kayg/infraternal
Watch
1
0
Fork
You've already forked infraternal
 0
Code Issues 356 Pull requests Projects Releases Packages Wiki Activity Actions

A slow access check closes the whole browser connection #240

New issue
Closed
opened 2026-10-17 14:06:08 +00:00 by kayg · 215 comments
kayg commented 2026-10-17 14:06:08 +00:00
Owner
Copy link

Production reliability fix, split out of the app-windows work (#146).

Finding (app-windows-ship c7169cb78, commit ff845df22): every frame a browser socket handles — terminal input and output, action calls, desktop input — first reads the session's authority from SQLite with a fixed 25 ms deadline. One read that misses that deadline closes the whole socket, terminals included. On a busy server this is a likely cause of "Reconnects" and "The connection to the server ended." (#227, #234).

Fix: a read that misses its deadline is a busy store, not a refusal. It is retried (5 ms doubling to 100 ms pauses) for at most 1 s while the socket's work waits — frames stay in order, none lost. A refusal or store error still closes at once; a store stuck past 1 s still closes (fail-closed); the session deadline is measured from the wall clock after the read, so a slow store can never extend a session.

Plan: branch authority-read-retry off origin/release-prod-live; cherry-pick only the fix + its tests; failing test first; a terminal-only socket stall test (100–800 ms); perf-VM count of socket closes before/after with injected stalls, and per-frame added latency on fast reads; scripts/verify fast; size vs release-prod-live (D243).

Refs #146 #227 #234

Production reliability fix, split out of the app-windows work (#146). **Finding** (app-windows-ship c7169cb78, commit ff845df22): every frame a browser socket handles — terminal input and output, action calls, desktop input — first reads the session's authority from SQLite with a fixed 25 ms deadline. One read that misses that deadline closes the whole socket, terminals included. On a busy server this is a likely cause of "Reconnects" and "The connection to the server ended." (#227, #234). **Fix**: a read that misses its deadline is a busy store, not a refusal. It is retried (5 ms doubling to 100 ms pauses) for at most 1 s while the socket's work waits — frames stay in order, none lost. A refusal or store error still closes at once; a store stuck past 1 s still closes (fail-closed); the session deadline is measured from the wall clock after the read, so a slow store can never extend a session. **Plan**: branch `authority-read-retry` off `origin/release-prod-live`; cherry-pick only the fix + its tests; failing test first; a terminal-only socket stall test (100–800 ms); perf-VM count of socket closes before/after with injected stalls, and per-frame added latency on fast reads; `scripts/verify fast`; size vs release-prod-live (D243). Refs #146 #227 #234
server-tests-deadline.log
82 KiB
server-clippy-deadline.log
203 B
server-cap-deadline.log
5.5 KiB
red-authority-cap.log
1 KiB
green-authority-cap.log
577 B
server-tests.log
41 KiB
stream-end-review-test.log
1.3 KiB
stream-end-sequence.txt
1.4 KiB
verify-iterate-final.log
436 KiB
gate-logout-commit.log
3.1 KiB
head-static-sizes.json
277 B
server-tests-remote.log
83 KiB
gate-primitive-final.log
1.5 KiB
baseline-size.json
227 B
head-static-sizes.json
277 B
self-review.txt
2.1 KiB
gate-bootstrap-entry.log
2.2 KiB
author-gate-summary.txt
593 B
iterate-merged-dev.log
472 KiB
focused-restored.log
8.7 KiB
perf-three-way-10k.log
3.7 KiB
verify-fast-final.log
371 KiB
size-unit-detach-both.txt
495 B
static-size.json
307 B
size-cap-tests.log
287 B
fence-corpus.json
1.1 KiB
dev-storm-test.log
1.9 KiB
server-remote-tests.log
74 KiB
verify-iterate.log
450 KiB
findings.txt
6.3 KiB
gate-summary.txt
612 B
reviewer-checklist.txt
2.1 KiB
cleanup.txt
407 B
size-semaphore-guard-x86.txt
270 B
storm-paired-results.json
2.3 KiB
server-remote-clippy.log
8.2 KiB
gate-capacity-final.log
1.4 KiB
verify-fast.log
382 KiB
logout-after.gz
12 MiB
perf-after.json
266 B
logout-before.gz
12 MiB
outside-runtime-red.log
1.4 KiB
static-exact-caps.log
2.4 KiB
self-review.txt
1.8 KiB
lost-recovery-source.log
1.2 KiB
server-tests-final.log
81 KiB
storm-pair-3-candidate.log
885 B
storm-baseline-comparison.txt
141 B
static-sizes.json
502 B
disk-cleanup.txt
468 B
clippy.log
8.2 KiB
environment.txt
137 B
outside-runtime-green.log
567 B
storm-paired.log
4.4 KiB
storm-paired.json
407 B
storm-dev-baseline.log
1.8 KiB
baseline-capacity-9896.txt
7 KiB
perf-before.log
1.2 KiB
clippy-server-final.log
203 B
verify-fast.log
437 KiB
verify-fast-summary.txt
663 B
self-review.txt
4.1 KiB
fence-close.log
1.9 KiB
cleanup.txt
857 B
red-upgrade-9896.log
1 KiB
head-static-sizes.json
277 B
gate-static-ceilings.log
287 B
red-logout-9896.log
1 KiB
self-review.txt
2.1 KiB
sizes-final.json
577 B
perf-after.log
1.2 KiB
red-recovery-9896.log
760 B
revocation-routing-pending.patch
16 KiB
verify-iterate.log
368 KiB
base-functional-9896-environment.json
99 B
baseline-regressions-9896.patch
5.6 KiB
perf-conditional-after.log
1.2 KiB
perf-before-repeat.log
1.2 KiB
green-unrelated-paused.log
571 B
green-revoked-paused.log
437 B
final-focused.log
592 B
scope-first.log
12 KiB
storm-repeat.log
1.1 KiB
server-clippy.log
2 KiB
clippy-remote-feature.log
2 KiB
perf-final-paired-10k.log
2.2 KiB
final-verify-fast.log
349 KiB
final-server-clippy.log
209 B
binary-comparison.json
982 B
final-gate-summary.txt
593 B
final-typescript.log
69 KiB
verify-fast.log
263 KiB
cleanup.json
1 KiB
verify-fast-final-head.log
368 KiB
functional-results-final.json
1.6 KiB
review-audit-final.txt
3.1 KiB
review-commit-history.txt
3.6 KiB
diagnostic-error.log
7.8 KiB
diagnostic-error-summary.json
686 B
diagnostic-error-protocol.log
102 KiB
runtime-lock-isolated-full-features.log
838 B
full-place-failure.txt
720 B
baseline-load-environment.json
328 B
server-tests-final.log
81 KiB
clippy-server-default.log
203 B
review-run-1.log
5.6 KiB
review-run-2.log
5.6 KiB
review-run-4.log
5.6 KiB
review-run-5.log
5.6 KiB
run-review-command.txt
694 B
wire-review-test.log
3.5 KiB
review-sequences.txt
991 B
paused-single.log
592 B
review-run-3.log
5.8 KiB
verify-fast-initial.log
348 KiB
baseline-load-full-place-matched.log
1.1 KiB
baseline-load-environment.json
826 B
gate-revocation-final.log
75 KiB
head-full-place-rerun.log
239 B
step1.log
8.8 KiB
step2.log
934 B
step3.log
1 KiB
paused-isolated.log
36 KiB
paused-loaded.log
23 KiB
paused-loaded-summary.json
702 B
paused-protocol-companion.log
191 KiB
step4.log
1.2 KiB
baseline-tests.log
4.4 KiB
pending-busy-fix.patch
24 KiB
paused-isolated-summary.json
623 B
red-final-subscriber.log
726 B
verify-fast-final.log
439 KiB
size-baseline.log
10 KiB
size-dyn-query-x86.log
309 B
review-audit.txt
2.5 KiB
review-1013-final.log
436 B
green-final-subscriber.log
938 B
gate-recovery.log
3.6 KiB
author-static.json
439 B
size-dyn-query-aarch64.log
309 B
review-cleanup-final.log
440 B
statement-completion-probe.log
618 B
verify-fast-final.log
467 KiB
findings.md
1.5 KiB
reviewer-checklist.txt
4.5 KiB
merge-proof.json
1,017 B
terminal-isolated.log
17 KiB
terminal-isolated-summary.json
628 B
terminal-loaded-summary.json
707 B
terminal-protocol-companion.log
483 KiB
terminal-loaded.log
17 KiB
matrix-direct-test.log
229 B
expiry-review-test.log
232 B
teardown-comparison.txt
1.1 KiB
step5.log
801 B
clock-review-test.log
233 B
closed-review-test.log
248 B
storm-review-test.log
251 B
functional-results.json
1.1 KiB
verify-fast-final.log
457 KiB
step6.log
818 B
verify-fast-final.log
457 KiB
red-on-release-prod-live.log
2.2 KiB
green-transient.log
858 B
server-socket-filters.log
11 KiB
perf-vm-results.txt
2.3 KiB
perf-vm-rtt-extra.txt
2.4 KiB
perf-vm-v4.txt
1.2 KiB
verify-fast-2.log
316 KiB
review-fix-verify-fast.log
309 KiB
review-fix-perf-vm.txt
3.8 KiB
review-fix-perf-vm-earlier.txt
3.8 KiB
review-fix-p2-red.log
1.9 KiB
size-detached-type-x86.log
309 B
verify-fast.log
438 KiB
verify-fast-head.txt
41 B
red-logout-commit.log
1.1 KiB
verify-fast.log
396 KiB
gate-summary-final.txt
702 B
self-review-final.txt
2.1 KiB
red-busy.log
11 KiB
isolated.log
17 KiB
isolated-summary.json
621 B
union-1.log
6.6 KiB
union-2.log
5.2 KiB
binary-size.txt
783 B
base-static-build.log
8.7 KiB
review-audit.txt
3.4 KiB
union-3.log
5.2 KiB
cleanup-final.json
512 B
size-evidence.txt
900 B
account-tests.log
14 KiB
primitive-standalone.log
642 B
union-4.log
5.2 KiB
fmt.log
0 B
union-final-1.log
5.2 KiB
union-final-5.log
5.2 KiB
iterate-inline.log
368 KiB
ca-rerun.log
424 B
focused-corrected.log
3.1 KiB
size-unit-detach-x86.txt
414 B
revoked-repeat-1.log
750 B
green-revoked-fenced.log
564 B
milestone-iterate.log
356 KiB
union-5.log
5.2 KiB
union-final-2.log
5.2 KiB
union-final-3.log
5.2 KiB
union-final-4.log
5.2 KiB
green-busy.log
1.8 KiB
loaded.log
26 KiB
protocol-companion.log
252 KiB
server-tests-trim.log
84 KiB
loaded-summary.json
705 B
green-busy-final.log
454 B
red-subsecond.log
1.2 KiB
author-verify-fast.log
484 KiB
run-union-command.txt
947 B
perf-trim-paired.log
2.5 KiB
perf-trim-paired-10k.log
2.6 KiB
verify-fast.log
441 KiB
green-unrelated.log
571 B
green-revoked.log
489 B
verify-iterate.log
453 KiB
self-review.txt
2.1 KiB
cleanup.txt
385 B
baseline-static.log
10 KiB
findings.md
1.7 KiB
reviewer-checklist.txt
5.1 KiB
verify-fast.log
371 KiB
typescript.log
71 KiB
verify-fast-initial.log
401 KiB
run-union-final.txt
959 B
recovery-source-red.log
9.4 KiB
sources-red.log
1.9 KiB
focused-green.log
4.5 KiB
self-review.txt
2 KiB
static-sizes.log
19 KiB
size-boundaries.log
287 B
commit-gates.log
3.8 KiB
union-final-1.log
6.9 KiB
union-final-2.log
6.9 KiB
union-final-3.log
6.9 KiB
union-final-4.log
6.9 KiB
union-final-5.log
6.9 KiB
static-size-cap.log
287 B
verify-fast.log
480 KiB
self-review.txt
2.7 KiB
run-union.txt
946 B
review-audit.txt
1.8 KiB
findings.txt
1.8 KiB
reviewer-checklist.txt
1.8 KiB
verify-fast.log
513 KiB
gate-summary.txt
703 B
union-final-1.log
8.2 KiB
head-sizes.json
250 B
baseline-size.json
185 B
baseline-static.log
8.6 KiB
descriptor-proof.json
1.9 KiB
prior-tests-diff.txt
3.9 KiB
cleanup.json
291 B
perf-paired.log
2.1 KiB
kayg commented 2026-10-17 14:08:30 +00:00
Author
Owner
Copy link

Start. Branch authority-read-retry, base origin/release-prod-live 3048580c11.

Source of the fix: ff845df22 on app-windows-ship ("hold a socket's work through a slow authority read instead of closing it"). It touches only websocket.rs (read_authority + three call sites) and adds socket_tests/transient_authority_stall.rs; nothing app-windows-specific. The cherry-pick conflicts only on a native-diagnostics eprintln! block that is not on the production line, so I re-apply the same change by hand without it.

Next: tests first on unmodified prod (expect red), plus a new terminal-only test (100/300/800 ms stalls, input and output order checked).

Start. Branch `authority-read-retry`, base `origin/release-prod-live` 3048580c1184e2fd6728aee7fc5b5b80416cd8fd. Source of the fix: `ff845df22` on app-windows-ship ("hold a socket's work through a slow authority read instead of closing it"). It touches only `websocket.rs` (read_authority + three call sites) and adds `socket_tests/transient_authority_stall.rs`; nothing app-windows-specific. The cherry-pick conflicts only on a native-diagnostics `eprintln!` block that is not on the production line, so I re-apply the same change by hand without it. Next: tests first on unmodified prod (expect red), plus a new terminal-only test (100/300/800 ms stalls, input and output order checked).
kayg commented 2026-10-17 15:10:40 +00:00
Author
Owner
Copy link

Findings so far (branch authority-read-retry, pushed at 73f410984).

Red on release-prod-live 3048580c1 (tests added, websocket.rs unchanged):

test ...authority_read_stall_shorter_than_the_wait_keeps_the_socket_and_its_order ... FAILED
  assertion `left == right` failed: a slow authority read closed the socket or reordered its frames  left: None right: Some(1)
test ...terminal_stream_survives_authority_stalls_without_loss_or_reorder ... FAILED
  a 100 ms authority stall closed the terminal socket: Some(Ok(Close(None)))
test ...authority_read_stall_beyond_the_wait_still_fails_closed ... ok

Green with the fix (fd54530ed): 3 passed. Server authority/socket/websocket filters: 72 passed, 0 failed.

Policy change in #189 tests (please review): three websocket_authority_tests cases pinned "a periodic read whose operation is frozen or holds the only connection fails at exactly one 25 ms deadline". With the fix they hung, because the paused clock never reached the new 1 s bound. They now step through the bounded wait and also assert the result does not come before half the wait or after wait + 25 ms. Every safety assertion stays the same: no side effect after a revocation or expiry, the result is Err, and the owned value is dropped. In practice, when a revoked socket's frozen operation holds the only pool connection, the socket now closes in up to 1 s instead of 25 ms. Production has 8 connections.

Harness pitfalls found and fixed in the measurement (not server bugs): a test browser that does not answer the server's liveness Pings is closed after the proof budget (2 s at first, then about 300 ms once the RTT is learned). Without TCP_NODELAY on the test listener, echo p50 was 35–40 ms from delayed ACKs. Production sets nodelay (runtime.rs:328).

Local soak (build host, load ~10–16, 10 s, 4 terminals, 5 stalls of 50–300 ms): before 16 closes, 1607 echoes; after 0 closes, 4004 echoes. Without stalls, the before build had 0 closes. Perf VM numbers follow.

Findings so far (branch `authority-read-retry`, pushed at 73f410984). **Red on release-prod-live 3048580c1** (tests added, websocket.rs unchanged): ``` test ...authority_read_stall_shorter_than_the_wait_keeps_the_socket_and_its_order ... FAILED assertion `left == right` failed: a slow authority read closed the socket or reordered its frames left: None right: Some(1) test ...terminal_stream_survives_authority_stalls_without_loss_or_reorder ... FAILED a 100 ms authority stall closed the terminal socket: Some(Ok(Close(None))) test ...authority_read_stall_beyond_the_wait_still_fails_closed ... ok ``` **Green with the fix** (fd54530ed): 3 passed. Server authority/socket/websocket filters: 72 passed, 0 failed. **Policy change in #189 tests (please review):** three `websocket_authority_tests` cases pinned "a periodic read whose operation is frozen or holds the only connection fails at exactly one 25 ms deadline". With the fix they hung, because the paused clock never reached the new 1 s bound. They now step through the bounded wait and also assert the result does not come before half the wait or after wait + 25 ms. Every safety assertion stays the same: no side effect after a revocation or expiry, the result is Err, and the owned value is dropped. In practice, when a revoked socket's frozen operation holds the *only* pool connection, the socket now closes in up to 1 s instead of 25 ms. Production has 8 connections. **Harness pitfalls found and fixed in the measurement (not server bugs):** a test browser that does not answer the server's liveness Pings is closed after the proof budget (2 s at first, then about 300 ms once the RTT is learned). Without TCP_NODELAY on the test listener, echo p50 was 35–40 ms from delayed ACKs. Production sets nodelay (runtime.rs:328). **Local soak (build host, load ~10–16, 10 s, 4 terminals, 5 stalls of 50–300 ms):** before 16 closes, 1607 echoes; after 0 closes, 4004 echoes. Without stalls, the before build had 0 closes. Perf VM numbers follow.
kayg commented 2026-10-17 17:24:12 +00:00
Author
Owner
Copy link

Finished. Branch authority-read-retry, head 61dc21e333 (base release-prod-live 3048580c1). Pushed.

Commits:

  • fd54530ed fix(server): hold a socket's work through a slow authority read instead of closing it
  • 73f410984 test(server): ignored soak and echo-latency harness for slow authority reads
  • eec9d1421 test(server): satisfy pedantic clippy in the #240 stall tests and harness. Note: fd54530ed and 73f410984 alone fail clippy (tests only). Squash on merge if each commit must pass the gate.
  • 61dc21e33 perf(server): compile the authority read retry once; ratchet x86_64 size (D243). The final shape is one non-generic read_expiry with a fixed 10 ms pause against an absolute 1 s give-up instant.

Root cause: before any frame's work, the server checks in SQLite that the session is still valid, and gives that check 25 ms. If the database is busy for longer, even once, the server treats the miss as "not allowed" and closes the whole connection: every terminal, every window. Now a miss counts as "busy". The frame waits, the check is retried for up to 1 s, and nothing is lost or reordered. A real "no" still closes at once, and a database stuck for more than 1 s still closes.

Perf VM (10.69.69.208, under the perf lock), 4 terminal sockets typing every 10 ms, store connection held for random stalls:

run before (release-prod-live) after
300 s, 138 stalls of 50–300 ms 548 closes, 0 gaps 0 closes, 0 gaps (v4: 0 closes, 120,000 echoes)
300 s, no stalls 1 close 0 closes
120 s, 32 stalls of 700–900 ms (v4 only) – 0 closes, 0 gaps, worst echo 908 ms

Fast-store echo round trip (5,000 samples per run, interleaved): 9 rounds, p50 median before 791 µs / after 768 µs, p99 median 3,934 / 3,882 µs. v4: 5 rounds, p50 median before 1,111 µs / after 840 µs (a noisier VM window). The added per-frame latency is within noise, about 0.

Size (static, same target dir): first version +3,392 B x86_64 / +2,816 B aarch64. Final: x86_64 21,090,384 (−64 B, ceiling ratcheted down as the gate requires), aarch64 19,316,264 (+0).

scripts/verify fast (load 10.6 at start), verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
+ @types/bun@1.3.8
+ @types/node@22.19.0
+ @types/ws@8.5.10
+ playwright@1.61.1
+ typescript@5.9.3
+ ws@8.18.3
+ @scure/bip39@2.2.0
+ geist@1.7.2
exit=0

Size lines: size: 21090384 bytes; cap: 21090384 bytes; delta: +0 bytes / size: 19316264 bytes; cap: 19316264 bytes; delta: +0 bytes

Evidence:
red-on-release-prod-live.log
green-transient.log
server-socket-filters.log
perf-vm-results.txt
perf-vm-rtt-extra.txt
perf-vm-v4.txt
verify-fast-2.log

Finished. Branch `authority-read-retry`, head **61dc21e333491bd6a78637216e2474333a40fb4b** (base release-prod-live 3048580c1). Pushed. Commits: - fd54530ed fix(server): hold a socket's work through a slow authority read instead of closing it - 73f410984 test(server): ignored soak and echo-latency harness for slow authority reads - eec9d1421 test(server): satisfy pedantic clippy in the #240 stall tests and harness. Note: fd54530ed and 73f410984 alone fail clippy (tests only). Squash on merge if each commit must pass the gate. - 61dc21e33 perf(server): compile the authority read retry once; ratchet x86_64 size (D243). The final shape is one non-generic `read_expiry` with a fixed 10 ms pause against an absolute 1 s give-up instant. **Root cause:** before any frame's work, the server checks in SQLite that the session is still valid, and gives that check 25 ms. If the database is busy for longer, even once, the server treats the miss as "not allowed" and closes the whole connection: every terminal, every window. Now a miss counts as "busy". The frame waits, the check is retried for up to 1 s, and nothing is lost or reordered. A real "no" still closes at once, and a database stuck for more than 1 s still closes. **Perf VM (10.69.69.208, under the perf lock)**, 4 terminal sockets typing every 10 ms, store connection held for random stalls: | run | before (release-prod-live) | after | |---|---|---| | 300 s, 138 stalls of 50–300 ms | **548 closes**, 0 gaps | **0 closes**, 0 gaps (v4: 0 closes, 120,000 echoes) | | 300 s, no stalls | **1 close** | 0 closes | | 120 s, 32 stalls of 700–900 ms (v4 only) | – | 0 closes, 0 gaps, worst echo 908 ms | Fast-store echo round trip (5,000 samples per run, interleaved): 9 rounds, p50 median before 791 µs / after 768 µs, p99 median 3,934 / 3,882 µs. v4: 5 rounds, p50 median before 1,111 µs / after 840 µs (a noisier VM window). **The added per-frame latency is within noise, about 0.** **Size (static, same target dir):** first version +3,392 B x86_64 / +2,816 B aarch64. Final: x86_64 21,090,384 (−64 B, ceiling ratcheted down as the gate requires), aarch64 19,316,264 (+0). **scripts/verify fast** (load 10.6 at start), verbatim: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ + @types/bun@1.3.8 + @types/node@22.19.0 + @types/ws@8.5.10 + playwright@1.61.1 + typescript@5.9.3 + ws@8.18.3 + @scure/bip39@2.2.0 + geist@1.7.2 exit=0 ``` Size lines: `size: 21090384 bytes; cap: 21090384 bytes; delta: +0 bytes` / `size: 19316264 bytes; cap: 19316264 bytes; delta: +0 bytes` Evidence: [red-on-release-prod-live.log](https://git.kayg.org/attachments/e535c2bf-ae64-4f34-9e87-dfafb522d9dd) [green-transient.log](https://git.kayg.org/attachments/ffa2d499-8d9e-4691-aa58-8278b9c16c5e) [server-socket-filters.log](https://git.kayg.org/attachments/c04677fd-02d5-45d1-9bad-ce1618c265b5) [perf-vm-results.txt](https://git.kayg.org/attachments/d6387385-59f1-4cf4-aa30-a2107741b54d) [perf-vm-rtt-extra.txt](https://git.kayg.org/attachments/1daf0dab-e79a-4f25-979e-829f555f4832) [perf-vm-v4.txt](https://git.kayg.org/attachments/13a29e25-57b5-45d5-986c-98e0ab82a4b6) [verify-fast-2.log](https://git.kayg.org/attachments/9c2ffe0b-46f0-4aba-a832-f22017e58f89)
kayg commented 2026-10-17 17:29:01 +00:00
Author
Owner
Copy link

Break-it review (Opus) started on branch review-authority-read-retry at 61dc21e33 (base release-prod-live 3048580c1).

Break-it review (Opus) started on branch `review-authority-read-retry` at 61dc21e33 (base release-prod-live 3048580c1).
kayg commented 2026-10-17 18:18:13 +00:00
Author
Owner
Copy link

Break-it review (Opus) of 61dc21e33: two P1s, do not merge

Branch review-authority-read-retry, commit 42710ba1a, adds crates/infraternal-server/src/auth/socket_tests/review_authority_retry.rs (2 tests, both fail).
Run: cargo test -p infraternal-server --lib review_authority_retry

test ...::session_expiring_during_the_wait_is_not_revived_or_served ... FAILED
  an expired session was renewed by a retried read: expires 1794850592, ended 1792258593
test ...::renewing_retries_do_not_drain_the_pool_during_a_write_stall ... FAILED
  one renewing socket drained the pool during a write stall: a WAL read waited 253.425185ms (pool size 8, idle 0)
test result: FAILED. 0 passed; 2 failed

P1-1: a session that expires during the wait is renewed for 30 days, and its frame runs. read_expiry takes now once, before the retry loop. Every retry passes that old now to live_expiry (expires > now) and to socket_activity (renewal to now + SESSION). After a stall that crosses the session end, the retried read still treats the session as live and renews it. Expiry stops being monotonic: HTTP sees the session as dead, then it comes back. session_is_live (renew=true, used at the input/attach/resize gates and at shutdown) has the same old clock. Before this change the read missed its 25 ms deadline and the socket closed. Fix: read the clock again for each attempt.

P1-2: retrying a renewing read drains the 8-connection pool during a write stall. A renewing read is a SELECT followed by an UPDATE. While another connection holds the write lock, the UPDATE waits on busy_timeout (5 s). The 25 ms timeout drops the future, but the statement keeps its pooled connection. A retry every 10 ms checks out another connection, so one socket due for renewal uses all 8 in about 300 ms. Then every WAL reader in the server stalls (other sockets close at 1 s, which is the global outage #240 is meant to stop). The 50–300 ms soak holds one connection but no write lock, so it cannot see this. Fix direction: retry only the read and defer or skip a busy renewal, or keep awaiting the same attempt instead of starting a new one. Cap concurrent authority attempts as well.

P2-3: session_is_live on the teardown path now waits up to 1 s before drop(sink)/drop(transport), and it also renews at shutdown. The comment on AUTHORITY_READ_TIMEOUT ("shutdown cannot inherit the normal one-second writer wait") is now wrong.

P3-4: A revocation that arrives while a tick read is in flight closes after up to about 2 s (authority.await? then socket_deadline). Nothing is sent in the meantime (the operation is not polled). Only the close is late, past the "within 1 s" that the #189 tests state.

P3-5: The issue says the backoff starts at 5 ms and doubles up to 100 ms. The code uses a fixed 10 ms, about 28 attempts per second per stalled socket, which makes P1-2 worse.

Checked, holds: frame ordering and loss (serial loop, bounded INPUT_SLOTS, TCP backpressure); a revocation published during the entry wait (subscribed before the read, biased select, the frame does not run); pings are answered without SQL (D265). The changed #189 tests widen 25 ms to the designed 1 s, a deliberate weakening and not a bug.

Not done: the same tests run against the base code (3048580c1). The run waited over 40 min for a build slot and was stopped. Without the retry, both failures cannot happen: there is one attempt and the socket closes.

## Break-it review (Opus) of 61dc21e33: two P1s, do not merge Branch `review-authority-read-retry`, commit 42710ba1a, adds `crates/infraternal-server/src/auth/socket_tests/review_authority_retry.rs` (2 tests, both fail). Run: `cargo test -p infraternal-server --lib review_authority_retry` ``` test ...::session_expiring_during_the_wait_is_not_revived_or_served ... FAILED an expired session was renewed by a retried read: expires 1794850592, ended 1792258593 test ...::renewing_retries_do_not_drain_the_pool_during_a_write_stall ... FAILED one renewing socket drained the pool during a write stall: a WAL read waited 253.425185ms (pool size 8, idle 0) test result: FAILED. 0 passed; 2 failed ``` **P1-1: a session that expires during the wait is renewed for 30 days, and its frame runs.** `read_expiry` takes `now` once, before the retry loop. Every retry passes that old `now` to `live_expiry` (`expires > now`) and to `socket_activity` (renewal to `now + SESSION`). After a stall that crosses the session end, the retried read still treats the session as live and renews it. Expiry stops being monotonic: HTTP sees the session as dead, then it comes back. `session_is_live` (renew=true, used at the input/attach/resize gates and at shutdown) has the same old clock. Before this change the read missed its 25 ms deadline and the socket closed. Fix: read the clock again for each attempt. **P1-2: retrying a renewing read drains the 8-connection pool during a write stall.** A renewing read is a SELECT followed by an UPDATE. While another connection holds the write lock, the UPDATE waits on busy_timeout (5 s). The 25 ms timeout drops the future, but the statement keeps its pooled connection. A retry every 10 ms checks out another connection, so one socket due for renewal uses all 8 in about 300 ms. Then every WAL reader in the server stalls (other sockets close at 1 s, which is the global outage #240 is meant to stop). The 50–300 ms soak holds one connection but no write lock, so it cannot see this. Fix direction: retry only the read and defer or skip a busy renewal, or keep awaiting the same attempt instead of starting a new one. Cap concurrent authority attempts as well. **P2-3:** `session_is_live` on the teardown path now waits up to 1 s before `drop(sink)`/`drop(transport)`, and it also renews at shutdown. The comment on `AUTHORITY_READ_TIMEOUT` ("shutdown cannot inherit the normal one-second writer wait") is now wrong. **P3-4:** A revocation that arrives while a tick read is in flight closes after up to about 2 s (`authority.await?` then `socket_deadline`). Nothing is sent in the meantime (the operation is not polled). Only the close is late, past the "within 1 s" that the #189 tests state. **P3-5:** The issue says the backoff starts at 5 ms and doubles up to 100 ms. The code uses a fixed 10 ms, about 28 attempts per second per stalled socket, which makes P1-2 worse. **Checked, holds:** frame ordering and loss (serial loop, bounded INPUT_SLOTS, TCP backpressure); a revocation published during the entry wait (subscribed before the read, biased select, the frame does not run); pings are answered without SQL (D265). The changed #189 tests widen 25 ms to the designed 1 s, a deliberate weakening and not a bug. Not done: the same tests run against the base code (3048580c1). The run waited over 40 min for a build slot and was stopped. Without the retry, both failures cannot happen: there is one attempt and the socket closes.
kayg commented 2026-10-17 18:19:39 +00:00
Author
Owner
Copy link

Start: fixing the break-it review (P1-1, P1-2, P2-3, P3-4, P3-5). Branch authority-read-retry, base release-prod-live 3048580c1. History rewritten (force-with-lease): the clippy-only commit eec9d1421 is squashed into its parents (its one transient_authority_stall.rs line into the fix commit, the soak changes into the harness commit; final tree identical), and the review tests 42710ba1a are cherry-picked on top. Rewritten head before fixes: de9ecbc5b.

Start: fixing the break-it review (P1-1, P1-2, P2-3, P3-4, P3-5). Branch `authority-read-retry`, base release-prod-live 3048580c1. History rewritten (force-with-lease): the clippy-only commit eec9d1421 is squashed into its parents (its one transient_authority_stall.rs line into the fix commit, the soak changes into the harness commit; final tree identical), and the review tests 42710ba1a are cherry-picked on top. Rewritten head before fixes: de9ecbc5b.
kayg commented 2026-10-18 03:06:46 +00:00
Author
Owner
Copy link

Break-it review fixes: done, with one gate still red (aarch64 size +1,584 B, owner decision)

Branch authority-read-retry, head 37d2e4dc3c (base release-prod-live 3048580c1). Pushed with force-with-lease over 61dc21e33.

History: the clippy-only commit eec9d1421 is squashed into its parents. The review tests (42710ba1a, now 2e621f6b2) are cherry-picked. Then one commit per finding:

  • 9f04c80ea P1-1: each attempt reads the clock, and the answer is checked against the clock again after the read. An ended session is never found live or renewed. Review test session_expiring_during_the_wait_is_not_revived_or_served is green.
  • 6f342c440 P1-2 + P3-5: only the SELECT is retried. Renewal runs off the read path as a spawned UPDATE: at most one server-wide, skipped when busy, judged by expires>unixepoch() when the statement runs. AUTHORITY_READS=4 caps authority connections server-wide (a semaphore; an attempt waits its turn within its own deadline). The backoff is 5 ms doubling to 100 ms. socket_activity is gone. Review test renewing_retries_do_not_drain_the_pool_during_a_write_stall is green.
  • 3a8791618 soak: SOAK_HOLD=write|mixed holds the write lock (BEGIN IMMEDIATE outside the pool) after making the session due for renewal. SOAK_STORE=file uses the production pool shape. A pool probe reports other readers' wait.
  • 360480fea P2-3: teardown makes one attempt, no wait, no renewal. The AUTHORITY_READ_TIMEOUT comment is corrected. New tests, red before the fix: teardown_with_a_busy_store_does_not_wait_for_authority (959 ms → <500 ms) and teardown_does_not_renew_the_session.
  • fa37d18db P3-4: on revocation or deadline during a periodic read, the stale in-flight read is dropped and one fresh read decides, so the close comes within one bounded wait of the change. There is no new red test: the old 2 s case needs a SELECT that straddles the revocation commit. The bound stays pinned by the authority_watchdog interruption tests, which measure from the interruption.
  • 37d2e4dc3 ratchets the x86_64 ceiling down to 21,086,416.

Rejected along the way: try-only counters for the cap. They were 512 B smaller, but a burst of more than 4 reads paid a 5 ms pause and recovery_subscription_updates_every_signed_in_socket failed deterministically.

Perf VM (10.69.69.208, under the perf lock), 120 s, 4 terminals typing every 10 ms, 55 stalls of 50–300 ms. "reviewed" = 61dc21e33:

run before (3048580c1) reviewed after
conn holds, memory store: closes 218 0 0
write-lock holds, file pool of 8: closes 88 0 0
write-lock holds: other readers' DB wait max / >100 ms 301 ms / 14 286 ms / 11 8.5 ms / 0
mixed: closes 32 0 0
mixed: DB wait max / >100 ms 213 ms / 4 277 ms / 9 8.9 ms / 0
Gaps were 0 everywhere. With conn holds on the 1-connection store, the probe's waits are the held connection itself (~280 ms in all versions). An earlier run of a near-final build gave the same picture: write holds, reviewed 274 ms / 15 vs after 6.0 ms / 0.

Fast-store echo RTT p50 (µs, 3 interleaved rounds): before 697/815/707, reviewed 784/771/1165, after 791/1041/1250. The VM was noisy in rounds 2–3 (reviewed jumped too). The previous run of a near-final build gave before 826/841/772, after 832/811/825. I do not claim a per-frame cost from this. A clean re-run is needed before merge.

Size (static, same target dir): x86_64 21,086,416 (−3,968 vs the old ceiling, ratcheted). aarch64 19,317,848, +1,584 over 19,316,264. A symbol diff puts the growth in the spawned renewal UPDATE plus its drop glue, and the AuthorityLimits Arc. I did not raise the ceiling: it is the owner's call.

scripts/verify fast (load 13.3 at start), verbatim:

PT_INTERP: absent; size: 21086416 bytes; cap: 21085584 bytes; delta: +832 bytes
PT_INTERP: absent; size: 19317848 bytes; cap: 19316264 bytes; delta: +1584 bytes
PT_INTERP: absent; size: 21086416 bytes; cap: 21085584 bytes; delta: +832 bytes

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+
exit=1

The only red item is static builds, which fails on the aarch64 size line above; the x86_64 line there is from before the ratchet commit (cap now 21,086,416).

Evidence:
review-fix-verify-fast.log
review-fix-perf-vm.txt
review-fix-perf-vm-earlier.txt
review-fix-p2-red.log

## Break-it review fixes: done, with one gate still red (aarch64 size +1,584 B, owner decision) Branch `authority-read-retry`, head **37d2e4dc3cc2372382f061c71481207f8335ce02** (base release-prod-live 3048580c1). Pushed with force-with-lease over 61dc21e33. History: the clippy-only commit eec9d1421 is squashed into its parents. The review tests (42710ba1a, now 2e621f6b2) are cherry-picked. Then one commit per finding: - 9f04c80ea **P1-1**: each attempt reads the clock, and the answer is checked against the clock again after the read. An ended session is never found live or renewed. Review test `session_expiring_during_the_wait_is_not_revived_or_served` is green. - 6f342c440 **P1-2 + P3-5**: only the SELECT is retried. Renewal runs off the read path as a spawned UPDATE: at most one server-wide, skipped when busy, judged by `expires>unixepoch()` when the statement runs. AUTHORITY_READS=4 caps authority connections server-wide (a semaphore; an attempt waits its turn within its own deadline). The backoff is 5 ms doubling to 100 ms. `socket_activity` is gone. Review test `renewing_retries_do_not_drain_the_pool_during_a_write_stall` is green. - 3a8791618 soak: `SOAK_HOLD=write|mixed` holds the write lock (BEGIN IMMEDIATE outside the pool) after making the session due for renewal. `SOAK_STORE=file` uses the production pool shape. A pool probe reports other readers' wait. - 360480fea **P2-3**: teardown makes one attempt, no wait, no renewal. The AUTHORITY_READ_TIMEOUT comment is corrected. New tests, red before the fix: `teardown_with_a_busy_store_does_not_wait_for_authority` (959 ms → <500 ms) and `teardown_does_not_renew_the_session`. - fa37d18db **P3-4**: on revocation or deadline during a periodic read, the stale in-flight read is dropped and one fresh read decides, so the close comes within one bounded wait of the change. There is no new red test: the old 2 s case needs a SELECT that straddles the revocation commit. The bound stays pinned by the authority_watchdog interruption tests, which measure from the interruption. - 37d2e4dc3 ratchets the x86_64 ceiling down to 21,086,416. Rejected along the way: try-only counters for the cap. They were 512 B smaller, but a burst of more than 4 reads paid a 5 ms pause and `recovery_subscription_updates_every_signed_in_socket` failed deterministically. **Perf VM (10.69.69.208, under the perf lock), 120 s, 4 terminals typing every 10 ms, 55 stalls of 50–300 ms. "reviewed" = 61dc21e33:** | run | before (3048580c1) | reviewed | after | |---|---|---|---| | conn holds, memory store: closes | 218 | 0 | 0 | | write-lock holds, file pool of 8: closes | 88 | 0 | 0 | | write-lock holds: other readers' DB wait max / >100 ms | 301 ms / 14 | 286 ms / 11 | **8.5 ms / 0** | | mixed: closes | 32 | 0 | 0 | | mixed: DB wait max / >100 ms | 213 ms / 4 | 277 ms / 9 | **8.9 ms / 0** | Gaps were 0 everywhere. With conn holds on the 1-connection store, the probe's waits are the held connection itself (~280 ms in all versions). An earlier run of a near-final build gave the same picture: write holds, reviewed 274 ms / 15 vs after 6.0 ms / 0. Fast-store echo RTT p50 (µs, 3 interleaved rounds): before 697/815/707, reviewed 784/771/1165, after 791/1041/1250. The VM was noisy in rounds 2–3 (reviewed jumped too). The previous run of a near-final build gave before 826/841/772, after 832/811/825. I do not claim a per-frame cost from this. A clean re-run is needed before merge. **Size (static, same target dir):** x86_64 21,086,416 (−3,968 vs the old ceiling, ratcheted). aarch64 **19,317,848, +1,584 over 19,316,264**. A symbol diff puts the growth in the spawned renewal UPDATE plus its drop glue, and the AuthorityLimits Arc. I did not raise the ceiling: it is the owner's call. **scripts/verify fast** (load 13.3 at start), verbatim: ``` PT_INTERP: absent; size: 21086416 bytes; cap: 21085584 bytes; delta: +832 bytes PT_INTERP: absent; size: 19317848 bytes; cap: 19316264 bytes; delta: +1584 bytes PT_INTERP: absent; size: 21086416 bytes; cap: 21085584 bytes; delta: +832 bytes +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ exit=1 ``` The only red item is static builds, which fails on the aarch64 size line above; the x86_64 line there is from before the ratchet commit (cap now 21,086,416). Evidence: [review-fix-verify-fast.log](https://git.kayg.org/attachments/c9da1217-10ad-42fb-a28a-2cba70cb90d4) [review-fix-perf-vm.txt](https://git.kayg.org/attachments/ed2cd41c-580f-4fb9-97b1-452d51abde09) [review-fix-perf-vm-earlier.txt](https://git.kayg.org/attachments/8c699cd7-c14b-4df8-9cf4-b470556edb1d) [review-fix-p2-red.log](https://git.kayg.org/attachments/5ca4333f-e5f4-445f-8928-844d68bb774b)
kayg commented 2026-10-18 03:08:24 +00:00
Author
Owner
Copy link

Break-it delta review r2 (Opus) started on branch review-authority-read-retry-r2 at a9db5526be (origin/authority-read-retry). Scope: prior P1-1, P1-2, P2-3, P3-4, P3-5 plus renewal starvation, clock skew, the authority cap, fairness at the cap, shutdown of the renewal task.

Break-it delta review r2 (Opus) started on branch `review-authority-read-retry-r2` at a9db5526be1cf62eb4d835f6d79ca838150d5e57 (origin/authority-read-retry). Scope: prior P1-1, P1-2, P2-3, P3-4, P3-5 plus renewal starvation, clock skew, the authority cap, fairness at the cap, shutdown of the renewal task.
kayg commented 2026-10-18 04:18:50 +00:00
Author
Owner
Copy link

Break-it delta review r2 (Opus) of a9db5526b: no P0/P1/P2, one P3 with a failing test, three P3 notes. MERGE

Branch review-authority-read-retry-r2, head 0faea9c3d6 (on origin/authority-read-retry a9db5526b). Adds crates/infraternal-server/src/auth/socket_tests/review_authority_cap.rs (1 test, fails on purpose).

Prior findings

# status evidence
P1-1 expired session revived during the wait FIXED session_expiring_during_the_wait_is_not_revived_or_served ... ok. Each attempt reads the clock, a post-read check rejects expiry <= now, and the renewal is expires>unixepoch() when the statement runs
P1-2 retries drain the pool under a write lock FIXED renewing_retries_do_not_drain_the_pool_during_a_write_stall ... ok. Only the SELECT is retried, and WAL serves it under the write lock. At most one renewal runs server-wide
P2-3 teardown waits/renews FIXED teardown_with_a_busy_store_does_not_wait_for_authority ... ok, teardown_does_not_renew_the_session ... ok
P3-4 revocation bound ~2 s FIXED the stale in-flight read is dropped and one fresh read decides. All 6 authority_watchdog tests ok
P3-5 backoff FIXED 5 ms doubling to 100 ms, as the issue specifies

New

P3-6 (failing test): the cap counts attempts, not connections. The read_expiry doc says "however many sockets retry at once they hold at most that many connections". The place is a permit inside the attempt future. A missed deadline drops the future and the permit returns at once. The statement that is already running keeps its pooled connection until SQLite returns: sqlx 0.8.6 return_to_pool pings the connection before reuse (pool/connection.rs:314), and that ping waits behind the running statement. If the SELECT itself waits, one socket takes the whole pool:

test ...::review_authority_cap::retries_whose_select_waits_stay_within_the_authority_cap ... FAILED
one socket's abandoned authority reads hold 8 of 8 pool connections; the cap promises at most 4

The test uses a rollback-journal file whose lock another connection holds. In production WAL the write lock does not block the SELECT, so the case needs a read that is slow inside SQLite (slow I/O). That is why this is P3. Fix options: keep awaiting the same attempt rather than starting a new one, or hold the place until the connection has been returned. Or narrow the doc to what the cap actually bounds.

Renewal starvation (asked): no risk. A renewal is due 60 s after the last slide, and the session lasts 30 days. An active session expires only if every renewal is skipped or fails for about 30 days. One renewal blocks the others for at most busy_timeout 5 s, plus the pool acquire timeout if the pool is exhausted. HTTP requests also renew (read_session). No deadline before expiry is needed. P3-7: a failed renewal is discarded (let _ =). If renewals always fail (a read-only or full disk), nothing logs it. One rate-limited log line would cover this.

Clock skew (asked): none. now_seconds() (SystemTime) and SQLite's unixepoch() (unix VFS, gettimeofday) read the same CLOCK_REALTIME and both truncate to whole seconds. SQLite takes "now" after the busy-handler wait inside the step, so a renewal that queued behind a writer judges the session at the moment it writes. A wall-clock step backward affects both sides equally, so the two cannot disagree. The only fake clock is test_http_time, which applies to HTTP in tests only.

Cap vs non-authority readers, deadlock with a renewal: holds. A renewal holds 1 place and 1 connection, so authority work holds at most 4 connections plus whatever P3-6 leaks. The writer that a renewal waits on never needs an authority place to finish (require_session_tx uses its own transaction). A nested live() inside an authorized() operation takes its own place, independent of the tick read. No cycle.

P3-8 fairness at the cap. The semaphore is FIFO, but an attempt that misses its 25 ms deadline leaves the queue and rejoins at the back after its pause. Every logout wakes every socket (the revocation watch is server-wide), so N sockets queue on 4 places. That is half the herd throughput of the old 8-connection path. At about 100 µs per read this is about 2.5 ms for 100 sockets, so it is harmless. It only matters when reads take milliseconds. The backoff also adds up to 100 ms after a stall ends (before: 10 ms). That follows the spec, but if latency comes first the 100 ms ceiling could come down now that the cap bounds the cost.

Shutdown of the background task: holds. The renewal task is detached and never joined. When the runtime drops, the task is dropped; RenewalHold returns the place and clears the flag. The UPDATE is atomic and idempotent, so an interrupted one is harmless. Production never calls pool.close(), so nothing waits on it.

Gate

scripts/verify fast on 0faea9c3d (load ~15 at start). test is red only because of the new review test (508 passed, 1 failed):

PT_INTERP: absent; size: 21086416 bytes; cap: 21086416 bytes; delta: +0 bytes
PT_INTERP: absent; size: 19317848 bytes; cap: 19317848 bytes; delta: +0 bytes
+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | FAIL (101)   |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
exit=1

No perf-VM runs in this review.

MERGE: 0 P0, 0 P1, 0 P2, 4 P3 (P3-6 with a failing test, which can follow up after merge or be fixed before).

## Break-it delta review r2 (Opus) of a9db5526b: no P0/P1/P2, one P3 with a failing test, three P3 notes. MERGE Branch `review-authority-read-retry-r2`, head **0faea9c3d6ad2179e47539e738b3718f0021b419** (on origin/authority-read-retry a9db5526b). Adds `crates/infraternal-server/src/auth/socket_tests/review_authority_cap.rs` (1 test, fails on purpose). ### Prior findings | # | status | evidence | |---|---|---| | P1-1 expired session revived during the wait | **FIXED** | `session_expiring_during_the_wait_is_not_revived_or_served ... ok`. Each attempt reads the clock, a post-read check rejects `expiry <= now`, and the renewal is `expires>unixepoch()` when the statement runs | | P1-2 retries drain the pool under a write lock | **FIXED** | `renewing_retries_do_not_drain_the_pool_during_a_write_stall ... ok`. Only the SELECT is retried, and WAL serves it under the write lock. At most one renewal runs server-wide | | P2-3 teardown waits/renews | **FIXED** | `teardown_with_a_busy_store_does_not_wait_for_authority ... ok`, `teardown_does_not_renew_the_session ... ok` | | P3-4 revocation bound ~2 s | **FIXED** | the stale in-flight read is dropped and one fresh read decides. All 6 `authority_watchdog` tests ok | | P3-5 backoff | **FIXED** | 5 ms doubling to 100 ms, as the issue specifies | ### New **P3-6 (failing test): the cap counts attempts, not connections.** The `read_expiry` doc says "however many sockets retry at once they hold at most that many connections". The place is a permit inside the attempt future. A missed deadline drops the future and the permit returns at once. The statement that is already running keeps its pooled connection until SQLite returns: sqlx 0.8.6 `return_to_pool` pings the connection before reuse (pool/connection.rs:314), and that ping waits behind the running statement. If the SELECT itself waits, one socket takes the whole pool: ``` test ...::review_authority_cap::retries_whose_select_waits_stay_within_the_authority_cap ... FAILED one socket's abandoned authority reads hold 8 of 8 pool connections; the cap promises at most 4 ``` The test uses a rollback-journal file whose lock another connection holds. In production WAL the write lock does not block the SELECT, so the case needs a read that is slow inside SQLite (slow I/O). That is why this is P3. Fix options: keep awaiting the same attempt rather than starting a new one, or hold the place until the connection has been returned. Or narrow the doc to what the cap actually bounds. **Renewal starvation (asked): no risk.** A renewal is due 60 s after the last slide, and the session lasts 30 days. An active session expires only if every renewal is skipped or fails for about 30 days. One renewal blocks the others for at most busy_timeout 5 s, plus the pool acquire timeout if the pool is exhausted. HTTP requests also renew (`read_session`). No deadline before expiry is needed. **P3-7:** a failed renewal is discarded (`let _ =`). If renewals always fail (a read-only or full disk), nothing logs it. One rate-limited log line would cover this. **Clock skew (asked): none.** `now_seconds()` (SystemTime) and SQLite's `unixepoch()` (unix VFS, gettimeofday) read the same CLOCK_REALTIME and both truncate to whole seconds. SQLite takes "now" after the busy-handler wait inside the step, so a renewal that queued behind a writer judges the session at the moment it writes. A wall-clock step backward affects both sides equally, so the two cannot disagree. The only fake clock is `test_http_time`, which applies to HTTP in tests only. **Cap vs non-authority readers, deadlock with a renewal: holds.** A renewal holds 1 place and 1 connection, so authority work holds at most 4 connections plus whatever P3-6 leaks. The writer that a renewal waits on never needs an authority place to finish (`require_session_tx` uses its own transaction). A nested `live()` inside an `authorized()` operation takes its own place, independent of the tick read. No cycle. **P3-8 fairness at the cap.** The semaphore is FIFO, but an attempt that misses its 25 ms deadline leaves the queue and rejoins at the back after its pause. Every logout wakes **every** socket (the revocation watch is server-wide), so N sockets queue on 4 places. That is half the herd throughput of the old 8-connection path. At about 100 µs per read this is about 2.5 ms for 100 sockets, so it is harmless. It only matters when reads take milliseconds. The backoff also adds up to 100 ms after a stall ends (before: 10 ms). That follows the spec, but if latency comes first the 100 ms ceiling could come down now that the cap bounds the cost. **Shutdown of the background task: holds.** The renewal task is detached and never joined. When the runtime drops, the task is dropped; `RenewalHold` returns the place and clears the flag. The UPDATE is atomic and idempotent, so an interrupted one is harmless. Production never calls `pool.close()`, so nothing waits on it. ### Gate `scripts/verify fast` on 0faea9c3d (load ~15 at start). `test` is red only because of the new review test (508 passed, 1 failed): ``` PT_INTERP: absent; size: 21086416 bytes; cap: 21086416 bytes; delta: +0 bytes PT_INTERP: absent; size: 19317848 bytes; cap: 19317848 bytes; delta: +0 bytes +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | FAIL (101) | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ exit=1 ``` No perf-VM runs in this review. **MERGE: 0 P0, 0 P1, 0 P2, 4 P3 (P3-6 with a failing test, which can follow up after merge or be fixed before).**
kayg commented 2026-10-18 06:38:47 +00:00
Author
Owner
Copy link

Release 2 deployed to production at 14:08 IST: release-prod-live 103815e70, server sha256 8608623e…, MainPID 86026, /healthz ok. Backup /var/backups/infraternal/20261018-083808-103815e70…. CA is locked after the restart until the owner unlocks it.

Release 2 deployed to production at 14:08 IST: release-prod-live 103815e70, server sha256 8608623e…, MainPID 86026, /healthz ok. Backup /var/backups/infraternal/20261018-083808-103815e70…. CA is locked after the restart until the owner unlocks it.
kayg commented 2026-10-20 22:05:13 +00:00
Author
Owner
Copy link

Start: branch authority-cap-hold, base origin/release-prod-live bec4eb7dd2. Read #240 and parent #146 history; continuing the open P3 cap finding. Next: cherry-pick only the test from 0faea9c3d, confirm it fails on this base, then implement the smallest connection-lifetime fix.

Start: branch `authority-cap-hold`, base `origin/release-prod-live` bec4eb7dd29b0391567662289b144a8accd42da6. Read #240 and parent #146 history; continuing the open P3 cap finding. Next: cherry-pick only the test from 0faea9c3d, confirm it fails on this base, then implement the smallest connection-lifetime fix.
kayg commented 2026-10-20 22:22:07 +00:00
Author
Owner
Copy link

Finding P3-6 reproduced on authority-cap-hold at 12eeafe81: retries_whose_select_waits_stay_within_the_authority_cap fails after 1.32 s with one socket's abandoned authority reads hold 8 of 8 pool connections; the cap promises at most 4. The assertion is in crates/infraternal-server/src/auth/socket_tests/review_authority_cap.rs:85; crates/infraternal-server/src/websocket.rs:2383-2403 places the permit inside the future that the 25 ms timeout drops, while the SQLite SELECT remains active. A repeat is queued to save and attach the raw log.

Finding P3-6 reproduced on `authority-cap-hold` at `12eeafe81`: `retries_whose_select_waits_stay_within_the_authority_cap` fails after 1.32 s with `one socket's abandoned authority reads hold 8 of 8 pool connections; the cap promises at most 4`. The assertion is in `crates/infraternal-server/src/auth/socket_tests/review_authority_cap.rs:85`; `crates/infraternal-server/src/websocket.rs:2383-2403` places the permit inside the future that the 25 ms timeout drops, while the SQLite SELECT remains active. A repeat is queued to save and attach the raw log.
kayg commented 2026-10-20 22:22:43 +00:00
Author
Owner
Copy link

Raw repeat attached. The same test is red on the release base: 8/8 pool connections busy at 600 ms, permitted maximum 4; exit 101. red-authority-cap.log

Raw repeat attached. The same test is red on the release base: 8/8 pool connections busy at 600 ms, permitted maximum 4; exit 101. [red-authority-cap.log](https://git.kayg.org/attachments/038ce516-9852-4372-9fb2-9b7c79f60ce1)
kayg commented 2026-10-20 22:23:09 +00:00
Author
Owner
Copy link

Step complete: test-only cherry-pick 36d4bb58edddc5fc582cbbf00cf7ceef3c05d29f is pushed on origin/authority-cap-hold. Its tree is unchanged from the requested test commit; the message now records D243 and ends with Refs: #240. Red evidence remains 8/8 pooled connections busy at 600 ms versus a cap of 4; raw run.

Step complete: test-only cherry-pick `36d4bb58edddc5fc582cbbf00cf7ceef3c05d29f` is pushed on `origin/authority-cap-hold`. Its tree is unchanged from the requested test commit; the message now records D243 and ends with `Refs: #240`. Red evidence remains 8/8 pooled connections busy at 600 ms versus a cap of 4; [raw run](https://git.kayg.org/attachments/038ce516-9852-4372-9fb2-9b7c79f60ce1).
kayg commented 2026-10-20 22:28:24 +00:00
Author
Owner
Copy link

Finding P3-6 fix validation (working tree, test commit 36d4bb58e): the focused regression passes, 1/1, with the assertion that busy pooled connections stay at or below 4 of 8 after the 600 ms SELECT wait. The permit is now held by the spawned query through Auth::live_expiry; dropping the timed caller detaches that query. green-authority-cap.log

Finding P3-6 fix validation (working tree, test commit `36d4bb58e`): the focused regression passes, 1/1, with the assertion that busy pooled connections stay at or below 4 of 8 after the 600 ms SELECT wait. The permit is now held by the spawned query through `Auth::live_expiry`; dropping the timed caller detaches that query. [green-authority-cap.log](https://git.kayg.org/attachments/64c48b59-396c-4e3f-a1f8-de9ca99f2b4e)
kayg commented 2026-10-20 22:45:41 +00:00
Author
Owner
Copy link

Gate finding at test commit 36d4bb58e plus the uncommitted fix: the unfiltered cargo test -p infraternal-server --locked run completed with 375 passed, 2 failed, 25 ignored. The cap regression and prior #240 retry tests passed. Two review_subscription_refusal cases at crates/infraternal-server/src/auth/socket_tests/review_subscription_refusal.rs:177 received plugin unavailable where they expect mesh unavailable. I’m rerunning these cases in isolation and will compare with the release base if they reproduce. Full server test log

Gate finding at test commit `36d4bb58e` plus the uncommitted fix: the unfiltered `cargo test -p infraternal-server --locked` run completed with 375 passed, 2 failed, 25 ignored. The cap regression and prior #240 retry tests passed. Two `review_subscription_refusal` cases at `crates/infraternal-server/src/auth/socket_tests/review_subscription_refusal.rs:177` received `plugin unavailable` where they expect `mesh unavailable`. I’m rerunning these cases in isolation and will compare with the release base if they reproduce. [Full server test log](https://git.kayg.org/attachments/69f01b7c-1b66-443e-b761-b7b286e504bd)
kayg commented 2026-10-20 22:56:13 +00:00
Author
Owner
Copy link

The corrected workspace-equivalent server run passed with remote enabled: cargo test -p infraternal-server --features remote --locked — 615 library tests passed, plus all integration and doc-test binaries; the cap regression, prior authority retry tests and both review_subscription_refusal cases passed. The earlier two failures were only from running the crate with its default feature set (remote disabled), while those tests expect remote-enabled behavior. Full output: server-tests-remote.log.

The corrected workspace-equivalent server run passed with `remote` enabled: `cargo test -p infraternal-server --features remote --locked` — 615 library tests passed, plus all integration and doc-test binaries; the cap regression, prior authority retry tests and both `review_subscription_refusal` cases passed. The earlier two failures were only from running the crate with its default feature set (remote disabled), while those tests expect remote-enabled behavior. Full output: [server-tests-remote.log](https://git.kayg.org/attachments/701d92a5-362c-4587-9835-24a8d5ea40a0).
kayg commented 2026-10-20 23:13:55 +00:00
Author
Owner
Copy link

Perf measurement setup finding: the host-linked x86_64 harness binary transferred with matching SHA-256 101f58116c3edba61805a4ad21b3001d5b30d17780fb580900403e729eb0c088, but the perf VM returned cannot execute: required file not found; ldd shows its interpreter under /nix/store/.../ld-linux-x86-64.so.2, which is absent on the VM. I am rebuilding the before/after harness as static musl binaries with the production target recipe, then I will measure there.

Perf measurement setup finding: the host-linked x86_64 harness binary transferred with matching SHA-256 `101f58116c3edba61805a4ad21b3001d5b30d17780fb580900403e729eb0c088`, but the perf VM returned `cannot execute: required file not found`; `ldd` shows its interpreter under `/nix/store/.../ld-linux-x86-64.so.2`, which is absent on the VM. I am rebuilding the before/after harness as static musl binaries with the production target recipe, then I will measure there.
kayg commented 2026-10-20 23:27:22 +00:00
Author
Owner
Copy link

Pre-fix perf baseline on the 4-vCPU perf VM (load average 0.00; 5,870 MiB available), using the production-profile static x86_64 harness and three rounds of 5,000 echoes: p50 699.4 / 705.3 / 688.5 µs; p99 3,861.7 / 2,634.3 / 3,575.0 µs. No closes in 15,000 samples. Full output: perf-before.log. The fixed binary is building now for the matching comparison.

Pre-fix perf baseline on the 4-vCPU perf VM (load average 0.00; 5,870 MiB available), using the production-profile static x86_64 harness and three rounds of 5,000 echoes: p50 699.4 / 705.3 / 688.5 µs; p99 3,861.7 / 2,634.3 / 3,575.0 µs. No closes in 15,000 samples. Full output: [perf-before.log](https://git.kayg.org/attachments/86647e36-a709-4979-99fe-5697132af25f). The fixed binary is building now for the matching comparison.
kayg commented 2026-10-20 23:41:55 +00:00
Author
Owner
Copy link

The first fixed-path measurement exposed a latency regression at essentially idle VM load (0.00): p50 904.3 / 861.7 / 1,095.6 µs and p99 6,915.7 / 6,096.1 / 8,643.4 µs, versus pre-fix p50 699.4 / 705.3 / 688.5 and p99 3,861.7 / 2,634.3 / 3,575.0. The three post-fix rounds had no closes. The always-spawned query task adds a scheduler hop to every fast check. I am changing the fast path to await inline and detach only after the per-attempt deadline. Full output: perf-after.log.

The first fixed-path measurement exposed a latency regression at essentially idle VM load (0.00): p50 904.3 / 861.7 / 1,095.6 µs and p99 6,915.7 / 6,096.1 / 8,643.4 µs, versus pre-fix p50 699.4 / 705.3 / 688.5 and p99 3,861.7 / 2,634.3 / 3,575.0. The three post-fix rounds had no closes. The always-spawned query task adds a scheduler hop to every fast check. I am changing the fast path to await inline and detach only after the per-attempt deadline. Full output: [perf-after.log](https://git.kayg.org/attachments/52de8045-6c2d-4603-a634-5122b75ea1f8).
kayg commented 2026-10-20 23:52:04 +00:00
Author
Owner
Copy link

A second fixed implementation, which awaited normal SELECTs inline and detached only after a per-query deadline, still regressed on the same 4-vCPU VM at load 0.00. Three 5,000-sample rounds: p50 881.3 / 972.5 / 918.9 µs (median 918.9); p99 5,225.6 / 6,753.1 / 6,323.0 µs (median 6,323.0). Baseline medians were p50 699.4 and p99 3,575.0 µs. This version adds a per-query timer/select; I am removing that overhead and will remeasure. Full output: perf-conditional-after.log.

A second fixed implementation, which awaited normal SELECTs inline and detached only after a per-query deadline, still regressed on the same 4-vCPU VM at load 0.00. Three 5,000-sample rounds: p50 881.3 / 972.5 / 918.9 µs (median 918.9); p99 5,225.6 / 6,753.1 / 6,323.0 µs (median 6,323.0). Baseline medians were p50 699.4 and p99 3,575.0 µs. This version adds a per-query timer/select; I am removing that overhead and will remeasure. Full output: [perf-conditional-after.log](https://git.kayg.org/attachments/ff1c9906-e0d8-4350-8269-c26b37b6abe6).
kayg commented 2026-10-20 23:52:41 +00:00
Author
Owner
Copy link

A repeated pre-fix run shows the perf VM's timing shifted since the first baseline, so the earlier comparison was not load-window matched. At 4 vCPUs, load average 0.45, and 5,855 MiB available, the original binary measured p50 864.2 / 861.1 / 924.9 µs and p99 5,698.1 / 4,688.2 / 5,816.2 µs, with zero closes in 15,000 samples. This overlaps the conditional implementation's range and warrants interleaved comparison in one load window. Full output: perf-before-repeat.log.

A repeated pre-fix run shows the perf VM's timing shifted since the first baseline, so the earlier comparison was not load-window matched. At 4 vCPUs, load average 0.45, and 5,855 MiB available, the original binary measured p50 864.2 / 861.1 / 924.9 µs and p99 5,698.1 / 4,688.2 / 5,816.2 µs, with zero closes in 15,000 samples. This overlaps the conditional implementation's range and warrants interleaved comparison in one load window. Full output: [perf-before-repeat.log](https://git.kayg.org/attachments/bb75a062-a2b5-4b4d-a967-463cf547ca1f).
kayg commented 2026-10-20 23:53:43 +00:00
Author
Owner
Copy link

The interleaved comparison resolves the earlier apparent regression, which coincided with a perf-VM speed shift. In one locked run on the 4-vCPU VM (start load average 0.59, 5,844 MiB available), three 5,000-sample rounds per binary had zero closes. Baseline p50/p99: 819.2 / 4,475.9 µs medians; fixed p50/p99: 760.5 / 4,099.3 µs medians. Individual baseline p50/p99 were 819.2/4,475.9, 751.5/3,302.5, 848.3/4,747.1; fixed were 720.2/4,099.3, 760.5/3,626.2, 845.9/4,705.7. The measured fast path has no latency regression. Full alternating output: perf-paired.log.

The interleaved comparison resolves the earlier apparent regression, which coincided with a perf-VM speed shift. In one locked run on the 4-vCPU VM (start load average 0.59, 5,844 MiB available), three 5,000-sample rounds per binary had zero closes. Baseline p50/p99: 819.2 / 4,475.9 µs medians; fixed p50/p99: 760.5 / 4,099.3 µs medians. Individual baseline p50/p99 were 819.2/4,475.9, 751.5/3,302.5, 848.3/4,747.1; fixed were 720.2/4,099.3, 760.5/3,626.2, 845.9/4,705.7. The measured fast path has no latency regression. Full alternating output: [perf-paired.log](https://git.kayg.org/attachments/9af715d6-be6d-469c-bc2e-fa2f4fbfc07f).
kayg commented 2026-10-20 23:55:17 +00:00
Author
Owner
Copy link

Clippy finding while checking the remote-feature server test configuration: cargo clippy -p infraternal-server --all-targets --features remote --locked -- -D warnings exits 101 because crates/infraternal-agent/src/plugins.rs:123 and :133 trigger clippy::unnecessary_wraps. This code is outside the three-file fix and the feature-specific server tests pass; the server's default-feature clippy gate is running separately. Full output: clippy-remote-feature.log.

Clippy finding while checking the `remote`-feature server test configuration: `cargo clippy -p infraternal-server --all-targets --features remote --locked -- -D warnings` exits 101 because `crates/infraternal-agent/src/plugins.rs:123` and `:133` trigger `clippy::unnecessary_wraps`. This code is outside the three-file fix and the feature-specific server tests pass; the server's default-feature clippy gate is running separately. Full output: [clippy-remote-feature.log](https://git.kayg.org/attachments/f3cfb002-18b3-4737-a2fb-ae2e8e2bd34f).
kayg commented 2026-10-21 00:09:15 +00:00
Author
Owner
Copy link

Final-source server validation completed at test commit 36d4bb58e plus the uncommitted three-file fix. cargo test -p infraternal-server --features remote --locked passed: 615 passed, 0 failed, 52 ignored; 37 integration/doc-test binaries also passed. This includes retries_whose_select_waits_stay_within_the_authority_cap, both existing authority retry tests and both remote-enabled refusal cases. Default-feature server clippy passed with -D warnings. The optional remote-feature clippy run separately reports two unrelated unnecessary_wraps lints in crates/infraternal-agent/src/plugins.rs:123,133 (logged above). Outputs: server tests, server clippy.

Final-source server validation completed at test commit `36d4bb58e` plus the uncommitted three-file fix. `cargo test -p infraternal-server --features remote --locked` passed: 615 passed, 0 failed, 52 ignored; 37 integration/doc-test binaries also passed. This includes `retries_whose_select_waits_stay_within_the_authority_cap`, both existing authority retry tests and both remote-enabled refusal cases. Default-feature server clippy passed with `-D warnings`. The optional remote-feature clippy run separately reports two unrelated `unnecessary_wraps` lints in `crates/infraternal-agent/src/plugins.rs:123,133` (logged above). Outputs: [server tests](https://git.kayg.org/attachments/1e6157d3-0c88-4233-8502-910c12f89b80), [server clippy](https://git.kayg.org/attachments/7a35f431-502e-4ab2-b9c8-086ce4f43768).
kayg commented 2026-10-21 00:09:28 +00:00
Author
Owner
Copy link

Correction to my previous count: there were 19 integration-test binaries plus one doc-test binary (20 non-library executables), not 37. Together they report 82 passed, 0 failed, 1 ignored; the library reported 615 passed, 0 failed, 52 ignored.

Correction to my previous count: there were 19 integration-test binaries plus one doc-test binary (20 non-library executables), not 37. Together they report 82 passed, 0 failed, 1 ignored; the library reported 615 passed, 0 failed, 52 ignored.
kayg commented 2026-10-21 00:09:57 +00:00
Author
Owner
Copy link

Production fix committed and pushed on authority-cap-hold: 8e58fd16a. The red-first regression failed before the fix at 8/8 pooled connections against the cap of 4; the final remote-enabled server suite passed 615 library tests (0 failed, 52 ignored) and 82 integration tests (0 failed, 1 ignored), plus doc tests. Default-feature server clippy and formatting passed. Paired perf VM medians: p50/p99 819.2/4475.9 µs before, 760.5/4099.3 µs after (three 5,000-echo rounds each, zero closes). Full scripts/verify fast is running now at the pushed head.

Production fix committed and pushed on `authority-cap-hold`: `8e58fd16a`. The red-first regression failed before the fix at 8/8 pooled connections against the cap of 4; the final remote-enabled server suite passed 615 library tests (0 failed, 52 ignored) and 82 integration tests (0 failed, 1 ignored), plus doc tests. Default-feature server clippy and formatting passed. Paired perf VM medians: p50/p99 819.2/4475.9 µs before, 760.5/4099.3 µs after (three 5,000-echo rounds each, zero closes). Full `scripts/verify fast` is running now at the pushed head.
kayg commented 2026-10-21 00:57:10 +00:00
Author
Owner
Copy link

The branch-head scripts/verify fast cargo-deny row reports the pre-acknowledged RUSTSEC-2026-0382 advisory for rustls-webpki 0.103.15; bans, licenses and sources pass. This matches the brief's note that another job is patching the dependency, so I have not changed dependencies in this minimal production fix. The gate continues through the static architecture builds; exact output will be attached with the final transcript.

The branch-head `scripts/verify fast` cargo-deny row reports the pre-acknowledged `RUSTSEC-2026-0382` advisory for `rustls-webpki 0.103.15`; bans, licenses and sources pass. This matches the brief's note that another job is patching the dependency, so I have not changed dependencies in this minimal production fix. The gate continues through the static architecture builds; exact output will be attached with the final transcript.
kayg commented 2026-10-21 01:07:13 +00:00
Author
Owner
Copy link

The branch-head fast gate's stripped x86_64 static binary is 21,394,064 bytes against the exact 21,386,224-byte D243 cap (+7,840 bytes), so the size row fails despite the brief's expected <2 KB delta. This is above the exact gate ceiling; I am reducing code size without changing the bounded-query behavior, then will rerun the gate. The in-progress verify-fast.log contains the size receipt and will be attached after completion.

The branch-head fast gate's stripped x86_64 static binary is 21,394,064 bytes against the exact 21,386,224-byte D243 cap (+7,840 bytes), so the size row fails despite the brief's expected <2 KB delta. This is above the exact gate ceiling; I am reducing code size without changing the bounded-query behavior, then will rerun the gate. The in-progress `verify-fast.log` contains the size receipt and will be attached after completion.
kayg commented 2026-10-21 01:19:09 +00:00
Author
Owner
Copy link

The first pushed-head scripts/verify fast completed. Workspace tests (including the server suite), clippy, fmt, VT fmt, plugin compile-out and SSH checks passed. The gate returned 1 for the pre-acknowledged RUSTSEC-2026-0382 cargo-deny row and both exact D243 size caps: x86_64 21,394,064 / 21,386,224 (+7,840 bytes); aarch64 19,566,936 / 19,557,992 (+8,944 bytes). Full transcript: verify-fast.log.

Final gate summary (verbatim):

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| cargo-deny                | FAIL (1)     |
| static builds             | FAIL (1)     |
+---------------------------+--------------+
The first pushed-head `scripts/verify fast` completed. Workspace tests (including the server suite), clippy, fmt, VT fmt, plugin compile-out and SSH checks passed. The gate returned 1 for the pre-acknowledged `RUSTSEC-2026-0382` cargo-deny row and both exact D243 size caps: x86_64 21,394,064 / 21,386,224 (+7,840 bytes); aarch64 19,566,936 / 19,557,992 (+8,944 bytes). Full transcript: [verify-fast.log](https://git.kayg.org/attachments/a7cc0b22-1dd4-49b1-966f-c5160d25bc35). Final gate summary (verbatim): ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | cargo-deny | FAIL (1) | | static builds | FAIL (1) | +---------------------------+--------------+ ```
kayg commented 2026-10-21 01:22:20 +00:00
Author
Owner
Copy link

Size-trim follow-up compile finding: the first DetachOnDrop compile failed because Tokio requires the spawned future's output to be Send (websocket.rs:190, E0277). Added the output bound; formatting now passes. Re-running the cap regression next.

Size-trim follow-up compile finding: the first `DetachOnDrop` compile failed because Tokio requires the spawned future's output to be `Send` (`websocket.rs:190`, E0277). Added the output bound; formatting now passes. Re-running the cap regression next.
kayg commented 2026-10-21 01:23:06 +00:00
Author
Owner
Copy link

Release 9.2 integration is running on release-9-2 from 411485164; progress, interplay findings and final artifact/gate receipts are tracked on #24. No deploy. #240 inclusion remains conditional on its completed finish record after #250/#243 are integrated and gated.

Release 9.2 integration is running on release-9-2 from 411485164; progress, interplay findings and final artifact/gate receipts are tracked on #24. No deploy. #240 inclusion remains conditional on its completed finish record after #250/#243 are integrated and gated.
kayg commented 2026-10-21 01:42:41 +00:00
Author
Owner
Copy link

Size-trim step is in the working tree based on 8e58fd16a: DetachOnDrop leaves successful queries inline and transfers only a timed-out query into a task with its authority place. The focused cap regression passes. Full remote-enabled server suite: 615 unit tests passed, 0 failed, 52 ignored; 82 integration tests passed, 0 failed, 1 ignored; doc tests passed (0). Evidence: server-tests-trim.log. Clippy, perf and size gates remain.

Size-trim step is in the working tree based on 8e58fd16a: `DetachOnDrop` leaves successful queries inline and transfers only a timed-out query into a task with its authority place. The focused cap regression passes. Full remote-enabled server suite: 615 unit tests passed, 0 failed, 52 ignored; 82 integration tests passed, 0 failed, 1 ignored; doc tests passed (0). Evidence: [server-tests-trim.log](https://git.kayg.org/attachments/128cd9cd-0ce6-4f3a-a809-cca3e72eb639). Clippy, perf and size gates remain.
kayg commented 2026-10-21 02:00:15 +00:00
Author
Owner
Copy link

The first perf-VM paired run after the size trim returned baseline median p50/p99 694.9/1557.2 us and trim 720.4/2018.3 us (three 5,000-echo rounds each, 0 closes). Load rose from 0.00 to 0.79 during the 25-second run, so this is an apparent regression with a time-order confound. I’m repeating in a reversed/interleaved order before accepting the comparison. Receipt: perf-trim-paired.log.

The first perf-VM paired run after the size trim returned baseline median p50/p99 694.9/1557.2 us and trim 720.4/2018.3 us (three 5,000-echo rounds each, 0 closes). Load rose from 0.00 to 0.79 during the 25-second run, so this is an apparent regression with a time-order confound. I’m repeating in a reversed/interleaved order before accepting the comparison. Receipt: [perf-trim-paired.log](https://git.kayg.org/attachments/1f753de9-0360-4a6e-94ab-d88e4e43140e).
kayg commented 2026-10-21 02:01:35 +00:00
Author
Owner
Copy link

Second perf-VM run used 10,000 echoes per round in trim/baseline/baseline/trim/trim/baseline order (4 vCPU, 7,879 MiB RAM; 1-minute load rose 0.49 to 1.08; no closes). Median baseline p50/p99 was 678.2/1996.9 us; trim was 724.8/2030.2 us, a measured +6.9% p50 and +1.7% p99. I’m comparing the earlier direct-select implementation in the same VM window to separate wrapper overhead from run variance before selecting the final implementation. Receipt: perf-trim-paired-10k.log.

Second perf-VM run used 10,000 echoes per round in trim/baseline/baseline/trim/trim/baseline order (4 vCPU, 7,879 MiB RAM; 1-minute load rose 0.49 to 1.08; no closes). Median baseline p50/p99 was 678.2/1996.9 us; trim was 724.8/2030.2 us, a measured +6.9% p50 and +1.7% p99. I’m comparing the earlier direct-select implementation in the same VM window to separate wrapper overhead from run variance before selecting the final implementation. Receipt: [perf-trim-paired-10k.log](https://git.kayg.org/attachments/1da7e973-4e5c-43a1-9b3c-b6bc114ca2e7).
kayg commented 2026-10-21 02:01:39 +00:00
Author
Owner
Copy link

Correction: the 10,000-echo trim measurement receipt is perf-trim-paired-10k.log.

Correction: the 10,000-echo trim measurement receipt is [perf-trim-paired-10k.log](https://git.kayg.org/attachments/c1b6adf0-f829-41fa-b6db-dadd12edf1aa).
kayg commented 2026-10-21 02:02:56 +00:00
Author
Owner
Copy link

Perf-VM follow-up used three 10,000-echo rounds for each implementation, interleaved baseline/direct-select/trim variants (4 vCPU, 7,879 MiB; load 0.97 to 1.32; 0 closes). Median p50/p99: baseline 488.6/1030.8 us, direct-select 478.3/1009.7 us, trim 481.9/1003.4 us. The trim is 1.4% lower p50 and 2.7% lower p99 than baseline, and within 0.8% p50 and 0.6% p99 of the earlier direct-select implementation. Run-to-run values drifted during the window; the three-way sequence shows no consistent regression. Receipt: perf-three-way-10k.log.

Perf-VM follow-up used three 10,000-echo rounds for each implementation, interleaved baseline/direct-select/trim variants (4 vCPU, 7,879 MiB; load 0.97 to 1.32; 0 closes). Median p50/p99: baseline 488.6/1030.8 us, direct-select 478.3/1009.7 us, trim 481.9/1003.4 us. The trim is 1.4% lower p50 and 2.7% lower p99 than baseline, and within 0.8% p50 and 0.6% p99 of the earlier direct-select implementation. Run-to-run values drifted during the window; the three-way sequence shows no consistent regression. Receipt: [perf-three-way-10k.log](https://git.kayg.org/attachments/bf88941a-185c-4457-be2e-44e2da5eff12).
kayg commented 2026-10-21 02:03:17 +00:00
Author
Owner
Copy link

Self-review finding: the size trim changed the attempt from the prior timeout_at + post-result Instant::now() <= attempt_deadline check to timeout(read_timeout, read). That removed the explicit late-result guard in crates/infraternal-server/src/websocket.rs; Tokio documents that timeout cannot preempt a future that does not yield. I’m restoring the monotonic deadline check so a result first observed after its attempt bound retries as before.

Self-review finding: the size trim changed the attempt from the prior `timeout_at` + post-result `Instant::now() <= attempt_deadline` check to `timeout(read_timeout, read)`. That removed the explicit late-result guard in `crates/infraternal-server/src/websocket.rs`; Tokio documents that timeout cannot preempt a future that does not yield. I’m restoring the monotonic deadline check so a result first observed after its attempt bound retries as before.
kayg commented 2026-10-21 02:23:51 +00:00
Author
Owner
Copy link

Committed and pushed 4f54f4c49 (D243 size trim): successful reads stay inline; timed-out queries carry their read place into a task, with the explicit late-result deadline check preserved. Focused cap regression passes. Full remote-enabled server suite: 615 unit + 82 integration tests passed, 0 failed, 53 ignored across unit/integration binaries; clippy and fmt pass. Receipts: cap test, server suite, clippy. Final static-size gate and performance measurement on this exact commit are pending.

Committed and pushed 4f54f4c49 (D243 size trim): successful reads stay inline; timed-out queries carry their read place into a task, with the explicit late-result deadline check preserved. Focused cap regression passes. Full remote-enabled server suite: 615 unit + 82 integration tests passed, 0 failed, 53 ignored across unit/integration binaries; clippy and fmt pass. Receipts: [cap test](https://git.kayg.org/attachments/fc3b24c8-7705-44c5-a2cd-8475a6b48a7d), [server suite](https://git.kayg.org/attachments/0ded2f8a-f21c-4073-aa58-18ca0db09958), [clippy](https://git.kayg.org/attachments/d62b0c41-8910-4031-8faa-1c6ee1db2734). Final static-size gate and performance measurement on this exact commit are pending.
kayg commented 2026-10-21 02:45:02 +00:00
Author
Owner
Copy link

D243 size finding on branch head 4f54f4c49: the final scripts/verify fast x86_64 static build is 21,393,616 bytes against 21,386,224 (delta +7,392). The aarch64 build is still running. The trim reduced the first fix's x86_64 overage by 448 bytes, so a further code-size reduction is required before completion.

D243 size finding on branch head 4f54f4c49: the final `scripts/verify fast` x86_64 static build is 21,393,616 bytes against 21,386,224 (delta +7,392). The aarch64 build is still running. The trim reduced the first fix's x86_64 overage by 448 bytes, so a further code-size reduction is required before completion.
kayg commented 2026-10-21 02:49:26 +00:00
Author
Owner
Copy link

Final scripts/verify fast on 4f54f4c49 completed with static size still over D243: x86_64 21,393,616 vs 21,386,224 (+7,392); aarch64 19,566,888 vs 19,557,992 (+8,896). The cargo-deny row also reports the already known RUSTSEC-2026-0382 on rustls-webpki 0.103.15, assigned to the other patch job. fmt, CLI compile-out, clippy, SSH helper, workspace tests and inode-reuse fixture pass. Full receipt: verify-fast-final.log. I’m reducing the spawn task’s monomorphized code before the next gate.

Final `scripts/verify fast` on 4f54f4c49 completed with static size still over D243: x86_64 21,393,616 vs 21,386,224 (+7,392); aarch64 19,566,888 vs 19,557,992 (+8,896). The `cargo-deny` row also reports the already known RUSTSEC-2026-0382 on rustls-webpki 0.103.15, assigned to the other patch job. fmt, CLI compile-out, clippy, SSH helper, workspace tests and inode-reuse fixture pass. Full receipt: [verify-fast-final.log](https://git.kayg.org/attachments/55298b67-3a60-4b05-b0f9-76dfc346948b). I’m reducing the spawn task’s monomorphized code before the next gate.
kayg commented 2026-10-21 03:46:35 +00:00
Author
Owner
Copy link

The boxed-query cancellation candidate reduces the earlier overage but still misses both exact D243 caps: x86_64 21,388,304 bytes (+2,080) and aarch64 19,560,280 bytes (+2,288). Receipts: x86_64, aarch64. I’m replacing the manual permit hold with an owned semaphore permit carried by the query, which should remove the custom permit wrapper.

The boxed-query cancellation candidate reduces the earlier overage but still misses both exact D243 caps: x86_64 21,388,304 bytes (+2,080) and aarch64 19,560,280 bytes (+2,288). Receipts: [x86_64](https://git.kayg.org/attachments/3d504d3f-535c-43d3-9050-89ca71a7fa08), [aarch64](https://git.kayg.org/attachments/8c0e676a-868c-4ca7-8080-82ddf3cb4480). I’m replacing the manual permit hold with an owned semaphore permit carried by the query, which should remove the custom permit wrapper.
kayg commented 2026-10-21 03:54:33 +00:00
Author
Owner
Copy link

Release 9.2 leaves #240 for the next release: completion marker absent at the integration checkpoint and still absent after the full first-two-fix gate. Release head c996c8d2bd; artifact hashes and final gate receipts on #24. No deploy.

Release 9.2 leaves #240 for the next release: completion marker absent at the integration checkpoint and still absent after the full first-two-fix gate. Release head c996c8d2bd5d54ee3f66e0b7707c22c89b4cddac; artifact hashes and final gate receipts on #24. No deploy.
kayg commented 2026-10-21 04:07:51 +00:00
Author
Owner
Copy link

Experiment update: replacing the boxed unit future with a named spawned query task and an owned semaphore permit produced x86_64 21,393,648 bytes (+7,424), so that form is rejected; receipt: size-detached-type-x86.log. I’m returning to the erased unit-task form and testing a select! deadline wrapper to reduce the remaining ~2 KB while retaining the strict post-result bound.

Experiment update: replacing the boxed unit future with a named spawned query task and an owned semaphore permit produced x86_64 21,393,648 bytes (+7,424), so that form is rejected; receipt: [size-detached-type-x86.log](https://git.kayg.org/attachments/098601b0-7bbf-4df8-8c3d-4ee68e040561). I’m returning to the erased unit-task form and testing a `select!` deadline wrapper to reduce the remaining ~2 KB while retaining the strict post-result bound.
kayg commented 2026-10-21 04:29:03 +00:00
Author
Owner
Copy link

Size finding: the unit-output detach helper builds to 21,388,272 bytes on x86_64 against the exact 21,386,224-byte D243 cap (+2,048). Receipt: size-unit-detach-x86.txt. I am testing a select-based deadline path that moves only a timed-out query into this shared unit-output task.

Size finding: the unit-output detach helper builds to 21,388,272 bytes on x86_64 against the exact 21,386,224-byte D243 cap (+2,048). Receipt: [size-unit-detach-x86.txt](https://git.kayg.org/attachments/0a66b523-1e9e-4caf-a9fe-615f7a56acea). I am testing a select-based deadline path that moves only a timed-out query into this shared unit-output task.
kayg commented 2026-10-21 05:04:41 +00:00
Author
Owner
Copy link

Size finding on the smallest tested timeout-task form: x86_64 is 21,388,272 bytes (+2,048 over cap); aarch64 is 19,560,120 bytes (+2,128). Both are about 2 KB and below the 16 KB growth threshold, but the exact D243 caps still require an update for the branch image. Receipt: size-unit-detach-both.txt. I am testing a guard that owns only the read semaphore to reduce the remaining bytes before finalizing the cap ratchet.

Size finding on the smallest tested timeout-task form: x86_64 is 21,388,272 bytes (+2,048 over cap); aarch64 is 19,560,120 bytes (+2,128). Both are about 2 KB and below the 16 KB growth threshold, but the exact D243 caps still require an update for the branch image. Receipt: [size-unit-detach-both.txt](https://git.kayg.org/attachments/71654ab7-beec-4ea9-b208-3c6593e67532). I am testing a guard that owns only the read semaphore to reduce the remaining bytes before finalizing the cap ratchet.
kayg commented 2026-10-21 05:10:29 +00:00
Author
Owner
Copy link

The smaller guard candidate did not help: owning Arc measures +2,304 bytes on x86, 256 bytes larger than the Arc guard. I am reverting it. Receipt: size-semaphore-guard-x86.txt.

The smaller guard candidate did not help: owning Arc<Semaphore> measures +2,304 bytes on x86, 256 bytes larger than the Arc<AuthorityLimits> guard. I am reverting it. Receipt: [size-semaphore-guard-x86.txt](https://git.kayg.org/attachments/82648528-e20e-4eb2-b893-0726e6a521d5).
kayg commented 2026-10-21 05:16:17 +00:00
Author
Owner
Copy link

Full server suite passed on the final query-handoff implementation: 615 library tests passed, 0 failed, 52 ignored; 82 integration tests passed, 0 failed, 1 ignored; doc tests 0/0. The #240 retries_whose_select_waits_stay_within_the_authority_cap regression passed in the run. Receipt: server-tests-final.log.

Full server suite passed on the final query-handoff implementation: 615 library tests passed, 0 failed, 52 ignored; 82 integration tests passed, 0 failed, 1 ignored; doc tests 0/0. The #240 `retries_whose_select_waits_stay_within_the_authority_cap` regression passed in the run. Receipt: [server-tests-final.log](https://git.kayg.org/attachments/402093ab-0c67-4c66-b2ee-124bd7105cca).
kayg commented 2026-10-21 05:16:44 +00:00
Author
Owner
Copy link

Default-feature server clippy passed: cargo clippy --locked -p infraternal-server --all-targets -- -D warnings. Receipt: clippy-server-final.log.

Default-feature server clippy passed: `cargo clippy --locked -p infraternal-server --all-targets -- -D warnings`. Receipt: [clippy-server-final.log](https://git.kayg.org/attachments/be012887-63a5-4091-8d6c-51646bf340ab).
kayg commented 2026-10-21 05:28:55 +00:00
Author
Owner
Copy link

scripts/verify iterate completed. Repository artifact, deployment fixture, fmt, VT native fmt, CLI compile-out, clippy, SSH runtime helper, workspace tests and SSH inode reuse fixture passed. The only reported failure is the known RUSTSEC-2026-0382 cargo-deny advisory assigned to the other patch job. Raw output: verify-iterate.log.

`scripts/verify iterate` completed. Repository artifact, deployment fixture, fmt, VT native fmt, CLI compile-out, clippy, SSH runtime helper, workspace tests and SSH inode reuse fixture passed. The only reported failure is the known `RUSTSEC-2026-0382` cargo-deny advisory assigned to the other patch job. Raw output: [verify-iterate.log](https://git.kayg.org/attachments/4dd17c21-9e73-41c4-abef-70ae1cc8ce0e).
kayg commented 2026-10-21 05:40:37 +00:00
Author
Owner
Copy link

Final paired perf-VM benchmark passed with no closures. Six interleaved runs used 10,000 echoes each. On infraternal-perf-test (4 vCPU, 7,879 MiB RAM; 1-minute load average 0.25 before and 1.00 after), median baseline p50/p99 was 716.8/1,645.3 µs; candidate was 714.4/1,601.9 µs (-0.3% / -2.6%). Receipt: perf-final-paired-10k.log.

Final paired perf-VM benchmark passed with no closures. Six interleaved runs used 10,000 echoes each. On infraternal-perf-test (4 vCPU, 7,879 MiB RAM; 1-minute load average 0.25 before and 1.00 after), median baseline p50/p99 was 716.8/1,645.3 µs; candidate was 714.4/1,601.9 µs (-0.3% / -2.6%). Receipt: [perf-final-paired-10k.log](https://git.kayg.org/attachments/5974f1dc-1e60-4b6a-9068-deb237d1e42d).
kayg commented 2026-10-21 05:54:49 +00:00
Author
Owner
Copy link

Finished on authority-cap-hold, head d6efb0f04c4b90f9a1ca76b7f9606c6c9321a082 (pushed; clean worktree). No deployment.

The timeout retry regression passes; the existing #240 slow-check socket tests remain green. The server suite passed (615 unit tests and 82 integration tests). The final access-check loop measured baseline p50/p99 716.8/1,645.3 µs and candidate 714.4/1,601.9 µs; no regression. Static stripped sizes: x86_64 21,388,272 bytes (+2,048); aarch64 19,560,120 bytes (+2,128). Both match the updated caps. Full gate log: verify-fast-final-head.log.

scripts/verify fast final Rust gate output:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| cargo-deny                | FAIL (1)     |
| static builds             | PASS         |
+---------------------------+--------------+

The only failing row is the known RUSTSEC-2026-0382 advisory for rustls-webpki 0.103.15, being patched by another job.

Finished on `authority-cap-hold`, head `d6efb0f04c4b90f9a1ca76b7f9606c6c9321a082` (pushed; clean worktree). No deployment. The timeout retry regression passes; the existing #240 slow-check socket tests remain green. The server suite passed (615 unit tests and 82 integration tests). The final access-check loop measured baseline p50/p99 716.8/1,645.3 µs and candidate 714.4/1,601.9 µs; no regression. Static stripped sizes: x86_64 21,388,272 bytes (+2,048); aarch64 19,560,120 bytes (+2,128). Both match the updated caps. Full gate log: [verify-fast-final-head.log](https://git.kayg.org/attachments/4f4c257d-6d14-4c7b-b533-4b52b80b7578). `scripts/verify fast` final Rust gate output: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | cargo-deny | FAIL (1) | | static builds | PASS | +---------------------------+--------------+ ``` The only failing row is the known `RUSTSEC-2026-0382` advisory for `rustls-webpki 0.103.15`, being patched by another job.
kayg commented 2026-10-21 05:58:19 +00:00
Author
Owner
Copy link

Start delta review r3 on review-authority-cap-r3, base d6efb0f04c (origin/authority-cap-hold). Scope: 36d4bb58e..d6efb0f04; test-only commits, no deployment. Read all 52 #240 comments and retrieved parent #146 (1,492 comments); continuing the existing cap regressions. Checking query cancellation, permit recovery, deadlines and bounded stalled-read storms against real SQLite.

Start delta review r3 on review-authority-cap-r3, base d6efb0f04c4b90f9a1ca76b7f9606c6c9321a082 (origin/authority-cap-hold). Scope: 36d4bb58e..d6efb0f04; test-only commits, no deployment. Read all 52 #240 comments and retrieved parent #146 (1,492 comments); continuing the existing cap regressions. Checking query cancellation, permit recovery, deadlines and bounded stalled-read storms against real SQLite.
kayg commented 2026-10-21 06:03:12 +00:00
Author
Owner
Copy link

Step 1: 45aceec8d on review-authority-cap-r3. Added a 32-caller full-budget retry storm using explicit runtime time and real SQLite pool exhaustion. All 32 callers fail closed; exactly 4 retained query holds remain after callers finish (Arc count 5 including state), no fifth place becomes available during retries, and all 4 places recover after releasing the connection. Formatting, default-feature server clippy (-D warnings) and all 7 authority-watchdog tests pass. Raw gate receipt will be attached with the final record.

Step 1: 45aceec8d on review-authority-cap-r3. Added a 32-caller full-budget retry storm using explicit runtime time and real SQLite pool exhaustion. All 32 callers fail closed; exactly 4 retained query holds remain after callers finish (Arc count 5 including state), no fifth place becomes available during retries, and all 4 places recover after releasing the connection. Formatting, default-feature server clippy (-D warnings) and all 7 authority-watchdog tests pass. Raw gate receipt will be attached with the final record.
kayg commented 2026-10-21 06:04:11 +00:00
Author
Owner
Copy link

Step 2: 48aec3784 pushed. A second 32-caller storm cancels both running and queued reads, matching the enclosing-future drop used by socket disconnect/shutdown. All 4 places stay held by detached queries, then recover exactly once. Subsequent Denied and closed-pool storage errors preserve all 4 places. Formatting, server clippy (-D warnings) and both new tests pass.

Step 2: 48aec3784 pushed. A second 32-caller storm cancels both running and queued reads, matching the enclosing-future drop used by socket disconnect/shutdown. All 4 places stay held by detached queries, then recover exactly once. Subsequent Denied and closed-pool storage errors preserve all 4 places. Formatting, server clippy (-D warnings) and both new tests pass.
kayg commented 2026-10-21 06:05:41 +00:00
Author
Owner
Copy link

Step 3: 0559a49e3 pushed. Real SQLite rollback-journal lock, pool size 8, configured busy timeout 2 s, 32 callers: exactly 4 acquisitions observed; callers end with 4 places retained; all 4 places recover while the independent exclusive lock is still held. No unlock is needed to drain detached reads. Formatting, server clippy (-D warnings) and all 3 r3 tests pass. These are functional timeout/completion checks on the build host, not performance measurements.

Step 3: 0559a49e3 pushed. Real SQLite rollback-journal lock, pool size 8, configured busy timeout 2 s, 32 callers: exactly 4 acquisitions observed; callers end with 4 places retained; all 4 places recover while the independent exclusive lock is still held. No unlock is needed to drain detached reads. Formatting, server clippy (-D warnings) and all 3 r3 tests pass. These are functional timeout/completion checks on the build host, not performance measurements.
kayg commented 2026-10-21 06:06:58 +00:00
Author
Owner
Copy link

Step 4: 1355aa888 pushed. A real SQLite progress callback and a custom result waker arrange a ready SELECT first observed after its attempt deadline. The access check remains pending, then its retry observes a session deletion and refuses the stale live answer. All 4 new r3 tests, formatting and server clippy pass. Running the new tests on pre-delta 36d4bb58e to verify that they detect the old cap failure, then the full branch-head fast gate.

Step 4: 1355aa888 pushed. A real SQLite progress callback and a custom result waker arrange a ready SELECT first observed after its attempt deadline. The access check remains pending, then its retry observes a session deletion and refuses the stale live answer. All 4 new r3 tests, formatting and server clippy pass. Running the new tests on pre-delta 36d4bb58e to verify that they detect the old cap failure, then the full branch-head fast gate.
kayg commented 2026-10-21 06:09:25 +00:00
Author
Owner
Copy link

Comparison finding: all 4 new tests fail on pre-delta 36d4bb58e, and all 4 pass on review head 1355aa888 (product base d6efb0f04). The pre-delta cancellation, deadline and SQLite-stall cases return all 4 places while queries still own them (expected 0 available). The pre-delta late-result case returns the stale live answer after its attempt deadline. These are fixed by the reviewed delta; no new P0/P1/P2 finding. Raw baseline receipt will accompany the final gate.

Comparison finding: all 4 new tests fail on pre-delta 36d4bb58e, and all 4 pass on review head 1355aa888 (product base d6efb0f04). The pre-delta cancellation, deadline and SQLite-stall cases return all 4 places while queries still own them (expected 0 available). The pre-delta late-result case returns the stale live answer after its attempt deadline. These are fixed by the reviewed delta; no new P0/P1/P2 finding. Raw baseline receipt will accompany the final gate.
kayg commented 2026-10-21 06:11:25 +00:00
Author
Owner
Copy link

R3 receipts: 4 new tests fail on 36d4bb58e and pass on 1355aa888.

step1.log
step2.log
step3.log
step4.log

baseline-tests.log

review-audit.txt

Audit qualification: AuthorityReadHold spans SELECT-future completion; sqlx performs pooled return/ping asynchronously afterward. Its pinned single-row SQLite path resets the iterator before publishing the row, so no blocked SELECT remains outside the tested cap. The stronger comment about actual pooled return should not be treated as an instantaneous num_idle guarantee. The clock-error branch is reviewed statically (explicit borrowed-place drop), without changing the live host clock. Final gate and same-recipe size comparison are pending.

R3 receipts: 4 new tests fail on 36d4bb58e and pass on 1355aa888. [step1.log](https://git.kayg.org/attachments/9b7aae3b-eca1-4345-be9e-5ff35dcad575) [step2.log](https://git.kayg.org/attachments/14a5a114-e1a0-4b0e-bebb-3a79676f966b) [step3.log](https://git.kayg.org/attachments/7ceec658-7611-4449-9273-6e51b7c18502) [step4.log](https://git.kayg.org/attachments/19bc9b9c-e2df-4f5c-a19b-200b07484a11) [baseline-tests.log](https://git.kayg.org/attachments/1e10c295-7124-4a35-b78d-b6981279af85) [review-audit.txt](https://git.kayg.org/attachments/5ab257a2-04ef-439a-b90f-7043575bd1fb) Audit qualification: AuthorityReadHold spans SELECT-future completion; sqlx performs pooled return/ping asynchronously afterward. Its pinned single-row SQLite path resets the iterator before publishing the row, so no blocked SELECT remains outside the tested cap. The stronger comment about actual pooled return should not be treated as an instantaneous num_idle guarantee. The clock-error branch is reviewed statically (explicit borrowed-place drop), without changing the live host clock. Final gate and same-recipe size comparison are pending.
kayg commented 2026-10-21 06:36:33 +00:00
Author
Owner
Copy link

Step 5: 4bd4c24c0 pushed. Real transport storm at the per-person ceiling: 16/16 sockets receive an explicit Close, 0 action results, with the sole pooled connection held until all outcomes are counted. Both protocol and WebSocket pings are answered; EOF is not counted as success. Formatting, default-feature server clippy (-D warnings) and the focused real-socket test pass. The four earlier regressions are also green in the full workspace milestone. Static x86_64 is 21,388,272 bytes (exact cap); aarch64 and the final-head gate remain pending.

step5.log

Step 5: 4bd4c24c0 pushed. Real transport storm at the per-person ceiling: 16/16 sockets receive an explicit Close, 0 action results, with the sole pooled connection held until all outcomes are counted. Both protocol and WebSocket pings are answered; EOF is not counted as success. Formatting, default-feature server clippy (-D warnings) and the focused real-socket test pass. The four earlier regressions are also green in the full workspace milestone. Static x86_64 is 21,388,272 bytes (exact cap); aarch64 and the final-head gate remain pending. [step5.log](https://git.kayg.org/attachments/e5759642-d61a-47ce-b517-ea68e3ef4f7f)
kayg commented 2026-10-21 06:40:07 +00:00
Author
Owner
Copy link

Step 6: 077ebbc02 pushed. Four cancelled reads keep all four places while queued for the sole pool connection. Advancing the configured acquire timeout with explicit runtime time returns all four places and drops every retained query reference, while the connection remains held. Formatting, server clippy (-D warnings) and the focused test pass. This complements the real SQLite busy-timeout case.

step6.log

Milestone full Rust gate: every row except the inherited RUSTSEC-2026-0382 advisory passes. Static sizes match exact caps: x86_64 21,388,272 bytes; aarch64 19,560,120 bytes. Final-head full gate and supplemental TypeScript checks are running (the advisory otherwise exits the script before that phase).

Step 6: 077ebbc02 pushed. Four cancelled reads keep all four places while queued for the sole pool connection. Advancing the configured acquire timeout with explicit runtime time returns all four places and drops every retained query reference, while the connection remains held. Formatting, server clippy (-D warnings) and the focused test pass. This complements the real SQLite busy-timeout case. [step6.log](https://git.kayg.org/attachments/ca9fcbcb-b6e9-40f4-9f61-bde0ba50330c) Milestone full Rust gate: every row except the inherited RUSTSEC-2026-0382 advisory passes. Static sizes match exact caps: x86_64 21,388,272 bytes; aarch64 19,560,120 bytes. Final-head full gate and supplemental TypeScript checks are running (the advisory otherwise exits the script before that phase).
kayg commented 2026-10-21 06:52:20 +00:00
Author
Owner
Copy link

Final-head gate at 077ebbc024: all 6 new r3 tests pass; workspace tests, clippy and both static builds pass. Only the inherited RUSTSEC-2026-0382 cargo-deny row fails. The TypeScript phase was run explicitly after the script exited on that row: supplemental TypeScript exit=0. Static x86_64 21,388,272 bytes; aarch64 19,560,120 bytes, both exact caps. Same-recipe merge-base x86_64 rebuild remains in progress.

verify-fast.log
verify-fast-head.txt

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| cargo-deny                | FAIL (1)     |
| static builds             | PASS         |
+---------------------------+--------------+
Final-head gate at 077ebbc0247e6fe7ce81e33e0a6ee50f6c860e29: all 6 new r3 tests pass; workspace tests, clippy and both static builds pass. Only the inherited RUSTSEC-2026-0382 cargo-deny row fails. The TypeScript phase was run explicitly after the script exited on that row: supplemental TypeScript exit=0. Static x86_64 21,388,272 bytes; aarch64 19,560,120 bytes, both exact caps. Same-recipe merge-base x86_64 rebuild remains in progress. [verify-fast.log](https://git.kayg.org/attachments/c18d9e0f-7577-4aea-aed5-00f471d98210) [verify-fast-head.txt](https://git.kayg.org/attachments/ae7cd901-863c-474b-858e-90f4f5fd6f70) ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | cargo-deny | FAIL (1) | | static builds | PASS | +---------------------------+--------------+ ```
kayg commented 2026-10-21 06:56:53 +00:00
Author
Owner
Copy link

Finished delta review r3: CLEAN (MERGE). No P0/P1/P2 found in 36d4bb58e..d6efb0f04.

Branch review-authority-cap-r3, pushed head 077ebbc024. Six atomic test commits, two test files only; product code, dependencies and decisions unchanged.

Evidence: four new regressions fail on pre-delta 36d4bb58e and pass on the candidate. Full-budget and cancellation storms use 32 callers, retain exactly 4 query holds, and recover all 4 places without duplication. Success, Denied and closed-pool storage error recover all places. Real SQLite busy-timeout and pool-acquire-timeout cases recover without releasing the blocking lock/connection. A ready result first observed past its attempt deadline retries and sees a subsequent deletion. Actual socket storm: 16/16 explicit Close outcomes at the per-person ceiling, 0 action results, both ping forms answered, store held until every outcome is counted. All six r3 tests pass in the final workspace gate.

D243 same-recipe stripped static x86_64 comparison against merge base d6efb0f04: 21,388,272 / 21,388,272 bytes, delta +0 B, SHA-256 byte-identical. aarch64 gate size 19,560,120 bytes. Both exact caps pass.

Scope qualification: the hold spans SELECT-future completion; sqlx schedules pooled return/ping afterward. Its pinned single-row path resets the iterator before publishing the row, so no blocked SELECT remains outside the tested cap. The comment about actual pool return is stronger than this mechanism. unix_seconds failure is reviewed statically (explicit borrowed-place drop); no host clock changes or product hooks were introduced. Cancellation is tested at the enclosing access-check future drop boundary. The supplied perf-VM receipt is reused, not remeasured. Details are in the attached audit.

Final scripts/verify fast summary, verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| cargo-deny                | FAIL (1)     |
| static builds             | PASS         |
+---------------------------+--------------+

Fast gate exit=1 solely for inherited RUSTSEC-2026-0382 (rustls-webpki 0.103.15). The TypeScript phase otherwise skipped by that exit was run explicitly: supplemental TypeScript exit=0.

verify-fast.log
verify-fast-head.txt

binary-size.txt
base-static-build.log
review-audit.txt

Own scratch baseline and build artifacts are being removed; raw receipts remain outside the checkout and attached here. No deployment. Issue remains open.

Finished delta review r3: CLEAN (MERGE). No P0/P1/P2 found in 36d4bb58e..d6efb0f04. Branch review-authority-cap-r3, pushed head 077ebbc0247e6fe7ce81e33e0a6ee50f6c860e29. Six atomic test commits, two test files only; product code, dependencies and decisions unchanged. Evidence: four new regressions fail on pre-delta 36d4bb58e and pass on the candidate. Full-budget and cancellation storms use 32 callers, retain exactly 4 query holds, and recover all 4 places without duplication. Success, Denied and closed-pool storage error recover all places. Real SQLite busy-timeout and pool-acquire-timeout cases recover without releasing the blocking lock/connection. A ready result first observed past its attempt deadline retries and sees a subsequent deletion. Actual socket storm: 16/16 explicit Close outcomes at the per-person ceiling, 0 action results, both ping forms answered, store held until every outcome is counted. All six r3 tests pass in the final workspace gate. D243 same-recipe stripped static x86_64 comparison against merge base d6efb0f04: 21,388,272 / 21,388,272 bytes, delta +0 B, SHA-256 byte-identical. aarch64 gate size 19,560,120 bytes. Both exact caps pass. Scope qualification: the hold spans SELECT-future completion; sqlx schedules pooled return/ping afterward. Its pinned single-row path resets the iterator before publishing the row, so no blocked SELECT remains outside the tested cap. The comment about actual pool return is stronger than this mechanism. unix_seconds failure is reviewed statically (explicit borrowed-place drop); no host clock changes or product hooks were introduced. Cancellation is tested at the enclosing access-check future drop boundary. The supplied perf-VM receipt is reused, not remeasured. Details are in the attached audit. Final scripts/verify fast summary, verbatim: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | cargo-deny | FAIL (1) | | static builds | PASS | +---------------------------+--------------+ ``` Fast gate exit=1 solely for inherited RUSTSEC-2026-0382 (rustls-webpki 0.103.15). The TypeScript phase otherwise skipped by that exit was run explicitly: supplemental TypeScript exit=0. [verify-fast.log](https://git.kayg.org/attachments/c18d9e0f-7577-4aea-aed5-00f471d98210) [verify-fast-head.txt](https://git.kayg.org/attachments/ae7cd901-863c-474b-858e-90f4f5fd6f70) [binary-size.txt](https://git.kayg.org/attachments/dfc3b458-8923-4c51-bbb3-e078650c8446) [base-static-build.log](https://git.kayg.org/attachments/49a6878c-17e0-4d8d-9d8e-4d90871ee2dc) [review-audit.txt](https://git.kayg.org/attachments/39244240-322a-4337-9367-c81ab91b2244) Own scratch baseline and build artifacts are being removed; raw receipts remain outside the checkout and attached here. No deployment. Issue remains open.
kayg commented 2026-10-21 06:57:54 +00:00
Author
Owner
Copy link

Cleanup complete: removed the owned detached baseline worktree, cargo target, comparison binary and SQLite scratch directories. Raw receipts remain outside the checkout and attached above. Worktree clean; local HEAD and origin/review-authority-cap-r3 both 077ebbc024. Final verdict remains CLEAN (MERGE); no P0/P1/P2. No deployment; issue left open.

Cleanup complete: removed the owned detached baseline worktree, cargo target, comparison binary and SQLite scratch directories. Raw receipts remain outside the checkout and attached above. Worktree clean; local HEAD and origin/review-authority-cap-r3 both 077ebbc0247e6fe7ce81e33e0a6ee50f6c860e29. Final verdict remains CLEAN (MERGE); no P0/P1/P2. No deployment; issue left open.
kayg commented 2026-10-21 09:18:15 +00:00
Author
Owner
Copy link

Release 9.3 with the socket authority read cap is pushed at abedd62b068cbd0af0c51488abb0a6e0ddf4ce4e; final gates, artifact hashes, staging/browser results and the broad-suite caveat are recorded on #24.

Release 9.3 with the socket authority read cap is pushed at `abedd62b068cbd0af0c51488abb0a6e0ddf4ce4e`; final gates, artifact hashes, staging/browser results and the broad-suite caveat are recorded on #24.
kayg commented 2026-10-21 09:20:03 +00:00
Author
Owner
Copy link

Orchestrator: release 9.3 deployed at abedd62b0 (9.2 + the #240 authority read cap + r2/r3 review tests; the r3 review was CLEAN).

  • Restarted 09:19:36 UTC (14:49 IST, 2026-10-21). MainPID 175891; /proc/PID/exe sha256 e98f7dfa…bf0 matches the artifact; /healthz ok; no journal errors.
  • Size +2,048 / +2,256 B over 9.2. The fast gate is fully green, including cargo-deny. The 60-membership gate is 10/10 with zero closes. The staging proof passes.
  • Backup: /var/backups/infraternal/20261021-111932-abedd62b0…
  • release-prod-live → abedd62b0.
  • The broader 116-test real suite had 11 failures (phone console/scroll/stale-screen, a missing mesh fixture, localhost network change, stalled-shim pause). No browser code changed since 9.2. I deployed because the authority-path signals (focused lane, 60-membership, staging sockets) are green. A baseline triage job (9.2 vs 9.3) is queued under #207.
  • The CA is locked; one owner unlock covers both the 9.2 and 9.3 restarts.
Orchestrator: **release 9.3 deployed** at abedd62b0 (9.2 + the #240 authority read cap + r2/r3 review tests; the r3 review was CLEAN). - Restarted 09:19:36 UTC (14:49 IST, 2026-10-21). MainPID 175891; `/proc/PID/exe` sha256 e98f7dfa…bf0 matches the artifact; `/healthz` ok; no journal errors. - Size +2,048 / +2,256 B over 9.2. The fast gate is fully green, including cargo-deny. The 60-membership gate is 10/10 with zero closes. The staging proof passes. - Backup: /var/backups/infraternal/20261021-111932-abedd62b0… - `release-prod-live` → abedd62b0. - The broader 116-test real suite had 11 failures (phone console/scroll/stale-screen, a missing mesh fixture, localhost network change, stalled-shim pause). No browser code changed since 9.2. I deployed because the authority-path signals (focused lane, 60-membership, staging sockets) are green. A baseline triage job (9.2 vs 9.3) is queued under #207. - The CA is locked; one owner unlock covers both the 9.2 and 9.3 restarts.
kayg commented 2026-10-21 11:40:33 +00:00
Author
Owner
Copy link

Audit: auth, session and WebSocket authority code at release 9.3 (abedd62b0)

Defensive read-only audit (Claude subagent). Scope: crates/infraternal-server/src/auth/sessions.rs, crates/infraternal-server/src/websocket.rs (AuthorityReadHold, DetachOnDrop, read_expiry/timeout_at, while_authorized, EndedStreams), revocation paths in auth/, and crates/infraternal-protocol/src/lib.rs. No fixes were made. Line numbers are at abedd62b0.

Summary: no P0 or P1 found. No path lets a revoked or expired session keep authority past one bounded read. One P2 (closes for every account, labelled as a refusal) with a failing test. Three P3.

P2-1: one account's logout plus a busy store closes every socket on the server, logged as auth_resume_refusal

  • websocket.rs:732-751 (main socket loop): on revocations.changed() and on sleep_until(expiry), a failed socket_deadline sets teardown_reason = RESUME_REFUSED for any error. A busy store (AuthorityMiss::Unavailable after AUTHORITY_WAIT, 1 s) and a real revocation (Refused) get the same label.
  • RESUME_REFUSED is not in the re-classification set at websocket.rs:931-933 (PROTOCOL_ERROR | AUTHORITY_UNAVAILABLE | SERVER_PROCESSING_FAILED), so failure_reason never corrects it. The close log says reason=connection_resume_refused, reason_category=auth_resume_refusal. If the single teardown read succeeds, the browser also gets control Close 1011 "the server refused to resume the connection". #227 and #240 say a busy server must never look like a refusal.
  • Who is affected: Auth::revocations is a single watch channel for the whole server (auth/sessions.rs:108-123, webauthn.rs:221). Any logout or recovery by any account wakes every open socket's main loop, and every in-flight while_authorized operation, at the same moment. Each one does a read through the four AUTHORITY_READS places, with 25 ms attempts.
  • Input sequence: (1) account B has a welcomed socket with an attached terminal. (2) All 8 pool connections are busy for more than 1 s (for example, writers waiting out the 5 s busy_timeout, runtime.rs:776-778). (3) Account A signs out (DELETE FROM sessions, then send_replace).
  • Wrong result: B's socket closes even though B's session was never touched. Every terminal on it reconnects, and the log records an auth refusal, not server_busy. Expected: either no read for B (the wake is not B's), or at least the AUTHORITY_UNAVAILABLE label.
  • Proof: failing test close_logging::revocation_wake_on_busy_store_logs_authority_unavailable_not_resume_refused on branch audit-auth-93. It is the existing authority_read_timeout_during_a_frame_logs_authority_unavailable fixture, with the Resize trigger replaced by f.auth.revocations.send_replace(()). Result: 
    cargo test --locked -p infraternal-server --features remote --lib revocation_wake_on_busy_store
test auth::tests::socket_tests::close_logging::revocation_wake_on_busy_store_logs_authority_unavailable_not_resume_refused ... FAILED
assertion `left == right` failed: {..."reason":"connection_resume_refused","reason_category":"auth_resume_refusal","session_id":"75757575-7575-7575-7575-757575757575",...,"who":"server"}
  left: String("auth_resume_refusal")
 right: "server_busy"
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 674 filtered out; finished in 1.68s
    Commit 6fe600b0ef on audit-auth-93 (pushed to origin).

P3-1: whole-second truncation keeps an expired session's socket up to ~1 s past expires

  • websocket.rs:2402-2415 authority_deadline: remaining = expiry - unix_seconds() in whole seconds, added to Instant::now(). At a real time of E-1+0.9 it gives a deadline of E+0.9.
  • Input sequence: a socket whose session expires=E streams terminal output (or is idle) across E.
  • Wrong result: the main-loop sleep_until(expiry) (:745) and the post-operation check (:1091) trust that deadline. Output and long operations keep flowing for up to about 1 s after E. probe_deadline (:2376-2392) already does this correctly with sub-second wall time, so the two are inconsistent. Each new frame still does an entry read, which is correct, so the exposure is bounded and small.

P3-2: EndedStreams failure is fatal for the whole socket

  • websocket.rs:2793-2827: up to MAX_ATTACHMENTS (32) ended stream ids wait for the browser's Close. The 33rd insert returns Err (:1447, :2007, :2326), and the error ends the whole socket and every sibling terminal on it.
  • Input sequence: a client that does not send a stream Close after a server-side end. The tracer does send one (terminal.ts endSession calls closeStream). Another client, or a tracer path that returns early in retryStream without reattaching, then ends 33 terminals.
  • Wrong result: all live terminals on the socket drop. Memory is bounded (good). This is a robustness note: a full set could drop the oldest entry instead of failing the socket.

P3-3: a busy store after a revocation event shares one label with a refusal (diagnostics)

The same mislabel as P2-1 on the sleep_until(expiry) branch (:745-751): a session that is still live, read during a stall at its renewal deadline, logs auth_resume_refusal. One fix covers both: map Unavailable to AUTHORITY_UNAVAILABLE here.

Checked, no finding

  • read_expiry (:2445-2498): the wall clock is read per attempt, and the result is re-checked after the read (expiry <= now means refused). A late Ok past attempt_deadline is retried, not accepted. Refused or a store error fails at once. No resurrection: renewal uses expires>unixepoch() in SQL, and a deleted row cannot be revived.
  • AuthorityReadHold and DetachOnDrop (:145-213): the permit moves into the SELECT future (live_expiry _hold). A timed-out attempt is detached with its permit, so at most 4 detached queries are in flight. RenewalHold returns its place and flag on drop. No permit leak was found: place.forget() is always followed by an owner that calls add_permits(1) exactly once.
  • while_authorized_operation (:1024-1094): it subscribes before the entry read. The race between a late operation result and a revocation is closed by the final has_changed() check.
  • Revocation coverage: logout, recovery completion (webauthn.rs:220-222) and the cascade delete all publish after commit. Pending (unlocked=0) sessions cannot authorize sockets (live_expiry requires unlocked=1).
  • Wire parser (infraternal-protocol/src/lib.rs): varints are canonical and bounded, and frame length is capped at MAX_FRAME_LEN before allocation. Offsets use checked_add. body[8..] for InputReply runs only after body_u64 checked the length. No panic path found.
  • Secrets in logs: no tracing call formats a token, cookie or resume token. The setup token print is D26 by design.

Branch: audit-auth-93 (test only, no fix). AI agent: Claude Opus 5.5, session https://claude.ai/code/session_01GHLxFr6gB7AcU2GRKHB6DE

## Audit: auth, session and WebSocket authority code at release 9.3 (abedd62b0) Defensive read-only audit (Claude subagent). Scope: `crates/infraternal-server/src/auth/sessions.rs`, `crates/infraternal-server/src/websocket.rs` (AuthorityReadHold, DetachOnDrop, read_expiry/timeout_at, while_authorized, EndedStreams), revocation paths in `auth/`, and `crates/infraternal-protocol/src/lib.rs`. No fixes were made. Line numbers are at abedd62b0. **Summary:** no P0 or P1 found. No path lets a revoked or expired session keep authority past one bounded read. One P2 (closes for every account, labelled as a refusal) with a failing test. Three P3. ### P2-1: one account's logout plus a busy store closes every socket on the server, logged as `auth_resume_refusal` - `websocket.rs:732-751` (main socket loop): on `revocations.changed()` and on `sleep_until(expiry)`, a failed `socket_deadline` sets `teardown_reason = RESUME_REFUSED` for any error. A busy store (`AuthorityMiss::Unavailable` after `AUTHORITY_WAIT`, 1 s) and a real revocation (`Refused`) get the same label. - `RESUME_REFUSED` is not in the re-classification set at `websocket.rs:931-933` (`PROTOCOL_ERROR | AUTHORITY_UNAVAILABLE | SERVER_PROCESSING_FAILED`), so `failure_reason` never corrects it. The close log says `reason=connection_resume_refused`, `reason_category=auth_resume_refusal`. If the single teardown read succeeds, the browser also gets control Close 1011 "the server refused to resume the connection". #227 and #240 say a busy server must never look like a refusal. - Who is affected: `Auth::revocations` is a single watch channel for the whole server (`auth/sessions.rs:108-123`, `webauthn.rs:221`). Any logout or recovery by any account wakes every open socket's main loop, and every in-flight `while_authorized` operation, at the same moment. Each one does a read through the four `AUTHORITY_READS` places, with 25 ms attempts. - Input sequence: (1) account B has a welcomed socket with an attached terminal. (2) All 8 pool connections are busy for more than 1 s (for example, writers waiting out the 5 s `busy_timeout`, `runtime.rs:776-778`). (3) Account A signs out (`DELETE FROM sessions`, then `send_replace`). - Wrong result: B's socket closes even though B's session was never touched. Every terminal on it reconnects, and the log records an auth refusal, not `server_busy`. Expected: either no read for B (the wake is not B's), or at least the `AUTHORITY_UNAVAILABLE` label. - Proof: failing test `close_logging::revocation_wake_on_busy_store_logs_authority_unavailable_not_resume_refused` on branch `audit-auth-93`. It is the existing `authority_read_timeout_during_a_frame_logs_authority_unavailable` fixture, with the Resize trigger replaced by `f.auth.revocations.send_replace(())`. Result: ``` cargo test --locked -p infraternal-server --features remote --lib revocation_wake_on_busy_store test auth::tests::socket_tests::close_logging::revocation_wake_on_busy_store_logs_authority_unavailable_not_resume_refused ... FAILED assertion `left == right` failed: {..."reason":"connection_resume_refused","reason_category":"auth_resume_refusal","session_id":"75757575-7575-7575-7575-757575757575",...,"who":"server"} left: String("auth_resume_refusal") right: "server_busy" test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 674 filtered out; finished in 1.68s ``` Commit 6fe600b0efa749c5e0a34da2071af79bb4f71a43 on `audit-auth-93` (pushed to origin). ### P3-1: whole-second truncation keeps an expired session's socket up to ~1 s past `expires` - `websocket.rs:2402-2415` `authority_deadline`: `remaining = expiry - unix_seconds()` in whole seconds, added to `Instant::now()`. At a real time of `E-1+0.9` it gives a deadline of `E+0.9`. - Input sequence: a socket whose session `expires=E` streams terminal output (or is idle) across `E`. - Wrong result: the main-loop `sleep_until(expiry)` (`:745`) and the post-operation check (`:1091`) trust that deadline. Output and long operations keep flowing for up to about 1 s after `E`. `probe_deadline` (`:2376-2392`) already does this correctly with sub-second wall time, so the two are inconsistent. Each new frame still does an entry read, which is correct, so the exposure is bounded and small. ### P3-2: `EndedStreams` failure is fatal for the whole socket - `websocket.rs:2793-2827`: up to `MAX_ATTACHMENTS` (32) ended stream ids wait for the browser's Close. The 33rd `insert` returns `Err` (`:1447`, `:2007`, `:2326`), and the error ends the whole socket and every sibling terminal on it. - Input sequence: a client that does not send a stream Close after a server-side end. The tracer does send one (`terminal.ts` `endSession` calls `closeStream`). Another client, or a tracer path that returns early in `retryStream` without reattaching, then ends 33 terminals. - Wrong result: all live terminals on the socket drop. Memory is bounded (good). This is a robustness note: a full set could drop the oldest entry instead of failing the socket. ### P3-3: a busy store after a revocation event shares one label with a refusal (diagnostics) The same mislabel as P2-1 on the `sleep_until(expiry)` branch (`:745-751`): a session that is still live, read during a stall at its renewal deadline, logs `auth_resume_refusal`. One fix covers both: map `Unavailable` to `AUTHORITY_UNAVAILABLE` here. ### Checked, no finding - `read_expiry` (`:2445-2498`): the wall clock is read per attempt, and the result is re-checked after the read (`expiry <= now` means refused). A late `Ok` past `attempt_deadline` is retried, not accepted. Refused or a store error fails at once. No resurrection: `renewal` uses `expires>unixepoch()` in SQL, and a deleted row cannot be revived. - `AuthorityReadHold` and `DetachOnDrop` (`:145-213`): the permit moves into the SELECT future (`live_expiry` `_hold`). A timed-out attempt is detached with its permit, so at most 4 detached queries are in flight. `RenewalHold` returns its place and flag on drop. No permit leak was found: `place.forget()` is always followed by an owner that calls `add_permits(1)` exactly once. - `while_authorized_operation` (`:1024-1094`): it subscribes before the entry read. The race between a late operation result and a revocation is closed by the final `has_changed()` check. - Revocation coverage: logout, recovery completion (`webauthn.rs:220-222`) and the cascade delete all publish after commit. Pending (`unlocked=0`) sessions cannot authorize sockets (`live_expiry` requires `unlocked=1`). - Wire parser (`infraternal-protocol/src/lib.rs`): varints are canonical and bounded, and frame length is capped at `MAX_FRAME_LEN` before allocation. Offsets use `checked_add`. `body[8..]` for InputReply runs only after `body_u64` checked the length. No panic path found. - Secrets in logs: no tracing call formats a token, cookie or resume token. The setup token print is D26 by design. Branch: `audit-auth-93` (test only, no fix). AI agent: Claude Opus 5.5, session https://claude.ai/code/session_01GHLxFr6gB7AcU2GRKHB6DE
kayg commented 2026-10-21 12:02:00 +00:00
Author
Owner
Copy link

Start auth-busy-wake at 6fe600b0ef (origin/audit-auth-93; production base abedd62b0). Read #240 history and retrieved parent #146 history. Scope: preserve typed busy/refused authority outcomes in both socket-loop wake branches, regression tests, then sub-second authority deadlines in a separate commit. Existing read_expiry already retries within AUTHORITY_WAIT and checks late results; no retry budget increase is needed. Per-account wakes affect every revocation publisher and the watchdog/proof subscribers, so will document a separate plan rather than widen this production fix. No deployment or development-line push.

Start auth-busy-wake at 6fe600b0efa749c5e0a34da2071af79bb4f71a43 (origin/audit-auth-93; production base abedd62b0). Read #240 history and retrieved parent #146 history. Scope: preserve typed busy/refused authority outcomes in both socket-loop wake branches, regression tests, then sub-second authority deadlines in a separate commit. Existing read_expiry already retries within AUTHORITY_WAIT and checks late results; no retry budget increase is needed. Per-account wakes affect every revocation publisher and the watchdog/proof subscribers, so will document a separate plan rather than widen this production fix. No deployment or development-line push.
kayg commented 2026-10-21 12:09:56 +00:00
Author
Owner
Copy link

Reproduced P2-1 on unchanged websocket.rs at 6fe600b0e: supplied revocation-wake test fails, left auth_resume_refusal / right server_busy (0 passed, 1 failed). The shared read already retries for AUTHORITY_WAIT; authority_deadline erases AuthorityMiss, and both wake branches label every error RESUME_REFUSED. The patch preserves typed errors until those branches, without changing attempts, backoff, permits or the post-result deadline check. Two additional attached-terminal cases cover another account deletion + wake with a 300 ms connection hold, and own-session deletion with the same hold. These are functional timeout scenarios, not build-host performance evidence.

red-busy.log

Per-account wake follow-up plan: keep one watch generation per account with subscriptions established before the entry read; publish only the affected account after logout/recovery commit; preserve simultaneous account removals (a last-user-id watch alone loses coalesced events); share the same account subscription across the main loop, operation watchdog and proof authority; remove unused account entries when the last subscriber drops. Test concurrent two-account revocations and missed-wakeup windows, then compare at the 256-socket ceiling. This is larger than an obviously correct ~2 KB change and is deferred from this production fix.

Reproduced P2-1 on unchanged websocket.rs at 6fe600b0e: supplied revocation-wake test fails, left auth_resume_refusal / right server_busy (0 passed, 1 failed). The shared read already retries for AUTHORITY_WAIT; authority_deadline erases AuthorityMiss, and both wake branches label every error RESUME_REFUSED. The patch preserves typed errors until those branches, without changing attempts, backoff, permits or the post-result deadline check. Two additional attached-terminal cases cover another account deletion + wake with a 300 ms connection hold, and own-session deletion with the same hold. These are functional timeout scenarios, not build-host performance evidence. [red-busy.log](https://git.kayg.org/attachments/0cfdfd2f-b524-4a1d-82da-a494b1e4cbdb) Per-account wake follow-up plan: keep one watch generation per account with subscriptions established before the entry read; publish only the affected account after logout/recovery commit; preserve simultaneous account removals (a last-user-id watch alone loses coalesced events); share the same account subscription across the main loop, operation watchdog and proof authority; remove unused account entries when the last subscriber drops. Test concurrent two-account revocations and missed-wakeup windows, then compare at the 256-socket ceiling. This is larger than an obviously correct ~2 KB change and is deferred from this production fix.
kayg commented 2026-10-21 12:29:29 +00:00
Author
Owner
Copy link

Additional finding: fixing only websocket.rs main-loop classification is insufficient. The supplied regression still fails (auth_resume_refusal instead of server_busy) after that patch. websocket_probe_authority::Lease::refresh/run also erase AuthorityMiss; websocket_transport.rs proof_loop turns any failure into AuthorizationRefused, and run_socket teardown prefers that transport reason. Extending the same typed outcome through the proof path, with a distinct internal AuthorityUnavailable transport end (1013 / server_busy), is necessary for this request. Authorized transmit errors retain ServerWriteFailed. Read retries, permit holds and final generation/deadline checks are unchanged. Added a shared-fixture expiry-wake case as well as the requested short-stall cases.

green-busy.log

Additional finding: fixing only websocket.rs main-loop classification is insufficient. The supplied regression still fails (auth_resume_refusal instead of server_busy) after that patch. websocket_probe_authority::Lease::refresh/run also erase AuthorityMiss; websocket_transport.rs proof_loop turns any failure into AuthorizationRefused, and run_socket teardown prefers that transport reason. Extending the same typed outcome through the proof path, with a distinct internal AuthorityUnavailable transport end (1013 / server_busy), is necessary for this request. Authorized transmit errors retain ServerWriteFailed. Read retries, permit holds and final generation/deadline checks are unchanged. Added a shared-fixture expiry-wake case as well as the requested short-stall cases. [green-busy.log](https://git.kayg.org/attachments/959a9d09-012e-495e-81c3-4c14583d7a10)
kayg commented 2026-10-21 12:38:51 +00:00
Author
Owner
Copy link

Focused functional results: 3/3 requested attached-terminal cases pass: supplied sustained revocation stall logs server_busy, other-account logout with a 300 ms held connection preserves authenticated application progress, own-session deletion under the same hold logs auth_resume_refusal. Setup now waits for an application result after attach before holding storage. Removed the extra expiry-wake fixture because ordinary terminal events can also start authority reads, so it did not isolate the timer branch. Both production branches explicitly preserve AuthorityMiss.

P3-1 red before correction: the paused-runtime clock-conversion test fails with a deadline later than the stored fractional wall-clock end. This is an arithmetic assertion with real SQLite and stationary runtime time, not a build-host latency measurement. The test is temporarily ignored in the uncommitted second-step file and run explicitly; the committed fix will enable it normally. Broader slot-wrapped checks are still queued behind shared builds.

green-busy-final.log
green-unrelated.log
green-revoked.log
red-subsecond.log

Focused functional results: 3/3 requested attached-terminal cases pass: supplied sustained revocation stall logs server_busy, other-account logout with a 300 ms held connection preserves authenticated application progress, own-session deletion under the same hold logs auth_resume_refusal. Setup now waits for an application result after attach before holding storage. Removed the extra expiry-wake fixture because ordinary terminal events can also start authority reads, so it did not isolate the timer branch. Both production branches explicitly preserve AuthorityMiss. P3-1 red before correction: the paused-runtime clock-conversion test fails with a deadline later than the stored fractional wall-clock end. This is an arithmetic assertion with real SQLite and stationary runtime time, not a build-host latency measurement. The test is temporarily ignored in the uncommitted second-step file and run explicitly; the committed fix will enable it normally. Broader slot-wrapped checks are still queued behind shared builds. [green-busy-final.log](https://git.kayg.org/attachments/6d3d0124-e9ab-4a07-955d-09bfde608804) [green-unrelated.log](https://git.kayg.org/attachments/ebcdc4c3-bfa7-4379-8a77-7f25192be10e) [green-revoked.log](https://git.kayg.org/attachments/d2a9f0f4-3709-46b6-bdf0-08c9842cf9d8) [red-subsecond.log](https://git.kayg.org/attachments/663e32de-c76a-4d83-85b8-fddb11c47e3c)
kayg commented 2026-10-21 12:55:36 +00:00
Author
Owner
Copy link

Baseline comparison for the pre-existing auth socket storm test (#118 exception): initial branch runs failed the explicit WebSocket Close count (11/16); detached origin/dev ee3dab018 passed once, then the branch passed once in the next window. Fixed cohort of three interleaved branch/dev-baseline pairs, using the compiled test binaries: pair 1 both PASS; pairs 2 and 3 both FAIL at review_authority_cap.rs:162 (Close count, expected 16). No application Result was observed; the test would panic on one. Host and load are recorded before each run in the raw receipt. No timing/performance claim is made. This matches the owner-authorized auth socket baseline exception: record both outputs, retain the safety assertions, commit and continue; all other rows must pass.

The first larger targeted run has 9/9 close-log tests PASS and 11/11 authority-watchdog/cap-retention tests PASS; its only functional failure is the matched storm test. Its lint failure was in the separate uncommitted fractional-expiry test, which has been corrected and removed from the checkout until the first commit is gated. The first-step library lint passes with remote + infraternal-agent/mesh enabled (the earlier remote-only dependency combination has existing unnecessary_wraps warnings).

storm-paired.log
storm-paired.json
storm-repeat.log
storm-dev-baseline.log

Baseline comparison for the pre-existing auth socket storm test (#118 exception): initial branch runs failed the explicit WebSocket Close count (11/16); detached origin/dev ee3dab018 passed once, then the branch passed once in the next window. Fixed cohort of three interleaved branch/dev-baseline pairs, using the compiled test binaries: pair 1 both PASS; pairs 2 and 3 both FAIL at review_authority_cap.rs:162 (Close count, expected 16). No application Result was observed; the test would panic on one. Host and load are recorded before each run in the raw receipt. No timing/performance claim is made. This matches the owner-authorized auth socket baseline exception: record both outputs, retain the safety assertions, commit and continue; all other rows must pass. The first larger targeted run has 9/9 close-log tests PASS and 11/11 authority-watchdog/cap-retention tests PASS; its only functional failure is the matched storm test. Its lint failure was in the separate uncommitted fractional-expiry test, which has been corrected and removed from the checkout until the first commit is gated. The first-step library lint passes with remote + infraternal-agent/mesh enabled (the earlier remote-only dependency combination has existing unnecessary_wraps warnings). [storm-paired.log](https://git.kayg.org/attachments/87e0ce0e-96bb-4df1-b407-16e739099367) [storm-paired.json](https://git.kayg.org/attachments/32bba829-8efd-4783-8599-8171544f082f) [storm-repeat.log](https://git.kayg.org/attachments/85d670c9-5b8d-49cc-82cb-012f288ff30b) [storm-dev-baseline.log](https://git.kayg.org/attachments/5726283d-6178-406c-933f-c50f54f9c92b)
kayg commented 2026-10-21 13:19:39 +00:00
Author
Owner
Copy link

Short-stall harness refinement before the first commit: one combined run closed B unexpectedly while the initial isolated runs passed. The two new short-stall tests now use the existing FrozenSocketTime helper, park content-free probes through the existing visibility notice, and observe retained authority-read places through a cfg(test, remote)-only monitor. Three held queries prove a timed-out attempt was retried; storage is released before 300 ms of explicit runtime time, then time stays stationary during real SQLite/network completion. This isolates authority from host scheduling and the independent liveness clock. Both tests pass; the original sustained busy-wake case remains active/real-time and also passes. Production backoff, attempt deadlines, authority wait and post-result checks are unchanged. These are functional clock/availability checks, not timing evidence.

green-unrelated-paused.log
green-revoked-paused.log

Short-stall harness refinement before the first commit: one combined run closed B unexpectedly while the initial isolated runs passed. The two new short-stall tests now use the existing FrozenSocketTime helper, park content-free probes through the existing visibility notice, and observe retained authority-read places through a cfg(test, remote)-only monitor. Three held queries prove a timed-out attempt was retried; storage is released before 300 ms of explicit runtime time, then time stays stationary during real SQLite/network completion. This isolates authority from host scheduling and the independent liveness clock. Both tests pass; the original sustained busy-wake case remains active/real-time and also passes. Production backoff, attempt deadlines, authority wait and post-result checks are unchanged. These are functional clock/availability checks, not timing evidence. [green-unrelated-paused.log](https://git.kayg.org/attachments/eb46023d-2cfa-41fa-b05f-54bff435f665) [green-revoked-paused.log](https://git.kayg.org/attachments/f63ee1d8-d298-4cc3-aa3b-c8f1e6bacf0d)
kayg commented 2026-10-21 13:30:18 +00:00
Author
Owner
Copy link

Checkpoint while waiting for shared build capacity: attached the current busy-store correction against 6fe600b0e so the in-progress code is recoverable from the issue. The supplied busy-wake regression and both explicitly timed short-stall cases pass individually; the exact-tree all-target lint/test sequence is queued through build-slot before the first atomic commit. The fractional-expiry test and its red receipt remain separate for the next commit. No deployment or development-line push.

pending-busy-fix.patch

Checkpoint while waiting for shared build capacity: attached the current busy-store correction against 6fe600b0e so the in-progress code is recoverable from the issue. The supplied busy-wake regression and both explicitly timed short-stall cases pass individually; the exact-tree all-target lint/test sequence is queued through build-slot before the first atomic commit. The fractional-expiry test and its red receipt remain separate for the next commit. No deployment or development-line push. [pending-busy-fix.patch](https://git.kayg.org/attachments/1a3cf6af-58a8-4abd-80f8-21538424b86d)
kayg commented 2026-10-21 13:31:13 +00:00
Author
Owner
Copy link

Step 1 committed and pushed: ac28fb5edc. Busy/refused outcomes now survive both main-loop wakes and the competing proof checker. No retry, cap, renewal or post-result guard is relaxed.

Fmt and server all-target clippy (remote + infraternal-agent/mesh): PASS. Functional results:
close: test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 668 filtered out
watchdog: test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 666 filtered out
review: test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 673 filtered out
transient: test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 672 filtered out
proofs: test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 673 filtered out
transport: test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 674 filtered out

Per-account wakes remain the separately documented follow-up. Next: the independently reproduced fractional-expiry correction, then same-recipe static sizes and the final fast gate.

Step 1 committed and pushed: ac28fb5edcf29b16c9bf9f383954ee48e096710b. Busy/refused outcomes now survive both main-loop wakes and the competing proof checker. No retry, cap, renewal or post-result guard is relaxed. Fmt and server all-target clippy (remote + infraternal-agent/mesh): PASS. Functional results: close: test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 668 filtered out watchdog: test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 666 filtered out review: test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 673 filtered out transient: test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 672 filtered out proofs: test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 673 filtered out transport: test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 674 filtered out Per-account wakes remain the separately documented follow-up. Next: the independently reproduced fractional-expiry correction, then same-recipe static sizes and the final fast gate.
kayg commented 2026-10-21 13:32:38 +00:00
Author
Owner
Copy link

Step 2 committed and pushed: aad424a6a7. Authority and proof deadlines now share checked sub-second wall-clock conversion, pairing clocks after the read. The paused-runtime/real-SQLite regression is enabled normally and passes; its pre-fix failing receipt is attached earlier.

Fmt and server all-target clippy: PASS. Functional results:
watchdog: test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 666 filtered out
close: test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 669 filtered out
proofs: test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 674 filtered out
transient: test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 673 filtered out

No new dependency, timer, renewal or authority query is added. Building production abedd62b0 and the branch with the same pinned static recipe next; final fast gate remains pending.

Step 2 committed and pushed: aad424a6a7b4dda5ae9bcb5ea668c18fd98b88c4. Authority and proof deadlines now share checked sub-second wall-clock conversion, pairing clocks after the read. The paused-runtime/real-SQLite regression is enabled normally and passes; its pre-fix failing receipt is attached earlier. Fmt and server all-target clippy: PASS. Functional results: watchdog: test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 666 filtered out close: test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 669 filtered out proofs: test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 674 filtered out transient: test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 673 filtered out No new dependency, timer, renewal or authority query is added. Building production abedd62b0 and the branch with the same pinned static recipe next; final fast gate remains pending.
kayg commented 2026-10-21 14:10:15 +00:00
Author
Owner
Copy link

Broader iterate at aad424a6a: all Rust rows pass except test. The only failed case is the new revoked-session fixture, before the storage hold/session deletion: its next-frame assertion expected the visibility Pong. Five fixed repeats reproduced that assertion. An attached terminal can have unrelated notices queued before the correlated reply. Fixed the fixture to wait for control stream 0 / nonce 240, reject an early Close and retain a hang bound. The focused corrected test passes; exact-tree lint, suite and fixed-repeat gates are queued before a separate test-only commit. No authority, liveness or timeout assertion is weakened. This failure was not treated as the pre-existing storm exception.

revoked-repeat-1.log
green-revoked-fenced.log
milestone-iterate.log

Broader iterate at aad424a6a: all Rust rows pass except test. The only failed case is the new revoked-session fixture, before the storage hold/session deletion: its next-frame assertion expected the visibility Pong. Five fixed repeats reproduced that assertion. An attached terminal can have unrelated notices queued before the correlated reply. Fixed the fixture to wait for control stream 0 / nonce 240, reject an early Close and retain a hang bound. The focused corrected test passes; exact-tree lint, suite and fixed-repeat gates are queued before a separate test-only commit. No authority, liveness or timeout assertion is weakened. This failure was not treated as the pre-existing storm exception. [revoked-repeat-1.log](https://git.kayg.org/attachments/ef45858b-4608-4e21-91c1-b97383eb1cc8) [green-revoked-fenced.log](https://git.kayg.org/attachments/a3a430a4-d427-46fb-9d81-28b7001a5161) [milestone-iterate.log](https://git.kayg.org/attachments/588e0e9e-9a48-4371-9e9c-5191cd0b77c0)
kayg commented 2026-10-21 14:14:56 +00:00
Author
Owner
Copy link

Step 3 committed and pushed: 4d2ea3884f. The broader iterate gate exposed a fixture assumption before the revocation stall: an attached-terminal notice could precede the visibility Pong. The test now waits for the matching control-stream nonce, fails on an early Close and has a hang bound. No authorization, liveness or deadline assertion was relaxed.

Fmt/all-target server clippy PASS; close-log suite 9/9 PASS with remote + infraternal-agent/mesh; both controlled short-stall tests pass 5/5 fixed repeats each. The earlier full iterate Rust summary passed every row except test (this new fixture assertion); cargo-deny passed. Continuing the same-recipe static comparison and then the required final-head fast gate. The auth corrections themselves remain ac28fb5ed + aad424a6a.

Step 3 committed and pushed: 4d2ea3884fb9395c10429637f98b50e54fca9104. The broader iterate gate exposed a fixture assumption before the revocation stall: an attached-terminal notice could precede the visibility Pong. The test now waits for the matching control-stream nonce, fails on an early Close and has a hang bound. No authorization, liveness or deadline assertion was relaxed. Fmt/all-target server clippy PASS; close-log suite 9/9 PASS with remote + infraternal-agent/mesh; both controlled short-stall tests pass 5/5 fixed repeats each. The earlier full iterate Rust summary passed every row except test (this new fixture assertion); cargo-deny passed. Continuing the same-recipe static comparison and then the required final-head fast gate. The auth corrections themselves remain ac28fb5ed + aad424a6a.
kayg commented 2026-10-21 14:31:55 +00:00
Author
Owner
Copy link

Static baseline completed at abedd62b0 using scripts/static-cargo build --locked --release --package infraternal --target x86_64-unknown-linux-musl on infraternal-dev. Stripped artifact: 21,389,296 bytes, exactly the current recorded cap. Branch comparison is building with the same recipe/target directory; no timing claim is made from this shared build host. Removed this job's 12 GB debug incremental cache while preserving compiled tests to relieve shared disk pressure. Final fast gate still pending.

Static baseline completed at abedd62b0 using scripts/static-cargo build --locked --release --package infraternal --target x86_64-unknown-linux-musl on infraternal-dev. Stripped artifact: 21,389,296 bytes, exactly the current recorded cap. Branch comparison is building with the same recipe/target directory; no timing claim is made from this shared build host. Removed this job's 12 GB debug incremental cache while preserving compiled tests to relieve shared disk pressure. Final fast gate still pending.
kayg commented 2026-10-21 14:50:53 +00:00
Author
Owner
Copy link

Static comparison at 4d2ea3884f: reproduced abedd62b0 x86_64 = 21,389,296 bytes; branch = 21,389,040 bytes, delta -256 bytes. Branch aarch64 = 19,561,912 bytes, +256 bytes against its recorded release-9.3 ceiling (19,561,656). Same scripts/static-cargo --locked --release recipe, stripped static binaries; no dependency, feature or profile change. This is artifact-size evidence, not shared-host timing evidence.

D243 requires the x86_64 ceiling to ratchet down; proposing the exact measured ceilings 21,389,040 / 19,561,912, without allowance, in scripts/verify.d/rust.sh and docs/PROCESS.md. The 256-byte ARM increase preserves the necessary typed busy/refused outcome in the competing proof path and the common fractional deadline conversion; it is below the 16 KB band. Leaving stale caps or adding slack is rejected. Running the existing exact-cap / +1-byte / downward-ratchet checks before an atomic size-gate commit, then the final-head fast gate.

Static comparison at 4d2ea3884fb9395c10429637f98b50e54fca9104: reproduced abedd62b0 x86_64 = 21,389,296 bytes; branch = 21,389,040 bytes, delta -256 bytes. Branch aarch64 = 19,561,912 bytes, +256 bytes against its recorded release-9.3 ceiling (19,561,656). Same scripts/static-cargo --locked --release recipe, stripped static binaries; no dependency, feature or profile change. This is artifact-size evidence, not shared-host timing evidence. D243 requires the x86_64 ceiling to ratchet down; proposing the exact measured ceilings 21,389,040 / 19,561,912, without allowance, in scripts/verify.d/rust.sh and docs/PROCESS.md. The 256-byte ARM increase preserves the necessary typed busy/refused outcome in the competing proof path and the common fractional deadline conversion; it is below the 16 KB band. Leaving stale caps or adding slack is rejected. Running the existing exact-cap / +1-byte / downward-ratchet checks before an atomic size-gate commit, then the final-head fast gate.
kayg commented 2026-10-21 14:51:22 +00:00
Author
Owner
Copy link

Step 4 committed and pushed: 300c0c8cb7. Exact static ceilings now match the measured artifacts (x86_64 21,389,040; aarch64 19,561,912 bytes), with no slack. bash -n PASS; existing size-boundary tests PASS at both exact caps, reject cap+1, require downward ratcheting and reject an unsupported target. Starting scripts/verify fast on this final head through build-slot.

Step 4 committed and pushed: 300c0c8cb7de63084e887f8a3944f658d8b8599e. Exact static ceilings now match the measured artifacts (x86_64 21,389,040; aarch64 19,561,912 bytes), with no slack. bash -n PASS; existing size-boundary tests PASS at both exact caps, reject cap+1, require downward ratcheting and reject an unsupported target. Starting scripts/verify fast on this final head through build-slot.
kayg commented 2026-10-21 14:57:03 +00:00
Author
Owner
Copy link

Receipts for pushed head 300c0c8cb: x86_64 21,389,040 bytes (-256 versus reproduced abedd62b0); aarch64 19,561,912 bytes (+256 versus recorded ceiling); both exact boundary checks PASS, and each controlled short-stall regression 5/5 PASS. scripts/verify fast is waiting for its host-wide build slot; no final gate result yet.

static-size.json
size-cap-tests.log
fence-corpus.json

Receipts for pushed head 300c0c8cb: x86_64 21,389,040 bytes (-256 versus reproduced abedd62b0); aarch64 19,561,912 bytes (+256 versus recorded ceiling); both exact boundary checks PASS, and each controlled short-stall regression 5/5 PASS. scripts/verify fast is waiting for its host-wide build slot; no final gate result yet. [static-size.json](https://git.kayg.org/attachments/3e69e8d3-a9de-4750-9672-f2c25195b32a) [size-cap-tests.log](https://git.kayg.org/attachments/6d29719c-e983-43ca-afa0-1518039661ed) [fence-corpus.json](https://git.kayg.org/attachments/64822b59-8fab-4c80-b9f4-92104b34eae2)
kayg commented 2026-10-21 15:16:14 +00:00
Author
Owner
Copy link

Finished and pushed auth-busy-wake at 300c0c8cb7. Both socket wake branches and the competing proof checker retain busy/unavailable versus known refusal. Short unrelated-account stalls preserve the socket; genuinely revoked sessions still close as RESUME_REFUSED once the read answers. Sustained unavailability closes as AUTHORITY_UNAVAILABLE/server_busy. Fractional expiry uses a shared checked wall/monotonic conversion. Per-account wakes are deferred with the lifecycle/coalescing plan above.

Final scripts/verify fast exit 0 on that head; no baseline exception was used. All three busy-store socket regressions, fractional-expiry regression and existing full-place storm passed. Final gate output excerpt, verbatim (complete unfiltered output attached):

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

 39 pass
 0 fail
 36135 expect() calls
Ran 39 tests across 10 files. [2.43s]

Stripped static x86_64: reproduced abedd62b0 21,389,296 bytes; head 21,389,040, delta -256 bytes. ARM: 19,561,912 bytes (+256 versus recorded ceiling). Exact caps and boundary checks updated with no slack. Existing limits unchanged: 25 ms/read attempt, one-second total authority wait, four shared read places and 5-to-100 ms backoff; post-result checks retained. No added shipping state, tasks, queries, timers, dependencies or features. Auth B1/S1/S2/N1 self-review attached.

Working tree clean; origin/auth-busy-wake matches head. Detached baseline and all job build targets removed; evidence retained outside checkout. No deployment, dev/main push or lab-host use. Issue left open.

verify-fast.log
verify-fast-summary.txt
self-review.txt
fence-close.log

static-size.json
size-cap-tests.log
fence-corpus.json

cleanup.txt

Finished and pushed auth-busy-wake at 300c0c8cb7de63084e887f8a3944f658d8b8599e. Both socket wake branches and the competing proof checker retain busy/unavailable versus known refusal. Short unrelated-account stalls preserve the socket; genuinely revoked sessions still close as RESUME_REFUSED once the read answers. Sustained unavailability closes as AUTHORITY_UNAVAILABLE/server_busy. Fractional expiry uses a shared checked wall/monotonic conversion. Per-account wakes are deferred with the lifecycle/coalescing plan above. Final scripts/verify fast exit 0 on that head; no baseline exception was used. All three busy-store socket regressions, fractional-expiry regression and existing full-place storm passed. Final gate output excerpt, verbatim (complete unfiltered output attached): ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 39 pass 0 fail 36135 expect() calls Ran 39 tests across 10 files. [2.43s] ``` Stripped static x86_64: reproduced abedd62b0 21,389,296 bytes; head 21,389,040, delta -256 bytes. ARM: 19,561,912 bytes (+256 versus recorded ceiling). Exact caps and boundary checks updated with no slack. Existing limits unchanged: 25 ms/read attempt, one-second total authority wait, four shared read places and 5-to-100 ms backoff; post-result checks retained. No added shipping state, tasks, queries, timers, dependencies or features. Auth B1/S1/S2/N1 self-review attached. Working tree clean; origin/auth-busy-wake matches head. Detached baseline and all job build targets removed; evidence retained outside checkout. No deployment, dev/main push or lab-host use. Issue left open. [verify-fast.log](https://git.kayg.org/attachments/716462a8-4783-4711-a22a-c052139fc1bf) [verify-fast-summary.txt](https://git.kayg.org/attachments/0f020ad5-a347-4bc9-9e47-d59827fb5465) [self-review.txt](https://git.kayg.org/attachments/2bb66d00-615b-4515-bbc8-cf37ef68355a) [fence-close.log](https://git.kayg.org/attachments/9c8899a5-a316-44ca-9019-b6b6ced21773) [static-size.json](https://git.kayg.org/attachments/3e69e8d3-a9de-4750-9672-f2c25195b32a) [size-cap-tests.log](https://git.kayg.org/attachments/6d29719c-e983-43ca-afa0-1518039661ed) [fence-corpus.json](https://git.kayg.org/attachments/64822b59-8fab-4c80-b9f4-92104b34eae2) [cleanup.txt](https://git.kayg.org/attachments/de5c8c8d-9cdd-448c-81a6-77e74e1fe5a1)
kayg commented 2026-10-21 15:18:30 +00:00
Author
Owner
Copy link

Verification review started on review-auth-busy-wake at 300c0c8cb7; diff base 6fe600b0ef. Independent initial diff view recorded before reading author comments. Retrieved full #240 and parent #146 histories. Scope: edge tests only, no fixes/deploy; exact-author-head fast gate followed by review-head validation. Checking known expiry under storage stalls and outcome propagation.

Verification review started on review-auth-busy-wake at 300c0c8cb7de63084e887f8a3944f658d8b8599e; diff base 6fe600b0efa749c5e0a34da2071af79bb4f71a43. Independent initial diff view recorded before reading author comments. Retrieved full #240 and parent #146 histories. Scope: edge tests only, no fixes/deploy; exact-author-head fast gate followed by review-head validation. Checking known expiry under storage stalls and outcome propagation.
kayg commented 2026-10-21 15:23:42 +00:00
Author
Owner
Copy link

Independent review progress: the wake branches use the same pre-existing retry budget (25 ms per attempt, one-second wait), so no added revocation grace was found in the diff. Static wire finding under test: websocket.rs:975-994 sends only an optional 1011 application Close, conditioned on a successful teardown read, then an empty WebSocket Close; main-loop AuthorityMiss::Unavailable therefore has no guaranteed 1013 wire outcome. The transport proof path separately maps AuthorityUnavailable to 1013 at websocket.rs:798-800. Added an idle-socket wire regression to isolate the main loop; execution pending the exact-author-head full gate. Closed watch is infrastructure loss and is unreachable while the normal Auth-owned sender is alive; Unavailable is appropriate. No verdict yet.

Independent review progress: the wake branches use the same pre-existing retry budget (25 ms per attempt, one-second wait), so no added revocation grace was found in the diff. Static wire finding under test: websocket.rs:975-994 sends only an optional 1011 application Close, conditioned on a successful teardown read, then an empty WebSocket Close; main-loop AuthorityMiss::Unavailable therefore has no guaranteed 1013 wire outcome. The transport proof path separately maps AuthorityUnavailable to 1013 at websocket.rs:798-800. Added an idle-socket wire regression to isolate the main loop; execution pending the exact-author-head full gate. Closed watch is infrastructure loss and is unreachable while the normal Auth-owned sender is alive; Unavailable is appropriate. No verdict yet.
kayg commented 2026-10-21 15:34:54 +00:00
Author
Owner
Copy link

Start full-place-storm on branch flake-full-place-storm, base origin/release-prod-live abedd62b06. Read #240 comments and its linked parent #146 history. Scope: classify every_socket_in_a_full_place_storm_fails_closed_without_a_reply with 50 isolated runs and 50 runs under a competing test workload, preserving the 16 explicit-Close/zero-reply contract. No server changes unless a deterministic production defect is demonstrated; no deployment.

Start `full-place-storm` on branch `flake-full-place-storm`, base `origin/release-prod-live` abedd62b068cbd0af0c51488abb0a6e0ddf4ce4e. Read #240 comments and its linked parent #146 history. Scope: classify `every_socket_in_a_full_place_storm_fails_closed_without_a_reply` with 50 isolated runs and 50 runs under a competing test workload, preserving the 16 explicit-Close/zero-reply contract. No server changes unless a deterministic production defect is demonstrated; no deployment.
kayg commented 2026-10-21 15:46:43 +00:00
Author
Owner
Copy link

P2 contract finding, test-only commit 939b456cd pushed on review-auth-busy-wake. websocket.rs:738-758 sets AUTHORITY_UNAVAILABLE on the main wake path, but websocket.rs:975-997 conditionally sends only an application Close hardcoded to 1011, then an empty WebSocket Close. The new 1013 mapping at websocket.rs:796-800 is reached only through transport.recv, so it does not cover this path.

Sequence: authenticate an idle socket; require an application result as a main-loop barrier; hold the only pooled connection; publish an unrelated shared revocation; keep storage held past the existing retry wait. Result: the socket fails closed but no application/WebSocket close code is observed (codes=[]), rather than required server_busy/1013. New regression: 0 passed, 1 failed; compilation and fmt pass. This is a wire/diagnostic contract gap, not retained authorization. The main teardown shape predates this diff; the requested contract remains unmet by the candidate. No fix added. Exact-author-head full gate and touched-test lint remain in progress.

wire-review-test.log
review-sequences.txt

P2 contract finding, test-only commit 939b456cd pushed on review-auth-busy-wake. websocket.rs:738-758 sets AUTHORITY_UNAVAILABLE on the main wake path, but websocket.rs:975-997 conditionally sends only an application Close hardcoded to 1011, then an empty WebSocket Close. The new 1013 mapping at websocket.rs:796-800 is reached only through transport.recv, so it does not cover this path. Sequence: authenticate an idle socket; require an application result as a main-loop barrier; hold the only pooled connection; publish an unrelated shared revocation; keep storage held past the existing retry wait. Result: the socket fails closed but no application/WebSocket close code is observed (codes=[]), rather than required server_busy/1013. New regression: 0 passed, 1 failed; compilation and fmt pass. This is a wire/diagnostic contract gap, not retained authorization. The main teardown shape predates this diff; the requested contract remains unmet by the candidate. No fix added. Exact-author-head full gate and touched-test lint remain in progress. [wire-review-test.log](https://git.kayg.org/attachments/17f97386-1c55-4380-b677-17ee53f9db2d) [review-sequences.txt](https://git.kayg.org/attachments/377523d0-f06b-43b4-9b39-a0bd91cdccfb)
kayg commented 2026-10-21 15:47:36 +00:00
Author
Owner
Copy link

Source review: review_authority_cap.rs:100-163 establishes all 16 sockets before holding the fixture’s sole SQLite connection, sends an action on each, answers WebSocket and protocol pings, treats any action Result as a failure, and counts only explicit WebSocket Close messages. The fixture’s pool is max_connections(1) at auth/tests.rs:224-232; MAX_USER_CONNECTIONS is 16 at websocket.rs:36, and authority wait is 1 s at websocket.rs:59-61. The current main-loop error path reaches teardown and sends Message::Close(None) at websocket.rs:927-985. Reproduction build is queued behind all four host build slots; no code changed.

Source review: `review_authority_cap.rs:100-163` establishes all 16 sockets before holding the fixture’s sole SQLite connection, sends an action on each, answers WebSocket and protocol pings, treats any action Result as a failure, and counts only explicit WebSocket Close messages. The fixture’s pool is `max_connections(1)` at `auth/tests.rs:224-232`; `MAX_USER_CONNECTIONS` is 16 at `websocket.rs:36`, and authority wait is 1 s at `websocket.rs:59-61`. The current main-loop error path reaches teardown and sends `Message::Close(None)` at `websocket.rs:927-985`. Reproduction build is queued behind all four host build slots; no code changed.
kayg commented 2026-10-21 15:48:57 +00:00
Author
Owner
Copy link

Test-only review commits pushed: 939b456cd (idle wire contract, expected red), 1741038d2 (12 revoked retry boundaries), 9f57e0998 (expiry crossing held read), 4f70e46af (wall/runtime clock roles), bbdd236bb (closed notification source), 8f5846229 (16 real sockets recover application authority).

Five new tests PASS, one wire regression FAIL: close codes=[] rather than required 1013. The boundary matrix suppresses guarded work for all 12 stalls and recovers all four read places plus the pool. The 16-socket case verifies application results after the shared wake, not only content-free proofs. No fixes or deploy. Exact author-head full gate is still in progress; final review-head full gate follows. Tests ran from the compiled review binary; raw outputs will be attached with final gates. Formatting and test compilation pass; new-source workspace lint remains pending in the final gate.

Test-only review commits pushed: 939b456cd (idle wire contract, expected red), 1741038d2 (12 revoked retry boundaries), 9f57e0998 (expiry crossing held read), 4f70e46af (wall/runtime clock roles), bbdd236bb (closed notification source), 8f5846229 (16 real sockets recover application authority). Five new tests PASS, one wire regression FAIL: close codes=[] rather than required 1013. The boundary matrix suppresses guarded work for all 12 stalls and recovers all four read places plus the pool. The 16-socket case verifies application results after the shared wake, not only content-free proofs. No fixes or deploy. Exact author-head full gate is still in progress; final review-head full gate follows. Tests ran from the compiled review binary; raw outputs will be attached with final gates. Formatting and test compilation pass; new-source workspace lint remains pending in the final gate.
kayg commented 2026-10-21 15:50:18 +00:00
Author
Owner
Copy link

Test-only placement step committed and pushed at 0705cfbf3: move the closed-channel review module after Lease implementation, following the items_after_test_module convention; assertions unchanged. Fmt PASS; closed-channel compiled-binary repeat PASS. The six new test commits remain separate. Exact author-head fast gate is still running (no test failures reported so far). Review-head touched-server clippy, full fast gate, static artifact comparison versus author head and supplemental TypeScript are serialized to start after it releases its slot. Final verdict pending these receipts.

Test-only placement step committed and pushed at 0705cfbf3: move the closed-channel review module after Lease implementation, following the items_after_test_module convention; assertions unchanged. Fmt PASS; closed-channel compiled-binary repeat PASS. The six new test commits remain separate. Exact author-head fast gate is still running (no test failures reported so far). Review-head touched-server clippy, full fast gate, static artifact comparison versus author head and supplemental TypeScript are serialized to start after it releases its slot. Final verdict pending these receipts.
kayg commented 2026-10-21 15:59:43 +00:00
Author
Owner
Copy link

Targeted test harness build complete at unchanged HEAD abedd62b068cbd0af0c51488abb0a6e0ddf4ce4e; no repository files changed. cargo test --locked -p infraternal-server --lib every_socket_in_a_full_place_storm_fails_closed_without_a_reply --no-run passed through build-slot in 11m42s with two Cargo jobs. Binary: $HOME/.cache/codex-scratch/flake-full-place-storm/target/debug/deps/infraternal_server-6dc06b768874f2f9. Cohort runs are next.

Targeted test harness build complete at unchanged HEAD `abedd62b068cbd0af0c51488abb0a6e0ddf4ce4e`; no repository files changed. `cargo test --locked -p infraternal-server --lib every_socket_in_a_full_place_storm_fails_closed_without_a_reply --no-run` passed through build-slot in 11m42s with two Cargo jobs. Binary: `$HOME/.cache/codex-scratch/flake-full-place-storm/target/debug/deps/infraternal_server-6dc06b768874f2f9`. Cohort runs are next.
kayg commented 2026-10-21 16:04:36 +00:00
Author
Owner
Copy link

The 50-run isolated cohort is queued but has not started: all four host build slots are occupied by other jobs. The targeted test binary is ready in $HOME/.cache/codex-scratch/flake-full-place-storm/target; continuing as soon as a slot is released. No work outside this branch has been started.

The 50-run isolated cohort is queued but has not started: all four host build slots are occupied by other jobs. The targeted test binary is ready in `$HOME/.cache/codex-scratch/flake-full-place-storm/target`; continuing as soon as a slot is released. No work outside this branch has been started.
kayg commented 2026-10-21 16:07:38 +00:00
Author
Owner
Copy link

Functional review evidence at pushed head 0705cfbf3: five new tests PASS, one deliberate P2 contract regression FAIL (idle unavailable wake observes no 1013 code). Twelve revoked-stall inputs cover 0/24/25/26/100/300/800/925/975/1000/1025/1200 ms of controlled runtime time; no guarded write, all four read places and the pool recover. Both deadline callers refuse expiry crossed during a held read. Closed watch is Unavailable without polling the write. Sixteen actual sockets recover authenticated application results after a controlled short shared wake stall.

Clock qualification: real wall expiry and independent runtime movement are tested; the live host CLOCK_REALTIME is not stepped. Static comparison confirms the unavailable-wire teardown block is byte-identical between 6fe600b0e and 300c0c8cb, so the P2 is a pre-existing contract gap. No new authority-retention regression found. Original author server suite passed 626/626 active tests (52 ignored). Full author gate is building static artifacts; final review-head lint/gate remains serialized afterward.

matrix-direct-test.log
expiry-review-test.log
clock-review-test.log
closed-review-test.log
storm-review-test.log
functional-results.json
review-audit.txt
teardown-comparison.txt

Functional review evidence at pushed head 0705cfbf3: five new tests PASS, one deliberate P2 contract regression FAIL (idle unavailable wake observes no 1013 code). Twelve revoked-stall inputs cover 0/24/25/26/100/300/800/925/975/1000/1025/1200 ms of controlled runtime time; no guarded write, all four read places and the pool recover. Both deadline callers refuse expiry crossed during a held read. Closed watch is Unavailable without polling the write. Sixteen actual sockets recover authenticated application results after a controlled short shared wake stall. Clock qualification: real wall expiry and independent runtime movement are tested; the live host CLOCK_REALTIME is not stepped. Static comparison confirms the unavailable-wire teardown block is byte-identical between 6fe600b0e and 300c0c8cb, so the P2 is a pre-existing contract gap. No new authority-retention regression found. Original author server suite passed 626/626 active tests (52 ignored). Full author gate is building static artifacts; final review-head lint/gate remains serialized afterward. [matrix-direct-test.log](https://git.kayg.org/attachments/57bfd96c-82bf-4a2b-9aa5-063fa1874f42) [expiry-review-test.log](https://git.kayg.org/attachments/856fe4ef-77a2-4771-8337-ad064af0d13e) [clock-review-test.log](https://git.kayg.org/attachments/371bd144-a9e3-41c3-a5be-abbf907e9e16) [closed-review-test.log](https://git.kayg.org/attachments/f7d83824-2fea-4b82-ac7d-4eafb2606c87) [storm-review-test.log](https://git.kayg.org/attachments/fafa850b-4898-4fd3-80bc-d744d62283fa) [functional-results.json](https://git.kayg.org/attachments/310a9101-4e21-46c7-9da2-5d7101ba2e79) [review-audit.txt](https://git.kayg.org/attachments/b37a7569-8b4d-48c4-9802-d39766af0b52) [teardown-comparison.txt](https://git.kayg.org/attachments/85ced9e5-aa01-4848-b896-df2368935d2c)
kayg commented 2026-10-21 16:08:06 +00:00
Author
Owner
Copy link

Correction to the source-review line references: MAX_USER_CONNECTIONS = 16 is at websocket.rs:72 (not line 36); AUTHORITY_WAIT = 1 s is at websocket.rs:87; the fixture pool cap is at auth/tests.rs:229; the main-loop teardown WebSocket Close is at websocket.rs:977.

Correction to the source-review line references: `MAX_USER_CONNECTIONS = 16` is at `websocket.rs:72` (not line 36); `AUTHORITY_WAIT = 1 s` is at `websocket.rs:87`; the fixture pool cap is at `auth/tests.rs:229`; the main-loop teardown WebSocket Close is at `websocket.rs:977`.
kayg commented 2026-10-21 16:20:04 +00:00
Author
Owner
Copy link

Unaccompanied cohort complete at unchanged HEAD abedd62b068cbd0af0c51488abb0a6e0ddf4ce4e: 50/50 pass on infraternal-dev (12 CPUs), no companion test started by this job. Load average: 22.12 / 21.59 / 21.91 at start; 34.78 / 26.21 / 23.54 at end. Each outcome was an explicit WebSocket Close and no action Result; no failures to diagnose in this cohort. Receipts: isolated.log, isolated-summary.json. Starting 50 runs alongside cargo test -p infraternal-protocol.

Unaccompanied cohort complete at unchanged HEAD `abedd62b068cbd0af0c51488abb0a6e0ddf4ce4e`: **50/50 pass** on `infraternal-dev` (12 CPUs), no companion test started by this job. Load average: 22.12 / 21.59 / 21.91 at start; 34.78 / 26.21 / 23.54 at end. Each outcome was an explicit WebSocket Close and no action Result; no failures to diagnose in this cohort. Receipts: [isolated.log](https://git.kayg.org/attachments/e87b4978-39cc-4740-b634-92e8b344a76f), [isolated-summary.json](https://git.kayg.org/attachments/d21b8bd8-265a-4836-874e-e30b188d5874). Starting 50 runs alongside `cargo test -p infraternal-protocol`.
kayg commented 2026-10-21 16:30:14 +00:00
Author
Owner
Copy link

Controlled cohort finding at unchanged HEAD abedd62b068cbd0af0c51488abb0a6e0ddf4ce4e: 38/50 pass, 12/50 fail when run beside cargo test -p infraternal-protocol (212 companion runs, 0 failures). The failed assertions counted 8, 9, 10, 11, 11, 11, 11, 12, 12, 14, 14, and 9 explicit WebSocket Closes out of 16. No action Result was observed; every failure reached review_authority_cap.rs:162 in under 2 seconds, before its 15-second reader bound. Machine: infraternal-dev, 12 CPUs; load average 8.97 / 15.60 / 19.94 at start, 16.33 / 15.53 / 19.40 at end. This shows the failure is reproducible under a competing test workload, but the current assertion does not distinguish EOF from a socket that stayed open. Receipts: loaded.log, loaded-summary.json, protocol-companion.log. Next: record each socket's terminal outcome and make the timer-controlled run deterministic before classifying.

Controlled cohort finding at unchanged HEAD `abedd62b068cbd0af0c51488abb0a6e0ddf4ce4e`: **38/50 pass, 12/50 fail** when run beside `cargo test -p infraternal-protocol` (212 companion runs, 0 failures). The failed assertions counted 8, 9, 10, 11, 11, 11, 11, 12, 12, 14, 14, and 9 explicit WebSocket Closes out of 16. No action Result was observed; every failure reached `review_authority_cap.rs:162` in under 2 seconds, before its 15-second reader bound. Machine: infraternal-dev, 12 CPUs; load average 8.97 / 15.60 / 19.94 at start, 16.33 / 15.53 / 19.40 at end. This shows the failure is reproducible under a competing test workload, but the current assertion does not distinguish EOF from a socket that stayed open. Receipts: [loaded.log](https://git.kayg.org/attachments/e11d4533-427a-4cdb-a569-057ab7a588f7), [loaded-summary.json](https://git.kayg.org/attachments/47aabcea-c853-4204-9992-6dd030e237cd), [protocol-companion.log](https://git.kayg.org/attachments/63eb6b34-9188-4769-870c-29d14281d235). Next: record each socket's terminal outcome and make the timer-controlled run deterministic before classifying.
kayg commented 2026-10-21 16:31:19 +00:00
Author
Owner
Copy link

Exact author-head validation completed on detached 300c0c8cb7: scripts/verify fast exit 0, no load/baseline exception used. All nine Rust rows and all TypeScript phases pass. Original server suite: 626 passed, 0 failed, 52 ignored. Stripped static artifacts match exact caps: x86_64 21,389,040 bytes; aarch64 19,561,912 bytes; PT_INTERP absent. The complete unfiltered gate transcript is attached.

Verbatim final Rust gate output:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

exit=0

author-verify-fast.log
author-gate-summary.txt
author-static.json

The same detached validation checkout is now at review head 0705cfbf3 for touched-server clippy and final review-head fast verification. Candidate artifacts were recorded before changing that checkout. Test-only review verdict still pending final lint/gate receipts; no fixes or deploy.

Exact author-head validation completed on detached 300c0c8cb7de63084e887f8a3944f658d8b8599e: scripts/verify fast exit 0, no load/baseline exception used. All nine Rust rows and all TypeScript phases pass. Original server suite: 626 passed, 0 failed, 52 ignored. Stripped static artifacts match exact caps: x86_64 21,389,040 bytes; aarch64 19,561,912 bytes; PT_INTERP absent. The complete unfiltered gate transcript is attached. Verbatim final Rust gate output: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ exit=0 ``` [author-verify-fast.log](https://git.kayg.org/attachments/eacdebf1-158d-46d8-8898-dc2a1f35769f) [author-gate-summary.txt](https://git.kayg.org/attachments/f762b78d-4c6c-4e6c-98b9-c6f7f1194670) [author-static.json](https://git.kayg.org/attachments/2ac07c50-43da-4185-95c4-eae6c63366ca) The same detached validation checkout is now at review head 0705cfbf3 for touched-server clippy and final review-head fast verification. Candidate artifacts were recorded before changing that checkout. Test-only review verdict still pending final lint/gate receipts; no fixes or deploy.
kayg commented 2026-10-21 16:39:43 +00:00
Author
Owner
Copy link

P3 cleanup-order finding, test-only commit 737b2c095 pushed. websocket.rs:953-961 now receives typed AUTHORITY_UNAVAILABLE from the wake branches and therefore awaits failure_reason/teardown_read before the stream-end record and drop(attachments) at :969. Before this diff, that miss became RESUME_REFUSED and skipped the pre-drop classification read. Stream-resource cleanup moves later by one attempt bound (25 ms production). Guarded work is not polled during it; known Refused keeps its old ordering; the total socket-close path still has one teardown read in either ordering. This is not an added authorization grace period.

The new attached-terminal regression deletes the session on the held connection, publishes revocation, parks browser probes, keeps storage unavailable, and advances controlled runtime through the existing one-second wait. With the fixture's existing 100 ms attempt bound, stream-end records are still absent at that fence: 0 passed, 1 failed at the cleanup assertion; setup/liveness checks completed. No physical latency claim. The old ordering is established by source comparison, not a full-base replay. No fix added.

Seven new review tests now comprise five PASS and two deliberate diagnostic regressions (P2 wire code, P3 cleanup ordering). Original author-head fast gate completed exit 0 and is attached above. A full gate on final review head 737b2c095 is queued behind the isolated 0705cfbf3 milestone; final verdict pending head lint/gate and cleanup.

stream-end-review-test.log
stream-end-sequence.txt

P3 cleanup-order finding, test-only commit 737b2c095 pushed. websocket.rs:953-961 now receives typed AUTHORITY_UNAVAILABLE from the wake branches and therefore awaits failure_reason/teardown_read before the stream-end record and drop(attachments) at :969. Before this diff, that miss became RESUME_REFUSED and skipped the pre-drop classification read. Stream-resource cleanup moves later by one attempt bound (25 ms production). Guarded work is not polled during it; known Refused keeps its old ordering; the total socket-close path still has one teardown read in either ordering. This is not an added authorization grace period. The new attached-terminal regression deletes the session on the held connection, publishes revocation, parks browser probes, keeps storage unavailable, and advances controlled runtime through the existing one-second wait. With the fixture's existing 100 ms attempt bound, stream-end records are still absent at that fence: 0 passed, 1 failed at the cleanup assertion; setup/liveness checks completed. No physical latency claim. The old ordering is established by source comparison, not a full-base replay. No fix added. Seven new review tests now comprise five PASS and two deliberate diagnostic regressions (P2 wire code, P3 cleanup ordering). Original author-head fast gate completed exit 0 and is attached above. A full gate on final review head 737b2c095 is queued behind the isolated 0705cfbf3 milestone; final verdict pending head lint/gate and cleanup. [stream-end-review-test.log](https://git.kayg.org/attachments/78a80bab-3a80-4670-80f9-5380519ae3d0) [stream-end-sequence.txt](https://git.kayg.org/attachments/a09c2494-3f9b-434d-ae81-8d61281a1c78)
kayg commented 2026-10-21 16:48:20 +00:00
Author
Owner
Copy link

0705cfbf3 milestone hit the owner-listed auth socket storm exception at review_authority_cap.rs:162: explicit WebSocket Close count 10/16, with no application Result observed (that would fail earlier). The exact author-head fast gate had passed in its earlier window. Comparing against owned detached origin/dev adee19da0 now, using the same CARGO_TARGET_DIR. The storm test function is byte-identical on that dev baseline. Baseline compile is in progress; paired compiled-binary checks will record each load window before any exception is applied. No production fix or timeout change. Final review head remains pushed 737b2c095.

0705cfbf3 milestone hit the owner-listed auth socket storm exception at review_authority_cap.rs:162: explicit WebSocket Close count 10/16, with no application Result observed (that would fail earlier). The exact author-head fast gate had passed in its earlier window. Comparing against owned detached origin/dev adee19da0 now, using the same CARGO_TARGET_DIR. The storm test function is byte-identical on that dev baseline. Baseline compile is in progress; paired compiled-binary checks will record each load window before any exception is applied. No production fix or timeout change. Final review head remains pushed 737b2c095.
kayg commented 2026-10-21 16:54:23 +00:00
Author
Owner
Copy link

Owner #118 baseline comparison complete in fixed paired order on the same build host/load window: detached origin/dev adee19da0 initial filtered run PASS, then dev 3/3 PASS; retained review executable 2/3 PASS, one Close-count failure. Every invocation selected exactly one test; the test function is byte-identical. The paired JSON records each start/load and all outcomes, with no timing claim. No matched-baseline failure was reproduced, so I am NOT applying the load exception. The final 737b2c095 gate must pass this pre-existing case; it is queued behind the earlier isolated milestone. No production or timeout changes.

dev-storm-test.log
storm-paired-results.json
storm-pair-3-candidate.log
storm-baseline-comparison.txt

Owner #118 baseline comparison complete in fixed paired order on the same build host/load window: detached origin/dev adee19da0 initial filtered run PASS, then dev 3/3 PASS; retained review executable 2/3 PASS, one Close-count failure. Every invocation selected exactly one test; the test function is byte-identical. The paired JSON records each start/load and all outcomes, with no timing claim. No matched-baseline failure was reproduced, so I am NOT applying the load exception. The final 737b2c095 gate must pass this pre-existing case; it is queued behind the earlier isolated milestone. No production or timeout changes. [dev-storm-test.log](https://git.kayg.org/attachments/d613b702-7fbc-4b20-81df-93853604aaa7) [storm-paired-results.json](https://git.kayg.org/attachments/2944ca0a-d664-424b-90c4-707f7eeb35a9) [storm-pair-3-candidate.log](https://git.kayg.org/attachments/bdf06ff0-ff94-418d-ac2b-47d4683583ff) [storm-baseline-comparison.txt](https://git.kayg.org/attachments/688d7ae9-153a-4fc4-a8c7-2b46c27e7704)
kayg commented 2026-10-21 17:17:37 +00:00
Author
Owner
Copy link

Diagnostic outcomes narrowed the loaded failures: the 10-run cohort passed 7/10; all three failures observed Connection reset by peer (os error 104) on clients that did not receive a WebSocket Close, with no action Result and no 15-second timeout. The companion protocol test passed 87/87. This proves a terminal TCP reset rather than a socket that remained open, but it does not prove a clean WebSocket close. I am retaining the explicit-close and no-reply assertions while comparing a paused Tokio-time cohort. Evidence: diagnostic-error.log, diagnostic-error-summary.json, diagnostic-error-protocol.log.

Diagnostic outcomes narrowed the loaded failures: the 10-run cohort passed 7/10; all three failures observed `Connection reset by peer (os error 104)` on clients that did not receive a WebSocket Close, with no action Result and no 15-second timeout. The companion protocol test passed 87/87. This proves a terminal TCP reset rather than a socket that remained open, but it does not prove a clean WebSocket close. I am retaining the explicit-close and no-reply assertions while comparing a paused Tokio-time cohort. Evidence: [diagnostic-error.log](https://git.kayg.org/attachments/c3034e3e-51de-45f0-97a2-68f904068a94), [diagnostic-error-summary.json](https://git.kayg.org/attachments/d861eced-6579-484c-af52-8f342a814bfc), [diagnostic-error-protocol.log](https://git.kayg.org/attachments/609b507e-8713-423d-ba60-22aaad84f8f9).
kayg commented 2026-10-21 17:18:55 +00:00
Author
Owner
Copy link

Verdict: HOLD — the stated 1013 wire acceptance criterion is not met (P2). No P0/P1 found. Findings: 1 P2, 1 P3. No fixes or deploy.

Reviewed 6fe600b0e..300c0c8cb. Test-only branch review-auth-busy-wake is pushed at 737b2c095b; eight atomic commits contain seven new tests plus test placement cleanup. Root worktree is clean and origin matches HEAD.

  • P2, crates/infraternal-server/src/websocket.rs:975 (and hardcoded 1011 at :990): an idle authenticated socket is held on busy storage, then receives a shared revocation wake. After retries exhaust, the main loop records AUTHORITY_UNAVAILABLE but its teardown sends no guaranteed 1013. The real-socket regression observes close codes=[] with storage still held. If a teardown read succeeds, this path instead hardcodes 1011. The only new 1013 mapping is in the transport-input end path, which the main wake need not take. This teardown block is byte-identical to the diff base: a pre-existing wire gap remains against the explicit contract. Test: review_busy_wake.rs:79, commit 939b456cd.
  • P3, crates/infraternal-server/src/websocket.rs:953-969: typed unavailable now enters failure_reason before recording the stream end and dropping attachments. Previously the generic refusal exit performed those steps before its teardown read. Resource cleanup therefore moves later by up to one attempt bound (25 ms configured in production). Guarded work remains stopped; known Refused retains its ordering; the total socket-close path still contains one teardown read in either ordering. The attached-terminal controlled-clock test exposes the delay using the fixture's existing 100 ms attempt bound; its failed fence is at close_logging.rs:1018, commit 737b2c095. Old ordering is established by source comparison, not a full-base replay.

Edges checked: twelve revoked-stall boundaries, expiry crossing a held read, fractional deadline arithmetic, closed revocation source, separate wall/runtime clock behavior, sixteen real sockets recovering application authority, and all four retained read places plus pool recovery. Five new tests pass; two intentionally fail at the findings above. A closed notification source correctly means unavailable infrastructure; normal Auth ownership keeps its sender alive. No new authorization grace period was found. Live CLOCK_REALTIME was not stepped, and no fresh performance claim is made.

Exact author head 300c0c8cb: scripts/verify fast completed exit 0, with no exception. Server: 626 passed, 0 failed, 52 ignored. Verbatim Rust gate output:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

exit=0

Final review head 737b2c095: touched-server all-target clippy with remote,infraternal-agent/mesh and -D warnings PASS. Full scripts/verify fast completed exit 1 solely for the two intentional review regressions: server 631 passed, 2 failed, 52 ignored. Every other Rust row passes. Verbatim final gate output:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| test                      | FAIL (101)   |
| SSH inode reuse fixture   | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

exit=1

The Rust failure stops the dispatcher before TypeScript, so supplemental TypeScript was run separately and completed exit 0. Complete unfiltered gate and lint/TypeScript transcripts are attached.

The pre-existing 16-socket storm passed in the final full run. Earlier milestone failure (10/16 Close count), owned detached dev baseline adee19da0 and fixed paired results are recorded above: dev 3/3 PASS, review 2/3 PASS. No matched-baseline exception was applied or needed for the final head.

D243 same-recipe comparison against the review branch's merge base 300c0c8cb: stripped static x86_64 21,389,040 -> 21,389,040 bytes (+0); aarch64 19,561,912 -> 19,561,912 (+0). Both images are byte-identical and satisfy their exact caps.

Cleanup complete: owned detached author/baseline checkouts, the one Cargo target folder, retained test executables and any worktree target/ are removed. Raw receipts remain outside the checkout and are attached here. Issue remains open.

author-verify-fast.log
author-gate-summary.txt
author-static.json

final-verify-fast.log
final-gate-summary.txt
final-server-clippy.log
final-typescript.log
binary-comparison.json
functional-results-final.json
review-audit-final.txt
review-commit-history.txt
cleanup.json

Verdict: HOLD — the stated 1013 wire acceptance criterion is not met (P2). No P0/P1 found. Findings: 1 P2, 1 P3. No fixes or deploy. Reviewed 6fe600b0e..300c0c8cb. Test-only branch review-auth-busy-wake is pushed at 737b2c095b61d960fab726f56ce0511a0300acd0; eight atomic commits contain seven new tests plus test placement cleanup. Root worktree is clean and origin matches HEAD. - P2, crates/infraternal-server/src/websocket.rs:975 (and hardcoded 1011 at :990): an idle authenticated socket is held on busy storage, then receives a shared revocation wake. After retries exhaust, the main loop records AUTHORITY_UNAVAILABLE but its teardown sends no guaranteed 1013. The real-socket regression observes close codes=[] with storage still held. If a teardown read succeeds, this path instead hardcodes 1011. The only new 1013 mapping is in the transport-input end path, which the main wake need not take. This teardown block is byte-identical to the diff base: a pre-existing wire gap remains against the explicit contract. Test: review_busy_wake.rs:79, commit 939b456cd. - P3, crates/infraternal-server/src/websocket.rs:953-969: typed unavailable now enters failure_reason before recording the stream end and dropping attachments. Previously the generic refusal exit performed those steps before its teardown read. Resource cleanup therefore moves later by up to one attempt bound (25 ms configured in production). Guarded work remains stopped; known Refused retains its ordering; the total socket-close path still contains one teardown read in either ordering. The attached-terminal controlled-clock test exposes the delay using the fixture's existing 100 ms attempt bound; its failed fence is at close_logging.rs:1018, commit 737b2c095. Old ordering is established by source comparison, not a full-base replay. Edges checked: twelve revoked-stall boundaries, expiry crossing a held read, fractional deadline arithmetic, closed revocation source, separate wall/runtime clock behavior, sixteen real sockets recovering application authority, and all four retained read places plus pool recovery. Five new tests pass; two intentionally fail at the findings above. A closed notification source correctly means unavailable infrastructure; normal Auth ownership keeps its sender alive. No new authorization grace period was found. Live CLOCK_REALTIME was not stepped, and no fresh performance claim is made. Exact author head 300c0c8cb: scripts/verify fast completed exit 0, with no exception. Server: 626 passed, 0 failed, 52 ignored. Verbatim Rust gate output: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ exit=0 ``` Final review head 737b2c095: touched-server all-target clippy with remote,infraternal-agent/mesh and -D warnings PASS. Full scripts/verify fast completed exit 1 solely for the two intentional review regressions: server 631 passed, 2 failed, 52 ignored. Every other Rust row passes. Verbatim final gate output: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | test | FAIL (101) | | SSH inode reuse fixture | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ exit=1 ``` The Rust failure stops the dispatcher before TypeScript, so supplemental TypeScript was run separately and completed exit 0. Complete unfiltered gate and lint/TypeScript transcripts are attached. The pre-existing 16-socket storm passed in the final full run. Earlier milestone failure (10/16 Close count), owned detached dev baseline adee19da0 and fixed paired results are recorded above: dev 3/3 PASS, review 2/3 PASS. No matched-baseline exception was applied or needed for the final head. D243 same-recipe comparison against the review branch's merge base 300c0c8cb: stripped static x86_64 21,389,040 -> 21,389,040 bytes (+0); aarch64 19,561,912 -> 19,561,912 (+0). Both images are byte-identical and satisfy their exact caps. Cleanup complete: owned detached author/baseline checkouts, the one Cargo target folder, retained test executables and any worktree target/ are removed. Raw receipts remain outside the checkout and are attached here. Issue remains open. [author-verify-fast.log](https://git.kayg.org/attachments/eacdebf1-158d-46d8-8898-dc2a1f35769f) [author-gate-summary.txt](https://git.kayg.org/attachments/f762b78d-4c6c-4e6c-98b9-c6f7f1194670) [author-static.json](https://git.kayg.org/attachments/2ac07c50-43da-4185-95c4-eae6c63366ca) [final-verify-fast.log](https://git.kayg.org/attachments/acf54e7c-97cf-49c2-9132-63bde925fa3f) [final-gate-summary.txt](https://git.kayg.org/attachments/5ca3cd97-8acd-4100-87d8-56e78494c0b6) [final-server-clippy.log](https://git.kayg.org/attachments/dfd08b21-63f0-4c48-8221-21a44c6df89a) [final-typescript.log](https://git.kayg.org/attachments/ec97e350-78fb-4d0f-b03e-acca2de0aee4) [binary-comparison.json](https://git.kayg.org/attachments/d33d0ddb-0167-4ff4-9bfc-ab627e0fdcd0) [functional-results-final.json](https://git.kayg.org/attachments/88328133-15c0-4dc4-a66f-92f4828b55b8) [review-audit-final.txt](https://git.kayg.org/attachments/b36e4f78-250b-477b-8078-005a09c11e0d) [review-commit-history.txt](https://git.kayg.org/attachments/6fcf8445-b805-4a9e-bef2-4e3623142a79) [cleanup.json](https://git.kayg.org/attachments/cd37d97c-5ded-4534-bffb-91f9df22aad0)
kayg commented 2026-10-21 17:22:05 +00:00
Author
Owner
Copy link

Start: branch auth-busy-1013, base origin/review-auth-busy-wake at 737b2c095b61d960fab726f56ce0511a0300acd0. Fixing the two review regressions: route known Unavailable teardown through the existing 1013 close-frame path and skip the redundant teardown authority read. Existing limits remain unchanged.

Start: branch `auth-busy-1013`, base `origin/review-auth-busy-wake` at `737b2c095b61d960fab726f56ce0511a0300acd0`. Fixing the two review regressions: route known Unavailable teardown through the existing 1013 close-frame path and skip the redundant teardown authority read. Existing limits remain unchanged.
kayg commented 2026-10-21 17:30:28 +00:00
Author
Owner
Copy link

The paused-clock focused test is still queued in the host-wide build-slot wrapper; its compile/test command has not started. The worktree change remains limited to the storm test. I will continue once a slot is released.

The paused-clock focused test is still queued in the host-wide build-slot wrapper; its compile/test command has not started. The worktree change remains limited to the storm test. I will continue once a slot is released.
kayg commented 2026-10-21 17:32:13 +00:00
Author
Owner
Copy link

Paused-time diagnostic: the strict assertion passed once all real SQLite/WebSocket setup finished and Tokio time was paused immediately before the storm calls (1/1, 16 explicit Close outcomes, no Result). start_paused = true from runtime creation instead made the SQLx in-memory fixture fail at auth/tests.rs:232 with PoolTimedOut, so the test now pauses only after acquiring the held connection. Evidence: paused-single.log.

Paused-time diagnostic: the strict assertion passed once all real SQLite/WebSocket setup finished and Tokio time was paused immediately before the storm calls (1/1, 16 explicit Close outcomes, no Result). `start_paused = true` from runtime creation instead made the SQLx in-memory fixture fail at `auth/tests.rs:232` with `PoolTimedOut`, so the test now pauses only after acquiring the held connection. Evidence: [paused-single.log](https://git.kayg.org/attachments/e1d53877-8001-486f-9853-a3c847d8b956).
kayg commented 2026-10-21 17:37:28 +00:00
Author
Owner
Copy link

Confirmed against head 737b2c095: the main-loop wake records AUTHORITY_UNAVAILABLE, but teardown called failure_reason before releasing attachments, then the final close path could make another liveness read and suppress the close. The #240 review receipts show the wire case observed no close code and the attached-terminal case had no stream-end by the one-second fence. The working diff preserves the known unavailable result, skips both reads, and sends the existing control close frame with code 1013 and the server_busy classification. The retry and read limits are unchanged. Targeted validation is pending.

Confirmed against head `737b2c095`: the main-loop wake records `AUTHORITY_UNAVAILABLE`, but teardown called `failure_reason` before releasing attachments, then the final close path could make another liveness read and suppress the close. The #240 review receipts show the wire case observed no close code and the attached-terminal case had no stream-end by the one-second fence. The working diff preserves the known unavailable result, skips both reads, and sends the existing control close frame with code 1013 and the `server_busy` classification. The retry and read limits are unchanged. Targeted validation is pending.
kayg commented 2026-10-21 17:38:42 +00:00
Author
Owner
Copy link

The revised 50-run isolated + 50-run companion-load harness has been waiting in build-slot for more than five minutes. It has not started and has produced no cohort logs. It needs a host-wide slot release; I am keeping it queued.

The revised 50-run isolated + 50-run companion-load harness has been waiting in `build-slot` for more than five minutes. It has not started and has produced no cohort logs. It needs a host-wide slot release; I am keeping it queued.
kayg commented 2026-10-21 17:42:59 +00:00
Author
Owner
Copy link

Correction from a second source pass: AUTHORITY_UNAVAILABLE is also provisional after a guarded frame failure (websocket.rs frame handler), where failure_reason must still distinguish a refusal from a busy store. I am tracking the typed known-unavailable outcome separately; only an exhausted wake read or a closed revocation source will bypass that classification read. This keeps revoked-session behavior intact.

Correction from a second source pass: `AUTHORITY_UNAVAILABLE` is also provisional after a guarded frame failure (`websocket.rs` frame handler), where `failure_reason` must still distinguish a refusal from a busy store. I am tracking the typed known-unavailable outcome separately; only an exhausted wake read or a closed revocation source will bypass that classification read. This keeps revoked-session behavior intact.
kayg commented 2026-10-21 17:43:10 +00:00
Author
Owner
Copy link

The paused-clock experiment rejects the time-control approach for this test: with the exact 16-WebSocket-close assertion, the edited test passed 35/50 isolated and 45/50 with the protocol companion test (162 companion passes, 0 failures). Every failed run reported Connection reset by peer for sockets without an explicit Close; none timed out or received a Result. Automatic time advancement also advances the production 25 ms best-effort close deadline before every close frame can be observed. I will assert the actual fail-closed contract instead: every socket reaches a terminal outcome (Close, EOF or read error), no Result is received, and unexpected messages/timeouts fail. Evidence: paused-isolated.log, paused-isolated-summary.json, paused-loaded.log, paused-loaded-summary.json, paused-protocol-companion.log.

The paused-clock experiment rejects the time-control approach for this test: with the exact 16-WebSocket-close assertion, the edited test passed 35/50 isolated and 45/50 with the protocol companion test (162 companion passes, 0 failures). Every failed run reported `Connection reset by peer` for sockets without an explicit Close; none timed out or received a Result. Automatic time advancement also advances the production 25 ms best-effort close deadline before every close frame can be observed. I will assert the actual fail-closed contract instead: every socket reaches a terminal outcome (Close, EOF or read error), no Result is received, and unexpected messages/timeouts fail. Evidence: [paused-isolated.log](https://git.kayg.org/attachments/658061cb-f883-435c-ac7c-28214994cb0e), [paused-isolated-summary.json](https://git.kayg.org/attachments/7e95051f-b127-4cc2-8aca-c55f36001da0), [paused-loaded.log](https://git.kayg.org/attachments/49046ff6-f0bb-4532-a2f4-806a86b9ab97), [paused-loaded-summary.json](https://git.kayg.org/attachments/461ac8ac-1ce8-42ab-ad6e-cfbb725f9251), [paused-protocol-companion.log](https://git.kayg.org/attachments/c50da451-c134-4686-a138-0d8bc48605ff).
kayg commented 2026-10-21 17:45:53 +00:00
Author
Owner
Copy link

Step evidence: run_socket now tracks a typed Unavailable outcome separately from the provisional frame-error reason. Known busy wakes release attachments without another authority read and send the control close frame with code 1013; refusal classification remains on provisional paths. No wait, retry, or pool limit changed. With remote,infraternal-agent/mesh, both requested tests pass (1/1 each). Full server validation and the repository iterate gate are pending; the diff is still uncommitted at base 737b2c095.

review-1013-final.log
review-cleanup-final.log

Step evidence: `run_socket` now tracks a typed Unavailable outcome separately from the provisional frame-error reason. Known busy wakes release attachments without another authority read and send the control close frame with code 1013; refusal classification remains on provisional paths. No wait, retry, or pool limit changed. With `remote,infraternal-agent/mesh`, both requested tests pass (1/1 each). Full server validation and the repository iterate gate are pending; the diff is still uncommitted at base `737b2c095`. [review-1013-final.log](https://git.kayg.org/attachments/7d798048-62d2-4bd6-aa14-c9d8d7a55e58) [review-cleanup-final.log](https://git.kayg.org/attachments/2e9c7a0e-4178-4f86-9485-f18b576e652a)
kayg commented 2026-10-21 17:47:56 +00:00
Author
Owner
Copy link

Classification: test defect. The original assertion equated a WebSocket Close frame with a closed socket. Under load, misses were Connection reset by peer terminal reads, not timeouts or action Results. Pausing Tokio time is unsuitable here: it also advances the 25 ms best-effort close write deadline and produced 35/50 isolated, 45/50 loaded with the strict assertion. The revised test requires all 16 sockets to reach a terminal read outcome (Close, EOF or read error), still panics on any Result, and fails on unexpected messages or a 15 s timeout. It passed 50/50 isolated and 50/50 loaded alongside 409 successful protocol test runs (0 companion failures). infraternal-dev, 12 CPUs; load average start/end: isolated 17.02/12.41/12.84 → 10.03/10.99/12.28; loaded 10.03/10.99/12.28 → 6.31/9.79/11.76. Evidence: terminal-isolated.log, terminal-isolated-summary.json, terminal-loaded.log, terminal-loaded-summary.json, terminal-protocol-companion.log.

Classification: test defect. The original assertion equated a WebSocket Close frame with a closed socket. Under load, misses were `Connection reset by peer` terminal reads, not timeouts or action Results. Pausing Tokio time is unsuitable here: it also advances the 25 ms best-effort close write deadline and produced 35/50 isolated, 45/50 loaded with the strict assertion. The revised test requires all 16 sockets to reach a terminal read outcome (Close, EOF or read error), still panics on any Result, and fails on unexpected messages or a 15 s timeout. It passed 50/50 isolated and 50/50 loaded alongside 409 successful protocol test runs (0 companion failures). `infraternal-dev`, 12 CPUs; load average start/end: isolated 17.02/12.41/12.84 → 10.03/10.99/12.28; loaded 10.03/10.99/12.28 → 6.31/9.79/11.76. Evidence: [terminal-isolated.log](https://git.kayg.org/attachments/4db2cf0e-4bf2-4254-9b6a-4c6adbc2ba4b), [terminal-isolated-summary.json](https://git.kayg.org/attachments/daf6348e-86b0-4db9-b349-f9a205e09e3f), [terminal-loaded.log](https://git.kayg.org/attachments/0c8a5a16-0d50-48b4-9d94-9f1fe50394a1), [terminal-loaded-summary.json](https://git.kayg.org/attachments/ff9564a7-a2a2-42b1-8cb0-603fed406960), [terminal-protocol-companion.log](https://git.kayg.org/attachments/48b83c9f-ce0b-4691-8fae-2b8a3f0e46df).
kayg commented 2026-10-21 17:51:36 +00:00
Author
Owner
Copy link

Start revocation-per-account at 300c0c8cb7 (origin/auth-busy-wake). origin/auth-busy-1013 is not pushed. Read #240 history and retrieved parent #146 history. Continuing the recorded per-account watch/lifecycle plan: independent generations, subscribe before authority reads, publish after commit, remove the last subscriber's entry. Logout carries account and session hash; recovery carries account. No current production mutation affects every account; any all-account test notification models out-of-band database changes only. No deploy or development-line push.

Start revocation-per-account at 300c0c8cb7de63084e887f8a3944f658d8b8599e (origin/auth-busy-wake). origin/auth-busy-1013 is not pushed. Read #240 history and retrieved parent #146 history. Continuing the recorded per-account watch/lifecycle plan: independent generations, subscribe before authority reads, publish after commit, remove the last subscriber's entry. Logout carries account and session hash; recovery carries account. No current production mutation affects every account; any all-account test notification models out-of-band database changes only. No deploy or development-line push.
kayg commented 2026-10-21 17:55:52 +00:00
Author
Owner
Copy link

Finding: websocket.rs:726 also guards recovery-state delivery with while_authorized on the server-wide recovery_changes channel. auth/webauthn.rs:222 publishes it after recovery completion, so scoping revocations alone would still make every recovery-subscribed account read authority. Reusing the account registry for recovery-state notifications in a separate logical commit; start/cancel/rotation/complete already know the affected account. No global production recovery-state case exists. Existing per-account snapshot contents and subscription protocol stay unchanged.

Finding: websocket.rs:726 also guards recovery-state delivery with while_authorized on the server-wide recovery_changes channel. auth/webauthn.rs:222 publishes it after recovery completion, so scoping revocations alone would still make every recovery-subscribed account read authority. Reusing the account registry for recovery-state notifications in a separate logical commit; start/cancel/rotation/complete already know the affected account. No global production recovery-state case exists. Existing per-account snapshot contents and subscription protocol stay unchanged.
kayg commented 2026-10-21 18:00:01 +00:00
Author
Owner
Copy link

Additive contract note before documentation: keywrap.md recovery visibility retains its existing protocol and account-selected snapshots. Document that revocation and recovery-state wake generations are independent per authenticated account, subscribed before entry reads, published after commit, and coalescing always means recheck that account. Session hashes are private hints, never a reason to skip a recheck. Current logout/recovery mutations have no server-wide case; shutdown/restore restart ends sockets directly. Test-only unknown-scope database notifications may wake every account to model infrastructure loss. No foundational choice or frozen wire change.

Additive contract note before documentation: keywrap.md recovery visibility retains its existing protocol and account-selected snapshots. Document that revocation and recovery-state wake generations are independent per authenticated account, subscribed before entry reads, published after commit, and coalescing always means recheck that account. Session hashes are private hints, never a reason to skip a recheck. Current logout/recovery mutations have no server-wide case; shutdown/restore restart ends sockets directly. Test-only unknown-scope database notifications may wake every account to model infrastructure loss. No foundational choice or frozen wire change.
kayg commented 2026-10-21 18:07:01 +00:00
Author
Owner
Copy link

scripts/verify iterate reached server clippy and found one touched-file lint: clippy::items_after_statements because SocketOutcome is declared inside the test after setup statements (review_authority_cap.rs:125). I will move the enum to module scope and rerun the affected gates.

`scripts/verify iterate` reached server clippy and found one touched-file lint: `clippy::items_after_statements` because `SocketOutcome` is declared inside the test after setup statements (review_authority_cap.rs:125). I will move the enum to module scope and rerun the affected gates.
kayg commented 2026-10-21 18:10:50 +00:00
Author
Owner
Copy link

Registry checks: 6/6 PASS in a standalone harness against built Tokio/futures dependencies. Covers coalesced two-account generations, cancellation, 256 independent accounts, last-subscriber removal, 4 concurrent registration/cleanup callers and notification outside the registry lock. This is an early functional check, not the server crate gate. Pre-fix server compilation at 300c0c8cb remains in progress. No commits yet.

primitive-standalone.log

Registry checks: 6/6 PASS in a standalone harness against built Tokio/futures dependencies. Covers coalesced two-account generations, cancellation, 256 independent accounts, last-subscriber removal, 4 concurrent registration/cleanup callers and notification outside the registry lock. This is an early functional check, not the server crate gate. Pre-fix server compilation at 300c0c8cb remains in progress. No commits yet. [primitive-standalone.log](https://git.kayg.org/attachments/761bbefc-8fb2-450a-8879-84f07b3e1f24)
kayg commented 2026-10-21 18:24:50 +00:00
Author
Owner
Copy link

Committed and pushed 9896d3a85749... as auth-busy-1013. The remote-feature server suite passed 633 tests, 0 failed, 52 ignored; all-target clippy with remote,infraternal-agent/mesh passed. scripts/verify iterate exited 0: all eight Rust rows passed, and each TypeScript phase reported 0 failures (345 tests across 59 files, plus the smaller protocol, metadata and release suites). Final scripts/verify fast is pending.

Auth self-review (B1/S1/S2/N1): typed refusal behavior stays intact; provisional frame errors still go through failure_reason; only confirmed Unavailable avoids another authority read and reports server_busy/1013. Retry, timeout, pool and renewal limits are unchanged. No schema, dependency, crypto or parser changes; no secrets enter code or logs.

server-remote-tests.log
server-remote-clippy.log
verify-iterate.log

Committed and pushed `9896d3a85749...` as `auth-busy-1013`. The remote-feature server suite passed 633 tests, 0 failed, 52 ignored; all-target clippy with `remote,infraternal-agent/mesh` passed. `scripts/verify iterate` exited 0: all eight Rust rows passed, and each TypeScript phase reported 0 failures (345 tests across 59 files, plus the smaller protocol, metadata and release suites). Final `scripts/verify fast` is pending. Auth self-review (B1/S1/S2/N1): typed refusal behavior stays intact; provisional frame errors still go through `failure_reason`; only confirmed Unavailable avoids another authority read and reports `server_busy`/1013. Retry, timeout, pool and renewal limits are unchanged. No schema, dependency, crypto or parser changes; no secrets enter code or logs. [server-remote-tests.log](https://git.kayg.org/attachments/60cde0a1-1fc9-40d3-a708-1063cd8e80b5) [server-remote-clippy.log](https://git.kayg.org/attachments/8b280784-6f04-4b4a-9c48-6367c0315e98) [verify-iterate.log](https://git.kayg.org/attachments/ee6877d8-60e5-46bd-81c8-7cb2c0d4a16d)
kayg commented 2026-10-21 18:24:55 +00:00
Author
Owner
Copy link

Correction: the full commit SHA is 9896d3a85b7499fee9e7237fc6233c913f41bd5b.

Correction: the full commit SHA is `9896d3a85b7499fee9e7237fc6233c913f41bd5b`.
kayg commented 2026-10-21 18:31:33 +00:00
Author
Owner
Copy link

Base update: origin/auth-busy-1013 appeared at 9896d3a85b. Fast-forwarded revocation-per-account to it before any own commit, as requested. Stopped only own build process group 2945118; its partial primitive crate gate is not counted as a pass. Baseline checkout now also 9896d3a85. Static comparison and remaining gates will use that merge base.

Valid old-base (300c0c8cb) red results: account notification 0/1; admission/subscription gap 0/2; 256 sockets/16 accounts logout 0/1, one unrelated account authority reads 112 -> 128 (+16). The old recovery capacity run failed at fixture setup (synthetic future NOW after HTTP wall-time renewal), so it is not evidence of the product defect. Corrected to current recovery time and the returned ready_at; rerunning on 9896d3a85 before the recovery fix.

Base update: origin/auth-busy-1013 appeared at 9896d3a85b7499fee9e7237fc6233c913f41bd5b. Fast-forwarded revocation-per-account to it before any own commit, as requested. Stopped only own build process group 2945118; its partial primitive crate gate is not counted as a pass. Baseline checkout now also 9896d3a85. Static comparison and remaining gates will use that merge base. Valid old-base (300c0c8cb) red results: account notification 0/1; admission/subscription gap 0/2; 256 sockets/16 accounts logout 0/1, one unrelated account authority reads 112 -> 128 (+16). The old recovery capacity run failed at fixture setup (synthetic future NOW after HTTP wall-time renewal), so it is not evidence of the product defect. Corrected to current recovery time and the returned ready_at; rerunning on 9896d3a85 before the recovery fix.
kayg commented 2026-10-21 18:35:04 +00:00
Author
Owner
Copy link

Pre-fix evidence on 9896d3a85: admission/subscription-gap tests 0/2; account notification + full-capacity logout tests 0/2; corrected full-capacity recovery test 0/1. Real SQLite and 256 real WebSockets across 61 accounts. One unrelated four-socket account reads 28 -> 32 on logout (+4), and 28 -> 40 on recovery start/completion (+12). The recovery fixture now uses wall time and returned ready_at; it reaches completion and fails the intended read-isolation assertion.

Build-host functional evidence only, no latency claim. Environment and exact reproduction sources attached. The first primitive module crate gate is running; no own commit yet.

red-upgrade-9896.log
red-logout-9896.log
red-recovery-9896.log
base-functional-9896-environment.json
baseline-regressions-9896.patch

Pre-fix evidence on 9896d3a85: admission/subscription-gap tests 0/2; account notification + full-capacity logout tests 0/2; corrected full-capacity recovery test 0/1. Real SQLite and 256 real WebSockets across 61 accounts. One unrelated four-socket account reads 28 -> 32 on logout (+4), and 28 -> 40 on recovery start/completion (+12). The recovery fixture now uses wall time and returned ready_at; it reaches completion and fails the intended read-isolation assertion. Build-host functional evidence only, no latency claim. Environment and exact reproduction sources attached. The first primitive module crate gate is running; no own commit yet. [red-upgrade-9896.log](https://git.kayg.org/attachments/7fcfffff-3649-4e32-b314-9f5ac964a132) [red-logout-9896.log](https://git.kayg.org/attachments/ab7f3f70-d7eb-4a5b-8c90-9239d1e350f8) [red-recovery-9896.log](https://git.kayg.org/attachments/bfa4d605-a51f-45ec-9a9e-b8db716bdd95) [base-functional-9896-environment.json](https://git.kayg.org/attachments/467557b3-e3fd-4ee3-acd5-7cf433850b88) [baseline-regressions-9896.patch](https://git.kayg.org/attachments/09a0ee44-d280-4d3c-a19c-730a4adc97c7)
kayg commented 2026-10-21 18:35:21 +00:00
Author
Owner
Copy link

Reproduction source supplement: the attachment endpoint rejected the .rs extension (HTTP 422); the identical capacity fixture is attached as plain text. The preceding patch includes the test-only read counter and test-module registration.

baseline-capacity-9896.txt

Reproduction source supplement: the attachment endpoint rejected the .rs extension (HTTP 422); the identical capacity fixture is attached as plain text. The preceding patch includes the test-only read counter and test-module registration. [baseline-capacity-9896.txt](https://git.kayg.org/attachments/682407d4-6e1f-421b-9906-5b16db918c0d)
kayg commented 2026-10-21 18:37:18 +00:00
Author
Owner
Copy link

Moved SocketOutcome to module scope and made ReadError a unit variant so failures retain outcome categories without dead-field warnings. The focused storm test passes (1/1); cargo clippy --locked -p infraternal-server --all-targets -- -D warnings passes. I am rerunning scripts/verify iterate for a green branch gate. Evidence: final-focused.log, server-clippy.log.

Moved `SocketOutcome` to module scope and made `ReadError` a unit variant so failures retain outcome categories without dead-field warnings. The focused storm test passes (1/1); `cargo clippy --locked -p infraternal-server --all-targets -- -D warnings` passes. I am rerunning `scripts/verify iterate` for a green branch gate. Evidence: [final-focused.log](https://git.kayg.org/attachments/dccc8300-9a24-413c-82cc-9cb9570f2e4f), [server-clippy.log](https://git.kayg.org/attachments/d0f5ed27-b860-4bc0-b020-20d8604c6fa0).
kayg commented 2026-10-21 18:42:12 +00:00
Author
Owner
Copy link

Self-review caught an uncommitted registry cleanup race: checking watch.receiver_count in the wrapper Drop runs before receiver fields are destroyed. Two final wrappers can both see two receivers and retain an inactive entry. A test-only barrier holds both receiver fields after bookkeeping; the regression fails before correction and passes afterward. The registry now counts subscription lifetimes under its existing mutex with no extra allocation or atomic counter, and checks key identity so an old closed cursor cannot remove a replacement generation.

Standalone module: 9/9 PASS. The crate gate also found one single_match_else lint, corrected to if let. That partial gate is not a pass; exact-source crate validation is scheduled after the clean 9896d3a85 static baseline build currently running. No own commit yet.

red-final-subscriber.log
green-final-subscriber.log

Self-review caught an uncommitted registry cleanup race: checking watch.receiver_count in the wrapper Drop runs before receiver fields are destroyed. Two final wrappers can both see two receivers and retain an inactive entry. A test-only barrier holds both receiver fields after bookkeeping; the regression fails before correction and passes afterward. The registry now counts subscription lifetimes under its existing mutex with no extra allocation or atomic counter, and checks key identity so an old closed cursor cannot remove a replacement generation. Standalone module: 9/9 PASS. The crate gate also found one single_match_else lint, corrected to if let. That partial gate is not a pass; exact-source crate validation is scheduled after the clean 9896d3a85 static baseline build currently running. No own commit yet. [red-final-subscriber.log](https://git.kayg.org/attachments/82ba763c-c938-412e-810e-62fcc66a2682) [green-final-subscriber.log](https://git.kayg.org/attachments/7703bebe-8eae-4b0e-90cc-67e550c47508)
kayg commented 2026-10-21 18:44:09 +00:00
Author
Owner
Copy link

The post-fix scripts/verify iterate rerun has waited in build-slot for more than five minutes and has not started. The focused storm test and server all-target clippy pass; the full fast gate remains required. This needs a host-wide slot release.

The post-fix `scripts/verify iterate` rerun has waited in `build-slot` for more than five minutes and has not started. The focused storm test and server all-target clippy pass; the full fast gate remains required. This needs a host-wide slot release.
kayg commented 2026-10-21 19:01:34 +00:00
Author
Owner
Copy link

Post-fix scripts/verify iterate passes. Rust rows: fmt, VT native fmt, compile-out, clippy, SSH runtime helper, workspace tests, inode fixture and cargo-deny all PASS; server suite: 622 passed, 0 failed, 52 ignored. TypeScript protocol suite: 39 passed, 0 failed. Evidence: verify-iterate-final.log. I am committing this single test-contract correction, then running scripts/verify fast on the branch head.

Post-fix `scripts/verify iterate` passes. Rust rows: fmt, VT native fmt, compile-out, clippy, SSH runtime helper, workspace tests, inode fixture and cargo-deny all PASS; server suite: 622 passed, 0 failed, 52 ignored. TypeScript protocol suite: 39 passed, 0 failed. Evidence: [verify-iterate-final.log](https://git.kayg.org/attachments/a431bfd6-9b8c-499b-b523-4486ef159310). I am committing this single test-contract correction, then running `scripts/verify fast` on the branch head.
kayg commented 2026-10-21 19:01:54 +00:00
Author
Owner
Copy link

Committed the single test-contract change as edfdb18124fb8bdb772f60f59bb576b3c94ce462. The post-fix iterate gate passes (server 622 passed/0 failed/52 ignored; protocol 39 passed/0 failed), and the revised test passes 50/50 isolated and 50/50 under the protocol-test companion load. The final scripts/verify fast gate and static size delta are next.

Committed the single test-contract change as `edfdb18124fb8bdb772f60f59bb576b3c94ce462`. The post-fix iterate gate passes (server 622 passed/0 failed/52 ignored; protocol 39 passed/0 failed), and the revised test passes 50/50 isolated and 50/50 under the protocol-test companion load. The final `scripts/verify fast` gate and static size delta are next.
kayg commented 2026-10-21 19:02:34 +00:00
Author
Owner
Copy link

Step 1 committed and pushed: 95e5de0e2d. Account notification registry introduced behind test configuration before production wiring. Formatter PASS; server all-target clippy with remote,infraternal-agent/mesh PASS; module tests 9 passed, 0 failed. Concurrent final-drop cleanup, replacement identity, coalescing, closed source and wake-lock safety are covered.

Clean 9896d3a85 static x86_64 baseline: 21,389,424 bytes, stripped static PIE, PT_INTERP absent (384 bytes above the earlier recorded cap). This is the merge-base reference for the branch delta. No dependency, schema or deployment change.

gate-primitive-final.log
baseline-size.json

Step 1 committed and pushed: 95e5de0e2dde298c8f2500a8eb8b513fab955355. Account notification registry introduced behind test configuration before production wiring. Formatter PASS; server all-target clippy with remote,infraternal-agent/mesh PASS; module tests 9 passed, 0 failed. Concurrent final-drop cleanup, replacement identity, coalescing, closed source and wake-lock safety are covered. Clean 9896d3a85 static x86_64 baseline: 21,389,424 bytes, stripped static PIE, PT_INTERP absent (384 bytes above the earlier recorded cap). This is the merge-base reference for the branch delta. No dependency, schema or deployment change. [gate-primitive-final.log](https://git.kayg.org/attachments/a6b20569-39c2-484c-b9bd-715d987597af) [baseline-size.json](https://git.kayg.org/attachments/56a1517f-92b2-48f8-b008-6320b4ccb0e4)
kayg commented 2026-10-21 19:04:01 +00:00
Author
Owner
Copy link

Full fast gate finding: scripts/verify fast reported a_live_legacy_runtime_cannot_publish_an_unheld_lifetime_file failed at crates/plugins/remote/src/runtime_lock_tests.rs:109 (assert!(acquire(&fixture.state()).is_ok())); that suite had 97 passed, 1 failed, 15 ignored. The gate is still building aarch64. I will rerun the isolated test after that build finishes to determine whether this was transient.

The x86_64 static artifact measured 21,389,424 bytes against the existing 21,389,040-byte cap (+384 bytes); baseline 300c0c8cb measured 21,389,040 bytes. I will record the aarch64 result and address the exact cap after the gate completes.

Full fast gate finding: `scripts/verify fast` reported `a_live_legacy_runtime_cannot_publish_an_unheld_lifetime_file` failed at `crates/plugins/remote/src/runtime_lock_tests.rs:109` (`assert!(acquire(&fixture.state()).is_ok())`); that suite had 97 passed, 1 failed, 15 ignored. The gate is still building aarch64. I will rerun the isolated test after that build finishes to determine whether this was transient. The x86_64 static artifact measured 21,389,424 bytes against the existing 21,389,040-byte cap (+384 bytes); baseline `300c0c8cb` measured 21,389,040 bytes. I will record the aarch64 result and address the exact cap after the gate completes.
kayg commented 2026-10-21 19:10:55 +00:00
Author
Owner
Copy link

Checkpoint at pushed head 95e5de0e2: pending revocation routing diff attached. It enables the registry, uses DELETE RETURNING user_id for logout, publishes recovery revocation to its account, scopes all six trusted subscriber paths, and adapts closed-source/busy-wake fixtures without changing their assertions. The OtherAccount transient fixture now asserts zero retained reads through a controlled 300 ms store hold. Formatter passed; full touched-server clippy/test command is still waiting for a host build slot (no gate result). Recovery-state routing, bootstrap entry rechecks, capacity fixture registration and final gates remain separate following steps.

revocation-routing-pending.patch

Checkpoint at pushed head 95e5de0e2: pending revocation routing diff attached. It enables the registry, uses DELETE RETURNING user_id for logout, publishes recovery revocation to its account, scopes all six trusted subscriber paths, and adapts closed-source/busy-wake fixtures without changing their assertions. The OtherAccount transient fixture now asserts zero retained reads through a controlled 300 ms store hold. Formatter passed; full touched-server clippy/test command is still waiting for a host build slot (no gate result). Recovery-state routing, bootstrap entry rechecks, capacity fixture registration and final gates remain separate following steps. [revocation-routing-pending.patch](https://git.kayg.org/attachments/2c938608-ee57-459d-a33d-7d739cb2575f)
kayg commented 2026-10-21 19:12:23 +00:00
Author
Owner
Copy link

Contract step pushed: b4c60d727a adds the notification requirements already proposed above; 963b21634 clarifies that recovery retires old sessions while preserving the recovered account/new enrollment session. Documentation only, git diff --check PASS, no Rust/TypeScript touched. No wire/request/schema or decision change. This is the required behavior for the pending implementation, not a deployment claim. Revocation routing validation remains queued.

Contract step pushed: b4c60d727ac19f238335929bc42c939082547e05 adds the notification requirements already proposed above; 963b21634 clarifies that recovery retires old sessions while preserving the recovered account/new enrollment session. Documentation only, git diff --check PASS, no Rust/TypeScript touched. No wire/request/schema or decision change. This is the required behavior for the pending implementation, not a deployment claim. Revocation routing validation remains queued.
kayg commented 2026-10-21 19:21:31 +00:00
Author
Owner
Copy link

First scripts/verify fast completed with exit 1. The remote crate suite reported 97 passed, 1 failed, 15 ignored: a_live_legacy_runtime_cannot_publish_an_unheld_lifetime_file at crates/plugins/remote/src/runtime_lock_tests.rs:109. Static artifacts measured x86_64 21,389,424 bytes (+384 vs 300c0c8cb) and aarch64 19,562,296 bytes (+384); the prior exact caps were 21,389,040 and 19,561,912. Other Rust gate rows passed. I will reproduce the isolated test and ratchet both exact caps to the measured artifacts.

Raw gate log: verify-fast.log

First `scripts/verify fast` completed with exit 1. The remote crate suite reported 97 passed, 1 failed, 15 ignored: `a_live_legacy_runtime_cannot_publish_an_unheld_lifetime_file` at `crates/plugins/remote/src/runtime_lock_tests.rs:109`. Static artifacts measured x86_64 21,389,424 bytes (+384 vs 300c0c8cb) and aarch64 19,562,296 bytes (+384); the prior exact caps were 21,389,040 and 19,561,912. Other Rust gate rows passed. I will reproduce the isolated test and ratchet both exact caps to the measured artifacts. Raw gate log: [verify-fast.log](https://git.kayg.org/attachments/f96025af-64a1-4657-a055-3bfed982cf26)
kayg commented 2026-10-21 19:24:21 +00:00
Author
Owner
Copy link

The full-suite runtime-lock failure did not reproduce in isolation with the workspace feature set. The exact test passed: 1 passed, 0 failed, 112 filtered out (cargo test -p infraternal-plugin-remote --lib --features agent,server,test-support,tokio/rt-multi-thread ...). Log: runtime-lock-isolated-full-features.log. I will confirm the full workspace suite on the final fast-gate rerun.

The full-suite runtime-lock failure did not reproduce in isolation with the workspace feature set. The exact test passed: 1 passed, 0 failed, 112 filtered out (`cargo test -p infraternal-plugin-remote --lib --features agent,server,test-support,tokio/rt-multi-thread ...`). Log: [runtime-lock-isolated-full-features.log](https://git.kayg.org/attachments/831b2f3b-591f-40e0-98dc-cb2a1cb8c0b8). I will confirm the full workspace suite on the final fast-gate rerun.
kayg commented 2026-10-21 19:24:49 +00:00
Author
Owner
Copy link

Cap-only step pushed as 5280c44d4. Exact ceilings now match the measured artifacts: x86_64 21,389,424 bytes and aarch64 19,562,296 bytes (+384 bytes each vs 300c0c8cb). bash -n scripts/verify.d/rust.sh and scripts/test-static-size.py passed, including exact-cap acceptance, one-byte-over rejection, and downward-ratchet checks. static-size-cap.log

Cap-only step pushed as 5280c44d4. Exact ceilings now match the measured artifacts: x86_64 21,389,424 bytes and aarch64 19,562,296 bytes (+384 bytes each vs 300c0c8cb). `bash -n scripts/verify.d/rust.sh` and `scripts/test-static-size.py` passed, including exact-cap acceptance, one-byte-over rejection, and downward-ratchet checks. [static-size-cap.log](https://git.kayg.org/attachments/2c9f3839-e85f-4100-b98e-233b0b16597f)
kayg commented 2026-10-21 19:33:45 +00:00
Author
Owner
Copy link

Revocation routing committed and pushed: f16bbe216e. Logout uses one DELETE RETURNING statement for account + private session hint; recovery revocation and six trusted subscriber paths use account generations. Existing guards, 4 read places, attempt/total retry bounds, renewal and typed busy/refused outcomes remain unchanged.

Formatter PASS; all-target server clippy PASS (remote,infraternal-agent/mesh). Full server library result, verbatim:

test result: ok. 643 passed; 0 failed; 52 ignored; 0 measured; 0 filtered out; finished in 382.31s

The idempotent/metadata/isolation test, 300 ms controlled unrelated-account store hold with zero retained reads, own-session refusal, full-place storm and inherited 1013/closed-source review cases all pass. No baseline exception used. Recovery-state scoping is now the next uncommitted step.

gate-revocation-final.log

Revocation routing committed and pushed: f16bbe216e69278d05e2a7232be393c518ac9230. Logout uses one DELETE RETURNING statement for account + private session hint; recovery revocation and six trusted subscriber paths use account generations. Existing guards, 4 read places, attempt/total retry bounds, renewal and typed busy/refused outcomes remain unchanged. Formatter PASS; all-target server clippy PASS (remote,infraternal-agent/mesh). Full server library result, verbatim: ``` test result: ok. 643 passed; 0 failed; 52 ignored; 0 measured; 0 filtered out; finished in 382.31s ``` The idempotent/metadata/isolation test, 300 ms controlled unrelated-account store hold with zero retained reads, own-session refusal, full-place storm and inherited 1013/closed-source review cases all pass. No baseline exception used. Recovery-state scoping is now the next uncommitted step. [gate-revocation-final.log](https://git.kayg.org/attachments/0dcb645a-ed43-487a-b8a3-4b462eb265b6)
kayg commented 2026-10-21 19:40:02 +00:00
Author
Owner
Copy link

Finished on auth-busy-1013, head 5280c44d42ddcd0158e472c21e6fec9a1e7179aa, pushed to origin. The code fix is 9896d3a85; the separate exact-cap update is 5280c44d4.

Reviewer checklist: only typed known Unavailable outcomes skip the redundant teardown authority read; provisional frame-error reasons still pass through failure_reason and retain refusal classification. Other close reasons retain the existing liveness check. Known unavailable closes use 1013/server_busy, and attachments are released without adding retries, reads, renewal, or pool limits. No auth storage, crypto, rate-limit, or UI paths changed.

Final scripts/verify fast output (verbatim):

5264:PT_INTERP: absent; size: 21389424 bytes; cap: 21389424 bytes; delta: +0 bytes
5265-key memory: x86_64-unknown-linux-musl; memlock=8388608 bytes
5266-Key memory initialization=1; locked pages and dump exclusion enabled
5267-    Finished `release` profile [optimized] target(s) in 0.63s
5268-production trust: PASS (staging-trust authority absent)
5269-/home/kayg/.cache/codex-scratch/auth-busy-1013/target/aarch64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped
5270:PT_INTERP: absent; size: 19562296 bytes; cap: 19562296 bytes; delta: +0 bytes
5271-key memory: aarch64-unknown-linux-musl runtime not checked (host x86_64; native execution required)
5272-x86_64-unknown-linux-musl: exact 21389424-byte cap PASS; 21389425 bytes rejected PASS; smaller artifact requires ratchet PASS
5273-aarch64-unknown-linux-musl: exact 19562296-byte cap PASS; 19562297 bytes rejected PASS; smaller artifact requires ratchet PASS
5274-unsupported target: rejected PASS
5275-bun test v1.4.2 (744846f84)
5276-
5277-scripts/release/static-metadata-review.test.ts:
5278-(pass) x86_64-unknown-linux-musl compiler metadata is independent of the checkout location [41.09ms]
5279-(pass) aarch64-unknown-linux-musl compiler metadata is independent of the checkout location [36.38ms]
5280-
5281- 2 pass
5282- 0 fail
5283- 18 expect() calls
5284-Ran 2 tests across 1 file. [141.00ms]
--
5290:| Rust gate                 | Result       |
5291-+---------------------------+--------------+
5292-| fmt                       | PASS         |
5293-| VT native fmt             | PASS         |
5294-| CLI plugin compile-out    | PASS         |
5295-| clippy                    | PASS         |
5296-| SSH runtime test helper   | PASS         |
5297-| test                      | PASS         |
5298-| SSH inode reuse fixture   | PASS         |
5299-| cargo-deny                | PASS         |
5300-| static builds             | PASS         |
5301-+---------------------------+--------------+
5302-
5303-==> Compiler metadata generator checks
5304-bun test v1.4.2 (744846f84)
scripts/verify fast exit=0

Static-size delta vs 300c0c8cb: x86_64 21,389,424 vs 21,389,040 bytes (+384); aarch64 19,562,296 vs 19,561,912 bytes (+384). Both exact caps and one-byte-over rejection checks passed. Full final gate log: verify-fast-final.log

Finished on `auth-busy-1013`, head `5280c44d42ddcd0158e472c21e6fec9a1e7179aa`, pushed to origin. The code fix is `9896d3a85`; the separate exact-cap update is `5280c44d4`. Reviewer checklist: only typed known Unavailable outcomes skip the redundant teardown authority read; provisional frame-error reasons still pass through `failure_reason` and retain refusal classification. Other close reasons retain the existing liveness check. Known unavailable closes use 1013/server_busy, and attachments are released without adding retries, reads, renewal, or pool limits. No auth storage, crypto, rate-limit, or UI paths changed. Final `scripts/verify fast` output (verbatim): ```text 5264:PT_INTERP: absent; size: 21389424 bytes; cap: 21389424 bytes; delta: +0 bytes 5265-key memory: x86_64-unknown-linux-musl; memlock=8388608 bytes 5266-Key memory initialization=1; locked pages and dump exclusion enabled 5267- Finished `release` profile [optimized] target(s) in 0.63s 5268-production trust: PASS (staging-trust authority absent) 5269-/home/kayg/.cache/codex-scratch/auth-busy-1013/target/aarch64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped 5270:PT_INTERP: absent; size: 19562296 bytes; cap: 19562296 bytes; delta: +0 bytes 5271-key memory: aarch64-unknown-linux-musl runtime not checked (host x86_64; native execution required) 5272-x86_64-unknown-linux-musl: exact 21389424-byte cap PASS; 21389425 bytes rejected PASS; smaller artifact requires ratchet PASS 5273-aarch64-unknown-linux-musl: exact 19562296-byte cap PASS; 19562297 bytes rejected PASS; smaller artifact requires ratchet PASS 5274-unsupported target: rejected PASS 5275-bun test v1.4.2 (744846f84) 5276- 5277-scripts/release/static-metadata-review.test.ts: 5278-(pass) x86_64-unknown-linux-musl compiler metadata is independent of the checkout location [41.09ms] 5279-(pass) aarch64-unknown-linux-musl compiler metadata is independent of the checkout location [36.38ms] 5280- 5281- 2 pass 5282- 0 fail 5283- 18 expect() calls 5284-Ran 2 tests across 1 file. [141.00ms] -- 5290:| Rust gate | Result | 5291-+---------------------------+--------------+ 5292-| fmt | PASS | 5293-| VT native fmt | PASS | 5294-| CLI plugin compile-out | PASS | 5295-| clippy | PASS | 5296-| SSH runtime test helper | PASS | 5297-| test | PASS | 5298-| SSH inode reuse fixture | PASS | 5299-| cargo-deny | PASS | 5300-| static builds | PASS | 5301-+---------------------------+--------------+ 5302- 5303-==> Compiler metadata generator checks 5304-bun test v1.4.2 (744846f84) scripts/verify fast exit=0 ``` Static-size delta vs `300c0c8cb`: x86_64 21,389,424 vs 21,389,040 bytes (+384); aarch64 19,562,296 vs 19,561,912 bytes (+384). Both exact caps and one-byte-over rejection checks passed. Full final gate log: [verify-fast-final.log](https://git.kayg.org/attachments/91afce94-33b1-432e-b603-3057ede6dd4d)
kayg commented 2026-10-21 19:41:29 +00:00
Author
Owner
Copy link

Recovery-state routing committed and pushed: 9427866232. Start/cancel/rotation/completion now publish only to their account; notification schema, audit and credential verification are unchanged. Formatter and all-target server clippy PASS; recovery filter: 28 passed, 0 failed, 3 ignored. Existing 16-device start/cancel socket coverage and other-account signal assertions pass.

Self-review correction needed in the earlier f16bbe216 logout query: pinned SQLx fetch_optional limits RETURNING to one row and resets the iterator before forwarding it. A real SQLite deferred-constraint probe reports success while the parent row remains (1). This loses a commit refusal. Added an actual Auth regression before changing logout; it is queued/running. Planned correction: fetch_all drains the statement through completion before any success/publication; token_hash is unique, so the result is bounded to one row. This retains one SQL statement and avoids separate lookup or transaction round trips. No deployment.

gate-recovery.log
statement-completion-probe.log

Recovery-state routing committed and pushed: 9427866232676acdf49fb10d14a29f752f323b19. Start/cancel/rotation/completion now publish only to their account; notification schema, audit and credential verification are unchanged. Formatter and all-target server clippy PASS; recovery filter: 28 passed, 0 failed, 3 ignored. Existing 16-device start/cancel socket coverage and other-account signal assertions pass. Self-review correction needed in the earlier f16bbe216 logout query: pinned SQLx fetch_optional limits RETURNING to one row and resets the iterator before forwarding it. A real SQLite deferred-constraint probe reports success while the parent row remains (1). This loses a commit refusal. Added an actual Auth regression before changing logout; it is queued/running. Planned correction: fetch_all drains the statement through completion before any success/publication; token_hash is unique, so the result is bounded to one row. This retains one SQL statement and avoids separate lookup or transaction round trips. No deployment. [gate-recovery.log](https://git.kayg.org/attachments/f9822db4-0ed7-4468-a717-e899e075de01) [statement-completion-probe.log](https://git.kayg.org/attachments/73f4fd0e-0c21-4809-b065-3bc9c889a667)
kayg commented 2026-10-21 19:49:58 +00:00
Author
Owner
Copy link

Classification: test defect. The old assertion required all 16 clients to receive an explicit WebSocket Close frame before a wall-clock timeout. Production performs a bounded best-effort close, so a client can observe a TCP reset after the server has already closed the socket. The revised test records terminal outcomes (Close, EOF, or read error) for every client, while still failing on a result frame, an unexpected message, or a 15-second timeout. Production code and limits are unchanged.

Final revised test cohorts on infraternal-dev (12 CPUs): isolated 50/50 pass; under concurrent cargo test --locked -p infraternal-protocol, 50/50 pass. The companion protocol test ran 409 times with 0 failures. Load average for the loaded cohort: 10.03/10.99/12.28 at start, 6.31/9.79/11.76 at end.

Static stripped binary sizes vs abedd62b0, using the documented static recipe: x86_64 21,389,296 bytes (delta 0); aarch64 19,561,656 bytes (delta 0).

Head edfdb181246b057265ebfc7cf99e8b89deca37c2 pushed to origin/flake-full-place-storm.

Final scripts/verify fast output (verbatim):

PT_INTERP: absent; size: 21389296 bytes; cap: 21389296 bytes; delta: +0 bytes
PT_INTERP: absent; size: 19561656 bytes; cap: 19561656 bytes; delta: +0 bytes
x86_64-unknown-linux-musl: exact 21389296-byte cap PASS; 21389297 bytes rejected PASS; smaller artifact requires ratchet PASS
aarch64-unknown-linux-musl: exact 19561656-byte cap PASS; 19561657 bytes rejected PASS; smaller artifact requires ratchet PASS
+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
 39 pass
 0 fail
 36135 expect() calls
Ran 39 tests across 10 files. [3.58s]

Full raw gate transcript: verify-fast-final.log.

Classification: test defect. The old assertion required all 16 clients to receive an explicit WebSocket Close frame before a wall-clock timeout. Production performs a bounded best-effort close, so a client can observe a TCP reset after the server has already closed the socket. The revised test records terminal outcomes (Close, EOF, or read error) for every client, while still failing on a result frame, an unexpected message, or a 15-second timeout. Production code and limits are unchanged. Final revised test cohorts on infraternal-dev (12 CPUs): isolated 50/50 pass; under concurrent `cargo test --locked -p infraternal-protocol`, 50/50 pass. The companion protocol test ran 409 times with 0 failures. Load average for the loaded cohort: 10.03/10.99/12.28 at start, 6.31/9.79/11.76 at end. Static stripped binary sizes vs abedd62b0, using the documented static recipe: x86_64 21,389,296 bytes (delta 0); aarch64 19,561,656 bytes (delta 0). Head `edfdb181246b057265ebfc7cf99e8b89deca37c2` pushed to `origin/flake-full-place-storm`. Final `scripts/verify fast` output (verbatim): ``` PT_INTERP: absent; size: 21389296 bytes; cap: 21389296 bytes; delta: +0 bytes PT_INTERP: absent; size: 19561656 bytes; cap: 19561656 bytes; delta: +0 bytes x86_64-unknown-linux-musl: exact 21389296-byte cap PASS; 21389297 bytes rejected PASS; smaller artifact requires ratchet PASS aarch64-unknown-linux-musl: exact 19561656-byte cap PASS; 19561657 bytes rejected PASS; smaller artifact requires ratchet PASS +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 39 pass 0 fail 36135 expect() calls Ran 39 tests across 10 files. [3.58s] ``` Full raw gate transcript: [verify-fast-final.log](https://git.kayg.org/attachments/01afff69-664f-4ab6-9ae4-749bfe98a920).
kayg commented 2026-10-21 19:51:00 +00:00
Author
Owner
Copy link

Auth-level commit-refusal regression reproduced before correction at 942786623: 0 passed, 1 failed, "a refused commit was reported as logout success". The fixture adds a real deferred foreign-key constraint on its in-memory sessions row; no migration or production schema change. This confirms the earlier driver probe reaches logout itself.

Correction under validation: drain DELETE RETURNING through fetch_all, bounded to at most one row by the unique token hash, and publish only after successful statement completion. Keeps one SQL statement; rejected extra lookup and BEGIN/COMMIT round trips. Formatter applied; touched-server lint/logout/close-log tests are queued/running.

red-logout-commit.log

Auth-level commit-refusal regression reproduced before correction at 942786623: 0 passed, 1 failed, "a refused commit was reported as logout success". The fixture adds a real deferred foreign-key constraint on its in-memory sessions row; no migration or production schema change. This confirms the earlier driver probe reaches logout itself. Correction under validation: drain DELETE RETURNING through fetch_all, bounded to at most one row by the unique token hash, and publish only after successful statement completion. Keeps one SQL statement; rejected extra lookup and BEGIN/COMMIT round trips. Formatter applied; touched-server lint/logout/close-log tests are queued/running. [red-logout-commit.log](https://git.kayg.org/attachments/3ee367a6-8298-44c0-8ff1-1e9e6bc3766b)
kayg commented 2026-10-21 20:12:56 +00:00
Author
Owner
Copy link

Step logout-completion committed and pushed: 8d44a362ba. Formatter and all-target touched-server clippy PASS (remote,infraternal-agent/mesh). Relevant functional test output, verbatim:

test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 686 filtered out; finished in 8.95s
test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 686 filtered out; finished in 12.02s

gate-logout-commit.log

Step logout-completion committed and pushed: 8d44a362ba4cddac6a4b22d65f953b7ed698bc66. Formatter and all-target touched-server clippy PASS (remote,infraternal-agent/mesh). Relevant functional test output, verbatim: ``` test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 686 filtered out; finished in 8.95s test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 686 filtered out; finished in 12.02s ``` [gate-logout-commit.log](https://git.kayg.org/attachments/e81cb2d7-97ef-4283-9135-652b7b1c5a05)
kayg commented 2026-10-21 20:14:35 +00:00
Author
Owner
Copy link

Step bootstrap-entry committed and pushed: cf609f9771. Formatter and all-target touched-server clippy PASS (remote,infraternal-agent/mesh). Relevant functional test output, verbatim:

test result: ok. 17 passed; 0 failed; 0 ignored; 0 measured; 681 filtered out; finished in 15.74s

gate-bootstrap-entry.log

Step bootstrap-entry committed and pushed: cf609f977154afc3456a77fb9d704750fb824ece. Formatter and all-target touched-server clippy PASS (remote,infraternal-agent/mesh). Relevant functional test output, verbatim: ``` test result: ok. 17 passed; 0 failed; 0 ignored; 0 measured; 681 filtered out; finished in 15.74s ``` [gate-bootstrap-entry.log](https://git.kayg.org/attachments/93c646ad-1472-4b97-9cae-76bc31da28f7)
kayg commented 2026-10-21 20:21:27 +00:00
Author
Owner
Copy link

Step capacity committed and pushed: f4e5b6aadf. Formatter and all-target touched-server clippy PASS (remote,infraternal-agent/mesh). Relevant functional test output, verbatim:

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 698 filtered out; finished in 36.95s

gate-capacity-final.log

Step capacity committed and pushed: f4e5b6aadf9114b207d042a5b15374a4b3e6b585. Formatter and all-target touched-server clippy PASS (remote,infraternal-agent/mesh). Relevant functional test output, verbatim: ``` test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 698 filtered out; finished in 36.95s ``` [gate-capacity-final.log](https://git.kayg.org/attachments/5d6517f0-2f89-4dae-9ab9-0f6494d873ce)
kayg commented 2026-10-21 20:54:29 +00:00
Author
Owner
Copy link

Iteration milestone on pushed f4e5b6aadf: scripts/verify iterate PASS; server 650 passed, 0 failed, 52 ignored. No load exception. Static builds now running for exact size measurement against reproduced auth-busy-1013 merge base 9896d3a85. Verbatim gate summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| cargo-deny                | PASS         |
+---------------------------+--------------+

ITERATE gate passed. This is not the final gate: run scripts/verify fast before reporting done.
Iteration milestone on pushed f4e5b6aadf9114b207d042a5b15374a4b3e6b585: scripts/verify iterate PASS; server 650 passed, 0 failed, 52 ignored. No load exception. Static builds now running for exact size measurement against reproduced auth-busy-1013 merge base 9896d3a85. Verbatim gate summary: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | cargo-deny | PASS | +---------------------------+--------------+ ITERATE gate passed. This is not the final gate: run scripts/verify fast before reporting done. ```
kayg commented 2026-10-21 21:31:44 +00:00
Author
Owner
Copy link

Static builds on f4e5b6aadf succeeded. Stripped x86_64: 21,395,728 bytes versus reproduced auth-busy-1013 merge base 21,389,424: +6,304 bytes. ARM: 19,572,056 bytes. x86_64 is static PIE, stripped, with no PT_INTERP. Reviewer B1/S1/S2/N1 check attached. Exact-ceiling update plus final scripts/verify fast is queued for a shared build slot; iteration already passed. No deployment.

head-static-sizes.json
self-review.txt

Static builds on f4e5b6aadf9114b207d042a5b15374a4b3e6b585 succeeded. Stripped x86_64: 21,395,728 bytes versus reproduced auth-busy-1013 merge base 21,389,424: +6,304 bytes. ARM: 19,572,056 bytes. x86_64 is static PIE, stripped, with no PT_INTERP. Reviewer B1/S1/S2/N1 check attached. Exact-ceiling update plus final scripts/verify fast is queued for a shared build slot; iteration already passed. No deployment. [head-static-sizes.json](https://git.kayg.org/attachments/573a8345-2e32-4a0b-8e53-162e4aeebbee) [self-review.txt](https://git.kayg.org/attachments/c615d58e-e303-42b8-8467-50e5de0fd3f3)
kayg commented 2026-10-21 21:57:35 +00:00
Author
Owner
Copy link

Measured size ceilings committed and pushed: 57185fd9bf. Stripped static x86_64: 21395728 bytes; reproduced merge base 21389424 bytes; delta 6304 bytes. ARM static: 19572056 bytes. No dependency, feature or build-profile changes. Exact-cap, one-byte-over rejection, downward-ratchet and unknown-target checks PASS. Reviewer B1/S1/S2/N1 checks attached. Full final gate starts on this head.

head-static-sizes.json
gate-static-ceilings.log
self-review.txt

Measured size ceilings committed and pushed: 57185fd9bff933aeda8138ca846cd24325f66a3d. Stripped static x86_64: 21395728 bytes; reproduced merge base 21389424 bytes; delta 6304 bytes. ARM static: 19572056 bytes. No dependency, feature or build-profile changes. Exact-cap, one-byte-over rejection, downward-ratchet and unknown-target checks PASS. Reviewer B1/S1/S2/N1 checks attached. Full final gate starts on this head. [head-static-sizes.json](https://git.kayg.org/attachments/ffcaf00f-53a7-48de-ae1e-8bbd5a54ce13) [gate-static-ceilings.log](https://git.kayg.org/attachments/9e83c948-1424-4b6f-8c85-3ca79a0dc88f) [self-review.txt](https://git.kayg.org/attachments/f85d6e3d-343a-4c3c-945d-dda3c23a71a1)
kayg commented 2026-10-21 22:11:27 +00:00
Author
Owner
Copy link

Final fast gate on 57185fd9bf: existing auth socket full-place contention test failed at review_authority_cap.rs:162 (14 close outcomes, expected 16); server result 649 passed, 1 failed, 52 ignored. All four new per-account tests PASS. Not waived. Exact failed test is building on detached origin/dev 5868ef5360 in the same host-load window; environment and assertion attached. Other gate rows continue. A complete final gate rerun will follow the comparison.

full-place-failure.txt
baseline-load-environment.json

Final fast gate on 57185fd9bff933aeda8138ca846cd24325f66a3d: existing auth socket full-place contention test failed at review_authority_cap.rs:162 (14 close outcomes, expected 16); server result 649 passed, 1 failed, 52 ignored. All four new per-account tests PASS. Not waived. Exact failed test is building on detached origin/dev 5868ef5360770f0c634bd264b7ec5473a155decf in the same host-load window; environment and assertion attached. Other gate rows continue. A complete final gate rerun will follow the comparison. [full-place-failure.txt](https://git.kayg.org/attachments/897f9660-675b-4b90-ad4c-330158752163) [baseline-load-environment.json](https://git.kayg.org/attachments/2164e2d8-cce5-4906-8225-131c87a516fe)
kayg commented 2026-10-21 22:16:07 +00:00
Author
Owner
Copy link

Close-count comparison complete: isolated branch test PASS (1/0), detached dev 5868ef536 test with matching remote,infraternal-agent/mesh features PASS (1/0). Test source is byte-identical. The initial 14/16 failure was not reproduced; no load exception is applied and no test/deadline was changed. Every other initial Rust gate row, including both static builds, passed. Complete scripts/verify fast rerun on unchanged pushed head 57185fd9b is queued. Full initial transcript and both comparison results attached.

verify-fast-initial.log
head-full-place-rerun.log
baseline-load-full-place-matched.log
baseline-load-environment.json

Close-count comparison complete: isolated branch test PASS (1/0), detached dev 5868ef536 test with matching remote,infraternal-agent/mesh features PASS (1/0). Test source is byte-identical. The initial 14/16 failure was not reproduced; no load exception is applied and no test/deadline was changed. Every other initial Rust gate row, including both static builds, passed. Complete scripts/verify fast rerun on unchanged pushed head 57185fd9b is queued. Full initial transcript and both comparison results attached. [verify-fast-initial.log](https://git.kayg.org/attachments/f2ea894e-835f-4b89-9eb5-2aea56a93045) [head-full-place-rerun.log](https://git.kayg.org/attachments/c5ea7692-e0df-44e7-8627-0e34f28ef6b4) [baseline-load-full-place-matched.log](https://git.kayg.org/attachments/502088ba-291f-4745-ad32-eeb008d8d9da) [baseline-load-environment.json](https://git.kayg.org/attachments/8aa17951-1717-4ee2-a1aa-6de69d88d71a)
kayg commented 2026-10-21 22:38:45 +00:00
Author
Owner
Copy link

Finished on pushed branch revocation-per-account, head 57185fd9bf, based on auth-busy-1013 9896d3a85b. No deployment.

Logout and recovery notifications are scoped to the committed account; known session hashes remain private hints. Coalescing always rechecks the account, including an earlier logout hidden by a later session hint. All six revocation subscribers use account scope; recovery-state notifications are scoped too. Bootstrap sockets recheck after subscription. Logout drains its bounded RETURNING result through statement completion before publication. Account entries disappear after the last cursor, including concurrent drops. No current production logout/recovery case needs a server-wide event; shutdown/component disable retain independent lifecycle signals.

Real-engine functional evidence: 256 sockets across 61 accounts; both logout and recovery completion close 16 affected sockets without advancing runtime time; all 240 unrelated sockets add zero authority reads and still complete authenticated application work. Baseline 9896 reproduction: one unrelated four-socket account added four reads on logout and twelve on recovery. Coalesced-session, surviving-session, lost-source, commit-refusal and subscription-gap checks PASS. Full gate PASS; reviewer B1/S1/S2/N1 receipt attached. No build-host duration is claimed as latency evidence.

Stripped static x86_64: 21,395,728 bytes versus merge-base 21,389,424: +6,304 bytes. ARM: 19,572,056 bytes. Exact ceilings and their boundary checks PASS; no new dependency or feature.

The first full run had a 14/16 close-count failure in an existing auth socket test. Isolated branch and feature-matched detached dev runs both passed; no exception was applied. The complete final rerun passes. Temporary checkout and build products were removed; evidence receipts remain.

scripts/verify fast output (verbatim summary and final output; complete unfiltered transcript attached):

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

src/mesh-review-resync.test.ts:
(pass) review watch applies same-revision authoritative resync [0.28ms]
(pass) authoritative resync keeps priority over an equal-revision pending list [1.62ms]

src/mesh-vectors.test.ts:
(pass) every shared Mesh action vector passes through the typed client unchanged [2.69ms]
(pass) shared Mesh event vectors drive the typed watch adapter [6.06ms]

 39 pass
 0 fail
 36135 expect() calls
Ran 39 tests across 10 files. [3.61s]

verify-fast.log
verify-iterate.log
head-static-sizes.json
self-review.txt
cleanup.txt

Initial failure and comparison receipts:
verify-fast-initial.log
head-full-place-rerun.log
baseline-load-full-place-matched.log
baseline-load-environment.json

Finished on pushed branch revocation-per-account, head 57185fd9bff933aeda8138ca846cd24325f66a3d, based on auth-busy-1013 9896d3a85b7499fee9e7237fc6233c913f41bd5b. No deployment. Logout and recovery notifications are scoped to the committed account; known session hashes remain private hints. Coalescing always rechecks the account, including an earlier logout hidden by a later session hint. All six revocation subscribers use account scope; recovery-state notifications are scoped too. Bootstrap sockets recheck after subscription. Logout drains its bounded RETURNING result through statement completion before publication. Account entries disappear after the last cursor, including concurrent drops. No current production logout/recovery case needs a server-wide event; shutdown/component disable retain independent lifecycle signals. Real-engine functional evidence: 256 sockets across 61 accounts; both logout and recovery completion close 16 affected sockets without advancing runtime time; all 240 unrelated sockets add zero authority reads and still complete authenticated application work. Baseline 9896 reproduction: one unrelated four-socket account added four reads on logout and twelve on recovery. Coalesced-session, surviving-session, lost-source, commit-refusal and subscription-gap checks PASS. Full gate PASS; reviewer B1/S1/S2/N1 receipt attached. No build-host duration is claimed as latency evidence. Stripped static x86_64: 21,395,728 bytes versus merge-base 21,389,424: +6,304 bytes. ARM: 19,572,056 bytes. Exact ceilings and their boundary checks PASS; no new dependency or feature. The first full run had a 14/16 close-count failure in an existing auth socket test. Isolated branch and feature-matched detached dev runs both passed; no exception was applied. The complete final rerun passes. Temporary checkout and build products were removed; evidence receipts remain. scripts/verify fast output (verbatim summary and final output; complete unfiltered transcript attached): ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ src/mesh-review-resync.test.ts: (pass) review watch applies same-revision authoritative resync [0.28ms] (pass) authoritative resync keeps priority over an equal-revision pending list [1.62ms] src/mesh-vectors.test.ts: (pass) every shared Mesh action vector passes through the typed client unchanged [2.69ms] (pass) shared Mesh event vectors drive the typed watch adapter [6.06ms] 39 pass 0 fail 36135 expect() calls Ran 39 tests across 10 files. [3.61s] ``` [verify-fast.log](https://git.kayg.org/attachments/a4d5de93-8acc-46a3-9849-ebf1f23a1d76) [verify-iterate.log](https://git.kayg.org/attachments/15ed43e6-0c19-4253-ad95-59be292e195a) [head-static-sizes.json](https://git.kayg.org/attachments/7b9aa058-bfa4-420c-8b20-eaafeedb07a6) [self-review.txt](https://git.kayg.org/attachments/56b80ed2-bf59-47fa-b817-80a9202a231b) [cleanup.txt](https://git.kayg.org/attachments/3e66d6b1-f246-4fe0-aeea-1b96c1976277) Initial failure and comparison receipts: [verify-fast-initial.log](https://git.kayg.org/attachments/f2ea894e-835f-4b89-9eb5-2aea56a93045) [head-full-place-rerun.log](https://git.kayg.org/attachments/c5ea7692-e0df-44e7-8627-0e34f28ef6b4) [baseline-load-full-place-matched.log](https://git.kayg.org/attachments/502088ba-291f-4745-ad32-eeb008d8d9da) [baseline-load-environment.json](https://git.kayg.org/attachments/8aa17951-1717-4ee2-a1aa-6de69d88d71a)
kayg commented 2026-10-21 22:40:43 +00:00
Author
Owner
Copy link

Start independent verification review #240. Branch review-revocation-per-account; base/head 57185fd9bf; diff base 9896d3a85. Read issue #240 and parent #146 history. Test-only changes; cover subscription orders, coalescing/source loss, concurrent recovery/logout, identity changes, transaction refusal and inherited busy-store outcomes. No deployment or remote host access.

Start independent verification review #240. Branch review-revocation-per-account; base/head 57185fd9bff933aeda8138ca846cd24325f66a3d; diff base 9896d3a85. Read issue #240 and parent #146 history. Test-only changes; cover subscription orders, coalescing/source loss, concurrent recovery/logout, identity changes, transaction refusal and inherited busy-store outcomes. No deployment or remote host access.
kayg commented 2026-10-21 22:43:33 +00:00
Author
Owner
Copy link

Audit progress: test-only cases added for two-account revocation, 65,536 coalesced overwrites plus unknown-scope fallback, concurrent A recovery/B logout, out-of-band reassignment/deletion, SQLite statement rollback, both bootstrap subscription orders, lost bootstrap source, and cancellation after an externally observed logout commit. Validation is queued behind the shared build-slot wrapper; no result claimed yet. Source inspection: watch channels have no bounded queue/lag error; source loss must fail closed per contracts/keywrap.md. No production reassignment/deletion path exists.

Audit progress: test-only cases added for two-account revocation, 65,536 coalesced overwrites plus unknown-scope fallback, concurrent A recovery/B logout, out-of-band reassignment/deletion, SQLite statement rollback, both bootstrap subscription orders, lost bootstrap source, and cancellation after an externally observed logout commit. Validation is queued behind the shared build-slot wrapper; no result claimed yet. Source inspection: watch channels have no bounded queue/lag error; source loss must fail closed per contracts/keywrap.md. No production reassignment/deletion path exists.
kayg commented 2026-10-21 23:04:44 +00:00
Author
Owner
Copy link

Finding R1 — committed logout can lose its wake on caller cancellation. Test auth::tests::logout_commit::review_account_scope_committed_logout_keeps_wake_when_waiter_is_cancelled fails at logout_commit_tests.rs:146: "committed logout lost its notification when the waiter was cancelled". A separate disk-SQLite observer sees the session deletion commit while the logout future is suspended; cancellation then drops the waiter before sessions.rs:124 publication. The only pool connection is reacquired as a completion fence. 0 generations published for 1 committed deletion. This is a cancellation-safety gap inherited from the old post-await publication pattern, not evidence of cross-account access. Reproduction is at the Auth API boundary; HTTP cancellation reachability is not established by this test.

Finding R2 — lost bootstrap notification source does not fail closed. Test bootstrap_api::tests::review_account_scope_lost_bootstrap_source_retires_instead_of_spinning fails at bootstrap_api_tests.rs:1055: "lost revocation source retained bootstrap instead of failing closed". bootstrap_api.rs:331 ignores changed() errors and repeatedly reauthorizes the still-live session. contracts/keywrap.md requires source loss to fail closed as unavailable. The test-only source-removal hook models unexpected loss; normal registry ownership prevents this state today. Cleanup explicitly logs out and waits for the upgrade permit to return. Defensive P2 contract gap.

First new-case run: 7 passed; 2 failed. Passing: two-account revocation, 65,536 overwrites per affected account plus global fallback, simultaneous recovery A/logout B including recovery completion, original-account authority after reassignment, deletion with an open socket, rollback then committed retry, and logout after bootstrap subscription. Existing pre-subscription tests and inherited busy outcomes are in the repetition suite.
scope-first.log

Finding R1 — committed logout can lose its wake on caller cancellation. Test auth::tests::logout_commit::review_account_scope_committed_logout_keeps_wake_when_waiter_is_cancelled fails at logout_commit_tests.rs:146: "committed logout lost its notification when the waiter was cancelled". A separate disk-SQLite observer sees the session deletion commit while the logout future is suspended; cancellation then drops the waiter before sessions.rs:124 publication. The only pool connection is reacquired as a completion fence. 0 generations published for 1 committed deletion. This is a cancellation-safety gap inherited from the old post-await publication pattern, not evidence of cross-account access. Reproduction is at the Auth API boundary; HTTP cancellation reachability is not established by this test. Finding R2 — lost bootstrap notification source does not fail closed. Test bootstrap_api::tests::review_account_scope_lost_bootstrap_source_retires_instead_of_spinning fails at bootstrap_api_tests.rs:1055: "lost revocation source retained bootstrap instead of failing closed". bootstrap_api.rs:331 ignores changed() errors and repeatedly reauthorizes the still-live session. contracts/keywrap.md requires source loss to fail closed as unavailable. The test-only source-removal hook models unexpected loss; normal registry ownership prevents this state today. Cleanup explicitly logs out and waits for the upgrade permit to return. Defensive P2 contract gap. First new-case run: 7 passed; 2 failed. Passing: two-account revocation, 65,536 overwrites per affected account plus global fallback, simultaneous recovery A/logout B including recovery completion, original-account authority after reassignment, deletion with an open socket, rollback then committed retry, and logout after bootstrap subscription. Existing pre-subscription tests and inherited busy outcomes are in the repetition suite. [scope-first.log](https://git.kayg.org/attachments/2d31093c-fa00-4edc-b3a0-98e41f7243da)
kayg commented 2026-10-21 23:07:55 +00:00
Author
Owner
Copy link

Step pushed: 1a16ddd43 on review-revocation-per-account. Five account-scope cases pass: two-account logout, 65,536 coalesced generations per account with all-account fallback, simultaneous recovery/logout, reassignment authority binding, and deletion with an open socket. cargo fmt --all --check exit 0; all-target touched-server clippy (remote,infraternal-agent/mesh) exit 0. Product code unchanged. The two boundary reproductions remain uncommitted while the required five-run suite executes.

Step pushed: 1a16ddd43 on review-revocation-per-account. Five account-scope cases pass: two-account logout, 65,536 coalesced generations per account with all-account fallback, simultaneous recovery/logout, reassignment authority binding, and deletion with an open socket. cargo fmt --all --check exit 0; all-target touched-server clippy (remote,infraternal-agent/mesh) exit 0. Product code unchanged. The two boundary reproductions remain uncommitted while the required five-run suite executes.
kayg commented 2026-10-21 23:08:02 +00:00
Author
Owner
Copy link

Step pushed: 7d3bdc892. Bootstrap logout after the installed-subscription fence passes; source loss fails closed-contract assertion as recorded in R2. The test cleans up its upgrade via explicit logout and permit-return fence even on failure. Formatter/clippy exit 0. No product change.

Step pushed: 7d3bdc892. Bootstrap logout after the installed-subscription fence passes; source loss fails closed-contract assertion as recorded in R2. The test cleans up its upgrade via explicit logout and permit-return fence even on failure. Formatter/clippy exit 0. No product change.
kayg commented 2026-10-21 23:08:10 +00:00
Author
Owner
Copy link

Step pushed: f52fd309b. Real SQLite statement rollback then successful retry passes; cancellation after an externally observed committed deletion fails the notification assertion (R1). Explicit single-connection return fence and database cleanup complete before the assertion. Formatter/clippy exit 0; no product code changed. Five repeated #240 runs and the full fast gate continue on this head.

Step pushed: f52fd309b. Real SQLite statement rollback then successful retry passes; cancellation after an externally observed committed deletion fails the notification assertion (R1). Explicit single-connection return fence and database cleanup complete before the assertion. Formatter/clippy exit 0; no product code changed. Five repeated #240 runs and the full fast gate continue on this head.
kayg commented 2026-10-21 23:13:11 +00:00
Author
Owner
Copy link

Five consecutive #240 union runs completed on pushed f52fd309b. Each ran 38 tests: 36 passed, only R1/R2 failed; no baseline/load exception. Both capacity cases pass each time (256 sockets, 61 accounts, 16 affected, 240 unrelated usable; zero unrelated authority reads). 1013 busy close and sixteen-socket recovery pass in all five. Formatter and touched-server clippy exit 0. Static merge-base reproduction is running, followed by full scripts/verify fast.

Verbatim results:

Run 1:
test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 68.44s
Run 2:
test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 76.03s
Run 3:
test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 78.50s
Run 4:
test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 66.70s
Run 5:
test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 67.73s

review-run-1.log
review-run-2.log
review-run-3.log
review-run-4.log
review-run-5.log

Five consecutive #240 union runs completed on pushed f52fd309b. Each ran 38 tests: 36 passed, only R1/R2 failed; no baseline/load exception. Both capacity cases pass each time (256 sockets, 61 accounts, 16 affected, 240 unrelated usable; zero unrelated authority reads). 1013 busy close and sixteen-socket recovery pass in all five. Formatter and touched-server clippy exit 0. Static merge-base reproduction is running, followed by full scripts/verify fast. Verbatim results: ```text Run 1: test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 68.44s Run 2: test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 76.03s Run 3: test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 78.50s Run 4: test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 66.70s Run 5: test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 67.73s ``` [review-run-1.log](https://git.kayg.org/attachments/b03ceddc-045c-4065-a5b0-096c42d62111) [review-run-2.log](https://git.kayg.org/attachments/833e1034-6b2a-4e5e-bdc8-783a9381b4ba) [review-run-3.log](https://git.kayg.org/attachments/d1d989a3-f10d-44ca-86e7-abd67aa7f3a8) [review-run-4.log](https://git.kayg.org/attachments/30084c9b-96aa-44e7-80a6-2c0b426e4e0e) [review-run-5.log](https://git.kayg.org/attachments/044e2cb2-015a-4755-84a5-2d0eca44d55b)
kayg commented 2026-10-21 23:13:19 +00:00
Author
Owner
Copy link

run-review-command.txt

[run-review-command.txt](https://git.kayg.org/attachments/d26d8682-c1de-415a-b734-1ed3303d1ef2)
kayg commented 2026-10-21 23:25:39 +00:00
Author
Owner
Copy link

Static baseline reproduced at 9896d3a85 with scripts/static-cargo and the same job target/toolchain: x86_64 static PIE, stripped, 21,389,424 bytes. No alternate recipe or dependency change. Full scripts/verify fast has started on pushed f52fd309ba; final head sizes remain pending.
size-baseline.log

Static baseline reproduced at 9896d3a85 with scripts/static-cargo and the same job target/toolchain: x86_64 static PIE, stripped, 21,389,424 bytes. No alternate recipe or dependency change. Full scripts/verify fast has started on pushed f52fd309ba374a540b28a352dd902a7c380cd1d3; final head sizes remain pending. [size-baseline.log](https://git.kayg.org/attachments/ea7900ac-07fc-43cb-8133-7553d2971e71)
kayg commented 2026-10-21 23:39:55 +00:00
Author
Owner
Copy link

Gate resource note on f52fd309b: shared disk free space fell to 12 GiB while GNU test binaries compiled. Removed 430 inactive incremental-cache directories from this job only, retaining the active infraternal_server cache and all dependency artifacts. Paused/resumed only own Cargo PID 3808132 to prevent a new compiler starting during cleanup. Free space returned to 17 GiB. No test, compiler option or product change; fast gate continues.

Gate resource note on f52fd309b: shared disk free space fell to 12 GiB while GNU test binaries compiled. Removed 430 inactive incremental-cache directories from this job only, retaining the active infraternal_server cache and all dependency artifacts. Paused/resumed only own Cargo PID 3808132 to prevent a new compiler starting during cleanup. Free space returned to 17 GiB. No test, compiler option or product change; fast gate continues.
kayg commented 2026-10-21 23:51:45 +00:00
Author
Owner
Copy link

Full fast gate server result on f52fd309b, verbatim:

test result: FAILED. 657 passed; 2 failed; 52 ignored; 0 measured; 0 filtered out; finished in 404.85s

Only R1/R2 fail; no inherited failure or load exception. fmt, VT native fmt, CLI compile-out, workspace clippy, SSH runtime helper, SSH inode reuse and cargo-deny completed successfully. Both shipping static builds are running. Removed this job GNU debug artifacts only after all GNU checks completed and after confirming no executable in target/debug remained active.

Full fast gate server result on f52fd309b, verbatim: ```text test result: FAILED. 657 passed; 2 failed; 52 ignored; 0 measured; 0 filtered out; finished in 404.85s ``` Only R1/R2 fail; no inherited failure or load exception. fmt, VT native fmt, CLI compile-out, workspace clippy, SSH runtime helper, SSH inode reuse and cargo-deny completed successfully. Both shipping static builds are running. Removed this job GNU debug artifacts only after all GNU checks completed and after confirming no executable in target/debug remained active.
kayg commented 2026-10-22 00:01:09 +00:00
Author
Owner
Copy link

Head x86_64 static image reproduced on f52fd309b: 21,395,728 bytes, compared with merge base 9896d3a85 at 21,389,424 bytes: +6,304 bytes, exactly the claim. Production trust and native key-memory checks pass. Verbatim size line:

PT_INTERP: absent; size: 21395728 bytes; cap: 21395728 bytes; delta: +0 bytes

ARM static build is running; full gate remains pending.

Head x86_64 static image reproduced on f52fd309b: 21,395,728 bytes, compared with merge base 9896d3a85 at 21,389,424 bytes: +6,304 bytes, exactly the claim. Production trust and native key-memory checks pass. Verbatim size line: ```text PT_INTERP: absent; size: 21395728 bytes; cap: 21395728 bytes; delta: +0 bytes ``` ARM static build is running; full gate remains pending.
kayg commented 2026-10-22 00:16:53 +00:00
Author
Owner
Copy link

Independent verification review finished: HOLD on review-revocation-per-account, pushed head f52fd309ba374a540b28a352dd902a7c380cd1d3 (reviewed product head 57185fd9b; diff base 9896d3a85). Three test-only commits: 1a16ddd43, 7d3bdc892, f52fd309b. No product code changed.

R1: logout_commit_tests.rs:146 reproduces one externally observed committed SQLite deletion with zero notification when the awaiting logout future is cancelled. Publication is tied to the caller's post-await continuation. This is an inherited Auth API cancellation gap; the test does not establish an HTTP reset reproduction.

R2: bootstrap_api_tests.rs:1055 reproduces a live bootstrap socket retained after its notification source is removed. The idle loop ignores the watch error and keeps reauthorizing. The source-removal test hook models unexpected loss; normal registry ownership retains sources today. This violates the specified fail-closed defensive contract.

Ordinary account scope holds in the tested scenarios: both bootstrap subscription orders; two-account coalescing; 65,536 overwrites per affected account and all-account fallback; A recovery concurrent with B logout, including recovery completion; original-account binding after out-of-band reassignment; deletion with an open socket; failed/rolled-back logout and successful retry. In each of five runs, both 256-socket/61-account cases close the 16 affected sockets while 240 unrelated sockets do zero authority reads and remain usable. Busy-store 1013 and sixteen-socket recovery pass in all five. No load exception used.

Five consecutive #240 union results, verbatim and in order:

test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 68.44s
test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 76.03s
test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 78.50s
test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 66.70s
test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 67.73s

Full server result, verbatim:

test result: FAILED. 657 passed; 2 failed; 52 ignored; 0 measured; 0 filtered out; finished in 404.85s

Only R1/R2 fail. Final scripts/verify fast summary and exit, verbatim (complete unfiltered transcript attached):

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| test                      | FAIL (101)   |
| SSH inode reuse fixture   | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
scripts/verify fast exit=1

The TypeScript project stage is not reached after the Rust gate failure; no TypeScript files changed.

Static qualification: x86_64 21,395,728 bytes vs independently reproduced merge base 21,389,424: +6,304 bytes, exactly the claim. ARM 19,572,056 bytes. Static linkage, exact ceilings, production trust and compiler-metadata checks pass; native x86_64 key-memory check passes. The gate explicitly does not execute the ARM key-memory check on this x86_64 host.

Verbatim size lines:

PT_INTERP: absent; size: 21395728 bytes; cap: 21395728 bytes; delta: +0 bytes
PT_INTERP: absent; size: 19572056 bytes; cap: 19572056 bytes; delta: +0 bytes

Reproduction: stage the pinned compiler with scripts/auth-toolchain using a job-local CARGO_TARGET_DIR, then use the attached exact #240 runner command (remote,infraternal-agent/mesh features). Full gate ran through the host build-slot wrapper. Temporary baseline checkout and build target are removed; no executable under this job target remained active. Worktree is clean and head equals origin/review-revocation-per-account. Findings and reviewer checklist are attached; all evidence remains outside the checkout.

findings.txt
verify-fast.log
gate-summary.txt
static-sizes.json
reviewer-checklist.txt
cleanup.txt
disk-cleanup.txt
clippy.log
fmt.log
environment.txt

review-run-1.log
review-run-2.log
review-run-3.log
review-run-4.log
review-run-5.log
run-review-command.txt
size-baseline.log

Independent verification review finished: **HOLD** on `review-revocation-per-account`, pushed head `f52fd309ba374a540b28a352dd902a7c380cd1d3` (reviewed product head `57185fd9b`; diff base `9896d3a85`). Three test-only commits: `1a16ddd43`, `7d3bdc892`, `f52fd309b`. No product code changed. R1: `logout_commit_tests.rs:146` reproduces one externally observed committed SQLite deletion with zero notification when the awaiting logout future is cancelled. Publication is tied to the caller's post-await continuation. This is an inherited Auth API cancellation gap; the test does not establish an HTTP reset reproduction. R2: `bootstrap_api_tests.rs:1055` reproduces a live bootstrap socket retained after its notification source is removed. The idle loop ignores the watch error and keeps reauthorizing. The source-removal test hook models unexpected loss; normal registry ownership retains sources today. This violates the specified fail-closed defensive contract. Ordinary account scope holds in the tested scenarios: both bootstrap subscription orders; two-account coalescing; 65,536 overwrites per affected account and all-account fallback; A recovery concurrent with B logout, including recovery completion; original-account binding after out-of-band reassignment; deletion with an open socket; failed/rolled-back logout and successful retry. In each of five runs, both 256-socket/61-account cases close the 16 affected sockets while 240 unrelated sockets do zero authority reads and remain usable. Busy-store 1013 and sixteen-socket recovery pass in all five. No load exception used. Five consecutive #240 union results, verbatim and in order: ```text test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 68.44s test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 76.03s test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 78.50s test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 66.70s test result: FAILED. 36 passed; 2 failed; 0 ignored; 0 measured; 673 filtered out; finished in 67.73s ``` Full server result, verbatim: ```text test result: FAILED. 657 passed; 2 failed; 52 ignored; 0 measured; 0 filtered out; finished in 404.85s ``` Only R1/R2 fail. Final `scripts/verify fast` summary and exit, verbatim (complete unfiltered transcript attached): ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | test | FAIL (101) | | SSH inode reuse fixture | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ scripts/verify fast exit=1 ``` The TypeScript project stage is not reached after the Rust gate failure; no TypeScript files changed. Static qualification: x86_64 21,395,728 bytes vs independently reproduced merge base 21,389,424: **+6,304 bytes**, exactly the claim. ARM 19,572,056 bytes. Static linkage, exact ceilings, production trust and compiler-metadata checks pass; native x86_64 key-memory check passes. The gate explicitly does not execute the ARM key-memory check on this x86_64 host. Verbatim size lines: ```text PT_INTERP: absent; size: 21395728 bytes; cap: 21395728 bytes; delta: +0 bytes PT_INTERP: absent; size: 19572056 bytes; cap: 19572056 bytes; delta: +0 bytes ``` Reproduction: stage the pinned compiler with `scripts/auth-toolchain` using a job-local `CARGO_TARGET_DIR`, then use the attached exact #240 runner command (remote,infraternal-agent/mesh features). Full gate ran through the host build-slot wrapper. Temporary baseline checkout and build target are removed; no executable under this job target remained active. Worktree is clean and head equals origin/review-revocation-per-account. Findings and reviewer checklist are attached; all evidence remains outside the checkout. [findings.txt](https://git.kayg.org/attachments/b72341e3-9493-4216-860f-a3f9f9bc3c12) [verify-fast.log](https://git.kayg.org/attachments/12fd3f7f-941f-47d2-b911-17b92d574318) [gate-summary.txt](https://git.kayg.org/attachments/7c7fb032-d4c7-4c49-a485-2571073c0a0a) [static-sizes.json](https://git.kayg.org/attachments/3965e14a-73c2-49b2-a58f-49e6b957512b) [reviewer-checklist.txt](https://git.kayg.org/attachments/af9e50a9-9b01-4ee2-909f-776ecdb5d320) [cleanup.txt](https://git.kayg.org/attachments/373c67bc-307c-4128-8669-92d07ef05b9a) [disk-cleanup.txt](https://git.kayg.org/attachments/a65c9068-1d81-40ac-865f-8960d1eb14a7) [clippy.log](https://git.kayg.org/attachments/83699da0-4949-417f-af35-f78f05de92fb) [fmt.log](https://git.kayg.org/attachments/df86f014-b5ab-4b0f-bb22-41d08a27315b) [environment.txt](https://git.kayg.org/attachments/dbf58c17-a55c-4f33-bee9-5490e9a59f72) [review-run-1.log](https://git.kayg.org/attachments/b03ceddc-045c-4065-a5b0-096c42d62111) [review-run-2.log](https://git.kayg.org/attachments/833e1034-6b2a-4e5e-bdc8-783a9381b4ba) [review-run-3.log](https://git.kayg.org/attachments/d1d989a3-f10d-44ca-86e7-abd67aa7f3a8) [review-run-4.log](https://git.kayg.org/attachments/30084c9b-96aa-44e7-80a6-2c0b426e4e0e) [review-run-5.log](https://git.kayg.org/attachments/044e2cb2-015a-4755-84a5-2d0eca44d55b) [run-review-command.txt](https://git.kayg.org/attachments/d26d8682-c1de-415a-b734-1ed3303d1ef2) [size-baseline.log](https://git.kayg.org/attachments/ea7900ac-07fc-43cb-8133-7553d2971e71)
kayg commented 2026-10-22 01:00:06 +00:00
Author
Owner
Copy link

Release 9.4 merge, verification, staging, artifact hashes, and the five consecutive authority-storm passes are recorded on #24; final head is b30bb81cfc.

Release 9.4 merge, verification, staging, artifact hashes, and the five consecutive authority-storm passes are recorded on #24; final head is b30bb81cfc764772f667eb58a19b7d975c660905.
kayg commented 2026-10-22 01:01:59 +00:00
Author
Owner
Copy link

Release 9.4 (b30bb81cf) is live with the #240 busy-store authority fix: sign-out wakes on a busy store now close with the correct outcome (resume refused / 1013 authority unavailable), and expiry keeps fractional seconds. Deploy details on #24.

Release 9.4 (b30bb81cf) is live with the #240 busy-store authority fix: sign-out wakes on a busy store now close with the correct outcome (resume refused / 1013 authority unavailable), and expiry keeps fractional seconds. Deploy details on #24.
kayg commented 2026-10-29 12:13:26 +00:00
Author
Owner
Copy link

Resumed revocation-per-account-r2 on branch revocation-per-account at pushed head 57185fd9bf; diff base 9896d3a85. Read #240 and parent #146 history. Review findings file was not migrated; equivalent R1/R2 findings and exact runner are attached to #240. Next: merge test-only origin/review-revocation-per-account f52fd309b, reproduce both failures, fix cancellation-safe publication and bootstrap source loss. No deployment.

Resumed revocation-per-account-r2 on branch revocation-per-account at pushed head 57185fd9bff933aeda8138ca846cd24325f66a3d; diff base 9896d3a85. Read #240 and parent #146 history. Review findings file was not migrated; equivalent R1/R2 findings and exact runner are attached to #240. Next: merge test-only origin/review-revocation-per-account f52fd309b, reproduce both failures, fix cancellation-safe publication and bootstrap source loss. No deployment.
kayg commented 2026-10-29 12:18:49 +00:00
Author
Owner
Copy link

Review history merged and pushed at ccea75217 (test-only f52fd309b, no test weakened). Recovered missing review findings and exact union runner from #240 attachments. Source audit: sessions.rs logout publishes after fetch_all await; webauthn.rs recovery completion after tx.commit await; recovery.rs start/cancel and recovery_rotation.rs rotation have the same cancellation boundary. Plan: owned write/publication completion; preserve quiet rollback and affected-account scope. bootstrap_api.rs idle loop ignores source loss; setup idle loop does too. Handle unavailable notification source as 1013 in both shared upgrade modes, including pending sends/confirmation. Fresh R1/R2 reproduction is building through the host slot.

Review history merged and pushed at ccea75217 (test-only f52fd309b, no test weakened). Recovered missing review findings and exact union runner from #240 attachments. Source audit: sessions.rs logout publishes after fetch_all await; webauthn.rs recovery completion after tx.commit await; recovery.rs start/cancel and recovery_rotation.rs rotation have the same cancellation boundary. Plan: owned write/publication completion; preserve quiet rollback and affected-account scope. bootstrap_api.rs idle loop ignores source loss; setup idle loop does too. Handle unavailable notification source as 1013 in both shared upgrade modes, including pending sends/confirmation. Fresh R1/R2 reproduction is building through the host slot.
kayg commented 2026-10-29 12:31:33 +00:00
Author
Owner
Copy link

R1/R2 freshly reproduced on merged review tests: test result: FAILED. 0 passed; 2 failed; 0 ignored; 0 measured; 709 filtered out; finished in 3.72s. Product changes now cover logout owned connection through publication, recovery start/cancel/rotation/completion owned final commit+account notifications, and typed source-loss propagation to 1013 in bootstrap/setup (idle, sends, confirmation and setup initial-request wait). Original review assertions retained; bootstrap source-loss assertion strengthened to require 1013. Added real-SQLite cancelled/refused transaction checks and setup 1013 check. Formatter/diff whitespace checks pass; server clippy/test command has waited about nine minutes for the host build slot. Final gates/size/repetitions pending. Shared disk free is about 20 GiB; this job target is 4.9 GiB. No performance measurements on the build host.

R1/R2 freshly reproduced on merged review tests: test result: FAILED. 0 passed; 2 failed; 0 ignored; 0 measured; 709 filtered out; finished in 3.72s. Product changes now cover logout owned connection through publication, recovery start/cancel/rotation/completion owned final commit+account notifications, and typed source-loss propagation to 1013 in bootstrap/setup (idle, sends, confirmation and setup initial-request wait). Original review assertions retained; bootstrap source-loss assertion strengthened to require 1013. Added real-SQLite cancelled/refused transaction checks and setup 1013 check. Formatter/diff whitespace checks pass; server clippy/test command has waited about nine minutes for the host build slot. Final gates/size/repetitions pending. Shared disk free is about 20 GiB; this job target is 4.9 GiB. No performance measurements on the build host.
kayg commented 2026-10-29 12:51:39 +00:00
Author
Owner
Copy link

Focused fixes pass: fmt; all-target server clippy with remote,infraternal-agent/mesh; 18 passed, 0 failed, 1 ignored (perf-only), including unchanged R1, strengthened R2/1013, setup source loss, real cancelled/refused commit checks. Full iterate passed fmt, VT fmt, CLI compile-out, workspace clippy and SSH helper/inode checks. Workspace test compilation hit shared disk ENOSPC and linker bus errors as free space fell below 1 GiB. Removed 334 inactive incremental directories, then all own incremental caches after the command ended; this job debug/deps alone is about 10 GiB, free space remains about 4.6 GiB. Own build outputs only; no other job files/processes touched. Need shared capacity freed by orchestrator before final full build qualification; continuing available work.

New external gate blocker: cargo-deny reports RUSTSEC-2026-0386 for tokio 1.53.2 (AsyncFd I/O safety); fixed versions listed by the advisory are >=1.51.6,<1.52.0 or >=1.53.3. origin/dev carries the same 1.53.2 lock entry. No dependency or advisory exception changed. Request orchestrator security-update direction/patch for the shared line; this is unrelated to account-wake fixes and should stay a separate atomic dependency change. No green full-gate claim. Raw iterate and cleanup receipts retained under this job evidence path.

Focused fixes pass: fmt; all-target server clippy with remote,infraternal-agent/mesh; 18 passed, 0 failed, 1 ignored (perf-only), including unchanged R1, strengthened R2/1013, setup source loss, real cancelled/refused commit checks. Full iterate passed fmt, VT fmt, CLI compile-out, workspace clippy and SSH helper/inode checks. Workspace test compilation hit shared disk ENOSPC and linker bus errors as free space fell below 1 GiB. Removed 334 inactive incremental directories, then all own incremental caches after the command ended; this job debug/deps alone is about 10 GiB, free space remains about 4.6 GiB. Own build outputs only; no other job files/processes touched. Need shared capacity freed by orchestrator before final full build qualification; continuing available work. New external gate blocker: cargo-deny reports RUSTSEC-2026-0386 for tokio 1.53.2 (AsyncFd I/O safety); fixed versions listed by the advisory are >=1.51.6,<1.52.0 or >=1.53.3. origin/dev carries the same 1.53.2 lock entry. No dependency or advisory exception changed. Request orchestrator security-update direction/patch for the shared line; this is unrelated to account-wake fixes and should stay a separate atomic dependency change. No green full-gate claim. Raw iterate and cleanup receipts retained under this job evidence path.
kayg commented 2026-10-29 16:02:25 +00:00
Author
Owner
Copy link

Resumed on shared build VM 6by32-compute02. Branch revocation-per-account, base/head ccea75217; restored unreviewed WIP 3b5618001 with soft reset. Reviewing R1 owned commit/publication and R2 bootstrap/setup source-loss changes before atomic commits. Will merge current origin/dev after fixes, push each commit, run five #240 union repetitions and final scripts/verify fast. No deployment.

Resumed on shared build VM 6by32-compute02. Branch revocation-per-account, base/head ccea75217; restored unreviewed WIP 3b5618001 with soft reset. Reviewing R1 owned commit/publication and R2 bootstrap/setup source-loss changes before atomic commits. Will merge current origin/dev after fixes, push each commit, run five #240 union repetitions and final scripts/verify fast. No deployment.
kayg commented 2026-10-29 16:06:43 +00:00
Author
Owner
Copy link

Restored WIP reviewed: cancellation protection covers logout plus recovery start/cancel/rotation/completion. Earlier transaction authority checks stay in place; failed commits do not publish. Bootstrap/setup source loss propagates to the existing 1013 authority-unavailable close across idle, pending send, confirmation and initial setup receive paths. No dependency/features added. Existing R1 retained unchanged; R2 strengthened to require 1013, with setup coverage added. Full iterate is building through the host slot; about 109 GiB free, own target about 3 GiB. Exact reviewer union runner recovered from #240 attachment and adapted only for current paths; five final repetitions pending.

Restored WIP reviewed: cancellation protection covers logout plus recovery start/cancel/rotation/completion. Earlier transaction authority checks stay in place; failed commits do not publish. Bootstrap/setup source loss propagates to the existing 1013 authority-unavailable close across idle, pending send, confirmation and initial setup receive paths. No dependency/features added. Existing R1 retained unchanged; R2 strengthened to require 1013, with setup coverage added. Full iterate is building through the host slot; about 109 GiB free, own target about 3 GiB. Exact reviewer union runner recovered from #240 attachment and adapted only for current paths; five final repetitions pending.
kayg commented 2026-10-29 16:16:48 +00:00
Author
Owner
Copy link

First restored-tree iterate: fmt, VT fmt, CLI compile-out, workspace clippy, SSH runtime helper and inode fixture PASS. Workspace tests stopped at existing infraternal/tests/agent_daemon.rs real_binary_preserves_input_and_output_across_24_abrupt_stops: verify-agent.py waits for shim-test prompt, socket read timed out. origin/dev scripts/agent_fixture.py now explicitly prepares the Bash prompt; preserve that shipped fix in required merge. No baseline/load exception claimed. cargo-deny reports expected RUSTSEC-2026-0386 on pre-merge tokio 1.53.2; required origin/dev merge supplies #255. Focused all-target server clippy and auth/recovery/source-loss tests are running before atomic fix commits.

First restored-tree iterate: fmt, VT fmt, CLI compile-out, workspace clippy, SSH runtime helper and inode fixture PASS. Workspace tests stopped at existing infraternal/tests/agent_daemon.rs real_binary_preserves_input_and_output_across_24_abrupt_stops: verify-agent.py waits for shim-test prompt, socket read timed out. origin/dev scripts/agent_fixture.py now explicitly prepares the Bash prompt; preserve that shipped fix in required merge. No baseline/load exception claimed. cargo-deny reports expected RUSTSEC-2026-0386 on pre-merge tokio 1.53.2; required origin/dev merge supplies #255. Focused all-target server clippy and auth/recovery/source-loss tests are running before atomic fix commits.
kayg commented 2026-10-29 16:20:04 +00:00
Author
Owner
Copy link

Committed/pushed 7986f5f72: logout retains its acquired connection through drained DELETE RETURNING and account publication in an owned boxed completion. Existing cancellation review test and rollback tests PASS. Formatter, workspace clippy and explicit all-target server clippy (remote,infraternal-agent/mesh) PASS. Focused restored-tree tests: test result: ok. 46 passed; 0 failed; 4 ignored; 0 measured; 665 filtered out; finished in 56.44s. Includes R1, strengthened R2/1013, setup source loss, cancelled/refused transaction checks and recovery capacity. Four ignored tests are measurement-only. Full iterate after this step is running; pre-merge fixture/Tokio failures remain recorded, not waived.

Committed/pushed 7986f5f72: logout retains its acquired connection through drained DELETE RETURNING and account publication in an owned boxed completion. Existing cancellation review test and rollback tests PASS. Formatter, workspace clippy and explicit all-target server clippy (remote,infraternal-agent/mesh) PASS. Focused restored-tree tests: test result: ok. 46 passed; 0 failed; 4 ignored; 0 measured; 665 filtered out; finished in 56.44s. Includes R1, strengthened R2/1013, setup source loss, cancelled/refused transaction checks and recovery capacity. Four ignored tests are measurement-only. Full iterate after this step is running; pre-merge fixture/Tokio failures remain recorded, not waived.
kayg commented 2026-10-29 16:20:57 +00:00
Author
Owner
Copy link

Committed/pushed ff5b6da44: final recovery commit and account notifications now share owned completion for start/cancel/rotation/completion. Real cancelled transaction wakes both affected sources; deferred-constraint commit refusal wakes neither and rolls back; unrelated account sources stay quiet. Included in 46/0 focused tests and clean all-target server clippy. Post-logout iterate repeated only the recorded old daemon prompt fixture and old Tokio advisory failures; no exception claimed. Next R2 bootstrap/setup commit, then dev merge to retain shipped fixture/security fixes.

Committed/pushed ff5b6da44: final recovery commit and account notifications now share owned completion for start/cancel/rotation/completion. Real cancelled transaction wakes both affected sources; deferred-constraint commit refusal wakes neither and rolls back; unrelated account sources stay quiet. Included in 46/0 focused tests and clean all-target server clippy. Post-logout iterate repeated only the recorded old daemon prompt fixture and old Tokio advisory failures; no exception claimed. Next R2 bootstrap/setup commit, then dev merge to retain shipped fixture/security fixes.
kayg commented 2026-10-29 16:22:18 +00:00
Author
Owner
Copy link

Committed/pushed dfb806246: bootstrap and setup propagate lost account source as typed unavailable authority to the shared upgrade, stop work, and send existing 1013 close. Covers idle, pending send, host-key confirmation and setup initial request waits. Original R1 unchanged; R2 strengthened to require 1013, added setup source loss and admission-retirement checks. Focused tests/clippy passed as recorded. Per-commit iterate still shows only old daemon prompt fixture + old Tokio advisory, which the required dev merge supplies; no tests/deadlines weakened. Remaining WIP is ignored perf-only logout publication harness, then merge origin/dev 4a6202a52 and final qualification.

Committed/pushed dfb806246: bootstrap and setup propagate lost account source as typed unavailable authority to the shared upgrade, stop work, and send existing 1013 close. Covers idle, pending send, host-key confirmation and setup initial request waits. Original R1 unchanged; R2 strengthened to require 1013, added setup source loss and admission-retirement checks. Focused tests/clippy passed as recorded. Per-commit iterate still shows only old daemon prompt fixture + old Tokio advisory, which the required dev merge supplies; no tests/deadlines weakened. Remaining WIP is ignored perf-only logout publication harness, then merge origin/dev 4a6202a52 and final qualification.
kayg commented 2026-10-29 16:25:05 +00:00
Author
Owner
Copy link

Committed/pushed perf-only harness 34b627ef4; formatter, explicit all-target server clippy PASS; logout tests 3 passed, 0 failed, measurement ignored. Merging origin/dev 4a6202a52 after all restored changes committed. Only conflicts: docs/PROCESS.md measured-size history and scripts/verify.d/rust.sh exact ceilings. Resolved both to dev (#255 ceilings 21,386,512 / 19,563,608); fresh branch measurements will be recorded separately. Kept all shipped busy-store authority handling, descriptor ownership/Tokio 1.53.3 repair, and new fixture prompt/short-path checks. No evidence/capture files introduced by merge. Merged-tree iterate running before merge commit.

Committed/pushed perf-only harness 34b627ef4; formatter, explicit all-target server clippy PASS; logout tests 3 passed, 0 failed, measurement ignored. Merging origin/dev 4a6202a52 after all restored changes committed. Only conflicts: docs/PROCESS.md measured-size history and scripts/verify.d/rust.sh exact ceilings. Resolved both to dev (#255 ceilings 21,386,512 / 19,563,608); fresh branch measurements will be recorded separately. Kept all shipped busy-store authority handling, descriptor ownership/Tokio 1.53.3 repair, and new fixture prompt/short-path checks. No evidence/capture files introduced by merge. Merged-tree iterate running before merge commit.
kayg commented 2026-10-29 16:44:16 +00:00
Author
Owner
Copy link

Merge committed/pushed 501f0d7ed: origin/dev 4a6202a52 integrated; both size conflicts resolved to dev as described in merge body. scripts/verify iterate PASS in full, including patched-Tokio cargo-deny, workspace tests, additional shim suite, TypeScript. Earlier daemon prompt fixture now PASS with dev's existing explicit shell setup. Server result verbatim:

test result: ok. 662 passed; 0 failed; 53 ignored; 0 measured; 0 filtered out; finished in 252.57s

No load exception. Five exact #240 reviewer-union runs now running on merged branch; final fast/static measurements still pending.

Merge committed/pushed 501f0d7ed: origin/dev 4a6202a52 integrated; both size conflicts resolved to dev as described in merge body. scripts/verify iterate PASS in full, including patched-Tokio cargo-deny, workspace tests, additional shim suite, TypeScript. Earlier daemon prompt fixture now PASS with dev's existing explicit shell setup. Server result verbatim: ```text test result: ok. 662 passed; 0 failed; 53 ignored; 0 measured; 0 filtered out; finished in 252.57s ``` No load exception. Five exact #240 reviewer-union runs now running on merged branch; final fast/static measurements still pending.
kayg commented 2026-10-29 16:49:49 +00:00
Author
Owner
Copy link

Five consecutive #240 reviewer-union runs on pushed merged head 501f0d7ed PASS. Same reviewer filters and remote,infraternal-agent/mesh features, plus 3 new functional tests. The sole ignored case is the perf-only diagnostic. Original R1 retained; R2 strengthened to require 1013. Both 256-socket/61-account cases pass each time: 16 affected sockets, 240 unrelated sockets with zero authority reads and authenticated work. Busy-store 1013 and source-loss checks pass all five. No load exception. Results verbatim:

test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 46.92s
test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 48.16s
test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 51.20s
test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 55.08s
test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 56.34s

All remaining own GNU incremental caches removed after the suite ended, before static builds; dependency artifacts retained. No other job files/processes touched.

Five consecutive #240 reviewer-union runs on pushed merged head 501f0d7ed PASS. Same reviewer filters and remote,infraternal-agent/mesh features, plus 3 new functional tests. The sole ignored case is the perf-only diagnostic. Original R1 retained; R2 strengthened to require 1013. Both 256-socket/61-account cases pass each time: 16 affected sockets, 240 unrelated sockets with zero authority reads and authenticated work. Busy-store 1013 and source-loss checks pass all five. No load exception. Results verbatim: ```text test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 46.92s test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 48.16s test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 51.20s test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 55.08s test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 56.34s ``` All remaining own GNU incremental caches removed after the suite ended, before static builds; dependency artifacts retained. No other job files/processes touched.
kayg commented 2026-10-29 16:55:07 +00:00
Author
Owner
Copy link

Evidence for five consecutive 41/0 #240 union passes, exact current-host runner, merged iterate PASS and focused auth/recovery/source-loss checks. Source cancellation/refusal/isolation assertions retained; durations are functional gate output, not perf evidence.

union-1.log
union-2.log
union-3.log
union-4.log
union-5.log
run-union-command.txt
iterate-merged-dev.log
focused-restored.log

Evidence for five consecutive 41/0 #240 union passes, exact current-host runner, merged iterate PASS and focused auth/recovery/source-loss checks. Source cancellation/refusal/isolation assertions retained; durations are functional gate output, not perf evidence. [union-1.log](https://git.kayg.org/attachments/a4453ffb-d2d7-45bc-94e2-852a29cc92e7) [union-2.log](https://git.kayg.org/attachments/bfa0e21a-8fa9-481e-a9f0-7556fb90569e) [union-3.log](https://git.kayg.org/attachments/4ff2b662-0e90-40b5-b08a-e40477a783a8) [union-4.log](https://git.kayg.org/attachments/763e8afb-009b-4051-98fe-0b92a7883c61) [union-5.log](https://git.kayg.org/attachments/b21acd97-2c2a-4b9e-b144-a039d8c23922) [run-union-command.txt](https://git.kayg.org/attachments/81a6d405-a9f5-4d76-aa63-9f2ef47550ad) [iterate-merged-dev.log](https://git.kayg.org/attachments/6f96cc85-d882-4b2e-87f5-56e087573328) [focused-restored.log](https://git.kayg.org/attachments/d4863f67-304e-4978-8eae-b7b8569704cf)
kayg commented 2026-10-29 16:59:20 +00:00
Author
Owner
Copy link

Fresh static baseline reproduction complete on 6by32-compute02, same job CARGO_TARGET_DIR/toolchain/profile/recipe: 9896d3a85b x86_64 image = 21,389,424 bytes, static PIE, stripped, PT_INTERP absent; SHA-256 71ced02f01ef832af382e0df838bc9d62e5de1226ec302f3c5ea5c7836605ef3. Matches prior independently reproduced baseline exactly. Branch static sizes pending. Preparing perf-only static test binaries for orchestrator handoff; no runtime performance measurement on the build VM.

Fresh static baseline reproduction complete on 6by32-compute02, same job CARGO_TARGET_DIR/toolchain/profile/recipe: 9896d3a85b7499fee9e7237fc6233c913f41bd5b x86_64 image = 21,389,424 bytes, static PIE, stripped, PT_INTERP absent; SHA-256 71ced02f01ef832af382e0df838bc9d62e5de1226ec302f3c5ea5c7836605ef3. Matches prior independently reproduced baseline exactly. Branch static sizes pending. Preparing perf-only static test binaries for orchestrator handoff; no runtime performance measurement on the build VM.
kayg commented 2026-10-29 17:07:35 +00:00
Author
Owner
Copy link

Perf-VM handoff (orchestrator runs; this VM does not measure): baseline static test executable ccea75217 plus only the ignored measurement harness from 34b627ef4. Production baseline unchanged. Binary retained on shared build VM 6by32-compute02 at /home/agent/.cache/codex-scratch/revocation-per-account-r2/evidence/logout-before; SHA-256 f9205be98be1c40c8bb01be8cda447deabd3603d095dd42d41b501a2de20b60f. Static PIE test program; size budget applies separately to stripped shipping CLI.

logout-before.gz

Decompress to ~/infraternal-perf/logout-before and make executable. Exact perf-VM command:

/usr/local/bin/perf-run.sh -- ~/infraternal-perf/logout-before --exact auth::tests::logout_commit::logout_publication_measurement --ignored --nocapture --test-threads=1

1,000 real in-memory SQLite logout completions, 16 affected and 240 unrelated watch cursors over 61 scopes; reports completion p50/p99, asserts account isolation. Final-head matching executable follows. Please run 3 interleaved before/after pairs under the perf lock once both are available. Comparison includes the required dev/Tokio merge and must not be called isolated completion-helper overhead. No build-host performance result claimed. Continuing static qualification and final gate.

Perf-VM handoff (orchestrator runs; this VM does not measure): baseline static test executable ccea75217 plus only the ignored measurement harness from 34b627ef4. Production baseline unchanged. Binary retained on shared build VM 6by32-compute02 at `/home/agent/.cache/codex-scratch/revocation-per-account-r2/evidence/logout-before`; SHA-256 `f9205be98be1c40c8bb01be8cda447deabd3603d095dd42d41b501a2de20b60f`. Static PIE test program; size budget applies separately to stripped shipping CLI. [logout-before.gz](https://git.kayg.org/attachments/f16d6acc-55da-4ba1-9fb0-706f70749fa1) Decompress to `~/infraternal-perf/logout-before` and make executable. Exact perf-VM command: ```sh /usr/local/bin/perf-run.sh -- ~/infraternal-perf/logout-before --exact auth::tests::logout_commit::logout_publication_measurement --ignored --nocapture --test-threads=1 ``` 1,000 real in-memory SQLite logout completions, 16 affected and 240 unrelated watch cursors over 61 scopes; reports completion p50/p99, asserts account isolation. Final-head matching executable follows. Please run 3 interleaved before/after pairs under the perf lock once both are available. Comparison includes the required dev/Tokio merge and must not be called isolated completion-helper overhead. No build-host performance result claimed. Continuing static qualification and final gate.
kayg commented 2026-10-29 17:14:22 +00:00
Author
Owner
Copy link

Fresh branch x86_64 static measurement on pushed 501f0d7ed: 21,403,472 bytes, stripped static PIE, PT_INTERP absent. Versus freshly reproduced task baseline 9896d3a85 at 21,389,424: +14,048 bytes total, within the task's <=16 KB budget. Against dev #255 cap 21,386,512, +16,960 bytes; the task comparison is against 9896, not the later smaller dev image. Trust and native key-memory check PASS. ARM is building sequentially. Exact caps remain dev values until both measurements complete; expected cap failure is not waived. No dependency/feature/profile changes introduced by R1/R2; required dev merge supplies #255.

Fresh branch x86_64 static measurement on pushed 501f0d7ed: 21,403,472 bytes, stripped static PIE, PT_INTERP absent. Versus freshly reproduced task baseline 9896d3a85 at 21,389,424: +14,048 bytes total, within the task's <=16 KB budget. Against dev #255 cap 21,386,512, +16,960 bytes; the task comparison is against 9896, not the later smaller dev image. Trust and native key-memory check PASS. ARM is building sequentially. Exact caps remain dev values until both measurements complete; expected cap failure is not waived. No dependency/feature/profile changes introduced by R1/R2; required dev merge supplies #255.
kayg commented 2026-10-29 17:27:00 +00:00
Author
Owner
Copy link

Both static images measured on 501f0d7ed: x86_64 21,403,472 (+14,048 vs fresh 9896 baseline), ARM 19,585,304 (+23,008 vs recorded 9896 ARM 19,562,296). ARM exceeds the 16 KB target. Before accepting an exception, reusing the existing websocket DetachOnDrop ownership wrapper instead of the new result oneshot: normal writes can run inline; cancellation alone detaches their owned commit/publication. This removes the success-path task hop and a channel implementation. First extracting the existing wrapper unchanged into shared completion module (including existing read-place retention); iterate running. Then auth switches to it, tests/repetitions and both sizes will rerun. No gate budget raised yet.

Both static images measured on 501f0d7ed: x86_64 21,403,472 (+14,048 vs fresh 9896 baseline), ARM 19,585,304 (+23,008 vs recorded 9896 ARM 19,562,296). ARM exceeds the 16 KB target. Before accepting an exception, reusing the existing websocket DetachOnDrop ownership wrapper instead of the new result oneshot: normal writes can run inline; cancellation alone detaches their owned commit/publication. This removes the success-path task hop and a channel implementation. First extracting the existing wrapper unchanged into shared completion module (including existing read-place retention); iterate running. Then auth switches to it, tests/repetitions and both sizes will rerun. No gate budget raised yet.
kayg commented 2026-10-29 17:49:23 +00:00
Author
Owner
Copy link

Continued branch revocation-per-account at pushed d1f653dcd (shared completion refactor). Latest iterate PASS (662 passed, 0 failed, 53 ignored). Auth trimming found an extra cancellation edge: inline retention using ambient tokio::spawn fails when its public waiter is dropped on a thread without an entered runtime. Real SQLite blocked-COMMIT test reproduced failure (0 passed, 1 failed); retaining the originating runtime only for auth writes fixes scheduling without cloning a handle on authority reads. Focused green run in progress, then five repetitions and both static sizes. No deployment.

Continued branch revocation-per-account at pushed d1f653dcd (shared completion refactor). Latest iterate PASS (662 passed, 0 failed, 53 ignored). Auth trimming found an extra cancellation edge: inline retention using ambient tokio::spawn fails when its public waiter is dropped on a thread without an entered runtime. Real SQLite blocked-COMMIT test reproduced failure (0 passed, 1 failed); retaining the originating runtime only for auth writes fixes scheduling without cloning a handle on authority reads. Focused green run in progress, then five repetitions and both static sizes. No deployment.
kayg commented 2026-10-29 18:11:03 +00:00
Author
Owner
Copy link

Inline completion validation: formatter, explicit all-target server clippy PASS; full iterate test row failed only ca_bootstrap::tests::generated_remote_leaf_is_verifiable_after_cold_restart at existing X509StoreContext verify_cert assertion (661 passed, 1 failed, 53 ignored). Exact isolated rerun, unchanged tree: 1 passed, 0 failed. No CA source changes and no load waiver; final full fast must pass afresh. Other Rust iterate rows passed. Five #240 union repetitions on final auth retention implementation now running. Runtime-context cancellation red/green attached below.
outside-runtime-red.log
outside-runtime-green.log

Inline completion validation: formatter, explicit all-target server clippy PASS; full iterate test row failed only ca_bootstrap::tests::generated_remote_leaf_is_verifiable_after_cold_restart at existing X509StoreContext verify_cert assertion (661 passed, 1 failed, 53 ignored). Exact isolated rerun, unchanged tree: 1 passed, 0 failed. No CA source changes and no load waiver; final full fast must pass afresh. Other Rust iterate rows passed. Five #240 union repetitions on final auth retention implementation now running. Runtime-context cancellation red/green attached below. [outside-runtime-red.log](https://git.kayg.org/attachments/1245a58b-0471-47a9-8d00-9985e81ff4a6) [outside-runtime-green.log](https://git.kayg.org/attachments/8416d8c7-f550-44ad-9369-a4c628d7afa7)
kayg commented 2026-10-29 18:15:34 +00:00
Author
Owner
Copy link

Committed f2943586f: auth reuses shared cancellation retention, normal writes finish inline; auth retains originating runtime only for cross-thread cancellation. No success-path oneshot/task hop. Formatter and explicit all-target server clippy PASS; strengthened blocked-COMMIT test red then green. Five consecutive #240 unions on this source, verbatim:

test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 56.92s
test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 54.11s
test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 49.98s
test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 48.30s
test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 49.79s

All ten 256-socket capacity cases: 16 affected, 240 unaffected, unrelated_reads=0, recovered=240. Existing R1 unchanged, R2 requires 1013. Full iterate CA failure and isolated green rerun recorded separately, no waiver. Both static images now rebuilding sequentially before caps change; final fast pending.

Committed f2943586f: auth reuses shared cancellation retention, normal writes finish inline; auth retains originating runtime only for cross-thread cancellation. No success-path oneshot/task hop. Formatter and explicit all-target server clippy PASS; strengthened blocked-COMMIT test red then green. Five consecutive #240 unions on this source, verbatim: ```text test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 56.92s test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 54.11s test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 49.98s test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 48.30s test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 49.79s ``` All ten 256-socket capacity cases: 16 affected, 240 unaffected, unrelated_reads=0, recovered=240. Existing R1 unchanged, R2 requires 1013. Full iterate CA failure and isolated green rerun recorded separately, no waiver. Both static images now rebuilding sequentially before caps change; final fast pending.
kayg commented 2026-10-29 18:24:29 +00:00
Author
Owner
Copy link

Final corrected source f2943586f, same pinned static recipe: x86_64 21,401,712 bytes; aarch64 19,583,480. Against task baseline 9896d3a85 (21,389,424 / 19,562,296), whole-branch growth +12,288 / +21,184 bytes. x86 baseline independently reproduced byte-for-byte; ARM baseline is recorded release artifact. Both stripped static PIEs, PT_INTERP absent, production trust and compiler metadata PASS; native x86 key-memory PASS, ARM runtime not executable on x86 host.

D243 target-specific justification under the brief's "unless justified": x86 meets 16 KB; ARM exceeds 16 KiB by 4,800 bytes. Required corrected behavior owns commit+notification through cancellation for logout and every recovery writer, and propagates unavailable authority across bootstrap/setup idle, pending sends, initial receive and confirmation. First corrected implementation cost +14,048 / +23,008; sharing existing completion retention removes a success-path task hop/result channel and saves 1,760 / 1,824 bytes. Remaining +21,184 ARM is the whole branch including account scoping and required dev/Tokio integration, not isolated helper overhead. No new dependency/features/schema/protocol/profile. Preserve correctness guarantees rather than weaken tests or change release optimization. Exact caps updated to 21,401,712 / 19,583,480, with no allowance, and are being rechecked. No runtime-performance claim; paired perf handoff pending.

Final corrected source f2943586f, same pinned static recipe: x86_64 21,401,712 bytes; aarch64 19,583,480. Against task baseline 9896d3a85 (21,389,424 / 19,562,296), whole-branch growth +12,288 / +21,184 bytes. x86 baseline independently reproduced byte-for-byte; ARM baseline is recorded release artifact. Both stripped static PIEs, PT_INTERP absent, production trust and compiler metadata PASS; native x86 key-memory PASS, ARM runtime not executable on x86 host. D243 target-specific justification under the brief's "unless justified": x86 meets 16 KB; ARM exceeds 16 KiB by 4,800 bytes. Required corrected behavior owns commit+notification through cancellation for logout and every recovery writer, and propagates unavailable authority across bootstrap/setup idle, pending sends, initial receive and confirmation. First corrected implementation cost +14,048 / +23,008; sharing existing completion retention removes a success-path task hop/result channel and saves 1,760 / 1,824 bytes. Remaining +21,184 ARM is the whole branch including account scoping and required dev/Tokio integration, not isolated helper overhead. No new dependency/features/schema/protocol/profile. Preserve correctness guarantees rather than weaken tests or change release optimization. Exact caps updated to 21,401,712 / 19,583,480, with no allowance, and are being rechecked. No runtime-performance claim; paired perf handoff pending.
kayg commented 2026-10-29 18:24:53 +00:00
Author
Owner
Copy link

Committed/pushed 63c0d9c3a: exact static ceilings and measured D243 history/ARM justification. Cached full static qualification with new caps PASS; boundary, linkage, production trust, compiler metadata, x86 native key-memory and CLI checks pass. Verbatim size rows:

PT_INTERP: absent; size: 21401712 bytes; cap: 21401712 bytes; delta: +0 bytes
PT_INTERP: absent; size: 19583480 bytes; cap: 19583480 bytes; delta: +0 bytes

ARM key-memory execution is explicitly not checked on x86. Final-head perf binary building now, followed by full scripts/verify fast on committed head. No deployment.

Committed/pushed 63c0d9c3a: exact static ceilings and measured D243 history/ARM justification. Cached full static qualification with new caps PASS; boundary, linkage, production trust, compiler metadata, x86 native key-memory and CLI checks pass. Verbatim size rows: ``` PT_INTERP: absent; size: 21401712 bytes; cap: 21401712 bytes; delta: +0 bytes PT_INTERP: absent; size: 19583480 bytes; cap: 19583480 bytes; delta: +0 bytes ``` ARM key-memory execution is explicitly not checked on x86. Final-head perf binary building now, followed by full scripts/verify fast on committed head. No deployment.
kayg commented 2026-10-29 18:32:42 +00:00
Author
Owner
Copy link

Matching final-head perf executable ready on 6by32-compute02: /home/agent/.cache/codex-scratch/revocation-per-account-r2/evidence/logout-after, source 63c0d9c3a576e409a026f837c02347648e201bef, SHA-256 f4e7d28ab96317c8b8fe40e86240d10f6aed4a8dd25f6835892037a61d5e5da4. Static PIE test program; --list confirms exact diagnostic, no measurement run here.

Decompress attachment to ~/infraternal-perf/logout-after, make executable. Exact command:

/usr/local/bin/perf-run.sh -- ~/infraternal-perf/logout-after --exact auth::tests::logout_commit::logout_publication_measurement --ignored --nocapture --test-threads=1

Please run 3 interleaved before/after pairs with earlier logout-before artifact (SHA f9205be98be1c40c8bb01be8cda447deabd3603d095dd42d41b501a2de20b60f). Same 1,000 SQLite logouts, 16 affected + 240 unrelated cursors/61 scopes. Comparison includes dev/Tokio merge; do not attribute it solely to helper overhead. Runtime performance remains pending orchestrator, not a build-host claim. Full final scripts/verify fast running on committed head.

logout-after.gz
perf-after.json

Matching final-head perf executable ready on 6by32-compute02: `/home/agent/.cache/codex-scratch/revocation-per-account-r2/evidence/logout-after`, source `63c0d9c3a576e409a026f837c02347648e201bef`, SHA-256 `f4e7d28ab96317c8b8fe40e86240d10f6aed4a8dd25f6835892037a61d5e5da4`. Static PIE test program; --list confirms exact diagnostic, no measurement run here. Decompress attachment to ~/infraternal-perf/logout-after, make executable. Exact command: ```sh /usr/local/bin/perf-run.sh -- ~/infraternal-perf/logout-after --exact auth::tests::logout_commit::logout_publication_measurement --ignored --nocapture --test-threads=1 ``` Please run 3 interleaved before/after pairs with earlier logout-before artifact (SHA f9205be98be1c40c8bb01be8cda447deabd3603d095dd42d41b501a2de20b60f). Same 1,000 SQLite logouts, 16 affected + 240 unrelated cursors/61 scopes. Comparison includes dev/Tokio merge; do not attribute it solely to helper overhead. Runtime performance remains pending orchestrator, not a build-host claim. Full final scripts/verify fast running on committed head. [logout-after.gz](https://git.kayg.org/attachments/8d2e09a8-0341-41aa-8097-411efd510b2f) [perf-after.json](https://git.kayg.org/attachments/75c58298-9562-47a0-adff-55f737391b78)
kayg commented 2026-10-29 18:47:19 +00:00
Author
Owner
Copy link

Finished implementation on pushed branch revocation-per-account, head 63c0d9c3a5; origin matches, worktree clean. R1: logout and recovery writers own final commit plus account publication through cancellation, including dropping the public waiter outside runtime context. R2: bootstrap/setup notification-source loss stops work and closes with existing 1013 unavailable authority. Original R1 test unchanged; R2 strengthened, none weakened. Required dev 4a6202a52 merged in 501f0d7ed, preserving shipped busy-store handling and Tokio repair; merge resolutions recorded in commit. No deployment, issue stays open.

Final scripts/verify fast on this committed head, verbatim summary and exit (complete unfiltered transcript attached):

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
scripts/verify fast exit=0

Server result, verbatim:

test result: ok. 662 passed; 0 failed; 53 ignored; 0 measured; 0 filtered out; finished in 328.17s

TypeScript stages pass. Earlier iterate's isolated CA assertion failure did not recur in final full gate, no waiver.

Five consecutive final #240 union results, verbatim:

test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 56.92s
test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 54.11s
test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 49.98s
test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 48.30s
test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 49.79s

All ten capacity cases: sockets=256, accounts=61, affected=16, unaffected=240, unrelated_reads=0, recovered=240. Busy-store 1013 and closed-source checks pass every run. Sole ignored union case is perf-only.

D243 shipping images: x86_64 21,401,712 (+12,288 versus reproduced 9896d3a85); ARM 19,583,480 (+21,184 versus recorded 9896 baseline). ARM justified-growth rationale and trim savings (1,760 / 1,824 bytes) in prior comment and docs/PROCESS.md. Exact caps, static linkage/no PT_INTERP, trust and metadata pass; x86 native key-memory pass. ARM runtime execution not checked on x86 host.

Runtime performance remains for the orchestrator: both static before/after test binaries, hashes and exact perf-run.sh commands attached in preceding handoff; request 3 interleaved pairs. No runtime-performance measurement or claim from build VM.

Cleanup complete: own target deleted after proving no executable from it remained active; temporary baseline worktree already removed. Both perf binaries and evidence preserved outside checkout. No other job files/processes touched. Author auth review attached; independent review remains the orchestrator's next step.

verify-fast-final.log
gate-summary-final.txt
self-review-final.txt

union-final-1.log
union-final-2.log
union-final-3.log
union-final-4.log
union-final-5.log
iterate-inline.log
ca-rerun.log

static-exact-caps.log
sizes-final.json
self-review.txt

cleanup-final.json
run-union-final.txt

Finished implementation on pushed branch revocation-per-account, head 63c0d9c3a576e409a026f837c02347648e201bef; origin matches, worktree clean. R1: logout and recovery writers own final commit plus account publication through cancellation, including dropping the public waiter outside runtime context. R2: bootstrap/setup notification-source loss stops work and closes with existing 1013 unavailable authority. Original R1 test unchanged; R2 strengthened, none weakened. Required dev 4a6202a52 merged in 501f0d7ed, preserving shipped busy-store handling and Tokio repair; merge resolutions recorded in commit. No deployment, issue stays open. Final scripts/verify fast on this committed head, verbatim summary and exit (complete unfiltered transcript attached): ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ scripts/verify fast exit=0 ``` Server result, verbatim: ```text test result: ok. 662 passed; 0 failed; 53 ignored; 0 measured; 0 filtered out; finished in 328.17s ``` TypeScript stages pass. Earlier iterate's isolated CA assertion failure did not recur in final full gate, no waiver. Five consecutive final #240 union results, verbatim: ```text test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 56.92s test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 54.11s test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 49.98s test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 48.30s test result: ok. 41 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 49.79s ``` All ten capacity cases: sockets=256, accounts=61, affected=16, unaffected=240, unrelated_reads=0, recovered=240. Busy-store 1013 and closed-source checks pass every run. Sole ignored union case is perf-only. D243 shipping images: x86_64 21,401,712 (+12,288 versus reproduced 9896d3a85); ARM 19,583,480 (+21,184 versus recorded 9896 baseline). ARM justified-growth rationale and trim savings (1,760 / 1,824 bytes) in prior comment and docs/PROCESS.md. Exact caps, static linkage/no PT_INTERP, trust and metadata pass; x86 native key-memory pass. ARM runtime execution not checked on x86 host. Runtime performance remains for the orchestrator: both static before/after test binaries, hashes and exact perf-run.sh commands attached in preceding handoff; request 3 interleaved pairs. No runtime-performance measurement or claim from build VM. Cleanup complete: own target deleted after proving no executable from it remained active; temporary baseline worktree already removed. Both perf binaries and evidence preserved outside checkout. No other job files/processes touched. Author auth review attached; independent review remains the orchestrator's next step. [verify-fast-final.log](https://git.kayg.org/attachments/a31e2285-1b59-4e5f-9e08-f6fed324e7b6) [gate-summary-final.txt](https://git.kayg.org/attachments/f3163c1c-bb46-4f98-bcdf-653dfd4485ef) [self-review-final.txt](https://git.kayg.org/attachments/d367b339-b0a4-4fe2-a7ff-2d4e1abc260e) [union-final-1.log](https://git.kayg.org/attachments/b5cd5fc8-2eb7-4386-ac99-10e5a718d915) [union-final-2.log](https://git.kayg.org/attachments/ba4a3648-3c4c-4e5d-9070-7996b62a076a) [union-final-3.log](https://git.kayg.org/attachments/352e8e59-46cd-4576-a086-61b9f13c7968) [union-final-4.log](https://git.kayg.org/attachments/b70e4f5f-cbc9-46e9-b266-20eade535f5e) [union-final-5.log](https://git.kayg.org/attachments/f39ce3f6-e188-497c-a812-62d92c85e075) [iterate-inline.log](https://git.kayg.org/attachments/1530fb30-39be-45f4-826a-06772b383fa8) [ca-rerun.log](https://git.kayg.org/attachments/d6af8f74-8165-4bfb-9edf-a82bd96596f4) [static-exact-caps.log](https://git.kayg.org/attachments/192df36a-4443-4c11-bbf1-aef236a9e3f4) [sizes-final.json](https://git.kayg.org/attachments/da420924-a146-4776-835f-854456d7e704) [self-review.txt](https://git.kayg.org/attachments/b364f3b0-b7a2-4e59-b924-658ded4fa0da) [cleanup-final.json](https://git.kayg.org/attachments/a4c3db90-e9b9-45e5-8273-7ad82bd7b117) [run-union-final.txt](https://git.kayg.org/attachments/4971b415-c219-4638-93c5-b5bf955f205d)
kayg commented 2026-10-29 18:48:19 +00:00
Author
Owner
Copy link

Independent round 2 delta review started. Branch review-revocation-r2, base 63c0d9c3a. Reviewing R1 cancellation/commit publication, R2 source loss and restoration, isolation, busy-store close handling, dev merge and size justification. Implementation will remain unchanged.

Independent round 2 delta review started. Branch review-revocation-r2, base 63c0d9c3a. Reviewing R1 cancellation/commit publication, R2 source loss and restoration, isolation, busy-store close handling, dev merge and size justification. Implementation will remain unchanged.
kayg commented 2026-10-29 18:53:02 +00:00
Author
Owner
Copy link

Source audit complete; functional compilation running through build-slot. No confirmed finding yet. R1: logout retains its acquired connection and drained DELETE through publication; recovery start/cancel/rotation and WebAuthn recovery completion all reach the shared retained final commit. Pending-login removal cannot authorize a live socket; passkey addition/counter updates do not revoke sessions. R2: old watch receivers retain closure when a replacement registry entry appears; added real-socket restoration checks and a revoked proof-cursor check. Added real-SQLite blocked-COMMIT checks for timeout, panic, task abort, and refusal after caller drop (results pending).

Merge audit: Cargo.lock and crates/infraternal-shim/src/readiness.rs byte-identical to current origin/dev 63773bb3e. Transport and close-reason modules also identical. Actual merged dev parent is 4a6202a52; 63773bb3e only adds D311 text. Remerge diff confirms only process/size-cap conflicts. Release 9.4's known-unavailable/1013 logic remains intact. Size reproduction and final fast gate pending. Implementation unchanged.

Source audit complete; functional compilation running through build-slot. No confirmed finding yet. R1: logout retains its acquired connection and drained DELETE through publication; recovery start/cancel/rotation and WebAuthn recovery completion all reach the shared retained final commit. Pending-login removal cannot authorize a live socket; passkey addition/counter updates do not revoke sessions. R2: old watch receivers retain closure when a replacement registry entry appears; added real-socket restoration checks and a revoked proof-cursor check. Added real-SQLite blocked-COMMIT checks for timeout, panic, task abort, and refusal after caller drop (results pending). Merge audit: Cargo.lock and crates/infraternal-shim/src/readiness.rs byte-identical to current origin/dev 63773bb3e. Transport and close-reason modules also identical. Actual merged dev parent is 4a6202a52; 63773bb3e only adds D311 text. Remerge diff confirms only process/size-cap conflicts. Release 9.4's known-unavailable/1013 logic remains intact. Size reproduction and final fast gate pending. Implementation unchanged.
kayg commented 2026-10-29 18:56:49 +00:00
Author
Owner
Copy link

Round 2 finding R2-1 (P2), failing test committed/pushed immediately at 69e91d072 on review-revocation-r2. Recovery-state source loss uses websocket.rs:674–675 plain break, leaving loop_result Ok. An idle recovery-subscribed socket therefore stops with an empty WebSocket Close, without 1013 or a fresh authority read. This differs from the corrected revocation-source path. Contract keywrap.md:359 requires lost sources to report unavailable authority; the review brief also permits a full read.

Real SQLite/WebSocket reproduction closes then synchronously replaces the recovery source before the old cursor runs, parks proof timers, and counts authority reads. Test review_r2_lost_recovery_source_reports_unavailable_or_reads_authority: 0 passed, 1 failed, codes=[], reread=false. The socket stops; no continued serving is alleged. Normal registry ownership prevents source loss without the existing test hook. Implementation unchanged. Full gate and remaining checks pending.
lost-recovery-source.log

Round 2 finding R2-1 (P2), failing test committed/pushed immediately at 69e91d072 on review-revocation-r2. Recovery-state source loss uses websocket.rs:674–675 plain break, leaving loop_result Ok. An idle recovery-subscribed socket therefore stops with an empty WebSocket Close, without 1013 or a fresh authority read. This differs from the corrected revocation-source path. Contract keywrap.md:359 requires lost sources to report unavailable authority; the review brief also permits a full read. Real SQLite/WebSocket reproduction closes then synchronously replaces the recovery source before the old cursor runs, parks proof timers, and counts authority reads. Test review_r2_lost_recovery_source_reports_unavailable_or_reads_authority: 0 passed, 1 failed, codes=[], reread=false. The socket stops; no continued serving is alleged. Normal registry ownership prevents source loss without the existing test hook. Implementation unchanged. Full gate and remaining checks pending. [lost-recovery-source.log](https://git.kayg.org/attachments/00ed243c-aec3-49ae-870e-fa7159ac1f4f)
kayg commented 2026-10-29 19:00:47 +00:00
Author
Owner
Copy link

Review evidence pushed in separate commits: 69e91d072 (new P2 failing source-loss regression), 93cdf2450 (four passing real-SQLite commit/departure checks), 53e6a7f0a (three passing source-restoration checks). Head 53e6a7f0a; no implementation changes.

Formatter and all-target server clippy with remote,infraternal-agent/mesh PASS after correcting one similar_names lint in a new test. Focused results: new passing checks 7/0; logout completion/refusal/rollback 3/0 (one perf-only ignore); inherited busy-wake/1013 and sixteen-socket recovery 2/0. Initial account filter 39/0, one perf ignore, including original R1/R2 and both capacity cases. Capacity evidence: 256 sockets / 61 accounts / 16 affected / 240 unaffected, unrelated_reads=0 and recovered=240 for logout and recovery.

The sole confirmed finding remains P2 R2-1, recovery-state source loss with codes=[] and reread=false. Shared-helper tests plus call-site audit cover every recovery final-commit writer; pending-login cleanup and ordinary passkey updates cannot revoke authorized sockets. Same-recipe static dev merge-base reproduction is running, then full scripts/verify fast on the review head. No runtime performance measurement on this VM.

Review evidence pushed in separate commits: 69e91d072 (new P2 failing source-loss regression), 93cdf2450 (four passing real-SQLite commit/departure checks), 53e6a7f0a (three passing source-restoration checks). Head 53e6a7f0a; no implementation changes. Formatter and all-target server clippy with remote,infraternal-agent/mesh PASS after correcting one similar_names lint in a new test. Focused results: new passing checks 7/0; logout completion/refusal/rollback 3/0 (one perf-only ignore); inherited busy-wake/1013 and sixteen-socket recovery 2/0. Initial account filter 39/0, one perf ignore, including original R1/R2 and both capacity cases. Capacity evidence: 256 sockets / 61 accounts / 16 affected / 240 unaffected, unrelated_reads=0 and recovered=240 for logout and recovery. The sole confirmed finding remains P2 R2-1, recovery-state source loss with codes=[] and reread=false. Shared-helper tests plus call-site audit cover every recovery final-commit writer; pending-login cleanup and ordinary passkey updates cannot revoke authorized sockets. Same-recipe static dev merge-base reproduction is running, then full scripts/verify fast on the review head. No runtime performance measurement on this VM.
kayg commented 2026-10-29 19:53:17 +00:00
Author
Owner
Copy link

Review evidence correction: e231c1644 (pushed to review-revocation-r2) adds an explicit one-shot SQLite worker fence to the refused-commit test. The initial full gate exposed my test's assumption that the first poll must remain Pending: deferred foreign-key refusal can complete before a reader lock matters. This was a review-fixture defect, separate from R2-1; production code remains unchanged.

Corrected focused run: fmt and all-target server clippy PASS; seven new positive tests PASS; logout ordering/refusal 3 PASS, 1 measurement-only ignored; busy-wake 2 PASS. Initial full fast gate: all rows except workspace tests PASS, including both static builds. Reproduced shipping sizes: x86 21,401,712 / ARM 19,583,480 bytes. Fresh dev merge-base x86 was 21,386,512, delta +15,200.

Final scripts/verify fast is running on e231c1644. The deliberate R2-1 regression is retained.

Review evidence correction: e231c1644 (pushed to review-revocation-r2) adds an explicit one-shot SQLite worker fence to the refused-commit test. The initial full gate exposed my test's assumption that the first poll must remain Pending: deferred foreign-key refusal can complete before a reader lock matters. This was a review-fixture defect, separate from R2-1; production code remains unchanged. Corrected focused run: fmt and all-target server clippy PASS; seven new positive tests PASS; logout ordering/refusal 3 PASS, 1 measurement-only ignored; busy-wake 2 PASS. Initial full fast gate: all rows except workspace tests PASS, including both static builds. Reproduced shipping sizes: x86 21,401,712 / ARM 19,583,480 bytes. Fresh dev merge-base x86 was 21,386,512, delta +15,200. Final scripts/verify fast is running on e231c1644. The deliberate R2-1 regression is retained.
kayg commented 2026-10-29 20:08:04 +00:00
Author
Owner
Copy link

Independent round-2 verdict: merge after fixes. Counts: 0 P0 / 0 P1 / 1 P2 / 0 P3.

Target 63c0d9c3a5; review head e231c16444, pushed only to review-revocation-r2. Four atomic test-only commits; implementation unchanged. Never close this issue from the review job.

R2-1 (P2) — websocket.rs:674–675 takes a plain break when a subscribed recovery-state notification source is lost. Even synchronous source replacement leaves the old cursor closed. The real SQLite/loopback regression fails with codes=[], reread=false: socket stops without 1013 or a fresh authority read. This is a defensive outcome/contract gap; it does not demonstrate continued serving, and current registry ownership requires the existing test hook to produce the loss. Fix the unavailable-authority outcome and retain this regression.

Original R1 logout cancellation and bootstrap R2 regressions pass. New real-SQLite completion checks pass for panic, timeout, task abort and refused commit after caller drop: no precommit or rolled-back publication. Recovery/recovery rotation/WebAuthn recovery writers share the retained commit path; remaining writers were checked for session-revocation scope. Immediate source restoration checks pass for bootstrap, setup and the proof lease. Both 256-socket capacity cases pass: 16 affected, 240 unaffected, zero unrelated authority reads and 240 recovered application calls. Busy-store 1013 and short-stall recovery pass.

Dev merge: requested Cargo.lock/readiness.rs diff is empty against origin/dev 63773bb3e; transport and close reasons also match. Remerge resolution only docs/size caps; release 9.4 busy/unavailable behavior is retained.

Size: shipping x86/ARM reproduced at 21,401,712 / 19,583,480 bytes, exact caps and digests retained. Fresh dev merge-base x86 is 21,386,512 (+15,200). Task-baseline deltas +12,288 / +21,184 (ARM 4,800 above 16 KiB). No obvious dead/duplicated production helper found. Source review supports the recorded whole-branch behavior justification and shared-helper trim; this is not independent symbol attribution. ARM baseline remains the author's recorded artifact. Paired runtime perf-VM handoff remains with the orchestrator; no shared-build-VM timing claim.

Final server result, verbatim:

test result: FAILED. 669 passed; 1 failed; 53 ignored; 0 measured; 0 filtered out; finished in 325.47s

Only R2-1 fails. The initial gate exposed a reviewer-fixture Pending assumption; e231c1644 replaces it with an explicit SQLite worker fence. It passes focused checks and the full suite. Supplemental standard ts_verify_fast stage PASS (exit 0), since the deliberate Rust failure prevents dispatch to it.

Final scripts/verify fast on the job head, verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| test                      | FAIL (101)   |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

scripts/verify fast exit=1

Evidence:
findings.md
reviewer-checklist.txt
verify-fast.log
typescript.log
verify-fast-initial.log

merge-proof.json
size-evidence.txt
account-tests.log
focused-corrected.log
baseline-static.log

Cleanup: no active executable under the job target; target directory deleted, temporary baseline removed. Review worktree and scratch evidence retained. Local and origin review heads match; worktree clean. No deployment or implementation fix.

Independent round-2 verdict: **merge after fixes**. Counts: **0 P0 / 0 P1 / 1 P2 / 0 P3**. Target 63c0d9c3a576e409a026f837c02347648e201bef; review head e231c16444f266871e07503762d0c5e370e0422e, pushed only to review-revocation-r2. Four atomic test-only commits; implementation unchanged. Never close this issue from the review job. **R2-1 (P2)** — websocket.rs:674–675 takes a plain break when a subscribed recovery-state notification source is lost. Even synchronous source replacement leaves the old cursor closed. The real SQLite/loopback regression fails with `codes=[], reread=false`: socket stops without 1013 or a fresh authority read. This is a defensive outcome/contract gap; it does not demonstrate continued serving, and current registry ownership requires the existing test hook to produce the loss. Fix the unavailable-authority outcome and retain this regression. Original R1 logout cancellation and bootstrap R2 regressions pass. New real-SQLite completion checks pass for panic, timeout, task abort and refused commit after caller drop: no precommit or rolled-back publication. Recovery/recovery rotation/WebAuthn recovery writers share the retained commit path; remaining writers were checked for session-revocation scope. Immediate source restoration checks pass for bootstrap, setup and the proof lease. Both 256-socket capacity cases pass: 16 affected, 240 unaffected, zero unrelated authority reads and 240 recovered application calls. Busy-store 1013 and short-stall recovery pass. Dev merge: requested Cargo.lock/readiness.rs diff is empty against origin/dev 63773bb3e; transport and close reasons also match. Remerge resolution only docs/size caps; release 9.4 busy/unavailable behavior is retained. Size: shipping x86/ARM reproduced at 21,401,712 / 19,583,480 bytes, exact caps and digests retained. Fresh dev merge-base x86 is 21,386,512 (+15,200). Task-baseline deltas +12,288 / +21,184 (ARM 4,800 above 16 KiB). No obvious dead/duplicated production helper found. Source review supports the recorded whole-branch behavior justification and shared-helper trim; this is not independent symbol attribution. ARM baseline remains the author's recorded artifact. Paired runtime perf-VM handoff remains with the orchestrator; no shared-build-VM timing claim. Final server result, verbatim: ``` test result: FAILED. 669 passed; 1 failed; 53 ignored; 0 measured; 0 filtered out; finished in 325.47s ``` Only R2-1 fails. The initial gate exposed a reviewer-fixture Pending assumption; e231c1644 replaces it with an explicit SQLite worker fence. It passes focused checks and the full suite. Supplemental standard ts_verify_fast stage PASS (exit 0), since the deliberate Rust failure prevents dispatch to it. Final `scripts/verify fast` on the job head, verbatim: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | test | FAIL (101) | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ scripts/verify fast exit=1 ``` Evidence: [findings.md](https://git.kayg.org/attachments/aacbdb4f-066e-416b-a579-eb6d357db670) [reviewer-checklist.txt](https://git.kayg.org/attachments/5c201008-cfb7-43bf-91f4-162dbb8db7a4) [verify-fast.log](https://git.kayg.org/attachments/0fb5523f-fa33-47f1-85a1-cbbb37a8169a) [typescript.log](https://git.kayg.org/attachments/439713d5-7909-474c-82c8-acdd666e61a9) [verify-fast-initial.log](https://git.kayg.org/attachments/32fc150e-59b3-4b4b-ac4d-b10d021a3060) [merge-proof.json](https://git.kayg.org/attachments/325be556-0939-4212-8678-b85cc5a395ed) [size-evidence.txt](https://git.kayg.org/attachments/1e5109ee-9d04-4a2d-9d53-6f3b437a42e8) [account-tests.log](https://git.kayg.org/attachments/ed21bfc6-867e-41cd-87b1-a8b7a5932eeb) [focused-corrected.log](https://git.kayg.org/attachments/9d5a923e-4327-4306-a603-f8db7c1e3992) [baseline-static.log](https://git.kayg.org/attachments/311fac07-82ba-4f92-a929-891fa7b85822) Cleanup: no active executable under the job target; target directory deleted, temporary baseline removed. Review worktree and scratch evidence retained. Local and origin review heads match; worktree clean. No deployment or implementation fix.
kayg commented 2026-10-29 20:09:27 +00:00
Author
Owner
Copy link

Start R2-1 (P2) implementation fix. Base origin/revocation-per-account 63c0d9c3a5; merged review e231c16444. Local branch revocation-r2-fix (revocation-per-account is still attached to the prior job worktree); will push HEAD to revocation-per-account without force. Scope: shared fail-closed account notification mechanism, all subscription call sites, unchanged R1/R2/isolation/busy-store regressions, five #240 repetitions, sequential pinned static sizes and final fast gate. No deployment.

Start R2-1 (P2) implementation fix. Base origin/revocation-per-account 63c0d9c3a576e409a026f837c02347648e201bef; merged review e231c16444f266871e07503762d0c5e370e0422e. Local branch revocation-r2-fix (revocation-per-account is still attached to the prior job worktree); will push HEAD to revocation-per-account without force. Scope: shared fail-closed account notification mechanism, all subscription call sites, unchanged R1/R2/isolation/busy-store regressions, five #240 repetitions, sequential pinned static sizes and final fast gate. No deployment.
kayg commented 2026-10-29 20:12:59 +00:00
Author
Owner
Copy link

R2-1 source audit: production account subscribers are websocket.rs (recovery, revocation and operation watchdog), websocket_probe_authority.rs (proof lease), bootstrap_api.rs + bootstrap_setup_api.rs (idle/write/confirmation/first-request), and bootstrap_remote.rs (provisioning cancellation). Bootstrap/setup already preserve typed AuthorityUnavailable; proof lease maps closure to AuthorityMiss::Unavailable; provisioning returns unavailable. The main recovery arm alone uses plain break without preserving unavailable status. Operation-watchdog unit errors can also reach ordinary main-loop breaks, so source-loss classification should be shared at main-loop exit rather than copied into a second select arm.

Mutation audit: sessions.rs logout retains acquired connection through drained DELETE RETURNING and account publication; recovery.rs start/cancel and recovery_rotation.rs rotation use AccountEvents::commit; webauthn.rs recovery registration uses that same retained commit with revocations. Ordinary passkey addition/counter updates do not revoke existing sessions; pending-login cleanup cannot authorize a socket. No writer changes needed. Shared source-loss handling will reuse the existing known-unavailable/1013 teardown outcome, with no new authority query or retry budget. Add strict real-socket recovery/revocation closure checks; retain the review's acceptance assertion.

R2-1 source audit: production account subscribers are websocket.rs (recovery, revocation and operation watchdog), websocket_probe_authority.rs (proof lease), bootstrap_api.rs + bootstrap_setup_api.rs (idle/write/confirmation/first-request), and bootstrap_remote.rs (provisioning cancellation). Bootstrap/setup already preserve typed AuthorityUnavailable; proof lease maps closure to AuthorityMiss::Unavailable; provisioning returns unavailable. The main recovery arm alone uses plain break without preserving unavailable status. Operation-watchdog unit errors can also reach ordinary main-loop breaks, so source-loss classification should be shared at main-loop exit rather than copied into a second select arm. Mutation audit: sessions.rs logout retains acquired connection through drained DELETE RETURNING and account publication; recovery.rs start/cancel and recovery_rotation.rs rotation use AccountEvents::commit; webauthn.rs recovery registration uses that same retained commit with revocations. Ordinary passkey addition/counter updates do not revoke existing sessions; pending-login cleanup cannot authorize a socket. No writer changes needed. Shared source-loss handling will reuse the existing known-unavailable/1013 teardown outcome, with no new authority query or retry budget. Add strict real-socket recovery/revocation closure checks; retain the review's acceptance assertion.
kayg commented 2026-10-29 20:14:54 +00:00
Author
Owner
Copy link

Review tests merged/pushed as e6cb0bc20 (review head e231c1644). No implementation changed in this merge; R2-1 remains deliberately red until the fix. Local strict-test extensions share only the existing setup, preserve the review acceptance assertion, and additionally require 1013/server_busy with zero follow-up authority reads for both recovery and revocation source loss. Fresh regression compilation is in progress through build-slot.

Review tests merged/pushed as e6cb0bc20 (review head e231c1644). No implementation changed in this merge; R2-1 remains deliberately red until the fix. Local strict-test extensions share only the existing setup, preserve the review acceptance assertion, and additionally require 1013/server_busy with zero follow-up authority reads for both recovery and revocation source loss. Fresh regression compilation is in progress through build-slot.
kayg commented 2026-10-29 20:16:42 +00:00
Author
Owner
Copy link

R2-1 freshly reproduced before production changes: reviewer regression 0 passed/1 failed, codes=[], reread=false. Shared fixture retains its acceptance assertion and now also rejects any application frame after source loss. Strict recovery 1013/zero-reread check fails before the fix; strict revocation equivalent passes (sources filter: 3 passed, 2 failed). The implemented candidate moves the existing revocation known-unavailable classification to one common main-loop exit check for both account cursors, including guarded-work exits. It reuses the existing server_busy/1013 teardown, matching bootstrap/setup's known-unavailable outcome; no duplicate close sender/helper, authority query, timer or allocation. Focused remote+mesh tests compiling now.
recovery-source-red.log
sources-red.log

R2-1 freshly reproduced before production changes: reviewer regression 0 passed/1 failed, codes=[], reread=false. Shared fixture retains its acceptance assertion and now also rejects any application frame after source loss. Strict recovery 1013/zero-reread check fails before the fix; strict revocation equivalent passes (sources filter: 3 passed, 2 failed). The implemented candidate moves the existing revocation known-unavailable classification to one common main-loop exit check for both account cursors, including guarded-work exits. It reuses the existing server_busy/1013 teardown, matching bootstrap/setup's known-unavailable outcome; no duplicate close sender/helper, authority query, timer or allocation. Focused remote+mesh tests compiling now. [recovery-source-red.log](https://git.kayg.org/attachments/5340a678-59f8-4759-af39-21b416e1200c) [sources-red.log](https://git.kayg.org/attachments/51e00c6a-64fc-42b4-ad1e-1635cf4a786d)
kayg commented 2026-10-29 20:18:46 +00:00
Author
Owner
Copy link

R2-1 candidate focused validation PASS: 23 passed, 0 failed. Includes retained reviewer regression; strict recovery/revocation 1013 + zero-reread checks; original R1 and bootstrap/setup R2; immediate source restoration; four SQLite commit/departure checks; proof closed-source checks; inherited busy-store 1013 and sixteen-socket short-stall recovery. No baseline exception. Production diff is one shared exit classification (18 changed lines), avoiding a second close sender or watcher helper. Author source/mutation review attached. All-target server clippy running; static sizes, five union repetitions and final fast gate pending.
focused-green.log
self-review.txt

R2-1 candidate focused validation PASS: 23 passed, 0 failed. Includes retained reviewer regression; strict recovery/revocation 1013 + zero-reread checks; original R1 and bootstrap/setup R2; immediate source restoration; four SQLite commit/departure checks; proof closed-source checks; inherited busy-store 1013 and sixteen-socket short-stall recovery. No baseline exception. Production diff is one shared exit classification (18 changed lines), avoiding a second close sender or watcher helper. Author source/mutation review attached. All-target server clippy running; static sizes, five union repetitions and final fast gate pending. [focused-green.log](https://git.kayg.org/attachments/6076f05b-e775-4016-a205-8fd26936d84d) [self-review.txt](https://git.kayg.org/attachments/68581970-cee5-44d7-842c-39bd1fd51b81)
kayg commented 2026-10-29 20:21:17 +00:00
Author
Owner
Copy link

R2-1 implementation committed as 55ed71bb4: one main-loop exit check routes lost recovery/revocation sources through the existing known-unavailable 1013 teardown. No extra authority read, close sender, task, dependency or timer. The review regression remains, plus strict recovery and revocation cases; each reports codes=[1013], reread=false and rejects continued application frames.

