Native flood latency budget fails on dev #197
Open
opened 2026-10-12 20:01:27 +00:00 by kayg
·
334 comments
No Branch/Tag specified
main
j470b-server-mesh-rejoin
mesh-compat-382
j444b-d381-key-wins-flood
j461b-macos-utun-reader-thread
j475b-remove-host-motion
fix-reconnect-new-link
j481-d380
dev
j479-mesh-soak
fix/j476-host-facts
j475-motion-pill-split
j470-mac-node-join
root-upgrade-d376
j474-review-merge
latency-targets-120hz
nightly-suite-shards
gotatun-pin-j469
macos-utun-reader-thread
fix-flood-echo-stall
wip/j416
motion-fast-ease-out
mesh-addhost-j259
takeover-close-terminals-d368
kbd-instant-followups
fix-trust-key-double-click
nightly-suite-partial-report
appwin-icons-j207
rusqlite-slice1
swipe-content-first-d374
mesh-mtu-381
addhost-instant-open
glass-contrast-d365-mock
glass-contrast-d365
signout-followups-442
fix-startup-toast-red
research-gotatun-matrix-j317
themes-sync-j304
fix-load-flakes
fix-nix-zig-patch
fix-compute01-browser-baseline
ratchet-size-baseline-419
predict-auto-d130
revoke-coverage-d367
nightly-suite-queue-timeout
nightly-browser-suite
fix-rustsec-2026-0459
fonts-ioskeley-obel
log-retention-d375
fix-kbd-no-anim-427
fix-dev-red-specs-2
takeover-proof-305-j205
wip/j410-server-pump
ui-consistency-d372
fix-osc52-clipboard
libghostty-vt-1.0
forget-retired-host-d369
j404-merge-426
fix-setup-lock-race
fix-touch-select-426
revoke-access-report-ui
fix-predictive-echo-specs
fix-selinux-agent-exec
wip/j395-checkpoint2
wip/j395
j391-review-scratch
ui-consistency-j195-deferred-rebased
fix-rustc-paths-421
decisions-wording-341
fix-install-suite-red
fix-dev-rtt-specs
fix-pending-removal-align
fix-privileged-skip
fix-install-suite-404
review-j368
mesh-dns-j254
revoke-access-report-d356b
revoke-privilege-round5
fix-removal-confirm
review-j360
gotatun-rotation-367
deps-refresh-340
review-j354
review-J351
review-j350
addhost-takeover-d359
revoke-report-items-347
revoke-end-sessions-d362
review-j348
size-mesh-ssh-346
size-trim-337
revoke-access-diff-d356
j259-pre-rebase-b06c5a6
j305-ended-at-start-spec
addhost-sudo-consent
fix-layout-real-specs-411
fix-shell-open-411
fix-console-hosts-373
fix-shell-exit
fuzz-host-name-353
fix-host-details-410
macos-filter-j197
research-gotatun-tricks
revoke-p3-j216l
stale-state-pill
revoke-followups-j216k
revoke-progress-j216e
backup/macos01-20261106/lume/j197
backup/macos01-20261106/lume/appwin-icons-j207-stash0
backup/macos01-20261106/claude/stash-0
backup/macos01-20261106/claude/stash-1
backup/macos01-20261106/claude/J80-macos-s1
backup/macos01-20261106/claude/J80
backup/macos01-20261106/claude/J80-slice1-20261102
backup/macos01-20261106/claude/J16b-appwin-on-dev
backup/macos01-20261106/claude/appwin-launch-idle-146
backup/macos01-20261106/claude/J80-s1-run
wip/j259
trust-285-p3c
runtime-lock-j216f
mesh-ssh-p3-j175
tun-proof-p3b
trust-285-p3
terminal-polish-j271
tun-proof-p3
ssh-install-flakes-j216i
fuzz-fixes-j264
trust-285-a
trust-285-b
restart-oversized-fixture-j198
backup/macos01-20261106/lume/appwin-icons-j207
restart-bound-j216h
up-preflight-p3-j198
backup/macos01-20261106/lume/j251
up-preflight-j198
wip/up-preflight-j198-j245-p2
wip/up-preflight-j198-j245-p1
agent-fsync-offloop-j196
wip/up-preflight-j198-j245
settings-offscreen-j231
wip/up-preflight-j198-j226-inspection
wip/j103f
themes-j206
wip/up-preflight-j198-j226
flakes-j216c
backup/macos01-20261106/claude/j197
flakes-j216b
backup/macos01-20261106/claude/j197-red
wip/up-preflight-j198-review
flakes-j216
backup/macos01-20261106/claude/appwin-icons-j207
engineering-j208b
appwin-mock-j209
toast-stack-j165
engineering-j208
decisions-d351
decisions-d350
decisions-d349
appearance-presets-mock-j129
decisions-d348
docs-audit-spec
doc-coverage-baseline-raise
decisions-d347
decisions-d346b
decisions-d346
j88h-profile
ui-consistency-j195-deferred
ui-consistency-j195
engineering-practices-j194
preferred-login-ui-j166
signin-pools-263-j174
macos-node-265-s1
decisions-d345
decisions-d344
proxy-cgroup-j164
verify-quick-fuzz-329
proxy-start-io-j168
timing-flakes-j163
up-263-s1
mcp-events-j147
verify-quick-fuzz-j158
proxy-p3-j159
agent-resource-j157-detect
wip/j103d-final
remote-cancel-hang-j155
proxy-traefik-281-j62d
j149-verify-quick
proxy-traefik-281-j62b
j150-drop-unnamed
wip/j79d-red-r4
wip/j103d-d332
rootless-toast-j142
wip/j103d-head
wip/j103d
j125c-mcp
macos-build-j136
backup/macos01-20261106/claude/j136
wip/j79d-red-cli
wip/j79d-red-server
j121-link-liveness
j118c-tracer-failures
wip/j79c-head
release-desktop-j131
j124c-signed-macos
wip/j79c-red-p3
wip/j79c-red-p23
wip/j79c-red-p22
merge-j128-check
perf-deferred-j128
sidebar-toggle-260
j127-shortcut-changed-dot
j125-mcp
j118-tracer-failures
j126-account-summary
settings-sections-mock-j92
j120-pinch-lock
sidebar-292
backup/macos01-20261106/claude/j120
taste-2026-11-03
row-actions-242-215
backup/macos01-20261106/claude/stash-0-untracked
backup/macos01-20261106/claude/J80-265-s1-run
backup/macos01-20261106/claude/J80-macos-s1-20261102
j112-canvas-commands
ui-no-overshoot-scroll
fix-recovery-restart
backup/macos01-20261106/claude/stash-1-untracked
taste-2026-11-02
size-baseline-ratchet
machine-cards-structure-j108
j109-boot-copy-mockups
fix-dev-red
wip/up-263-s1
j95b-settings-rows
proxy-traefik-281
j95-option-rows
docs-human-j91
docs-keys-palette
fix-flood-1013-270-j38d
mesh-ssh-s1
mesh-ssh-s0
addhost-d291-tunnel
test-stability-load
mesh-relay-220
repro-296
shim-thp-off-24
mesh-pins-258-v2
mesh-dns
signin-d311-merged
docs-pages
ui-size-283
fix-ui-batch-specs
wip/j12b-edge-update
gate-on-arm
fix-rename-sync-293
trust-285-j60b
fix-focus-ring-clip
integ-ui-1101
edge-update-v2
signin-d311
taste-2026-11-01
layout-per-tab-250
ui-approved-splitopt-224
ui-approved-splitopt-224-on-dev
icon-text-centre-282
ui-approved-189-212-216
research-reverse-proxy
transfer-budget-320
review-mesh-pins-258-r2
sidebar-pill-259
review-mesh-relay-220
wip/j12-edge-update-v2
nix-package
status-crash-loop-237
fix-dev-test-failures
fix-fixture-socket-path
wip/mesh-relay-220-pre-dev-advance-rebase
fix-canvas-side-clip
research-head-to-head
frosted-real-256
review-mesh-pins-258
wip/mesh-relay-220-pre-final-rebase
review-layout-per-tab-250-r2
broad-suite-triage
nix-devshell
review-status-crash-loop-237-r3
wip/nix-devshell-pre-p3
taste-frosted-real
wip/code-serve-demo-2026-10-30
wip/code-serve-glass-2026-10-30
wip/code-serve-clusters-2026-10-30
wip/code-merge-release94-dev-2026-10-30
wip/rproxy-delta-scratch-2026-10-30
wip/stale-note-257-staged-2026-10-30
wip/d241-size-staged-2026-10-30
review-broad-suite-207
wip/mesh-pins-258-pre-split
wip/mesh-relay-220-pre-rebase
mesh-measure-220
plan-211-update
review-edge-autoupdate-r3
perf24-reconnect
review-stale-note-r2
release-prod-live
d241-shell-marker
review-mesh-pins-server-258
review-revocation-r3
review-setup-token-r2
review-sync-journal-r3
wip/review-mesh-pins-258-prune-review-1995fee46
frosted-scroll-256
sync-journal-r3
revocation-per-account-wip
review-tokio-asyncfd-0386
review-sync-p3s
wip/stash-8by64-stash0-2026-10-30
mesh-drag-r2
setup-token-data-wip
release-9-4
auth-busy-1013
mesh-view-overlap
sync-p3s
review-auth-busy-wake
review-readd-r8-wip
mesh-drag-bounds
audit-auth-93
app-windows-stream-start
review-authority-cap-r3
app-windows-r7-measure
readd-minimal-r6
readd-minimal-r5
app-windows-r7-soak
readd-minimal-r4
app-windows-r7
app-windows-r6
readd-minimal-r3
readd-minimal-r2
readd-minimal
merge-release8-dev
review-busy-page-liveness-r2
review-busy-page-liveness
mesh-view-trim
review-authority-read-retry-r2
review-remove-uninstall-r2
release-retry-reattach
release-retry
review-remove-uninstall
review-authority-read-retry
app-windows-ship
mesh-autoswitch-p2
mesh-ssh
mesh-relay
mesh-macos-node
screen-and-control
session-labels
review-real-logins-r5
review-real-logins-r4
review-real-logins-r3
shim-memory-r2
review-real-logins-r2
shim-memory
shadow-addhost-instant
shadow-real-logins
shadow-same-session-flood
shadow-prod-perf-fix
hosts-from-server
app-windows-real
app-windows-transport
release-prod-6w
mesh-policy-verify
quiet-close-toast
dev-merge-r4
review-mesh-agent-transport
review-app-windows-transport
settings-roundtrip
review-release-pipeline-r4
mesh-agent-transport
ended-strip-fix
review-audit-ca-update-d244
settings-rows
phone-width
signout-clear
fix-restart-tests
dev-merge-rp
signer-hardening
review-audit-ca-update
terminal-fidelity
review-audit-ca-update-wip
mesh-integrate
review-mesh-agent-transport-515d3712
review-mesh-dataplane-feec1988
mesh-dataplane
signout
research-canvas-node
wip/review-renderer-cost
wip/review-terminal-fidelity
padlock-glyph
review-release-pipeline-2e95b689
phone-polish
sidebar-polish
inbox-generic
review-mesh-dataplane-378d4055
prod-batch
ui-inbox
ui-ca-unlock
ui-machine-sections
review-mesh-dataplane-a5f744fb
tls-session-prod
session-bounds-prod
fix-dead-session
session-bounds
tls-session
palette-polish
shortcuts-d222
research-appmeta
phone-gutter
ui-centre-button
wip/ui-centre-button
wip/tls-session
review-addhost-breakit
ui-platform
renderer-cost
remote-agents
mesh-api
ssh-bootstrap
prod-hotfix2
prod-fixes
review-remote-agents
review-mesh-dataplane
session-life
research-browser
review-mesh-api
research-capture
review-mesh-api-round3
review-mesh-api-round1
gate-stability
review-gate-stability
review-relay-direct
review-mesh-api-findings
proto-sessions
font-picker
proto-addhost
proto-windows
mesh-core
latency-gate
research-bsd
research-discovery
keytray-mods
mock-core
ui-tweaks
fix-motion-sel
fix-motion
integrate2
fix-robust
t-web
t-server
vt-ghostty
fix-snap-echo
t-web-auth
review-vt2
t-agent
lane-protocol
lane-shim
lane-auth
s1-base
s1-contracts
s1-workspace
No results found.
No labels
launch-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".
No due date set.
Dependencies
No dependencies set
Reference
kayg/infraternal#197
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Determine whether the native same-session flood latency budget failure reported in evidence/dev-merge-d215/README.md reproduces on the pinned perf VM. Interleave five runs each for release-prod-5 (
5bf3f42e), pre-D215 dev (a0799810/ commit before the D215 merge), and current dev. Report per-step p50/p99 and load. If current dev is slower than production beyond noise, bisect the intervening merges and fix only with a failing benchmark first. No budget changes.Started on branch flood-latency. Worktree HEAD and current origin/dev are
92e17ea7; the brief namesee104344as the base, which is an older ancestor present in the current history.Step 1 complete: current dev source is
92e17ea7; production and pre-D215 source commits are5bf3f42eanda0799810. NetBird reached infraternal-perf-test (Debian 13, x86_64, 4 CPUs); pre-run load average was 0.00/0.08/0.43. The required CPUWeight=10000 user scope starts successfully. No timing run has started.Step 2 complete: release-prod-5 source
5bf3f42ebuilt as a stripped x86_64 musl static binary (20,329,584 bytes, SHA-256 f73a7b9b2a03b96751b2dadb637d236ad10b389fd13d5d6532a2688da93250ba). The artifact is retained in the job scratch area. Pre-D215 build is in progress; no latency result yet.Step 3 complete: pre-D215 source
a0799810built as a stripped x86_64 musl static binary (21,857,264 bytes, SHA-256 81c6f619d50fedad0e5fb947f09f6b644d988ce586b5fca31a7649db5ba4339c). Current dev build is next; no latency result yet.Step 4 complete: current dev source
92e17ea7built as a stripped x86_64 musl static binary (22,345,648 bytes, SHA-256 e1440392ee56bfda5396e3f70c0a46a19ad41d9c02b5617ec11bb236e14e7807). The three artifacts now share the locked Rust 1.99.0 release profile. Next: transfer artifacts and run five interleaved cohorts each at 300 ms RTT with 100 samples per gate; no timing result yet.Finding: the first production cohort reached baseline and sibling-flood rows (n=100; p50/p99 301.83/324.53 ms and 306.99/317.48 ms; sibling growth -7.13 ms), all below the 334 ms / 16.67 ms limits, but the same-session case had not emitted a result after 11 minutes. I sent SIGINT only to the owned Python PID 842977; the scope is inactive, fixture state is empty, and the lock was released. The incomplete run is invalid for comparison (exit 130). Recorded load was 0.33/0.28/0.40 before and 0.25/0.22/0.27 after. VM logs: /root/infraternal-bench/flood-latency/results/release-prod-5-1.log and matching .load-before/.load-after files.
Root-cause investigation: the D215 raw logs show completed n=100 same-session rows (e.g. perf-results/dev-1.log.gz, p99 359.29 ms); scripts/verify-latency.py, agent_fixture.py, latency_proxy.py and the shell profile match between D215 source
0af8b6dfand production source5bf3f42e. Our current production run stayed blocked in Binary.read after the sibling case with load 0.33/0.28/0.40 before and 0.25/0.22/0.27 after; it is not usable timing evidence or a build-host-load comparison. Preserved the aborted run under evidence/flood-latency/attempt-1-aborted/. Next runs are 20 samples each, five interleaved runs per source (100 pooled samples per case), with a 120 s whole-run cap so each flood burst stays under two minutes; raw samples are retained.Diagnostic cohort complete on the perf VM (release-prod-5, n=20; excluded from the five-run matrix because progress tracing was enabled). Baseline p50/p99 295.63/321.44 ms; sibling flood 302.68/329.05 ms, growth 7.61 ms; same-session 309.29/327.67 ms, growth 6.23 ms. All passed 334 ms / 16.67 ms, exit 0. The same-session trace received all 20 x echoes and 20.85 MB of PTY output (log evidence/flood-latency/results/release-prod-5-1.log); load was 0.01/0.11/0.21 before and 0.01/0.10/0.21 after. The capped runner works; the traced run is diagnostic only, and the five untraced runs per source start next.
The traced diagnostic artifacts referenced above are preserved at evidence/flood-latency/diagnostic/release-prod-5-1.*. The results/ path is reserved for the untraced five-run comparison.
Matrix round 1 / production iteration 1 completed on the perf VM (n=20, untraced, exit 1). Baseline echo p99=321.36 ms; sibling flood=316.98 ms, growth=-4.38 ms; same-session echo p99=339.14 ms, growth=17.78 ms, above 334 ms / 16.67 ms. At n=20 p99 is the run maximum; this is not the pooled five-run result. Load: 0.02/0.07/0.17 before, 0.09/0.08/0.18 after. Raw metrics: evidence/flood-latency/results/release-prod-5-1.log and .samples.json.
Matrix round 1 / pre-D215 iteration 1 completed on the perf VM (n=20, untraced, exit 1). Baseline echo p99=325.18 ms; sibling flood=315.14 ms, growth=-10.04 ms; same-session echo p99=342.69 ms, growth=17.51 ms, above 334 ms / 16.67 ms. Preliminary n=20 maximum; raw samples retained for pooling. Load: 0.05/0.07/0.17 before, 0.03/0.07/0.16 after. Evidence: evidence/flood-latency/results/dev-pre-d215-1.log and .samples.json.
Matrix round 1 / current dev iteration 1 completed on the perf VM (n=20, untraced, exit 1). Baseline echo p99=322.41 ms; sibling flood=323.43 ms, growth=1.02 ms; same-session echo p99=589.86 ms, growth=267.44 ms. This is a large single-run outlier versus production 339.14 ms and pre-D215 342.69 ms, but n=20 p99 is the maximum and cannot establish a regression; continue the interleaved repetitions. Load: 0.02/0.06/0.16 before, 0.01/0.05/0.15 after. Evidence: evidence/flood-latency/results/dev-current-1.log and .samples.json.
Matrix round 2 / pre-D215 iteration 2 completed (n=20, untraced, exit 1). Baseline PTY echo p50/p99=306.21/326.86 ms; sibling=303.58/320.03 ms, growth=-6.83 ms; same-session Ack=301.75/329.61 ms and PTY echo=304.00/341.10 ms (echo budget miss 7.10 ms; growth=14.23 ms remains within 16.67 ms). Preliminary run maximum, not pooled. Load: 0.00/0.05/0.15 before, 0.00/0.04/0.14 after. Evidence: evidence/flood-latency/results/dev-pre-d215-2.log and .samples.json.
Matrix round 2 / current dev iteration 2 completed on the perf VM (n=20, untraced, exit 1). Baseline PTY echo p99=325.21 ms; sibling=325.92 ms, growth=0.71 ms; same-session Ack=527.80 ms and PTY echo=527.90 ms, growth=202.69 ms. This is the second high current-dev sample (round 1 same-session p99=589.86 ms); still preliminary n=20 maxima pending the pooled 100-sample comparison. Load: 0.23/0.11/0.16 before, 0.17/0.10/0.16 after. Evidence: evidence/flood-latency/results/dev-current-2.log and .samples.json.
Matrix round 2 / production iteration 2 completed (n=20, untraced, exit 1). Baseline PTY echo p99=314.62 ms; sibling=319.47 ms, growth=4.85 ms; same-session Ack=628.85 ms and PTY echo=630.88 ms, growth=316.26 ms. This is a second large same-session outlier on production (iteration 1 was 339.14 ms), so the first-run current-dev difference is not attributable yet. Load: 0.14/0.12/0.16 before, 0.09/0.11/0.16 after. Evidence: evidence/flood-latency/results/release-prod-5-2.log and .samples.json.
Matrix round 3 / current dev iteration 3 completed (n=20, untraced, exit 1). Baseline PTY echo p99=326.65 ms; sibling=328.43 ms, growth=1.79 ms; same-session Ack=601.10 ms and PTY echo=602.84 ms, growth=276.19 ms. Third consecutive high current-dev same-session run (rounds 1–3: 589.86, 527.90, 602.84 ms); pooled comparison remains pending. Load: 0.06/0.10/0.15 before, 0.18/0.12/0.16 after. Evidence: evidence/flood-latency/results/dev-current-3.log and .samples.json.
Matrix round 3 / production iteration 3 completed (n=20, untraced, exit 1). Baseline PTY echo p99=325.29 ms; sibling=324.23 ms, growth=-1.06 ms; same-session Ack=331.18 ms and PTY echo=334.96 ms (0.96 ms over echo limit; growth=9.67 ms passes). This is production run 3; prior same-session PTY p99 values were 339.14 and 630.88 ms. Load: 0.12/0.11/0.15 before, 0.16/0.12/0.16 after. Evidence: evidence/flood-latency/results/release-prod-5-3.log and .samples.json.
Matrix round 3 / pre-D215 iteration 3 completed (n=20, untraced, exit 1). Baseline PTY echo p99=327.49 ms; sibling=327.48 ms, growth=-0.02 ms; same-session Ack=556.64 ms and PTY echo=558.10 ms, growth=230.61 ms. This is a large pre-D215 outlier too, reinforcing that single-run maxima are noisy. Load: 0.85/0.31/0.22 before, 0.61/0.29/0.21 after. Evidence: evidence/flood-latency/results/dev-pre-d215-3.log and .samples.json.
Matrix round 4 / production iteration 4 completed (n=20, untraced, exit 1). Baseline PTY echo p99=319.29 ms; sibling=323.17 ms, growth=3.88 ms; same-session Ack=328.95 ms and PTY echo=340.55 ms, growth=21.26 ms. Preliminary max exceeds both same-session limits; pooled result pending. Load: 0.37/0.26/0.20 before, 0.31/0.25/0.20 after. Evidence: evidence/flood-latency/results/release-prod-5-4.log and .samples.json.
Matrix round 4 / current dev iteration 4 completed (n=20, untraced, exit 1). Baseline PTY echo p99=320.83 ms; sibling=319.27 ms, growth=-1.55 ms; same-session Ack=593.79 ms and PTY echo=596.40 ms, growth=275.57 ms. Fourth consecutive current-dev same-session outlier (589.86, 527.90, 602.84, 596.40 ms); pooled result remains pending. Load: 0.20/0.23/0.19 before, 0.21/0.23/0.19 after. Evidence: evidence/flood-latency/results/dev-current-4.log and .samples.json.
Matrix round 4 / pre-D215 iteration 4 completed (n=20, untraced, exit 0). Baseline PTY echo p99=317.12 ms; sibling=317.81 ms, growth=0.70 ms; same-session Ack=326.18 ms and PTY echo=329.90 ms, growth=12.79 ms, all within limits. Load: 0.13/0.21/0.18 before, 0.09/0.19/0.18 after. Evidence: evidence/flood-latency/results/dev-pre-d215-4.log and .samples.json.
Matrix round 5 / pre-D215 iteration 5 completed (n=20, untraced, exit 1). Baseline PTY echo p99=325.76 ms; sibling=323.49 ms, growth=-2.27 ms; same-session Ack=516.80 ms and PTY echo=516.86 ms, growth=191.09 ms. This is the third large pre-D215 outlier (rounds 1–5: 342.69, 341.10, 558.10, 329.90, 516.86 ms); confirms substantial same-session variance before D215 too. Load: 1.51/0.56/0.31 before, 1.14/0.54/0.30 after. Evidence: evidence/flood-latency/results/dev-pre-d215-5.log and .samples.json.
Matrix round 5 / production iteration 5 completed (n=20, untraced, exit 1). Baseline PTY echo p99=328.79 ms; sibling=312.43 ms, growth=-16.35 ms; same-session Ack=321.46 ms and PTY echo=612.52 ms, growth=283.73 ms. Production also has a large round-5 same-session outlier; pooled comparison remains pending. Load: 0.90/0.55/0.31 before, 0.59/0.50/0.30 after. Evidence: evidence/flood-latency/results/release-prod-5-5.log and .samples.json.
Matrix round 5 / current dev iteration 5 completed (n=20, untraced, exit 1). Baseline PTY echo p99=324.15 ms; sibling=301.41 ms, growth=-22.74 ms; same-session Ack=329.73 ms and PTY echo=337.25 ms (3.25 ms over echo limit; growth=13.10 ms passes). Current-dev same-session PTY p99 across rounds 1–5: 589.86, 527.90, 602.84, 596.40, 337.25 ms. Load: 0.45/0.47/0.30 before, 0.40/0.46/0.30 after. Evidence: evidence/flood-latency/results/dev-current-5.log and .samples.json.
Finding: the 5×20-sample pooled perf-VM matrix reproduces the same-session flood failure on production, pre-D215 dev, and current dev. PTY echo p50/p99: production 307.37/612.52 ms, pre-D215 305.00/516.86 ms, current 309.68/596.40 ms. Baseline p99s are 325.29/326.86/325.21 ms; other-session flood p99s are 323.17/323.49/325.92 ms. All same-session p99s exceed 334 ms and growth exceeds 16.67 ms. Current is 16.12 ms faster than production at pooled p99; run-to-run tails are far wider, so this does not establish a current-dev regression and does not trigger a bisect. Results, per-run load snapshots, raw samples and method are recorded in evidence/flood-latency/README.md and evidence/flood-latency/results/. Current source HEAD:
92e17ea7b0.Finish: commit
42cb32a1e5on branch flood-latency. Evidence-only change; product source is unchanged. The five interleaved perf-VM runs show the same-session gate failing on production, pre-D215 dev, and current dev. Current pooled PTY echo p50/p99 is 309.68/596.40 ms versus production 307.37/612.52 ms; run maxima range 337.25–602.84 ms on current and 334.96–630.88 ms on production. This does not show current dev slower than production beyond run variance, so no merge bisect or latency code change was warranted. Full method, metrics, load snapshots and raw logs are in evidence/flood-latency/README.md and evidence/flood-latency/results/.scripts/verify fastexit status: 1. All rows passed except the pre-existing release static binary size budget (current dev binary 22,345,648 bytes; maximum 16,404,816 bytes). Its final output:Finding (flood-latency job,
42cb32a1): same-session flood echo exceeds budget on production, pre-D215 dev and current dev alike (≈308/600 ms p50/p99 vs 334 ms p99). Not a regression; never met. Fix queued as job 01e-same-session-flood: bound bytes in flight per session, backpressure instead of buffering, render newest state when behind while the shim keeps every byte.Started same-session-flood at base
21b37bca70(origin/dev). Read all 27 comments on #197 and the linked originating #55 history. Continuing the established pre-existing failure, not bisecting. D130/D214/D259: instrument queues, reproduce before changing behavior, bound in-flight output without losing retained replay bytes. The job explicitly authorizes perf VM measurement and branch pushes.Functional failing test reproduced before the fix with the earlier dev artifact (
92e17ea7, same shim pump): scripts/verify-shim-flight.py counted 81,920 output bytes before a same-socket input Ack after pausing the viewer, exceeding the 65,536-byte test bound. Log: evidence/same-session-flood/shim-flight-before.log. The shim has one userspace frame but leaves the Unix socket send buffer at the kernel default. Testing an explicit one-frame socket budget, preserving frozen framing, PTY byte order and backpressure; no access-check changes. Perf reproduction is still waiting on the shared lock, and the current-base release build is in progress.Measurement waiting: the authorized perf-VM diagnostic is queued in flock -w 3600 /var/lock/perf-bench.lock. The current holder is PID 996128, a browser measurement under /root/infraternal-bench/browser/, observed holding the lock for about 19 minutes. I have not touched its processes or artifacts. Continuing local functional regression, lint and release builds while waiting; no new latency claims yet. Current base
21b37bca.Current-base failing native benchmark reproduced on the perf VM before the fix: base
21b37bca, static artifact SHA-256 0051ea4acff1137684f2775852fc40a4702caeaa83dd731714dd926e9202b031, second n=20 cohort, 300 ms RTT. First cohort passed, confirming between-run variation. Complete raw samples and load are in evidence/same-session-flood/baseline-300-2.*.METRIC name=keystroke_echo_confirmed_flood_same_session source=real-agent-pty n=20 p50_ms=305.11 p99_ms=562.23 budget_ms=334.00 result=FAIL
METRIC name=keystroke_pty_echo_flood_same_session source=real-agent-pty n=20 p50_ms=307.81 p99_ms=562.32 budget_ms=334.00 result=FAIL
METRIC name=flood_isolation_same_session source=real-agent-pty n=20 baseline_p99_ms=322.54 flood_p99_ms=562.32 growth_ms=239.78 budget_ms=16.67 result=FAIL
Experiment findings, not completion: the interleaved 5x20 matrix on the perf VM gives current-base same-session echo p99 411.84 ms at 300 ms RTT versus 351.05 ms with a payload-only 16 KiB shim send budget; the latter still fails 334 ms / 16.67 ms growth (LAN growth also fails). Its finite, exactly checked 50 MiB LAN transfer dropped from 18.59 to 8.01 MB/s, so that version is rejected. Linux Unix-stream packet sizing uses (sk_sndbuf >> 1) - 64; a 16 KiB budget splits the 16 KiB+13-byte shim frame. Testing a whole-frame budget with accounting margin. Buffered diagnostic stamps are being used to reduce observer overhead; native raw samples remain the acceptance source. Further flow-control clarification, if needed, will keep frozen v1 layouts and byte ordering: a healthy credit return loop must be distinguished from a viewer that has stopped, before the existing 250 ms pending-output detach. No budget or access check changes. Evidence: evidence/same-session-flood/results/, throughput-baseline-1.log, throughput-bounded-1.log and diagnostic/.
Step complete:
cb20832fadds benchmark-only private output-stage recorder infrastructure; pushed on same-session-flood. Ordinary builds erase record calls; no wire layouts or product behavior changed in this commit. Exact staged-tree gates: cargo fmt --check PASS; shim clippy --all-targets --features bench-flight -D warnings PASS; shim tests 80 passed / 13 ignored, integration 2+1+2 passed, doc tests 0. Private-root, exclusive-create and symlink refusal tested. Instrumentation call sites and the performance fix remain separate uncommitted steps. The full milestone workspace tests also passed, but its early clippy error has since been fixed and static binary size remains over the pre-existing x86/ARM budgets. No completion claim.Contract clarification proposed before implementation (#197, D130/D259): in buffered perf-VM trace-framed-buffered-1, nine healthy flood credit returns arrived 0.56–24.38 ms AFTER the fixed 250 ms timer detached the shim (last-credit gaps 252–261 ms). This turns normal flight time into detach/replay work. Keep all frozen v1 layouts, explicit credit accounting, byte order and access checks. Extend the pending-output deadline only for a substantial active refund loop, using observed output-to-credit flight time plus a frame; an unfunded/tiny stream keeps the existing 250 ms deadline. The deadline remains one-shot and cannot be prolonged by partial unaffordable repaint refunds. An expired sample is discarded so a paused viewer cannot become a huge RTT estimate. Bytes in flight do not increase; the PTY remains backpressured while the refund is travelling. The native budgets remain unchanged. Evidence: diagnostic/framed-buffered/trace-framed-buffered-1/flight-1184589.log.
Completed diagnostic relay-stage hooks in
c26a8f36(branch same-session-flood). Exact staged tree: fmt PASS; clippy infraternal-agent all targets with bench-flight PASS; tests 54 unit passed/7 ignored, 2 transport passed, doc tests passed. The hooks retain only offset/length/timestamp metadata and compile away outside bench-flight.Content-free framed/buffered diagnostic at 300 ms (excluded from acceptance): evidence/same-session-flood/diagnostic/framed-buffered/stages.json has PTY-read -> ring-stored p99 1.198 ms (max 2.689); daemon queued -> sent p99 0.0616 ms (max 0.138). Shim queued -> sent p99 231.400 ms and sent -> daemon received p99 232.268 ms, with 32,768 complete-pair bytes max per stream. This includes the fixture's shaped hop. Missing buffered-tail/replay pairs are reported, not silently included. The browser production observer with 8 KiB frames/new draining reports decode -> parse p99 1.0 ms under same-session flood (old renderer batching waited a frame); receipt p99 325.4 ms and paint p99 335.9 ms, so browser acceptance is still being investigated, not claimed.
Completed shim-stage diagnostics in
819cd7f4and pushed. fmt PASS; clippy shim all targets/bench-flight PASS; shim unit tests 80 passed/13 ignored; detach 2 passed; public native mouse 1 passed after restoring pinned Zig PATH; process-exit descriptor 2 passed. No output payload is logged and no wire/parser layout changes.Completed and pushed
d5c34184: tracer parses new suffixes into newest terminal state before older paint callbacks; credit/cursors still move only after FIFO paint, with snapshot/replay/epoch fences. Before-change renderer failures retained; now 11 tests/40 assertions PASS and bun run check PASS. Real production browser observer reports decode -> parse p99 1.0 ms at 300 ms flood; acceptance remains pending.Completed
e3fce55e: substantial credit-wave flight sampling prevents false 250 ms detach; byte windows and frozen protocol unchanged. Original unfunded/tiny deadline and one-shot/partial-refund behavior retained. Before-change funded-wave test FAIL; after change 58 agent unit tests PASS/7 ignored, fmt PASS, all-target agent clippy PASS. State layout test ceiling 128 bytes, no payload (312.5 KiB ceiling for 500 sessions × 5 viewers); measured RSS will be reported separately.Paired 50 MiB flood comparison rejects plain 8 KiB polling: baseline 16.73/17.99/17.77 MB/s vs 15.94/16.91/17.01 MB/s, about 5% slower. A bounded eager first-frame flush is being measured; no acceptance claim yet.
Completed/pushed
8e20159a(embedded receive-stage observer) and637197d6(WebSocket queue/flush observer), one module per commit. Both record only byte-range metadata in explicit bench-flight builds and compile away normally. Existing payload ownership, credit/order and access checks unchanged. fmt PASS; server all-target clippy PASS; complete server unit gate 239 passed, 22 ignored, 0 failed.Completed/pushed
cf0b3c51(bounded shim output with eager first-frame flush) andc8d6100d(real PTY byte-bound regression). Original base fails above 77,312 queued bytes; final functional probe observes 16,384 bytes before PTY input Ack and requires contiguous complete echo, below 65,536 bound. fmt and shim/CLI all-target clippy PASS; shim 80 unit passed/13 ignored, detach 2, mouse 1, descriptor 2; new CLI integration 1 passed. Parsing remains 16 KiB/batch; raw outgoing frames 8 KiB; socket accounting has 256-byte framing allowance. Output order, complete retained ring and access checks unchanged. Final VM artifact SHA-256 53e305ca6b0e846cb839afb47c6a5e4bd38be376bf2ba9555b43c8e65f7d67cb; latency/paired-throughput acceptance is running.Further measured queueing: traced production browser at LAN receives same-session echo 67–167 ms after input, but its matching WebSocket flush occurs 7–26 ms after input; decode -> parse is ~1 ms and only 8–229 KiB are in the explicit browser ring at those samples. The remainder is buffered between WebSocket flush and renderer message delivery. Evidence: trace/browser-eager-0 plus results/browser-eager-trace-0.json (diagnostic, excluded from acceptance). Plain 1 MiB browser credit permits about 131 ms of backlog at measured 7.64 MB/s LAN rendering.
Contract extension proposed before implementation: negotiate a terminal credit-hint capability in existing leg-B Hello bits; add optional credit_hints on existing session-bound terminal.replay_complete notices and optional credit_bytes on terminal.snapshot_unavailable. No binary frame/layout/parser change. New clients bound raw output permission to about a refund RTT plus one frame, retaining withheld refunds locally. Indivisible Snapshot costs can request temporary funding up to the existing 1 MiB ceiling. Old peers keep current windows; new fields are emitted only with a supporting server. Existing access/session binding remains mandatory. No idle timer or new engine. D130, D214, D259.
The eager-flush candidate is rejected: paired throughput declines and native 300 ms readiness times out. It is being removed; framed 16 KiB output with flight-aware starvation is now building.
Corrective commit
abcf3169pushed: removed rejected eager flushing and restored poll-driven order; outgoing frames/socket budget are framed 16 KiB while PTY parsing remains 16 KiB. Eager 300 ms native readiness timed out (four recorded cohorts); it is not acceptance evidence. Corrected first 300 ms native cohort passes all rows: same-session PTY echo p50/p99 303.96/327.22 ms, growth 7.53 ms; other-session p99 320.55 ms, growth 0.86 ms. No budget changes. Shim fmt/clippy PASS; 80 unit passed/13 ignored; detach 2, mouse 1, descriptor 2 passed. Full repeated artifact acceptance follows after negotiated browser credit changes.Completed/pushed
c3960e59: plugin-API Hello bit 6 for terminal credit hints; API fmt/clippy PASS, 20 unit + 2 parser integration tests PASS. Completed/pushed3136a889: capability-gated replay/cost notices and compatibility-preserving native entry point; remote-enabled daemon gate 100 PASS/14 ignored. Completed/pushed88ff537c(native supervisor),4222c4ad(active native path),7a8fbebb(parked native path), one module per commit; current all-target agent/server clippy with remote features PASS, daemon/real-transport gate 101 PASS/14 ignored. Older peers retain legacy entry points and notice fields; access, writer binding, priming and cancellation unchanged.Browser credit tests now cover raw refund withholding, repaint reserve loans, malformed/over-capacity hints and old-host fallback: 15 renderer/credit tests PASS/62 assertions; TypeScript check PASS. Typed server notice parser gate: 28 PASS/3 ignored, including new capability/cost validation. New fuzz target is building. A withheld idle-refund test failed before the credit-clock guard; the guard now passes in the 101-test gate. Final artifact/browser/native acceptance remains pending.
Resumed same-session-flood at HEAD
233f051216, original base21b37bca70. Read all 43 comments on #197 and the linked #55 history. Continuing outstanding server notice negotiation, browser credit limits, parser fuzzing and final artifact acceptance; retaining prior rejected experiments as evidence, not acceptance. No deployment.Completed/pushed
785f6b89(negotiated browser refund bounds) anda5b305ad(credit reserve regressions). Tracer and observer TypeScript checks PASS; 9 output/credit tests PASS, 50 assertions. Perf-VM production-browser observer remains short of full acceptance: same-session receipt p99 at LAN/150/300 ms is 51.5/195.3/327.5 ms versus baseline 2.9/153.0/303.7 ms; paint p99 is 62.2/213.2/335.4 ms versus 18.3/166.2/316.0 ms. Raw output throughput in the flood phases is 7.06/5.99/3.35 MB/s. Source observer ranges are excluded from untraced native acceptance. Evidence: evidence/same-session-flood/results/browser-credit-window-{0,150,300}.json. No budget changes or completion claim. Final native artifact and repeated matrix are next.Completed/pushed
375c39a5(server negotiation and bounded typed notice routing) and708d87ee(server notice regressions). fmt PASS; all-target server clippy PASS; embedded suite 28 PASS/3 ignored. Session identity is still matched against the authorized attachment. Repaint costs accept only integers 1..1,048,576; legacy notices remain accepted. Parser fuzz target is rebuilding after a harness invariant refinement; no parser or wire-layout change from that refinement.Final current native artifact built from product source
708d87ee(includes idle-refund clock guard), static x86_64 musl SHA-256 83df2d751916685dbf66dc91492b25ae3a4ee24a85693d0604957c23ba9f5dfb. First locked perf-VM LAN native cohort passes every row: baseline PTY p99 1.54 ms, other-session 0.60 ms, same-session p50/p99 3.12/5.94 ms, growth 4.41 ms. Load 0.15/0.23/0.39 before and after. Five 20-sample cohorts per LAN/150/300 ms are now running; paired 50 MiB throughput and 50-session resource checks queued with separate short locks. The corrected fuzz harness has fmt/clippy PASS (server default features); full gate is in workspace tests.Remaining acceptance failure on final native artifact 83df2d75: full n=100 at 300 ms has same-session Ack p99 329.74 ms but PTY echo p99 474.40 ms; baseline echo p99 328.94 ms (growth 145.46 ms). At 150 ms, echo p99 161.74 ms exceeds the 16.67 ms growth target by 2.87 ms. The large 300 ms gap is about one shaped one-way trip after input acceptance, consistent with echo needing another batched refund at an exhausted output window. Testing a small interactive reserve inside existing credit (no larger window): ordinary bulk withholds at most three framed 16 KiB chunks on a measured long refund flight; newly accepted input can spend that headroom in original PTY byte order. New refunds refill bulk capacity, not permission beyond the existing bound. Unfunded and tiny-window starvation/repaint behavior must stay unchanged. No wire/access/library/budget change. A failing flow regression precedes this experiment; paired throughput decides whether it is retained.
Diagnostic finding at 150 ms (earlier framed trace artifact; observer run excluded from acceptance): probe input offset 53 reaches the infraternal daemon at +85.309 ms; Ack +85.386; echo-containing PTY range read +87.021, ring stored +87.720, shim sent +87.754, daemon received +160.374, daemon sent +160.426, client echo +223.988 ms. No starvation expiry. Probe offsets 104 and 75 likewise wait ~50–55 ms between shim send and daemon receive. This supports credit-waiting after input acceptance, not a renderer or detach stall. Raw source: trace-final-150/ and results/diagnostic-framed-150.json on the VM and retained job scratch.
Before-change flow regression fails: ordinary suffix length 983,040 versus expected 933,888 with a long active flight (48 KiB headroom inside original credit). After experimental reserve change, 61 default daemon unit tests pass/7 ignored. Added an expiry regression that also failed before its guard, and a recovered-fast-path case: reservations follow only the newest active refund wave; conservative waiting still remembers peak flight. These avoid a historical WAN flight slowing a later LAN path. Remote feature tests are retrying serially after two unrelated server-path fixture timeouts under build-host contention. Candidate static build/acceptance pending; nothing claimed complete.
Completed/pushed
479e2329: bounded terminal notice fuzz target uses the authenticated router parser. fmt/clippy PASS; coverage-guided ASAN smoke completed 10,000 inputs, no findings, with CARGO_PROFILE_RELEASE_LTO=false (shipping profiles unchanged). Default LTO + ASAN linkage failed with undefined _sancov_gen symbols; disabling LTO for this fuzz invocation resolves it. Evidence retained in fuzz-no-lto.log; parser strict-field/cost/session tests passed earlier.48 KiB reserve prototype (SHA-256 039031f188d5d06baadebefe021528c10c7b35de46450c09055dc4291f1d1a85) full n=100 at 300 ms passes every native row: same-session p50/p99 291.31/328.91 ms, growth 2.76 ms, other-session p99 318.64 ms. 150 ms still fails (185.92 ms echo p99, growth 27.82 ms), so it is not acceptance. Current experiment adds the infraternal daemon pending frame to the allowance (64 KiB inside existing credit) and keeps it only during recent typing; bulk reclaims it after two observed flights, without another timer. A failing expired-reservation test ensures an existing pending-output timer resumes newly affordable output instead of detaching. Current functional suite passes; exact artifact and throughput/latency acceptance remain pending.
Atomic steps pushed:
f68b24bccurrent-flight eligibility;70bf5ff3byte-flow reserve state;d05c54b2accepted-input activation;c228576bsnapshot hint satisfaction on receipt;027ab409its repaint funding regression;b992800bretain unspent input allowance across refunds;149b03a7flow/expiry/refund regressions. A staging mistake in two just-created branch commits was corrected with an explicit lease-guarded rewrite of my own tip; the old mixed revisions 67b869ef/bc0cbfaf are superseded.Exact staged daemon slices passed fmt/clippy and 103 unit/14 ignored + 2 transport tests. Final working product gate passed fmt/clippy and 107 unit/14 ignored + 2 transport; tracer check and 10 credit/output tests (54 assertions) pass. Two failing regressions reproduced before correction: refund clears unspent input loan (available suffix 64 KiB instead of 128 KiB), and older repaint paint cancels a newer cost hint (768 KiB funded instead of 1 MiB). Fixed native artifact SHA-256 af5651a52f9487c89fae32bd579432a558b4588f91e9ab50dd43b3560c3130fa is queued/running full n=100 acceptance on the VM. Previous 64 KiB prototype 3ca04686 fails and is not acceptance. Final product fast gate is in static builds.
Current plain artifact af5651a5: full native n=100 passes LAN (same echo p99 5.31 ms) and 300 ms (325.12 ms, growth -8.23 ms). First 150 ms run misses absolute Ack/echo p99 (193.63/195.96 ms), but growth 13.40 ms passes. Two repeats pass all 150 ms rows: echo p99 156.15/158.18 ms, growth 3.59/8.92 ms. All raw cohorts, including the miss, are retained; no selective completion claim. Further 300 ms repeat remains running.
Ledger diagnostic n=100 at 150 ms passes (echo p99 160.03 ms). Its slowest sample shows input sent +62.107 ms, Ack +63.573, PTY read +89.501, shim sent +90.335, daemon received +90.397, daemon sent +90.420, echo +166.597. Throughout the 65–81 ms gap the relay has 172,030–448,502 bytes of available/raw credit and 65,536 bytes of unspent input allowance: this remaining gap is before PTY read, not credit starvation or VT parsing (parse/ring append ~0.8 ms). No detach. Trace excluded from acceptance.
Current production browser still misses flood tails: receipt p99 LAN/150/300 = 40.1/765.7/346.1 ms, while parse adds ~1.3 ms. The 150 ms outlier is near out_seq 16,220,415; explicit ring queued bytes 253,955. A content-free server/ledger browser trace is queued to distinguish source stall from delivery queueing. Full serial fast gate is running after isolated CLI restart retry passed; prior attempt had a timeout and pre-existing size failures. Source and regression commits are pushed; acceptance is not complete.
Resuming same-session-flood at
a1e9e775(original base21b37bca). Browser ledger found an accounting defect: after accepted input at +75.80 ms, 35,845 bytes forwarded leaves credit=29,691 and input allowance=29,691, but raw_credit=0 at +75.86 ms. Echo PTY range is ready at +77.30 ms yet waits for refunds until +115.09 ms. Source: trace-browser-retained-150/flight-1859350.log and flight-1859428.log. The subtractive reserve formula charges fragmented borrowed bytes twice once credit falls below the reserve. Adding a failing fragmented-chunk regression before correcting the formula; existing credit ceiling, FIFO and access checks remain unchanged. Current acceptance remains incomplete.Completed/pushed
50096e5b(fragmented credit accounting) and7e6783f5(regression). Before-fix four-chunk test fails after its first 16 KiB forward: 32,768 sendable versus expected 49,152. Correct calculation adds unspent input allowance to ordinary credit, capped by actual credit, instead of subtracting already-spent reserve twice. No larger window or byte reordering. fmt/clippy PASS; remote daemon 108 unit tests PASS/14 ignored and 2 transport tests PASS. Current plain static rebuild and locked acceptance measurements pending. Previous artifact throughput means: baseline/current LAN 16.837/15.989 MB/s, 150 ms 6.486/6.639, 300 ms 3.420/3.258 (three complete checked 50 MiB transfers each). LAN/WAN drops are retained as unresolved evidence, not hidden. Fifty real PTYs: idle daemon/shim CPU ticks unchanged over 1 s; one complete 50 MiB flood 16.122 MB/s; combined shim RSS 299,052→326,560 KiB, daemon 7,572→7,764 KiB. Source results/scale-retained.log.Additive client startup proposal within existing credit protocol: current tryAttach grants 1,048,576 bytes before capability/PTY RTT is known, which cannot be withdrawn. LAN browser first flood echo near out_seq 1,122,561 takes 40.1 ms (results/browser-retained-0.json), versus baseline p99 5.6 ms. Start with 32 KiB and bank the balance. Unknown capability keeps this bound; a validated existing repaint-cost hint can borrow the bank before replay completion. Existing replay_complete without credit_hints or snapshot_unavailable without a cost restores the old-host full window, avoiding large-repaint deadlocks. Negotiated hosts use the measured existing RTT-plus-frame window. No new frame, notice shape, access check or foundational choice. Add failing unknown-capability and pre-fence repaint regressions first; test old-host fallback and ordered repaint ownership.
Full fast gate: attached_backpressure_and_detached_progress fails at stable output head 1,468 versus its arbitrary minimum 1,832 (fragmented-fast.log lines 289–301). With the framed socket bound, small packets may exhaust kernel packet accounting before another 1 KiB advances; requiring more buffering contradicts the change. Fixture correction: observe the real finite producer's 1,000th numbered line before stopping reads, then require stable head below completion, an absent completion marker while attached, and >1 MiB plus completion screen after detach. The real-PTY queue-bound regression remains unchanged. No performance budget relaxed. Other fast rows pass except pre-existing static-size budget failure. Startup fix/regressions bbcacc39/e324ef1a pushed; tracer check and 18 terminal tests/79 assertions pass.
Current source/regressions are pushed through
e324ef1a; plain native artifact bf250df09ac1b9ee5774b0e31ff25b2df379a0c1bef3ce84f46c94ab6a48f5f2 includes corrected fragmented-loan accounting. Fresh full native and separate ordinary-browser/startup-browser cohorts are queued with flock -w 3600 and per-run 120 s caps. At 05:42 UTC the shared perf lock remains held by another process; no measurement has started and no foreign process was changed. Corrected real-PTY backpressure fixture passes individually; full suite running. Most recent full fast gate retains the fixture false failure and pre-existing binary-size failures; rerun follows fixture commit.Current plain artifact bf250df0: all fresh n=100 native cohorts pass LAN/150/300. Same-session echo p99 4.50/176.84/326.02 ms; growth 4.02/4.32/0.36 ms. Raw: results/gate-fragmented-{0,150,300}.json/log. Ordinary startup browser receipt p99 32.9/173.2/322.8 ms; paint 46.6/186.5/337.9 ms, so browser frame growth remains unresolved. Duplex observer-only LAN sample inputtarget 116: bridge input receive/send +1.21/+1.28 ms, echo bridge receive/send +24.83/+24.84 ms (socket buffered bytes 0), browser Ack +25.3 and echo +27.8 ms. Source results/browser-startup-duplex-0.json and .bridge.json. Private server input-receive/authorized-FIFO stamps are building to separate scheduling from authorization/backend wait; no access checks changed. Full serial fast gate after fixture correction: fmt PASS, VT native fmt PASS, CLI compile-out PASS, clippy PASS, test PASS, cargo-deny PASS, static builds FAIL(1) for pre-existing size budgets. Complete logs will be committed in evidence; acceptance not claimed.
Private current trace isolates browser LAN echo credit wait: inputtarget 127 enters server receive/authorized FIFO at +1.387/+1.523 ms, daemon input sent +1.575, PTY Ack +2.008; echo PTY read +1.844, ring stored +3.140, daemon received +3.207 but daemon sent +19.642 ms after refund +19.455. At input submission actual/raw credit 16,931, reserve=0, allowance=0; Ack leaves 547 bytes. Source trace-browser-input-0/ and results/browser-server-input-trace-0.json. Authority admission costs ~0.14 ms in this sample; access checks are not the delay and remain unchanged. Existing eligibility (window>=256 KiB and latest refund>=68 ms) misses the ~144 KiB browser window and its outstanding render wave. Testing reserve eligibility at a window of two 64 KiB waves and while a substantial wave remains outstanding; no larger permission, timer, field, parser or byte reordering. Add failing travelling-wave and two-wave-window regressions first, then remeasure browser/native/throughput.
Completed/pushed
77ee004d(headroom while a substantial wave is unreturned),3644203d(two-wave browser eligibility) and07702ca5(regressions). Tests first fail: outstanding-wave headroom 0 versus 65,536; two-wave bulk suffix 65,536 versus expected 0. After fixes: fmt/clippy PASS; daemon remote 110 unit tests PASS/14 ignored plus 2 transport tests PASS. No new field/timer/permission, no RTT inflation or access change. A staged-only extra EOF blank was corrected in the owned clock tip using an explicit lease:77ee004dsupersedes231d8613; product hunk unchanged. Plain artifact 39775057c0c85668162dcc24ed7101d9d0f582e05bb64c08a03e5c8b7697b7fb is now on the perf VM for ordinary production-browser cohorts. Previous raw history/gates committed atc19b2d20(history.tar.gz, validation-history.tar.gz, fast-gate.txt, README); incomplete acceptance and misses are preserved.Shadow review of
same-session-floodate331a80f(merge base21b37bca). Failing tests are on branchshadow-same-session-flood, head30ef2976. This review changed no product code.P1: a host without credit hints never gets a repaint larger than 32 KiB (reattach hangs)
apps/tracer/src/terminal.tstryAttach(now grantsSTARTUP_CREDITof 32 KiB) andfundOutputCredit(the window stays at 32 KiB whileadaptiveOutput === undefined). The client widens to the old 1 MiB window only afterreplay_complete, or aftersnapshot_unavailablewithoutcredit_bytes. An infraternal agent built beforeTERMINAL_CREDIT_HINTSsends neither in this case. Itsreplay_completecomes after the repaint. Itssnapshot_unavailableis sent only for shimError(1|2)(basedaemon.rs:1273). Itsrelay::Output::repaintrecordsrequired = len, andneeds_snapshot()waits untilcredit >= required. On reattach, when the cursor has left the ring (a flood session, the case #197 is about), or on a fresh load of a session whose ring start is above 0, the shim sends a Snapshot. That Snapshot is the visible screen plus a 256-row tail, and with colour it is often over 32 KiB. The agent then parks it forever, and the browser shows no status. The same applies to the new agent's compatibility entry points that passcredit_hints = false. This happens whenever the browser and server are newer than the agent on a host.With hint-capable agents, a repaint over 32 KiB now costs an extra round trip before it can be sent: notice → Credit. Before this change the repaint went out at once inside 1 MiB. That counts against D259 budget (2), "typable within RTT + 50 ms". It has not been measured.
Test:
apps/tracer/test/shadow-credit-window.test.ts› "a host without credit hints can afford a repaint larger than the startup window". It fails with creditAvailable 32768 against an expected ≥ 65536.P2: the output window can only shrink. A path that gets slower keeps a LAN-sized window
terminal.tsacknowledgeInput:outputRoundTripMs = Math.min(previous, flight), which is reset only bytryAttach. Primed or parked native writers (D215) let the host path change from direct to relay without the browser reattaching. If a stream was measured at about 1 ms, it keeps a window of about 145 KB, so a 150 ms path can deliver at most about 0.9 MB/s. Before this change it was about 7 MB/s.Test:
shadow-credit-window.test.ts› "a later, longer refund flight enlarges the output window". It fails with 144726 against an expected ≥ 819200.P2: the starvation deadline ratchets with no ceiling
crates/infraternal-agent/src/credit_clock.rsreturned()accepts a flight whenelapsed <= grace(), andgrace = max(250 ms, 2·peak + 17 ms). Each accepted flight widens the bound for the next one, andpeaknever decays. When refunds slowly get slower (a slow renderer, banked refunds), the deadline grows geometrically. While it runs, a viewer that has stopped keeps the shim link, so the PTY stays backpressured when it is the only viewer, instead of detaching after 250 ms. The reserve window (relay.rsreserve(),last_interactivewithin grace) gets longer in the same way.Test:
credit_clock::shadow_ratchet_tests::successive_slower_refund_waves_cannot_ratchet_the_starvation_deadline_without_bound. It fails at 34.03 s after six waves.P2: the reserve holds back bulk output against available credit
relay.rsraw_credit()/reserve(). Withlarge_window_seenset and recent typing, bulk output can use onlycredit − 64 KiB, and once the input budget is spent, a credit of 64 KiB or less sends nothing. In steady state this only reaches the browser's startup phase: after a hint-funded repaint above 128 KiB, the window falls back to 32 KiB until the RTT is known. It ends when grace expires, so it does not deadlock. It does trade throughput for echo, and the branch's own LAN numbers are about −5% (16.84 → 15.99 MB/s) and about −4.7% at 300 ms. CLAUDE.md priority 1 needs that benchmark-justified before merge. I wrote no test (it is timing-dependent).P2 (process): evidence committed to the repo, against D262
c19b2d20addsevidence/same-session-flood/(history.tar.gz 2.5 MB, validation-history.tar.gz, fast-gate.txt, logs, scripts). D262 (2026-10-13) puts these on the issue.crates/infraternal/tests/same_session_flood.rsalso writes logs under$CARGO_TARGET_DIR/same-session-flood, which is fine, but its probe depends onscripts/verify-shim-flight.py.P3: measurement
Native acceptance is at n=100 per cohort on the perf VM, which is correct (D256). At 150 ms, the first run missed the absolute p99 and was followed by two passing repeats. Report all three together, not "passes". Browser acceptance, which is the path a person actually uses, has not been shown to pass. The last ordinary-browser numbers miss growth at 150 ms (receipt p99 173.2 ms against a baseline of about 153 ms + 16.67 ms).
attached_backpressure_and_detached_progresswas relaxed fromseq + 1024toseq. The added completion-marker check largely makes up for this.Checked, no defect found
interactive_inputonly changes permission.forward()cannot fail aftersuffix(), becausereserve()only decreases while the emit await runs.remaining <= 0waits for paint).discardAfter(keep)).prediction.hostWrittenin order.bench-flighthooks compile to no-ops by default.SO_SNDBUF: the bound is the userspace frame plus the socket, and InputAck still queues only after pending is empty.Not verified: timing-dependent behaviour (no measurements by request), many sessions with slow clients (code reading only, bounded per stream), and whether native path switches really keep the browser stream without a reattach (this affects how often the second P2 happens).
Current artifact 39775057: full native n=100 passes all rows at LAN/150/300 (same echo p99 3.88/143.23/325.76 ms; growth 3.47/3.71/-0.13). Paired checked 50 MiB means, baseline/current n=3: LAN 17.763/18.025 MB/s, 150 ms 6.671/6.798, 300 ms 3.293/3.275. Product CPU percentages (daemon+shim, excludes emitter) 92.8/92.7, 34.5/35.8, 16.6/17.0; max current daemon/shim RSS <=7,756/33,596 KiB. Fifty real PTYs: idle CPU ticks unchanged, aggregate shim RSS 299,224 KiB; one finite flood 18.480 MB/s; after aggregate shim RSS 326,732 KiB, daemon 7,768 KiB. Full browser n=100 paint p99 LAN/150/300 47.5/208.6/340.3 ms remains unresolved. Current trace has ample credit and full unspent input allowance for its slowest echoes: extra reserve is unsupported. Private default-vs-explicit socket experiment fails before samples because runtime wrapper exposes no socket handle; pinned declared dependency diagnostic completes but retains tail (150 receipt/paint p99 193.5/200.7). No transport/library change selected. Prefix-write timing now measures preceding renderer work, not only the echo own parser. Raw results and failed experiments retained. Full fast gate remains all PASS except pre-existing static-size budgets.
Current browser full n=100 at 150 ms fails the explicit companion check: receipt p99 191.5 ms vs native 184 ms budget, paint growth 42.3 ms vs one-frame 16.67 ms. Current private trace has ample credit and full unspent loan for slow echoes; an echo reaches server +86.827 but WebSocket flush +96.362 ms, and input receipt can lag its shaped hop. Prefix-write diagnostic sees no singular long parse/redraw (maximum 2.7 ms), but ~90–100 writes during each pending key. Testing ready control/input priority ahead of bulk in existing server loop, with one inbound priority turn then a yielding poll so bulk cannot be starved by zero-credit traffic. No added task/timer/queue or access-check change; raw PTY output remains FIFO. All previous raw data preserved. Companion browser check is summarize-browser.py; the before-change full cohort reports FAIL. Benchmark/build/real socket gates pending; no acceptance claim.
Rejected broad server select priority before committing: three existing socket tests fail (mesh result/subscription ordering, lifecycle timeout, unexpected close). It changes control selection, contrary to this lane's narrow scope. Narrow candidate restores the outer control select unchanged and groups only inbound-vs-terminal-output arbitration; one inbound turn yields its next poll to ready bulk, with no lost input on cancellation. Deterministic real-protocol fairness test fails before the yield and passes after. Candidate fmt/clippy PASS; full real socket suite and plain build running. No access-check content or PTY ordering changed. Current accepted native/throughput source remains
07702ca5; no candidate acceptance claim. Logs: priority-final-socket-tests.log and io-priority-*.log in job scratch.Rejected uncommitted scoped server I/O priority candidate (artifact 0ec65468): full n=100 at 150 ms receipt/paint p99 191.3/207.0 ms versus previous 191.5/208.6; no meaningful improvement, other-session remains within budget. Candidate socket tests retain result-ordering and lifecycle failures; isolated lifecycle retry passes. Broad priority also rejected earlier. Restored committed server source, preserving all access boundaries and control behavior. Candidate patches, fairness reproducer and logs retained for evidence. Detached origin/dev baseline
c75c362bcontrol test is still building under the same host load; no exception claimed yet. Current product source remains07702ca5plus disabled diagnostic hooks, ordinary artifact 39775057; native/throughput gates pass, browser tail remains unresolved.Head
d30cede5: retained runtime source through07702ca5plus disabled diagnostics, ordinary artifact 39775057. Native n=100 all LAN/150/300 rows pass; echo p50/p99 2.59/3.88, 141.31/143.23, 301.92/325.76 ms; growth 3.47/3.71/-0.13. Complete paired throughput and fifty-real-PTY CPU/RSS pass without meaningful throughput loss. Full browser paint p99 47.5/208.6/340.3 ms remains unresolved. Rejected broad/narrow server priority (tests/no benefit), private socket experiment (unsupported facade), pinned dependency (tail remains), tighter window (throughput -33%). No rejected product code remains. Restored branch and detached origin/devc75c362bresult-ordering tests pass. Existing Shim::SnapshotRequest path is the next measurement/prototype, preserving ring history, cursor epochs, legacy compatibility and access checks; no new screen protocol implemented. Evidence is committed: README, review.md, current-native.json/current-browser.json, current-experiments.tar.gz, history/validation archives and identified production captures. All requested snippets and rejected diffs/tests preserved there. Final head scripts/verify fast is running; prior retained-source gate all PASS except pre-existing static-size budgets. Task unfinished; keep issue open and scratch artifacts for continuation.Handoff remains INCOMPLETE, head
d30cede5c5(same-session-flood; all commits pushed). Native flood n=100 all LAN/150/300 rows pass; same echo p99 3.88/143.23/325.76 ms, growth 3.47/3.71/-0.13. Paired finite flood throughput and fifty-real-PTY CPU/RSS evidence are committed without meaningful throughput loss. Browser full n=100 still misses paint growth (p99 47.5/208.6/340.3 ms); rejected experiments did not solve it and no rejected product code remains. Next step: measure existing Shim::SnapshotRequest recovery for a display behind while preserving retained byte history, cursor/credit ownership, legacy support and unchanged access checks.Evidence: evidence/same-session-flood/README.md, current-native.json, current-browser.json, current-experiments.tar.gz, history/validation archives, review.md and captures/. Scratch remains for continuation because the lane is unfinished. No issue closed or deployment performed.
Branch-head scripts/verify fast output, verbatim (exit 1; only pre-existing static-size budgets fail):
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| CLI plugin compile-out | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | FAIL (1) |
+---------------------------+--------------+
Resuming same-session-flood at
d30cede5c5; original base21b37bca. Read all 67 comments on #197 and parent #55. Ported shadow-credit-window and credit_clock ratchet tests from30ef2976. Browser regressions reproduce: legacy repaint credit 32,768 < 65,536; slower-path window 144,726 < 819,200. Fixing shadow findings before fresh perf-VM repaint/browser measurements. Prior failed cohorts remain part of acceptance; no deployment or access-check change. D262 evidence relocation follows.Completed shadow fixes:
c0cd2a57caps starvation grace at 2 s (shadow before-fix 34.0336 s);baf72291announces existing cost-hint capability before initial Ack; current client commit funds all existing-session repaints in the Attach/Credit batch and widens again on a slower current PTY flight. Both original browser shadow regressions and two negotiation/attach regressions pass; tracer check passes; terminal suite 16 tests/75 assertions. Remote daemon serial suite 111 unit tests + 2 transport tests pass (14 ignored), fmt/all-target clippy pass. First parallel suite had a healthy_mesh_probes timeout (110 passed); serial suite passes including that test. Static build and fresh perf-VM cohorts pending. Prior failed runs remain in the issue, including browser paint p99 47.5/208.6/340.3 ms. D262 attachment relocation: installed fj exposes body-file comments but no attachment-upload command; preserving archives in job scratch pending an authorized upload interface, never reading credentials.Shadow fixes pushed at
ff3e4b68. D262 cleanup: removed evidence/same-session-flood from branch tip, moved reusable measurement code to scripts/same-session-flood; all original archives/captures retained at ~/.cache/codex-scratch/same-session-flood/continuation/evidence-preserved pending attachment upload (fj has no attachment command). TypeScript and Python syntax checks pass.Perf-VM 150 ms CPU diagnostic, n=100, old render-wave-static + new client/readable build (diagnostic, not acceptance): receipt p50/p99 167.0/185.7 ms, paint 176.7/202.0 ms, growth 35.5 ms FAIL. Profile duration 18.54 s, WASM write inclusive 8.57 s, renderer ~1.34 s; parser dominates main-thread work. Intermediate raw-rate 6144 experiments on the same old artifact fail: LAN receipt/paint p99 42.6/50.8 ms (paint growth 34.5); 150 ms 192.5/201.8 ms (growth 35.4). These are rejected measurement builds, no rate change shipped. Lower-rate 5120 and fresh corrected-artifact native/browser runs still pending. Raw files on perf VM: /root/infraternal-bench/same-session-flood/shadow197/profile-150* and rate-6144-{0,150}*. All failed first cohorts will be reported alongside repeats.
Fresh corrected artifact 7994f8a9 native n=100 passes all profiles: same PTY echo p50/p99 LAN 2.85/4.48, 150 ms 153.12/155.62, 300 ms 303.77/328.19; growth 4.06/4.08/5.93 ms. Fresh browser 150 ms still fails paint growth: receipt/paint p99 181.9/196.3, paint growth 29.8 ms. Both intermediate rate experiments rejected: 6144 LAN/150 paint p99 50.8/201.8; 5120 59.9/198.1; neither meets one-frame growth. No rate change shipped. Next renderer experiment coalesces ordered raw paint callbacks/refunds into one per render frame while retaining synchronous FIFO parsing, owned-prefix and snapshot/replay epoch fences. No extra frame wait, no byte omission or access-check change. Failing batching invariant will precede candidate. Repaint, paired throughput/scale and final fast checks are running.
Callback-only coalescing is rejected and committed renderer restored: n=100 candidate paint p99 LAN/150/300 will be retained with all runs; available LAN/150 values 57.8/204.2 ms fail growth. Parser profile and baseline one-byte writes (~0.4 ms) vs 16 KiB writes (~0.8 ms) suggest per-call VT overhead. Next private browser candidate batches received raw suffixes in a bounded 64 KiB task, retaining the fixed ownership ring and frame-based refunds. Keyboard capture and synthetic input must flush received VT modes before encoding input; snapshot/replay/epoch fences remain exact. No new library/engine/protocol/access check. Reject if mode ordering, latency or throughput worsens. Large-repaint attempt 1 had invalid command quoting; attempt 2 produced only 3.4 MB, inside the 8 MiB ring, so neither exercised repaint. Corrected attempt 3 emits 13.4 MB and verifies >32 KiB repaint; all legacy/current profiles are now complete and will be reported together.
Continuation results at
4b681d8e48(all four continuation commits pushed). Task remains INCOMPLETE: native flow and shadow regressions pass; browser paint growth still fails. No deployment, access-check change, protocol layout change or engine/library choice.Fixes:
c0cd2a57bounded starvation grace (before: 34.0336 s; after: <=2 s);baf72291ordered initial credit capability;ff3e4b68legacy/repaint funding and current-path window growth;4b681d8eremoves generated evidence from the branch and retains measurement source in scripts/same-session-flood. Original shadow regressions pass. 16 tracer terminal tests / 75 assertions, tracer check and measurement-helper TypeScript check pass. Serial remote daemon: 111 unit tests + 2 transport tests pass, 14 ignored. fmt/clippy pass.Fresh ordinary native artifact SHA-256 7994f8a93e8a24f92a1fb01dedd2aa8c561e9346f771b381245dc18ed25a7284, perf VM, n=100 per phase/profile: same-session PTY echo p50/p99 LAN 2.85/4.48 ms, 150 ms 153.12/155.62, 300 ms 303.77/328.19; growth 4.06/4.08/5.93 ms, every native row PASS. Full logs include other-session controls and pre/post load: /root/infraternal-bench/same-session-flood/shadow197/native-{0,150,300}.{log,json}.
All new browser runs below are n=100 per phase, perf VM only. Receipt/paint p99 and paint growth are milliseconds. profile/frames are diagnostic; rate/coalesce/batch are rejected private builds. None of their changes remains in product source.
These runs are added to, not substituted for, the retained pre-continuation misses: af5651a5 150 ms native first run echo p99 195.96 ms (FAIL), repeats 156.15/158.18 (PASS); prior ordinary browser receipt 32.9/173.2/322.8 and paint 46.6/186.5/337.9 ms; later retained ordinary paint 47.5/208.6/340.3 ms. Prior complete cohorts, failed/partial runs and rejected experiments remain preserved in the archived evidence (upload pending).
CPU diagnostic: 18.54 s sampled, WASM write inclusive 8.57 s, renderer ~1.34 s. Fresh per-frame trace: {"frames": 1101, "writes": 9607, "renders": 1201, "frame_interval_p50_ms": 16.69999999999709, "frame_interval_p99_ms": 16.80000000000291, "frame_interval_max_ms": 33.299999999995634, "parse_per_frame_p50_ms": 9.09999993443489, "parse_per_frame_p99_ms": 13.799999982118607, "parse_per_frame_max_ms": 26.000000059604645, "render_per_frame_p99_ms": 2.5, "render_per_frame_max_ms": 4.100000023841858, "parse_total_ms": 8365.79999962449, "render_total_ms": 1138.1000002622604}
Parsing dominates measured browser CPU, but renderer-only optimizations did not remove receipt growth. Callback coalescing and bounded task batching are rejected. The remaining work needs current duplex input/output stage traces and a measured newest-screen recovery prototype that preserves shim history and input/mode ordering, rather than declaring these failing paint cohorts acceptable.
All raw new cohorts/profiles/captures and rejected source patches are in /root/infraternal-bench/same-session-flood/shadow197/ and ~/.cache/codex-scratch/same-session-flood/continuation/. Complete prior evidence is preserved in continuation/evidence-preserved/. D262 upload remains blocked: installed fj has no attachment-upload command. No credentials were searched or read. No issue closed.
Resource and repaint evidence at
4b681d8e(perf VM, ordinary static artifact 7994f8a9).Paired, fully byte-checked 50 MiB transfers, three per variant/profile, no truncation or substituted snapshots. Product CPU is daemon+shim, emitter excluded, percent of one core; before/after load and artifact hashes are in every log. All individual throughput results are included below.
Current means vs baseline: LAN -1.81%, 150 ms +11.40%, 300 ms -0.06%; LAN run-to-run variance includes a slower current second transfer (16.928 vs paired baseline 18.687 MB/s), so this is not a claim of zero per-run regression. The retained reservation delivers native echo within budget without reproducing the earlier mean ~5% bulk loss. No throughput budget changed.
Fifty real retained PTYs: daemon/shim idle CPU counters unchanged over one second; aggregate shim RSS 299,468 KiB before, 326,976 after one exact 50 MiB flood; daemon 7,644 -> 7,836 KiB. One active flood 18.877 MB/s, product CPU 92.53% of one core. This is fifty retained sessions and one producer, not fifty simultaneous floods. Controller state remains constant space, <=128 bytes per attachment (<=320,000 bytes projected at 500 sessions x5 viewers); projection is not a measured fleet. Raw scale-current.log retained.
Large repaint: 13.4 MB of generated colored output exceeds the real 8 MiB shim ring, then ten same-session retarget/reattach probes each receive a 113,880-byte Snapshot, larger than the 32 KiB startup allowance. Existing-session credit is sent with Attach, so new agents need no cost/refund round trip. Every attempt-3 row meets RTT+50 ms.
Failed first runs, reported together: repaint attempt 1 on baseline/current at LAN/150/300 produced no qualifying repaint because the fixture command quoting was invalid. Attempt 2 on both artifacts at all three profiles emitted only ~3.4 MB, inside the 8 MiB ring, and saw raw replay rather than a >32 KiB Snapshot. All twelve timed-out fixture attempts are invalid for repaint acceptance and are retained as repaint-{baseline-static,infraternal}-{0,150,300} and repaint-2-* logs/JSON. Attempt 3 corrects both defects; no earlier failure is presented as a product pass.
Repaint reproduction uses the production browser fixture and generated command: stty -echo; python3 -c 'import sys; sys.stdout.write(("\x1b[31mR\x1b[32mG"*60+"\n")*16000)'; printf '%s' READY. Wait for the marker and quiet, call the exposed TerminalClient.retarget(its sessionUuid), and time to onPaintedOutput with bytes.length >32768, ten times. Full private harness source repaint-source.ts/repaint-run-3.js retained in continuation and on the VM. No owner live fixture was touched.
Every measurement used netbird SSH to the authorized 4-vCPU/7GB perf VM, flock -w3600 only during measurement, CPUWeight=10000, per-run 120 s cap, TRACER_TEST_PORT=4397. No rejected product change remains; no deployment. Task still incomplete because ordinary browser paint growth misses its budget.
Continuation handoff remains INCOMPLETE. Branch same-session-flood, HEAD
4b681d8e48, pushed. Three shadow correctness fixes are shipped on the branch and real legacy/current large repaints meet RTT+50 ms. Native n=100 flood cases pass; ordinary browser paint growth remains FAIL at LAN/150/300 (p99 62.1/196.3/348.1 ms; growth 46.6/29.8/31.9). Every new valid, failed and invalid run is reported in the preceding two comments. No rejected optimization remains.Author review: fixed credit ownership remains <=1 MiB; repaint funding precedes payload without a new frame; initial hint ordering is FIFO; legacy fallback occurs only after a valid input Ack; current-path flight can widen again; starvation grace has a fixed ceiling. Snapshot/replay cursors and paint epochs stay ordered. Auth/session checks and foundational libraries are unchanged. No idle timer or additional native payload queue was introduced. Existing parser regressions/fuzz coverage remain applicable; no parser layout changed.
Final scripts/verify fast on this HEAD used CARGO_TARGET_DIR=~/.cache/codex-scratch/same-session-flood/static-target, INFRATERNAL_TEST_RTT=0, RUST_TEST_THREADS=4. Exit 1: only pre-existing static size limits fail (x86_64 22,477,936 >16,404,816 bytes; ARM 19,911,624 >13,817,816). Relative to retained prior source: +3,168/+2,080 bytes. No size budget changed. Tracer/helper TypeScript checks and 16 terminal tests pass separately. Earlier default-RTT invocation stopped before Rust checks when its loaded-host relay self-test missed; first serial workspace run had one session_gone unexpected close; that exact workspace binary test passes isolated, and final full workspace run passes. No baseline exception was claimed.
Final gate summary, verbatim:
Full output: ~/.cache/codex-scratch/same-session-flood/continuation/fast-final.log. Generated evidence removed from repository tip (D262); complete original/new evidence and source patches stay in continuation/evidence-preserved and continuation/, plus /root/infraternal-bench/same-session-flood/shadow197. fj exposes no attachment upload; that external upload is still pending, without credential access. Original untracked scripts/pycache remains; no tracked changes. All owned measurement runs have completed; issue remains open and no deployment occurred. Scratch retained because the lane is unfinished.
Resume from this issue and these four commits. Current input/receipt growth still precedes paint: renderer-only changes failed. Follow up with current duplex queue/stage stamps (disabled bench-flight hooks already exist) and a measured newest-screen recovery path, preserving complete shim retention, legacy support and VT mode/input ordering. Per-frame trace: parser p50/p99 9.1/13.8 ms, render p99 2.5 ms, frame-interval p99 16.8 ms at 150 ms. No claim that a new engine or library is required or selected.
Independent verification started on local branch review-same-session-flood, detached target
4b681d8e48; merge base with dev8e7467c07c, #197 implementation base21b37bca. Read #197 and parent #55 history; continuing the prior shadow review and reported incomplete browser acceptance. Review brief forbids pushes, deployment and perf VM use; functional verification only, no new performance claims. Evidence/failing tests will be committed locally.Independent review finding SSF-1, P1, D130 acceptance incomplete at target
4b681d8e. HOLD / merge after fixes.Replayed the retained ordinary-artifact perf-VM cohorts through scripts/same-session-flood/summarize-browser.py --gate, without running a new measurement. n=100 per phase/profile. RTT 0/150/300: same-session paint p99 62.1/196.3/348.1 ms; baseline 15.5/166.5/316.2; growth 46.6/29.8/31.9 ms vs 16.67 ms maximum. All three fail. Receipt p99 45.1/181.9/331.0 ms (LAN receipt also exceeds 34 ms). Recorded load 1.26/0.81/0.71; 1.78/1.14/0.63; 1.42/0.95/0.77. This confirms the author's reported unresolved acceptance gap, not a newly established regression against dev.
Failing acceptance test committed locally at
1098705a, apps/tracer/test/same-session-flood-acceptance.test.ts, three named RTT cases. Reproduce: SAME_SESSION_FLOOD_COHORT_DIR=$HOME/.cache/codex-scratch/same-session-flood/continuation bun test apps/tracer/test/same-session-flood-acceptance.test.ts. Result: 0 pass, 3 fail, 3 assertions. Unit suite separately: 16 pass, 0 fail, 75 assertions. Generated cohorts remain external per D262; test is skipped without an explicit cohort directory. Perf VM was not accessed; implementation unchanged; no push.browser-current-0.json: SHA-256 a56de0961e3c8d16e07caf50bfd030748e3efe585e6c0387d7aab7e1d76c5ddc
browser-current-150.json: SHA-256 75f46fc24198bea3de9f942cbd5a7cf625c262a52546721220d3cb34a0a0807b
browser-current-300.json: SHA-256 16f0b0bfa269c748c8cae6bbba11be468eb55a88c4a278db1bb0e6b043d991b4
Review step complete at local head
1098705a: #197 prior shadow regressions and terminal exit/order checks pass (22 tests, 87 assertions); tracer and scripts/same-session-flood TypeScript checks pass after installing the tracer locked dependencies. Native measurement-helper import smoke passes; no benchmark executed. SSF-1 acceptance replay remains 3 failing profiles, 1 P1 finding. First fast gate failed agent_daemon at iteration 1 (432128 received of 470784 payload; final input Ack 17 bytes behind), so no host-load exemption claimed. Exact compiled agent_daemon isolated retry passed all 24 stop positions / 4710396 payload bytes. Full gate retry uses serial test execution; original output retained. Implementation unchanged.Review checks at
1098705a: daemon 111 pass / 14 ignored; embedded server 47 pass / 3 ignored; shim 80 pass / 13 ignored; terminal Bun tests 22 pass / 87 assertions; both TypeScript checks pass. Real PTY shim-flight probe (INFRATERNAL_TEST_RTT=0) observes 32768 bytes ahead of Ack, below 65536. Initial default-RTT probe refused session open and is retained, not used as evidence of a product regression. Direct daemon test binary initially ran with wrong working directory and had 12 path failures; corrected Cargo crate working directory passes the full suite. First required fast run still building ARM; x86 static size 22477936 bytes vs 16404816 limit, matching the author. Second run timed out in deployment rollback test; third stopped at relay self-test. All outputs preserved; no baseline exception claimed. Final serial fast run will follow completed static builds.Independent verification finish. Verdict: merge after fixes. HOLD (P1 present). Counts: P0=0, P1=1, P2=0, P3=0.
Target same-session-flood
4b681d8e48; merge base with dev8e7467c07c. Local review branch review-same-session-flood, head1098705a02. One atomic test-only commit; implementation unchanged; no push/deploy/perf-VM access.SSF-1 is the already reported D130 acceptance gap, independently reproduced by replaying retained perf-VM ordinary-build samples. Three failing tests in apps/tracer/test/same-session-flood-acceptance.test.ts: same-session browser cohort at 0/150/300 ms meets echo and one-frame paint growth budgets. n=100 per phase/profile; paint growth 46.6/29.8/31.9 ms >16.67 ms. These are recorded VM measurements, not a fresh benchmark or a change-versus-dev regression claim. Fresh timing/throughput/scale/repaint remeasurement was prohibited by this review brief.
Preserved identical cohorts and SHA-256 evidence under ~/.cache/codex-scratch/same-session-flood-review/cohorts, logs in its parent, and finding ledger ~/.local/state/codex-jobs/infraternal/review-same-session-flood/findings.md. Reproduce: SAME_SESSION_FLOOD_COHORT_DIR=$HOME/.cache/codex-scratch/same-session-flood-review/cohorts bun test apps/tracer/test/same-session-flood-acceptance.test.ts (0 pass, 3 fail). Supply fresh authorized perf-VM cohorts to evaluate a subsequent implementation.
Functional checks: 22 terminal Bun tests / 87 assertions; tracer and measurement-helper TypeScript checks; daemon 111 tests, embedded server 47, shim 80; full Rust workspace passes on the final gate. Real PTY input Ack queued behind 32768 output bytes <=65536 bound. Prior shadow regressions pass; typed notice validation, byte order, repaint ownership, replay/epoch fences, resource bounds and compile-out reviewed; no additional functional defect confirmed. The existing terminal_notice fuzz target and the author's bounded fuzz evidence were reviewed; this run did not repeat ASAN fuzzing or judge visual quality.
Final scripts/verify fast (product sources at the target plus the review test): CARGO_TARGET_DIR=$HOME/.cache/codex-scratch/same-session-flood-review/target INFRATERNAL_TEST_RTT=0 RUST_TEST_THREADS=4 TRACER_TEST_PORT=4398. Exit 1; only static size limits fail: x86 22477936 >16404816 bytes, ARM 19911624 >13817816, matching author sizes. No shipping source/dependency change in this review, and size alone is not the HOLD reason (D205). Fast exits before TypeScript checks on the size failure, so tracer/helper checks were run separately.
Earlier attempts retained, not substituted silently: first fast run failed agent_daemon at restart iteration 1 (its isolated retry passed all 24 stop positions / 4710396 payload bytes); retry 2 stopped at the deployment test's five-second timeout; retry 3 stopped at the relay self-test; serial retry stopped making progress in mesh_plugin_discovery_disable_and_restart_preserve_control_socket, so only its owned test PID 3036084 was interrupted. That exact isolated test passes, and final four-thread workspace passes it. No baseline exception claimed. A direct daemon test run with the wrong cwd had 12 path errors; the corrected crate cwd run passes all 111 tests. The first default-RTT shim-flight probe refused open; the zero-RTT functional probe passes. All attempt logs retained.
Final gate summary, verbatim:
Large review build target is being deleted; cohorts, source test and gate logs remain. Issue stays open.
Resuming same-session-flood at
4b681d8e, original base21b37bca, after reading #197 and parent #55. Ported the break-it review acceptance cases from1098705a: retained ordinary perf-VM cohorts fail all three cases, paint growth 46.6/29.8/31.9 ms against 16.67 ms. Shadow fixes already present. Continuing duplex stage diagnostics and browser paint fixes; no budget/access/library change. All failed runs will remain alongside repeats. Attachment helper is now available; uploading retained D262 evidence first.current-experiments.tar.gz
continuation-runs.tar.gz
Completed
a7dffc83(pushed): ported all three break-it acceptance cases, unchanged gate; explicit retained-cohort replay fails 3/3. Tracer check and 16 functional terminal tests/75 assertions pass. D262 original evidence and continuation cohorts/logs now uploaded through the supplied issue-attach helper:current-experiments.tar.gz
continuation-runs.tar.gz
prior-evidence.tar.gz
Fresh LAN diagnostic n=100, ordinary current binary with range/bridge/window observer: receipt/paint p99 63.5/79.3 ms, growth 63.2 ms FAIL, load 1.98/0.58/0.33. Correct current bench-flight binary: receipt/paint p99 72.6/83.6, growth 67.1 FAIL, load 1.07/0.59/0.39. At input target 374 echo bridge send +11.09 ms, browser receipt +72.6, paint +83.6; outstanding parsed prefix 131072 bytes and prior inferred RTT 72.4 ms. Initial idle RTT ~2 ms; current estimator appears to amplify delivery backlog. WebSocket event timestamps differ by at most 2.8 ms from handler time, so they do not resolve the queue. Private candidate measures subtraction of local parsing work from input-Ack flight; no shipping change and no acceptance claim. True path changes must still widen without attach; rejecting if WAN throughput/latency worsens.
All attempts retained: duplex-0 and window-0 invalid socket-path attempts; window-0-2 old trace artifact diagnostic (no native stamps because env variable was wrong); window-current-0, timestamp-0, current-duplex-0 are diagnostic only. Native new current trace SHA pending attachment alongside source/rows; three buffered partial tail lines excluded. Trace does not alter authority checks.
New deterministic finding from current native/browser private trace cpu-trace-0, LAN n=100: input target 317, forwarding cursor 9751927; echo offset 9830809 is 78882 bytes ahead. Input arrives +0.62 ms, PTY Ack +0.72; echo PTY read +4.06, ring +6.15, shim send +6.21, daemon receives only +35.4 after render refunds at +34.48..35.38. Exactly 65536 bytes of input allowance exhaust at cursor 9817463; the old range sends only 3550 of 16384 bytes. New isolated production-flow reproducer fails with left=3550/right=16384, matching the trace. File paint-round/reserve-regression.rs plus reserve-before.log, current trace and all cohorts will be attached.
Proposed measured candidate: six framed chunks (96 KiB) inside existing permission, accounting for partial relay frame, kernel/socket frames, shim pending frame and the PTY read containing echo. No larger output window, extra channel, reordered bytes or access change. Current native-only bulk has no recent typing reservation, so paired exact 50 MiB throughput decides whether retained. Private static candidate builds separately from shipping sources; no acceptance claim. CPU-estimator candidate remains insufficient: LAN/150 receipt p99 45.2/182.0 ms; paint 50.5/191.5; growth 34.2/25.1 FAIL. Native flow reproducer preceded any proposed shipping fix.
Handoff remains INCOMPLETE / HOLD: browser paint growth still misses D130/D214/D259. Branch same-session-flood, HEAD
4ff1140200, both commits pushed.a7dffc83ports the three failing break-it acceptance cases;4ff11402adds read-only credit-window/ownership metadata to the existing private observer. No product behavior, access checks, protocol layout, library/engine, budget or deployment changed.Evidence, all valid/invalid/failed runs together: paint-round-evidence.tar.gz
Original D262 evidence is now uploaded as well:
current-experiments.tar.gz
continuation-runs.tar.gz
prior-evidence.tar.gz
Fresh matching native trace identifies a 78882-byte echo prefix beyond the forwarding cursor versus a 65536-byte allowance; deterministic production-flow replay fails at the observed 3550-byte partial chunk. The private 96 KiB reserve passes that reproducer but fails browser acceptance. Input-Ack RTT also grows with browser backlog: one current echo leaves the bridge at +11.09 ms, receives at +72.6 and paints at +83.6; inferred prior flight72.4 ms. MessageEvent timestamps do not expose that delivery queue. Subtracting local parser work is insufficient and may remove work overlapping network travel; it is rejected along with the wider reserve.
All new complete cohorts below are diagnostic, perf VM, n=100 per phase. Receipt/paint p99 and paint growth in ms; every same-session row FAIL. Original retained ordinary acceptance cohorts still fail all three replay cases.
Invalid first runs: duplex-0/window-0 refused the overly long fixture Unix path before measurement. window-0-2 used the old native diagnostic artifact and wrong trace environment variable (no native stamps), so is excluded from current native acceptance. Partial buffered trace tails are excluded. Artifact digests, raw cohorts, before/after load for reserve-driver runs (end load for other diagnostics), observed browser receipt throughput, source patches, reproducer and all gate logs are in the attachment. No new CPU/RSS or finite bulk-transfer acceptance claim: failed candidates were rejected before those gates. Earlier native/throughput/fifty-PTY/repaint evidence remains in prior attachments.
Current checks: strict tracer/helper TypeScript pass; 16 functional terminal tests/75 assertions pass, three external-cohort cases skip by default and fail with original retained cohorts. Author checklist is in attached README: private counters only, exact ownership/epoch/replay/mode/legacy fences unchanged. No rejected code remains in product files. Original scripts/pycache remains untouched; tracked tree clean.
Final scripts/verify fast on HEAD: CARGO_TARGET_DIR=~/.cache/codex-scratch/same-session-flood/static-target, INFRATERNAL_TEST_RTT=0, RUST_TEST_THREADS=2, TRACER_TEST_PORT=4497; exit1, only existing static-size limits fail (x86 22478000 >16404816; ARM19911624 >13817816). Full output is attached. Failed first gate attempts retained: initial relay self-test stopped before Rust; first full retry passed all non-size rows; four-thread final rerun failed server_setup_terminal_echo_and_resume_preserve_offsets_once and mesh_lifecycle_withdrawals_survive_calls_but_never_end_a_replacement, then stalled in four socket tests. Interrupted only owned test PID3610903 (no children); both failed cases pass isolated, and final two-thread full workspace passes. No baseline exception claimed.
Verbatim final gate summary:
Resume from attached README, current-duplex-0/cpu-trace-0 ranges and reserve-regression.rs. Next work must reduce the actual source/delivery queue or measure a faithful newest-screen/parse-off-main-thread path with the existing engine and complete shim retention; larger reserves, naive RTT correction and earlier renderer-only batching/coalescing have not met acceptance. This is no claim of completion or merge readiness. Measurement units finished; no issue closed. Scratch targets/cohorts retained for this unfinished lane; private rejected source checkouts can be reconstructed from the attached patch.
Resuming same-session-flood (browser paint growth) at
4ff1140200, original base21b37bca. Read all comments on #197. The break-it acceptance cases from1098705aare already ported (a7dffc83); they remain the definition of done. Plan: perf-VM browser stage traces under flood (main-thread per frame, input->send, receipt->parse->render->present), find the stage that adds the growth, fix it there. The rejected experiments (larger reserves, CPU-adjusted RTT, callback coalescing, bounded task batching, rate caps, server I/O priority) are not repeated without new evidence. D188 budgets unchanged. No deployment.Finding (perf VM, fresh baseline, ordinary native artifact 7994f8a9 + current client
4ff11402with observer, LAN, n=100/phase, load 0.90/0.34/0.25):New observer field
receivedAtInputgives the FIFO byte count ahead of each echo (echo out_seq minus the client's received cursor at keypress): p50/p99 248,321/422,269 bytes. Drain rate in the flood is 7.85 MB/s, and 248 KB / 7.85 MB/s = 31.6 ms = the receipt p50. The growth is entirely bytes queued ahead of the echo divided by the browser's drain rate; nothing else of note.Two terms make that queue large:
Candidate under measurement (browser only, no protocol change): refund at parse (the terminal state already holds the bytes; the ring keeps them until paint, and the bank excludes them, so the 1 MiB ring bound is unchanged); window = 8192 x RTT + 64 KiB, with no frame term; an Ack whose flight was mostly spent parsing (>50% parse time) may only shrink the estimate, while an idle-parser flight (a really slower path) still widens it at once, as the shadow-review P2 requires.
Candidate A (parse-time refund, window 8192 B/ms x RTT + 64 KiB, parse-share estimator guard) fails. Perf VM, n=100/phase, artifact 7994f8a9:
Stage stamps from the delayed bridge (ms after keypress, LAN p50/p99): input reaches the bridge at 0.65/4.0; the echo leaves the bridge toward Chromium at 10.8/35.1; JS receipt is at 31.6/44.8. The queue sits between the bridge's socket send and the message handler, so it is in Chromium/kernel delivery, not in our ring: unparsed bytes in the ring are about 0. The estimator guard never fired. Parsing is under 50% of a flight, so the main thread is not saturated; delivery (~7.5 MB/s) is the limit. RTT estimate p50/p99 is still 23.0/28.4 ms against a true ~2 ms, so the window stays about 250 KB, and FIFO bytes ahead of the echo are still 248 KB at p50.
Conclusion: refunding at parse is not enough on its own. The window must come from a queue-free RTT, and no input-Ack flight taken during a flood is queue-free. Next, an attainability experiment: lifetime-minimum RTT (the bound the shadow review rejected for path changes, used only to measure what a correctly sized window achieves) with 64 KiB and 32 KiB headroom.
Measured on the perf VM (artifact 7994f8a9, n=100/phase), all FAIL, all reported:
min32 crosses the agent's 64 KiB interactive reserve: bulk gets no ordinary credit while typing, the 250 ms starvation detach fires, and the p99 sits at ~333 ms.
Candidate C estimator: an Ack that arrives behind more than 16 KiB of output may only lower the RTT estimate. A queue-free sample comes from a parse refund sent when the host had spent all its permission, timed to the first output it releases. Nothing can be queued ahead of that output. The last 8 are kept and their minimum is used. A quiet Ack flight (the path itself, for example a new slower relay) replaces them. It holds the true RTT: 1.8/152.9/303.0 ms against the old 28.9 ms at LAN, with no lifetime minimum.
Decomposition per echo, p50/p90/p99 ms. "Source" is bridge echo receipt minus bridge input receipt minus the shaped half-RTT; "Chrome" is JS receipt minus bridge echo send:
Finding: the browser-side queue (Chrome delivery) is fixed by a correct window: LAN p50 20.9 -> 2.6 ms, p99 47.5 -> 10.3 ms. The remaining tail is the source term: the echo waits 22-32 ms at p99 before it leaves the server. The browser drains at its parse rate, 7.3-7.4 KB per ms of write() at LAN (write time ≈ 100% of wall time during an echo wait, so parsing saturates the main thread). The host already holds ~79 KB of PTY output ahead of the echo (the earlier trace measured 78,882 bytes), and that alone costs ~10.7 ms at that rate. The agent's 64 KiB interactive reserve also withholds bulk credit while typing, which costs throughput at small windows (C64 LAN 4.33 MB/s). Next: a private, never-shipped agent build with the reserve switched off, to see whether the source tail is reserve dynamics or plain FIFO drain.
Reserve experiment, all FAIL: private agent build (exp-noreserve, SHA-256 prefix ea9d2599bf8c3e78, never shipped;
4ff11402+ an env switch that makesOutput::reserve()return 0) with candidate C clients, perf VM, n=100/phase:Finding: the agent's interactive reserve is net positive at WAN. Without it the 300 ms source p99 goes from 21.8 to 123.4 ms. At LAN it trades throughput for a shorter source wait: with the reserve, C64 LAN source p50 is 7.5 ms at 4.33 MB/s; without it, 12.4 ms at 6.61 MB/s. The reserve stays; this rejects removing it.
Lower bound: with the browser-side queue gone (Chrome p50 2.6-6 ms), the echo still waits behind the bytes the host already holds (kernel PTY buffer, shim frame and socket, agent pending frame; ~79 KB in the earlier trace), and the browser drains them at its parse rate (7.4 KB per ms of write() at LAN for
yesoutput, one scroll per two bytes). That floor is ~10 ms at p50 and 21-35 ms at p99 across all variants. Flow control cannot reorder those bytes, so no window setting reaches one-frame p99 growth under ayesflood on this VM. Repeat cohorts of base/C64/C96 are running to separate the variants from run-to-run noise before anything is committed.Resuming same-session-flood at
9f5597d6, original base/merge-base origin/dev21b37bca. Read #197 and parent #55 history; acceptance cases from1098705aalready ported. Last source commits refund parsed output and estimate queue-free RTT; all measured variants still fail paint growth. Continuing source FIFO and existing renderer investigation with perf-VM measurements only, every run retained. No access/budget/foundational engine change or deployment.Step
ab7be704pushed: opt-in FLIGHT_TRACE CPU/timeline captures around same-session phase; strict helper TypeScript and diagnostic bundle build pass. No product behavior changed.Head retained cohorts replay 0 pass / 3 fail. New perf-VM n=100/phase diagnostics (ordinary native 7994f8a9; every run retained): ReleaseFast stripped WASM grows 424218 ->671456 bytes; D188 critical transfer fails (gzip349234>307200, Brotli272864>256000). Same paint p99/growth: LAN42.9/26.9, 150ms240.5/74.4, 300ms476.6/160.3 ms, all FAIL. First three r6-fast attempts had invalid TRACER_DIST path, no samples; corrected runs retained alongside them. ReleaseSmall ASCII-ground bypass adds184 WASM bytes, D188 passes (gzip296291/Brotli246461), LAN47.0/28.1 and 150ms249.6/83.5 FAIL; 300ms pending. Neither candidate shipped.
Perf-VM current trace profile-current-0: paint69.2/growth53.2 FAIL (profiling enabled, diagnostic only), load2.79/1.34/0.55. FunctionCall p99 2.38ms, animation callback1.80ms; repeated WASM self work ~1.3s across capture, not one isolated long callback. CPU/timeline/range raw files retained under r6 on VM/job scratch. Next: map WASM hot functions; matched96KiB input loan plus128KiB LAN window trial, because old trace's echo prefix78882 bytes exceeds64KiB loan. That trial uses existing rejected private native artifact, no runtime change.
First scripts/verify fast fails agent_daemon restart oracle iteration10 despite full1747-byte payload received/Acked; exact isolated retry passes24 positions. Next head fast stopped before Rust at loaded-host relay selftest (p50 39.22,p99 361.38). Both retained, no baseline exception claimed; final head retry still required.
Further perf-VM rows, n=100/phase, all retained: ASCII-ground bypass 300ms paint398.5/growth82.1ms FAIL, completing three failed profiles. Matched96KiB loan/128KiB headroom: LAN paint32.7/growth16.6ms PASS once;150ms217.6/37.6 FAIL (other-session growth18.2 also FAIL);300ms364.2/47.9 FAIL. Rejecting both candidates; no product changes.
Current traced LAN fixed60Hz windows: FunctionCall aggregate p50/p99 12.756/15.525ms (485 nonempty windows), max16.308ms. WASM hot functions map to Screen.clearCells (387ms CPU self), PageList.grow (353ms), Terminal.index (183ms), terminal write/parser (163ms), Terminal.print (105ms). Mapping uses same pinned-source symbol build; no new engine/library. Enabling bulk_memory target alone produces an identical424218-byte WASM (SHA5335687263d92325b6736201a107a46cf324a3503f94ac336bf6aa0a184a8d4d), so that compiler experiment has no effect and no extra timing run.
Private candidate under build: preserve managed-reference cleanup and mandatory row clearing, but expose default all-zero cells as a constant byte memset instead of filling one runtime packed-u64 cell at a time. Colored blank cells retain the existing fill. Existing acceptance replay fails before this performance change; generated colored/Unicode/hyperlink/alternate-screen/history differential follows. No shipping change or acceptance claim yet.
Two further fast attempts stop at the loaded-host relay selftest (RTT0 p50/p99 9.26/52.12;RTT300 372.01/403.98). All gate outputs retained, no baseline exception claimed.
All new renderer-only candidates remain private and fail acceptance. Zero-byte clear (21 extra WASM bytes;13,454 VT viewport/history comparisons match;D188296062gzip/246259Brotli): paint growth LAN/150/300=16.7/54.4/22.7ms FAIL. Fresh unchanged-head baseline=26.3/54.3/50.3 FAIL; these single cohorts do not establish a stable improvement. Zero clear+96KiB loan/128KiB headroom=15.4 PASS LAN once,68.9/51.2 FAIL WAN. Factoring the full-screen scroll call out of partial-region rotation=48.3/108.3/49.2 FAIL;13,454 functional comparisons match. All source patches/cohorts and first attempts retained under r6, no runtime optimization shipped.
Native/bridge diagnostic at150ms (traced artifact, not acceptance): source prefix p50/p99=43520/76289bytes, budget65536. Shim-send->daemon-receive p99 3.88ms;daemon-receive->send3.04ms;server-receive->WSsend19.92ms. Input-to-PTY-read p99 14.71ms;PTY-read->ring4.62ms. Bridge timer lateness p99 upstream/downstream5.28/6.26ms;Chrome input->bridge-front p99 27.41ms, receipt delivery71.38ms, receipt->paint39.3ms. Native work receipt->WSsend39.28ms. Trace heavily affects the system (paint growth114.8ms;browser flood4.75MB/s), so retain for localization only. No justification for changing authority/control selection or an unbounded reserve.
Next private attainability prototype: move parsing of the SAME pinned VT engine to a browser worker and mirror only the newest completed viewport for rendering; parsed-byte acknowledgements retain the existing flight bound, while paint callbacks retain FIFO byte ownership. No new engine/library, no raw-byte loss or shim/protocol change. Prototype is flood-only: scrollback/selection/mode/snapshot integration are not production complete; cannot ship or count as ordinary acceptance. Measure whether clearing main-thread parse work actually meets the budgets before undertaking that integration. Every failed run remains reported.
Head
ab7be704final fast run under a CPUWeight10000 functional-check scope: all non-size rows PASS;static x86/ARM22478000/19911624bytes exceed existing16404816/13817816limits. No baseline exception claimed. Prior attempts and isolated agent_daemon retry retained. Verbatim summary:Private worker prototype now really installs (runtime assertion): still FAIL. RTT0/150/300 paint p99/growth72.0/43.6,258.3/76.3,369.9/38.3ms. FIFO parsing moved off-main-thread does not remove the work ahead of an echo; window-sized bursts can still sit in the worker. D188 passes298122gzip/248413Brotli; not production complete or shipping. Initial r6-worker cohorts did NOT install the worker: observer onLoad consumed terminal.ts first. Likewise r6-reserve96-c128 and r6-zero-reserve96 did not actually change96KiB browser headroom to128KiB. Those runs remain as misconfigured diagnostics, not claimed measurements of the intended variants. Runtime validation was missing; corrected worker build prepends its load hook and preserves range stamps, and readiness/install asserts workerReady and workerUnparsed. WASM candidates used a different file hook and were active.
Next private measurement, proposed before code: existing shim Snapshot framing as a latest SIMPLE screen view, with complete bytes still in the unchanged ring. Only compact unseen printable-ASCII/CR/LF at a known parser-ground cursor; never queries/escape/UTF8 sequences. Preserve64KiB raw output after accepted input so generated echo ranges are still observable. No new engine/library, wire layout or access change. This is an attainability build under a private environment flag only, not a product selection: D259 requires measurement before deciding a latest-screen lane. Production negotiation, retained scrollback interaction, parser/replay fidelity and resources would all require real tests and review before any shipping code. Current ordinary head still misses all three acceptance profiles. Every run will remain reported.
Step
e12f7030pushed: the browser observer confirms echo paint using the first painted exclusive raw-stream cursor beyond the independently observed echo offset. Repaint payload bytes are encoded state, not raw offset ranges. Regression decodes a real Output frame at offset10: an older repaint(head9,length100) wrongly confirmed paint at100 before; a newer painted cursor11 confirms at200 after. Failing-before log retained; unit1/1 and strict helper TypeScript pass. Raw ordinary cohort acceptance budgets/receipt clock unchanged; no production terminal/access/protocol behavior changed.Private latest-simple screen attempts remain INCOMPLETE/invalid, not acceptance. Original/exit/frontier/refund fixtures timed out after baseline+other-session because the secondary viewer ignored/then mishandled Snapshot teardown. Owned-process teardown attempts failed first on missing copied helper, then wrong rendezvous path, then a missing private shim PID. Source inspection found live snapshot serialization errors were propagated by the prototype, which may terminate an unrepresentable-mode session; the prototype now falls back to ordered raw data on serialization refusal, build pending. No such code is on the branch. All attempted profiles and their completed/partial rows are retained under r6; native generated-x metadata contains only timestamps/input offsets/output offsets, never PTY text. Latest-view timings require matching exact native echo offsets with actually received/painted cursors; input Ack is never paint proof.
D259 latest-view lane is still a measurement candidate, not a selected engine/transport or shipping feature. Production negotiation, local history retention, parser/mode/replay fidelity and resource/throughput validation remain required if the measured candidate is viable. Worker-only parsing and renderer/compiler candidates still fail. Final head fast gate running; previous
ab7be704non-size rows pass, sizes remain above old limits. No deployment or issue closure.Head
e12f703022: final scripts/verify fast exits 1. All non-size rows pass; x86-64 22478000 >16404816 bytes; ARM64 19911624 >13817816 bytes, identical to earlier ab7 head sizes. Only harness files changed, no native runtime change. Gate output verbatim:Private fallback screen cohort completed n20 at LAN/150/300, but emitted no live snapshots. Same-session receipt p99 64.2/322.1/392.7 ms, paint p99 78.6/365.3/413.4 ms, growth59.2/193.7/87.3ms: all FAIL. Native generated-x offsets matched actual received and painted cursors; input Ack was never used as echo proof. Investigating conservative eligibility and unrepresentable engine state; candidate remains private, not shipped. All attempts and failures being bundled for issue attachments (D262).
Correction to the preceding comment: exact e12 head x86-64 size is 22477936 bytes (not 22478000, the prior ab7 size), still above max16404816 by6073120 bytes. ARM64 is19911624 as stated. This branch changed only diagnostic observer files; full head gate log is retained for attachment.
End-of-turn checkpoint, GOAL UNMET. Head/origin same-session-flood
e12f703022;ab7be704opt-in after-auth profiling ande12f7030raw-frontier paint-observer regression fix are pushed. No runtime optimization committed. Review acceptance cases already ported ata7dffc83; current replay of fresh ordinary-runtime perf-VM cohorts:0pass/3fail. No deployment or issue closure.All61 browser cohorts, failed first/setup attempts, configuration corrections, CPU/timeline traces, source patches and checks are attached. ReleaseFast, ASCII bypass, zero-clear, factored scroll and actual worker parsing all fail; not promoted. Earlier c128 and worker labels were misconfigured because observer onLoad consumed the source first; README and ledger disclose them.
Final private latest-ground n20 diagnostic: receipt p99 37.5/190.5/386.6,paint49.8/208.9/398.3,growth30.5/37.5/76.1ms, FAIL all; zero live snapshots. Engine refuses the faithful painter for these states (numeric-only echo metadata and constant refusal reason retained). Private code safely falls back to raw on refusal; none is shipping. Reusing strict restoration snapshots is not an effective newest-view lane here. Remaining work: measure a bounded viewport representation/import on the pinned engine that preserves parser/modes, already-held history and replay, with explicit old-peer negotiation; then full n100 acceptance, throughput and resource validation. No library/engine choice made.
D188 ordinary head production build/budget PASS: critical295953gzip/246297Brotli bytes, deferred49804/43969. Observer regression1pass, strict helper/tracer TypeScript PASS; selected terminal19tests/55assertions PASS. Reviewer self-check recorded in README; no credentials or raw PTY text in generated native metadata or profiles.
Final scripts/verify fast on e12 exits1: x8622477936 >16404816 and ARM19911624 >13817816 bytes. Every non-size row PASS. Full output attached; no host-load baseline exception claimed. Verbatim summary:
Final evidence links (supersede earlier partially uploaded README/table):
README.md
ALL-RUNS.md
all-runs.json
latest-ground-raw.tar.gz
all-local-checks.tar.gz
private-prototype-sources.tar.gz
private-latest-simple.patch
private-wasm-candidates.patch
latest-fallback-screenshots.tar.gz
fast-e12-head.log
head-production-budget.log
latest-ground-summary.json
latest-fallback-summary.json
private-wasm-and-worker-artifacts.tar.gz
head-acceptance-replay.log
vm-all-attempts.tar.gz
Private sources/checks remain under /home/kayg/.cache/codex-scratch/same-session-flood/r6 for unfinished-work resumption; no active build or perf run remains. Worktree tracked files clean; pre-existing untracked Python pycache directories retained. No repo evidence tarball or root result.md created.
Resuming same-session-flood at
e12f703022on same-session-flood, original base21b37bca. Read #197 and #55 history and repository contracts. Review acceptance cases already ported; latest ordinary cohorts still fail LAN/150/300 growth 26.3/54.3/50.3 ms. Shadow correctness fixes already present. Continuing within the pinned VT engine and existing ordered byte/credit protocol, starting with a failing acceptance replay and inspecting prior worker/scheduling experiments. No deployment, budget/access/engine selection changes; every measurement retained and reported. Perf VM use and branch pushes are authorized by the job-specific brief.Failing-before acceptance replay: 0 pass / 3 fail on the retained e12 ordinary cohorts. Previous profiling identifies clearCells and PageList.grow as the top VT self-time; 4 ms frame scheduling would limit parser service and increase the same-session FIFO unless that work gets faster. Measuring a private ReleaseSmall +simd128 build of the same pinned engine (5714ed07), retaining the exact existing adapter patches and every row clear. This compiler candidate has not been tried in the recorded rounds; no wire/API/library selection change. Candidate must pass D188 and ordinary n100 LAN/150/300 growth gates before any production change. Prior ReleaseFast/ASCII/zero-clear/worker/snapshot failures remain rejected.
SIMD compiler candidate rejected: n100 LAN/150/300 same paint growth192.0/488.6/395.4ms, LAN other-session31.5ms also fails. Fresh unchanged-runtime diagnostic control LAN68.1ms fails; WAN control still completing. All runs kept, with before/after load.
Next measurement separates acceptance from diagnostics: current build-harness injects bridge recording into every output frame, and build-browser injects range stamps into production parsing. Build the exact production terminal with only the existing probe instance exposed; bundle browser-run without bridge transforms. Existing receipt/paint observers and acceptance budgets unchanged. This measures whether diagnostics themselves inflate the tail; no product/runtime/protocol changes or passing claim. In parallel, private targeted hot-function inlining in the pinned VT engine (not the rejected never-inline split) is built for comparison; measured candidates remain private unless accepted.
Ordinary uninstrumented terminal/bridge cohorts still fail: LAN45.3ms and150ms106.1ms growth (n100); 300ms retained, summarization pending. Hot-function inlining also fails LAN65.7ms; no private compiler change will ship. The single-visible-terminal acceptance workload has no background browser window, so prioritizing the focused window over other windows or lazily parsing an off-screen window cannot reduce the tested focused-window FIFO.
Before new representation work: private attainability diagnostic will use the existing visible-only painter as a DISPLAY-ONLY stand-in at parser-ground printable-ASCII/CR/LF boundaries. This deliberately does NOT claim faithful Snapshot restoration, input-mode correctness, or production acceptance: the prior faithful painter refused all live states. Exact raw bytes remain in the unchanged shim ring and the authoritative native VT still parses every byte in order. The private observer matches native generated-x offsets to first received/painted frontiers (never Ack as paint proof). The experiment may show whether a representable newest viewport removes queueing; a production version would need a separate negotiated view representation and preservation of input modes, client history/selection and replay. No shipping wire layout/API/access/engine/budget changes. Diagnostic first, no implementation selection or approval request.
Steps pushed:
612a9e8dterminal diagnostics opt-in;a18beb08bridge diagnostics opt-in;d8ff5595real bundle regressions (before2fail/1pass, after3pass/11assertions). Tracer/helper strict TypeScript and workspace fmt pass. No product runtime change; stages now require FLIGHT_STAGES=1. Ordinary fixture keeps existing auth, delay, receipt and paint observers.All12 new n100 perf-VM cohorts below, not cherry-picked. base is unchanged runtime with full range/bridge diagnostics; ordinary has only required receipt/paint observations; simd and inline are rejected private compiler candidates. Every growth row FAIL; SIMD LAN other-session also fails (31.5ms). All before/after load/raw cohorts retained in r7. No engine/protocol/budget/access changes are shipping. Source/frame hooks affect timing materially (e.g. LAN plain flood3.89vs7.87MB/s); removing them does not resolve the acceptance failure.
D188 private SIMD294703gzip/246026Brotli and hot-inline298026/247940bytes pass; 13454 generated viewport/history comparisons match for each. Both are nevertheless rejected on latency. Previous failed helper invocations retained: incorrect Bun --cwd syntax tried a nonexistent package (404); corrected existing local TypeScript checks pass. First tar-fetch glob quoting was invalid; corrected fetch/summarization succeeds. These are tooling failures, not additional benchmark runs.
Private display-only attainability build is linking. It uses the existing visible painter, so omits hidden state and cannot be treated as faithful restoration/ordinary acceptance. It will isolate viewport delivery before any production representation is chosen. No successful candidate claim yet.
New display-only diagnostic (n20, paced with Ack+80ms and normalized against independently recorded native x offsets; NOT ordinary acceptance): LAN receipt/paint p9916.9/41.6ms, growth22.2ms FAIL;150ms206.4/248.6,growth78.2 FAIL;300ms completed, normalization pending. LAN processes27,137,536rawPTYbytes in3.001s into1,139,307visible-painter bytes across1703liveSnapshots. The visible painter now actually runs; prior strict restoration painter produced zero live Snapshots. Hidden state/history fidelity is deliberately incomplete, so this cannot ship or certify ordinary acceptance.
Concrete renderer finding: a second live Snapshot waits for the older Snapshot's paint callback, then parses AFTER the render loop and waits another frame. New functional regressions fail before the fix: newest repaint absent from the first frame; raw-prefix case also queues its newer sibling. Testing one coalesced repaint owner per frame (aggregate exact credit, only newest payload retained), preserving raw ownership, replay fences and cursor epochs. This differs from the previously rejected raw callback-only coalescing: the newest checkpoint is parsed before that frame.
Further private experiment: publish display-only frames no more than once per8ms, coalescing authoritative state before transport; continue parsing every raw byte into the native VT/ring while the display viewer waits. It is not a raw-stream backpressure replacement and is not selected production behavior. This prevents a raw-byte-sized flight window from queuing hundreds of small obsolete encoded viewports. No shipping protocol change; a faithful separate view representation/history/input-mode design remains necessary if it measures well.
Head fast first attempt fails repeated_tiny_credit_pauses_preserve_shell_progress with Output cursor328vs367 plus existing static-size limits. Exact isolated head retry passes all four12MiB floods. Per #118 instruction, detached origin/dev804ac0e8 baseline is building for the same test; no baseline exception claimed. Both outputs retained.
R7 longer prototype and worker follow-up (head
a3102bc3, pushed): newest-live-repaint functional regressions now pass 5 tests/25 assertions; selected tracer checks17/73 and D188 critical296175gzip/246431Brotli, deferred49805/43988. Display-only n20 growth2.2/12.8/4.4ms passes diagnostic checks only; it is NOT faithful production restoration or acceptance.All n100 follow-ups retained: display-only LAN127.0ms growth,30087.9ms FAIL;150 cannot normalize because native generated-x metadata lacks target358, so INVALID, not a pass. LAN typed phase had6704raw frames and ZERO liveSnapshots (plain flood182Snapshots), unlike n20's1004typedSnapshots. Investigating view eligibility with numeric-only transition diagnostics before interpreting that run as a compaction result.
Raw worker import-at-draw n100 growth38.2/64.7/47.1ms FAIL (LAN plain7.071MB/s); three-buffer pool51.9/40.6ms FAIL atLAN/150;300 incomplete: other-session flood did not respond. Neither prototype ships (mode/history integration incomplete). Testing task-driven viewport publication: the worker's4ms timer may be starved by queued writes; publish from parser tasks with the same bounded pool. No protocol/library/budget/access changes. Ordinary current-head matrix and full fast retry running. Earlier head tiny-credit isolated retry AND detached dev804ac0e8 isolated test passed; no baseline exemption claimed.
R7 checkpoint, NOT complete. Head
a3102bc3a3; five atomic commits pushed (612a9e8d/a18beb08/d8ff5595/8f0eac7f/a3102bc3). Ordinary artifacts exclude terminal range/bridge diagnostics. Newest live repaint is prepared before the actual renderer draw, with one exact-credit owner; raw prefixes/replay fences/epochs retained. Real pinned VT + regressions pass; relevant suite24tests91assertions and tracer/helper strict checks PASS. D188 unchanged: critical296175gzip/246431Brotli; deferred49805/43988B.Current ordinary n100 perf-VM acceptance (0/3; every earlier run in attached inventory):
Private worker task-driven publication FAILS: growth31.8/107.6/111.9ms; uninstrumented-worker31.6/85.0/120.2ms. Modes/history/selection incomplete; none ships. First pooled300 incomplete (other-session flood did not respond). Visible-only painter n20 growth2.2/12.8/4.4ms and later n100LAN16.6ms are diagnostic ONLY, not faithful restoration/acceptance. Earlier n100LAN fell back to raw and failed127ms;150 invalid (native target358 missing),30087.9ms FAIL. Numeric eligibility retry stays compacted (1756typedSnapshots, zeroRaw) but does not reproduce fallback. First retry setup failed ENOENT, corrected as view-reason2. All retained.
Head main-thread perf-VM trace:392render phases p50/p993.008/12.568ms; non-overlapping FunctionCall time per fixed60Hz interval12.674/15.111ms. Large VT WASM functions account for roughly3seconds of self samples. Trace is diagnostic, not acceptance.
Final scripts/verify fast output summary, verbatim (FULL output attached):
First fast also failed tiny-credit cursor328vs367; isolated head AND detached dev804ac0e8 retries pass, no baseline exemption. Final full Rust tests PASS. Dispatcher has no iterate mode; rejection included. Checklist/evidence/reproduction in archive. Temporary baseline checkout/target and private source clones removed after attaching patches; pre-existing build cache retained for continuation. No deploy/issue close/engine/dependency/access/budget change.
Remaining: faithful newest-state or full-worker mode/history/selection/replay integration, all three ordinary acceptance cases, a passing candidate's end-to-end CPU/RSS/scale evidence and a green full gate. Current changes can be reviewed separately; this lane is not ready to merge as complete.
r7-evidence.tar.gz

