docs: the arca revert is half landed, and the handoff for resuming it - #93
Open
richardkiene wants to merge 8 commits into
Open
docs: the arca revert is half landed, and the handoff for resuming it#93richardkiene wants to merge 8 commits into
richardkiene wants to merge 8 commits into
Conversation
P5's second exit clause. Records what was measured rather than what was recorded: arca carries 2 ignore attributes and not 3 (the third grep match is a doc comment at arca_startup.rs:10), only 8 of the 11 apple live tests can run on this machine because run-apple-e2e.sh:59 exports the predecessor image only under a release-candidate receipt, and of the 27 fixture methods those 8 call, exactly 5 touch the Apple runtime. That last number is what makes the shape cheap: one shared fixture, a five-method RuntimeInspector trait, two implementations. The test bodies are re-pointed rather than retyped, so a port cannot silently assert less than the original. Two things stated rather than left implicit. The harness loads the workspace image itself via skopeo and arca-engine image load, which contradicts roadmap:505 marking U5 as blocking P5 exit -- the reasoning is in section 4, and a green suite is not evidence that U5 is closed. And the backend guard is mutation-tested, because backend.rs:168 returns Apple when nothing is requested, so an untested guard and no guard are worth the same.
…he fork's Validating the design found its own central assumption false. Same test, same binaries, one variable changed: 1-layer alpine passes 2/2 in 6.44s, the 35-layer approved workspace image fails at create with "no free indices are available for allocation". The engine attaches one block device per OCI layer and tags come from a 26-letter alphabet, so 24 remain after initfs and the writable overlay. Not a regression. git grep against upstream/main finds no OverlayFSUnpacker, ArcaBlockDeviceRole or ArcaLayerAttachment; upstream stays under the same allocator because LinuxContainer takes one rootfs Mount. The fork caches per layer, which pays when derived images share base layers -- a registry workload Gas Can does not have, since it pins one workspace image. The decision is to revert to upstream rather than raise the ceiling or shrink the image, so upstream's work arrives by merge instead of being reimplemented. Scope is measured in section 4.1: roughly 2200 lines across two repositories, mostly deletion, and about 722 of them appear already dead since OverlayFSClient has no external references. The fork is 70 commits ahead of upstream and 0 behind, so nothing has to be reconciled first. Everything outside section 4 survives: the measurements, the structure, the backend proof and the failure discipline are unaffected.
PR 1 (arca-containerization#2) is merged as a5803b6, a merge commit with parents 6304122 and 10f408c; all four cited SHAs verified reachable from origin/merge/upstream-main. PR 2's Task 5 is complete on arca's revert/upstream-rootfs, unpushed. Tasks 7-14 remain; Task 6 was ruled already satisfied by the twelve-mutation matrices in the Task 5 reports and reviews. Records the two constraints that break things if forgotten: arca's submodule pointer may only be advanced by PR 2, because PR 1 deleted a mount filter whose producer is still in the parent until Task 9; and the submodule is deliberately held at 6304122 for Tasks 5-11 so the parent builds against the un-reverted submodule. Also corrects this file's own ignore-attribute count. MEASURED 2026-08-22 with `grep -cE '^[[:space:]]*#\[ignore'`: arca carries 2, not 3 -- arca_engine 2 and arca_startup 0. The unanchored pattern this file quoted counts prose, matching `#[ignore]`d inside arca_startup.rs's own //! header at :10. Apple's 11 is unchanged. The anchored pattern is now recorded beside the number so the next reader does not re-derive the wrong one.
Supersedes the 2026-08-22 handoff, which says "Resume at Task 7" and is now wrong on both the task and the branch state. Tasks 1-12 of 14 are complete. arca PR #61 is open with 25 commits at b3d47b5, submodule at a5803b6 (verified to have parents 6304122 and 10f408c). Execution stopped before Task 13 by an earlier ruling: it publishes a release and Task 14 pushes to a second repository. Records what must survive without the SDD ledger, which is git-ignored and exists on one machine: the two open merge gates (the submodule suite has not been re-run at a5803b6, and no final whole-branch review was run), the residue accepted with reasons, and the measured traps. The ceiling is not yet proven gone, and the document says so plainly. The bump removes 343 lines from vminitd/Sources/VminitdCore, all inside #if os(Linux), and cross-compiling locally is unavailable because the installed Static Linux SDK carries only an x86_64 slice. No guest code in this change has been executed by anything. It gets verified by the 35-layer image creating and running, never by a unit test asserting a device count.
…f says so START-HERE described P5's second exit clause -- the product e2e suite on arca -- as untouched, with no mention that attempting it found a hard engine defect. Adds the reproduction, the fix's PR state, and the reason a green unit suite is not evidence: the submodule bump removes 343 lines from the guest, all inside #if os(Linux), and cross-compiling locally is unavailable because the installed Static Linux SDK carries only an x86_64 slice. Its ignore-count block needed nothing -- it already records arca at 2 with the anchored pattern and explains the //! prose match that produced an earlier 3. Verified: grep -cE '^[[:space:]]*#\[ignore' gives arca_engine 2, arca_startup 0. The 2026-08-22 handoff gets a superseded banner rather than deletion. It says "Resume at Task 7" and calls the branch pushed when that was true only through f1a7f28, but its defect reproduction and trap list are still accurate and still cited from the new handoff.
The ceiling that blocked P5's second exit clause is fixed, merged, and verified by the experiment that found it. No code in gascan changes here; the repin (Task 14) is still not done and `engine/arca-pin.json` still names `c545612`. MEASURED 2026-08-23 on this host. The 35-layer workspace image -- the one that gave `no free indices are available for allocation` on 2026-08-21 -- creates, starts, runs, stops and removes: `cargo test -p gascan-arca --test live -- --ignored lifecycle` reports 3 passed, 0 failed, with 0 occurrences of that string in the engine's own log. The mechanism, which is what design §6 asks for and what no unit test could give: `total_mounts=11`, identical for the 1-layer and the 35-layer image, against the fork's failing `layers=36 total_mounts=38`. The `layer_devices_start` and `layers=` fields are gone entirely -- they belonged to the deleted per-layer path. Nothing regressed, measured against a matched control rather than argued. The same tier against the genuine pre-revert pair -- engine built from the pinned `c545612` (submodule `6304122`), and the released vminit verified byte-exact against the pin -- gives 24 passed / 2 failed; post-revert gives 22 / 4. The two real failures fail identically on both, at `gascan-conformance/src/lib.rs:139` and `live/network.rs:447:13`, so both pre-date this work. The delta is one pin artifact (the engine was built from `main` while the pin still names `c545612`, which is that test doing its job) and one flake. Three claims these documents used to make, now corrected because they were wrong rather than merely stale: - A release was never required to prove this. The live tier honours both `GASCAN_ARCA_VMINIT_LAYOUT` and `GASCAN_ARCA_BASE_OCI_LAYOUT`, so it carries the 35-layer image with a locally built engine and guest. - The Static Linux SDK is not x86_64-only. Both installed SDKs carry `aarch64`; the real blocker is that the SDK's prebuilt Foundation was compiled by a different compiler version than the 6.3.3 toolchain. - Guest code has now been compiled and run. On Darwin `make init` builds it inside the `containerization-dev:6.3.0` Linux container rather than with the host SDK, and the containers above booted on that vminit. Also recorded: two pre-existing defects this did not cause and did not fix, the more serious being an offline sandbox reaching a host endpoint, a public IP and public DNS at both privilege levels; the one open code finding, that ArcaDaemon's half of design §4.4 is pinned by nothing and survives two mutations under a green suite; and the traps this session paid for, including the ad-hoc signing an engine needs before it can start at all. Task 14 step 7 is already done and says so, so the next session does not redo it: the anchored ignore count re-derives as arca_engine.rs 2, arca_startup.rs 0.
The handoff pointed at "this session's scratchpad", which is exactly the failure the SDD ledger's own warning is about: a record whose location stops existing. The reviews, the ceiling measurement, the attribution run and the raw engine logs now live beside the ledger, under .superpowers/sdd/PLAN-revert-to-upstream-rootfs/final-review/ in the arca checkout -- git-ignored and machine-local, with the same `git clean -fdx` warning attached.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documentation only. No code in
gascanchanged.What this adds
docs/status/2026-08-22-arca-revert-handoff.md— a mid-execution handoff for the arca engine revert that blocks P5's second exit clause, written so the work can be resumed in a fresh session.Where the work stands
a5803b6revert/upstream-rootfsPR 1 merged as a merge commit —
parents=6304122 10f408c— and all four cited SHAs verified reachable, so every SHA citation in the design and plan still resolves.Tasks 1–5 of 14 are done and reviewed. Task 6 was ruled already satisfied: its mutation matrix exists four times over in the Task 5 reports and reviews, at twelve mutations and per-assertion granularity against the three the task specifies. Work resumes at Task 7.
What this also fixes
This file's own ignore-attribute count. MEASURED 2026-08-22 with
grep -cE '^[[:space:]]*#\[ignore': arca carries 2, not 3 —arca_engine2,arca_startup0. The unanchored pattern START-HERE quoted counts prose, matching`#[ignore]`dinsidearca_startup.rs's own//!header at:10. Apple's 11 is unchanged. The anchored pattern is now recorded beside the number.The two constraints worth reading even if nothing else is
arca's submodule pointer may only be advanced by PR 2. PR 1 deleted
LinuxContainer.swift's empty-destination mount filter, which was not inert — its producer isOverlayFSMounter.buildMountsin the parent, still present until Task 9. PR 2 removes the producer and moves the pointer in one merge. A bump without Task 9 sends empty-destination block mounts into the OCI spec for every container.The submodule is deliberately held at
6304122for Tasks 5–11, so the parent builds against the un-reverted submodule while its callers are deleted. Task 12 bumps it toa5803b6— the merge commit, not10f408c.Traps recorded
Several measured in this session, including one that would have made every task gate meaningless:
swift test --disable-swift-testingruns zero tests in the submodule, and the plan originally specified it at 13 sites. Alsoswift package describeaccepting an invalid manifest with exit 0, SwiftPM linking stale objects after a signature change, andghresolving to apple/containerization in a checkout with no default repo set.