Current-source commit gates: fmt and diff checks passed; all-target server clippy with remote + mesh passed; focused review union: 23 passed, 0 failed. Subscriber/writer audit remains as recorded above; no other production paths required changes. Measuring pinned static images sequentially next, then five full #240 union runs and the final committed-head fast gate.

R2-1 implementation committed as 55ed71bb4: one main-loop exit check routes lost recovery/revocation sources through the existing known-unavailable 1013 teardown. No extra authority read, close sender, task, dependency or timer. The review regression remains, plus strict recovery and revocation cases; each reports codes=[1013], reread=false and rejects continued application frames. Current-source commit gates: fmt and diff checks passed; all-target server clippy with remote + mesh passed; focused review union: 23 passed, 0 failed. Subscriber/writer audit remains as recorded above; no other production paths required changes. Measuring pinned static images sequentially next, then five full #240 union runs and the final committed-head fast gate.
kayg commented 2026-10-29 20:40:45 +00:00
Author
Owner
Copy link

R2-1 measured with the pinned static recipe, sequentially in one build slot on 6by32-compute02: x86_64 21,401,776 bytes (+64 versus round 2); aarch64 19,583,480 bytes (0). Total versus task baseline: +12,352 / +21,184 bytes; the existing round-2 ARM justification remains. Both images are stripped/static with no INTERP. No dependencies, features or profile changes.

Exact x86_64 cap and measured explanation committed/pushed as 8208904789. Both exact-cap, one-byte-over, downward-ratchet and unsupported-target tests passed. fmt, shell syntax and diff checks passed. Five consecutive full #240 union runs are now in progress; final fast gate follows on this head.

static-sizes.log
size-boundaries.log
commit-gates.log

R2-1 measured with the pinned static recipe, sequentially in one build slot on 6by32-compute02: x86_64 21,401,776 bytes (+64 versus round 2); aarch64 19,583,480 bytes (0). Total versus task baseline: +12,352 / +21,184 bytes; the existing round-2 ARM justification remains. Both images are stripped/static with no INTERP. No dependencies, features or profile changes. Exact x86_64 cap and measured explanation committed/pushed as 8208904789322efaf173ecd5f398e0ca4f7383c0. Both exact-cap, one-byte-over, downward-ratchet and unsupported-target tests passed. fmt, shell syntax and diff checks passed. Five consecutive full #240 union runs are now in progress; final fast gate follows on this head. [static-sizes.log](https://git.kayg.org/attachments/70d7eb99-6782-4ab1-acf4-142a13c594b4) [size-boundaries.log](https://git.kayg.org/attachments/cd9f4020-2dd0-4f36-8489-afce9a3950c5) [commit-gates.log](https://git.kayg.org/attachments/4d44bca1-6a29-4133-bdeb-dbfe5cb8d4f5)
kayg commented 2026-10-29 20:46:21 +00:00
Author
Owner
Copy link

Five consecutive full #240 union runs passed on 8208904789. Each: 51 passed, 0 failed, 1 perf-only ignored. Every run exercised both 256-socket/61-account cases: 16 affected, 240 unaffected, unrelated_reads=0, recovered=240. Each recovery/revocation source-loss diagnostic was codes=[1013], reread=false. Busy-store 1013, short-stall recovery, R1/R2 and restoration tests passed in all five runs. These are functional counts, not build-host performance claims.

scripts/verify fast is now running on this committed head.

union-final-1.log
union-final-2.log
union-final-3.log
union-final-4.log
union-final-5.log

Five consecutive full #240 union runs passed on 8208904789322efaf173ecd5f398e0ca4f7383c0. Each: 51 passed, 0 failed, 1 perf-only ignored. Every run exercised both 256-socket/61-account cases: 16 affected, 240 unaffected, unrelated_reads=0, recovered=240. Each recovery/revocation source-loss diagnostic was codes=[1013], reread=false. Busy-store 1013, short-stall recovery, R1/R2 and restoration tests passed in all five runs. These are functional counts, not build-host performance claims. `scripts/verify fast` is now running on this committed head. [union-final-1.log](https://git.kayg.org/attachments/3d7fb661-eac0-47ba-84b0-28ecdcc09ac1) [union-final-2.log](https://git.kayg.org/attachments/bc31a83a-8a85-44e6-ad75-2b16d8c52628) [union-final-3.log](https://git.kayg.org/attachments/39bb1c0d-29d9-419e-a51c-7f3e32e7a071) [union-final-4.log](https://git.kayg.org/attachments/9ba336d8-fbcf-43b8-81f5-c6fbc2785793) [union-final-5.log](https://git.kayg.org/attachments/df57ef53-9c7f-47b7-96c4-56c7258e02ad)
kayg commented 2026-10-29 21:11:37 +00:00
Author
Owner
Copy link

Finished R2-1 on head 8208904789, pushed to revocation-per-account. Shared known-unavailable teardown closes lost recovery/revocation sources with 1013 and no reread. Reviewer regression retained; strict recovery/revocation regressions added. Subscriber/writer audit found no further changes needed.

Five consecutive #240 unions each passed 51/0 (one perf-only ignored). All ten 256-socket cases: 240 unrelated sockets, unrelated_reads=0, recovered=240. Busy-store 1013 and R1/R2 guarantees passed.

Pinned sizes: x86_64 21,401,776 bytes (+64 versus round 2); aarch64 19,583,480 bytes (+0). Exact cap ratcheted; boundary tests pass. Total baseline delta +12,352 / +21,184; existing round-2 ARM justification remains.

scripts/verify fast on this committed head exited 0; verbatim summary and test result excerpts:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

test result: ok. 672 passed; 0 failed; 53 ignored; 0 measured; 0 filtered out; finished in 316.38s

 356 pass
 0 fail
 21671 expect() calls
Ran 356 tests across 60 files. [27.66s]

 105 pass
 0 fail
 413 expect() calls
Ran 105 tests across 13 files. [185.00ms]

 17 pass
 0 fail
 1794 expect() calls
Ran 17 tests across 4 files. [240.00ms]

 39 pass
 0 fail
 36135 expect() calls
Ran 39 tests across 10 files. [2.31s]

Gate limitation, verbatim:

key memory: aarch64-unknown-linux-musl runtime not checked (host x86_64; native execution required)

No baseline exception used. Worktree clean, origin matches head. Verified no executable was running from this job target, then deleted CARGO_TARGET_DIR; evidence retained outside the repository. Issue remains open for review.

verify-fast.log
self-review.txt

run-union.txt

Finished R2-1 on head 8208904789322efaf173ecd5f398e0ca4f7383c0, pushed to revocation-per-account. Shared known-unavailable teardown closes lost recovery/revocation sources with 1013 and no reread. Reviewer regression retained; strict recovery/revocation regressions added. Subscriber/writer audit found no further changes needed. Five consecutive #240 unions each passed 51/0 (one perf-only ignored). All ten 256-socket cases: 240 unrelated sockets, unrelated_reads=0, recovered=240. Busy-store 1013 and R1/R2 guarantees passed. Pinned sizes: x86_64 21,401,776 bytes (+64 versus round 2); aarch64 19,583,480 bytes (+0). Exact cap ratcheted; boundary tests pass. Total baseline delta +12,352 / +21,184; existing round-2 ARM justification remains. `scripts/verify fast` on this committed head exited 0; verbatim summary and test result excerpts: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ test result: ok. 672 passed; 0 failed; 53 ignored; 0 measured; 0 filtered out; finished in 316.38s 356 pass 0 fail 21671 expect() calls Ran 356 tests across 60 files. [27.66s] 105 pass 0 fail 413 expect() calls Ran 105 tests across 13 files. [185.00ms] 17 pass 0 fail 1794 expect() calls Ran 17 tests across 4 files. [240.00ms] 39 pass 0 fail 36135 expect() calls Ran 39 tests across 10 files. [2.31s] ``` Gate limitation, verbatim: ```text key memory: aarch64-unknown-linux-musl runtime not checked (host x86_64; native execution required) ``` No baseline exception used. Worktree clean, origin matches head. Verified no executable was running from this job target, then deleted CARGO_TARGET_DIR; evidence retained outside the repository. Issue remains open for review. [verify-fast.log](https://git.kayg.org/attachments/39db394a-37e5-4112-821d-cbda4d7a76a1) [self-review.txt](https://git.kayg.org/attachments/c929aa29-2376-4592-bba2-31b010f1ab90) [run-union.txt](https://git.kayg.org/attachments/689c0c5f-f963-4735-903a-8651c40e346c)
kayg commented 2026-10-29 21:12:34 +00:00
Author
Owner
Copy link

Final independent round 3 review started. Branch review-revocation-r3; base 8208904789. Checking prior tests without weakening, all notification subscribers, retained commit ordering, account isolation, release 9.4 / #255 scope and exact static sizes. Implementation unchanged; final permitted review round.

Final independent round 3 review started. Branch review-revocation-r3; base 8208904789322efaf173ecd5f398e0ca4f7383c0. Checking prior tests without weakening, all notification subscribers, retained commit ordering, account isolation, release 9.4 / #255 scope and exact static sizes. Implementation unchanged; final permitted review round.
kayg commented 2026-10-29 21:20:33 +00:00
Author
Owner
Copy link

Source audit completed; review checkpoint 57165ba12c pushed only to review-revocation-r3. No implementation/test changes (empty audit commit; D262 receipts remain outside checkout). No new confirmed finding.

Diff e231c1644..820890478 leaves prior test files unchanged except review_account_scope.rs: common source-loss fixture extraction retains the original acceptance assertion and adds rejection of application frames plus strict 1013/zero-reread cases. Persistent main cursors catch source loss across guarded-work exits and immediate registry replacement. Bootstrap/setup share typed unavailable close; proof leases and provisioning return unavailable. Final-commit notification ownership and quiet refusal/rollback code unchanged.

All files changed by #255 repair 1495c9480, including Cargo.lock and AsyncFd readiness.rs, are byte-identical to current origin/dev 07c5da77b. Release 9.4 known-unavailable close classification, fractional deadlines and read limits remain. Dev merge-base 4a6202a52 recorded sizes 21,386,512 / 19,563,608 imply +15,264 / +19,872 at requested head sizes; task-baseline deltas +12,352 / +21,184. Existing ARM growth rationale and shared-helper trim are recorded above and in PROCESS.md. Fresh full fast gate is compiling through build-slot; runtime measurements are not claimed from the build VM.

Source audit completed; review checkpoint 57165ba12cbf5450dcd28a7f072f109443416b01 pushed only to review-revocation-r3. No implementation/test changes (empty audit commit; D262 receipts remain outside checkout). No new confirmed finding. Diff e231c1644..820890478 leaves prior test files unchanged except review_account_scope.rs: common source-loss fixture extraction retains the original acceptance assertion and adds rejection of application frames plus strict 1013/zero-reread cases. Persistent main cursors catch source loss across guarded-work exits and immediate registry replacement. Bootstrap/setup share typed unavailable close; proof leases and provisioning return unavailable. Final-commit notification ownership and quiet refusal/rollback code unchanged. All files changed by #255 repair 1495c9480, including Cargo.lock and AsyncFd readiness.rs, are byte-identical to current origin/dev 07c5da77b. Release 9.4 known-unavailable close classification, fractional deadlines and read limits remain. Dev merge-base 4a6202a52 recorded sizes 21,386,512 / 19,563,608 imply +15,264 / +19,872 at requested head sizes; task-baseline deltas +12,352 / +21,184. Existing ARM growth rationale and shared-helper trim are recorded above and in PROCESS.md. Fresh full fast gate is compiling through build-slot; runtime measurements are not claimed from the build VM.
kayg commented 2026-10-29 21:40:14 +00:00
Author
Owner
Copy link

Final-round full server suite passed on review head 57165ba12 (source identical to 820890478). Verbatim:

test result: ok. 672 passed; 0 failed; 53 ignored; 0 measured; 0 filtered out; finished in 333.74s

Includes original R1/R2 and R2-1, strict recovery/revocation 1013 without another authority read, bootstrap/setup/proof immediate source restoration, panic/timeout/abort/drop final-commit ordering and quiet refusal/rollback, both 256-socket capacity cases and inherited busy-store 1013. No new confirmed finding or load exception. Remaining workspace/static/TypeScript gate stages, focused diagnostics and same-recipe dev merge-base x86 size rebuild are pending. No implementation change.

Final-round full server suite passed on review head 57165ba12 (source identical to 820890478). Verbatim: ```text test result: ok. 672 passed; 0 failed; 53 ignored; 0 measured; 0 filtered out; finished in 333.74s ``` Includes original R1/R2 and R2-1, strict recovery/revocation 1013 without another authority read, bootstrap/setup/proof immediate source restoration, panic/timeout/abort/drop final-commit ordering and quiet refusal/rollback, both 256-socket capacity cases and inherited busy-store 1013. No new confirmed finding or load exception. Remaining workspace/static/TypeScript gate stages, focused diagnostics and same-recipe dev merge-base x86 size rebuild are pending. No implementation change.
kayg commented 2026-10-29 22:13:08 +00:00
Author
Owner
Copy link

Independent final-round verdict: merge. Counts: 0 P0 / 0 P1 / 0 P2 / 0 P3.

Target 8208904789; review branch review-revocation-r3, head 57165ba12c. The source tree is identical to the target. One empty audit commit records the review without adding repository receipts (D262); only this review branch was pushed. No implementation fix or deployment.

Prior R2-1 is resolved. The original acceptance assertion and I/O fences remain; extracting the shared fixture adds rejection of application frames and strict recovery/revocation 1013 + zero-reread checks. The other round-1/round-2 review files are unchanged from e231c1644. Main recovery/revocation and guarded-work exits reach the common known-unavailable teardown; bootstrap/setup share typed unavailable close, proof leases return unavailable, and provisioning cancellation returns unavailable. Old cursors remain closed across immediate registry replacement.

Committed-write checks pass for caller cancellation, panic, timeout, abort and future drop. Successful final commit precedes publication; refused commits and rollback stay quiet. Logout retains its acquired connection through drained DELETE RETURNING and notification; recovery start/cancel/rotation and WebAuthn recovery completion use the shared retained final commit. Ordinary passkey/counter updates and pending-login cleanup do not revoke authorized sockets.

Fresh focused diagnostics, verbatim:

account_isolation recovery=false sockets=256 accounts=61 affected=16 unaffected=240 affected_reads=32 unrelated_reads=0 recovered=240
account_isolation recovery=true sockets=256 accounts=61 affected=16 unaffected=240 affected_reads=34 unrelated_reads=0 recovered=240
account_source_loss recovery=true codes=[1013] reread=false
account_source_loss recovery=false codes=[1013] reread=false
account_source_loss recovery=true codes=[1013] reread=false
test result: ok. 51 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 56.16s

The sole ignore is perf-only. Inherited busy-store 1013, sixteen-socket short-stall recovery, authority read caps and fractional expiry checks pass. No load exception was needed.

Every file changed by #255 repair 1495c9480, including Cargo.lock and all AsyncFd ownership sources, is byte-identical to dev 07c5da77b. Release 9.4 known-unavailable teardown and retry/read budgets are retained.

Both pinned stripped static images reproduced exactly: 21,401,776 / 19,583,480 bytes, no PT_INTERP, exact-cap checks pass. Fresh same-recipe dev merge-base 4a6202a52 x86_64 is 21,386,512, giving +15,264 bytes. Its recorded ARM baseline is 19,563,608, giving +19,872; that ARM baseline was not rebuilt this round. Current dev 07c5da77b recorded caps are 21,400,400 / 19,575,064 (arithmetic differences +1,376 / +8,416; later unrelated changes make merge-base the D243 comparison). Task-baseline deltas remain +12,352 / +21,184. The #240 / PROCESS.md ARM justification retains cancellation ownership and typed unavailable teardown, and records the shared-owner trim of 1,760 / 1,824 bytes. R2-1 itself adds only +64 / 0 bytes, with no dependencies/features/profile changes. No runtime-performance claim from this build VM.

Full server result, verbatim:

test result: ok. 672 passed; 0 failed; 53 ignored; 0 measured; 0 filtered out; finished in 333.74s

Final scripts/verify fast on the review head, verbatim summary and observed exit:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

scripts/verify fast exit=0

TypeScript stages also pass; full transcript attached. Gate limitation, verbatim:

key memory: aarch64-unknown-linux-musl runtime not checked (host x86_64; native execution required)

Cleanup verified: no active executable under the job target; target directory deleted; temporary baseline worktree removed. Review worktree clean, local and origin heads match. Issue remains open.

findings.txt
reviewer-checklist.txt
verify-fast.log
gate-summary.txt
union-final-1.log
head-sizes.json
baseline-size.json
baseline-static.log
descriptor-proof.json
prior-tests-diff.txt
cleanup.json

Independent final-round verdict: **merge**. Counts: **0 P0 / 0 P1 / 0 P2 / 0 P3**. Target 8208904789322efaf173ecd5f398e0ca4f7383c0; review branch review-revocation-r3, head 57165ba12cbf5450dcd28a7f072f109443416b01. The source tree is identical to the target. One empty audit commit records the review without adding repository receipts (D262); only this review branch was pushed. No implementation fix or deployment. Prior R2-1 is resolved. The original acceptance assertion and I/O fences remain; extracting the shared fixture adds rejection of application frames and strict recovery/revocation 1013 + zero-reread checks. The other round-1/round-2 review files are unchanged from e231c1644. Main recovery/revocation and guarded-work exits reach the common known-unavailable teardown; bootstrap/setup share typed unavailable close, proof leases return unavailable, and provisioning cancellation returns unavailable. Old cursors remain closed across immediate registry replacement. Committed-write checks pass for caller cancellation, panic, timeout, abort and future drop. Successful final commit precedes publication; refused commits and rollback stay quiet. Logout retains its acquired connection through drained DELETE RETURNING and notification; recovery start/cancel/rotation and WebAuthn recovery completion use the shared retained final commit. Ordinary passkey/counter updates and pending-login cleanup do not revoke authorized sockets. Fresh focused diagnostics, verbatim: ```text account_isolation recovery=false sockets=256 accounts=61 affected=16 unaffected=240 affected_reads=32 unrelated_reads=0 recovered=240 account_isolation recovery=true sockets=256 accounts=61 affected=16 unaffected=240 affected_reads=34 unrelated_reads=0 recovered=240 account_source_loss recovery=true codes=[1013] reread=false account_source_loss recovery=false codes=[1013] reread=false account_source_loss recovery=true codes=[1013] reread=false test result: ok. 51 passed; 0 failed; 1 ignored; 0 measured; 673 filtered out; finished in 56.16s ``` The sole ignore is perf-only. Inherited busy-store 1013, sixteen-socket short-stall recovery, authority read caps and fractional expiry checks pass. No load exception was needed. Every file changed by #255 repair 1495c9480, including Cargo.lock and all AsyncFd ownership sources, is byte-identical to dev 07c5da77b. Release 9.4 known-unavailable teardown and retry/read budgets are retained. Both pinned stripped static images reproduced exactly: **21,401,776 / 19,583,480 bytes**, no PT_INTERP, exact-cap checks pass. Fresh same-recipe dev merge-base 4a6202a52 x86_64 is **21,386,512**, giving **+15,264 bytes**. Its recorded ARM baseline is 19,563,608, giving +19,872; that ARM baseline was not rebuilt this round. Current dev 07c5da77b recorded caps are 21,400,400 / 19,575,064 (arithmetic differences +1,376 / +8,416; later unrelated changes make merge-base the D243 comparison). Task-baseline deltas remain +12,352 / +21,184. The #240 / PROCESS.md ARM justification retains cancellation ownership and typed unavailable teardown, and records the shared-owner trim of 1,760 / 1,824 bytes. R2-1 itself adds only +64 / 0 bytes, with no dependencies/features/profile changes. No runtime-performance claim from this build VM. Full server result, verbatim: ```text test result: ok. 672 passed; 0 failed; 53 ignored; 0 measured; 0 filtered out; finished in 333.74s ``` Final `scripts/verify fast` on the review head, verbatim summary and observed exit: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ scripts/verify fast exit=0 ``` TypeScript stages also pass; full transcript attached. Gate limitation, verbatim: ```text key memory: aarch64-unknown-linux-musl runtime not checked (host x86_64; native execution required) ``` Cleanup verified: no active executable under the job target; target directory deleted; temporary baseline worktree removed. Review worktree clean, local and origin heads match. Issue remains open. [findings.txt](https://git.kayg.org/attachments/b5c7afdc-cb1e-48ae-940d-2db76b603ef4) [reviewer-checklist.txt](https://git.kayg.org/attachments/a3259e28-89cd-4191-894e-a5842cf03657) [verify-fast.log](https://git.kayg.org/attachments/27385fa8-7f20-4798-b550-e9a1b36b05da) [gate-summary.txt](https://git.kayg.org/attachments/879a8564-e968-46fa-a1a3-a0d72d250e0d) [union-final-1.log](https://git.kayg.org/attachments/96c5b7cb-503a-400e-bad6-278ec6fafc4e) [head-sizes.json](https://git.kayg.org/attachments/a31d7f92-8afc-47cf-a1df-2680626b8abd) [baseline-size.json](https://git.kayg.org/attachments/6c489b51-089f-429c-baa3-51f7b253752f) [baseline-static.log](https://git.kayg.org/attachments/5f380572-9057-446b-a5ac-0fbb2a5d20f6) [descriptor-proof.json](https://git.kayg.org/attachments/7ec76757-4ce2-4dc6-85a6-29389a729ae0) [prior-tests-diff.txt](https://git.kayg.org/attachments/1c0fb066-ccbc-48b2-bf78-5986e81faf44) [cleanup.json](https://git.kayg.org/attachments/678a0604-8fdf-49b2-84b6-2434552e9822)
kayg commented 2026-10-29 22:15:10 +00:00
Author
Owner
Copy link

Start release 9.5 integration. Branch integrate-9-5, base origin/dev 07c5da77b. Merge reviewed #240 head 820890478 (final round-3 review 57165ba12). Preserve both sides, sequential pinned static rebuilds and exact D243 caps, five #240 union repetitions, #252 setup-token tests, then final committed-head scripts/verify fast. Will push only integrate-9-5, never dev; no deployment.

Start release 9.5 integration. Branch integrate-9-5, base origin/dev 07c5da77b. Merge reviewed #240 head 820890478 (final round-3 review 57165ba12). Preserve both sides, sequential pinned static rebuilds and exact D243 caps, five #240 union repetitions, #252 setup-token tests, then final committed-head scripts/verify fast. Will push only integrate-9-5, never dev; no deployment.
kayg commented 2026-10-29 22:16:12 +00:00
Author
Owner
Copy link

Merge findings: exactly three conflicted files. auth/tests.rs appended independent tests on both sides; retained public_status_result_fields_are_listed_in_the_auth_contract, account_logout_does_not_notify_another_account, and logout_commit module. docs/PROCESS.md retains #252 and #240 histories; current table will use merged measurements. scripts/verify.d/rust.sh changes only the exact size caps after measurement. No conflict in production code. Cargo.lock and the #255 shim ownership sources are identical to reviewed #240; static builds are running sequentially through build-slot on 6by32-compute02.

Merge findings: exactly three conflicted files. auth/tests.rs appended independent tests on both sides; retained public_status_result_fields_are_listed_in_the_auth_contract, account_logout_does_not_notify_another_account, and logout_commit module. docs/PROCESS.md retains #252 and #240 histories; current table will use merged measurements. scripts/verify.d/rust.sh changes only the exact size caps after measurement. No conflict in production code. Cargo.lock and the #255 shim ownership sources are identical to reviewed #240; static builds are running sequentially through build-slot on 6by32-compute02.
kayg commented 2026-10-29 22:24:46 +00:00
Author
Owner
Copy link

Merged x86_64 pinned stripped static image: 21,420,592 bytes; no PT_INTERP. Delta +20,192 versus dev 07c5da77b (21,400,400), +18,816 versus reviewed #240 alone (21,401,776). Sequential ARM build is running through the same build slot on 6by32-compute02.

D243 growth justification: this integration retains both reviewed behaviors: #240 account-isolated revocation, retained commit/publication under caller cancellation and typed unavailable teardown, together with #252 installed-service setup command and data resolution. Neither branch's caps predict the combined link. There is no manual production-code resolution, dependency/feature/profile change, duplicated helper or added runtime work in this merge. Per the integration brief, the cap will equal the actual merged bytes with no allowance. Both original size histories are retained; final merged table and ARM measurement follow.

Merged x86_64 pinned stripped static image: 21,420,592 bytes; no PT_INTERP. Delta +20,192 versus dev 07c5da77b (21,400,400), +18,816 versus reviewed #240 alone (21,401,776). Sequential ARM build is running through the same build slot on 6by32-compute02. D243 growth justification: this integration retains both reviewed behaviors: #240 account-isolated revocation, retained commit/publication under caller cancellation and typed unavailable teardown, together with #252 installed-service setup command and data resolution. Neither branch's caps predict the combined link. There is no manual production-code resolution, dependency/feature/profile change, duplicated helper or added runtime work in this merge. Per the integration brief, the cap will equal the actual merged bytes with no allowance. Both original size histories are retained; final merged table and ARM measurement follow.
kayg commented 2026-10-29 22:34:57 +00:00
Author
Owner
Copy link

Both sequential pinned stripped static builds passed on 6by32-compute02, with no PT_INTERP:

Source x86_64 bytes aarch64 bytes
Dev 07c5da77b 21,400,400 19,575,064
#240 alone 820890478 21,401,776 19,583,480
Merged 21,420,592 19,592,504
Delta versus dev +20,192 +17,440

Both caps now equal the measured merge bytes, with no allowance. docs/PROCESS.md retains both parent histories and adds this comparison. D243 growth retains reviewed account isolation, cancellation-safe commit/publication, unavailable-authority teardown and installed-service setup resolution; no manual production-code resolution, dependency, feature or profile changes. Parent deltas are non-additive at link time.

Fresh fmt, shell syntax and diff checks passed. Size boundary tests passed exact caps, one byte over rejection, downward ratchet and unsupported target. Five #240 unions are compiling/running through one build slot; #252 tests follow.
static-build.log

Both sequential pinned stripped static builds passed on 6by32-compute02, with no PT_INTERP: | Source | x86_64 bytes | aarch64 bytes | | --- | ---: | ---: | | Dev 07c5da77b | 21,400,400 | 19,575,064 | | #240 alone 820890478 | 21,401,776 | 19,583,480 | | Merged | 21,420,592 | 19,592,504 | | Delta versus dev | +20,192 | +17,440 | Both caps now equal the measured merge bytes, with no allowance. docs/PROCESS.md retains both parent histories and adds this comparison. D243 growth retains reviewed account isolation, cancellation-safe commit/publication, unavailable-authority teardown and installed-service setup resolution; no manual production-code resolution, dependency, feature or profile changes. Parent deltas are non-additive at link time. Fresh fmt, shell syntax and diff checks passed. Size boundary tests passed exact caps, one byte over rejection, downward ratchet and unsupported target. Five #240 unions are compiling/running through one build slot; #252 tests follow. [static-build.log](https://git.kayg.org/attachments/f86b5af1-0835-4eb4-bb54-1c4941b90e00)
kayg commented 2026-10-29 22:45:03 +00:00
Author
Owner
Copy link

Five consecutive #240 union runs passed on the merged source. Each: 51 passed, 0 failed, 1 perf-only ignored. All ten 256-socket/61-account cases report 16 affected, 240 unaffected, unrelated_reads=0 and recovered=240. Recovery/revocation source-loss checks report codes=[1013], reread=false. No baseline exception used. #252 CLI, status and production-browser functional checks are now compiling/running; committed-head fast gate follows.

Five consecutive #240 union runs passed on the merged source. Each: 51 passed, 0 failed, 1 perf-only ignored. All ten 256-socket/61-account cases report 16 affected, 240 unaffected, unrelated_reads=0 and recovered=240. Recovery/revocation source-loss checks report codes=[1013], reread=false. No baseline exception used. #252 CLI, status and production-browser functional checks are now compiling/running; committed-head fast gate follows.
kayg commented 2026-10-29 22:47:41 +00:00
Author
Owner
Copy link

Integration merge committed/pushed only to integrate-9-5: 8f88bf086f (parents dev 07c5da77b and #240 820890478). Every conflict resolution is documented in the commit message. Dev was not pushed; no deployment.

Targeted merged-tree checks passed: five consecutive #240 unions, each 51/0 (one perf-only ignored); six setup_output CLI tests; four token/data-resolution unit tests; 22 server setup/public-status tests; service-discovery suite; both unchanged system-service production-browser tests at unique port 51295 with zero synthetic RTT for functional validation. Display/copy at 393px and bounds at 375px pass. Final scripts/verify fast is running on this committed head; this is not yet the final qualification report.

Integration merge committed/pushed only to integrate-9-5: 8f88bf086f5c3d3c3a57d4bc8529befbcb0ca176 (parents dev 07c5da77b and #240 820890478). Every conflict resolution is documented in the commit message. Dev was not pushed; no deployment. Targeted merged-tree checks passed: five consecutive #240 unions, each 51/0 (one perf-only ignored); six setup_output CLI tests; four token/data-resolution unit tests; 22 server setup/public-status tests; service-discovery suite; both unchanged system-service production-browser tests at unique port 51295 with zero synthetic RTT for functional validation. Display/copy at 393px and bounds at 375px pass. Final scripts/verify fast is running on this committed head; this is not yet the final qualification report.
kayg commented 2026-10-29 23:15:33 +00:00
Author
Owner
Copy link

Finished release 9.5 integration on integrate-9-5, head 8f88bf086f5c3d3c3a57d4bc8529befbcb0ca176. Pushed only this branch; local and origin heads match, worktree clean. Dev was not pushed; no deployment. The merge message records every conflict resolution: retain both auth test additions and logout_commit module; retain both PROCESS histories with a new comparison; use freshly measured exact merged caps.

Pinned stripped static sizes, built sequentially on 6by32-compute02 and reproduced by the final gate: 21,420,592 / 19,592,504 bytes (x86_64 / aarch64), no PT_INTERP. Delta versus dev 07c5da77b: +20,192 / +17,440 bytes. Both exact caps have no allowance; reviewed behavior and combined-link growth justification are recorded above and in PROCESS.md.

Five consecutive #240 unions each passed 51/0, one perf-only ignored. All ten 256-socket cases: unrelated_reads=0, recovered=240. Source-loss cases: codes=[1013], reread=false. #252 checks passed: setup_output 6/0, token/data resolution 4/0, server setup/public status 22/0, service discovery 14/0, production-browser display/copy and phone bounds 2/0. No baseline exception used.

Final scripts/verify fast on this committed head, verbatim summary and observed exit:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

scripts/verify fast exit=0

Full server result, verbatim:

test result: ok. 673 passed; 0 failed; 53 ignored; 0 measured; 0 filtered out; finished in 325.22s

Final protocol output, verbatim:

 39 pass
 0 fail
 36135 expect() calls
Ran 39 tests across 10 files. [2.68s]

scripts/verify fast exit=0

Gate limitation, verbatim:

key memory: aarch64-unknown-linux-musl runtime not checked (host x86_64; native execution required)

Verified no executable was running from the job target, then deleted CARGO_TARGET_DIR. Evidence is outside the repository. Issues remain open.

verify-fast.log

static-build.log

union-1.log
union-2.log
union-3.log
union-4.log
union-5.log
focused-tests.log
self-review.txt
system-service-setup-token-command.png
cleanup.json

Finished release 9.5 integration on `integrate-9-5`, head `8f88bf086f5c3d3c3a57d4bc8529befbcb0ca176`. Pushed only this branch; local and origin heads match, worktree clean. Dev was not pushed; no deployment. The merge message records every conflict resolution: retain both auth test additions and logout_commit module; retain both PROCESS histories with a new comparison; use freshly measured exact merged caps. Pinned stripped static sizes, built sequentially on 6by32-compute02 and reproduced by the final gate: **21,420,592 / 19,592,504 bytes** (x86_64 / aarch64), no PT_INTERP. Delta versus dev 07c5da77b: +20,192 / +17,440 bytes. Both exact caps have no allowance; reviewed behavior and combined-link growth justification are recorded above and in PROCESS.md. Five consecutive #240 unions each passed **51/0**, one perf-only ignored. All ten 256-socket cases: unrelated_reads=0, recovered=240. Source-loss cases: codes=[1013], reread=false. #252 checks passed: setup_output 6/0, token/data resolution 4/0, server setup/public status 22/0, service discovery 14/0, production-browser display/copy and phone bounds 2/0. No baseline exception used. Final `scripts/verify fast` on this committed head, verbatim summary and observed exit: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ scripts/verify fast exit=0 ``` Full server result, verbatim: ```text test result: ok. 673 passed; 0 failed; 53 ignored; 0 measured; 0 filtered out; finished in 325.22s ``` Final protocol output, verbatim: ```text 39 pass 0 fail 36135 expect() calls Ran 39 tests across 10 files. [2.68s] scripts/verify fast exit=0 ``` Gate limitation, verbatim: ```text key memory: aarch64-unknown-linux-musl runtime not checked (host x86_64; native execution required) ``` Verified no executable was running from the job target, then deleted CARGO_TARGET_DIR. Evidence is outside the repository. Issues remain open. [verify-fast.log](https://git.kayg.org/attachments/f0e49419-7fd9-44b3-ab1a-22aa9401505c) [static-build.log](https://git.kayg.org/attachments/f86b5af1-0835-4eb4-bb54-1c4941b90e00) [union-1.log](https://git.kayg.org/attachments/e901eccd-fe67-44dd-8235-d6363fceb58a) [union-2.log](https://git.kayg.org/attachments/c19f14c9-24d3-4abe-afe7-18cfffdf31da) [union-3.log](https://git.kayg.org/attachments/515c748b-3346-4471-b91c-64e7576650b9) [union-4.log](https://git.kayg.org/attachments/d19cfeed-8550-4ee7-a4ef-e070c0c70ad7) [union-5.log](https://git.kayg.org/attachments/42eb1b5a-5b8b-4eab-a24d-5ecda341cb98) [focused-tests.log](https://git.kayg.org/attachments/2f9ced60-8648-46bd-a4a5-a88782e4d856) [self-review.txt](https://git.kayg.org/attachments/c304e601-f1e5-41f8-8515-96e9b2b0aa89) ![system-service-setup-token-command.png](https://git.kayg.org/attachments/1fd5a6ef-5b96-425a-ade5-d8cda052627f) [cleanup.json](https://git.kayg.org/attachments/4e6ae887-ee67-4d20-bdfa-76a30e7565c6)
kayg commented 2026-10-29 23:16:03 +00:00
Author
Owner
Copy link

Merged into dev via the 9.5 integration 8f88bf086 (final review: merge, 0 findings; gate PASS).

Merged into dev via the 9.5 integration `8f88bf086` (final review: merge, 0 findings; gate PASS).
kayg commented 2026-11-08 19:04:28 +00:00
Author
Owner
Copy link

Closed by the orchestrator during the 2026-11-09 night housekeeping (owner order: "close stale prs/issues"). The work has landed on dev, and the latest note here is a finish or merge note (J387 inventory on #436). Reopen if anything is still missing.

Closed by the orchestrator during the 2026-11-09 night housekeeping (owner order: "close stale prs/issues"). The work has landed on dev, and the latest note here is a finish or merge note (J387 inventory on #436). Reopen if anything is still missing.
kayg closed this issue 2026-11-08 19:04:28 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
j470b-server-mesh-rejoin
mesh-compat-382
j444b-d381-key-wins-flood
j461b-macos-utun-reader-thread
j475b-remove-host-motion
fix-reconnect-new-link
j481-d380
dev
j479-mesh-soak
fix/j476-host-facts
j475-motion-pill-split
j470-mac-node-join
root-upgrade-d376
j474-review-merge
latency-targets-120hz
nightly-suite-shards
gotatun-pin-j469
macos-utun-reader-thread
fix-flood-echo-stall
wip/j416
motion-fast-ease-out
mesh-addhost-j259
takeover-close-terminals-d368
kbd-instant-followups
fix-trust-key-double-click
nightly-suite-partial-report
appwin-icons-j207
rusqlite-slice1
swipe-content-first-d374
mesh-mtu-381
addhost-instant-open
glass-contrast-d365-mock
glass-contrast-d365
signout-followups-442
fix-startup-toast-red
research-gotatun-matrix-j317
themes-sync-j304
fix-load-flakes
fix-nix-zig-patch
fix-compute01-browser-baseline
ratchet-size-baseline-419
predict-auto-d130
revoke-coverage-d367
nightly-suite-queue-timeout
nightly-browser-suite
fix-rustsec-2026-0459
fonts-ioskeley-obel
log-retention-d375
fix-kbd-no-anim-427
fix-dev-red-specs-2
takeover-proof-305-j205
wip/j410-server-pump
ui-consistency-d372
fix-osc52-clipboard
libghostty-vt-1.0
forget-retired-host-d369
j404-merge-426
fix-setup-lock-race
fix-touch-select-426
revoke-access-report-ui
fix-predictive-echo-specs
fix-selinux-agent-exec
wip/j395-checkpoint2
wip/j395
j391-review-scratch
ui-consistency-j195-deferred-rebased
fix-rustc-paths-421
decisions-wording-341
fix-install-suite-red
fix-dev-rtt-specs
fix-pending-removal-align
fix-privileged-skip
fix-install-suite-404
review-j368
mesh-dns-j254
revoke-access-report-d356b
revoke-privilege-round5
fix-removal-confirm
review-j360
gotatun-rotation-367
deps-refresh-340
review-j354
review-J351
review-j350
addhost-takeover-d359
revoke-report-items-347
revoke-end-sessions-d362
review-j348
size-mesh-ssh-346
size-trim-337
revoke-access-diff-d356
j259-pre-rebase-b06c5a6
j305-ended-at-start-spec
addhost-sudo-consent
fix-layout-real-specs-411
fix-shell-open-411
fix-console-hosts-373
fix-shell-exit
fuzz-host-name-353
fix-host-details-410
macos-filter-j197
research-gotatun-tricks
revoke-p3-j216l
stale-state-pill
revoke-followups-j216k
revoke-progress-j216e
backup/macos01-20261106/lume/j197
backup/macos01-20261106/lume/appwin-icons-j207-stash0
backup/macos01-20261106/claude/stash-0
backup/macos01-20261106/claude/stash-1
backup/macos01-20261106/claude/J80-macos-s1
backup/macos01-20261106/claude/J80
backup/macos01-20261106/claude/J80-slice1-20261102
backup/macos01-20261106/claude/J16b-appwin-on-dev
backup/macos01-20261106/claude/appwin-launch-idle-146
backup/macos01-20261106/claude/J80-s1-run
wip/j259
trust-285-p3c
runtime-lock-j216f
mesh-ssh-p3-j175
tun-proof-p3b
trust-285-p3
terminal-polish-j271
tun-proof-p3
ssh-install-flakes-j216i
fuzz-fixes-j264
trust-285-a
trust-285-b
restart-oversized-fixture-j198
backup/macos01-20261106/lume/appwin-icons-j207
restart-bound-j216h
up-preflight-p3-j198
backup/macos01-20261106/lume/j251
up-preflight-j198
wip/up-preflight-j198-j245-p2
wip/up-preflight-j198-j245-p1
agent-fsync-offloop-j196
wip/up-preflight-j198-j245
settings-offscreen-j231
wip/up-preflight-j198-j226-inspection
wip/j103f
themes-j206
wip/up-preflight-j198-j226
flakes-j216c
backup/macos01-20261106/claude/j197
flakes-j216b
backup/macos01-20261106/claude/j197-red
wip/up-preflight-j198-review
flakes-j216
backup/macos01-20261106/claude/appwin-icons-j207
engineering-j208b
appwin-mock-j209
toast-stack-j165
engineering-j208
decisions-d351
decisions-d350
decisions-d349
appearance-presets-mock-j129
decisions-d348
docs-audit-spec
doc-coverage-baseline-raise
decisions-d347
decisions-d346b
decisions-d346
j88h-profile
ui-consistency-j195-deferred
ui-consistency-j195
engineering-practices-j194
preferred-login-ui-j166
signin-pools-263-j174
macos-node-265-s1
decisions-d345
decisions-d344
proxy-cgroup-j164
verify-quick-fuzz-329
proxy-start-io-j168
timing-flakes-j163
up-263-s1
mcp-events-j147
verify-quick-fuzz-j158
proxy-p3-j159
agent-resource-j157-detect
wip/j103d-final
remote-cancel-hang-j155
proxy-traefik-281-j62d
j149-verify-quick
proxy-traefik-281-j62b
j150-drop-unnamed
wip/j79d-red-r4
wip/j103d-d332
rootless-toast-j142
wip/j103d-head
wip/j103d
j125c-mcp
macos-build-j136
backup/macos01-20261106/claude/j136
wip/j79d-red-cli
wip/j79d-red-server
j121-link-liveness
j118c-tracer-failures
wip/j79c-head
release-desktop-j131
j124c-signed-macos
wip/j79c-red-p3
wip/j79c-red-p23
wip/j79c-red-p22
merge-j128-check
perf-deferred-j128
sidebar-toggle-260
j127-shortcut-changed-dot
j125-mcp
j118-tracer-failures
j126-account-summary
settings-sections-mock-j92
j120-pinch-lock
sidebar-292
backup/macos01-20261106/claude/j120
taste-2026-11-03
row-actions-242-215
backup/macos01-20261106/claude/stash-0-untracked
backup/macos01-20261106/claude/J80-265-s1-run
backup/macos01-20261106/claude/J80-macos-s1-20261102
j112-canvas-commands
ui-no-overshoot-scroll
fix-recovery-restart
backup/macos01-20261106/claude/stash-1-untracked
taste-2026-11-02
size-baseline-ratchet
machine-cards-structure-j108
j109-boot-copy-mockups
fix-dev-red
wip/up-263-s1
j95b-settings-rows
proxy-traefik-281
j95-option-rows
docs-human-j91
docs-keys-palette
fix-flood-1013-270-j38d
mesh-ssh-s1
mesh-ssh-s0
addhost-d291-tunnel
test-stability-load
mesh-relay-220
repro-296
shim-thp-off-24
mesh-pins-258-v2
mesh-dns
signin-d311-merged
docs-pages
ui-size-283
fix-ui-batch-specs
wip/j12b-edge-update
gate-on-arm
fix-rename-sync-293
trust-285-j60b
fix-focus-ring-clip
integ-ui-1101
edge-update-v2
signin-d311
taste-2026-11-01
layout-per-tab-250
ui-approved-splitopt-224
ui-approved-splitopt-224-on-dev
icon-text-centre-282
ui-approved-189-212-216
research-reverse-proxy
transfer-budget-320
review-mesh-pins-258-r2
sidebar-pill-259
review-mesh-relay-220
wip/j12-edge-update-v2
nix-package
status-crash-loop-237
fix-dev-test-failures
fix-fixture-socket-path
wip/mesh-relay-220-pre-dev-advance-rebase
fix-canvas-side-clip
research-head-to-head
frosted-real-256
review-mesh-pins-258
wip/mesh-relay-220-pre-final-rebase
review-layout-per-tab-250-r2
broad-suite-triage
nix-devshell
review-status-crash-loop-237-r3
wip/nix-devshell-pre-p3
taste-frosted-real
wip/code-serve-demo-2026-10-30
wip/code-serve-glass-2026-10-30
wip/code-serve-clusters-2026-10-30
wip/code-merge-release94-dev-2026-10-30
wip/rproxy-delta-scratch-2026-10-30
wip/stale-note-257-staged-2026-10-30
wip/d241-size-staged-2026-10-30
review-broad-suite-207
wip/mesh-pins-258-pre-split
wip/mesh-relay-220-pre-rebase
mesh-measure-220
plan-211-update
review-edge-autoupdate-r3
perf24-reconnect
review-stale-note-r2
release-prod-live
d241-shell-marker
review-mesh-pins-server-258
review-revocation-r3
review-setup-token-r2
review-sync-journal-r3
wip/review-mesh-pins-258-prune-review-1995fee46
frosted-scroll-256
sync-journal-r3
revocation-per-account-wip
review-tokio-asyncfd-0386
review-sync-p3s
wip/stash-8by64-stash0-2026-10-30
mesh-drag-r2
setup-token-data-wip
release-9-4
auth-busy-1013
mesh-view-overlap
sync-p3s
review-auth-busy-wake
review-readd-r8-wip
mesh-drag-bounds
audit-auth-93
app-windows-stream-start
review-authority-cap-r3
app-windows-r7-measure
readd-minimal-r6
readd-minimal-r5
app-windows-r7-soak
readd-minimal-r4
app-windows-r7
app-windows-r6
readd-minimal-r3
readd-minimal-r2
readd-minimal
merge-release8-dev
review-busy-page-liveness-r2
review-busy-page-liveness
mesh-view-trim
review-authority-read-retry-r2
review-remove-uninstall-r2
release-retry-reattach
release-retry
review-remove-uninstall
review-authority-read-retry
app-windows-ship
mesh-autoswitch-p2
mesh-ssh
mesh-relay
mesh-macos-node
screen-and-control
session-labels
review-real-logins-r5
review-real-logins-r4
review-real-logins-r3
shim-memory-r2
review-real-logins-r2
shim-memory
shadow-addhost-instant
shadow-real-logins
shadow-same-session-flood
shadow-prod-perf-fix
hosts-from-server
app-windows-real
app-windows-transport
release-prod-6w
mesh-policy-verify
quiet-close-toast
dev-merge-r4
review-mesh-agent-transport
review-app-windows-transport
settings-roundtrip
review-release-pipeline-r4
mesh-agent-transport
ended-strip-fix
review-audit-ca-update-d244
settings-rows
phone-width
signout-clear
fix-restart-tests
dev-merge-rp
signer-hardening
review-audit-ca-update
terminal-fidelity
review-audit-ca-update-wip
mesh-integrate
review-mesh-agent-transport-515d3712
review-mesh-dataplane-feec1988
mesh-dataplane
signout
research-canvas-node
wip/review-renderer-cost
wip/review-terminal-fidelity
padlock-glyph
review-release-pipeline-2e95b689
phone-polish
sidebar-polish
inbox-generic
review-mesh-dataplane-378d4055
prod-batch
ui-inbox
ui-ca-unlock
ui-machine-sections
review-mesh-dataplane-a5f744fb
tls-session-prod
session-bounds-prod
fix-dead-session
session-bounds
tls-session
palette-polish
shortcuts-d222
research-appmeta
phone-gutter
ui-centre-button
wip/ui-centre-button
wip/tls-session
review-addhost-breakit
ui-platform
renderer-cost
remote-agents
mesh-api
ssh-bootstrap
prod-hotfix2
prod-fixes
review-remote-agents
review-mesh-dataplane
session-life
research-browser
review-mesh-api
research-capture
review-mesh-api-round3
review-mesh-api-round1
gate-stability
review-gate-stability
review-relay-direct
review-mesh-api-findings
proto-sessions
font-picker
proto-addhost
proto-windows
mesh-core
latency-gate
research-bsd
research-discovery
keytray-mods
mock-core
ui-tweaks
fix-motion-sel
fix-motion
integrate2
fix-robust
t-web
t-server
vt-ghostty
fix-snap-echo
t-web-auth
review-vt2
t-agent
lane-protocol
lane-shim
lane-auth
s1-base
s1-contracts
s1-workspace
No results found.
Labels
Clear labels   
launch-qa
Findings from launch QA.

No labels
launch-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/infraternal#240
No description provided.