Repository navigation
Merge everything into main (staging) - #45
Merged
Merged
Conversation
…and exact mutant values Corrects A2.4 (G0 proves a dirty tree, not which mutant), A2.5 (G4b's real reason) and M9's scope as a negative control. Registers exact counts for M1/M2/M3/M8/M9, a G7 check after the sweep-2 probe, and the script's restore by bytes, pinned HEAD, whole-tree cleanliness, source-decided slot state, baseline equality, pinned env and warning-free M5. Nothing compiled or run.
…act values and baseline identity Per PREREG amendment 3 (77b6369). Harness: G7 also after the sweep-2 probe. firecheck.py: writes back the bytes it read (no git index lock) with SIGTERM and SIGHUP ignored meanwhile; pins HEAD and checks every verdict's sha; refuses any modified tracked file; decides the slot state from D200's marker symbol in src/; checks A3.2's exact values for M1/M2/M3/M8/M9; requires the two baselines' measured/slots/verdict lines to be identical; pins D16_PERSIST=1 and records RUSTFLAGS; saves build logs; exits 3 on a signal. M5 is warning-free. Nothing compiled or run.
…ocale-decoded text The sources hold non-ASCII; a text round trip depends on the locale's encoding and newline translation, either of which could leave a restored file differing from HEAD. Nothing compiled or run.
…t proposal, and the disk stores the largest entry a frame carries - a_membership_the_wire_cannot_carry_is_refused_at_proposal_and_never_reaches_the_log: 1025 learners; today on_propose appends it. - a_wal_batch_one_byte_over_a_frame_is_refused_at_proposal_and_one_at_the_limit_is_admitted: boundary pinned as literals (budget 8,388,531, WalBatch overhead 29); today the over case is appended. - the_largest_entry_one_frame_can_carry_is_storable_and_reads_back (tests_log): today the disk refuses it (MAX_ENTRY_BYTES sits ~4 KiB below the wire). Compile against 5a86ad8. Additions only; never compiled or run.
…, the disk-limit decision, counted send refusals, corrections (21 -> 13 bytes; M27 was killable), mutants M28-M34, before the fix
…est Q's stale 'count and nothing else' comment As registered in PREREG amendment 8 (7f6d6c5), re-review R4 and R5. Test E gains one premise assertion; test Q changes only its comment. Never compiled or run.
…k accepts all a frame carries; count every refused send - transport::admit_entry: encode_entry's own refusals (a configuration over MAX_CONFIG_NODES, a name over u16) and append_entries_budget; on_propose runs it before append_own_entry and refuses with Action::Refuse, so neither the in-memory tail nor the disk sees an entry the wire cannot carry. append_own_entry's doc names who admits for it. - log::MAX_ENTRY_BYTES = MAX_FRAME_BYTES (was - 4096): a disk frame is at most its wire entry + 8, so the disk now stores everything any frame can carry. Its check stays as the log's write/read pairing (MAX_FRAME), a condition strictly looser than admission, so neither masks the other. - Transport::send counts unencodable and unaddressable refusals (refused_after_stop already was), so node.rs's 'counted by the transport' is true; comments there, in send's doc and the module header say which meter. - replicate::slice_from's doc corrects the false 'never binds on an entry the log admitted'. Never compiled or run.
… entry no frame carries is still offered alone (T5) T4 needs the new accessors, so its red evidence is mutants M32/M33. T5 seeds around admission on purpose and kills M27, whose earlier 'survives by design' reason was false (PREREG amendment 8). Additions only; never compiled or run.
…s true From lane D73's observations (report section 9), verified by reading: - the module header said every way a message can be lost has a counter. Frames already handed to the kernel are untracked (TCP gives no receipt): a dying connection loses its buffers uncounted, including the first frame written after the peer's idle close. So do receive-side closes on an unknown tag, an undecodable or truncated frame. The header now says which losses are counted and which cannot be. - idle_deadline said closing costs only a reconnect. Followers send each other nothing while a leader holds, so their connections to each other are idle-closed, and a failover's first two campaign frames between survivors are lost (one uncounted, one lost_in_flight). - Counters: 'drops and refusals are counted' narrowed to those this transport decides on. Docs only; never compiled.
