fix(rpc-ts): align RPC wire layer with .NET V5/ExceptionInfo contracts

Batch "rpcwire" fixes from docs/plans/ts-port-audit.md:

- R1: parse V5/V5Compact headers AFTER the argument data (per
  RpcByteMessageSerializerV5), reading argData right after the 4-byte
  length prefix and counting header bytes in bytesRead.
- R2 (D3): send JS errors to .NET peers as RemoteException — TypeRef
  'ActualLab.Serialization.RemoteException, ActualLab.Core' with
  Message "{name}: {message}" from $sys.Error and stream $sys.End.
- R6: unregister mempack6/mempack6c; the resolver now throws a clear
  "MemoryPack formats are not supported by the TS client" error.
- R7 (partial): export readPolymorphismMarker (\0\0 fast path, NullValue,
  derived-type markers throw) as a building block — it is NOT wired into
  arg decoding because TS has no per-argument polymorphism signal (in
  .NET, needsPolymorphism comes from method metadata, not the wire).
  Instead, $sys.Ok/I/B handlers guard on value arity (these calls carry
  a fixed count; marker bytes decode as extra msgpack values), so a
  polymorphic payload now rejects the call / errors the stream with a
  clear "polymorphic payloads are not supported" error instead of
  silently resolving marker bytes as the result.
- R15: key $sys.End error detection on TypeRef presence (fallback to
  Message), carrying the TypeRef's type name into the Error's name.

Adds regression tests for R1 (V5 + V5Compact + headerless + two headers
in a multi-message frame), R2, R6, R7 (marker parsing + arity guards),
R15; removes the temporary ts-port-audit-repro suite.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SDiBQM5rnhyBG1asuP1kDi

Author: alexyakunin

docs/plans/ts-port-audit.md

@@ -414,6 +414,8 @@ Confidence: confirmed. Every failure is pushed to a plain array; only manual `di
 
 ### R1. V5/V5C binary format: header block parsed at the wrong position
 
+Status: **closed** — fixed 2026-07-15 (batch rpcwire; byte-level parity re-verified against the .NET writer, incl. multi-header and multi-message frames).
+
 Confidence: confirmed (byte-level; re-verified).
 
 - TS: `rpc-serialization.ts:293-321` (`deserializeBinaryMessage`) reads the 4-byte argLen, then skips headers, then reads argData. Same in the compact variant at `:473-495`.
@@ -425,6 +427,8 @@ Confidence: confirmed (byte-level; re-verified).
 
 ### R2. `$sys.Error` sent without `TypeRef` permanently hangs .NET callers
 
+Status: **closed** — fixed 2026-07-15 (batch rpcwire, per D3).
+
 Confidence: confirmed.
 
 - TS: `rpc-system-call-sender.ts:152-165` — `error()` sends `[{ Message }]`, no `TypeRef`.
@@ -469,6 +473,8 @@ Confidence: confirmed (code path; failure against .NET verified by its handshake
 
 ### R6. `mempack6` / `mempack6c` registered as MessagePack formats
 
+Status: **closed** — fixed 2026-07-15 (batch rpcwire).
+
 Confidence: confirmed.
 
 - TS: `rpc-serialization-format.ts:239-242, 249-252` — `MemoryPackV6`/`MemoryPackV6C` are constructed as msgpack formats and resolvable via `f=` URL keys.
@@ -479,6 +485,8 @@ Confidence: confirmed.
 
 ### R7. Binary polymorphism markers (`msgpack6`) not implemented
 
+Status: **closed (partial)** — 2026-07-15 (batch rpcwire). Polymorphic payloads now fail loudly ("polymorphic payloads are not supported") via an arity guard on `$sys.Ok`/`I`/`B` value counts, and `readPolymorphismMarker` ships as a verified building block. Actual decoding of polymorphic payloads stays unsupported until TS method metadata gains a polymorphism flag — there is no wire signal to key on (`needsPolymorphism` is .NET-side method metadata).
+
 Confidence: confirmed in code; triggers only for polymorphic types.
 
 - TS: args are encoded/decoded as bare concatenated msgpack values (`rpc-serialization.ts:209-257, 309-321`), no type-marker handling.
@@ -559,6 +567,8 @@ Confidence: confirmed code; failure plausible.
 
