Repository navigation
fix(accounting): credit monitor only after durable token commit - #4811
ScriptedAlchemy wants to merge 16 commits into
Conversation
Keep the live monitor's raw tool activity after a local accounting write fails, but publish zero saved tokens instead of crediting the uncommitted delta. Only the canonical project-store commit controls what the monitor reports; optional global projection remains best-effort. Add a real registered-store and mmap-backed regression covering successful savings, an overflow refusal, both durable counters and monitor output. No schema, release or policy changes. Refs #4447
|
Apply the exact source changes requested by the first failing hosted Bazel Rustfmt gate at the preceding PR head. No behavior or assertions change; all existing regression tests are preserved. Refs #4447 Verification: source contexts checked against hosted Rustfmt diffs. New-head Rust/Bazel tests require hosted CI.
Repair three hosted automation_runner_test failures by supplying the configured executable identity required by the production prefilter. Use the same identity for the prefilter and retained runner, preserving manual-schedule, exact-ledger, live-lock and lock-race assertions. Add a production-prefilter regression for unconfigured refusal, deduplication and same-occurrence recovery after binding, with zero backend calls and no effectful terminal. Do not relax backend admission, change timeouts, or alter the graph publication changes. Refs #4532
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
A synchronous OnceLock wait inside the asynchronous historical-ingest fixture blocked the worker that must poll live projection concurrently. Use a durable async watch latch to preserve release ordering while exercising the real interleaving and supersession journey. Refs #4481
… commit Refs #4447. Independently scheduled analytics awaits an exact per-response canonical project-store commit receipt. Failed or abandoned commits preserve raw activity and cost but cannot add phantom saved-token history or totals. Add a registered-store overflow and analytics regression.
|
Replaced by #4852 to repair both confirmed CI blockers without force-rewriting contributor history. The original branch is retained at freshly verified Successor Current-head hosted tests are pending, not passed. Preserve prerequisite/review/CI holds; #4447 remains open for durable idempotency/reset/restart/disconnect acceptance. Maintenance and the issue sweep should continue on #4852, not append to this superseded lane. |
* fix(accounting): preserve durable credit and monitor failures Refs #4447. Preserve the complete source and regression tree from PR #4811 at d0f314b, including the exact Clippy import repair. This clean successor uses the same prerequisite base because the prior branch contains an immutable 74-character commit header rejected by the unchanged 72-character gate. The original branch and all contributor commits remain intact; no force update, assertion weakening, or release changes. * style(accounting): apply exact hosted rustfmt corrections Refs #4447. Apply the two byte-for-byte formatter hunks from CI run 42702961402 to the active replacement PR. Preserve existing semantics, registered-store regression assertions, and branch ancestry. Do not change CI gates or retry budgets.
Latest #4447 integrity repair — 2026-11-09 (head
024ca1c31ce6)Commit
024ca1c31ce6repairs a newly discovered cross-store phantom-savings credit. Previouslyspawn_success_analyticsqueued savings-history and tool-analytics rows independently of the project counter write. If the canonicalrecord_token_savingstransaction failed (e.g. checked u64 overflow), the monitor correctly recorded delta 0 but the globalsavings_ledgerandanalytics_events.metadata_json.tokens_savedcould still claim a positive saving.The MCP writer now sends a one-shot exact-response commit receipt to the separately scheduled analytics task. Positive history is admitted only on successful canonical project-store commit, never on a later project-wide total. A refused or dropped writer leaves raw before/after tool activity and cost visible, marks
savings_commit=refused, recordstokens_saved=0, and creates no phantom savings-history row. Zero-saving calls retain their original telemetry. Tool responses remain nonblocking; observed write settlement still drains both tasks. No new store, schema, scheduler or release change.A new real registered-store Rust regression drives (1) one committed 7-token response, (2) a subsequent forced checked-u64-overflow response, and asserts lifetime counter preservation, exactly one savings-history row, and both analytics events with the second's raw 30/29 activity intact but saved-token credit zero. The original independently scheduled path violates these assertions. The two-file source/test diff was independently inspected; one-parent commit, expected-old-head
force=falsebranch fast-forward verified by GitHub PR/head/ref readbacks.Validation boundary: Four isolated executable SQLite scheduling/overflow/abandoned-receipt assertions passed, not the compiled Rust path. Exact-head CI #42608938968 was QUEUED on inspection; Bazel Rust/Clippy/rustfmt/native macOS have not been verified for this new commit. Earlier full-green CI on predecessor heads is not validation of this head.
Refs #4447only; durable response-idempotency/retry, restart/reset/disconnect and all failure stages remain incomplete. Keep #4447 OPEN and this PR unmerged until actual applicable CI/review acceptance.Current feature diff and verification
At
469570a2c1the diff against its draft prerequisite #4831 contains onlymcp/server/ledger.rs. Its blob is identical to the version that passed all 183 hosted Linux targets. The native registered-store and monitor-ring regression executed on the stacked head and passed, proving that a refused counter write emits a zero saved-token delta. Current full hosted run.Scope — Refs #4447 (correctness slice, not full acceptance)
The canonical project-store writer already atomically commits lifetime and resettable savings counters. However the MCP accounting task wrote a positive saved-token delta to the live monitor ring even when the project-store commit refused, so terminal-monitor totals could claim savings that were never durable. The logged persistence error did not stop that credit.
