Publish task compaction summaries in authorized private files
Problem
Admitted tasks could not read model-visible compaction summaries stored in the host journal. Canonical checkpoint validation also used that journal-only loader. Recovery then exposed a missing authenticated journal reader, whose underlying error was discarded when the worker recorded Indeterminate.
Design
Publish summary text through the task's authorized private content binding at summaries/<operation>/<step>.txt. Keep provenance and immutable references in the journal. Bind execution and command journals to the already-issued TaskContext, preserving its authority, lease, native custody, descriptor checks and byte limit. Canonical publication and cold recovery use the authenticated reader. Indeterminate conversion traces the original cause with its task, command and operation.
The canonical regression uses three committed messages backed by private files and depends on the production reader binding. It covers cold recovery, forged-summary rejection, the old journal-loader failure, and a broken validator routed through the same rejection assertion. Removing that assertion breaks the control.
Selection already authenticates the projected history files. Validate every message's limits, grants and original binding before selection I/O; retain the original verifier for native configurations afterward. Plain history no longer performs the duplicate file pass. The shrinking read-once property now stages actual file bytes, reads and verifies their descriptors during selection, and rejects the former repeated-read variant. It would fail if the duplicate production pass were restored.
Read accounting and coverage
The last reviewed head produced 5,075 compaction ready reads. Main's #758 removes 212 redundant command/lifecycle reads per turn; this fix removes the remaining 69 repeated reads of the three plain history files. The measured compaction total is 4,794.
Every increase relative to the earlier verified manifests is attributed below:
| Scenario | Ready reads | Explanation |
|---|---|---|
| Text | 2,754 | Earlier 2,636 + 118 required file-backed command/lifecycle reads |
| Tool/GOAL | 7,195 | Earlier 6,908 + 236 required reads across two turns + 51 for #749's terminal goal acknowledgement |
| Canonical compaction | 4,794 | Earlier 4,745 + 118 required reads - 69 duplicate historical-file reads |
Per turn, the remaining 118 reads are authenticated lineage/pause observation 58, fresh model-settings snapshots 4, and lifecycle/status plus attention projection 56. #758 reuses the existing TaskContext lineage and removes the second successful-turn refresh; no fresh settings or authority check is removed.
Each turn publishes two ordinary task-volume files, lifecycle/status and attention. Their two commits add four blocking pairs and two owned-task pairs, hence 12 cancellation cuts per turn. Text and compaction each gain 12 cuts; tool/GOAL gains 24 from lifecycle publication.
Newly merged #749 adds one conditional request-head publication acknowledging the goal write at the continuation cap. Its indexed inputs/current.json write, generation pin and pinned verification add 51 ready reads, four blocking pairs, two owned-task pairs and one native pair, hence 14 additional tool/GOAL cuts. It consumes no continuation allowance and dispatches no model/tool. Text and compaction have no goal and gain no operations from #749.
All 1,834 cuts pass: 334 text + 834 tool/GOAL + 666 canonical compaction. None of the previous 1,772 cuts is omitted. Independent checked-in manifests, seed-711 permutation, named submitted-admission cut 111, exact admission/effect counts, repeated resume and broken recovery/omission controls remain.
The earlier 3,995 compaction expectation described an injected text-history fixture. This fixture exercises real committed canonical history, private content and immutable-manifest discovery. Prior profiling removed another 220 repeated reads: parent revalidation 174, repeated input 23, and reloading a just-staged authenticated proof 23. Public summary entry points and cold checkpoint validation retain their checks.
Deletions
Remove model-visible summary text from host-journal staging, manual fixture reader injection, repeated parent/input/proof/history reads, repeated per-cut fixture initialization, and redundant replay pools. Restore independent filesystem/stream snapshots and reconstruct runtime/provider state per case. Full PR delta: +2,115/-133, net +1,982, chiefly canonical recovery fixtures and cancellation verification. Review fixes excluding main merges: +239/-46, net +193.
Decisions
- Current main
ab110844c, including #758 and #749, is integrated with signed merges, preserving the already-pushed branch as lane rules require. The final main merge resolves only the effect/GOAL manifest conflict; the canonical fixture uses main's new retained Turn-record admission API. No unmerged prerequisite remains. - No broadened journal grant, new public API, compatibility shim, server/gateway, transport or authoritative store. Summary bytes are ordinary authorized private-volume files.
- One bounded replay pool uses current-thread runtimes; setup/recovery use existing inline host I/O. Controlled submission/completion barriers run before that path and remain intact. Snapshot restores compare bytes and permissions and share no live runtime/provider caches.
- Suite times are measured externally; no wall-clock assertions, sleeps, polling, reduced cases or stack-limit changes. Windows matrix performance remains the separate nonblocking follow-up.
