From 14b2d066eddeb162d8ccee67a64633324361b0e8 Mon Sep 17 00:00:00 2001 From: "Joshua D. Drake" Date: Mon, 3 Aug 2026 20:02:04 -0600 Subject: [PATCH] test: measure the cancel guard against the timeout floor, not half the load The full five-major matrix at 488a2c0 came back green on PG15, PG16, PG18 and PG19 and red on PG17, on native_cancel's "cancel arrives well before the load completes". The cancellation worked every time: the server log shows the statement cancelled by statement_timeout in each run. What failed is the threshold. The check was cancel < full / 2. cancel cannot go below the timeout itself, so that is only a real threshold while full is comfortably more than twice the timeout. At full=155 it leaves 27 ms of headroom above a 50 ms floor, and PG17 measured 64-82 ms against PG18's stable 63-64, failing two runs in three. That is a threshold reporting the box rather than the guard, which is the specific thing this project does not want a gate to do. Measure against the window the guard actually distinguishes instead: cancel fires during the load (just after the timeout) or only after it (converging on full), so require cancel in the lower half of the interval between those two. Self-calibrating in both directions and it cannot be squeezed by a fast box. PG17 now passes 4 runs of 4, having passed 1 of 3 before. Proven by removal, and the removal found that the comment was wrong about which guard this covers. Deleting the per-column-chunk CHECK_FOR_INTERRUPTS in columnar_native_load_group() leaves the suite green: a two-column group reaches it twice. The guard that matters is COLUMNAR_DECODE_INTERRUPT in columnar_encoding.c, the per-value decode-loop check; disabling it makes cancel converge on full (151 ms against 150, and 157 against 154) and fails this check on both runs. Recorded in the suite so nobody removes the cheap guard on the strength of a green run here. Co-Authored-By: Claude Opus 5 (1M context) --- test/native_cancel.sh | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/test/native_cancel.sh b/test/native_cancel.sh index 0663e66..f8c867d 100755 --- a/test/native_cancel.sh +++ b/test/native_cancel.sh @@ -65,8 +65,34 @@ check "the short timeout is what fired" \ # Without interrupt checks in the load path the timeout cannot fire until the # load finishes, so cancel and full converge. With them it fires during the load. +# +# The yardstick is the window between the two outcomes, not a bare fraction of +# `full`. `cancel` cannot go below the timeout itself, so `full / 2` is only a +# real threshold while `full` is comfortably more than twice the timeout: at +# full=155 it leaves 27 ms of headroom above a 50 ms floor, and PG17 measured +# 64-82 ms against PG18's stable 63-64, failing two runs in three on hardware +# where the cancel worked correctly every time. That is a threshold reporting the +# box, not the guard. +# +# What the guard actually distinguishes: cancel fires *during* the load (just +# after the timeout) or only *after* it (converging on `full`). So require cancel +# to land in the lower half of the interval between those two, which is +# self-calibrating in both directions and cannot be squeezed by a fast box. +# +# Which guard this actually proves, established by removing each one rather than +# from the description above: it is COLUMNAR_DECODE_INTERRUPT in +# columnar_encoding.c, the per-value decode-loop check on a 65536 stride, not the +# per-column-chunk CHECK_FOR_INTERRUPTS in columnar_native_load_group(). Deleting +# the per-chunk check leaves this suite green, because a two-column group reaches +# it only twice; disabling the decode-loop macro makes cancel converge on full +# (151 ms against 150) and fails this check, which is the behaviour the paragraph +# above predicts. Stated so the next person does not remove the cheap guard on the +# strength of a green run here. +TIMEOUT_MS=50 +limit=$(( TIMEOUT_MS + (full - TIMEOUT_MS) / 2 )) check_timing "cancel arrives well before the load completes" \ - "$( [ "$cancel" -lt $(( full / 2 )) ] && echo yes || echo "no (cancel=${cancel}ms full=${full}ms)")" \ + "$( [ "$full" -gt $(( TIMEOUT_MS * 2 )) ] && [ "$cancel" -lt "$limit" ] && echo yes || + echo "no (cancel=${cancel}ms full=${full}ms limit=${limit}ms)")" \ "yes" pgc_summary