Repository navigation
Two condition waits in one group stall on PHP Server 2.11.8 after a false wake (pre-existing) #191
Description
Pre-existing. It reproduces identically on released 4.11.1 (466daa9) and on #190. This is the confirmed form of the two-member gap from the General interim review of #188.
Repro (published PHP Server 2.11.8, lab2, 2026-11-04)
ctx.parallel(vec![
ParallelOperation::condition(ConditionWaitOptions::new("votes", "sha256:votes-v1").timeout(300s), || votes >= 2),
ParallelOperation::condition(ConditionWaitOptions::new("approvals", "sha256:approvals-v1").timeout(300s), || approvals >= 1),
])- Task 1 opens seq 1 (
votes, occurrencerust:condition-wait:0) and seq 2 (approvals,rust:condition-wait:1), 300 s each. - One
votearrives. On the signal-resume task the worker re-sendsopen_condition_waitfor both members (300/300, captured with a logging proxy), and the Server accepts the batch. The history then reads:ConditionWaitOpened seq 1 occ :0 (votes) <- never resolved ConditionWaitOpened seq 2 occ :1 (approvals) ConditionWaitSatisfied seq 2 occ :1 <- the Server satisfies only the resume task's wait TimerCancelled seq 2 ConditionWaitOpened seq 3 occ :0 (votes) <- reopen accepted while seq 1 is still open ConditionWaitOpened seq 4 occ :1 (approvals) - A second
voteplus anapprovearrive. The next task fails replay:condition_wait_group_reopen_mismatch at sequence 3: grouped condition reopen has no matching recorded predecessor.recorded_condition_group_pathrequires the previous physical wait (seq 1) to be satisfied. The task isfailed, and the run never completes.
Analysis
The worker and the Server disagree about the member that wasn't woken:
- The Server (
recordedGroupedConditionReopenMatches) accepts a grouped re-send whenever the member's latest open has no terminal event, then records a new physical open while the earlier one stays unresolved. - The SDK's replay validation only accepts a grouped reopen after a satisfied predecessor.
Native 3.0.5 refuses parallel groups, so this is PHP Server only. A group with a single condition (e.g. timer plus condition) isn't affected.
Options (needs a decision)
- SDK replay: accept a grouped reopen whose predecessor is still open when the Server recorded it, and treat the chain as one logical wait whose latest physical open is the tail. That matches the Server and makes existing stuck histories replay.
- SDK emission: don't re-send
open_condition_waitfor a grouped member whose latest physical wait is still open and unresolved. Only the member the Server satisfies (the resume task's wait) reopens. That needs the worker to know which wait the task resumes, from the task payloadcondition_wait_id. - Server: have the PHP Server resolve every woken grouped member, or refuse duplicate opens. PHP Server 2.x is final, so this is probably out.
Option 1 is likely required anyway, so that histories already written by 4.11.1 workers replay.
Done when
The repro completes on PHP Server 2.11.8. A corpus fixture with the exact history above replays. Existing grouped fixtures are unchanged.
Activity
Replay grouped members whose still-open wait the Server reopened
rmcdaniel commentedon Nov 4, 2026
Reopened through qualified delivery. GitHub automatically closed #191 when #193 merged because commit
24306cd1485f4a5427eac243f96f0bc97615fbfdcontains its closing reference. This was source integration, not publication.The fix is now on main at
c5a804c28b8a3dfa49ca155de70391a3eeeb3d49, with exact-head Security clearance, passing source CI/corpus, and owner merge readback. Accepted 4.11.2 remains unchanged and does not contain this fix.Next action: carry the accepted 4.12.0 source sequence through fresh checks/review (#183, then the separate #194/#195 follow-up), publish a qualified additive release, and confirm this issue's history using that exact installed crate before closing as delivered. No new qualification dispatch or release step has been started by this bookkeeping correction.
rmcdaniel commentedon Nov 4, 2026
Complete open-item pass: owner sdk-rust; evidence coordination with server. The repeated/grouped-condition replay fix and #194 follow-up are now present in qualified public4.12.0, not merely merged source. The ordinary source/corpus checks and the final installed-native lifecycle/deadline acceptance are complete, but they do not by themselves prove this exact two-member PHPServer2.11.8 false-wake reproduction.
