Skip to content

test(ui-server): control primary boot probe deadlines - #2174

Merged
schlessera merged 7 commits into
mainfrom
test/1939-primary-deadline-0113361e
Oct 17, 2026
Merged

schlessera merged 7 commits into
mainfrom
test/1939-primary-deadline-0113361e

Conversation

@schlessera

@schlessera schlessera commented Oct 16, 2026 •

Copy link
Copy Markdown
Owner

Closes #1939

Ten original boot-probe scenarios now advance the actual source-owned primary callback after real version output, pending native stdout/stderr reads and target readiness. The original unwrapped and two hung-helper cases retain native five-second delivery; #2180’s forward/backward wall-clock controls also remain native. All thirteen original scenarios and 28 authored assertion lines remain, plus three cancellation/restoration controls: 18 cases total.

The file-local controller pins the SDK path, enclosing probeVersionCommand declaration, callback expression and actual registration stack site. Independent literals enforce 5000/250/200 ms. At 4999 the probe remains pending; at 5000 the callback delivers exactly once. Cleanup/helper timers, process groups, signals, pipe reads and returned promises stay native. Inherited readiness compares the live descendant’s actual stdout/stderr endpoints with the exited parent’s original endpoints.

All elapsed observations/polls use monotonic time. The clock-jump controls independently measure actual native delivery outside the helper, so logical 5000 ms cannot satisfy their five-second guarantee. Nested cleanup settles direct children/native reads, discards owned handles/callbacks and restores complete descriptors even after a genuine disappearance-assertion failure. Their pass-through spawn observer unwinds before each outer wall-jump patch restores. Production source/defaults and public surfaces remain unchanged; the wait guide describes the redistributed guarantees.

Current local proof

Candidate 2c10aa257e2629f023c94a01717946ca543579f3 integrates main 85873db77bf09143c51818255d2d4733a8eb1f67, including the delivered #2180 correction. Test SHA256 3c357915be8cdc4e412edc5ad4c1ee222948088e30394ebe609015b60974d671. Both production files remain byte-identical: version probe 086e77e6db8786fa250121093d3f345df7cd9e1a3f89ac0a3079faf878e26db0, exec wrapper e9d38a19a0ebe129c6aa07f1d9cf40ab610dc5e5119f8cd9a8d5bfa989a25ee1.

  • Complete uninstrumented file passes 18 tests / 702 assertions. Root strict types pass. Required preflight passes lint/leakage/metadata gates, 53 fast tests / 1371 assertions and the complete 18-case file / 702 assertions. The frozen copyfile install check reports 950 installs across 1123 packages with no changes. Complete hosted execution results and their sole stale-base aggregate failure are recorded below.
  • Twelve intended mutation/restoration pairs pass on this exact test source: early/late default, wrong timer selector, wrong function owner (public export preserved), ignored cancellation, wrong signal, late group kill, false noop confirmation, parent exit treated as EOF, uncompleted helper cleanup, omitted descriptor restoration, and logical delivery substituted in a native wall-jump control. Each mutant fails its named assertion rather than module loading, and its immediate restored control passes. The last fault fails the independent native lower bound at 4.71 ms versus >=4950 ms. Temporary production mutations restore byte for byte.

Matched observations

Serial arms use the same private installation, Bun 1.4.2, 32 allowed host CPUs, ordinary offline preload and explicit loopback-only unprivileged namespace with all capability sets zero. Only the test file changes between arms. Host load is uncontrolled. Python perf_counter measures outer physical elapsed; GNU time records CPU/RSS. Installation is outside the comparison.

Arm Cases / assertions Monotonic command seconds Summed case ms CPU user + system s Peak RSS KiB
Corrected native whole file 15 / 109 76.811 76479.94 0.56 + 0.33 95736
Proposed whole file 18 / 702 27.834 27503.45 0.40 + 0.19 95496
Corrected native ten affected cases 10 / 74 51.342 51063.10 0.38 + 0.28 93084
Proposed same ten affected cases 10 / 492 1.317 1059.74 0.27 + 0.05 95148

This is one current-source local pair per selection, with three added safeguards in the proposed whole file. It does not establish a stable percentage, memory reduction or hosted critical-path speedup. Outer setup/join/runner overhead beyond summed case bodies is included in command time, not treated as separate performance gain.

