jerry/buzz

mirror of https://github.com/block/buzz.git synced 2026-11-01 06:51:17 +00:00

Files

Duncan b4c0662fce fix(readState): round-5 v4 conformance — durable latch commit, tagged parse, overflow liveness, behavioral witnesses

Finding 1 (durable latch commit + fresh drain):
- pendingOverrideIntentStore.promoteDeferred() called BEFORE step-3
  persistLocalState() in drainPendingIntentsImpl, so gen1 cleanup and
  gen2 pi/ng land in one v2-blob write.
- scheduleDrain() called after a successful cleanup write when gen2 was
  promoted, so gen2 drains immediately (fresh pass) rather than waiting.
- scheduleDrain() sets pendingFreshDrain when drainScheduled=true (in-
  progress drain); drainPendingIntents() honours it after the impl returns.
- Failure semantics: gen1 register already durable; if the cleanup write
  fails, orphaned receipt is swept on restart (receipt prevents re-bump);
  gen2 (if promoted) stays in-memory and drains this session.
- commitTransaction() is now a no-op unlock when promoteDeferred already ran.
- Tests 30/33 rewritten to assert the new durable contract: v2 blob has
  gen1 register + gen2 pi atomically; restart hydrates gen2; auto-drain
  fires a second pass; queue empty after auto-drain.

Finding 2 (tagged parseForcedUnreadEntry):
- Return type changed to { ok: true; value: ForcedUnreadEntry | undefined }
  | { ok: false } — null is valid legacy v1 data, not a failure sentinel.
- Structured entries rejected when ANY member of sources is invalid (no
  silent partial filtering).
- Caller updated to use parsedPrior.ok / parsedPrior.value.
- Tests 48/49 added: legacy null prior hydrates correctly; corrupt fields
  (readTarget=1e300, invalid marker=-1, invalid source member) rejected
  without blocking valid sibling intents.

Finding 3 (overflow liveness re-evaluation):
- In markChannelReadDirect, when newC > 0xffffffff, re-evaluate
  isOverrideActive(reg, effectiveFrontier) post-advance.
  Inactive → already_inactive (maps to silent-inactive outcome, source
  cleanup runs). Still active → genuine uint32_overflow refusal.
- Restores parity with sync applyOverrideRead() at readStateOverride.ts.
- Test 50 added: {s:0xffffffff,c:0,b:50} + readTarget=100 → frontier
  advanced, register deactivated, silent-inactive outcome, forced owner
  removed, versionBumps=1.

Finding 4 (cross-layer behavioral witnesses):
- wireDrainCallback() harness mirrors production useDrainOutcomeCallback
  with drift guard (exhaustive switch default assigns outcome to never).
- Tests 45/46/47 assert forcedUnreadStore (durable) via wireDrainCallback:
  45: inbox removed, manual remains, v2 blob register+C-bump, no pi/receipt.
  46: silent-inactive removes inbox from persisted forced store, versionBumps=1.
  47: full localStorage round-trip; post-restart drain; forcedUnreadStore
      restored to priorForcedEntry byte-for-byte via deepEqual.
- Tests 30/33 assert v2 blob bytes, restart hydration, auto-scheduled
  fresh drain (see Finding 1).
- Test 37 (reconnect): unchanged from round-4 — fake scheduler fires timer,
  proves second fetch, reconnect coalescing, destroy-cancellation.

File-size ratchet: readStateManager.ts trimmed to 999 wc -l (1000 gate).

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

2026-08-08 13:47:40 -04:00