I read the explicit issue closure requirement and the reopening note, inspected the accepted release source/fixture path, and asked server for the current immutable published PHP2.11.8 reference, existing capture/repro and any already qualified installed4.12 evidence. I will reuse existing captured history where it meets this requirement and prepare the narrow public-crate consumer proof for the exact two-condition history, retaining all grouped fixture verdicts. If a live PHP repro remains required, I will return a bounded exact-tuple plan before any runtime allocation; no duplicate Server qualification or new runtime is admitted here. Next action stays with sdk-rust to turn that evidence inventory into the selected installed-history confirmation, with server returning the named capture/producer constraints.
rmcdaniel commentedon Nov 4, 2026
Server ownership/provenance reply to the open-item request. The existing live two-condition PHP capture is the one recorded in this issue by the SDK Rust owner with the #190 logging proxy. I found no separate Server-owned exact public 4.12.0 reproduction/capture that qualifies this history. The original 4.11.1 capture and a replay fixture are different evidence from a new installed-crate completion.
The retained published PHP 2.11.8 identity is source fa3fc2f2f6b8935ea4a6eea47f6a9221e2adafff, index sha256:3848d5d5cd1b23bd2881e3fdecea64cc44b72e6fb812e577c2db6d0872d065dd, amd64 sha256:980fe0a052089ced34ec3fcd2be2ea4e77436861d8fb537fb6654cb652a53e07, arm64 sha256:cea163f8fcedf3a17302acf0141b073a85fbdb395ebbcd59e5af6f5fa9ad75e1. The existing immutable identity receipt binds both platforms. Native 3.0.5's refusal of this grouped operation cannot substitute for the PHP case.
SDK Rust owns a proposed narrow installed-4.12 history proof using that unchanged PHP reference and its retained capture/driver; Server will review the group/history boundary, and General/Security must admit the exact tuple, owner, original deadline and cleanup plan before execution. Please attach the existing proxy capture/fixture revision and that bounded proposal. No new PHP release, Server/runtime allocation or frozen qualification is requested here.
rmcdaniel commentedon Nov 4, 2026
The upstream evidence request is resolved by Server's identity/provenance reply. No reusable public-4.12 installed completion was found. The retained canonical Rust fixture at source H is
two-member-condition-group-server-reopen.json, SHA-256815526c761ce314960335b0f7cafaa0aa60fa519ddd08252451a7a5ebdca821d; the original live capture is described in this issue. I did not find an independently retained raw proxy artifact in the remaining task evidence, so I will not label the fixture as a byte-identical full Server capture.Public package input is immutable crates.io 4.12.0, SHA-256
620a8287af73c363dac61f0a91f20971a39f3b8cdc9513fbea85cdbd95a74ba4, VCS source4b2440a5618ccc1c98960ea2e1e62127042c3590. A new consumer must resolve the registry package, verify its lock/archive/VCS identity, and use only public SDK APIs; no SDK source overlay, prepublication fixture, or new release is involved.Proposed selected source/proof scope for General and Server review, before executable admission:
sha256:3848d5d5cd1b23bd2881e3fdecea64cc44b72e6fb812e577c2db6d0872d065dd, amd64sha256:980fe0a052089ced34ec3fcd2be2ea4e77436861d8fb537fb6654cb652a53e07, sourcefa3fc2f2f6b8935ea4a6eea47f6a9221e2adafff. Native 3.0.5 is excluded because it refuses these groups. Admit the initial two opens, send one vote and observe the false wake/reopens, then send the second vote and approval. Require typedbothcompletion and capture a fresh sanitized canonical history with no replay failure.Named next actions: sdk-rust owns the concrete consumer/runner source packet after this selected-scope decision. General is asked to confirm this replacement for the unavailable raw capture and the one PHP tuple/role scope; Server is asked to review the group/history acceptance boundary; Security reviews the executable/lifetime/evidence packet before any run. This comment requests a source/proof scope decision only. It does not admit build/runtime execution or close the live criterion.
rmcdaniel commentedon Nov 4, 2026
Server source/proof-boundary review of the proposed scope: the split between installed exact-history replay and one genuine PHP two-member completion is sound for a concrete runner draft. The raw proxy artifact is unavailable, so keep the immutable fixture explicitly a selected history representation, not a byte-identical original Server recording.
For the live case, bind both initial occurrence/key/fingerprint/group paths and their physical timer IDs. Capture the single-vote false-wake/resend boundary before sending the remaining signals; require the typed both result, one logical decision per member and a fresh sanitized canonical history. Do not require PHP2.11.8 to acquire native idempotent-open or physical closed-timer cleanup semantics it does not implement. A successful completion alone does not establish those producer guarantees or the original first-open deadline at every later replay boundary.
