSetChrome(false) the read-only viewer and mobile
canvas-only mode applied moments earlier (CI: read-only-editor +
mobile-editor "9 visible menu titles").
Two-part fix in pcbjam_theme:
- early-out when the requested theme AND the wx dark-chrome flag are
already applied — the every-boot re-send (still needed for warm
relaunches with stale MEMFS settings) becomes a true no-op;
- after a REAL apply, re-assert the hidden chrome via a hook the merged
image installs (kicadSetChrome(false) when the snapshot says hidden),
queued with CallAfter from inside the fiber body so FIFO lands it
behind the CallAfter-deferred ReCreateMenuBar. Covers viewers/mobile
users toggling dark mode mid-session.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y32etYBCKV6t1qDoLoGmgF
Chrome start-hidden default is now startsChromeHidden(): phones (UA-CH),
tablets (coarse primary pointer at any width), and narrow windows (<=900px,
any pointer). isMobileMode() drops its narrow-viewport requirement so
tablets get the full mobile treatment (touch shim, preflight suppression);
touch laptops stay desktop (fine primary pointer). capabilities.ts probe
kept in sync. ?mobile= still overrides both ways.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CkUNWj4KWz6WfP8VwRsUNN
The Vercel -> Cloudflare Pages move is done and the Vercel project is
deleted, so the one-shot scripts have no remaining purpose. Nothing in CI
ever called them — deploy-site.yml runs npm ci / test / build / pages
deploy inline — so this removes 10 files and orphans nothing.
Deleted: 00-baseline (refused to run without x-vercel-id, so permanently
unrunnable), 01-preflight (proved Vercel state and API-token scopes),
07-dns-cutover (the phased cutover; in the end the records were attached
through the dashboard, and the rules/apex phases went unused once we chose
APEX_MODE=serve), 09-detach-vercel (its target project is gone), plus
03-ensure-project, 04-set-secrets, 05-deploy, 06-verify-deploy,
02-verify-local and 99-rollback, all either spent or duplicating CI. Their
lib/cf-api.sh went with them: the survivors use wrangler, so the whole
remaining path needs only `wrangler login` and no zone scopes.
What is kept is the part with ongoing value: lib/parity.sh, the assertion
set that caught five real defects during the migration — the live COOP/COEP
bug on the post's canonical URL, the soft-404 Pages would have introduced,
the cross-site form-POST guard Vercel had been providing for free, the
missing immutable header, and HSTS max-age=0. "Does the page return 200"
catches none of those.
08-verify-prod.sh becomes verify.sh, since the numbered sequence it
belonged to no longer exists. It drops the stamp machinery, the dry-run
plumbing and the Vercel-fallback messaging (there is no fallback now:
recovery is promoting a previous Pages deployment), and gains --skip-dns /
--skip-domains so it can be pointed at a single deployment via PROD_BASE
before promoting it.
The README is rewritten around the four invariants that fail SILENTLY —
never widen _headers to /*, keep both URL forms of the Gerber post, never
delete 404.astro, keep the cross-site form-POST guard — each with the
reason, since the reason is the only thing that stops someone simplifying
them back out.
Verified after: 21 probes, 20 pass, 1 warn (HSTS max-age is 6 months vs
Vercel's 2 years — on, just shorter), 0 fail.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LAmkjM7okPdScp9XLW1JVr
Enabling HSTS with the Max Age dropdown left at 0 serves
`strict-transport-security: max-age=0`, which the sweep was filing under
"differs from the baseline". That is far too mild: max-age=0 is not weaker
protection, it is an instruction to browsers to DISCARD the HSTS policy
they already hold — so it actively revokes the two-year policy Vercel had
been setting, for every returning visitor.
Now a hard failure regardless of EXPECT_HSTS, with the fix in the message,
since nobody deliberately wants a header whose only effect is to turn
protection off. A non-zero max-age that differs from the baseline stays a
warning: protection is on, the duration is a judgement call.
Caught on the live zone right after enabling HSTS.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LAmkjM7okPdScp9XLW1JVr
Both fired on a healthy production cutover and told the operator to roll
back, which is worse than not checking at all.
