[EricAndrechek]

Hold: this lands with the next v2 spec batch, not on its own (the lead's ruling). It is prose and one rule label, so it moves no fingerprint by itself.

What

A new generation-2 rule, (r8) No input crashes the process, normative for the library, in spec/abi-v2/docs.md's Rules section:

• No input to any call (an expression, a statement, a type, a settings/options/columns JSON, a body, a server profile) may terminate, abort or corrupt the calling process. An input the library can't handle is CHS_REJECTED, CHS_DECLINED or CHS_INTERNAL.

• A ClickHouse LOGICAL_ERROR, a failed assertion or a stack running out inside a call is CHS_INTERNAL, never an abort. Where the stack check applies, it is CHS_REJECTED 306, as the status list already says.

• A crash ranks with a filter over-accept: a security-severity defect, never documented as behaviour. Until it is fixed, the shape is declined, with a catalog entry.

• The exceptions, exactly:

  • misuse the ABI already forbids: a free overlapping a call on the same handle; a call outside its thread class (two chs_initialize calls at once, process_once); use after free; unloading, or initializing again after chs_shutdown;
  • memory exhaustion outside the admission budgets;
  • signals from outside the process.

  A second chs_initialize with a different spelling, made after the first returns, is NOT an exception: the spec already makes it CHS_INVALID_ARGUMENT, and r8 holds for it.

Also in this PR:

• scripts/abi-v1/model.py: GENERATION_RULES gains r8, so gen.py --check refuses a Rules section that drops it.
• The rule count is updated where it is written: the preamble's "(r1 to r8)", the reference's "eight rules", and the note that r8 is the library's behaviour.

Measured

• Fingerprint unchanged: sha256:d60a681ea0e249ab9e2c83b50640ad9cef040261ddf61805106c93e2c68774e4.
• include/v2/chtypes.h: a509580c… → 1e707565fbe5c1882220cb19418ad79e5df0babbdf19d7761cb4e4bce0e1cc3c. Only the preamble line moves.
• Gates, each exit 0:
  • gen.py --selftest;
  • --major 2 --check and --major 1 --check;
  • check-no-hand-decls.py --scope all;
  • lint-spelling and lint-cited-paths;
  • markdownlint-cli2@0.18.1 (52 files, 0 errors) and dprint@0.57.4 check;
  • lint-public (run last): ok — no pointers into the private repository, its private notes, or a local filesystem.

🤖 Generated with Claude Code

[EricAndrechek]

Landing checklist (handoff 2026-10-13; #633 item 5):

1. Trigger: this lands with the next spec batch (SPEC-BATCH-2), per the maintainers' ruling. It isn't merged on its own.
2. Base-merge v2 and regenerate (scripts/abi-v1/gen.py --major 2 --write, then --check). v2 spec: an expression the INSERT evaluates never sees the schema's own settings #632 also moves include/v2/chtypes.h. If the spec batch's own PR edits the Rules section, fold r8 into it instead.
3. The exception list is deliberate. A second chs_initialize with a different spelling, made after the first returns, is NOT an exception: the spec already makes it CHS_INVALID_ARGUMENT. Only concurrent chs_initialize calls, which break process_once, are listed.

[EricAndrechek]

Superseded by #655 (spec batch 2). The maintainers ruled that full crash containment is a later generation's guarantee. So the v2 spec's r8 now documents a known-crash list instead of promising that no input crashes the process: a matching schema or filter is declined at create with known-crash-declined, naming the matched rule.