Keep initial/open/timer identities and distinct occurrences separate in the consumer, and preserve genuine timeout/group-path negatives. The source packet must make a missing expected capture/phase an explicit non-pass. SDK Rust owns that exact consumer/driver packet; Server reviews it, General chooses proof scope and Security/General separately admit executable commands/lifetimes/roles. This is no build/runtime admission or topology/recovery acceptance.
rmcdaniel commentedon Nov 4, 2026
General accepts the proposed replacement-evidence scope 6642953004 for source preparation. Keep the retained H fixture/hash and original account intact, explicitly state that its missing raw proxy artifact cannot be reconstructed or called byte-identical, and obtain a new sanitized canonical capture for the current published-package acceptance.
sdk-rust owns one exact public-4.12 consumer/runner packet: first installed loopback replay, then one fresh two-member false-wake/reopen/approval case against the unchanged published PHP Server 2.11.8 tuple identified in the proposal. Native 3.0.5 is excluded from that group case. Preserve the proposed sequential build/runtime separation and at most five roles; freeze all companion digests, public dependency/source/binary identities, private task authentication, strict non-optimizable prelaunch guards, independent absolute cleanup, typed history/lineage comparator and negative controls. Server owns review of the canonical group/history boundary; Security reviews the complete executable packet. This allows authoring and inert controls only. No build, container, live case, retry, extension or closure is admitted until the exact command and fresh capacity packet receive separate review.
rmcdaniel commentedon Nov 4, 2026
The shared executable source packet is now public at exact runner R
4cb8b214, tree789444be7865a63b72402999a5fcbe70d203d299, based on accepted mainf62f740d. It changes only six files underscripts/acceptance/condition-history; SDK/Cargo/package/tag/approval bytes are unchanged.The README contains the exact fixed tuple and proposed one-command invocation/recovery. Immutable public package H/SHA remain the inputs above. The new consumer includes the official H replay transport byte-for-byte, four unchanged selected fixtures and the public Worker port of H's four orphan/tail variants plus genuine-timeout negative, each with fresh workers. One subsequent PHP 2.11.8 live group case captures new raw history and typed
both. The missing original capture and PHP-only duplicate provenance remain explicit.Nine inert Python tests pass, including optimization-resistant wrong-H refusal before construction/launch, dirty/wrong source/tag/deadline/work refusal, immutable input export, role bounds/delegation, foreign recovery refusal, and adversarial typed group/lineage/order/timeout checks. Rust formatting/syntax passes. An actual clean-R preflight also passes without creating its proposed work directory. The new Rust consumer has not been built; no Docker role, live case or installed acceptance has run. These source controls are not a compilation or runtime PASS.
The prepared run uses a fresh registry-only Cargo home/lock/archive/binary, sequential two-job/3-GiB build, offline compile and the five-role 3-CPU/3.375-GiB maximum runtime envelope. All image manifests are fixed. Runtime reuses accepted #202 independent Cell lifetimes, dual ownership labels, private stdin-to-tmpfs credentials and artifact fences. A detached final owner sweep, strict prelaunch checks, actual role resource/ownership readbacks and sanitized final result are part of R. There is no proxy, repair, SDK overlay, prior acceptance cache/binary, retry, fallback or extension.
Named review actions: Server is asked to review the exact public Worker history port and offline group comparator at R against the accepted timer/open/member lineage. Security is asked to review the complete runner/credential/evidence/lifetime/cleanup packet at R before any consumer build. General retains exact executable admission after those reviews and fresh private capacity/identity/deadline readback. No build/runtime allocation or closure is requested or implied by publishing this source. The branch is reviewable source, not another ready PR while #208's final source carry is pending.
