Merge train: #9861, #9965, #9969, #9970, #9971, #9973, #9975 - #9978
Merged
Conversation
Keep the no-default-features product build free of dead-code warnings while retaining every helper where its regex feature or unit tests need it. Dispositions: - newborn_parent_needs_barrier: cfg(test or regex-engine); feature + tests use it. - REGEXP_PROTOTYPE_PTR_SLOT: cfg(test or regex-engine); feature GC root backing. - REGEXP_PROTOTYPE_TEST_CLOSURE_SLOT: cfg(test or regex-engine); feature root backing. - REGEXP_PROTOTYPE_TEST_INDEX_SLOT: cfg(test or regex-engine); feature scalar backing. - REGEXP_PROTOTYPE_PTR: cfg(test or regex-engine); feature fast path/root scanner. - REGEXP_PROTOTYPE_TEST_CLOSURE: cfg(test or regex-engine); feature fast path/scanner. - REGEXP_PROTOTYPE_TEST_WALKS: cfg(test or regex-engine); feature/test diagnostic. Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo (cherry picked from commit 31a9d08)
Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo (cherry picked from commit d5115df)
The extractor only admitted commands beginning with `python3 scripts/`, `./scripts/`, or `cargo fmt`. The public-baseline commands instead begin with an inline PYTHONPATH assignment and `python3 benchmarks/`, so both were filtered out; the YAML block's comments and step metadata were not the cause. Recognize every executable family currently used by lint, retain workflow step names in the derived list, and reject any run step that produces no commands. Keep the two GitHub-context commands on a stale-checked explicit skip list, and self-test both comment-led extraction and the loud failure. Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo (cherry picked from commit 75885c0)
Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo (cherry picked from commit 942e5f4)
Derive the warnings and check job gates from test.yml, including the product-only warnings check, both host-compatible workspace scopes, and the API-docs regeneration and drift assertion. Expand the workflow's package exclusions portably for macOS Bash 3.2. Extend the extractor self-test to require the product check under -D warnings, reject its removal, and prove newly added warnings commands are replayed. Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo (cherry picked from commit 3e6aeef)
Replace arm 5b's expected verifier panic with positive correctness and liveness checks for the retained-growth workload. Compare Perry's stdout byte-for-byte with Node, require a successful exit, and require copied objects so the evacuation verifier cannot pass vacuously. Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo (cherry picked from commit 83b90a0)
Include PERRY_SEGVIEW in the build-cache environment fingerprint so switching the lowering cannot reuse a binary built under the other mode. Record PERRY_SEGVIEW_DIAG as diagnostics-only, and cover the real cache miss with a qualifying Intl.Segmenter compile. Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo (cherry picked from commit 9929ed0)
…opy (#9851) The adaptive tenuring loop takes its one and only survivor-round mortality sample on the FIRST minor of the process -- when the cohort really is immortal (99.1 % survival) -- drops the threshold to 1, and thereby destroys its ability to ever sample again: n=1 across 352 minors. In steady state an aging round filters 26.1 % of each cohort, and the loop cannot see it. `retune_after_scavenge` picks the threshold from `S = 1 + desired / influx`, the largest S whose projected survivor occupancy `(S-1) x influx` fits the desired survivor size. With integer division, any influx above `desired` yields exactly 1 -- there is no rung at 2 or 3. On the compiled claude-code TUI the first drop reads `eden_live_bytes=12075344` against `desired=1048576`. S=1 does not reduce the surviving data; it relocates it, from the survivor space -- where the next minor re-examines it for free -- to the old generation, which only a full can reclaim. The occupancy formula has no term for that. And S=1 is self-sealing: nothing is copied, so `copied_bytes` is 0, so next cycle `prev_copied` is 0, so the survival-rate lock's guard (`prev_copied >= substantial`) is false forever. Both remaining exits -- the occupancy recompute and PROMOTE_LOCK's unlock -- are QUIET-INFLUX exits, which say nothing about lifetime. The loop concludes "long-lived" from a premise about space and then removes its ability to check. Measured, 4 streamed turns in one process, both arms from one binary via the diagnostic knob PERRY_GC_TENURING_SURVIVALS, 3300-character replies: adaptive pinned S=2 minors at S=1 351 of 352 (100 % of promotion) 0 threshold transitions 1 7 mortality samples 1 393 median mortality 0.9 % 26.1 % ...steady turns 2 / 3 / 4 not measurable 26.1 / 26.1 / 26.1 % substantial cohorts < 10 % 1/1 5/358 promoted 1057 MB 792 MB The occupancy rule now stops at the lowest threshold that still PRODUCES that measurement. 