admin/LithosAnanake
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

revert(v4.0.0): step 6d, the wait, is backed out -- two reviews found it unsound

Browse Source 
Ruled 2026-10-08.  The engine, the nucleus and their tests are as they
were at dfabfa46, before step 6d; the code of the wait and its tests are
in history at 075385ab..2cf37aab.  The limit of MESH.md 7b.7 stands: a
node that is stuck can hold up its neighbours until Hera kills it.

MESH.md 7c is kept as the record of the design as approved, and 7c.6 says
what was built, what the two reviews found, the cause the findings share
-- a node's message machinery runs on the stacks its text is using, and a
fault abandons whatever was in progress -- and what a second attempt
must settle before anything is built.

Kept from it, in hosted-check: a line that leaves 29 values on the stack,
and WORDS with 26 values on it.  Both hung the products at some commit of
the wait.

make -C v4 test and sanitize at both widths, hosted-check, lint; three
bare-metal boots typing both.  POST 538 of 538, word_count=317,
dict_hash=0xc0769523a47b7dc3 on all six: the hash of step 6c's code.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
rajames
2026-10-08 07:31:40 -04:00
co-authored by Claude Opus 5.5
parent 10f5ffd00b
commit 6015c87157
20 changed files with 1108 additions and 1203 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/v4.0.0/MESH.md
+132 -181
View File
@@ -104,10 +104,6 @@ word address `base`:
| `base` … `base + V4_PORTS − 1` | Port 0 … port `V4_PORTS − 1` |
| `base + V4_PORTS` | Any port: a read here takes from whichever port has a neighbour writing |
| `base + V4_PORTS + 1` | Which port the last read from "any" came from. Read only. |
| `base + V4_PORTS + 2`, `+ 3` | Who is waiting to write to this node, and who to read from it: section 7a |
| `base + V4_PORTS + 4 + k` | The offer on port *k*: section 7c |
| `base + 2 * V4_PORTS + 4` | The wait: section 7c |
| `base + 2 * V4_PORTS + 5` | The wait for an offer only: section 7c |
- **A write to a port blocks the node until the neighbour has read it.**
Built 2026-10-05 for one port; the opcode after the write runs when the
@@ -244,9 +240,9 @@ and these tables. Nothing else changes.
## 7a. Two neighbours writing to each other (ruled 2026-10-06)
*(The lower-number rule and the looking again of this section are
replaced by the wait, section 7c, ruled 2026-10-07. The messages waiting,
and what flooding costs, stand.)*
*(The wait of section 7c was to replace the lower-number rule and the
looking again of this section. It was backed out on 2026-10-08; this
section is what the code does.)*
The fault is in section 10, step 4. **Ruled: a node writes only to a
neighbour that is already reading; a node keeps the messages it takes in
@@ -295,10 +291,8 @@ part of wiring them. Put to Captain Bob after it was built, and ruled:
**What it costs.** A node that is flooded loses messages, of every kind:
text for it, answers to text it sent, and messages it was only passing
on. In the test three nodes send each other 800 messages at once; 278
arrive (287 as first built, before step 6d) and the nodes count some
1,400 let go (the count is of every kind of message, and since step 6d
counts some more than once; it includes answers and text
on. In the test three nodes send each other 800 messages at once; 287
arrive and 714 messages are let go (the count includes answers and text
that was to start a node sending). Six from each to each, at once, all
arrive. Nothing here makes a sender slow down or send again; that is
kernel-Hermes's work in v3 and is not decided for the mesh.
