Busy page retires a healthy socket: 194 drops/min with 65 sessions (prod) #245
Closed
opened 2026-10-18 17:27:59 +00:00 by kayg
·
78 comments
No Branch/Tag specified
main
j470b-server-mesh-rejoin
mesh-compat-382
j444b-d381-key-wins-flood
j461b-macos-utun-reader-thread
j475b-remove-host-motion
fix-reconnect-new-link
j481-d380
dev
j479-mesh-soak
fix/j476-host-facts
j475-motion-pill-split
j470-mac-node-join
root-upgrade-d376
j474-review-merge
latency-targets-120hz
nightly-suite-shards
gotatun-pin-j469
macos-utun-reader-thread
fix-flood-echo-stall
wip/j416
motion-fast-ease-out
mesh-addhost-j259
takeover-close-terminals-d368
kbd-instant-followups
fix-trust-key-double-click
nightly-suite-partial-report
appwin-icons-j207
rusqlite-slice1
swipe-content-first-d374
mesh-mtu-381
addhost-instant-open
glass-contrast-d365-mock
glass-contrast-d365
signout-followups-442
fix-startup-toast-red
research-gotatun-matrix-j317
themes-sync-j304
fix-load-flakes
fix-nix-zig-patch
fix-compute01-browser-baseline
ratchet-size-baseline-419
predict-auto-d130
revoke-coverage-d367
nightly-suite-queue-timeout
nightly-browser-suite
fix-rustsec-2026-0459
fonts-ioskeley-obel
log-retention-d375
fix-kbd-no-anim-427
fix-dev-red-specs-2
takeover-proof-305-j205
wip/j410-server-pump
ui-consistency-d372
fix-osc52-clipboard
libghostty-vt-1.0
forget-retired-host-d369
j404-merge-426
fix-setup-lock-race
fix-touch-select-426
revoke-access-report-ui
fix-predictive-echo-specs
fix-selinux-agent-exec
wip/j395-checkpoint2
wip/j395
j391-review-scratch
ui-consistency-j195-deferred-rebased
fix-rustc-paths-421
decisions-wording-341
fix-install-suite-red
fix-dev-rtt-specs
fix-pending-removal-align
fix-privileged-skip
fix-install-suite-404
review-j368
mesh-dns-j254
revoke-access-report-d356b
revoke-privilege-round5
fix-removal-confirm
review-j360
gotatun-rotation-367
deps-refresh-340
review-j354
review-J351
review-j350
addhost-takeover-d359
revoke-report-items-347
revoke-end-sessions-d362
review-j348
size-mesh-ssh-346
size-trim-337
revoke-access-diff-d356
j259-pre-rebase-b06c5a6
j305-ended-at-start-spec
addhost-sudo-consent
fix-layout-real-specs-411
fix-shell-open-411
fix-console-hosts-373
fix-shell-exit
fuzz-host-name-353
fix-host-details-410
macos-filter-j197
research-gotatun-tricks
revoke-p3-j216l
stale-state-pill
revoke-followups-j216k
revoke-progress-j216e
backup/macos01-20261106/lume/j197
backup/macos01-20261106/lume/appwin-icons-j207-stash0
backup/macos01-20261106/claude/stash-0
backup/macos01-20261106/claude/stash-1
backup/macos01-20261106/claude/J80-macos-s1
backup/macos01-20261106/claude/J80
backup/macos01-20261106/claude/J80-slice1-20261102
backup/macos01-20261106/claude/J16b-appwin-on-dev
backup/macos01-20261106/claude/appwin-launch-idle-146
backup/macos01-20261106/claude/J80-s1-run
wip/j259
trust-285-p3c
runtime-lock-j216f
mesh-ssh-p3-j175
tun-proof-p3b
trust-285-p3
terminal-polish-j271
tun-proof-p3
ssh-install-flakes-j216i
fuzz-fixes-j264
trust-285-a
trust-285-b
restart-oversized-fixture-j198
backup/macos01-20261106/lume/appwin-icons-j207
restart-bound-j216h
up-preflight-p3-j198
backup/macos01-20261106/lume/j251
up-preflight-j198
wip/up-preflight-j198-j245-p2
wip/up-preflight-j198-j245-p1
agent-fsync-offloop-j196
wip/up-preflight-j198-j245
settings-offscreen-j231
wip/up-preflight-j198-j226-inspection
wip/j103f
themes-j206
wip/up-preflight-j198-j226
flakes-j216c
backup/macos01-20261106/claude/j197
flakes-j216b
backup/macos01-20261106/claude/j197-red
wip/up-preflight-j198-review
flakes-j216
backup/macos01-20261106/claude/appwin-icons-j207
engineering-j208b
appwin-mock-j209
toast-stack-j165
engineering-j208
decisions-d351
decisions-d350
decisions-d349
appearance-presets-mock-j129
decisions-d348
docs-audit-spec
doc-coverage-baseline-raise
decisions-d347
decisions-d346b
decisions-d346
j88h-profile
ui-consistency-j195-deferred
ui-consistency-j195
engineering-practices-j194
preferred-login-ui-j166
signin-pools-263-j174
macos-node-265-s1
decisions-d345
decisions-d344
proxy-cgroup-j164
verify-quick-fuzz-329
proxy-start-io-j168
timing-flakes-j163
up-263-s1
mcp-events-j147
verify-quick-fuzz-j158
proxy-p3-j159
agent-resource-j157-detect
wip/j103d-final
remote-cancel-hang-j155
proxy-traefik-281-j62d
j149-verify-quick
proxy-traefik-281-j62b
j150-drop-unnamed
wip/j79d-red-r4
wip/j103d-d332
rootless-toast-j142
wip/j103d-head
wip/j103d
j125c-mcp
macos-build-j136
backup/macos01-20261106/claude/j136
wip/j79d-red-cli
wip/j79d-red-server
j121-link-liveness
j118c-tracer-failures
wip/j79c-head
release-desktop-j131
j124c-signed-macos
wip/j79c-red-p3
wip/j79c-red-p23
wip/j79c-red-p22
merge-j128-check
perf-deferred-j128
sidebar-toggle-260
j127-shortcut-changed-dot
j125-mcp
j118-tracer-failures
j126-account-summary
settings-sections-mock-j92
j120-pinch-lock
sidebar-292
backup/macos01-20261106/claude/j120
taste-2026-11-03
row-actions-242-215
backup/macos01-20261106/claude/stash-0-untracked
backup/macos01-20261106/claude/J80-265-s1-run
backup/macos01-20261106/claude/J80-macos-s1-20261102
j112-canvas-commands
ui-no-overshoot-scroll
fix-recovery-restart
backup/macos01-20261106/claude/stash-1-untracked
taste-2026-11-02
size-baseline-ratchet
machine-cards-structure-j108
j109-boot-copy-mockups
fix-dev-red
wip/up-263-s1
j95b-settings-rows
proxy-traefik-281
j95-option-rows
docs-human-j91
docs-keys-palette
fix-flood-1013-270-j38d
mesh-ssh-s1
mesh-ssh-s0
addhost-d291-tunnel
test-stability-load
mesh-relay-220
repro-296
shim-thp-off-24
mesh-pins-258-v2
mesh-dns
signin-d311-merged
docs-pages
ui-size-283
fix-ui-batch-specs
wip/j12b-edge-update
gate-on-arm
fix-rename-sync-293
trust-285-j60b
fix-focus-ring-clip
integ-ui-1101
edge-update-v2
signin-d311
taste-2026-11-01
layout-per-tab-250
ui-approved-splitopt-224
ui-approved-splitopt-224-on-dev
icon-text-centre-282
ui-approved-189-212-216
research-reverse-proxy
transfer-budget-320
review-mesh-pins-258-r2
sidebar-pill-259
review-mesh-relay-220
wip/j12-edge-update-v2
nix-package
status-crash-loop-237
fix-dev-test-failures
fix-fixture-socket-path
wip/mesh-relay-220-pre-dev-advance-rebase
fix-canvas-side-clip
research-head-to-head
frosted-real-256
review-mesh-pins-258
wip/mesh-relay-220-pre-final-rebase
review-layout-per-tab-250-r2
broad-suite-triage
nix-devshell
review-status-crash-loop-237-r3
wip/nix-devshell-pre-p3
taste-frosted-real
wip/code-serve-demo-2026-10-30
wip/code-serve-glass-2026-10-30
wip/code-serve-clusters-2026-10-30
wip/code-merge-release94-dev-2026-10-30
wip/rproxy-delta-scratch-2026-10-30
wip/stale-note-257-staged-2026-10-30
wip/d241-size-staged-2026-10-30
review-broad-suite-207
wip/mesh-pins-258-pre-split
wip/mesh-relay-220-pre-rebase
mesh-measure-220
plan-211-update
review-edge-autoupdate-r3
perf24-reconnect
review-stale-note-r2
release-prod-live
d241-shell-marker
review-mesh-pins-server-258
review-revocation-r3
review-setup-token-r2
review-sync-journal-r3
wip/review-mesh-pins-258-prune-review-1995fee46
frosted-scroll-256
sync-journal-r3
revocation-per-account-wip
review-tokio-asyncfd-0386
review-sync-p3s
wip/stash-8by64-stash0-2026-10-30
mesh-drag-r2
setup-token-data-wip
release-9-4
auth-busy-1013
mesh-view-overlap
sync-p3s
review-auth-busy-wake
review-readd-r8-wip
mesh-drag-bounds
audit-auth-93
app-windows-stream-start
review-authority-cap-r3
app-windows-r7-measure
readd-minimal-r6
readd-minimal-r5
app-windows-r7-soak
readd-minimal-r4
app-windows-r7
app-windows-r6
readd-minimal-r3
readd-minimal-r2
readd-minimal
merge-release8-dev
review-busy-page-liveness-r2
review-busy-page-liveness
mesh-view-trim
review-authority-read-retry-r2
review-remove-uninstall-r2
release-retry-reattach
release-retry
review-remove-uninstall
review-authority-read-retry
app-windows-ship
mesh-autoswitch-p2
mesh-ssh
mesh-relay
mesh-macos-node
screen-and-control
session-labels
review-real-logins-r5
review-real-logins-r4
review-real-logins-r3
shim-memory-r2
review-real-logins-r2
shim-memory
shadow-addhost-instant
shadow-real-logins
shadow-same-session-flood
shadow-prod-perf-fix
hosts-from-server
app-windows-real
app-windows-transport
release-prod-6w
mesh-policy-verify
quiet-close-toast
dev-merge-r4
review-mesh-agent-transport
review-app-windows-transport
settings-roundtrip
review-release-pipeline-r4
mesh-agent-transport
ended-strip-fix
review-audit-ca-update-d244
settings-rows
phone-width
signout-clear
fix-restart-tests
dev-merge-rp
signer-hardening
review-audit-ca-update
terminal-fidelity
review-audit-ca-update-wip
mesh-integrate
review-mesh-agent-transport-515d3712
review-mesh-dataplane-feec1988
mesh-dataplane
signout
research-canvas-node
wip/review-renderer-cost
wip/review-terminal-fidelity
padlock-glyph
review-release-pipeline-2e95b689
phone-polish
sidebar-polish
inbox-generic
review-mesh-dataplane-378d4055
prod-batch
ui-inbox
ui-ca-unlock
ui-machine-sections
review-mesh-dataplane-a5f744fb
tls-session-prod
session-bounds-prod
fix-dead-session
session-bounds
tls-session
palette-polish
shortcuts-d222
research-appmeta
phone-gutter
ui-centre-button
wip/ui-centre-button
wip/tls-session
review-addhost-breakit
ui-platform
renderer-cost
remote-agents
mesh-api
ssh-bootstrap
prod-hotfix2
prod-fixes
review-remote-agents
review-mesh-dataplane
session-life
research-browser
review-mesh-api
research-capture
review-mesh-api-round3
review-mesh-api-round1
gate-stability
review-gate-stability
review-relay-direct
review-mesh-api-findings
proto-sessions
font-picker
proto-addhost
proto-windows
mesh-core
latency-gate
research-bsd
research-discovery
keytray-mods
mock-core
ui-tweaks
fix-motion-sel
fix-motion
integrate2
fix-robust
t-web
t-server
vt-ghostty
fix-snap-echo
t-web-auth
review-vt2
t-agent
lane-protocol
lane-shim
lane-auth
s1-base
s1-contracts
s1-workspace
No results found.
