@calcit/procs 0.13.50 → 0.13.52

package/README.md

@@ -19,7 +19,7 @@ Core design:
 
 Current direction:
 
-- `calcit.cirru` is the primary source snapshot; legacy `compact.cirru` is still compatible
+- `calcit.cirru` is the canonical source snapshot; retired `compact.cirru` inputs receive migration guidance
 - CLI-first development with `calcit` and `caps`, designed to work well with AI agents in terminal workflows
 - Better CLI editing and validation for CI, docs lookup, module management, and incremental updates
 
@@ -62,18 +62,16 @@ calcit eval 'range 100'
 calcit eval -- '-> 100 range (map $ \ * % %)'
 ```
 
-Run with a runtime snapshot such as `calcit.cirru` (legacy filename: `compact.cirru`):
+Run with the canonical runtime snapshot `calcit.cirru`:
 
 ```bash
 calcit calcit.cirru # run once (default)
-calcit compact.cirru # legacy filename still works
-
-calcit # by default, it picks `calcit.cirru`, then falls back to `compact.cirru`
+calcit # reads calcit.cirru from the current directory
 
 calcit -w # watch mode (explicit flag required)
 ```
 
-By default Calcit reads `:init-fn` and `:reload-fn` from `calcit.cirru` configs (falling back to `compact.cirru`). You may also specify functions:
+By default Calcit reads `:init-fn` and `:reload-fn` from `calcit.cirru` `:entries.default`. You may also specify functions:
 
 ```bash
 calcit --init-fn='app.main/main!' --reload-fn='app.main/reload!'
@@ -150,7 +148,7 @@ Use `caps add --dev <org/repo>@<ref>` and `caps remove --dev <org/repo>` to mana
 
 `:calcit-version` helps with version checks and provides hints in [CI](https://github.com/calcit-lang/setup-calcit).
 
-To load modules, use `:modules` configuration and the runtime snapshot file `calcit.cirru` (legacy: `compact.cirru`):
+To load modules, use `:modules` configuration and the runtime snapshot file `calcit.cirru`:
 
 ```cirru.no-check
 :entries $ {}
@@ -161,7 +159,7 @@ To load modules, use `:modules` configuration and the runtime snapshot file `cal
 Paths defined in `:modules` load from the snapshot directory's `.calcit/modules/`, e.g.
 `.calcit/modules/memof/calcit.cirru`. Run `caps` to materialize or refresh that project-local view.
 
-Modules ending with `/` are automatically suffixed with `calcit.cirru`, and still fall back to `compact.cirru` for compatibility.
+Modules ending with `/` are automatically suffixed with `calcit.cirru`. A module containing only retired `compact.cirru` is rejected with migration guidance.
 
 Inspect and verify the resolved graph with:
 
@@ -203,7 +201,7 @@ yarn check-all
 ```
 
 - [Cirru Parser](https://github.com/Cirru/parser.rs) for indentation-based syntax parsing.
-- [Cirru EDN](https://github.com/Cirru/cirru-edn.rs) for runtime snapshot file parsing (`calcit.cirru` / legacy `compact.cirru`).
+- [Cirru EDN](https://github.com/Cirru/cirru-edn.rs) for canonical runtime snapshot parsing (`calcit.cirru`).
 - [Ternary Tree](https://github.com/calcit-lang/ternary-tree.rs) for immutable list data structure.
 
 Other tools:

package/RFCs/05-12-program-diff-rfc.md

@@ -11,7 +11,7 @@
 
 - `calcit analyze program-diff <GIT REF>`
 
-该命令从 Git 中读取指定版本的完整运行时快照文件（默认沿用当前 `calcit` 的输入文件路径，优先 `calcit.cirru`，兼容旧文件名 `compact.cirru`），确保**历史版本**与**当前工作区版本**都能被正确解析为 Calcit snapshot，然后做**结构化 diff**。
+该命令从 Git 中读取指定版本的完整运行时快照文件（默认沿用当前 `calcit` 的 canonical `calcit.cirru` 输入路径；退休的 `compact.cirru` 会被拒绝并提示迁移），确保**历史版本**与**当前工作区版本**都能被正确解析为 Calcit snapshot，然后做**结构化 diff**。
 
