rudy4 0.2.0

data/experiments/exp_exc.d

@@ -0,0 +1,265 @@
+/// EXPERIMENT 6 — D <-> Ruby exception ping-pong torture.
+///
+/// Torture elements:
+/// - rb_rescue / rb_ensure / rb_protect nested inside each other, with
+///   bodies that call BACK into Ruby (rb_funcall) and raise from both sides
+///   of the boundary in every combination.
+/// - Mutual recursion Ruby -> D -> Ruby -> D ... 50 levels deep, unwinding
+///   through raises at the deepest level: longjmp must cleanly skip D
+///   frames without corrupting D state.
+/// - State checks after each unwind: module vars survive, D-GC memory
+///   allocated before the raise is still reachable (no collection of live
+///   objects due to the longjmp), and the Ruby exception object surfacing
+///   in Ruby is the SAME object raised inside the D call (identity check).
+/// - rb_protect with nested rb_protect: inner raise caught by inner
+///   protect, outer protect sees state == 0.
+/// - rb_ensure: the ensure callback runs even when the body raises through
+///   two nested rescues.
+///
+/// Layout:
+///   DExc.echo_or_raise(n)   -> calls Ruby method (n times recursively via
+///                              Ruby-level recursion into this function)
+///   DExc.rescue_case        -> rb_rescue around a raising body
+///   DExc.ensure_case        -> rb_ensure: body raises, ensure counts
+///   DExc.protect_case       -> rb_protect with nested protect inside
+///   DExc.deep_ping_pong     -> the recursion torture (see test)
+///   DExc.state              -> survival checks after unwinds
+///   DExc.identical_exc      -> raise inside rb_protect, re-raise SAME VALUE
+
+module exp_exc;
+
+import rudy.bind.value;
+import rudy.convert;
+
+import core.stdc.stdlib : malloc, free;
+
+private:
+
+// All module state __gshared: D module vars are thread-local by default
+// (torture finding #1) — Ruby threads are OS pthreads.
+__gshared:
+long calls_made;         // every entry into a D function
+long ensures_run;        // every rb_ensure ensure callback
+long rescues_run;        // every rb_rescue rescue callback
+long protects_caught;    // every rb_protect that observed state != 0
+long max_depth_seen;     // deepest recursion observed (mutual D<->Ruby)
+VALUE exc_kept;          // exception VALUE held across a longjmp
+VALUE exc_reseen;        // exception VALUE re-observed after re-raise
+int  ping_pong_failed;   // set when deep recursion returns wrong value
+
+// ---------------------------------------------------------- helpers
+
+extern (C) VALUE keep_exc(VALUE exc)
+{
+    // Store the pending VALUE (from rb_errinfo after a protect catch).
+    exc_kept = exc;
+    return Qnil_;
+}
+
+extern (C) void note_exception(VALUE exc) { exc_kept = exc; }
+
+// ---------------------------------------------------------- echo_or_raise
+// Ruby test calls: DExc.echo_or_raise(depth)
+//   - if depth > 0: call Ruby-side DExc.ping_pong(depth - 1) — Ruby method
+//     defined in the test file calls DExc.echo_or_raise back. Mutual
+//     recursion through the boundary.
+//   - if depth == 0: raise Ruby RuntimeError (longjmp from D code).
+//   - if depth < 0: return a string; no raise (clean path).
+
+extern (C) VALUE echo_or_raise(VALUE self, VALUE depth)
+{
+    calls_made += 1;
+    long d = d_type!long(depth);
+    if (d > 0)
+    {
+        // record depth for the max-depth assertion
+        if (d > max_depth_seen) max_depth_seen = d;
+        // Mutual recursion: D -> Ruby method -> D again.