2 is forced by the requirement rather than tuned: at S=1 nothing enters the survivor space, at S=2 exactly one cohort does. The clamp is at the USE SITE, not inside `compute_target_survivals`: that pure function has a second caller, `full_seed_promotes_on_first_copy`, which gates the sweep seed on `... != 1`. Clamping the shared function would silently disarm the sweep seed, which is one of the two paths that IS allowed to reach 1. Reaching 1 still belongs to the survival-rate lock and the sweep seed, which measure mortality; both are untouched, so the rule is self-limiting -- on a workload whose cohort genuinely does not die the lock fires after one cohort's copy and takes the loop back to 1. On claude-code it correctly does not: 5 of 358 substantial cohorts sit under the lock's 90 % bar, so the clamp holds rather than oscillating. Tests. `target_formula_matches_projected_occupancy` is byte-identical -- the arithmetic is untouched, and that test is the proof. Four tests move an expected value 1 -> 2 and keep their names, structure and invariants: `drops_immediately_and_rises_debounced` (asymmetric response: immediate drop, debounced rise -- 4 -> 2 shows it as well as 4 -> 1), `steady_heavy_influx_is_a_fixed_point` (fixed-pointness, now at 2), `heavy_influx_lowers_threshold_and_promotes_next_cycle` (its promotion half is untouched: the cohort was copied once, so `next_age` is 2 on cycle 2 and it still tenures exactly when the test says) and `quiet_cycles_restore_power_on_threshold_debounced` (the debounced restore is asserted structurally and survives). Two new tests: the two-phase attributed pair -- occupancy alone holds at the floor and has not taken the lock's route, then a substantial fully-surviving cohort still reaches 1 through the lock -- and a dying-cohort test at claude-code's measured 74 % survival. (cherry picked from commit 925ceb2)
… survivor space Follow-up to the previous commit, and caused by it. #9851's clamp stops the occupancy rule concluding "promote on first copy", and measuring the relinked candidate showed it buys -7 % of promotion where the pinned control buys -26 %: 85 % of promotion still happens at S=1, now reached through the survival-rate lock 8-12 times per four-turn run. That is a consequence of the clamp, not a coincidence. At S=1 nothing is copied, so `prev_copied` is 0 and the lock's guard can never be satisfied -- the previous commit's own argument. Removing the seal hands the lock its guard back, and the lock then reaches 1 by itself. The lock tested prev_copied >= substantial && survivor_live_bytes * 10 >= prev_copied * 9 where `survivor_live_bytes` is every live byte leaving the from-survivor space this cycle, of any age, and `prev_copied` is the previous cycle's whole intake. Those two scopes MATCH: the survivor spaces are a strict semispace pair (to-space reset before the minor, everything copied into it, then flip), so the from-space at cycle N holds exactly what cycle N-1 copied. The ratio is well-formed and cannot exceed 1. The defect is not the arithmetic. The defect is which POPULATION the ratio rates, and that is chosen by the very threshold the lock sets. At S <= 2 the space holds one fresh cohort (age-2 is promoted) and the ratio is one aging round's survival -- 74 % on the compiled claude-code TUI, under the 90 % bar. At S = 3-4 it also holds age-2 and age-3 objects, which have already survived a round and are therefore selected for longevity, so the aggregate clears 90 % while a fresh cohort does not. The rule reads its own setting back as evidence. The clamp is what lets the debounced rise reach 3 and 4, which is why this only became visible once the seal was gone. The copier now accounts the fresh half of each cycle. `eden_copied_bytes` is what this cycle copied out of EDEN into the to-survivor space (no re-copies) -- one cohort's intake. `survivor_first_round_live_bytes` is what came back out of the from-survivor space alive with a stored survival age of 1, i.e. members of exactly the cohort the previous cycle's `eden_copied_bytes` counted; the age is already in the header at copy time (`copied_survival_age`), so no new per-object state is needed. `retune_after_scavenge` keeps