ci: integration batch C of reviewed PRs - #1848
Merged
Merged
Conversation
HTTP reset checks ride out a still-warming project open instead of treating the first after_delay answer as the terminal. Ignored-dependency publication faults a pointer a background pass cannot rename over. Killing a test daemon now signals its process group, and the next spawn waits out a socket that is still closing. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
The nested reconciling if trips clippy::collapsible_if under -D warnings. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
The packaged host advisory journey required the Codex stop ingest to report committed. A project catch-up sweep that admits the rollout first reports exact_duplicate, which is the durable replay, and the assertion panicked. Accept both terminals, reject accepted_for_replay, and ride out the same typed warming or deferred progress the Cursor ingest already does. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
A completed accepted_for_replay is not a durable commit. Keep polling until committed or exact_duplicate, or the deadline fails closed. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
Resume verification looks up symbol_occurrence_id on WITHOUT ROWID posting tables whose keys start at class and language. That scan never finished, so a resumed successor could not return to ready. Opening a successor builds the occurrence indexes, including one staged before they existed, and the lookups require them. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
A directory in the active pointer slot makes read and rename return EISDIR. That OS error was filed as unavailability, so a coalesced publication failure left the scheduler publication family. Refuse the non-file slot as reset-required corruption before either syscall. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
workflow_dispatch admits an integration branch and previously skipped commitlint, so batch-fold follow-ups with headers of 73, 75, and 85 characters landed in #1796 and failed the master push. Dispatch now lints the commits a merge onto the default branch would introduce. header-max-length stays 72. A dispatch of the default branch does not rejudge published history. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
`tracedecay_configuration_protected_preview` is the dry run a host calls before it commits a protected setting, and nothing covered its host-facing contract end to end. Drive the tool through MCP `tools/call` on the production composition and assert what a caller actually receives: a plan bound to the supplied revision, the redacted per-setting digests, the operation digest echoed as the preview digest, the five-minute validity window, and a preview id the host can apply. The rule identity and the denied capability must never appear in the rendered answer, a stale revision must be a typed `configuration.conflict`, an empty capability set a typed `configuration.invalid_request`, and no preview may advance the configuration revision. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The root crate depended on tracedecay-search-eval unconditionally, and cargo unifies that package's tracedecay-query/search-eval feature into every test target. Transport suites therefore compiled the eval-only in-memory lexical projection. The dependency is now opt-in and enabled only by the journeys that compare the CLI receipt to the library. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
A generation-retention census that does not hold the store lock can observe a scope root the publisher has not created, or a file a peer unlinked after it was listed. That NotFound is the same deferral as a held writer, not a storage failure. The mounted journey waits until the superseded source is actually collectable. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
Codex prepare turned every resolution failure of the host CLI into DeferredUserAction, so Ready depended on PATH. Staging now returns Ready. Activation still reports HostCliUnavailable when codex cannot be resolved. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
Dotted Rust calls emitted the method's simple name, so a unique same-file callable of that name became a caller. Bind self through the enclosing impl or trait, and keep Type::method for stated receivers. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
`tracedecay_remote_status` was proved only below the transport. The handler unit test and `remote_status_dispatch_tests` call the dispatch function directly, and `daemon::remote_protocol_tests` reads the session runtime registry. Nothing exercised the tool through a real `tools/call`, so the two typed no-plane outcomes could diverge at the boundary without a failing test. Add the transport-level cases the existing suites do not cover: - A production composition harness mounts the Remote Brain reader with no listener and no registered node, so `tools/call` must render `unconfigured` in both markdown and JSON. - A direct protocol server never installs the reader, so the same call over JSON-RPC must render `unavailable`, with no `isError`. Both cases also assert the response carries exactly one content block, pinning that a typed read attaches no banner or token footer. The configured (`observed`) plane is left to the two suites that can mount one cheaply: the harness exposes no registry accessor, so provisioning a node here would duplicate `remote_protocol_tests` at the cost of reproducing daemon authority acquisition, a signed grant, and enrollment admission in an integration fixture. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
A seal or clone backfill outlives the 30s freshness window. Expiry and a predecessor witness used to clear the newer generation and reseal it. Unchanged sealed bytes now rebind that proof instead. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
The registered describe path blanked every preview and treated the snippet length as the message size, so a session expand could already read came back empty. Report the bounded snippet and the stored message length instead. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
Harness stop signaled only the detached group leader, so descendants kept the listen socket after wait. Publication renamed the active pointer without checking the bytes it had observed. Signal the whole group before reap, unlink the published socket, and refuse a pointer rename whose file is no longer that observation. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
Host reserve and the cgroup ceiling are alternative protections, not stacked discounts. memory.max is the hard ceiling; memory.high below it is the reclaim watermark. A 128 GiB host with max=30 GiB and high=26 GiB stays open at 24 GiB RSS instead of carving another margin out of high. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
The GitHub upgrade path recorded the release tag as the daemon
identity. The daemon advertises {release}+{sha}, and readiness
compares those strings exactly, so update refused the binary it had
just installed. Both install paths now record the binary's own
--version and never substitute the tag.
Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
Published hotpath 0.24 snapshots the builder limit for live queries and only reads HOTPATH_FUNCTIONS_LIMIT when the exit report is built. The shipped guard copies that env onto the builder before MCP starts. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
Rebuild activation classified session conflicts as message OutputCollision
with message_id session:{id}, erasing the field. Overlaps now use
reconcile_session_rows_detailed and SessionOutputCollision. A missing
message is no longer reported as a missing session when that session row
is still durable.
Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
The worker dropped its admission permit and reconcile_in_progress, then still renamed the active pointer and stamped BusyFollowUp. Those two signals are now idle only after that tail: continuations are stamped while the pass is visible, and published text projection re-takes the permit before the pointer rename. The pass is dropped only across that permit wait, so a holder waiting on the flag cannot deadlock. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
The advance that installs exact and lexical owners also copied the prior lexical artifact into the clone successor. That copy ran under reconcile_in_progress, so status stayed non-current for the copy. Leave the successor pending; the retained driver starts it after the seat. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
Extractor revision bumps reseal the generation named inside every candidate occurrence and the eval freshness digest. Hashing that production fallback subpayload made ranking-identical runs rewrite both partition receipts and the workload identity. The receipt now hashes ordered ranking rows and lane coverage. Workload identity omits those receipts, so a receipt edit is not a workload change. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
Live ingest and catch-up both advance the same coverage with different reasons. The loser was a permanent cursor-advance collision, so both owners warned on every retry. A frontier the durable cursor has already reached keeps the first ledger row and returns an exact duplicate. A disagreement is still a write failure when the cursor has not moved. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
A query that cannot join the scheduler posted BusyFollowUp whenever the proof had expired. The in-flight pass consumes that arrival, the next poll finds the lock still held, and posts another. Dashboard freshness treats the pending slot as refresh_in_flight and stays Verifying. The holder is already the observation; the next read that acquires the scheduler still requests a proof that remains expired. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
The handler test moved the seed string into ingest, so the length assertion could not read it. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
SIGKILL skips the daemon's endpoint unlink. A child that inherited the listen descriptor still accepts on that path, so the next spawn reports a live daemon. branch_search init does exactly that: spawn, init, drop, spawn again. Waiting for the path to go quiet papers over the leak. Kill the owner's process group, then unlink the socket the owner bound. A path that still accepts is a daemon this call did not stop. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
The seat-swap witness does not own the lexical full-copy. That copy stays on the retained successor driver. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
…or/hotpath-functions-limit-29f1
…or/lexical-artifact-transport-63fc
7 tasks
Fold master tip including #1855, #1857, #1794, and #1795 into the batch while keeping folded PR ancestry. # Conflicts: # crates/tracedecay/tests/common/mod.rs # crates/tracedecay/tests/mcp_suite/git_correlation_test.rs # crates/tracedecay/tests/mcp_suite/mcp_handler_test.rs Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
The 500ms open bound leaves the open running and used to answer application.surface.unavailable. The typed CLI treats that as the answer, so cold storage_status and configuration writes fail the moment the bound elapses. Return the mounting refusal those clients already resend. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
The coalesced publication fault injects a directory, which rename cannot replace. The leftover truncated-file assertion read that directory and failed with EISDIR after the publication family had already held. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
Rebuild activation read every staged session that already existed in one
unbounded SELECT. The exact-SQL transport refuses a result set past
MAX_QUERY_ROWS (10_000) or 64 MiB rather than truncating it, so a rebuild
overlapping more history than that failed activation with
InvalidOperation("exact SQL query materialization exceeded its limit")
instead of reconciling. The predecessor query carried LIMIT 1; removing
that predicate in 88139f6 removed the bound with it.
