morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #4598] [Bug] Digest consumers replace physical read failures with cancellation during close #2386

New issue

Closed

opened 2026-10-17 21:04:01 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-17 21:04:01 +00:00

Owner

Originally created by @morluto on GitHub (Oct 16, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4598

Before submitting

Searched open and closed issues for digest/hash physical failure and late cancellation. Closed #4266 covers previous hash cleanup ownership; #4594 covers subprocess consumers.
No credentials or sensitive target data included.

Area

Evidence, artifacts, or reconstruction

Observed behavior

Controlled real-file tests show ADB single-file pull, package pull, and bugreport digest consumers replace an injected physical read failure with cancellation when the caller aborts during final close. With close failure, the cancellation can be nested under cleanup failure instead of retaining the physical primary classification.
Direct producer tests also show failed-close outcomes cannot distinguish cancellation observed during close from a later abort in the retention callback; successful-close physical hash failures have no producing-stage tag for multi-stage consumers.

Reproduction

At the revision below, executed npm run test:focused -- tests/boundary/filesystem/stableFileHashOwnership.test.ts tests/boundary/providers/adb/adbHashCleanupConsumers.test.ts with the new controls.
Result: 10 failed, 12 passed. Six ADB controls inject EIO into a real file handle read, abort during successful/failed close, then require the original failure and exact cleanup owner. Three direct controls require null/string/Error cancellation recorded before ownership transfer; one requires physical hash failure provenance even when that physical error is the later abort reason. A retention-callback-only abort is the non-cancellation control.
Tests reclaim all handles; ADB protocol output is simulated. No native close-failure or Android-device reproduction claimed.

Expected behavior

Record cancellation at the producing checkpoint/close boundary. Preserve physical failures and exact caller reasons independently of cleanup ownership. Consumers should use those recorded facts instead of sampling the later signal or comparing arbitrary errors to its reason.

Impact and scope

Observed across three ADB workflows with controlled real host files. Source-derived analogous mappings exist in JADX, Kuna and Hopper publication; those consumers have not yet been reproduced by this report. Native Windows/Linux and spontaneous fault frequency: NOT_ENOUGH_INFO; untested.

REA version

0d22474280

Runtime and platform

Node 24.18.0, macOS arm64. Injected read/close faults on real file handles.

Target and artifact context

Synthetic pulled host files and simulated ADB protocol responses; no actual adb server/device.

Interface

Other: production filesystem/provider boundary

Earliest failure stage

Cleanup, cancellation, or lifecycle

Relevant output or evidence

Six ADB controls fail either with public code cancelled or a nested AnalysisCancelledError despite the earlier EIO. Three producer controls lack completionCancellation; the physical hash control receives a bare error instead of producer-tagged failure.
Source: ADB hash consumer, file owner, and hash producer.

Analysis or suspected cause

Source-derived: physical outcomes carry ownership only when cleanup fails; raw cancellation reasons and ordinary physical failures are otherwise ambiguous to shared multi-stage mappers. Failed-close cancellation is reconstructed from consumer-time signals. Add explicit producer provenance and migrate directly affected consumers, preserving missing/changed-file and cache semantics.

Additional context

Related: #4266, #4381, #4594, #4227. This report separates controlled observations from source-only additional consumers.

Originally created by @morluto on GitHub (Oct 16, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4598 ## Before submitting - [x] Searched open and closed issues for digest/hash physical failure and late cancellation. Closed #4266 covers previous hash cleanup ownership; #4594 covers subprocess consumers. - [x] No credentials or sensitive target data included. ## Area Evidence, artifacts, or reconstruction ## Observed behavior Controlled real-file tests show ADB single-file pull, package pull, and bugreport digest consumers replace an injected physical read failure with cancellation when the caller aborts during final close. With close failure, the cancellation can be nested under cleanup failure instead of retaining the physical primary classification. Direct producer tests also show failed-close outcomes cannot distinguish cancellation observed during close from a later abort in the retention callback; successful-close physical hash failures have no producing-stage tag for multi-stage consumers. ## Reproduction At the revision below, executed `npm run test:focused -- tests/boundary/filesystem/stableFileHashOwnership.test.ts tests/boundary/providers/adb/adbHashCleanupConsumers.test.ts` with the new controls. Result: 10 failed, 12 passed. Six ADB controls inject EIO into a real file handle read, abort during successful/failed close, then require the original failure and exact cleanup owner. Three direct controls require null/string/Error cancellation recorded before ownership transfer; one requires physical hash failure provenance even when that physical error is the later abort reason. A retention-callback-only abort is the non-cancellation control. Tests reclaim all handles; ADB protocol output is simulated. No native close-failure or Android-device reproduction claimed. ## Expected behavior Record cancellation at the producing checkpoint/close boundary. Preserve physical failures and exact caller reasons independently of cleanup ownership. Consumers should use those recorded facts instead of sampling the later signal or comparing arbitrary errors to its reason. ## Impact and scope Observed across three ADB workflows with controlled real host files. Source-derived analogous mappings exist in JADX, Kuna and Hopper publication; those consumers have not yet been reproduced by this report. Native Windows/Linux and spontaneous fault frequency: NOT_ENOUGH_INFO; untested. ## REA version 0d224742808e32106e2ee93340c6755ee5e0a0db ## Runtime and platform Node 24.18.0, macOS arm64. Injected read/close faults on real file handles. ## Target and artifact context Synthetic pulled host files and simulated ADB protocol responses; no actual adb server/device. ## Interface Other: production filesystem/provider boundary ## Earliest failure stage Cleanup, cancellation, or lifecycle ## Relevant output or evidence Six ADB controls fail either with public code `cancelled` or a nested AnalysisCancelledError despite the earlier EIO. Three producer controls lack completionCancellation; the physical hash control receives a bare error instead of producer-tagged failure. Source: [ADB hash consumer](https://github.com/morluto/rea/blob/0d224742808e32106e2ee93340c6755ee5e0a0db/src/adb/AdbProvider.ts#L184), [file owner](https://github.com/morluto/rea/blob/0d224742808e32106e2ee93340c6755ee5e0a0db/src/filesystem/OwnedRegularFile.ts#L104), and [hash producer](https://github.com/morluto/rea/blob/0d224742808e32106e2ee93340c6755ee5e0a0db/src/filesystem/StableFileHash.ts). ## Analysis or suspected cause Source-derived: physical outcomes carry ownership only when cleanup fails; raw cancellation reasons and ordinary physical failures are otherwise ambiguous to shared multi-stage mappers. Failed-close cancellation is reconstructed from consumer-time signals. Add explicit producer provenance and migrate directly affected consumers, preserving missing/changed-file and cache semantics. ## Additional context Related: #4266, #4381, #4594, #4227. This report separates controlled observations from source-only additional consumers.

bsakaguchi added the

triage

bug

labels

2026-10-17 21:04:01 +00:00

bsakaguchi commented

2026-10-17 21:04:02 +00:00

Author

Owner

@morluto commented on GitHub (Oct 16, 2026):

Pushed to main in e65c3955f and cd9252bc6.

The file owner now records explicit checkpoint cancellation and completion cancellation before handing off a failed-close owner. Physical hash failures remain distinct from later aborts. Artifact and application boundaries translate these recorded facts once; ADB, JADX, Kuna and Hopper consumers preserve primary outcomes and cleanup ownership. Package-pull aggregate failures retain their original causes.

Validation on Node 24.18.0/macOS arm64:

Original controlled baseline: 10 failed, 12 passed at 0d2247428.
Final affected suite: 38 files, 566 passed, 22 platform skips. Final Kuna cleanup-reason rerun: 43 passed.
Typecheck/lint, documentation checks (including 5 tests), formatting, test discovery (1444 files), and pre-push checks passed.
Controls cover physical read failure plus late abort, premature EOF plus abort, exact null/string/Error checkpoint reasons, successful/failed close and retry, completed digest preservation, retention-only abort, and failed-admission owner recovery.

Completed public CLI pull comparison used a simulated ADB executable and real 1.125 MiB host files. Both builds returned identical normalized results and 332 cl100k_base reply tokens. Four alternating warm repeats/build: baseline/candidate median elapsed 0.4575/0.4335s, CPU 0.6791/0.6459s, sampled process-family RSS 378150912/366673920 bytes. No performance improvement claim; first-process runs were recorded separately and caches were not flushed. Whole-agent tokens and fault/retry costs remain unmeasured.

No Android device, real JADX/Kuna engine, native close-failure, or Windows execution is claimed. Existing raw-reader late-signal mappings outside the hash migration remain follow-up work; this does not declare an entire provider or the repository fully audited. Leaving the issue open for maintainer review.

