myxce/.wolf/memory.md

Memory Log

• 2026-10-29: Delivered scheduler-hardening-plan.md (scheduler hardening, 5 phases, root of repo). Based on full source read of rejoin chain: controller sched.c on_scheduler_join push order (configs→workers→jobs), egress.c commit watermark, scheduler core_events.c merge semantics (14 accumulated bug fixes 1513-1886), core_session.c reset+re-derive (bug-1799), snapshot_load.c atomic-rebuild precedent, sched_election.c reason threading contract (91c3fb7f). Plan thesis: rejoin = atomic derived-state discard + full rebuild (state-level equivalence with fresh join), merge reserved for true incremental events. Zero open bugs currently (1971-1980 all fixed) — this is structural hardening, not bug fixing.
• 2026-10-30: Phase 0 test 1 landed (b20caf8d): test_res_account_symmetry.c 102/102 green, mutation-injection red proof done (removing resource.c bug-1801 skip → 2.5→4.5 = +1 charge/round exactly bug-1799 shape). Two semantic lessons from writing it: (1) charge formula = used+reserved where used is the OVERAGE component reconcile maintains (acct_entry->used ← max(0, actual - reserved), pool delta = new_used - old used), so pool converges to max(reserved, actual) — NOT "charge is the usage"; (2) charge-skip tests are vacuous unless the job's account NAMES the excluded host (one account entry per host, each its own struct+baseline). sched_repl_trace baseline single flake re-run green (known MALLOC_PERTURB_ mechanism, bug-1971).
• 2026-10-30 (later): Phase 0 fully closed. 0.2 rejoin-trigger contract audited — NO gap: 5 rejoin tests in test_scheduler_decision_publish_retry.c + test_scheduler_connect.c's no-io scan already lock the full contract (flag-only, broken-only, healthy no-probe, flag clear semantics, main.c unconditional call site). Plan doc updated with execution results (5269f8a5), branch pushed to myxce. Next: Phase 1 (bug-1521 reason-ownership structural scan + steering doc).
• 2026-10-30 (Phase 1): reason-ownership audit landed (1fd6dc1c, pushed). test_reason_ownership_audit.c: 51-file closed-list scan + OWNERSHIP_SITES allowlist (fragments verified live) + sched_job_picker body scan; ctx->reason shuttle exempt (sched_ctx_t local), construction =NULL + destruction free exempt, comment lines skipped (leading-marker test -- contract prose names the write shape). Injection red-proof: picker MOVE_PTR(job->schedobj->reason) tripped BOTH scans. Steering doc .kiro/steering/scheduler-reason-ownership.md created. Detector lessons: same-line discipline needs schedobj-base allowlist (ctx->reason false-positive), comment lines MUST be skipped (scheduler.c:496 comment itself has MOVE_PTR(obj->reason) inline). Next: Phase 2 (rejoin rebuild — user approved kiro spec workflow for it).
• 2026-10-30 (HA-impact analysis): Before Phase 2, user gated on a full HA-impact analysis. Source trace completed: rejoin trigger chain (client_failover.c xcecli_invoke_rejoin :213/:420 after transparent rotate → sched_on_reconnect flag, no-I/O constraint from failover.lock self-deadlock → sched_check_pending_rejoin scheduler.c:1871, main.c:550 unconditional + publish-loop call :1962); controller side (join.c:166 handle_scheduler_join → on_scheduler_join sched.c:792 pushes configs→workers→jobs, NO fence/role gate on the join opcode itself, jobs gated by egress.c job_submit_committed); receive side (handler.c enqueues everything as pend_updates → driver.c:713 translate batch between rounds → core_events.c merge; JOBS_PUSH duplicate-merge block ~245 lines is the 14-fix hot spot). Constraints found for rebuild design: xce_core_push_events is -EBUSY under session_active — rebuild must sit at the same between-rounds boundary as sched_apply_pending_config (main.c:520); limit plugin instance survival comes free via limit_replace_config/rebind_instances_ (bug-1884) as long as rebuild routes config through plugin config_cb; configver++ must be mirrored; capnp ReplayEvent.body union has additive ordinals 12+ available for the rejoin-boundary marker (schema comment at :1209 explicitly reserves additive growth). Analysis delivered to user; kiro spec workflow for Phase 2 next.