J448: reconnect after a network change runs ~0.75 RTT over D375 (4 RTT + 50 ms)

kayg commented

2026-11-09 16:07:46 +00:00

Owner

J448, from #447 (J407): after a network change, reconnect-until-typable takes 1469.6 ms at 300 ms RTT on quiet dev-02 (tracer scenario row reconnect_network_change), against the D375/D267 budget of 4 RTT + 50 ms = 1370 ms. The resumed-link reconnect is in budget (328.8 ms).

Plan (about 3 h):

Trace the reconnect round trip by round trip (connect, upgrade, Hello/Resume/Welcome, attach + snapshot, replay paint, first input echo) and every timer and liveness wait, on a production tracer build through the latency proxy at 40, 150 and 300 ms RTT, against the protocol minimum.
Cut the excess without weakening the resume check (no change to resume-token validation; no 0-RTT data).
Red on origin/dev, green on the branch, with J407's row (branch latency-targets-120hz, 174127529) at all three RTTs; before/after per step; resumed-link and first paint must not regress.
verify quick, then verify fast.

Branch: fix-reconnect-new-link from origin/dev.

J448, from #447 (J407): after a network change, reconnect-until-typable takes 1469.6 ms at 300 ms RTT on quiet dev-02 (tracer scenario row `reconnect_network_change`), against the D375/D267 budget of 4 RTT + 50 ms = 1370 ms. The resumed-link reconnect is in budget (328.8 ms). Plan (about 3 h): 1. Trace the reconnect round trip by round trip (connect, upgrade, Hello/Resume/Welcome, attach + snapshot, replay paint, first input echo) and every timer and liveness wait, on a production tracer build through the latency proxy at 40, 150 and 300 ms RTT, against the protocol minimum. 2. Cut the excess without weakening the resume check (no change to resume-token validation; no 0-RTT data). 3. Red on origin/dev, green on the branch, with J407's row (branch `latency-targets-120hz`, 174127529) at all three RTTs; before/after per step; resumed-link and first paint must not regress. 4. `verify quick`, then `verify fast`. Branch: `fix-reconnect-new-link` from origin/dev.

kayg commented

2026-11-09 17:06:09 +00:00

Author

Owner

Start: branch fix-reconnect-new-link from origin/dev 5eb968744. Trace venue: dev-02, production tracer build behind scripts/latency_proxy.py (TCP relay, no DNS/TLS: the test double is plain ws://localhost), J407's branch merged locally plus temporary performance.mark probes (not committed).

Finding 1: one isolated reconnect is already at the protocol minimum, 3 round trips. Per-step trace of one forced drop at 300 ms RTT (ms from the drop click):

step	ms	round trips
retry timer (fast recovery, 5–10 ms jitter)	0.1 → 12.4	0
WebSocket upgrade (TCP to the relay is local; HTTP 101 crosses the link)	12.4 → 303.8	1
Hello + Resume + AttachTerm + Credit + Resize sent in one flight on `open`	303.9	0 (pipelined)
server Hello, Welcome, Ack, replay; attach confirmed; marker key sent	597.6 → 598.7	1
marker echo painted ("typable")	912.1	1

At 150 ms: 11.6 connect → 190.7 open → 367.6 Welcome → 561.4 echo painted. No liveness check, backoff or extra auth round trip sits on the path: the resume token rides in the first message, and attach is pipelined with it.

Isolated drops (each waits for the previous resume to finish), n=20 per RTT:

RTT	p50	p99	budget 4 RTT+50
300	929.7	963.8	1370	PASS

Log: dev-02:~/.cache/codex-scratch/j448/evidence/trace2-rtt300-170437.log.

Finding 2 (in progress): the 1426–1470 ms in J407's row come from how the scenario paces drops. The scenario polls #probe-results for Time to resume: <n> ms, but a forced drop does not clear the previous number, so the poll returns at once with the previous sample and the next drop is clicked while the current resume is still running. With the same pacing my first trace also gave p50 1431 / p99 1530.7 at 300 ms (trace-rtt300-165143.log), and the samples repeat the previous value. Tracing now what a drop during an unfinished resume costs (whether it is a real client delay or only the measurement).

Start: branch `fix-reconnect-new-link` from origin/dev `5eb968744`. Trace venue: dev-02, production tracer build behind `scripts/latency_proxy.py` (TCP relay, no DNS/TLS: the test double is plain `ws://localhost`), J407's branch merged locally plus temporary `performance.mark` probes (not committed). **Finding 1: one isolated reconnect is already at the protocol minimum, 3 round trips.** Per-step trace of one forced drop at 300 ms RTT (ms from the drop click): | step | ms | round trips | |---|---|---| | retry timer (fast recovery, 5–10 ms jitter) | 0.1 → 12.4 | 0 | | WebSocket upgrade (TCP to the relay is local; HTTP 101 crosses the link) | 12.4 → 303.8 | 1 | | Hello + Resume + AttachTerm + Credit + Resize sent in one flight on `open` | 303.9 | 0 (pipelined) | | server Hello, Welcome, Ack, replay; attach confirmed; marker key sent | 597.6 → 598.7 | 1 | | marker echo painted ("typable") | 912.1 | 1 | At 150 ms: 11.6 connect → 190.7 open → 367.6 Welcome → 561.4 echo painted. No liveness check, backoff or extra auth round trip sits on the path: the resume token rides in the first message, and attach is pipelined with it. Isolated drops (each waits for the previous resume to finish), n=20 per RTT: | RTT | p50 | p99 | budget 4 RTT+50 | | |---|---|---|---|---| | 300 | 929.7 | 963.8 | 1370 | PASS | Log: `dev-02:~/.cache/codex-scratch/j448/evidence/trace2-rtt300-170437.log`. **Finding 2 (in progress): the 1426–1470 ms in J407's row come from how the scenario paces drops.** The scenario polls `#probe-results` for `Time to resume: <n> ms`, but a forced drop does not clear the previous number, so the poll returns at once with the *previous* sample and the next drop is clicked while the current resume is still running. With the same pacing my first trace also gave p50 1431 / p99 1530.7 at 300 ms (`trace-rtt300-165143.log`), and the samples repeat the previous value. Tracing now what a drop during an unfinished resume costs (whether it is a real client delay or only the measurement).

kayg commented

2026-11-09 17:26:19 +00:00

Author

Owner

Finding 2 confirmed: the over-budget samples span two reconnects. Scenario-paced trace at 300 ms (dev-02:~/.cache/codex-scratch/j448/evidence/overlap-rtt300-171339.log), ms from the first drop:

1880.5 drop            (2nd drop)
2206.4 open / AttachTerm sent
2490.8 Welcome, attach confirmed, marker "~" sent
2714.9 drop            (3rd drop: the button was enabled and the panel still showed the old number, so the loop clicked it)
3016.8 open
3311.7 replay Output carries the 2nd drop's "~" echo -> "done"

The 2nd drop's marker sample ends at 3312.7, measured from 1880.5: 1432 ms, which is two reconnects, not one. Samples from that run: 895, 895, 895 (stale repeats), then 1432, 1480, 1528, 1474, 1446.

Fix (commit 8b69b99ea): apps/tracer/src/perf-probe.ts. A forced drop shows "pending" until its own marker echo paints, the run and drop buttons stay disabled while a resume is being measured, and a marker that the terminal refused is forgotten. New unit test apps/tracer/src/perf-probe.test.ts: on dev's probe it fails 0/2 (Received: "Time to resume: 900.00 ms" where "pending" was expected; 1550.00 ms where 800 was expected), and with the fix it passes 2/2.