 ### R15. `$sys.End` error detection keyed on `Message` truthiness, not `TypeRef`
 
+Status: **closed** — fixed 2026-07-15 (batch rpcwire).
+
 Confidence: confirmed. TS: `rpc-system-call-handler.ts:146-163` — `error = msg ? new Error(msg) : null`. C#: `error.IsNone` = empty `TypeRef` (`RpcSystemCalls.cs:180-187`, `ExceptionInfo.cs:32`). A stream terminated by an exception with an empty `Message` looks like clean completion.
 
 - **Recommended:** key error detection on `TypeRef` presence (fall back to `Message`), and carry the `TypeRef` into the constructed `Error`'s name for fidelity.

ts/packages/rpc/src/index.ts

@@ -22,6 +22,7 @@ export {
     createBinaryEncoder,
     defaultBinaryEncoder,
     defaultBinaryDecoder,
+    readPolymorphismMarker,
 } from './rpc-serialization.js';
 
 export type {
@@ -56,7 +57,7 @@ export {
 } from './rpc-call-tracker.js';
 
 export { RpcCallStage } from './rpc-call-stage.js';
-export { RpcError } from './rpc-error.js';
+export { RpcError, REMOTE_EXCEPTION_TYPE_REF, toExceptionInfo } from './rpc-error.js';
 export { IncreasingSeqCompressor } from './increasing-seq-compressor.js';
 
 export { RpcSystemCallHandler } from './rpc-system-call-handler.js';

ts/packages/rpc/src/rpc-error.ts

@@ -9,3 +9,16 @@ export class RpcError extends Error {
             this.typeName = typeName;
     }
 }
+
+// Assembly-qualified TypeRef of ActualLab's RemoteException — the type every
+// ActualLab peer can reconstruct from a single (string message) ctor. TS uses
+// it whenever it reports a JS error to a .NET peer ($sys.Error, stream $sys.End),
+// folding the JS error name into the message for provenance (see decision D3).
+export const REMOTE_EXCEPTION_TYPE_REF = 'ActualLab.Serialization.RemoteException, ActualLab.Core';
+
+/** Wire shape of .NET `ExceptionInfo` for a JS error sent to a .NET peer. */
+export function toExceptionInfo(error: unknown): { TypeRef: string; Message: string } {
+    const name = error instanceof Error ? error.name : 'Error';
+    const message = error instanceof Error ? error.message : String(error);
+    return { TypeRef: REMOTE_EXCEPTION_TYPE_REF, Message: `${name}: ${message}` };
+}

ts/packages/rpc/src/rpc-serialization-format.ts

@@ -75,9 +75,7 @@ export abstract class RpcSerializationFormat {
     static NewtonsoftJsonV5: RpcSerializationFormat;
     static NewtonsoftJsonV5NP: RpcSerializationFormat;
     static MessagePackV6: RpcSerializationFormat;
-    static MemoryPackV6: RpcSerializationFormat;
     static MessagePackV6C: RpcSerializationFormat;
-    static MemoryPackV6C: RpcSerializationFormat;
     static All: readonly RpcSerializationFormat[];
 
     /** Convenience shortcut for RpcSerializationFormatResolver.Default.get(key). */
@@ -126,7 +124,7 @@ export class RpcJsonSerializationFormat extends RpcSerializationFormat {
 }
 
 /**
- * MessagePack binary format — "msgpack6" / "mempack6" (V5 wire format).
+ * MessagePack binary format — "msgpack6" (V5 wire format).
  */
 export class RpcMessagePackSerializationFormat extends RpcSerializationFormat {
     readonly key: string;
@@ -171,7 +169,7 @@ export class RpcMessagePackSerializationFormat extends RpcSerializationFormat {
 }
 
