docs: record review boundary fixes and exact-source verification

2026-10-12 09:06:36 +09:00
parent c0223a0dea
commit b10b731531
2 changed files with 57 additions and 4 deletions
@@ -58,6 +58,11 @@ owned workflow needs async resource locks, `run_host_workflow` polls it on a Hos
 worker using the original Tokio handle; do not build a replacement runtime for
 cached services and do not submit to and await the Host lane from inside itself.
 Control/session guards needed by an accepted mutation belong to that actual job.
+Subjektiv session Read/Search, subject response projection, memory staging and
+legacy consolidation-scope helpers also use Host ownership: they can synchronously
+call Runtime/network services outside their SQL transactions. Pure DB-resident
+Subjektiv scope and memory projection helpers stay on the DB lane. Host admission
+must not be acquired again from an already-owned Host workflow.

 Backend Job cleanup has a third finite lane (two workers, 16 queued jobs), so a
 long Run teardown wait cannot starve ordinary Host control/stop requests. It is
@@ -69,9 +74,14 @@ unknown DB outcome. Runtime teardown is still its own lifecycle fence, not proof
 of model processing.

 Remote subscription and Workdir authorization are async callbacks: their complete
-live binding check and fresh request signing are offloaded together. A queue error
-must not fall back to a configured bearer token. Synchronous CLI/migration callers
-and existing synchronous Runtime adapters retain their explicit blocking boundary.
+live binding check and fresh request signing are offloaded together. Cold protocol
+source lookup in `connect_workspace_worker_protocol` is also awaited as an owned
+DB stage, rather than invoking its synchronous signing callback on Tokio.
+`WorkspaceWorkerRuntime::observation_source` is fallible: live binding/signing
+failure and bounded admission errors propagate explicitly, not as a missing
+source or a fallback to a configured bearer token. Synchronous CLI/migration
+callers and existing synchronous Runtime adapters retain their explicit blocking
+boundary.

 ## Caller recipe (including assignment APIs)

@@ -148,7 +148,7 @@ The fresh candidate build listed the expected executor tests and total test coun

 ## Validation and remaining composition boundary

-Final code source `49bfbfb2` passed the full default-parallel Server suite,
+Pre-review code source `49bfbfb2` passed the full default-parallel Server suite,
 including the command-overload case: 960 passed, zero failures, one existing
 ignored migration fixture; 11 binary tests, library duration 175.29 seconds.
 The only captured panics were the three deliberate unknown-outcome tests.
@@ -159,6 +159,49 @@ These commands used the isolated candidate artifact directory; libtest default
 parallelism and the production budgets were unchanged. The MR records the exact
 published source, which also includes this report and the boundary document.

+## Post-publication independent review and causal fixes
+
+MR `01a12d3f-e90c-7b02-9ed9-cf3bd2e822a1` seq3 independently reviewed published
+source `66bb9d0b` and requested changes despite the successful original suite.
+Its two major findings exposed boundaries the earlier tests did not prove:
+
+- `T748-DB-NETWORK-LANE`: mixed Subjektiv helpers could wait for synchronous
+  Runtime HTTP on the sole DB worker. Fix `d3fcfb29` places session read/search,
+  subject projection, memory staging, and legacy consolidation-scope helpers on
+  the existing finite Host owner; pure DB-resident operations keep DB placement.
+  Whole transaction helpers remain intact, and no Runtime I/O is introduced
+  inside a SQL transaction.
+- `T748-ASYNC-PROTOCOL-SIGNING`: cold protocol source lookup called live binding
+  checks and signing directly on Tokio. Fix `c0223a0d` awaits the owned DB stage.
+  The source API now propagates failure explicitly: an invalid live binding or
+  signing/admission failure cannot be hidden as `None` or a legacy bearer fallback.
+
+Permanent real loopback HTTP regressions hold upstream Runtime replies during
+session read/search, subject and legacy-scope requests, while independently
+observing SQL, timer and control progress. Cancelling waiters retains the actual
+Host lifecycle lease until completion. Cold protocol source tests control another
+SQLite writer and shared connection mutex wait, and verify bounded overload,
+fresh signing and revocation without fallback. Existing queue/cancellation and
+deletion evidence now observes the actual mutation owner; the mixed fixtures
+explicitly inject a small finite Host budget. Production budgets are unchanged.
+
+Focused boundary tests passed (10). Restoring the old placement produced a
+failing regression, and fixed placement passed; an earlier syntax-rejected
+instrumentation attempt is excluded from evidence. Diagnostic artifacts under
+`target/` are not production source or replacement domain implementations.
+
+Exact code source `c0223a0d` then passed root `cargo check` and the original
+**default-parallel** Server suite: **962 passed, zero failed, one pre-existing
+ignored**, 11 binary tests; library duration **173.36 seconds**. Only the three
+intentional executor panic diagnostics appeared, with no residual test processes.
+Workdir default (153) and `http-client` (156) full suites, format/diff checks and
+state-contract naming (558 matching lines, zero unapproved, zero stale) passed.
+All used the isolated `target/t748-candidate-build` artifact directory. Logs:
+`target/t748-review-fix-{root-check,full-suite,workdir-default,workdir-http,format,names}.log`.
+The following documentation-only commit does not change that tested code.
+Fresh independent review of the normally advanced same MR source is still
+required; previous `request_changes` evidence is not approval of this fix.
+
 No latency benchmark, production incident measurement, target integration,
 Ticket conclusion, or running-environment update is claimed. T743 has now
 published its caller inventory/source; its owner will compose the T748 facade and