J407's row (terminal.spec.ts, INFRATERNAL_LATENCY_PROFILE=1, dev-02), red = origin/dev bd551e549 + latency-targets-120hz, green = this branch + latency-targets-120hz:

RTT	red p50 / p99	green p50 / p99	budget
300	1410.0 / 1442.5 FAIL	929.8 / 969.8 PASS	1370
150	478.2 / 539.6 PASS	465.1 / 533.4 PASS	770
40	scenario cannot run: it requires a measured RTT > 60 ms for prediction (`terminal-scenario.ts:118`, both red and green)		330

At 150 ms the overlap seldom happens: the marker echo usually returns before the 100 ms quiet timer re-enables the button. A 40 ms run with J407's loop alone (no prediction steps) is queued, along with a repeat at 300 ms and the phone first-paint row.

**Finding 2 confirmed: the over-budget samples span two reconnects.** Scenario-paced trace at 300 ms (`dev-02:~/.cache/codex-scratch/j448/evidence/overlap-rtt300-171339.log`), ms from the first drop: ``` 1880.5 drop (2nd drop) 2206.4 open / AttachTerm sent 2490.8 Welcome, attach confirmed, marker "~" sent 2714.9 drop (3rd drop: the button was enabled and the panel still showed the old number, so the loop clicked it) 3016.8 open 3311.7 replay Output carries the 2nd drop's "~" echo -> "done" ``` The 2nd drop's marker sample ends at 3312.7, measured from 1880.5: **1432 ms**, which is two reconnects, not one. Samples from that run: 895, 895, 895 (stale repeats), then 1432, 1480, 1528, 1474, 1446. **Fix (commit `8b69b99ea`):** `apps/tracer/src/perf-probe.ts`. A forced drop shows "pending" until its own marker echo paints, the run and drop buttons stay disabled while a resume is being measured, and a marker that the terminal refused is forgotten. New unit test `apps/tracer/src/perf-probe.test.ts`: on dev's probe it fails 0/2 (`Received: "Time to resume: 900.00 ms"` where "pending" was expected; `1550.00 ms` where 800 was expected), and with the fix it passes 2/2. J407's row (terminal.spec.ts, `INFRATERNAL_LATENCY_PROFILE=1`, dev-02), red = origin/dev `bd551e549` + `latency-targets-120hz`, green = this branch + `latency-targets-120hz`: | RTT | red p50 / p99 | green p50 / p99 | budget | |---|---|---|---| | 300 | 1410.0 / **1442.5 FAIL** | 929.8 / **969.8 PASS** | 1370 | | 150 | 478.2 / 539.6 PASS | 465.1 / 533.4 PASS | 770 | | 40 | scenario cannot run: it requires a measured RTT > 60 ms for prediction (`terminal-scenario.ts:118`, both red and green) | | 330 | At 150 ms the overlap seldom happens: the marker echo usually returns before the 100 ms quiet timer re-enables the button. A 40 ms run with J407's loop alone (no prediction steps) is queued, along with a repeat at 300 ms and the phone first-paint row.

kayg commented

2026-11-09 17:57:31 +00:00

Author

Owner

Round-trip breakdown, one reconnect after a forced drop (production tracer build, latency proxy, dev-02; ms from the drop click; first isolated drop of each run; logs dev-02:~/.cache/codex-scratch/j448/evidence/trace-rtt{40,150,300}-*.log, trace2-rtt300-170437.log):

step	what crosses the link	40 ms	150 ms	300 ms
DNS	none: `localhost` (a real page reuses its cached host lookup)	0	0	0
retry timer	D259 fast recovery, 5–10 ms jitter; no backoff after a forced drop or a welcomed link	13.3	11.6	12.4
TCP	the relay accepts locally, so the venue does not model it	0	0	0
TLS	none: the test double is plain `ws://`	0	0	0
WebSocket upgrade	HTTP 101: 1 RTT	37.4	190.7	303.8
auth/session check + host attach + snapshot	Hello(RESUME_NEXT) + Resume token + AttachTerm + Credit + Resize go in one flight on `open`; Hello, Welcome, Ack and the replay come back together: 1 RTT	60.6	368.0	598.5
first input accepted, echo painted	marker key → echo → next 60 Hz paint: 1 RTT + up to one frame	96.3	561.4	912.1

The protocol minimum on this venue is 3 RTT (upgrade, resume, echo), and that is what one reconnect takes. No liveness check gates the path: the probes start after Welcome and do not delay attach. There is no separate auth request, because the resume token rides in the first message, and the snapshot (replay) comes with the attach reply. Nothing on the path is excess, so I cut nothing. The 1426–1470 ms came from the probe's sampling (findings 2 and 3 above).

What the venue does not show (for the orchestrator/owner, no change made):

The relay hides TCP and TLS, which are 2 RTT in a real deployment. Behind TLS, the same probe end point (echo painted) is TCP + TLS + upgrade + resume + echo = 5 RTT. D267's 4 RTT counts up to the resume (input accepted), not the echo. So at 300 ms a real-network reconnect measured this way is about 1500 + 50 ms, over 4 RTT + 50. On this venue the row has 2 RTT of slack and would not catch a one-RTT regression.
TLS session resumption does not save a round trip in TLS 1.3. 0-RTT early data is not offered for a browser's WebSocket upgrade, and the upgrade carries the session cookie, so it would not be replay-safe anyway. TCP Fast Open is not available to pages. 3 RTT before the first application byte is the floor. With the token in the first message, 4 RTT to "input accepted" is the floor, which matches D267.
The only further real cut: keys typed during the outage are held until the replay is painted (releaseReplayResponsesAfterPaint → resendUnacknowledgedInput). If they rode in the same flight as Resume + AttachTerm, their echo would come back with the Welcome flight, which saves 1 RTT for those keys. That changes input ordering against the replay and the server's handling of frames before Welcome, which is protocol and auth-adjacent (CLAUDE.md priority 2). It needs its own design and review, so I have not done it here.
J407's scenario cannot run at 40 ms: it needs a measured RTT > 60 ms for prediction (terminal-scenario.ts:118).
J407's last-screen helper stops at the rAF timestamp (frame start). That timestamp can predate the click, which gives the 0.00 ms readings on the fixed branch.

**Round-trip breakdown, one reconnect after a forced drop** (production tracer build, latency proxy, dev-02; ms from the drop click; first isolated drop of each run; logs `dev-02:~/.cache/codex-scratch/j448/evidence/trace-rtt{40,150,300}-*.log`, `trace2-rtt300-170437.log`): | step | what crosses the link | 40 ms | 150 ms | 300 ms | |---|---|---|---|---| | DNS | none: `localhost` (a real page reuses its cached host lookup) | 0 | 0 | 0 | | retry timer | D259 fast recovery, 5–10 ms jitter; no backoff after a forced drop or a welcomed link | 13.3 | 11.6 | 12.4 | | TCP | the relay accepts locally, so the venue does not model it | 0 | 0 | 0 | | TLS | none: the test double is plain `ws://` | 0 | 0 | 0 | | WebSocket upgrade | HTTP 101: **1 RTT** | 37.4 | 190.7 | 303.8 | | auth/session check + host attach + snapshot | Hello(RESUME_NEXT) + Resume token + AttachTerm + Credit + Resize go in **one flight** on `open`; Hello, Welcome, Ack and the replay come back together: **1 RTT** | 60.6 | 368.0 | 598.5 | | first input accepted, echo painted | marker key → echo → next 60 Hz paint: **1 RTT** + up to one frame | 96.3 | 561.4 | 912.1 | The protocol minimum on this venue is 3 RTT (upgrade, resume, echo), and that is what one reconnect takes. No liveness check gates the path: the probes start after Welcome and do not delay attach. There is no separate auth request, because the resume token rides in the first message, and the snapshot (replay) comes with the attach reply. **Nothing on the path is excess, so I cut nothing.** The 1426–1470 ms came from the probe's sampling (findings 2 and 3 above). **What the venue does not show (for the orchestrator/owner, no change made):** 1. The relay hides TCP and TLS, which are 2 RTT in a real deployment. Behind TLS, the same probe end point (echo painted) is TCP + TLS + upgrade + resume + echo = **5 RTT**. D267's 4 RTT counts up to the resume (input accepted), not the echo. So at 300 ms a real-network reconnect measured this way is about 1500 + 50 ms, over 4 RTT + 50. On this venue the row has 2 RTT of slack and would not catch a one-RTT regression. 2. TLS session resumption does not save a round trip in TLS 1.3. 0-RTT early data is not offered for a browser's WebSocket upgrade, and the upgrade carries the session cookie, so it would not be replay-safe anyway. TCP Fast Open is not available to pages. 3 RTT before the first application byte is the floor. With the token in the first message, 4 RTT to "input accepted" is the floor, which matches D267. 3. The only further real cut: keys typed during the outage are held until the replay is painted (`releaseReplayResponsesAfterPaint` → `resendUnacknowledgedInput`). If they rode in the same flight as Resume + AttachTerm, their echo would come back with the Welcome flight, which saves 1 RTT for those keys. That changes input ordering against the replay and the server's handling of frames before Welcome, which is protocol and auth-adjacent (CLAUDE.md priority 2). It needs its own design and review, so I have not done it here. 4. J407's scenario cannot run at 40 ms: it needs a measured RTT > 60 ms for prediction (`terminal-scenario.ts:118`). 5. J407's last-screen helper stops at the rAF timestamp (frame start). That timestamp can predate the click, which gives the 0.00 ms readings on the fixed branch.