@morluto commented on GitHub (Oct 16, 2026): Pushed to main in e65c3955f and cd9252bc6. The file owner now records explicit checkpoint cancellation and completion cancellation before handing off a failed-close owner. Physical hash failures remain distinct from later aborts. Artifact and application boundaries translate these recorded facts once; ADB, JADX, Kuna and Hopper consumers preserve primary outcomes and cleanup ownership. Package-pull aggregate failures retain their original causes. Validation on Node 24.18.0/macOS arm64: - Original controlled baseline: 10 failed, 12 passed at 0d2247428. - Final affected suite: 38 files, 566 passed, 22 platform skips. Final Kuna cleanup-reason rerun: 43 passed. - Typecheck/lint, documentation checks (including 5 tests), formatting, test discovery (1444 files), and pre-push checks passed. - Controls cover physical read failure plus late abort, premature EOF plus abort, exact null/string/Error checkpoint reasons, successful/failed close and retry, completed digest preservation, retention-only abort, and failed-admission owner recovery. Completed public CLI pull comparison used a simulated ADB executable and real 1.125 MiB host files. Both builds returned identical normalized results and 332 cl100k_base reply tokens. Four alternating warm repeats/build: baseline/candidate median elapsed 0.4575/0.4335s, CPU 0.6791/0.6459s, sampled process-family RSS 378150912/366673920 bytes. No performance improvement claim; first-process runs were recorded separately and caches were not flushed. Whole-agent tokens and fault/retry costs remain unmeasured. No Android device, real JADX/Kuna engine, native close-failure, or Windows execution is claimed. Existing raw-reader late-signal mappings outside the hash migration remain follow-up work; this does not declare an entire provider or the repository fully audited. Leaving the issue open for maintainer review.

bsakaguchi closed this issue

2026-10-31 00:33:18 +00:00

bsakaguchi commented

2026-10-31 00:33:19 +00:00

Author

Owner

@morluto commented on GitHub (Oct 18, 2026):

Reconciled against main94bc7ed3222ab6ca33fe68f58326eefb91689904. The producer/consumer repair is present in e65c3955f9, with further regression coverage in cd9252bc6.

StableFileHash now tags physical failures separately. OwnedRegularFile records completionCancellation before handing failed-close authority to retention. regularFileCancellation consumes those producing facts and never treats a failed physical outcome as late cancellation. ADB single-file pull, package pull and bugreport consumers preserve the earlier primary, completed digests and exact cleanup capability. JADX, Kuna export/cache and Hopper publication source paths consume the same tagged physical/cancellation facts rather than overwrite a recorded hash failure with the current signal.

Fresh executed validation: 23 stableFileHashOwnership tests and15 adbHashCleanupConsumers tests passed inside the95-test/seven-file reader/CLI/MCP lane. Additional related checks passed27 tests across three files (15 Kuna hash-owner controls,2 JADX cleanup controls and10 portable Hopper publisher controls);20 Linux-specific publisher cases skipped. Overall122 passed/20 skipped across10 selected files. The physical-failure-as-abort-reason and close-versus-retention-only abort controls are included; retained descriptors are reclaimed and original cleanup markers resolve on exact-owner recovery.

No source change was needed for this reconciliation. ADB/JADX/Kuna protocols are controlled seams; Linux publisher qualification, real Android devices, spontaneous OS faults and native Windows/Linux coverage remain unverified. The portable publisher controls do not establish Linux installation behavior. This closes the reported digest-provenance defect; the full codebase audit remains active.

@morluto commented on GitHub (Oct 18, 2026): Reconciled against main94bc7ed3222ab6ca33fe68f58326eefb91689904. The producer/consumer repair is present in e65c3955f92d83f5fef09cae1232278d75ce4022, with further regression coverage in cd9252bc6. StableFileHash now tags physical failures separately. OwnedRegularFile records completionCancellation before handing failed-close authority to retention. regularFileCancellation consumes those producing facts and never treats a failed physical outcome as late cancellation. ADB single-file pull, package pull and bugreport consumers preserve the earlier primary, completed digests and exact cleanup capability. JADX, Kuna export/cache and Hopper publication source paths consume the same tagged physical/cancellation facts rather than overwrite a recorded hash failure with the current signal. Fresh executed validation: 23 stableFileHashOwnership tests and15 adbHashCleanupConsumers tests passed inside the95-test/seven-file reader/CLI/MCP lane. Additional related checks passed27 tests across three files (15 Kuna hash-owner controls,2 JADX cleanup controls and10 portable Hopper publisher controls);20 Linux-specific publisher cases skipped. Overall122 passed/20 skipped across10 selected files. The physical-failure-as-abort-reason and close-versus-retention-only abort controls are included; retained descriptors are reclaimed and original cleanup markers resolve on exact-owner recovery. No source change was needed for this reconciliation. ADB/JADX/Kuna protocols are controlled seams; Linux publisher qualification, real Android devices, spontaneous OS faults and native Windows/Linux coverage remain unverified. The portable publisher controls do not establish Linux installation behavior. This closes the reported digest-provenance defect; the full codebase audit remains active.

bsakaguchi referenced this issue

2026-10-31 01:04:44 +00:00

[PR #2386] [CLOSED] feat(skill): inspect PlayStation discs and preserve boot provenance #5198

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2386

No description provided.

Rows
Columns