A separate temporary final-source profile passes all 18 cases. Controller setup/readiness/disposal windows total 1.435 / 17.243 / 1038.329 ms; disposal includes the genuine 1000 ms disappearance-failure witness and native joins. This is elapsed ownership cost, not isolated JS CPU. Thirteen controlled observations record ten primary deliveries and three cancellations, ten native 250 ms cleanup registrations (four deliver) and six native 200 ms helper registrations (all clear). The five native cases install no timer replacement. Fifteen readiness polls were observed, not configured. All 26 direct child PIDs and three distinct non-child descendants are independently absent; descendants are disappearance observations, not awaited direct-child reaps. Instrumentation was removed and the exact source restored.

Assertion map

Original cases Retained guarantee
Unwrapped brain (1) Native 4950–6500 ms and timeout warning.
Missing/failing helpers (4) Real spawn failure/exit 3, warnings and fallback.
Hung helpers (2) Native 4950–6500 ms, positive helper PID and original liveness ordering.
Noop helpers (2) Actual target alive before teardown; native 250 ms unconfirmed-cleanup window.
Inherited pipes (2) Parent exit, direct endpoint ownership, pending readers and native 250 ms negative window.
Group killers (2) Original PID/KILL/alive record and exactly --version argv.

The ten controlled elapsed operands explicitly combine 5000 logical primary ms with measured native settlement, retaining the original 1500 ms allowance. They are not ten real five-second observations. #2180’s two added jump cases independently retain real native duration and complete restoration. #1310 remains independent.

Hosted qualification and relevance assessment

Confirmation 39038788470, attempt 1, passes all fourteen selected execution jobs: metadata/discovery, types, all four units, both browsers, both layouts, captures, endurance and both runtimes. Packaging intentionally skips. All eighteen boot-probe cases pass in unit 3 (summed case bodies 27529.09 ms). Every actual job, including aggregate, checked out 345924da02c939cb0ecf0d1a5bd180cf5ac499c5, tree 6d0ec900c70d422bbb502167b1653bcbbda4e88a, parents the recorded base/head above. All thirteen artifact digests and checkout receipts verify. The full request costs 7303 summed job wall-seconds and 944 event seconds, not CPU or additive elapsed.

The overall workflow remains failed solely because aggregate saw live main advance to 9423920fcd696c57156a20424789e871066c21f4 during its final check. The one incoming commit is #2145’s voice-permission UI, WebSocket capability/voice-activity handling, related tests/docs and exact source-browser dispatch pin. It changes no boot-probe test, callback owner, production version-probe/exec-wrapper, deadline, fixture, dependency/lockfile, preload, workflow or test runner. The host-path probes exercised here do not enter the changed voice/WebSocket handling. This source review finds no input interaction with this test-only controller or its wait guide.

Under the explicit session selective-refresh instruction, retain these passing executions with their actual older base rather than restart unrelated proof. The prospective combined tree is a22ea0d7785e956da3bb05725b97df30e48aec09, distinct from the hosted tree; actual squash identity must match it. No older execution is relabelled proof of that different combined tree, no aggregate is called green and no protection bypass is used.

Historical receipts

The old final focused baseline at the adjustable-clock source remains failed (8 pass / 2 fail, elapsed 6541/6550 ms); no proposed arm followed and it was never retried unchanged for green. #2180 delivered a distinct corrected baseline, used above. Earlier passing pairs, clock diagnostics, eleven historical mutations and three cancelled ready requests retain their exact older identities in the existing review comments. They are not relabelled current-source or hosted proof. #2180’s automatic actual-main CI 39033938992 subsequently passed independently.

The maintainer’s session selective-refresh instruction remains active: assess main changes, retain honestly attributed proof for unrelated advances, and qualify affected inputs when changes could sway results. No coordinated pause, reservation or CI configuration change is claimed.

Checklist

  • Scoped behavior, assertion mapping and meaningful current-source native/mutation proof pass.
  • Required local preflight passes.
  • All selected hosted execution jobs pass; the sole stale-base aggregate failure and session selective-refresh merge basis are disclosed below.
  • PR and issue retain release 0.44.0 (58); read back again before merge.
  • No changeset: test execution and proof documentation only.
  • No public machine surface, production deadline, discovery or concurrency change.
  • Source citations into the moved test file were audited; none exist in repository docs/source.
  • Nothing on provider history changes.