Page by (provider, session_id) at REBUILD_PAGE_SIZE, the same bound the
staging batches already use. Both the staged primary key and sessions are
unique on that pair, so a page's writes never move a later page's cursor.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Codex finding on #1848 rebuild.rs:2288 confirmed: the overlap reconciliation query dropped its LIMIT in 88139f6 and the exact-SQL transport refuses result sets past MAX_QUERY_ROWS, so a rebuild overlapping >10k sessions failed activation. Paged at REBUILD_PAGE_SIZE with a test past the cap. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
|
Merged CI run 35437915532:
|
Session describe now reports the bounded snippet and stored length, not a blank stub. A generation bump can answer search_failed while clone publication is still retiring; wait for the stale cursor. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
The #1722 describe proof pinned the blank preview that the registered renderer regressed to. #1817 restores the stored bounded snippet, so the session overview and the external-payload target now show the snippet (the externalized-payload placeholder, never the payload body). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Keep the bounded-preview pin landed on the branch and the clone publication wait for the stale redundancy cursor. # Conflicts: # crates/tracedecay/tests/mcp_suite/mcp_handler_test/lcm_describe_behavior.rs Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
Contributor
|
Merged master tip
|
`discard_incompatible_staging` read `symlink_metadata` and reported an
unavailable authority when the staging file was already gone. A
concurrent clone-successor build retires that path, so the discard found
its own goal state and failed on it. The caller in `begin_clone_successor`
uses the discard to recover an incompatible staging database and reopen
it; the refusal aborted that recovery instead, and the clone-family lane
answered `search_failed` with `retryable=false`. Treat an absent staging
path as the end state and sweep its sidecars, the way
`prepare_absent_text_artifact_staging` and the sidecar sweep already read
`NotFound`.
The clone-similarity warmup reports `Pending` when the advance budget runs
out, so a caller learns the projection is unfinished and may retry. An
`AuthorityUnavailable` advance failure is that same unfinished state, but
the executor collapsed it into `Internal`, telling every caller never to
retry a window one background pass resolves. Both clone lanes now keep
`Pending`'s `generation_unverified` verdict for it.
Evidence: with the redundancy tests pinned to two CPUs under load,
`discard_incompatible_staging` returned `AuthorityUnavailable("No such
file or directory (os error 2)")` through `begin_clone_successor` ->
`advance_artifact_text_serving` -> `finish_clone_similarity_warmup_for_request`,
and the tool answered `reason_code=search_failed retryable=false`.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Root cause of the redundancy_pull_request_scope TRY1 failures: discarding a staging file a concurrent clone-successor build already retired reported an unavailable authority, and both clone lanes mapped AuthorityUnavailable to Internal (search_failed, retryable=false) for a window that resolves on the next pass. The test-side wait now keys only on generation_unverified. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
search_failed and code_index_unavailable are retryable=false; treating them as a publication window would hide a real failure now that the clone lanes answer generation_unverified while the projection finishes. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
ScriptedAlchemy
added a commit
that referenced
this pull request
Sep 19, 2026
This was referenced Sep 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Integration batch of reviewed PRs on top of master 58f8f83. Each folded PR was reviewed by its own lane, which merged master, traced the production change to its callers, ran the touched crates' tests and CI's clippy lens, and pushed fixes to the PR branch where needed. This branch validates them together on one CI run. Once the run is green, the batch merges and each folded PR merges with it.
Folded PRs: #1804 #1794 #1800 #1801 #1805 #1806 #1810 #1814 #1815 #1816 #1817 #1818 #1820 #1823 #1825 #1826 #1828 #1829 #1833 #1821 #1811 #1835 #1803 #1822 #1819 #1832 #1837 #1839 #1843 #1841 #1838.
Not folded. #1812 is reverted here. Returning Ready from Codex prepare without a resolvable plugin CLI opens a component transaction whose rollback leaves a journal that pins the paths the printed remediation tells the operator to change, so the next install refuses with a stale preview. #1836 and #1834 wait for batch D because they conflict with folded PRs in the scheduler and extraction files.
Integration changes made on this branch:
tracedecay toolretries the typed project_server_response_revoked error, the same fix style(session-temporal): keep the test module last and rustfmt master #1847 landed on master.Run 35431957131 on the first head failed four tests. Two were the receipt drift above. One was the codex remediation journey, resolved by the #1812 revert. One was a retry-pass flake in root_graph_ready_does_not_depend_on_the_publication_decode_cache. A lane measured that flake at one failure in 200 runs on master with a byte-identical readiness path; its cause is the test's store-wide waiter gauge, and a separate fix is in flight for batch D.
🤖 Generated with Claude Code