0 Fork 0

Files

T

glm-5.3-flash aa66dd1912 pg: forwarder TOCTOU closed + hang-shaped arms bounded (review 004 items 4+6)

- (a) the register/unregister decide-and-queue critical sections: the
  refcount change and the derived LISTEN/UNLISTEN enqueue run under one
  registry guard (ChannelSet::enqueue_register/enqueue_unregister), so
  the command queue's order is the registry transitions' linearization —
  the old thread-preempted decide/send split (no await inside, but
  mid-unit preemption across workers) could leave a live refcount with
  the server-side LISTEN cleared until the next reconnect re-issue.
  The redundant per-registration LISTEN stays as the ack's vehicle, so
  a listen() that returned still awaits a server-processed LISTEN.
- (b) a failed generation-verify no longer parks on the poll task
  forever: the bounded settle (LISTEN_SETTLE_TIMEOUT=2s, shutdown-
  selected) reaps a genuinely dead session promptly or aborts the
  alive-but-unusable connection's reaper at the bound — reconnect
  either way.
- (c) close()/Drop can no longer leak the listener session: every
  listener-client query (verify batch, replay commands, serve
  commands) rides bounded_wait (LISTENER_QUERY_TIMEOUT=5s) with the
  shutdown watch selected alongside — the old unbounded run_command
  await sat outside the shutdown select; an overrun is the honest
  death posture (abort + reconnect, the snapshot re-issue recovers).
- pins: the interleaved register/unregister server-model equality pin
  (with a decision-anchored deterministic finale), the bounded-wait +
  failed-verify-settle paused-time pins, and the black-hole-poxy
  harness pin (close reclaims the session past a stuck serve arm);
  the refcount unit pin reworked onto the decide-and-queue API.
- replay-proofs (both ways, verified live): the old split shape fails
  the interleave pin on the review's exact mismatch; the old
  unbounded serve await fails the black-hole pin (session leaked past
  close).
- the preserved postures re-verified green: reconnect survival, the
  fanout release guard, receivers-terminal-iff-loop-gone, the
  stale-UNLISTEN generation machinery, the register-failure
  unregister discipline, the poison-recovery idiom, and both
  POC-pinned deadlock-pitfall exclusions.
- gates: pg suite with the harness server green (131 lib + 25
  contract + 9 schema; lib battery run twice full), workspace
  build/test/fuzz gates server-less green, clippy -D warnings, fmt,
  and the rustdoc gate all green; task -> completed

2026-10-11 12:20:54 +00:00

src

pg: forwarder TOCTOU closed + hang-shaped arms bounded (review 004 items 4+6)

2026-10-11 12:20:54 +00:00

tests

Contract-suite rows (task suite-opts-backoff-rows): the backoff-curve equivalence row and the deferred enqueue-opts clock legs. backoff_curve_equivalence — the equal-jitter exponential pinned as the range, not a jitter label (ADR-010 §3): claim → retry(err, None) cycles on a backoff_base_s = 2 queue land the ranges [1,2], [2,4], [4,8] across attempts 1–3, each computed delay read back through get_job's resolved run_at minus a clock read taken before the retry — the lower bound race-free (the retry's internal clock read cannot precede the suite's, so the observed value over-reads the delay, never under-reads) and the upper bound carrying a one-second straddle tolerance for the integer-second stamp crossing a wall second; identical bounds on both engines is the equivalence pin (ADR-012 §2, the row body shared). The explicit-delay override legs ride the same row: retry(err, Some(5)) honored verbatim ([5, 6] under the same straddle tolerance) and retry(err, Some(0)) resolving ready-now per the boundary-total rule (ADR-023 §2), claimed within a bounded wait. enqueue_opts_resolution extended in place with the wave-5 legs its deferral note named — the run_at-alone literal leg (a future run_at is the row's ready time verbatim, a deterministic equality with no clock read involved; a past run_at stores the literal too and is claimable now through the run_at <= now predicate within a bounded wait, the run_at-ASC ordering making the observation unambiguous among the row's other legs) and the neither-field leg (ready at the enqueue instant, abs_diff(now) <= 5 tolerance-bounded proximity, never a tight timing assert); the deferral note replaced by the completion statement, ADR-023 §2 stamp accumulated per the convention (ADR-020 §1 governs the resolutions). Cap-leg disposition recorded in Notes for the review gate: the 1-hour cap is not suite-pinnable (capped attempts need minute-scale waits) and stays pinned engine-side on both engines' unit tests per the wave-3/4 reviews. Ready-now waits are bounded claim_one poll loops (deadline asserts only, sequential single-store drive), with the one draft defect the finding surfaced (a re-claim after the bounded wait consumed nothing; the helper returns the claimed handle) noted. Wired into both engines' suite targets (SQLite tokio test, pg harness_row!), 25 rows per column up from 24. Verified: SQLite column green server-less (25/25 suite, 189 lib), pg column green vs harness (postgres/poc@:15432 — 25/25 suite, 121 lib + 9 schema), 3 solo re-runs of each new/extended row per engine (determinism), server-less pg skips cleanly via the reachability gate, cargo test -p alkstore-sqlite -p alkstore-postgres green, clippy -D warnings, fmt clean

2026-10-10 07:26:55 +00:00

Cargo.toml

release-publish-prep: license texts ride each package — LICENSE-MIT/LICENSE-APACHE copies in the four published crate dirs (cargo's auto-detect packages them; workspace-inherited license-files is a packaging no-op on cargo 1.99, reverted); the sqlite substrate's bundled in-src notice stays per ADR-018

2026-10-11 08:05:09 +00:00

LICENSE-APACHE

2026-10-11 08:05:09 +00:00

LICENSE-MIT

2026-10-11 08:05:09 +00:00

README.md

release-readme: the root README written last, honestly — crate family table with per-engine honest postures (ADR-016 compile-time identity, deployment.md as the boundary), mem-carried usage sketch compile-checked and executed against the real API, contract-suite pointer (three engines, one pinned contract), license note; LICENSE-MIT + LICENSE-APACHE per the family pattern (substrate notice untouched per ADR-018); CHANGELOG seeded with the 0.1.0 contract-v1 entry; per-crate readme wiring decided + landed (pointer-style per-crate readmes, readme fields wired on the four published crates); honesty trace list in task Notes; task -> completed

2026-10-11 01:32:33 +00:00

README.md

alkstore-postgres

The Postgres engine of the alkstore family: the core contract implemented on tokio-postgres + deadpool-postgres, natively async (no blocking bridge, no spawn_blocking seam), with a hand-rolled LISTEN forwarder.

let store = alkstore_postgres::open(&dsn, alkstore_postgres::PgOpts::default()).await?;

Engine posture — multi-host native. Connections are per-process state; nothing assumes a shared host. Connection budget: max_size pooled connections + 1 non-pooled listener connection per LISTEN-ing process (pooled connections cannot carry LISTEN) — size the server for the sum. v1 TLS is effectively unavailable: the engine hardwires NoTls on every connection path, so network confidentiality must come from the deployment topology. Queue/stream/lock/schedule tables live in one engine-owned PostgreSQL schema (default alkstore, per-engine option).

See the family README for the interface and the deployment matrix, and the Postgres engine spec for the driver's details.