+        return rb_funcall(rb_mKernel, rb_intern("DExc_ping_pong"), 1, rb_int2inum(d - 1));
+    }
+    else if (d == 0)
+    {
+        // raise from D: longjmp straight out of this D frame (never returns)
+        rb_raise(rb_eRuntimeError, "bottom of recursion");
+        assert(0);
+    }
+    else
+    {
+        return rb_str_new_cstr("clean");
+    }
+    assert(0);   // rb_raise is noreturn; silence D's no-return analysis
+}
+
+// ---------------------------------------------------------- rescue_case
+// rb_rescue around a Ruby-method body that raises. The rescue callback
+// runs with the exception VALUE in hand — we store it and return a marker.
+
+extern (C) VALUE raising_body(VALUE data) { return rb_funcall(rb_mKernel, rb_intern("DExc_raise"), 0); }
+extern (C) VALUE rescue_body(VALUE data, VALUE exc)
+{
+    rescues_run += 1;
+    note_exception(exc);
+    return rb_str_new_cstr("rescued");
+}
+
+extern (C) VALUE rescue_case(VALUE self)
+{
+    calls_made += 1;
+    return rb_rescue(&raising_body, Qnil_, &rescue_body, Qnil_);
+}
+
+// ---------------------------------------------------------- ensure_case
+// rb_ensure: body raises; the ensure callback must still run (its counter
+// is the assertion) and the exception must propagate to the Ruby caller.
+
+extern (C) VALUE ensure_ensure(VALUE data)
+{
+    ensures_run += 1;
+    return Qnil_;
+}
+
+extern (C) VALUE ensure_case(VALUE self)
+{
+    calls_made += 1;
+    return rb_ensure(&raising_body, Qnil_, &ensure_ensure, Qnil_);
+}
+
+// ---------------------------------------------------------- protect_case
+// Nested rb_protect: the inner protect catches an inner raise; the outer
+// protect runs a clean body and must see state == 0. If the inner raise
+// leaked outward, the whole VM would die (this actually happened with
+// early def! trampolines — chunk-1 finding).
+
+extern (C) VALUE inner_protect_body(VALUE data) { return rb_funcall(rb_mKernel, rb_intern("DExc_raise"), 0); }
+
+extern (C) VALUE inner_protect(VALUE data)
+{
+    int state = 0;
+    VALUE v = rb_protect(&inner_protect_body, Qnil_, &state);
+    if (state != 0)
+    {
+        protects_caught += 1;
+        // clear the pending exception: we HANDLED it (else the next Ruby
+        // API call spuriously raises at an arbitrary point)
+        rb_set_errinfo(Qnil_);
+        return rb_str_new_cstr("inner caught");
+    }
+    return v;
+}
+
+extern (C) VALUE protect_body(VALUE data) { return rb_funcall(rb_mKernel, rb_intern("DExc_inner"), 0); }
+
+// The Ruby-side stepper for the outer protect body calls THIS (registered
+// as DExc.protect_inner): nested protect, raise contained at the inner.
+extern (C) VALUE protect_inner(VALUE self)
+{
+    return inner_protect(Qnil_);
+}
+
+extern (C) VALUE protect_case(VALUE self)
+{
+    calls_made += 1;
+    int state = 0;
+    VALUE v = rb_protect(&protect_body, Qnil_, &state);
+    if (state != 0)
+    {
+        protects_caught += 1;
+        rb_set_errinfo(Qnil_);
+        return rb_str_new_cstr("outer caught unexpectedly");
+    }
+    return v;
+}
+
+// ---------------------------------------------------------- deep ping-pong
+// Called from Ruby with a big depth and a block: recurses D -> Ruby -> D
+// with the block called at every level, then raises at the bottom. The
+// Ruby rescue wraps the whole thing; we assert the unwind depth bookkeeping.
