Skip to content

Prepare Hew v0.6.0-rc1 - #2857

Merged
slepp merged 888 commits into
mainfrom
release/v0.6.0-rc1
Aug 11, 2026
Merged

Prepare Hew v0.6.0-rc1#2857
slepp merged 888 commits into
mainfrom
release/v0.6.0-rc1

Conversation

@slepp

@slepp slepp commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Summary

This composes the completed v0.6.0-rc1 closure work into one release candidate branch.

  • closes the remaining MIR, codegen, runtime, FFI, and stdlib ownership/leak tails
  • hardens actor lifecycle type provenance, terminal mailbox handling, bounded mailbox admission, and channel endpoint identity
  • completes the Arena and MQTT release surfaces and strengthens capability, dogfood, and memory authorities
  • makes release artifacts, package consumers, Windows/FreeBSD staging, npm publication, checksums, and playground dispatch fail closed

Why

RC1 needs one coherent candidate whose compiler/runtime behavior, platform interoperability, memory floor, and publication machinery are proven together. This branch consolidates the independently reviewed closure lanes and the defects found while composing them, rather than shipping them as a sequence of partial release PRs.

Validation

Completed before publication:

  • workspace formatting and strict Clippy through signed commit hooks
  • full hew-types suite: 2,872 tests
  • full hew-runtime library suite: 2,285 tests
  • actor lifecycle authority: 45/45; qualified-constructor regressions: 8/8
  • bounded mailbox concurrency: 73/73; focused FFI mailbox boundary: 17/17
  • complete vertical-slice suite twice with zero failures
  • release contract runners: 28/28, 33/33, 8/8, and 2/2
  • independent Claude Sonnet blocker review and delta acceptance

The comprehensive macOS preflight/leak authority, Linux/FreeBSD/Windows fleet validation, normal CI, and the dedicated release gate are running against this branch. The PR will be marked ready only after those candidate-wide gates and final Claude Opus acceptance are green.

Copilot AI lite review requested due to automatic review settings July 30, 2026 16:22

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

Comment thread scripts/lib/toml_compat.py
Copilot AI review requested due to automatic review settings July 30, 2026 18:09

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

Copilot AI review requested due to automatic review settings July 30, 2026 18:22

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

Copilot AI review requested due to automatic review settings August 2, 2026 17:06

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

Comment thread scripts/bounded_subprocess.py Fixed
Comment thread scripts/libhew-freshness.py
Comment thread scripts/libhew-inputs.py
Comment thread scripts/tests/test_opaque_resource_lifecycle_matrix.py
Copilot AI review requested due to automatic review settings August 2, 2026 17:22

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

@gertybotbot

Copy link
Copy Markdown
Contributor

Heads-up before this gets rebased: the Windows rpmalloc fix does not survive the toolchain repo move.

main moved past this PR with d4793f89 (chore(ci): move LLVM Windows toolchain build to hew-lang/llvm-toolchain), which deleted .github/workflows/prebuild-llvm.yml. git merge-tree against current main gives 3 conflicts:

  • .github/actions/setup-llvm/action.yml (content)
  • .github/workflows/prebuild-llvm.ymlmodify/delete (deleted in main, modified here)
  • .github/workflows/release.yml (content)

The modify/delete is the risky one: it resolves silently in the "take the deletion" direction.

Why that matters. Commit a52b06bf here bumped the Windows toolchain v3 → v4 and added, with a comment explaining exactly why:

# LLVM's integrated rpmalloc exports malloc/free/calloc/realloc.
# Hew links LLVM statically through llvm-sys against the UCRT, so
# use the platform allocator and keep those CRT exports unique.
-DLLVM_INTEGRATED_CRT_ALLOC=OFF

hew-lang/llvm-toolchain publishes only llvm-22.1.0-windows-msvc-v1, and its prebuild-llvm.yml cmake -S argument list contains no -DLLVM_INTEGRATED_CRT_ALLOC at any value. Meanwhile main's setup-llvm still carries the comment describing the failure mode ("statically embeds rpmalloc … duplicate symbols against ucrt at lld-link time") while pinning 22.1.0-windows-msvc-v1.