kayg commented

2026-11-09 19:12:39 +00:00

Author

Owner

Progress: head eb4135818 pushed (test helper doc comments and a typecheck fix folded into the one commit). verify quick on dev-02: all rows PASS, QUICK_EXIT=0 (dev-02:~/.cache/codex-scratch/j448/evidence/verify-quick2.log). verify fast is running on dev-02, slot 2, since 19:12 UTC. compute01 had 9 queued. First paint, red vs green alternated 3x (p99 ms): red 184.7 / 217.2 / 159.1, green 180.3 / 166.4 / 143.5, so no regression (red-fp*/green-fp* logs). The resumed-link row (verify-latency.py, real agent PTY) runs no tracer code, so this change cannot move it.

Progress: head `eb4135818` pushed (test helper doc comments and a typecheck fix folded into the one commit). `verify quick` on dev-02: all rows PASS, `QUICK_EXIT=0` (`dev-02:~/.cache/codex-scratch/j448/evidence/verify-quick2.log`). `verify fast` is running on dev-02, slot 2, since 19:12 UTC. compute01 had 9 queued. First paint, red vs green alternated 3x (p99 ms): red 184.7 / 217.2 / 159.1, green 180.3 / 166.4 / 143.5, so no regression (`red-fp*`/`green-fp*` logs). The resumed-link row (`verify-latency.py`, real agent PTY) runs no tracer code, so this change cannot move it.

kayg commented

2026-11-10 09:42:03 +00:00

Author

Owner

Finish (J448). Head 17d45da23 on fix-reconnect-new-link: the probe fix eb4135818 merged with origin/dev 97928be8a. Pushed and confirmed with git ls-remote. Not merged.

Red/green on the new base (dev-02; red = origin/dev 97928be8a + latency-targets-120hz 6458fdcb5, green = this head + the same J407 head; the two differ only by this change; p50 / p99 ms):

RTT	J407 scenario row, red	green	J407 drop loop alone, red	green	budget
300	1433.3 / 1480.6 FAIL	922.4 / 1815.9 FAIL (one outlier, see below)	1446.1 / 1553.0 FAIL	913.6 / 962.7 PASS	1370
150	479.4 / 569.7 PASS	476.3 / 557.7 PASS	480.2 / 514.4 PASS	489.0 / 559.9 PASS	770
40	scenario cannot run (needs RTT > 60 ms, `terminal-scenario.ts:118`)		132.3 / 211.3 PASS	146.9 / 196.1 PASS	330

The row is red only at 300 ms. At 150 and 40 ms the marker echo usually lands before the 100 ms quiet timer re-enables the drop button, so the overlap seldom happens.
Green outlier: one of 20 samples in one green scenario run read 1815.9 ms; that run's p50 was 922.4 ms. Three traced green scenario runs at 300 ms, 60 samples, did not reproduce it: p99 1016.8 / 993.0 / 956.5, all PASS. The slowest traced sample (1016.8) is upgrade 351 + resume 306 + echo 313 + a two-frame paint wait. That is proxy jitter, not a timer or an extra round trip. Since p99 of n=20 is the maximum, a single outlier fails the row. Logs: r3-green-rtt300-044707.log (outlier), tr{1,2,3}-rtt300-*.log (traced).
Excess round trips cut: none, because there are none on this path (breakdown above: upgrade 1 RTT, Hello + Resume + AttachTerm in one flight 1 RTT, echo 1 RTT; no backoff, liveness gate or separate auth request). The over-budget numbers were the probe's sampling, which this branch fixes. The protocol-level cut that remains (sending keys typed during the outage in the same flight as Resume, which saves 1 RTT for those keys only) is protocol and auth-adjacent. I left it for a design decision (comment above, item 3).
No regressions: phone first paint p99, red vs green alternated 3x: 184.7/217.2/159.1 vs 180.3/166.4/143.5. The resumed-link row runs no tracer code.
Merge note for J407: latency-targets-120hz and this branch both touch perf-probe.ts next to forceDrop. The conflict is trivial: keep J407's armIdleTimeout above this branch's forceDrop doc. Resolved that way for these runs, and the tsc and unit tests pass.

verify quick (dev-02, 17d45da23): every row PASS, QUICK_EXIT=0.

verify fast (dev-02, HEAD 17d45da23c9d309656336c235728b35681b38781; compute01 and dev-02 queues were both empty, and the target stays on dev-02 as asked):

src/mesh-review-resync.test.ts:
(pass) review watch applies same-revision authoritative resync [0.07ms]
(pass) authoritative resync keeps priority over an equal-revision pending list [1.49ms]

src/desktop-input.test.ts:
(pass) coordinates reject bands/outside edges and retain subpixel density [0.09ms]
(pass) physical keys, modifiers and committed layout text have distinct encodings [0.14ms]
(pass) wheel units become bounded signed native pixel deltas [0.05ms]
(pass) Unicode scalar extension roundtrips and rejects surrogate/out-of-range text [0.23ms]
(pass) server control state is a bounded boolean envelope [0.04ms]
(pass) shortcut release follows its press after modifiers change [0.04ms]

src/stream.test.ts:
stream differential: 239 streams, 25599 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3089.85ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [3.08ms]

src/mesh-vectors.test.ts:
(pass) every shared Mesh action vector passes through the typed client unchanged [1.14ms]
(pass) shared Mesh event vectors drive the typed watch adapter [5.71ms]

src/desktop.test.ts:
(pass) desktop fixed fields and borrowed video roundtrip [0.38ms]
(pass) desktop semantics reject nonfinite coordinates and invalid input before encoding [0.14ms]
desktop rejection differential: 1376 cases, zero divergences
(pass) desktop Rust and TypeScript agree on malformed lengths, flags and mutations [60.56ms]

 50 pass
 0 fail
 77253 expect() calls
Ran 50 tests across 13 files. [3.22s]
VERIFY_EXIT=0

Static sizes (report only): x86 28328824 bytes (+60384 vs the gate baseline), aarch64 25428888 bytes (+50384 vs baseline). This branch changes no Rust. The delta is dev's drift against the gate's stored baseline. Privileged integration: SKIP (no change to install, proxy, mesh or shim code).

Evidence: dev-02:~/.cache/codex-scratch/j448/evidence/ (verify-fast.log, verify-quick2.log, r3-*, tr*, *-fp*).

