Jia Sui
4fde941291
只接 std::exception 的话，第三方库或跨 FFI 边界抛出来的东西照样会逃出 main 走 abort， 和上一个 commit 修掉的是同一类故障：ctest 看不到原因，栈也不展开。引擎内现有的抛出确实 都是 std::exception 派生，但这一层缺的是「无论什么异常都到不了 terminate」的保证，补上它 才让 main 的边界真正闭合。 只加 catch 分支，输出通道沿用各文件原来那一个（fprintf / cerr / fmt::println）， 不改任何断言。
WebView messages
messages.json owns the message envelope, payload shape, and allowed sender windows.
Change it here, run python3 generate.py, and re-sync the copy under ui-html/ in the same
commit. The generated TypeScript union and embedded C++ schema must pass generate.py --check.
runtime.js and validator.h implement the documented schema subset and run the same
fixtures.json compatibility cases. The standalone CMake test requires Boost.JSON;
the input engine itself does not acquire that dependency.
New messages carry protocolVersion: 1. A missing version is accepted as legacy v1
for existing skins; an explicit unknown version, unknown message, invalid payload,
or message sent from the wrong window is rejected before dispatch. This is envelope
validation, not a replacement for domain checks such as dictionary key validation,
allowed configuration values, or the host's HTTPS URL policy.
ui-html/scripts/sync-contracts.py materializes these bindings into
ui-html/webview2/shared and checks byte equality; CI runs it with --check, which
now compares against this directory directly rather than against a pinned submodule.
Settings imports the typed serializer and checks incoming messages. Classic candidate,
toolbar and menu pages load the same runtime from the host's https://msime-contracts/
virtual mapping; packaging must include webview2/shared.
Server-to-page candidate rendering currently uses the existing view functions; this contract covers WebMessage actions and settings responses. Candidate view model ownership is documented separately from transport envelopes.