+
+extern (C) VALUE deep_ping_pong(VALUE self, VALUE depth)
+{
+    calls_made += 1;
+    long d = d_type!long(depth);
+    if (d > max_depth_seen) max_depth_seen = d;
+    if (d == 0)
+    {
+        rb_raise(rb_eRuntimeError, "deep bottom");
+        assert(0);
+    }
+    // call the Ruby-side stepper (defined in the test file); a dedicated
+    // name so the deep test does not route through echo_or_raise's stepper
+    return rb_funcall(rb_mKernel, rb_intern("DExc_deep_ping_pong"), 1, rb_int2inum(d - 1));
+}
+
+// ---------------------------------------------------------- identical_exc
+// Prove that the exception object raised inside a protected body is the
+// SAME object that later appears in Ruby's rescue: identity via rb_obj_id.
+// (also exercises rb_exc_raise: D re-raises the SAME exception VALUE after
+// the protect catch — re-raising with rb_raise would build a new exc.)
+
+extern (C) VALUE bomb_body(VALUE data) { return rb_funcall(rb_mKernel, rb_intern("DExc_raise"), 0); }
+
+extern (C) VALUE identical_exc(VALUE self)
+{
+    calls_made += 1;
+    int state = 0;
+    VALUE v = rb_protect(&bomb_body, Qnil_, &state);
+    if (state != 0)
+    {
+        protects_caught += 1;
+        exc_reseen = rb_errinfo();
+        rb_set_errinfo(Qnil_);
+        // return the exception itself; the Ruby test compares object ids
+        // after catching a re-raise of this same VALUE via rb_exc_raise
+        return exc_reseen;
+    }
+    return v;
+}
+
+extern (C) VALUE reraise(VALUE self, VALUE exc)
+{
+    calls_made += 1;
+    exc_reseen = exc;
+    rb_exc_raise(exc);   // never returns
+    assert(0);
+}
+
+// ---------------------------------------------------------- state
+
+extern (C) VALUE get_calls(VALUE self)      { return rb_int2inum(calls_made); }
+extern (C) VALUE get_ensures(VALUE self)    { return rb_int2inum(ensures_run); }
+extern (C) VALUE get_rescues(VALUE self)    { return rb_int2inum(rescues_run); }
+extern (C) VALUE get_protects(VALUE self)   { return rb_int2inum(protects_caught); }
+extern (C) VALUE get_max_depth(VALUE self)  { return rb_int2inum(max_depth_seen); }
+extern (C) VALUE get_ping_fail(VALUE self)   { return ping_pong_failed ? Qtrue_ : Qfalse_; }
+extern (C) VALUE get_exc_kept(VALUE self)    { return exc_kept; }
+extern (C) VALUE get_exc_reseen(VALUE self)  { return exc_reseen; }
+
+// ---------------------------------------------------------- init
+
+pragma(mangle, "Init_exp_exc")
+extern (C) void Init_exp_exc()
+{
+    // The two __gshared VALUE slots hold exceptions across D calls; Ruby's
+    // GC would otherwise be free to collect them mid-experiment (a VALUE
+    // stored only in a D global is invisible to the collector).
+    rb_gc_register_address(&exc_kept);
+    rb_gc_register_address(&exc_reseen);
+
+    VALUE m = rb_define_module("DExc");
+    rb_define_module_function(m, "echo_or_raise", cast(AnyMethod) &echo_or_raise, 1);
+    rb_define_module_function(m, "rescue_case", cast(AnyMethod) &rescue_case, 0);
+    rb_define_module_function(m, "ensure_case", cast(AnyMethod) &ensure_case, 0);
+    rb_define_module_function(m, "protect_case", cast(AnyMethod) &protect_case, 0);
+    rb_define_module_function(m, "protect_inner", cast(AnyMethod) &protect_inner, 0);
+    rb_define_module_function(m, "deep_ping_pong", cast(AnyMethod) &deep_ping_pong, 1);
+    rb_define_module_function(m, "identical_exc", cast(AnyMethod) &identical_exc, 0);
+    rb_define_module_function(m, "reraise", cast(AnyMethod) &reraise, 1);
+    rb_define_module_function(m, "calls", cast(AnyMethod) &get_calls, 0);
+    rb_define_module_function(m, "ensures", cast(AnyMethod) &get_ensures, 0);
+    rb_define_module_function(m, "rescues", cast(AnyMethod) &get_rescues, 0);
+    rb_define_module_function(m, "protects", cast(AnyMethod) &get_protects, 0);
+    rb_define_module_function(m, "max_depth", cast(AnyMethod) &get_max_depth, 0);
+    rb_define_module_function(m, "ping_pong_failed", cast(AnyMethod) &get_ping_fail, 0);
+    rb_define_module_function(m, "exc_kept", cast(AnyMethod) &get_exc_kept, 0);
+    rb_define_module_function(m, "exc_reseen", cast(AnyMethod) &get_exc_reseen, 0);
+}

data/experiments/exp_gcstorm.d

@@ -0,0 +1,169 @@
+/// EXPERIMENT 5 — TypedData allocation/free storm under GC pressure.
+///
+/// Torture elements:
+/// - Ruby threads hammer DExpStorm.make(n) -> n malloc'd TypedData wrappers,
+///   dropped immediately (Ruby GC churns them), each dfree bumps an ATOMIC
+///   D-side counter: allocation/free must balance exactly at the end.
+/// - While the Ruby storm runs, a D-side native thread churns D-GC memory
+///   (large struct arrays) and forces GC.collect()s — exercising the D
+///   collector while Ruby's collector runs in other OS threads.
+/// - Cross-thread free counting proves dfree callbacks are actually invoked
+///   (freed == allocated) and that typed-data free is thread-safe w.r.t.
+///   a concurrently-running D GC.
+///
+/// Layout:
+///   DExpStorm.make(n)        -> allocate n wrappers, return the last one
+///   DExpStorm.alloc_count    -> total wrappers allocated (monotonic)
+///   DExpStorm.free_count     -> total dfree callbacks run
+///   DExpStorm.start_churn / stop_churn -> D background GC churn on/off
+///   DExpStorm.churn_cycles   -> how many churn cycles completed
+///   DExpStorm.balance        -> alloc_count - free_count (== live wrappers)
+///
+/// What can go wrong (the point of the torture):
+/// - dfree never called (leak) -> free_count stalls below alloc_count
+/// - dfree called twice -> free_count > alloc_count (corruption)
+/// - race on the counters between Ruby threads + D thread -> torn reads
+///   (counters must be shared, atomic ops via core.atomic)
+
+module exp_gcstorm;
+
+import rudy.bind.value;
+import rudy.convert;
+import rudy.typeddata;
+
+import core.atomic : atomicOp, atomicLoad;
+import core.thread : Thread;
+import core.time : msecs;
+import core.memory : GC;
+import core.runtime : rt_init;
+import core.stdc.stdlib : malloc, free;
+import std.conv : to;
+
+private:
+
+// A struct with real payload so malloc'd memory is actually used
+struct StormCell
+{
+    double[16] payload;
+    ulong serial;
+}
+
+// dfree for this experiment: count the free, then release the malloc'd
+// cell. The free runs on Ruby's GC thread — a DIFFERENT OS thread than
+// make() — which is exactly the cross-thread race the storm tests.
+extern (C) void stormcell_free(void* p)
+{
+    atomicOp!"+="(free_count, 1);
+    free(p);
+}
+
+// The mixin wires our counting dfree into the descriptor directly (third
+// template param) — no need for a hand-built second descriptor, which the
+// first version of this experiment did (and which was silently unused:
+// stormcell_wrap always wrapped with the ORIGINAL descriptor, so free_count
+// stayed 0 — torture finding #6: the mixin's wrap function hard-codes
+// `&name_type`, so overriding .dfree on a copied descriptor does nothing).