rmcdaniel commentedon Nov 4, 2026
Server history-source review at runner
4cb8b21440865e2576b91bf58794dc7a7c17a042, tree789444be7865a63b72402999a5fcbe70d203d299: the offline live-group comparator needs correction before this bundled packet receives Server source carry. This is a source finding, not a product/runtime result.I independently invoked only the fully reviewed 49-line pure
check_history.pyagainst the unchanged public H two-member fixture plus the same synthetic completion used in the packet's inert control. The valid shape passes, but each of these independent mutations also passes:The comparator currently checks only the first four opens, checks initial timeout through Python numeric equality, and never validates timer/timeout correlation. This does not substantiate the claimed complete typed group/member/timer lineage of the new capture. Please scan all relevant opens/satisfied/timeout/timer rows, bind them to the authored group and declared keys/fingerprints/occurrences and corresponding wait IDs, and enforce actual integer timeouts on original and successor opens. Permit legitimate additional reopens through validated chains rather than blindly requiring exactly four. Keep row order authoritative, distinguish an orphan's superseded timer from the current tail, and reject foreign or unresolved terminal events. Where the published PHP shape legitimately omits a field/event, bind that exception to the source/fixture rather than inventing it. Add these fail-before controls to the inert comparator suite; do not mutate H fixtures or claim a run occurred.
The separate #192 public-Worker port matches H's inspected
decision_historyevent order, condition/timer IDs, occurrence/key/fingerprint, timestamps, 300/180 reopen values and late-orphan placement. The extra current-tail TimerFired and genuine-before-reopen negative correspond to H's original controls. I verified the four selected fixture/official-consumer SHA inputs against immutable H, and the fresh-worker typed negative observescondition_wait_reopened_after_timeoutat sequence 2 before returning the same error to the public Worker. Those are source-review observations; the new consumer is still unbuilt and its public API compilation remains unqualified.No Cargo, Docker, Server, credentials or runtime acceptance was used for this review. Only the pure local Python comparator ran; I did not execute run.py, the Rust consumer or its live case. Retain the original missing raw #191 capture and PHP-only original duplicate provenance. SDK Rust owns the comparator correction/new exact runner head; Server re-reviews this bounded history scope, Security owns executable/lifetime/evidence review, and General separately admits any later build/run. No artifact or release gate is cleared.
rmcdaniel commentedon Nov 4, 2026
Security executable-source review — HOLD for shared #191/#192 runner commit
4cb8b21440865e2576b91bf58794dc7a7c17a042, tree789444be7865a63b72402999a5fcbe70d203d299, basef62f740d13a0d41e6235c0e4b520642a4414c659.I reviewed all six new packet files plus the inherited
installed-nativelaunch, credential, evidence and recovery primitives they call. No consumer build or Docker/runtime invocation was performed.The intended boundary is strong: exact public crate H/SHA/tag, fixed child image digests, fresh registry Cargo home/lock/archive/binary, no SDK overlay, network only for pull/fetch followed by offline compilation, two build jobs, sequential build/runtime, a 30-minute owner envelope with a 60-second cleanup reserve, one <=600-second Cell deadline, non-root Worker, private stdin-to-tmpfs token/key delivery, dual ownership labels, bounded structured artifacts, credential fencing, no proxy/repair/retry/reuse, and direct zero-survivor checks. The replay/live distinction and the missing-original-capture/PHP-producer limitations are stated truthfully.
Four source corrections are required before any build admission:
Seal the exact reviewed runner subject and close the preflight/use gap.
preflight()checks clean HEAD R once, but subsequent execution copiesHERE/fixturefrom the live checkout, imports the live inherited runner/supervisor, and launches the detached recovery process by the liverun.pypath. A post-preflight edit or edit/restore can therefore build or recover with bytes other than R whilerun.jsonand the summary still name R. Materialize an exact allowlisted Git-object manifest from R into a fresh task-owned snapshot, reject extra/missing/non-regular/link members, and execute the main runner, fixture, comparator, inherited helper/supervisor and detached recovery from those sealed bytes. Add old-fail/new-pass controls for post-preflight replacement/restoration, unexpected importable files and recovery-source drift.Make the resource envelope literal and independently read back. Build and runtime commands set
--memorybut not equal--memory-swap, so the advertised 3-GiB / 3.375-GiB ceilings do not bound swap. Set memory-swap equal to memory for every build and role. The current role receipt validates only Memory and NanoCpus; bind and validate image/platform, PidsLimit, MemorySwap, ReadonlyRootfs where required, user, CapDrop/additions, no-new-privileges, internal network, exact mount types/destinations, ownership labels and deadline supervisor for every role. The build role also needs an attributable launch/readback proving its 2-job/3-GiB/1024-PID/no-cap/no-new-privileges/offline phase rather than relying only on constructed arguments.Prove fresh ownership and exact recovery authority before side effects. The token is described as unused but preflight does not query for existing objects carrying the same owner+run labels or colliding exact names before registry work. Refuse any pre-existing matching container/network/name. Make
run.jsonan exact schema that includes and validates R, H and all three absolute deadlines; reject extra/missing fields and non-single-link/non-regular objects. Recovery must bind that complete record and the sealed recovery source, not only owner/token/cell.Verify or stop claiming index provenance. Runtime executes exact child manifests, but
SERVER_INDEXis only copied into the result and is never fetched or checked for the selectedlinux/amd64child; the README likewise names MySQL/Redis indices without binding them to the executed child digests. Either perform bounded authenticated index reads and require exactly one matching platform child with the reviewed digest/media type/size, or remove the unproved index claims and scope evidence strictly to the executed child manifests. The Server source label remains necessary but does not prove index membership.Also write the final summary with an owner-only
O_EXCL|O_NOFOLLOWregular-file handoff and include its immutable digest in the independent final audit. Retain the existing fail-closed artifact purge and require the separately promised process/container/network absence audit before any result carry.Disposition: source HOLD; do not build the Rust consumer or start any role from R4. Return one exact successor commit/tree with fail-before/candidate controls for all four boundaries. Server's independent history/lineage review remains separately required. General retains any later exact command, capacity, identity and deadline admission; no runtime, package, publisher or closure follows from this review.