Provenance is not in doubt. hew-lang/llvm-toolchain has exactly one commit (22832ce9dc) and one successful workflow run (30772094684, head SHA 22832ce9dc, 23:21:41Z → 01:56:54Z). The v1 release published at 01:56:09Z inside that window. So the tree that built the asset is the tree whose workflow lacks the flag — there is no unpushed-tree escape hatch.

If, then: rebasing this PR by taking main's side of the three conflicts (the natural resolution, since prebuild-llvm.yml no longer exists there) makes the Windows release job consume a v1 asset built with integrated rpmalloc, reintroducing duplicate malloc/free/calloc/realloc against the UCRT at lld-link — the exact regression a52b06bf was written to repair.

Suggested resolution: port -DLLVM_INTEGRATED_CRT_ALLOC=OFF (plus the v4 packaging delta) into hew-lang/llvm-toolchain, publish …-v2, repoint setup-llvm, then rebase and re-run the Windows release path end-to-end at the real link site.

Noting this is a draft, so it is not a merge block today — it is a pre-merge defect the rebase would otherwise bury. Asset bytes were not downloaded; the claim is about the published build recipe and its provenance chain.

Copilot AI review requested due to automatic review settings August 4, 2026 05:25

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

Copilot AI review requested due to automatic review settings August 4, 2026 05:36

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

@gertybotbot

Copy link
Copy Markdown
Contributor

Second heads-up on this RC: the CI run at this head has three blocking classes that are regressions against this PR's own base.

Following up my earlier note about the Windows rpmalloc/toolchain-move interaction. This one is separate and, unlike that one, it is not a rebase hazard — it is red right now at head 7851454e01.

Two workflow runs exist at this head. Discussion of this RC has centred on Pre-Release Cross-Platform Gate (30881221758). The sibling CI run (30881224662) is also failure, and it carries a disjoint failure set:

run name conclusion
30881221758 Pre-Release Cross-Platform Gate failure
30881224662 CI failure
30881223349 Code Quality: PR #2857 success
30881224632 Stdlib Int-Surface Lint success

1. Release Gate — Linux x86_64Run Rust workspace tests. nextest run summary from the job log:

Summary [ 719.768s] 13013 tests run: 12919 passed (2 slow, 1 leaky), 94 failed, 645 skipped

201 raw FAIL [ lines reduce to 81 distinct final-attempt test ids across 30 crates (the log emits TRY 1 FAIL retry lines and prints each final failure twice). The distribution is the part worth flagging — it is concentrated in the ownership/affine machinery rather than scattered:

20 hew-cli::distributed_two_process_e2e     6 hew-cli::extern_ownership_double_release_e2e
 6 hew-cli::run_e2e                         5 hew-types::actor
 5 hew-cli::eval_e2e                        4 hew-cli::vec_param_embed_copy_in_temp_leak_oracle
 4 hew-lsp                                  3 hew-codegen-rs::structural

plus *_leak_oracle suites, *_drop_ir, and affine_resource_carrier_boundaries.

2. Clippy & formatVerify FreeBSD workflow contract: 7/23 tests failed. This is adjacent to the FreeBSD provisioning discussion but says something stronger than a missing PATH export: the contract gate asserts the provisioning sequence violates the repo's own declared bootstrap contract in every FreeBSD job.

FAIL test_all_freebsd_jobs_provision_and_probe_wasi_tools: build-and-test must bootstrap
pkg through the base utility from FreeBSD, refresh only that named repository, then
install the exact tool set without an automatic update; got
[('/usr/sbin/pkg','bootstrap','-fy','-r','FreeBSD'),
 ('pkg','update','-f','-r','FreeBSD'),
 ('pkg','install','-y','-U','-r','FreeBSD','llvm22','gdb','rust',...)]

plus test_pkg_bootstrap_phases_cannot_be_removed_reordered_or_merged, test_named_repository_drift_is_rejected_in_every_freebsd_job, test_nightly_bash_package_removal_is_rejected, test_commented_nightly_tool_commands_are_rejected, and both indent-decoy tests. A fix scoped to one PATH line would leave these 7 red.

3. Docs & scripts gatesVerify release workflow contract: 1/41 failed, test_release_record_is_durable_and_tag_ready. On a release-candidate PR, the gate asserting the release record is tag-ready is red.


Attribution — these are this branch's, not inherited. Read by name on the PR's own base d4793f8949:

check base d4793f8949 head 7851454e01
Build & test (Linux) success failure
Clippy & format success failure
Docs & scripts gates success failure

All three flip success → failure at this head.

