tywrap 0.8.0 → 0.9.0

package/dist/runtime/subprocess-transport.js

@@ -17,7 +17,6 @@ import { DisposableBase } from './bounded-context.js';
 import { BridgeDisposedError, BridgeProtocolError, BridgeTimeoutError } from './errors.js';
 import { Reassembler, encodeFrames, utf8ByteLength } from './frame-codec.js';
 import { TimedOutRequestTracker } from './timed-out-request-tracker.js';
-import { FRAME_PROTOCOL_ID, PROTOCOL_ID, } from './transport.js';
 // =============================================================================
 // CONSTANTS
 // =============================================================================
@@ -47,14 +46,6 @@ const FRAME_ENVELOPE_HEADROOM = 1024;
  * ceiling sound without over-allocating buffer headroom.
  */
 const FRAME_DATA_ESCAPE_FACTOR = 2;
-/** Negotiation env var: `1` enables `tywrap-frame/1` chunked transport. */
-const ENV_CHUNKING = 'TYWRAP_TRANSPORT_CHUNKING';
-/** Negotiation env var: the framing protocol id the bridge must implement. */
-const ENV_FRAME_PROTOCOL = 'TYWRAP_TRANSPORT_FRAME_PROTOCOL';
-/** Negotiation env var: per-frame UTF-8 byte ceiling for the data slice. */
-const ENV_MAX_FRAME_BYTES = 'TYWRAP_TRANSPORT_MAX_FRAME_BYTES';
-/** Timeout (ms) for the in-init meta negotiation probe. */
-const NEGOTIATION_PROBE_TIMEOUT_MS = 30_000;
 /**
  * Default cap (UTF-8 bytes) on a single chunked response reassembled in memory.
  * Mirrors the codec's `DEFAULT_MAX_PAYLOAD_BYTES` (10 MiB) so chunking never
@@ -154,25 +145,15 @@ export class SubprocessTransport extends DisposableBase {
     maxReassemblyBytes;
     restartAfterRequests;
     writeQueueTimeoutMs;
-    /** Whether `tywrap-frame/1` negotiation was requested by the caller. */
-    enableChunking;
     /**
-     * Whether the bridge advertised chunking during the init meta probe. Only
-     * `true` after a successful negotiation; drives {@link capabilities} and the
-     * frame-aware stdout line ceiling.
+     * Per-frame UTF-8 data ceiling. The packaged Python peer receives this
+     * transport's `maxLineLength` when it is spawned, so request and response
+     * framing use the same fixed ceiling without runtime negotiation.
      */
-    negotiatedChunking = false;
-    /**
-     * The per-frame UTF-8 byte ceiling actually agreed with the bridge:
-     * `min(maxLineLength, the bridge's advertised maxFrameBytes)`. Defaults to
-     * `maxLineLength` and is narrowed during negotiation, so REQUEST frames are
-     * never sized larger than the bridge said it will accept (the reference bridge
-     * echoes the requested value, but a custom bridge may advertise a smaller one).
-     */
-    negotiatedFrameBytes;
+    frameBytes;
     /**
      * Reassembles `tywrap-frame/1` response frames into single logical response
-     * lines. Constructed lazily once chunking is negotiated; per-id discard tracks
+     * lines. Per-id discard tracks
      * timed-out/aborted streams so late frames cannot desync stdout.
