From b32d9850a16dad6fb0045f287c8556ba4664eaa5 Mon Sep 17 00:00:00 2001 From: PLN <78331+PLN@users.noreply.github.com> Date: Sun, 13 Sep 2026 18:13:52 +0200 Subject: [PATCH] Record qualified lifecycle diagnostics and recovery cancellation --- docs/MILESTONES.md | 4 +-- docs/R2-EVIDENCE.md | 59 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 61 insertions(+), 2 deletions(-) diff --git a/docs/MILESTONES.md b/docs/MILESTONES.md index 5bcc1b6..fa36dbc 100644 --- a/docs/MILESTONES.md +++ b/docs/MILESTONES.md @@ -48,8 +48,8 @@ Exit gate: real-process tests cover deletion, invalid replacement, recreation wh Status: in progress (handler migration, bounded admission and snapshots delivered; complete writer/invariant acceptance pending). Closure depends on preserved R1.1-R1.3 ownership/cleanup invariants, not completion of unrelated R1.4 or R4 qualification. Outcome: one state owner, concurrent I/O, explicit operation identity. - [ ] **R2.1 Records/events:** bounded immutable snapshots include units, active operations and accepted system user-host ownership, with host-scoped instance IDs and policy revisions. Native liveness remains a separate observation. Complete coordinator-wide identity-bearing event coverage. [Native snapshot evidence](R2-EVIDENCE.md#system-user-host-snapshot-qualification), [snapshot contract](OPERATIONS.md). -- [ ] **R2.2 Coordinator:** timer and session/admission/linger policy now use serialized decision handlers. Finish the complete [writer audit](LIFECYCLE-WRITERS.md), including I/O boundaries and completion authority, using the Design section 2 contract. Preserve independent blocking I/O and prohibit transaction-result replay. [Policy acceptance](R2-EVIDENCE.md#user-policy-and-cleanup-admission-acceptance). -- [ ] **R2.3 Scheduling:** ordinary/diagnostic/stop overload and completion progress passed combined control tests; reserved maintenance quiesced real workloads with all 128 ordinary connections occupied. Native linger revocation has reserved admission, and retired-SID/reload cleanup requests are bounded and coalesced. [Control acceptance](R2-EVIDENCE.md#control-overload-and-reserved-maintenance-acceptance), [native-work acceptance](R2-EVIDENCE.md#user-policy-and-cleanup-admission-acceptance). Remaining: complete the full worker-class audit. Handler extraction alone does not satisfy this gate. +- [ ] **R2.2 Coordinator:** timer and session/admission/linger policy now use serialized decision handlers; transition diagnostics and adapter error observations preserve independent progress. Finish the complete [writer audit](LIFECYCLE-WRITERS.md), including I/O boundaries and completion authority, using the Design section 2 contract. Preserve independent blocking I/O and prohibit transaction-result replay. [Policy acceptance](R2-EVIDENCE.md#user-policy-and-cleanup-admission-acceptance), [diagnostic acceptance](R2-EVIDENCE.md#nonblocking-lifecycle-diagnostics-and-error-observations). +- [ ] **R2.3 Scheduling:** ordinary/diagnostic/stop overload and completion progress passed combined control tests; reserved maintenance quiesced real workloads with all 128 ordinary connections occupied. Native linger revocation has reserved admission, retired-SID/reload cleanup requests are bounded and coalesced, and canceled recovery releases obsolete gate waits. [Control acceptance](R2-EVIDENCE.md#control-overload-and-reserved-maintenance-acceptance), [native-work acceptance](R2-EVIDENCE.md#user-policy-and-cleanup-admission-acceptance), [recovery acceptance](R2-EVIDENCE.md#canceled-recovery-worker-acceptance). Remaining: complete the full worker-class audit. Handler extraction alone does not satisfy this gate. - [ ] **R2.4 Operations:** Remaining to close: reconcile coordinator-wide lifetime coverage. Explicit start/restart cancellation preserves successfully completed members; accepted stops continue cleanup. Accepted operation contexts, deadlines, disconnection behavior and bounded history are delivered; history is intentionally nonpersistent. [Contract](OPERATIONS.md), [evidence](R2-EVIDENCE.md#accepted-operation-lifetimes). - [ ] **R2.5 Interleavings:** Remaining to close: complete the invariant/operation-sequence matrix through public paths and delayed adapters; replace overlapping handler-only tests rather than duplicating them. Track the [race-suite budget](TEST-HARDENING.md). diff --git a/docs/R2-EVIDENCE.md b/docs/R2-EVIDENCE.md index 41be48a..3b4f729 100644 --- a/docs/R2-EVIDENCE.md +++ b/docs/R2-EVIDENCE.md @@ -1,5 +1,64 @@ # R2 initial evidence +## Nonblocking lifecycle diagnostics and error observations + +These September 13 candidates passed exact-source Windows/Linux CI and isolated +LTSC build 26100 qualification. Each selected case ran ten times per SYSTEM and +headless standard-user identity, with no skips. Both fixtures removed their units, +linger grants and helper/user-manager processes and confirmed profile release. +Binary/source hashes, raw logs and cleanup observations are retained privately. + +| Change | Tested source and CI | Cases per identity; SYSTEM/user seconds | Equal-tree merge | +| --- | --- | --- | --- | +| PR #202: bounded transition diagnostics | `2d0f6f3dc45eff130fc23415d35c5d51d933b7e3`, [CI](https://github.com/PLN/winunitd/actions/runs/34765837025) | 6; 5.603/2.527 | `de0c901c97f00228dab60efa17abd59b38620530` | +| PR #203: adapter error observations | `dd515c8bf09dbb8ca7a0682132920c520fa0a583`, [CI](https://github.com/PLN/winunitd/actions/runs/34766883282) | 10; 2.569/1.121 | `726c3a7444c6d2abbdb93c2cf8d342d3b6471233` | + +Illegal transitions previously called the console logger while holding the +lifecycle mutex. Rejected transitions now preserve the accepted state and enqueue +a `daemon`/`err` journal record carrying invocation and manager-origin identity. +Messages are capped at 4096 UTF-8 bytes, with truncation marked. A shared diagnostic +group uses the existing 4 MiB/12,288-record allowance and aggregate journal budgets; +storage pressure reports loss through the existing counters. No additional writer +class is created, and accepted records remain owned through journal close. + +Four manager and two journal cases cover blocked console output, independent +snapshot/start/stop progress, persisted diagnostics, storage-stall pressure, +UTF-8 truncation and immutable invocation/origin identity. Concurrent origin +publication no longer acquires the storage mutex. This qualifies transition +diagnostics; broader daemon messages and Windows event resources remain R5 work. + +Adapter error formatting and start-error classification could also block the +decision mutex. Observations now happen before serialization, and acceptance +rechecks identity and cancellation afterward. Operation completion freezes +protocol classification before locking and joins manager-owned cancellation +causes at publication. Both new public lifecycle regressions fail on previous +main and pass with the fix. Companion cases cover failed/partial launch, late +stop outcomes, readiness/watchdog/exit cleanup, retained operation deadlines, +completed dependencies and linger-token recovery. Delayed adapters run under real +identities; this does not claim new S4U or process-launch mechanism qualification. + +The full lifecycle writer, worker-class and invariant audits remain R2 gates. + +## Canceled recovery worker acceptance + +PR #204 source `6591e9ac16f49a8c1a96bd68a19c5c433db4564a` passed +[exact-source CI](https://github.com/PLN/winunitd/actions/runs/34767502672) and +eight cases ten times per SYSTEM/headless standard-user identity on isolated LTSC +build 26100, in 9.957/9.123 seconds. No cases skipped; process/linger/profile cleanup +passed. Merge `8a39dff81c4f5637208101ada5d9edab0b75e97c` has the tested tree. + +A newer explicit attempt could cancel recovery while keeping the unit gate, +leaving the obsolete recovery worker blocked. The strengthened existing regression +fails on the old implementation with the gate still held. Recovery now acquires +the gate using its accepted cancellation context and exits without waiting for +the newer native operation. Initial launch failures also admit recovery before +spawning, so duplicate requests allocate no worker. + +Six delayed-adapter cases cover stale recreated/replacement identity, gate +cancellation, captured backoff, stop/removal and start-limit exhaustion. Two cases +exercise actual native failure/backoff limits and fresh invocation identity on +restart. Full writer/worker-class acceptance remains separate. + ## User policy and cleanup admission acceptance The following September 13 candidates passed exact-source Windows/Linux CI and