T-015 / ADR-0032 — symmetric Deadlock rollback + ipc_cancel_recv

[cemililik]

Summary

• ADR-0032 Accepted (commit db24d6d — separate diff for the careful-re-read pass per write-adr skill step 10, the first project-side application of that discipline as its own commit).
• ipc_cancel_recv recovery primitive added in kernel/src/ipc/mod.rs; reverses an Idle → RecvWaiting transition, no-op on any other state, RECV-rights validated, zero new unsafe (covered by UNSAFE-2026-0014's umbrella).
• ipc_recv_and_yield's Phase 2 Deadlock branch in kernel/src/sched/mod.rs now calls ipc_cancel_recv after dropping its &mut Scheduler<C> and before returning Err(SchedError::Deadlock), so both scheduler and endpoint state restore to the caller's pre-call shape.
• 152 → 158 host tests + 158/158 miri clean. 5 new IPC unit tests covering the cancel state machine + 1 scheduler regression test (empirical form of ADR-0032's Simulation table row 3b); the existing T-007 Deadlock test gained an endpoint-state assertion.
• QEMU smoke unchanged — full demo trace through tyrne: all tasks complete + boot-to-end elapsed = 4088000 ns. Byte-for-byte identical message sequence to the post-T-014 baseline (T-015 adds no v1-reachable code path; Deadlock is structurally unreachable with register_idle installed per ADR-0026).

Closes the last open B2-prep follow-on item from the B1 closure retro §Adjustments before B2's first userspace-driven endpoint destroy lands.

Diff shape

Area	Files	LOC
Kernel implementation	kernel/src/ipc/mod.rs, kernel/src/sched/mod.rs	+328 / -43
ADR-0032 Accept	docs/decisions/0032-...md, docs/decisions/README.md	+2 / -2
Doc updates	docs/decisions/0017-...md rider, docs/architecture/ipc.md, docs/audits/unsafe-log.md, T-015 + phase-b README + current.md + phase-b.md	+23 / -9

3 commits: db24d6d (ADR Accept), 7a402cb (kernel impl + tests), c258ee3 (doc-side).

Test plan

• cargo fmt --all -- --check — clean
• cargo host-clippy — clean (-D warnings)
• cargo kernel-clippy — clean
• cargo host-test — 158/158 pass (incl. 5 new IPC + 1 new sched + extended T-007)
• cargo +nightly miri test — 158/158 pass
• cargo kernel-build — clean
• ./tools/run-qemu.sh — full demo trace; boot-to-end ~4.1 ms; byte-for-byte unchanged from post-T-014 baseline
• UNSAFE-2026-0014 fourth Amendment recorded for the new Deadlock-branch momentary-&mut site (no new audit entry — covered under existing umbrella)
• ADR-0017 §Revision notes rider records the additive recovery primitive (user-observable IPC surface unchanged)

What's next after this lands

B2 prep — ADR-0027 (kernel virtual memory layout) drafting. ADR-0027 is the first ADR drafted under the write-adr skill §Simulation discipline codified after ADR-0026's caught-by-table experience: its Decision outcome must include a 3–5 row state-machine table walking the worst-case interaction (page-table walk / TTBR switch / mapping handshake) before the Accept can flip. Design-first applies — docs/architecture/memory-management.md lands alongside or before the implementation task (T-016 or next free slot).

🤖 Generated with Claude Code

Summary by Sourcery

Introduce a kernel-internal IPC cancel primitive and wire it into scheduler deadlock handling for symmetric rollback, while updating ADRs, roadmap docs, and unsafe-audit notes to reflect the new behaviour.

New Features:

• Add the ipc_cancel_recv recovery primitive to reverse Idle → RecvWaiting endpoint transitions in the IPC subsystem, initially consumed only by the scheduler bridge.

Enhancements:

• Update ipc_recv_and_yield deadlock handling so both scheduler and endpoint state are rolled back to their pre-call shape, keeping error paths state-symmetric.
• Document the new RecvWaiting → Idle cancel arc in the IPC architecture state machine and record ADR-0032 as Accepted with its relationship to existing ADRs.
• Extend the unsafe-audit log and phase-B roadmap/task docs to cover the new Deadlock-branch borrows and the completion of T-015 as a B2-prep follow-on.

Tests:

• Add five IPC unit tests for ipc_cancel_recv’s state-machine behaviour and a scheduler regression test ensuring endpoint state rollback on Deadlock, plus extend the existing deadlock test with endpoint-state assertions.

[qodo-code-review]

ⓘ You've reached your Qodo monthly free-tier limit. Reviews pause until next month — upgrade your plan to continue now, or link your paid account if you already have one.

[sourcery-ai]

Reviewer's Guide

Implements ADR-0032 by adding an ipc_cancel_recv recovery primitive and wiring it into ipc_recv_and_yield’s Deadlock path so both scheduler and endpoint state are rolled back symmetrically, with accompanying tests and documentation/audit updates.

Sequence diagram for ipc_recv_and_yield Deadlock rollback using ipc_cancel_recv

sequenceDiagram
    actor Task
    participant Scheduler
    participant IpcBridge as IpcBridge_ipc_recv_and_yield
    participant IpcLayer as IpcLayer_ipc_recv
    participant Endpoint

    Task->>IpcBridge: ipc_recv_and_yield(ep_cap)
    IpcBridge->>IpcLayer: ipc_recv(ep_cap)
    IpcLayer->>Endpoint: register receiver
    Endpoint-->>IpcLayer: state = RecvWaiting
    IpcLayer-->>IpcBridge: RecvOutcome.Pending

    IpcBridge->>Scheduler: block current on ep_handle
    Scheduler->>Scheduler: ready.dequeue().or(idle)
    Scheduler-->>IpcBridge: None (no next task, no idle)

    IpcBridge->>Scheduler: restore current and task_states
    Scheduler-->>IpcBridge: scheduler state restored

    IpcBridge->>IpcLayer: ipc_cancel_recv(ep_cap)
    IpcLayer->>Endpoint: RecvWaiting -> Idle
    Endpoint-->>IpcLayer: state = Idle
    IpcLayer-->>IpcBridge: Ok(())

    IpcBridge-->>Task: Err(SchedError.Deadlock)

Loading

Class diagram for ipc_cancel_recv and scheduler Deadlock rollback integration

classDiagram
    class EndpointState {
        <<enum>>
        Idle
        SendPending
        RecvWaiting
        RecvComplete
    }

    class EndpointHandle {
        slot_index: usize
        generation: u32
    }

    class EndpointArena {
        +get(slot_id) EndpointHandle
    }

    class IpcQueues {
        +state_of(handle EndpointHandle) EndpointState*
        +reset_if_stale_generation(handle EndpointHandle)
    }

    class CapabilityTable {
        +lookup(handle CapHandle) Capability
    }

    class CapHandle

    class CapRights {
        <<bitflags>>
        SEND
        RECV
    }

    class IpcError {
        <<enum>>
        InvalidCapability
        QueueFull
        PendingAfterResume
        Other
    }

    class Scheduler {
        +current: Option_TaskHandle_
        +task_states: TaskState_array_
        +ready: ReadyQueue
        +idle: Option_TaskHandle_
    }

    class TaskState {
        <<enum>>
        Ready
        Blocked_on_ep_handle_
        Running
    }

    class SchedError {
        <<enum>>
        Deadlock
        NoCurrentTask
        Ipc
    }

    class IpcApi {
        +ipc_send(ep_arena EndpointArena, queues IpcQueues, ep_cap CapHandle, caller_table CapabilityTable, msg Message, cap Capability) SendOutcome
        +ipc_recv(ep_arena EndpointArena, queues IpcQueues, ep_cap CapHandle, caller_table CapabilityTable) RecvOutcome
        +ipc_notify(notification_cap CapHandle) IpcError
        +ipc_cancel_recv(ep_arena EndpointArena, queues IpcQueues, ep_cap CapHandle, caller_table CapabilityTable) Result_void__IpcError_
    }

    class BridgeApi {
        +ipc_recv_and_yield(sched Scheduler, cpu Cpu, ep_arena EndpointArena, queues IpcQueues, caller_table CapabilityTable, ep_cap CapHandle) Result_RecvOutcome__SchedError_
    }

    Scheduler --> IpcQueues : uses
    Scheduler --> EndpointArena : uses
    Scheduler --> CapabilityTable : uses

    BridgeApi --> Scheduler : mut_borrow
    BridgeApi --> IpcApi : calls

    IpcApi --> EndpointArena : uses
    IpcApi --> IpcQueues : uses
    IpcApi --> CapabilityTable : uses
    IpcApi --> IpcError : returns

    IpcQueues --> EndpointState : owns_array

    Scheduler --> SchedError : returns

    class ReadyQueue
    class TaskHandle
    class Message
    class Capability
    class SendOutcome
    class RecvOutcome

    Scheduler --> ReadyQueue
    Scheduler --> TaskHandle
    IpcApi --> Message
    IpcApi --> Capability
    IpcApi --> SendOutcome
    IpcApi --> RecvOutcome

Loading

State diagram for EndpointState with ipc_cancel_recv recovery arc

stateDiagram-v2
    state EndpointState {
        Idle
        SendPending
        RecvWaiting
        RecvComplete
    }

    Idle --> SendPending: ipc_send enqueues
    SendPending --> Idle: ipc_recv collects

    Idle --> RecvWaiting: ipc_recv registers
    RecvWaiting --> RecvComplete: ipc_send delivers
    RecvComplete --> Idle: ipc_recv collects