      */
     responseReassembler = null;
@@ -182,6 +163,7 @@ export class SubprocessTransport extends DisposableBase {
     processError = null;
     // Stream buffers
     stdoutBuffer = '';
+    stdoutScanOffset = 0;
     stderrBuffer = '';
     // Request tracking
     pending = new Map();
@@ -190,8 +172,13 @@ export class SubprocessTransport extends DisposableBase {
     });
     requestCount = 0;
     needsRestart = false;
+    /** Serializes restart decisions with dispatch reservations. */
+    dispatchMutex = Promise.resolve();
+    activeDispatches = 0;
+    dispatchDrainWaiters = [];
     // Write queue for backpressure
     writeQueue = [];
+    writeQueueHead = 0;
     draining = false;
     /**
      * Per-logical-request write mutex (W5). When a request is chunked into
@@ -217,9 +204,12 @@ export class SubprocessTransport extends DisposableBase {
         this.maxLineLength = options.maxLineLength ?? DEFAULT_MAX_LINE_LENGTH;
         this.restartAfterRequests = options.restartAfterRequests ?? 0;
         this.writeQueueTimeoutMs = options.writeQueueTimeoutMs ?? DEFAULT_WRITE_QUEUE_TIMEOUT_MS;
-        this.enableChunking = options.enableChunking ?? false;
         this.maxReassemblyBytes = options.maxReassemblyBytes ?? DEFAULT_MAX_REASSEMBLY_BYTES;
-        this.negotiatedFrameBytes = this.maxLineLength;
+        this.frameBytes = this.maxLineLength;
+        this.responseReassembler = new Reassembler({
+            maxReassemblyBytes: this.maxReassemblyBytes,
+            expectedStream: 'response',
+        });
     }
     // ===========================================================================
     // TRANSPORT INTERFACE
@@ -232,7 +222,7 @@ export class SubprocessTransport extends DisposableBase {
      * @param signal - Optional AbortSignal for cancellation
      * @returns The raw JSON response string
      */
-    async send(message, timeoutMs, signal) {
+    async send(message, timeoutMs, signal, requestId) {
         // Check disposed state
         if (this.isDisposed) {
             throw new BridgeDisposedError('Transport has been disposed');
@@ -253,17 +243,20 @@ export class SubprocessTransport extends DisposableBase {
             throw new BridgeTimeoutError('Operation aborted');
         }
         // Extract message ID for response correlation
-        const messageId = extractMessageId(message);
+        const messageId = requestId ?? extractMessageId(message);
         if (messageId === null) {
             throw new BridgeProtocolError('Message must contain an "id" field');
         }
-        // Check for restart condition (either scheduled restart or forced by stream error)
-        if (this.needsRestart ||
-            (this.restartAfterRequests > 0 && this.requestCount >= this.restartAfterRequests)) {
-            await this.restartProcess();
-        }
+        let ownsDispatchReservation = false;
+        let reservationReleased = false;
+        const releaseOwnedReservation = () => {
+            if (ownsDispatchReservation && !reservationReleased) {
+                reservationReleased = true;
+                this.releaseDispatch();
+            }
+        };
         // Create promise for response
-        return new Promise((resolve, reject) => {
+        const response = new Promise((resolve, reject) => {
             // Set up timeout if specified
             let timer;
             // Defined before the timer so the timeout path can also detach it.
@@ -322,13 +315,28 @@ export class SubprocessTransport extends DisposableBase {
                 timer,
             };
             this.pending.set(messageId, pendingEntry);
-            // Write message to stdin. When chunking is negotiated and the encoded
-            // request exceeds the negotiated per-frame ceiling, it is fragmented into
+            // Write message to stdin. When the encoded request exceeds the per-frame
+            // ceiling, it is fragmented into
             // `tywrap-frame/1` request frames written contiguously under the write
             // mutex (W5); otherwise it goes out as a single JSONL line. Both paths
             // serialize through the same mutex so a small request can never slip
             // between another request's frames.
-            this.writeRequest(message, messageId, signal, pendingEntry).catch(err => {
+            this.reserveDispatch(() => this.pending.get(messageId) === pendingEntry && !signal?.aborted)
+                .then(reserved => {
+                if (!reserved) {
+                    return;
+                }
+                ownsDispatchReservation = true;
+                // Timeout/abort may have settled while this reservation waited behind
+                // a generation restart. Do not write the abandoned request, and release
+                // only the reservation this send actually acquired.
