dohertj2/mxaccessgw
1
0
Fork 0
Code Issues 14 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(ipc): cancellation-priority timeout classification; structurally-enforced no-throw cancel send

Browse Source
This commit is contained in:
Joseph Doherty
2026-08-15 12:41:38 -04:00
parent 1742e38c10
commit a1a38b5538
3 changed files with 130 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/GatewayProcessDesign.md
+10 -2
View File
@@ -604,8 +604,16 @@ running on it, and the rule above still holds. A command whose envelope is still
in the gateway's outbound queue needs no special handling: the queue is FIFO, so
the worker reads the command and then its cancel and drops it before execution.
Failing to send the cancel is logged at debug and never replaces the
`CommandTimeout` the caller is owed.
Cancels ride the same outbound channel as commands, whose capacity is
`MaxPendingCommands + 4`: the reserve above the pending-command limit is what
absorbs them, so a burst of timeouts stays bounded and cannot deadlock the
enqueue path. Failing to send the cancel is logged at debug and never replaces
the `CommandTimeout` the caller is owed.
Cancellation outranks the deadline. When a caller's token is canceled around the
same time the timeout fires, the command is reported as canceled
(`GatewayShutdown`, `OperationCanceledException`), not as `CommandTimeout`, and
no cancel is forwarded.
## Fault Model