Anything left open

Merged normally with matching head as 3227bffcf0ad25a7245cd0b4cc2df201e0c6910f, parent 9423920fcd696c57156a20424789e871066c21f4. Main ancestry and exact prospective tree a22ea0d7785e956da3bb05725b97df30e48aec09 are verified. Actual-squash complete offline proof passes 18 tests / 702 assertions in 27.70 seconds. PR and issue are closed with verified release 0.44.0. Automatic main push 39040016479 remains separately in progress; all selected PR execution jobs pass with the stale-base aggregate and relevance assessment disclosed above. #1939 is delivered; epic #1849 remains open. Independent #1310 historical attribution remains open.

@schlessera schlessera added this to the 0.44.0 milestone Oct 16, 2026
@schlessera schlessera added type: test Coverage, harness or proof work with no behaviour change. area: ui-server Hono app factory: turn coordinator, auth, session catalog, routes, cron. labels Oct 16, 2026
@schlessera
schlessera marked this pull request as ready for review October 16, 2026 16:48
@schlessera
schlessera marked this pull request as draft October 16, 2026 16:49
@schlessera
schlessera marked this pull request as ready for review October 16, 2026 16:50
@schlessera

Copy link
Copy Markdown
Owner Author

Local qualification at unchanged scoped blobs on head 53b2a873f293583effd561f8862ba3be92a043f8 (base ff85aca0f86fa3498acc3685bac7173d67b8a0ce, tree ef89c5f6862c3ad17dd80272f6e2a0b536e40c35): fresh preflight passes the 53 selected invariant cases and all 16 changed-file cases / 651 expectations. GitHub's independently fetched merge ref 256a09414229ffc2328f6d0a83895adc8782784d has exactly that base/head and tree. This is a source identity check, not hosted execution proof.

The full ten-mutation set has now been executed against the final SDK-path-bound selector and restored after every mutation: early/late defaults, wrong ownership selector, ignored cancellation, wrong signal, late group invocation, false noop confirmation, false parent EOF, omitted helper termination and omitted descriptor restoration. Every mutant exits 1 on its named behavior; each immediate restored command exits 0. The private test file is restored byte for byte, and production source remains unchanged. The earlier less-specific selector's receipts remain separate.

Temporary profile observations: 21 one-millisecond readiness polls over 13 controlled cases (ten original and three added); the native three controls do not install timer replacements. Of thirteen captured primary registrations, ten deliver once and three clear without delivery. Ten cleanup registrations retain native 250 ms (four deliver, six clear); six helper registrations retain native 200 ms and all clear. Twenty-four observed direct-child PIDs were individually absent after awaiting their real exit promises. The inherited-descendant tests separately assert native endpoint identity and non-child disappearance; they are not counted as awaited direct children. Original legacy liveness polls are retained and were not counted by this temporary readiness observer.

Baseline test SHA-256 d7336e86fb9d5e4dd91beea912435ab50354399fb2a57a6adbb185854dc62867; final test 5a1af6d3eabc16d7f7feb0961501d5a2f007b734ce40a35544b76d3698751748. Shared version probe remains 086e77e6db8786fa250121093d3f345df7cd9e1a3f89ac0a3079faf878e26db0, helper e9d38a19a0ebe129c6aa07f1d9cf40ab610dc5e5119f8cd9a8d5bfa989a25ee1. Frozen private copyfile installation took 37.94 seconds, outside all reported behavioral command timings.

The first ready request, 38934804111, was explicitly cancelled with no executed tests after main advanced. No failed test was retried. The refreshed exact-candidate request is 38935112410; it is still queued, not passing proof. Project-sync's separate queue overflow remains the documented board limitation. Nothing here resolves #1310 or completes #1939 before required hosted and actual-main proof.

@schlessera

Copy link
Copy Markdown
Owner Author

Additional ownership-cost observation on the unchanged final test blob: all 16 cases / 651 expectations pass in a separately instrumented 18.89-second command. Temporary constructor/readiness/disposal windows total 0.906 / 16.758 / 1,034.115 ms. For the original thirteen scenarios, those windows are 0.765 / 13.464 / 23.333 ms; the added genuine disappearance-failure witness deliberately consumes its original 1000 ms cleanup watchdog. Readiness includes native IO/poll latency, and disposal includes native exit/disappearance joins: these are elapsed windows, not isolated JavaScript CPU cost. Descriptor-assertion calls remain included in whole-command timing, outside the disposal window.

