A chunk routed by the demux inside the adopt_channel install→drain
window was delivered ahead of earlier-parked early arrivals: the mpsc
send order was inverted relative to wire-arrival order, misordering the
channel's byte stream (C-01, critical — downstream alkgit observed two
desync shapes under multi-process load). A related loss variant is also
closed: a chunk whose map miss parked it after the drain had removed
the queue sat parked forever.
The window closes by serialization, not by widening locks across
awaits — the resolution is fully synchronous:
- route_payload holds the channels-map lock across the miss → park
decision (park_early_arrival runs nested; lock order channels →
early_arrivals): a park can never straddle the install, and the
installer that caused the miss always swaps the queue out.
- install_locked (new, shared by open_channel / adopt_channel /
install_channel_zero) swaps the parked queue, inserts the state, and
try_sends the parked queue into the fresh, empty receiver before
releasing the channels lock — a direct route can only begin after
release, so parked chunks always precede it in send order. No await
runs inside the section: the effective park cap is now
min(EARLY_ARRIVAL_CAP, buffer_cap), bounding the parked queue by the
receiver's capacity so the drain never blocks. drain_early_arrivals
remains as the defensive full-buffer fallback and is now called by
all three install paths.
Regression tests: adopt_window_does_not_reorder_chunks (200 iterations
on a 2-worker runtime — a racer routing C the moment the install is
visible, receiver byte stream asserted byte-identical to the producer's;
catches the old window under genuine preemption, the alkgit repro
shape), adopt_drains_parked_and_raced_chunks_in_fifo, and
park_cap_bounded_by_receiver_buffer. rt-multi-thread added as a
dev-dependency for the runtime test.
Semver: patch (0.10.1) — private fix surface; no API, wire-format, or
documented-cap behavior change; behavior only strengthens.
Verification: cargo test 700/724 (--all-features) passed; clippy
--all-targets -D warnings clean; fmt --check clean; cargo doc --no-deps
generated; fuzz corpus replay passed; wasm32-unknown-unknown check
passed.
glm-5.3-flash
4dbd4bc583