Flash-Engine 0.5.1

Bugfix release: eight verified findings from the post-0.5.0 security/reliability/tooling audits — all confirmed against the source, fixed, and verified in a real release FXServer (full selftest suites green).

SDK (Flash.Sdk)

• StateWatcher: [FromSource] parameters with unsupported types are now rejected at registration (fail fast, like the event router), and dispatch catches reflection-layer exceptions — a bad watcher signature can no longer crash the script thread. Registries are additionally serialized under a lock against off-thread change-callback races.
• Exports: Exports.Register/Exports.Call assert the script thread and fail fast off-thread (consistent with Rpc.Client and the DB layer) instead of racing the registry.
• Attribute routers: RegisterAll(typeof(X)) now works for static/utility classes across all four routers (Commands/Events/Exports/StateWatchers) instead of silently registering nothing; annotated instance methods without an instance are rejected with a clear error.

Native core / component (new payload)

• Spatial grid: empty cells are fully torn down on removal — fixes unbounded empty-cell accumulation (slow memory creep) on long-running servers.
• Object-return native invoke: argument counts outside 0..32 are rejected up front instead of reading past a 32-slot stack buffer (out-of-bounds stack read).
• Runtime lifecycle: the active runtime handle is reset on resource destroy, so the core is never left pointing at a freed runtime (use-after-free).

Tooling (Flash.LuaDefGen)

• ValueTask/ValueTask<T> returns are documented like Task/Task<T> instead of table; generic methods get correct compiler doc-IDs so overloaded generic exports keep their XML docs; the assembly resolver no longer crashes under single-file publish.

Compatibility: Flash.Sdk 0.5.1 (NuGet) · core contract v12 · FXServer artifact pin 31689 — unchanged. The payload zip contains the rebuilt component + host; install/update via tools/install-flash.ps1.

🤖 Generated with Claude Code