@mikrojs/native 0.18.0-pr-306.20260731215718 → 0.18.0

package/include/mikrojs/private.h

@@ -57,6 +57,9 @@ struct MIKRejectedPromise {
     JSValue reason;
 };
 
+/* Observable dispatch queue (defined in mik_observable.cpp). */
+struct MIKObservableDispatch;
+
 struct MIKRuntime {
     MIKRunOptions options;
     MIKConfig config;
@@ -170,6 +173,10 @@ struct MIKRuntime {
      * through the wire protocol. NULL means __testEmit is a no-op. */
     void (*test_emit_fn)(const char* json, size_t len, void* opaque) = nullptr;
     void* test_emit_opaque = nullptr;
+    /* Observable dispatch trampoline state (FIFO + active flag). Allocated by
+     * mik__observable_init, freed via mik__observable_dispatch_free. Empty
+     * outside an active dispatch, so teardown never sees live JSValues. */
+    struct MIKObservableDispatch* observable_dispatch = nullptr;
 };
 
 void mik__pub_fs_register(JSContext* ctx);
@@ -259,6 +266,7 @@ JSModuleDef* mik__udp_init(JSContext* ctx);
 
 /* Observable module (mik_observable.cpp) */
 JSModuleDef* mik__observable_init(JSContext* ctx);
+void mik__observable_dispatch_free(struct MIKRuntime* mik_rt);
 
 bool mik__repl_is_evaluating(void);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikrojs/native",
-  "version": "0.18.0-pr-306.20260731215718",
+  "version": "0.18.0",
   "description": "Mikro.js C++ runtime library and Node.js native addon",
   "keywords": [
     "esp32",
@@ -86,14 +86,14 @@
     "cmake-js": "^8.0.0",
     "node-addon-api": "^8.7.0",
     "node-gyp-build": "^4.8.4",
-    "@mikrojs/quickjs": "0.18.0-pr-306.20260731215718+751f499"
+    "@mikrojs/quickjs": "0.18.0"
   },
   "devDependencies": {
     "@swc/core": "^1.15.30",
     "@types/node": "^24.12.2",
     "esbuild": "^0.28.0",
     "terser": "^5.46.2",
-    "@mikrojs/registry": "0.18.0-pr-306.20260731215718+751f499"
+    "@mikrojs/registry": "0.18.0"
   },
   "engines": {
     "node": ">=24.0.0"

package/runtime/observable/native-observable.node-shim.ts

@@ -5,24 +5,48 @@
 // - subscribe() returns a Subscription with unsubscribe() (no AbortSignal)
 // - no error channel — throws inside dispatch or teardown are caught at the
 //   boundary, isolated to the offending subscriber, and re-thrown
-//   asynchronously via setTimeout(0) so the synchronous producer keeps
-//   running but the bug eventually surfaces (and on device, halts the
-//   runtime via the existing unhandled-rejection path)
+//   asynchronously via setTimeout(0) so the synchronous producer finishes
+//   the dispatch; on device the deferred throw then panics
 // - sync emission allowed
 // - pipe-only composition (operators live in operators.ts)
 // - withEmitters() factory: {observable, next, complete}
 
-/* Catch a thrown error and re-throw it on the next tick. The synchronous
- * caller keeps going (other subscribers receive the value, remaining
- * teardowns run); the error eventually surfaces as an uncaught exception. */
-function panicAsync(err: unknown): void {
+/* A throw in a subscriber, operator, or teardown callback is an application
+ * crash. On device it stops the runtime per onPanic, so nothing further is
+ * delivered. There is no runtime to stop here, so the host sees an uncaught
+ * error on the next tick and `panicked` suppresses further delivery, which is
+ * the part a unit test can observe. It clears on the next fresh subscribe, so
+ * one test's crash cannot poison the next; on device the runtime is gone. */
+let panicked = false
+
+function panic(err: unknown): void {
+  panicked = true
   setTimeout(() => {
     throw err
   }, 0)
 }
 
+/* Dispatch trampoline, mirroring mik_observable.cpp: next/complete called
+ * while a dispatch is active enqueue instead of recursing; the outermost
+ * dispatch drains in FIFO order. Handler code after sub.next() therefore
+ * runs before downstream delivery. */
+type QueueEntry = {sub: Subscriber<unknown>; value: unknown; isComplete: boolean}
+const queue: QueueEntry[] = []
+let queueHead = 0
+let dispatchActive = false
+
+function drainQueue(): void {
+  while (queueHead < queue.length) {
+    const e = queue[queueHead++]!
+    if (!panicked) e.sub.deliverQueued(e)
+  }
+  queue.length = 0
+  queueHead = 0
+}
+
 class Subscriber<T> {
-  closed = false
+  private _closed = false
+  private completePending = false
   private next_fn: ((v: T) => void) | undefined
   private complete_fn: (() => void) | undefined
   private teardowns: Array<() => void> = []
@@ -40,25 +64,61 @@ class Subscriber<T> {
     }
   }
 