 输出目标不是纯文本行 diff，而是面向程序结构的树形 diff：
 
@@ -27,7 +27,7 @@
 
 当前针对运行时快照文件的版本对比主要依赖 Git 行 diff，但它有几个明显问题：
 
-1. **对结构不友好**：`calcit.cirru`（兼容旧文件名 `compact.cirru`）是机器生成的 snapshot，行 diff 容易受格式、字段顺序和长表达式影响；
+1. **对结构不友好**：`calcit.cirru` 是机器生成的 snapshot，行 diff 容易受格式、字段顺序和长表达式影响；
 2. **对表达式内部变化不友好**：definition 代码改动往往是局部子树变化，行 diff 很难快速看出 AST 层面的增删改；
 3. **对 LLM / CLI 阅读不友好**：调用 `git diff` 后很难一眼区分“只是某个 def 变了”还是“整个 namespace 被搬动了”；
 4. **缺少 parse guard**：历史版本文件如果本身损坏，应该先明确报解析失败，而不是直接进入错误 diff。
@@ -43,7 +43,7 @@ calcit analyze program-diff <GIT REF>
 语义：
 
 - `<GIT REF>` 可以是 `HEAD~1`、tag、branch、commit SHA 等；
-- 当前侧使用 `calcit` 输入路径（默认优先 `calcit.cirru`，兼容旧文件名 `compact.cirru`）；
+- 当前侧使用 `calcit` 输入路径（默认是 canonical `calcit.cirru`；退休的 `compact.cirru` 不参与 diff）；
 - 历史侧使用 `git show <ref>:<repo-relative-input-path>` 读取文件内容；
 - 两边都必须先经过：
   1. `cirru_edn::parse`
@@ -177,7 +177,7 @@ list 内部子节点对比采用“带替换代价的序列对齐”策略：
 
 ## 7. 预期收益
 
-- 更适合 review `calcit.cirru`（兼容旧文件名 `compact.cirru`）的语义变化；
+- 更适合 review canonical `calcit.cirru` 的语义变化；
 - 更容易理解大型 definition 的局部 AST 改动；
 - 对 agent/LLM 更友好，能直接拿到层级化变化；
 - 为后续抽象成 Cirru diff 模块提供实现样本。

package/build.rs

@@ -64,20 +64,6 @@ pub struct SnapshotEntry {
   pub target: Option<String>,
 }
 
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct LegacySnapshotConfigs {
-  #[serde(rename = "init-fn", deserialize_with = "deserialize_ns_def")]
-  pub init_fn: String,
-  #[serde(rename = "reload-fn", deserialize_with = "deserialize_ns_def")]
-  pub reload_fn: String,
-  #[serde(default)]
-  pub modules: Vec<String>,
-  #[serde(default)]
-  pub version: String,
-  #[serde(default, rename = "type-slots")]
-  pub type_slots: HashMap<String, String>,
-}
-
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct CodeEntry {
   pub doc: String,
@@ -613,30 +599,15 @@ fn main() {
 
   let files = parse_files(data.get_or_nil("files")).unwrap_or_else(|e| panic!("failed to parse calcit-core `:files`: {e}"));
 
