Block a user
f32a37c2bb
sqlite: opts + README doc accuracy — the config surface is the watcher cadence + reader pool, durability settings are bootstrapped constants (aligning with review-004 item 9's lib-header correction)
609dc3b39c
review-004-fixes gate passed — all sixteen dispositions verified by code-read against the review's failure mechanisms (armor/state-machine/hardening/decision changes structurally match their tasks' Notes of record; every injected-panic/death/interleave test drives the real mechanism); no regressions among the review-004 inline fixes' pinned postures (tick drop-+-replenish, raw tx-form seed + mem has_offset_row, MAX_SLEEP_S caps, saturating claim stamp, register-failure unregisters, poison-recovery idiom, encode depth 127); records landed — review 004's recorded-findings items annotated with dispositions/task pointers (record reads closed), implementation.md gains the fix-batch review-rounds entry, task-file audit done with three minor hygiene defects fixed inline (stale placeholder lines incl. pre-existing ones in review-wave-3/release-readme, completed-AC checkboxes left unticked on five batch tasks, the gate description's fifteen→sixteen task count); gates green this session: build, server-less workspace tests, full live pg column vs harness pglo-poc (135+26+9), clippy -D warnings, fmt --check, fuzz corpus replay 6/6, wasm32 mem check, doc gate zero warnings, taskgraph validate (96); task -> completed
9301bb926b
core: verify and pin the receiver's pre-yield offset() value (review 004 item 12, core-pin-offset-initial-value) — the three engines verified equal live, so the doc-pin branch applies: offset() reads 0 before any yield on every receiver — fresh consumer, stored positive checkpoint, stored negative seed (ADR-023 §2's totality arm, the one a checkpoint-seeded realization would surface on) — the no-yield sentinel, never the stored checkpoint: the checkpoint gates the feed's attach-read start while the receiver's offset tracks the last-yielded event only, composing with the pinned pre-yield save_offset() no-op; the attach read's prefetches sit unobserved and the first recv/try_recv observation is the first move (then the post-yield value, receiver_close_and_save_arms' pin). Verified by code read first (all three offset() bodies are self.position, all three constructors seed position: 0 unconditionally — mem stream.rs:353, sqlite :399, pg :620) then live: new suite row receiver_offset_pre_yield_is_zero (alkstore-contract-suite, stamped ADR-008 §8 + the core-contract.md pin, four arms incl. the first-observation composition leg) green on all three columns, pg against the harness server (parked pglo-poc :15432); pinned in three places: core-contract.md streams/subscribe row (dated 2026-10-11 annotation) + a verification-backlog bullet recording the verified pin, the core trait doc on offset() (core's doc comments are contract text), and the suite row itself — ADR-008 §8's shape comment deliberately left untouched (doc-only verification takes no ADR amendment, noted in the task); no engine code changed, no divergence to raise; gates green: workspace build/tests server-less, full pg column vs harness (135+26+9), clippy -D warnings, fmt --check, doc gate zero warnings, fuzz corpus replay 6/6, wasm32 mem check, taskgraph validate (96); task -> completed
321f579ac2
pg: surface the forwarder's swallowed connect/poll failures (review 004 item 7's two narrow arms, pg-fix-forwarder-diagnosability) — output form per the ADR-025 decision of record: the reconnect arm's .ok() swallow at the loop's attempt closure becomes a tracing::warn! per failed connect (attempt index mapping the backoff state — 50 ms base doubling to the 2 s cap — plus the raw io-class connect error; reconnect_with_retry's generic signature and its two unit pins unchanged); poll_loop returns the fatal poll_message error instead of discarding it and the serve loop's poll-death arm surfaces the ending as a tracing::error! (fatal error, no-error stream close, and the join abort/panic variant — each naming the death and the stall-until-reconnect consequence); secret-free re-verified by grep — both new emission contents checked against the substrate (tokio-postgres 0.7.18 connect errors are Error::connect(io::Error), no DSN/user/password in Display; no subscriber-asserting test added, holding ADR-025's dev-dep stance); gates green: full crate suite against the harness server (135+25+9, all pre-existing forwarder/reconnect pins and the hardening task's pins green unchanged), workspace build/tests server-less, clippy -D warnings, fmt, doc gate, fuzz corpus replay 6/6; task -> completed
a9b6cf0c86