 /**
- * MessagePack compact binary format — "msgpack6c" / "mempack6c" (V5Compact).
+ * MessagePack compact binary format — "msgpack6c" (V5Compact).
  * Uses 4-byte method hash instead of full method name.
  * Registry is passed via parameters — format instance is immutable.
  */
@@ -236,20 +234,19 @@ RpcSerializationFormat.NewtonsoftJsonV5 = new RpcJsonSerializationFormat('njson5
 RpcSerializationFormat.NewtonsoftJsonV5NP = new RpcJsonSerializationFormat('njson5np');
 // Binary: MessagePack (non-compact)
 RpcSerializationFormat.MessagePackV6 = new RpcMessagePackSerializationFormat('msgpack6');
-RpcSerializationFormat.MemoryPackV6 = new RpcMessagePackSerializationFormat('mempack6');
 // Binary: MessagePack (compact)
 RpcSerializationFormat.MessagePackV6C = new RpcMessagePackCompactSerializationFormat('msgpack6c');
-RpcSerializationFormat.MemoryPackV6C = new RpcMessagePackCompactSerializationFormat('mempack6c');
 
+// The mempack6* formats are intentionally NOT registered: .NET's mempack6 uses
+// MemoryPack argument serialization (a different byte format), which the TS
+// client does not implement. Resolving one throws via isMemoryPackKey below.
 RpcSerializationFormat.All = [
     RpcSerializationFormat.SystemJsonV5,
     RpcSerializationFormat.SystemJsonV5NP,
     RpcSerializationFormat.NewtonsoftJsonV5,
     RpcSerializationFormat.NewtonsoftJsonV5NP,
     RpcSerializationFormat.MessagePackV6,
-    RpcSerializationFormat.MemoryPackV6,
     RpcSerializationFormat.MessagePackV6C,
-    RpcSerializationFormat.MemoryPackV6C,
 ];
 
 // ============================================================
@@ -284,6 +281,9 @@ export class RpcSerializationFormatResolver {
     }
 
     get(key: string): RpcSerializationFormat {
+        if (isMemoryPackKey(key))
+            throw new Error(`Serialization format '${key}': MemoryPack formats are not supported by the TS client.`);
+
         const format = this.tryGet(key);
         if (!format)
             throw new Error(`No format with key '${key}'.`);
@@ -292,6 +292,13 @@ export class RpcSerializationFormatResolver {
 
     tryGet(key: string): RpcSerializationFormat | undefined {
         if (!key) key = this.defaultFormatKey;
+        if (isMemoryPackKey(key))
+            throw new Error(`Serialization format '${key}': MemoryPack formats are not supported by the TS client.`);
         return this.formats.get(key);
     }
 }
+
+/** True for .NET MemoryPack format keys (mempack5, mempack6, mempack6c, …). */
+function isMemoryPackKey(key: string): boolean {
+    return key.startsWith('mempack');
+}

ts/packages/rpc/src/rpc-serialization.ts

@@ -168,6 +168,46 @@ function readVarUint(
 
 // --- Binary helpers ---
 
+// Skips `headerCount` V5 headers (key: L1Memory, value: LVarSpan) starting at
+// `pos`, returning the position past them. The TS client never emits headers,
+// but .NET does (e.g. Activity injection), and per the V5 layout they follow
+// the argument data — so they must be accounted for in `bytesRead`.
+function skipHeaders(data: Uint8Array, pos: number, headerCount: number): number {
+    for (let h = 0; h < headerCount; h++) {
+        const keyLen = data[pos++];
+        pos += keyLen;
+        const valLen = readVarUint(data, pos);
+        pos += valLen.bytesRead + valLen.value;
+    }
+    return pos;
+}
+
+/**
+ * Parses a polymorphism marker (as written by .NET `ByteTypeSerializer`) at
+ * `offset`. The msgpack6 format prefixes every *polymorphic* argument/result
+ * with a 2-byte little-endian length:
+ *   - 0        → expected (non-polymorphic) type — the `\0\0` fast path
+ *   - 1        → NullValue (the value itself is absent)
+ *   - >= 2     → a derived type (2-byte length + 2-byte hash + UTF-8 name)
+ *
+ * Returns how many bytes the marker occupies and whether the value is a
+ * NullValue. Derived-type markers are unsupported by the TS client and throw a
+ * clear error instead of letting the marker bytes corrupt the msgpack frame.
+ */
+export function readPolymorphismMarker(
+    data: Uint8Array,
+    offset: number
+): { bytesRead: number; isNull: boolean } {
+    const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+    const length = view.getUint16(offset, true);
+    if (length === 0)
+        return { bytesRead: 2, isNull: false };
+    if (length === 1)
+        return { bytesRead: 2, isNull: true };
+
+    throw new Error('polymorphic payloads are not supported by the TS client');
+}
+
 function concatUint8Arrays(arrays: Uint8Array[]): Uint8Array {
     let totalLength = 0;
     for (const arr of arrays) totalLength += arr.length;
@@ -290,22 +330,11 @@ export function deserializeBinaryMessage(
     const method = textDecoder.decode(methodBytes);
     pos += methodLen.value;
 