-  let legacy_configs = match data.get_or_nil("configs") {
-    Edn::Nil => None,
-    value => {
-      Some(from_edn::<LegacySnapshotConfigs>(value).unwrap_or_else(|e| panic!("failed to parse calcit-core legacy `:configs`: {e}")))
-    }
-  };
-  let mut entries = parse_entries(data.get_or_nil("entries")).unwrap_or_else(|e| panic!("failed to parse calcit-core `:entries`: {e}"));
-  if let Some(configs) = &legacy_configs {
-    entries.insert(
-      "default".to_owned(),
-      SnapshotEntry {
-        mode: SnapshotRunMode::Native,
-        init_fn: configs.init_fn.clone(),
-        reload_fn: configs.reload_fn.clone(),
-        description: String::new(),
-        modules: configs.modules.clone(),
-        type_slots: configs.type_slots.clone(),
-        feature_policy: HashMap::new(),
-        target: None,
-      },
-    );
+  if data.contains_key("configs") {
+    panic!("calcit-core uses retired top-level `:configs`; migrate it with Calcit 0.13.50 before building")
+  }
+  let entries = parse_entries(data.get_or_nil("entries")).unwrap_or_else(|e| panic!("failed to parse calcit-core `:entries`: {e}"));
+  if !entries.contains_key("default") {
+    panic!("calcit-core `:entries` must contain `:default`");
   }
   let version = match data.get_or_nil("version") {
-    Edn::Nil => legacy_configs.map(|configs| configs.version).unwrap_or_default(),
+    Edn::Nil => String::new(),
     value => from_edn(value).unwrap_or_else(|e| panic!("failed to parse calcit-core `:version`: {e}")),
   };
 

package/editing-history/20260827-1225-retire-snapshot-configs.md

@@ -0,0 +1,6 @@
+# Retire legacy Snapshot config aliases
+
+- Stop decoding top-level `:configs` at runtime and while embedding `calcit.core`; point legacy projects to Calcit 0.13.50 for the one-way `:entries.default` migration.
+- Remove silent `calcit.cirru` to `compact.cirru` path aliasing across runtime, query, docs, and diff commands while retaining sibling detection for an actionable error.
+- Remove the formatter advisory for a shape that current Calcit no longer loads, and align README, Agent guidance, and Snapshot docs with the released filename cutoff.
+- Validate the strict loader against the latest `Respo/respo` and `calcit-lang/recollect` main branches: native checks/tests, Markdown examples, generated JavaScript tests, quality gates, and production Vite builds remain green.

package/editing-history/20260827-1739-remove-legacy-macro-schemas.md

@@ -0,0 +1,38 @@
+# Remove legacy macro schemas
+
+## Context
+
+Issue #480 ends the migration window for runtime-shaped macro schemas. A
+`defmacro` now has one persisted and executable schema representation: the
+phase-aware `Macro` contract.
+
+## Changes
+
+- Removed the legacy macro compatibility state, provenance metadata, staged
+  warning environment switch, metrics/cache exceptions, and coverage-report
+  fields.
+- Made Snapshot loading reject a `defmacro` with a `Fn`, `Dynamic`, or other
+  non-`Macro` schema before compilation. Errors include the Snapshot
+  definition path and the final compatible Calcit version, 0.13.51.
+- Made schema editing reject legacy `:kind :macro` function maps, preventing
+  current tools from emitting a schema the loader will reject.
+- Made preprocessing and runtime macro evaluation use only strict parameter,
+  expansion, and capability checks.
+- Migrated the JS integration fixture and direct temporary-Snapshot test helper
+  to explicit strict macro contracts.
+- Updated migration, static-analysis, macro-contract, and agent documentation.
+
+## Validation
+
+- `cargo fmt --check`
+- `cargo clippy -- -D warnings`
+- `cargo test -- --test-threads=1`
+- `yarn compile`
+- `yarn check-agent-interface`
+- latest Respo and Recollect `--check-only` plus
+  `analyze check-types --deps --summary-only --format json` with the local
+  release binary
+
+`yarn check-all` was also run after the agent-interface lock cleared; its
+component gates are covered by the full Rust, integration-fixture, and release
+checks above.