**Finish (J448).** Head `17d45da23` on `fix-reconnect-new-link`: the probe fix `eb4135818` merged with origin/dev `97928be8a`. Pushed and confirmed with `git ls-remote`. Not merged. **Red/green on the new base** (dev-02; red = origin/dev `97928be8a` + `latency-targets-120hz` `6458fdcb5`, green = this head + the same J407 head; the two differ only by this change; p50 / p99 ms): | RTT | J407 scenario row, red | green | J407 drop loop alone, red | green | budget | |---|---|---|---|---|---| | 300 | 1433.3 / **1480.6 FAIL** | 922.4 / 1815.9 FAIL (one outlier, see below) | 1446.1 / **1553.0 FAIL** | 913.6 / **962.7 PASS** | 1370 | | 150 | 479.4 / 569.7 PASS | 476.3 / 557.7 PASS | 480.2 / 514.4 PASS | 489.0 / 559.9 PASS | 770 | | 40 | scenario cannot run (needs RTT > 60 ms, `terminal-scenario.ts:118`) | | 132.3 / 211.3 PASS | 146.9 / 196.1 PASS | 330 | - The row is red only at 300 ms. At 150 and 40 ms the marker echo usually lands before the 100 ms quiet timer re-enables the drop button, so the overlap seldom happens. - **Green outlier:** one of 20 samples in one green scenario run read 1815.9 ms; that run's p50 was 922.4 ms. Three traced green scenario runs at 300 ms, 60 samples, did not reproduce it: p99 1016.8 / 993.0 / 956.5, all PASS. The slowest traced sample (1016.8) is upgrade 351 + resume 306 + echo 313 + a two-frame paint wait. That is proxy jitter, not a timer or an extra round trip. Since p99 of n=20 is the maximum, a single outlier fails the row. Logs: `r3-green-rtt300-044707.log` (outlier), `tr{1,2,3}-rtt300-*.log` (traced). - **Excess round trips cut: none, because there are none on this path** (breakdown above: upgrade 1 RTT, Hello + Resume + AttachTerm in one flight 1 RTT, echo 1 RTT; no backoff, liveness gate or separate auth request). The over-budget numbers were the probe's sampling, which this branch fixes. The protocol-level cut that remains (sending keys typed during the outage in the same flight as Resume, which saves 1 RTT for those keys only) is protocol and auth-adjacent. I left it for a design decision (comment above, item 3). - **No regressions:** phone first paint p99, red vs green alternated 3x: 184.7/217.2/159.1 vs 180.3/166.4/143.5. The resumed-link row runs no tracer code. - **Merge note for J407:** `latency-targets-120hz` and this branch both touch `perf-probe.ts` next to `forceDrop`. The conflict is trivial: keep J407's `armIdleTimeout` above this branch's `forceDrop` doc. Resolved that way for these runs, and the tsc and unit tests pass. `verify quick` (dev-02, 17d45da23): every row PASS, `QUICK_EXIT=0`. `verify fast` (dev-02, `HEAD 17d45da23c9d309656336c235728b35681b38781`; compute01 and dev-02 queues were both empty, and the target stays on dev-02 as asked): ``` src/mesh-review-resync.test.ts: (pass) review watch applies same-revision authoritative resync [0.07ms] (pass) authoritative resync keeps priority over an equal-revision pending list [1.49ms] src/desktop-input.test.ts: (pass) coordinates reject bands/outside edges and retain subpixel density [0.09ms] (pass) physical keys, modifiers and committed layout text have distinct encodings [0.14ms] (pass) wheel units become bounded signed native pixel deltas [0.05ms] (pass) Unicode scalar extension roundtrips and rejects surrogate/out-of-range text [0.23ms] (pass) server control state is a bounded boolean envelope [0.04ms] (pass) shortcut release follows its press after modifiers change [0.04ms] src/stream.test.ts: stream differential: 239 streams, 25599 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3089.85ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [3.08ms] src/mesh-vectors.test.ts: (pass) every shared Mesh action vector passes through the typed client unchanged [1.14ms] (pass) shared Mesh event vectors drive the typed watch adapter [5.71ms] src/desktop.test.ts: (pass) desktop fixed fields and borrowed video roundtrip [0.38ms] (pass) desktop semantics reject nonfinite coordinates and invalid input before encoding [0.14ms] desktop rejection differential: 1376 cases, zero divergences (pass) desktop Rust and TypeScript agree on malformed lengths, flags and mutations [60.56ms] 50 pass 0 fail 77253 expect() calls Ran 50 tests across 13 files. [3.22s] VERIFY_EXIT=0 ``` Static sizes (report only): x86 28328824 bytes (+60384 vs the gate baseline), aarch64 25428888 bytes (+50384 vs baseline). This branch changes no Rust. The delta is dev's drift against the gate's stored baseline. Privileged integration: SKIP (no change to install, proxy, mesh or shim code). Evidence: `dev-02:~/.cache/codex-scratch/j448/evidence/` (`verify-fast.log`, `verify-quick2.log`, `r3-*`, `tr*`, `*-fp*`).

kayg commented

2026-11-10 09:42:16 +00:00

Author

Owner

Correction: the verify fast block in my finish comment cut off the gate table. Here it is verbatim (dev-02:~/.cache/codex-scratch/j448/evidence/verify-fast.log, HEAD 17d45da23):

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| Nix Cargo vendoring       | PASS         |
| Nix release inputs        | PASS         |
| fmt                       | PASS         |
| migration names           | PASS         |
| migration tooling tests   | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| Traefik component manifest | PASS         |
| release component publication | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| gate architecture         | PASS         |
| doc coverage ratchet      | PASS         |
| shape lints off (D351)    | PASS         |
| doc comments on diff      | PASS         |
| fixed test waits          | PASS         |
| privileged integration    | SKIP         |
| probe release exclusion   | PASS         |
| nightly fuzz reporter     | PASS         |
| nightly browser suite reporter | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

VERIFY_EXIT=0

kayg commented

2026-11-10 09:46:47 +00:00

Author

Owner

On J468's reading of reconnect_network_change at 1435.8 ms against the 1370 gate on latency-targets-120hz (6458fdcb5): that branch does not contain this fix. Checked with git merge-base --is-ancestor eb4135818: no for both origin/latency-targets-120hz and origin/dev (3c0b20252). Without it the probe still shows the previous drop's number, so the loop clicks the next drop mid-resume and a sample spans two reconnects. 1435.8 sits right in that range (red on dev+J407: p50 1410–1446, p99 1442–1553 across 5 runs). The same J407 head with this branch merged reads p99 962.7–1016.8 at 300 ms (loop and traced scenario runs above).

To get the row green, merge fix-reconnect-new-link (17d45da23) together with or before latency-targets-120hz. The one conflict, in perf-probe.ts, is trivial: keep J407's armIdleTimeout, then this branch's forceDrop doc. Nothing of J448 is running on any VM, and the target and worktrees have been removed.

On J468's reading of `reconnect_network_change` at 1435.8 ms against the 1370 gate on `latency-targets-120hz` (6458fdcb5): that branch does not contain this fix. Checked with `git merge-base --is-ancestor eb4135818`: no for both `origin/latency-targets-120hz` and `origin/dev` (3c0b20252). Without it the probe still shows the previous drop's number, so the loop clicks the next drop mid-resume and a sample spans two reconnects. 1435.8 sits right in that range (red on dev+J407: p50 1410–1446, p99 1442–1553 across 5 runs). The same J407 head with this branch merged reads p99 962.7–1016.8 at 300 ms (loop and traced scenario runs above). To get the row green, merge `fix-reconnect-new-link` (17d45da23) together with or before `latency-targets-120hz`. The one conflict, in `perf-probe.ts`, is trivial: keep J407's `armIdleTimeout`, then this branch's `forceDrop` doc. Nothing of J448 is running on any VM, and the target and worktrees have been removed.

kayg commented

2026-11-10 15:09:06 +00:00

Author

Owner

J473 review start: reviewing fix-reconnect-new-link at 17d45da23c (fix eb4135818), with current origin/dev d7b2e4dc1 and latency-targets-120hz af543ecd6. Plan, about 45 minutes: inspect sample and failure lifecycles plus perf-only gating; reproduce the two tests red/green on dev-02; trial-merge both branches into current dev and run tracer unit tests; post verdict and D382 follow-up. No branch pushes. Per BRIEF-COMMON review rule, read author gate receipts rather than rerun verify quick/fast.

