[BUG] Deferred native cleanup waits for idle intake and stalls behind one owner #3

New issue

Closed

opened 2026-09-18 01:28:17 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-18 01:28:17 +02:00

Owner

Summary

Deferred native process destruction depended on idle request intake, and an
unacknowledged queue head prevented independent queued cleanup attempts. This
could delay reclaiming already-terminal process records. The correction gives
one retained owner a turn before intake and rotates unsuccessful attempts.

Reproduction

At Procd 4e233515341067f6b6d3503db0acb61da6d54422, inspect
src/process_cleanup.rs and the idle-only destruction call in
src/runtime_loop.rs: the queue loop stops at its first failure and runtime
dispatch reaches it only after an empty receive scan. These are source findings;
no new VM reproduction is claimed.

At corrected revision 507a98f53462b688d9008931aab09902713ed805, run
cargo test --locked --bin procd process_cleanup_tests. The eight controls
include a continuously ready intake callback, distinct queued generations,
repeated failure, full-ring rotation, canonical absence and malformed identity.

Expected and actual behavior

Each deferred native owner should receive an independent attempt without waiting
for idle intake. Failure must preserve its original generation and first error;
only a correlated native cleanup acknowledgment permits removal. Previously the
head could monopolize subsequent attempts and ready intake skipped them. The
corrected controls observe exactly one native attempt before each ready receive
and allow a later owner to complete while its predecessor remains unresolved.

Environment and identity

Component: Procd; affected and corrected revisions are recorded above.
Image and Integration graph: no new image or consumer VM acceptance claimed.
Host validation: x86_64 Linux, Rust 1.97.1, default/all-feature dev/release.
Native builds: x86_64-unknown-none with repository linkers and fatal warnings.
Authority: existing held Process endpoint and retained terminal-generation pair;
the change grants no capability and adds no process selector.
Last known working revision: not established.

Evidence and prior checks

The signed correction passes 263/268 main units, five probe controls and forty
native builds, formatting, strict Clippy and private-item rustdoc. All eight
queue controls pass. Original CI 284 and CI 285 pass from all four complete logs (337,764 bytes), without warnings. Native call
count per turn is bounded; elapsed time, legacy receive/provider progress and
complete realm fairness are not established by these controls. Existing native
cleanup receipt validation remains unchanged.

Tracking

Related: process design and
implementation review.
The signed correction and complete original component CI close this bounded
queue scheduling defect. Coordinated consumer VM execution, terminal/provider
progress and complete realm fairness remain requirements in the linked design.

## Summary Deferred native process destruction depended on idle request intake, and an unacknowledged queue head prevented independent queued cleanup attempts. This could delay reclaiming already-terminal process records. The correction gives one retained owner a turn before intake and rotates unsuccessful attempts. ## Reproduction At Procd `4e233515341067f6b6d3503db0acb61da6d54422`, inspect `src/process_cleanup.rs` and the idle-only destruction call in `src/runtime_loop.rs`: the queue loop stops at its first failure and runtime dispatch reaches it only after an empty receive scan. These are source findings; no new VM reproduction is claimed. At corrected revision `507a98f53462b688d9008931aab09902713ed805`, run `cargo test --locked --bin procd process_cleanup_tests`. The eight controls include a continuously ready intake callback, distinct queued generations, repeated failure, full-ring rotation, canonical absence and malformed identity. ## Expected and actual behavior Each deferred native owner should receive an independent attempt without waiting for idle intake. Failure must preserve its original generation and first error; only a correlated native cleanup acknowledgment permits removal. Previously the head could monopolize subsequent attempts and ready intake skipped them. The corrected controls observe exactly one native attempt before each ready receive and allow a later owner to complete while its predecessor remains unresolved. ## Environment and identity - Component: Procd; affected and corrected revisions are recorded above. - Image and Integration graph: no new image or consumer VM acceptance claimed. - Host validation: x86_64 Linux, Rust 1.97.1, default/all-feature dev/release. - Native builds: x86_64-unknown-none with repository linkers and fatal warnings. - Authority: existing held Process endpoint and retained terminal-generation pair; the change grants no capability and adds no process selector. - Last known working revision: not established. ## Evidence and prior checks The signed correction passes 263/268 main units, five probe controls and forty native builds, formatting, strict Clippy and private-item rustdoc. All eight queue controls pass. Original [CI 284](https://git.erikinkinen.fi/erix/procd/actions/runs/284) and [CI 285](https://git.erikinkinen.fi/erix/procd/actions/runs/285) pass from all four complete logs (337,764 bytes), without warnings. Native call count per turn is bounded; elapsed time, legacy receive/provider progress and complete realm fairness are not established by these controls. Existing native cleanup receipt validation remains unchanged. ## Tracking Related: [process design](https://git.erikinkinen.fi/erix/procd/issues/1) and [implementation review](https://git.erikinkinen.fi/erix/procd/pulls/2). The signed correction and complete original component CI close this bounded queue scheduling defect. Coordinated consumer VM execution, terminal/provider progress and complete realm fairness remain requirements in the linked design.

erikinkinen added the

bug

phase-6

labels

2026-09-18 01:28:17 +02:00

erikinkinen referenced this issue

2026-09-18 01:31:52 +02:00

[FEATURE] Audit authority, code quality and documentation in procd #1

erikinkinen referenced this issue

2026-09-18 01:31:55 +02:00

WIP: Guard mediator construction and Launchd admission #2

erikinkinen closed this issue