Earlier validation
Signed head 630ad94a3fa2926d9f19133aa9aaa80b0080cb6d. Linux debug library built at this exact head after repointing the fixture, then direct binaries ran with RUST_MIN_STACK unset.
| Focused suite | Result | Process wall time after build |
|---|---|---|
| Complete cancellation matrix and controls | 13 passed; all 1,834 cuts | 8.999 s |
| Six isolated admission cases, both orders | passed | 0.765 s |
| Content preflight and three shrinking properties | 4 passed | 0.016 s |
| Canonical private-summary recovery/tamper and assertion-deletion control | passed | 0.164 s |
| Executor compaction | 13 passed | 0.016 s |
| Original-error TRACE regression | passed | 0.064 s |
| Windows lb.ps1 cargo check -p acyclic-harness --lib --tests, existing feature closure | passed | 29.29 s compilation |
The matrix test itself took 8.912 s. Linux build took 2m44s. Build and direct-run log: /home/var/log/buildbox/2026-10-16T211925618Z-807629.log. Before #749, the same review fix passed all 1,820 then-current cuts in 7.385 s. These are different heads/case sets, not a paired performance comparison. LF, signature verification and git diff --check pass; no README changes.
Final worker-queue review fix
Signed head 0b5a66cb9c61dbf7a57d39473a22bd1ab0fbed5c keeps controlled native operations on their original host/native worker pool. The existing submission gate precedes the actual capacity wait and queue acceptance; the completion gate follows the actual physical terminal. The owned completion survives caller cancellation, propagates queue errors, and retires the file fence on failure even when its caller is gone. There is no direct job.run() on the Tokio controller task.
The saturated-queue regression asserts no execution before capacity release, capacity and terminal wakes, real thread handoff, and one effect. Its deliberately broken direct-execution variant fails the same capacity assertion. A scoped completion regression independently asserts both boundary names and the actual acyclic-host-io-* worker name, so restoring the old bypass in the controller also fails. No new lock, synchronization primitive, public API or coverage-manifest change is introduced; the existing tracker model and production admission synchronization are unchanged.
Final Linux debug build and direct binaries ran with RUST_MIN_STACK unset:
| Focused suite | Result | Process wall time |
|---|---|---|
| Actual worker queue, handoff and broken capacity control | 3 passed | 0.008 s |
| Existing native admission/cancellation/fencing | 10 passed | 0.064 s |
| Complete cancellation matrix and controls | 13 passed; all 1,834 cuts | 7.835 s |
| Canonical recovery/tamper and broken-validator control | passed | 0.164 s |
| Six isolated admission cases, both orders | passed | 0.866 s |
The matrix itself took 7.789 s. Final Linux build took 2m53s; log /home/var/log/buildbox/2026-10-16T215013383Z-845311.log. Windows lb.ps1 cargo check -p acyclic-native-runtime -p acyclic-harness --lib --tests passed at the signed head in 23.19 s compilation. An initial queue-test fixture incorrectly used the measured-only wait API without a meter; the final regression polls the physically completed result directly and passes.
This review fix is +177/-15, net +162 across four files, chiefly three deterministic queue regressions. The shared/bounded replay I/O pools and Windows matrix performance remain the explicitly requested separate follow-up.
Main conflict resolution
Final signed head efc52194f32aac75cc978d26c6208c6d0b04c6ef integrates main f929b60e6, required because GitHub reported a conflict after the worker-queue fix was pushed. Retain #733's exact-summary provenance authentication, original-upload lookup and scoped buffer accounting, together with private summary publication and the no-duplicate-history pass. Repoint the read-once fixture to the new journal argument and explicitly import the private scope checker. The newly merged automatic-compaction test now asserts its actual private summary, unchanged admission grants and rejection when private read authority is removed; exact journal-summary exception controls remain covered separately.
All independent manifests are unchanged: 1,834 cuts and ready-read totals 2,754 / 7,195 / 4,794. The current ordinary-provider scenarios introduce no additional reads from main's native-origin index. Canonical source, summary and model-content profile counts also remain unchanged.
One Linux debug build (2m43s) followed by direct binaries at the merged head:
| Focused suite | Result | Process wall time |
|---|---|---|
| Real-read content properties | 4 passed | 0.016 s |
| Canonical private recovery/tamper/control | passed | 0.164 s |
| Retained exact-summary authorization/accounting properties | 7 passed | 4.984 s |
| Production automatic private compaction | passed | 0.869 s |
| Complete cancellation matrix and controls | 13 passed; all 1,834 cuts | 25.199 s |
| Six isolated admission cases, both orders | passed | 1.167 s |
Windows lb.ps1 cargo check -p acyclic-harness --lib --tests passed at the merged head in 28.17 s compilation, excluding its 30 s slot wait. Log: /home/var/log/buildbox/2026-10-16T215958116Z-857030.log. The merged-head matrix exceeded the timing bar despite passing every invariant. The explicitly requested separate replay-pool/Windows performance follow-up will address this; this result is not described as a passing timing gate.
Current PR delta against main: +2,143/-152, net +1,991. No README change or human checkbox change.