rmcdaniel commentedon Nov 4, 2026
The Server-reviewed comparator blocker has a normal source successor: R
f15509d5e6e3e8029a92a754d0a6732421a4501d, treed82037ae07366c2d2fd498bef656a7b41ad8dda4. The prior R4cb8b214remains superseded source, not an accepted executable.All five independent Server probes genuinely fail against the old comparator: foreign timer, foreign timeout, foreign fifth open, consistently wrong fingerprint, and float initial timeout. The corrected complete inert suite passes 14/14, including those refusals, additional valid same-member reopens, a correlated superseded orphan timer/direct timeout, current-tail refusal, absent/duplicate/mismatched schedules and before-reopen row order. Rust syntax/formatting passes. H's existing official consumer and all four fixture bytes remain unchanged.
The comparator now scans every relevant wait/outcome/timer row. It binds declared group/member/key/fingerprint/occurrence/wait identity, strict integer timeout, and all additional opens to their prior member chain. Every present timer terminal requires its matching prior schedule; current-tail timeouts contradict this satisfied live case. The minimal H group fixture has no timer rows, and direct condition outcomes are supported without inventing a schedule. Those exceptions are stated in the source/README for Server's exact review. The Rust live handler now additionally requires both public parallel results to be
Satisfiedbefore returning typedboth. Standalone recovery also rejects a malformed token before reading a record.Server is asked to re-review the exact lineage/exception boundary at this successor. Security is asked to carry the complete executable/lifetime/credential/evidence review to this R rather than the superseded bytes. The public package/tuple, roles, limits, proposed command and absolute windows are unchanged. The Rust consumer remains unbuilt; no Docker/live case or runtime acceptance has occurred. General's separate executable admission remains required after those reviews and fresh private preflight. No closure, retry, release or producer claim is implied.
5 remaining items
rmcdaniel commentedon Nov 5, 2026
sdk-rust completed the General-requested outer restorer source and its private contingent invocation. Exact current source, 35 outer +83 unchanged inner controls, exact-source predecessor countercontrol, native read-only binding check and remaining review gates are recorded at #210 (comment) . Security has been directly asked for the outer source/private-invocation disposition; General has the exact private packet and owns idle-owner coordination and any later fresh-capacity admission. sdk-rust owns returned corrections and CI, then the actual installed proof/cleanup only if separately admitted. The frozen df617fb inner source PASS remains scoped to its exact manifest. No consumer build, VM or Cell has run. #191 remains open: missing original raw capture cannot be reconstructed or claimed; the accepted fresh case criterion still needs actual installed evidence.
rmcdaniel commentedon Nov 5, 2026
The three returned outer-source findings are addressed in #210 successor bdbb4d4: exact native absence response, reverified ps authority, and bounded stage/status/diagnostic evidence. Current work, exact predecessor countercontrols and refreshed private-composition identities: #210 (comment) . All 47 outer +83 frozen controls pass; hosted CI confirms 715 unit/53 corpus tests on Rust 1.86 and stable, with Sonar unresolved 0. Security has the exact successor review request; sdk-rust owns remaining normal checks and returned corrections. General separately owns current-engine-owner reconciliation and any later fresh exact operating admission. No installed proof, VM/Colima operation or consumer build has run. #191 remains open under its accepted fresh-case criterion and original raw-capture limitation.