package/editing-history/20260827-2250-ffi-blocking-protocol-v1.md

@@ -0,0 +1,52 @@
+# C-safe blocking FFI protocol v1
+
+## Goal
+
+Remove Rust closures, trait objects, `Vec<Edn>`, `Result`, and `FnOnce` from
+the supported `&blocking-dylib-edn-fn` boundary while preserving methods that
+must own and call back on the Calcit host thread.
+
+## Protocol decisions
+
+- use a distinct `<method>_calcit_ffi_blocking_v1` symbol so blocking and
+  asynchronous starts cannot be confused;
+- reuse `calcit_ffi_async_version() -> 1`, the generation task registry,
+  OneShot lifecycle, serial event sequence, task descriptor, status codes, and
+  Cirru EDN request encoding;
+- invoke the Calcit callback directly only on the task's owner thread instead
+  of enqueueing work that cannot drain while the dylib owns that thread;
+- let modules finish explicitly exactly once, with method return providing the
+  implicit finish when no explicit finish occurred;
+- keep callback result bytes host-owned and indexed by exact pointer/length;
+  modules release them through the task-bound host `free_buffer` function;
+- report foreign-thread access, callback failures, forged/duplicate frees, and
+  leaked host buffers even if the module ignores the returned status;
+- probe the migrated method before allocating runtime task state, preserving
+  the build-ID-guarded per-method Rust ABI fallback for unmigrated modules;
+- make legacy blocking task release exactly once on explicit finish or method
+  return, fixing the previous pending-task leak on error paths.
+
+## Tests
+
+- C-layout host table and versioned method name;
+- inline callback execution and host-owned EDN result;
+- exact buffer metadata and duplicate-free rejection;
+- owner-thread enforcement;
+- explicit finish exactly once and callback rejection after finish.
+
+## Native verification
+
+An optimized standalone C dylib was loaded by the debug Calcit host and
+verified both explicit and implicit finish. Separate methods confirmed that a
+foreign pthread callback, an unfreed callback buffer, and a Calcit callback
+error all fail deterministically and release the pending task.
+
+## Full verification
+
+- `cargo fmt -- --check`
+- `cargo clippy --all-targets -- -D warnings`
+- `cargo test` (864 Rust tests)
+- `yarn compile`
+- `yarn check-agent-interface` (17/17)
+- `yarn check-all` (Calcit core 221/221, JS, IR, WASM and runtime benchmarks)
+- `bash scripts/check-docs-md.sh` (57 files, 325 blocks)

package/editing-history/20260827-2257-release-0.13.52.md

@@ -0,0 +1,17 @@
+# Release 0.13.52
+
+Release the C-safe asynchronous and blocking FFI runtime completed after
+0.13.51.
+
+Highlights:
+
+- bounded C-safe async task/event queue and host-thread callback drain;
+- native callback-v1 with per-method guarded fallback;
+- cancellable Server tasks and exactly-once response capabilities;
+- C-safe blocking callback-v1 with owner-thread dispatch, explicit/implicit
+  finish, and host-owned callback buffer tracking;
+- removal of the remaining supported Rust closure/container boundary for
+  migrated blocking methods.
+
+The release provides the stable host version required for the Phase 6 module
+migration under issue #482.

package/editing-history/202608270956-fs-path-file-effects.md

@@ -0,0 +1,33 @@
+# FsPath file-effect boundary
+
+## Summary
+
+- Removed `.read-file`, `.read-dir`, and `.write-file` from the built-in String method table.
+- Added the nominal, UTF-8-backed `FsPath` type and the explicit `fs:path` constructor.
+- Added `FsPath` methods `.read-text`, `.write-text`, `.read-dir`, `.walk-dir`, and `.to-string` through a nominal trait implementation.
+- Kept `try-read-file`, `try-read-dir`, `try-write-file` and the raw raising primitives as String-path compatibility APIs.
+
+## Design notes
+
+- `path` remains available for generic AST, data, and query path concepts; the filesystem-specific type is named `FsPath`.
+- Calcit uses one immutable path value rather than copying Rust's borrowed `Path` versus owned mutable `PathBuf` split.
+- `fs:path` stores the original UTF-8 text without lexical normalization or filesystem access.
+- `.read-dir` is non-recursive and `.walk-dir` is recursive, avoiding an `Option<Bool>` mode in the new public method API.
+- Text operations are named `.read-text` and `.write-text` so future byte-oriented operations have an unambiguous place.
+
+## Implementation lesson
+
+Keep `defstruct FsPath` directly inside the public `FsPath` definition before `impl-traits`, matching the core `Result` pattern. Hiding the base struct in an intermediate `FsPath0` definition prevents required-field analysis from resolving `:value` through the nominal reference.
+
+For an expression receiver, prefix method syntax such as `.read-text $ fs:path |file` is always explicit. The ergonomic suffix form should use a typed binding such as `source.read-text`; `(fs:path |file) .read-text` is not a general runtime rewrite for arbitrary expression receivers.
+
+## Validation
+
+- `cargo fmt --all`
+- `cargo clippy --all-targets -- -D warnings`
+- `cargo test`
+- `yarn check-all`
+- changed Markdown snippets via `calcit docs check-md`
+- latest Respo main: 27/27 tests, 111/111 documentation blocks, JS codegen
+- latest Recollect main: 9/9 native tests, generated-JS tests, production build, and required WASM checks
+

