@@ -8,6 +8,7 @@ members = [
     "domain",
     "ports",
     "windows",
+    "testkit",
     "core",
     "ffi",
     "core-client",
@@ -19,17 +20,26 @@ members = [
 ]
 
 [workspace.package]
-version = "2.0.0-alpha.3"
+version = "2.0.0-alpha.4"
 edition = "2024"
 rust-version = "1.96"
 publish = false
 
+# The `// SAFETY:` note the `windows/`, `ffi/`, `broker/`, and `ui/` crate
+# headers require on every unsafe block. A Cargo lint rather than a crate-root
+# attribute because it has to reach the integration-test targets too, which are
+# crates of their own; the cost is that every member has to opt in with
+# `[lints] workspace = true`, which testkit/tests/state_rules.rs gates.
+[workspace.lints.clippy]
+undocumented_unsafe_blocks = "deny"
+
 [workspace.dependencies]
 # Internal crates.
 windhawk-core-protocol = { path = "protocol" }
 windhawk-core-domain = { path = "domain" }
 windhawk-core-ports = { path = "ports" }
 windhawk-core-windows = { path = "windows" }
+windhawk-core-testkit = { path = "testkit" }
 windhawk-core = { path = "core" }
 # The raw C ABI transport shared by the bridge and the CLI. Outside the core
 # layering, like the bridge; depends on libloading alone.
@@ -75,9 +85,11 @@ thiserror = "2.0"
 # keeps the last value. default-features off drops the `encoding` feature
 # (encoding_rs); the core feeds the parser &str it decoded itself.
 yaml-rust2 = { version = "0.11", default-features = false }
-# Raw Win32 bindings for the adapter and ffi crates. Pinned to the version other
-# dependencies already resolve to so cargo-deny sees no duplicate. Features are
-# enabled per consuming crate.
+# Raw Win32 bindings for the adapter and ffi crates. Pinned to the version the
+# rest of the tree already resolves to, so the workspace edge adds no version of
+# its own; the Tauri UI and the embed-resource build chain still pull 0.59/0.60,
+# which cargo-deny reports as a duplicate warning. Features are enabled per
+# consuming crate.
 windows-sys = "0.61"
 libloading = "0.9"
 tempfile = "3"
@@ -95,9 +107,9 @@ clap = { version = "4", default-features = false, features = [
 ] }
 # The CLI's Windows console control handler: a safe wrapper over
 # SetConsoleCtrlHandler so the `cli` crate keeps `forbid(unsafe_code)`. On
-# Windows it depends on `windows-sys` ALONE, pinned to the workspace's 0.61 (no
-# duplicate version); the Unix/Apple deps it declares are not pulled for the
-# *-pc-windows-msvc targets the CLI builds for.
+# Windows it depends on `windows-sys` ALONE, resolved to the workspace's 0.61
+# (no version of its own); the Unix/Apple deps it declares are not pulled for
+# the *-pc-windows-msvc targets the CLI builds for.
 ctrlc = "3"
 # The Windows version-resource compiler, a BUILD dependency of the cli and ffi
 # crates. Their build scripts generate a VERSIONINFO .rc from Cargo's version
 
@@ -20,3 +20,6 @@ windhawk-core-client = { workspace = true }
 
 [build-dependencies]
 napi-build = "2"
+
+[lints]
+workspace = true
@@ -16,6 +16,8 @@
 //! This crate deliberately sits outside the core layering: it depends on no
 //! core crate and reaches the DLL only through the C ABI (via core-client).
 
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used))]
+
 #[macro_use]
 extern crate napi_derive;
 
@@ -32,8 +34,9 @@ fn napi_err(message: impl Into<String>) -> napi::Error {
     napi::Error::from_reason(message.into())
 }
 