⚠️ Scoped deliberately per-check, because the base is not fully green. Build & test (FreeBSD x86_64), Full workspace tests (Windows), Rust runtime ASan and Rust runtime TSan (advisory) are already red on base — so a blanket "the PR broke CI" claim would be false, and part of the FreeBSD failure surface is inherited rather than introduced here. Only the three checks above are attributable to this branch.

Still a draft, so this is not a merge block today — but for a branch whose purpose is to be tagged as v0.6.0-rc1, the tag-readiness gate and the affine/ownership suites seem like the ones to clear first. Read-only from the API and job logs; no build or local reproduction.

Copilot AI review requested due to automatic review settings August 4, 2026 16:35

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

@gertybotbot

Copy link
Copy Markdown
Contributor

Update on my earlier three-blocker note: two of the three are now clear at 76df5732be. The remaining red on Clippy & format is a different, one-line cause than the FreeBSD contract failure it replaced.

Re-read by name against the same checks I attributed last time:

check base d4793f8949 prev head 7851454e01 head 76df5732be
Docs & scripts gates success failure success
Clippy & format success failure ❌ failure — new cause
Build & test (Linux) success failure ❌ failure

Blocker 3 (release-record tag-readiness) is resolved. Blocker 2 (FreeBSD workflow contract) is also resolved — the Verify FreeBSD workflow contract step is now success on this job, so the 7/23 contract failures are gone.

What Clippy & format fails on now is unrelated to either. The job dies at Verify every corpus floor has a live call site:

cargo nextest run --profile ci -p hew-cli --test leak_harness_fail_closed
error: no such command: `nextest`
make: *** [Makefile:753: test-leak-oracle-selftest] Error 101

Cause is a prerequisite added to a target that runs in a job with no nextest. On base, Makefile:1108 read:

corpus-floor-check:
	bash scripts/tests/test_corpus_floor.sh

At this head, Makefile:1190 reads:

corpus-floor-check: test-leak-oracle-selftest

and test-leak-oracle-selftest (Makefile:752) shells straight into cargo nextest. The Clippy & format job installs LLVM and the Rust build action but never cargo-nextesttools: nextest appears in ci.yml only on the jobs at lines 500 and 858, not this one. So the lint job inherited a nextest dependency it has no toolchain for.

Worth flagging because of what it masks. This step sits early in the job, so its failure leaves 14 downstream steps skipped, including Run structural authority lint, Clippy, Codegen carried-identity gate, Runtime poison-safe lint, Orchestration-token leak scan and Preflight↔CI parity self-test. None of those has been evaluated at this head — the job is red on toolchain acquisition before any lint actually runs, so a green Clippy & format after a fix could still surface further findings.

Two candidate shapes, both small: add tools: nextest to this job's setup, or scope the selftest prerequisite off corpus-floor-check so the lint gate keeps depending only on the two shell scripts it used to.

Read-only from the API and job logs; no build or local reproduction. Blocker 1 (Build & test (Linux), the affine/ownership suites) is unchanged and still open.

@gertybotbot

Copy link
Copy Markdown
Contributor

Following up on Blocker 1, which my last note left as "unchanged and still open" — I measured it rather than assuming, and "unchanged" turns out to be exactly, byte-for-byte true.

I diffed the failing-test sets in the Release Gate — Linux x86_64 job logs at the two heads:

prev head 7851454e01 head 76df5732be
test result: FAILED lines 107 107
distinct panic sites 111 111
diff of the failing-site multisets empty

So the four new commits move the workflow/packaging layer only; the test failures are untouched. That is consistent with the delta (ci.yml, freebsd.yml, release-gate.yml, CHANGELOG.md, one wasm32 cfg gate, one contract test) — nothing in it reaches the affected crates.

This is a regression against the PR's own base, not inherited. Build & test (Linux) is success at base d4793f8949 and red here, so unlike the FreeBSD surface this one is not partly pre-existing.

Where the 107 sit, by owning crate: hew-cli 72, hew-codegen-rs 22, hew-types 5, hew-runtime 4, hew-lsp 4, hew-mir 2, hew-hir 1, hew-compile 1.