J473 review start: reviewing fix-reconnect-new-link at 17d45da23c9d309656336c235728b35681b38781 (fix eb4135818), with current origin/dev d7b2e4dc1 and latency-targets-120hz af543ecd6. Plan, about 45 minutes: inspect sample and failure lifecycles plus perf-only gating; reproduce the two tests red/green on dev-02; trial-merge both branches into current dev and run tracer unit tests; post verdict and D382 follow-up. No branch pushes. Per BRIEF-COMMON review rule, read author gate receipts rather than rerun verify quick/fast.

kayg commented

2026-11-10 15:12:13 +00:00

Author

Owner

J473 finding P2: the overlap fix is red 0/2 on current dev and green 2/2 on 17d45da23. A separate fake-clock check preserves a 60300 ms successful sample, but missing-marker-echo and no-attach cases never finish: after 60000 ms both still show "Dropping the socket and measuring the first resumed echo…", with drop disabled. Source has no resume deadline or failure path for either case; the key-run timeout only calls finishRun when runActive is true. Evidence: dev-02:~/.cache/codex-scratch/J473/evidence/{red.log,green.log,lifecycle.log,green/review-lifecycle.test.ts}. A bounded, explicit failed resume result must survive reporting, clean up the marker and release measurement state without accepting a late echo as the next sample. Trial merge into dev d7b2e4dc1 has the expected sole conflict next to forceDrop, resolved by keeping armIdleTimeout and the new forceDrop documentation. Unit checks in progress; no branch changes pushed.

J473 finding P2: the overlap fix is red 0/2 on current dev and green 2/2 on 17d45da23. A separate fake-clock check preserves a 60300 ms successful sample, but missing-marker-echo and no-attach cases never finish: after 60000 ms both still show "Dropping the socket and measuring the first resumed echo…", with drop disabled. Source has no resume deadline or failure path for either case; the key-run timeout only calls finishRun when runActive is true. Evidence: dev-02:~/.cache/codex-scratch/J473/evidence/{red.log,green.log,lifecycle.log,green/review-lifecycle.test.ts}. A bounded, explicit failed resume result must survive reporting, clean up the marker and release measurement state without accepting a late echo as the next sample. Trial merge into dev d7b2e4dc1 has the expected sole conflict next to forceDrop, resolved by keeping armIdleTimeout and the new forceDrop documentation. Unit checks in progress; no branch changes pushed.

kayg commented

2026-11-10 15:15:02 +00:00

Author

Owner

J473 verdict: REQUEST CHANGES on fix-reconnect-new-link at 17d45da23c9d309656336c235728b35681b38781 (fix eb4135818).

P2, blocking: a forced-drop measurement can lock the probe indefinitely. apps/tracer/src/perf-probe.ts:188–203,227–243,400–403 starts resumeStartedAt and disables both controls, but never arms a resume deadline. If attachment never succeeds, or attachment succeeds but the accepted marker never echoes (for example a terminal program with echo disabled), nothing clears the measurement or records failure. The key-run timeout is unrelated: it is only armed by run(), and finishRun() immediately returns when no key run is active. The new lock makes the latter case unrecoverable even though the terminal is connected and quiet.

Reproducer: the author's fake panel/terminal plus two fake-clock cases, advancing 60,000 ms after a drop with (a) no attachment, and (b) a resumed attachment with no painted marker. Both remain at Dropping the socket and measuring the first resumed echo…, report No painted key echoes yet., and keep drop disabled. Source inspection confirms there is no eventual timer beyond that interval. lifecycle.log: 3 pass, 2 fail (the 3 passes include the author's two tests). This is a lifecycle check, not a wall-clock performance assertion.

Required: terminate unavailable/never-echoing resumes as explicit failed measurements, retain the failure for the scenario/report rather than omit it from percentiles, and clean up the marker/timer and measurement lock. Late output from an expired sample must not finish a subsequent sample. Cover missing attach, missing echo, failure cleanup and late echo; keep the ordinary slow-success path honest. The refused-marker cleanup itself is correct and shows an error message, but should use the same explicit failure/reporting contract.

What passes review:

The normal path prevents the stale-number and second-click overlap. I independently ran the unchanged new test against current dev's probe: 0 pass / 2 fail, including stale 900.00 ms and misattributed 1550.00 ms; reviewed probe: 2 pass / 0 fail. Both files and logs are attached.
An additional slow-success test records 60300.00 ms after a 60-second fake reconnect plus a 300 ms echo; the second click is ignored and both buttons remain locked until completion. Successful slow samples are not clipped or reset by this fix.
Product runtime behavior is isolated behind the existing ?probe=1 flag: main.ts:482,618–619 constructs the probe/hooks only there. The module is statically bundled, so this is runtime flag isolation, not compile-out. This branch changes only the probe and its unit test; no terminal, reconnect, auth or protocol implementation changes.

Trial merge: current origin/dev was d7b2e4dc1bf767787b05e4ce287d885841f7aa5f. Merged reviewed 17d45da23, then latency-targets-120hz / #447 at af543ecd609630e8aa3a7b943236bea88ccaa7a1, in a detached local review worktree. Sole conflict: next to forceDrop in perf-probe.ts; kept #447's armIdleTimeout and this branch's expanded forceDrop doc. Trial head 46fb0830977a980020914506f2881a900752d4ca, resolution attached. Nothing pushed.

On dev-02, through build-slot/nice/nix, with CARGO_INCREMENTAL=0 and CARGO_BUILD_JOBS=3:

bun run check: exit 0.
bun run build: exit 0.
bun test --isolate ./src ./precompress.test.ts ./browser-build.test.ts ./docs-build.test.ts ./chunk-classes.test.ts ./test/*.test.ts ./real/*.test.ts: 1004 pass, 1 fail, 7 errors; 1005 tests across 153 files; exit 1. The two probe tests pass in this trial.
Same build and test command on unmodified dev d7b2e4dc1: 1002 pass, 1 fail, 7 errors; 1003 tests across 152 files; exit 1. Same failure: dead-session-transfer-review.test.ts, deferred Brotli 50876 > 45056 bytes on dev and 50915 > 45056 in the combined trial. Same seven unhandled document is not defined errors at packages/ui/src/host-icons.ts:55. Thus the broad suite is not green, and these failures reproduce without either reviewed branch. The combined +39 bytes is not attributable to #478 alone.
Initial setup runs omitted vendored dist files during transfer; those runs are not qualification results. Restored them, verified SHA256SUMS, and then produced the *-ready.log results above. The non-isolated initial run also exposed shared module mocks; the matched baseline/trial comparison uses --isolate.

D382: the stopwatch endpoint fits: forced drop through resumed attach to the first marker echo painted. The branch does not establish the new deployment budget: the author's numbers use a plain-WS loopback relay without TCP/TLS handshake latency, and #447 still gates that endpoint at 4 * roundTripBoundMs + 50. Follow-up must run WSS behind real TLS with TCP handshake latency represented on the shaped link, preserve this echo endpoint, and update the network-change target/report/docs to resume's 4 RTT + one echo RTT + 50 ms (5 RTT + 50; nominal 1550 ms at 300 ms RTT, or 1700 ms with #447's 330 ms bound). Rerun the required sample count there and keep timeouts/failures visible. No auth/input-ordering optimization is needed or authorized by D382. The reported ~957–1017 ms plain-WS p99 values demonstrate the sampling correction, not D382 compliance; I did not rerun those performance measurements.

