ddefd581
docs: three cross-reference fixes in the hygiene doctrine
a73x 2026-08-14 09:55
Commit message
docs/decisions.md
| Old | New | ||
|---|---|---|---|
| @@ -3234,38 +3234,41 @@ two dialects. | |||
| 3234 | stated per-row. The strata computation excludes the column. | 3234 | stated per-row. The strata computation excludes the column. |
| 3235 | - **refAllDecls in every test-loop module root, scope stated honestly.** | 3235 | - **refAllDecls in every test-loop module root, scope stated honestly.** |
| 3236 | Pub decls only — std.meta.declarations sees nothing private. Narrower | 3236 | Pub decls only — std.meta.declarations sees nothing private. Narrower |
| 3237 | still than the original hazard framing: in 0.15.2 a pub decl with an | 3237 | still than the original silent-module-loss framing: in 0.15.2 a pub decl |
| 3238 | unresolvable type fails eagerly once the module is touched at all (the | 3238 | with an unresolvable type fails eagerly once the module is touched at |
| 3239 | planned probe proof did not reproduce; two isolated repros confirmed), | 3239 | all (the planned probe proof did not reproduce; two isolated repros |
| 3240 | so the gap this closes is the module that is imported but never | 3240 | confirmed), so the gap this closes is the module that is imported but |
| 3241 | referenced by name — plus forcing analysis where nothing referenced the | 3241 | never referenced by name — plus forcing analysis where nothing |
| 3242 | decl. quic/quic_server/quic_client use the plain variant (the recursive | 3242 | referenced the decl. quic/quic_server/quic_client use the plain variant |
| 3243 | walk would analyze the whole wolfSSL/ngtcp2 cImport namespace); engine | 3243 | (the recursive walk would analyze the whole wolfSSL/ngtcp2 cImport |
| 3244 | was downgraded to plain because recursion reaches pre-existing comptime | 3244 | namespace); engine was downgraded to plain because recursion reaches |
| 3245 | errors inside vendored ghostty-vt (re-promote when the dep is bumped); | 3245 | pre-existing comptime errors inside vendored ghostty-vt (re-promote |
| 3246 | wasm_core is excluded because it is not in the native test loop and a | 3246 | when the dep is bumped); wasm_core is excluded because it is not in |
| 3247 | block there would never run. | 3247 | the native test loop and a block there would never run. |
| 3248 | - **Leak verdicts print, never panic.** All three binaries check | 3248 | - **Leak verdicts print, never panic.** The three gpa-backed binaries |
| 3249 | `gpa.deinit()` and print `<binary>: LEAK: allocations outlived deinit` | 3249 | (muxd, mux, muxweb) check `gpa.deinit()` and print |
| 3250 | to stderr on `.leak` — never an exit-code change, because muxd's exit | 3250 | `<binary>: LEAK: allocations outlived deinit` to stderr on `.leak` — |
| 3251 | code carries the session shell's. e2e captures every daemon's stderr and | 3251 | never an exit-code change, because muxd's exit code carries the |
| 3252 | sweeps all captures at the end, behind a canary that fails if the sweep | 3252 | session shell's. e2e captures every daemon's stderr and sweeps all |
| 3253 | has nothing to read; agent.sh checks the detached-daemon log after each | 3253 | captures at the end, behind a canary that fails if the sweep has |
| 3254 | nothing to read; agent.sh checks the detached-daemon log after each | ||
| 3254 | clean stop, post process-exit, and fails loudly if the daemon outlives | 3255 | clean stop, post process-exit, and fails loudly if the daemon outlives |
| 3255 | the stop (a wedged daemon must not read as leak-free). Proven by | 3256 | the stop (a wedged daemon must not read as leak-free). Proven by |
| 3256 | deliberate leak: marker appeared, e2e failed at the sweep, agent failed | 3257 | deliberate leak: marker appeared, e2e failed at the sweep, agent failed |
| 3257 | all three leakcheck sites. kill -9 paths print nothing — no false | 3258 | all three leakcheck sites. kill -9 paths print nothing — no false |
| 3258 | positive, no coverage, stated. Known uncovered captures: $OUT.q and the | 3259 | positive, no coverage, stated. Known uncovered captures: $OUT.q and the |
| 3259 | other mid-suite rm'd files (recorded debt). | 3260 | other mid-suite rm'd files (recorded debt). muxa is arena-over- |
| 3260 | - **The persistence soak phase owns the classes 6a cannot see.** One | 3261 | page_allocator by construction and has no verdict to check. |
| 3261 | daemon, N client lifecycles: every cycle must prove its client attached | 3262 | - **The persistence soak phase owns the classes the Zig-side LEAK |
| 3262 | (a vacuous cycle fails the phase); fd count must return to baseline | 3263 | marker (6a) never sees.** One daemon, N client lifecycles: every cycle |
| 3263 | exactly, with one settle resample to absorb the unacked-detach race; RSS | 3264 | must prove its client attached (a vacuous cycle fails the phase); fd |
| 3264 | gets a 4MB growth bound past a 3-cycle warmup (allocators retain pages; | 3265 | count must return to baseline exactly, with one settle resample to |
| 3265 | equality would flake). The zombie /proc pitfall is guarded (`VmRSS` | 3266 | absorb the unacked-detach race; RSS gets a 4MB growth bound past a |
| 3266 | absent on a dead child reads as empty, not 0). Failure evidence is swept | 3267 | 3-cycle warmup (allocators retain pages; equality would flake). The |
| 3267 | into the faildir, never rm'd. First real numbers (SOAK_CYCLES=8): fds | 3268 | zombie /proc pitfall is guarded (`VmRSS` absent on a dead child reads |
| 3268 | 5->5 exact; RSS 9020->9128 kB (+108 kB across the 5 post-warmup cycles). | 3269 | as empty, not 0). Failure evidence is swept into the faildir, never |
| 3270 | rm'd. First real numbers (SOAK_CYCLES=8): fds 5->5 exact; RSS | ||
| 3271 | 9020->9128 kB (+108 kB across the 5 post-warmup cycles). | ||
| 3269 | - **`zig build check` is the pre-commit gate**: fmt (including | 3272 | - **`zig build check` is the pre-commit gate**: fmt (including |
| 3270 | build.zig.zon) + unit tests, seconds. e2e/agent/soak stay separate | 3273 | build.zig.zon) + unit tests, seconds. e2e/agent/soak stay separate |
| 3271 | steps — minutes-long and process-spawning. | 3274 | steps — minutes-long and process-spawning. |