+  get closed(): boolean {
+    return this._closed || this.completePending
+  }
+
   next(value: T): void {
-    if (this.closed) return
+    if (this.closed || panicked) return
+    if (dispatchActive) {
+      queue.push({sub: this as Subscriber<unknown>, value, isComplete: false})
+      return
+    }
+    dispatchActive = true
+    this.deliverNext(value)
+    drainQueue()
+    dispatchActive = false
+  }
+
+  complete(): void {
+    if (this.closed || panicked) return
+    if (dispatchActive) {
+      this.completePending = true
+      queue.push({sub: this as Subscriber<unknown>, value: undefined, isComplete: true})
+      return
+    }
+    dispatchActive = true
+    this.deliverComplete()
+    drainQueue()
+    dispatchActive = false
+  }
+
+  /* Deliver a queued entry; entries whose subscriber closed (unsubscribed)
+   * between enqueue and drain are dropped. */
+  deliverQueued(e: QueueEntry): void {
+    if (this._closed) return
+    if (e.isComplete) this.deliverComplete()
+    else this.deliverNext(e.value as T)
+  }
+
+  private deliverNext(value: T): void {
     if (this.next_fn) {
       try {
         this.next_fn(value)
       } catch (err) {
-        panicAsync(err)
+        panic(err)
       }
     }
   }
 
-  complete(): void {
-    if (this.closed) return
-    this.closed = true
+  private deliverComplete(): void {
+    this.completePending = false
+    this._closed = true
     if (this.complete_fn) {
       try {
         this.complete_fn()
       } catch (err) {
-        panicAsync(err)
+        panic(err)
       }
     }
     this.runTeardowns()
@@ -68,11 +128,11 @@ class Subscriber<T> {
     if (typeof fn !== 'function') {
       throw new TypeError('addTeardown: argument must be a function')
     }
-    if (this.closed) {
+    if (this._closed) {
       try {
         fn()
       } catch (err) {
-        panicAsync(err)
+        panic(err)
       }
       return
     }
@@ -80,9 +140,10 @@ class Subscriber<T> {
   }
 
   // Used by Subscription.unsubscribe — silent (no observer.complete call).
+  // A pending complete owns the close; its queued entry still delivers.
   closeSilently(): void {
     if (this.closed) return
-    this.closed = true
+    this._closed = true
     this.runTeardowns()
   }
 
@@ -93,7 +154,7 @@ class Subscriber<T> {
       try {
         list[i]!()
       } catch (err) {
-        panicAsync(err)
+        panic(err)
       }
     }
   }
@@ -122,6 +183,7 @@ export class Observable<Ok, Err = never> {
   }
 
   subscribe(observer?: unknown): Subscription {
+    if (!dispatchActive) panicked = false
     const sub = new Subscriber<unknown>(observer)
     try {
       this.#cb(sub)
@@ -167,7 +229,7 @@ export class Observable<Ok, Err = never> {
     ) {
       return new Observable<unknown>((sub) => {
         for (const value of src as Iterable<unknown>) {
-          if (sub.closed) return
+          if (sub.closed || panicked) return
           sub.next(value)
         }
         if (!sub.closed) sub.complete()
@@ -201,6 +263,7 @@ export class Observable<Ok, Err = never> {
       // Snapshot to be resilient against mid-dispatch unsubscribes.
       const snapshot = subs.slice()
       for (const s of snapshot) {
+        if (panicked) break
         if (!s.closed) s.next(value)
       }
     }
@@ -211,6 +274,7 @@ export class Observable<Ok, Err = never> {
       const snapshot = subs.slice()
       subs.length = 0
       for (const s of snapshot) {
+        if (panicked) break
         if (!s.closed) s.complete()
       }
     }

package/runtime/observable/operators.ts

@@ -7,12 +7,9 @@
  * Result-aware operators (`mapOk`, `filterOk`, ...) ship when a concrete
  * consumer asks. Today no module produces fallible event streams.
  *
- * Errors: throws inside operator transforms or finalize callbacks are caught
- * at the dispatch boundary, isolated to that subscriber, and re-thrown
- * asynchronously via setTimeout(0). The synchronous producer keeps going
- * (the bad value is dropped, sibling subscribers untouched), and on device
- * the eventual uncaught throw halts the runtime via the existing
- * unhandled-rejection path. Stream errors are panics.
+ * Errors: a throw inside a transform or a finalize callback propagates to the
+ * dispatch boundary, which reports it and panics. Operators do not catch:
+ * an application crash is an application crash.
  *
  * See `.claude/plans/observable.md` for the full design.
  */
@@ -28,69 +25,42 @@ import type {Observable as ObservableT} from './types.js'
 const Observable = NativeObservable as unknown as typeof ObservableT
 type Observable<Ok, Err = never> = ObservableT<Ok, Err>
 