package/editing-history/202608271407-audit-legacy-macro-schemas.md

@@ -0,0 +1,20 @@
+# Legacy macro schema inventory
+
+## Summary
+
+- Added the stable `W_LEGACY_MACRO_SCHEMA` diagnostic to `analyze check-types`.
+- Preserved whether a compatibility macro came from an old runtime `Fn` schema or a whole `Dynamic` schema.
+- Added check-types JSON schema v2 fields for the aggregate count and per-definition source, legacy signature, Snapshot path, and migration guidance.
+- Kept compatibility loading and execution unchanged; the analyzer does not infer phase-aware contracts.
+
+## Release constraint
+
+Release audits must use `check-types --deps` against resolved module artifacts. A dependency's main branch may already be strict while its published module still exposes legacy macro schemas. Migrate and release providers before setting consumer graphs to a zero-legacy target.
+
+## Validation
+
+- `cargo fmt --all`
+- `cargo clippy --all-targets -- -D warnings`
+- `cargo test`
+- `yarn check-all`
+- latest Respo and Recollect source plus Recollect's resolved published dependency graph

package/editing-history/202608271427-review-legacy-macro-inventory.md

@@ -0,0 +1,19 @@
+# Legacy macro inventory review follow-up
+
+## Summary
+
+- Persisted the `Dynamic` legacy macro origin through canonical Snapshot serialization instead of reclassifying it as `Fn` after reload.
+- Limited legacy macro parameter-shape validation to old `Fn` contracts; a whole-`Dynamic` schema carries no arity contract.
+- Corrected the Agent guide to use the complete `data.summary.legacy_macro_schemas` JSON path.
+
+## Compatibility
+
+Old wrapped macro schemas omit `:legacy-origin` and continue to load as `Fn`. Only whole-`Dynamic` compatibility schemas write `:legacy-origin :dynamic`, so existing `Fn` serialization remains unchanged.
+
+## Validation
+
+- focused origin round-trip and Dynamic-parameter regression tests
+- `cargo fmt --all -- --check`
+- `cargo clippy --all-targets -- -D warnings`
+- `cargo test -- --test-threads=1`
+- `yarn check-all`

package/editing-history/202608271444-release-0.13.51.md

@@ -0,0 +1,6 @@
+# Release 0.13.51
+
+- Added nominal `FsPath` values and explicit filesystem effect methods.
+- Retired top-level `:configs` and the `compact.cirru` filename alias after the 0.13.50 migration window.
+- Added dependency-aware legacy macro schema inventory and schema-v2 `check-types` diagnostics for the staged strict-macro rollout.
+- Kept Cargo and npm package versions synchronized and refreshed the workspace lockfile.

package/editing-history/202608271831-ffi-async-protocol-foundation.md

@@ -0,0 +1,28 @@
+# Async FFI protocol foundation
+
+## Summary
+
+- Defined a versioned, C-safe async task descriptor for one-shot, stream,
+  server, and response handles without changing the existing synchronous FFI.
+- Added a thread-safe generational handle registry with ordered event
+  sequences, explicit close/finish/release transitions, and host shutdown.
+- Retired exhausted generation slots so stale handles cannot become valid
+  again after counter wraparound.
+- Documented the transport-neutral lifecycle intended for timers, watchers,
+  HTTP/WebSocket servers, and a future WASM adapter.
+
+## Compatibility constraint
+
+Native libraries must enqueue events for the Calcit host instead of invoking
+Calcit callbacks from foreign threads. The protocol models stable integer
+handles and byte payloads; a WASM adapter may map them to imports/exports
+without reproducing native pointers or function pointers.
+
+## Validation
+
+- `cargo fmt --check`
+- `cargo clippy -- -D warnings`
+- `cargo test -- --test-threads=1`
+- `yarn compile`
+- `yarn check-agent-interface`
+- `yarn check-all`

