Repository navigation
Retire held backends and join original session observations - #3828
Merged
Merged
Conversation
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
|
debt-src at c0f4081, every finding: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
One lifecycle repair, 2 commits, 6 files, +189/-44. Final bounded controls: 11 passed in 2.81s, exit 0. No full suite, local NRA gate, paid model, failed-root replay, migration or installed-package edit.
Cleanup no longer manufactures a backend. Configuration and shared-root goal observations now borrow the original
OwnerSessionthrough owner-held completion joins, instead of resolving a session ID after that session was removed. Independent observations remain parallel.Failure and owners
The preserved configured-fork attempt failed during attachment because its wrapper re-entered in a spawned process. That wrapper defect is separate from these two Core failures recorded in the same private owner log:
SessionConfigOptions._observe_configuration:219 -> SessionLifecycle.sync_identity:385 -> TurnRunner.close_idle_backend:395 -> idle_backend:415 -> backend_for:186 -> PiNativeBackend.for_worker:214 -> DrainedSession.owned:606: cleanup attempted backend acquisition without local execution.InputObservation.observe_root:256 -> GoalScheduler.observe_root:275 -> SessionLifecycle.require:143: a captured observation used an already removed session ID.Original evidence stays immutable at
pi-toad-errors/configured-fork-image-1; zero tracked input IDs was not promoted into a no-effects claim.Before / after
Backend retirement
Before:
TurnRunner.idle_backendselected/created a backend, borrowed its concrete.lock, and called.close(). That was native-specific behavior beside the declared family contract.After:
TurnRunner.close_idle_backendreads onlypersistent_backends, keeps the turn exclusion, and dispatchesAgentBackend.close_idle(). Native inheritsPersistentPiSession.close_idle; durable suppliesPiDurableBackend.close_idle. Each implementation owns its child lock and closure. The unused acquisition context manager and both consumers' unnecessaryThreadargument are deleted; there is no compatibility alias.IMPL-4: fact: backend retirement behavior; at: old
turn_runner.py:394-417; derive: base-method; by:agent_backend.py:278, implemented atpi_native_backend.py:180andpi_durable_backend.py:239. Paper1 Theorems 4.6/4.7 explain why a consumer-side route is still outside supply.Observation lifetime
OwnerSessionalready owns the original stop future. Its newobserve_liveadmits an observation only while that stop remains unset and retains one completion for the admitted operation. Retirement closes admission, retires transport/input producers, then joins those completions before closing backends or dropping session state. Work captured before retirement but admitted afterward performs no observation. Cancellation completes its admitted operation in the same finally block; independent readers do not share a mutex.The initial a5b checkpoint used the retirement lock around observation. Source review caught that unnecessary serialization before merge. The second commit replaces it with owner-held completions; the control requires two independent observations to enter together before either is released, then checks real fenced retirement waits for both. The old checkpoint is not the qualified head.
Configuration membership retains those original owner objects, replacing the ID-only set. Both initial menus and registry-driven refresh use the same owner method. Shared-root goal publication carries
OwnerSession, and source decoding occurs inside admission—not before it. Goal refresh tasks remain independent of inbox waking; failures still reachRuntimeServer's original logger.This preserves the required distinction between an original owner and an ID which could later be missing or rebound (paper1 Theorem 4.8; paper4 Theorem 2.6). No new stop flag, session mirror, empty-queue fallback, swallowed exception or retry mechanism is introduced.
Source evidence
NRA's existing parser and
ModuleSyntaxIndexcovered Core and Toadsrc/tests/tools: 1,885 parsed modules, zero parse omissions, 38 selected modules, 5,613 original sites in the before map. The publication map has 5,747 sites; its 37 selected Core module hashes matched the committed sources. The sole selected Toad module belongs to the original 4dfab029 snapshot, not the later #1393 review checkout. Original coordinates, declarations, imports, decisions, writes and consumer sites are retained in the owned source-map artifacts. Dynamic attribute binding and runtime mutation remain OPEN; syntax is not a behavioral proof.The first driver invocation used an installed NRA version lacking
module_syntax_indexand exited 1. It was corrected by selecting the actual NRA source already read; no installed dependency was edited. The one-shot driver is removed before publication.Interpreter readback confirmed actual native MRO resolution to
PersistentPiSession.close_idleand durable resolution to its ownclose_idle. Six changed Python files compile. Whole-tree search found no remainingidle_backend()or_publication_sessionsconsumers.Behavior evidence
Final command (existing host TestLease; borrowed dependencies read-only; explicit allocated Core src/tools/tests):
11 passed / 2.81s / rc0 on the corrected parallel-reader head. Earlier selections passed 11/11 in 2.71s and 2.82s but did not establish preserved parallelism. The final selection covers concurrent admitted readers, fenced retirement, and source decoding inside admission, including a source document no longer containing the retired owner.
Actual private bus, registry, ACP owner, goal consumers and fenced retirement are used. Controls establish: no unloaded-session/backend acquisition during cleanup; a controlled real child is retained while a turn is held and retired through the durable backend contract when idle; admitted observation finishes before real owner retirement; captured configuration/goal sources cannot recreate state afterward; a queued initial menu respects the original stop; cancelled observation completes its retained admission; unchanged-goal source routing and original failure reporting survive.
Artifacts: owned
heartbeat-publication/config-lifetime-{controls-1,controls-2,controls-3,source-proof,map-source,map-publish,parallel-reproof,parallel-publish}.*. The parallel correction uses targeted NRA reproof of its three changed modules, zero omissions; the other source-map bindings remain retained at a5b..Acceptance still owed
This is source and private application-owner evidence, not installed or configured-provider fork/image acceptance. Preserve the original failed attempt. The independent Toad pager cleanup repair remains on Toad #1393 with its existing author; its exact-head lifecycle controls are a separate process/lease selection. Mobile/physical acceptance and the complete shared-work overhaul #3824 remain open and are not claimed here.
Assumed: no arbitrary runtime mutation beyond the traced backend/owner declarations; retired observations may be discarded, but admitted observations must finish before state removal. No change to routing, input dispositions, UNKNOWN handling, drafts or historical coordinates.