-/* Catch a thrown error and re-throw it on the next tick. The synchronous
- * caller keeps going; the error eventually surfaces as an uncaught
- * exception. */
-function panicAsync(err: unknown): void {
-  setTimeout(() => {
-    throw err
-  }, 0)
-}
-
-/* Map values through a transform. Throws inside `fn` are caught and
- * scheduled to re-throw on the next tick (panic). The bad value is dropped
- * for that subscription; sibling subscriptions are unaffected. */
+/* Map values through a transform. A throw inside `fn` panics. */
 export const map =
   <A, B>(fn: (value: A) => B) =>
   (source: Observable<A>): Observable<B> =>
     new Observable<B>((sub) => {
       const upstream = source.subscribe({
-        next: (value) => {
-          let next: B
-          try {
-            next = fn(value)
-          } catch (err) {
-            panicAsync(err)
-            return
-          }
-          sub.next(next)
-        },
+        next: (value) => sub.next(fn(value)),
         complete: () => sub.complete(),
       })
       sub.addTeardown(() => upstream.unsubscribe())
     })
 
-/* Pass through values matching `pred`. `pred` errors panic asynchronously. */
+/* Pass through values matching `predicate`. A throw inside it panics. */
 export const filter =
-  <A>(pred: (value: A) => boolean) =>
+  <A>(predicate: (value: A) => boolean) =>
   (source: Observable<A>): Observable<A> =>
     new Observable<A>((sub) => {
       const upstream = source.subscribe({
         next: (value) => {
-          let keep: boolean
-          try {
-            keep = pred(value)
-          } catch (err) {
-            panicAsync(err)
-            return
-          }
-          if (keep) sub.next(value)
+          if (predicate(value)) sub.next(value)
         },
         complete: () => sub.complete(),
       })
       sub.addTeardown(() => upstream.unsubscribe())
     })
 
-/* Take at most n values, then complete. n <= 0 completes immediately. */
+/* Take at most `count` values, then complete. count <= 0 completes immediately. */
 export const take =
-  (n: number) =>
+  (count: number) =>
   <A>(source: Observable<A>): Observable<A> =>
     new Observable<A>((sub) => {
-      if (n <= 0) {
+      if (count <= 0) {
         sub.complete()
         return
       }
-      let remaining = n
+      let remaining = count
       const upstream = source.subscribe({
         next: (value) => {
           if (remaining <= 0) return
@@ -123,8 +93,8 @@ export const takeUntil =
     })
 
 /* Run `fn` when the subscription ends for any reason (unsubscribe or
- * natural completion). Throws inside `fn` are caught and panic
- * asynchronously, so subsequent teardowns still run. RxJS naming. */
+ * natural completion). A throw inside `fn` panics; the remaining teardowns
+ * still run. RxJS naming. */
 export const finalize =
   (fn: () => void) =>
   <A>(source: Observable<A>): Observable<A> =>
@@ -135,10 +105,6 @@ export const finalize =
       })
       sub.addTeardown(() => {
         upstream.unsubscribe()
-        try {
-          fn()
-        } catch (err) {
-          panicAsync(err)
-        }
+        fn()
       })
     })

package/src/mik_observable.cpp

@@ -1,4 +1,4 @@
-/* mik_observable.cpp — push-shaped composable event stream primitive.
+/* mik_observable.cpp — push-based composable event stream primitive.
  *
  * See .claude/plans/observable.md (worktree branch) for the locked design.
  *
@@ -9,17 +9,44 @@
  *                 addTeardown, closed
  *   - Subscription: unsubscribe
  *
- * Error semantics: throws inside observer or operator callbacks (and inside
- * teardown callbacks) are caught at the dispatch boundary, isolated to the
- * offending subscriber, and re-thrown asynchronously via setTimeout(0). The
- * synchronous producer keeps running (sibling subscribers receive the value,
- * remaining teardowns run); the bug eventually surfaces as an uncaught
- * exception, which the runtime treats as fatal via the existing
- * unhandled-rejection halt mechanism. Stream errors are panics.
+ * Error semantics: a throw inside an observer, operator, or teardown callback
+ * is caught at the dispatch boundary only to report it and apply the app's
+ * onPanic policy; it is an application crash like any other uncaught error.
+ * Nothing further is delivered: queued entries are dropped, the multicast
+ * fan-out stops, from(iterable) stops pulling, and later next/complete calls
+ * from the producer's own callback (which JS cannot interrupt mid-function)
+ * are no-ops. Teardowns are the exception, since they release resources for
+ * work that is already ending; the rest of the chain still runs.
  *
  * Producer-setup throws inside the subscribe callback bubble synchronously
  * to the .subscribe() caller — that's a bug in the producer factory itself,
- * not a runtime dispatch event.
+ * not a runtime dispatch event. Teardowns registered before the throw still
+ * run: no Subscription reaches the caller, so nothing else could ever
+ * release what the producer already acquired.
+ *
+ * Dispatch trampoline: next/complete invoked while a dispatch is already
+ * active (i.e. from inside a handler) enqueue onto a per-runtime FIFO
+ * instead of recursing; the outermost dispatch drains the queue before
+ * returning. Chain length and re-entrant emission therefore cost O(1)
+ * stack per delivery — on-device JS stacks are small and quickjs-ng 0.16
+ * frames are large enough that a 3-operator chain used to exhaust a 16 KB
+ * limit. Two consequences:
+ *   - Handler code after a sub.next()/sub.complete() call runs before the
+ *     downstream handler sees that event (FIFO order is preserved).
+ *   - complete() closes the subscriber at the call site (complete_pending),
+ *     so closed/no-op semantics stay synchronous while the complete_fn +
+ *     teardowns run when the queued entry drains.
+ * Delivery is what became O(1) stack, not subscription setup or teardown:
+ * subscribe() recurses once per chain layer (user JS calling subscribe), and
+ * unsubscribe -> run_teardowns -> upstream.unsubscribe() mirrors it on the
+ * way out. Both are paid once per subscription rather than once per value,
+ * so neither reintroduces a per-value ceiling.
+ * Trade-off: what used to be bounded stack growth is now unbounded heap
+ * growth. A synchronous producer emitting N values from inside a dispatch
+ * buffers N entries (plus the retained values) instead of recursing N deep.
+ * That turns a catchable stack overflow into heap pressure, which on device
+ * ends in an OOM panic. Left uncapped deliberately: no shipped producer
+ * emits unbounded bursts from inside a handler.
  */
 
