V16-KI30: native receipt drain mirrors busy_timeout, capped at host grace by Cuarroc · Pull Request #737 · Cuarroc/ProjectA

Cuarroc · 2026-10-08T21:59:20Z

Der Windows-Host für Native-Receipts wartet unter SQLite-Last länger; nur diese lokale Wartezeit ist auf die Host-Grace begrenzt, übergeordnete Fristen können vorher ablaufen. Die Busy-Timeout-Zahl ist mit dem Store geteilt; der Kommentar beschreibt nur die lokale Drain-Frist. Du musst nichts entscheiden; Review und Merge übernimmt der Orchestrator.

Report

Package: V16-KI30 · Review tier: A (process capture / concurrency)
Author model: Cursor auto (Composer; exact served slug not exposed by harness)
Head: 0b407bac8040fa59254bf8129ba5106500271a17 (round-3 delta from dd0768de06440d99e71c0020d697320df0685505)

Goal / benefit: Keep KI-30 receipt survival under SQLite writer load, while the host drain mirrors busy_timeout capped at host grace (not an end-to-end deadline claim).
Parent / ticket / owner: PLAN row V16-KI30 · Root msg-0mv073o34-19227f25 · NACHBESSERN round 3 (delta only)
Scope / limits: comment wording in windows_capture.rs only this round; no other code; fail-closed drain retained
Diff size (full PR): +94 / −8 plus comment delta; round-3: comment-only (git diff dd0768d..HEAD --stat = 1 file)

Decision (round-1 disposition)

Cap the writer drain at HOST_GRACE_MS (do not extend ownership/security deadlines). Share SQLITE_BUSY_TIMEOUT_MS between Store::open and the capture budget. Widen the receipt-ack self-test parent bound to 30 s. Explicitly leave the full three-checkpoint busy budget unsupported when a child finishes near its provider timeout and only grace remains.

What changed

RED: protocol contract tests requiring drain ≤ host grace, busy_timeout mirror, and ≥10 s self-test slack (101dcdd).
FIX: writer_drain_budget_ms() = min(3*busy+margin, HOST_GRACE_MS); wire windows_capture + Store::open + self-test parent const (dd0768d).
Round 3: comment only — drain is a local allowance; no parent/owner lifetime guarantee (0b407ba).

Findings disposition

ID	Source	Severity	Finding	Disposition
R737-A1	Anthropic	medium	Literal 5 s busy budget not tied to Store::open	accepted — `SQLITE_BUSY_TIMEOUT_MS` shared; Store::open + drain use it (`dd0768d`)
R737-A2	Anthropic	medium	17 s drain vs 20 s self-test parent leaves ~3 s slack	accepted — drain capped at 10 s grace; self-test parent raised to 30 s (`dd0768d`)
R737-O1	OpenAI	medium	17 s drain can exceed parent/owner `HOST_GRACE_MS` (10 s)	accepted — drain capped at `HOST_GRACE_MS`; full 3×busy near-deadline budget retained as unresolved (`dd0768d`)
R737-A3	Anthropic	low	Comment overstated parent/owner containment	accepted — comment rewritten as local drain allowance (`0b407ba`)
R737-O3	OpenAI	low	Comment still claimed host never outlives parent/owner grace	accepted — same comment fix (`0b407ba`)
R737-A4	Anthropic	low	Stale test comment; Windows-only red-first	accepted (cheap comment); Windows proof via workflow_dispatch
R737-O2	OpenAI	medium	Store seam edit beyond no-seam brief	closed — Root exclusive store-seam assignment to #737 until v1.6.0 tag (msg-0mv073o34); no further code
R737-A5	Anthropic	low	`native_managed_tests.rs` under `store/` seam path	closed — same Root exclusive store-seam assignment (msg-0mv073o34)
R737-A6	Anthropic	medium	Production `store.rs` seam touch + capture dependency edge	closed — same Root exclusive store-seam assignment (msg-0mv073o34)
R737-A7	Anthropic	low	Title/body “sized/derived” overstates effective drain	accepted — title/body now “mirrors busy_timeout, capped at host grace”
R737-A8	Anthropic	low	Protocol tests are constant arithmetic only	follow-up — acceptable for constants; behaviour rests on Windows receipt test
R737-A9	Anthropic	low	Timing margin / do not claim KI-30 solved	accepted — no “KI-30 fixed/solved” claim; queue Windows run is next sample

Review: ausstehend (Stufe A) — round-3 delta; orchestrator queues OpenAI + Anthropic delta reviews.

Evidence

Command	Exit	Result
`cargo test -p projecta --lib writer_drain_budget` (RED head `101dcdd`)	101	both budget tests failed (17000 > 10000)
`cargo test -p projecta --lib host_receipt_ack_self_test_parent_bound` (RED)	101	slack test failed (20 s vs 17 s drain)
same filters on FIX head `dd0768d`	0	all three contract tests passed
`bash scripts/ci/gates.sh lane prepush` (head `dd0768d`)	0	prior round
`git diff dd0768de06440d99e71c0020d697320df0685505..HEAD --stat`	0	only `windows_capture.rs` comment (+11/−10)
`bash scripts/ci/gates.sh lane prepush` (head `0b407ba`, `CARGO_BUILD_JOBS=2`)	0	159 s; rust-suite 1887 passed
`bash scripts/ci/red-first.sh --plan`	0	count=10 specs=10 (via prepush)
`git push -u origin cursor/v16-ki30-native-receipt-deadline`	0
`git ls-remote origin cursor/v16-ki30-native-receipt-deadline`	0	`0b407bac8040fa59254bf8129ba5106500271a17`
prior RED `37844893967` / reject-22s `37846914003` / GREEN `37848531045`	—	original package Windows proof
`gh workflow run ci.yml` → 37854560786 (head `dd0768d`)	0	conclusion success; gates (linux) success; gates (windows) success; receipt test ok

NICHT ABGEDECKT

Linux does not compile or run #[cfg(windows)] capture/host code or real_native_* tests; Windows native run only via the merge queue (and prior workflow_dispatch 37854560786 on dd0768d).
Full three-checkpoint busy budget after near-timeout child exit remains unsupported by design (capped at host grace); no ownership deadline extension.
Sibling flake real_native_runner_bounds_… / store owner-deadline hypothesis unchanged.
development_capture still uses literal + 10_000 for owner deadline (mirrors HOST_GRACE_MS; follow-up to share the const).

Open points

Orchestrator: queue OpenAI + Anthropic delta reviews on 0b407ba; no ready/labels/merge from this worker.

Made with Cursor

Root-Abnahme (09.10.2026, head `0b407ba`) — Tier A, round 3 (user-approved E1)

ID	Source	Severity	Finding	Disposition
R737-O4	OpenAI d3	low	opening sentence promised containment in parent grace	accepted, fixed in this PR text by Root: opening now says only the local drain allowance is capped at `HOST_GRACE_MS` and enclosing deadlines may expire first
R737-O5	OpenAI d3	medium	store-seam exception not bounded to this PR's files	accepted, fixed by Root disposition below
R737-A10	Anthropic d3	condition	Root confirms the store-seam assignment	confirmed below
R737-A11	Anthropic d3	optional	soften `protocol.rs:30` wording; diff-size figure	follow-up (wording only); full PR diff is +95/−8 in 4 files

Store-seam exception (Root, file-bounded): authorized ONLY for this PR at head 0b407bac8040 and ONLY for the existing edits in src-tauri/src/store.rs (~1122: busy_timeout now reads SQLITE_BUSY_TIMEOUT_MS = 5 000 ms, same value as before) and src-tauri/src/store/native_managed_tests.rs (~157–181: test uses the shared constant; Process-stage delay). No other Store work is authorized by this exception. Serial ownership: no other open job/PR edits store.rs/store/ (Z4-ARCH-11 and KI14-POISON wait until after the v1.6.0 tag). Source: user decision E1 (09.10.2026) + Root msg-0mv073o34.

Claims bound: no "KI-30 fixed" claim. Windows evidence = workflow_dispatch 37854560786 on code-identical dd0768d + the merge-queue run; KI-30 needs several clean queue/weekly runs before closure (V16-NACHBEOB).

Reviews at this head: OpenAI d3 — code delta acceptable, report defects O4/O5 → fixed above in the report; Anthropic d3 — approve with conditions → conditions 1–2 met above, 3 follow-up. Reports: ~/pa-orch/reports/review-pr737-{openai,anthropic}-d3-0b407bac8040.md.

…n_busy_timeout deterministically fail Test-First: src-tauri/src/store/native_managed_tests.rs::real_native_completed_receipt_survives_sqlite_writer_within_busy_timeout Co-authored-by: Cursor <cursoragent@cursor.com>

Launch sleep only shifts the run before drain starts (workflow 37840356500 stayed green). Process persistence overlaps the fixed 5s receipt budget. Test-First: src-tauri/src/store/native_managed_tests.rs::real_native_completed_receipt_survives_sqlite_writer_within_busy_timeout Co-authored-by: Cursor <cursoragent@cursor.com>

A fixed 5s drain rejected a successful Receipt commit when earlier checkpoints still overlapped child exit. Keep fail-closed bounds, but allow four sequential busy_timeout waits plus margin. Test-First: src-tauri/src/store/native_managed_tests.rs::real_native_completed_receipt_survives_sqlite_writer_within_busy_timeout Co-authored-by: Cursor <cursoragent@cursor.com>

Four busy_timeout stages (22s) outlived the 20s parent observer used by self_test_host_receipt_ack, so a missing ack hit capture deadline exceeded. Size the drain for the three stages that can overlap child exit instead. Test-First: src-tauri/src/store/native_managed_tests.rs::real_native_completed_receipt_survives_sqlite_writer_within_busy_timeout Co-authored-by: Cursor <cursoragent@cursor.com>

