BRO-035: streaming bro — resident producer, pipe protocol, hunks via mmap log

Now: OPEN

Input

Context

Ruling thread (gritzko 2026-07-18): bro renders gradually as hunks arrive. JS is 1 process, so the verb runs in a SEPARATE producer process; hunks go into a shared mmap log; a pipe carries the line protocol. The hunk substrate is already stream-shaped (HUNKcb one-at-a-time, TLV framing, sink rows) — only the plumbing is batch today (sink collected in full, pager blocked around the verb call).

Producer is warm-resident (VM boot + require + store open paid ONCE at bro launch), the serve.js resident-daemon pattern.
Fast path: io.fork() of the already-warm pager process — probe 2026-07-18: this musl JSCOnly jab runs Threads: 1 (no JIT/GC helpers), fork-safe. macOS/system JSC is multithreaded + CF-hostile → spawn fallback.

Goals

Pager sends a request, paints arriving hunks incrementally, stays responsive throughout.

Pipe protocol (line-oriented, hand-debuggable, ONE request in flight):
1. >>> //context verb args — the addr-bar form (BRO-024 prompt minus the colon), argline/spell escaping, no new grammar;
2. <<< hunk OFF LEN — one line per committed hunk, byte offset+length into the log (no ordinals, no scanning; the line IS the commit publish);
3. <<< ok N / <<< err CODE — terminator with tally or error code (bar prints the tally / flips red with CODE);
4. next >>> only after the terminator; abort = kill+respawn (a cancel line is a later nicety).
Mmap log: file-backed MAP_SHARED (memfd/unlinked temp — session scratch, not a store artifact), append-only, one region per request; large sparse reserve up front (no re-mmap); single-writer single-reader, bytes-before-publish ordering (the pipe line publishes).
Log content ruling (gritzko 2026-07-18): TLV hunks, NOTHING else — back-to-back dog/HUNK.h 'H' records (T ts / V verb / U uri / X text / K toks), the same bytes --tlv emits; no headers, no markers, no other record kinds, no new serialization. The reader drains with the libdog-specified validation (HUNKTOKLEN/HUNKTOKOOB shape) so a torn/in-flight record rejects instead of corrupting the render.
Log virtues to keep: the log IS the scrollback (seek/jump/re-render without re-running), crashed producer leaves a readable prefix, no backpressure needed (writer never blocks; pipe lines are tiny).
Pager side: pol watches the pipe fd (no polling timers); append-tolerant views paint as hunks land; sort/total views (status quad, spot dedup) repaint in place at the terminator; BRO-034 yellow bar = stream open, normal at ok, red at err.

Constraints

Producer lifecycle: spawn/fork at bro launch, respawn on death (worst case one cold load); child closes/never touches the pager tty, writes ONLY its log region, exits via _exit.
io.fork() is a NEW binding (io.cpp, alongside spawn/spawnFds/reap) gated by a threads==1 check (/proc/self/status) at fork time — a future JIT build must fail the gate, not corrupt; spawn (io.spawnFds + shared file / memfd) is the portable path, SAME protocol, pager agnostic.
Verb contract intact: producer resolves (context, args) via the verb layer / resolve_hash; the pager stays arg-blind and never parses hunk bodies.
pty legs per the standing rule: incremental paint mid-grind (slow verb), terminator repaint, err path, producer-crash respawn.

WIP

Design decisions

(pending)

TODOs

io.fork binding + threads==1 gate; io.reap wiring
producer main: read >>> lines, run verb with sink → log appends + <<< lines
log writer/reader: TLV 'H' framing, sparse reserve, per-request regions
pager: pol on pipe fd, incremental paint, terminator repaint, BRO-034 bar states
spawn fallback leg (same protocol, cold producer) + macOS note
pty legs: mid-grind paint, ok/err, crash-respawn

Blockers and bummers

BRO-034 (yellow bar) is the visible-state half — land it with or before this.

Outcome

(pending)