No labels
launch-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".
No due date set.
Dependencies
No dependencies set
Reference
kayg/infraternal#245
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Production 2026-10-18 ~22:50 IST, owner's desktop browser (Console view, 65 sessions): after refresh and CA unlock, keeps showing "The connection did not respond in time." / "The server stopped hearing from this browser." Server journal:
closed 194 times in 60 s, reason websocket_closed, who=browser, websocket_code=4000 websocket_reason="connection unresponsive" — the BROWSER retires the socket. Server load 0.28, no restarts.Cause (hypothesis, to be proven): apps/tracer/src/connection.ts
checkLiveness()retires the single shared socket when a pong is later thanresponseAllowance()= max(250, srtt + 4·rttvar + 50) ms (~300 ms at India↔Germany RTT). With 65 terminals attaching/drawing, the page's main thread stalls longer than that, the pong waits unprocessed in the task queue, the page retires the socket, all 65 streams reattach, the main thread stalls again: a loop. Same family as #244 (phone).Start #245: branch busy-page-liveness at production base
a906ede871. Read issue and related #234/#244 histories (no parent listed). Scope is web-only. Baseline has an expiry check in acceptPong as well as checkLiveness, so either task order can retire a busy page. Reading #244 compatibility changes without merging. Reproduce on production build, add failing controls, preserve responsive-page dead-link detection, then scoped checks, full fast, production web artifact and branch push; no deployment.Step 1 pushed:
6bd956cc0. Only tracer connection code/regressions changed. Baseline controlled-clock suite: 30 pass / 4 fail (1 s and 60 s stalls, both task orders). After: all 48 connection tests pass, 146 assertions; strict TypeScript and fmt pass. Timer lateness is credited once; retirement yields a task; correlated queued pongs recover without training RTT from renderer wait. Responsive-page allowance/probe cadence unchanged. Rejected blanket deadline inflation and additional continuous polling.Real production binary/bundle on locked perf VM: one idle 1 s main-thread block at 150 ms RTT produces a client 4000 "connection unresponsive" close (load 0.63/0.40/0.34). The many-window harness first exposed layout reload restoring 1 rather than 65 windows, so the focused measurement now reconnects the existing 65 windows together. Baseline/final scale and idle-dead-link rows are underway. #244 read: its visibility, refusal and allowance changes are not merged; the new lag accounting is independent of its allowance formula. Full iterate is queued behind the host build slots. No deployment.
Step 2 pushed:
17d8da5c7. Added exact-deadline task-order controls independently of lag credit: correlated queued Pong saves the route; wrong timestamp does not. All 50 connection tests pass / 150 assertions, strict TypeScript passes.Raw receipts:
baseline: 4 regression failures
after: 50 connection tests
preliminary production-browser run
clean baseline scale run
The scale fixture confirms 65 distinct real attached sessions. Preliminary run after an idle block: 2 liveness closes / 60,202 ms. Clean-start baseline: 0 / 60,247 ms, but only 37 windows live and 28 reconnecting after the forced route restart. These are not a claimed production-rate reproduction (194/min) or a healthy 65-window result. The idle 1 s block consistently reproduces one liveness close. Strengthening scale to show all windows and verifying all 65 live on the final branch. Final browser attempts also encountered cold-navigation ERR_NETWORK_CHANGED; fixture startup is being retried with its disposable TLS front explicitly trusted, before any measurements. Build-slot iterate still queued. No deployment.
Pushed steps
95c8afbaf(one task per restored renderer initialization) and97b8c0588(real production browser measurement spec). Current head97b8c0588; web-only, no server source/dependency changes, no deployment. Production web build with index.html and passing transfer budget is at /home/kayg/.cache/codex-scratch/busy-page-liveness/web. Rechecking this exact final bundle now.Locked perf VM: Linux 6.12.111, 4 CPUs, MemTotal 8,069,112 kB. Real production binary is merge-base release-4 artifact SHA-256 c821a30a063b982c813ce7e5ca61eee7ee5f21e4f3bff29c95eb5c2f2ca193b1. Same real sessions, production bundle, 150 ms relay RTT, 6x browser CPU, valid saved 13x5 layout, fresh page reload:
Five retained-real-socket/backend-stop trials, browser page responsive, retirement medians: LAN baseline 266.4 ms -> fix 268.1 ms; 150 ms baseline 186 ms -> fix 156.1 ms (probe phase explains variation; no slowdown demonstrated). Reconnecting medians are 266.6 -> 268.2 ms and 186.1 -> 156.2 ms. #234 D300 host-link notice/retirement numbers (LAN 270.2/544.1 ms; 150 ms 454.2/830.1 ms) concern the other leg; native binary unchanged here.
One idle 1 s main-thread block at 150 ms: baseline one client liveness close, fix zero. LAN also produces a non-4000 close during this deliberately long block in both variants; this web-only patch does not alter native liveness. Interactive fixture construction before the valid-grid reload also exposes native reply timeouts/protocol refusals/resume-refusal loops, separately recorded; #244 is not merged. The valid reload runs above nevertheless finish with all 65 real sessions live.
Receipts:
baseline grid
final code variant, normal grid run
core fix grid
retained real-socket 150 ms trials
native construction diagnostic
measurement driver source
Trace-heavy diagnostic is deliberately not the headline measurement: zero client liveness closes but all windows reconnecting under additional trace collection overhead. Remaining longest categories include microtasks, layout and GC; no engine choice or broad renderer rewrite added to this hotfix. Diagnostic receipt.
Compatibility dry-run only (no merge): #244 has three small textual overlaps in sampleRoundTrip guard, checkLiveness guard, and Welcome timer setup. Keep #244 hidden-page guards and allowance, then this lag credit/due timestamp; initialize due only when Welcome arms its foreground timer. Existing 250 ms test assumptions need #244's own 500 ms bounds when integrated.
Validation ongoing: stopped the partial iterate after its cold compilation phase to avoid running the whole native matrix twice after implementation was complete. It is not a passing gate. Full scripts/verify fast is now queued/running on committed
97b8c0588, reusing the same job target, with static builds and every row enabled. Logs: /home/kayg/.cache/codex-scratch/busy-page-liveness/evidence/fast.log. Final gate, exact-head browser receipts, binary delta and cleanup follow. Issue remains open.Exact committed-head production web bundle validation (
97b8c05883) is complete. 265 web files, index.html present; commit embedded in chunk-y8m37s0y.js. Critical gzip 300,328/307,200 B, +146 B vs production baseline; deferred 49,078/51,200 B. Artifact remains at /home/kayg/.cache/codex-scratch/busy-page-liveness/web.Final locked perf-VM runs: 65 real sessions, 150 ms RTT, 6x CPU -> 0 client liveness closes / 63,785.4 ms, all 65 live. Longest cold-start task 1,515 ms (the earlier untraced yield trial was 957 ms); do not treat the best single sample as a universal bound. Baseline was 3 / 63,458.6 ms = 2.84/min. One idle 1 s block at 150 ms -> zero closes; LAN still sees a non-4000 close, as baseline does. Five exact-bundle dead-link retirement medians: LAN 262.9 ms, 150 ms 162.2 ms; baseline 266.4/186 ms. Reconnecting medians 262.9/162.2 ms. Native server unchanged.
final 65-session receipt

final 150 ms idle/dead-link trials
final LAN idle/dead-link trials
production build and transfer budget
Additional existing browser suite at 150 ms: 5 functional tests pass (including typing recovery with both/up/down stopped, passkey, terminal resume/input); the first-paint case fails on both original and final bundles. Screenshot upper bounds setup/signin: baseline 1306/1091 ms, final 1032/1080 ms. No budget changed or test waived. The unmodified zero-RTT local first-paint profile passes (459/305 ms). All 50 connection tests pass, 150 assertions.
browser controls
same first-paint failure on baseline
local first-paint pass
Full fast: fmt, VT fmt, CLI compile-out and clippy pass. Native test row stopped only because previous_attempt_shell.py:25 requires INFRATERNAL_TEST_RUNTIME_HELPER, absent from the launch environment. The existing target/debug/examples/recovery-helper is built; isolated rerun passes with that variable set. No server/test source is changed. The first attempt is completing both static builds; a complete second fast run is queued immediately afterwards with INFRATERNAL_TEST_RUNTIME_HELPER=/home/kayg/.cache/codex-scratch/busy-page-liveness/target/debug/examples/recovery-helper, same target and all rows enabled. Final gate and static delta are still pending; do not call the partial gate green.
Perf VM cleanup is complete: zero owned executable/cwd references, then all owned VM folders removed. Host target/runtime cleanup waits for the gate.
zero-process audit
VM folder cleanup
Final refinement pushed:
30b57eddc(supersedes97b8c0588). On an overdue task, only the overdue portion was observable; the preceding scheduled wait could also be part of the renderer stall. An outstanding probe now gets a fresh responsive observation allowance. Fully answered routes still sample immediately on wake; timely-task budgets/cadence are unchanged. New control failed before, passes after: all 51 connection tests / 152 assertions pass, strict TypeScript passes. This is the same web-only scope; no native source changed.before refinement: outstanding-probe control fails
51 passing connection tests
Exact rebuilt

30b57eddcweb dist remains /home/kayg/.cache/codex-scratch/busy-page-liveness/web, with index.html. Repeated production perf-VM run: 0 liveness closes / 63,807.4 ms, all 65 real sessions live, 150 ms RTT / 6x CPU. Baseline 3 / 63,458.6 ms = 2.84/min. Largest cold task 1,292 ms vs baseline 3,997 ms; no claim that every individual runtime/layout/GC task is gone. All three stopped-route typing recovery cases also pass on this exact bundle.latest grid receipt
latest 150 ms idle/dead-link
latest LAN idle/dead-link
latest three typing-recovery cases
Five dead-link trials, baseline -> latest: LAN retirement median 266.4 -> 267.2 ms, maximum 273.6 -> 268.0 ms; 150 ms median 186.0 -> 220.7 ms, maximum 240.8 -> 245.2 ms. The probe phase changes the sample median; the 150 ms ranges overlap (127.0–240.8 vs 127.4–245.2 ms), with +4.4 ms at the observed maximum. The idle allowance is unchanged. Reconnecting DOM-state median 266.6 -> 267.3 ms LAN and 186.1 -> 220.8 ms at 150 ms. D300 native-host figures stay separate and unchanged.
Fresh static x86 is bit-identical to release-4 merge base: 21,144,112 B, +0 B, SHA-256 c821a30a063b982c813ce7e5ca61eee7ee5f21e4f3bff29c95eb5c2f2ca193b1. ARM exact cap 19,370,696 B also passes. All prior native/static gate rows except the test row pass. Initial test setup failures are retained, not waived: missing helper env; parallel runtime socket lifetime observation (isolated control passes); too-long recovery socket paths; then a short symlink root correctly refused by restart guards. No assertion, timeout, skip or native code changed.
The final full fast launch uses RUST_TEST_THREADS=1, existing target/debug/examples/recovery-helper via INFRATERNAL_TEST_RUNTIME_HELPER, and a real private mode-700 /home/kayg/.cache/b245 state root (short enough for sun_path and not a symlink). Recovery fixtures pass 11/11 runnable cases there, and the restart cold-exec control passes. It is waiting for a shared build slot; all rows remain enabled. Native caches are reused under this job's one target folder. The state root, unused /run/user/1001/b245 alias, target symlink and build targets will be removed at finish. No deployment.
Finished: busy-page-liveness, head
30b57eddc0, pushed and remote verified. Five atomic commits, only five apps/tracer files. No deployment or server changes. #244 was inspected, not merged; the small overlapping liveness bookkeeping/hidden-page guards are documented above.Healthy-page liveness now excludes locally stalled observation, accepts correlated queued replies without learning renderer delay as RTT, and gives socket tasks a turn before retirement. Restored renderers each get a task rather than one shared-promise microtask batch. Timely-task allowance and probe cadence stay unchanged.
Final production build on locked perf VM (4 vCPU, 8,069,112 KiB MemTotal), 65 real sessions / 150 ms RTT / Chromium 6x: baseline 3 closes in 63,458.6 ms (2.84/min), head 0 in 63,807.4 ms (0/min), all 65 live. Largest task 3,997 -> 1,292 ms; remaining individual runtime/layout tasks are not claimed eliminated. Ending load baseline 1.63/1.34/1.00, head 2.63/0.97/0.51. One-second idle block at 150 ms: baseline 1 client liveness close, head 0.
Five idle dead-link trials: LAN retirement median 266.4 -> 267.2 ms, maximum 273.6 -> 268.0 ms; RTT150 median 186.0 -> 220.7 ms, maximum 240.8 -> 245.2 ms. Reconnecting DOM-state median LAN 266.6 -> 267.3 ms, RTT150 186.1 -> 220.8 ms. Probe phases vary; ranges overlap. D300/#234 native notice/retire medians (LAN 270.2/544.1 ms, RTT150 454.2/830.1 ms) describe a different native-host lease and remain unchanged.
exact measurements
Production web dist: /home/kayg/.cache/codex-scratch/busy-page-liveness/web (265 files, index.html present, final head embedded). Production flags INFRATERNAL_CLUSTERS_PREVIEW=0, INFRATERNAL_RECOVERY_UI=off. Critical JS gzip 300,321/307,200 B (+139 B vs baseline), deferred 49,070/51,200 B. Stripped static x86 21,144,112 B, +0 B and byte-identical to merge base; ARM size gate also passes.
artifact checksums · production build · native comparison
Final full scripts/verify fast completed exit 0 on this head, with every row enabled. Runtime fixtures use existing recovery-helper, RUST_TEST_THREADS=1 and a real short private state root; no source, assertion, timeout or skip was changed to obtain the pass. Verbatim gate summary and frontend/protocol output:
full verbatim final gate output
All 51 focused connection controls / 152 assertions pass, including new controls demonstrated failing before each liveness correction. Three stopped-route typing recovery browser cases pass on the final artifact. Broader terminal/restart controls ran earlier; the RTT150 first-paint profile is red on both production baseline and candidate, already linked above, and was not waived as green. LAN synthetic block can still get a non-4000 close from the existing server/control path; that is outside this web-only fix.
Earlier unsuccessful full-gate attempts remain available: missing fixture helper, parallel runtime descriptor lifetime, long socket fixture path, symlink root correctly refused. Real short-root recovery and cold restart preflight controls pass.
Author review completed for correlation, task ordering, timer reset/cancellation, stale-socket guards, RTT accounting, unchanged idle allowance, dependencies and web-only scope. Production screenshot is attached for independent visual review; no author visual-quality verdict. Worktree clean; remote head matches. No owned test process references remain. Own targets, comparison builds, test state and temporary symlinks removed; web artifact/evidence retained. host cleanup · perf VM cleanup. Issue remains open for review/deployment by orchestrator.
Review start: branch review-busy-page-liveness, base/head
253ce0e17f. Read every #245 comment; no parent listed. Reviewing git diff origin/release-prod-live253ce0e17(five apps/tracer files). D300 is absent from this head's DECISIONS.md; read its definition from origin/dev (host-side doubt then two consecutive misses), and D265/D267 browser recovery contract. Testing repeated scheduling lateness, throttled timer schedules, restore/input routing and production workload; MERGE/HOLD pending. No deployment.P1 / HOLD: repeated timer lateness renews a dead browser route indefinitely (connection.ts:520–532). accountLivenessDelay resets lastPongAt to now whenever the timer is >25 ms late, without any peer reply or limit on renewals. Pending probes therefore never reach responseAllowance while callbacks remain late. Streams continue to report welcomed/live; unacknowledged typing cannot trigger retirement.
Three new deterministic controls in connection-idle.test.ts fail on
253ce0e17: "a dead typing route eventually retires when browser tasks run every 75ms", and the idle variants every 1000ms and 60000ms. Each executes callbacks for 600,000 virtual ms with forwarding disabled, then observes isWelcomed=true. No finite worst-case detection bound exists: repeat the same schedule for any duration. These are controlled-clock counterexamples, not build-host performance measurements or claims of a particular browser's timer policy. The 60,000ms case models minute-spaced background timer batches; a native Safari/hidden Chromium run is still pending.All three controls PASS against origin/release-prod-live's connection.ts with the same fixture. Existing 37 idle controls still pass on the candidate. candidate 37 pass / 3 fail. Strict TypeScript and git diff --check pass.
D300 applies to the native host lease, not this browser lease; it requires doubt then retirement on a second consecutive miss. This finding leaves native D300 behavior unchanged but violates bounded browser detection/recovery in D265/D267. A finite stall grace or responsive-time accumulation must preserve queued healthy replies without permitting unlimited dead-route renewals. Regression tests will be committed intentionally red as required by break-it review. No implementation fix in this review lane.
Review step committed/pushed:
5dd86380a(three controlled-clock dead-route regressions);2d2382369(real-browser stopped-link and restore-input regressions; verified real-output soak and restored-order assertions). Branch review-busy-page-liveness only. TypeScript and diff checks pass; red review controls are intentional, no implementation changed.Locked perf VM, production
253ce0e17web code, release-5 binary, RTT150: "repeated busy tasks do not keep a stopped route live" fails: backend stopped behind retained browser socket; repeated 75ms tasks for six seconds; closes=[], status=live, ending load 1.48/1.26/0.70. This independently confirms the P1 deadline-renewal finding. Baseline real-browser control queued.Restore-input test also fails on candidate with deterministic 150ms spacing between zero-delay task callbacks: at first typing only 1 of 8 renderers exists, chosen terminal t-aad54d8f-a4dc-4b00-85d4-e64c7471f67f; focus ends in t-49b99a43-408e-4596-837b-a13f6d159291; executed marker count 0. Awaiting production-bundle control before classifying as an additional regression. Window constructor unconditionally focuses each renderer; the new task yield permits input tasks between these focus changes.
The valid-grid 65-real-session soak has now verified three distinct real printing streams at 6x CPU / RTT150 and is observing for 600,000ms. Earlier setup attempts (0/1/2 verified printers) are not counted as measurements; switched workload launch to explicit window activation plus atomic pasted command and an executed marker per printer. No timing bound relaxed. Full fast is still running cold native builds in the job-specific target. HOLD already required by the first P1. No deployment or production handoff artifact.
Initial full fast reached the previous_attempt_shell integration test and failed because my launch omitted INFRATERNAL_TEST_RUNTIME_HELPER (documented in the author's #245 history); Python raises KeyError before its checks. It continues both static builds. This is a gate setup error, not a change regression. The existing target/debug/examples/recovery-helper is built. After this invocation releases its build slot, rerun full fast on
2d2382369with that helper, RUST_TEST_THREADS=1, and the new real private /home/kayg/.cache/codex-scratch/q245 runtime root. No tests, skips, assertions, timeouts or native code changed. Initial transcript retained as evidence/fast.log.P1 / HOLD: per-renderer task yields allow later restored terminals to steal focus during typing (terminal.ts:449 with constructor focus at :425). "typing into a restored terminal stays with that terminal while others initialize" now isolates only native promise-resolver zero-delay callbacks, leaving ordinary UI/deferred-focus callbacks unchanged. With 8 real sessions, a deterministic 150ms gap between the new renderer yields permits typing into the first initialized terminal. Subsequent constructors focus their own terminals; the command splits across shells and never executes. Fix must respect current user focus while restoring other windows.
Same release-5 real binary, production bundles, RTT150, locked perf VM:
253ce0e17: 1 initialized; executed count 0; chosen t-94173a87-84c1-466f-aa9e-cc160f8e442a, final focus t-8e8c2c22-50e0-462b-99bc-3c793995cae0; FAIL.isolated candidate failure · baseline pass
The earlier override of ALL zero-delay callbacks failed on both variants; it changed existing deferred-focus behavior and is not evidence of a new regression. Refinement committed/pushed as
181444701(tests only; strict TypeScript/diff checks pass). Scope counts now P0=0, P1=2, P2=0, P3=0. First P1 also has real-browser baseline control: production retires the stopped route, candidate retains live status, baseline controlled-clock 3/3 pass.65-session real-output observation PASSES: 3 verified distinct printing streams; 65 real sessions, production
253ce0e17web; RTT150 / 6x CPU; elapsed 625,310.3ms including restore/workload setup and 600,000ms observation; 0 client 4000 closes = 0/min; ending 65 live; longest task 857ms; ending load 2.66/2.01/1.37. Saved window IDs/order match after reload. Linux 6.12.111, 4 vCPU perf VM. raw run · numbers · production screenshot.Receipt caveat: after Playwright printed 1 passed / 2 skipped, the soak wrapper printed "un: command not found" because I edited its file while that shell waited for Playwright. Environment and running test code were already loaded; all observation records and assertions completed beforehand. Retained raw transcript includes the post-test wrapper error. Do not describe the wrapper exit as green.
The 60s timer schedule is a controlled-clock counterexample, not a native Safari or Chromium intensive-throttling measurement. Those real background profiles remain unverified. HOLD does not depend on them: the visible stopped-route test already reproduces P1. No production handoff build/deployment. Final full gate/runtime setup and cleanup still in progress.
Final test head pushed and remote verified:
1814447012. Three atomic review commits, no implementation changes. Focused head controls: 51 existing connection tests pass / 3 new regressions fail (158 assertions); verbatim output.First full fast completed: fmt, VT fmt, CLI compile-out, clippy, cargo-deny and both static builds PASS; test row fails only at missing INFRATERNAL_TEST_RUNTIME_HELPER setup (32 Python KeyErrors). Complete initial gate transcript. Corrected full fast on final head is queued in build-slot with RUST_TEST_THREADS=1, the built recovery-helper and a real mode-700 /home/kayg/.cache/codex-scratch/q245 state root. Every row remains enabled.
Both stripped shipping binaries are byte-identical to release-5 merge base
c00c6364e6, using the same scripts/static-cargo recipe: x86 21,225,872 B, ARM 19,427,688 B; both +0 B. Sizes/checksums.Review-only production web build (
253ce0e17embedded) remains /home/kayg/.cache/codex-scratch/review-busy-page-liveness/review-web with 265 files/index.html; SHA-256 manifest alongside it at review-web.SHA256SUMS (copy). Transfer budget passes: critical gzip 300,322/307,200 B; deferred 49,076/51,200 B. The requested /web handoff is conditional on MERGE and is not produced under HOLD.Perf VM receipt metadata: Linux 6.12.111, 4 vCPU, MemTotal 8,069,112 kB (machine). VM cleanup complete: zero owned executable/cwd references, own folder removed. Host target/runtime cleanup waits for the final gate. Verdict HOLD, P0=0/P1=2/P2=0/P3=0. No deployment.
Gate runtime requirement isolated without source changes: the state root must be both short and on the checkout's filesystem. /home/kayg/.cache/codex-scratch/q245 is too long for deeper recovery-support sockets (second transcript); /run/user/1001/r245 fits the socket but makes the restart hard-link fixture fail EXDEV (third transcript).
Now using a new real private mode-700 /home/kayg/.cache/r245, matching the author's successful short same-filesystem setup. This is ephemeral native fixture state only; build target and evidence remain in codex-scratch/review-busy-page-liveness. No symlink, test skip/assertion/timeout change, or native code change. Existing compiled workspace binaries: recovery_support 11/11 runnable PASS (receipt); restart hard-link/cold-exec control PASS (receipt). Earlier partial short-root preflight: receipt.
Full fast rerun on
181444701is active with that root, RUST_TEST_THREADS=1 and the existing recovery-helper; 99 native unit tests pass, real-daemon integration checks underway. Every row enabled. All three own fixture roots will be removed at finish. Review verdict remains HOLD with two independent P1 findings.Full fast on
181444701completed exit 0 with the proven short same-filesystem runtime root: every Rust row PASS; frontend 257 pass / 0 fail; protocol 37 pass / 0 fail. Verbatim complete run.Coverage gap found during transcript audit: the multi-path frontend command's src/connection selection did not execute the root connection-idle.test.ts controls. Its green result did not contradict the separately red regressions. Added a two-line directory test entry importing the existing suite, without copying the fixture or modifying scripts/verify. New atomic commit pushed:
8bd3726956. Strict TypeScript/diff checks pass. Exact frontend gate command now reports 294 pass / 3 fail / 11,798 assertions; the only failures are the repeated-lateness review controls. Exact command output.Final full fast on this new head is launched through build-slot with the same passing native environment and all rows enabled; transcript evidence/fast-review-head.log. Expected final exit is nonzero at these intentionally failing review tests. No implementation changes; source under review remains
253ce0e17. Verdict HOLD, P0=0/P1=2/P2=0/P3=0. Runtime/target cleanup follows this final gate.Finished review: HOLD. P0=0, P1=2, P2=0, P3=0.
Reviewed production web code at
253ce0e17fagainst release-5c00c6364e6. Review branch review-busy-page-liveness, final head8bd3726956, pushed and remote verified. Four atomic test-only commits; three files changed relative to the review target. Implementation is unchanged.P1 — unbounded dead-route renewal, connection.ts:527. Every >25ms-late callback resets lastPongAt without a peer reply. Repeating this schedule gives no finite retirement bound. Three controls (typing every 75ms, idle every 1000ms, idle every 60000ms) still report welcomed after 600,000 virtual ms; all three pass on production baseline. Real retained-socket/backend-stop test with repeated 75ms busy tasks: candidate remains live with no 4000 close after six seconds; baseline retires. D300 is the separate native host lease (doubt, then retirement after two consecutive misses); this violates bounded browser recovery under D265/D267. Candidate real-browser failure · baseline pass.
P1 — restore yields permit input to split across terminals, terminal.ts:449 / constructor focus :425. The isolated test spaces only native promise-resolver zero-delay callbacks by 150ms. Baseline: all 8 renderers exist at first typing, focus stays chosen, command executes once. Candidate: only 1 exists at first typing; subsequent constructors move focus, command fragments enter different shells, command never executes. Candidate failure · baseline pass · split input screenshot.
Positive workload: locked perf VM, Linux 6.12.111 / 4 vCPU / 8,069,112 kB RAM; 65 real sessions, three verified printing streams, 6x browser CPU, 150ms relay RTT. 600,000ms observation; 625,310.3ms including restore/workload setup. Zero browser liveness closes = 0/min, all 65 live at finish; restored window IDs/order match. Longest task 857ms; ending load 2.66/2.01/1.37. Raw receipt · screenshot. Playwright's workload assertions passed; the already-documented post-test wrapper error remains in the raw receipt and its wrapper exit is not described as green.
Coverage limit: the minute-spaced timer schedule is simulated. Native Safari and actual Chromium intensive-throttling profiles were not run. The visible busy-page P1 does not depend on those profiles.
Final scripts/verify fast on
8bd372695exits 1 at the three intentionally failing review regressions. Every Rust row passes. The directory test entry now includes the previously omitted timer suite; the exact frontend command reports 294 pass / 3 fail. Verbatim final summary:Complete verbatim final gate output · summary. The pre-entry full run passed all rows, including 37/37 protocol tests; final gate stops before those later checks (complete prior run). No assertions, native code, timeouts or skips changed to resolve fixture setup. Earlier missing-helper, socket-path and cross-filesystem failures remain linked above; real short same-filesystem private fixture state resolved them.
Reproduce the review controls: bun test apps/tracer/src/connection. On the locked perf VM with a real binary and production TRACER_DIST, run the committed busy-page-liveness.spec.ts with TRACER_TEST_PORT=4297 and BUSY_PAGE_MEASURE=1; select BUSY_PAGE_DEAD_BUSY=1 or BUSY_PAGE_RESTORE_INPUT=1 for the two negative browser controls. Positive workload uses BUSY_PAGE_PRINTING=1 BUSY_PAGE_OBSERVE_MS=600000 BUSY_PAGE_EXPECT_HEALTHY=1.
Stripped static sizes against merge base, same recipe: x86 21,225,872 B (+0 B); ARM 19,427,688 B (+0 B). Both byte-identical to release 5. Final-head sizes/checksums.
Review-only production web dist from
253ce0e17: /home/kayg/.cache/codex-scratch/review-busy-page-liveness/review-web (265 files; index.html present). Manifest next to it: review-web.SHA256SUMS (copy). Production flags INFRATERNAL_CLUSTERS_PREVIEW=0 / INFRATERNAL_RECOVERY_UI=off. Transfer budget passes: critical gzip 300,322/307,200 B, deferred 49,076/51,200 B. The requested /web production handoff is conditional on MERGE and is not produced under HOLD.Reviewer checklist completed for timer/task ordering, nonce correlation, stale-route/reset lifecycle, saved order, focus/input routing, real-engine workload, dependencies/licensing, module documentation and evidence/scope hygiene. VM processes/copy removed; host test-process audit empty; own target, baseline copy and all three fixture roots removed. Review web artifact/evidence retained. Host cleanup · VM cleanup. Worktree clean. Issue remains open. No deployment.
Round 2 start: branch busy-page-liveness-r2, base
253ce0e17f. Read #245 body and all comments (no parent listed), repository contract/architecture/process and D265/D267. Cherry-picked the four required review test commits as596869cc3,9a893f1ec,61d38ddd5,afb42359c; intentionally red controls preserved. Fix bounded silence accounting and restore focus ownership separately, then real-binary controls/65-session ten-minute perf-VM soak, full fast, zero native growth and production web artifact. No deployment. Push and fast-forward busy-page-liveness only after green, per this brief.Step 1:
262e54a9cbounds local stall grace to one fresh allowance per correlated peer reply; the final socket task turn is no longer renewable by lateness. The unchanged review controls failed before (51 pass / 3 fail), now 54 pass / 0 fail / 158 assertions. With allowance A and maximum callback gap G, conservative retirement bound after probe issuance is 2A + 3G; no wall bound is possible while no browser task executes. Timely callback cadence/allowance remains unchanged. Strict TypeScript and cargo fmt pass. Raw receipts under busy-page-liveness-r2/evidence/connection-{before,after}.log; attaching with browser evidence after real-binary runs. Found renderer.open also invokes focus and schedules a deferred focus task; restore fix must suppress this source as well as the explicit constructor focus, with the active window choosing initial focus.Focus steps committed:
a702a7129suppresses renderer opening focus (including its deferred callback) and cancels pending automatic focus on focus/pointer/key/input activity;859bc9aeblets only the active canvas binding request initial focus and removes stale post-open requests. Renderer yields retained. Strict TypeScript, 21 terminal unit controls and 208 canvas controls pass. Production bundle built at /home/kayg/.cache/codex-scratch/busy-page-liveness-r2/web: critical gzip 300,394/307,200 B, deferred 49,063/51,200 B. Full fast queued through host build-slot with short private same-filesystem runtime root and recovery-helper environment. Real-binary restore/baseline, stopped-route and ten-minute soak are prepared on the named perf VM; no deployment.Round 2 implementation head
37786982f. Added strict virtual-clock bound controls (c26b72f63): four new controls plus the three unchanged review controls fail on253ce0e17; all 58 connection controls pass on the fix. Helper/focus follow-upse6b0a8392,d5c32bcb9,0f9071cbb,76f1f9b7fand37786982fshare four temporary passive listeners across all pending opens and cover the dynamic import gap. No native/dependency/contract changes.Locked perf VM, release-5 real binary, production bundle at
859bc9aeb, RTT150: unchanged restore regression PASS (1/8 renderers at first typing; command executed once; chosen/final focus identical); productionc00c6364e6baseline control PASS (8/8; executed once; focus identical). Repeated 75ms busy tasks with retained browser socket and stopped backend now produce client close 4000 and connecting status (PASS; old review had no close). Ending loads in attached receipts. Repeating restore and ten-minute 65-session/three-printer soak on exact final helper bundle now. Full fast cold native compilation active through build-slot, every row enabled. No deployment.connection-before.log
bounds-before.log
connection-bounds.log
restore.log
baseline-restore.log
dead.log
Exact-head
37786982fproduction bundle: locked perf VM soak PASS. Linux 6.12.111, 4 vCPU, MemTotal 8,069,112 kB; RTT150 / Chromium 6x; 65 real sessions, 3 verified distinct printing streams, saved window IDs/order unchanged after reload. Observation 600,000 ms; elapsed including restore/printer setup 616,748.5 ms. Client 4000 connection-unresponsive closes: 0 = 0/min. Ending 65 live. Longest task 673 ms. Ending load 1.21/1.19/0.82. This preserves the positive workload while bounding silent routes; no claim that every task meets a frame budget.Exact helper bundle restore PASS: 1 of 8 initialized at first typing, command executed once, chosen/final focus identical. Exact bundle busy stopped-route PASS: one 4000 close while prescribed 75ms tasks run. Production restore baseline already passed (8 initialized, command executed once). All intentionally failing review assertions remain unchanged.
Functional focus ownership at scale: 65 windows / 130 pending waits share 4 passive listeners, zero after completion. Production web contains 265 files; final commit embedded; critical gzip 300,550/307,200 B and deferred 49,086/51,200 B. web-dist.tar and SHA256SUMS created and all checksums pass. Full fast is in native tests; terminal browser controls are waiting for the perf lock after releasing our short soak lock. No deployment; pushes wait for final green per brief.
soak.log


soak-numbers.json
restore-final.log
dead-final.log
focus-count.log
Full fast first run: native test row failed only in recovery_support review_live_session_socket_in_newline_home_blocks_cleanup: Python bind raises AF_UNIX path too long with /home/kayg/.cache/b245r2. This repeats the setup constraint already recorded in #245, with no source changes. A new private mode-700 same-filesystem /home/kayg/.cache/b2r passes all 11 runnable recovery controls. No assertion, timeout or skip changed. Current full gate continues its static builds; after it releases the slot, rerun every row on exact head
37786982fwith the proven shorter root. Native test transcript and preflight attached.fast-initial-checkpoint.log
Exact-head x86 static build complete: 21,225,872 B, +0 B against release-5
c00c6364e6(the same native tree as merge base253ce0e17). SHA-256 f8afe9bed532d7cf274a72aa9c7f89d1f4aa6d6ca1f8c73b05a7938c2e08da73 is byte-identical to release 5. Same scripts/static-cargo recipe; no native source/dependency/toolchain/build-script changes. ARM static build underway.Short-root recovery preflight: 11 runnable PASS, existing Docker-only ignore unchanged. Full fast rerun will follow after the current static build releases its slot. After real-browser phases, audit found own fixture processes 3365088 and 3370001; verified own executable/cwd, terminated those exact PIDs with pidfds, confirmed both executable references gone. Final zero-process audit will follow terminal suite. The suite is still waiting for the perf lock. No deployment.
native-comparison.json
recovery-short-root.log
vm-after-soak-audit.log
vm-after-soak-cleanup.log
Both static builds completed and PASS on
37786982f: x86 21,225,872 B / ARM 19,427,688 B, both +0 B and byte-identical to release-5 full artifacts (native source equals merge base). Initial full fast exits 1 only at the already-recorded recovery socket-path setup error; fmt, VT fmt, CLI compile-out, clippy, cargo-deny and static builds PASS. Complete transcript attached.Corrected full fast is queued through build-slot with /home/kayg/.cache/b2r, RUST_TEST_THREADS=1 and the built recovery-helper. That private short same-filesystem root passes all 11 runnable recovery controls. Command prints exact head before running all rows. No source/assertion/timeout/skip changes. Terminal browser suite is still waiting for the shared perf lock. All required real-binary restore/stopped-route/65-session ten-minute observations already pass as linked above; no pushes or deployment yet.
native-comparison.json
fast-initial.log
Perf VM fairness checkpoint: terminal browser suite has waited 45 minutes for /var/lock/perf-bench.lock since the exact-head stopped-route run ended around 23:46 CEST. Current receipt:
Continuing to wait; no lock modification or other job process action. Required real-binary restore/baseline, stopped-route and 65-session ten-minute soak already pass. Corrected full fast has passed the formerly failing recovery controls and is progressing through 615 server tests on exact head
37786982f. Both static full binaries are byte-identical to release 5, +0 B. No push/deployment yet.Full scripts/verify fast PASS, exit 0, exact head
37786982f1(printed at transcript start). Every row enabled, same short private /home/kayg/.cache/b2r, built recovery-helper, RUST_TEST_THREADS=1. No native source, assertion, timeout or skip changed. Both static full images byte-identical to release 5: x86 21,225,872 B / ARM 19,427,688 B, +0 B each.Verbatim gate summary and frontend/protocol output:
fast.log
fast-summary.txt
native-comparison.json
web-SHA256SUMS.txt
focused-final.log
Required 65-session ten-minute production soak and real-binary restore/baseline/stopped-route rows remain PASS as linked above. Additional terminal browser suite is still queued on the shared perf lock; 45-minute wait owner receipt recorded. No push/deployment yet. Host audit finds zero own test executable/private fixture cwd references; own native build cache and fixture roots can now be removed.
The first one-hour terminal-suite lock wait ended without starting any browser test. Old waiting-driver audit is empty; no duplicate runner remains. Current owner receipt at 00:46:41 CEST:
Renewed the foreground flock -w 3600 wait and continue; no lock or other process modified. Full fast has completed exit 0 on exact head
37786982f, with all Rust rows, 305 frontend and 37 protocol tests PASS. Own host build target/private runtime roots removed after zero test-process audit. Required real-binary restore/baseline/stopped-route and 65-session ten-minute soak PASS; only the additional terminal browser suite remains before pushes and final cleanup.Terminal browser suite acquired the perf lock. First attempt used shipping preview=0 at RTT0: 10 pass / 7 fail. Five product-hook tests cannot connect because main.ts:353 deliberately gates __tracerProductTestDouble behind preview=1; the predictive test requires RTT >60 ms. Theme socket-count mismatch also observed in that initial sequence. No test assertions changed.
Rerun with the repository browser-test build profile (preview=1, recovery UI off), exact same source head
37786982f, RTT150, locked perf VM: all 16 functional/interaction rows PASS, including theme socket preservation, links/touch, DPR1/2/3, replay, sign-in/resume and predictive input. Predicted glyph p99 13.6/17 ms, reconnect p99 556.3/600 ms, returning sign-in p99 3107/5000 ms. Machine/load and raw samples in receipt.The 17th row is the already-documented RTT150 local-first-paint profile failure (setup/signin screenshot upper bounds 1220.1/1150.3 ms). Prior #245 production baseline control also fails this profile (1306/1091 ms, linked earlier). No budget changed or test waived. Queueing the unchanged local first-paint reference at RTT0, plus an isolated RTT0 theme/socket check to resolve the initial sequence result. Production handoff remains the previously measured preview=0 web artifact; the test-hook build is separate.
terminal-browser.log
terminal-browser-preview.log
browser-build.log
Finished round 2: head
37786982f1. Atomic push created busy-page-liveness-r2 and fast-forwarded busy-page-liveness from253ce0e17; both remote refs verified at this head. Thirteen atomic commits include all four required review cherry-picks; their assertions are preserved. Worktree clean. No deployment; issue left open.P1-a: only a correlated peer reply replenishes local stall grace. A silent route retires within the conservative 2A + 3G bound after probe issuance, where A is responseAllowance and G bounds liveness callback gaps. No wall bound is possible while the browser executes no callbacks. Added strict bound/replenishment controls fail on
253ce0e17; all 58 connection tests / 172 assertions pass now. P1-b: renderer opening focus and its deferred callback are suppressed; the selected window may take restore focus only while its pre-import/resource-wait intent remains current. Shared packages/ui tracking uses 4 passive listeners for 65 windows / 130 waits, zero after completion. Renderer task yields remain.Required real-binary rows PASS on the locked perf VM, Linux 6.12.111 / 4 vCPU / 8,069,112 kB RAM, production preview=0 bundle and release-5 full binary (byte-identical to this head):
Full scripts/verify fast completed exit 0 on this exact head, every row enabled. Private short same-filesystem fixture root and built recovery-helper resolve the initial AF_UNIX path setup error; no source/assertion/timeout/skip change. Verbatim final gate summary and frontend/protocol output:
Both stripped static full images are byte-identical to release 5 with the same recipe: x86 21,225,872 B / ARM 19,427,688 B, +0 B each. No native source/dependency/toolchain/build-script change.
Terminal browser coverage: 16 interaction cases PASS at RTT150 (standard preview=1 browser-test build): DPR1/2/3, fresh/reset renderer, links/touch, replay, theme/socket preservation, sign-in, resume and predictive input. Predicted glyph p99 13.6/17ms, reconnect p99 556.3/600ms, returning sign-in p99 3107/5000ms. Local first-paint reference PASS at RTT0 on the shipping bundle: setup/signin screenshot upper bounds 501.1/144.3ms, budget 1000ms. Extra profiles remain red and are retained, without waived assertions or budgets: RTT150 first-paint fails as already documented on the production baseline; the isolated RTT0 theme/socket check fails identically on this head and release-5 baseline (6 opened / 6 closed / 0 active). These are pre-existing profile failures. Initial hook-disabled/zero-RTT suite setup errors are also retained in the earlier receipts.
Production handoff at /home/kayg/.cache/codex-scratch/busy-page-liveness-r2/:
Author checklist completed for timer/task order, correlation, reset lifecycle, focus ownership, shared component reuse, source documentation, dependencies/licensing, real-engine coverage and evidence hygiene. Host audit zero owned test references; own native target and both private fixture roots removed. VM audit zero owned executable/cwd references; own VM folders removed. Two leftover fixture processes (3365088, 3370001) were verified by executable/cwd, terminated by exact pidfd and proved gone. No broad process termination.
How to test:
Gate, native comparison, checksums and focused unit receipts:
fast.log
fast-summary.txt
native-comparison.json
web-SHA256SUMS.txt
focused-final.log
Production soak/restore/stopped-route receipts and screenshots:


soak.log
soak-numbers.json
restore-final.log
dead-final.log
focus-count.log
Terminal profiles and their baseline controls:
terminal-browser.log
terminal-browser-preview.log
browser-build.log
Final local/baseline checks, cleanup, author review and remote-ref proof:
terminal-local.log
terminal-theme-baseline.log
vm-final-process-audit.log
vm-final-cleanup.log
host-test-process-audit.json
reviewer-check.txt
remote-heads.txt
artifact-final-check.log
Round 2 delta review start: review-busy-page-liveness-r2 at
37786982f1; reviewing 253ce0e17..37786982f. Read #245 body/all 29 comments; no parent listed. Testing correlated/stale replies, confirm-task ordering, reset, large callback gaps and focus ownership across restore/non-terminal surfaces/coarse pointers. Repeating prescribed 65-session/3-printer/RTT150/CPU6x ten-minute soak on locked perf VM; fresh production build comparison and full fast follow. Test commits only, no deployment.Review step pushed:
f3123ca133(tests only). Four additional controls pass: alternating late/timely callbacks with duplicate, unknown-nonce or wrong-timestamp replies cannot renew consumed grace; a correlated reply between expiry and confirmation recovers but its duplicate cannot. All 62 connection tests / 177 assertions pass, strict tracer compiler passes. No new P0/P1 reproduced. Prescribed ten-minute perf-VM soak running on fresh production37786982fbundle. Initial browser fixture attempt stopped before workload due to long runtime socket path; rerun uses owned short private root. Author/fresh SHA256 manifests differ; review handoff rebuilt at /home/kayg/.cache/codex-scratch/review-busy-page-liveness-r2/web (265 files); focus matrix queued behind our soak lock.P1 / HOLD: continuous typing cancels every silent-route retirement confirmation. Input send (connection.ts:229-232) calls scheduleLiveness(), which clears livenessTimer (:575-576), including the zero-delay confirm installed by checkLiveness (:553-554). The replacement callback always invokes checkLiveness(false), so an input task queued between every expiry callback and its confirmation cancels retirement indefinitely without any peer reply.
New test-only regression at
67133f57d: callbacks every G=75 virtual ms, A=250 ms, terminal-style sampleRoundTrip plus contiguous one-byte Input after each callback, forwarding stopped. Still welcomed after 600000 virtual ms; claimed 2A+3G bound is 725 ms. All other 63 connection controls pass; strict tracer compiler passes. This is a deterministic task-order counterexample, not a build-host performance number. One-shot unacknowledged input tests do not cover continuous rescheduling. No implementation changes. Raw initial counterexample: continuous-input.log. Fresh production ten-minute soak and expanded focus matrix still running/queued; full fast will include the intentionally red review test.Completed reset control:
b21f1a3d9(tests only, pushed). A replacement route gets exactly one independent local-stall grace after the old route consumes its own; all 63 connection tests / 179 assertions passed before adding the intentionally failing P1 test in67133f57d. Strict tracer compiler passes. For the P1 source references in the preceding comment, exact lines on37786982fare Input scheduling :219-225, timer cancellation :572, replacement non-confirming callback :581, confirmation :554. The mechanism/conclusion is unchanged. No production edits; HOLD remains.Independent exact-source production soak PASS on locked perf VM: Linux 6.12.111, 4 vCPU; fresh preview=0/recovery=off web bundle with
37786982fembedded, release-5 real binary. RTT150 / Chromium CPU6x / 65 real sessions / 3 verified printing streams; observation 600000 ms, elapsed including restore/setup 616076.9 ms. Client 4000 connection-unresponsive closes: 0 = 0/min; all 65 live at finish; longest task 423 ms; ending load 1.79/1.63/1.13. Saved window IDs/order assertion passes. The construction-stage native refusals already described on #245 occur before the valid-grid reload; this run is not claimed free of those pre-existing paths.raw soak · numbers

HOLD remains: the continuous-input confirmation-cancellation counterexample in
67133f57dis independent of the positive soak. Seven expanded focus controls now running; native fixture build acquired build-slot. Final full fast will retain the intentionally failing regression, with no implementation/assertion change.Review focus step pushed:
c3d864974e, fourth atomic test-only review commit. Corrected seven-case production-browser matrix PASS on locked perf VM: 30-window restore keeps palette/button/removed-input focus (including selected-window closure); only selected restored window gets initial focus; desktop one-window initial focus; coarse-pointer no automatic focus then tap focus; 30-window typing executes once in chosen/final terminal. Initial setup failures are retained: all-live construction can hit the documented native refusal path, and historical attachments can exceed current persisted references. Final fixture waits for each current window reference, with unchanged focus assertions. Strict app/spec compilers pass.Original eight-window restore and repeated-busy stopped-route tests PASS unchanged. No extra focus P0/P1 found. #244 Discard/Send again controls are absent from this source; their combined integration focus path remains untested. The button check uses the sidebar control; no dedicated toast-action case or native iPhone run was performed.
Full scripts/verify fast is active on exact
c3d864974, all rows enabled, short private fixture root, built recovery helper and RUST_TEST_THREADS=1. The new continuous-input regression remains intentionally red; HOLD, P0=0/P1=1. VM audit found owned fixture PID 3480664; executable/cwd proved ownership, exact pidfd TERM, zero remaining references; owned VM directories removed. Host target retained only until gate completes. No deployment.focus.log
original-browser-controls.log
continuous-input.log
Gate checkpoint on exact review head
c3d864974e: fmt, VT fmt, CLI plugin compile-out, clippy, full native test row and cargo-deny PASS. Fresh stripped static x86_64: 21225872 B, +0 B against merge base/release 5, byte-identical SHA256 f8afe9bed532d7cf274a72aa9c7f89d1f4aa6d6ca1f8c73b05a7938c2e08da73; PT_INTERP absent, production trust PASS. Same scripts/static-cargo recipe; native source/dependency/toolchain delta empty. ARM static build active, so full scripts/verify fast is not finished. Frontend must still execute the intentionally failing continuous-input regression; HOLD remains P0=0/P1=1. All browser phases completed and own VM processes/folders removed; host target retained only until final gate.Finished delta review: HOLD. P0=0, P1=1, P2=0, P3=0.
Reviewed 253ce0e17..37786982f1abe561973cdc68cddf7ee7c1a4f5dc. Review branch review-busy-page-liveness-r2, head
c3d864974e, four atomic test-only commits, pushed and remote verified. No implementation/dependency/contract changes. Issue remains open. No deployment.P1 — continuous input cancels every silent-route retirement confirmation (connection.ts:219-225, 305, 554, 572, 581). Input and urgent RTT sampling call scheduleLiveness, which clears the pending zero-delay confirmation and replaces it with checkLiveness(false). A queued input task between every expiry check and confirmation prevents retirement without a correlated peer reply. Regression
67133f57dmirrors terminal sampling plus contiguous one-byte Input: actual liveness checks every G=75 virtual ms, A=250 ms, still welcomed after 600000 virtual ms versus the claimed 725 ms bound. This is a task-order counterexample, not a measured browser failure rate. The previous one-shot typing controls do not cover this rescheduling. Preserve the pending confirmation across input/sampling reschedules; the failing test is committed unchanged.Other connection controls: 63 PASS, including duplicate/unknown/wrong-timestamp replies, queued reply between expiry and confirmation, replacement-route grace, and large callback gaps. No additional focus P0/P1 found. Locked perf VM, fresh production preview=0/recovery=off bundle with
37786982fembedded, real release-5 binary:Coverage limits: the phone check is coarse-pointer emulation. #244 Discard/Send again controls are absent from this source; combined integration focus remains untested. Initial focus harness failures are retained: native construction live-state wait, then historical bridge counts missing current saved references. Final fixture waits for each current saved window reference; focus assertions were unchanged.
Full scripts/verify fast on this exact head exits 1 only at the intentionally failing P1 regression. Every Rust row PASS. Verbatim final summary:
Fresh stripped static builds, same scripts/static-cargo recipe against merge base/release 5: x86_64 21225872 B / ARM 19427688 B, both +0 B and byte-identical. Native source/dependency/toolchain diff is empty. No size exception is needed.
Actual 265-file author/fresh production web trees differ by SHA256 manifest. Fresh
37786982freview bundle retained at /home/kayg/.cache/codex-scratch/review-busy-page-liveness-r2/web (265 files, index.html, exact source head embedded). Its transfer gate passes: critical gzip 300548/307200 B, deferred 49085/51200 B.The TypeScript protocol row, run separately after the full gate stopped at the intentional frontend failure, passes 37 tests / 0 fail / 34463 assertions. The already-built oracle was reused. The redundant queued production rebuild was cancelled before it started; review commits only change tests, and the exact reviewed production build/transfer and its unchanged 265-file manifest were already verified.
Cleanup complete: VM owned fixture PID 3480664 was verified by executable/cwd and terminated by exact pidfd; zero remaining references and both owned VM folders removed. Host test-reference audit is empty; owned target and short private fixture root removed. Only queued wrapper PID 2508678 and its own sleep child were stopped before any follow-up command started. Web artifact/evidence retained. Reviewer checklist completed.
Gate, hashes, remote ref and audit receipts:
fast.log
fast-summary.txt
native-comparison.json
host-test-processes.json
remote-head.txt
Browser receipts:



soak-short-root.log
soak-numbers.json
focus.log
original-browser-controls.log
continuous-input.log
Web comparison and VM cleanup:
web-comparison.json
author-SHA256SUMS.txt
fresh-SHA256SUMS.txt
vm-process-cleanup.json
vm-cleanup.txt
focus-scale.log
Earlier harness setup attempts:
focus-initial.log
focus-attachments.log
protocol.log
host-cleanup.json
web-final-check.json
reviewer-check.txt
findings.txt
Reproduce the P1: bun test apps/tracer/src/connection. Real-browser review cases: BUSY_PAGE_MEASURE=1 TRACER_TEST_PORT=4298 bun x --bun playwright test -c playwright.real.config.ts real/busy-page-liveness.spec.ts --grep round-2, using the locked perf VM, real binary and production TRACER_DIST. The unchanged original restore/stopped-route/soak selectors are documented in this issue and the committed spec.
Start #245 round 3: branch busy-page-liveness-r3, base
37786982f1(origin/busy-page-liveness). Read all #245 comments; prior reviewers recorded no parent issue. Cherry-picking the four review test commits unchanged, then fixing confirmation scheduling and running focused tests, production build, locked 65-session soak, binary-size comparison and final fast. No deployment.Review controls cherry-picked unchanged as
ee900c662,48b19892d,8606ae31fand0391200b5; branch head0391200b5. Before the implementation change, the exact continuous-input control fails: 0 pass / 1 fail, 600,000 virtual ms elapsed,isWelcomedremains true. Receipt: /home/kayg/.cache/codex-scratch/busy-page-liveness-r3/evidence/continuous-input-before.log. The full connection test set is queued through build-slot.Step 1 committed:
e0398acfa9. Input/probe scheduling now preserves a pending zero-delay confirmation; reset clears its pending state. The unchanged continuous-input control changes from 0 pass / 1 fail with the route still welcomed after 600,000 virtual ms to 1 pass.apps/tracerbun run checkpasses. The full connection test set is queued through the shared build slot.Step 2 verification on
e0398acfa9: all connection tests pass, 64 tests / 180 assertions across 7 files; the review's continuous-input control is included. Tracer TypeScript check passes. Before/after receipts: counterexample, full connection suite.Step 3 production build for
e0398acfa9:web/contains 265 files with the exact commit embedded;web-dist.taris 3,624,960 B; all 266 SHA256SUMS entries verify. Transfer budget passes: critical gzip 300,592/307,200 B, deferred gzip 49,085/51,200 B. The bundle and checksums were copied to the perf VM job handoff and verified there. The issue helper rejected the 3.6 MB tar with HTTP 422; it remains at /home/kayg/.cache/codex-scratch/busy-page-liveness-r3/web/web-dist.tar.Receipts: build, transfer budget, checksums, artifact verification.
Step 4 complete at
e0398acfa9565a9a293168b05db8b31eb74d4877.scripts/verify iteratepassed: 563 server library tests passed, 52 ignored; full workspace clippy passed in 299s; tracer connection suite passed 64/64; TypeScript protocol suite passed 37 tests / 34,463 assertions. Load-sensitivevt_creditpassed in 20.23s andrepeated_tiny_credit_pauses_preserve_shell_progresspassed as part of the agent review suite. The final line was:ITERATE gate passed. This is not the final gate: run scripts/verify fast before reporting done.Log: iterate.log. Starting the required final fast gate.Step 5 complete at
e0398acfa9565a9a293168b05db8b31eb74d4877.scripts/verify fastreports all Rust gate rows PASS, and the final TypeScript protocol suite passed 37/37 with 34,463 assertions. Static artifacts: x86_64 21,225,872 B (exact cap); aarch64 19,427,688 B (exact cap). Full raw output: fast.log.Verbatim final gate summary:
I have queued an explicit same-recipe x86_64 size build at merge base
37786982f1abe561973cdc68cddf7ee7c1a4f5dcto confirm the binary delta.Perf VM browser preflight: the initial Playwright listing failed before test execution with a bundler AggregateError for missing
chromium-bidi; no benchmark or browser test started. The isolated runner also lacked the tracer package manifest and lockfile. I copied those files, ranbun install --frozen-lockfile, and confirmed the exact soak test is discoverable (1 test, 1 file). Logs: failed preflight, successful listing.Perf VM soak has started under
codex-busy-page-liveness-r3-soak-20261019.scope, with the bench lock held, CPUWeight=10000, 4 vCPU, load average 0.19/0.29/0.13 at launch, 65 sessions, 3 shell printers, 150 ms RTT, 6x browser CPU throttling, and a 600,000 ms observation. Two systemd preflights failed before Playwright started because--pipeand then--waitare incompatible with--scope; both were removed, and no browser measurement ran during those attempts. Receipts: scope preflight 1, scope preflight 2.Soak setup reached 65 server sessions and confirmed 3 continuing shell printers. The ready receipt first showed 37/65 live before the page restore; after reload, the spec's assertion that all 65 routes were live passed, then it entered the 600,000 ms observation. The runner remains active; current perf VM load average is 1.38/0.63/0.26. Progress log.
Native binary comparison completed with the same locked static recipe at merge base
37786982f1abe561973cdc68cddf7ee7c1a4f5dcand branch head: stripped x86_64 static-pie size was 21,225,872 bytes at both revisions (delta +0 B). The first baseline invocation lacked the target-scoped Zig path; I reused the job's already pinned Zig 0.15.2 toolchain and the baseline build then completed successfully. Receipts: build log, size comparison, SHA256.Perf VM scale soak passed: 65 sessions, 3 shell printers, 150 ms RTT, 6x browser CPU throttle, 600,000 ms observation. There were 0 client unresponsive closes (0.0/min); the longest browser task was 842 ms across 1,261 long-task entries; final state was 65/65 live. The harness recorded 58 connecting-status mutations during the scale interval. Initial setup had 37/65 live before restore; the post-restore 65-live assertion passed before measurement. Load average samples (1/5/15 min): launch 0.19/0.29/0.13, mid-run 4.14/2.14/0.98, scale receipt 2.04/2.00/1.24. Logs, metrics and screenshot: soak.log, 65-session screenshot, metrics.
I initially passed
INFRATERNALEVIDENCE_DIRwithout the underscore required by the evidence helper, so Playwright wrote the screenshot under its PID-scoped fallback directory. I copied the screenshot to this job's external evidence directory and will remove the exact fallback directory during cleanup.Perf VM cleanup complete: the soak scope is inactive, the observed Playwright CLI/worker/server PIDs are gone or reused, test port 4253 is free, and this job's remote runner/data/runtime plus the exact PID-scoped fallback evidence directory have been removed. Cleanup receipt.
Finished #245 round 3. HEAD
e0398acfa9565a9a293168b05db8b31eb74d4877is pushed asbusy-page-liveness-r3;origin/busy-page-livenesswas fast-forwarded to the same SHA. No deploy was performed. The change preserves the zero-delay confirmation timer through Input and other liveness reschedules, while reset/close clears its pending state.The exact continuous-typing control failed before the fix after 600,000 virtual ms and passes afterward. The connection suite passed 64 tests across 7 files;
scripts/verify iteratepassed. The 65-session perf VM soak passed with 3 printers, 150 ms RTT, 6x browser CPU throttle, and a 600,000 ms observation: 0 unresponsive closes (0.0/min), longest task 842 ms, 1,261 long-task entries, and all 65 sessions live at the end. The harness recorded 58 connecting-status mutations during the interval. Load average samples (1/5/15 min): start 0.19/0.29/0.13, mid-run 4.14/2.14/0.98, final 2.04/2.00/1.24. Soak log, screenshot, metrics, reviewer checklist, remote cleanup receipt.The stripped static x86_64 binary is 21,225,872 bytes at both merge base
37786982f1abe561973cdc68cddf7ee7c1a4f5dcand HEAD: +0 B. The production web artifact is retained at/home/kayg/.cache/codex-scratch/busy-page-liveness-r3/web/web-dist.tar, SHA2565d9b8580a83cb00c7a7ae31822e7daaa1d29aeccc0f8957e014d072fe9ba2888; itsSHA256SUMShas 266 verified entries. Size comparison, web checksums.Final
scripts/verify fastgate summary (verbatim; full log):Review start: branch
review-busy-page-liveness-r3, base37786982f1abe561973cdc68cddf7ee7c1a4f5dc, heade0398acfa9565a9a293168b05db8b31eb74d4877. Read the repository contract, architecture/process docs, all 51 #245 comments, and confirmed no parent issue is linked. Reviewing only theconnection.tsliveness-confirmation flag and its four test commits against the requested controlled-clock cases. No production edits, push, or deployment planned; verdict pending focused suite, full fast, and artifact checksum comparison.P1 / HOLD: a queued confirmation from an old route can retire its replacement before the replacement's queued Pong runs. The deterministic control at
apps/tracer/src/connection-idle.test.ts:499-530captures the old confirmation after expiry, resets throughforceDrop(), reconnects, arms a new route confirmation, queues a correlated Pong, then runs the old callback first. It fails at line 522: expected the replacement to remain welcomed, received false; the connection logs a client 4000 unresponsive close.checkLiveness(confirm)atconnection.ts:544-547validates only the shared boolean, whileresetPings()at :745-749 clears that boolean without binding callbacks to a route/generation. The 2A+3G continuous-input bound and reconnect/close/dispose reset controls pass. Full connection directory: 67 pass / 1 fail / 203 assertions. No production code changed in this review lane.Step complete: test-only commit
de298eedeis pushed onreview-busy-page-liveness-r3. The continuous-input control now asserts retirement within2*A+3*G = 725 ms; reset controls pass for reconnect, explicit close and dispose. The new stale-callback regression is intentionally red: the old queued callback closes the replacement before its queued correlated Pong. Focused suite result: 67 pass / 1 fail / 203 assertions; tracer TypeScript check passes afterbun install --frozen-lockfile. No production source was changed or pushed tobusy-page-liveness.The controlled-clock P1 receipt is attached: stale-confirmation.log. The new route has a correlated Pong queued when the old callback runs; the replacement closes before that message task executes.
Fresh production build step complete from exact
e0398acfa9565a9a293168b05db8b31eb74d4877:/home/kayg/.cache/codex-scratch/review-busy-page-liveness-r3/webhas 265 files,index.html, and the commit embedded. Transfer budget passes: critical gzip 300,593/307,200 B; deferred gzip 49,085/51,200 B; largest on-demand chunk gzip 15,098/20,480 B. The author tar is at the nested path/home/kayg/.cache/codex-scratch/busy-page-liveness-r3/web/web-dist.tarand hashes to the expected5d9b8580…2888; the flat path in the brief is absent. A fresh archive from the exact source is 3,624,960 B with SHA-25603bd7a22368ab927781e43da2bcbab0889383de256ce0d38fee6dfed932710bc, so it does not match the author archive. Fresh output/checksums are retained under the requested review scratch path. Receipts: transfer-budget.log, fresh-web-checksums.txt.Full
scripts/verify fastfinding: the Rusttestrow reportedshared_ownership_shell_preserves_recovery_and_refusal_invariantsfailed becauseprevious_attempt_shell.pyraisedKeyError: 'INFRATERNALE_TEST_RUNTIME_HELPER'in 32 fixture setups. The gate runner process hadINFRATERNALE_TEST_RUNTIME_HELPER=/home/kayg/.cache/codex-scratch/review-busy-page-liveness-r3/target/debug/examples/recovery-helper,INFRATERNALE_TEST_STATE_ROOT=/home/kayg/.cache/busy3, andCARGO_TARGET_DIR=/home/kayg/.cache/codex-scratch/review-busy-page-liveness-r3/target; the test subprocess still lacked the helper variable. I have not attributed the cause. I will rerun the isolated Rust test with the helper explicitly set after the full gate completes.Review verdict: HOLD (one P1, no P0). Head
de298eedec900cd61331726f5ec03e783ce37c19is pushed toreview-busy-page-liveness-r3.The controlled-clock connection suite reports 67 passed, 1 failed, 203 assertions across 68 tests. The failing regression test proves a confirmation queued before reconnect can close the replacement route; the shared boolean has no generation identity. Its focused receipt is stale-confirmation.log.
bun run checkpassed. The Rust fast-gate test row also failed:previous_attempt_shell.pyraisedKeyError: 'INFRATERNALE_TEST_RUNTIME_HELPER'in 32 fixture setups. A focused rerun with the helper explicitly set reproduced the same error; I have not attributed its cause. The gate stopped before its TypeScript checks. Full log: fast.log.The author archive at
busy-page-liveness-r3/web/web-dist.tarmatches the requested SHA2565d9b8580a83cb00c7a7ae31822e7daaa1d29aeccc0f8957e014d072fe9ba2888and all 266 archived checksums pass. A fresh production build ofe0398acfa9565a9a293168b05db8b31eb74d4877was rebuilt under/home/kayg/.cache/codex-scratch/review-busy-page-liveness-r3/web; its archive SHA256 is03bd7a22368ab927781e43da2bcbab0889383de256ce0d38fee6dfed932710bc. Transfer budgets pass: critical JS gzip 300593/307200 B and Brotli 250411/256000 B; deferred JS gzip 49085/51200 B and Brotli 43514/45056 B; largest on-demand chunk gzip 15098/20480 B and Brotli 13451/18432 B. Receipts: transfer-budget.log, fresh-web-checksums.txt.scripts/verify fastcompleted its Rust and static rows and exited 1. Verbatim final Rust summary:Static sizes were x86_64 21225872/21225872 bytes and aarch64 19427688/19427688 bytes. No Rust source changed in this review lane.
Start #245 round 4: branch
busy-page-liveness-r4, basee0398acfa9565a9a293168b05db8b31eb74d4877(origin/busy-page-liveness). Read all issue comments; no parent issue is linked. Cherry-picking the round-3 stale-confirmation regression, then binding each confirmation to its route generation. Preserving the continuous-input2*A+3*Gbound and reconnect/close/dispose reset controls. No deployment.Round 4 finding reproduced on test commit
c0ba3d60e: the new controlled-clock stale-confirmation test fails atapps/tracer/src/connection-idle.test.ts:523. After reconnect and a new route confirmation, running the old timer callback closes the welcomed replacement with code 4000 (connection unresponsive); expectedisWelcomed=true, received false. Focused failing control. No implementation change yet.Step 1 complete: cherry-picked regression as
c0ba3d60e, then committed the route-bound confirmation fix as857823ce4(head SHA is recorded in the branch). The stale-callback control failed before the fix (0 pass / 1 fail; old callback closed the new route) and passes after. Full connection directory: 68 pass / 0 fail / 207 assertions across 8 files.apps/tracerbun run checkpasses. Before · after · connection suite · TypeScript check.Step 2 production bundle complete from
857823ce4:/home/kayg/.cache/codex-scratch/busy-page-liveness-r4/web/has 265 files and embeds the exact head. Critical JS gzip is 300,657/307,200 B; deferred is 49,084/51,200 B./home/kayg/.cache/codex-scratch/busy-page-liveness-r4/web-dist.taris 3,624,960 B (SHA256ce108f23e80a610c65ca274c24867b93cd5dc3568ea8fc72c3675e0ceab98bab);SHA256SUMSverifies all 266 entries. Production build · transfer budget · checksum verification. The on-demand class total is 87,474 B; the existing budget applies to the largest chunk, 15,101/20,480 B.Gate finding during
scripts/verify iterate: the Rust test row fails only inshared_ownership_shell_preserves_recovery_and_refusal_invariants;previous_attempt_shell.py:25raisesKeyError: 'INFRATERNALE_TEST_RUNTIME_HELPER'in 32 fixture setups. This matches the unrelated gate issue called out in the brief. No SSH test source was changed. Exact failure excerpt. The full gate is continuing through cargo-deny and TypeScript checks.Perf VM setup finding: the first Playwright invocation stopped in 153 ms before server startup because the environment overrides were mistyped: INFRATERNA_BIN and INFRATERNAL_EVIDENCE_DIR were passed with an extra LE/E. The harness therefore looked for /root/infraternal-bench/bpl4/target/x86_64-unknown-linux-musl/release/infraternal and returned ENOENT; no soak interval ran. The scope is inactive and the bench lock is free. Correcting the environment names and retrying. Setup failure receipt.
Correction to my setup note: the expected names are INFRATERNAL_BIN and INFRATERNAL_EVIDENCE_DIR. The first invocation passed INFRATERNALE_BIN and INFRATERNALE_EVIDENCE_DIR (each with an extra E after the L). The ENOENT receipt and no-measurement status are unchanged.
Perf VM attempt 2 reached 65 server sessions at 150 ms RTT, but failed before the soak interval: my REAL_BRIDGE_LEAN=1 setting disables the output receipt used by the shell-printer preflight, so the first printer predicate timed out after 15 s. The foreground scope exited, the lock is free, and the server fixture cleaned up. Retrying with that setting removed. Preflight failure receipt.
Native size step complete at HEAD
857823ce43. Using scripts/static-cargo build --locked --release --package infraternal --target x86_64-unknown-linux-musl, the stripped static x86_64 binary is 21,225,872 B (SHA256 f8afe9bed532d7cf274a72aa9c7f89d1f4aa6d6ca1f8c73b05a7938c2e08da73). The recorded r3 final fast build at this branch basee0398acfa9is also 21,225,872 B: delta +0 B. No native source changed. Receipts: build · size comparison.Perf VM measurement finding: the 65-session workload completed 600,000 ms at 150 ms RTT, 6x browser CPU throttle, with 3 shell printers. One client close used code 4000 / "connection unresponsive" at page time 157,886.7 ms (0.10 closes/min); 65/65 sessions were live at the end. Longest task was 1,030 ms across 1,863 entries. The zero-close assertion failed. Load average (1/5/15 min): launch 0.99/0.40/0.14, ready 2.33/0.82/0.30, mid-run 8.17/3.42/1.52, end 2.97/2.88/1.78. The scope is inactive and bench lock released. I’m checking whether host load explains the close, then will rerun under a quieter load window. log · screenshot · metrics · mid-run load.
Perf VM retry passed at HEAD
857823ce43: 65 sessions, 3 shell printers, 150 ms RTT, 6x browser CPU throttle, and a 600,000 ms observation. There were 0 unresponsive closes (0.00/min); longest task was 333 ms across 1,128 long-task entries; final status 65/65 live. Load average (1/5/15 min): launch 0.31/1.82/1.53, ready 0.72/1.78/1.53, mid-run 2.27/1.97/1.66, final 2.66/2.37/1.91. The earlier run with 1 close remains recorded separately; this repeat began at lower host load. All exact Bun/Playwright/Chromium PIDs from the completed run are gone; the scope is inactive and our lock is released. Receipts: soak log, screenshot, metrics, cleanup.Finished #245 round 4 at HEAD
857823ce43. Commits:c0ba3d60eadds the stale-confirmation regression control;857823ce4binds confirmations to their socket/token and preserves the pending timer handle. Pushed busy-page-liveness-r4 and fast-forwarded busy-page-liveness to857823ce43. Both remote refs were verified at that SHA. No deployment.The stale callback control failed before the fix and passes afterward. The full connection test directory passes: 68 tests, 0 failed, 207 assertions across 8 files. apps/tracer bun run check passes. Receipts: before, after, connection suite, TypeScript check.
Perf VM retry passed at 65 sessions, 3 shell printers, 150 ms RTT, 6x browser CPU throttle, and a 600,000 ms observation: 0 unresponsive closes (0.00/min), longest task 333 ms across 1,128 entries, and 65/65 live at the end. Load average (1/5/15 min): launch 0.31/1.82/1.53, midpoint 2.27/1.97/1.66, final 2.66/2.37/1.91. An earlier run at higher load recorded one close; it remains documented separately without attributing the cause. Retry receipts: log, screenshot, metrics, cleanup.
Stripped static native sizes match the branch base: x86_64 21,225,872 B (+0 B) and aarch64 19,427,688 B (+0 B). The production archive is /home/kayg/.cache/codex-scratch/busy-page-liveness-r4/web-dist.tar, 3,624,960 B, SHA256 ce108f23e80a610c65ca274c24867b93cd5dc3568ea8fc72c3675e0ceab98bab; all 266 SHA256SUMS entries verify.
Final scripts/verify fast exited 1 only on the known unrelated SSH fixture test: shared_ownership_shell_preserves_recovery_and_refusal_invariants raises KeyError: INFRATERNAL_TEST_RUNTIME_HELPER in 32 fixture setups. I did not change that test. Formatting, clippy, cargo-deny and both static builds passed. The exact final gate summary is verbatim:
Full gate log: fast.log.
Deployed to production web-only at
857823ce4(orchestrator, 2026-10-19 ~11:35 IST). No restart: MainPID 101325 unchanged, CA stays unlocked. healthz ok. release-prod-live →857823ce4, merged into dev (e2f1c646e).Contents since release 5: round 1 (count only responsive silence), round 2 (one stall grace per correlated peer reply, bound 2·A + 3·G; restore never steals focus), round 3 (input cannot cancel a pending confirmation), round 4 (confirmation bound to its arming route/socket). Rounds 1–3 had break-it reviews; round 4's 30-line fix was read by the orchestrator and gets a post-deploy narrow review now, because production was retiring busy browsers (6 liveness_timeout close summaries in the 3 h before deploy) and the change is web-only and reverts in seconds (web.prev).
Soak (perf VM, 65 sessions, 3 printers, RTT150, 6x CPU, 10 min): 0 closes, longest task 333 ms, 65/65 live. Web artifact sha256 ce108f23e80a610c65ca274c24867b93cd5dc3568ea8fc72c3675e0ceab98bab, 266/266 file checksums OK.
Owner test: reload once (new web), keep a busy canvas open on the phone and desktop; "The server did not respond in time" should no longer appear while the server is fine.
Post-deploy review start: branch
review-busy-page-liveness-r4, base/head857823ce433bc3f729c04571e32813073b1cc37e. Reviewing onlygit diff e0398acfa 857823ce4 -- apps/tracer/src/connection.ts, with controlled-clock regressions in the existing connection fixture and read-only production journal counts since the 2026-10-19 06:05 UTC deploy versus the prior three hours. No production changes or deployment.Production journal check (read-only): since deploy
2026-10-19 06:05 UTCthrough06:10:04 UTC, there are 0terminal_stream_closerecords. In the preceding three hours, there are 6 server /liveness_timeoutrecords: 3 individual close records and 3 summary records (closed_count3, 16, 28). Browser /websocket_closedhas 2 records (individualclosed_count=1, summaryclosed_count=3). Receipt: production-journal-summary.txt.Gate setup finding on the first
scripts/verify fastat79226172afc1272caf22d8e1ad0cde64da8a3977: onlyshared_ownership_shell_preserves_recovery_and_refusal_invariantsfailed, with 32 Python setups raisingKeyError: INFRATERNAL_TEST_RUNTIME_HELPER. I exported the misspelledINFRATERNALE_TEST_RUNTIME_HELPER(extra E); the built helper is present. All other Rust rows passed, including clippy, cargo-deny, and both exact-cap static builds (x86_64 21,225,872 B; aarch64 19,427,688 B). No source changed. Correctly named full-gate rerun is next. Setup finding receipt.Corrected full gate passed all rows except one fixture setup check:
review_live_session_socket_in_newline_home_blocks_cleanupcould not bind its AF_UNIX socket because the supplied state root produced a 108-byte pathname (OSError: AF_UNIX path too long,crates/plugins/ssh/tests/recovery_support.rs:478). This is test harness path length, not a source failure. I will rerun with a shorter job-specific state root, verify that fixture, then rerun the full gate.Short-root rerun passed:
review_live_session_socket_in_newline_home_blocks_cleanup— 1 passed, 0 failed; inspection and cleanup both returned 73, and the session socket and receipt remained present. Starting the final fullscripts/verify fastwith/home/kayg/.cache/2454as the fixture state root.Round 4 complete. Head
79226172afc1272caf22d8e1ad0cde64da8a3977is pushed toreview-busy-page-liveness-r4.Verdict: MERGE. No P0/P1 findings; no production revert recommended. The requested
connection.tsreview found no liveness-schedule defect in this round. Added controlled-clock coverage inapps/tracer/src/connection-idle.test.tsfor a queued regular check followed by silence or healthy probing, replacement-socket Welcome with an old confirmation pending, repeated reconnect storms, close/dispose with a pending confirmation, the2·A + 3·Gbound, and a busy healthy route.Production check (read-only): since deploy at 06:05 UTC through 07:28 UTC, 0
terminal_stream_closerecords. In the previous three hours: server/liveness_timeout had 6 records (3 individual and 3 summary records withclosed_count=3,16,28); browser/websocket_closed had 2 records (1 individual and 1 summary withclosed_count=3). Nothing was changed or deployed.Connection test output, verbatim:
bun run checkoutput, verbatim (exit 0):Final
scripts/verify fastexit 0. Its Rust gate summary, verbatim:Static stripped sizes were x86_64 21,225,872 B (delta +0 B) and aarch64 19,427,688 B (delta +0 B), both at their existing caps.
Receipts: connection test log, TypeScript check log, production journal counts, full fast gate log.
Closed by the orchestrator during the 2026-10-28 handover (#254), on the owner's request to close finished issues. Evidence: Liveness retirement fix deployed web-only at
857823ce4(ancestor of dev and prod); production journal showed zero stream closes after deploy. Reopen if anything is still missing.kayg referenced this issue2026-10-28 17:53:55 +00:00