+                if (this.pending.get(messageId) !== pendingEntry) {
+                    releaseOwnedReservation();
+                    return;
+                }
+                return this.writeRequest(message, messageId, signal, pendingEntry);
+            })
+                .catch(err => {
                 this.pending.delete(messageId);
                 if (timer) {
                     clearTimeout(timer);
@@ -336,31 +344,86 @@ export class SubprocessTransport extends DisposableBase {
                 signal?.removeEventListener('abort', abortHandler);
                 reject(this.classifyError(err));
             });
+        });
+        return response.finally(releaseOwnedReservation);
+    }
+    /**
+     * Atomically reserve the current process generation for one request. A
+     * threshold restart waits for every request reserved on the old generation
+     * to settle before killing it; later callers remain queued behind this lock.
+     */
+    async withDispatchMutex(operation) {
+        let unlock;
+        const previous = this.dispatchMutex;
+        this.dispatchMutex = new Promise(resolve => {
+            unlock = resolve;
+        });
+        await previous;
+        try {
+            return await operation();
+        }
+        finally {
+            unlock();
+        }
+    }
+    async reserveDispatch(isLive) {
+        return this.withDispatchMutex(async () => {
+            // Cancellation may win while this request waits behind an earlier
+            // generation. It must consume neither a request slot nor a restart.
+            if (!isLive()) {
+                return false;
+            }
+            if (this.isLifecycleEnding()) {
+                throw new BridgeDisposedError('Transport has been disposed');
+            }
+            if (this.needsRestart ||
+                (this.restartAfterRequests > 0 && this.requestCount >= this.restartAfterRequests)) {
+                if (this.activeDispatches > 0) {
+                    await new Promise(resolve => this.dispatchDrainWaiters.push(resolve));
+                }
+                // The owner or transport can settle while waiting for the old
+                // generation to drain. Do not restart for work that no longer exists.
+                if (!isLive()) {
+                    return false;
+                }
+                if (this.isLifecycleEnding()) {
+                    throw new BridgeDisposedError('Transport has been disposed');
+                }
+                await this.restartProcess();
+            }
+            this.activeDispatches++;
             this.requestCount++;
+            return true;
         });
     }
+    releaseDispatch() {
+        this.activeDispatches = Math.max(0, this.activeDispatches - 1);
+        if (this.activeDispatches === 0) {
+            for (const resolve of this.dispatchDrainWaiters.splice(0)) {
+                resolve();
+            }
+        }
+    }
+    isLifecycleEnding() {
+        return this.state === 'disposing' || this.isDisposed;
+    }
     /**
      * Static capability descriptor for the subprocess backend.
      *
      * Per the {@link Transport.capabilities} contract this is lifecycle-independent
      * (safe before `init()` / after `dispose()`) and never makes a Python round
      * trip. Subprocess carries Arrow IPC and arbitrary binary (bytes envelopes)
-     * over the JSONL stream. `supportsChunking` reports the *configured* capability
-     * — `this.enableChunking`, i.e. whether this transport is set up to use the
-     * `tywrap-frame/1` framing path — exactly as `supportsArrow` reports a static
-     * channel capability rather than a runtime fact. Whether the *connected* bridge
-     * actually advertised framing is the negotiated fact, surfaced separately on
-     * `BridgeInfo.transport.supportsChunking`; "will chunking actually happen"
-     * needs both `true`. `supportsStreaming` stays `false` (0.8.0). `maxFrameBytes`
-     * is the configured JSONL line-length limit — the largest single (unchunked)
-     * response line this transport accepts.
+     * over the JSONL stream. `supportsChunking` is always `true` because the npm
+     * package ships both `tywrap-frame/1` peers. `supportsStreaming` stays `false`.
+     * `maxFrameBytes` is the fixed per-frame data ceiling supplied to the Python
+     * bridge at spawn time.
