[BUG] Terminal retirement loses notification or mediator CPU evidence #5
Labels
No labels
bug
ci
docs
duplicate
enhancement
help wanted
invalid
performance
phase-6
question
refactor
security
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
erix/procd#5
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Terminal retirement can publish an incomplete local result: ordinary processes are marked terminal before a fallible visible-event queue write, and mediator retirement discards its managed record without retaining the final CPU counters. These paths prevent reliable final status/accounting delivery when native observations become explicitly acknowledged.
Reproduction
Source-audited baseline: Procd
ac8a12993bc8cbf134a11e141e459cb63df71123,src/processes_lifecycle.rs,retire_process_event. For an ordinary managed process, fill its visible-event queue and deliver an exact terminal event. For a mediator, retire the exact managed generation and then query its terminal CPU counters. These are deterministic producer-state inputs; a baseline VM reproduction has not been performed.Expected and actual behavior
Expected: capacity refusal precedes cleanup effects, a terminal marker denotes a complete notification/accounting commit, and mediator scalar counters survive capability cleanup until their authorized observation is discharged. Native acknowledgement must follow the complete local commit.
Actual in the published source: the ordinary path marks the row terminal before
push_visible_process_eventcan returnBUSY; a repeated event then takes the already-terminal return. The mediator path callsretire_realm_custody, which empties the row, then returns an unpersisted terminal copy without querying CPU counters. Neither path supports the required reliable acknowledged observation.Environment and identity
ac8a12993bc8cbf134a11e141e459cb63df71123; x86_64 host producer controls, Rust 1.97.1.Evidence and prior checks
Published lifecycle source and published realm cleanup establish the two ordering/lifetime defects. The implementation now has producer controls for full queues, lost acknowledgements, failed counter queries, mediator cleanup, original supervisor death and native ID reuse. The first updated default host suite passes 299 tests. Full strict validation, original CI and coherent service VM acceptance remain pending; this report is not a claim of complete runtime acceptance.
Tracking
Related: Kernel terminal-accounting design, Procd WIP PR, and Phase 6 completion.
Reserve local publication storage before effects, preserve final scalar evidence after mediator authority disposal, and acknowledge only a fully committed exact-generation observation. Keep regressions for lost replies, independent queue saturation, original consumer loss and reused identities. Retain the open runtime and CI acceptance gates.
Committed terminal-accounting consumers — 21 September 2026:
Procd 66934642c4464fc738152a9e60790914ba27dd1c in WIP PR 2 reserves notification/crash/cleanup storage before effects, obtains exact final CPU evidence, commits local status and cleanup obligations, then acknowledges on every actual event polling path. Lost acknowledgement replies preserve the local result without duplicate counters or notifications. Mediators retain only scalar counters and the original authenticated supervisor identity after disposing all capability columns; supervisor death discharges the pending scalar observation and a replacement cannot inherit it. Four strict 299/305-test configurations, native builds, Clippy and private rustdoc pass. Original CI 298/299 passes from four complete hashed logs, 347,245 bytes, zero warnings. Bug 5 remains open for actual service acceptance.
Rootd 64c97b13c450003d9c2b6bd9ed2a627088684b46 in WIP PR 2 acknowledges bootstrap evidence only after exact native destruction and local endpoint absence; both operations remain unavailable after temporary Process custody transfers to Procd. Four strict 430/429-test configurations, native builds, Clippy and private rustdoc pass. Original 1039/1040 exposed bug 7: a stale source-call inventory and its matching semantic operation declarations. The correction explicitly inventories acknowledgement consumers and preserves the same temporary route and eventual Procd owner. All 64 Python controls, production-boundary, semantic baseline, threat model, phase contract and operation-ownership gates pass. Corrected original CI 1041/1042 passes from four complete verified logs, 222,969 bytes, zero warnings. Bug 7 is corrected; failed original runs remain retained without reruns or weaker gates.
Docs e4525848ad4462901c9a6794ef1794cf85ea9e6b updates the native contract, Procd/Rootd consumer custody and original signed IPC API references. Selector 55 is retired in both the detailed contract and summary; 58/59/60 are cross-checked against the shared registry. All 45 documentation tests and generated-reference checks pass. The complete 2,431-page manual builds without warnings; changed prose, selector and API pages pass visual review. Original documentation CI 995/996 and corrected-table 997/998 passes from eight complete logs, 1,549,628 bytes, with zero warnings in the final LaTeX passes. The 37 earlier convergence candidates per manual log are retained and resolved.