 #include <cstddef>
@@ -33,6 +60,20 @@ extern "C" {
 #include "quickjs.h"
 }
 
+/* Per-runtime dispatch queue. Entries hold their own references (dup on
+ * enqueue, freed after the drained delivery). The queue is only non-empty
+ * while a dispatch is on the stack, so runtime teardown never sees values. */
+struct MIKObservableDispatch {
+    struct Entry {
+        JSValue subscriber;
+        JSValue value; /* JS_UNDEFINED for complete entries */
+        bool is_complete;
+    };
+    bool active = false;
+    size_t head = 0;
+    std::vector<Entry> queue;
+};
+
 namespace {
 
 JSClassID observable_class_id;
@@ -46,6 +87,10 @@ struct ObservableData {
 struct SubscriberData {
     JSContext* ctx;
     bool closed;
+    /* complete() was called while queued dispatch was active: the subscriber
+     * is closed to producers, but complete_fn + teardowns run when the queued
+     * complete entry drains. */
+    bool complete_pending;
     /* observer object retained so its props can't be reclaimed mid-dispatch. */
     JSValue observer;
     JSValue next_fn;
@@ -61,24 +106,13 @@ struct SubscriptionData {
 
 /* ── Helpers ─────────────────────────────────────────────────────── */
 
-/* Re-throws the captured exception from func_data[0]. Used as the
- * `setTimeout(callback, 0)` payload in panic_async. */
-static JSValue throw_captured(JSContext* ctx, JSValueConst this_val, int argc,
-                              JSValueConst* argv, int magic, JSValue* func_data) {
-    (void)this_val;
-    (void)argc;
-    (void)argv;
-    (void)magic;
-    return JS_Throw(ctx, JS_DupValue(ctx, func_data[0]));
-}
-
-/* Escalation for a panic that cannot be scheduled: report through the
- * allocation-free native uncaught path and halt, mirroring the
- * unhandled-rejection flush. Scheduling fails exactly when the runtime is
- * out of stack or memory — the same conditions that caused the throw — and
- * silence here turned engine-level failures into silently dropped values.
- * Consumes `exception`. */
-static void panic_now(JSContext* ctx, JSValue exception) {
+/* An uncaught throw from a subscriber, operator, or teardown callback is an
+ * application crash like any other: report it, notify the host error handler,
+ * and apply the app's onPanic policy. Reporting happens here rather than
+ * through a deferred re-throw because MIK_Loop stops pumping timers once the
+ * panic is armed, so a deferred report would never run. Consumes
+ * `exception`. */
+static void panic(JSContext* ctx, JSValue exception) {
     MIKRuntime* mik_rt = MIK_GetRuntime(ctx);
     if (mik__report_uncaught(ctx, exception, false) && mik_rt) {
         if (mik_rt->error_handler_fn) {
@@ -89,57 +123,12 @@ static void panic_now(JSContext* ctx, JSValue exception) {
     JS_FreeValue(ctx, exception);
 }
 