      */
     capabilities() {
         return {
             backend: 'subprocess',
             supportsArrow: true,
             supportsBinary: true,
-            supportsChunking: this.enableChunking,
+            supportsChunking: true,
             supportsStreaming: false,
             maxFrameBytes: this.maxLineLength,
         };
@@ -369,130 +432,11 @@ export class SubprocessTransport extends DisposableBase {
     // BOUNDED CONTEXT LIFECYCLE
     // ===========================================================================
     /**
-     * Initialize the transport by spawning the Python process and, when chunking
-     * is enabled, negotiating `tywrap-frame/1` via a small unchunked `meta` probe.
+     * Initialize the transport by spawning the Python process. The packaged
+     * bridge always speaks `tywrap-frame/1`.
      */
     async doInit() {
         await this.spawnProcess();
-        if (this.enableChunking) {
-            await this.negotiateChunking();
-        }
-    }
-    /**
-     * Probe the freshly-spawned bridge for `tywrap-frame/1` support.
-     *
-     * Sends a small unchunked `meta` request directly over stdin (NOT via the
-     * public {@link send}, which would re-enter init while we are mid-init) and
-     * reads the single-line response. If the bridge reports
-     * `transport.supportsChunking: true`, response reassembly is enabled. If the
-     * bridge does not advertise chunking (old bridge, or it disabled framing), the
-     * transport stays single-frame and an oversize response still fails loud — no
-     * silent fallback. A probe failure leaves chunking disabled but does not fail
-     * init (small calls must keep working); the loud failure is deferred to the
-     * first oversize response.
-     */
-    async negotiateChunking() {
-        const probeId = -1;
-        const probeMessage = JSON.stringify({
-            id: probeId,
-            protocol: PROTOCOL_ID,
-            method: 'meta',
-            params: {},
-        });
-        let responseLine;
-        try {
-            responseLine = await this.sendProbe(probeId, probeMessage, NEGOTIATION_PROBE_TIMEOUT_MS);
-        }
-        catch {
-            // Probe failed (slow/old bridge, transient): leave chunking off. Oversize
-            // responses will fail loud at the line ceiling; small calls keep working.
-            this.negotiatedChunking = false;
-            return;
-        }
-        let parsed;
-        try {
-            parsed = JSON.parse(responseLine);
-        }
-        catch {
-            this.negotiatedChunking = false;
-            return;
-        }
-        const supports = this.bridgeAdvertisesChunking(parsed);
-        this.negotiatedChunking = supports;
-        if (supports) {
-            // Honor the bridge's advertised ceiling so request frames are never sized
-            // larger than it will accept. bridgeAdvertisesChunking already validated
-            // maxFrameBytes is a positive integer, so this read is safe.
-            const advertised = parsed.result
-                ?.transport?.maxFrameBytes;
-            if (typeof advertised === 'number') {
-                this.negotiatedFrameBytes = Math.min(this.maxLineLength, advertised);
-            }
-            this.responseReassembler = new Reassembler({
-                maxReassemblyBytes: this.maxReassemblyBytes,
-                expectedStream: 'response',
-            });
-        }
-    }
-    /**
-     * Whether a parsed `meta` response advertises `tywrap-frame/1` chunking with a
-     * matching frame protocol. Defensive: any missing/mismatched field => `false`.
-     */
-    bridgeAdvertisesChunking(parsed) {
-        if (parsed === null || typeof parsed !== 'object') {
-            return false;
-        }
-        const result = parsed.result;
-        if (result === null || typeof result !== 'object') {
-            return false;
-        }
-        const transport = result.transport;
-        if (transport === null || typeof transport !== 'object') {
-            return false;
-        }
-        const t = transport;
-        // Match the BridgeInfo validator (rpc-client.ts): a valid framing block needs
-        // the matching protocol AND a positive-integer maxFrameBytes. A bridge that
-        // advertises chunking with a bogus frame ceiling is not a contract we honor.