its arity and its two lock parameters are redefined to those, which is the whole change at the policy end: both sides of the ratio are now scoped to one cohort at every threshold. Both new counts are on the `[gc-copy-minor]` diagnostic line next to the whole-space ones, so first-round mortality is readable from ANY build rather than only from an instrumented branch -- the measurement this policy is about should not require a custom binary. Measured, one binary, three arms via `PERRY_GC_TENURING_SURVIVALS`, 3300-char replies, 4 turns in one process, macOS arm64: arm minors promoted S=1 share via the lock =1 (pre-clamp equivalent) 356 1055 MB 100 % - clamp only, run 1 368 982 MB 85 % 8 clamp only, run 2 384 980 MB 84 % 12 =2 (positive control) 380 785 MB 0 % n/a Tests. No existing expected value moves -- all 1,069 gc tests pass unchanged, which is itself the finding: nothing in the suite distinguished the two scopes, because they are equal on every heap whose survivor space holds one generation, and that is every heap at a threshold of 2 or below. So the premise gets a test of its own on a real heap: two rooted objects introduced one cycle apart at the power-on threshold, asserting that the two numbers AGREE while only one generation is resident and then DIFFER once an aged resident joins it, with the aged object in the whole-space number and not in the cohort number. A test-only witness (`test_last_cohort_split`) reports the pair the copier computed. The two lock tests keep their values and gain the scoping in their names and comments; `a_cohort_that_dies_in_its_round_holds_at_the_occupancy_floor` now states that this same heap locks if the call site passes the whole space, which is what it used to pass. The previous commit's changelog fragment claimed the lock correctly stays out on claude-code (5 of 358 substantial cohorts under the bar). That figure was taken with the threshold PINNED, where every cohort the lock can rate is a first-round cohort; it does not describe the rule running, and the fragment is corrected rather than left to be read as a result. Claude-Session: https://claude.ai/code/session_014knX724SYDogwzsXybCGxp (cherry picked from commit c154ba6)
…d is measured The symmetric half of #9851. That commit stopped the occupancy rule concluding "promote on first copy" -- a claim about LIFETIME derived from a measurement of SPACE. The same formula makes the same category error at the other end: compute_target_survivals = 1 + desired / influx (capped at the ceiling) returns the ceiling for a tiny influx AND for a zero one. On the first minors of a process -- heap nearly empty, no cohort ever followed -- occupancy therefore claims the MAXIMUM, before a single object has been given the chance to die. It is the expensive direction of the error, because every survivor is then copied up to three times before it may be promoted. Measured on the landing base (main5 + #9881, one binary, four env arms, two rounds of 4 turns at 3300 and 400, quiet host), this startup excursion is the WHOLE difference between the adaptive loop and a pinned threshold: * unset vs pinned S=1: turn-1 CPU 3.41 s vs 3.02 s at 3300 (+0.35..0.45 s both rounds) and 1.05 s vs 0.72 s at 400 (+50 %), while the sum over turns 2-4 is within noise (6.18-6.23 vs 6.35-6.41); * the adaptive arm's transitions are `4 -> 2 (occupancy) -> 1 (lock)` and ALL of them land inside turn 1; turns 2-4 run at S=1 with nothing copied. So the adaptive policy's only cost on this workload was a startup claim it had no evidence for, and its steady state was already the pinned one. The rule is now symmetric: **until one survivor round has actually been rated, the occupancy rule holds at `OCCUPANCY_MIN_SURVIVALS`.** That value is not a tuning choice; it is the lowest threshold that PRODUCES the measurement the rule needs in order to say anything -- at 1 nothing enters the survivor space, at 2 exactly one cohort does. The power-on threshold becomes the same value for the same reason: starting at the ceiling is a lifetime claim made before the process has run. `SURVIVOR_ROUND_MEASURED` is set the moment a cohort the previous cycle copied becomes rateable, so the gate lifts after about two minors and the ladder is unchanged from then on -- it delays the claim until evidence exists, it does not remove the ladder. The two paths that MEASURE mortality are untouched: the survival-rate lock and the sweep seed may still reach 1 whenever they have the evidence for it. `compute_target_survivals` is again left alone, and its test