Two signatures dominate and both are ownership/affinity diagnostics fired at compile time, i.e. the fixtures no longer typecheck rather than failing an assertion:

  • 20 occurrences, hew-cli/tests/await_e2e.rs:211 and the distributed_two_process_e2e.rs:100 cluster, all one message — E_HIR: Listeneris a#[resource]/#[linear]handle passed by value to extern fnhew_tcp_listener_local_port, whose body is not visible at the call site, so its borrow-vs-consume disposition cannot be inferred; annotate consume listener: Listener. These are examples/net/probe_b*.hew fixtures.
  • 1 at affine_resource_carrier_boundaries.rs:494 — ``Vec<std.channel.Receiver>contains#[resource]` value `Token` and cannot be cloned`.

The single largest cluster is distributed_two_process_e2e.rs:100 at 20 panics.

Reading these as one class: a tightened extern-ownership/affinity rule landed somewhere in the RC composition and the examples/net probe fixtures were not updated for it. If that is right, the remedy is the annotation the diagnostic itself names (consume listener: Listener) applied across those fixtures — which would be a fixture-side change, not a compiler-side one, and would clear the bulk of the 72 hew-cli failures in one pass. Worth confirming against whichever lane tightened it before touching the fixtures.

Note the same suite runs on FreeBSD x86_64 with 681 unique failing tests of 12902, and that job's provisioning is now fine — it reaches and runs the suite at both heads, with an identical failing set. So the FreeBSD gate's remaining red is this same Blocker 1, not a packaging problem.

Read-only from the API and job logs; no build or local reproduction, so the single-root-cause reading above is a hypothesis from the diagnostics, not a bisect.

@gertybotbot

Copy link
Copy Markdown
Contributor

Windows-only blocker: the new capability-gen authority gate is CRLF-fragile (head 76df5732be, base d4793f8949)

Following up on the previous review — the Linux MIR regression there still stands. This is a separate, not-yet-reported failure on a different platform, found by reading step-level conclusions rather than check-level ones.

Build & test (Windows) fails 4 tests, all in hew-capability-gen::authority, all with the same message:

docs/wasm-capability-matrix.md: `<!-- BEGIN GENERATED: playground-wasi-capability-summary -->` must end its own line
  • checked_outputs_are_current (authority.rs:55)
  • authority_mutations_fail_closed (authority.rs:186)
  • checker_variant_mutations_turn_the_freshness_gate_red (authority.rs:50)
  • every_checked_output_gate_detects_mutation (authority.rs:50)

Cause, pinned to one line — hew-capability-gen/src/lib.rs:863:

let content_start = after_begin + source[after_begin..].strip_prefix('\n').map_or(0, |_| 1);

On a Windows checkout the byte following the marker is \r, not \n. strip_prefix('\n') therefore fails, content_start == after_begin, and the guard on line 864 raises the error above.

Why the file is CRLF there: .gitattributes pins LF for *.expected, *.hew and *.mir, but not *.md, so docs/wasm-capability-matrix.md is checked out with CRLF under the default core.autocrlf on the Windows runner. The content itself is fine — the blob in the repo is LF and the marker already ends its own line, which is why this is invisible on Linux and macOS.

Attribution: this is introduced by the PR, not pre-existing. Both strip_prefix('\n') and the must end its own line string are absent from hew-capability-gen/src/lib.rs at base, tests/authority.rs is a new file, and Build & test (Windows) is success at base.

Two candidate fixes (either resolves it; the first is more robust):

  1. Accept both endings at the marker, e.g. strip \r\n before \n — also worth checking the matching END marker handling.
  2. Add *.md text eol=lf (or scope it to docs/wasm-capability-matrix.md) to .gitattributes.

I'd lean toward (1): the generator asserts a byte-exact property of a checked-in doc, so making the parser line-ending agnostic keeps the gate honest regardless of checkout config.

⚠️ Also note 14 downstream steps are skipped in Clippy & format behind the nextest prerequisite reported previously, so more may surface once that is unblocked.

Not reported as blockers: the 7 red Pre-Release Cross-Platform Gate platforms are a standing condition on release/v0.6.0-rc1 — that workflow has failed on every run since 2026-07-30 and does not run on this PR's base, so it is not attributable to these changes.

