[minggangw]

Summary

Keep callback dispatch fail-fast while preventing stale entity access,
ensuring exception-safe resource cleanup, and fixing the exit-time crash
exposed by ASan/LSan.

Changes

• Invalidate ready batches when nodes stop or are destroyed, including immediate stop/restart sequences.
• Skip destroyed event handlers and recheck action entities between successive ready events.
• Release raw ROS messages, action-expiration buffers, and retired handle references through finally blocks.
• Document callback exception behavior for spin() and spinOnce().
• Shut down all live contexts on process exit before native library teardown.
• Add regression coverage for callback errors, entity destruction, stop/restart, and default/custom context cleanup across exit paths.
• Include child-process termination details and captured output in unhandled-callback test failures.

Fix: #1667

[Copilot]

🟡 Changes recommended

Continued dispatch can still access released event handlers because the ready-event loop does not recheck their destruction state.

1 open issue

• Skip destroyed events before taking data · New

What changed in this PR

This PR improves executor error recovery by preserving valid ready callbacks after failures while preventing stale batches from continuing after node shutdown or restart.

Changes:

• Collect callback errors and report them after processing the valid batch.
• Invalidate stopped batches, recheck action lifetimes, and release temporary native resources through finally blocks.
• Document error reporting and add regression tests for recovery, lifecycle boundaries, and cleanup.

File	Description
types/​node.d.ts	Documents batch callback error reporting.
test/​test-spinning.js	Adds error recovery, lifecycle, and resource cleanup tests.
lib/​node.js	Implements guarded dispatch, error aggregation, and cleanup.

_{Review effort: Balanced}

[coveralls]

coverage: 91.177% (+0.01%) from 91.164% — minggangw:fix/executor-ready-batch into RobotWebTools:develop

[Copilot]

🟡 Changes recommended

The regressions do not cover expiration-processing failures, leaving unverified that GoalInfoArray.freeArray runs exactly once and the original exception propagates.

1 open issue

• Add regression test for cleanup when expired-goal processing throws · New

1 resolved since last review

• Skip destroyed events before taking data

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Exception-path regression coverage is missing for expired-goal cleanup, including verification that failures in actionExpireGoals and processGoalExpired call freeArray exactly once and propagate the original exception.

1 open issue

• Add regression test for cleanup when expired-goal processing throws

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The exit hook shuts down live contexts before destruction, causing DestroyContext() to skip finalization and leak native allocations.

2 open issues

• Finalize contexts even after shutdown to prevent native allocation leaks · New
• Add regression test for cleanup when expired-goal processing throws

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The non-removable exit listener shuts down contexts before application exit handlers, causing final synchronous publishes to use released publisher handles and leaving no supported opt-out.

3 open issues

• Make the process exit handler removable for custom shutdown ordering · New
• Finalize contexts even after shutdown to prevent native allocation leaks
• Add regression test for cleanup when expired-goal processing throws

_{Review effort: Max}