Author gate, read rather than rerun per BRIEF-COMMON's reviewer exception: dev-02:~/.cache/codex-scratch/j448/evidence/verify-fast.log, reviewed head 17d45da23, copied to the review evidence directory. Table verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| Nix Cargo vendoring       | PASS         |
| Nix release inputs        | PASS         |
| fmt                       | PASS         |
| migration names           | PASS         |
| migration tooling tests   | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| Traefik component manifest | PASS         |
| release component publication | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| gate architecture         | PASS         |
| doc coverage ratchet      | PASS         |
| shape lints off (D351)    | PASS         |
| doc comments on diff      | PASS         |
| fixed test waits          | PASS         |
| privileged integration    | SKIP         |
| probe release exclusion   | PASS         |
| nightly fuzz reporter     | PASS         |
| nightly browser suite reporter | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
VERIFY_EXIT=0

Review evidence lives at /home/kayg/.cache/codex-scratch/J473/evidence/ and dev-02:~/.cache/codex-scratch/J473/evidence/; selected raw receipts and the lifecycle reproducer are attached. No repository implementation edits, branch pushes, deployment or issue closure. Review did not rerun verify quick/fast. VM target/worktree cleanup follows the completed tests.

J473 verdict: **REQUEST CHANGES** on `fix-reconnect-new-link` at `17d45da23c9d309656336c235728b35681b38781` (fix `eb4135818`). **P2, blocking: a forced-drop measurement can lock the probe indefinitely.** `apps/tracer/src/perf-probe.ts:188–203,227–243,400–403` starts `resumeStartedAt` and disables both controls, but never arms a resume deadline. If attachment never succeeds, or attachment succeeds but the accepted marker never echoes (for example a terminal program with echo disabled), nothing clears the measurement or records failure. The key-run timeout is unrelated: it is only armed by `run()`, and `finishRun()` immediately returns when no key run is active. The new lock makes the latter case unrecoverable even though the terminal is connected and quiet. Reproducer: the author's fake panel/terminal plus two fake-clock cases, advancing 60,000 ms after a drop with (a) no attachment, and (b) a resumed attachment with no painted marker. Both remain at `Dropping the socket and measuring the first resumed echo…`, report `No painted key echoes yet.`, and keep drop disabled. Source inspection confirms there is no eventual timer beyond that interval. `lifecycle.log`: **3 pass, 2 fail** (the 3 passes include the author's two tests). This is a lifecycle check, not a wall-clock performance assertion. Required: terminate unavailable/never-echoing resumes as explicit failed measurements, retain the failure for the scenario/report rather than omit it from percentiles, and clean up the marker/timer and measurement lock. Late output from an expired sample must not finish a subsequent sample. Cover missing attach, missing echo, failure cleanup and late echo; keep the ordinary slow-success path honest. The refused-marker cleanup itself is correct and shows an error message, but should use the same explicit failure/reporting contract. **What passes review:** - The normal path prevents the stale-number and second-click overlap. I independently ran the unchanged new test against current dev's probe: **0 pass / 2 fail**, including stale `900.00 ms` and misattributed `1550.00 ms`; reviewed probe: **2 pass / 0 fail**. Both files and logs are attached. - An additional slow-success test records **60300.00 ms** after a 60-second fake reconnect plus a 300 ms echo; the second click is ignored and both buttons remain locked until completion. Successful slow samples are not clipped or reset by this fix. - Product runtime behavior is isolated behind the existing `?probe=1` flag: `main.ts:482,618–619` constructs the probe/hooks only there. The module is statically bundled, so this is runtime flag isolation, not compile-out. This branch changes only the probe and its unit test; no terminal, reconnect, auth or protocol implementation changes. **Trial merge:** current `origin/dev` was `d7b2e4dc1bf767787b05e4ce287d885841f7aa5f`. Merged reviewed `17d45da23`, then `latency-targets-120hz` / #447 at `af543ecd609630e8aa3a7b943236bea88ccaa7a1`, in a detached local review worktree. Sole conflict: next to `forceDrop` in `perf-probe.ts`; kept #447's `armIdleTimeout` and this branch's expanded `forceDrop` doc. Trial head `46fb0830977a980020914506f2881a900752d4ca`, resolution attached. Nothing pushed. On dev-02, through build-slot/nice/nix, with CARGO_INCREMENTAL=0 and CARGO_BUILD_JOBS=3: - `bun run check`: **exit 0**. - `bun run build`: **exit 0**. - `bun test --isolate ./src ./precompress.test.ts ./browser-build.test.ts ./docs-build.test.ts ./chunk-classes.test.ts ./test/*.test.ts ./real/*.test.ts`: **1004 pass, 1 fail, 7 errors; 1005 tests across 153 files; exit 1**. The two probe tests pass in this trial. - Same build and test command on unmodified dev `d7b2e4dc1`: **1002 pass, 1 fail, 7 errors; 1003 tests across 152 files; exit 1**. Same failure: `dead-session-transfer-review.test.ts`, deferred Brotli **50876 > 45056 bytes** on dev and **50915 > 45056** in the combined trial. Same seven unhandled `document is not defined` errors at `packages/ui/src/host-icons.ts:55`. Thus the broad suite is not green, and these failures reproduce without either reviewed branch. The combined +39 bytes is not attributable to #478 alone. - Initial setup runs omitted vendored dist files during transfer; those runs are not qualification results. Restored them, verified SHA256SUMS, and then produced the `*-ready.log` results above. The non-isolated initial run also exposed shared module mocks; the matched baseline/trial comparison uses `--isolate`. **D382:** the stopwatch endpoint fits: forced drop through resumed attach to the first marker echo painted. The branch does **not** establish the new deployment budget: the author's numbers use a plain-WS loopback relay without TCP/TLS handshake latency, and #447 still gates that endpoint at `4 * roundTripBoundMs + 50`. Follow-up must run WSS behind real TLS with TCP handshake latency represented on the shaped link, preserve this echo endpoint, and update the network-change target/report/docs to resume's **4 RTT + one echo RTT + 50 ms** (5 RTT + 50; nominal 1550 ms at 300 ms RTT, or 1700 ms with #447's 330 ms bound). Rerun the required sample count there and keep timeouts/failures visible. No auth/input-ordering optimization is needed or authorized by D382. The reported ~957–1017 ms plain-WS p99 values demonstrate the sampling correction, not D382 compliance; I did not rerun those performance measurements. **Author gate, read rather than rerun per BRIEF-COMMON's reviewer exception:** `dev-02:~/.cache/codex-scratch/j448/evidence/verify-fast.log`, reviewed head `17d45da23`, copied to the review evidence directory. Table verbatim: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | Nix Cargo vendoring | PASS | | Nix release inputs | PASS | | fmt | PASS | | migration names | PASS | | migration tooling tests | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | Traefik component manifest | PASS | | release component publication | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | gate architecture | PASS | | doc coverage ratchet | PASS | | shape lints off (D351) | PASS | | doc comments on diff | PASS | | fixed test waits | PASS | | privileged integration | SKIP | | probe release exclusion | PASS | | nightly fuzz reporter | PASS | | nightly browser suite reporter | PASS | | static builds | PASS | +---------------------------+--------------+ VERIFY_EXIT=0 ``` Review evidence lives at `/home/kayg/.cache/codex-scratch/J473/evidence/` and `dev-02:~/.cache/codex-scratch/J473/evidence/`; selected raw receipts and the lifecycle reproducer are attached. No repository implementation edits, branch pushes, deployment or issue closure. Review did not rerun verify quick/fast. VM target/worktree cleanup follows the completed tests.

J473-review-evidence.zip

83 KiB

kayg commented

2026-11-10 15:15:53 +00:00

Author

Owner

J473 cleanup complete: dev-02 /home/claude/worktrees/J473 (including its sole target directory) removed after all commands exited. Evidence retained outside the checkout; J473-review-evidence.zip is attached to verdict comment 89632. No test server or browser was started, and nothing was pushed.

kayg commented

2026-11-10 15:23:46 +00:00

Author

Owner

J448c round 2 starting on fix-reconnect-new-link, base 17d45da23c, isolated checkout /home/kayg/Developer/Worktrees/infraternal/t3-c77461c5 (detached while the branch is checked out by J448). Plan: red-first lifecycle tests for no attach/no echo and late output; add a bounded explicit FAIL result with cleanup; tracer unit suite, quick and fast on compute01; commit/push this branch only and report receipts. Estimate: 90 minutes including shared build queue, with gate queue time uncertain. No deployment or integration merge.

J448c round 2 starting on fix-reconnect-new-link, base 17d45da23c9d309656336c235728b35681b38781, isolated checkout /home/kayg/Developer/Worktrees/infraternal/t3-c77461c5 (detached while the branch is checked out by J448). Plan: red-first lifecycle tests for no attach/no echo and late output; add a bounded explicit FAIL result with cleanup; tracer unit suite, quick and fast on compute01; commit/push this branch only and report receipts. Estimate: 90 minutes including shared build queue, with gate queue time uncertain. No deployment or integration merge.

kayg referenced this issue

2026-11-10 15:23:46 +00:00

D382: validate reconnect echo budget with real TLS and modelled TCP handshake #488

kayg commented

2026-11-10 15:28:39 +00:00

Author

Owner

J448c finding and fix: the resume stopwatch had no deadline independent of a key run. Red-first fake-clock tests reproduce both no-attach and no-echo failures, plus marker-refusal reporting: 3 pass / 3 fail. Current targeted green run: 6 pass / 0 fail, 31 assertions, including a 60300.00 ms success, one reconnect per sample, timeout cleanup, disposal and late-marker isolation. These are deterministic lifecycle assertions, not wall-clock performance claims.

The new deadline is 120000 ms, over 70× the 1700 ms 300 ms-RTT-plus-jitter worst-case bound and above the reviewed minute-long slow-success case. Every failure is counted as FAIL and remains in the copyable panel report (cumulative count plus latest duration/reason), including after later successes. Each sample uses a unique printable marker matched across painted chunks, so an expired echo cannot complete a later sample. Buttons unlock once the measurement ends, subject to the existing connected/quiet requirement; a disconnected terminal remains unavailable until attachment.

D382 follow-up opened separately as #488. No TLS/budget changes in this round. Unit red/green artifacts: compute01 and control host /.cache/codex-scratch/j448c/evidence/{red,green}.log. Quick, tracer units and fast are queued sequentially on compute01 as explicitly requested (launcher PID 4018429; one slot at a time); logs live in compute01:/.cache/codex-scratch/j448c/evidence/. One target: /home/claude/worktrees/j448c/target, removed at finish. No integration merge or deployment.

J448c finding and fix: the resume stopwatch had no deadline independent of a key run. Red-first fake-clock tests reproduce both no-attach and no-echo failures, plus marker-refusal reporting: 3 pass / 3 fail. Current targeted green run: 6 pass / 0 fail, 31 assertions, including a 60300.00 ms success, one reconnect per sample, timeout cleanup, disposal and late-marker isolation. These are deterministic lifecycle assertions, not wall-clock performance claims. The new deadline is 120000 ms, over 70× the 1700 ms 300 ms-RTT-plus-jitter worst-case bound and above the reviewed minute-long slow-success case. Every failure is counted as FAIL and remains in the copyable panel report (cumulative count plus latest duration/reason), including after later successes. Each sample uses a unique printable marker matched across painted chunks, so an expired echo cannot complete a later sample. Buttons unlock once the measurement ends, subject to the existing connected/quiet requirement; a disconnected terminal remains unavailable until attachment. D382 follow-up opened separately as #488. No TLS/budget changes in this round. Unit red/green artifacts: compute01 and control host ~/.cache/codex-scratch/j448c/evidence/{red,green}.log. Quick, tracer units and fast are queued sequentially on compute01 as explicitly requested (launcher PID 4018429; one slot at a time); logs live in compute01:~/.cache/codex-scratch/j448c/evidence/. One target: /home/claude/worktrees/j448c/target, removed at finish. No integration merge or deployment.

red.log

2.3 KiB

green.log

866 B

kayg commented

2026-11-10 15:30:54 +00:00

Author

Owner

J448c fix committed and pushed: b539991a0c on fix-reconnect-new-link. git ls-remote origin refs/heads/fix-reconnect-new-link confirms that exact SHA. compute01 checkout matches both changed-file SHA256 digests and has no tracked changes. Targeted probe tests: 6 pass, 0 fail; tracer typecheck exit 0. Red/green logs attached to the prior progress comment. Quick/full tracer unit suite/fast remain queued on compute01, one slot at a time; no finish claim yet. D382 follow-up: #488.

J448c fix committed and pushed: b539991a0cd56942ffc66e6dd0a9d8f7f4c88771 on fix-reconnect-new-link. `git ls-remote origin refs/heads/fix-reconnect-new-link` confirms that exact SHA. compute01 checkout matches both changed-file SHA256 digests and has no tracked changes. Targeted probe tests: 6 pass, 0 fail; tracer typecheck exit 0. Red/green logs attached to the prior progress comment. Quick/full tracer unit suite/fast remain queued on compute01, one slot at a time; no finish claim yet. D382 follow-up: #488.

kayg commented

2026-11-10 15:37:12 +00:00

Author

Owner

J448c compute01 update, pushed head b539991a0c: quick pre-check passed (QUICK_EXIT=0). Production tracer build passed. Full isolated tracer unit command completed with 990 pass, 1 fail, 7 errors across 152 files; UNIT_EXIT=1. Failure: dead-session production canvas fits the deferred Brotli budget. Seven errors: document is not defined from packages/ui/src/host-icons.ts. J473 documented both failure classes independently; I will run the matching unmodified origin/dev comparison after fast completes, without overlapping build slots. All six probe lifecycle tests pass in the broad run. Full fast is now compiling on compute01. Receipts: ~/.cache/codex-scratch/j448c/evidence/{quick,tracer-unit,verify-fast}.log on compute01.

J448c compute01 update, pushed head b539991a0cd56942ffc66e6dd0a9d8f7f4c88771: quick pre-check passed (QUICK_EXIT=0). Production tracer build passed. Full isolated tracer unit command completed with 990 pass, 1 fail, 7 errors across 152 files; UNIT_EXIT=1. Failure: dead-session production canvas fits the deferred Brotli budget. Seven errors: document is not defined from packages/ui/src/host-icons.ts. J473 documented both failure classes independently; I will run the matching unmodified origin/dev comparison after fast completes, without overlapping build slots. All six probe lifecycle tests pass in the broad run. Full fast is now compiling on compute01. Receipts: ~/.cache/codex-scratch/j448c/evidence/{quick,tracer-unit,verify-fast}.log on compute01.

quick.log

9.4 KiB

tracer-unit.log

118 KiB

typecheck.log

36 B

kayg commented

2026-11-10 16:10:02 +00:00

Author

Owner

J448c remains on pushed head b539991a0c. No implementation edits since that commit. The compute01 final gate is still active in CLI plugin compile-out, which runs three compilation/test variants; recorded compiler children are active. This is a cold per-job target, not a hung probe test. Launcher PID 4018429, sole target /home/claude/worktrees/j448c/target. Full live log: compute01:~/.cache/codex-scratch/j448c/evidence/verify-fast.log. Quick/typecheck/broad unit logs are attached to comment 89753. The six probe lifecycle tests pass in both focused and broad runs.

A clean origin/dev comparison checkout is ready at /home/claude/worktrees/j448c-baseline, SHA 4889dfaf16, with verified vendor checksums; no baseline build slot is running concurrently. After fast finishes, I will run the same broad unit command there to qualify the deferred-budget failure and seven document-global errors, then attach results and remove the target. No final gate verdict yet; no integration merge or deployment.