…ified (O-2 is D207, fixed; O-1 verified by reading; loss docs narrowed), mutants re-cut from 749d399
…s is the lane report
…could never fire; restore semantics Logs that A3.4's identity check was implied by per-baseline registration and its claim false; the check is removed. Registers blocking (not ignoring) signals during restore, an atomic restore that preserves a foreign edit as evidence, and exit-code precedence. Nothing compiled or run.
…, keeps foreign edits, drops a check that could not fire Per PREREG amendment 4 (d7823b1). Restore writes a sibling temp file and os.replace()s it, with SIGTERM/SIGHUP blocked (delivered after, not lost); a file changed by another writer mid-run is saved as evidence before HEAD's bytes go back, and the run stops. Terminated is a BaseException so no except-Exception can mislabel a signal; SIGINT exits 3; an interrupt verifies the last mutated file against HEAD. Refuses a failed D200 git grep and unknown VALUES keys; re-checks tree and HEAD before the final baseline. The baseline-identity comparison is removed: it was implied, so it could never fire. Nothing compiled or run.
…link arrives on the first attempt The link carries one frame, stays silent until the receiver idle-closes it (observed through idle_closed and live_inbound_conns), then one frame is sent. Today it is written into the closed connection and lost uncounted. Compiles against 1b8d290; additions only; never compiled or run.
…deadline/2 with its bounds, counters and mutants N1-N5, before the fix
…re writing, and redial if the peer closed it - sender_loop: before the first write after a gap of idle_probe_gap (idle_deadline / 2), a non-blocking peek for the peer's EOF (peer_has_closed). If the link is closed, it redials first and carries the frame to the new connection, so nothing is lost. Busy links never reach the gate. - idle_probe_gap documents both bounds: above the longest gap on a busy link (a heartbeat, 150 ms at the defaults, so the gate is 200 heartbeats away) and at most idle_deadline, under the stated premise of symmetric idle_deadline. It also names the residual race near the peer's close. - counters idle_probes and idle_redials, with accessors and Debug. - the idle close's comment no longer claims silence proves a peer is gone; D223's docs on the idle close's cost are updated. Never compiled or run.
…ol), an idle-closed link is probed once and redialled Both read the new counters, so their red evidence is the mutants N1-N5. Additions only; never compiled or run.
…mic apply, one verified exit path Nothing compiled or run.
…e verified exit path Per PREREG amendment 5 (0fe4f75). The first SIGTERM/SIGHUP/SIGINT ignores the rest and unwinds; apply and restore both run with those signals held; HEAD's own bytes are not a foreign edit; the file is verified against HEAD before any claim that it was restored; finish() is the one exit path and lets a tree not at HEAD override every other outcome. Nothing compiled or run.
…nt lists for arms A, P and M, one 'outcomes K=' line per K after the table (PREREG amendment 1, observation only; no existing line changed)
… makes an older build refuse the log (F2); the unsigned maximum is delivered and stored (F6) - a_frame_over_the_pre_d223_read_bound_makes_an_older_build_refuse_the_log: red at 1b8d290 (the header stays version 1, which a pre-D223 build accepts and then trims the frame). - a_log_of_ordinary_frames_stays_readable_by_an_older_build: the control, green at 1b8d290. - a_checkpoint_keeps_the_mark_while_a_large_frame_survives: red at 1b8d290. - no_crash_can_leave_a_large_frame_under_a_header_an_older_build_accepts: a fault sweep over the first large append, both durability models; red at 1b8d290 on its unfaulted run. - the_largest_entry_an_unsigned_frame_carries_is_delivered_and_stored (F6): green at 1b8d290; its red is the surviving mutant MAX_ENTRY_BYTES = MAX_FRAME_BYTES - 69. All read the header bytes, not the log, for the version. Additions only; never compiled or run.
…sion plan and the rolling-upgrade statement, F3-F6 plans, mutants M35-M40, before the fixes
…ad bound is format version 2, which an older build refuses - VERSION 2 and LEGACY_VERSION 1; the header carries its version and decode accepts both. A new log starts at 1, so a log that never held a large frame can still be downgraded. - Before the first frame over LEGACY_READ_BOUND (8,384,576, the pre-D223 MAX_FRAME, a literal) is written, the log switches to version 2 through the same two-file switch a checkpoint uses, so no crash can leave that frame under a header an older build accepts. Checkpoints keep the version they find. - The switch is extracted from discard_prefix unchanged into RoundLog::switch, one copy of the ordering, with the caller named in its errors. - MAX_FRAME is now format version 2's literal read bound (8,388,672), with compile-time asserts that MAX_ENTRY_BYTES + 64 fits it and that the legacy bound sits below it. A pre-D223 build's Header::decode refuses version 2 with Corrupt at open, where it used to trim a large frame and every round after it. Never compiled or run.
… running node; node.rs's loss comment narrowed - transport::TransportCounters, a read-only copy of every meter (Transport::counters), exposed as Node::transport_counters. A copy rather than &Transport, whose send and shutdown take &self. Debug now also prints refused_after_stop. - node.rs perform: the comment no longer claims every lost queued frame is counted. It names what is counted and what is not (TCP losses after a successful write, frames queued at shutdown, a push that races a shutdown). Never compiled or run.
…adable from a running node A node whose configuration names peers it holds no address for campaigns once; its refused pre-votes must show as unaddressable through Node::transport_counters. Needs the new accessor, so its red evidence is mutant M40. Additions only; never compiled or run.
…er derived from the consensus disk bound MAX_APPEND_BYTES becomes MAX_FRAME_BYTES - 4096 directly: the value it had. Its reason (a TEL delta larger than one consensus entry could never be shipped) needs a bound at or below what one entry in one Append carries, and consensus::log::MAX_ENTRY_BYTES is now the whole frame, which is above that. TEL behaviour is unchanged; the compile-time assert against MAX_RECORD still holds. Never compiled or run.
…MAX_SIDECAR_BYTES derivation, membership's 'appends every command') Comments only; never compiled.
… not only NotLeader Comment only; never compiled.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
main-all: staging merge of every landable branch into main
This PR merges into main every branch on the list that git could merge cleanly. Each branch was merged one at a time, oldest work first, using only git object commands (
merge-tree --write-treeandcommit-tree). No checkout was used, and no conflict was resolved.6bd2d690c438f5df1759git merge-base --is-ancestor), so main can fast-forward to it.git diff --shortstat: 300 files changed, +61720/-810.Read before landing: these hazards came in with the clean merges
Nobody has built main-all. A clean merge-tree only means git found no textual conflict. It does not mean the code compiles or the suite passes. No build was run on the Mac, by standing order, so this PR's CI run is the first build and the first test run.
658af3f): the commit subject readsDELIBERATELY FAILING - do not merge. It addstests/depth_probe.rs, which its body says "FAILS ON PURPOSE", andtests/depth_cost.rs.3c2a132): the commit subject readsTHROWAWAY, do not merge. It addsexamples/d89_falsify.rsandexamples/d89_falsify2.rs, plus raw output.85d4401is titledMEASUREMENT ONLY (never lands). It addspub static R11_ACCEPT_POLLtosrc/consensus/transport.rs, a switch that is off by default and, when on, restores the pre-F1 accept path (F1 mutant M1). It also adds a transport event trace and a role log tonode.rsandtransport.rs. r11-dist is still a live lane.680f1ac): the commit body saysQuarantined instrumentation; never lands. It adds ascan_countmodule tosrc/tel/log.rs. The classification chose this branch over d138-measure-new and d138-measure-old.863d755addsbench/d207/raw/RUN_log.txt, and d225-byte-split422be66addsbench/d225/red_a5.txt.UNBUILT.Merged (in order)
Already contained in main
Conflicted and skipped (paths as reported by merge-tree)
38 of these conflict with origin/main itself. 20 of them carry the rollback-index-orphan (#16) stack, whose first commit is
74cff64(delete-insert-lookup's failing-first tests). Those same 20, and only those, conflict insrc/wal/recovery.rs. The stack's own base, delete-insert-lookup, merged cleanly, so main-all carries its red tests without the fix.15 merge cleanly into origin/main by themselves but conflict with branches merged earlier in main-all. Each line lists the earlier merged branches that touch the same path. These are candidates for the conflict, not a proven cause.
Excluded by classification (not merged)
Branches on origin that neither list names
2aacf74), so their content is already on main. They were not merged.git cherrymarks its only commit-(patch-equivalent on main). Merging it conflicts insrc/agent_sql/dispatch.rs,runtime.rs,binder.rs,parser.rsandscanner.rs. Not merged.