From 0e073122a56cb2b8498aaacb79968bdf8309b309 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Sun, 4 Oct 2026 20:54:03 -0400 Subject: vgsp: never run work for a slot consumed without it (epoch mark + content-hash once gate) The grace-expiry fake path consumed a held CE entry without marking its GPFIFO slot as consumed for the put epoch, and the replay guard only ran while the channel was not deferring. A later pin-batch rewind then re-read the slot, found no recorded identity, and executed the push's copies against a staging buffer the client had refilled after the faked release - a deterministic vadd input shift (a[k] == h_a[k + 2 MB]). - grace-fake consume path now calls svc_replay_note() before advancing; - the svc_replay_seen() replay skip is evaluated unconditionally: a slot consumed in the current epoch is skipped on every replay, deferral or not, until a put wrap clears the mark; - the once-only identity gate gains a content witness (FNV-1a hash of the recorded push bytes): the same entry words with different push content is a new push (clients rewrite push buffers in place) and runs its ops with a cleared done bitmap; suppression requires identical content; - snapshot write-back persists the hash array; new drain counter reident= counts content-mismatch cancellations; - the grace window stays at 8 s: a faked entry's work is never run, so the hold is that work's only chance (a 2.5 s experiment made red-class runs complete with corrupt data instead of timing out). Verified: module 8e90fc7e..., three consecutive end-to-end acceptance runs (MAIL + VADD bad=0 checksum=392344090.500000 + STATUS OK). --- docs/03-architecture/06-host-module-and-hybrid-model.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'docs') diff --git a/docs/03-architecture/06-host-module-and-hybrid-model.md b/docs/03-architecture/06-host-module-and-hybrid-model.md index cfe1c8e..98b3523 100644 --- a/docs/03-architecture/06-host-module-and-hybrid-model.md +++ b/docs/03-architecture/06-host-module-and-hybrid-model.md @@ -256,6 +256,21 @@ pipeline: The same page-granular discipline already applies to the host-side bridge read/write helpers and to semaphore I/O. +3. **A slot consumed without running its work never runs it later.** When a + CE push cannot be resolved within its bounded hold, the fallback + acknowledges its release and consumes the entry so the client's tracker + keeps moving. That acknowledgement leaves the push's data work unrun; if + a later pin-batch rewind re-reads the consumed slot, executing the work + then would read a staging buffer the client has since refilled and write + the next chunk's data over a finished one (observed as a deterministic + input shift). The per-put-epoch consumed mark is therefore authoritative: + a slot consumed in the current epoch is skipped on every replay, + independently of the channel's deferral state, and only a put wrap (which + recycles slots for genuinely new pushes) clears the mark. Entry-word + identity is additionally checked against a hash of the recorded push + bytes, so a rewritten push that reuses the same entry words is treated as + new work rather than suppressed as a replay. + Rule 1 holds at *operation* granularity as well as per entry. A push whose decode finds one operand still under targeted translation is left pending and decoded again on the next pass; the operations that already ran before the -- cgit v1.2.3