-/* Catch a thrown error and re-throw it on the next event-loop tick via the
- * runtime's setTimeout. The synchronous caller keeps going (sibling
- * subscribers receive the value, remaining teardowns run); the eventual
- * uncaught throw halts the runtime via the existing unhandled-rejection
- * path. Stream errors are panics. If the deferred throw cannot be
- * scheduled, escalate via panic_now instead of going silent.
- *
- * Takes ownership of `exception` — caller must not free after this call. */
-static void panic_async(JSContext* ctx, JSValue exception) {
-    JSValue global = JS_GetGlobalObject(ctx);
-    JSValue setTimeout = JS_GetPropertyStr(ctx, global, "setTimeout");
-    JS_FreeValue(ctx, global);
-    if (!JS_IsFunction(ctx, setTimeout)) {
-        JS_FreeValue(ctx, setTimeout);
-        panic_now(ctx, exception);
-        return;
-    }
-    JSValueConst data[1] = {exception};
-    JSValue thrower = JS_NewCFunctionData(ctx, throw_captured, 0, 0, 1, data);
-    if (JS_IsException(thrower)) {
-        JSValue stray = JS_GetException(ctx);
-        JS_FreeValue(ctx, stray);
-        JS_FreeValue(ctx, setTimeout);
-        panic_now(ctx, exception);
-        return;
-    }
-    JSValue zero = JS_NewInt32(ctx, 0);
-    JSValueConst call_args[2] = {thrower, zero};
-    JSValue ret = JS_Call(ctx, setTimeout, JS_UNDEFINED, 2, call_args);
-    JS_FreeValue(ctx, setTimeout);
-    JS_FreeValue(ctx, thrower);
-    JS_FreeValue(ctx, zero);
-    if (JS_IsException(ret)) {
-        /* setTimeout itself threw — under stack exhaustion it fails the
-         * same check the dispatch just failed. Escalate. */
-        JSValue stray = JS_GetException(ctx);
-        JS_FreeValue(ctx, stray);
-        panic_now(ctx, exception);
-        return;
-    }
-    JS_FreeValue(ctx, ret);
-    JS_FreeValue(ctx, exception);
-}
-
-/* Call `fn(argv...)` synchronously; if it throws, schedule the exception
- * to re-throw on the next tick. Caller is not informed of the throw. */
+/* Call `fn(argv...)` synchronously; a throw panics. Caller is not informed. */
 static void run_safely(JSContext* ctx, JSValue fn, int argc, JSValue* argv) {
     JSValue ret = JS_Call(ctx, fn, JS_UNDEFINED, argc, argv);
     if (JS_IsException(ret)) {
         JSValue exc = JS_GetException(ctx);
-        panic_async(ctx, exc);
+        panic(ctx, exc);
     } else {
         JS_FreeValue(ctx, ret);
     }
@@ -153,15 +142,15 @@ static void invoke_safely(JSContext* ctx, JSValueConst this_val, JSAtom method,
     JSValue ret = JS_Invoke(ctx, this_val, method, argc, argv);
     if (JS_IsException(ret)) {
         JSValue exc = JS_GetException(ctx);
-        panic_async(ctx, exc);
+        panic(ctx, exc);
     } else {
         JS_FreeValue(ctx, ret);
     }
 }
 
-/* Run all registered teardowns in reverse insertion order. Throws are
- * scheduled to re-throw async via panic_async, so subsequent teardowns
- * still run synchronously. */
+/* Run all registered teardowns in reverse insertion order. A throw panics,
+ * but the remaining teardowns still run: they release resources for work
+ * that is already ending. */
 static void run_teardowns(JSContext* ctx, SubscriberData* d) {
     /* Swap into a local list. If a teardown calls addTeardown synchronously,
      * the SubscriberData.closed flag is already true so addTeardown fires the
@@ -174,6 +163,66 @@ static void run_teardowns(JSContext* ctx, SubscriberData* d) {
     }
 }
 
