From b10b731531ac3661dcf7f6f9a8906ae72af03958 Mon Sep 17 00:00:00 2001 From: Hare Date: Mon, 12 Oct 2026 09:06:36 +0900 Subject: [PATCH] docs: record review boundary fixes and exact-source verification --- docs/development/backend-db-execution.md | 16 +++++-- .../report/2026-10-12-t748-suite-diagnosis.md | 45 ++++++++++++++++++- 2 files changed, 57 insertions(+), 4 deletions(-) diff --git a/docs/development/backend-db-execution.md b/docs/development/backend-db-execution.md index 8dd00b478..7fd4a58d6 100644 --- a/docs/development/backend-db-execution.md +++ b/docs/development/backend-db-execution.md @@ -58,6 +58,11 @@ owned workflow needs async resource locks, `run_host_workflow` polls it on a Hos worker using the original Tokio handle; do not build a replacement runtime for cached services and do not submit to and await the Host lane from inside itself. Control/session guards needed by an accepted mutation belong to that actual job. +Subjektiv session Read/Search, subject response projection, memory staging and +legacy consolidation-scope helpers also use Host ownership: they can synchronously +call Runtime/network services outside their SQL transactions. Pure DB-resident +Subjektiv scope and memory projection helpers stay on the DB lane. Host admission +must not be acquired again from an already-owned Host workflow. Backend Job cleanup has a third finite lane (two workers, 16 queued jobs), so a long Run teardown wait cannot starve ordinary Host control/stop requests. It is @@ -69,9 +74,14 @@ unknown DB outcome. Runtime teardown is still its own lifecycle fence, not proof of model processing. Remote subscription and Workdir authorization are async callbacks: their complete -live binding check and fresh request signing are offloaded together. A queue error -must not fall back to a configured bearer token. Synchronous CLI/migration callers -and existing synchronous Runtime adapters retain their explicit blocking boundary. +live binding check and fresh request signing are offloaded together. Cold protocol +source lookup in `connect_workspace_worker_protocol` is also awaited as an owned +DB stage, rather than invoking its synchronous signing callback on Tokio. +`WorkspaceWorkerRuntime::observation_source` is fallible: live binding/signing +failure and bounded admission errors propagate explicitly, not as a missing +source or a fallback to a configured bearer token. Synchronous CLI/migration +callers and existing synchronous Runtime adapters retain their explicit blocking +boundary. ## Caller recipe (including assignment APIs) diff --git a/docs/report/2026-10-12-t748-suite-diagnosis.md b/docs/report/2026-10-12-t748-suite-diagnosis.md index 3e73e67c2..ff78dc17f 100644 --- a/docs/report/2026-10-12-t748-suite-diagnosis.md +++ b/docs/report/2026-10-12-t748-suite-diagnosis.md @@ -148,7 +148,7 @@ The fresh candidate build listed the expected executor tests and total test coun ## Validation and remaining composition boundary -Final code source `49bfbfb2` passed the full default-parallel Server suite, +Pre-review code source `49bfbfb2` passed the full default-parallel Server suite, including the command-overload case: 960 passed, zero failures, one existing ignored migration fixture; 11 binary tests, library duration 175.29 seconds. The only captured panics were the three deliberate unknown-outcome tests. @@ -159,6 +159,49 @@ These commands used the isolated candidate artifact directory; libtest default parallelism and the production budgets were unchanged. The MR records the exact published source, which also includes this report and the boundary document. +## Post-publication independent review and causal fixes + +MR `01a12d3f-e90c-7b02-9ed9-cf3bd2e822a1` seq3 independently reviewed published +source `66bb9d0b` and requested changes despite the successful original suite. +Its two major findings exposed boundaries the earlier tests did not prove: + +- `T748-DB-NETWORK-LANE`: mixed Subjektiv helpers could wait for synchronous + Runtime HTTP on the sole DB worker. Fix `d3fcfb29` places session read/search, + subject projection, memory staging, and legacy consolidation-scope helpers on + the existing finite Host owner; pure DB-resident operations keep DB placement. + Whole transaction helpers remain intact, and no Runtime I/O is introduced + inside a SQL transaction. +- `T748-ASYNC-PROTOCOL-SIGNING`: cold protocol source lookup called live binding + checks and signing directly on Tokio. Fix `c0223a0d` awaits the owned DB stage. + The source API now propagates failure explicitly: an invalid live binding or + signing/admission failure cannot be hidden as `None` or a legacy bearer fallback. + +Permanent real loopback HTTP regressions hold upstream Runtime replies during +session read/search, subject and legacy-scope requests, while independently +observing SQL, timer and control progress. Cancelling waiters retains the actual +Host lifecycle lease until completion. Cold protocol source tests control another +SQLite writer and shared connection mutex wait, and verify bounded overload, +fresh signing and revocation without fallback. Existing queue/cancellation and +deletion evidence now observes the actual mutation owner; the mixed fixtures +explicitly inject a small finite Host budget. Production budgets are unchanged. + +Focused boundary tests passed (10). Restoring the old placement produced a +failing regression, and fixed placement passed; an earlier syntax-rejected +instrumentation attempt is excluded from evidence. Diagnostic artifacts under +`target/` are not production source or replacement domain implementations. + +Exact code source `c0223a0d` then passed root `cargo check` and the original +**default-parallel** Server suite: **962 passed, zero failed, one pre-existing +ignored**, 11 binary tests; library duration **173.36 seconds**. Only the three +intentional executor panic diagnostics appeared, with no residual test processes. +Workdir default (153) and `http-client` (156) full suites, format/diff checks and +state-contract naming (558 matching lines, zero unapproved, zero stale) passed. +All used the isolated `target/t748-candidate-build` artifact directory. Logs: +`target/t748-review-fix-{root-check,full-suite,workdir-default,workdir-http,format,names}.log`. +The following documentation-only commit does not change that tested code. +Fresh independent review of the normally advanced same MR source is still +required; previous `request_changes` evidence is not approval of this fix. + No latency benchmark, production incident measurement, target integration, Ticket conclusion, or running-environment update is claimed. T743 has now published its caller inventory/source; its owner will compose the T748 facade and