-        return (t.supportsChunking === true &&
-            t.frameProtocol === FRAME_PROTOCOL_ID &&
-            typeof t.maxFrameBytes === 'number' &&
-            Number.isInteger(t.maxFrameBytes) &&
-            t.maxFrameBytes > 0);
-    }
-    /**
-     * Send a single in-init probe message over stdin and resolve with its raw
-     * response line. Registers a pending entry keyed by `probeId` exactly like the
-     * normal send path so {@link handleResponseLine} resolves it, but bypasses the
-     * `isReady`/auto-init guard (we are deliberately running during `doInit`).
-     */
-    sendProbe(probeId, message, timeoutMs) {
-        return new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                this.pending.delete(probeId);
-                this.timedOutRequests.mark(probeId);
-                reject(new BridgeTimeoutError(`Negotiation probe timed out after ${timeoutMs}ms`));
-            }, timeoutMs);
-            if (typeof timer.unref === 'function') {
-                timer.unref();
-            }
-            this.pending.set(probeId, {
-                resolve: (value) => {
-                    clearTimeout(timer);
-                    resolve(value);
-                },
-                reject: (error) => {
-                    clearTimeout(timer);
-                    reject(error);
-                },
-                timer,
-            });
-            this.writeToStdin(`${message}\n`).catch(err => {
-                this.pending.delete(probeId);
-                clearTimeout(timer);
-                reject(this.classifyError(err));
-            });
-        });
     }
     /**
      * Dispose the transport by killing the Python process.
@@ -510,20 +454,21 @@ export class SubprocessTransport extends DisposableBase {
         }
         this.pending.clear();
         // Clear write queue
-        for (const queued of this.writeQueue) {
-            this.clearQueuedWriteTimeout(queued);
-            queued.reject(error);
-        }
-        this.writeQueue.length = 0;
-        // Kill process
-        await this.killProcess();
+        this.rejectAllQueuedWrites(error);
+        // Fence queued restart work before killing the process. A restart already
+        // holding the mutex observes the disposing state before it can spawn; if it
+        // spawned just before disposal began, this barrier kills that child too.
+        await this.withDispatchMutex(() => this.killProcess());
         // Clear buffers
         this.stdoutBuffer = '';
+        this.stdoutScanOffset = 0;
         this.stderrBuffer = '';
         this.timedOutRequests.clear();
         this.requestCount = 0;
-        this.responseReassembler = null;
-        this.negotiatedChunking = false;
+        this.responseReassembler = new Reassembler({
+            maxReassemblyBytes: this.maxReassemblyBytes,
+            expectedStream: 'response',
+        });
         // Reset the per-request write mutex so a disposed transport starts from a
         // clean (resolved) tail if reused.
         this.writeMutex = Promise.resolve();
@@ -546,34 +491,16 @@ export class SubprocessTransport extends DisposableBase {
         // on top of it. Spread (rather than dynamic index assignment) keeps the
         // computed keys off ESLint's object-injection sink. See
         // docs/transport-framing.md.
-        const chunkingEnv = this.enableChunking
-            ? {
-                [ENV_CHUNKING]: '1',
-                [ENV_FRAME_PROTOCOL]: FRAME_PROTOCOL_ID,
-                [ENV_MAX_FRAME_BYTES]: String(this.maxLineLength),
-            }
-            : {};
         const env = {
             ...baseEnv,
-            ...chunkingEnv,
             // Ensure Python uses UTF-8
             PYTHONUTF8: '1',
             PYTHONIOENCODING: 'UTF-8',
             // Disable Python buffering
             PYTHONUNBUFFERED: '1',
         };
-        // This transport's enableChunking is authoritative: when chunking is OFF,
-        // strip any inherited TYWRAP_TRANSPORT_* from the parent environment so a
-        // host-level value can't make the bridge negotiate framing the TS side won't
-        // reassemble (or a different frame ceiling). When ON, chunkingEnv above
-        // already set all three to this transport's values.
-        if (!this.enableChunking) {
-            delete env[ENV_CHUNKING];
-            delete env[ENV_FRAME_PROTOCOL];
-            delete env[ENV_MAX_FRAME_BYTES];
-        }
         // Spawn process
-        this.process = spawn(this.pythonPath, [this.bridgeScript], {
+        this.process = spawn(this.pythonPath, [this.bridgeScript, '--tywrap-max-frame-bytes', String(this.frameBytes)], {
             stdio: ['pipe', 'pipe', 'pipe'],
             env,
             cwd: this.cwd,
@@ -649,26 +576,34 @@ export class SubprocessTransport extends DisposableBase {
      * Restart the Python process.
      */
     async restartProcess() {
+        if (this.isLifecycleEnding()) {
+            throw new BridgeDisposedError('Transport has been disposed');
+        }
         // Kill existing process
         await this.killProcess();
         // Clear buffers and restart flags
         this.stdoutBuffer = '';
+        this.stdoutScanOffset = 0;
         this.stderrBuffer = '';
         this.requestCount = 0;
         this.needsRestart = false;
         // Drop any partial reassembly + discard tracking: the new process owns a
         // fresh stdout stream, so stale per-id state from the dead process must not
         // leak across the restart boundary.
-        this.responseReassembler = null;
-        this.negotiatedChunking = false;
+        this.responseReassembler = new Reassembler({
+            maxReassemblyBytes: this.maxReassemblyBytes,
+            expectedStream: 'response',
+        });
         // The new process owns a fresh stdin stream; reset the write mutex so a
         // pending frame burst against the dead process cannot serialize behind it.
         this.writeMutex = Promise.resolve();
-        // Spawn new process and re-negotiate framing against the fresh bridge.
-        await this.spawnProcess();
-        if (this.enableChunking) {
-            await this.negotiateChunking();
+        // Disposal may begin while the old child is being killed. Never publish a
+        // replacement after lifecycle teardown has started.
+        if (this.isLifecycleEnding()) {
+            throw new BridgeDisposedError('Transport has been disposed');
         }
+        // Spawn a fresh process with the packaged always-on framing protocol.
+        await this.spawnProcess();
     }
     /**
      * Mark the process for restart on the next send.
@@ -684,17 +619,13 @@ export class SubprocessTransport extends DisposableBase {
     /**
      * Effective stdout line ceiling.
      *
-     * Without chunking it is exactly {@link maxLineLength} (legacy behavior). With
-     * chunking negotiated, a single wire line is a `tywrap-frame/1` envelope whose
+     * A single wire line may be a `tywrap-frame/1` envelope whose
      * `data` slice is capped at `maxLineLength` UTF-8 bytes by the bridge, but the
      * JSON envelope adds escaping (`"`/`\`) plus fixed keys; the ceiling is widened
      * to bound that overhead so a legitimate frame line is never rejected while a
      * runaway/garbage line still is.
      */
     effectiveLineCeiling() {
-        if (!this.negotiatedChunking) {
-            return this.maxLineLength;
-        }
         return this.maxLineLength * FRAME_DATA_ESCAPE_FACTOR + FRAME_ENVELOPE_HEADROOM;
     }
     /**
@@ -703,20 +634,23 @@ export class SubprocessTransport extends DisposableBase {
     handleStdoutData(chunk) {
         this.stdoutBuffer += chunk.toString();
         const ceiling = this.effectiveLineCeiling();
-        // Check for excessive line length without newline
-        if (this.stdoutBuffer.length > ceiling && !this.stdoutBuffer.includes('\n')) {
+        // Scan only bytes newly appended since the last incomplete line.
+        let newlineIndex = this.stdoutBuffer.indexOf('\n', this.stdoutScanOffset);
+        if (this.stdoutBuffer.length > ceiling && newlineIndex === -1) {
             const snippet = this.stdoutBuffer.slice(0, 500);
             this.stdoutBuffer = '';
+            this.stdoutScanOffset = 0;
             this.handleProtocolError(`Response line exceeded ${ceiling} bytes`, snippet);
             return;
         }
         // Process complete lines
-        let newlineIndex;
-        while ((newlineIndex = this.stdoutBuffer.indexOf('\n')) !== -1) {
+        while (newlineIndex !== -1) {
             const line = this.stdoutBuffer.slice(0, newlineIndex);
             this.stdoutBuffer = this.stdoutBuffer.slice(newlineIndex + 1);
+            this.stdoutScanOffset = 0;
             // Skip empty lines
             if (!line.trim()) {
+                newlineIndex = this.stdoutBuffer.indexOf('\n', this.stdoutScanOffset);
                 continue;
             }
             // Check line length
@@ -726,18 +660,20 @@ export class SubprocessTransport extends DisposableBase {
                 return;
             }
             this.handleResponseLine(line);
+            newlineIndex = this.stdoutBuffer.indexOf('\n', this.stdoutScanOffset);
         }
+        this.stdoutScanOffset = this.stdoutBuffer.length;
     }
     /**
      * Handle a complete response line from stdout.
      *
-     * When chunking is negotiated, a line may be a `tywrap-frame/1` envelope: it is
+     * A line may be a `tywrap-frame/1` envelope: it is
      * routed into the per-id {@link Reassembler}, which returns the reassembled
      * logical response only once the stream is complete and valid. Single-line
      * (non-frame) responses keep the original fast path unchanged.
      */
     handleResponseLine(line) {
-        if (this.negotiatedChunking && this.responseReassembler) {
+        if (this.responseReassembler) {
             const probe = probeFrameLine(line);
             if (probe.kind === 'frame') {
                 this.handleResponseFrame(probe.value, line);
@@ -786,7 +722,7 @@ export class SubprocessTransport extends DisposableBase {
     handleResponseFrame(rawFrame, line) {
         const reassembler = this.responseReassembler;
         if (!reassembler) {
-            // Unreachable: only called when negotiatedChunking && reassembler set.
+            // Unreachable: the always-on framing path constructs the reassembler.
             this.handleProtocolError('Received frame with no reassembler', line);
             return;
         }
@@ -896,11 +832,7 @@ export class SubprocessTransport extends DisposableBase {
         // EPIPE means process died
         const error = new BridgeProtocolError(this.withStderrTail(`stdin error: ${err.message}`));
         // Reject all pending writes
-        for (const queued of this.writeQueue) {
-            this.clearQueuedWriteTimeout(queued);
-            queued.reject(error);
-        }
-        this.writeQueue.length = 0;
+        this.rejectAllQueuedWrites(error);
         // Reject all pending requests
         this.rejectAllPending(error);
         // Mark for restart on next send
@@ -934,13 +866,11 @@ export class SubprocessTransport extends DisposableBase {
      */
     createQueuedWrite(data, resolve, reject, isLive) {
         const queuedAt = Date.now();
-        const entry = { data, resolve, reject, queuedAt, isLive };
+        const entry = { data, resolve, reject, queuedAt, isLive, isQueued: true };
         // Set up timeout timer that fires if drain never happens
         entry.timeoutHandle = setTimeout(() => {
-            // Remove this entry from the queue
-            const index = this.writeQueue.indexOf(entry);
-            if (index !== -1) {
-                this.writeQueue.splice(index, 1);
+            if (entry.isQueued) {
+                entry.isQueued = false;
                 reject(new BridgeTimeoutError(`Write queue timeout: entry waited ${this.writeQueueTimeoutMs}ms without drain`));
             }
         }, this.writeQueueTimeoutMs);
@@ -968,7 +898,7 @@ export class SubprocessTransport extends DisposableBase {
                 reject(new BridgeProtocolError(this.withStderrTail('Process stdin not available')));
                 return;
             }
-            if (this.draining || this.writeQueue.length > 0) {
+            if (this.draining || this.writeQueue.length > this.writeQueueHead) {
                 // Queue the write with timestamp, timeout timer, and liveness predicate
                 // (checked again at flush — see processQueuedWrite).
                 this.writeQueue.push(this.createQueuedWrite(data, resolve, reject, isLive));
@@ -1003,7 +933,7 @@ export class SubprocessTransport extends DisposableBase {
     }
     /**
      * Write one logical request to stdin, fragmenting it into `tywrap-frame/1`
-     * request frames when chunking is negotiated and the encoded request exceeds
+     * request frames when the encoded request exceeds
      * the per-frame ceiling (W5 — the mirror of W4's response chunking).