-    // ArgData length as fixed 4-byte LE
+    // ArgData length as fixed 4-byte LE, immediately followed by argData (V5
+    // writes headers AFTER the argument data — see RpcByteMessageSerializerV5).
     const argDataLen = view.getInt32(pos, true);
     pos += 4;
 
-    // Skip headers (if any — TS client doesn't use them)
-    if (headerCount > 0) {
-        for (let h = 0; h < headerCount; h++) {
-            // L1Memory: 1-byte length prefix + key bytes
-            const keyLen = data[pos++];
-            pos += keyLen;
-            // LVarSpan: VarUint length + value bytes
-            const valLen = readVarUint(data, pos);
-            pos += valLen.bytesRead + valLen.value;
-        }
-    }
-
     // Deserialize arguments from argData — multiple concatenated MessagePack values
     const args: unknown[] = [];
     const argEnd = pos + argDataLen;
@@ -317,8 +346,13 @@ export function deserializeBinaryMessage(
         for (const decoded of decoder.decodeMulti(argSlice)) {
             args.push(decoded);
         }
-        pos = argEnd;
     }
+    pos = argEnd;
+
+    // Headers (if any) follow the argument data. The TS client ignores their
+    // content but must skip them so `bytesRead` covers the whole message.
+    if (headerCount > 0)
+        pos = skipHeaders(data, pos, headerCount);
 
     const message: RpcMessage = {
         Method: method,
@@ -470,20 +504,11 @@ export function deserializeCompactBinaryMessage(
         registry?.getName(methodHash | 0) ??
         `<hash:0x${methodHash.toString(16).padStart(8, '0')}>`;
 
-    // ArgData length as fixed 4-byte LE
+    // ArgData length as fixed 4-byte LE, immediately followed by argData
+    // (V5Compact writes headers AFTER the argument data, same as V5).
     const argDataLen = view.getInt32(pos, true);
     pos += 4;
 
-    // Skip headers (if any)
-    if (headerCount > 0) {
-        for (let h = 0; h < headerCount; h++) {
-            const keyLen = data[pos++];
-            pos += keyLen;
-            const valLen = readVarUint(data, pos);
-            pos += valLen.bytesRead + valLen.value;
-        }
-    }
-
     // Deserialize arguments
     const args: unknown[] = [];
     const argEnd = pos + argDataLen;
@@ -492,8 +517,12 @@ export function deserializeCompactBinaryMessage(
         for (const decoded of decoder.decodeMulti(argSlice)) {
             args.push(decoded);
         }
-        pos = argEnd;
     }
+    pos = argEnd;
+
+    // Headers (if any) follow the argument data.
+    if (headerCount > 0)
+        pos = skipHeaders(data, pos, headerCount);
 
     const message: RpcMessage = {
         Method: method,

ts/packages/rpc/src/rpc-stream-sender.ts

@@ -1,5 +1,6 @@
 import { PromiseSource, RingBuffer } from '@actuallab/core';
 import { getLogs } from './logging.js';
+import { toExceptionInfo } from './rpc-error.js';
 import type { RpcObjectId, IRpcObject } from './rpc-object.js';
 import { RpcObjectKind } from './rpc-object.js';
 import type { RpcPeer } from './rpc-peer.js';
@@ -212,7 +213,7 @@ export class RpcStreamSender<T> implements IRpcObject {
         // .NET ExceptionInfo is a non-nullable value type, so we must always
         // emit a valid map shape (empty TypeRef+Message for the "no error" case).
         const errorInfo = error
-            ? { TypeRef: 'System.Exception', Message: error.message }
+            ? toExceptionInfo(error)
             : { TypeRef: '', Message: '' };
         this.peer.hub.systemCallSender.end(
             conn, this.peer.serializationFormat, this.id.localId, this._nextIndex, errorInfo,