seller delivery: bound the lifetime of the push WORK, not the patience of its caller - #1006

Merged

jbojcic1 merged 63 commits into

MakePrisms:mainfrom

maxy-player:w-git-delivery-cancellation

Sep 17, 2026

Commits on Sep 14, 2026

delivery push: bound the lifetime of the WORK, not the patience of its caller
w-git-delivery-cancellation
committed
452ae32
delivery push: the turn is handed back when BOTH sides are finished with it
w-git-delivery-cancellation
committed
f1c9a29
delivery push: the required cancellation tests, on the real wire
w-git-delivery-cancellation
committed
0575a69
delivery push: interrupt the local pack phase, and name the span that cannot be
w-git-delivery-cancellation
committed
0995308
delivery push: the killable executor, and the feasibility it rests on
w-git-delivery-cancellation
committed
8ecc498
delivery push: unknown exit retains the turn, and the reader has a ceiling
w-git-delivery-cancellation
committed
1731140
delivery push: the production push runs in the killable child
w-pr1006-wiring-gates
committed
2b1dd47
delivery push: gate the finite stop on the production path
w-pr1006-wiring-gates
committed
443b9ca
delivery push: bound the mint and the cleanup, and watch a second delivery wait
w-pr1006-wiring-gates
committed
c6c4c3f
delivery push: print the measured hold and handover
w-pr1006-wiring-gates
committed
3bd1546
delivery push: bound every parent phase, and release only on an exit we saw
w-pr1006-r3-correction
committed
32be84b
delivery push: make the shipped binary do a real delivery, verifying the peer
w-pr1006-r3-correction
committed
a119e94
delivery push: serialize the shipped-child gates on the one trust store they share
w-pr1006-r3-correction
committed
1d63e60

Commits on Sep 15, 2026

delivery push: act on a revocation, enforce the protocol, and never strand a childless turn
w-pr1006-renewed-r1
committed
e41c00c
delivery push: charge the pipe transit to the child that spends it
w-pr1006-renewed-r1b
committed
5dffa3e
delivery push: observe the second delivery's Poll::Pending, not a marker the test wrote
w-pr1006-renewed-r1b
committed
a48d1b3
delivery push: fill in the shipped-child hold matrix, both legs and both ways out
w-pr1006-renewed-r1b
committed
99596db
delivery push: mint the shipped child's tokens through the real signer actor
w-pr1006-renewed-r1b
committed
55df3bb
delivery push: pin revoked-vs-deadline on the type, not on a log substring
w-pr1006-renewed-r1b
committed
3b58e67
delivery push: gate both halves of the arm rule, and unbreak the lib suite
w-pr1006-renewed-r1b
committed
c68c309
delivery push: wait for the wedged child, do not sleep at it
w-pr1006-renewed-r1b
committed
58e59a2
delivery push: gate the oid comparison on purpose, and stop counting authority calls
w-pr1006-renewed-r1b
committed
71efb46
delivery push: measure every parent phase from the deadline, and poll on a clock
w-pr1006-renewed-r1b
committed
4b7e967
delivery push: gate the revocation bound against a child that is not quiet
w-pr1006-renewed-r1b
committed
d2ea822
delivery push: gate the production signer under a held reply and a full queue
w-pr1006-renewed-r1b
committed
07063e4
delivery push: hold the seat with real libgit2 packing, and watch a second delivery wait
w-pr1006-renewed-r1b
committed
ec922ba
delivery push: gate a real task-abort with a second delivery observed pending
w-pr1006-renewed-r1b
committed
1f9e7ec
delivery push: restore the persistent post-mint revocation case alongside the isolated one
w-pr1006-renewed-r1b
committed
71d5599
executor: one shared authority-poll deadline, and a reap budget per child
w-pr1006-renewed-r1b
committed
4553cb1
executor tests: prove the shared poll deadline as a rule, and measure what this host can actually see
w-pr1006-renewed-r1b
committed
25bcf33
executor tests: the cap stops the encoder, and the reap window is one budget
w-pr1006-renewed-r1b
committed
28ce0e3
tests: compare abort cleanup against the remaining deadline, not the whole budget
w-pr1006-renewed-r1b
committed
42c52fd
delivery push: hold the delivery inside libgit2's own object walk, not a shell and not the wire
w-pr1006-second-renewal-r1
committed
1c82543
delivery push: time the stop against a real signer that cannot answer
w-pr1006-second-renewal-r1
committed
f9512db
delivery push: poll the second delivery THROUGH the reap, and ask the OS whether the first is gone
w-pr1006-second-renewal-r1
committed
205aee4
delivery push: give the deadline its own thread, so the kill stops waiting behind the supervisor
w-pr1006-second-renewal-r1
committed
a5a55e4
delivery custody: hand the seat on from a thread the stalled supervisor is not on
w-pr1006-continuation-r1
committed
d116d2b
delivery custody: prove the custody suite goes red under both mutations
w-pr1006-continuation-r1
committed
2fce05f
delivery custody: confirm the exit from the thread that killed it
w-pr1006-continuation-r1
committed
47c1455
delivery attribution: a write that failed because we killed the child is a kill
w-pr1006-continuation-r1
committed
1c4baba
T3: make the abort case a test of cancellation, not of patience
w-pr1006-continuation-r1
committed
db0bbb1
T2: wire the real PushAuthority, making the call-for-call claim true
w-pr1006-continuation-r1
committed
69c0d4f
mutation rigor: named-assertion reds, enforced counts, hash-bound receipts
w-pr1006-continuation-r1
committed
56e542e
gate-final.log's 101: the cause, established, and what the fix does and does not do
w-pr1006-continuation-r1
committed
2933dcf
tests: gate my stalled-supervisor test on the feature it needs
w-pr1006-continuation-r1
committed
fafb4e7
fix(delivery): withhold the seat until cleanup is established, and charge the failed reap
w-pr1006-continuation-r1
committed
ee2b290
test(delivery): identify and prove the mechanism that ends an aborted wire delivery
w-pr1006-continuation-r1
committed
85877db
docs(test): name the startup residual and the executor change that would close it
w-pr1006-continuation-r1
committed
e9dc340
test(delivery): decide the overlap from evidence a starved observer cannot
w-pr1006-continuation-r1
committed
51fbaed
test(delivery): show the overlap oracle going red on a real overlap
w-pr1006-continuation-r1
committed
7952041
test(delivery): fail when the observer never looked, instead of passing
w-pr1006-continuation-r1
committed
097feab

Commits on Sep 16, 2026

fix(delivery): publish the observed EOF before the queued frame, not after
w-pr1006-continuation-r1
committed
5e61933

Commits on Sep 17, 2026