The separate Integration orchestration library checkpoint b06dfad00202765491a64552dde29eaca1c24838 passes four strict 320/321-test host/native configurations. Full service catalogs remain on their prior coherent graph while 35 remaining application/service repositories adopt the original shared revisions. Integration 1697/1698 remains running, and 1699/1700 plus 1701/1702 waits at the latest bounded observations. These are pending full regressions, not successful runtime acceptance.
No new canonical acceptance leaf is closed: 15/460 and 3.48% weighted. Ordinary Launchd metric-consumer restart/disposal semantics, coherent service CPU/profiler VMs, complete realm/provider authority and I/O, source/effect/frame proof, Pagerd, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. The static audit finds 3,162 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 173 direct missing-docs gates and 92 conventional crate roots; this does not establish semantic authority or complete private-documentation closure.
Terminal selector documentation reconciliation — 21 September 2026:
Signed Procd 68748bc65ea3fb798e810d624845dcb298ae1346 removes stale operation 55 prose and documents observation 59 plus exact acknowledgement 60. All runtime inputs are byte-identical to the validated consumer implementation; its four strict 299/305-test configurations remain applicable. Original documentation-checkpoint CI 300/301 passes from four complete hashed logs (347,266 bytes, zero warnings).
Ordinary consumer loss/restart and final reply disposition remain audited acceptance gaps. Failed ordinary metrics transport currently terminates Procd; it is not evidence of continued execution and row reuse. Full service CPU/profiler VM acceptance, complete realm lifecycle and both guest build generations remain open.
Actual service CPU scenarios and startup admission — 21 September 2026:
The published original Integration catalog
dff878dd3545c4751b3c05d37b2bdd5e21cce548passes the maintained shell times, two-CPU Extop and out-of-session denial VM scenarios under their unchanged 120-second guest limits. Each retains 106 hashed evidence files, warning-free image builds, empty QEMU stderr and every required, forbidden, ordered and unique marker check. Build-plus-scenario wall times are 119.876978, 34.802620 and 36.173027 seconds respectively; these are not guest-only or startup measurements.Times reports nonzero self and waited-child CPU. Extop observes both CPUs, memory and increasing job CPU nanoseconds with
CTRL no; both per-CPU percentages remain--.--%in the two samples, so numeric utilization is unproven. The denial scenario confirms the existing out-of-session boundary. Complete mediator/lifecycle acceptance in Procd 5 remains open.A separate ordinary development package also builds without warnings, but its required startup-contract preflight exits 1 before any VM or observer starts. Integration 69 records the missing full-runtime-transition contract selections and Kernel effective-feature/original-source evidence. Preserve the refused package and all admission controls; the 120/15/10 capture limits and performance thresholds are unchanged. No startup-profile acceptance is awarded. Complete source/effect/frame and Pagerd proof, native external Rust/LLVM/runtime rebuilding and both full EriX guest build generations remain required by Phase 6 completion.
Coherent scalar-consumer validation — 21 September 2026: signed Integration 07c883525ee5 selects Procd 59ee30a88534 in both complete catalogs. All 171 maintained helper commands pass without warnings; unchanged orchestration inputs retain four strict matrices. Five actual service VMs pass: shell CPU accounting, exec successor replacement, two-CPU read-only inspection, out-of-session denial and guarded realm preparation. Each preserves 106 hashed evidence files, clean QEMU stderr, warning-free image builds and all original markers under the unchanged 120-second guest limit. The build-plus-scenario times are 119.746880, 38.325332, 35.346729, 35.773237 and 55.339698 seconds respectively; these are not guest performance measurements. Inspection reports increasing job CPU counters with control disabled; numeric CPU utilization remains unproven.
Procd's four strict 308/314-test configurations and original CI 302/303 pass. The manual update passes 45 tests, all 2,431 pages, 450,185 word bounds and changed-page visual review. Original Docs CI 1003/1004 passes from four complete logs (774,710 bytes); retained reference-convergence warnings resolve to zero on final passes. All 3,166 authored code files remain below 1,000 lines.
Original Integration 1701/1702 remains running; 1703–1710 remains queued. Logd 240 remains failed with terminal logs unavailable through HTTP 500; no cause is inferred. No original job was restarted or cancelled. Remaining lifecycle control/event ownership, complete native fault/cleanup acceptance and the measured startup timing failures remain open. No whole acceptance leaf closes: 15/460, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain inside EriX and using it in the required full EriX guest-build generations remain mandatory and unproven.