[mremond]

Why

A huge binary:copy/2 request could abort every process instead of notifying its monitoring parent.

What changed

• Oversized results and refused reservations raise catchable system_limit errors.
• Valid copies account for output work and yield between bounded chunks.
• Invalid arguments raise badarg even for empty results; unsigned machine-word counts accept boxed integers.

Before and after

Before: The original overflow ended the whole program with exit 134 before its parent could receive DOWN.

After: The overflow now delivers DOWN with system_limit; copying yields in chunks of at most 65,536 output bytes.

This changes native program behavior, not an on-screen view; execution transcripts demonstrate error delivery and cooperative copying.

Checked

Live validation: Demonstrated for this version. 4 of 4 scenarios driven live in the product.

Scenario	Result	Evidence
Monitored oversized requests and allocator refusal	✅ Passed live	Each native child delivered DOWN with system_limit, and the parent continued.
OTP-compatible arguments, errors and copied bytes	✅ Passed live	Ten consecutive runs per selected native mode and OTP 29.1.2 entry reached the fixture's completion marker.
Observer progress during large and repeated copies	✅ Passed live	Strict single-scheduler ordering passed ten consecutive native and OTP runs; runtime tests observed partial output.
Cancellation of a one-byte subject repeated 2^46 times	✅ Passed live	The native parent cancelled the child on one scheduler, received DOWN and completed an ordinary copy.

• Full local project gate on macOS arm64: Release builds, strict lint, 2,163 Rust tests and 489 Erlang tests passed; one Rust test was ignored and two Erlang fixtures were skipped.
• Five new runtime regressions, ten consecutive runs: Sizing, output reduction charges, GC-safe resumption, output adoption, cleanup and partial-copy scheduling passed.
• Existing codec scheduling and cross-object journeys: Codec observers progressed; macOS x86_64 and Linux aarch64 object checks passed.
• Independent review of all changed files: No actionable correctness, safety, performance or simplification issues.

How it was checked

cargo build --release --locked -p nera-runtime; cargo build --release --locked: passed.

cargo clippy --workspace --all-targets --locked -- -D warnings: passed.

cargo test --workspace --locked --no-fail-fast: 2,163 passed, zero failed, one ignored.

python3 scripts/test-allocator-config.py: passed.

./target/release/nera test -j 1 --timeout 30: 489 passed, zero failed, two documented skips.

python3 scripts/test-stacktrace-order.py: passed.

cargo test --locked -p nera-runtime ffi::binary_ops::copy:: -- --nocapture: five tests passed ten consecutive runs without retries.

Native copy fixtures ran ten times per selected scheduler mode; the same entries passed ten times on OTP 29.1.2.

python3 scripts/test-base64-scheduler.py: existing encode, binary-decode and list-decode scheduling journeys passed.

scripts/test-cross.sh passed for x86_64-apple-darwin and aarch64-unknown-linux-gnu; these are object checks, not target-native runtime validation.

Risk

Risk above low: Novelty, medium — New repetition state reuses the existing cooperative binary-work adapter.

Full risk assessment

Dimension	Level	Why
Blast radius	low	Changes only binary:copy/2 and the native-work trait documentation.
Behavior	low	Corrects aborts, missing reduction charges and argument error handling.
Undo	low	Reverting the commit restores the previous implementation.
Evidence	low	Native monitored errors, cancellation and repeated OTP comparisons passed.
Sensitivity	low	No credentials, settings, releases or saved data change.
Novelty	medium	New repetition state reuses the existing cooperative binary-work adapter.
Dependencies	low	No dependency changes.

Not done

Allocation and garbage collection remain synchronous; successful reservation does not prevent operating-system out-of-memory termination.

Native Windows and Linux aarch64 runtime execution are not established by these local checks.

Pipeline

Updates from git push no-mistakes

Infinitary checked this version: an independent review that also judged the documents, and live validation the review accepted.