      *
      * Both the chunked and single-line paths run under {@link writeMutex} so a
@@ -1039,10 +969,9 @@ export class SubprocessTransport extends DisposableBase {
             if (!isLive()) {
                 return Promise.resolve();
             }
-            // Only chunk when chunking was negotiated AND the encoded request exceeds
-            // the NEGOTIATED per-frame ceiling (which honors the bridge's advertised
-            // maxFrameBytes). Otherwise: one JSONL line, unchanged.
-            if (this.negotiatedChunking && utf8ByteLength(message) > this.negotiatedFrameBytes) {
+            // Chunk when the encoded request exceeds the fixed per-frame ceiling
+            // supplied to the packaged Python peer. Otherwise use one JSONL line.
+            if (utf8ByteLength(message) > this.frameBytes) {
                 return this.writeChunkedRequest(message, messageId, signal, isLive);
             }
             return this.writeToStdin(`${message}\n`, isLive);
@@ -1069,7 +998,7 @@ export class SubprocessTransport extends DisposableBase {
         const frames = encodeFrames(message, {
             id: messageId,
             stream: 'request',
-            maxFrameBytes: this.negotiatedFrameBytes,
+            maxFrameBytes: this.frameBytes,
         });
         for (const frame of frames) {
             // Stop the burst if the caller aborted, the request was abandoned (timed
@@ -1092,11 +1021,16 @@ export class SubprocessTransport extends DisposableBase {
      * Clears each entry's timeout before rejecting so no late timer fires.
      */
     rejectAllQueuedWrites(error) {
-        for (const q of this.writeQueue) {
-            this.clearQueuedWriteTimeout(q);
-            q.reject(error);
+        for (let index = this.writeQueueHead; index < this.writeQueue.length; index += 1) {
+            const queued = this.writeQueue[index];
+            if (queued?.isQueued) {
+                queued.isQueued = false;
+                this.clearQueuedWriteTimeout(queued);
+                queued.reject(error);
+            }
         }
         this.writeQueue.length = 0;
+        this.writeQueueHead = 0;
     }
     /**
      * Process a single dequeued write entry: enforce the fallback queue timeout,
@@ -1148,7 +1082,7 @@ export class SubprocessTransport extends DisposableBase {
      */
     flushWriteQueue() {
         const now = Date.now();
-        while (this.writeQueue.length > 0 && !this.draining) {
+        while (this.writeQueueHead < this.writeQueue.length && !this.draining) {
             const stdin = this.process?.stdin;
             if (!stdin || this.processExited) {
                 // Process died - reject all queued writes
@@ -1156,10 +1090,15 @@ export class SubprocessTransport extends DisposableBase {
                 this.markForRestart();
                 return;
             }
-            const queued = this.writeQueue.shift();
+            const queued = this.writeQueue[this.writeQueueHead];
+            this.writeQueueHead += 1;
             if (!queued) {
                 return;
             }
+            if (!queued.isQueued) {
+                continue;
+            }
+            queued.isQueued = false;
             // Clear the timeout since we're processing this entry now
             this.clearQueuedWriteTimeout(queued);
             const status = this.processQueuedWrite(queued, stdin, now);
@@ -1167,6 +1106,10 @@ export class SubprocessTransport extends DisposableBase {
                 return;
             }
         }
+        if (this.writeQueueHead === this.writeQueue.length) {
+            this.writeQueue.length = 0;
+            this.writeQueueHead = 0;
+        }
     }
     // ===========================================================================
     // HELPERS