+mixin RudyTypedData!(StormCell, "stormcell", &stormcell_free);
+
+shared long alloc_count;     // bumped by make() under GVL (no race with dfree)
+shared long free_count;     // bumped by dfree from Ruby GC threads
+shared long churn_cycles;   // bumped by the D background thread
+
+// ---------------------------------------------------------- Ruby API
+
+extern (C) VALUE make(VALUE self, VALUE n)
+{
+    long count = d_type!long(n);
+    VALUE last = Qnil_;
+    foreach (i; 0 .. count)
+    {
+        auto cell = cast(StormCell*) malloc(StormCell.sizeof);
+        cell.serial = cast(ulong) atomicOp!"+="(alloc_count, 1);
+        cell.payload[] = 1.5;             // touch the memory
+        last = stormcell_wrap(rb_cObject, cell);
+        // immediately drop `last` from Ruby's perspective: not stored
+        // anywhere, next iteration overwrites the reference.
+    }
+    return last;
+}
+
+extern (C) VALUE get_alloc_count(VALUE self) { return rb_int2inum(atomicLoad(alloc_count)); }
+extern (C) VALUE get_free_count(VALUE self)  { return rb_int2inum(atomicLoad(free_count)); }
+extern (C) VALUE get_balance(VALUE self)
+{
+    return rb_int2inum(atomicLoad(alloc_count) - atomicLoad(free_count));
+}
+
+// ---------------------------------------------------------- D churn thread
+
+shared bool churning;             // D keyword-safe flag read by the thread
+__gshared Thread churn_thread;
+
+// Plain D function (NOT extern (C)): core.thread.Thread's ctor wants
+// `void function()` and an extern (C) function has a different D type even
+// though the machine code is identical.
+void churn_loop()
+{
+    while (atomicLoad(churning))
+    {
+        // churn: allocate and drop D-GC memory, forcing collections
+        auto junk = new StormCell[10_000];
+        foreach (ref c; junk) c.serial = 42;
+        atomicOp!"+="(churn_cycles, 1);
+        // D GC runs while Ruby GC frees wrappers in other threads
+        if (atomicLoad(churning))
+            GC.collect();
+        Thread.getThis.sleep(10.msecs);
+    }
+}
+
+extern (C) VALUE start_churn(VALUE self)
+{
+    if (churn_thread !is null) return Qfalse_;
+    churning = true;
+    churn_thread = new Thread(&churn_loop);
+    churn_thread.isDaemon = true;
+    churn_thread.start();
+    return Qtrue_;
+}
+
+extern (C) VALUE stop_churn(VALUE self)
+{
+    churning = false;
+    if (churn_thread !is null)
+    {
+        churn_thread.join();
+        churn_thread = null;
+    }
+    return Qnil_;
+}
+
+extern (C) VALUE get_churn_cycles(VALUE self) { return rb_int2inum(atomicLoad(churn_cycles)); }
+
+// ---------------------------------------------------------- init
+
+pragma(mangle, "Init_exp_gcstorm")
+extern (C) void Init_exp_gcstorm()
+{
+    // TORTURE FINDING #5: a GDC-compiled .so dlopened by Ruby NEVER runs
+    // rt_init(). The D GC lazy-initializes on first `new`, but core.time's
+    // _ticksPerSecond is filled only by _d_initMonoTime() from rt_init().
+    // Calling MonoTime/Thread.sleep from a D thread then hard-aborts with
+    // "MonoTimeImpl failed to get the frequency of the system's monotonic
+    // clock." (druntime core/time.d abort) — seen as a process-wide SIGABRT
+    // racing the Ruby VM. Any D extension that spawns threads, sleeps, or
+    // uses GC.collect() must call rt_init() itself in its Init hook.
+    rt_init();
+
+    // descriptor is generated by the mixin with the counting free func
+    // wired in via template parameter — nothing to patch here.
