Repository navigation
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Reviewer's GuideThe PR adds narrowly scoped Linux recovery for first-fsync lock crashes, backed by an extensive isolated syscall-injection harness that compares exact durable state and restart receipts, plus CI, documentation, fixtures, and 50-writer concurrency validation. Sequence diagram for first-fsync lock crash recoverysequenceDiagram
participant Mutation
participant Lock as Lock manager
participant Gate as Publication gate
participant Kernel as Linux kernel lease
participant Owner as Original process
participant Recovery as Durable recovery
Mutation->>Lock: acquire_lock_attempt()
Lock->>Gate: write complete lock payload
Lock->>Gate: fsync()
Kernel-->>Lock: SIGKILL during first fsync
Mutation--xOwner: process dies
Recovery->>Kernel: hold permanent lease
Recovery->>Owner: confirmed_dead_owner()
Recovery->>Gate: read_lock_owner()
alt identity matches and gate is empty
Recovery->>Recovery: write recovery intent receipt
Recovery->>Gate: reclaim_stale_gate()
Recovery-->>Mutation: restart succeeds before TTL expiry
else live, unknown, replaced, or occupied gate
Recovery-->>Mutation: LockConflict
end
Flow diagram for syscall-injection crash corpus validationflowchart TD
A[Create acknowledged synthetic seed] --> B[Run update or comment reference]
B --> C[Observe task-local rename and fsync ordinals]
C --> D[Inject SIGKILL at each declared boundary]
D --> E[Restart the same operation family]
E --> F{State and receipt match reference?}
F -->|yes| G[Verify exact item/history bytes]
F -->|no| H[Retain bounded synthetic failure evidence]
G --> I{Native and published parity?}
I -->|yes| J[Pass corpus boundary]
I -->|no| H
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
…into fix/crash-restart-recovery
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
…into fix/crash-restart-recovery
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The native first-fsync update/comment crashes found by #104 preserve acknowledged data but previously refused restart with exit 4. This PR builds on #104 and must merge after #104; its base remains main.
The integration round pulled the remote head, confirmed no unresolved review threads and no substantive CodeRabbit review body, and merged current main
a600bd8plus the completed #104 branch at328ff009483d754b3e25412580495378025d5d87. Both merges were clean. Main contributes its audited tracker reconciliation. The harness contributes three typed-refusal fixes and four regressions; the recovery implementation and its strict acceptance assertions remain unchanged.The recovery holds the permanent kernel lease, confirms original-process death on the same Linux host/namespace, and admits identity-checked empty-gate reclamation before TTL expiry. Its durable recovery intent still precedes lock removal. Live or unverified owners, occupied gates and replacement identities keep their refusal policy. Item/history serialization and transaction recovery are unchanged.
Before: native update/comment killed at fsync ordinal 1 restarted with exit 4. After: both recover to the exact pre-mutation restart reference, including item/history bytes and raw receipt. The full Linux corpus requires every observed boundary to pass, and permanent independent replay manifests cover both first-fsync reproductions. The non-git concurrency contract retains 50 simultaneous writers and all 150 comments/history links.
Local merged-head verification:
node --test scripts/crash-harness.test.mtspasses 20/20 with zero failures or skips, including both retained replays and all four merged refusal regressions. It completed within its unchanged stored 300-second budget.53e4988177a2298f28f14e49406768484ec4cd0ehas all nine CI jobs passing, including all three full release gates. Its downloaded Linux log confirms 580 ordinary and 580 instrumented Rust tests, zero failed/ignored; all four required Rust metrics are 100 percent, and the crash harness passes 20/20 with zero skips. Source files are unchanged from the validated integrated head. Earlier incomplete local cold builds are not used as full-gate evidence. The existing allowed RUSTSEC-2024-0449 advisory remains.Retained original evidence:
mutation::acquire_lock_attemptto Compare native and published crash recovery with replayable failure evidence #104 and rebuilding makes both permanent replays fail with actual restart exit 4; restoring/rebuilding passes both. The record remains immutable.Process-kill evidence does not establish power-loss durability, unmeasured syscall coverage or cross-runtime journal recovery. Each runtime uses its own raw restart reference; cross-runtime acknowledgement uses the shared projection declared by #104. Separate existing comment lock-conflict diagnostic differences remain on pm-rust-comment-lock-receipt.
pm-rust-crash-lock-restart remains in progress with its claim released for orchestrator verification. Receipt-only changelog and isolated pinned-PM health checks pass; final-head CI receipts are linked above. No review replies or resolutions, PR merge or release.
Summary by Sourcery
Recover native mutations from verified first-fsync lock crashes while adding comprehensive Linux crash-conformance validation.
New Features:
Bug Fixes:
Enhancements:
CI:
Documentation:
Tests:
Chores:
Updated harness stack integration
After PR 104 head
f555a4238fc4d0fa5768feaee0e81dce66031202passed all nine exact-head CI jobs, this branch merged that completed update under the original stacked-PR instruction. Current maina600bd8was already an ancestor. The merge was clean and brings the correct baseline-parity replay guide/docstring distinction, two documentation regressions and LF/CRLF checks. PR 105 still has zero review threads and no substantive CodeRabbit review.All Rust source is byte-identical to previously certified recovery head
53e4988; both permanent first-fsync reproductions and the strict every-boundary recovery assertions are intact. Current native build, strict erasable TypeScript, ESLint and required check-only tracker health pass. The existing pinned-PM linkednode --test scripts/crash-harness.test.mtspasses 22/22, zero failed/canceled/skipped, in about 16 seconds inside its unchanged 300-second budget. All 78 pre-existing history streams retain their original bytes as prefixes. There is no new runtime fix requiring another recovery revert; the original two-fail/two-restored-pass recovery proof and PR 104 documentation controls remain linked and unchanged.Final integration head
ca52b3608505542519781d6709799c163d9e01deincludes the merge and append-onlypm-rust-crash-lock-restartrecords. The item remains in progress with its claim released. The final exact-head CI run passes all nine jobs, including unchangedjust release-checkon Linux, macOS and Windows. Downloaded logs confirm ordinary/instrumented Rust tests: Linux 580/580, macOS 568/568 and Windows 562/562, zero failed or ignored. All four required Rust coverage metrics are exactly 100 percent on every platform with unchanged scope and thresholds. Linux counts: lines 14030/14030, functions 1467/1467, regions 23449/23449 and branches 3298/3298. The final Linux crash suite passes 22/22 with zero skips; macOS passes 13 with nine declared Linux-only skips and Windows passes 12 with ten declared platform skips. Strict TypeScript, ESLint, audit, changelog and required check-only tracker health pass. The existing allowed RUSTSEC-2024-0449 advisory and separately tracked comment lock-diagnostic mismatch remain. No TypeScript coverage percentage or power-loss durability is claimed. Earlier receipts above remain historical evidence. No review replies/resolutions, PR merge or release.