    RecvWaiting --> Idle: ipc_cancel_recv

Loading

File-Level Changes

Change	Details	Files
Add ipc_cancel_recv recovery primitive to reverse Idle → RecvWaiting endpoint transitions.	Introduce ipc_cancel_recv(ep_arena, queues, ep_cap, caller_table) that validates RECV rights, inspects EndpointState, and resets RecvWaiting back to Idle while treating other states as no-op. Extend ipc module docs and architecture diagram to describe the RecvWaiting → Idle cancel arc and clarify that ipc_cancel_recv is a kernel-internal recovery primitive, not part of the user-facing IPC surface. Record ADR-0017 revision notes to mention ipc_cancel_recv as an additive recovery primitive and keep the user-visible primitive set unchanged.	kernel/src/ipc/mod.rs docs/architecture/ipc.md docs/decisions/0017-ipc-primitive-set.md
Wire symmetric Deadlock rollback into ipc_recv_and_yield using ipc_cancel_recv, and test it.	Refactor ipc_recv_and_yield’s Phase 2 dispatch block to return an Option<(current_idx, next_idx)> and perform scheduler rollback entirely inside that block when no next task is available. After dropping &mut Scheduler, add a Deadlock branch that calls ipc_cancel_recv via an unsafe momentary borrow of EndpointArena and IpcQueues, asserts success in debug, and returns Err(SchedError::Deadlock). Update SchedError::Deadlock and ipc_recv_and_yield documentation to describe symmetric scheduler+endpoint rollback semantics and reference ADR-0032. Add a new scheduler regression test ipc_recv_and_yield_deadlock_rolls_back_endpoint_state and extend the existing Deadlock test to assert endpoint Idle state after rollback.	kernel/src/sched/mod.rs
Add focused IPC unit tests and ensure test suite + miri remain clean.	Add five ipc_cancel_recv-focused unit tests covering RecvWaiting→Idle rollback, Idle no-op, SendPending no-op without message loss, missing RECV rights error, and idempotency. Update imports in IPC tests to include ipc_cancel_recv and any additional types used by the new tests. Confirm host tests increase from 152 to 158 and miri tests from 152 to 158, all passing.	kernel/src/ipc/mod.rs
Accept ADR-0032 and connect it into roadmap, tasks, and ADR indexes.	Flip ADR-0032 status from Proposed to Accepted and note its role, simulation table, and relationship to ipc_cancel_recv in the ADR text. Update decisions index README to mark ADR-0032 as Accepted. Update phase-b roadmap, phase-b tasks README, and T-015 task analysis doc to mark T-015 as Done, reference ADR-0032 acceptance, and describe the implementation and verification outcomes.	docs/decisions/0032-endpoint-rollback-and-cancel-recv.md docs/decisions/README.md docs/roadmap/phases/phase-b.md docs/analysis/tasks/phase-b/README.md docs/analysis/tasks/phase-b/T-015-endpoint-rollback-cancel-recv.md
Refresh high-level roadmap and unsafe audit log to account for T-015 and the new unsafe site.	Update roadmap/current.md to describe T-015 completion, new test counts, unchanged QEMU smoke, and B2-prep focus on ADR-0027. Add an UNSAFE-2026-0014 amendment describing the new Deadlock-branch unsafe block that borrows EndpointArena and IpcQueues to call ipc_cancel_recv, including invariants about non-overlapping &mut borrows and structural unreachability in v1. Ensure references to ADR-0032 and ipc_cancel_recv are linked from roadmap and audit docs so future readers can reconcile code and audit entries.	docs/roadmap/current.md docs/audits/unsafe-log.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

Warning

Rate limit exceeded

@cemililik has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 29 minutes and 40 seconds before requesting another review.

To continue reviewing without waiting, purchase usage credits in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 544b6453-42e0-4f7d-b425-b4ef51274188

📥 Commits

Reviewing files that changed from the base of the PR and between 95b15aa and c258ee3.

📒 Files selected for processing (11)

• docs/analysis/tasks/phase-b/README.md
• docs/analysis/tasks/phase-b/T-015-endpoint-rollback-cancel-recv.md
• docs/architecture/ipc.md
• docs/audits/unsafe-log.md
• docs/decisions/0017-ipc-primitive-set.md
• docs/decisions/0032-endpoint-rollback-and-cancel-recv.md
• docs/decisions/README.md
• docs/roadmap/current.md
• docs/roadmap/phases/phase-b.md
• kernel/src/ipc/mod.rs
• kernel/src/sched/mod.rs

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch t-015-endpoint-rollback-cancel-recv

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[gemini-code-assist]

Code Review

This pull request implements the ipc_cancel_recv recovery primitive as specified in ADR-0032, ensuring that both scheduler and endpoint states are symmetrically rolled back when a deadlock is detected during ipc_recv_and_yield. The implementation includes the new primitive in the IPC subsystem, its integration into the scheduler's deadlock branch, and comprehensive updates to documentation, ADRs, and the project roadmap. Verification was confirmed through new unit tests, a scheduler regression test, and QEMU smoke testing. I have no feedback to provide as there were no review comments.