swung0x48/MobileGL
1
0
Fork 0
mirror of https://github.com/MobileGL-Dev/MobileGL synced 2026-11-07 01:53:24 +09:00
Code Issues Packages Projects Releases Wiki Activity

[MG_Remote] (P6/dl): record the Session::Fail funnel as landed in the contract

Browse Source 
§5.2 gains a LANDED note: the three steps (the FatalFamilies.def vocabulary,
the SessionFail funnel that byte-identically routes ~90 aborts through one
place, and the SessionFault frame that names the family to the peer), and the
one deliberate deviation from the prose - seq/op are not threaded through the
90 sites because the message already names the op, so the frame carries code,
family and message rather than a field that is always zero.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
swung0x48
2026-09-21 21:52:18 -04:00
co-authored by Claude Opus 4.8
parent 91d0cb78c7
commit 16bfab1032
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MobileGL/MG_Remote/CONTRACT-P6.md
+14
View File
@@ -276,6 +276,20 @@ red-once are byte-identical. What the funnel buys, and what makes it worth `dl`'
- one telemetry point;
- a CI census gate refusing any **new** bare abort outside the funnel.
> **LANDED, in three steps.** (1) `FatalFamilies.def` + `FatalFamily.h` generate `MGFatalFamily`,
> its total projection `FatalCodeForFamily` and `FatalFamilyName`; 32 rows, tested. (2) `SessionFail`
> (`FatalFunnel.{h,cpp}`) is the funnel: the ~90 scattered `MGLOG_F("...Fatal{...}"); abort();` pairs
> under `MG_Remote/` become one call each, the message string passed **verbatim** so every line and
> grep is byte-identical, the family enum riding alongside for the coarse code. `SessionFaultCount()`
> is the telemetry point. The census now also requires every `SessionFail`/`WireLogFatal` call's
> string to carry a `Fatal{` word, and its baseline drops from 93 bare aborts to 4 (both funnels).
> (3) `table Fatal` gains `family: string`; `SessionFail` publishes the frame on whichever session
> control plane is active before aborting, and the client's control-reply loop recognizes it, names
> the family and latches device-lost. **seq/op are NOT threaded** through the 90 sites — the message
> already names the op — so the frame carries `code`, `family` and `message`, not a field always 0.
> A `kill -9` bypasses `abort()` and is caught by `dl`'s hangup witness instead; the self-detected
> fatal is the one that publishes.
**The policy flip is not P6's.** Making `Fail` return needs a real return path invented at every site
whose callers rely on `[[noreturn]]`, and a6 counted how many do. That is `Ph`'s (§11).