@@ -454,6 +454,8 @@ impl ActiveProcess {
454454 events: std::sync::Arc::clone(&socket.events),
455455 event_sender: socket.event_sender.clone(),
456456 remote_path: socket.remote_path.clone(),
457+ stream: std::sync::Arc::clone(&socket.stream),
458+ peer_readiness: socket.peer_readiness.clone(),
457459 },
458460 );
459461 }
@@ -14288,6 +14290,16 @@ fn new_unix_inline_drain(
1428814290/// committed behavior). Set to `1`/`true` to inject the inline net-drain + kernel
1428914291/// poll handle so those hops are serviced off the funnel on the per-session
1429014292/// bridge thread.
14293+ fn inline_socket_data_enabled() -> bool {
14294+ // F10-INLINE-WRITE (SECURE_EXEC_INLINE_SOCKET_DATA=1, default-OFF): service unix `net.write` on the
14295+ // per-session bridge thread instead of the single dispatch task, removing the ~636µs pickup latency for
14296+ // the ~4.7k X-request writes/boot. Gated for A/B + instant revert while validating determinism.
14297+ static EN: std::sync::OnceLock<bool> = std::sync::OnceLock::new();
14298+ *EN.get_or_init(|| {
14299+ std::env::var("SECURE_EXEC_INLINE_SOCKET_DATA").as_deref() == Ok("1")
14300+ })
14301+ }
14302+
1429114303fn inline_dispatch_enabled() -> bool {
1429214304 // DEFAULT-ON (2026-06-30): inline net.poll + non-blocking __kernel_fd_poll on the per-session bridge
1429314305 // thread (levers A + C-lite). Measured against the TRUSTWORTHY glyph-render ir metric it is a clean
@@ -14453,6 +14465,43 @@ impl secure_exec_execution::InlineNetDrain for UnixInlineNetDrain {
1445314465 }
1445414466 }
1445514467
14468+ fn try_socket_write(&self, socket_id: &str, chunk_value: &Value) -> Option<Value> {
14469+ // F10-INLINE-WRITE (gated SECURE_EXEC_INLINE_SOCKET_DATA): write the bytes to the socket + notify
14470+ // the peer INLINE on the per-session bridge thread, mirroring the on-pump `net.write` handler
14471+ // byte-for-byte, so the ~4.7k X-request writes/boot skip the ~636µs dispatch-pickup latency. Fall
14472+ // through (None) for any socket this drain can't see or a write error — the service loop owns
14473+ // error/teardown handling.
14474+ if !inline_socket_data_enabled() {
14475+ return None;
14476+ }
14477+ // Decode the chunk exactly as the on-pump handler does (string or base64 bytes payload); fall
14478+ // through on any decode error so the service loop reports it identically.
14479+ let chunk = javascript_sync_rpc_bytes_arg(std::slice::from_ref(chunk_value), 0, "net.write chunk")
14480+ .ok()?;
14481+ let chunk = chunk.as_slice();
14482+ let registry = self.registry.as_ref()?;
14483+ // Brief registry lock: clone the InlineSock, then release before touching the stream (same lock
14484+ // discipline as try_poll — the service loop never locks the registry while holding the stream).
14485+ let sock = {
14486+ let registry = registry.lock().ok()?;
14487+ registry.get(socket_id).cloned()?
14488+ };
14489+ {
14490+ xtrace_dump(sock.remote_path.as_deref(), "C>S", chunk);
14491+ let mut stream = sock.stream.lock().ok()?;
14492+ use std::io::Write;
14493+ if stream.write_all(chunk).is_err() {
14494+ return None; // fall through to the service loop for error/teardown handling
14495+ }
14496+ }
14497+ // Wake the peer (e.g. the X server) now that its request is on the wire — the SAME readiness object
14498+ // + notify() the on-pump handler uses (lever 1), so there is no lost-wakeup window.
14499+ if let Some(peer) = &sock.peer_readiness {
14500+ peer.notify();
14501+ }
14502+ Some(json!(chunk.len()))
14503+ }
14504+
1445614505 fn try_fd_poll(&self, fds: &[u32]) -> Option<Value> {
1445714506 let (handle, kernel_pid) = self.fd_poll.as_ref()?;
1445814507 // Mirror the service handler: an empty fd list yields an empty array,
@@ -21502,6 +21551,34 @@ where
2150221551 );
2150321552 return Ok(json!({ "generation": current }));
2150421553 }
21554+ // [deadprobe] D1 Phase-1 (SECURE_EXEC_DEADLINE_PROBE=1): we are about to block (guest drained
21555+ // nothing, readiness unchanged past last_seen). Non-blocking-poll this process's socket OS
21556+ // buffers: data already readable here means the per-socket reader thread is behind and the wake
21557+ // will land late (a = LATE notify); empty means a genuine no-data wait (b). Non-consuming.
21558+ if crate::state::deadline_probe_enabled() {
21559+ use std::os::fd::AsFd;
21560+ let mut os_readable = false;
21561+ for sock in process.unix_sockets.values() {
21562+ if let Ok(guard) = sock.stream.lock() {
21563+ let mut fds =
21564+ [nix::poll::PollFd::new(guard.as_fd(), nix::poll::PollFlags::POLLIN)];
21565+ if nix::poll::poll(&mut fds, nix::poll::PollTimeout::ZERO).unwrap_or(0) > 0
21566+ && fds[0]
21567+ .revents()
21568+ .is_some_and(|r| r.intersects(nix::poll::PollFlags::POLLIN))
21569+ {
21570+ os_readable = true;
21571+ }
21572+ }
21573+ if os_readable {
21574+ break;
21575+ }
21576+ }
21577+ crate::state::deadline_probe_record(
21578+ std::sync::Arc::as_ptr(&readiness) as usize,
21579+ os_readable,
21580+ );
21581+ }
2150521582 // L-L fd-scoped wakeups (SECURE_EXEC_FD_SCOPED_POLL): if the guest passed the host-net socket
2150621583 // ids it is awaiting (arg 2) and EVERY one resolves to a keyed unix socket in THIS process,
2150721584 // collect their per-source keys + current-generation snapshots so the pool worker completes
0 commit comments