is again the proof: the arithmetic still returns the ceiling for a zero and a tiny influx. Only what the loop may do with that changes. Tests. A new two-phase test: eight startup-shaped minors (tiny influx, nothing copied) must leave the loop at the floor and out of the lock; then, once a cohort has gone through the survivor space and been followed, the debounced rise must still reach the ceiling. Sabotage: delete the gate, or restore the power-on value to the ceiling, and phase 1 fails. Two existing tests move with the power-on value and keep their properties: `drops_immediately_and_rises_debounced` is about the ladder's ASYMMETRY, so it now seeds a fully-dying cohort first (which rates a round without involving the lock) and then tests the same immediate-drop / debounced-rise behaviour; `sweep_seed_refuses_a_small_fully_live_eden` asserts the threshold is unchanged from power-on, which is the floor now. `survival_rate_lock_breaks_a_saturated_ pipeline` needs no change -- the lock firing implies a rated round, so its ladder recovery is unaffected. NOT COMPILED: the box is at 7 GB free, under this campaign's 12 GB build floor, so neither the build nor the suite has been run against this commit. The braces balance and the reasoning above is stated per test, but that is a review and not a check. (cherry picked from commit 481e941)
…the floor (cherry picked from commit 939187c)
LAST_COHORT_SPLIT (cfg(test), copying.rs) is test_only; SURVIVOR_ROUND_MEASURED (tenuring.rs) is a boolean, not a GC pointer. Inventory only; no code change. (cherry picked from commit 9c85be5)
Snapshot malloc-backed headers before running verifier callbacks so exact child validation can lazily rebuild the malloc registry without re-entering its RefCell borrow. Add a worker-thread copying-minor regression fixture. Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo (cherry picked from commit 499b716)
Record the re-entrancy path, structural fix, disk-gated validation status, and the requested perrymaster campaign handoff. Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo (cherry picked from commit 4295d39)
Name heap parents, layout slots, root scanners, and collection coverage when evacuation verification finds a stale forwarding alias. Emit a compact success witness with heap-walk and remembered-edge counts under GC diagnostics. Add focused failure-attribution and success-line regression tests. Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo (cherry picked from commit 1ec9e0e)
Record VF2 field derivation, covered failure sites, passing-path cost, focused test evidence, disk-limited gates, and the perrymaster campaign request. Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo (cherry picked from commit 38229cc)
Re-pin the PASS1_MARKED non-moving window after auditing the verifier diagnostic plumbing, and classify its three counter-only TLS holders. Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo (cherry picked from commit 4fc86a2)
Instrument headerless receiver producers and dynamic receiver funnels behind the opt-in PERRY_RECEIVER_REPR_DIAG sink. Add explicit native return storage kinds while retaining the existing pointer-boxing lowering, plus checked provider inventory and fail-capable fixtures. Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo (cherry picked from commit 9b6884e)
Record the producer map, corrected executable-row census, sabotage proofs, gate results, and the perrymaster measurement request for campaign PR 1. Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo (cherry picked from commit ecbfba3)
#9969 makes run_lint_gates.sh derive every command of every run: step (80 now, up from 67). Two of the newly-run gates were red on this train: - addr_class_inventory rejected #9973's two GcHeader casts in hot_diag/receiver_repr.rs. Both are allowlisted with reasons rather than converted: the block is a #[cfg(debug_assertions)] trust-the-tag audit that compares the ownership-derived header against a direct byte-offset read and counts disagreements. Routing the raw side through try_read_gc_header would validate the address first and return None for exactly the implausible cases the audit exists to catch, so the canonical predicate cannot stand in there. - RUSTFLAGS="-D warnings" cargo check --workspace --all-targets rejected #9861's doc comment on a thread_local! macro invocation, which cannot carry one. Moved inside the macro onto the static it describes. This is a warning, not an error, so it only fails under -D warnings — which the driver never replayed before #9969.