@@ -310,8 +304,7 @@ kernel-Hermes's work in v3 and is not decided for the mesh.
gone; and a wait on a node that is alive and stuck is ended by Hera's
killing that node, or from the console. A message that is refused is
told to whoever waits on it, while the node that refuses it has room to
remember that it owes the telling.** (Since step 6d, section 7c, a node
that is stuck also holds up no other node.) As first written the rule was "no
remember that it owes the telling.** As first written the rule was "no
message is lost without its sender being told, and no node waits for
ever"; the review showed that was more than what was built could keep,
and section 7b.7 says exactly where it falls short. It closes two defects
@@ -378,12 +371,12 @@ Two types, beside text (1), output (2) and done (3):
- A NACK owed to this node itself -- its own message came back to it and
was let go here -- is put with its messages waiting, as if it had come
by a port.
- Paying one: it is offered on the port it goes by, with everything else
the node has to send, and the node sleeps in the wait (section 7c). One
there is no way for, or whose way is a port with nothing on it, is
dropped and counted. (As first mended it was written without looking to
a higher-numbered neighbour and kept back from a lower; step 6d
replaced that.)
- Paying one: if the neighbour it goes by is reading, it is sent. If not,
and that neighbour's number is the higher, it is written all the same,
as any message to it is (section 7a). If its number is the lower, the
NACK stays owed; the node goes on taking in what is written to it and
tries again, and does not sleep while it owes one. One there is no way
for, or whose way is a port with nothing on it, is dropped and counted.
- A message is passed on by at most 16 nodes. Its fourth word, the TTL,
carries how many more may pass it on; the node that would be the
sixteenth refuses it as it would one it had no way for. (Ruled
@@ -429,11 +422,14 @@ Two types, beside text (1), output (2) and done (3):
as usual.
- On the two products there is one node, and nobody but the console could
ever answer it: a line typed while it waits does the same.
- **A blocked write (ruled 2026-10-07; replaced by section 7c the same
day).** As first mended the fabric raised error 21 on a node blocked on
the first word of a message while its console had a line for it. Since
step 6d no node is blocked on a first word: it offers it and sleeps,
and a console line reaches it as any message does (7c.3).
- **A blocked write (ruled 2026-10-07).** Hera has the lowest number, so
she writes to a neighbour without looking and is blocked until it reads
(section 7a); if it never does, nothing could be typed to her again. So
when a node is blocked writing the first word of a message to another
node, and its console has a line for it, the fabric raises error 21 on
it: it gives that message up and goes on to read the line. Only on the
first word, so that half a message is never left on a wire
(`v4_fabric_interrupt_error`, `v4/include/v4/fabric.h`).
- **A node waiting to write to a neighbour that has been removed** is told:
the word that says which neighbours are reading also says which ports
have anything on them at all, and with nothing there the wait ends in
@@ -447,14 +443,32 @@ Two types, beside text (1), output (2) and done (3):
console. v3's pool is finite too, 32 messages, and a send beyond it is
refused.
- A node whose neighbour is asleep waits until it is woken (section 4.1).
- ~~A node that is stuck can hold up its neighbours until it is killed.~~
**Closed by step 6d (section 7c).** As step 6c left it, a node that
owed a stuck neighbour a NACK, or had a message for it, was blocked or
went round until Hera killed the stuck node; and a node waiting for an
answer kept back what was passing through it.
- **A node that is stuck can hold up its neighbours until it is killed.**
A node cannot tell a neighbour that is busy for a moment from one that
is stuck for good, and there is no clock (ruling 2). So:
- a node that owes a NACK to a stuck neighbour whose number is the
higher is blocked writing it;
- a node that owes one to a stuck neighbour whose number is the lower
goes on taking in what lower-numbered neighbours write to it, but does
not sleep, and a higher-numbered neighbour with something for it
waits;
- a node with a message for a stuck neighbour waits to write it.
Each ends when Hera kills the stuck node: the wire is then empty, the
waiting node is told so (error 18) and goes on. Hera herself can always
be typed to (7b.6). None of this can happen on a node that is gone.
- A node that is waiting for an answer keeps what comes for other nodes
and passes it on when its wait ends, not before.
- A node that was never told who is on its centre's port believes no GONE.
## 7c. The wait (ruled 2026-10-07)
## 7c. The wait (ruled 2026-10-07; built, found unsound, and backed out 2026-10-08)
**This section is a record, not what the code does.** The wait was built
(step 6d), two independent reviews in a row found it unsound, and Captain
Bob ruled it backed out: the engine and nucleus are as they were before
it, and section 7b.7's limit stands. What is below is the design as it
was approved; 7c.6 says what happened to it and what a second attempt
must deal with first.
**What it closes.** Section 7b.7's limit: a node with something for a
neighbour that was not reading could only write anyway, and be blocked, or
@@ -514,29 +528,13 @@ a node may offer a word on each of its ports at once.)*
the fabric has its offer taken, and the other gets the word (case 2
for the one, case 1 for the other).
- Whichever it is, every offer the node had is withdrawn.
- **A store to the wait withdraws every offer** and waits for nothing.
*(Added after the review, 2026-10-08: a node that goes round without
sleeping must not leave an old offer standing for its next wait to
find.)*
- **The wait for an offer only**, `base + 2 * V4_PORTS + 5`: as the wait,
but a word that comes for the node does not end it, and a writer to the
node is not served. It ends when the offer is taken, or when there
turns out to be nothing on the port. *(Added after the review: it is
how the words of a message after the first are written where no error
must come.)*
- A node in the wait that is handed a word by case 2 of another node gets
it by its own case 1.
- A node in the wait executes nothing and spends no heat. It shows to its
neighbours as waiting to read.
- With nothing on a port it has an offer on -- because nothing ever was,
or because what was there has been removed -- a node that can take an
error is woken: the fetch gives 0 and "which port" gives
`2 * V4_PORTS + k`. No error is raised: the node may be in the middle of
something that has nothing to do with that port. A bare node waits. A
neighbour that is asleep takes nothing: the offer stands. *(Changed
while it was built: as approved, error 18 was raised. That ended the
text of a node that merely had a message queued for a neighbour that
was then killed.)*
- With nothing on a port it has an offer on, a node that can take an error
has error 18 raised on it (section 4.1); a bare node waits. A neighbour that
is asleep takes nothing: the offer stands.
- `v4_fabric_interrupt_error`, a device's `pending`, and
`v4_node_words_since_look` are removed.
- The lone node of the two products (`v4/system/boot.c`) has the same
@@ -545,74 +543,30 @@ a node may offer a word on each of its ports at once.)*
### 7c.3 The nucleus
*(Rewritten 2026-10-08 as built. The first form had the node passing a
message on by beginning it at once, as its own text does. That held the
node passing on whenever the node it was for was stuck: text typed for a
stuck node left Hera deaf. So what is passed on waits, offered.)*
- *Beginning a message from text* (`(GATE)`): offer its first word; if a
word comes instead, take that message in and offer again; when the
offer is taken, write the rest, each word waiting for the neighbour,
which has taken the first and reads to the end. With nothing on the
port it is error 18.
- *Text from its console for a node whose text is waiting there* ends that
text in error 21, "Interrupted", and is then done. This is how Hera is
typed to while her line waits on a stuck node.
- *A node with nothing to do* (`(IDLE)`) deals first with what is for
itself, the oldest first. With nothing for itself it offers, all at
once, the first message it has for each port and each NACK it owes, and
sleeps in the wait. What is taken is written and done with; the rest
stays with the messages waiting, in the order it came. A message for a
stuck node waits there and holds up nothing.
- *What a node sends other than from text* goes the same way: what a
finished text printed (type 2), how it ended (type 3), and a GONE. Each
is put with the messages waiting and goes when it can; with no room for
it, it is let go and counted. So a node that did text for a sender that then stuck
is not held by it, and `KILL` is not held by one stuck node from telling
the next.
- *Order.* A node's own messages keep the order they were made in. A node
does not begin another text from a sender while what it owes that
sender from an earlier one -- what that text printed, how it ended -- is
still with it: so what one sender is told comes in the order its texts
were done. A GONE it is sending holds nothing back. It can note eight
senders so; past that, nothing more is held.
- *No error in the middle.* The words of a message after the first are
written, when a message is passed on or a NACK paid, through the wait
for an offer only. If the reader has been removed the rest is let go
and counted; no error is raised, for an error there would leave the
messages waiting in pieces. For the same reason a text may leave no
more than 28 values on the stack: one that leaves more ends "Stack
overflow". And a message half taken in when its writer is removed is
let go, not kept.
- *A node waiting for an answer* (`AWAIT`) does all of this but begin
text: it looks through the messages waiting for what would end its
wait, offers what is to be passed on and what it owes, and sleeps in
the wait. It no longer keeps back what passes through it.
- *Beginning a message* (`(GATE)`): offer its first word; if a word comes
instead, take that message in and offer again; when the offer is taken,
write the rest, each word waiting for the neighbour, which has taken the
first and reads to the end.
- *Paying what is owed* (`(PAY)`): every NACK owed is offered at once,
each on the port it goes by (one to a port). A node with nothing to do
that owes one sleeps in the wait; it no longer goes round, and it no
longer writes one without looking.
- *Text from its console for a node that is waiting to begin a message*
ends what the node was doing in error 21, "Interrupted", and is then
done, as in `AWAIT` (7b.6). This is how Hera is typed to while she waits
on a stuck node.
- `NEIGHBOUR` stays: a node must know who is on its centre's port to
believe a GONE (7b.4). It is no longer needed to write.
### 7c.4 What is still a limit
- A node's own text that must begin a message (`SEND`, or what it prints)
to a stuck node waits until Hera kills that node or, on Hera, a line is
typed. It takes in everything sent to it meanwhile, but passes nothing
on until its text ends.
- A line typed at Hera while her text is waiting to begin a message ends
that text, whether the node it waits on is stuck or only busy.
- While what a node owes a sender -- or the console -- cannot go, because
the way there is through a stuck node, it begins no more text from that
sender. It goes on passing on, paying, and doing text from others, and
when the stuck node is killed it lets go what could not go and does
what it kept back, in order.
- What text prints while it is still running, when the output buffer
fills, is begun as a message from text is, and waits as that does.
- An answer that reaches a waiting node whose messages waiting are full
is refused, and the wait ends "Message refused".
- A node's own line that must begin a message to a stuck node waits until
Hera kills that node or, on Hera, a line is typed. It takes in
everything sent to it meanwhile, and holds up no one.
- A node in `AWAIT` keeps what comes for other nodes, and what it owes,
until its wait ends (7b.7).
- A message once begun is written to its end. A node that takes a first
word and is then removed leaves its writer with error 18.
- The messages waiting are finite, 400 cells: a node that is passing on
for a stuck node keeps what is for it until that node is killed, and
with no room left refuses what comes, telling the sender.
### 7c.5 Acceptance
@@ -630,13 +584,68 @@ stuck node left Hera deaf. So what is passed on waits, offered.)*
5. *Hera.* Waiting to begin a message to a stuck node, she is typed to:
the line that waited ends "Interrupted", and the new line, which kills
the stuck node, is done.
6. *An empty port.* Text that begins a message on a port with nothing on
it ends in error 18.
6. *An empty port.* An offer to a port with nothing on it is error 18.
7. *Nothing deadlocks.* The flood of section 7a's test, 800 messages
among three nodes, comes to rest.
8. *Nothing else changes.* POST 538 of 538, the existing tests, and one
hash on all six systems; `sanitize`, `hosted-check`, lint, three boots.
### 7c.6 What happened (2026-10-08)
Built in commits `075385ab` to `2cf37aab`; the code is in history there,
with its tests (`v4/tests/test_host_mesh.c` at `2cf37aab` has a scene for
each defect below). Backed out by restoring the engine, nucleus and tests
to `dfabfa46`.
**What it grew into.** The approved design had a node pass a message on
by beginning it at once. That held a node passing on for a stuck node,
so what is passed on, how text ended, what a finished text printed, and
a GONE all came to wait with the messages waiting, offered; `AWAIT` came
to pass on and pay while it waited; an offer on an empty port came to
wake the node instead of raising an error; and a second wait, for an
offer only, was added so that the words after a message's first could be
written without an error.
**What the two reviews found**, after each of which it was mended and
still not sound:
- Passes over the messages waiting were left in pieces by any fault or
error in the middle of one: a stack overflow, or a neighbour removed.
A node then went round for ever.
- Offers left standing sent a text's message to the wrong port.
- What a finished text printed held the node when the way to the console
was through a stuck node.
- A node with many messages of its own waiting began no text.
- On the products, a line leaving 29 values on the stack hung the node;
and after that was mended, `WORDS` with 26 values on the stack did.
- A stack fault after a neighbour had taken a message's first word left
the two out of step for good, and hung the neighbour.
- `AWAIT` on a deep stack, a refusal with 28 values waiting, output out
of order, and a neighbour removed in mid-message ending an unrelated
wait.
**The cause they share.** A node's message machinery runs on the node's
own two stacks, the ones its text is using, and a fault abandons
whatever was in progress. The wait put more of that machinery, needing
more of the stack, into more places: between texts, inside `AWAIT`, and
wherever text prints. The tests ran those paths on a shallow stack with
every node present.
**What a second attempt must settle before anything is built.**
1. What a node does when a fault or an error comes in the middle of
writing or reading a message, on both ends of the wire, at every word.
2. How much of each stack the machinery may use, and where that is
checked, so that text which leaves too little ends in an error before
anything is on a wire.
3. Tests that run every message path at every depth of both stacks, and
with a node removed at every stage of a message, on writer's and
reader's side; and the products compared with the commit before on the
same input.
4. Whether to keep the messages a node passes on in the node at all, or
to do as v3 does: the kernel queues, and a send never blocks.
Two guards from this are kept in `hosted-check`: a line that leaves 29
values on the stack, and `WORDS` with 26 values on it.
## 8. Storage
**Ruled 2026-10-06 and 2026-10-07** (Captain Bob). On 2026-10-07 he found
@@ -1249,75 +1258,17 @@ Each is tested, committed and pushed before the next.
8. *Nothing else changes.* POST 538 of 538, the existing tests, and the
same hashes on all six systems.
**6d. The wait (section 7c).** Ruled 2026-10-07. **Built 2026-10-08.**
- *The engine* (`v4/src/node.c`, `fabric.c`): the offer addresses and
the wait; the fabric hands an offer over in one step; a node told
there is nothing on a port it offered on. Removed: the console
release of 7b.6, a device's `pending`, the count of words since a
look.
- *The nucleus* (`v4/capsule/core.v4`, `quit.v4`): `(OFFERS)`, `(GATE)`;
`(IDLE)` as in 7c.3, with `(MINE?)`, `(FWD-SET)`, `(FWD-GO)`,
`(PAY-SET)`, `(PAY-GO)`; `(FINISH)` and `GONE` put what they send with
the messages waiting; `AWAIT` goes on passing on and paying. The
lower-number rule, the looking again, `(PASS-ON)` and `(PAY)` are
gone. The ports moved in the nucleus's map to make room.
- *The lone node* (`v4/system/boot.c`): an offer is served as a write.
- *Found while it was built, and mended, each with a check that failed
first:* a message passed on toward a stuck node held the node passing
it on (7c.3); a node waited on a stuck sender to give it its answer;
with answers queued, a line typed during a wait was done before the
earlier line's answer had gone; a node with two answers it could not
give began no text; `KILL` waited to tell a stuck node, and a typed
line then left the rest untold; removing a node raised "No one on
that port" on the unrelated text of a neighbour with something
queued for it (7c.2). Two commits on the way were wrong as pushed:
`482cc75f` (the first of these) and `1c720ab2` (pushed with
`hosted-check` failing); `35378372` and `ec817a82` mend them.
- *Tests.* `test_fabric.c` 104 checks: acceptance 1, 2, 3, 6, and the
ring, the same-step and the asleep cases. `test_host_mesh.c` 127:
acceptance 4 for a creditor of either number, two refusals owed,
order kept through a node passing on, a waiting node passing on, a
line that waits and is typed to, and 7. `test_host_unit.c` 84:
acceptance 5; a node with answers for two stuck senders; `KILL` with
another node stuck.
- *Verified.* `make -C v4 test` and `sanitize` at both widths,
`hosted-check`, lint; three bare-metal boots, `logs/20261008-011558`
(amd64), `-011833` (aarch64), `-012159` (riscv64). On all six: POST
538 of 538, `word_count=317`, `dict_hash=0x6a39c0bb9d183418`.
- **The review (2026-10-08) found the step not sound as built**, and
Captain Bob ruled the mends (A, B, C, D and the guard: 7c.2, 7c.3).
Each has a scene in `test_host_mesh.c`, on a row of three begun
again, that failed first:
- *A line that left 29 values on the stack hung the node for ever*,
on the products too. It ends "Stack overflow"
(`test_host_quit.c`, `hosted-check`, and typed in the boots).
- *A node removed while a message was being passed on to it* left the
node passing it on going round for ever. The rest is let go.
- *Offers left standing:* text meant for one node was done by
another. A store to the wait withdraws them.
- *What a finished text printed* held the whole node when the way to
the console was through a stuck node. It is queued.
- *More than eight of a node's own messages waiting* locked out all
text, Hera's `KILL` included. Only what a sender is owed holds that
sender's text back.
- *A message half taken in when its writer was removed* was kept as
if whole. It is let go.
- Smaller: no value is left on the stack when a port goes in
mid-refusal; a refused line no longer ends a waiting text
"Interrupted"; a node's own messages may be passed on by 16 nodes.
- *Not mended, small:* with no console told of, a second text from
whoever sent the one being done interrupts it, as since step 6c;
refusals to one node go newest first; `(LOST)` counts some messages
more than once, so the flood's check is "it comes to rest", not an
exact count; the ring of three is tested in the engine only; the
five-node test is not run at 32 bits.
- *Verified, on the code as mended.* `test_fabric.c` 112 checks,
`test_host_mesh.c` 154, `test_host_unit.c` 84. `make -C v4 test` and
`sanitize` at both widths, `hosted-check`, lint; three bare-metal
boots, `logs/20261008-063450` (amd64), `-063738` (aarch64),
`-064120` (riscv64). On all six: POST 538 of 538, `word_count=317`,
`dict_hash=0xd41a6ac9448fff60`. This code has not been reviewed
again.
**6d. The wait (section 7c).** Ruled 2026-10-07. Built 2026-10-08,
found unsound by two reviews, and **backed out the same day** (ruled):
section 7c.6. The code is as it was at step 6c; the limit of 7b.7
stands. Verified after the backing out: `make -C v4 test` and
`sanitize` at both widths, `hosted-check` with its two new cases,
lint; three bare-metal boots, `logs/20261008-072104` (amd64),
`-072354` (aarch64), `-072743` (riscv64), each typing 29 values on a
line and `WORDS` with 26 on the stack; POST 538 of 538,
`word_count=317`, `dict_hash=0xc0769523a47b7dc3` on all six, which is
the hash of step 6c's mended code. The boots of `logs/20261008-01*`
and `-06*` are of the wait as built and are kept as its record.
7. **A second unit; scaling while running; sleep, wake and kill by
command.**