Joseph Doherty
97 lines
6.3 KiB
Markdown
97 lines
6.3 KiB
Markdown
# Issue #799 resolution gates
|
||
|
||
Status: prospective procedure under review, **not approved for launch**. The
|
||
retained cold failures remain failures. This document does not change the plan's
|
||
resource budgets, establish a replacement baseline, or authorize release.
|
||
|
||
## Separate the evidence
|
||
|
||
| Question | Evidence required | Current boundary |
|
||
|---|---|---|
|
||
| Finite generated-code startup | Fixed canonical operation sequence and bounded, lossless trace windows | Candidate saturation met the selected factory criterion. Summed native MethodSize does not explain all RSS. |
|
||
| Cross-version lifecycle ownership and memory | Equivalent operations, token invalidation, dropped harness roots, resource-owner checks and matched executable hosts | Original closed objects retain continuation lists while held by the harness; usable steady-state comparison is not established. |
|
||
| Continuing macOS native retention | Private-key import attribution, bounded native inventory, supported ownership correction and verification | Balanced managed disposal alone has not stopped Apple Security object accumulation. Linux results cannot close this component. |
|
||
|
||
The coordinator owns integration and long executions. Two independent Sol agent
|
||
lanes own `baseline-canonical/` and `native-retention/` respectively; use high
|
||
effort for control implementation and ownership analysis. Astra at xhigh reviews
|
||
each control design, its result, any production correction, and the complete
|
||
acceptance procedure before execution. No worker changes the other lane's files,
|
||
production factory architecture, immutable baseline, or acceptance denominator.
|
||
|
||
## Short controls before a new long run
|
||
|
||
The original-SDK lane must demonstrate removal from SessionManager, rejection of
|
||
the old authentication token, and rejection of old browse/history continuation
|
||
tokens from a fresh session. A helper boundary must drop all strong Session,
|
||
continuation and harness references before bounded GC/weak-reference observations.
|
||
Observe closed-session/point weak references while the same host remains live,
|
||
then separately observe application/validator/store roots after normal host stop;
|
||
teardown must not hide retention of closed sessions. Inventory separately
|
||
identifies which resource owner releases each object.
|
||
Retain the earlier held-object failure. Do not explicitly dispose abandoned
|
||
objects or clear caches merely to make the baseline pass. Unsupported original
|
||
ownership probes remain unsupported, rather than being reported as zero.
|
||
|
||
The native lane must attribute configured-store private-key loads separately
|
||
from public certificate and shared-handle operations using fixed counts and
|
||
identical certificates. Include a separate bounded store-update semantic control
|
||
so registry reuse cannot silently bypass configured-store rotation. Review exact
|
||
SDK 2.0.1 public ownership seams before any
|
||
application correction. A supported correction needs a failing-before/passing-
|
||
after ownership control and preserved trust, private-key availability, reconnect
|
||
and shutdown behavior. Custom crypto, copied transport negotiation, SDK forks,
|
||
factory substitution and certificate-policy changes require a separate design;
|
||
they are not fixes authorized by this procedure. Keep private PKI out of Git.
|
||
|
||
## Prerequisites for reviewing warmed acceptance
|
||
|
||
1. Establish operation/status/order parity and semantically valid close/ownership
|
||
checks across versions. Match executable host, runtime, architecture and
|
||
instrumentation. A growing original process is not an accepted denominator.
|
||
2. Freeze source commits, all artifact hashes, runtime/image identities, private
|
||
PKI identity, fixtures and the serial same-host schedule before launch.
|
||
3. Submit the actual harness change, negative controls and immutable artifact
|
||
receipts to Astra. Approval of diagnostics is not approval of acceptance.
|
||
4. Resolve continuing macOS native growth independently. A Linux acceptance run
|
||
cannot waive it, even if the Linux resource guard passes.
|
||
|
||
Before this draft becomes executable, define version-appropriate standard-node
|
||
loading/factory trace coverage for the original binary. The absence of SDK2's
|
||
`Opc.Ua.OpcUaExtensions` type must not let the original pass an irrelevant zero
|
||
counter. Also predeclare identical retained-managed/GC and RSS sampling cadence
|
||
and statistics, including exactly which samples feed the relative 15% comparison.
|
||
These details remain pending; observed results cannot select them retroactively.
|
||
|
||
## Proposed fixed warmup and measurement
|
||
|
||
This section is a review proposal only. If the prerequisites and Astra gate pass,
|
||
qualification uses exactly 384 canonical cycles / 96 restarts plus one settling
|
||
cycle within 1,800 seconds. The fixed trace windows are cycles 321–352 and
|
||
353–384, with the continuous veto across their boundary. Require zero generated-
|
||
factory JIT/load events, zero new SDK assembly loads and zero lost events. Reject
|
||
missing markers, wrong identity or observer faults. Do not extend or retry the
|
||
qualification until a favorable sample appears.
|
||
|
||
Prospectively select exactly the post-cycle-385 sample as the measurement
|
||
baseline; do not choose a minimum, median or later sample from observed RSS.
|
||
Retain all cold, peak and rejected rows. Measurement must then last at least
|
||
7,200 actual seconds **after** warmup, retaining the +64 MiB managed, +128 MiB
|
||
RSS and +32 descriptor caps, all canonical operations and semantic/native/
|
||
ownership guards. Latch the first failure permanently. No resource resets,
|
||
skipped operations or completion claim on a rejected run.
|
||
Setup, warmup and final cleanup do not count toward measurement duration. Final
|
||
shutdown and ownership checks are mandatory after that duration completes.
|
||
|
||
For uninstrumented acceptance, first perform an identical fresh paired
|
||
qualification rehearsal, then use the fixed warmup without EventPipe or
|
||
allocation StackTrace tracking. The earlier tracked candidate run cannot be
|
||
relabelled as this evidence. Predefine sampling and statistics for at least three
|
||
matched representative runs to assess the separate plan-relative throughput,
|
||
latency, allocation and RSS budgets. A two-hour absolute-cap pass alone does not
|
||
satisfy those comparisons.
|
||
|
||
Only verified results meeting these distinct requirements can support closing
|
||
#799. Keep #782 G4 and draft PR #802 on hold until their remaining gates also
|
||
pass; Windows/runtime and licensed interoperability evidence remain separate.
|