cohorts.md
head-fast2.log
R7 cleanup confirmation: all39 measurement scopes named in this round's perf-VM logs are inactive. No test scope left running. origin/same-session-flood matches
a3102bc3a3; tracked worktree clean (only the two pre-existing pycache directories remain).Started flood-server-ship on branch flood-server-ship, base/origin/dev
b182529fcc. Read #197 (108 comments), linked parent #55 (16 comments), CLAUDE.md, DECISIONS.md, ARCHITECTURE and PROCESS. D268 Q19 authorizes integration of reviewed4b681d8eonly; later browser experiments excluded. Merge preserves dev restart liveness/mesh/inventory/size changes. Functional gates on build host, native echo/paired throughput only on authorized perf VM. Push flood-server-ship only; no deployment.Started flood-worker at
a3102bc3a3on branch flood-worker (same-session-flood base named in brief). Read #197 history and parent #55 plus repository contracts. Continuing owner-decided worker integration using the same pinned VT engine; no deployment or budget changes. Finding: scripts/same-session-flood/browser-run.ts uses one focused browser terminal for the same-session phase; the sibling flood is a native socket, so background-only browser parsing cannot change the three acceptance cases. Clarification requested while inspecting worker/state integration. scripts/verify has no iterate dispatcher in this base (fast/nightly/integration/browser/latency/bench only); will record that invocation and use per-slice checks until the final fast gate.Merge prepared (not committed yet): exactly
4b681d8e, 44 changed paths, 2503 insertions/104 deletions relative tob182529f. Four conflicts resolved by combining #197 credit capability/conditional expiry/trace handling with #199 stream Pong and shim state fences, retaining both embedded regression groups and both fuzz bins. Original atomic history is retained by a merge, not squashed. No evidence/captures paths in merge delta; e12f7030/a3102bc3 excluded. First iterate attempt stopped before Rust at latency relay self-test under build-host load; retry passed that preflight and is compiling. That preflight is not performance evidence. Builds and functional checks continue; perf VM measurement runner prepared with one short flock/CPUWeight=10000 scope per run.Integration finding: #199 apps/tracer/test/input-ready.test.ts creates TerminalClient from its prototype and omitted #197 creditBank; replay_complete now calls fundOutputCredit, so undefined fixture state reaches protocolFailure. Failing readiness regression retained in liveness-tests.log. Initialize creditBank=0 to model no banked refunds; no product change. Combined #197 terminal + #199 readiness suite now 23 pass/0 fail/97 assertions (terminal-integration-tests.log). Prior #197-only suite 22 pass/87 assertions; tracer and flood-observer TypeScript checks pass. Separate transfer-budget review was invoked before its required production build (dist/chunks.json absent); rerun after production build. Exact reviewed source preserved except conflict combinations described earlier.
Gate finding: iterate retry passed relay preflight/fmt, but CLI plugin compile-out could not build pinned VT dependencies: HttpConnectionClosing for zigimg d7b7ab0b and uucode 5f05f8f8 (iterate-2.log lines 93-114). Other gate rows continue. This is a dependency-fetch failure, not a changed version; no source workaround or foundational selection. Both static builds continue. Production tracer build passes; dev deferred transfer review now passes with 42,471 Brotli bytes <=45,056 (transfer-review.log). Original missing-dist invocation retained. Source self-review: all reviewed-only files identical to
4b681d8e, no evidence/capture paths tracked; dev liveness/auth/path checks preserved.Completed and pushed
dee067c4(isolated VT checkpoint adapter) and58b6c98f(real-engine state regressions). No terminal routing changed yet. Workspace fmt and strict tracer check PASS; 3 pinned-engine tests PASS, 271 assertions. State comparison covers split UTF-8/CSI/OSC, history, saved/alternate screens, mode and device-response state, continuation and resize. The adapter explicitly requires a per-terminal WASM instance and an empty WASM stack; a test locks its one mutable-global layout. Transfer/memory measurements are pending, not accepted. Acceptance replay from the attached r7 ordinary head cohorts reproduces 0 pass / 3 fail: LAN/150/300 paint growth104.9/85.4/105.3ms. First new row-transfer regressions catch blank-codepoint and additional-grapheme semantics; fixing before committing that module. Scope clarification remains pending: same-session acceptance has no background browser window.Clippy integration findings (iterate-2.log): #199 daemon_liveness_tests.rs:124 lacked #197 terminal credit_hints argument (E0061); initialize false to retain its legacy frame sequence. Combined daemon writer became 101 lines vs100 lint bound; retain one ordered greeting/control/data dispatch with a narrow too_many_lines allowance rather than an unrelated refactor. Both fixes staged; no product behavior change. The release artifact is explicitly rebuilt after this integration edit before transfer/measurement. Full iterate continues and will be rerun; no passing claim yet.
Worker core steps pushed through
fe0d6313:3eb3dab7packed display rows;7df443c8real-engine row regressions (2 tests/1357 assertions);21a11faeFIFO worker commands;581be751real-worker regressions;14f8e757on-demand worker build;982c0f6dchunk classification regression;fe0d6313clean-checkpoint initial viewport fix (before0vs1360 cell bytes; after3 worker tests/17 assertions). Strict tracer check and all D188 budgets PASS. Current production critical gzip/Brotli296661/247307B; deferred49799/44054B; no budget change. No UI/session routing uses the worker yet.Perf-VM Chromium core transfer run4 completed, 20 moves each at0 and10000 emitted lines. This is a transfer diagnostic, NOT typing/paint acceptance. One dirty 80-column row:1280B; mirror p99 0.2/0.3ms. Exact checkpoint focus handoff p50/p99: no history5.4/8.8ms; history17.6/766.4ms. The engine retains1142 rows after10000 emitted lines; do not describe this as10000 retained rows. Native memory7.21/25.10MB per instance. Holding50 history-populated terminals on both main and worker sides retains100 native instances:1,245,184,000 linear-memory bytes per side; Chrome PSS275258->3811189KiB (RSS431436->3967488KiB). Load0.72/0.34/0.43 before,0.95/0.42/0.45 after. Frozen main-side retention and whole-memory copies are too costly to promote on this evidence; repeat transfer diagnostics are running.
All first attempts retained: transfer1 invalid (Node executable absent); transfer2 invalid (empty fixture write trips pinned engine allocator); transfer3 failed real state comparison because importing already-clean VT state produced no initial rows. This finding preceded
fe0d6313and its regression. Run4 uses the corrected full-first-viewport worker and 16KiB nonempty fixture chunks.Scope blocker needs orchestrator/owner clarification: the brief requires background-only parsing with the typed window direct, but all3 review acceptance cases flood the single focused browser terminal; there is no background browser window. They remain FAIL by construction with the focused path unchanged. Changing the workload or offloading the focused flood would change the requested scope. The question is pending; no acceptance workload/budget is altered. Full branch-head fast gate is running; no completion or merge-readiness claim.
First complete Rust pass stopped at agent_daemon abrupt restart iteration5: payload515 bytes all received and input-acked, then read timed out (iterate-2.log lines785-842). No baseline exemption claimed; this row is not among #118 exemptions. Original compile-out fetch and clippy fixture failures are also retained. Fresh iterate-3 uses an owned CPUWeight10000 functional-check scope, two build jobs/test threads; CLI compile-out now passes (25tests). Clippy/test rerun in progress. Native release builds and perf measurement remain pending; no performance claim from build-host timing.
Findings: iterate-3 passes fmt, VT fmt, CLI compile-out and clippy; abrupt-restart oracle and 8 daemon credit/replay tests pass. It stops at latency_fixture_accepts_the_unsolicited_startup_inventory waiting for CENSUS_FIXTURE_OK. Exact compiled workspace test binary retry passes1/1 (inventory-binary-retry.log); no baseline exemption claimed. Initial isolated Cargo retry selected another feature graph and was stopped by its owned PIDs before tests (inventory-retry.log retained). Serial iterate-4 is running. Initial x86 static merge artifact:22,287,472 bytes vs D243 cap22,204,304 (+83,168); baseline
b182529fis still building, so attribution is pending. Artifact explicitly rebuilding after final lint/fixture integration edits before perf transfer. No size ceiling/profile/dependency change; final fast remains required.Completed baseline build from
b182529f: x86 static22,275,888 bytes, already71,584 above unchanged22,204,304 cap. Initial merge artifact22,287,472 adds11,584 bytes; final post-edit rebuild still linking. D243 shipping-size blocker: orchestrator/owner must supply the existing size-cut work or a measured exception; this integration job does not change ceilings/profiles or reviewed product code. Other validation continues. Serial iterate-4 now passes restart oracle, startup inventory and reviewed real PTY shim flight:32,768 bytes ahead of Ack <=65,536 (shim-flight.stdout.log), plus8 daemon credit/replay tests. No baseline test exemption claimed; original failure logs retained. Final full gate and native perf VM matrix remain pending.Core evidence at
fe0d631345(pushed). 31 functional tests/1711 assertions and strict tracer check PASS; full fast non-static rows PASS, static builds pending. No terminal client creates the worker yet; task remains INCOMPLETE/HOLD.All three completed Chromium transfer cohorts are retained: run4/5/6 history handoff p50/p99=17.6/766.4,26.2/110.1,18.2/276.9ms; empty-history=5.4/8.8,7.7/20.6,6.9/217.2ms. n20 per fixture/run; p99 is the run maximum. Load pre/post: run4 0.72/0.34/0.43 ->0.95/0.42/0.45; run5 1.88/0.71/0.51 ->1.81/0.71/0.52; run6 0.08/0.23/0.34 ->0.30/0.27/0.36. These are core transfer diagnostics, not flood paint acceptance. One dirty row has1280 packed cell bytes plus metadata; mirror application p99<=0.5ms across all runs. The frozen-main retention / whole-memory handoff is rejected for UI promotion on these latency and50-window memory results. All six owned measurement scopes are inactive.
Archive includes every valid/invalid attempt, raw numeric samples, scale PSS/RSS, helper sources, failing-before regression, D188 before/after budgets, functional checks, retained acceptance replay and author checklist. Scope clarification still needed from the orchestrator/owner: background-only parsing cannot change the existing single-focused-terminal same-session acceptance cases. No workload/budget was altered and no completion claim.
worker-core-evidence.tar.gz
Step committed:
2f73f608d7. Merge parentsb182529fand reviewed4b681d8e; original atomic history retained. e12f7030/a3102bc3 are not ancestors.46 paths,2508 insertions/105 deletions; no evidence/captures tracked. Final product artifact f8764da68ababc3edd4774293a4ec1d1864c5a2e0e11c4291be84ca09ca42fd6; baseline0c954bc515c4200fbeb0aa1ad32c7b2bd1b18d747d58816305cf78b514116366.Full scripts/verify iterate exits0 (iterate-5.log), after retained failed attempts. Native/server/shim workspace tests, fmt, clippy, deny, TypeScript and production transfer checks pass;37 protocol tests/34463 assertions. Reviewed terminal/readiness tests23/97, shim Ack32768<=65536. Final scripts/verify fast is running on this exact head. No baseline test exemption used.
Perf VM,4vCPU, short flock/CPUWeight10000 scopes,n100 per phase: first same-session echo p99 LAN/150/300=25.23/184.18/352.78ms; growth23.54/23.85/25.99ms, allFAIL against16.67ms. Matched LAN follow-ups: reviewed7994f8a9 echo15.85/18.17,growth14.03/16.09 PASS; merge19.35/13.74,growth17.39 FAIL/11.63 PASS. All runs retained; these do not establish a stable merge regression, but native acceptance is not green and historical4.5/156/328 is not reproduced.
Paired fully byte-checked50MiB transfers,n3 each: dev/merge means LAN5.676/5.695MB/s (+0.35%),150ms5.680/5.674 (-0.12%),300ms3.315/3.256 (-1.79%). Individual values/load/resources in perf-summary.json and raw receipts. No reproducible throughput loss established. Retained reviewed7994 artifact also measures5.764MB/s LAN now vs its historical17.989; merge companion5.798. This comparison uses the identical reference SHA and unchanged native harness, not a new candidate.
50 retained real PTYs, one active finite flood: idle CPU counters unchanged for daemon and aggregate shims over1s; shim RSS291268->316972KiB, daemon7588->7780KiB; flood6.142MB/s. Not50 simultaneous producers.
Shipping blockers: native acceptance above; x86 merge22287472 bytes vs22204304 cap, baseline already22275888 (+71584), merge adds11584. No ceilings/profiles/engines/reviewed behavior changed to hide failure. Full final gate and evidence uploads follow; no deployment or issue closure.
Evidence for merge2f73f608 and the native acceptance/size findings recorded above (D262). Every initial failure and follow-up is retained; no benchmark budget changed.
perf-results.tar.gz
perf-summary.json
perf-machine.txt
functional-checks.tar.gz
Final fast first attempt has the known VT-credit cursor race349vs367; matching static head/baseline probes both pass in the same load window, so no baseline exemption is claimed. A complete fast retry is queued after the ARM build. Guest scheduling diagnostics find no cgroup CPU quota/throttling; idle steal samples0..4.72% do not explain the absolute throughput difference by themselves. No VM or host setting changed. Final gate transcripts and diagnostics will be attached after completion.
Incomplete handoff / HOLD. Branch flood-worker; HEAD and origin/flood-worker
fe0d631345. Nine atomic commits pushed. No deployment or issue closure.Built: pinned-VT checkpoint adapter, packed dirty rows, FIFO worker with one outstanding viewport, on-demand build classification and real-engine/thread regressions. NOT wired: terminal-client routing, paint-owned credit/epochs, DOM input, selection/search/scrollback/replay integration. Existing focused flood acceptance replay remains0pass/3fail. Whole-memory focus handoff / frozen-main retention is not accepted: history p99 across three runs766.4/110.1/276.9ms and50-window Chromium PSS3811189KiB. All runs, failed first attempts, sources and checklist attached earlier. Scope clarification still required from orchestrator/owner: keep background-only parsing and define a background-browser-window acceptance workload, or include focused flood parsing. The current three cases flood the single focused terminal; background-only cannot affect them. No workload or budget changes were made.
Checks on head:31 functional tests/1711 assertions PASS; strict tracer check PASS; pinned renderer checksums PASS; production build and D188 budgets PASS. Exact-head critical gzip/Brotli296668/247418B (limits307200/256000); deferred49798/44007B (limits51200/45056). No new dependency or engine choice; module role comments and state/response/order invariants reviewed. No UI visual-quality or full integration claim.
Final scripts/verify fast: exit1. CARGO_TARGET_DIR=~/.cache/codex-scratch/flood-worker/target, INFRATERNAL_TEST_RTT=0, RUST_TEST_THREADS=2, TRACER_TEST_PORT=4439, CPUWeight=10000 user scope. Every non-static row PASS. Only existing static size limits fail, with exactly the base sizes: x8622477936>16404816B; ARM19911624>13817816B. No baseline exception claimed. Verbatim final output summary:
fast-head.log
head-budget.log
Measurement scopes and final gate scope are inactive. Owned local build targets, generated bundles and Python caches are being removed; evidence remains attached/outside the worktree per D262. Resume from this head and the worker-core-evidence archive; this is not a completed typing-lag fix.
Cleanup confirmed: worktree clean; HEAD and origin/flood-worker both
fe0d631345. Owned build targets/generated bundles/Python caches removed; attached evidence retained. All six perf measurement scopes and the final gate scope are inactive. INCOMPLETE/HOLD status and required scope clarification remain as recorded above.Continuation r2 started on flood-worker at
fe0d631345; original basea3102bc3. Read #197 (124 comments), parent #55 and repository contract. D268 Q19 and the continuation brief resolve scope: production background browser windows at 1/5/20 producers; focused-terminal acceptance belongs to flood-server-ship. Rebasing the nine worker-core commits onto origin/dev609578196d, excluding inherited later focused-flood experiments and server changes handled by the separate lane. Engines stay in their owning thread across focus; no whole-memory focus handoff or frozen main-side VT. Chromium/Firefox acceptance, 1/10/50-window PSS, D188 and final gates pending. Browser plugin unavailable; use repository Playwright. Push flood-worker only, no deployment.Perf-VM layout diagnostic r2/layout-1 (4 vCPU, short flock/CPUWeight10000 run; not typing acceptance): existing pinned VT, 10000 emitted Unicode lines per 80x24 terminal. Shared-instance Chromium PSS at 1/10/50 windows: 175217/312495/946394 KiB; isolated-instance: 177049/341300/1053399 KiB. Isolated 50-window increase 11.31%, before worker overhead, exceeds the 10% continuation limit. Shared/isolated linear-memory at 50: 1162543104/1251737600 B. Load before 0.54/0.38/1.39, after 0.61/0.40/1.38. Reject isolated per-window engines; use the existing engine shared within a worker, with separate VT allocations and no focus migration. Actual production-vs-dev PSS and typing acceptance still pending. New real-worker route test fails before (worker error on create); after pooling: 9 real-engine/thread tests pass, 1649 assertions. Source apps/tracer/src/terminal-parser.on-demand.worker.ts; no routing wired yet.
Final gate attempts completed on2f73f608: static x8622287472>22204304 (+83168), ARM19716856>19638744 (+78112). Linkage/trust/key-heap x86 and CLI stubs pass; ARM key-heap runtime correctly skipped on x86. Fast1/3 fail VT-credit startup cursor349vs367; fast2 fails repeated_tiny_credit cursor224vs367. Matching static baseline/head probes pass, so no exemption claimed. Building matching GNU baseline from detached
b182529fwith verified identical source/adapter/ABI/ReleaseSafe native archive; original head GNU binary saved. An incomplete cache-copy attempt was stopped and removed. Shared disk fell to343MiB free; removed only own unused baseline target/incremental caches. No other jobs, owner fixtures, ceilings, profiles or reviewed code changed. Full iterate5 remains green; native first0/150/300 budget cohort failures and paired throughput evidence remain recorded above. Final race comparison, push and final receipts pending.Pushed merge head
2f73f608d7to origin/flood-server-ship; remote SHA verified. Parentsb182529fccand reviewed4b681d8e48. Later e12f7030/a3102bc3 excluded. Dev liveness/mesh/inventory/size work retained; no evidence paths committed; no deploy or dev push.NOT READY TO SHIP. Completed merge and measurement handoff; acceptance is blocked:
Paired perf VM exact-byte 50 MiB throughput (3 each/profile), dev -> merged: LAN 5.675707 -> 5.695307 MB/s (+0.35%); 150 ms 5.680482 -> 5.673672 (-0.12%); 300 ms 3.315279 -> 3.256000 (-1.79%). No reproducible loss established at this sample count; literal zero regression is not proven. All transfers passed byte/cursor checks. Unchanged reviewed binary now 5.763959 MB/s vs merged companion 5.798170; historical absolute throughput not reproduced. 50 retained PTYs: daemon RSS 7588 KiB idle, aggregate shims 291268 KiB, no idle CPU ticks over 1 s; after one finite flood 7780/316972 KiB. This is not 50 simultaneous producers. Machine/load/run scopes are in attached receipts.
Passing validation on this tree before merge commit: scripts/verify iterate exit 0; terminal integration 23 tests/97 assertions; protocol 37 tests/34463 assertions; real PTY output flight 32768 bytes <=65536 before Ack; production deferred bundle 42471 Brotli bytes <=45056; touched Rust fmt/clippy and TypeScript checks pass. Full fast still fails; no completion claim.
Final command: own CPUWeight=10000 user scope, CARGO_BUILD_JOBS=2, RUST_TEST_THREADS=1, INFRATERNAL_TEST_RTT=0, TRACER_TEST_PORT=4297, scripts/verify fast. Exit 1. Final summary verbatim:
Final gate, all attempts/baseline comparisons and artifact hashes:
fast-retry-4.log
final-validation.tar.gz
final-artifacts.txt
Perf and passing iteration receipts:
perf-results.tar.gz
perf-summary.json
perf-machine.txt
functional-checks.tar.gz
Issue stays open. Next lane must resolve the oracle/credit failures, size caps and native acceptance without silently changing budgets or importing browser experiments. Own measurement scopes inactive; temporary baseline and build targets being removed; evidence retained outside checkout.
Cleanup confirmed: clean worktree at
2f73f608; own detached baseline, GNU/static build targets and saved binaries removed; generated Python caches removed. All recorded owned perf scopes inactive; own /root/infraternal-bench/flood-server-ship removed after receipts were fetched/attached. Evidence remains only outside checkout and on #197. Shipping blockers in previous comment remain; no deploy.Continuation r2 started: branch flood-server-ship, HEAD
2f73f608d7; merge base/dev parentb182529fcc; origin/dev97366a3b64(only decision docs since merge parent). Read #197 and parent #55 history. First priority: identical-harness five-run interleaved reviewed 4b681d8e/dev/merge matrix on authorized perf VM at LAN/150/300, before any runtime change. Also compare abrupt-stop on dev and merge size delta <=16384 bytes. No budget/profile/engine changes, no dev push/deploy. Evidence under job scratch; scratch baseline/build artifacts will be removed after attachment.R2 completed steps (pushed flood-worker):
bf345beapools real VT contexts in one on-demand worker/WASM allocation;1b2f3c17verifies independent split-parser state;b5ea8295adds bounded history/text queries;444aa3acorders mode-sensitive input after raw bytes;25dca4b8adds real-worker input/history regressions. Tracer strict check passed at each commit; latest worker/parser/client tests: 7 pass, 32 assertions. Browser routing is still uncommitted and not accepted.First valid production-code background fixture pair, perf VM Chromium, 1 background window offered 1 MB/s yes, 100 idle/flood inputs plus 100 pan/drag frames: dev-8 idle p50/p99 16.6/45.3 ms, flood 18.1/31.1 ms, main busy 51.14%; head-2 idle 16.5/19.0 ms, flood 16.3/38.7 ms, busy 46.48%. Candidate p99 growth 19.7 ms FAILS the +4 ms target. Candidate pan p99/max 33.4/33.4 ms, drag p99/max 33.4/50.0 ms; frame acceptance unresolved. Loads before dev/head 3.97/3.67/6.00 and 1.13/2.16/4.47. Actual native clients, codec sockets and canvas, synthetic ordered PTY bytes; this is not a native PTY benchmark. Earlier dev-1..7/head-1 runs were fixture debugging (actor routing, reconnect support, missing CSS); no acceptance claim. Full runs and errors retained outside repository.
Read-only review confirmed input-order/reset loss, suspended-frame ownership stall, failed-parser recovery stall, and async selection/copy regressions. Fixing with regressions before further scale runs. First iterate gate failed native 24-restart oracle under host load; serial full fast native tests subsequently passed, static builds still running. No native source changes in this lane.
R2 comparison prepared, no performance outcome yet. Rebuild exact
97366a3borigin/dev,2f73f608merge,4b681d8ereviewed using Rust1.99.0/static musl/original source release recipes; all artifacts hashed. Identical merge-head collect-latency.py/verify-latency.py/agent_fixture.py/latency_proxy.py harness for every source. Five rotating triplets per RTT0/150/300; n20 per phase/run, n100 pooled/source/profile; rotating profile and source order. Each triplet owns short flock -w3600 /var/lock/perf-bench.lock plus CPUWeight10000; each run capped120s. Record before/after load and CPU steal counters, retain all failed/incomplete runs. Native harness does not send terminal liveness probes; agent_fixture.py matches reviewed source. No source change yet; static dev build progressing.R2 evidence attached below. Full provisional fast gate at
25dca4b8+ uncommitted browser integration: native fmt, VT native fmt, CLI plugin compile-out, clippy, test, cargo-deny PASS. Static builds FAIL: x86_64 22275888 B vs cap 22204304 B (+71584), ARM64 19704712 B vs cap 19638744 B (+65968). This lane changes no native source; rebase base60957819is current dev native source (new dev97366a3bchanges decisions only). Static-size fixture also fails at this same binary boundary. No baseline exception claimed and no cap changed. TS gate is skipped by verify after native static failure; running TS/build/functional rows separately. Final exact-head gate still required.background-pair-1.json
fast-r2-1.log
input-recovery-before.log
input-recovery-after.log
Input/reset regressions: before 2 pass/2 fail (missing FIFO method and recovery timeout); after 4 pass/0 fail, 9 assertions. Viewport dedup real-VT tests: 3 pass, 1750 assertions; exact identical cells suppressed, history still advances. Browser acceptance remains failing/pending.
R2 build step: origin/dev97366a3b static musl built,22275888 bytes,SHA25610aeb1ec24cf1ab8464b4e308f4718425e2e1a368871dcd8f784eb71bb913373. Preserve artifact. Changing Cargo checkout paths invalidated dependencies; stopped only owned build scope run-p2373161-i40115720 and retained its incomplete merge-build log. Remaining exact merge2f73f608/reviewed4b681d8e builds now use the same detached scratch checkout path as dev, restoring dev afterward. No source/recipe/compiler/budget changes; no performance outcome yet.
R2 static build step complete: exact merge2f73f608 =22287472 bytes,SHA256ea67af5062225211f74f13710771be116f98e343b681a6ab328657fe7a084f14; exact origin/dev97366a3b =22275888 bytes,SHA25610aeb1ec24cf1ab8464b4e308f4718425e2e1a368871dcd8f784eb71bb913373. Merge delta +11584 bytes <=16384: PASS. Both built at one stable detached checkout path, same target/toolchain/source release profiles. Reviewed4b681d8e build in progress; no runtime change or performance result yet.
Completed/pushed atoms:
e289340fresets failed native owners and materializes empty cells;f703b542adds lazy worker pool + draw receipts + input FIFO;891fdf95adds its real-worker regressions;4cedcebfadds exact viewport row comparison;cbe77c38wires dedup publication;eb301cd6adds repeated-scroll/history regressions;f3ef9e2fadds bounded worker scheduling. Strict tracer checks and fmt pass. Current native-worker/existing terminal unit cohort: 21 pass, 1805 assertions; separate existing input readiness/exit/checkpoint cohort: 10 pass, 293 assertions.Read-only review reproduced two further input bugs: pending mode-sensitive input re-encoded against blank recovery state, and delayed old-session paste delivered to a newly selected session. Added failing real-worker cases and fixes: encoding waits for the painted replay fence; retarget cancels the old input generation. Also regressed/fixed immediate stale mirror text after reset. Current adapter tests: 6 pass with 17 assertions; detailed browser FIFO test passes with actual InputHandler/clipboard events.
Functional production preview build: Snapshot, live-query/reload, no-query Snapshot, Unicode split/grapheme/Snapshot all passed; combined cohort had a test-double setup 409 before replay injection, and that row passed alone with a fresh server. No timing claim from the build host.
Perf blocker: /var/lock/perf-bench.lock is held by PID 597982 for the ppu-soak-long2-soak 7200-second soak (plus 600-second warmup), observed at 20 minutes elapsed. Our 1/5/20-background and 1/10/50-window PSS runs are queued using flock -w 3600; no foreign process changed. Need the scheduled soak to release the lock; native static-size blocker remains separately recorded. Browser acceptance is still unresolved.
R2 perf comparison is prepared and queued in flock -w3600. Lock metadata: PID597982 owns WRITE lock /run/lock/perf-bench.lock, elapsed54:31, cwd /root/infraternal-bench/ppu-soak/long2;20 waiters (WRITE*), including this job. The measurement needs that holder to release the shared lock; orchestrator/ppu-soak owns its scheduling. No foreign process touched. Exact reviewed4b681d8e built22477936 bytes,SHA2566a8afc7e87ae3fb7dcd3d492302c4cff1fb625e2804e096dc276df1f996cb8d8. All three artifacts uploaded; identical harness/rotating matrix queued before other validation. During the external wait, run read-only functional abrupt-stop controls/gates; no runtime change before the comparison.
R2 abrupt-stop control complete, unmodified shared verify-agent.py/agent_fixture.py (identical on dev and merge), source-exact static binaries, seed20, RTT0, CPUWeight10000, three alternating runs each on infraternal-dev. Dev97366a3b exits0/1/0; merge2f73f608 exits0/0/0. Each passing run verifies24 stop positions and4710396 payload bytes exactly once. Dev run2 fails the same real_binary_preserves_input_and_output_across_24_abrupt_stops oracle: iteration1,before-forward,payload470784,received406006,input sent470844,input acked470827,proxy aliveTrue; socket read timeout. This reproduces the test failure on origin/dev alone, although at a different stop position from the earlier merge failure. Per continuation brief it is pre-existing; no claim that its root cause is fixed or that the earlier merge failure was reproduced identically. Merge passes72 stop positions/14131188 exact payload bytes in these controls. Full iterate/fast still required. All six logs attached, including the failure:
r2-abrupt-dev-1.log
r2-abrupt-dev-2.log
r2-abrupt-dev-3.log
r2-abrupt-merge-1.log
r2-abrupt-merge-2.log
r2-abrupt-merge-3.log
R2 reviewed terminal flow regressions on unchanged HEAD2f73f608:23 tests PASS,97 assertions,0 failures across input readiness, output credit window, legacy/shadow credit window, ordered output/snapshot/epoch handling and terminal exit. TRACER_TEST_PORT4297; functional unit results only, no host timing used as performance evidence. Full iterate is in workspace clippy; perf matrix still queued on the external lock.
r2-terminal-tests.log
R2 source/method finding while waiting for the VM lock: scripts/latency_proxy.py:29,51-55,89-94 retains each direction's independent jitter sample across a200ms active burst (RTT150 profiles have ±30ms configured RTT jitter; RTT0 has zero jitter). In the previously recorded n100 reference7994f8a9 cohort,150ms echo155.62/growth4.08 implies quiet p99151.54ms; previous merge cohort echo184.182/growth23.853 implies quiet160.329ms. Quiet baselines differ8.789ms; flood growth still differs19.773ms. This arithmetic does not establish the cause of either difference. Fresh interleaving must report absolute echo AND within-cohort growth/per-run quiet baselines; do not attribute raw WAN p99 differences to code alone. No harness, jitter, budget or product change.
Resume after build-host disk interruption: branch flood-server-ship, HEAD
2f73f608d7, original baseb182529f; comparison baseline origin/dev97366a3b. Worktree clean, no uncommitted work lost. Three source-exact static binaries survive; VM r2 results directory empty and previous runner inactive. Restart identical-harness interleaved five-run reviewed/dev/merge comparison before any runtime change. Prior abrupt-stop baseline control and +11584-byte merge delta are recorded above. Rebuild deleted debug outputs; iterate then final fast. No deployment or dev push.Read-only candidate finding: reviewed4b681d8e vs merge2f73f608 have identical Cargo.toml release profile, .cargo wrappers, snapshot.zig and all shim runtime source. scripts/build-vt differs by #198 commit722af2a3, enabling link_function_sections/link_data_sections for native VT archive size cuts; Cargo.lock adds bytes only to remote plugin. Daemon delta is #199 stream liveness fence/park cleanup; identical native harness emits no liveness Ping. These are candidates, not causal attribution. VM run queued on flock -w3600; holder597982 (ppu-soak-long2-soak), elapsed1h48m at observation. Resume iterate rebuilding debug outputs; prior interrupted iterate failed ENOSPC, not a test assertion. No runtime/budget/build recipe change made.
Resumed source-exact merge2f73f608 functional flow regressions: shim input Ack behind32768 output bytes<=65536 PASS; terminal credit/output/legacy negotiation/replay epochs/exit/readiness23tests,97assertions,0fail PASS. TRACER_TEST_PORT4297. Rust fmt,VT fmt,CLI compile-out and clippy pass; workspace tests rebuilding. VM comparison remains queued; no build-host timing used as performance evidence.
resume-shim-flight.log
resume-terminal-tests.log
First same-session interleaved triplets complete (preliminary n20/source/profile, not pooled acceptance): reviewed/dev/merge echo p99 LAN14.521/19.417/16.695;150ms176.316/158.855/171.217;300ms377.669/426.566/344.594. Initial exits LAN0/0/0,1501/0/1,3001/1/1; every failure retained. Unchanged reviewed source itself misses historical4.5/156/328. Reviewed150 quiet p99312.916ms already fails184ms; merge150 growth24.259ms fails16.67. VM4vCPU; observed CPU steal7.43–16.12% per cohort; load values and samples in partial summary. This does not prove steal causes the tails or identify a code regression. Remaining four rounds rotate source/profile order; no runtime/budget/recipe changes.
resume-summary.json
Resumed iterate completed on unchanged HEAD2f73f608, exit0. All rows PASS, including 24-stop oracle,VT credit/repeated tiny-credit, reviewed reservation/refund/expiry regressions and #199 shim-liveness fence. TypeScript protocol37tests/34463assertions; production tracer check/build/transfer budget passes. Final fast started on this exact head; native five-run interleaving continues. No runtime or source change. Verbatim iterate summary (not the final gate):
resume-iterate.log
At
ac82fb1d, browser integration is committed/pushed; no deploy. Production release D188: critical gzip/Brotli 296445/247026 → 302162/251988 B (caps 307200/256000); deferred 47896/42508 → 47863/42401 B (caps 51200/45056); largest on-demand chunk 15946/14176 B, worker separate on-demand entry.Perf VM Chromium production-code PSS (KiB), 1/10/50 windows, same 290000 B Unicode seed per window, configured 10000 rows, actual retained history 1119 rows: dev cold 209969/284054/508658, seeded 241979/519882/1680223; worker cold 217015/279363/432811, seeded 246286/478010/1481149. Growth cold +3.36/-1.65/-14.91%; seeded +1.78/-8.05/-11.85%: all within +10%. Loads dev before/after 3.50/2.76/2.18 →3.30/2.75/2.18; worker 3.30/2.75/2.18 →3.02/2.71/2.18.
Latency still FAILS at scale. head-v3-c1, 1 background yes offered1MB/s, idle/flood key p50/p99 16.5/25.3→16.3/24.7 ms (delta target passes this run), busy44.39%, actual0.940MB/s, but pan max50.1ms and drag max33.3ms. head-v3-c20, 20 backgrounds, varied file offered6MB/s each: idle15.9/23.9→34.2/485.4ms FAIL, busy68.44%, achieved0.736MB/s/window; pan max66.7, drag83.3ms. Profiles show nine connection disconnects during the scale cohort; collecting exact reasons/key-path timestamps. Do not treat these as acceptance.
Firefox executable initially missing (head-v3-f1 invalid; no timing). Installed the pinned browser, then head-v3-f2 completed: idle/flood key p50/p99 18/34→19/35ms (delta passes), Linux content-main CPU busy36.99%, actual0.948MB/s. Idle pan p50 itself33.5ms, flood34.08ms; display-rate target unresolved. Full iterate native 24-restart oracle timed out at socket/teardown under load, not an allowed #118 exception; no waiver claimed. Full serial native cohort had passed earlier; final exact-head fast still required.
Native comparison finding: dev150-round5 and dev300-round5 exit1 at sibling-flood startup marker timeout (verify-latency.py:109), after quiet20samples but before either flood phase; reviewed/merge companions completed. Preserve originals for all three sources under VM r2/results/attempts/latency-{150,300}-5-original. Repeat each full triplet, same dev/merge/reviewed order, unchanged harness and20samples; completed latency failures remain included. Balanced five-complete-triplet pool will be accompanied by all-valid-run statistics that also include the original reviewed/merge companions. Current last LAN triplet and repeats wait on flock; holder715066, bench-vs-tmux/server_matrix.py chart10k, cap1800s, elapsed6min at observation. Need that external measurement to release the shared lock; no foreign processes touched. Local final fast continues; iterate already passed.
r2 progress through
f4ff1c3471. Stable worker routing, input replay recovery, desired geometry, lazy packed viewport rows and native DOM binding are committed/pushed. No focus migration; vendor parser/renderer unchanged.c6a86365Regress focused worker turns and bounded background progress (#197)ec8c5a7bYield background decode between ordered native write slices (#197)ec85fd13Fence worker input and viewport state across owner resets (#197)74cf2755Regress worker replacement and session reset generations (#197)503ea57dRegress focused echo ahead of complete background decoding (#197)a1d601ceAccept desired geometry when resetting a worker owner (#197)40227c75Retain requested grid and focus across worker replacement (#197)ea55671fMaterialize mirrored cells only when a consumer reads their rows (#197)ca9e5141Await terminal diagnostic reads inside browser probes (#197)15c75e8eAllow asynchronous history diagnostics in tracer test hooks (#197)9a88f3c2Read the visible terminal viewport without copying history (#197)8d4ca92eUse the mirrored viewport for the first visible content fence (#197)bdfa0a97Adapt the existing DOM terminal to stable worker-owned VT state (#197)16317e61Route terminal streams, replay and input through stable worker owners (#197)f8b3f4a7Regress resize immediately before worker replacement (#197)795ca534Regress unread rows coalesced across multiple worker packets (#197)ac82fb1dRegress actual keyboard and clipboard FIFO through the DOM wrapper (#197)ad483dbbReport output hints from the owning terminal worker (#197)30f8ed12Consume worker output hints without scanning floods on the UI thread (#197)f4ff1c34Regress worker-side output hints on the real parser (#197)Real-worker focused/Unicode tests: latest cohort 17 pass, 0 fail, 1806 assertions; strict tracer check and cargo fmt pass. Earlier focus-priority assertion failed once (owner 1 completed before owner 2 arrived); retained in raw-hints-after.log, investigating transport/scheduler task fairness. DOM keyboard/paste FIFO regression passed separately.
Perf findings: main-thread CPU profile has symbol scans 622 ms, binding.write 500 ms, owned transfer copy 396 ms. Worker output hints now remove duplicate UI-thread symbol/bell scans (ad483dbb/30f8ed12/f4ff1c34); pre-change hint regression failed, new regression passes. Scale run failures-c20 had 14 disconnects, no conn.fail calls. Input→wsMessage p99 469.9 ms vs termWrite→paint 36.8 ms (idle 16.9). Existing D265 liveness retirement bypasses conn.fail; review identified rejection of fresh probes after a main-thread scheduling gap. No liveness ceiling/contract was changed. Checking bounded fair fixture sending and separate host connections before attributing transport backlog to the worker.
At
ac82fb1d, browser integration is committed/pushed; no deploy. Production release D188: critical gzip/Brotli 296445/247026 → 302162/251988 B (caps 307200/256000); deferred 47896/42508 → 47863/42401 B (caps 51200/45056); largest on-demand chunk 15946/14176 B, worker separate on-demand entry.Perf VM Chromium production-code PSS (KiB), 1/10/50 windows, same 290000 B Unicode seed per window, configured 10000 rows, actual retained history 1119 rows: dev cold 209969/284054/508658, seeded 241979/519882/1680223; worker cold 217015/279363/432811, seeded 246286/478010/1481149. Growth cold +3.36/-1.65/-14.91%; seeded +1.78/-8.05/-11.85%: all within +10%. Loads dev before/after 3.50/2.76/2.18 →3.30/2.75/2.18; worker 3.30/2.75/2.18 →3.02/2.71/2.18.
Latency still FAILS at scale. head-v3-c1, 1 background yes offered1MB/s, idle/flood key p50/p99 16.5/25.3→16.3/24.7 ms (delta target passes this run), busy44.39%, actual0.940MB/s, but pan max50.1ms and drag max33.3ms. head-v3-c20, 20 backgrounds, varied file offered6MB/s each: idle15.9/23.9→34.2/485.4ms FAIL, busy68.44%, achieved0.736MB/s/window; pan max66.7, drag83.3ms. Profiles show nine connection disconnects during the scale cohort; collecting exact reasons/key-path timestamps. Do not treat these as acceptance.
Firefox executable initially missing (head-v3-f1 invalid; no timing). Installed the pinned browser, then head-v3-f2 completed: idle/flood key p50/p99 18/34→19/35ms (delta passes), Linux content-main CPU busy36.99%, actual0.948MB/s. Idle pan p50 itself33.5ms, flood34.08ms; display-rate target unresolved. Full iterate native 24-restart oracle timed out at socket/teardown under load, not an allowed #118 exception; no waiver claimed. Full serial native cohort had passed earlier; final exact-head fast still required.
Evidence links (profile contains CPU stacks only; no network trace):
memory-v3-pair.json
v3-first-runs.json
firefox-v3-2.json
run-failures-c20.json
run-profile-c20.cpuprofile
worker-review-probes.txt
current-release-budget.log
iterate-current.log
Other-c20 attempt invalid before browser launch: VM scope has no node executable; retry uses the installed Bun runner. No timing result claimed. Final gate and complete browser matrix remain pending; lane is not review-ready.
Final-gate cache finding, before any invalidation: x86 fast artifact is317312 bytes larger than preserved source-exact merge artifact, exactly #198 section-cut saving. x86 shim OUT_DIR/native resolves to native-ac2fe3e6...; cached GhosttyLibVt.zig has function/data sections=false although HEAD scripts/build-vt enables both. Main worktree reused the target populated later by detached reviewed checkout; Cargo did not rerun the shim build script for the older main-worktree file timestamp. This is a stale native build-output selection, not a source/profile/size-ceiling change. Preserved matrix artifacts remain correct (dev22275888,merge22287472,reviewed22477936). Let ARM gate finish, invalidate only owned x86 shim release build outputs, then rerun full fast and verify the selected native recipe. Retain this failed gate and failing archive inspection.
resume-native-cache-before.txt
Perf finding, fair-head-c20: 8 socket retirements, key idle/flood p50/p99 16.0/30.1 →87.8/679.7 ms, busy69.24%, achieved0.781MB/s/background at offered6. First retirement: previous-Pong age57.7ms, learned RTT5.34ms, outstanding probe age3.4ms. The code rejects the fresh reply because the previous-Pong lease elapsed, even though this correlated probe proves the live route within its existing RTT+50 ceiling. Separate-host older-build run also fails (18.7/391.7ms,5 disconnects,busy64.63%,actual0.936MB/s).
Proposed correctness repair within existing D265: accept a nonce/timestamp-correlated Pong if this probe itself is younger than the existing liveness budget; still reject stale queued probes and keep timer retirement/RTT+50 ceiling unchanged. This changes no wire contract, decision or retry budget. Add a failing simulated-clock regression first and retain the existing half-open/suspension tests. The worker-only matrix remains running; no acceptance claim.
Head
6de8ea52ffcommitted/pushed. Worker metadata and quiet notification steps: ad483dbb/30f8ed12/f4ff1c34/f9a6d331/05018e26. Harness: c807c9a5/2c9309f1/8344658d/8da976de/bb37e5d7. Fresh correlated Pong repaircb40ca61, failing/passing regressionba02eac4; read-only review found no new P1 and notes timer-first retirement remains possible. Fairness regression6de8ea52controls command arrival through a real-worker test barrier instead of assuming the parent thread remains scheduled.Worker suite28 pass,0 fail,2103 assertions; strict tracer/helper TypeScript and cargo fmt pass. Fair-source functional browser10 idle and10 flood echoes,20 input bytes. Separate full TypeScript gate passes, including protocol differential tests37 pass/34463 assertions. Release D188 critical gzip/Brotli302194/252083; deferred47867/42413; largest on-demand15945/14183. Worker entry itself2150/1915; budgets all pass. Baseline critical296445/247026 and deferred47896/42508.
Full scripts/verify fast on exact head FAILED. Native24-restart oracle stalled at iteration22 before-forward (received415743/payload468224), then socket/cleanup timeout; not an allowed #118 exception, no waiver claimed. Static x86_64 22275888 vs22204304(+71584), ARM64 19704712 vs19638744(+65968), unchanged native sources from rebased dev; no cap edits made. Standalone24-restart rerun in progress. Final gate output verbatim:
Acceptance remains FAIL/pending. New worker-only/fresh-Pong cohorts and browser regressions queued behind the perf lock (foreign holder exceeded10minutes). No host timing evidence or substitute acceptance claimed.
Five complete matched triplets/source/profile (n100): reviewed/dev/merge same echo p99 LAN19.876/16.045/18.418;150176.316/179.581/171.217;300350.193/426.134/325.626. All merge balanced rows PASS. Every original valid companion is also retained:150 n120 gives reviewed180.188 vsmerge181.483 (+1.295); merge growth17.812>16.667 FAIL. Echo-minus-Ack diagnostic p9913.829 vs15.245 (+1.416), not an acceptance replacement. The small difference is not stable across matched triplets, but checking it rather than dismissing it: private build2f73f608 with only native daemon module restored from4b681d8e isolates #199 daemon changes; same #198 VT sections, Cargo recipes, engine and harness. Separate mutable Cargo target avoids the detected shared-checkout cache trap. No private revert will ship; production branch unchanged. After build, run five rotating interleaved150ms triplets merge/private/reviewed, same raw budgets. Throughput and full final-gate confirmation continue. Socket final-close/Pong assertion failed once in gate retry; exact isolated test passed, further isolated/full retries running; no timeout waiver or fix claimed.
Gate finding on unchanged2f73f608: cache-correct fast retry fails final-close/control-Pong assertion once; exact binary isolated retries pass/fail/pass. Next full fast fails server_setup_terminal_echo_and_resume_preserve_offsets_once at tests.rs:1740, WebSocket Close(None); final-close case passes there. No baseline exemption or production fix claimed. Build detached dev97366a3b control with unchanged behavior and bounded enum-discriminant/stream diagnostic on final-close assertion (no payloads), separate mutable GNU target; alternate both cases against saved head test binary. Private no-native-probes performance artifact also compiling separately; no source edits on branch. Stopped only owned duplicate control-copy driver1165360 and removed inactive owned GNU incremental cache to preserve disk; control build1088207 continues. Original cache-red and all gate failures retained. Final verified size delta is+11584B<=16384, both target native recipes select function/data sections=true. Final gate must still be resolved/reported after controls.
Completed primary source-exact native campaign on VM (source head2f73f608, dev97366a3b, reviewed4b681d8e); artifacts/harness hashes and all raw attempted/complete cohorts attached. Balanced5x20 same echo p99 reviewed/dev/merge: LAN19.876/16.045/18.418;150176.316/179.581/171.217;300350.193/426.134/325.626ms. Merge balanced growth16.142/14.225/-1.682, all pooled rows PASS. Original valid companions also included in all-valid table:150merge181.483,growth17.812 FAIL, vsreviewed180.188; no cherry-picked green acceptance claim. Two original dev startup-marker timeouts retained; full triplets repeated.
27 fully checked50MiB transfers (three/source/profile), mean MB/s reviewed/dev/merge: LAN6.2007/6.6273/6.3148;1505.7801/5.9563/6.4216;3003.3664/3.2268/3.2928. Merge vsdev LAN-4.72%,150+7.81%,300+2.04%; LAN loss is not dismissed. Private native-daemon control + new interleaved LAN throughput repeats are prepared, build pending. No budget/source/profile change on branch.
resume-results.tar.gz
resume-summary.json
resume-all-valid-summary.json
resume-throughput-summary.json
resume-perf-hashes.txt
r2 progress, flood-worker head
8dd346e7(pushed). Acceptance is still failing; this is not a completion or review handoff.Completed steps:
88911f6bpreserves adaptive RTT learning while rejecting a Pong only when both the previous lease and this probe are stale;85d44201covers fresh-reply scheduling gaps, longer correlated RTT samples, healthy recovery and half-open rejection.49422976covers split Unicode at both scheduling boundaries.8dd346e7removes empty-header exceptions after complete mux messages without changing nonempty-frame validation; protocol tests 37 pass / 34,463 assertions, strict TypeScript pass. Rejected the experimental 16 KiB worker write quantum: it did not improve typing latency. The production quantum remains 4 KiB.Corrections to measurement scope: the 24-case fair2 matrix used 4 KiB envelopes (stress), whereas native shim session.rs CHUNK is 16 KiB. These are retained, not represented as production packet acceptance. Simulated different host IDs still share a ConnectionPool socket below 40 terminals; the other-host experiment was not separate TCP connections. Baselines that timed out are invalid, not passing baselines. Full 24 attempts, loads, raw samples and artifact hashes are attached below. None establish the acceptance matrix.
Representative 16 KiB packet experiment nativeframes16-c20 (temporary16 KiB write quantum + codec guard): idle typing p50/p99 16.1/30.1 ms, flood 33.0/357.0 ms, main busy54.00%, achieved0.997 MB/s/background at offered6, 20 backgrounds,11 disconnects. Pan and drag each reached33.4ms; targets fail. New profile breakdown16-c20: 12.035s TaskDuration/19.774s observation (60.86%), ScriptDuration3.646s, ThreadTime11.784s, layout0.052s, style0.339s. '(program)' cannot be confidently assigned to rendering. Capture diagnostic parked pictures did not establish a drawing bottleneck; raw transport/copies/receipts still run.
The isolated codec benchmark alternated before/after for five10,000-message trials in Chromium and Firefox. At16 KiB, median49.4→4.8ms and119→12ms respectively; this is decoder-only, not typing acceptance. Original benchmark produced all40 valid samples but its favicon handler logged an ENOENT; a corrected rerun is retained separately. Original echo enqueue→JS-delivery p99421ms is not proof of main-thread dispatch delay: socket.send acceptance is not wire receipt. A CDP diagnostic is separating these; first attempt filtered wrong stream (focused terminal was stream11), second capture timed out under diagnostic overhead, neither supports that attribution.
Experimental variants proof/proof2 and16KiB scheduling were superseded, never treated as acceptance. All available experiment results are attached with each run's machine/load/hash and failure status. Screenshot is from the real production-code fixture for independent visual review.
matrix-r2-all.json

run-nativeframes16-c20.json
run-breakdown16-c20.json
run-breakdown16-c20.cpuprofile
codec-micro.log
r2-experiments-all.json
r2-experiments-summary.md
codec-final-tests.log
codec-commit-check.log
matrix summary
Completed24 alternating functional WebSocket controls on dev97366a3b and merge2f73f608 (six each/source/case, CPUWeight10000, load snapshots retained). Merge12/12 PASS. Dev final-close/control-Pong6/6 PASS; setup/echo/resume5/6 PASS, round5 fails identical tests.rs:1740 WebSocket Close(None) to head fast3. This demonstrates that latter failure on dev alone; no root-cause fix or blanket #118 waiver claimed. Earlier isolated head final-close case pass/fail/pass remains retained; dev6 controls did not reproduce that assertion. Full source-head fast retry now running with correct native recipes; no source changes. All24logs and failing dev log attached:
auth-control-raw.tar.gz
auth-control-dev-1-5.log
At unchanged head
2f73f608, five additional rotating LAN cohorts transferred 50 MiB exactly per artifact: dev mean 8.904 MB/s, merge 7.717 (-13.32%), reviewed 8.961, private reviewed-daemon control 8.070. This does not establish #199 as the cause: that control removes liveness support and remains slower; no production change made. Next private factorial control keeps merged daemon and changes only scripts/build-vt to reviewed section layout. Final fast now passes all non-static rows; static caps remain exceeded (merge x64 22,287,472 vs dev 22,275,888 = +11,584 bytes <=16,384). Raw campaign and final gate will be attached with control result; no budget changes.Unchanged head
2f73f608: final full scripts/verify fast exits 1 only for static size caps; every non-static row passes, including the abrupt-stop and both previously intermittent socket tests. x64 merge +11,584 bytes vs dev, within +16,384 allowance. Absolute cap remains a dev baseline failure handled by the separate size lane. No green full-gate claim.Verbatim final summary:
Private controls and raw native measurements:
resume-fast-head-final.log
probe-results.tar.gz
probe-summary.json
probe-throughput-summary.json
no-probes-private.patch
no-probes-artifact.json
Five completed rotating 150 ms triplets (7–11; original timeout6 and its valid siblings retained) give merge/reference/no-probes echo p99 162.292/178.341/163.866 ms, all same-session budgets pass. Including all valid originals changes no p99. No reproducible latency degradation attributable to #199; private daemon reversion is not a proposed fix. Original primary all-valid150 growth17.812 ms FAIL remains recorded. Throughput interaction investigation continues with private section-layout control.
probe-repeat.tar.gz
probe-complete-summary.json
Throughput diagnostic, unchanged artifacts: across the20 retained LAN runs, raw MB/s vs VM global steal% Pearson r=-0.9644. Cohort7 dev10.752 MB/s,steal3.28%; merge6.710,steal17.39%. Cohort10 dev5.943,steal18.20%; merge6.569,steal14.39%. Observed slowdown reverses with steal; this is evidence of a load confounder, not proof of a source interaction. No adjusted performance result or budget waiver is claimed. Private section-off control completed22,604,784 bytes(+317,312 vs shipping),SHA8015a6d3d2c2c907a62c24940e4e78591ac5ad28c6bee84fe93db07c0417dd6d. Five rotating cohorts queued/running; shipping recipe restoration and exact hash check precede the rerun final gate.
throughput-steal-diagnostic.json
Private section-layout control complete:5 rotating LAN cohorts/source, all20 transfers exact50 MiB and cursor-contiguous. Mean MB/s (mean global steal%): merge8.42565(10.598%),section-off8.27516(11.376%),reviewed9.07453(7.007%),dev9.34313(6.889%). Restoring old layout has no measured benefit and adds317,312 bytes; no production flag change. Raw throughput vs steal r=-0.87468. Control built in shipping worktree, primary artifacts in one stable detached source path: differing binary layout/build provenance is an additional confounder, not proof of causality. Paired ABBA dev/merge cohorts now running to balance adjacent load windows.
Shipping recipe restored, git clean. Correct native archive574f0a95b7ac0299819ab5d42afcec72085eccd4c3d17200b44ce76e0393e911,sectionson. Rebuilt shipping binary22,287,472 bytes,SHA690c877460a663374457528ace971ca065ab56760059c4b1855e71f0d68e26a3 differs from preserved detached artifactea67af5062225211f74f13710771be116f98e343b681a6ab328657fe7a084f14. Same size and source; hashes not treated as equivalent. Final fast rerun on restored worktree underway.
sections-results.tar.gz
sections-throughput-summary.json
old-sections-artifact.json
old-sections-private.patch
Paired LAN control complete:5 ABBA/BAAB cohorts,10 runs/artifact,20 exact50 MiB transfers. Mean merge11.655051 vs dev12.243483 MB/s (-4.8061%); aggregate11.338895 vs11.926701 MB/s (-4.927%). Mean global steal merge2.3237% vs dev1.5369%. Cohort19 (both <=0.10% steal) merge14.5455 vs dev14.2159 MB/s (+2.3187%); other cohorts -3.2058/-7.7577/-12.7145/-2.4457%. No byte/cursor loss. Earlier slower campaigns remain recorded.
Acceptance blocker: no-throughput-loss is not established. Native echo merge penalty vs reviewed did not reproduce in the interleaved source controls; private daemon reversion and section-off layout have no established benefit. No production fix is justified by this evidence, and no budget is changed. Orchestrator review is needed to select the next controlled investigation of the remaining load-sensitive throughput gap. Final restored head gate still running; branch unchanged2f73f608, no dev push/deploy.
paired-throughput-results.tar.gz
paired-throughput-summary.json
restored-shipping-artifact.json
R2 continues on flood-worker; pushed head
27da6dc4. Completed atomic steps:fa411cafnative 16 KiB fixture envelopes,392aed24paint-parking diagnostic,b08fe35ascheduled viewport capture,1e47524dreal-worker background resize fairness regression,27da6dc4artifact preflight before server launch. Focus scheduling test fails before and passes after capture scheduling; full worker/protocol cohorts and strict TypeScript passed at those commits.Every additional perf attempt is in r2-experiments-next.json (machine, load, hashes, raw samples). Capture scheduling is a correctness/fairness change; differing load prevents causal latency claims. Splitting one socket per terminal failed (p99 281.2 ms); A/B two sockets failed (77.3); B socket worker batching failed (44.7); private/pair engine prototypes failed (80.1/62.6), and the first allocated engine was not proven to be A. No socket/engine prototype is product code. Raw socket-priority prototype is INVALID: inserting stream-0 control into a partial envelope corrupted the codec frontier; failing real socket test buffered 16345 bytes, whole-envelope fix passes. Whole-frame socket-control p99 17.6 idle → 33.3 flood still fails. Missing-artifact two-engine attempt and initial theme ESM setup attempts were invalid; owned leaked fixture PID 822877 was stopped, driver preflight now prevents it.
Newest uncommitted parked-state + focused inline-turn experiment, Chromium B20 cat offered 6 MB/s/B with native 16 KiB envelopes: shared socket idle/flood p50 16.2/16.3, p99 17.0/133.6 ms; actual 1.327 MB/s/B, busy 51.53%, pan/drag max 33.3/16.8 ms, load .24/.88/.97 → .86/.96/1.00. Scratch B socket-worker variant p50 16.1/16.1, p99 28.2/56.7; actual .683 MB/s/B, busy 45.44%, pan/drag max 50/16.8 ms, load .86/.96/1.00 → 2.02/1.22/1.08. Both FAIL acceptance. Hidden receipts preserve cursor/modes/history but avoid viewport packing/markClean; getCursor still invokes native update. Every byte is decoded. State-only receipts require a full viewport on resume. Review found stale getters/copy and incorrect viewport-vs-absolute selection coordinates; current DOM regression now returns live row-08, history row-00 and resumed NEW é, fixes not committed yet.
Corrections to previous comments: separate host IDs share the existing mux socket below 28 streams, not 40. Network r2 fixture crashed rather than merely timing out. CDP frameReceived can itself be renderer-dispatched; enqueue→CDP timing does not prove wire-versus-main scheduling attribution.
Production browser reruns on committed
27da6dc4with the required RTT300: predictive throughput 3 paired samples PASS, off/on medians 2.63/2.60 MB/s (−1.15%, budget −5%). 10k-history theme test PASS all 50 palettes/socket stability: click p50 .7/p99 2.9 ms, no >50ms long task. Raw logs linked. These do not establish background-flood acceptance.iterate on
27da6dc4fails the native 24-restart daemon harness (not an authorized #118 exception); other Rust rows pass, TypeScript skipped by gate. Old final-fast static size failures also remain outstanding. No cap changes. NOT complete, no break-it handoff yet.r2-experiments-next.json
socket-boundaries-before.log
socket-boundaries-after.log
theme-300-head-r3.log
publish-fairness-before.log
publish-fairness-after.log
run-parked-c20.json
run-socket-parked-c20.json
throughput-300-head.log
iterate-publish-head.log
selection-after.log
New gate finding at2f73f608: cargo-deny now rejects existing rustls0.23.45 for RUSTSEC-2026-0346/0347/0348/0349. Upstream0.23.46 released today fixes all four: https://github.com/rustls/rustls/releases/tag/v%2F0.23.46 . Proposed gate repair: measure a Cargo.lock-only0.23.46 update inside existing declared compatible range; preserve chosen library/provider/features and all flow source. No advisory ignores, engine changes, contract changes or budget increases. Adopt as a separate atomic dependency commit only if checks and merge delta<=16,384 bytes pass; otherwise report measured blocker. Stop duplicate unchanged-head gate before mutation.
Previous restored full gate also hit unchanged key-startup Storage(PoolTimedOut); isolated retries3/3 pass at host load65.96–67.54. No test waiver.
key-startup-full-gate-failure.log
key-startup-retries.json
key-startup-retry-1.log
key-startup-retry-2.log
key-startup-retry-3.log
R2 scheduler:
859afcc5db. Avoid the extra MessageChannel hop for interactive slices while yielding after four turns. Unbounded inline processing was rejected because incoming background work must join fairly. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) a focused turn uses the current task until its bounded burst is spent [133.78ms]
(pass) focus runs first and a continuous focused owner cannot starve background turns [0.49ms]
2 pass
0 fail
3 expect() calls
Ran 2 tests across 1 file. [234.00ms]
R2 screen:
4bc5804083. Parked windows still decode every byte and expose cursor, modes and history; preserve native damage for the next full viewport. Discarding output or marking parked damage clean was rejected. D268, D188.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) repeated scrolling rows retain history without transferring identical viewport cells [59.03ms]
(pass) a one-row change transfers one packed row and coalesced damage stays dirty until paint [74.33ms]
3 pass
0 fail
1752 expect() calls
Ran 3 tests across 1 file. [834.00ms]
R2 parser:
c895e9b49e. Carry visibility through the owner FIFO and force a full current viewport when shown. Moving the engine on focus was rejected for its history copy cost; parser allocation and byte order remain stable. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) multiple windows share a worker engine without sharing parser state [130.36ms]
(pass) worker input and history reads follow modes and Unicode before any viewport receipt [248.79ms]
10 pass
0 fail
50 expect() calls
Ran 10 tests across 1 file. [19.48s]
R2 client:
748b11e1a8. Immediately invalidate stale cells and accept only a full receipt at the show command frontier. Return obsolete parked transfer slots without spending visible paint credit; preserve desired visibility across replacement. Treating parser completion or old full receipts as a current picture was rejected. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) failed-owner input waits for replayed modes and session switches cancel only old input [65.71ms]
(pass) a reset discards parser replies and viewports from the previous session [68.02ms]
10 pass
0 fail
46 expect() calls
Ran 10 tests across 1 file. [658.00ms]
R2 clipboard:
08a193ce50. Extend the existing shared clipboard helper with promised text so worker selection retains mobile gesture permission. Awaiting text before constructing ClipboardItem was rejected; observe derived Blob rejection when clipboard construction fails. D268, D160.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) deferred text starts a ClipboardItem write before its contents resolve [6.21ms]
(pass) clipboard constructor failure consumes a later deferred cancellation [1.74ms]
2 pass
0 fail
4 expect() calls
Ran 2 tests across 1 file. [40.00ms]
R2 terminal:
6df6699dab. Gate predictive screen reads on the worker visibility frontier. Treating cached cells as current during resume was rejected because it predicts against old contents; direct printable input remains ordered and unblocked. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) failed-owner input waits for replayed modes and session switches cancel only old input [63.54ms]
(pass) a reset discards parser replies and viewports from the previous session [88.87ms]
10 pass
0 fail
46 expect() calls
Ran 10 tests across 1 file. [742.00ms]
R2 binding:
e1fbcbe1af. Wire visibility and exact frame ownership into the pinned renderer. Read absolute selection endpoints, query stale/history text in its owner, retain copy gesture permission and replay a bounded native word/line gesture only if intent and geometry remain valid. Copying stale cells, clamped viewport coordinates, migration on focus and new selection algorithms were rejected. Unrelated frames invalidate future caches without cancelling an already accepted copy snapshot. D268, D160.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
10 pass
0 fail
46 expect() calls
Ran 10 tests across 1 file. [4.57s]
{"browser":"chromium","result":{"live":"row-08","history":"row-00","copyAcrossFrame":"row-01","backwardBoundary":"row-06\nrow-07\nrow-08\nrow-09","resume":"NEW é","doubleClickResume":"NEW","cancel-typing":"","cancel-elsewhere":""}}
{"browser":"firefox","result":{"live":"row-08","history":"row-00","copyAcrossFrame":"row-01","backwardBoundary":"row-06\nrow-07\nrow-08\nrow-09","resume":"NEW é","doubleClickResume":"NEW","cancel-typing":"","cancel-elsewhere":""}}
R2 clipboard_tests:
a90e411311. Exercise the synchronous write start with deferred Blob contents and constructor failure followed by cancellation. Happy-path-only coverage was rejected because an orphaned derived promise caused an unhandled rejection. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) deferred text starts a ClipboardItem write before its contents resolve [1.27ms]
(pass) clipboard constructor failure consumes a later deferred cancellation [1.75ms]
2 pass
0 fail
4 expect() calls
Ran 2 tests across 1 file. [26.00ms]
Candidate lockfile-only security patch fits x64 delta gate: rustls0.23.46 static22,288,976 bytes,SHA4f29a9be37fe32eaa8a99b193c829336853a25640f41a2abfcf3870ce6d1cd5e; patch+1,504 bytes; total+13,088 vs origin/dev22,275,888 <=16,384 PASS. Direct cargo-deny: advisories ok,bans ok,licenses ok,sources ok. Library/provider/features unchanged. Iterate underway after reclaiming this job's inactive debug target under renewed disk pressure; no dependency commit until it passes. Initial candidate link found cached baseline absolute linker-script path after temporary checkout deletion; cleaning CLI package outputs corrected it.
rustls-patch-artifact.json
rustls-patch-candidate.patch
rustls-patch-deny.log
resume-fast-restored-final.log
R2 parser_tests:
a79f048cfa. Compare state-only receipts and resumed cells with the pinned native engine after history, Unicode and bracketed-paste output. Cell-only assertions were rejected because parked owners must preserve non-display terminal state. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) multiple windows share a worker engine without sharing parser state [799.57ms]
(pass) worker input and history reads follow modes and Unicode before any viewport receipt [251.19ms]
10 pass
0 fail
50 expect() calls
Ran 10 tests across 1 file. [6.90s]
R2 findings; source integration pushed through
e1fbcbe1, tests are being committed separately. Independent read-only review found no additional concrete P1 after the fixes.Focus proof invalidated focus-proof-c20: idle drag landing reparents the canvas host and drops focus, while synthetic keys still target A. Earlier cohorts did not assert uninterrupted DOM/worker focus, so they do not establish focused-path acceptance. Fixture now waits for landing, settles native delayed focus, awaits an ordered owner text-query barrier and checks A=true/B=false plus DOM focus throughout typing. Corrected shared-socket B20/cat6 run: idle/flood p50 16.1/16.3, p99 16.8/83.8 ms; actual 1.385 MB/s/B, busy 50.33%, pan/drag max 16.8/16.8 ms; load 1.20/1.49/1.45 → 1.95/1.65/1.50. Socket-worker scratch candidate with the same assertions: p50 16.1/16.1, p99 18.4/31.3; actual 1.216 MB/s/B, busy 46.80%, pan/drag max 33.3/16.8; load .31/.55/.99 → .91/.66/1.02. Both FAIL p99; no socket candidate committed.
Parked resume fixes now fence stale cells immediately at hide/show commands, including stale full receipts and worker replacement. Twenty-seven real-worker/shared-clipboard tests pass (1855 assertions). Native DOM functional tests pass in Chromium and Firefox: distinct live/history rows; backward selection across history/screen; Unicode before full resume; native double-click replay; cancellation on new typing or elsewhere pointer intent; accepted history copy across an unrelated viewport. Clipboard construction failure/cancellation regression fails before and passes after. Production-fixture screenshots linked; no self-assessment of visual taste.
D188 current source: critical gzip/Brotli dev 296445/247026 → 303212/252724; deferred 47896/42508 → 47877/42470. Largest on-demand chunk 15946/14175; worker entry on-demand 2245/2017. All caps pass. Before/after macros match release mode, not preview.
iterate was restarted using the existing HOME scratch target after stopping only its owned default-target scope; no gate was waived. Native 24-restart daemon now PASS. Shim locale test FAIL at crates/infraternal-shim/src/pty.rs:477 (selected locale missing in child shell). cargo-deny FAIL on rustls0.23.45 advisories RUSTSEC-2026-0346/0347/0348/0349; bans/licenses/sources pass. Cargo.lock object
6c43592050equals origin/devb0a3799c, and no native/Cargo files changed in this lane. Owner/orchestrator must coordinate the shared security dependency remediation; this lane has not changed crypto dependencies or caps. These failures are not #118 exceptions. Full final-fast still required at final head; this iterate output is not a final gate.NOT complete; background-flood p99 acceptance and final gates remain outstanding.
run-focus-proof-c20.json


run-focus-settled-c20.json
run-socket-settled-c20.json
iterate-parked-selection-scratch.log
budget-parked-current.log
selection-functional-final.log
R2 client_tests:
ea61713d50. Cover immediate stale-cell fencing, parked-to-full transfer ownership, rapid visibility changes and hidden worker replacement. A callback-count-only happy path was rejected because old full receipts and replacement epochs can expose stale content or double-refund credit. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) failed-owner input waits for replayed modes and session switches cancel only old input [1146.73ms]
(pass) a reset discards parser replies and viewports from the previous session [433.70ms]
10 pass
0 fail
46 expect() calls
Ran 10 tests across 1 file. [5.60s]
R2 scheduler_tests:
3e2598e2ec. The before test observed no immediate focused completion; the worker should retain the current task for its bounded interactive burst. Testing priority alone was rejected because it did not detect the extra event hop. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) a focused turn uses the current task until its bounded burst is spent [200.52ms]
(pass) focus runs first and a continuous focused owner cannot starve background turns [59.00ms]
2 pass
0 fail
3 expect() calls
Ran 2 tests across 1 file. [1112.00ms]
Perf VM measurement queue: socket-settled-pair-c20 and coalesce-c20 each exited 75 before launching after the configured flock -w3600 wait. No timing result exists for those attempts. Retried each with new run IDs; paint-budget-c20 is also waiting. Lock holder PID935095 has no flood-worker command markers; its cgroup is session-c3064.scope. The prior owned socket run scope was already gone; the targeted stop returned unit-not-loaded and no foreign process was stopped. Orchestrator coordination is needed for the long-held shared lock. No host-load measurements substituted.
The first native fixture commit gate exposed a Firefox resume-copy race (unchanged NEW é became empty after a display-only receipt). The strengthened real-DOM test now holds an actual obsolete display receipt between owner-query completion and the next selection read: old display-revision key fails deterministically, content-revision key passes Chromium and Firefox. Native/client module fixes and the regression are being committed atomically; no performance candidate is product code.
R2 content_revision:
3d07ea9ac7. Track accepted bytes, reset, reflow and owner replacement as selected-text invalidations. A visibility receipt does not change text; treating every display receipt as a content change was rejected after the Firefox resume copy race. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) failed-owner input waits for replayed modes and session switches cancel only old input [104.59ms]
(pass) a reset discards parser replies and viewports from the previous session [77.14ms]
10 pass
0 fail
46 expect() calls
Ran 10 tests across 1 file. [3.32s]
R2 selection_cache:
204382a1ed. Key the owner-query cache by content changes while preserving accepted copy snapshots. Keying it by display receipt revisions was rejected: an obsolete full receipt between query completion and the next native selection read erased unchanged Unicode text. A held real receipt now reproduces the failing behavior deterministically. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) failed-owner input waits for replayed modes and session switches cancel only old input [82.73ms]
(pass) a reset discards parser replies and viewports from the previous session [90.68ms]
10 pass
0 fail
46 expect() calls
Ran 10 tests across 1 file. [2.85s]
R2 selection_fixture:
592dcb6203. Run Chromium and Firefox against minified production terminal code and the real VT worker. Distinct history/live rows, backward boundary selection, Unicode resume, unrelated-frame copy, native double-click replay and newer-input cancellation failed before the corresponding fixes and now pass. Mock position getters and pointer replay without cancellation were rejected. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
10 pass
0 fail
46 expect() calls
Ran 10 tests across 1 file. [3.01s]
{"browser":"chromium","result":{"live":"row-08","history":"row-00","copyAcrossFrame":"row-01","backwardBoundary":"row-06\nrow-07\nrow-08\nrow-09","resume":"NEW é","doubleClickResume":"NEW","cancel-typing":"","cancel-elsewhere":""}}
{"browser":"firefox","result":{"live":"row-08","history":"row-00","copyAcrossFrame":"row-01","backwardBoundary":"row-06\nrow-07\nrow-08\nrow-09","resume":"NEW é","doubleClickResume":"NEW","cancel-typing":"","cancel-elsewhere":""}}
R2 resume_redraw:
c0d8b4c1df. A surface restore can clean a fenced mirror while drawing no cells; the first eligible receipt must redraw its cached rows even when native damage is empty. Relying solely on the worker dirty flag was rejected after the failing cleared-surface regression. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) failed-owner input waits for replayed modes and session switches cancel only old input [278.61ms]
(pass) a reset discards parser replies and viewports from the previous session [132.44ms]
11 pass
0 fail
50 expect() calls
Ran 11 tests across 1 file. [1.66s]
R2 resume_redraw_test:
d3b5b68dcc. Use real native cells with held visibility frontiers to prove the first current receipt still requests a full redraw after an intervening clean. Testing only cell equality was rejected because correct cached text can leave an empty canvas. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) failed-owner input waits for replayed modes and session switches cancel only old input [615.17ms]
(pass) a reset discards parser replies and viewports from the previous session [130.09ms]
11 pass
0 fail
50 expect() calls
Ran 11 tests across 1 file. [6.21s]
R2 focus_fixture:
c68698ee87. A drag landing reparents the terminal host and invalidated the prior synthetic-key cohort. Wait for landing and delayed native focus, await an ordered owner-query barrier, and assert A focused/B unfocused plus DOM focus throughout samples. UI active-window state alone was rejected because synthetic events keep reaching an unfocused A. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
11 pass
0 fail
50 expect() calls
Ran 11 tests across 1 file. [6.44s]
{"browser":"chromium","result":{"live":"row-08","history":"row-00","copyAcrossFrame":"row-01","backwardBoundary":"row-06\nrow-07\nrow-08\nrow-09","resume":"NEW é","doubleClickResume":"NEW","cancel-typing":"","cancel-elsewhere":""}}
{"browser":"firefox","result":{"live":"row-08","history":"row-00","copyAcrossFrame":"row-01","backwardBoundary":"row-06\nrow-07\nrow-08\nrow-09","resume":"NEW é","doubleClickResume":"NEW","cancel-typing":"","cancel-elsewhere":""}}
Candidate iterate failed during test compilation because shared disk filled again: rustc-LLVM "IO failure on output stream: No space left on device"; concurrent linker Bus error. fmt/native fmt/plugin compile-out/clippy/cargo-deny PASS; test FAIL101 is not a test-result waiver. After freeing only this job's inactive caches and external space recovery, same-source iterate retry is running. Cargo.lock candidate remains uncommitted pending passing tests. Post-patch VM artifacts uploaded and hashes verified; measurements queued on shared lock. Initial empty SSH console was diagnosed incorrectly as incomplete upload; remote hashes and files were complete.
rustls-patch-iterate.log
Completed atomic dependency gate repair6f08be16acdb675a89d9cb290c9fcafe7238e6fd: Cargo.lock only,rustls0.23.45->0.23.46,existing library/provider/features unchanged; D257/D268, no flow source change. Candidate x64 bytes22,288,976,total delta+13,088 vs origin/dev <=16,384. Direct cargo-deny PASS. Same-source iterate retry exits0: fmt,native fmt,plugin compile-out,clippy,Rust tests,cargo-deny,TypeScript,production build and protocol37 tests/34,463 assertions PASS. Earlier disk-full compile and startup PoolTimedOut receipts remain recorded; no waiver. Final scripts/verify fast now running on6f08be16. Branch push waits for final gate completion; no dev push/deploy.
rustls-patch-iterate-retry.log
Milestone head
6b1b890apushed, no deploy. Native DOM regression committed at592dcb62; content-vs-display revisions 3d07ea9a/204382a1; first-current surface redrawc0d8b4c1with failing-before regressiond3b5b68d; focus-cohort validationc68698ee; driver diagnostics6b1b890a. All touched-code gates passed; Chromium/Firefox selection regression passes. Source review found no further concrete P1 at its last pass.Full scripts/verify fast on exact head
6b1b890a, verbatim result:Native locale standalone retry and full native test row now pass. Four RustSec advisories remain in the unchanged rustls0.23.45 lock. Static x86_64 22275888 >22204304 (+71584); ARM 19704712 >19638744 (+65968). No native/Cargo source differences from origin/dev; no caps changed. Separate TypeScript/protocol gate passed (protocol37 tests/34463 assertions); final head has additional tested client resume fixes.
Additional scratch candidates all failed: focused-first/one-background-canvas paint scheduling idle/flood p99 18.3/130 ms, actual1.089 MB/s/B, busy52.29%, A disconnect11, load2.31/1.27/.75→2.21/1.33/.79; B socket worker+two round-robin parser pools 22.3/49.5, .952 MB/s/B, busy54.86%, A disconnect1, load1.32/1.25/.82→1.59/1.32/.85; bounded background write batching 16.9/96.6,1.032 MB/s/B,busy56.77%,A disconnect10,load1.59/1.32/.85→1.98/1.42/.89. None is product code. Earlier pair/coalesce lock timeouts produced no timings; retries and paint run later completed when the shared lock became available. No foreign process was stopped.
Measurement correction: previous cohorts start at the terminal input hook after synthesizing keydown inside the renderer. They exclude browser input-queue delay and cannot establish the full key-to-paint target; their already-failing results remain conservative diagnostics. Current uncommitted harness uses trusted Playwright keyboard events, records raw echo paint time, and measures from driver dispatch with one calibrated clock offset reused for idle and flood (constant offset error cancels in the delta). Fresh production-code and scratch all-socket-worker cohorts are running on the perf VM. NOT complete or ready for break-it review.
fast-current-head.log
content-revision-before.log
content-revision-after.log
resume-redraw-before.log
resume-redraw-after.log
run-paint-budget-c20.json
run-socket-settled-pair-c20-r2.json
run-coalesce-c20-r2.json
R2 trusted_fixture:
4968657d78. The previous input hook started after browser queuing and could not establish key-to-paint acceptance. Capture one trusted keydown per input, expose exact echo paints and counts, and retain DOM/worker focus assertions. Synthetic timing injection and sticky trust were rejected. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) synthetic input cannot establish trusted-input acceptance [0.06ms]
(pass) an echo before dispatch or with a nonfinite timestamp is invalid [0.13ms]
4 pass
0 fail
5 expect() calls
Ran 4 tests across 1 file. [8.00ms]
R2 trusted_driver:
e9da4c781c. Use serial browser keyboard dispatch with one clock calibration shared by idle and flood; retain calibration uncertainty and reject duplicates, unmatched input, synthetic events and invalid timestamps. Starting at the renderer input hook was rejected because it excludes queued input latency. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) synthetic input cannot establish trusted-input acceptance [0.10ms]
(pass) an echo before dispatch or with a nonfinite timestamp is invalid [0.28ms]
4 pass
0 fail
5 expect() calls
Ran 4 tests across 1 file. [13.00ms]
R2 trusted_tests:
204781459c. The old helper accepted duplicate echoes and negative or nonfinite latency; the failing-before regression now rejects them. Include untrusted input and a valid serial cohort using fabricated timestamps, not performance measurements. Happy-path-only acceptance checks were rejected. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) synthetic input cannot establish trusted-input acceptance [0.11ms]
(pass) an echo before dispatch or with a nonfinite timestamp is invalid [0.20ms]
4 pass
0 fail
5 expect() calls
Ran 4 tests across 1 file. [12.00ms]
R2 trusted-input acceptance correction; still FAIL, not review-ready. Head
204781459c, pushed flood-worker only.Perf VM, Chromium, production terminal/canvas/mux/codec with generated output (no native PTY), 20 background windows, same host, cat offered 6 MB/s/window, native-size 16 KiB packets, 100 trusted samples per phase. One driver/browser clock calibration reused for idle and flood; absolute latency includes calibration uncertainty and Playwright dispatch overhead. Both runs preceded the final duplicate-count/negative-timestamp guards, so retained as diagnostic runs, not final acceptance certification:
4968657dcaptures single-use trusted keydown association and exact echo counts in the fixture;e9da4c78replaces the late input-hook metric with trusted browser dispatch through exact raw-echo paint, retaining calibration;20478145regresses duplicate/untrusted/negative/nonfinite cohorts. Before: 2 pass/2 fail; after: 4 pass/0 fail. Independent source review found no remaining false-association gap in the serial echo-only fixture. Functional worker/clipboard/measurement unit cohort: 32 pass, 1864 assertions.The two hardened reruns are waiting on the shared perf lock with flock -w 3600; no foreign holder was stopped. An initial hardened command used the wrong RATE units; its own waiting flock PID 1755551 was terminated before measurement and replaced with RATE=6. No timing result from that canceled waiter.
Current production D188: critical gzip/Brotli 303246/252997 bytes (dev 296445/247026); deferred 47882/42460 (dev 47896/42508); largest on-demand 15947/14176. Caps pass. Full separate TypeScript/protocol gate passes, including protocol 37 tests/34463 assertions. Full fast is now running on exact head
20478145. Earlier full-fast dependency advisories/static-size failures remain recorded above; no gate waiver or cap change.run-trusted-head-c20.json
run-trusted-socket-all-c20.json
trusted-keys-before.log
trusted-keys-unit.log
R2 independent checklist found pre-encoding input ownership unbounded in terminal-worker-client.ts:209–225. A held owner admitted 10000 key commands before reaching TerminalClient.inputQueue. Failing regression: 11 pass/2 fail (missing capacity control; 10000 queued keys >4096). Binding also checked disableStdin when dispatching already admitted input, which would discard that FIFO after a pressure pause. Fixing admission reservations against downstream free bytes, separate retained-memory/command caps, and shared pause/resume; preserve reservations through recovery and include key-tray modifier expansion. No performance acceptance claim.
R2 input_admission:
4b9a49a070. Reserve final wire bytes including key-tray expansion against downstream capacity, cap retained UTF16 text and command count, and preserve accepted FIFO through replay and pressure. Relying on the later wire ring was rejected after 10000 stalled commands bypassed it. The pinned encoder output is bounded to 32 bytes. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) unanswered worker encoding reserves bounded input without losing admitted FIFO [30.93ms]
(pass) replay bounds queued commands and rejects oversized key payloads before posting [32.56ms]
13 pass
0 fail
58 expect() calls
Ran 13 tests across 1 file. [589.00ms]
R2 independent checklist: initial VT load/allocation errors bypass Worker.onerror and repeatedly trigger error/reset; dispose checks initialization too early and retains failed contexts beside a healthy owner. Startup regressions before: 0 pass/3 fail, including repeated reset and missing fatal classification; rejected load has no typed reply. Fix choice: stop only the failed terminal with an actionable status for unrecoverable initialization, retain bounded replacement for worker crashes, and allow idempotent disposal before initialization checks. No new engine or retry loop.
P2: document mouseup automatically copies an existing history selection after content changes, without a primary selection gesture. Adding a native DOM right-button regression and tracking canvas primary gesture ownership.
R2 input_binding:
aee13bb020. Relay worker admission pressure and deliver the accepted FIFO independently of disableStdin. Checking that future-input flag again at delivery was rejected because it silently discards already admitted input. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) unanswered worker encoding reserves bounded input without losing admitted FIFO [8.68ms]
(pass) replay bounds queued commands and rejects oversized key payloads before posting [16.29ms]
13 pass
0 fail
58 expect() calls
Ran 13 tests across 1 file. [404.00ms]
R2 input_wire:
98ae03755f. Refresh reservation capacity after retaining, acknowledging and clearing wire input. Resume native typing only when both ownership stages have headroom. Separate uncoordinated limits were rejected because accepted encoded text could overflow the existing resume ring. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) unanswered worker encoding reserves bounded input without losing admitted FIFO [10.72ms]
(pass) replay bounds queued commands and rejects oversized key payloads before posting [14.68ms]
13 pass
0 fail
58 expect() calls
Ran 13 tests across 1 file. [485.00ms]
R2 input_tests:
658af185d5. Before the fix a held owner accepted 10000 commands and had no capacity fence; preserve admitted key/text order, reject oversized retained text, bound replay to 4096 commands and drain every accepted command. Count-only tests without FIFO/recovery were rejected. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) unanswered worker encoding reserves bounded input without losing admitted FIFO [12.19ms]
(pass) replay bounds queued commands and rejects oversized key payloads before posting [9.33ms]
13 pass
0 fail
58 expect() calls
Ran 13 tests across 1 file. [514.00ms]
R2 startup_parser:
64441e1972. Observe rejected loading, classify absent native state as fatal and dispose before initialization guards. Clear freed handles before replacement allocation. Resetting an absent engine and keeping failed contexts alive were rejected after three failing startup regressions. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) a failed initial allocation disposes without retaining its context beside a live owner [52.05ms]
(pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [14.76ms]
13 pass
0 fail
57 expect() calls
Ran 13 tests across 2 files. [589.00ms]
R2 startup_client:
08dc05501f. Free an unrecoverable owner before notification and make reentrant reset inert. Sending reset into an engine that never initialized was rejected because it creates a hot typed-error loop outside the crash retry budget. Recoverable initialized parsers retain replay. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) unanswered worker encoding reserves bounded input without losing admitted FIFO [6.69ms]
(pass) replay bounds queued commands and rejects oversized key payloads before posting [7.17ms]
16 pass
0 fail
65 expect() calls
Ran 16 tests across 2 files. [357.00ms]
R2 strict trusted-input reruns completed on the perf VM, still FAIL. Same workload as progress8; exact guarded single-echo oracle, 100 keys/phase:
Input ownership fix pushed in 4b9a49a0/aee13bb0/98ae0375/658af185: bounded pre-encoding FIFO, downstream wire reservations including modifier expansion, retained-string/command limits and coordinated pause/resume; admitted input no longer silently discarded under disableStdin. Held-owner/replay regressions pass. Startup failure/disposal fix and native right-button clipboard regression are in progress following independent review. Startup tests before0/3, after3/3; combined startup/client16pass65assertions. Native right-button browser regression fails before: unrelated mouseup rewrote history clipboard.
Full fast milestone on20478145: Rust fmt/VTfmt/plugin compileout/clippy/tests PASS; cargo-deny FAIL (existing rustls advisories), static builds FAIL (existing sizes). Final gate must run again after checklist fixes; milestone is not the final head.
run-trusted-hardened-c20.json
run-trusted-hardened-socket-all-c20.json
input-bound-before.log
input-bound-after.log
startup-before.log
startup-after.log
unrelated-mouseup-before.log
R2 startup_binding:
39464b8d49. Relay fatal ownership separately from initialized parser failure while cancelling deferred gestures. Treating every typed error as recoverable was rejected because startup has no authoritative engine to replay into. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) a failed initial allocation disposes without retaining its context beside a live owner [49.16ms]
(pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [16.11ms]
3 pass
0 fail
7 expect() calls
Ran 3 tests across 1 file. [90.00ms]
Final scripts/verify fast at6f08be16acdb675a89d9cb290c9fcafe7238e6fd exits1 only for unchanged absolute static size caps. Every other row PASS; no test waiver. x64 final artifact SHA4f29a9be37fe32eaa8a99b193c829336853a25640f41a2abfcf3870ce6d1cd5e matches the post-patch VM input. x64 total delta+13,088 bytes vs origin/dev <=16,384 PASS. ARM static19,717,400 bytes; runtime/key-heap not executed on ARM. No cap/profile change. Native post-patch campaign finishing; throughput acceptance remains open pending its result.
Verbatim gate summary:
final-security-head-fast.log
R2 startup_terminal:
b10fc4896f. Retire the failed window client and display an actionable reopen instruction. Reconnecting the shared socket or retrying reset forever was rejected because unrelated windows must survive. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) a failed initial allocation disposes without retaining its context beside a live owner [44.55ms]
(pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [18.51ms]
3 pass
0 fail
7 expect() calls
Ran 3 tests across 1 file. [99.00ms]
R2 startup_tests:
86caa1581c. Inject failures around the pinned native engine, assert one fatal notification and no reset loop, and reuse disposed context ids while another real owner remains live. Before 0 pass/3 fail; mocked healthy-only lifecycle tests were rejected. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) a failed initial allocation disposes without retaining its context beside a live owner [53.65ms]
(pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [77.69ms]
3 pass
0 fail
7 expect() calls
Ran 3 tests across 1 file. [158.00ms]
R2 input_response:
6f7e5bec24. Parser-generated replies also spend the resume ring while user encoding is pending. Recheck final encoded size before dispatch, retain the FIFO head until ACK capacity returns, and guard synchronous reentrancy. Assuming reservations excluded all other producers was rejected by the failing held-paste regression. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) replay bounds queued commands and rejects oversized key payloads before posting [48.09ms]
(pass) parser responses cannot spend the wire space of an admitted unresolved paste [0.67ms]
14 pass
0 fail
61 expect() calls
Ran 14 tests across 1 file. [667.00ms]
R2 input_response_test:
ebe89be842. Hold a paste response, consume wire space through a parser response, and require the accepted text to wait and deliver exactly once after capacity returns. Admission-only assertions missed this second producer. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) replay bounds queued commands and rejects oversized key payloads before posting [33.89ms]
(pass) parser responses cannot spend the wire space of an admitted unresolved paste [0.62ms]
14 pass
0 fail
61 expect() calls
Ran 14 tests across 1 file. [558.00ms]
R2 selection_gesture:
6b3bcbc591. Track the native primary gesture and consume it at mouseup; right-button releases and existing selections cannot initiate deferred clipboard writes. Keep primary drag ownership through scroll while cancelling obsolete word replay. Unconditional document mouseup copying was rejected by the failing native browser regression. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
14 pass
0 fail
61 expect() calls
Ran 14 tests across 1 file. [571.00ms]
{"browser":"chromium","result":{"live":"row-08","history":"row-00","copyAcrossFrame":"row-01","beforeUnrelatedMouseup":"row-00","unrelatedMouseup":"0","backwardBoundary":"row-06\nrow-07\nrow-08\nrow-09","primaryHistoryCopy":"row-06\nrow-07\nrow-08\nrow-09","resume":"NEW é","doubleClickResume":"NEW","cancel-typing":"","cancel-elsewhere":""}}
{"browser":"firefox","result":{"live":"row-08","history":"row-00","copyAcrossFrame":"row-01","beforeUnrelatedMouseup":"row-00","unrelatedMouseup":"0","backwardBoundary":"row-06\nrow-07\nrow-08\nrow-09","primaryHistoryCopy":"row-06\nrow-07\nrow-08\nrow-09","resume":"NEW é","doubleClickResume":"NEW","cancel-typing":"","cancel-elsewhere":""}}
R2 follow-up review regressions: (1) native parser replies can consume wire space while a user paste is awaiting encoding; accepted paste must remain queued until ACK. Failing-before test demonstrated premature delivery; 6f7e5bec/ebe89be8 now gate final encoded size and prevent recursive draining. (2) input callback cancel/free cleared reservations before outer subtraction, yielding negative counters; failing-before cancellation tests, fixed with generation ownership, in progress commits. (3) worker module load failing twice exhausts crash retries but previously reported recoverable failure into an absent worker; failing-before 3 pass/1 fail, adding fatal retirement for every affected owner. Typed initialization failure and native disposal tests already pass; no new foundational dependency.
R2 selection_gesture_tests:
691e132f07. A right-button release with an existing changed history selection must not invoke clipboard writes; an actual backward primary drag still copies after scrolling. Native Chromium and Firefox fixtures fail before the fix and pass after; text-only selection checks missed gesture ownership. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
14 pass
0 fail
61 expect() calls
Ran 14 tests across 1 file. [565.00ms]
{"browser":"chromium","result":{"live":"row-08","history":"row-00","copyAcrossFrame":"row-01","beforeUnrelatedMouseup":"row-00","unrelatedMouseup":"0","backwardBoundary":"row-06\nrow-07\nrow-08\nrow-09","primaryHistoryCopy":"row-06\nrow-07\nrow-08\nrow-09","resume":"NEW é","doubleClickResume":"NEW","cancel-typing":"","cancel-elsewhere":""}}
{"browser":"firefox","result":{"live":"row-08","history":"row-00","copyAcrossFrame":"row-01","beforeUnrelatedMouseup":"row-00","unrelatedMouseup":"0","backwardBoundary":"row-06\nrow-07\nrow-08\nrow-09","primaryHistoryCopy":"row-06\nrow-07\nrow-08\nrow-09","resume":"NEW é","doubleClickResume":"NEW","cancel-typing":"","cancel-elsewhere":""}}
Post-patch native echo campaign complete on perf VM:5 rotating interleaved runs/source/profile,n100 pooled per phase,unchanged harness/ranks/budgets. All merge baseline/sibling-flood/same-session rows PASS at LAN/150/300. Same-session echo p99 ms reviewed/dev/merge: LAN9.324/12.351/11.452;150=183.767/191.350/173.331;300=348.979/475.291/330.343. Merge growth8.977/13.519/3.687 ms <=16.667. Reviewed and dev WAN aggregate rows FAIL; all raw runs retained.
LAN merge is2.128 ms above reviewed in this campaign; previous same-session r2 merge was1.458 ms below reviewed. The historical25.23-vs4.5 conclusion is not reproduced under interleaving; absolute reviewed results vary substantially with load. No attributable #199/section-layout interaction established, no speculative reversion. Throughput campaign continues; original gaps remain on record and no no-loss claim yet.
Head6f08be16 is pushed and remote-verified; final fast all non-static rows PASS,absolute caps only FAIL.
post-patch-latency-results.tar.gz
post-patch-latency-summary.json
R2 input_generation:
ffbe81e4ed. Tag retained ownership with its cancellation generation so input callbacks that retarget or free cannot subtract already-cleared reservations. Unconditional post-callback subtraction was rejected after the negative-counter regression. The existing drain guard preserves callback FIFO. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) replay bounds queued commands and rejects oversized key payloads before posting [43.62ms]
(pass) parser responses cannot spend the wire space of an admitted unresolved paste [0.70ms]
17 pass
0 fail
66 expect() calls
Ran 17 tests across 2 files. [981.00ms]
R2 input_generation_tests:
97d5be4cee. Assert zero retained ownership after cancel/free and nonrecursive callback FIFO when new text is admitted. Before cancellation drove counters negative; ordinary asynchronous-only callbacks missed this invariant. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) input accounting survives callback free [24.73ms]
(pass) reentrant admission waits until the preceding input consumer returns [0.53ms]
3 pass
0 fail
5 expect() calls
Ran 3 tests across 1 file. [98.00ms]
R2 exhausted_worker:
d6353eb2b1. Reuse fatal disposal for exhausted module-load retries and synchronous replacement construction failure, snapshotting owners before callbacks mutate the pool. Recoverable reset into an absent worker was rejected by the two-crash regression. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) replay bounds queued commands and rejects oversized key payloads before posting [37.00ms]
(pass) parser responses cannot spend the wire space of an admitted unresolved paste [0.89ms]
22 pass
0 fail
81 expect() calls
Ran 22 tests across 3 files. [947.00ms]
R2 exhausted_worker_test:
728d150aeb. Two load failures must create only one replacement, report each owner fatal once, release all pool owners and ignore late errors. The typed native-startup test alone missed worker module failures. Before3pass1fail; recoverable reconnect after the final retry was rejected. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) exhausted worker-load retries fatally retire every owner exactly once [2.70ms]
(pass) a replacement constructor failure fatally retires its owners [3.28ms]
5 pass
0 fail
15 expect() calls
Ran 5 tests across 1 file. [106.00ms]
R2 oversized_input:
972a16c5ae. Rejecting an item admits no ownership and may produce no future ACK or reply. Reevaluate real retained headroom immediately so ordinary input can continue; latching pressure until nonexistent progress was rejected by the failing idle-paste regression. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) replay bounds queued commands and rejects oversized key payloads before posting [31.25ms]
(pass) parser responses cannot spend the wire space of an admitted unresolved paste [3.40ms]
23 pass
0 fail
83 expect() calls
Ran 23 tests across 3 files. [798.00ms]
R2 oversized_input_test:
ad58b0ef5b. Reject a 600 KiB paste against the pre-encoding retained-memory bound, then require ordinary text to arrive without cancellation, worker reply or ACK. Busy queues hid this idle liveness gap. D268.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
(pass) reentrant admission waits until the preceding input consumer returns [0.49ms]
(pass) rejecting an oversized paste cannot permanently pause an idle terminal [6.52ms]
4 pass
0 fail
7 expect() calls
Ran 4 tests across 1 file. [54.00ms]
R2 input_readiness_test:
8ea7a8a769. Extend the existing wire-readiness adapter with the new worker admission boundary and realistic free bytes. Assert reservations see retained input and mode-sensitive input resumes after replay confirmation. Leaving the old adapter without its new dependency produced a TypeError instead of testing readiness. D268, D265.Touched-code gate: fmt, strict tracer TypeScript, diff whitespace and tests passed. Rust source unchanged; no crate clippy required.
apps/tracer/test/input-ready.test.ts:
(pass) an unconfirmed attachment buffers typing and flushes it once replay confirms readiness [2.44ms]
1 pass
0 fail
12 expect() calls
Ran 1 test across 1 file. [46.00ms]
R2 final verification base update: rebasing flood-worker head8ea7a8a769038028ae6cd37ff3e023779620b3cc onto origin/dev1b23ef311ce8f850ff01a60d06a420db33d26888, which carries the owner-selected rustls0.23.46 advisory fix. All source checklist P1s addressed; last focused independent source review reports none remaining (no timing claim). Final six native-packet trusted Chromium/Firefox cohorts queued with separate perf locks; full fast will run on rebased head.
R2 source checklist fixes complete on rebased/pushed head0e05b8ffd6f45e64765ebaed49c078a0a6c20efd, based on origin/dev1b23ef311 (owner security patch). No Rust/Cargo diff from that dev baseline. Rebase range map attached so earlier per-step SHAs remain traceable.
All terminal/worker/clipboard/measurement regressions:58pass,0fail,2204assertions across13files. Existing input-readiness adapter now checks capacity updates and replay-resume, rather than omitting the new dependency. Native Chromium/Firefox selection cases pass: unrelated right-button clipboard writes0; primary backward history drag still copies exact rows across scroll; live/history/Unicode resume/double-click cancellation retained. Screens attached for independent visual review; no self-judgment of visual quality.
Input ownership now caps pre-encoding commands/text, reserves transformed wire capacity, waits accepted resolved input behind unreserved parser replies, guards reentrant draining and cancellation generations, and resumes after an oversized unadmitted rejection without waiting for a nonexistent ACK. Fatal rejected native load/allocation disposes its context; exhausted module crash retries/constructor failures stop/free affected owners once. Independent final focused source review reports no remaining concrete P1; it did not rerun timings.
Production D188 current critical gzip/Brotli304091/253625 bytes (dev296445/247026), deferred47879/42462 (dev47896/42508), largest on-demand15948/14182. All caps pass. TypeScript gate progressing through protocol oracle; full fast on exact rebased head progressing. Six final trusted-input Chromium/Firefox cohorts remain queued on the perf lock. Known latency acceptance still FAIL from strict20B runs; exact-final memory certification still outstanding, and no completion/review-ready claim.
rebase-range-diff.txt


terminal-rebased-final.log
unrelated-mouseup-after-clean.log
input-response-before.log
input-lifecycle-before.log
exhausted-worker-before.log
exhausted-worker-after.log
oversized-input-before.log
R2 percentile reporting correction: previous 100-sample tables selected sorted[floor(N0.99)], i.e. the maximum. Final reporting uses nearest-rank sorted[ceil(Nq)-1], with maximum separate. Raw samples are unchanged; attached CSV recomputes all retained run arrays and records their hashes. The failure conclusion remains for both guarded20B runs: product idle/flood p99 32.138/57.126 (+24.988ms), maxima39.967/69.129; unshipped socket scratch p99 31.891/37.850 (+5.959), maxima31.959/53.395. Both exceed +4ms.
First exact-final cohort, Chromium1B yes offered1MB/s, achieved0.97947MB/s: idle p50/p99 28.983/34.293 ->flood28.080/37.775 (p99+3.482), floodmax75.480. Mainbusy31.4393%; pan/drag max16.8/16.8ms (quantized frame timestamps). Load1.20/1.49/1.32 ->1.20/1.47/1.32. This individual latency comparison is within target; it does not certify the remaining matrix or overall completion. Other cohorts are queued with lock release between runs.
Protocol rerun with isolated scratch Cargo target:37pass,0fail,34463assertions; the concurrent-target differential run timed out during Cargo activity and is retained as a failed attempt, not waived. Full fast continues on exact head0e05b8ff.
nearest-rank-runs.csv
R2 exact-final production-code fixture matrix on head0e05b8ff. Verdict: FAIL; no review-ready/completion claim. Every run completed with guarded trusted input, settled DOM/worker focus, exact one input/echo per press and one fixed clock offset reused for idle/flood. Same frozen JS artifact SHA256 2b7e7ab48c9a0cb04f2b156d95ca8811931e1326cdea78e2de1251263251ee2c across all six. Perf VM: Intel i9-9900K exposed4vCPU,8262770688B RAM,kernel6.12.111+deb13-amd64; weighted scopes and separate short locks. Source is production canvas/VT/mux/codec with generated output, not a native PTY acceptance certificate.
Offered workload:1B yes1MB/s/B;5/20B cat6MB/s/B. Achieved rates below1MB/s in Firefox5/20 mean the workload target is not established even when an idle/flood percentile happens to improve. Firefox idle pan already has long frames; these runs do not establish display-rate acceptance or attribute its baseline defect to B. Chromium5/20 and Firefox20 exceed typing p99 delta+4ms. Quantile is nearest-rank, maximum separate; earlier correction remains above.
Final source cohorts on head0e05b8ffd6f45e64765ebaed49c078a0a6c20efd; all timings perf VM. Nearest-rank p50/p99; maximum separate. 100 trusted samples/phase. Generated output through production mux/canvas/VT; no native PTY.
Transfer diagnostics: owner query round trip is not a pure copy benchmark; postMessage is synchronous send cost; mirror receipt includes applying state/callbacks. Samples are capped at first1000 for post/receipt.
All correctness checklist fixes,58tests/2204assertions and the full isolated-target TypeScript/protocol gate pass. The first rebased full-fast test row failed two server assertions (control queue closed connection; failed renewal publication unexpected terminal output), both pass in individually filtered workspace runs. They are not covered by the #118 waiver and no waiver is taken. One final full-fast run with2harness threads is queued after static release builds finish; all assertions remain unchanged. Static x86 already exceeds cap:22277392 vs22204304B (+73088); Rust/Cargo source is identical to current dev1b23ef311. No cap or foundation change made in this UI lane.
run-final-chromium-b1.json
run-final-chromium-b5.json
run-final-chromium-b20.json
ts-rebased-final-isolated.log
ts-rebased-final.log
run-final-firefox-b1.json
run-final-firefox-b5.json
run-final-firefox-b20.json
final-cohorts-table.md
final-matrix.log
Review handoff: head6f08be16acdb675a89d9cb290c9fcafe7238e6fd pushed to flood-server-ship and remote-verified. Worktree clean; no dev push/deploy; issue remains open. Reviewed4b681d8e ancestry/source integration retained via2f73f608; later browser experiments remain excluded. Only new product change this resume is the atomic compatible rustls0.23.46 lockfile security repair; chosen library/provider/features unchanged.
Five interleaved runs/source/profile on the perf VM (n100/phase) give same-session echo p99 ms:
All shipping-head baseline/sibling/same-session budget rows PASS. Historical25.23-vs4.5 merge penalty does not reproduce consistently under interleaving; LAN relative delta flips across campaigns. No attributable #199/section-layout interaction established. Private daemon reversion and section-off controls were not adopted.
Review blocker: no-throughput-loss remains unproven. All27 final50 MiB transfers are byte/cursor exact. Mean MB/s reviewed/dev/head: LAN9.117982/9.056180/9.010461;150=6.751788/6.112445/6.156591;300=3.284406/3.231305/3.318878. Head vs dev -0.505/+0.722/+2.710%; vs reviewed -1.179/-8.815/+1.050%. The150 gap vs reviewed needs orchestrator performance review/controlled investigation before integration; no waiver or speculative feature removal. Earlier negative campaigns and load/steal diagnostics remain attached.
Abrupt-stop failure also occurred on dev alone (prior alternating controls0/1/0 vs merge0/0/0); current head passes the full test row and abrupt-stop regression. Flow proof remains32,768 bytes ahead of Ack<=65,536; terminal credit/replay/readiness suite23 tests/97 assertions. Iterate exits0. Final fast exits1 only for unchanged absolute static caps; x64 delta+13,088 bytes vs origin/dev<=16,384 PASS. Final x64 hash4f29a9be37fe32eaa8a99b193c829336853a25640f41a2abfcf3870ce6d1cd5e matches the VM artifact. ARM static19,717,400 bytes; ARM runtime not tested. No budget/profile changes.
Verbatim final scripts/verify fast summary:
Exact input binaries, final harness/machine receipt, raw measurements, author checklist and gate:
post-patch-all-results.tar.gz
post-patch-throughput-summary.json
post-patch-perf-inputs.tar.gz
resume-reviewer-checklist.txt
final-arm-artifact.json
post-patch-final-harness.tar.gz
post-patch-latency-results.tar.gz
post-patch-latency-summary.json
final-security-head-fast.log
All recorded own perf scopes inactive; fixture count0. Removed owned r2/r3 VM scratch, local build targets, temporary worktrees, helpers and binary copies after attachment. Evidence retained outside checkout. Cleanup:
final-perf-cleanup.log
final-local-cleanup.log
Independent verification started on local branch review-flood-server-ship at target
6f08be16ac; merge base with dev8e7467c07c. Read #197 and parent #55 history, project rules and author report. Continuing prior reviews; D268 separates browser-worker acceptance from this shipping lane. Review brief forbids pushes, deployment and perf VM access. Functional checks and replay of retained VM evidence only; full scripts/verify fast running on the target before review-test changes. No implementation edits.Review step complete at local c070fd4b: FSS-1 P2 compatibility regression committed as apps/tracer/test/rebind-credit-compatibility.test.ts. A retained terminal.reconnecting stream keeps adaptiveOutput=true from its former host; after host rollback to a legacy version, initial Ack cannot fund its parked 64 KiB repaint. Failing production-handler test: available32768<65536; 0 pass/1 fail. Reconnecting and initial-Ack handling in apps/tracer/src/terminal.ts need per-host negotiation; fresh-browser-attach coverage misses this sequence. D17/D265. Existing terminal suite passes23 tests/97 assertions; tracer TypeScript check passes. No implementation changes.
Independent review FSS-2, P1: no-throughput-loss acceptance remains unresolved at target
6f08be16. Local failing test committed at e5581be7: apps/tracer/test/native-flood-throughput-acceptance.test.ts, "150 ms native flood campaign preserves reviewed throughput". Recomputed all six raw retained transfer logs, each exact 52,428,800 bytes; verified successful exits, before/after load and binary hashes. Reviewed mean 6.751788093 MB/s; shipping 6.156591464 MB/s (-8.815%); dev 6.112444826 MB/s (shipping +0.722%). Mean steal reviewed/shipping 3.978%/5.237%. This confirms the author-reported unresolved acceptance gap, not a source-caused regression or new measurement. Raw receipts: https://git.kayg.org/attachments/1d0c9c8f-dddd-47f4-8396-56aa2c80265a . Replay: FLOOD_SERVER_SHIP_RESULT_DIR=$HOME/.cache/codex-scratch/flood-server-ship-review/evidence/retained/results bun test apps/tracer/test/native-flood-throughput-acceptance.test.ts => 0 pass, 1 fail, 43 assertions. Perf VM access prohibited by review brief; a controlled authorized follow-up must resolve this before shipping. HOLD (P1 acceptance gap); implementation unchanged, no push.R2 resume artifacts: unshipped transport/queue/paint candidate sources attached; these are isolated spikes and are not part of the product branch. Their rejected/invalid/failed runs remain above. Reconstruct their6b1b890a production base from the rebase map; builders restore modified source in finally and now use the isolated source archive rather than the live worktree.
Earlier v3 Chromium PSS, perf VM, KiB, for1/10/50 windows respectively:
Scope:290000 Unicode bytes/window, configured10000 scrollback but actual1119 retained history rows, all windows checked. These earlier scoped numbers meet <=10% growth; they are not an exact-final-head or actual10000-row certification. Exact0e05b8ff1/10/50 memory measurement remains outstanding. Do not substitute configured history for actual rows.
unshipped-prototypes.tar.gz
memory-v3-pair.json
FSS-1 P2 regression refined at local 038fc704: use a valid confirmed steady-state 1 ms LAN path, rather than startup credit. The actual adaptive window is144726 bytes with903850 banked; after terminal.reconnecting and legacy initial Ack it remains144726, insufficient for a256 KiB repaint (262144). Test still0pass/1fail. This supersedes the earlier32 KiB/64 KiB fixture numbers; same rollback/rebind capability defect. Reproduction and output: apps/tracer/test/rebind-credit-compatibility.test.ts and ~/.cache/codex-scratch/flood-server-ship-review/evidence/rebind-credit-steady-state.log. Implementation unchanged.
Review verification step complete at local038fc7044 (target product6f08be16): standalone ts_verify_fast exits0;191 tracer/build tests /11387 assertions,37 protocol tests /34463 assertions, production transfer budgets and vendored checksums PASS. Existing terminal suite23/97 also PASS. Review tests retain FSS-1 P2 and FSS-2 P1 failures; no implementation edits. Recomputed native retained n100 same-session echo p99 LAN/150/300=11.452/173.331/330.343ms and growth8.977/13.519/3.687ms, all pooled rows PASS. These are original VM receipts, not host timings or fresh remeasurement. Failure evidence and recomputed native rows:
rebind-credit-steady-state.log
throughput-acceptance-before.log
replayed-native-summary.json
Full scripts/verify fast remains in progress.
R2 stopped INCOMPLETE on pushed flood-worker head0e05b8ffd6f45e64765ebaed49c078a0a6c20efd, rebased onto dev1b23ef311. Worktree clean; no deploy or dev push. Do not close#197 or treat this as merge-ready.
Implemented permanent pooled worker ownership, bounded focused scheduling, exact paint/epoch/credit frontiers, parked/resumed cells, native input and bounded history/search/selection/replay. Checklist fixes cover retained input capacity/reentrancy, fatal startup/disposal, and gesture-owned deferred copying. Independent final focused source review found no remaining concrete P1; it did not certify performance. Terminal/worker/clipboard/benchmark regressions:58pass/2204assertions. Full isolated-target TypeScript/protocol gate passes (protocol37tests/34463assertions). Screens, failing-before tests, source rebase map and rejected prototype sources are attached above.
Acceptance remains FAIL. Exact-final trusted100-sample nearest-rank p99 at20B: Chromium36.013→93.424ms (+57.411),1.08332MB/s/B,mainbusy47.199%; Firefox16.056→48.163 (+32.107),0.2793MB/s/B,mainbusy33.784%. Firefox5/20 also fall below1MB/s/B, and display-rate acceptance is not established. All six runs, loads, maxima and transfer diagnostics are in the matrix comment/table above; no best-run substitution. Generated output fixture is not a native-PTY acceptance certificate.
Fresh Chromium PSS comparison PASS within10% at1/10/50 windows. Scope:290000Unicode bytes/window,53columns/42rows,actual1119history rows in every window,configured10000. Baseline frontend files at60957819 are unchanged through dev1b23ef311. Head load2.31/1.25/1.16→2.18/1.31/1.18; dev1.95/2.61/1.81→1.66/2.51/1.79. The first baseline attempt used an older fixture missing grids(); it is INVALID and retained, then rerun with the compatible baseline-v3. This does not certify fully populated10000-row history.
D188 gzip/Brotli bytes: critical296445/247026→304092/253689; deferred47896/42508→47879/42470. Worker entry is its own on-demand chunk2277/2046; largest on-demand chunk15946/14178. Caps pass.
Final gate command: RUST_TEST_THREADS=2 scripts/verify fast on exact head above, exit1. Output verbatim:
No waiver: final full test row failed shim spawned_login_shell_receives_selected_locale_without_other_host_variables; it passes an individually filtered workspace retry. First full attempt failed the two server control/renewal tests; both pass individually and in the final full attempt. Both full attempts remain attached. Static binaries: x86_64=22277392>22204304B (+73088);aarch64=19705112>19638744 (+66368). Rust/Cargo sources match dev1b23ef311; no cap or unrelated native change made. Orchestrator must resolve the shared native gate/cap failures before integration; this lane still needs the background latency/throughput/frame targets met.
All owned benchmark/test scopes have finished. Removed65owned scratch directories including build targets, prototype source archives and temporary baseline; retained evidence and small reproduction scripts outside the repository. No result/report or raw evidence committed to the repository.
fast-rebased-final-two-threads.log
run-memory-final-head.json
run-memory-final-dev.json
final-benchmark-helpers.tar.gz
run-memory-final-dev-r2.json
locale-workspace-retry.log
final-memory-table.md
final-memory-artifact-hashes.txt
baseline-fixture-source.tar.gz
fast-rebased-final.log
native-control-workspace-retry.log
native-renewal-workspace-retry.log
R3 resume: flood-worker at
0e05b8ffd6, base origin/dev1b23ef311c(fresh fetch; already ancestor). Read #197 and parent #55 histories and project contracts. Continue D268 background-only scope: transfer background painting to OffscreenCanvas using the pinned renderer; preserve main-thread focused painting and last-frame handover, byte/epoch/credit order, selection/history/replay. Measure every attempt on authorized perf VM, 1/5/20 backgrounds in Chromium/Firefox, memory and D188. Reproduce locale test on origin/dev before any native fix. Heavy gates use build-slot. No deploy; push flood-worker only.R3 first offscreen-paint candidate, uncommitted, perf VM Chromium20B cat offered6MB/s/B,n100 trusted samples/phase: idle p50/p99/max29.944/32.468/38.240ms; flood30.409/98.468/149.647 (+66.000p99) FAIL. Mainbusy47.319%;achieved1.12409MB/s/B;pan/drag max33.3/33.4ms;load5.31/2.50/1.88→4.14/2.46/1.89. Artifactbe2aa47e4482dfd20ac2a4ca676d9f15d46deb027f91c3f6f004882ea71c322a. Five socket retirements;errors0. This first candidate predates inactive-backing release and glyph atlas. Source fixture hides off-screen windows (most of21); remaining visible backgrounds should render offscreen, but explicit runtime ownership assertions are being added before attributing cost. No acceptance or causal improvement claim. All output remains ordered. Native dev locale control and iterate queued through build-slot.
run-paint1-c20.json

Review Rust gate progress on unchanged product source6f08be16, local review head038fc70442d46409a4d1d655c2a71a67e4ba724b: fmt,VT fmt,CLI plugin compile-out,clippy,full test row,cargo-deny PASS.109 completed test groups report1056 passed/0 failed/138 ignored (including CLI compile-out); no baseline exception or retry used. Two serialized socket tests exceeded60seconds but both passed. Real PTY flight receipt: PASS shim input Ack behind bounded output:32768 bytes<=65536. Static x86_64/ARM64 builds now running; final table and output attachment follow. Standalone TypeScript gate already exits0. FSS-1 P2 and FSS-2 P1 review tests remain intentionally failing; no implementation changes.
R3 diagnostic paint1-profile-c20 (same be2aa47e artifact as first run, profiling ON, perf VM): n100 idle p50/p99/max29.837/33.030/35.467ms; flood30.474/142.844/148.866 (+109.814p99) FAIL;mainbusy48.783%,actual1.09543MB/s/B;load.50/1.25/1.58→1.41/1.38/1.61. Profile self samples: idle8107ms, unassigned browser program5478ms, writeWithCallback274ms,GC242ms, worker onmessage200ms,getBoundingClientRect111ms. Unassigned program time is not proof of a paint/transport cause.
Second candidate adds inactive backing-store release and bounded worker-wide glyph atlas; its3draw-frontier regressions/13assertions and strict TS pass. Production D188 critical gzip/Brotli305041/254542 vs R2 304092/253689;deferred47858/42484 vs47879/42470, caps pass. New real-browser surface handover regression FAILS waiting for the first background surface; diagnosing with typed metadata before promotion. No commits or acceptance claim yet. Old selection regression completes before that new failure. Baseline locale control remains queued through build-slot (initial duplicate waiters canceled before compilation); no dev-only failure claim yet.
run-paint1-profile-c20.json
run-paint1-profile-c20.cpuprofile
r3-build-2.log
r3-functional-1.log
R3 functional finding before fix: corrected native terminal.blur() test completes5focus handovers/history/Unicode reset, but exact screenshots differ in447RGB channels/149pixels (main→worker), returned main identical0. Differences are only row5, x96–159, operator glyphs == != ->. Main backing resize runs after its text-mode hook and resets optimizeSpeed, enabling contextual glyphs; worker preserves the intended mode. Fix under test: allocate/resize backing before existing font/ligature hooks and force full draw; do not expose a fenced mirror. This is a functional rendering regression, not a visual-taste judgment. The first test failure was fixture misuse (blurred inactive textarea rather than contenteditable host), not an offscreen failure.
Build-slot control is now compiling untouched dev1b23ef311 shim. Perf paint2 cohorts remain waiting in flock -w3600; current foreign holder PID1981650 elapsed11m16s. No foreign process touched and no build-host timing substituted.
r3-functional-2.log



Independent verification finish. Verdict: merge after fixes. HOLD (P0/P1 present). Counts: P0=0, P1=1, P2=1, P3=0.
Target6f08be16acdb675a89d9cb290c9fcafe7238e6fd; local review branch review-flood-server-ship, head038fc70442d46409a4d1d655c2a71a67e4ba724b. Requested local-dev merge base8e7467c07cd2ec1668a775a846076b278f68ef38; shipping/current-origin-dev merge base
b182529fcc. Three atomic test-only commits; implementation/Cargo.lock unchanged, worktree clean. No push/deploy/perf-VM access or issue closure.FSS-2 P1: unresolved no-throughput-loss acceptance. Recomputed all three exact50MiB transfers/source at150ms from retained raw VM logs; verified successful exits/load and independently hashed preserved input binaries and all five harness files. Shipping6.156591464 vs reviewed6.751788093 MB/s (-8.815%); dev6.112444826 (+0.722% shipping). Mean steal reviewed/shipping3.978%/5.237%. This confirms the existing acceptance gap, not a source-caused regression. Failing test at e5581be7: apps/tracer/test/native-flood-throughput-acceptance.test.ts; replay with FLOOD_SERVER_SHIP_RESULT_DIR=$HOME/.cache/codex-scratch/flood-server-ship-review/evidence/retained/results. Result0pass/1fail/43assertions. Controlled authorized follow-up must resolve acceptance; no invented tolerance or speculative implementation fix.
FSS-1 P2: retained stream keeps former host credit-hint support across terminal.reconnecting. A legacy host after rollback sends Ack, then parks a256KiB repaint before replay_complete. The valid1ms LAN window remains144726 bytes, with903850 banked, so recovery cannot progress. Locations apps/tracer/src/terminal.ts:845,1203. Final failing production-handler regression at038fc704: apps/tracer/test/rebind-credit-compatibility.test.ts;0pass/1fail. Earlier startup-only fixture numbers are superseded by this steady-state fixture.
Checks:23 existing terminal tests/97assertions; standalone ts_verify_fast exits0 (191 tracer/build tests/11387assertions,37 protocol tests/34463assertions), checksums and production transfer budgets PASS. Full Rust gate:109 completed test groups including compile-out,1056passed/0failed/138ignored. No retry or baseline exception. Two serialized socket tests exceeded60seconds but passed. Real PTY flight:32768 bytes ahead of Ack<=65536.
Retained final native echo replay: five runs/profile,n100/phase; LAN/150/300 p99=11.452/173.331/330.343ms, growth8.977/13.519/3.687ms; all pooled rows PASS. Separate browser-worker acceptance remains outside D268 shipping scope. Fresh performance/resource-scale/repaint/fuzz campaigns were not repeated; perf VM use is prohibited. Historical50-PTY evidence is not a measured D170200-session fleet.
Final scripts/verify fast: exit1, only unchanged absolute static caps fail, including the size fixture derived from those caps. x86_6422288976>22204304 B (+84672); ARM6419717400>19638744 (+78656). Preserved shipping input delta vs dev is13088 B. Both static linkage/trust checks pass; x86 key-memory passes, ARM runtime correctly not checked on x86. Fresh x86 hashbc4cbc19114d23f95731f4d1a1519fef0ec920afb4686ab9e42262439e218092 differs from original VM input4f29a9be...; no timing equivalence claimed. Size alone is not the HOLD reason (D205).
Command: CARGO_TARGET_DIR=$HOME/.cache/codex-scratch/flood-server-ship-review/target INFRATERNAL_TEST_STATE_ROOT=$HOME/.cache/codex-scratch/fsr-state INFRATERNAL_TEST_RTT=0 RUST_TEST_THREADS=2 TRACER_TEST_PORT=4387 orchestrator/build-slot scripts/verify fast.
Verbatim gate summary:
Receipts:
flood-server-ship-review-fast.log.gz
flood-server-ship-review-gate-summary.txt
flood-server-ship-review-reviewer-checklist.md
ts-fast.log
independent-perf-input-hashes.txt
independent-harness-match.txt
shim-flight-functional.log
Finding ledger: ~/.local/state/codex-jobs/infraternal/review-flood-server-ship/findings.md. Raw receipts/cohorts remain under ~/.cache/codex-scratch/flood-server-ship-review/evidence; owned Rust targets and generated Python cache removed. The original uncompressed gate attachment returned HTTP422; compressed uniquely named receipt above uploaded successfully.
R3 locale control on unchanged origin/dev1b23ef311, isolated archive/target: initial filtered test PASS;50filtered repeats50PASS/0FAIL;three full shim-lib suites at RUST_TEST_THREADS=2 allPASS. The historical failure did not reproduce in these controls; no claim that dev alone failed. Before-fix failing real-engine test remains the R2 head0e05b8ff full-fast log attached above.
Source-confirmed observer race: Linux6.12 begin_new_exec closes CLOEXEC descriptors before ELF create_elf_tables publishes env_start/env_end; proc environ_read explicitly returns0 while env_end is unset. Sources: https://github.com/torvalds/linux/blob/v6.12/fs/exec.c#L1239 , https://github.com/torvalds/linux/blob/v6.12/fs/binfmt_elf.c#L311 , https://github.com/torvalds/linux/blob/v6.12/fs/proc/base.c#L948 . This supports an empty-first-read race, not proof it caused the historical failure. Test-only repair now waits boundedly only for a nonempty own-child snapshot; all selected-locale/TERM/scrub assertions remain unchanged and nonempty wrong values fail immediately. No runtime spawn or locale selection change. Post-fix crate checks and full final-fast remain required.
r3-locale-dev-control-2.log
r3-locale-dev-repeat.log
r3-dev-shim-1.log
r3-dev-shim-2.log
r3-dev-shim-3.log
R3 started on flood-server-ship at
6f08be16ac, merge baseb182529fcc. Read #197 and parent #55 histories and review038fc7044. Continue P1 causal investigation with >=5 interleaved runs per suspect on authorized perf VM; preserve failing P2 retained-stream rollback regression before reset fix. No budget changes, no dev push or deployment; heavy gates through build-slot.P2 fixed and pushed:93c894fd4 resets host capability on terminal.reconnecting;
fffc3260epreserves the production-handler regression and adds modern replacement coverage. Before0pass/1fail:144726 available<262144 repaint. After19pass/0fail/93assertions across five terminal/credit/readiness files; fmt and strict tracer check PASS. Reconnect notice alone releases0 credit; legacy initial Ack restores1MiB, modern hint borrows262144 bytes only. D17/D265/D268; full iterate running through build-slot.Performance finding from source: reviewed/shipping shim and relay/credit-clock sources identical; only native build-vt section layout differs (#198 commit722af2a32). Release opt-level/LTO/panic/codegen settings identical; no speculative flag change. Daemon delta is #199 liveness/proof support. Preparing single-variable static controls; no new performance claim yet.
r3-rebind-before.log
r3-rebind-after.log
R3 causal measurement method prepared (no new results yet): five rotating cohorts each of exact retained reviewed/head/dev inputs plus same-path fresh head, head with reviewed daemon (#199 removed), pre-rustls-patch lock, pre-722af2a32 native section recipe, and reviewed expiry arm (merge-specific probe clear removed). Current origin/dev1b23ef311 differs from integration dev baseline only by the same rustls0.23.46 patch in native inputs, so also build it separately. Release opt-level/LTO/panic/codegen match reviewed; no other flag to revert.
Each source gets150ms exact50MiB throughput and LAN echo; final reviewed/current-dev/head also get five150/300ms echo runs. Same unchanged five checked-in harness files, short flock/CPUWeight10000 scopes,120s per run, full load/stat/hash receipts. Private wrapper observes selected relay delays without changing their sampled values. A second separately labelled diagnostic repeats throughput at fixed150ms (jitter0) to test the sustained-burst random-delay hypothesis; the default ±30ms acceptance profile and every budget remain unchanged. No speculative product/native change. Heavy builds and iterate continue via build-slot.
R3 source checkpoint, still uncommitted on0e05b8ff; NOT review-ready.11focused tests/2170assertions PASS. Cursor ownership regression before0/2, after2/2: no DOM cursor placement on worker-painted/fenced surfaces. Backgrounds retain lazy dirty-cell mirrors for native selection/links; the worker paints scrollback/selection/hover metadata, without moving typing focus. Main+worker use one font/placement helper; direct DOM/offscreen glyph probes match in both browsers, while the earlier wrapper-level operator pixel mismatch is under validation. Font loading is now outside the VT/input FIFO, with a sequenced ready refresh and generation fencing; delayed-font and fallback browser cases added. No new engine/library.
Full iterate is compiling native tests; refreshed production/pixel gate waits for build-slot. Unchanged-dev locale controls all pass as above; test-only empty-proc observer repair is included. Canceled only the known-raster-bad paint2 candidate's queued perf waiter1993288 and verified-own parent1993283 before measurement; no samples/no timings exist for those two planned cohorts. Foreign perf lock holder1981650 remains untouched. First two completed paint1 runs are retained/reported above.
Source checkpoint reconstructs all work from base0e05b8ff (tracked patch + new files + SHA256 manifest); code will be split into gated atomic commits after functional validation.
r3-in-progress-source.tar.gz
r3-focused-unit.log
r3-cursor-before.log
r3-cursor-after.log
r3-font-probe.log
r3-canceled-paint2-waiters.log
R3 milestone at pushed
fffc3260e8: scripts/verify iterate exits0. fmt/VT fmt/plugin compile-out/clippy/Rust tests/cargo-deny/TypeScript/production build/transfer/protocol checks PASS; protocol37tests/34463assertions. Expanded terminal/credit/replay/exit/readiness suite25pass/105assertions. All24 abrupt stops PASS this run, no baseline exception. Real PTY Ack ahead32768bytes<=65536. Full scripts/verify fast has been queued automatically on this head; iterate is not the final gate.Static controls built so far: fresh head22288976B; reviewed daemon/no-liveness22287888B; pre-security-lock22287472B. Old-section recipe and final controls still building; no new performance numbers yet.
r3-iterate.log.gz
r3-terminal-full.log
r3-iterate-shim-flight.stdout.log
Completed native test step:
e852b3bfdd(pushed to flood-worker). The locale test retries only empty /proc child-environment snapshots; populated wrong values still fail immediately. origin/dev1b23ef31did not reproduce the historical failure in 50 filtered repetitions and three full shim-library suites (two test threads); therefore this is a race hardening, not a reproduced regression.Current worktree iteration gate passed (full log attached below). Relevant checks: Rust fmt, native fmt, CLI compile-out, clippy, workspace tests, cargo-deny, TypeScript check and protocol tests. Protocol tests: 37 pass, 0 fail, 34463 assertions. D188: critical gzip/Brotli 305543/255015 bytes; deferred 47862/42457, all within caps. This is the iteration gate, not the final static gate.
Final line verbatim:
r3-iterate-2.log
Validation resource checkpoint (2026-10-15 00:35 UTC): current source includes worker OffscreenCanvas painting, shared text shaping, bounded worker-wide glyph atlas, async font configuration, and retained pictures while pan/drag freezes paint. No new performance conclusion yet. All four shared build slots are occupied; production/functional validation is waiting via the existing slot-2 lock (same four-slot capacity). On perf VM, /run/lock/perf-bench.lock remains held by flock PID 1981650 (elapsed 01:08:53 at inspection), with other waiters. Earlier paint2 waits were cancelled before any measurement began. No foreign process or lock was modified. Need the shared build/measurement slots to become available; continuing code review while waiting.
Approved step 2 is now in the candidate: background worker painting coalesces changed pictures at up to 30 Hz, with forced full refreshes for focus/view/resize bypassing the cap. The focused main canvas stays on its existing display path. Parser byte ordering and canonical state are unchanged. This follows the recorded uncapped OffscreenCanvas paint1 Chromium-20 failure (p99 +66.000 ms); it is not a claimed improvement until the next locked VM run. New diagnostics record painter ownership and surface failures during the typing phase, before pan/drag changes visibility. New functional regression checks a frozen picture remains byte-for-byte unchanged while its state advances, then verifies resumed worker/main pixel equality.
Final-fast functional finding at
fffc3260e(native source still6f08be16): agent_daemon restart oracle FAIL at iteration1/before-forward. Payload470784 bytes; received408063; input acked470844/470844; proxy alive, no pending barrier. Socket times out20s. Iterate immediately before passed all24 positions and the full1056-test row; no #118 baseline exception applies to this row. Preserve failure and compare unmodified oracle with current origin/dev1b23ef311 in paired functional runs before any waiver or source fix. The baseline static build is already one declared perf control. Final-fast static builds continue to preserve their caches/receipts; a final full retry will still be required after this finding is resolved.Raw failure: ~/.cache/codex-scratch/flood-server-ship/evidence/r3-abrupt-first-failure.log. No source/timeout/budget change.
Production bitmap candidate text4: TypeScript check passed; 12 worker paint/screen/cursor tests passed with 2176 assertions. D188 critical gzip/Brotli 305675/254918 bytes; deferred 47856/42458; largest on-demand chunk 15958/14197 (caps all pass). Real Chromium bitmap assertion failed: main/background differ in 492 channels (operator glyphs); return-to-main, selected history and frozen-picture comparisons each differ in 0; resumed background/main differs in 492. Font-delay/input ordering and drawing-fallback checks completed before the pixel assertion. No atomic frontend commits or performance claim from this failed candidate.
Source finding: apps/tracer/style.css:75-76 explicitly enables contextual/common ligatures and calt/liga on the page. DOM terminal canvases inherit them; a worker canvas has no CSS parent. The earlier detached native canvas probe did not test that inheritance. The next candidate explicitly disables these terminal-local features in the shared D175 canvas hook, pending browser pixel proof.
r3-text4.log


Completed step: Share terminal canvas text rules across rendering contexts
235c724195(pushed). D175 and D268 require identical glyph weights, placement and ligature behavior in both contexts. Extract the existing memoized hooks and preserve the hint across resize. Explicitly disable inherited calt/liga on the terminal canvas: page CSS enabled operators on the DOM surface while worker text was unligated. Keeping two implementations or only the rendering hint left 492 differing channels at handover.Gate: cargo fmt --all -- --check; tracer bun run check; existing worker client, input lifecycle, startup, screen and scheduler suites; git diff --check. All passed. (pass) a failed initial allocation disposes without retaining its context beside a live owner [47.54ms]; (pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [18.69ms]; (pass) a replacement constructor failure fatally retires its owners [0.59ms]; (pass) reset recovers a failed parser without retaining an old viewport slot [51.72ms]; (pass) failed-owner input waits for replayed modes and session switches cancel only old input [52.87ms]; 28 pass; 0 fail; 1838 expect() calls
Completed step: Reuse shared text hooks in the focused terminal
7f6f5da1ad(pushed). The focused renderer must use the same D175 weight and ligature rules as future background drawing. Replace duplicate hooks with the shared module; retaining two implementations allowed resize and font transitions to disagree. D268 keeps the focused drawing path local.Gate: cargo fmt --all -- --check; tracer bun run check; existing worker client, input lifecycle, startup, screen and scheduler suites; git diff --check. All passed. (pass) a failed initial allocation disposes without retaining its context beside a live owner [33.04ms]; (pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [12.85ms]; (pass) a replacement constructor failure fatally retires its owners [0.68ms]; (pass) reset recovers a failed parser without retaining an old viewport slot [18.90ms]; (pass) failed-owner input waits for replayed modes and session switches cancel only old input [21.52ms]; 28 pass; 0 fail; 1838 expect() calls
Completed step: Preserve native damage until the worker renderer consumes it
1b692675c1(pushed). D268 worker painting needs native row damage after a dirty-cell snapshot is transferred. Make cleaning optional while retaining the existing default; consuming damage before drawing would leave stale pictures.Gate: cargo fmt --all -- --check; tracer bun run check; existing worker client, input lifecycle, startup, screen and scheduler suites; git diff --check. All passed. (pass) a failed initial allocation disposes without retaining its context beside a live owner [29.95ms]; (pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [10.60ms]; (pass) a replacement constructor failure fatally retires its owners [0.50ms]; (pass) reset recovers a failed parser without retaining an old viewport slot [21.36ms]; (pass) failed-owner input waits for replayed modes and session switches cancel only old input [23.08ms]; 28 pass; 0 fail; 1838 expect() calls
Completed step: Render transferred terminal surfaces with the pinned renderer
02e7d4e39e(pushed). D268 moves background drawing into the existing worker without changing the engine. Share native renderer and text rules, pin metrics and a bounded worker-wide glyph atlas, and load exact faces outside the VT FIFO. Reject duplicate renderers and whole-memory focus migration; unchanged pictures need no upload. D188 keeps this module on demand.Gate: cargo fmt --all -- --check; tracer bun run check; existing worker client, input lifecycle, startup, screen and scheduler suites; git diff --check. All passed. (pass) a failed initial allocation disposes without retaining its context beside a live owner [33.29ms]; (pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [11.53ms]; (pass) a replacement constructor failure fatally retires its owners [0.62ms]; (pass) reset recovers a failed parser without retaining an old viewport slot [23.07ms]; (pass) failed-owner input waits for replayed modes and session switches cancel only old input [33.28ms]; 28 pass; 0 fail; 1838 expect() calls
Completed step: Publish background frames from the worker draw frontier
857063cf9c(pushed). D268 requires background parsing and drawing to leave the main thread while preserving byte order and credit. Add surface ownership, asynchronous font readiness and display-tick painting to each existing owner FIFO. Dirty cells remain available for selection and links; parser completion alone never acknowledges a visible draw.Gate: cargo fmt --all -- --check; tracer bun run check; existing worker client, input lifecycle, startup, screen and scheduler suites; git diff --check. All passed. (pass) a failed initial allocation disposes without retaining its context beside a live owner [44.30ms]; (pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [12.46ms]; (pass) a replacement constructor failure fatally retires its owners [0.27ms]; (pass) reset recovers a failed parser without retaining an old viewport slot [17.44ms]; (pass) failed-owner input waits for replayed modes and session switches cancel only old input [19.72ms]; 28 pass; 0 fail; 1838 expect() calls
Completed step: Coalesce flooding background pictures at thirty hertz
231369dd09(pushed). The uncapped OffscreenCanvas candidate still missed the Chromium twenty-window target (p99 growth 66 ms). Apply the owner-approved D268 continuation cap to background pictures; forced interaction/focus/resize refreshes bypass it. Keep canonical parsing and byte order intact rather than dropping terminal output. Focused drawing remains at display rate.Gate: cargo fmt --all -- --check; tracer bun run check; existing worker client, input lifecycle, startup, screen and scheduler suites; git diff --check. All passed. (pass) a failed initial allocation disposes without retaining its context beside a live owner [32.37ms]; (pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [13.48ms]; (pass) a replacement constructor failure fatally retires its owners [0.58ms]; (pass) reset recovers a failed parser without retaining an old viewport slot [25.50ms]; (pass) failed-owner input waits for replayed modes and session switches cancel only old input [27.02ms]; 28 pass; 0 fail; 1838 expect() calls
Completed step: Fence worker paint receipts across focus and visibility changes
17338c74ef(pushed). A delayed worker picture must not spend credit or reveal cells for a later owner. Track draw ownership and fresh visible frontiers, promptly retire obsolete transfer slots, retain frozen surfaces and fall back from drawing failures without resetting a healthy parser. D268 rejects engine migration and parse acknowledgements as paint proof.Gate: cargo fmt --all -- --check; tracer bun run check; existing worker client, input lifecycle, startup, screen and scheduler suites; git diff --check. All passed. (pass) a failed initial allocation disposes without retaining its context beside a live owner [35.50ms]; (pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [22.26ms]; (pass) a replacement constructor failure fatally retires its owners [0.31ms]; (pass) reset recovers a failed parser without retaining an old viewport slot [34.71ms]; (pass) failed-owner input waits for replayed modes and session switches cancel only old input [46.47ms]; 28 pass; 0 fail; 1838 expect() calls
Completed step: Keep the last terminal picture visible during surface handover
ffd2b9bb9d(pushed). D268 focus changes must preserve the last frame and native DOM input/selection identity. Transfer a sibling canvas once, release inactive backing stores, forward selection/history/link metadata, and reveal each owner only after current drawing. Frozen pictures retain pixels while parsing advances; context failures use the main renderer instead of replay loops.Gate: cargo fmt --all -- --check; tracer bun run check; existing worker client, input lifecycle, startup, screen and scheduler suites; git diff --check. All passed. (pass) a failed initial allocation disposes without retaining its context beside a live owner [41.45ms]; (pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [12.02ms]; (pass) a replacement constructor failure fatally retires its owners [0.60ms]; (pass) reset recovers a failed parser without retaining an old viewport slot [29.65ms]; (pass) failed-owner input waits for replayed modes and session switches cancel only old input [27.99ms]; 28 pass; 0 fail; 1838 expect() calls
Completed step: Enable background worker painting in terminal windows
ac70bbda7c(pushed). Wire D268 background drawing into creation, focus and pan freezes. Keep focused rendering local and suppress duplicate DOM cursors when worker painting or a fenced viewport owns the display. A focus event alone cannot reveal a stale surface.Gate: cargo fmt --all -- --check; tracer bun run check; existing worker client, input lifecycle, startup, screen and scheduler suites; git diff --check. All passed. (pass) a failed initial allocation disposes without retaining its context beside a live owner [33.66ms]; (pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [13.96ms]; (pass) a replacement constructor failure fatally retires its owners [0.52ms]; (pass) reset recovers a failed parser without retaining an old viewport slot [27.75ms]; (pass) failed-owner input waits for replayed modes and session switches cancel only old input [31.38ms]; 28 pass; 0 fail; 1838 expect() calls
Completed step: Regress terminal paint ownership and retained native damage
3791a6cf1c(pushed). Exercise exact draw credit, stale focus receipts, reset epochs, drawing fallback and fresh resource-ready frames against real VT snapshots. Regress duplicate cursor ownership and damage consumed before worker drawing. D268 requires ordered state and paint proof, not parser-only mocks.Gate: cargo fmt --all -- --check; tracer bun run check; existing worker client, input lifecycle, startup, screen and scheduler suites plus new regression suites; git diff --check. All passed. (pass) a failed initial allocation disposes without retaining its context beside a live owner [35.40ms]; (pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [13.28ms]; (pass) a replacement constructor failure fatally retires its owners [0.80ms]; (pass) reset recovers a failed parser without retaining an old viewport slot [22.45ms]; (pass) failed-owner input waits for replayed modes and session switches cancel only old input [32.63ms]; 37 pass; 0 fail; 2262 expect() calls
Completed step: Exercise real worker bitmap handovers in both browsers
d83b6300c2(pushed). Compare main/offscreen/returned and selected-history pixels with the pinned renderer. Hold a font request while encoding input, verify fallback preserves state, and prove a frozen picture resumes correctly. Record painter ownership and failures during trusted-key flood measurements. D268 and D188 require production artifacts and VM-only timing; screenshots remain outside the checkout.Gate: cargo fmt --all -- --check; tracer bun run check; existing worker client, input lifecycle, startup, screen and scheduler suites plus new regression suites; git diff --check. All passed. (pass) a failed initial allocation disposes without retaining its context beside a live owner [24.19ms]; (pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [12.79ms]; (pass) a replacement constructor failure fatally retires its owners [0.59ms]; (pass) reset recovers a failed parser without retaining an old viewport slot [21.31ms]; (pass) failed-owner input waits for replayed modes and session switches cancel only old input [21.64ms]; 37 pass; 0 fail; 2262 expect() calls
Frontend steps complete and pushed through
d83b6300c(12 atomic commits since r3 start, including native locale-test hardening). Each actual intermediate tree passed cargo fmt, tracer TypeScript check and 28 existing worker tests; the two final steps passed 37 tests / 2262 assertions including new paint, cursor and damage regressions. Final source overlay matches the validated text5 candidate byte for byte. Worktree clean.Chromium and Firefox production-code functional checks both pass: Unicode/operator handover, return to main, selected history, held picture and resumed picture all have 0 differing color channels at 280×108. Six focus returns preserve history. Native selection/copy and deferred gestures stay green. Bracketed input encodes while the HTTP server holds an actual worker font request. Missing font causes one drawing fallback, zero parser failures, and retains ordered text. The earlier paired diagnostic used browser request interception and timed out in Firefox; the direct HTTP barrier completes in both browsers.
D188 text5 candidate (final source, build identifier e852 plus then-uncommitted frontend diff): critical gzip/Brotli 305736/254993 bytes; deferred 47851/42415; all caps pass. A fresh production build of exact previous head
0e05b8ffis queued for the before/after comparison. Final scripts/verify fast is running atd83b6300c(workspace tests completed, static compilation ongoing). VM Chromium/Firefox 20-background cohorts are waiting on the shared lock; no new latency or memory claim yet.r3-text5.log




Perf run paint3-c20,
d83b6300csource, production fixture artifact SHA256 27becbd3ef8254c2c7a333e8303a0152840b067a7655b20fe8236fc77213505e. Locked VM scope run-p2065635-i2065935.scope, CPUWeight=10000. infraternal-perf-test, 4 vCPU Intel i9-9900K, 8262770688 RAM bytes, kernel 6.12.111+deb13-amd64. Load 0.43/0.72/0.61 → 1.52/0.93/0.68.Chromium, same host, 20 background cat streams, offered 6 MB/s each, achieved 1.052036 MB/s each. 100 trusted keys per phase. Idle p50/p99/max 29.489/34.523/36.388 ms; flood 31.448/222.148/241.954 ms. p99 growth +187.625 ms: FAIL. Main thread busy 54.827%. Pan p50/p99/max 16.7/50.0/50.0 ms (idle 16.7/16.8/16.8); drag 16.7/16.8/33.3 (idle 16.7/16.8/16.8).
New visibility proof during typing: 2 background canvases worker-painted/visible; 18 background windows parked; focused canvas local. Worker typing phase: 106 painted receipts, 1067 total messages, 3805824 cell bytes, 0 parser errors, 0 surface failures. Receive-handler cost p50/p99/max 0/1.2/5.1 ms; post cost 0/0.3/2.5. Query-hop p99 idle/flood 0.6/3.5 ms. 21 socket retirements/disconnections, no typed connection failures.
Trace finding: worst key 101 spent 0.7 ms input→server, 0 ms server echo acceptance queue, 226.4 ms accepted echo→browser wsMessage, then 12.5 ms termWrite→paint. Flood stage p50/p99/max: input→server 0.3/27.9/30.9 ms; accepted echo→wsMessage 14.0/208.0/226.4; termWrite→paint 14.4/26.0/30.0. Server timestamps are integer epoch ms; browser timeOrigin aligns the same VM clock (sub-ms values include rounding). The longest stall precedes VT/paint work, not proof of its cause. A timeline/CPU diagnostic is queued before choosing another optimization. Firefox-20 remains queued. No acceptance claim.
raw JSON

scope log
R3 relay instrumentation finding, preliminary n1/source (not acceptance): all three50MiB transfers byte/cursor exact. Reviewed5.742047MB/s with summed selected relay delay166.542ms; shipping7.736732MB/s with123.618ms; no-liveness6.256375MB/s with155.378ms. Shipping/reference raw delta+34.738%, reversing the historical-8.815%. Product CPU seconds5.13/5.64/5.73 and VM-window steal6.157/14.420/5.799% are retained. Selected delays are configured proxy sleeps, not measured wire RTT; no adjusted rate is treated as a gate. This demonstrates unequal realized network inputs within the same nominal150±30 profile. Fixed150ms controls and full repetitions are still needed for causal attribution.
Measurement continuation retains these initial rows, adds exact gated artifactfc9197b71ad97d329a0fe44d6f9676382f716cd35be12897e896c093ca3da902, and runs six default rounds (five complete rounds2–6 after the initial partial round), plus five fixed-jitter diagnostic rounds. Short cohort locks yield between cases after90s, rather than allowing another campaign between every source; each individual run still has its120s cap. All11 source/artifact variants are preserved; default WAN native pairs use reviewed/current-dev/exact-gated-head. No budget or native product change.
r3-initial-delay-receipts.tar.gz
r3-initial-delay-summary.json
Final fast at
d83b6300c: x86 release completed. It is static PIE with no PT_INTERP; production-trust and key-memory initialization checks pass. Size is exactly 22277392 bytes vs cap 22204304 (+73088), identical to the previously recorded rebased 0e05/dev1b23 size. The only Rust/Cargo diff from origin/dev is the cfg(test) locale-test hardening in crates/infraternal-shim/src/pty.rs; no native runtime or dependency change in this lane. No size waiver or cap adjustment is taken. ARM and the remaining final-gate summary are still running.Gate excerpt verbatim:
Blocked native-size row needs a passing dev baseline from the orchestrator/native-size lane; browser performance work and measurements continue independently. The VM lock is currently held by foreign PID2062385 (python3, elapsed21:57 at 01:19 UTC); queued Firefox, timeline, small-window and PSS runs have not yet measured. No foreign process was modified.
Final gate milestone at
fffc3260e8: complete scripts/verify fast retry exits1 ONLY for unchanged absolute static caps. All1056 Rust tests across109 groups pass;138 ignored. No source or timeout change between attempts. The initial restart failure remains attached. Three paired functional controls each of head GNU-debug and current-dev1b23ef311 static-release allPASS; these different-profile negative controls do not establish a new baseline failure. Historical devb182 r2-abrupt-dev-2.log already records the same iteration1/before-forward470784-byte partial-output stall (406006 received), preserved on the issue. No baseline exception used for the final test PASS.Exact gated x86 hashfc9197b71ad97d329a0fe44d6f9676382f716cd35be12897e896c093ca3da902; size22288976 B vs fresh current-dev22277392, delta+11584<=16384 B. ARM static19717400 B; ARM runtime not tested on x86. TypeScript/protocol and25 terminal tests/105assertions passed earlier on this same head. VM campaign remains pending the shared lock; current holder PID2062385 cwd/root/infraternal-bench/ppu-soak/r4seg, multiple queued contenders. Our controller stays queued with flock-w3600; no foreign process touched.
Verbatim final gate summary:
r3-final-fast.log.gz
r3-final-fast-retry.log.gz
r3-final-gate-receipt.json
r3-abrupt-first-failure.log
r3-abrupt-controls.json
R3 input provenance and perf queue blocker (head
fffc3260e8).Eleven first-round 150-ms throughput rows completed, each exactly 52,428,800 bytes. No five-run acceptance conclusion yet. Default 150 ±30 ms relay draws remain unchanged; fixed-delay measurements are separately diagnostic. The native-echo/further throughput cohorts are waiting for the shared perf lock. At 2026-10-15 01:52:36 UTC the holder was PID2078737, python3, cwd /root/infraternal-bench/p4; process age2529 seconds (not a claim of lock-hold duration). 22 waiters observed. No foreign process stopped. Need that owning measurement to release its lock; our controller waits with flock -w3600 and retains every completed row. Native source controls are private artifacts, not product changes.
Reproducible new inputs (each archive includes SHA receipts, build logs and single-variable patches; exact gated x64 and ARM artifacts included):
r3-artifacts-1.tar.gz
r3-artifacts-2.tar.gz
r3-artifacts-3.tar.gz
r3-artifacts-4.tar.gz
r3-artifacts-5.tar.gz
1: fresh-head/no-liveness. 2: old-tls/old-sections. 3: reviewed-expiry/fresh-dev. 4: fresh-reviewed/gate-head. 5: gate-arm64. Older reviewed/merge/dev binaries remain in the previously attached post-patch-perf-inputs.tar.gz. Fresh-source reviewed4b differs in binary layout/size from the retained reviewed binary despite identical source manifests/compiler IDs; both are included as provenance controls. No unproven source-cause claim.
R3 delta-review checkpoint — P2 fixed; P1 still HOLD, incomplete pending the shared perf VM. Head
fffc3260e8, pushed only flood-server-ship, clean worktree, no deploy.93c894fd4resets negotiated credit capability on validated host rebinding without releasing credit on the notice.fffc3260ecovers legacy and hint-capable replacement. Original reviewed production-handler regression fails before (144726-byte credit vs262144 repaint); after fix both pass, total25 terminal tests/105 assertions. No native product change in this R3 delta.scripts/verify iterate exit0:1056 Rust tests/109 groups,138 ignored; tracer check/build/protocol and transfer checks pass. Final scripts/verify fast retry exit1: all Rust tests pass; only inherited absolute static-size caps fail. x64 gated22288976 bytes vs pinned origin/dev1b23ef31122277392 bytes: +11584 <=16384-byte merge allowance. ARM19717400 bytes; no ARM runtime claim. First fast abrupt-stop timeout retained with historical matching unmodified b182 baseline evidence and current paired controls3+3 passing; final retry all tests pass, no waiver or timeout change. Final summary verbatim:
P1: no proven source cause, no acceptance claim, no new LAN/150/300 p99 claimed. Eleven first-round150-ms throughput controls each transferred exactly52428800 bytes, but required repetitions remain pending. Relay selection is instrumented unchanged in the default profile; fixed-delay runs are diagnostic only. Preserve default raw rates and every row. Binary/source/control provenance and actual gated artifact are attached in the preceding comment.
At 2026-10-15 02:00:32 UTC the lock holder remained PID2078737 python3 under /root/infraternal-bench/p4, process age3005s (not measured lock-hold duration). Our waiter PID2095614 is the child of our controller2074065; no foreign process touched. Owning measurement must release the lock before progress. Controller uses flock -w3600. The campaign remains queued, not cancelled.
Resume state: own VM directory /root/infraternal-bench/flood-server-ship/r4; campaign.py resumes completed SHA-validated rows, never overwrites them. Current SSH command runs
python3 campaign.py && FSS_FIXED_JITTER=1 python3 campaign.py; do NOT start a second controller while2074065 exists. Default completion marker campaign-complete.json; diagnostic fixed-complete.json. Six default rounds include five complete interleaved rounds2–6 for11 variants; five fixed-delay rounds. If lock wait expires, preserve the console and restart that exact command after confirming old controller ended. Local console: ~/.cache/codex-scratch/flood-server-ship/evidence/r3-cohort-campaign-console.log. Local analysis: r3/analyze.py consumes results/fixed-results. All temporary builds retained for the unfinished native investigation; no evidence in repo. Once measurements finish, inspect every row, attach full receipts, prove cause or retain HOLD, then clean owned scratch. No size cap/budget changed.Partial raw receipts, controller/harness and author checklist:
r3-partial-perf-receipts.tar.gz
r3-reviewer-checklist.txt
R4 resumed flood-server-ship, clean head
fffc3260e8; original baseb182529fcc. Read #197 and parent #55 histories; retained P2 fix and all native controls. Old campaign controller has ended; only 11 first-round throughput rows exist. Resuming SHA-validated measurements with throughput first (6 rotating rounds, including 5 new rounds), then separate fixed-delay diagnostics and native LAN/150/300 echo. Same harness and exact gated-head artifact. Each lock segment capped at 25 minutes, owner file written on acquisition; release between segments. Current owner file still names process-per-user ppu-soak-r4-own, 2026-10-15T01:37:09.334197+00:00; waiting with flock -w3600. No foreign process touched, no deploy or dev push. Final fast will run via build-slot after measurements.R4 final-gate milestone at unchanged
fffc3260e8: scripts/verify fast via build-slot exits1 only for inherited static-size caps. Every Rust functional/lint/security row PASS; no retry or baseline waiver. x64 22288976 B vs pinned dev1b23ef311 22277392 B: +11584 <=16384 B. Rebuilt exact x64 SHA256 fc9197b71ad97d329a0fe44d6f9676382f716cd35be12897e896c093ca3da902 matches queued VM gate-head artifact. ARM19717400 B; no ARM runtime claim. Standalone TypeScript stage/P2 regressions running because static failure stops the dispatcher. Perf controller still queued, no new throughput result. Verbatim final gate summary:r4-fast.log.gz
R4 standalone TypeScript gate exits0 on
fffc3260e(the full fast dispatcher stops at inherited size failures): tracer compiler/production build/transfer caps PASS, 191 frontend tests/11387 assertions; protocol 37 tests/34463 assertions, 134 stream cases/11439 schedules/zero divergences; selected production terminal/rebind/readiness tests 19/93. Rebuilt x64 hash unchanged. Worktree clean after removing generated Python cache; branch already pushed at this head. No new native/source change. P1 repeated VM campaign remains queued behind mesh-autoswitch scale-and-spacing (owner start02:11:28 UTC); no performance acceptance claim.r4-ts.log
R4 durable resume state: no source delta;
fffc3260eremains clean/pushed. VM controller2119891, waiter2119896, started02:03:38 UTC. Prior2074065 controller was gone before replacement. Owned command: python3 /root/infraternal-bench/flood-server-ship/r4/r4-driver.py; default throughput first, fixed-delay diagnostics second, native LAN/150/300 third. Each segment writes owner/start, caps its measurement work at20 minutes (+one <=120s case), and is externally capped25minutes; releases between stages/segments. Original campaign.py run/complete functions and hashed measurement harness remain unchanged; completed rows are SHA-checked and skipped. Default rounds2-6 form the five new complete interleaved cohorts, while round1 is retained and reported separately. Analyzer FSS_MIN_ROUND=2 selects those without overwriting raw receipts. Fixed five-round results remain diagnostic. Original artifacts/provenance remain attached in R3. Do not start another controller while2119891 exists. Local console evidence/r4-campaign-console.log; pending lock retries are automatic after3600s. At02:27 UTC active holder2156006 and owner file process-per-user ppu-soak-r5-delivery start02:25:50 UTC. No foreign process touched.R4 runner/analyzer archive (direct .py attachment was rejected422; archive succeeds):
r4-runner.tar.gz
R4 default 150±30 ms throughput matrix complete at unchanged
fffc3260e. Five new rotating same-session rounds2–6/source (55 transfers); retained earlier round1 reported separately. Every transfer52428800 bytes, cursor-contiguous, exit0, all metadata valid. Locked CPUWeight10000 segment02:28:04–02:36:12 UTC (8m09s), then release. VM 4vCPU x86_64; per-run load/stat/memory/selected relay delay in raw receipts.P1 raw gap persists: exact gated head vs retained reviewed -7.40196%; vs pinned current-dev1b23ef311 +0.97485%. No source attribution yet. Network input differs: selected delay140.863 vs152.102ms. Across55 raw runs rate vs inverse selected-delay Pearson r=0.9957503; this is diagnostic correlation, NOT an adjusted throughput gate or measured wire RTT. Fresh-head has identical native source but different artifact provenance:7.02168MB/s with139.065ms selection. The compatible old-TLS control also received140.883ms and cannot yet prove a TLS cause. Original Rust profile is unchanged; section and daemon/rebinding controls are isolated patches retained in R3 attachments. No budget/cap or native source change.
Fixed150ms zero-jitter diagnostic (five rotating rounds/all11 controls) now queued separately to equalize network input; original uniform-jitter profile above is preserved and remains FAIL under the raw no-loss assertion. Native echo follows. Need fixed controls before causal conclusion; no acceptance claim.
r4-default-receipts.tar.gz
r4-default-five-summary.json
r4-default-all-summary.json
R3 perf VM measurements (all completed runs; targets NOT met). Artifact:
d83b6300cproduction-code fixture r3-web-text5, JS SHA256 27becbd3ef8254c2c7a333e8303a0152840b067a7655b20fe8236fc77213505e. These predate the validated retina geometry fixes and are not final-head acceptance. Production canvas/VT/mux/codec with generated output, no native PTY. 100 trusted-key samples per phase, exact echo paint; all runs locked and CPUWeight=10000 on the authorized 4-vCPU/7.7-GiB perf VM. Chrome busy=CDP TaskDuration; Firefox=content-main-thread CPU ticks, workers excluded. 1 background offered1MB/s yes; 5/20 offered6MB/s cat per window. Actual throughput below is achieved per window, not offered load.Memory within +10% at all counts. Dev JS hash c7b7732b0413a59fdf3cd846bcba1005a05ae0a3f64815e678b88bff303daf90. Load dev [3.58, 1.65, 0.89]→[3.29, 1.62, 0.88]; head [2.26, 1.01, 1]→[2.04, 1.03, 1].
run-paint3-f1.json
run-paint3-c5.json
run-paint3-c20-other.json
run-paint3-f20-other.json
run-paint3-c20-park.json
run-paint3-layer-c20.json
run-paint3-memory-dev.json
run-paint3-memory-head.json
Earlier attached raw results: Firefox20, Chromium1, profile result, CPU profile, raw trace gzip.
Validated fixes awaiting their per-module commit gates:
r3-text8-dpr-1.log
r3-text8-dpr-1.25.log
r3-text8-dpr-1.5.log
r3-text8-dpr-2.log
r3-text8-dpr-3.log
r3-query-marker-fixed.log
R4 shared-resource wait update,02:57:42 UTC. About46 minutes cumulative lock waiting this run (24m26 before completed default stage; current fixed-delay waiter since02:36:12). Default required5x11 A/B is attached above; no byte/cursor failures. Remaining equal-delay cause test is blocked on shared VM lock. Owner file verbatim:
Kernel holder2169590 (Python); owner age~20m32. Need that owning measurement to release/resegment before fixed controls can run. Current controller2119891 remains queued with flock-w3600; automatic retry retains all valid rows. No foreign process or file modified. Continuing to wait as fairness rules require. ARM pinned-dev size control is compiling via build-slot; no shipping-source change.
Completed step: Share bounded canvas composition geometry across rendering contexts
407494c7a0(pushed). D268 and D175 require identical glyphs and grid coordinates on both owners. Transferred bitmaps with fractional CSS extents were resampled on retina displays. Share integral CSS/device extent calculation, with a bounded rational display-scale quantum; unusual scales retain the native main renderer instead of unbounded padding or incorrect pixels.Gate: cargo fmt; tracer TypeScript check; full terminal/worker/input-ready/clipboard unit corpus; git diff --check. All passed. (pass) a failed initial allocation disposes without retaining its context beside a live owner [40.88ms]; (pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [19.25ms]; (pass) a replacement constructor failure fatally retires its owners [0.25ms]; (pass) reset recovers a failed parser without retaining an old viewport slot [34.56ms]; (pass) failed-owner input waits for replayed modes and session switches cancel only old input [33.29ms]; (pass) clipboard constructor failure consumes a later deferred cancellation [1.64ms]; 59 pass; 0 fail; 2611 expect() calls
Completed step: Preserve scaled glyph bounds in the worker bitmap
df859a8e56(pushed). Before: selected dotted glyphs lost 24 channels at DPR2 and 72 at DPR3; fractional placeholder composition also changed 18053 channels. Pad the atlas by a CSS pixel, initialize the DPR transform explicitly, and expose logical renderer dimensions over a padded/clipped physical bitmap. D268 reuses the pinned renderer; changing its grid or tolerating glyph differences is rejected.Gate: cargo fmt; tracer TypeScript check; full terminal/worker/input-ready/clipboard unit corpus; git diff --check. All passed. (pass) a failed initial allocation disposes without retaining its context beside a live owner [94.71ms]; (pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [15.92ms]; (pass) a replacement constructor failure fatally retires its owners [0.48ms]; (pass) reset recovers a failed parser without retaining an old viewport slot [46.66ms]; (pass) failed-owner input waits for replayed modes and session switches cancel only old input [43.63ms]; (pass) clipboard constructor failure consumes a later deferred cancellation [6.72ms]; 59 pass; 0 fail; 2611 expect() calls
Completed step: Compose worker placeholders without scaling the terminal grid
7b53458420(pushed). Match the worker bitmap to integral CSS and backing extents while clipping its transparent tail to the original native viewport. Keep the original event canvas, selection coordinates and focused renderer. D268 rejects stretching a fractional placeholder because it changed text at focus; D188 keeps the adapter within the critical budget.Gate: cargo fmt; tracer TypeScript check; full terminal/worker/input-ready/clipboard unit corpus; git diff --check. All passed. (pass) a failed initial allocation disposes without retaining its context beside a live owner [31.53ms]; (pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [21.49ms]; (pass) a replacement constructor failure fatally retires its owners [0.35ms]; (pass) reset recovers a failed parser without retaining an old viewport slot [36.30ms]; (pass) failed-owner input waits for replayed modes and session switches cancel only old input [39.42ms]; (pass) clipboard constructor failure consumes a later deferred cancellation [3.23ms]; 59 pass; 0 fail; 2611 expect() calls
Completed step: Regress worker bitmap parity across display scales
5d9d6f8793(pushed). Compare the same logical viewport through both owners and record actual geometry. Validate bounded padding and fallback, and exercise DPR1/1.25/1.5/2/3 with real Unicode, selection, focus and held pictures. Correct the diagnostic parking description. Reject comparing padded element boxes instead of the pixels the user sees. D268 and D175 require exact glyphs.Gate: cargo fmt; tracer TypeScript check; full terminal/worker/input-ready/clipboard unit corpus; git diff --check; production browser regression. All passed. (pass) a failed initial allocation disposes without retaining its context beside a live owner [45.87ms]; (pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [21.54ms]; (pass) a replacement constructor failure fatally retires its owners [0.37ms]; (pass) reset recovers a failed parser without retaining an old viewport slot [42.89ms]; (pass) failed-owner input waits for replayed modes and session switches cancel only old input [36.86ms]; (pass) clipboard constructor failure consumes a later deferred cancellation [1.70ms]; 62 pass; 0 fail; 2747 expect() calls
Completed step: Verify fresh terminal replay across subsequent transport reconnects
c55b371313(pushed). The prior assertion rejected the latest attach at the correctly painted cursor after a reload had already restored from zero. A visible marker proved state was present in failing runs. Require a fresh document, a zero-origin attach, restored text and unchanged query-answer bytes; allow later valid cursor resumes. Reject weakening state checks or forbidding legitimate reconnects. D268 preserves replay and exact frontiers.Gate: cargo fmt; tracer TypeScript check; full terminal/worker/input-ready/clipboard unit corpus; git diff --check; production browser regression. All passed. (pass) a failed initial allocation disposes without retaining its context beside a live owner [32.22ms]; (pass) a rejected engine load produces a terminal failure rather than an unhandled worker error [15.60ms]; (pass) a replacement constructor failure fatally retires its owners [0.26ms]; (pass) reset recovers a failed parser without retaining an old viewport slot [41.83ms]; (pass) failed-owner input waits for replayed modes and session switches cancel only old input [41.16ms]; (pass) clipboard constructor failure consumes a later deferred cancellation [1.66ms]; 62 pass; 0 fail; 2747 expect() calls; 4 passed (50.2s)
Final implementation head
c55b371313is clean and pushed to flood-worker. Retina/replay fixes split into5atomic commits407494c7a,df859a8e5,7b5345842,5d9d6f879,c55b37131; each fmt/TypeScript/full terminal corpus gate passed, final replay4/4 and DPR3 native bitmap regression passed. Full scripts/verify fast now running via build-slot; no final success claim.D188 exact production before0e05→final
c55b37131(gzip/Brotli bytes): critical304096/253668→306032/255131; deferred47876/42486→47873/42524. Caps307200/256000critical,51200/45056deferred. Worker remains its own on-demand terminal-parser.on-demand.worker.js; both totals within caps (critical headroom1168gzip/869Brotli). No new dependencies or engine choice.Final fixture hashd67ca2ed8696db3fa6b64d15aaa331f33480b1418107a8312a2844b4cc923e85,114files; fresh1/5/20 Chromium/Firefox matrix queued on perf VM lock. Earlier timings are explicitly tied to d83 artifact, not relabeled.
r3-final-artifact-manifest.json
r3-retina-finish.log
R4 ARM size baseline complete via build-slot, pinned dev1b23ef311ce8f850ff01a60d06a420db33d26888. ARM dev19705112 B, SHA256 a70af61ed0dff489f8465bef6c21470c75c76ba30912b251d8041726aa47b7c9. Shipping ARM19717400 B (preserved gated artifact a4821cfcd9c5380e2bc958ae10f2a601a823265bcce038dea15bffafe69838bd): +12288 <=16384 B. x64 +11584 B already verified. Both deltas fit the brief; absolute cap failures remain inherited, no ratchet/waiver changed. Size-only cross build; no ARM runtime/performance claim. Archive includes baseline binary, recipe, build output and receipt. Shipping worktree unchanged.
r4-arm-size-control.tar.gz
Final branch-head gate,
c55b371313(pushed; clean). scripts/verify fast exit1, verbatim summary:The earlier abrupt-stop fixture now PASSES all24 stop variants in this full run. Current test failure is vt_credit::unaffordable_repaints_park_until_sufficient_credit, t1-gate-approximate-1, native fixture sequence assertion(356,367). A detached origin/dev1b23ef311 baseline control is now running through build-slot in the same host-load window; no load waiver claimed yet. Workspace test execution stops at this CLI integration test, so later crates are not represented as having run in this final invocation.
Static checks verbatim:
These match the recorded rebased0e05/dev native baseline exactly. Native diff against origin/dev is only the cfg(test)shim locale regression; no native runtime/Cargo/lock change. No cap or timeout is relaxed. Static linkage, production trust and x86 key-heap checks pass; ARM runtime key check explicitly not executed on x86. Size row remains an integration blocker.
Because the combined fast script stops before TypeScript when Rust fails, ran its unmodified ts_verify_fast stage separately on this exact head, exit0: compilers, precompression, D188 and protocol corpus37pass/34463assertions. Terminal corpus62pass/2747assertions and query/replay4/4 are in per-commit gates. Full fast is RED, not reported as passed.
fast-r3-final-2.log
r3-ts-final-2.log
r3-credit-head-stderr.log
r3-retina-commit-replay.log
Native test controls, no waiver:
Detached origin/dev1b23ef311 vt_credit control PASSED4case variants. Host load14.28/16.55/16.02→13.37/15.75/15.84. This does not reproduce final head failure(356,367), so #118 waiver is NOT applied. Running the full final-head fast gate again to check the unresolved failure and reach later workspace crates; every attempt remains recorded. No test/timeouts/source changed.
r3-credit-dev-control.log
r3-credit-dev-stderr.log
Earlier d83 fullfast failed abrupt-stop iteration22 before-forward (payload468224, received465912). Filtered head/default-feature and dev controls each passed24variants, and the final full-workspace-feature head run also passed it. These filtered controls are not represented as a full-gate waiver. The full first transcript and controls:
fast-r3-final.log
r3-agent-repeat.log
r3-agent-dev-control.log
R4 causal 150ms zero-jitter diagnostic complete: five rotating runs/all11 artifacts,55 exact52428800-byte transfers, no cursor errors, all valid/exit0. CPUWeight10000 lock03:09:15–03:17:34 UTC (8m20), then released. Every selected delay sum exactly150.000ms. This profile is explicitly diagnostic, separate from the unchanged default150±30ms result.
Conclusion: the large reviewed/head gap is caused by unequal network inputs in the default harness comparison, not demonstrated by any tested source interaction. Default five-run gated head6.437941 vs reviewed6.952566 MB/s (-7.40196%) received152.102 vs140.863ms selected delay; rate vs inverse selected delay across55 runs r=0.9957503. Holding the relay input equal removes that gap: gated head6.466809 vs reviewed6.400795 (+1.03135%). All four suspect reversions are slower than head in this controlled cohort. No source-cause fix or inherited dev commit can be responsibly named: no such loss is reproduced at equal input.
Controls: no-liveness restores reviewed daemon (inherited49fd1e262/cbbb580ff); old-tls reverts6f08be16 Cargo.lock patch; old-sections reverts722af2a32 VT section flags (Cargo release opt-level/panic/codegen settings already identical to reviewed); reviewed-expiry reverts integration probe clearing in the expiry branch. Single-variable patches and artifacts remain in R3 attachments. TLS repair remains intact. Native source after browser P2 remains6f08be16.
No budget changed and no adjusted rate substituted. The original default raw no-loss assertion still FAILS; the equal-input diagnostic passes it. Review must assess that causal evidence; no blanket shipping acceptance is claimed. Five native LAN/150/300 echo rounds/reference/current-dev/gated-head now queued. Final scripts/verify fast rerun via build-slot is queued/running after the completed P1 A/B. Worktree/head unchangedfffc3260e; no native fix warranted by these controls.
r4-fixed-receipts.tar.gz
r4-throughput-summary.json
Latest final-head fast attempt3 (unchanged
c55b37131) remains RED, exit1. The abrupt-stop fixture fails again at iteration22 before-forward, received120316/468224, input sent4193649/acked4193632, outputcursor3845901, proxy alive. This is outside the #118 waiver list; no waiver applied. A detached dev control with workspace feature selection is compiling; remaining workspace crates will run separately because the CLI test aborts the combined test stage. Native runtime remains identical to dev, only cfg(test)locale differs. Verbatim gate summary:fast-r3-final-3.log
Remaining d83 artifact cohort completed: Firefox5backgrounds, offered6MB/s/B cat, actual0.817394MB/s/B,100trusted keys. Idle p50/p99/max12.909/24.323/28.267ms→flood13.640/66.867/67.934ms (p99+42.544ms FAIL). Main busy34.94%; pan p99/max50.56/98.18ms vsidle33.44/49.48; drag33.62/34.02 vsidle33.38/50.60. Load1.99/1.70/1.37→2.33/1.81/1.41; page errors0. All six d83artifact1/5/20cases now recorded, no samples discarded.
run-paint3-f5.json

Final c55fixture six-case matrix still waiting on VM lock. In parallel, a scratch-only diagnostic composes c55worker painting with the prior unshipped socket-receive-worker prototype (no production file edits). Whole-envelope boundary test passes;10exact trusted echoes in each browser; Firefox driver emits internal WebSocket instrumentation assertions, so these are recorded as a limitation, not clean functional proof. A Chromium20diagnostic is queued to distinguish ingress from painting, not a production claim.
Perf VM run paint-final-c1: complete. Scope: Production canvas, terminal, mux and codec; generated output, no native PTY. Artifact SHA256 d67ca2ed8696db3fa6b64d15aaa331f33480b1418107a8312a2844b4cc923e85.
chromium, 1 background windows, same host routing, yes, offered 1MB/s/B; achieved 0.987722MB/s/B. Locked authorized4-vCPU perf VM, CPUWeight10000; load[5.48, 4.44, 2.84]→[4.07, 4.2, 2.8].
Trusted dispatch→exact echo paint, n=100/100. Idle p50/p99/max 29.429/33.220/33.362ms→flood 29.804/32.350/33.601ms; p50 growth+0.375ms, p99 growth-0.870ms. Main busy17.761%.
Pan idle16.700/16.800/16.800→flood16.700/16.800/16.800ms; drag idle16.700/16.800/16.800→flood16.700/16.800/16.800ms.
Empty ordered worker query round-trip p50/p99/max: idle0.100/0.600/0.600→flood0.100/0.800/0.800ms.
During typing: 1worker-painted BG windows, 0parked BG windows. Worker messages398, painted296, cell bytes298496, parser errors0, surface failures0.
Main receive/apply p50/p99/max 0.200/1.500/3.800ms; postMessage call 0.000/0.200/1.100ms.
Page errors []. Retirements count (includes startup) 1. All samples retained; acceptance is not inferred for other counts/browsers. Generated server output, no native PTY.
run-paint-final-c1.json

run-paint-final-c1.log
R4 final-fast rerun finding, unchangedfffc3260e: GNU-debug agent_daemon oracle fails iteration1/before-forward/payload470784, received293884, sent470844, acked470827 (missing17-byte fence); proxy alive, no held barrier, both pumps read. Preserve failure; no baseline exception claimed. The earlier same-head R4 checkpoint fast passed every Rust functional row. This rerun continues static builds before releasing its build slot.
One targeted existing-binary oracle against pinned-dev1b23ef311 static-release PASS24/24 positions,4710396 payload bytes. Different profile means this negative control does not explain the debug failure. Next after current heavy gate: build pinned dev GNU-debug using r4-arm-source under build-slot, run3 alternating matching-profile head/dev oracle pairs with identical seed20, then rerun head full fast; no fixture/timeout/source change. Prepared r3/r4-abrupt-controls.py (not started), preserved exact head GNU binary + SHA receipt outside checkout. Native P1 A/B already completed/attached; echo stage still queued.
Durable resume: root VM controller2119891 owns r4-driver.py, now queued for latency (five complete rounds/source at LAN/150/300,20 samples/phase,3sources). It retains completed throughput/fixed stages, never overwrites rows. Local console evidence/r4-campaign-console.log. Current owner process-per-user ppu-soak-r5lazy-soak start03:35:45 UTC; no foreign process touched. Current local final-fast log evidence/r4-final-fast.log; active heavy build only that gate. Updated runner archive below contains the five-echo-round plan and analyzer min-round filter applied only to default throughput (fixed/echo retain all five rounds).
r4-abrupt-head-failure.txt
r4-abrupt-dev-first.log
r4-current-runner.tar.gz
R4 first post-A/B full fast complete, exit1, unchanged
fffc3260e8. Formatting/clippy/dependency rows PASS. Tests FAIL only at the preserved agent_daemon before-forward470784-byte stall; workspace test command stops there, so later groups were not run in this attempt. Static sizes still22288976/19717400 B; only absolute caps fail, deltas vs pinned dev remain+11584/+12288 <=16384 B. x64 final hashfc9197b71ad97d329a0fe44d6f9676382f716cd35be12897e896c093ca3da902 exactly matches measured gate-head. Rebuilt ARM hash2bdbc7595bb14f86c42cc79c4006cb818b2722e6f9fb00d4ae390604d0110c5a differs from the prior preserved ARM artifact; byte size identical, no ARM runtime claim. Do not treat hashes as equivalent.Matching-profile restart controls queued via build-slot: r3/r4-abrupt-controls.py, console evidence/r4-abrupt-controls-console.log. It builds1b23 dev GNU-debug and runs3 alternating head/dev pairs without changing seed20/fixture/timeout. Source is r4-arm-source; exact head GNU saved evidence/r4-head-gnu with source/hash receipt. IMPORTANT shared-target safeguard: script removes target/debug/infraternal before materializing dev and after controls; next head gate must restore the head executable. If interrupted mid-control, explicitly remove only that generated CLI output before the head retry. Retain all passes/failures; dev release-only PASS is not a waiver. No second heavy job started while the gate held its slot. Need controls, then a complete head fast retry; no source changes planned absent evidence.
Verbatim first post-A/B gate summary:
r4-final-fast-first.log.gz
r4-control-recipes.tar.gz
r4-head-gnu.json
Measurement scope correction from raw traces: retain every sample, but do not certify reconnecting cohorts as steady continuous flooding acceptance. Trace input/paint frontiers identify exact100-key idle and flood intervals; retirements below occur within those intervals (not merely startup or later pan/drag).
R4 scratch cleanup: shared disk free fell106GB→37GB during the run. Removed only this job's inactive r3/target (2.7GB), returning~40GB free. All source/control artifacts and receipts remain under evidence and already attached. Active r3/gate-target (~20GB), preserved head GNU, r4-arm-source and GNU control recipe remain intact. r3/build-controls.py would need a rebuilt target if new static controls are required; existing11 artifacts are complete and preserved. No checkout/source/owner fixture/foreign target changed. Native echo and matching GNU-control jobs remain queued.
Native controls complete, no failures waived. Dev1b23ef311 workspace-feature abrupt-stop control passes24variants/4710396exactbytes. Head remaining-workspace attempt reaches server tests:422pass/1fail/46ignored. Failure auth::tests::socket_tests::review_liveness::review_mesh_watch_reports_liveness_expiry_without_another_edit, server closed websocket unexpectedly:None. Detached dev filtered control passes (468filtered); hostload19.89/24.08/22.02→23.77/24.92/22.95. It does not reproduce, so #118waiver is NOT applied. CLI abrupt-stop failure on latest fullfast also remains unwaived. No fourth unchanged-head fast retry, timeout change, or native runtime fix.
The separate remaining-workspace command also stops on the server failure: not represented as a full workspace pass. Earlier per-commit touched-shim gates and full iterate remain recorded, final fast stays RED. Static-size rows still exactbaseline+73088x86/+66368ARM. Native runtime and Cargo diff vsdev remains empty; only shim cfg(test)locale changes. These are integration blockers for orchestrator/native fixture/size follow-up, not concealed by frontend checks.
r3-agent-dev-workspace.log
r3-remaining-workspace.log
r3-native-controls.log
r3-auth-dev-control.log
R4 echo-stage wait exceeded45minutes: queued03:17:34 UTC, now04:03:47 UTC. Controller2119891 still waits with flock-w3600 (automatic requeue on timeout; no completed rows replaced). Kernel holder2169590. Owner file verbatim:
Current owner age28m02; need its measurement segment to release so native LAN/150/300 cohorts can run. No foreign process touched. P1 throughput A/B is already complete/attached; matching GNU-debug dev restart control is compiling via build-slot. First post-A/B full gate failure and both source-control recipes are attached above. Worktree/source remain unchangedfffc3260e. Continuing to wait under fairness rules.
Perf VM run paint-socket-c20: complete. Scope: Diagnostic only: committed
c55b37131worker painting plus an unshipped WebSocket receive-owner facade with whole-envelope FIFO batching; generated output, no native PTY. Artifact SHA256 e4277f1abf1091243caf43450a007d650671d0d2dc5a3702432535ca7c212456.chromium, 20 background windows, same host routing, cat, offered 6MB/s/B; achieved 1.034630MB/s/B. Locked authorized4-vCPU perf VM, CPUWeight10000; load[1.08, 0.62, 0.63]→[1.74, 0.81, 0.69].
Trusted dispatch→exact echo paint, n=100/100. Idle p50/p99/max 30.138/36.036/42.886ms→flood 31.019/455.553/495.009ms; p50 growth+0.881ms, p99 growth+419.517ms. Main busy37.314%.
Pan idle16.700/16.800/16.800→flood16.700/16.800/16.800ms; drag idle16.700/16.800/16.800→flood16.700/33.300/33.300ms.
Empty ordered worker query round-trip p50/p99/max: idle0.100/0.500/0.500→flood0.300/6.900/6.900ms.
During typing: 2worker-painted BG windows, 18parked BG windows. Worker messages1445, painted131, cell bytes4675024, parser errors0, surface failures0.
Main receive/apply p50/p99/max 0.000/1.300/5.900ms; postMessage call 0.000/1.000/6.000ms.
Exact idle/flood key-phase transport retirements0/4; final attached streams21 (requested21). Achieved rate denominator is requested backgrounds, not active streams. Reconnecting phases do not establish steady continuous acceptance; no samples removed.
Page errors []. Retirements count (includes startup) 8. All samples retained; acceptance is not inferred for other counts/browsers. Generated server output, no native PTY.
run-paint-socket-c20.json

run-paint-socket-c20.log
R4 echo finding: gated-head300ms round2 timed out waiting for BASELINE_READY in prepare_cat, BEFORE any phase/sample (raw metrics{} and phases[]). Binary remained alive; original20s socket budget unchanged. Not a latency sample and not a passing startup. Preserve raw traceback/meta/empty capture; source attribution unknown. Before/after VM load1.29/0.60/0.62→1.08/0.61/0.63; MemAvailable4.62→4.59GB.
Original controller2119891 exited2 and released its lock after~3m; no duplicate controller left. Replacement r4-driver resumes valid SHA-checked rows, explicitly retains/identifies this one inspected invalid row (asserts empty metrics/phases), completes remaining planned cases, then adds interleaved300ms round6 for all3 variants to obtain at least5 valid cohorts each. Every other budget-failing row remains valid/included (e.g. dev300 round2 same-session444.08ms). No measurement helper, byte budget, parser, seed or timeout changed. Final analysis will show all valid samples AND invalid count; no overwrite or silent retry. New local console evidence/r4-echo-resume-console.log. Replacement waits for shared lock; check existing r4-driver process before starting another. GNU-debug dev restart control still builds via the one local build slot. Native/source head unchangedfffc3260e; P1 throughput controls complete/attached.
r4-echo-startup-failure.tar.gz
Units correction to the preceding startup-timeout comment: raw MemAvailable is4,615,508→4,589,664KiB (about4.40→4.38GiB), not4.62→4.59GB. Raw attachment is unchanged. This was a label/conversion error in the comment; no memory/performance conclusion or gate changes.
Perf VM run paint-final-f1: complete. Scope: Production canvas, terminal, mux and codec; generated output, no native PTY. Artifact SHA256 d67ca2ed8696db3fa6b64d15aaa331f33480b1418107a8312a2844b4cc923e85.
firefox, 1 background windows, same host routing, yes, offered 1MB/s/B; achieved 0.967424MB/s/B. Locked authorized4-vCPU perf VM, CPUWeight10000; load[16.66, 4.03, 1.75]→[10.76, 3.79, 1.74].
Trusted dispatch→exact echo paint, n=100/100. Idle p50/p99/max 12.565/39.333/62.242ms→flood 12.340/29.233/36.215ms; p50 growth-0.225ms, p99 growth-10.100ms. Main busy33.095%.
Pan idle33.340/99.980/100.000→flood33.340/87.420/99.980ms; drag idle17.160/34.000/50.000→flood17.120/34.080/49.860ms.
Empty ordered worker query round-trip p50/p99/max: idle0.000/1.000/1.000→flood0.000/4.000/4.000ms.
During typing: 1worker-painted BG windows, 0parked BG windows. Worker messages301, painted200, cell bytes206064, parser errors0, surface failures0.
Main receive/apply p50/p99/max 0.000/2.000/5.000ms; postMessage call 0.000/1.000/5.000ms.
Exact idle/flood key-phase transport retirements0/0; final attached streams2 (requested2). Achieved rate denominator is requested backgrounds, not active streams. Reconnecting phases do not establish steady continuous acceptance; no samples removed.
Page errors []. Retirements count (includes startup) 5. All samples retained; acceptance is not inferred for other counts/browsers. Generated server output, no native PTY.
run-paint-final-f1.json

run-paint-final-f1.log
Scratch ingress-priority diagnostic proof (not production; branch still
c55b37131). First browser run failed: ready-time priority became stale after reattach. Virtual fixture now refreshes the actual client stream at its existing focus assertion, rather than assuming stream1 forever. Second browser run:10exacttrusted echoes in Chromium and10inFirefox; each proves current stream1=priority1. Real-worker unit16assertions pass: independentbulk blocked whilefocusedoutput advances, promotion includes old in-flightprefix before later bytes, each complete envelope retains decoder boundary. Firefox driver internal WebSocket instrumentation assertions remain visible in the transcript; not represented as a clean browser compatibility gate.Chromium20diagnostic queued on VM lock, recording actual priority ID and typing-time attached streams. This prototype is an attainability measurement, not a shipped transport choice: normal EOF draining, resource/teardown bounds and full auth/replay integration are not production-certified. Product source unchanged; no new library/engine/dependency selected. Repro source/builders and both failed/corrected functional transcripts:
r3-ingress-research-source.tar.gz
r3-priority-functional-first.log
r3-priority-functional-2.log
Validation queue status: final-head c55 Chromium1 andFirefox1 complete and attached; remaining5/20cases and the priority diagnostic still use flock -w3600, releasing between cohorts. Shared lock-holder metadata at04:40UTC: PID2169590 python3, elapsed2h14m51s, cwd/root/infraternal-bench/ppu-soak/r5lazy, session-c4743.scope. This identifies a separate job only; no foreign process or lock is changed, and no claim is made about its workload outside the lock. Our measurement scopes remain short. If a wait times out, that will be recorded as missing evidence rather than a passing case; further slot coordination belongs to orchestrator. Current acceptance remains HOLD with the recorded latency/reconnect/native-gate failures.
R4 restart root-cause finding (not a baseline waiver). Matching GNU-debug/seed20 controls: dev1b23 3/3PASS, headfffc1/3PASS,2/3FAIL. Live content-free diagnostic captured a stall: out4159757 vs shim retained head4193826,614404 unspent client bytes, no snapshots, marker absent; shim already holds every expected payload/fence byte. Control Ping/Pong still works. Missing34069 output bytes are retained, not lost PTY input.
Deterministic real-Unix-socket regression now fails head at the semantic assertion: Hello.head3, one Output(0,"abcdef"), Credit6 => prefix"abc", replay_complete3, then funded"def" never arrives without another command. Original fixture-parent setup failure was corrected before this semantic reproduction; it is not counted as bug evidence. Root: terminal_run retains the frame suffix after splitting at Hello.head, but enters select with no deadline because that suffix is already affordable. No command/timer can wake it. Source path also exists on pinned dev; git blame traces the split to
c4d42d6ec7(#160). An adapted test-only overlay on dev is running to confirm there too.Narrow correction next: immediately reconsider a retained raw suffix when no starvation deadline is needed. Keep frame order, explicit credit debit, socket budget, pending-frame bound and all frozen wire layouts. Rejecting extra client refunds/Pings, sleeps, timeout increases or larger socket buffers: they mask a progress defect and damage D268 flood isolation. Regression precedes the fix; no foundational choice. This is separate from the completed P1 throughput-input A/B.
Stopped only our queued, non-measuring old-candidate VM controller2319140/flock2319145 by verified PIDs, since validation must now target the corrected head. No foreign process touched. Preserve all pre-fix native rows/one startup timeout; no old row overwritten or counted toward the new head. After atomic correction/regression commits and touched-crate gates, rebuild exact head and run five interleaved reviewed/new-head native+throughput controls, then final fast. Updated head and raw receipts will follow.
r4-replay-stall-findings.tar.gz
r4-before-fix-native-receipts.tar.gz
Completed atomic production fix6648a243cc0ead15429d529222db56110a7cdb83, pushed only flood-server-ship. Five lines in terminal_run immediately reconsider an already-funded raw suffix after replay completion. No credit/window/socket/timer/wire change. Exact intermediate code-only tree gate via build-slot: fmtPASS; agent clippy --all-targets --features remote,mesh -DwarningsPASS; tests114passed/14ignored across3groups. Regression file was temporarily restored to base for this gate; no uncommitted test masked that commit tree.
Deterministic socket regression semantic FAIL before on both headfffc and pinned-dev1b23 (test-only overlay, API false-flag adapted); PASS after the five-line fix. Thus the progress defect is inherited from #160/c4d42d6ec7, despite the earlier3 dev GNU random-oracle passes. No baseline waiver used; fixing it under the abrupt-stop requirement. Test measures event/order/progress, not a host latency budget. Raw head/dev semantic failures and after result attached.
Regression restored in working tree and its exact-tree touched-crate gate is queued (evidence/r4-regression-gate.log), then separate test commit/push. Backup r3/r4-replay-regression.rs and patch below preserve it across interruption. After that, rebuild final head, real 24-stop oracle, new artifact native/throughput matrix and full fast. Old fffc throughput A/B remains valid for the requested suspect comparison; no old result will be relabelled as corrected head. Prepared r3/postfix-{driver,helpers}.py uses six declared rotating rounds/reviewed4b/dev1b/new-head, default150±30 and fixed150 diagnostic, nativeLAN/150/300, unchanged measurement scripts/budgets, <=25min lock segments; source/source-hash manifest comes with final artifacts. No VM controller running for old candidate now. No deploy.
r4-progress-regression-receipts.tar.gz
Author-review finding reproduced and fixed:725449acc380e31843be0a0e33f56a3cdbc6fce9 (pushed, clean). Old font completion can settle while a native write holds the FIFO, queue behind newer configB, then incorrectly announce ready/unavailable forB. Both successful and failed stale outcomes reproduced on c55:0pass/2fail. Added generation checks before queueing and when applying the outcome; do not serialize fonts behind input. New real-VT/thread regression controls only drawing resources, and proves ordered native text remainsx whileBloads, no stale notification, then currentB readiness. fmt, strict TypeScript, full terminal/worker/input/clipboard corpus64pass/2755assertions, diffcheck PASS.
r3-resource-race-before.log
r3-resource-race-after.log
Fresh production build, real-browser font/fallback/pixel checks and scripts/verify fast queued on this new head. Existing perf matrix remains explicitly c55/d67artifact; resource-race fix is not silently substituted into those measurements.
Perf VM run paint-final-c5: complete. Scope: Production canvas, terminal, mux and codec; generated output, no native PTY. Artifact SHA256 d67ca2ed8696db3fa6b64d15aaa331f33480b1418107a8312a2844b4cc923e85.
chromium, 5 background windows, same host routing, cat, offered 6MB/s/B; achieved 3.594332MB/s/B. Locked authorized4-vCPU perf VM, CPUWeight10000; load[0.03, 0.12, 0.5]→[3.39, 0.92, 0.76].
Trusted dispatch→exact echo paint, n=100/100. Idle p50/p99/max 28.551/47.565/122.030ms→flood 32.801/195.458/227.135ms; p50 growth+4.250ms, p99 growth+147.893ms. Main busy57.877%.
Pan idle16.700/33.400/33.400→flood16.700/33.400/33.400ms; drag idle16.700/16.800/16.800→flood16.700/33.300/33.400ms.
Empty ordered worker query round-trip p50/p99/max: idle0.100/0.700/0.700→flood0.200/4.900/4.900ms.
During typing: 2worker-painted BG windows, 3parked BG windows. Worker messages737, painted264, cell bytes9299168, parser errors0, surface failures0.
Main receive/apply p50/p99/max 0.100/4.800/8.600ms; postMessage call 0.000/0.800/7.800ms.
Exact idle/flood key-phase transport retirements2/8; final attached streams3 (requested6). Achieved rate denominator is requested backgrounds, not active streams. Reconnecting phases do not establish steady continuous acceptance; no samples removed.
Page errors []. Retirements count (includes startup) 19. All samples retained; acceptance is not inferred for other counts/browsers. Generated server output, no native PTY.
run-paint-final-c5.json

run-paint-final-c5.log
Perf VM run paint-priority-c20: complete. Scope: Diagnostic only: committed
c55b37131worker painting plus an unshipped WebSocket receive-owner facade with independently bounded focused/bulk lanes and whole-envelope per-stream FIFO; generated output, no native PTY. Artifact SHA256 8e3d1ef2449cea5e92cb433c4ef73c7b4bc39878b7118e4ac4fcc7f493eeeaa4.chromium, 20 background windows, same host routing, cat, offered 6MB/s/B; achieved 0.967259MB/s/B. Locked authorized4-vCPU perf VM, CPUWeight10000; load[12.29, 3.82, 1.76]→[9.15, 3.95, 1.88].
Trusted dispatch→exact echo paint, n=100/100. Idle p50/p99/max 29.577/32.557/42.960ms→flood 30.419/214.994/218.786ms; p50 growth+0.842ms, p99 growth+182.437ms. Main busy45.840%.
Pan idle16.700/16.800/16.800→flood16.700/33.400/33.400ms; drag idle16.700/16.800/16.800→flood16.700/33.300/33.400ms.
Empty ordered worker query round-trip p50/p99/max: idle0.100/0.500/0.500→flood0.200/1.600/1.600ms.
During typing: 2worker-painted BG windows, 18parked BG windows. Worker messages1782, painted165, cell bytes5857136, parser errors0, surface failures0.
Main receive/apply p50/p99/max 0.000/1.900/12.500ms; postMessage call 0.000/1.700/6.100ms.
Exact idle/flood key-phase transport retirements0/9; final attached streams21 (requested21). Achieved rate denominator is requested backgrounds, not active streams. Reconnecting phases do not establish steady continuous acceptance; no samples removed.
Diagnostic priority stream proof: {"stream": 7, "priority": 7}
Page errors []. Retirements count (includes startup) 14. All samples retained; acceptance is not inferred for other counts/browsers. Generated server output, no native PTY.
run-paint-priority-c20.json

run-paint-priority-c20.log
Completed separate regression commitf3f2d841ea2c8b31594c09c3434f6dfabeab991b, pushed flood-server-ship after code6648a243c. Exact test-commit tree gate via build-slot: fmtPASS; strict agent clippy --all-targets --features remote,meshPASS;115testsPASS/14ignored/3groups. Deterministic frozen-codec Unix-socket test covers prefix→replay_complete→funded suffix without more input/credit. No protocol/budget changes. Working tree clean.
Full corrected-head verification now queued as one sequential build-slot command: r3/r4-corrected-gates.py. It first builds release x64 using the shipping recipe and publishes evidence/r4-corrected-x64-ready.json + immutable artifact only if delta<=16384; then scripts/verify iterate and scripts/verify fast, logging separately. Ready artifact will be measured while the remaining gates run; final gate must confirm identical x64 hash. Console evidence/r4-corrected-gates-console.log; status evidence/r4-corrected-gate-status.json. Corrected new-head performance will use fresh VM r4f directory, unchanged scripts/hashes, six declared rotating rounds/source for reviewed4b/dev1b/currenthead at nativeLAN/150/300, default150 throughput and separately fixed150 diagnostic. All valid budget failures/invalid preparations retained, min5 valid/source; <=25min lock segments. Do not relabel old fffc measurements as currenthead. Old VM controller was stopped while queued; no controller running there for this new artifact yet. No deployment.
r4-regression-gate.log
Corrected shipping artifact ready at
f3f2d841ea: x86_64 musl 22,288,976 bytes, SHA256 5c7ce9d82e90bb667cb6f4db92b2a3e4b53be1249222a75ec96afbd39dc45421; +11,584 bytes vs pinned dev (unchanged size delta). iterate then fast are running sequentially through build-slot.Fresh perf campaign queued at 05:22 UTC under /root/infraternal-bench/flood-server-ship/r4f: six rotating rounds of reviewed/dev/corrected head, original-jitter and fixed-delay diagnostic throughput at 150 ms, plus original native echo at LAN/150/300. Same harness, exact artifact hashes; all invalid preparations and valid budget failures retained. Lock segments limited to 20 minutes plus one bounded case, releasing/requeueing between segments. Owner currently mesh-autoswitch.
Corrected artifact and reproduction recipes.
Scope correction: my r3follow-up called HOSTS=other diagnostics two connections. That was incorrect. HOSTS=other only registers another admitted host ID; createLiveSessions acquires from the same global ConnectionPool without a host argument (apps/tracer/src/canvas/sessions/live.ts:200,320). At21windows this fixture shares the gateway pool/socket, not isolated TCP perhost. Both rawother-host cohorts have unique shared streamIDs1..41; they do not establish separate-connection isolation. Their latency/CPU/recovery numbers remain recorded as logical different-host routing tests, not evidence ruling out shared transport ordering. The scratch socket composition measured this round also keeps the normal shared pool; the older r2prototype that explicitly split connections is a different experiment. No transport foundation is selected.
At
f3f2d841e, build-slot scripts/verify iterate exits 0. Real-binary exact replay across 24 abrupt stops and saturated terminal queues both pass; no baseline waiver or retry. Full fast has started automatically in the same slot.Verbatim final iterate line:
Complete iterate output. Perf campaign remains queued (0 cases); no provisional performance claim for corrected artifact.
Final-head validation checkpoint,
725449acc3(pushed, no deploy). HOLD / NOT ACCEPTED.Final production and fixture artifacts attached, including exact hashes. Latest fixture aggregate JS SHA256 94219aa87dee78d2e89393a9638a7b96eadb96b6ffb6ae1099a7ed77de41b2f1; DPR2 functional proof in both browsers only. Do not relabel pending c55 performance cohorts as this head. Both browsers have all five bitmap comparisons at zero changed channels, delayed-font input before HTTP release, and missing-font fallback preserving the parser. Screenshots attached for independent review; no author visual-quality judgment.
D188 gzip/Brotli before0e05→725: critical304096/253668→306029/255094; deferred47876/42486→47871/42466. Worker entry on demand2277/2046→4590/4116; largest on-demand chunk15950/14177→15961/14182, within each cap. Terminal corpus64pass2755assertions; separate unmodified frontend stage passes37protocol tests34463assertions plus build/budgets.
Full scripts/verify fast is RED. First attempt stopped at RTT preflight; detacheddev preflight passed. The retry reached Rust and failed vt_credit t1-gate-approximate-1; detacheddev credit control still waiting for build-slot. No waiver applied. Abrupt-stop24 passes in this run. Static sizes x8622277392/22204304cap (+73088), ARM19705112/19638744cap (+66368), same prior baseline overruns; ceilings unchanged. Only Rust diff vsdev is cfg(test) shim locale code, no native runtime/Cargo changes.
Verbatim final full-fast retry summary:
fast-r3-resource-head.log
fast-r3-resource-head-2.log
r3-preflight-dev.log
r3-preflight-controls.log
r3-ts-resource-head.log
r3-resource-final-validation.log
r3-resource-artifact-manifest.json


r3-resource-artifact.tar.gz
Additional causal control prepared (not yet queued separately): six interleaved 150 +/-30 ms RTT throughput rounds of reviewed / pinned dev /
fffc3260e/ correctedf3f2d841e. The observer seeds each original relay generator with 197000 + 100*round + direction; original jitter sampling and exact 50 MiB transfer are unchanged. Each per-direction delay selection is recorded. This checks paired nonzero jitter rather than relying only on zero-jitter diagnosis. It will run after the corrected artifact campaign, with one lock waiter per job and the same bounded segments. Both original unseeded and fixed-delay failures/results remain unchanged.Final-head full gate at
f3f2d841ea: build-slot scripts/verify fast exits 1 only for unchanged absolute static caps. All 1,057 Rust tests in 109 groups pass (138 ignored), including 24 abrupt stops and the funded-suffix regression. iterate passed previously. No retry or baseline waiver.Final stripped static bytes: x86 22,288,976 vs pinned dev 22,277,392 (+11,584); ARM 19,717,400 vs dev 19,705,112 (+12,288). Both branch deltas <=16,384. Absolute caps remain 22,204,304 / 19,638,744; no cap edits. x86 final SHA 5c7ce9d82e90bb667cb6f4db92b2a3e4b53be1249222a75ec96afbd39dc45421 matches the immutable queued perf artifact. ARM SHA b97ff6af01f2d29a30ecf3a4d6a4bd157b62769833b63ae1cdd0ef9226b80734.
Verbatim gate summary:
Complete fast output, final artifact receipt, ARM artifact. Separate final-head frontend/terminal checks running because fast stops before TypeScript on the size failure; corrected perf campaign still queued.
Final-head functional completion at
f3f2d841e: separate ts_verify_fast exits0 (191 frontend tests/11,387 assertions; 37 protocol tests/34,463 assertions; 134 differential streams/11,439 schedules/zero divergences). Focused terminal/credit tests exit0: 19 tests/93 assertions, including retained-stream legacy rebinding. Extra unchanged real-PTY oracle exits0: all24 stops, all four stop positions x6, 4,710,396 exact bytes. Including iterate and fast, corrected head passes three full 24-stop runs; old GNU head failed2/3 in the recorded alternating control campaign. No pass substituted for old failures.Self-review completed for this delta (contracts/order/credit/resources/history); reviewed ancestor4b681d8e present,
e12f7030anda3102bc3absent, no evidence paths in branch diff, diff-check clean. No changes to dev or deployment.Raw functional logs, status and checklist. Corrected perf evidence remains queued; next update at acquisition or the45-minute wait threshold.
Build-host disk pressure: free space fell to28 GiB after all gates completed. Preserved corrected GNU binary (SHA3857b47d7eefa2f28babb3ffddd102d47ea5f8a880f5396a723646fd32df6409), both static artifacts and every gate receipt; removed only this job completed r3/gate-target/debug (23 GiB). Free space now50 GiB. Static caches remain until perf validation finishes. No active build/test process interrupted.
Final725 credit control finished under build-slot on detacheddev1b23ef311ce8f850ff01a60d06a420db33d26888. Same workspace-feature test selection, compiled dependencies reused, no primary Rust test concurrent. Dev vt_credit passes1/1 at load9.92/12.59/12.18→22.20/16.87/13.84. The head full-fast test failed; this control does not reproduce it, so #118 does not waive it. Final full-fast stays RED (test101, static1); no ceilings or timeouts relaxed.
Verbatim dev result:
r3-resource-credit-dev.log
r3-resource-credit-dev.stderr.log
r3-resource-credit-head.stderr.log
Handoff for break-it review: HOLD / NOT ACCEPTED. Branch flood-worker, pushed head725449acc380e31843be0a0e33f56a3cdbc6fce9; origin/dev1b23ef311ce8f850ff01a60d06a420db33d26888 ancestor. No deploy. The implementation is reviewable; the latency acceptance and full gate are not green.
R3 implemented: background OffscreenCanvas painting using the pinned shared renderer and bounded worker-wide glyph atlas; retained last pictures through focus ownership changes; coalesced background pictures30Hz while preserving ordered parsing/state and focused display-rate rendering. Fixed retina geometry and stale queued font-resource completion with failing-before regressions. Locale dev failure was not reproduced (50filtered +3full passes); test now retries only an empty child-environment publication read, never a nonempty wrong locale.
Functional: terminal64pass2755assertions, separate unmodified frontend gate passes (protocol37tests34463assertions, compiler/build/D188). Both browsers DPR1/1.25/1.5/2/3 all five bitmap comparisons zero changed channels at c55; latest725 repeatsDPR2. Native selection/history, Unicode, sixfocusreturns, frozen/resumed output, delayed-font input and missing-font fallback pass. Strengthened query/replay12/12. Screenshots attached for independent judgment.
D188 before0e05→725, gzip/Brotli bytes: critical304096/253668→306029/255094; deferred47876/42486→47871/42466; on-demand worker entry2277/2046→4590/4116. Largest on-demand chunk15950/14177→15961/14182. All within their caps; no new dependency/foundation. Latest725 fixture SHA25694219aa87dee78d2e89393a9638a7b96eadb96b6ffb6ae1099a7ed77de41b2f1 is functional-tested, not perf-measured.
Completed core r3 matrix (d83 artifact27becbd3ef8254c2c7a333e8303a0152840b067a7655b20fe8236fc77213505e), exact raw nearest-rank deltas. Some earlier comments subtracted rounded endpoints (differences≤0.001ms); index uses raw values:
Targets remain unmet. These generated-output fixtures use production canvas/VT/mux/codec, no native PTY. At20 only2BGcanvases visible,18parked. High-load phases often reconnect; exact phase counts and final attached count are in raw comments/index. They do not establish continuous20-stream acceptance. Logical other-host labels still share the global gateway/socket, not separate TCP. Pre-callback delays are not actual wire-arrival timestamps or a proven browser-internal root cause. No samples removed.
Fresh c55 artifactd67ca2ed8696db3fa6b64d15aaa331f33480b1418107a8312a2844b4cc923e85 completed C1(-0.870ms p99/17.761%busy),F1(-10.100ms/33.095%),C5(+147.893ms/57.877%). C1idle1retirement;F1keyphases0/0;C5idle2/flood8. Remaining fresh rechecks are not certificates. Scratch-only plain and priority socket-owner experiments failed C20(+419.517ms/37.314%,+182.437ms/45.840%); neither integrated or chosen as a transport foundation.
Chromium PSS1/10/50 KiB dev→d83: cold209921/282983/507954→221366/278434/486754; seeded238948/513307/1293332→254756/512095/1181778. All growthwithin10%; actual1119historyrows/window, not full10000cap. Exact-artifact scope applies.
Final725 scripts/verify fast RED, retry after initial RTT-preflight failure. Abrupt-stop24 passes in latest run. vt_credit fails t1-gate-approximate-1; detacheddev1b23 control passes1/1 (load9.92/12.59/12.18→22.20/16.87/13.84), so #118 does not waive it. Static x8622277392 vs22204304cap (+73088), ARM19705112 vs19638744cap (+66368); same prior native baseline overruns. Only native source diff vsdev is cfg(test) shim locale check, no runtime/Cargo changes. Caps/timeouts unchanged.
Verbatim final full-fast output summary (full raw transcript linked):
Measurement blocker / cleanup: Fresh c55 F5 flock-w3600 expired at06:01UTC before browser launch (exit1, no timing result). Holder PID2169590 remained locked for3h35m; it was not touched. Fresh C20/F20 were not started. The orchestrator needs a free perf window for exact725 rechecks and continuous-stream acceptance. No acceptance claim on this head. Own paused matrix shell/client stopped after expiry, no measurement interrupted. Local temporary dev checkout,32GiB native target and expanded local/VM browser artifacts removed; no local job-port or VM4439 listener. Evidence/artifact archives retained and attached. Author checklist completed; independent visual/concurrency review still required. Stop here for break-it review, not integration.
Evidence and full gate transcript:
r3-author-review.txt
r3-measurement-index.json
r3-final-matrix-blocked.log
fast-r3-resource-head.log
fast-r3-resource-head-2.log
r3-preflight-dev.log
r3-preflight-controls.log
r3-ts-resource-head.log
r3-resource-final-validation.log
r3-resource-credit-dev.log
r3-resource-credit-dev.stderr.log
r3-resource-credit-head.stderr.log
r3-resource-artifact-manifest.json


r3-resource-artifact.tar.gz
r3-ingress-research-final-source.tar.gz
Perf VM fairness wait receipt: corrected-head campaign queued since 05:22:35 UTC; still waiting after45 minutes at 2026-10-15T06:07:57.559378+00:00. Owner file verbatim:
Keeping the same waiter active (flock -w3600 with retry), not abandoning the run. All corrected functional gates and per-target <=16 KiB size deltas are already recorded above. No corrected performance samples yet.
Corrected artifact perf campaign acquired lock at06:14:57.698501 UTC after52m22s waiting. Owner flood-server-ship replay-fix; bounded20-minute segment (+one <=120s case), hard25-minute outer timeout. First reviewed/dev/f3f2d841e original-jitter throughput150 transfers complete with exact50MiB checks. Continuing the declared six rotating rounds including fixed150 diagnostic and native echo LAN/150/300; no provisional aggregate acceptance claim.
Corrected native campaign: all six declared rounds/source/profile completed; zero invalid preparations, 36 exact50MiB transfers and54 native cases (120 samples/metric/source/RTT). Owner start06:14:57UTC; completion receipt mtime 2026-10-15T06:30:07+00:00; released within20minutes. Exact measured head
f3f2d841e/ SHA5c7ce9d82e90bb667cb6f4db92b2a3e4b53be1249222a75ec96afbd39dc45421. VM4vCPU/7GiB; load1 snapshots range 0.46..2.58.Corrected pooled same-session growth:13.87 /3.67 /4.65ms, each below16.67ms; all six pooled latency metrics pass at each RTT. The historical4.5ms LAN value is not reproduced by reviewed either (16.26ms now); no claim of LAN recovery to4.5ms. All per-run failures retained: corrected LAN1/6,150ms2/6,300ms0/6; reviewed0/6,1/6,0/6; dev0/6,5/6,6/6. Pooled passes do not erase those failures.
Throughput, n6 each:
Original-jitter selected delay means reviewed145.069 /head155.684ms; original no-loss acceptance therefore still fails(-6.13%). Fixed150ms diagnostic has head+0.519%, head vs dev-0.062%; it does not replace raw acceptance. Mean steal in throughput cohorts reviewed/head: unseeded5.715%/6.096%; fixed5.778%/5.339%. Paired nonzero-jitter check queued at06:30:31UTC as the sole remaining perf waiter.
All raw VM receipts, unchanged measurement scripts, driver and manifest, full computed summary.
Paired-jitter control remains queued since06:30:31UTC. At06:48:13 and06:48:51 the perf-bench.owner file was absent. At06:49UTC /proc/locks confirms perf-bench.lock held by PID2529395, with our waiter2548483 active; no lock/process changes made. Continuing to wait. Completed corrected campaign and full gates remain attached above.
Remaining paired control recipe/state: VM /root/infraternal-bench/flood-server-ship/r4p, parent pythonPID2548478, sole flock waiter2548483, queued06:30:31UTC. Reproduction command: python3 /root/infraternal-bench/flood-server-ship/r4p/paired-driver.py (check existing process and paired-complete.json first; do not duplicate). Driver retains every result, six rounds x four sources x exact50MiB at150+/-30ms, seeds197000+100*round+direction. Sources reviewed4b681d8e / dev1b23ef311 / pre-fix
fffc3260e/ correctedf3f2d841e; hashes in manifest. Results land in results/, completion paired-complete.json, invalid data stays visible. Maximum20-minute segment plus one bounded case, hard25-minute timeout, owner file maintained.Paired manifest and scripts. Original throughput/relay scripts are unchanged from the already attached corrected campaign; the observer only supplies matched generator seeds before relay threads start. Still waiting; no source changes or extra build work pending.
Seed-only control completed24 exact50MiB transfers (six/source), no invalids; lock07:08:10UTC to completion before07:12UTC.
Finding: identical generator seeds are insufficient to pair realized transfer delays because setup consumes a source/timing-dependent number of burst draws. E.g. round1 reviewed/gated head157.606ms, dev136.862ms, corrected173.780ms. Therefore the +0.383% corrected result is retained but is not claimed as a perfectly matched-input test.
One stronger control queued under /root/infraternal-bench/flood-server-ship/r4q: after READY, wait0.3s (existing200ms quiet threshold +100ms, outside the original transfer timer), then seed each generator before the transfer burst. No relay sampling-rule, harness transfer, data, release binary, or budget changes. Six rotating rounds/four sources; verify actual selected delays match in receipts. phase-driver.py maintains the same20-minute/hard25-minute lock bounds and owner file. Previous campaigns remain untouched.
All seed-only raw receipts, computed summary, transfer-phase control manifest and recipe. Phase control queued07:14:50UTC, sole remaining waiter. All build/functional gates already complete at unchanged
f3f2d841e.Transfer-boundary control acquired lock07:32:51.224555UTC after18-minute wait. VM r4q, four immutable artifacts unchanged; six rotating rounds, nominal150+/-30ms profile, original timed transfer code untouched. Post-READY quiet/seeding is before the original timer. First reviewed exact50MiB transfer passes. Receipt audit will require the actual post-boundary draws to match expected per-direction values, not merely equal seed labels; all rounds retained.
Transfer-boundary seed control completed24 exact50MiB transfers, no invalids. Strict no-loss means pass for every source: reviewed6.188253 /dev6.241866 /fffc3260e6.267253 /f3f2d841e6.241854 MB/s; corrected+0.8662% vs reviewed.
The stronger receipt audit exits1: all24 transfers start with matching first per-direction draws, but later quiet gaps can resample jitter at different points. Example round6 client direction resamples88.617->76.480ms in reviewed/dev/fffc, while corrected holds88.617ms. Therefore exact full-transfer input matching is FALSE; not claiming this cohort proves equal realized input. Raw logs and audit failure retained.
Final causal control queued under VM r4z (clamp-driver.py): six paired RTT realizations drawn from the original150+/-30ms distribution, one half-delay/direction held constant throughout each transfer. This intentionally disables within-transfer resampling in the diagnostic fixture, explicitly separate from original unseeded/burst-resampled acceptance; original byte-checking transfer/timer, binaries and budgets remain unchanged. Same four sources, six rotating rounds, all cases retained, mandatory exact actual-draw audit. Owner file and20-minute/hard25-minute bounds unchanged. No product source edits since
f3f2d841e.Transfer-boundary raw receipts, strict trace audit failure, fixed-realization control recipe. Final control queued07:39:25UTC, sole waiter.
Final equal-realization causal control at unchanged
f3f2d841ea: audit exits0. All24 exact50MiB transfers pass; six/source, all actual per-direction draws match within each round. Chosen RTT sums161.469 /147.789 /140.451 /160.035 /160.695 /168.342ms. One sampled half-delay/direction is held for the timed transfer; this is an explicit fixed-realization diagnostic, not original burst-resampled acceptance. No rate normalization or budget tolerance. Lock07:43:36..07:47:42UTC, released; no own benchmark processes remain. VM4vCPU/7GiB, load1 range2.08..8.32.Current head is above reviewed under exactly matched link input; dev also shows no controlled throughput loss. Oldfffc residual-2.689% is retained, with higher mean steal18.253% vs15.656% reviewed; not attributing that entire residual to the five-line fix. This control supports the earlier equal150ms results (five/source/all11 variants: old shipping+1.031%; six/source corrected+0.519%). No dev source commit is identified as causing a throughput loss.
Cause established for the reproduced large unpaired gaps: sustained relay jitter samples and their setup/burst-dependent draw consumption produce unequal actual network input between sources. Original current unpaired cohort remains FAIL(-6.134%, selected delay145.069ms reviewed vs155.684ms corrected); seed-only and boundary-seeded matching failures are retained. The old exact8.82% cohort did not capture selected delays, so its exact historical decomposition cannot be reconstructed; no claim otherwise. The corrected source now has passing controlled no-loss evidence, without changing the budget.
All final raw VM receipts, exact draw/byte/rate audit, audit code, gate recipes and completed checklist, additional preserved raw receipts. All old failures remain attached.
r4 finish — STOP for delta review. Head
f3f2d841eapushed and independently confirmed on flood-server-ship; worktree/diff-check clean. No dev/main push or deploy.Production correction6648a243c and regressionf3f2d841e fix the funded suffix parking after replay_complete. Failure-first socket test failed on old shipping and pinned dev; origin
c4d42d6ec7(#160). Old-head real-PTY oracle failed2/3; matching dev passed3/3, so no baseline-failure waiver was used. Corrected head passed three complete24-stop runs including both gates. P2 retained-stream rollback tests pass.P1: requested11-variant A/B completed at>=5/source; matched150ms controls and the final six exact link-realization rounds show no current-head loss (+1.0225% vs reviewed). No controlled dev loss or causal dev commit identified. Original unpaired current cohort still FAILS(-6.1338%) with unequal selected delays; exact historical8.82% decomposition remains unavailable. All failures/audits retained in preceding comments; no budget change.
Native pooled echo p99 LAN/150/300:17.54 /174.06 /325.92ms; all pooled echo/growth budgets pass. Reviewed in the same session:16.26 /161.13 /319.85ms. Historical4.5ms LAN not reproduced; individual aggregate failures remain explicit (current1/6 LAN,2/6 at150,0/6 at300).
Gates: iterate0; fast1 only inherited absolute static caps;1,057 Rust tests/109 groups pass,138 ignored. Separate final frontend/protocol and19 terminal-credit tests pass. x86delta+11,584bytes, ARM+12,288 vs pinned dev, both<=16KiB.
Verbatim final fast summary:
Full fast transcript, final gate/artifact receipt, functional logs, equal-input audit, recipes/checklist.
Self-review complete. All owned temporary source copies, extracted receipts and build targets removed; only evidence remains under the job scratch root. No job benchmark processes remain on the VM. Issue left open for delta review.
Delta review starts: branch review-flood-server-ship at
f3f2d841ea; delta baseline6f08be16a; dev merge base8e7467c07c. Prior review tests preserved at 038fc7044/e5581be7c/c070fd4bc. Scope is four changed files plus prior FSS-1/FSS-2. No implementation changes, push, deployment or perf VM access. Brief conflicts on perf VM; repeated explicit prohibitions take precedence, so retained receipts only for performance.Delta steps complete: review branch commits
0bff3211e(cherry-picked FSS-2 test),ef02b01d(original FSS-1 replay),ddb596a7(explicit current-cohort selection; original defaults retained). Original FSS-1 now passes; shipped legacy/hint cases pass (3 tests/11 assertions). Terminal credit/output suite 19 tests/86 assertions passes. FSS-2 current equal-realization receipts pass the preserved acceptance assertion (six/source, 86 assertions): independently recomputed reviewed5.882679, dev5.927601, head5.942827 MB/s. No implementation change or push. Full fast queued through required build-slot; four slots occupied. LAN receipt audit: medians head6.203/dev6.194ms, pooled p99 head17.541/dev13.774ms; head tail concentrated in round5 (max20.259ms). These six rounds alone do not establish a reproducible tail regression. Production9ab4329c absent from these cohorts; fresh A/B blocked by explicit no-perf-VM instruction.Receipt audit step complete at review commit
c4cbd147: independent equal-realization test passes194assertions over18 exact50MiB transfers (reviewed/dev/current, six each). Every post-reset per-direction delay draw is checked, plus artifact hashes and no-loss vs both baselines. All five original measurement scripts in both archives hash-identical to checkout. Original FSS-2 historical replay remains FAIL6.156591<6.751788MB/s; current unpaired remains FAIL6.272136<6.681994; controlled current PASS5.942827>=5.882679 and dev5.927601. Full gate acquired build-slot10:00:25CEST and is compiling. No new implementation finding.delta-paired-audit.log
delta-lan-audit.txt
delta-throughput-current.log
delta-throughput-unpaired.log
Independent full-gate checkpoint at review head
c4cbd147e(native implementation identical tof3f2d841e): formatting, VT fmt, CLI compile-out and strict workspace clippy PASS. Real daemon abrupt restart, saturated queues, vt_credit, and daemon::readiness_tests::replay_boundary_drains_a_funded_suffix_without_another_command PASS; agent unit group113pass/14ignored. Remaining workspace server tests are progressing without failures. No retry or baseline waiver. Cold full-gate compilation extends beyond the delta source-review timebox; gate remains running under build-slot. Standalone strict tracer compiler exits0. No implementation changes, push, deployment or perf-VM access.Independent fast test stage FAILED:423pass/2fail/46ignored in server group. (1) auth::tests::socket_tests::review_liveness::review_mesh_watch_reports_liveness_expiry_without_another_edit, review_liveness.rs:51 initial snapshot live Null!=true. Detached local dev8e7467c07 control queued per #118; not waived. (2) remote_runtime::tests::standby::control_queue::saturated_native_control_queue_does_not_hide_primary_terminal_output, remote_control_queue_tests.rs:216 live_connection.close_reason().is_none() assertion. This is NOT in #118 exception list; not waived. Both existing tests unchanged in reviewed four-file delta; no causal attribution yet. Native funded-suffix/restart/credit tests passed. Static phase still running. Review headc4cbd147e; implementationf3f2d841e. No implementation edits.
Exact first-gate server executable isolated replays BOTH PASS: saturated_native_control_queue_does_not_hide_primary_terminal_output1/1; review_mesh_watch_reports_liveness_expiry_without_another_edit1/1. Original full-server423pass/2fail remains recorded and unwaived. Full fast retry queued with RUST_TEST_THREADS=4 to reduce concurrent test contention; assertions/timeouts/implementation unchanged. Detached dev8e7467c07 watch control remains queued per #118. This is verification scheduling, not a new performance measurement or timeout waiver.
Historical LAN method check verified directly from archived raw receipts: artifact7994f8a9, one100-sample process/phase, same-session median2.850777/p99 4.480344/max4.545900ms. Latest campaign is six independent20-sample processes,120pooled/source/profile, and rebuilt reviewed/current artifacts. git diff4b681d8e..f3f2d841e for agent_fixture.py,latency_proxy.py,verify-latency.py,collect-latency.py is empty. Thus fixture source is unchanged but campaign configuration and artifact differ; cannot attribute the full historical increase solely to methodology or source. Fresh equal-method LAN/prod9ab4329c A/B remains unperformed under explicit perf-VM prohibition. No confirmed new P1 from the available six-round LAN tails.
delta-lan-audit.txt
delta-historical-native-0.log
delta-historical-native-0.json
delta-server-failure-excerpt.txt
delta-head-control-isolated.log
delta-head-watch-isolated.log
Independent first full fast finished at implementationf3f2d841e/reviewc4cbd147e, exit1. Two server tests failed in full-suite concurrency; both exact-binary isolated replays pass, neither first failure is waived. Static sizes match prior6f reviewed image: x8622288976B, ARM19717400B (delta0each). Linkage/native key locking pass; both absolute caps fail. Dev watch control and unchanged-head four-thread full retry consolidated into one sequential official build-slot run; still queued after another job acquired the released slot. No source changes or speculative fixes.
Verbatim full-fast summary:
delta-fast.log.gz
delta-unpaired-delay-audit.txt
delta-artifact-identity.txt
delta-measured-shim-flight.log
Verification blocked on official build-slot availability, not source changes or permission. Required dev watch control has been waiting since10:30CEST; the consolidated sequential control/retry waiter is PID1166932 (do not duplicate), command~/.cache/codex-scratch/flood-server-ship-review/delta-follow-up.sh. Status appears in evidence/delta-follow-up-status.txt, logs delta-baseline-watch.log and delta-fast-retry.log. All four slots occupied by other jobs after this review completed first fast. Need available capacity through orchestrator build-slot; no foreign process/lock touched or gate bypass. Review headc4cbd147e, native sourcef3f2d841e. First fast full transcript/table already attached; two first-run server failures unwaived, both isolated passes recorded. Continuing to wait.
FSS-3 — P1 — independent functional-gate acceptance remains unresolved
Location: crates/infraternal-server/src/auth/socket_tests/review_liveness.rs:51 and crates/infraternal-server/src/remote_control_queue_tests.rs:216; scripts/verify fast test row. Scenario: unchanged implementationf3f2d841e under full workspace/default test concurrency. Server group423passed/2failed/46ignored. Initial mesh snapshot live is Null instead of true; saturated native control fixture observes primary connection closed. These are existing committed regressions (
ee5e319b81andd6a77a965brespectively), preserved intact on review branchc4cbd147e; no duplicate test or implementation change added.Tests: auth::tests::socket_tests::review_liveness::review_mesh_watch_reports_liveness_expiry_without_another_edit; remote_runtime::tests::standby::control_queue::saturated_native_control_queue_does_not_hide_primary_terminal_output. Both pass in exact-binary isolated replays (1/1 each). That does not clear the full-gate failure. The latter case is outside the #118 exception list. Required detached-dev watch control and full four-thread retry could not acquire a build slot; dev control waited from10:30 to11:31CEST. Only the unstarted owned waiter/sleep were stopped, no test interrupted and no foreign process/lock changed. No baseline waiver is claimed.
This is a P1 acceptance/verification gap, not a claim of a new delta implementation defect or causal regression. Mandatory functional row must pass before merge; orchestrator needs an available build window to run the dev control and full retry. Review remains within delta scope; the unchanged server implementation was not re-audited.
Evidence: delta-fast.log.gz (full fast exit1; testFAIL101/staticFAIL1), delta-server-failure-excerpt.txt, delta-head-{control,watch}-isolated.log. Raw and isolated receipts attached to #197. Final static sizes22288976/19717400B, both delta0vs earlier6f; only inherited caps fail static checks. Final verdict HOLD / merge after fixes, outstanding P0=0/P1=1/P2=0/P3=0. Prior FSS-1 resolved; prior FSS-2 controlled current-head assertion passes, historical and current unpaired failures retained.
delta-server-failure-excerpt.txt
delta-head-control-isolated.log
delta-head-watch-isolated.log
delta-fast.log.gz
delta-unpaired-delay-audit.txt
Verdict: merge after fixes / HOLD (P0=0, P1=1, P2=0, P3=0). Blocking FSS-3 is independent functional-gate acceptance, not an attributed new delta implementation defect. Both failing tests are existing committed regressions retained intact (
d6a77a965b,ee5e319b81); no duplicate test or implementation fix added.Review head
c4cbd147e4on local review-flood-server-ship; target implementationf3f2d841ea. Four test-only review commits. Branch and diff clean; no push, deploy or perf VM use. Owned baseline/build targets/extracted executable/caches removed; no owned verification process remains.Prior findings: FSS-1 original legacy rollback regression now passes, as do both shipped hint variants. FSS-2 corrected controlled no-loss assertion passes: six exact50MiB transfers/source, head5.942827 vs reviewed5.882679 MB/s (+1.0225%), dev5.927601. Independent actual-draw/hash/byte audit194assertions passes. Historic and current unpaired failures still reproduce; actual current realized RTT reviewed145.069 vs head155.684ms independently confirmed. No rate normalization or erased failure.
LAN request remains limited: current raw pooled head17.541/dev13.774/reviewed16.258ms; head tail concentrated in one round, no stable per-round slowdown established. Historical4.480ms verified from raw one100-sample process; new campaign uses six20-sample processes and rebuilt artifacts. Fixture source unchanged; cannot attribute increase solely to method. Production9ab4329c same-method LAN comparison unverified under repeated explicit no-perf-VM instruction.
Independent fast exits1: server423pass/2fail/46ignored; mesh-watch initial-live Null!=true and saturated native-control primary unexpectedly closed. Both exact-binary isolated replays pass; original full failures remain unwaived. Dev control/full four-thread retry could not acquire an official slot after about one hour; only the unstarted owned waiter was stopped. Orchestrator needs an available build window to run those checks; native-control case is outside #118 exemptions. Static sizes22288976/19717400B, delta0each vs6f; linkage/native locked-key check pass, inherited absolute caps fail. Exact measured x86 image hash independently matches5c7ce9d8... and its shim-flight check passes32768<=65536 bytes.
Verbatim scripts/verify fast output summary:
delta-fast.log.gz
delta-unpaired-delay-audit.txt
delta-review-evidence.tar.gz
kayg referenced this issue2026-10-28 17:53:56 +00:00