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (89)
📝 WalkthroughWalkthroughThis PR adds typed native result classes and validation, receiver-representation diagnostics, GC evacuation-verifier and adaptive-tenuring updates, and build or lint tooling changes. It also updates tests, reports, smoke checks, and changelog entries to match the new behavior. ChangesTyped native results and ledger validation
Receiver representation diagnostics
GC verifier and adaptive tenuring
Tooling and build behavior
Estimated code review effort: 5 (Critical) | ~120 minutes Suggested reviewers: ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This was referenced Sep 7, 2026
This was referenced Sep 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge train: #9861, #9965, #9969, #9970, #9971, #9973, #9975.
The 13 open PRs split into two trains because six of them form two stacks (#9918 ⊂ #9958 ⊂ #9977 regex, #9950 ⊂ #9957 ⊂ #9976 GC); those follow separately so a failure in ~8k lines of GC and regex work stays attributable.
#9969 makes the local lint driver honest — and it immediately found things
run_lint_gates.shderives its gate list fromtest.yml, and its extractor only accepted commands starting withpython3 scripts/,./scripts/orcargo fmt. It derived 67 commands from 44run:steps, ran 65, and printed green. Verified against pristineorigin/mainbefore accepting the claim: the driver never referenced the Public benchmark evidence freshness step, that step is in the lint job, and it fails onmain— red since 2026-07-29.A second blind spot in the same driver: the compile tier ran only
cargo check --workspace --all-targets, where test targets keep dead code alive, and never the product-scope-D warningscheck. That fails onmainwith seven dead-code errors, which is exactly #9970.After the fix the driver derives 80 gates, and two of the newly-run ones were red on this train:
GcHeadercasts. Allowlisted with reasons rather than converted: the block is a#[cfg(debug_assertions)]trust-the-tag audit that compares the ownership-derived header against a direct byte-offset read and counts disagreements. Routing the raw side throughtry_read_gc_headerwould validate the address first and returnNonefor exactly the implausible cases the audit exists to catch — the canonical predicate cannot stand in there without destroying the check.-D warningsworkspace all-targets rejected fix(gc): the tenuring occupancy rule may not claim promote-on-first-copy (#9851) #9861's doc comment on athread_local!macro invocation, which cannot carry one. Moved inside, onto the static it describes. An unused doc comment is a warning, so this was invisible until the driver replayed the check under-D warnings.#9975 retires a pin correctly
#7254's arm asserted its reproducer still panics. With the bug fixed that pin must invert, and the replacement is stronger than a bare pass: Node runs as oracle and the arm fails loudly if the oracle itself cannot run the workload, output must be byte-identical to Node's, and
copied_objects > 0— so the arm fails if the copying minor never ran, rather than passing vacuously.Remaining gate state
run_lint_gates: 3 of 80 FAILEDon this train, all accounted for:main, verified on a pristine worktree. Regenerating that artifact is ~2h on the bench mini and tooling(lint): run_lint_gates.sh fails loudly when a lint step yields no command — it silently dropped the public-baseline step #9969 explicitly scopes it out as separate maintenance.regen_api_docs.shhardcodes$ROOT/target/release/perry; this session builds withCARGO_TARGET_DIRpointed elsewhere. With the binary placed where the script expects,regen_api_docs.shsucceeds and the drift check is clean — the committed docs match what this tree generates.Validation
Summary by CodeRabbit
Bug Fixes
Diagnostics
Builds