CI: with io_uring unavailable, 16 ./adaptive tests skip and the adaptive job passes even under CELERIS_REQUIRE_UPSWITCH=1

[FumingPower3925]

Summary

When io_uring is unavailable on a runner (for example, a seccomp profile that refuses io_uring_setup), the adaptive job's main test step goes green without testing adaptive switching.

• 16 ./adaptive tests skip, and go test reports ok, even with CELERIS_REQUIRE_UPSWITCH=1, because those skips are not routed through the require check.
• TestFlapConnsPerRing's own skip (s0Bind, when !IOUringTier.Available()) also ignores that variable.

Today the only thing that turns such a runner red is the T4 tally that PR #681 adds (it requires exactly 1 PASS and no T4 SKIP line).

How it was found

The T-SECCOMP interlock arm of PR #681's round 2 ran the adaptive job's race step verbatim, as GitHub does, under a seccomp profile that refuses io_uring_setup. The log shows 16 top-level --- SKIP lines and ok github.com/goceleris/celeris/adaptive (evidence: evidence/celeris-657/impl/pr2-r2/fix/interlock/48dfe1a/logs/IL-T-SECCOMP.log).

Proposed

• Route every io_uring-availability skip in ./adaptive through one helper that fails when CELERIS_REQUIRE_UPSWITCH=1 (or a dedicated require variable) is set, the way skipOrFail656 does for engine/iouring.
• Give the adaptive job a PASS-count interlock with SKIP forbidden, proven both ways from the verbatim run block.

Other behaviour stays the same: local runs without io_uring still skip.

[FumingPower3925]

CI-shape skip census, 2026-09-26 (main 9f4d89b)

The hole this issue was opened for is closed on main. With memlock raised, the adaptive job logs 0 --- SKIP lines (103 PASS in each of 3 runs). If io_uring became unusable, the T4 and placement tallies (10 named tests) and the one-worker revert step (any SKIP fails it) would turn the job red. So I did not add the per-skip helper.

Method. Throwaway draft #701 runs main's CI with -v added to every go test step that lacked it: the root step (ci.yml:123-127), the middleware sub-modules, websocket and driver-conformance. Runner: ubuntu-latest, memlock 8192 KiB, 4 vCPU, uid 1001, tcp_synack_retries=5. The tally counts only --- PASS/FAIL/SKIP: lines, subtests included. These tests skip (run 36254806377):

package	test	why	enforced elsewhere?	disposition
./engine/iouring	TestListenWithCancelledContextPublishesTheBoundAddress, TestListenRefusesToStartWhenNoWorkerReportsItsAddress	ENOMEM: the kernel uncharges ring memory asynchronously (12.4-22.8 ms) after the first test's 20 back-to-back starts	no	fixed on #674 (§1)
./engine/epoll	TestSendfileEndToEndLargeFile, TestSendfileHEADNoBody, TestSendfileRangeRequest, TestSendfileSubThresholdFallback	test defect: Workers: 1 < resource.MinWorkers	no	#702 (§2)
.	TestAdaptiveSettledRouteRetime592/iouring/* (3)	the rig needs 2 io_uring workers; 8 MiB funds 1	no	#702 test side (§3)
./engine/iouring	TestListenCloses* (3, celeris#656)	needs 2 workers	yes: iouring job	none
./engine/epoll	TestWriteBufBackpressureClosesSlowConsumer	opt-in; non-deterministic on CI by its own comment (backpressure_test.go:61-62)	no	reported, not changed
.	TestRouteAdaptive_SettleReopenCost	opt-in cost measurement	no	none
./middleware/sse	3 alloc-count tests	skip under -race, and every CI step is -race	no	follow-up
./probe, ./resource	TestProbeNonLinux, TestValidateEngineRequiresLinux	non-Linux only; the macOS job only builds	no	none
./test/conformance/redis	TestAuth_Password{Success,Failure}, TestAuth_ForceRESP2WithPassword	the CI redis service has no password	no	follow-up

The other steps log 0 skips. A static census of every t.Skip* site (297 sites in 135 files, each classified for this runner) is in the evidence. It maps what could skip; the table is what does.

