Mark ROADMAP 2.1 and 2.2 as DONE — both are fixed, tested, and documented

Start in ROADMAP.md at §§2.1 and 2.2, then check the cited implementations in lib/message.js, lib/dbus-buffer.js, index.js, and the coverage in test/message-framing.js and test/errors.js. Compare the status with docs/api.md's handlerError documentation; done means both roadmap sections clearly show DONE and point to the shipped protections and behavior.

• Priority rationale: ROADMAP still headlines "a hostile peer can crash the process" for hardening that has shipped; a contributor picking work from it would redo (or distrust) a finished section
• Possible duplicate: none (checked gh issue list -R sidorares/dbus-native --state all --limit 200 --search "ROADMAP")

Summary

ROADMAP.md marks finished items with — DONE (2.3–2.7, 2.9 all carry it), but §2.1 "Harden the read loop against malformed input" and §2.2 "Isolate user handlers from the read loop" do not — and at 0.15.1 every bullet in both sections is implemented, has tests, and is documented in docs/api.md. The two sections still open with "Severity: high — a hostile or buggy peer can crash the process" and "an ordinary application bug kills the process", neither of which is true anymore.

Evidence

Checked at 0.15.1 (commit 147c145), bullet by bullet against §2.1:

And §2.2: dispatch is wrapped at lib/message.js:185-190 — a throw from onMessage goes to the onHandlerError callback instead of unwinding through the parser — and index.js:284-297 turns that into the 'handlerError' event, preserving Node's crash default (via process.nextTick rethrow) when nobody listens. This is public, documented behaviour: docs/api.md's connection-events table lists handlerError ("an exception thrown by one of your message/signal listeners", api.md:1046) and distinguishes it from 'error'. Tests cover both sections: test/message-framing.js (framing, size limits, ProtocolError) and test/errors.js.

For contrast, §2.8 in the same file was updated in place when its status changed ("Scoped 2026-07-29… DONE, and further than planned"), so §§2.1–2.2 read as if they are the two remaining live hazards in the wire layer.

Proposed fix / API

Append — DONE to both headings and a one-line pointer each, in the style §2.9 uses ("Landed in #312"): for §2.1 name the size cap, align8, the unmarshall guard, readString, and fail(); for §2.2 name onHandlerError/'handlerError' and the nobody-listening rethrow. Optionally strike the two "Severity: high" lines, since the text beneath them is now history rather than a finding.

Impact

Anyone triaging what to build against the library reads these two sections as open high-severity holes in the read path — the exact opposite of the current state, where malformed-input handling is one of the better-tested parts of the package. Cheap fix, misleading while it lasts.

References

• ROADMAP.md §§2.1, 2.2, 2.9 at 0.15.1
• docs/api.md "Events" table (error vs handlerError)