docs(code-runtime-python): correct the claims the new backend invalidated

Adding a published Python backend and reordering `flush_line` left several
owning documents stating things that are no longer true.

`src/invariant.ts` justified its empty installer with "ships only the fd-3
wire-protocol codec", which the subprocess execution path contradicts. The
reason now states the actual one: every relation this backend maintains lives
in the CPython child or on the fd-3 wire, so no same-process event sequence is
observable from a listener -- the same shape the sibling worker-thread backend
uses.

The seam's `PORTABLE_RESERVED_WORDS` and `language` JSDoc, the code-runtime
README pair, and docs/subsystems/code-runtime both said only TypeScript has a
published backend. Corrected in all four, with the generated cordis catalog
regenerated for the `language` change.

The note attributed the 12x multiple to the settlement flush holding three
copies. That stopped being true when `flush_line` was reordered to drop the
pending chunks before its push: the binding worst case is the newline path's
single near-budget write. Corrected in the note (both sides) and in the test
comment that repeated it.

The note's Testing section now registers the cases this stack added, and the
Chinese side receives the O(depth) entry it never got plus the new ones -- it
had drifted from the English.

`INTERPRETER_BASELINE_BYTES` argued 64 MiB from a RESIDENT set while RLIMIT_AS
bounds address space. It now cites the bootstrap's own measurement (30.23 MiB
of mappings for `python3 -I`), making 64 MiB roughly twice the measured
baseline.

Also: a hardcoded `(:232-235)` comment reference becomes a reference by name,
a "which now walks in O(depth) too" change narrative becomes a current-state
statement, and a stray double blank line is removed.

packages/code-runtime/code-runtime-python/src/index.ts

@@ -266,13 +266,16 @@ const OUTPUT_BUDGET_WORST_CASE_ADDRESS_SPACE_MULTIPLE = 12
  * multiple claims the rest. The budget check subtracts this from `addressSpaceMb`
  * so a budget sized right at `addressSpaceMb / MULTIPLE` — which the multiple
  * alone would admit — cannot leave the peak output allocation plus the
- * interpreter over the limit. 64 MiB is generous for a `python3 -I` process
- * whose own resident set is tens of MiB; the value is a fixed safety margin, not
- * a deployment knob.
+ * interpreter over the limit. Sized against ADDRESS SPACE, which is what
+ * `RLIMIT_AS` bounds, not resident set: the bootstrap's own measurement is
+ * 30.23 MiB of mappings for a `python3 -I` child (see `_make_cpu_enforcer`,
+ * which also records the 64 MiB glibc per-thread arena reservation that pushes
+ * it to 102.37 MiB when threads are used). 64 MiB is roughly twice the measured
+ * baseline, leaving room for allocator arenas and import jitter. The value is a
+ * fixed safety margin, not a deployment knob.
  */
 const INTERPRETER_BASELINE_BYTES = 64 * 1024 * 1024
 
-
 /**
  * Interval between process-group liveness probes while settlement waits for an
  * escalated SIGKILL to empty the group (see the `killing` branch in
@@ -794,6 +797,14 @@ export class PythonCodeRuntime extends CodeRuntime {
     // peak plus the reserved baseline is the whole address space, the RLIMIT_AS
     // edge. `ceil(budgetableBytes / MULTIPLE) - 1` is the last integer strictly
     // under `budgetableBytes / MULTIPLE`.
+    // Reject a too-small address space on its own terms FIRST. Once
+    // `budgetableBytes` is zero or negative no budget can pass, and the loop
+    // below would report "a limit of -1" (or -2796203 at addressSpaceMb 32) while
+    // naming `maxLogBytes` -- pointing the operator at the knob that is not the
+    // problem. The baseline is what `addressSpaceMb` must clear here.
+    if (budgetableBytes <= 0) {
+      throw new Error(`dsh-code-runtime-python: config.addressSpaceMb must exceed the ${INTERPRETER_BASELINE_BYTES}-byte interpreter baseline with room for the output budgets, so the child has address space left to build and encode them; got ${String(this.config.addressSpaceMb)} MiB (${addressSpaceBytes} bytes)`)
+    }
     const admissibleBudget = Math.ceil(budgetableBytes / OUTPUT_BUDGET_WORST_CASE_ADDRESS_SPACE_MULTIPLE) - 1
     for (const key of ['maxLogBytes', 'maxValueBytes'] as const) {
       if (this.config[key] * OUTPUT_BUDGET_WORST_CASE_ADDRESS_SPACE_MULTIPLE >= budgetableBytes) {

packages/code-runtime/code-runtime-python/src/invariant.ts

@@ -15,9 +15,11 @@ export const name = 'code-runtime-python-invariant'
 export const inject = ['invariants']
 
 /**
- * No runtime invariant: this package ships only the fd-3 wire-protocol codec and its Python mirror,
- * exposing no runtime event sequence or mutable data relation; `protocol.spec.ts` and
- * `protocol-mirror.e2e.ts` cover the protocol's behavior.
+ * No runtime invariant: every relation this backend maintains — frame ordering, budget accounting,
+ * and process teardown — lives in the CPython subprocess or on the fd-3 wire, so no same-process
+ * event sequence or mutable data relation is observable from a Cordis listener. `protocol.spec.ts`,
+ * `protocol-mirror.e2e.ts`, and the real-subprocess `runtime.spec.ts` cover that behavior, matching
+ * the sibling process-boundary backend `@deepseek-ai/dsh-code-runtime-worker-thread`.
  */
 const install: InvariantInstaller = () => {}