[JC-000]

Fixes #209
Fixes #247 (item 1)

Stack: #254 → #257 → #256. This PR is based on #254's branch, so its diff is only #209. GitHub retargets it to master when #254 merges.

Design

rig_https_local (and the print_body/p384 wrappers that run its main()), rig_https_live and rig_https_bad_finished now allocate their scratch from page 3, $0334-$03FF (204 B), through _memory_policy.build_policy_and_low_ram_arbiter. That window is outside every segment the link lays out, so a CRYPTO_OVERLAY reshuffle can no longer take it away.

• Allocations are sized to what is written: routine 117 B (measured at address 0, since every operand is absolute), host 32 B (64 on live), path 8 B, and one 3-byte sentinel+progress+carry block. The poll reads that block as one 2-byte read, and three separate allocations had only been adjacent by first-fit luck. After the rebase onto rig_https_local / rig_https_bad_finished start the listener before taking the DeviceLock, so a queued run's ACCEPT_TIMEOUT expires #246 the routine is built only once the lock is held, and it is asserted to match the length allocated before the lock.
• c64-test-harness withholds its own page-3 writers from the arbiter. The window is allocated raw only against the 5 writers audited as never called from tools/uci, and a test pins that audit. It now ignores a script's own local helper of the same name (rig_close_retry's opcode-emitting jsr). Any new harness page-3 writer makes the allocation fail instead of being overridden.
• rig_https_live's default SENTINEL_POLL_TIMEOUT goes from 300 to 900 s.

Why page 3 is quiet while the trampoline runs

• Link. Every memory area in cfg/c64-https-uci*.cfg (re-checked on 8aa1a49) starts at or above $07FF (LOADADDR); the only ones below are ZP_CRYPTO $22-$3F and ZP_WIDE $40-$7F. The one symbol that labels.txt puts in page 3 is cassette_buf = $0334, an equate in libs/nistcurves/src/constants.s. It is absent from build/c64-https.map (the map lists only exports that something imports), and no source in src/ or the two libs references it. Grepping src/, libs/nistcurves/src and libs/x25519/src for $0300-$03FF finds only protocol constants and a comment.
• KERNAL. Of the KERNAL, our code calls only CHROUT ($FFD2, screen) and GETIN ($FFE4, keyboard); nothing calls SETLFS/OPEN/LOAD. The rig drives BASIC through the keyboard buffer ($0277, $C6) and SYS. $033C-$03FB is the datasette buffer, which only tape I/O uses, and $0334-$033B and $03FC-$03FF are unused by the KERNAL. The window starts just above the $0314-$0333 vectors. RAMTAS clears pages 2-3 at reset, which is why the rigs write their scratch after the load and the BASIC return.
• Runtime. On hardware the trampoline at $035F/$037F ran the whole handshake and GET and came back to write its sentinel. A page-3 byte overwritten mid-run would have left the sentinel unset or crashed the return.

Red-green

• tools/test_rig_scratch.py (new, in testpaths) runs each rig's main() on a uci-comb labels fixture up to the DeviceLock. Against rigs: listener after the lock, socket-teardown guard, banner handshake stop (#246 #234 #247) #254's rigs, 4 of 7 fail, three of them with uci-comb has no offline handshake rig — rig_https_local cannot allocate scratch on it #209's error (MemoryArbiter.alloc(size=256 ...) found no free range). On this branch all 7 pass.
• test_the_window_is_page_three pins LOW_RAM_SCRATCH to (0x0334, 0x03FF); widening it to 0x04FF fails it. test_each_rig_fits_routine_and_data_in_the_window checks routine + host + path + 3 markers against the window for the local, bad_finished and live rigs; setting HOST_STR_BYTES to 128 in local or bad_finished fails it (over the 204 B window: {...: 256}).
• Bare pytest on the stack top (uci-comb build): 346 passed, 1 failed. The failure is the same ip65-build-only exports test as on master.

Hardware (U64E 10.43.23.81, fw c47155b7, via DeviceLock), on the stack top 42e32a0 (#256, which contains this PR)

• rig_https_live on uci-comb PRG ed681de15314565f69325c918e621e6a0bd3ebe8af140d1bc7d9a46160e8315d (BACKEND=uci USE_NISTCURVES_ONCHIP_COMB=1, default target): HTTPS_TARGET=lwn.net gave PASS: HTTP 200, carry 0, tls_reached_connected=CONNECTED, trampoline at $037F, CFIN at 43.7 s.
  • The same image against the default github.com returned carry 1 after a completed handshake (latch CONNECTED, HTTP 200, 01,CONNECTION CLOSED BY HOST mid-body). That is rig_https_live against github.com fails ~1 run in 3 on the U64E, on master as well as on branches #147's github-side cut, and returning C=1 there is the correct client behaviour. The trampoline worked on that run too.
  • The pre-rebase github "PASS" in this PR's earlier body was on a pre-http: 24-bit chunk size, saturating on overflow (#147) #252 tree. http: 24-bit chunk size, saturating on overflow (#147) #252 found that 16-bit chunk sizes made github passes on such trees unreliable, so do not count it.
• rig_https_local on uci-onchip PRG c698b8c0cc535ec978a7ccaac4efe1627da45fb7a9c11625d41821f86153bf30 (HTTPS_SNI=www.foo.invalid) PASSED with no ACCEPT_TIMEOUT override. Scratch: markers $0334-$0336, host $0337-$0356, path $0357-$035E, trampoline $035F-$03D3.
• Pre-rebase (cf89a98): rig_https_local and bad-mode rig_https_bad_finished on uci-comb aedf8f5a… both PASSED.

Not proven / out of scope

• Nothing ran on a C64U. The 900 s default has not been exercised to completion on a large body.
• rig_close_retry (uci: close retry (#243), EOF closes the socket state, -1 write fails the send #253) still carves its scratch from the overlay tail. Its 296 B routine does not fit the 204 B window, and it is not one of the three rigs uci-comb has no offline handshake rig — rig_https_local cannot allocate scratch on it #209 names.

🤖 Generated with Claude Code