-/// Load windhawk-core.dll and resolve its exports. The ABI version is checked
-/// in core-client: the bridge refuses to run on a mismatch.
+/// Load windhawk-core.dll and resolve its exports. core-client checks the ABI
+/// version - the bridge refuses to run on a mismatch - and refuses a path that
+/// is not fully qualified, so the caller passes an absolute one.
 #[napi]
 pub fn load_core(dll_path: String) -> napi::Result<CoreLibrary> {
     let inner = ClientLibrary::load(&dll_path).map_err(|e| napi_err(e.to_string()))?;
@@ -156,9 +159,9 @@ impl Task for InvokeTask {
 #[napi]
 impl CoreSession {
     /// Synchronous core command, executed off the JS thread; resolves with the
-    /// raw response envelope JSON. Fails fast (synchronously) if the session
-    /// was already destroyed, so a use-after-destroy throws rather than
-    /// rejecting later.
+    /// raw response envelope JSON. A session already destroyed throws here,
+    /// synchronously; one destroyed between this check and the worker picking
+    /// the task up rejects the promise instead.
     #[napi(ts_return_type = "Promise<string>")]
     pub fn invoke(&self, request_json: String) -> napi::Result<AsyncTask<InvokeTask>> {
         if self.inner.is_destroyed() {
 
@@ -43,3 +43,6 @@ windows-sys = { workspace = true, features = [
     "Win32_Security_Cryptography",
     "Win32_Foundation",
 ] }
+
+[lints]
+workspace = true
@@ -86,6 +86,12 @@ pub trait BrokerHandler: Send + Sync + 'static {
     /// dead channel.
     fn oversized(&self, id: u64, bytes: usize, cap: usize) -> Self::Response;
 
+    /// Build the response that reports a [`handle`](Self::handle) that panicked.
+    /// A panic is a bug rather than a way to fail a request, but it is a bug in
+    /// one request's serving, and the requester is parked on an id only this end
+    /// can answer.
+    fn panicked(&self, id: u64) -> Self::Response;
+
     /// A push too large to put on the wire was dropped. A push answers no
     /// request, so there is nothing to fail; the default is to say nothing.
     fn push_dropped(&self, bytes: usize, cap: usize) {
@@ -105,6 +111,12 @@ pub trait PushSink<Push>: Send + Sync + 'static {
     /// The channel ended: no further push will arrive and every request in
     /// flight has been failed. Called exactly once.
     ///
+    /// The close comes FIRST: by the time this runs the channel already reports
+    /// closed to everyone else (`Requester::is_open`) and refuses new requests.
+    /// So the signal is not the only way to learn of the loss, which is what lets
+    /// a caller that was not yet in a position to act on the one signal it gets
+    /// find out by asking instead.
+    ///
     /// The same hand-off rule applies, and this is the harder place to keep it:
     /// whatever a caller wants to do about a lost channel - unwind the work that
     /// was in flight, put a notice in front of the user, fall back to some other
 
@@ -30,6 +30,7 @@
 // the `ui` crate took: deny unsafe operations outside an `unsafe` block, keep
 // unsafe confined to `pipe.rs` and `security.rs`, and carry a `// SAFETY:` note
 // on every block. The rest of the crate is safe.
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used))]
 #![deny(unsafe_op_in_unsafe_fn)]
 
 mod frame;
@@ -43,15 +44,15 @@ mod version;
 pub use frame::{FRAME_HEADER_BYTES, FrameError, decode, encode, read_frame, write_frame};
 pub use handler::{BrokerHandler, Disposition, PushSink, RequestFrames, Routed};
 pub use pipe::{
-    Event, PipeReader, PipeStream, channel_name, connect_flags, listener_open_mode,
+    Event, PipeReader, PipeStream, WriteError, channel_name, connect_flags, listener_open_mode,
     listener_pipe_mode,
 };
 pub use requester::{
     AcceptError, AcceptTerms, ChannelError, Handshaken, Listener, Rejection, Requester,
 };
 pub use responder::{ConnectError, Connection, PushQueue, Pusher, Responder, connect, push_queue};
 pub use security::{
-    Accepted, ClientPeer, Integrity, PeerPolicy, PipeSecurity, RejectReason, SelfIdentity,
-    ServerPeer, identify_client, identify_server,
+    Accepted, ClientPeer, Integrity, PeerIntegrity, PeerPolicy, PipeSecurity, RejectReason,
+    SelfIdentity, ServerPeer, identify_client, identify_server,
 };
-pub use version::{ChannelConfig, Handshake};
+pub use version::{ChannelConfig, HANDSHAKE_FRAME_CAP, Handshake};