Failing contract for R737-A1/A2/O1: uncapped 3*busy+margin exceeds HOST_GRACE_MS, and the 20s receipt-ack self-test parent lacks 10s slack. Test-First: src-tauri/src/process_capture/protocol.rs::writer_drain_budget_never_exceeds_host_grace Test-First: src-tauri/src/process_capture/protocol.rs::writer_drain_budget_mirrors_sqlite_busy_timeout_within_host_grace Test-First: src-tauri/src/process_capture/protocol.rs::host_receipt_ack_self_test_parent_bound_has_slack_over_drain_budget Co-authored-by: Cursor <cursoragent@cursor.com>

Mirror Store::open busy_timeout via SQLITE_BUSY_TIMEOUT_MS, cap the host drain at HOST_GRACE_MS so it cannot outlive parent/owner grace, and widen the receipt-ack self-test parent bound for runner slack (R737-A1/A2/O1). Test-First: src-tauri/src/process_capture/protocol.rs::writer_drain_budget_never_exceeds_host_grace Test-First: src-tauri/src/process_capture/protocol.rs::writer_drain_budget_mirrors_sqlite_busy_timeout_within_host_grace Test-First: src-tauri/src/process_capture/protocol.rs::host_receipt_ack_self_test_parent_bound_has_slack_over_drain_budget Co-authored-by: Cursor <cursoragent@cursor.com>

No-Test: comment wording only (R737-O3/A3) Co-authored-by: Cursor <cursoragent@cursor.com>

chatgpt-codex-connector · 2026-10-09T00:47:37Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T00:49:42.898677Z	`0b407ba`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

mergify · 2026-10-09T01:11:33Z

Cuarroc and others added 6 commits October 8, 2026 22:29

Cuarroc mentioned this pull request Oct 8, 2026

docs: Apply approved v1.6 release priorities #749

Merged

docs: clarify writer drain is a local allowance only

0b407ba

No-Test: comment wording only (R737-O3/A3) Co-authored-by: Cursor <cursoragent@cursor.com>

Cuarroc changed the title ~~V16-KI30: size native receipt drain from SQLite busy_timeout budget~~ V16-KI30: native receipt drain mirrors busy_timeout, capped at host grace Oct 9, 2026

Cuarroc mentioned this pull request Oct 9, 2026

fix(questions): await complete fixture cleanup before drop returns #784

Merged

Cuarroc marked this pull request as ready for review October 9, 2026 00:47

Cuarroc added the review-ok Pipeline: review disposition complete, no open high finding label Oct 9, 2026

mergify Bot mentioned this pull request Oct 9, 2026

merge queue: checking #737 on main (b12ed64), stacked on #783 #791

Closed

30 of 46 tasks

mergify Bot added the queued label Oct 9, 2026

Cuarroc mentioned this pull request Oct 9, 2026

docs: record E1-E3 decisions and synchronize PLAN after #749 #795

Merged

mergify Bot merged commit 7a7a2bd into main Oct 9, 2026
17 checks passed

mergify Bot deleted the cursor/v16-ki30-native-receipt-deadline branch October 9, 2026 01:11

mergify Bot removed the queued label Oct 9, 2026

This was referenced Oct 9, 2026

docs: update unreleased v1.6.0 changelog to 55c2238 (V16-CHANGELOG-a2) #835

Merged

docs: sync PLAN and changelog draft after V16-06 (DOCS-SYNC-0910d) #849

Merged

PLAN-SYNC-0910e: DR-SEC and V16 status rows #856

Merged

chatgpt-codex-connector Bot mentioned this pull request Oct 9, 2026

docs: close KI-30 with queue evidence, record KI-34 #874

Merged

Navigation Menu

Repository navigation

V16-KI30: native receipt drain mirrors busy_timeout, capped at host grace - #737

V16-KI30: native receipt drain mirrors busy_timeout, capped at host grace#737
mergify[bot] merged 7 commits into
mainfrom
cursor/v16-ki30-native-receipt-deadline

Cuarroc commented Oct 8, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

mergify Bot commented Oct 9, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Cuarroc commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Report

Decision (round-1 disposition)

What changed

Findings disposition

Evidence

NICHT ABGEDECKT

Open points

Root-Abnahme (09.10.2026, head 0b407ba) — Tier A, round 3 (user-approved E1)

Uh oh!

chatgpt-codex-connector Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

Uh oh!

mergify Bot commented Oct 9, 2026

Merge Queue Status

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Cuarroc commented Oct 8, 2026 •

edited

Loading

Root-Abnahme (09.10.2026, head `0b407ba`) — Tier A, round 3 (user-approved E1)

chatgpt-codex-connector Bot commented Oct 9, 2026 •

edited

Loading