- The DNS check looked for a CNAME on www. Once the custom domain is
attached the record is PROXIED, so it answers with Cloudflare anycast A
records and exposes no CNAME — the empty result was the correct state
being reported as "unexpected target". Now it asserts what actually
matters: the host resolves, and it does not still CNAME to Vercel. The
authoritative on-Cloudflare signal was already the cf-ray/x-vercel-id
pair right below it.
- HSTS absence was a hard FAIL. It is an independent one-toggle choice with
no bearing on whether the migration worked, so it is a WARN unless
EXPECT_HSTS=1. Set that once the zone toggle is on and it becomes a hard
assertion again.
Verified against the real cutover: 21 probes, 20 pass, 1 warn (HSTS), 0 fail.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LAmkjM7okPdScp9XLW1JVr
Vercel was doing the apex->www 308 itself (its "redirect to www" project
setting), so nothing about Cloudflare requires a redirect — the behaviour
just disappears with Vercel. Rather than rebuild it with a zone Redirect
Rule plus a proxied placeholder record, attach pcbjam.com as a SECOND
custom domain on pcbjam-site. Both hosts serve the site and the pages
already emit canonical=www, which is what consolidates them for search.
That drops the riskiest artefact in the migration. Redirect Rules are
zone-scoped and run BEFORE Workers/Pages routing, so a `contains` match
instead of `eq` would 308 app./editor./demo./api. to www — breaking the
product API, not just a marketing page. The sibling hosts are also the
reason this was worth avoiding rather than merely guarding.
APEX_MODE (lib/common.sh) selects the topology, defaulting to `serve`.
08-verify-prod.sh now dispatches through assert_apex: in serve mode it
requires the apex to answer 200 with no hop, to not be a stale Vercel
response, to declare canonical=www, and to expose /api/waitlist. The
`redirect` mode and 07's rules/apex phases are kept for the alternative.
08 also checks the attached domains via wrangler rather than the REST API,
so the whole serve-mode path needs only `wrangler login` — no zone scopes
at all.
Comments that explained themselves via the old redirect are corrected:
astro.config.mjs, web/standalone/src/lib/config.ts and
scripts/deploy/build-demo.mjs. The demo keeps posting to www — not because
the apex redirects, but because a CORS preflight cannot follow one, so
aiming at a host that might ever redirect is a latent breakage.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LAmkjM7okPdScp9XLW1JVr
`wrangler login` yields an OAuth token that wrangler uses itself but that
cannot be replayed as a REST bearer token, and it only carries zone:read.
03 and 06 were reaching for the REST API for things wrangler can answer,
so they died on a missing CLOUDFLARE_API_TOKEN even though every Pages
operation they needed was already authorised.
03 now reads `pages project list --json` for existence and the Git
provider, and proves the production branch EMPIRICALLY from
`pages deployment list --environment production` — if a deployment on
that branch is labelled Production, the setting must be right. That is a
stronger check than reading the field, which the REST endpoint would have
given us. 06 resolves the production deployment the same way.
cf_have_token() marks the boundary, and cf_token() now explains why a
login is not sufficient for the DNS/ruleset/HSTS phases of 07.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LAmkjM7okPdScp9XLW1JVr
Two generic (manufacturer-agnostic) pcbnew-side subcommands for platform
manufacturing plugins: --ipc356 (IPC-D-356 netlist via IPC356D_WRITER) and
--fab-components (board metrics + per-footprint placement/BOM JSON —
absolute board coords, consumers apply their own conventions). Bumps the
kicad submodule for the diet keep-back of export_d356.cpp.
Also closes a CI cache gap: wasm-cache-hash never hashed wasm/**, so a
pure wasm/cli change would cache-hit stale output — { dir: "wasm" } is
now an input (busts the cache once on landing).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mr8PQ34yCfvEtEcwSUvLAV
`command -v vercel` gated the check on a global install that nobody here
has — this repo always invokes it as `npx vercel`. The probe was silently
skipped, so preflight never confirmed the three env-var names that
04-set-secrets.sh needs to carry over. SKIP_VERCEL_CHECK=1 opts out.
Names only; values are never read or printed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LAmkjM7okPdScp9XLW1JVr
