fix: bound finite session stdin writes

CHANGELOG.en.md

@@ -20,7 +20,22 @@ Chinese is the primary changelog and this file is its maintained English mirror.
   explicitly unapproved for distribution without changing the XCFramework
   Release's RootFS exclusion policy.
 
-## v0.4.0-abi.7 (planned Stage1 maintenance prerelease)
+## v0.4.0-abi.8 (planned Stage1 maintenance prerelease)
+
+This is a compatibility maintenance release after `v0.4.0-abi.7`. It remains a
+prerelease and is **not stable v0.4.0**.
+
+- Finite-timeout streaming sessions now reuse the SPAWN absolute admission
+  deadline for stdin writes as well as stdin close. A blocked stdin ordering
+  lock or control writer returns bounded `ISH_ERR_TIMEOUT` instead of defeating
+  the product command timeout; zero-timeout sessions retain legacy synchronous
+  delivery. A failed multi-frame write can still have admitted a prefix, so
+  transactional callers must use staging.
+- The public C ABI remains version 1, wire protocol remains v4, and no public
+  symbol is added. RootFS remains outside the Release. This version does not
+  implement a native Agent Loop or install Codex CLI.
+
+## v0.4.0-abi.7 (published Stage1 maintenance prerelease)
 
 This is a compatibility maintenance release after `v0.4.0-abi.6`. It remains a
 prerelease and is **not stable v0.4.0**.
@@ -35,8 +50,8 @@ prerelease and is **not stable v0.4.0**.
   helper failure fails closed.
 - The Swift API adds `IshInstance.renameNoReplace(from:to:timeout:)` and
   `IshFilesystemError`. An existing destination maps to `.destinationExists`.
-  While source temporarily links `v0.4.0-abi.6`, a weak fallback reports
-  unsupported instead of producing a missing symbol.
+  Before the release manifest update, a weak fallback remains compatible with
+  the older binary instead of producing a missing symbol.
 - The public C ABI version remains 1 and wire protocol remains v4; the new
   function symbol is backward-compatible and additive. RootFS remains outside
   the Release. This version does not implement a native Agent Loop or install

CHANGELOG.md

@@ -15,7 +15,19 @@
   `fs.tar.gz`，环境差异仍保留在外部证据中。CI 不上传制品，候选仍明确标记为未获分发
   批准，不改变 XCFramework Release 的 RootFS 排除策略。
 
-## v0.4.0-abi.7（计划中的 Stage1 维护预发布）
+## v0.4.0-abi.8（计划中的 Stage1 维护预发布）
+
+这是 `v0.4.0-abi.7` 之后的兼容性维护版本，仍是 prerelease，**不是稳定
+v0.4.0**。
+
+- 有限 timeout 的 streaming session 现在让 stdin write 与 stdin close 一样复用
+  SPAWN 的绝对 admission deadline。stdin 顺序锁或控制 writer 被阻塞时会有界返回
+  `ISH_ERR_TIMEOUT`，不会让上层命令超时失效；零 timeout session 保留旧的同步交付语义。
+  多帧 write 失败前已经接纳的前缀仍可能送达，事务型调用方必须使用 staging。
+- 公开 C ABI 版本仍为 1，wire protocol 仍为 v4；未新增公开符号。RootFS 不进入
+  Release。本版本不实现原生 Agent Loop，也不会安装 Codex CLI。
+
+## v0.4.0-abi.7（已发布的 Stage1 维护预发布）
 
 这是 `v0.4.0-abi.6` 之后的兼容性维护版本，仍是 prerelease，**不是稳定
 v0.4.0**。
@@ -27,8 +39,8 @@ v0.4.0**。
   supervisor 执行原子重命名，以有界十进制记录返回 guest errno；协议损坏或 helper
   异常会 fail closed。
 - Swift API 新增 `IshInstance.renameNoReplace(from:to:timeout:)` 与
-  `IshFilesystemError`。目标已存在映射为 `.destinationExists`；源码临时链接
-  `v0.4.0-abi.6` 时通过 weak fallback 明确报告 unsupported，不会产生缺失符号。
+  `IshFilesystemError`。目标已存在映射为 `.destinationExists`；源码在 release
+  manifest 更新前通过 weak fallback 兼容旧 binary，不会产生缺失符号。
 - 公开 C ABI 版本仍为 1，wire protocol 仍为 v4；新增函数符号是向后兼容扩展。
   RootFS 不进入 Release。本版本不实现原生 Agent Loop，也不会安装 Codex CLI。
 

README.en.md

@@ -15,17 +15,17 @@ and simulator slices are arm64.
 
 ## Current phase: native ABI transition
 
-The default branch has published `v0.4.0-abi.6` and is preparing the compatible
-maintenance prerelease `v0.4.0-abi.7`. Both belong to the Stage1 **native ABI
+The default branch has published `v0.4.0-abi.7` and is preparing the compatible
+maintenance prerelease `v0.4.0-abi.8`. Both belong to the Stage1 **native ABI
 transition**. Neither is stable `v0.4.0` or the complete v0.4 Swift API. Keep
 these four version surfaces distinct:
 
-| Surface | Current `v0.4.0-abi.6` | Planned `v0.4.0-abi.7` |
+| Surface | Current `v0.4.0-abi.7` | Planned `v0.4.0-abi.8` |
 | --- | --- | --- |
-| Public C ABI | `ISH_EMBED_ABI_VERSION == 1`; compatible symbols are published | Still ABI 1, with one backward-compatible atomic-rename function symbol |
+| Public C ABI | `ISH_EMBED_ABI_VERSION == 1`; compatible symbols including atomic rename are public | Still ABI 1 with no new symbol; finite-session stdin deadline semantics are tightened |
 | Internal wire protocol | exact-match v4 between host and embedded supervisor | still v4; this is not the public C ABI version |
-| `Package.swift` | pins the public `v0.4.0-abi.6` URL/checksum | the release transaction creates a manifest-only release commit pinned to the maintenance binary |
-| Swift source | remains v0.3.3-ABI compatible and does not call retain/release | adds a typed rename API with a weak fallback for old binaries |
+| `Package.swift` | pins the public `v0.4.0-abi.7` URL/checksum | the release transaction creates a manifest-only release commit pinned to the maintenance binary |
+| Swift source | remains v0.3.3-ABI compatible and includes typed rename | same API; finite stdin writes can no longer bypass the product deadline |
 
 Stage1 native code adds session retain/release, a joinable kernel thread,
 soft-halt, exact wire v4, and complete session close. The existing Swift wrapper
@@ -48,7 +48,9 @@ size, SHA-256, licenses, and installation transaction.
 - One valid `IshInstance` lifecycle is supported per host process, with multiple
   concurrent command sessions.
 - One-shot and streaming commands support standard I/O, stdin close, signals,
-  PTY resize, and exit events.
+  PTY resize, and exit events. Finite-timeout sessions reuse the SPAWN absolute
+  admission deadline for stdin write/close; a failed multi-frame write may have
+  admitted a prefix, so transactional input must be staged.
 - Persistent trees below `/srv/vms/<name>` can be used as chroots. This isolates
   filesystem views; it is not hardware virtualization or an adversarial sandbox.
 - The native reader has hard frame and per-session backlog ceilings. The
@@ -88,15 +90,15 @@ gives those narrow differences independent PRs, CI, and an exact gitlink, making
 PocketRoot builds and releases reproducible. We do not directly rewrite somebody
 else's local upstream repository; generally useful fixes can still be contributed
 to [iSH upstream](https://github.com/ish-app/ish), while the fork carries project
-gates until upstream accepts and releases them. The current `v0.4.0-abi.7`
+gates until upstream accepts and releases them. The current `v0.4.0-abi.8`
 source change includes neither RootFS content nor any prebuilt XCFramework/guest
 binary; binaries may be produced and published only by a later release
 transaction after its gates pass.
 
 ## Installation status
 
-`v0.4.0-abi.6` is public and [`Package.swift`](Package.swift) currently pins it.
-Until `v0.4.0-abi.7` is published, the manifest keeps pointing at that verified
+`v0.4.0-abi.7` is public and [`Package.swift`](Package.swift) currently pins it.
+Until `v0.4.0-abi.8` is published, the manifest keeps pointing at that verified
 asset instead of advertising a future 404 URL. Use Xcode's
 **File → Add Package Dependencies…** with:
 
@@ -108,8 +110,9 @@ Select a version whose tag, `libIshKernel.xcframework.zip`, Corresponding Source
 and manifest URL/checksum all match. Consumer projects do not need Meson, Zig,
 or LLVM.
 
-`v0.4.0-abi.7` adds guest-atomic rename without a shell or check-then-rename
-race and maps an existing destination to a typed Swift error. It does not
+`v0.4.0-abi.7` provides guest-atomic rename without a shell or
+check-then-rename race. `v0.4.0-abi.8` makes finite-timeout stdin write/close
+share the SPAWN absolute deadline. It does not
 implement a native Agent Loop or
 install Codex CLI in the app.
 Node.js/npm remain optional choices of the RootFS/guest package-management flow,
@@ -147,8 +150,8 @@ do {
 A finite timeout starts at Swift API entry, deducts argv/env/cwd/chroot
 marshalling, and then covers the native SPAWN staging gate and control-queue
 admission. Finite streaming sessions use ordered bounded asynchronous
-admission for SPAWN, stdin close, and terminate. The session retains native
-SPAWN's absolute deadline, and stdin close reuses it when acquiring the writer
+admission for SPAWN, stdin write/close, and terminate. The session retains native
+SPAWN's absolute deadline, and stdin write/close reuses it for the ordering lock and writer
 gate, returning `ISH_ERR_TIMEOUT` on expiry. Callers must still read
 authoritative `EXITED` before confirming termination. Stdin close returns
 `ISH_ERR_BUSY` rather than waiting behind an active stdin write. If the runtime

README.md

@@ -13,16 +13,16 @@ RootFS 安装、产品级命令策略、Swift Concurrency 隔离和界面。项
 
 ## 当前阶段：Native ABI 过渡
 
-当前默认分支已发布 `v0.4.0-abi.6`，正在准备兼容性维护预发布
-`v0.4.0-abi.7`。它们都属于 **Stage1 native ABI 过渡**，不是稳定 `v0.4.0`，
+当前默认分支已发布 `v0.4.0-abi.7`，正在准备兼容性维护预发布
+`v0.4.0-abi.8`。它们都属于 **Stage1 native ABI 过渡**，不是稳定 `v0.4.0`，
 也不是完整 v0.4 Swift API。请同时区分下面四个版本面：
 
-| 版本面 | 当前 `v0.4.0-abi.6` | 计划中的 `v0.4.0-abi.7` |
+| 版本面 | 当前 `v0.4.0-abi.7` | 计划中的 `v0.4.0-abi.8` |
 | --- | --- | --- |
-| 公开 C ABI | `ISH_EMBED_ABI_VERSION == 1`；兼容性符号已发布 | 仍为 ABI 1，新增向后兼容的原子 rename 函数符号 |
+| 公开 C ABI | `ISH_EMBED_ABI_VERSION == 1`；原子 rename 等兼容性符号已发布 | 仍为 ABI 1，不新增符号；收紧有限 session 的 stdin deadline 语义 |
 | 内部 wire protocol | host 与内嵌 supervisor 精确匹配 v4 | 仍为 v4；它不是公开 C ABI 版本 |
-| `Package.swift` | 固定已公开的 `v0.4.0-abi.6` URL/checksum | 发布事务生成只改 manifest 的 release commit，固定到维护二进制 |
-| Swift 源 | 保持 v0.3.3 ABI 兼容，不调用 retain/release | 新增类型化 rename API；通过 weak fallback 兼容旧 binary |
+| `Package.swift` | 固定已公开的 `v0.4.0-abi.7` URL/checksum | 发布事务生成只改 manifest 的 release commit，固定到维护二进制 |
+| Swift 源 | 保持 v0.3.3 ABI 兼容，已提供类型化 rename | 同一 API；有限 stdin write 不再绕过产品 deadline |
 
 Stage1 的 native runtime 已加入 session retain/release、可等待 kernel 线程、soft-halt、
 严格 v4 协议和完整 session close 等底层能力。现有 Swift wrapper 刻意不调用新增
@@ -40,7 +40,8 @@ RootFS 不提交到本仓库、不包含在 XCFramework 或 GitHub Release 中
 
 - 每个宿主进程只支持一个有效的 `IshInstance` 生命周期，可并发运行多个 command session。
 - 支持一次性命令与流式 session；流式 session 可读写标准流、关闭 stdin、发送信号、
-  调整 PTY 尺寸并等待退出。
+  调整 PTY 尺寸并等待退出。有限 timeout session 的 stdin write/close 复用 SPAWN 的
+  绝对 admission deadline；多帧 write 失败时可能已经接纳前缀，事务型输入必须 staging。
 - `/srv/vms/<name>` 下的目录树可作为持久化 chroot。它隔离文件视图，但不是硬件虚拟机，
   也不是针对恶意代码的安全边界。
 - native reader 对协议帧和每个 session 的输出积压设置硬上限；host→guest 控制队列也有
@@ -68,13 +69,13 @@ JIT 脏页一致性必须修改模拟器核心，无法只在 outer package 或
 窄差异拥有独立 PR、CI 和精确 gitlink，PocketRoot 的构建与发布也因此可复现。我们不会在
 本地直接改写别人维护的上游仓库；适合通用化的修复仍可回馈
 [iSH upstream](https://github.com/ish-app/ish)，但在上游接受并发布前由 fork 承担项目门禁。
-当前 `v0.4.0-abi.7` 源码变更不纳入 RootFS，也不提交任何预构建
+当前 `v0.4.0-abi.8` 源码变更不纳入 RootFS，也不提交任何预构建
 XCFramework/guest binary；二进制只能在后续发布事务通过后生成和发布。
 
 ## 安装状态
 
-`v0.4.0-abi.6` 已公开且当前 [`Package.swift`](Package.swift) 固定到它。
-`v0.4.0-abi.7` 发布前，manifest 继续指向这个已验证的资产，不会提前引用 404 URL。
+`v0.4.0-abi.7` 已公开且当前 [`Package.swift`](Package.swift) 固定到它。
+`v0.4.0-abi.8` 发布前，manifest 继续指向这个已验证的资产，不会提前引用 404 URL。
 在 Xcode 的 **File → Add Package Dependencies…** 中使用：
 
 ```text
@@ -84,8 +85,9 @@ https://github.com/jacklv-coder/ish-arm64-pkg
 请选择明确包含 `libIshKernel.xcframework.zip`、对应源码归档，并且 manifest URL/checksum
 与同一标签匹配的版本。业务工程不需要安装 Meson、Zig 或 LLVM。
 
-`v0.4.0-abi.7` 新增无 shell、无 check-then-rename 竞争窗口的 guest 原子重命名，
-并把目标已存在映射为 Swift 类型化错误；它不实现原生 Agent Loop，也不会
+`v0.4.0-abi.7` 已提供无 shell、无 check-then-rename 竞争窗口的 guest 原子重命名。
+`v0.4.0-abi.8` 让有限 timeout session 的 stdin write/close 都受同一 SPAWN
+绝对 deadline 约束；它不实现原生 Agent Loop，也不会
 在 App 内安装 Codex CLI。Node.js/npm 如有需要仍由
 RootFS/guest 包管理流程选择，不属于 runtime 的强制依赖。
 
@@ -119,9 +121,9 @@ do {
 
 `IshSpawnOptions.timeout` 同时适用于 `runOneshot` 与 streaming `spawn`。有限超时从
 Swift API 入口开始，先扣除 argv/env/cwd/chroot 的封送时间，再覆盖 native SPAWN
-staging gate 和控制队列接纳；有限 streaming session 的 SPAWN、stdin close 与
+staging gate 和控制队列接纳；有限 streaming session 的 SPAWN、stdin write/close 与
 terminate 采用保持顺序的有界异步接纳。session 会保留 native SPAWN 的绝对 deadline，
-stdin close 复用同一期限取得 writer gate，过期时返回 `ISH_ERR_TIMEOUT`；调用方仍须
+stdin write/close 复用同一期限取得顺序锁和 writer gate，过期时返回 `ISH_ERR_TIMEOUT`；调用方仍须
 读取权威 `EXITED` 才能确认终止。stdin close 遇到 active stdin write 时返回
 `ISH_ERR_BUSY`，不会排在它后面等待。如果 runtime 无法确认命令已清理，会转入
 shutting-down 状态而不是遗留无主 guest 进程。

Sources/IshEmbed/IshEmbed.swift

@@ -64,10 +64,10 @@ public struct IshSpawnOptions {
     /// Starts at the Swift API entry. For oneshot commands, bounds Swift option
     /// staging plus the complete native execution and cleanup path. For
     /// streaming spawn, bounds Swift/native SPAWN staging and admission, and
-    /// selects ordered bounded admission for stdin close and terminate. Callers
-    /// still confirm streaming termination by reading the authoritative exit
-    /// event; stdin close may report busy while an active write owns its order
-    /// gate.
+    /// selects ordered bounded admission for stdin writes/close and terminate.
+    /// Callers still confirm streaming termination by reading the authoritative
+    /// exit event; stdin close may report busy while an active write owns its
+    /// order gate.
     public var timeout: TimeInterval?
     /// If non-nil, the child chroots to this guest path before exec.
     /// Used for VM-style isolation; pass `/srv/vms/<name>` to confine
@@ -804,6 +804,10 @@ public final class IshSession: @unchecked Sendable {
         }
     }
 
+    /// Queues stdin bytes in order. Finite-timeout sessions reuse the original
+    /// SPAWN admission deadline, so a stalled transport cannot make this call
+    /// wait indefinitely. A failed multi-frame write may have admitted a
+    /// prefix; callers requiring transactional semantics must stage input.
     public func write(_ data: Data) throws {
         try withRawCall { r in
             try data.withUnsafeBytes { rawBuf in