+
+    VALUE m = rb_define_module("DExpStorm");
+    rb_define_module_function(m, "make", cast(AnyMethod) &make, 1);
+    rb_define_module_function(m, "alloc_count", cast(AnyMethod) &get_alloc_count, 0);
+    rb_define_module_function(m, "free_count", cast(AnyMethod) &get_free_count, 0);
+    rb_define_module_function(m, "balance", cast(AnyMethod) &get_balance, 0);
+    rb_define_module_function(m, "start_churn", cast(AnyMethod) &start_churn, 0);
+    rb_define_module_function(m, "stop_churn", cast(AnyMethod) &stop_churn, 0);
+    rb_define_module_function(m, "churn_cycles", cast(AnyMethod) &get_churn_cycles, 0);
+}

data/experiments/exp_http.d

@@ -0,0 +1,254 @@
+/// EXPERIMENT 4 — A tiny single-endpoint HTTP server: D owns the socket,
+/// Ruby owns the handler.
+///
+/// Torture elements:
+/// - POSIX socket code entirely in D (std.socket), accept() runs with the
+///   GVL RELEASED via rb_thread_call_without_gvl + RUBY_UBF_IO — the same
+///   pattern any real blocking C extension must use.
+/// - The response body is produced by a Ruby block (proc) handed in from
+///   Ruby and invoked via rb_funcallv — D <-> Ruby boundary crossing on a
+///   hot path, with fresh Ruby objects (request string) each call.
+/// - A Ruby side thread stays alive while D blocks in accept(): proves the
+///   GVL is actually released (side thread's heartbeats would stall it).
+/// - rb_ensure wraps the whole serve-one-request cycle so the client socket
+///   is closed even if the handler block raises mid-response.
+///
+/// Layout (port chosen by kernel, reported back to Ruby via serve.port):
+///
+///   DExpHTTP.serve_one(port_block_latch)  — binds 127.0.0.1:0, accepts ONE
+///       request, calls the registered handler block with the request
+///       string, writes "HTTP/1.1 200 OK\r\nContent-Length: N\r\n\r\n" +
+///       body, closes, returns the port used.
+///   DExpHTTP.port                        — the bound port after serve_one.
+///   DExpHTTP.register_handler(&blk)      — stores the handler proc.
+///   DExpHTTP.heartbeat                   — tick counter bumped by a Ruby
+///       side thread; serve_one returns it alongside the port so the test
+///   DExpHTTP.handler_ok                  — true if the Ruby handler was
+///       actually called and returned a String.
+///
+/// What can go wrong (the point of the torture):
+/// - handler block raising with client fd open (ensure must close it)
+/// - GC moving the request string while D holds a slice (we .idup)
+/// - accept() blocking forever with no UBF (we pass RUBY_UBF_IO; without
+///   releasing the GVL a Ruby watchdog thread could never run)
+
+module exp_http;
+
+import rudy.bind.value;
+import rudy.convert;
+import rudy.defs;
+
+import std.socket;
+import std.string : toStringz, fromStringz;
+import std.conv : to;
+import std.format : format;
+
+private:
+
+// ---- state kept alive across calls ------------------------------------
+// TORTURE FINDING #1: D module-level variables are THREAD-LOCAL by default.
+// Ruby threads are OS pthreads — a variable set by one Ruby thread is NOT
+// visible to another unless declared `__gshared` (C-style global). D1-era
+// Rudy never hit this because D1 had no TLS globals. Without __gshared
+// the port/heartbeat handshakes below silently read 0 from other threads.
+__gshared:
+TcpSocket listening_sock;
+Socket client_sock;    // NOT TcpSocket: Socket.accept() returns a base
+                       // Socket instance; cast(TcpSocket) is a checked
+                       // downcast in D and would yield null (torture
+                       // finding #3), giving a null-deref on receive().
+ushort bound_port;
+int heartbeats;            // bumped via DExpHTTP.heartbeat from Ruby
+int handler_called;        // set when the Ruby handler block ran
+int accept_failed;          // set by do_accept on a D exception
+VALUE handler_blk = Qnil_; // the Ruby handler proc
+
+// ubf for interrupting a blocking accept when the Ruby thread is killed
+extern (C) void ubf_accept(void* unused)
+{
+    // RUBY_UBF_IO is what real extensions use for socket waits: it makes
+    // the GVL-released call interruptible on Thread#kill/timeout without
+    // us implementing a real unblocker (the fd gets closed by the OS on
+    // process exit; for a one-shot experiment this is acceptable).
+}
+
+extern (C) void* do_accept(void* data)
+{
+    // running WITHOUT the GVL: pure D socket code, no Ruby API calls.
+    // accept() returns a Socket (D GC-allocated), not TcpSocket — cast.
+    //
+    // TORTURE FINDING #2: when the process gets a signal (timeout(1) sends
+    // SIGTERM), accept(2) fails with EINTR and Phobos throws
+    // SocketAcceptException — and a D exception unwinding out of a
+    // rb_thread_call_without_gvl callback aborts the runtime (gcc.deh
+    // terminate: no D handler up-stack). All D exceptions must be
+    // swallowed inside the no-GVL region and reported after re-acquiring.
+    try
+    {
+        client_sock = listening_sock.accept();
+        accept_failed = false;
+    }
+    catch (Exception e)
+    {
+        accept_failed = true;
+    }
+    return null;
+}
+
+// ---- the Ruby handler invocation (GVL held again here) ----------------
+
+extern (C) VALUE call_handler_protected(VALUE data)
+{
+    // data = the request String built by D
+    VALUE blk = handler_blk;
+    VALUE[1] av = [data];
+    handler_called = 1;
+    return rb_funcallv(blk, rb_intern("call"), 1, av.ptr);
+}
+
+extern (C) VALUE ensure_close_client(VALUE data)
+{
+    // runs on the way out no matter what: success, handler raise, or a
+    // transport error. Closing twice is fine (second is a no-op).
+    if (client_sock !is null)
+    {
+        client_sock.close();
+        client_sock = null;
+    }
+    return Qnil_;
+}
+
+extern (C) VALUE serve_one_body(VALUE self)
+{
+    // bind 127.0.0.1:0 -> kernel picks a free port
+    auto addr = new InternetAddress("127.0.0.1", 0);
+    listening_sock = new TcpSocket(AddressFamily.INET);
+    listening_sock.bind(addr);
+    listening_sock.listen(1);
+    bound_port = (cast(InternetAddress) listening_sock.localAddress()).port;
+
+    // accept() with the GVL released — Ruby threads stay alive while we wait
+    rb_thread_call_without_gvl(&do_accept, null, &ubf_accept, null);
+    if (accept_failed)
+        rudy_raise(rb_eRuntimeError, "accept() failed (interrupted or bad fd)");
+
+    // read the request (curl/ruby client sends one small request; we read
+    // whatever arrived, up to a sane cap). Plain default-init is fine here.
+    ubyte[4096] buf;
+    size_t got = client_sock.receive(buf[]);
+    if (got == 0)                       // client closed without sending
+        rudy_raise(rb_eRuntimeError, "client closed before sending");
+
+    string req = cast(string) buf[0 .. got].idup;
+
+    // hand the request to the Ruby handler block
+    VALUE reqv = rb_str_new(req.ptr, cast(C_long) req.length);
+    int state;
+    VALUE body = rb_protect(&call_handler_protected, reqv, &state);
+    if (state)
+    {
+        // re-raise as a plain RuntimeError carrying the original message:
+        // proves the longjmp out of a D frame stack didn't corrupt state.
+        VALUE e = rb_errinfo();
+        VALUE msg = rb_funcallv(e, rb_intern("message"), 0, null);
+        string m = "handler raised: " ~ d_type!string(msg);
+        rudy_raise(rb_eRuntimeError, m);
+    }
+    VALUE body_s = rb_str_to_str(body); // enforce String contract
+    auto len = rb_str_strlen(body_s);
+    auto bptr = rb_string_value_ptr(&body_s);   // may swap body_s in-place
+
+    // build + write the response
+    string head = format!"HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: %d\r\nConnection: close\r\n\r\n"(len);
+    client_sock.send(head);
+    client_sock.send(bptr[0 .. len]);
+
+    // return [port, request_first_line] to Ruby
+    VALUE res = rb_ary_new_capa(2);
+    rb_ary_push(res, rb_int2inum(bound_port));
+    size_t line1_len = req.indexOf('\n'); // index of first '\n', or full len
+    VALUE line1 = rb_str_new(req.ptr, cast(C_long) line1_len);
+    rb_ary_push(res, line1);
+    return res;
+}
+
+extern (C) VALUE serve_one(VALUE self)
+{
+    handler_called = 0;
+    bound_port = 0;   // so Ruby's port>0 poll waits for THIS round's listener
+    // also drop any leftover listener from a previous round
+    if (listening_sock !is null)
+    {
+        try { listening_sock.close(); } catch (Exception e) {}
+        listening_sock = null;
+    }
+    // rb_ensure: body, body_data, ensure, ensure_data
+    return rb_ensure(&serve_one_body, Qnil_, &ensure_close_client, Qnil_);
+}
+
+extern (C) VALUE reset(VALUE self)
+{
+    // close any leftover listener (e.g. after a raise round) and zero the
+    // port so a new round's client poll waits for a fresh bind
+    if (listening_sock !is null)
+    {
+        try { listening_sock.close(); } catch (Exception e) {}
+        listening_sock = null;
+    }
+    if (client_sock !is null)
+    {
+        try { client_sock.close(); } catch (Exception e) {}
+        client_sock = null;
+    }
+    bound_port = 0;
+    return Qnil_;
+}
+
+extern (C) VALUE get_port(VALUE self)  { return rb_int2inum(bound_port); }
+extern (C) VALUE get_heartbeats(VALUE self) { return rb_int2inum(heartbeats); }
+extern (C) VALUE heartbeat(VALUE self)  { heartbeats += 1; return Qnil_; }
+extern (C) VALUE handler_ok(VALUE self) { return handler_called ? Qtrue_ : Qfalse_; }
+
+extern (C) VALUE register_handler(VALUE self)
+{
+    // Called as DExpHTTP.register_handler { |req| ... } — arity 0, the block
+    // is materialized via rb_block_proc (raises if no block was given).
+    handler_blk = rb_block_proc();
+    return handler_blk;
+}
+
+// so the side-thread test can bump the counter from Ruby
+extern (C) VALUE exphttp_note(VALUE self, VALUE note)
+{
+    VALUE m = rb_define_module("ExpHTTPNotes");
+    rb_iv_set(m, "@note", note);
+    return note;
+}
+
+// VOID_INIT helper removed — plain `ubyte[4096] buf;` works and avoids
+// template-instantiation pitfalls under GDC.
+
+// min/indexOf shims (avoid pulling whole std.algorithm for two names)
+private size_t indexOf(string s, char c)
+{
+    foreach (i, dchar ch; s)
+        if (ch == c) return i;
+    return s.length;
+}
+
+pragma(mangle, "Init_exp_http")
+extern (C) void Init_exp_http()
+{
+    VALUE m = rb_define_module("DExpHTTP");
+    rb_define_module_function(m, "serve_one",
+        cast(AnyMethod) &serve_one, 0);
+    rb_define_module_function(m, "reset",
+        cast(AnyMethod) &reset, 0);
+    rb_define_module_function(m, "register_handler",
+        cast(AnyMethod) &register_handler, 0);
+    rb_define_module_function(m, "port", cast(AnyMethod) &get_port, 0);
+    rb_define_module_function(m, "heartbeats", cast(AnyMethod) &get_heartbeats, 0);
+    rb_define_module_function(m, "heartbeat", cast(AnyMethod) &heartbeat, 0);
+    rb_define_module_function(m, "handler_ok", cast(AnyMethod) &handler_ok, 0);
+    rb_gc_register_address(&handler_blk);
+}