+/* ── Dispatch trampoline ────────────────────────────────────────── */
+
+static MIKObservableDispatch* dispatch_state(JSContext* ctx) {
+    MIKRuntime* mik_rt = MIK_GetRuntime(ctx);
+    return mik_rt ? mik_rt->observable_dispatch : nullptr;
+}
+
+/* True once a panic is armed. The producer's own callback keeps running (JS
+ * cannot be stopped mid-function), so its later next/complete calls have to
+ * become no-ops rather than delivering against crashed state. */
+static bool dispatch_stopped(JSContext* ctx) {
+    MIKRuntime* mik_rt = MIK_GetRuntime(ctx);
+    return mik_rt && MIK_IsStopRequested(mik_rt);
+}
+
+/* Deliver a value to the subscriber's next handler. `value` is borrowed. */
+static void deliver_next(JSContext* ctx, SubscriberData* d, JSValue value) {
+    if (!JS_IsUndefined(d->next_fn)) {
+        run_safely(ctx, d->next_fn, 1, &value);
+    }
+}
+
+static void deliver_complete(JSContext* ctx, SubscriberData* d) {
+    d->complete_pending = false;
+    d->closed = true;
+    if (!JS_IsUndefined(d->complete_fn)) {
+        run_safely(ctx, d->complete_fn, 0, nullptr);
+    }
+    run_teardowns(ctx, d);
+}
+
+/* Drain queued deliveries in FIFO order. Deliveries may enqueue more; the
+ * loop keeps going until the queue is empty. Entries whose subscriber closed
+ * (unsubscribed) between enqueue and drain are dropped. */
+static void drain(JSContext* ctx, MIKObservableDispatch* ds) {
+    MIKRuntime* mik_rt = MIK_GetRuntime(ctx);
+    while (ds->head < ds->queue.size()) {
+        MIKObservableDispatch::Entry e = ds->queue[ds->head++];
+        auto* d = static_cast<SubscriberData*>(JS_GetOpaque(e.subscriber, subscriber_class_id));
+        /* A panicked handler means the state these deliveries were queued
+         * against may be broken; free the rest without delivering. */
+        bool stopped = mik_rt && MIK_IsStopRequested(mik_rt);
+        if (d && !d->closed && !stopped) {
+            if (e.is_complete) {
+                deliver_complete(ctx, d);
+            } else {
+                deliver_next(ctx, d, e.value);
+            }
+        }
+        JS_FreeValue(ctx, e.subscriber);
+        JS_FreeValue(ctx, e.value);
+    }
+    ds->queue.clear();
+    ds->head = 0;
+    /* Don't let a one-off burst pin its capacity for the runtime lifetime. */
+    if (ds->queue.capacity() > 32) {
+        std::vector<MIKObservableDispatch::Entry>().swap(ds->queue);
+    }
+}
+
 /* ── Subscriber ─────────────────────────────────────────────────── */
 
 static void subscriber_finalizer(JSRuntime* rt, JSValue val) {
@@ -206,11 +255,22 @@ static JSClassDef subscriber_class_def = {
 static JSValue subscriber_next(JSContext* ctx, JSValueConst this_val, int argc, JSValueConst* argv) {
     auto* d = static_cast<SubscriberData*>(JS_GetOpaque2(ctx, this_val, subscriber_class_id));
     if (!d) return JS_EXCEPTION;
-    if (d->closed) return JS_UNDEFINED;
-    if (!JS_IsUndefined(d->next_fn)) {
-        JSValue arg = argc > 0 ? argv[0] : JS_UNDEFINED;
-        run_safely(ctx, d->next_fn, 1, &arg);
+    if (d->closed || d->complete_pending) return JS_UNDEFINED;
+    if (dispatch_stopped(ctx)) return JS_UNDEFINED;
+    JSValue arg = argc > 0 ? argv[0] : JS_UNDEFINED;
+    MIKObservableDispatch* ds = dispatch_state(ctx);
+    if (!ds) {
+        deliver_next(ctx, d, arg);
+        return JS_UNDEFINED;
+    }
+    if (ds->active) {
+        ds->queue.push_back({JS_DupValue(ctx, this_val), JS_DupValue(ctx, arg), false});
+        return JS_UNDEFINED;
     }
+    ds->active = true;
+    deliver_next(ctx, d, arg);
+    drain(ctx, ds);
+    ds->active = false;
     return JS_UNDEFINED;
 }
 
@@ -220,12 +280,22 @@ static JSValue subscriber_complete(JSContext* ctx, JSValueConst this_val, int ar
     (void)argv;
     auto* d = static_cast<SubscriberData*>(JS_GetOpaque2(ctx, this_val, subscriber_class_id));
     if (!d) return JS_EXCEPTION;
-    if (d->closed) return JS_UNDEFINED;
-    d->closed = true;
-    if (!JS_IsUndefined(d->complete_fn)) {
-        run_safely(ctx, d->complete_fn, 0, nullptr);
+    if (d->closed || d->complete_pending) return JS_UNDEFINED;
+    if (dispatch_stopped(ctx)) return JS_UNDEFINED;
+    MIKObservableDispatch* ds = dispatch_state(ctx);
+    if (!ds) {
+        deliver_complete(ctx, d);
+        return JS_UNDEFINED;
     }
-    run_teardowns(ctx, d);
+    if (ds->active) {
+        d->complete_pending = true;
+        ds->queue.push_back({JS_DupValue(ctx, this_val), JS_UNDEFINED, true});
+        return JS_UNDEFINED;
+    }
+    ds->active = true;
+    deliver_complete(ctx, d);
+    drain(ctx, ds);
+    ds->active = false;
     return JS_UNDEFINED;
 }
 