This profile observes fifteen readiness polls, separate from the earlier twenty-one-poll sample; scheduling-dependent poll counts are not a configured saving. All twenty-four direct children and three distinct non-child descendants (27 unique owned PIDs total) are independently absent after completion. Descendant receipts retain native endpoint identity and distinguish disappearance from direct-child reaping. The expected first disappearance failure is caught by its named rejection assertion before the real fallback cleanup; passing receipts record the subsequent absence.

Temporary instrumentation was removed and the committed source restored byte for byte. The separate ten-affected-case pair passes 10 / 74 at 53.76 seconds unchanged and 10 / 492 at 1.27 seconds proposed; complete resource/body timings are folded into the PR body. This records local ownership cost without claiming a hosted improvement. Hosted ready confirmation remains queued.

@schlessera

Copy link
Copy Markdown
Owner Author

The final function-owner-bound source is committed as a9a37261397e6d72760167e1c4e302ad24945f95 (base 8476426579152765160a70e03a50511f671f6be6, tree d1c5d729d1db73c153e0c72f7d8f5e070444a440). Strict root types and preflight pass, including all 16 cases / 664 expectations. All eleven actual fault/restoration pairs pass at the final test SHA-256 cc87f46e404cc4b8bcea50c296e66cf981ec0689a326b797adf2d3ff31159409. The added owner fault preserves the public export through an alias and fails the named function-owner assertion, with successful module loading.

A fresh final-source whole-file pair passes: unchanged 13 / 89, 69.33 s reported command, 66,466.88 ms summed Bun case bodies, 0.47/0.30 s CPU, 91,072 KiB peak RSS; proposed 16 / 664, 18.98 s reported command, 17,485.19 ms case bodies, 0.32/0.11 s CPU, 90,604 KiB RSS. Source/dependencies/resources are identical between these two arms except the test file. No physical elapsed saving or stable percentage is inferred from an adjustable wall-time report.

The subsequent unchanged ten-case arm failed rather than completing a second comparison: brain/noop elapsed 6541 (<6500 required), Claude/inherited elapsed 6550 (<6500 required), while their Bun-reported bodies are 5252.96 and 5264.21 ms. That command is 8 pass / 2 fail / 69 expectations; no proposed arm followed it and the baseline was not rerun. Its existing test-file SHA-256 is d7336e86fb9d5e4dd91beea912435ab50354399fb2a57a6adbb185854dc62867. This is a real preserved baseline failure, not a failing-first product mutation or a successful timing sample.

Separate native observations record CLOCK_REALTIME/CLOCK_MONOTONIC interval pairs of 579.946/10.078 ms and 745.436/10.106 ms. A separate Bun observer in the same loopback-only capability-free namespace records Date.now/performance.now pairs of 584/10.088 ms and 746/10.092 ms. These establish clock-domain divergence but do not directly timestamp the two earlier failures. #2180 records the separate duration-observation correction; no system clock, native duration bound or production source is changed here. #736's native child list is full (100), so that supporting finding is standalone and referenced. Its priority remains unsorted rather than guessed.

The observer samples Date.now and performance.now around native Bun.sleep(10) in a 35-second loop, recording intervals whose difference exceeds 10 ms. Python independently samples time.time_ns/time.monotonic_ns and reports installed clock metadata. These diagnostics are separate from test proof; they do not fix or retry the historical failing command. Earlier source variants, passing pairs and profile receipts remain attributed above. The PR body now describes the final implementation and both passing and failing measurements explicitly.

…dline-0113361e

# Conflicts:
#	packages/ui-server/tests/boot-probe-deadline.test.ts
@schlessera
schlessera marked this pull request as ready for review October 17, 2026 13:58
@schlessera
schlessera merged commit 3227bff into main Oct 17, 2026
17 of 29 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: ui-server Hono app factory: turn coordinator, auth, session catalog, routes, cron. type: test Coverage, harness or proof work with no behaviour change.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

tests: control version-probe primary deadlines with native readiness and cleanup proof

1 participant