1. The ./engine/iouring memlock skip: fixed on #674

In #701's 9 root-step-shaped jobs, TestListenWithCancelled... skipped 9/9 and TestListenRefuses... 8/9. In gate2's docker runs at 8 MiB they skipped 31/31 and 9/15. With celeris#639's refusal deleted, the fixed tree FAILS where the pristine tree SKIPs, so today such a regression is invisible at 8 MiB. #674's branch fixes this in commits not yet pushed (the PR head is still a941102):

• 9a01f71, e4f91c8 and 1d90b5d retry an engine start only on ring ENOMEM, for up to 10 s, and FAIL if a 4-entry ring can still be created. startTestEngine gets the same retry.
• d02d8cc runs ./engine/iouring in its own -v step. The step fails on any SKIP that no other step enforces, and requires both celeris#639 tests to PASS by name.

This part closes with #674.

2. Four epoll sendfile e2e tests have never run: #702

startFileEngine asks for Workers: 1 (engine/epoll/sendfile_e2e_linux_test.go:84). resource.MinWorkers is 2 (resource/preset.go:8), enforced at resource/config.go:147-148. So New fails validation and the helper's t.Skipf skips on every host. This has been true since 7beebb9, first released in v1.5.0.

#702 asks for resource.MinWorkers and fails on a New error. epoll's New fails only on validation. Results in the root step:

• With test: run the epoll sendfile e2e tests, and let CI forbid the celeris#592 rig's io_uring skips (celeris#684) #702: PASS 2/2.
• Mutant, sendfile hook not installed: LargeFile and HEAD FAIL 2/2.
• Mutant, offset ignored and threshold removed: Range and SubThreshold FAIL 2/2.
• Pristine tree under both mutants: all four SKIP, and the job is green.

3. The celeris#592 rig's io_uring half

#702 makes both of its io_uring skips FAIL when CELERIS_REQUIRE_IOURING_WORKERS=1. At 8 MiB with the variable set, the three subtests FAIL in 2/2 runs; on main's tests they SKIP. With memlock raised, all six subtests PASS (3 runs). With the celeris#592 re-opener reverted, both engines' settled subtests FAIL.

The rig does not catch a celeris#593 revert. With the snapshotH1Deadlines TryLock reverted to a blocking Lock, the io_uring half still PASSES 3/3. It prints a stalled fraction of 0.327-0.340, against 0.000 without the mutant, but it asserts only a median ratio. So running it in CI would repeat the celeris#592 check the epoll half already makes, and would not guard celeris#593.

Deferred to step 3 (ci.yml, after #674 and #671)

• -v and a SKIP-tally interlock with an allow-list on the root step, ./engine/epoll included, modelled on gate2's proposed-ci-skip-tally.sh: 30/30 pristine logs fail it, 5/5 fixed logs pass.
• A raised-memlock step for the adaptive dispatch never re-times a settled route: a store-backed handler that turns slow runs inline on the engine worker forever (#493 item 4, measured) #592 rig's io_uring half. It is worth adding only with the celeris#593 follow-up below.

Follow-ups (not in #702)

• Make the adaptive dispatch never re-times a settled route: a store-backed handler that turns slow runs inline on the engine worker forever (#493 item 4, measured) #592 rig assert the io_uring stall it already prints, if it is to guard celeris#593. The bar is the owner's call, given celeris#622's 0.145 queued-fraction outlier.
• Ten more epoll helpers skip on any epoll.New error ("epoll engine unavailable"). This is the sendfile trap, latent: none fires today. transplant_accounting_test.go is also in fix(epoll): never park the loop on a running async handler, and leave the live set to the loop on an async hijack (celeris#669, celeris#668) #698.
• The sse alloc-count tests need a step without -race.
• The redis auth conformance tests need a password-protected redis service.
• Decide whether TestWriteBufBackpressureClosesSlowConsumer stays opt-in or becomes deterministic.

Run ids, per-test tallies and scripts: evidence/celeris-684/lane-20260926/ (MANIFEST.txt). Mechanism: evidence/celeris-662/r6/gate2/90-GATE2.md T2. #674's side: evidence/celeris-662/r6/fix/90-FIX.md §T2.