@@ -248,7 +318,7 @@ static JSValue subscriber_add_teardown(JSContext* ctx, JSValueConst this_val, in
 static JSValue subscriber_get_closed(JSContext* ctx, JSValueConst this_val) {
     auto* d = static_cast<SubscriberData*>(JS_GetOpaque2(ctx, this_val, subscriber_class_id));
     if (!d) return JS_EXCEPTION;
-    return JS_NewBool(ctx, d->closed);
+    return JS_NewBool(ctx, d->closed || d->complete_pending);
 }
 
 static const JSCFunctionListEntry subscriber_proto_funcs[] = {
@@ -290,7 +360,10 @@ static JSValue subscription_unsubscribe(JSContext* ctx, JSValueConst this_val, i
     if (!sd) return JS_EXCEPTION;
     auto* sub = static_cast<SubscriberData*>(JS_GetOpaque(sd->subscriber_value,
                                                           subscriber_class_id));
-    if (!sub || sub->closed) return JS_UNDEFINED;
+    /* A pending complete owns the close: its queued entry delivers
+     * complete_fn + teardowns, matching the recursive-dispatch order where
+     * the complete had already run before unsubscribe could. */
+    if (!sub || sub->closed || sub->complete_pending) return JS_UNDEFINED;
     sub->closed = true;
     /* unsubscribe() is silent — does NOT call observer.complete().
      * Only natural producer-driven completion fires observer.complete(). */
@@ -380,6 +453,7 @@ static JSValue subscribe_with_callback(JSContext* ctx, JSValueConst subscribe_cb
     auto* d = new SubscriberData{
         ctx,
         false,
+        false,
         observer_dup,
         next_fn,
         complete_fn,
@@ -393,9 +467,20 @@ static JSValue subscribe_with_callback(JSContext* ctx, JSValueConst subscribe_cb
      * unsubscribe handles it. */
     JSValue cb_result = JS_Call(ctx, subscribe_cb, JS_UNDEFINED, 1, &subscriber_val);
     if (JS_IsException(cb_result)) {
-        /* Producer setup threw — bubble up. Mark closed so any deferred
-         * dispatch back to this subscriber is silently dropped. */
-        d->closed = true;
+        /* Producer setup threw — bubble up, but release whatever it already
+         * acquired first. No Subscription reaches the caller, so a teardown
+         * skipped here can never run: the handle it would close is
+         * unreachable for the rest of the runtime's life. Park the pending
+         * exception while the teardowns run, since they are JS calls and
+         * must not inherit it, then restore it for the caller.
+         * A queued completion is different: that entry owns the close and
+         * runs the teardowns when it drains. */
+        if (!d->complete_pending) {
+            d->closed = true;
+            JSValue pending = JS_GetException(ctx);
+            run_teardowns(ctx, d);
+            JS_Throw(ctx, pending);
+        }
         JS_FreeValue(ctx, subscriber_val);
         return cb_result;
     }
@@ -562,6 +647,8 @@ static JSValue from_iterable_subscribe(JSContext* ctx, JSValueConst this_val, in
         auto* sd = static_cast<SubscriberData*>(
             JS_GetOpaque(subscriber, subscriber_class_id));
         if (!sd || sd->closed) break;
+        MIKRuntime* mik_rt = MIK_GetRuntime(ctx);
+        if (mik_rt && MIK_IsStopRequested(mik_rt)) break;
 
         JSValue value = iterator_next(ctx, iterator, &done);
         if (JS_IsException(value)) {
@@ -831,9 +918,10 @@ static JSValue multicast_emit_next(JSContext* ctx, JSValueConst this_val, int ar
 
     JSValue value = argc > 0 ? argv[0] : JS_UNDEFINED;
     JSAtom next_atom = JS_NewAtom(ctx, "next");
+    MIKRuntime* mik_rt = MIK_GetRuntime(ctx);
     for (auto& s : snapshot) {
         auto* sd = static_cast<SubscriberData*>(JS_GetOpaque(s, subscriber_class_id));
-        if (!sd || sd->closed) {
+        if (!sd || sd->closed || (mik_rt && MIK_IsStopRequested(mik_rt))) {
             JS_FreeValue(ctx, s);
             continue;
         }
@@ -861,9 +949,10 @@ static JSValue multicast_emit_complete(JSContext* ctx, JSValueConst this_val, in
     snapshot.swap(m->subscribers);
 
     JSAtom complete_atom = JS_NewAtom(ctx, "complete");
+    MIKRuntime* mik_rt = MIK_GetRuntime(ctx);
     for (auto& s : snapshot) {
         auto* sd = static_cast<SubscriberData*>(JS_GetOpaque(s, subscriber_class_id));
-        if (sd && !sd->closed) {
+        if (sd && !sd->closed && !(mik_rt && MIK_IsStopRequested(mik_rt))) {
             invoke_safely(ctx, s, complete_atom, 0, nullptr);
         }
         JS_FreeValue(ctx, s);
@@ -948,9 +1037,19 @@ static int observable_module_init(JSContext* ctx, JSModuleDef* m) {
 
 }  // namespace
 
+void mik__observable_dispatch_free(MIKRuntime* mik_rt) {
+    delete mik_rt->observable_dispatch;
+    mik_rt->observable_dispatch = nullptr;
+}
+
 JSModuleDef* mik__observable_init(JSContext* ctx) {
     JSRuntime* rt = JS_GetRuntime(ctx);
 