J448c remains on pushed head b539991a0cd56942ffc66e6dd0a9d8f7f4c88771. No implementation edits since that commit. The compute01 final gate is still active in CLI plugin compile-out, which runs three compilation/test variants; recorded compiler children are active. This is a cold per-job target, not a hung probe test. Launcher PID 4018429, sole target /home/claude/worktrees/j448c/target. Full live log: compute01:~/.cache/codex-scratch/j448c/evidence/verify-fast.log. Quick/typecheck/broad unit logs are attached to comment 89753. The six probe lifecycle tests pass in both focused and broad runs. A clean origin/dev comparison checkout is ready at /home/claude/worktrees/j448c-baseline, SHA 4889dfaf16a95203882f745187bcb99368ca1a54, with verified vendor checksums; no baseline build slot is running concurrently. After fast finishes, I will run the same broad unit command there to qualify the deferred-budget failure and seven document-global errors, then attach results and remove the target. No final gate verdict yet; no integration merge or deployment.

kayg commented

2026-11-10 16:27:40 +00:00

Author

Owner

J448c self-review found a P11 concern in my new marker matcher: a rolling string window allocated on every painted byte. Replaced it with a bounded integer prefix position. The generated marker has ~ only at its ends, so mismatch recovery retains only a new leading ~; split and expired marker coverage still passes. Six focused tests, 31 assertions: 6 pass / 0 fail, receipt compute01:~/.cache/codex-scratch/j448c/evidence/green-index.log. No timing-performance claim or new dependency.

Refinement committed and pushed separately as 203f60909 (fix-reconnect-new-link). Current compute01 fast remains on the first commit b539991a0 and has passed clippy and reached workspace tests. I will let it finish safely, retain its log as an intermediate receipt, then run quick, the broad tracer units and fast on the final pushed head using the same target cache. The final finish will quote only that final-head gate, not the intermediate run. Clean origin/dev baseline comparison remains queued after the branch checks, without overlapping slots. No merge or deployment.

J448c self-review found a P11 concern in my new marker matcher: a rolling string window allocated on every painted byte. Replaced it with a bounded integer prefix position. The generated marker has `~` only at its ends, so mismatch recovery retains only a new leading `~`; split and expired marker coverage still passes. Six focused tests, 31 assertions: 6 pass / 0 fail, receipt compute01:~/.cache/codex-scratch/j448c/evidence/green-index.log. No timing-performance claim or new dependency. Refinement committed and pushed separately as 203f60909 (fix-reconnect-new-link). Current compute01 fast remains on the first commit b539991a0 and has passed clippy and reached workspace tests. I will let it finish safely, retain its log as an intermediate receipt, then run quick, the broad tracer units and fast on the final pushed head using the same target cache. The final finish will quote only that final-head gate, not the intermediate run. Clean origin/dev baseline comparison remains queued after the branch checks, without overlapping slots. No merge or deployment.

kayg commented

2026-11-10 16:39:08 +00:00

Author

Owner

Correction to J448c progress: advancing to the next gate row did not mean the workspace test row passed; verify records a failure and continues. Intermediate b539991a0 fast has a Rust failure in remote_client::tests::idle_timers::copy_cost::udp_drop_receipt_counts_only_owned_live_sockets at crates/infraternal-agent/src/remote_mesh_copy_cost_tests.rs:128: observed Number(2), expected 1. Package result: 292 passed, 1 failed, 23 ignored. Raw receipt: compute01:~/.cache/codex-scratch/j448c/evidence/verify-fast.log, lines 2499–2516. No Rust code changed in this job.

The initial gate is still compiling the shim variant and must not be called green. Final pushed head is 203f60909a, which still needs its complete gate rerun. I will report this intermediate failure even if that final run passes, and qualify on unmodified dev if it persists. The separate broad tracer-unit failure and seven document-global errors also remain tracked for baseline comparison.

Correction to J448c progress: advancing to the next gate row did not mean the workspace test row passed; verify records a failure and continues. Intermediate b539991a0 fast has a Rust failure in remote_client::tests::idle_timers::copy_cost::udp_drop_receipt_counts_only_owned_live_sockets at crates/infraternal-agent/src/remote_mesh_copy_cost_tests.rs:128: observed Number(2), expected 1. Package result: 292 passed, 1 failed, 23 ignored. Raw receipt: compute01:~/.cache/codex-scratch/j448c/evidence/verify-fast.log, lines 2499–2516. No Rust code changed in this job. The initial gate is still compiling the shim variant and must not be called green. Final pushed head is 203f60909ad404dc68beb3fe5717a1482aed67d3, which still needs its complete gate rerun. I will report this intermediate failure even if that final run passes, and qualify on unmodified dev if it persists. The separate broad tracer-unit failure and seven document-global errors also remain tracked for baseline comparison.

kayg commented

2026-11-10 16:50:56 +00:00

Author

Owner

J448c timing update: the original 90-minute estimate is being exceeded by cold native/release gate builds on compute01. The sole launcher has been running about 82 minutes including its queued quick/unit phases, and is now in probe release exclusion after shim checks. It is active, not waiting on the probe timeout tests. I expect roughly another 60–75 minutes for remaining cold static builds, the cached final-head gate/unit rerun, and the unmodified-dev unit comparison; this remains within the original 2× estimate guard for now. No additional implementation scope or unrelated Rust fix is being taken on.

Pushed final implementation head remains 203f60909a. Single target remains /home/claude/worktrees/j448c/target and will be removed after checks. Current intermediate fast has the explicitly recorded UDP test failure from comment 89837; it is not green. The final report will retain that failure and quote the final-head gate separately.

J448c timing update: the original 90-minute estimate is being exceeded by cold native/release gate builds on compute01. The sole launcher has been running about 82 minutes including its queued quick/unit phases, and is now in probe release exclusion after shim checks. It is active, not waiting on the probe timeout tests. I expect roughly another 60–75 minutes for remaining cold static builds, the cached final-head gate/unit rerun, and the unmodified-dev unit comparison; this remains within the original 2× estimate guard for now. No additional implementation scope or unrelated Rust fix is being taken on. Pushed final implementation head remains 203f60909ad404dc68beb3fe5717a1482aed67d3. Single target remains /home/claude/worktrees/j448c/target and will be removed after checks. Current intermediate fast has the explicitly recorded UDP test failure from comment 89837; it is not green. The final report will retain that failure and quote the final-head gate separately.

kayg commented

2026-11-10 16:56:53 +00:00

Author

Owner

The exact UDP test that failed in the intermediate full gate passed when rerun alone from the same already-compiled test executable: 1 passed, 0 failed, 315 filtered out; UDP_FOCUSED_EXIT=0. No Rust source, dependency, binary or build flags changed. This focused retry is investigation evidence only; it does not turn the intermediate full gate green and does not replace the final-head full gate. Receipt: compute01:~/.cache/codex-scratch/j448c/evidence/udp-focused-retry.log.

The intermediate gate is now compiling static builds. Final implementation remains pushed at 203f60909a.

The exact UDP test that failed in the intermediate full gate passed when rerun alone from the same already-compiled test executable: 1 passed, 0 failed, 315 filtered out; UDP_FOCUSED_EXIT=0. No Rust source, dependency, binary or build flags changed. This focused retry is investigation evidence only; it does not turn the intermediate full gate green and does not replace the final-head full gate. Receipt: compute01:~/.cache/codex-scratch/j448c/evidence/udp-focused-retry.log. The intermediate gate is now compiling static builds. Final implementation remains pushed at 203f60909ad404dc68beb3fe5717a1482aed67d3.

Rows
Columns

J448: reconnect after a network change runs ~0.75 RTT over D375 (4 RTT + 50 ms) #478