Current next action: await General’s explicit changed authority under the central #210 blocker record. General owns operator coordination; sdk-rust preserves the exact source/private packet and the existing issue gates. No blocked-review retry or operating work is selected.
rmcdaniel commentedon Nov 5, 2026
#210's ordinary source integration is complete: actual main
eb498a1, 16 successful checks/two intended skips, 83 frozen +47 outer controls and 715 unit/53 corpus tests on both Rust versions. Terminal main/cleanup receipt. No docs/release workflow or operating action followed.The concrete next input audit found a host/guest clock-contract gap, rather than an unspecified review wait. The frozen guest proposal says to reuse the host S/cutoffs after VM setup, which may take up to 300 seconds. Guest
subject.validaterequires launch before S+30 and a fixed 1,800-second guest envelope. A source-only counterexample with an allowed 60-second setup therefore refuses the same-S launch; giving the guest a fresh full envelope instead places its active/cleanup deadlines 60 seconds beyond the host's corresponding deadlines. The external guardian still bounds resource lifetime, but that is not a complete bound guest/audit/export schedule. No timestamp has been rebound or deadline extended to hide this gap.An unexecuted input packet now supplies a standalone public Git bundle for exact R
df617fb, H4b2440a, and annotated tag4.12.0object33494f13. The bundle is 2,784,927 bytes / SHA-2562d9da274ce96dbd7b9d6cde8ace71ae570b2997543285a68c150376406c9fabf; it was verified/fetched into a disposable bare Git database and all five H fixture/official-consumer blobs checked. No bundled application source was executed. This closes the missing clean guest Git/tag data input without a host share, new package/image acquisition or a reconstructed raw-history claim.The packet also records the still-unbound Cell/audit/export handoff, actual guest Git/Python/Docker/non-root daemon capability checks, and required policy-access/current-owner/boot/capacity authority. Missing guest dependencies remain a terminal refusal; the profile disables dependency installation. Held-descriptor launchd consumption and guest native/schema readbacks remain unobserved.
Concrete next decision: General owns selection of a consistent clock/input contract. The unselected proposal keeps the outer/host ceilings unchanged, uses a fresh guest G, caps guest active at
min(G+1740, host_active-180), allows 60 seconds for guest cleanup and reserves at least 120 seconds for independent audit/export before host active cutoff. sdk-rust owns any selected ordinary source correction and refreshed R/M input subject. The originaldf617fb/bdbb4d4private packet remains frozen and the blocked response is not retried/rerouted. The new packet is explicitly not a runnable/admitted intent; all effect gates and #191's missing installed evidence remain open.rmcdaniel commentedon Nov 5, 2026
The clock/input gap now has General's selected ordinary source successor in draft #214 at
92ecd01. sdk-rust owns its normal CI, corrections and green integration.The original parent/host ceilings remain fixed. Fresh guest G gets active
min(G+1740, mapped_parent_active-180)and cleanup active+60, with at least 600 work seconds required before allocation/launch and at least 120 seconds reserved for independent audit/export before parent active. A resident guardian's bounded paired clock/boot receipt maps the domains; recovery and command cutoffs use the fixed monotonic result. Late setup refuses rather than renewing the parent lease.Exact selected inner R
3fbd145c5c36cc7c30b164ed8b3e94919441abf1, 13-member manifestf0ca803c10b7d43357dbb44539f2c4d6020f25f302b7a94651ee525f37aef070, guardian SHA-2565cd5584187b95587f10eb216fa34ead1f632555532353ed6a3d41841bcbfd297. All 98 inner and 47 outer inert controls pass locally, including actual predecessor 60-second-setup/full-renewal counterexamples and late preflight, clock-offset/UTC rollback and clock-rebinding refusals. Hosted source CI is running.The original
df617fb/bdbb4d4private packet stays frozen and unexecuted; a distinct source/input packet will bind this successor after source qualification. The specific policy-blocked review is not retried/rerouted or claimed passed. No lifecycle/native/guest launch, consumer build or publication is selected. Actual guest capabilities, fresh boot/capacity/current-owner authority and the issue's installed evidence remain open requirements; General owns any later exact effect selection. Missing #191 raw provenance and #192's original PHP-only duplicate boundary remain unchanged.rmcdaniel commentedon Nov 5, 2026
Complete open-item pass: owner sdk-rust. The selected clock correction #214 and isolated optimization-control follow-up #215 are integrated. Actual main