This one-file change makes
commit_token_savingsreport whether the project-store transaction committed. The monitor always retains the raw tool-activity size; it publishes a positive saved-token delta only for a successful canonical commit. Optional global projection failure remains warned and does not erase a locally committed saving. The response remains nonblocking and observed ledger-write shutdown settlement is unchanged. No schema, lock, API, dashboard, policy or release changes.Falsifiable production regression
The new
live_monitor_reports_only_committed_token_savingsRust test uses a registered project store plus the real memory-mapped monitor ring, not mock counters: a successful 7-token response must appear as delta 7 with raw input 20, then a committed maximum counter forces the next 1-token write to fail checked addition. Its monitor activity must still appear with raw input 30 but delta 0, and both durable project counters must remain unchanged at the boundary. The old implementation fails the delta-0 assertion. Existing concurrent/restart/rollback tests remain intact.Review / validation
Commit
109f4608e616is a single-parent change based onmaster91c72aba7750, touching onlycrates/tracedecay/src/mcp/server/ledger.rs(88 added / 5 removed). Diff reviewed; pushed withforce=falseand exact expected-old-head fast-forward. No existing #4447 branch was rewritten.On
c2f0c83b80, the Linux fleet passed all 183 selected Bazel targets. The composition-root unit suite and automation runner both executed and passed in 386.0s and 32.3s. Repository gates and Clippy also passed. The ordinary PR workflow skipped native macOS.Remaining #4447: durable per-response idempotency/replay identity across retries, explicit failed-stage diagnostics and reinsertion/restart/disconnect coverage, proving no double credit under all races, and reducing duplicate authority. Those are not satisfied by this monitor fix; keep #4447 open, Refs only. PR-maintenance handles CI review and eligible merges; no automatic merge on green metadata. Mixed Kev/draft #4776 and release #4763 untouched.
Latest CI source fix — hosted Rustfmt (2026-11-08)
Commit
48d27c89applies all three exact formatting corrections inledger.rsreported by Repository gates run 42453927974: one awaited-commit conditional and two multi-line counter assertions. Diff independently reviewed: one file, twelve insertions/three deletions, no behavior or assertion changes. Published withforce=falseand expected previous head. Remaining durable response idempotency and reset/replay integration must still be addressed.Live monitor I/O failure propagation — 2026-11-09
Commit
63ff93aremoves the last silently dropped monitor-ring filesystem error on this accounting path. Previouslywrite_entry_todiscarded both directory-creation and mmap/locking failures and returned(); the MCP ledger only warned if its blocking task failed to join, so an unavailable monitor ring looked like an ordinary successful projection.The existing ring writer now returns
std::io::Result<()>, and the MCP accounting owner distinguishes I/O refusal from blocking-task failure in its existing warning surface. The CLI fixture and in-crate tests explicitly assert successful writes, while a new real-filesystem Rust regression requires failure for an occupied monitor-directory path and an occupied mmap path without touching the foreign objects. This changes only monitor visibility: the canonical durable project accounting commit remains independent and remains the sole saved-token authority. No duplicate store or new scheduler.Verification: The exact three-file commit diff was independently inspected, and two isolated filesystem syscall analogues reproduced the rejection paths; these are not execution of the committed Rust tests. Local checkout/Bazel were unavailable. Exact-head hosted CI #42594482403 was QUEUED at publication; Rust/Bazel, formatter/Clippy and native macOS are not proven passing.
Refs #4447, not full acceptance. Durable per-response replay idempotency, reset/disconnect/shutdown evidence and all fault stages remain open; do not close #4447 on this change alone.Project receipt ordering across independently stalled profile writers — 2026-11-09
Commit
aa3a706fixes an independent cross-store credit/observability liveness problem. The per-response one-shot confirmation used by savings-history/analytics waited for the optional registered profileprojects.tokens_savedsummary write even after the canonical project lifetime/resettable counters committed. A stalled profile writer could therefore hold a truthful positive project commit receipt and block dependent best-effort analytics behind unrelated storage admission.The canonical project-store result now settles its exact response receipt immediately on commit (or false on refusal/dropped sender), before attempting the independently admitted profile summary. That optional summary still logs failure and the observed ledger task still drains the write on shutdown; no additional counter, cache, retries, storage owner or speculative success is introduced.
A real registered-store Tokio regression holds the profile writer transaction while committing a 7-token response to the separate project store and requires the receipt to arrive before releasing the profile gate. Under the previous implementation the receipt stalls behind the held profile writer; afterward the test explicitly rolls back the held transaction, drains the observed writer, and verifies the project profile summary is 7. Two direct helper call sites were updated for the new optional receipt parameter; existing commit-refusal, history, monitor and reset assertions were retained. The published commit diff was independently inspected: only
ledger.rsandfreshness_tests.rs, guarded one-parent fast-forward.Verification boundary: This is a committed falsifiable Rust regression, not an executed Rust/Bazel test. No local Bazel checkout/native macOS runner was available. Current-head CI #42625612229 was QUEUED when checked. Rustfmt, Clippy, native macOS and end-to-end accounting have not yet been confirmed for this head. Keep Refs #4447 and the issue OPEN: durable retry/replay idempotency, resets/restart/disconnect and full fault-stage acceptance remain outstanding; do not merge without current applicable green tests and reviews.