Repository navigation
test(pi): cover crash after native cancellation before journal publication - #1307
Merged
Merged
Conversation
…lation-crash-1025 # Conflicts: # docs/pi-durable-cp1204-1048-acceptance-ledger.md # docs/pi-durable-native-guarded-abort-compatibility.md # packages/pi-durable-adapter/src/native-cancellation-publication.fixture.mjs
0xPlayerOne
changed the title
0xPlayerOne
marked this pull request as ready for review
October 24, 2026 04:13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Exercise the crash window after actual guarded native cancellation commits and its persisted receipt is verified, but before the adapter receives that reply or publishes cancellation intent. The parent waits for an fsynced boundary marker, sends SIGKILL and confirms process death before opening two fresh authorized recovery processes.
Both recoveries remain
unknownwith the same pending inference and zero inference authorizations, engines, models, provider calls or usage settlements. They invent no cancellation intent, native receipt, safe-resume marker or terminal result. The parent reaps every owned process before removing its SQLite directory; uncertain cleanup preserves state and aggregates failures. Existing injected-failure assertions are retained.Exact published head:
2ed2501bd247c6f02bc0ae1d9ae59be555b83845, including history-preserving integration of maina0086343c6b0c79c81eeabd8f1b237aaf08095ef. Normal local qualification on this frozen, clean head:bun run format:check,bun run lint,bun run type-check: pass.bun run test:unit: 5,067 pass / 11 skip / 0 fail, 34,401 assertions, 175.47s. Coverage 82.21% lines / 84.09% functions against an 80% minimum. Includes the actual compiled Node 24.21.0 crash proof and prior publication/registration cases.bun run test:group:e2e: 504 pass / 0 fail, 4,010 assertions, 81.98s.bun run test:group:smoke: 1,052 pass / 13 skip / 0 fail, 9,797 assertions, 168.50s. The unchanged original TLS certificate-chain test passes (13,197.69ms).E2E and smoke ran ONCE serially through the existing fleet-heavy scheduler, with original inventory, seed 1104, assertions and deadlines, no instrumented replacement and no source changes. No retry-until-green policy or threshold change was used.
Historical evidence remains: #1305 head
ce6501b3had one normal smoke failure, migration expecting syntheticXX999but receivingCONNECT_TIMEOUT. A selected diagnostic and one full 53-file instrumented composition did not reproduce it; the latter passed 1,052 / 13 skip / 0 fail. The original timeout's cause remains unproven. Current-head green qualification is not a causal fix claim; an unreferenced timer-tick delay also does not establish blocked networking.Refs #1025 and #935; #942 stays open. Pi Sol owns these five test/doc paths. This is negative no-repeat qualification, not positive cancellation recovery, unopened receipt lookup, independent restore-generation authority, complete production writer participation or production activation.
Auto-merge off. Root reviews exact published heads; Advance Queue alone controls readiness and merge.