Bound notification readers before authorization and dispatch - #207
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Allowed idle notification clients could create an unbounded reader goroutine per connection. Each unit listener now reserves one of 64 connection slots before PID authorization or reader creation. Excess connections close without an acceptance banner, and a slot remains held through reader/close completion. Existing notification authorization still applies to admitted connections.
Portable and real Windows-pipe regressions fail on the old implementation when the 65th client is accepted. The final tests also prove 65 denied clients do not leak slots, admitted native clients have the expected process identity, overload does not perform authorization, releasing one slot permits READY delivery, and cancellation joins saturated readers. Twenty complete notification-package repetitions passed (3.026s); full uncached race tests passed (manager 59.559s, journal 40.720s, notify 1.766s), plus vet, Windows/Linux staticcheck and complete diff/privacy/link review. The documented session-map bound is corrected to the existing 4096-entry implementation.
Exact source
4855ce8c90fc2676f608ef778371592fd6a117e5passed all Windows/Linux lanes in CI 34769236108. Consolidated native qualification passed all 61 manager/journal/timer/notification cases three times per SYSTEM and headless standard-user identity, with no skips. Four binary hashes, source/module identity and final process/profile/linger cleanup were verified and retained privately. The existing broker and real pilot remained unchanged. R2 acceptance remains open pending final audit/evidence publication.