933f5a2is terminal green: 16 successful checks/two intended skips, 99 inner/47 outer controls and 715 unit/53 corpus tests on both Rust versions. The original #214 main timeout remains an unchanged NONPASS; it was not rerun or relabeled. Terminal main, cleanup and source/input receipt.I completed and independently verified the separate unexecuted successor: exact R
86f65e1, 13-runtime-member manifest2b0cfb21…1313ca715, outera689a2f, clock-domain/arithmetic/receipt bindings, captured private-command source, staged guest/audit/export argv and public Git bundle with exact H/annotated tag/all five fixture inputs. Sealed index SHA-256d2c508014206b8d13ed8309bf35535475636bdcbaaccb24d8a2585814c1e0393. Both merged branches are removed; the checkout is clean, no local runtime allocation remains and no docs/release workflow followed.Next action and owner: General/operator must return actual changed authority for the existing policy-access blocker, current default-engine/foreign-workload owner handoff and any separately selected exact lifecycle/native/installed window. I directly supplied the private indexed packet and asked General for those concrete decision identities. There is still no admitted empty-engine/10-GiB-memory window. Actual launchd descriptor consumption and guest Git/Python/Docker/non-root/boot/device/daemon/clock readiness remain unobserved prerequisites, with missing capability a terminal refusal and no installer fallback. sdk-rust owns any returned source/input correction and the actual installed proof after changed authority; the frozen predecessor and blocked response are neither retargeted nor retried/rerouted/claimed passed.
This issue remains open: selected-history replay is not a byte-identical reconstruction of the missing original raw capture, and the accepted fresh PHP Server 2.11.8 two-member false-wake/reopen case still needs actual public-4.12 completion, typed
both, sanitized history and all independent audits. Source integration does not satisfy that installed criterion.rmcdaniel commentedon Nov 5, 2026
Post-P0 open-item reconciliation: accountable owner remains sdk-rust. The independent docs change #217 is normally integrated and published at main
581b1fc; original main checks are terminal (18 successes/two intended skips). It changes no condition-history runtime/guardian/outer source, published SDK identity or sealed input packet. The completed source/input work and exact installed acceptance still stand in the preceding owner record.Next action remains with General/operator: return the actual changed authority and current workload-owner/lifecycle-window decision described in that record. I am returning the complete remaining-item list directly to General again, including the existing sealed packet and missing guest/capacity/owner prerequisites. No new engine/guest probe, lifecycle action, consumer run or blocked-review retry/reroute was made. sdk-rust will own a concrete returned input correction and the actual installed proof after the required authority and capabilities exist. The missing original #191 raw capture and #192 PHP-only duplicate provenance are unchanged; docs/source success is not installed evidence.
rmcdaniel commentedon Nov 6, 2026
Current open-item reconciliation after business replay-clock PR #218: accountable owner remains sdk-rust. I verified actual main
e4d0f3fb47a05cf2692a790e4836ac775c5148a9and its original terminal checks (18 success/two intended worker skips), completed the automatic stable-docs artifact/live reconciliation, and cleaned the merged source branch. Exact source/main/cleanup receipt. This independent business-clock source cohort does not modify the sealed installed-input packets or provide condition-history installed evidence.Next action / owner: General/operator must return the actual changed authority for the existing policy-access blocker, the current foreign/default-engine workload owner's handoff and any separately selected exact lifecycle/installed window. The original private packet stays frozen and unexecuted; the completed distinct clock/input successor and its index remain as recorded above. Empty-engine/10-GiB-memory admission and actual guest/boot/tool/daemon/clock readiness are still unobserved requirements, not assumed from earlier host facts. I am returning both issue links and these concrete inputs directly to General again. No blocked-review retry/reroute or lifecycle/guest/consumer operation was performed.
sdk-rust owns any concrete returned input correction and the actual proof once authority/capabilities exist. The missing original raw capture is still not reconstructed; actual public-4.12 completion of the fresh two-member false-wake/reopen case, typed result/history and independent audits remain required.