@gertybotbot

Copy link
Copy Markdown
Contributor

Blocker on 76df5732be: MIR bytes-ownership regression on Linux + macOS arm64 (distinct from the Windows CRLF failure)

The rollup is broadly red (12 FAILURE / 2 CANCELLED / 7 SUCCESS), but it is two independent causes, and they need separate handling:

1. Windows onlyhew-capability-gen::authority (4 tests) panicking with docs/wasm-capability-matrix.md: BEGIN GENERATED ... must end its own line. This is the CRLF line-ending issue already reported on this PR; scoping still holds (Windows only).

2. Linux AND macOS arm64hew-cli/tests/actor_handler_bytes_cancel_leak_ir.rs, 2 tests. I don't see this raised yet:

  • cooperate_then_forward_drops_bytes_in_the_cancel_exit_block (:182) — cancel_exit must branch to the Bytes copy-mode drop child. The emitted cancel_exit branches to %helper_crash_cleanup_retire / %helper_crash_cleanup_retire_merge; the expected label %borrow_drop_copy_only edge is absent.
  • cooperate_then_forward_does_not_drop_bytes_on_the_normal_send_path (:258) — the forward path transfers the sole bytes reference to the recipient's mailbox and must not also drop %local_0.

Identical signature on both platforms, so it isn't platform-conditional.

Why I think this is branch-introduced rather than inherited:

  • main is green at d4793f8949 (CI + Code Quality, 2026-08-03).
  • The test file 404s at main and at base d4793f8949, but exists at head 76df5732be (12434 bytes).
  • It is not in this PR's changed-files list — this PR didn't author it.
  • It arrives via e6114ee0bd ("fix(mir): close actor bytes transfer ownership") and fdb01ee193 ("fix(mir): guard conditional actor bytes ownership"), both 2026-07-28, and compare/main...<sha> reports diverged for both — neither is an ancestor of main.

So this branch carries MIR bytes-ownership fixes that never landed on main, and those fixes' own regression tests fail against the lowering as it exists here.

Please don't green this by touching the tests. Both assertions inspect real emitted LLVM IR (:258 asserts the absence of a hew_bytes_drop on %local_0 outside the cancel child) — that's a genuine double-drop/UAF predicate, not a golden-file cosmetic. Skipping them would ship the leak.

Suggestion: land the MIR bytes-ownership work on main and rebase the rc onto it — but first check why cancel_exit no longer emits the borrow_drop_copy_only edge. The helper_crash_cleanup_* blocks now occupy its successors, so a later commit in the 100-commit stack may have re-lowered the crash-cleanup path and displaced the copy-mode drop child. If that's what happened, a rebase alone won't restore it.

Caveat: read from CI logs (run 30929891509), no local build. The Windows leg is fail-fast-truncated (12213/12467 not run), so it's unsampled, not clean.

@gertybotbot

Copy link
Copy Markdown
Contributor

Re-checked at head 76df5732be (base d4793f8949 unchanged, mergeable recovered CONFLICTINGMERGEABLE). Compare vs the head I last reviewed (7851454e01) is ahead_by 4 / behind_by 0, 6 files — small and targeted, so prior findings still apply except as noted.

✅ The FreeBSD provisioning contract is cleared, via the split rather than the duplicationgdb into NIGHTLY_TOOL_PACKAGES, keeping it nightly-only. That uses the _expected_pkg_phases() seam that already existed but was inert while both constants were byte-identical. Dropping -U and re-pointing the drift mutation from replace(" -U", "") to replace(" -y", " -y -U") was a good catch that I'd missed: the old mutation would have quietly become a no-op once -U was gone, retiring that test's teeth without any signal. Docs & scripts gates is green.

Two reds remain. Rollup is 7 success / 10 failure / 2 cancelled.


1. The lint job runs a nextest target without installing nextest (one line)

cargo nextest run --profile ci -p hew-cli --test leak_harness_fail_closed
error: no such command: `nextest`
make: *** [Makefile:753: test-leak-oracle-selftest] Error 101

Chain at this head:

  • .github/workflows/ci.yml:239Verify every corpus floor has a live call sitemake corpus-floor-check
  • Makefile:1190corpus-floor-check: test-leak-oracle-selftest
  • Makefile:752test-leak-oracle-selftest:cargo nextest run …

The lint job (ci.yml:194) sets up Rust with components: 'clippy, rustfmt' plus LLVM, but never acquires nextest, while other jobs in the same workflow do so explicitly (tools: nextest at ci.yml:500 and :858).