package/editing-history/202608271928-ffi-host-event-queue.md

@@ -0,0 +1,29 @@
+# Async FFI host event queue
+
+## Summary
+
+- Added a C-layout event descriptor for repeating emit and terminal
+  complete/fail events.
+- Added a bounded multi-producer queue that only its creating host thread may
+  wait on or drain into the Calcit runtime.
+- Kept sequence reservation atomic with queue admission, made terminal events
+  exactly once, and limited coalescing to explicitly opted-in stream events.
+- Returned callback and lifecycle failures as structured drain diagnostics;
+  callback failure finishes the task and purges its remaining queued events.
+- Retained producer-thread and queue-delay metadata for low-payload FFI traces.
+
+## Compatibility constraint
+
+Existing Rust callback and blocking dylib calls remain unchanged. This queue
+is the scheduling foundation for the next C host-function-table PR; native
+threads and a future WASM polling adapter share descriptors and lifecycle
+semantics without sharing pointers or callback layouts.
+
+## Validation
+
+- `cargo fmt --all`
+- `cargo clippy --all-targets -- -D warnings`
+- `cargo test -- --test-threads=1`
+- `yarn compile`
+- `yarn check-agent-interface`
+- `yarn check-all`

package/editing-history/202608271947-preserve-ffi-drain-report.md

@@ -0,0 +1,15 @@
+# Preserve async FFI drain accounting
+
+## Summary
+
+- Kept malformed event-kind failures inside the structured drain report rather
+  than returning after a batch had already been removed from the queue.
+- Recorded queue-purge failures alongside callback and lifecycle failures.
+- Separated discarded batch events from events purged before drain, preserving
+  the invariant that every dequeued event is delivered or discarded.
+
+## Validation
+
+- `cargo fmt --all`
+- `cargo clippy --all-targets -- -D warnings`
+- `cargo test ffi_async::tests -- --nocapture`

package/editing-history/202608272013-native-ffi-callback-v1.md

@@ -0,0 +1,31 @@
+# Native C-safe callback FFI v1
+
+## Goal
+
+Move `&call-dylib-edn-fn` onto the versioned asynchronous C ABI without
+breaking modules that still expose the guarded Rust callback ABI.
+
+## Changes
+
+- added the versioned native async start symbol and process-lifetime C host
+  function table;
+- copied and validated foreign byte payloads before placing them in the
+  bounded host queue;
+- decoded `Emit` arguments on the CLI host thread, required explicit `&unit`
+  completion, and surfaced structured `Fail` diagnostics;
+- reclaimed handles and tracking state on terminal delivery, callback failure,
+  and start failure;
+- kept per-method fallback to the build-identity-guarded Rust ABI while making
+  an advertised version mismatch a hard error;
+- added ABI, payload, foreign-producer, host-drain, lifecycle, and failure
+  regression coverage;
+- documented symbols, ownership, payload rules, statuses, and rollout.
+
+## Verification
+
+- `cargo fmt --all`
+- `cargo clippy --all-targets -- -D warnings`
+- `cargo test -- --test-threads=1`
+- `yarn compile`
+- `yarn check-agent-interface`
+- `yarn check-all`

package/editing-history/202608272133-ffi-response-server-v1.md

@@ -0,0 +1,45 @@
+# Async FFI response and server protocol v1
+
+## Goal
+
+Extend native callback-v1 with cancellable Server tasks and exactly-once
+response capabilities without exposing generation handles as lossy Calcit
+numbers or allowing foreign threads to enter the runtime.
+
+## Changes
+
+- appended C-safe task configuration and response registration functions to
+  the versioned host table;
+- allowed modules to declare OneShot, Stream, or Server semantics before the
+  first event and install a Server cancellation hook;
+- returned opaque task capabilities from callback-v1 methods that install a
+  cancel hook, preserved `&unit` for non-cancellable methods, and added
+  `&ffi-task-cancel`;
+- issued opaque AnyRef response capabilities, appended them to request callback
+  arguments, and added `&ffi-response-resolve` / `&ffi-response-reject`;
+- enforced response owner, kind, active lifecycle, `REQUIRES_RESPONSE`, timeout,
+  and non-coalescing queue rules;
+- rejected and released unresolved responses on timeout or owner completion,
+  while startup rollback discards handles without entering untransferred module
+  context;
+- added registry configuration/snapshot, response queue invariants,
+  exactly-once/stale reuse, timeout, cross-server, and foreign producer tests;
+- documented the expanded C ABI, Calcit capability API, ownership, timeout,
+  cancellation, backpressure, and WASM representation boundary.
+
+## Runtime verification
+
+A standalone C dylib configured a cancellable Server, opened a response,
+published a request from a pthread, received the Calcit response on the host
+thread, enqueued explicit `&unit` completion, and released with pending task
+count zero. A second idle Server fixture verified `&ffi-task-cancel` and its
+terminal acknowledgement path.
+
+## Verification
+
+- `cargo fmt --all`
+- `cargo clippy --all-targets -- -D warnings`
+- `cargo test -- --test-threads=1`
+- `yarn compile`
+- `yarn check-agent-interface`
+- `yarn check-all`

package/editing-history/202608272158-ffi-response-review-fixes.md

@@ -0,0 +1,33 @@
+# Async FFI response review fixes
+
+## 中文
+
+- 将每个 host table 的 context 绑定到对应 task handle，阻止不同任务或模块意外复用 host context；
+- 在调用 dylib resolver 前原子 claim response，保证并发 resolve/reject 只会进入模块一次，模块返回错误时也会释放 capability；
+- 使用 ordered deadline index、response lookup 与 owner index 代替每轮 drain 和 task 结束时的全 registry clone/scan；
+- 每个任务最多允许 1024 个并发未完成 response，避免只 open 不 enqueue 导致无界增长；
+- response 在队列等待期间过期时只 reject/skip 当前 request，不再把整个长期 Server 标记失败并清空后续事件；
+- 修正文档中的 `REQUIRES_RESPONSE` 术语，并补充 host table 生命周期、并发与超时语义。
+
+## English
+
+- bound each host-table context to its task handle so another task or module cannot accidentally reuse it;
+- atomically claim a response before entering the dylib resolver, ensuring concurrent resolve/reject attempts invoke the module at most once and release the capability even when the module reports an error;
+- replaced full-registry clones/scans during drains and task completion with an ordered deadline index, response lookup, and owner index;
+- capped concurrent outstanding responses at 1024 per task to prevent unbounded open-without-enqueue growth;
+- reject and skip a request that expires in the queue without failing the long-lived Server or purging later events;
+- aligned documentation with `REQUIRES_RESPONSE` terminology and clarified host-table lifetime, concurrency, and timeout semantics.
+
+## Validation
+
+- `cargo fmt --all`;
+- `cargo clippy --all-targets -- -D warnings`;
+- `cargo test -- --test-threads=1` (855 Rust tests passed);
+- `yarn compile`;
+- `yarn check-agent-interface` (17/17);
+- `yarn check-all` (Calcit core 221/221 plus JS, IR, WASM, and benchmark checks);
+- rebuilt the standalone C dylib and verified pthread Server request → Calcit
+  callback → response resolver → explicit `&unit` completion with no runtime
+  errors;
+- verified an idle Server task capability can still be cancelled and reaches
+  explicit `&unit` completion with no runtime errors.

package/lib/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@calcit/procs",
-    "version": "0.13.50",
+    "version": "0.13.52",
     "main": "./lib/calcit.procs.mjs",
     "devDependencies": {
         "@types/node": "^25.7.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calcit/procs",
-  "version": "0.13.50",
+  "version": "0.13.52",
   "main": "./lib/calcit.procs.mjs",
   "devDependencies": {
     "@types/node": "^25.7.0",