release: 0.3.0 - #40
Merged
Merged
Conversation
D1 closed as (a) + (c) on the record (PR #37). The lane-owned surfaces now cite the decision instead of a deferral: LatestItem::skipped carries the full X6 disclosure (exactness span, silent-zero full-cycle case, stall-only reachability arithmetic, deliberate non-detection, and the payload/watchdog escape hatches), the module docs mark D1 closed with D2/D3 still open, the full-cycle test comment names itself the closure's pin, and the evaluation record marks its D1 row CLOSED. No code changes; contract-copy updates arrive by resync after #37 merges. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
D2 closed as the proposal's option 1 on the record (PR #37): the consumer does not implement Source<T> - LatestSource is the type's designed contract surface, because try_pop cannot report the displacement that is this channel's designed overload behaviour. The module and Consumer docs now cite the closed decision and non- promise X7, and a compile_fail doctest (E0277) on Consumer pins the absent impl so a convenience Source cannot arrive silently - the evidence row named by the closure. README and AGENTS counts move from 3 to 4 compile-fail doctests. The evaluation record marks its D2 row CLOSED. The branch's contract copy updates by resync after #37 merges. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
D3 closed on the record (PR #37) as the convergent answer: T stays generic by decision, a complete block is a payload via the BlockBuf composition, and no separate latest-block type exists. The module docs now state all three contract decision points closed, and the evaluation record marks its D3 row CLOSED with the registered reopening condition routed behind cycle decisions P/S. The branch's contract copy updates by resync after #37 merges. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The maintainer closed D3 (2026-08-11, PR #37) exactly as this document recommends: composition is the type identity, sample-versus-block is release scheduling, and no separate block primitive exists. The closure binds the documentation obligation on the block-payload surfaces (per-shape RAM, small-N inversion guidance, no-partial-block limitation) and the promotion bar's first item is done. Remaining before PROPOSED: the deferred P budget reading and its consequences. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A.3 closed on the record (PR #37): channel-resident role state with stateless handles - the mechanism this implementation already uses - so continuation holds by construction. The module docs state every LatestBuf decision closed, and try_producer/try_consumer now carry the X8 role-recovery boundary for integrators: the role is held until the handle drops, handle lifetime is an application property, and there is deliberately no out-of-band reset because a forced release would defeat the exclusive ownership soundness rests on. Facts of the exchange only; no supervision or teardown prescriptions. The evaluation record marks its A.3 row CLOSED and reframes section 7: channel-state is the decision, persist-on-drop is considered-and-not- selected with its partial evidence preserved as the surviving artifact. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Mirrors the Codex-review corrections on PR #37: skipped is stated as its actual formula (wrap-aware distance minus one, saturated at zero) rather than "modular arithmetic's approximation", and the wrap boundary is stated neutrally as a rate x take-interval property crossed when a full span separates two takes - deliberate low-cadence deployments reach it by design, not only stalled consumers. Doc-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
# Conflicts: # docs/0.3.0-candidates.md # docs/proposals/latest-buf-contract.md
# Conflicts: # docs/proposals/block-buf.md
Per #26 mechanics rule 12 / PR #38 discipline: value statement, risks and integration concerns, claims mapped to evidence, then the working record. Docs-only; cites the lane contract/proposal and measured rows without restating normative prose. Refs #26 Co-authored-by: Steven Giacomelli <swgiacomelli@users.noreply.github.com>
Per #26 mechanics rule 12 / PR #38 discipline: value statement, risks and integration concerns, claims mapped to evidence, then the working record. Docs-only; cites the lane contract/proposal and measured rows without restating normative prose. Refs #26 Co-authored-by: Steven Giacomelli <swgiacomelli@users.noreply.github.com>
Per #26 mechanics rule 12 / PR #38 discipline: value statement, risks and integration concerns, claims mapped to evidence, then the working record. Docs-only; cites the lane contract/proposal and measured rows without restating normative prose. Refs #26 Co-authored-by: Steven Giacomelli <swgiacomelli@users.noreply.github.com>
Cycle decision P closed 2026-08-11 as Copy composition (planning-record P/S closure, PR #38). The promotion bar's remaining items resolve: the budget posture is per-shape measured rows rather than a library-wide threshold; all nine shapes become release baselines at promotion via the deliberate --bless; and the double-copy hazard guidance for DMA integrations rides to promotion as a documentation obligation. Status moves to DECISION-COMPLETE - promotion awaits the #34 acceptance review. SlotPool is deferred by decision S with its trigger registered. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The record landed minutes before P closed; per the stale-claims discipline its P-open framing is updated in the same resync that brings the closure in: status DECISION-COMPLETE, P closed as Copy with the per-shape budget posture and the registered unserved corner, S closed as deferred with the adopter-gated trigger, and the double-copy DMA guidance recorded as a bound obligation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
# Conflicts: # AGENTS.md # CHANGELOG.md # README.md # src/loom_tests.rs
Contributor
Author
|
Handoff after undraft: tip is |
Persist/compare latest and latest-block flash rows like block-matrix, bless their baselines into CI, drive the X6 full-cycle pin through publish/take, and retire stale proposed/exploratory/Safety wording for shipped types. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
Author
Bugbot arbitration (Bugbot)Tip after fixes:
Security review: no medium+ issues (already on record). |
swgiacomelli
commented
Aug 12, 2026
swgiacomelli
left a comment
swgiacomelli
left a comment
Contributor
Author
There was a problem hiding this comment.
Comprehensive review of current head cf77ead plus the associated lane PRs/branches and issues #26–#40.
The assembly topology itself is coherent: accepted lane heads from #33/#34/#35/#36/#39 are present, while SlotPool #32 is intentionally deferred and archived. I took no release action.
Current conclusion: this head is not ready. The inline findings comprise 2 P1s, 6 P2s, and 2 P3s. Both current Actions runs are red (push run, PR run); I reproduced the Clippy failure locally. The PR's full zero-SKIP verification evidence is pinned to 49cf88a, two commits behind this head, so it is valid historical evidence but not current-tip evidence.
The component history also still has eight unresolved review threads: #34 (2), #35 (2), #36 (1), and #38 (3). I did not promote the stale/non-reproduced ones into new blockers. Substantive inherited gaps are called out inline where they affect this assembly; the existing #38 threads about rate-mismatch wording, static-only .bss placement, and the historical SlotPool body also remain applicable.
After the code/docs findings are addressed, the PR body and tracker #26 should be synchronized with the actual tip and verification state: the PR body stops at f72c6ad, and #26 still calls #40 a draft and describes the assembly as verified although cf77ead is non-draft and red. The new-type engineering-record headers likewise still say candidate/draft/awaiting acceptance even though these types are assembled for shipment.
…zen entry window P1 (clippy, CI red): the consumer-state seeding closure in the full-generation-cycle test had no SAFETY comment of its own — the one at the producer-state closure does not cover it, and undocumented_unsafe_blocks fails the build under -D warnings. Reproduced locally (one error, src/latest_buf.rs:677), now clean. P1 (unbounded poll): poll_up_to re-read the newest published sequence every iteration and counted only successful reads against its budget, so a producer that stayed ahead starved the poll — with N = 1 every read misses and poll_up_to(1) never returns, inherited by poll_one, poll_one_value, Source::try_pop, and forward, contradicting the crate's no-unbounded-loops rule. Per the maintainer's chosen contract the drain goal is now frozen at entry: one lag-recovery jump computed once against the entry sample, then a walk in which every iteration advances the cursor by exactly one toward it — bounded by construction at one jump + at most N slots + at most max reads. