driver: stale settled entry, poisoned-probe spin, corpse settlements, exception-exit hand-off (review) - #301
Merged
Merged
Conversation
…in, corpse settlements, exception-exit hand-off Adversarial correctness review of the export-call driver (boundary.ts) and its store-level helpers, judged against definitions.py's single-loop `canon_lift`/`Store.tick` model and arch §6. Each finding was confirmed by a store-level regression test that fails on the pre-fix tree. - F1 one settlement, one delivery. `noteAwaiting` records a settlement into `store.settled` EAGERLY; the P5 race-winner path then called `resumeWith` directly and left that entry queued. A body that re-parks synchronously inside `resumeWith` (a `waitUntil` returning without yielding on a pending cancel) is back in `awaiting` when the next `serviceSettled` runs, so the OLD value was delivered against the NEW park. The winner site now splices the thread's queued entries before resuming. (driver_stale_settled_test.ts) - F2 the deadlock probe's "a thread became READY" branch consulted `store.readyCandidates()` unfiltered while `tick` filtered poisoned instances, so a ready thread of a corpse made the probe re-arm every macrotask instead of trapping — silent hang plus CPU spin. The poison filter moves into `readyCandidates`; `tick`'s copy is deleted. (driver_poisoned_probe_test.ts) - F3 a poisoned instance's outstanding async import settled into the corpse: a fulfilment lowered results into its memory (possibly re-entering its realloc), a rejection parked on `store.hostFailure` and failed the next driver — a HEALTHY sibling's export call, contra arch §6 #173. The settle continuation's renounced-call guard now also covers a poisoned lowering instance. (poisoned_host_call_retire_test.ts) - F4 exit by exception is still an exit. `drive`'s throw path skipped `ensureSettlementPump`, orphaning a sibling's in-flight host call; `driveAsync`'s trap exit armed the pump only on real host calls, leaving a sibling's hop-park queued in `store.settled` where it gates every later driver's `tick` (#280's trace via the trap exit). `drive` hands off on throw; the pump's work predicate covers queued tails and hop-parked threads, racing the hop promises alongside the host calls. (driver_trap_exit_liveness_test.ts) - F6 the speculative `addPendingResumption(chosen)` collapsed with a genuine entry for the same thread (Set by identity) and the `finally` removed the only one; recorded as added only when this driver added it. Baseline 702 → 723 passed; conformance 1511 commands / 0 failed / 0 stale; sched-seeds green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adversarial correctness review of
main@ 396a216, driver track. Four confirmed findings in the export-call driver plus one cheap hazard, each pinned by a store-level regression test that fails on the pre-fix tree.store.settled; a synchronous re-park insideresumeWithgets the OLD value delivered against the NEW promise (double resume)driver_stale_settled_test.tsreadyCandidates()whiletickfilters poisoned instances → driver re-arms every macrotask forever instead of trappingdriver_poisoned_probe_test.tsstore.hostFailurefails a healthy sibling's next call (contra arch §6 #173)poisoned_host_call_retire_test.tsdrive's throw path skips the settlement pump;driveAsync's trap exit leaves a sibling hop-park queued instore.settled(the #280 trace via the trap path)driver_trap_exit_liveness_test.ts(2 tests)addPendingResumption(chosen)collapses with a genuine entry;finallyremoves the only oneMechanisms are in the commit message. Authorities: definitions.py
canon_lift/Store.tick/Thread.resume; docs/architecture.md §6 (one driver per store, #173).Gates:
just test-runtime723/0;just conformance1511 commands / 0 failed / 0 stale;just sched-seedsgreen; fulljust gatesgreen on the union of the five review PRs.Automerge armed. Sibling PRs from the same review: wait_until pending-cancel, transcoder u32, built-in index u32, host pump trap. Related open issues from the same track: #294 (F5, unconfirmed).