Summary
Extend the engine-integrity-fault abort policy to the shared CLI error handler, TGocciaApplication.Run (source/units/Goccia.Application.pas), so every GocciaScript binary reports corruption distinctly instead of as a generic failure.
Why
ADR 0109 makes integrity faults (use-after-free, invalid dereference, broken heap — Goccia.EngineFault.IsEngineIntegrityFault) uncatchable by guests, and the test runner aborts on them with a distinct diagnostic and exit 70. But faults raised outside per-file test execution — during startup, module loading, or in any other binary (loader, REPL, bundler, benchmark runner) — still land in TGocciaApplication.Run's generic on E: Exception arm and become a plain exit 1 with no Integrity fault: line. ADR 0109's host-tier section records this as a known residual boundary whose closure "is a change to every CLI binary and belongs to its own decision" — this issue is that decision.
Current behavior
TGocciaApplication.Run (~line 63): on E: Exception do HandleError; Result := 1 — an EAccessViolation during, say, engine setup in the loader is indistinguishable from an ordinary script error at the exit-code level, and prints no corruption diagnostic.
Expected behavior
- The shared arm checks
IsEngineIntegrityFault(E) first: greppable diagnostic to stderr (class + message, mirroring the runner's Integrity fault: prefix), then terminate with exit 70 (docs/contributing/cli-conventions.md already documents 70 as EX_SOFTWARE for this class) using the no-finalization terminate the runner ships (TerminateProcessNow — consider hoisting it from GocciaTestRunner.dpr into a shared unit rather than duplicating the platform bindings).
- Ordinary exceptions keep today's behavior exactly (HandleError, exit 1).
- ADR 0109's "known residual boundary" paragraph is updated to record the closure.
Scope notes
Summary
Extend the engine-integrity-fault abort policy to the shared CLI error handler,
TGocciaApplication.Run(source/units/Goccia.Application.pas), so every GocciaScript binary reports corruption distinctly instead of as a generic failure.Why
ADR 0109 makes integrity faults (use-after-free, invalid dereference, broken heap —
Goccia.EngineFault.IsEngineIntegrityFault) uncatchable by guests, and the test runner aborts on them with a distinct diagnostic and exit 70. But faults raised outside per-file test execution — during startup, module loading, or in any other binary (loader, REPL, bundler, benchmark runner) — still land inTGocciaApplication.Run's genericon E: Exceptionarm and become a plain exit 1 with noIntegrity fault:line. ADR 0109's host-tier section records this as a known residual boundary whose closure "is a change to every CLI binary and belongs to its own decision" — this issue is that decision.Current behavior
TGocciaApplication.Run(~line 63):on E: Exception do HandleError; Result := 1— anEAccessViolationduring, say, engine setup in the loader is indistinguishable from an ordinary script error at the exit-code level, and prints no corruption diagnostic.Expected behavior
IsEngineIntegrityFault(E)first: greppable diagnostic to stderr (class + message, mirroring the runner'sIntegrity fault:prefix), then terminate with exit 70 (docs/contributing/cli-conventions.mdalready documents 70 asEX_SOFTWAREfor this class) using the no-finalization terminate the runner ships (TerminateProcessNow— consider hoisting it fromGocciaTestRunner.dprinto a shared unit rather than duplicating the platform bindings).Scope notes
scripts/run_test262_suite.tstreats loaderexitCode > 1asWRAPPER_INFRAandscripts/test-es-toolkit-validation.tshas a similar> 1pattern — decide whether 70-from-the-loader should be surfaced differently there or whether their classification is already correct for "engine corrupted".