adopt the tracing log facade, engine crates only (review 004 item 7's family-level decision, ADR-025): the family precedent checked and unanimous (alkcall/alktunnels/alksocks/alktty all on tracing = "0.1" facade-only, tracing-subscriber env-filter a dev-dep where present, silent by default); user sign-off taken in-session (2026-10-11, adopt-tracing option chosen) and recorded in the ADR's status; core stays dep- and emit-free (the explicit core-dep answer — the payload serde deps remain the sole core deps, the ADR states the ADR-020-§4 reading explicitly); all 19 library-path eprintln! sites migrated to tracing::warn!/error! with message text + the alkstore: prefix + the secret-free discipline unchanged (17 at review time, +2 from the review's own inline tick/lease restructures — re-grepped, sqlite 10 / pg 9, zero remainder, tests' harness-skip prints untouched); levels: warn = retried/degraded ops, error = unrecoverable loss (watcher death, discarded pooled clients, panic-path rollback failures); the four substrate-lineage files ride PROVENANCE delta D-41 (message-identical macro swap); deployment.md gains the diagnostics-posture section (operator recipe RUST_LOG=warn/error at the consuming binary; listener application_name diagnosability joins it), ADR index + design-decisions table carry the 025 row, CHANGELOG's 0.1.0 body states the facade; pg-fix-forwarder-diagnosability's output form now pinned (warn on failed reconnect connects with attempt/backoff context, error on the loop-exit poll error); gates green: build, workspace tests server-less, clippy -D warnings, fmt, doc gate zero warnings, fuzz corpus replay 6/6; task -> completed
ce5da852ca
pg: server-side stamp sums saturate to the i64 domain — the review-004 item-5 sticky-poison class dies (pg-fix-bigint-stamp-overflow): every stamp sum/subtraction computes in numeric via one owner (resolution::saturating_stamp_expr, the ADR-023 §2 2026-10-11 annotation's form) called at all six sites — claim deadline (queue.rs:385), retention sweep (:721), retry reschedule (:927), heartbeat renewal (:1016), lock insert + renew (lock.rs:95/222); the realized ($N::bigint)::numeric chain pins the params' inferred bigint type (a bare $N::numeric fails the i64 binding with WrongType — found live, recorded in the owner's doc); behavior pinned against the harness server per site (i64::MAX stamp claims to the i64::MAX deadline with neighbors unaffected, heartbeat extremes renew to the saturated edge and now+MIN rides exact then voids through the validity predicate, retry Some(i64::MIN)/(i64::MAX) reschedule, retention i64::MIN sweep-all + i64::MAX delete-nothing, ttl i64::MAX insert+renew); two consecutive full-crate harness runs green (135+25+9), workspace gates + fuzz corpus gate green server-less; no re-deciding, no contract-text change (the failure-set change was the decision's own annotation); task -> completed
60f7d02769
decide the pg server-side stamp-arithmetic guard (review 004 item 5): the server expression owns it — the clamp domain is the arithmetic result, saturated to the i64 domain, no input clamped/validated at any seam; per-call args (heartbeat extend, retry override, lock ttl x2) have no enqueue to clamp at, QueueOpts verbatim-stamping is the review-002 posture, and the boundary row already pins argument totality — the annotation corrects the 'plain SQL integer add' form on pg (never total in the overflow domain), verified green against the Postgres 16 harness (both clamp edges, representable rides exact, now-MIN clamps to MAX); six sites of record (queue.rs:386/912/1000/715, lock.rs:92/217); window state verified open (no tag, no publish), dated class-1 annotation landed in ADR-023 §2; task -> completed
608104ab13
pg: run_schedules' failed-renewal arm classifies as Database, never LeadershipLost (review 004 item 9's pg twin) — a lost lease (Ok(false)) keeps the respawn arm unchanged; a failed renewal (closed store / storage failure) propagates its opaque classification, matching the sqlite task's 2026-10-11 classification landed engine-neutral in ADR-009 §1 / core-contract §Errors (cited, not re-decided); module doc aligned; two tests pin both arms on the harness server (the sqlite twin's pin shapes); task -> completed
c03c798e34
decompose the pg scheduler-classification twin (review 004 item 9 — recorded at the sqlite task's implementation: scheduler.rs:682 carries the identical renew flattening; the ADR-009 §1 arm set is already landed engine-neutral, pg implements to match) + gate wiring; taskgraph validate green (96)
9a9ccf26e0
sqlite: run_schedules' failed-renewal arm classifies as Database, never LeadershipLost (review 004 item 9) — a lost lease (Ok(false)) keeps the respawn arm unchanged; a failed renewal (closed store / storage failure) propagates its opaque classification, so respawning misdirects at a dead store no more; dated (2026-10-11) ADR-017 §2 class-1 annotation of the loss-vs-failure arm set in ADR-009 §1, core-contract §Errors, queues.md, engine-sqlite.md, core+sqlite doc comments; two tests pin both arms; pg twin recorded for follow-up; task -> completed
acdef94058
sqlite: the listen bridge takes the stream bridge's std-thread shape (review 004 item 8) — one dedicated named thread per subscription doing blocking_send, not a spawn_blocking task (past ~500 listeners the blocking-pool ceiling queued the whole engine's seams); spawn failure unsubscribes and fails closed with Error::Database, matching the stream bridge's posture; notify.rs + engine-sqlite.md docs aligned; task -> completed
0fadf0f224
sqlite: dead-watcher subscribe fails closed + initial-stat identity-unknown baseline (review 004 items 2+3) — the poll loop sets a dead sign before the watcher-fatal exit and subscribe() fails closed on it (and the taken watcher slot) atomically with enrollment; listen/stream subscribe map it to Error::Database, never park on a dead feed; the identity baseline is Option-tracked so a failed startup stat no longer seeds the (0,0) false identity that a transient recovery would trip into death; engine-sqlite.md posture covers both arms; PROVENANCE D-39; task -> completed