Verify admission cancellation at real native provider boundaries
Problem
Cancellation can leave a HEAD file or submitted LocalStream admission whose owned completion outlives its caller. Memory-only cuts miss that window, and effect counts alone miss silent duplicate admissions. The initial native sweep also oversubscribed CPUs during concurrent runs.
Design
Drive LocalHarness over real LocalStream, filesystem and object I/O. Cut at owned submission and physical completion, mark cancellation, drain accepted work, discard caches, reopen and repeatedly resume. Independent manifests require all 1,008 cuts (294 text, 714 tool/GOAL), ready-read counts 2,623 / 6,876, and named admission cut 83. Check physical admissions, successful completions, model/tool effects and original prompt/digest identity; broken variants must fail the same invariants.
The six admission cases restore one immutable bootstrap into independent roots with fresh scripted providers, in both execution orders. Actual completion synchronization uses one crate-local modeled mutex; registration and terminal-wake controls fail the bounded Loom model.
The final replay pool has at most 64 workers, each polling its driver and owned completions on a current-thread runtime. One bounded pool serves every scenario. There is no additional CPU-sized Tokio scheduler pool.
Deletions
Remove the private memory adapter, public test-driven generic parameters, duplicated scripted-event conversion, atomic/Notify completion tracker, unrelated journal-payload replay, and redundant scheduler threads. Latest concurrency review delta: +8/-2, net +6 lines.
Decisions
- No coverage or authority reduction, wall-clock assertions, sleeps or polling. Runtime is measured externally.
- The cap is measured rather than CPU-proportional: the four-worker/two-scheduler experiment took 71.7 s; 32 current-thread workers took 10.122-10.228 s concurrently. The 64-worker cap retains necessary CPU parallelism while bounding contention.
- Per-case snapshots contain bytes and permissions, never live caches. Per-user owner state remains private and outside the checkout.
- Use the supported ordinary staged-request reader with existing signed read authority and decoder. Internal upload recovery uses the same content-path receipt identity as publication.
- Completion lock order: one state lock, never nested; callbacks, wake and awaits occur after unlocking. The single driver owns the drain waiter. The dedicated model command alone sets
acyclic_native_runtime_loom; ordinary/all-features builds remain ordinary. - No new public API, store, daemon, transport, gateway or journal grant. Private-summary compaction remains stacked #711.
Tests run
Signed head ba8d87723. One final focused bb1 debug build, then direct test binary execution, default stack and RUST_MIN_STACK unset:
| Suite | Result | Process wall time |
|---|---|---|
| Matrix and controls | 10 passed; all 1,008 cuts | 4.591 s |
| Three simultaneous matrices | 30 passed; every cut in each run | 7.476 / 9.007 / 9.124 s |
| Six isolated admission cases, both orders | passed | 0.659 s |
| Windows lb.ps1 harness --lib --tests check | passed | 10.52 s compilation |
The reviewed concurrent baseline was 19.638 / 20.186 / 20.227 s. The unchanged completion Loom model previously passed all 20 schedules and both injected faults in 0.008 s; staged-request identity/authority properties and native recovery were already green. No production synchronization changed in this final delta.
After the disk-space repair, the final Windows runtime binary passed all ten matrix tests (all 1,008 cuts) and the six isolated admission cases. Process times were 50.356 s / 1.772 s respectively. Windows full-matrix performance therefore remains above the standing 10 s target; this is a functional pass, not a timing pass. All commits signed; git diff --check passes; no README changes.
Live steps
Windows full-matrix performance remains above target. #711 is being validated with the tamper assertion-deletion control, internal seeded cut permutation and this bounded runner.
Decisions and validation after merging main
The bootstrap P1 reproduced before the fix: the six-case suite returned Storage("No such file or directory (os error 2)") before executing its cases.
The fix captures and restores the configured state directory, separately from the filesystem provider snapshot. Every restore still has independent immutable starting bytes and a fresh scripted provider. The default per-user path is explicitly checked to differ from the configured path. State stays inside each temporary root and uses its normal TempDir cleanup.
Validation on bb1 after the fix: all six admission cases/both orders passed, 0.967 s process wall time (0.887 s measured inside the suite). Windows lb.ps1 cargo check -p acyclic-harness --lib --tests with the existing feature closure passed, 24.72 s compilation.
Decisions after merging main: the independent manifests detected changed physical I/O. The current implementation has 268 text + 694 tool/continuation = 962 live cancellation boundaries, compared with the pre-merge 294 + 714. The submitted-admission reproducer is the same boundary and now occurs at 57, formerly 83. Updated only the explicit checked-in counts/index; the submission/completion hooks, every-boundary cancellation, drain, cold recovery, prompt/digest audit, exact admission/effect/completion checks, and broken-hook/cut controls remain active. No live boundary is skipped. Ready-read expectations are now 2,547 / 6,715. This count change comes from the main merge, not the forthcoming Windows performance change.
Direct execution of the already-built Linux binary: 10 matrix/property/control tests passed, 4.06 s, exercising every current boundary. No rebuild for the manifest update. Windows performance remains the immediate follow-up.