Worth flagging that the corpus-floor check never actually executes — its verdict here is unsampled, not green. Adding nextest to lint fixes the red; but since lint is a required check on main, you may prefer to decouple corpus-floor-check from test-leak-oracle-selftest instead, so a lint job doesn't carry a test-runner dependency at all.

2. Two actor-bytes IR oracles fail on all six platforms

hew-cli/tests/actor_handler_bytes_cancel_leak_ir.rs, identical on Linux, Windows, macOS arm64 and all four release-gate legs:

  • :182 cooperate_then_forward_drops_bytes_in_the_cancel_exit_blockcancel_exit must branch to the Bytes copy-mode drop child; observed, cancel_exit branches only to helper_crash_cleanup_retire / …_retire_merge.
  • :258 cooperate_then_forward_does_not_drop_bytes_on_the_normal_send_pathmust not also drop the parameter slot %local_0.

These constrain opposite directions of the same ownership property on @Forwarder__recv__forward — one requires a drop on the cancel path, the other forbids one on the success path — so a single over-or-under-broad drop-insertion rule failing both is consistent with what's observed. That's likely the most economical place to look.

Two things I checked before reporting, since both would have changed the conclusion:

  • This isn't a regression against base. The test file 404s at d4793f8949 — it's introduced by this PR (e6114ee0bd, fdb01ee193). So there's no base-vs-head differential; the PR ships a new oracle its own codegen doesn't yet satisfy. That's a much better failure mode than the reverse, but it does mean the oracle and the fix are out of step.
  • It isn't a timeout artifact. The 29.16s/29.17s durations sit close to DEFAULT_EXEC_TIMEOUT = 30s, but these are assertion panics that print the offending IR, not timeouts — the panic message is the diff. The ~29s is compile/link cost. (I've reported a spurious timeout-derived finding on another PR before, so I wanted that ruled out explicitly rather than left implicit.)

Neither of these was touched by the 4 commits since 7851454e01 — nothing in the compare range matches the MIR or that test. Both predate the push; #2 is just more visible now that the two workflow-contract failures have cleared out of the rollup.

Net: real forward movement here. Remaining is one CI prerequisite and one genuine codegen/oracle disagreement.

@gertybotbot

Copy link
Copy Markdown
Contributor

ASan gate is red on a test-oracle defect, not a leak in this diff

Release Gate — Sanitizers fails on exactly one test of 2383:

test reactor::tests::active_mode_teardown_releases_all_consumed_connections ... FAILED
assertion `left == right` failed: active-mode teardown leaked fds: before=9 after=6
test result: FAILED. 2382 passed; 1 failed
sanitizer-gate: ERROR: ASan hard gate did not pass unambiguously

The fd count went down by 3. A leak is after > before, so the message asserts the
opposite of what the numbers show.

Mechanism. open_fd_count() (hew-runtime/src/reactor.rs:2317) counts process-wide
descriptors from /proc/self/fd; it is not scoped to the connections this test creates.
The oracle at reactor.rs:2372 is an exact equality on that global number. fds_before is
sampled immediately after reset_reactor()reactor_shutdown(), and this test never calls
ensure_reactor_started() (it injects via inject_registration_for_test), so the descriptors
counted at fds_before are not its own — they are residue from the preceding test still
being reclaimed.

The job runs --test-threads=1, so this is sequential contamination, not a thread race —
which is why it reproduces rather than flaking. The immediately preceding test in alphabetical
order is reactor::tests::accept_deposit_failure_closes_handle_no_stream_leak (an accept/socket
test, passing), three milliseconds earlier.

Why it's worth fixing rather than retrying. The equality is also fail-open in the direction
that matters: a genuine +3 leak occurring alongside a −3 baseline drift satisfies
after == before and PASSES. The oracle cannot distinguish "teardown is correct" from "two
errors cancelled".

Suggested remedy — snapshot the fd set (the read_dir entries) rather than the count, and
assert the post-teardown set contains no descriptor the test itself introduced; or at minimum make
the count comparison directional (fds_after <= fds_before). The set-difference form is immune to
unrelated baseline drift and cannot be satisfied by cancelling errors. The test's other
assertions — no surviving registrations, no surviving transport-table entries
(reactor.rs:2359-2365) — passed and already cover the ownership property correctly.