+    MIKRuntime* mik_rt = MIK_GetRuntime(ctx);
+    if (mik_rt && !mik_rt->observable_dispatch) {
+        mik_rt->observable_dispatch = new MIKObservableDispatch();
+    }
+
     /* Class IDs are runtime-scoped; safe to register once per runtime. */
     JS_NewClassID(rt, &observable_class_id);
     JS_NewClass(rt, observable_class_id, &observable_class_def);

package/src/mikrojs.cpp

@@ -416,6 +416,8 @@ void MIK_FreeRuntime(MIKRuntime* mik_rt) {
     delete mik_rt->timers;
     mik_rt->timers = nullptr;
 
+    mik__observable_dispatch_free(mik_rt);
+
     /* Destroy the JS engine. */
     JS_FreeValue(mik_rt->ctx, mik_rt->env_obj);
     mik_rt->env_obj = JS_UNDEFINED;
@@ -599,6 +601,8 @@ void mik__execute_jobs(JSContext* ctx) {
                     JS_Throw(ctx1, exc);
                 }
                 mik_dump_error(ctx1);
+                /* Same rule as every other uncaught throw: panic. */
+                if (mik_rt) MIK_Stop(mik_rt);
             }
             break;
         }
@@ -662,6 +666,7 @@ int MIK_Loop(MIKRuntime* mik_rt) {
             JS_Throw(mik_rt->ctx, exc);
         }
         mik_dump_error(mik_rt->ctx);
+        MIK_Stop(mik_rt);
         return 1;
     }
     mik__stdin_consume(mik_rt->ctx);
@@ -787,17 +792,12 @@ bool MIK_IsStopRequested(MIKRuntime* mik_rt) {
 
 void MIK_Stop(MIKRuntime* mik_rt) {
     CHECK_NOT_NULL(mik_rt);
-    /* A throw inside an interactive REPL eval is a user typo, not an app
-     * crash; the eval path already reports it. Don't request a stop or
-     * reboot. (Evaluating implies the REPL is active, so this is checked
-     * before the IsReplActive guard below.) */
-    if (mik__repl_is_evaluating()) {
-        return;
-    }
-    /* Signal the loop to halt. This is the single place stop_requested is
-     * set, so the repl-eval gate above can't be bypassed by a caller. Host
-     * embedders (Node addon) observe it via MIK_Loop's return value; the
-     * firmware test supervisor reads it via MIK_IsStopRequested. */
+    /* REPL-evaluated code gets no exemption: a typo throws synchronously and
+     * the eval path reports it without reaching here, so only async fallout
+     * from typed code panics. */
+    /* The single place stop_requested is set. Host embedders (Node addon)
+     * observe it via MIK_Loop's return value; the firmware test supervisor
+     * reads it via MIK_IsStopRequested. */
     mik_rt->stop_requested = true;
     /* Only firmware (protocol REPL attached) auto-restarts on uncaught
      * exceptions. Host embedders (Node addon, standalone tests) own their

package/src/timers.cpp

@@ -165,7 +165,17 @@ void mik__timers_consume(JSContext* ctx) {
     if (due_count == 0)
         return;
 
+    // Timers that ran (or were skipped) this pass; the one-shot cleanup below
+    // must not unschedule the ones a panic stopped us from reaching.
+    size_t handled = due_count;
+
     for (size_t i = 0; i < due_count; i++) {
+        // A panic in an earlier callback means the state these were scheduled
+        // against may be broken. Leave the rest for the restart.
+        if (MIK_IsStopRequested(mik_rt)) {
+            handled = i;
+            break;
+        }
         // Re-find the entry — a previous callback may have cleared it
         auto it = std::find_if(timers->entries.begin(), timers->entries.end(),
                                [&](const MIKTimerEntry& e) { return e.id == due_ids[i]; });
@@ -189,6 +199,9 @@ void mik__timers_consume(JSContext* ctx) {
                 JS_Throw(mik_rt->ctx, exc);
             }
             mik_dump_error(mik_rt->ctx);
+            /* Applies the app's onPanic policy; the loop above stops before
+             * the next due timer. */
+            MIK_Stop(mik_rt);
         }
         JS_FreeValue(mik_rt->ctx, ret);
         JS_FreeValue(mik_rt->ctx, func);
@@ -198,7 +211,7 @@ void mik__timers_consume(JSContext* ctx) {
     }
 
     // Remove one-shot timers that are still alive (not already cleared by a callback)
-    for (size_t i = 0; i < due_count; i++) {
+    for (size_t i = 0; i < handled; i++) {
         auto it = std::find_if(timers->entries.begin(), timers->entries.end(),
                                [&](const MIKTimerEntry& e) { return e.id == due_ids[i]; });
         if (it != timers->entries.end() && !it->is_interval) {