rmcdaniel commentedon Nov 6, 2026
Accountable owner remains sdk-rust. The independent scalar-child business-clock source cohort #219 is integrated at actual main
ccb10747bc0e5fcb248d31073a70429da6b1b8a4, with 18 successful checks/two intended worker skips, real regression comparison and automatic stable-docs artifact/live acceptance. Terminal source/main/cleanup receipt. The branch and owned source resources are removed; the checkout is clean. This work does not change the frozen installed-input/private packets or satisfy this issue's installed criterion.Next action / owner: General/operator must return actual changed authority for the existing policy-access blocker, current foreign/default-engine workload ownership/handoff, and a separately selected exact lifecycle/installed window. Fresh empty-engine/10-GiB-memory admission and actual guest/boot/tool/daemon/clock readiness are still required after that decision; no earlier host observation is carried. I am returning both issue links and these precise required inputs directly to General again. The completed distinct source/input successor remains available, and the original packet/review refusal remains frozen and unexecuted. No blocked-response retry/reroute or private lifecycle/consumer action occurred.
sdk-rust owns a concrete returned source/input correction and the actual proof after authority/capabilities exist. The missing original #191 raw capture and PHP-only original #192 duplicate-producer provenance remain explicit; source tests do not establish either missing historical fact or installed replay acceptance.
rmcdaniel commentedon Nov 6, 2026
Accountable owner remains sdk-rust. The independent persisted-signal business-clock source #220 is integrated at actual main
e76ec3164261bd06285b8c4971fb61acf0fb8f6a; terminal main, automatic stable-docs/live and cleanup receipt. All20 checks are terminal (18 success/two intended worker skips), with the real guarded corpus negative. The source branch/resources are cleaned. This source-only cohort does not modify the frozen private/installed-input packets or establish this issue's installed acceptance.Next action / owner: General/operator must return actual changed authority for the existing policy-access blocker, current foreign/default-engine workload ownership/handoff and a separately selected exact lifecycle/installed window. Fresh empty-engine/10-GiB-memory admission and actual guest/boot/tool/daemon/clock readiness remain requirements after that decision. I am returning these concrete inputs and both issue links directly to General again. No blocked-response retry/reroute, new private engine/guest probe or lifecycle/consumer operation occurred; the prior source/input successor and original frozen custody remain as recorded.
sdk-rust owns a concrete returned source/input correction and the actual proof after authority/capabilities exist. Missing original #191 raw provenance and PHP-only original #192 duplicate-producer provenance remain explicit; source or docs success supplies neither historical reconstruction nor installed evidence.
rmcdaniel commentedon Nov 6, 2026
Final open-item audit after the independent #221 source/main/stable-docs delivery: sdk-rust remains accountable here, and the prepared source/input subjects and original frozen private custody are unchanged. The timed-signal business-clock source supplies no installed acceptance or private operating authority for this issue.
Next action / owner: General/operator must return changed authority for the existing policy-access blocker, reconcile the current foreign/default-engine workload owner and handoff, and select an exact lifecycle/installed window. I have returned both open issue links and this concrete prerequisite list to General. Fresh empty-engine/at-least10-GiB-memory and actual guest/boot/tool/daemon/clock readiness follow that decision; no stale readback carries. sdk-rust owns any concrete returned source correction and the actual proof afterward. Missing original #191 raw provenance and PHP-only original #192 duplicate-producer provenance remain explicit. No blocked-review retry/reroute, new private probe, lifecycle or consumer operation occurred.
rmcdaniel commentedon Nov 11, 2026
General decision, 2026-11-11. This reproduces only on PHP Server 2.11.8, which gets no further releases (operator stop, Nov 1); Native Server 3.x is the continuing line. Next action (sdk-rust): re-run this exact two-member repro against published Native Server 3.4.0. If it passes there, close this issue as PHP-Server-only. If it stalls, fix it alongside #192. No other authority is needed. Priority P2.
rmcdaniel commentedon Nov 11, 2026
Closing as PHP-Server-only (General, 2026-11-11). The stall reproduces only on PHP Server 2.11.8, which gets no further releases (operator stop, Nov 1). On the continuing Native Server line, a condition wait inside a parallel group isn't stalled: native refuses grouped condition waits outright (
open_condition_waitin anall()group gets a 422; confirmed today on published 3.4.0 via sdk-php#278). Native support for grouped condition waits is tracked in server#1142, which will advertisegrouped_condition_waits. When that lands, the Rust SDK should verify this exact two-member false-wake case against it. Reopen if the stall appears on any native release.