Read-only review; nothing pushed. CI readings are spot readings at head 76df5732be.

@slepp

slepp commented Aug 5, 2026

Copy link
Copy Markdown
Contributor Author

Thanks, this has been genuinely useful. Worth saying up front that I've been working locally and haven't pushed since 76df5732be, so you're reviewing a stale head and a few of these are already fixed on my machine. That's my fault, not yours. The reactor fd oracle is one of them, though your framing beat mine: the equality is fail-open in the direction that matters, since a real +3 leak alongside a -3 baseline drift still satisfies after == before. I've taken that reasoning. FreeBSD and the release record gate are done too. Blocker 1 turned out to be a compiler bug rather than the fixtures, where canonical close was discharging the ownership obligation without marking the receiver moved, so close-then-use was silently accepted across 11 handle types. Fixing that plus making the move checker flow-sensitive across branch joins took the tracked failures from 45 to 33.

Two of yours were new to me and I've verified and tracked both. The CRLF one is exactly right, including the .gitattributes gap, and I agree the parser should be fixed rather than the file, since it asserts a byte-exact property of a checked-in doc. The lint job one matters more than its red does: those 14 skipped steps mean clippy and the structural authority lint were never evaluated at that head, so the job was unsampled rather than green, and I'd missed it. I'll decouple corpus-floor-check from the selftest rather than add nextest, since lint is required on main.

One thing to push back on gently. Annotating the examples/net fixtures with consume listener would have gone green, but the compiler was wrong, not the fixtures. You did flag it as a hypothesis to confirm against whatever tightened the rule, which was the right instinct and worth keeping: when a diagnostic suddenly starts firing across a lot of fixtures at once, the fixtures usually aren't the thing that broke.

Agreed on the actor bytes IR tests, I won't green those by touching them. The rpmalloc note is tracked, and spotting that the modify/delete would resolve silently toward the deletion was the valuable part of it. More of the per-check base-vs-head attribution please, and more of the unsampled-versus-green flag, since those two are where you're adding the most. I'll push once the ownership work is integrated, which should clear a lot of what you're seeing.

Copilot AI review requested due to automatic review settings August 5, 2026 02:46

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

Copilot AI review requested due to automatic review settings August 5, 2026 04:50
Comment thread scripts/tests/test_structural_authority_audit.py
The lifecycle matrix imports run_bounded and assert_bounding_contract from
scripts/bounded_subprocess. It was removed as an unused entry point, but it is
a module nothing executes and everything about it is reached by import, so a
scan for callers did not see it.
Comment thread scripts/bounded_subprocess.py
slepp added 8 commits August 10, 2026 03:17
Five fixtures under tests/hew are bare fn main oracles with no #[test]
functions. Running the directory as one invocation ignored them; caching runs
each file separately, where hew test exits non-zero with no report and the
wrapper read that as a broken fixture.

A clean exit with no report now means no tests and the fixture is skipped. The
wrapper also stops discarding the exit code with || true, so a genuine failure
that still writes a parseable report can no longer pass.
The 600-second floor came from a 234-second run on a warm 16-core developer
machine. Hosted runners have far fewer cores and the consumer corpus has
grown, so the watchdog killed this gate on CI while it was still healthy and
took both Linux jobs down with it. 1800 seconds matches its sibling compiled
corpora and still bounds a hang.
Finalize sink classification and rejected-connection EOF behavior, streamline
compiled test execution, and repair platform provisioning. Remove the reverted
parallel test runner and calibrate bounded checks to measured host capacity.
@slepp
slepp marked this pull request as ready for review August 11, 2026 02:43
@slepp
slepp enabled auto-merge August 11, 2026 02:44
@slepp
slepp force-pushed the release/v0.6.0-rc1 branch 2 times, most recently from 3cfa690 to df55886 Compare August 11, 2026 05:35
@slepp
slepp disabled auto-merge August 11, 2026 09:28
@slepp
slepp enabled auto-merge August 11, 2026 09:28
@slepp
slepp merged commit 4ce27c7 into main Aug 11, 2026
37 checks passed
@slepp
slepp deleted the release/v0.6.0-rc1 branch August 11, 2026 09:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants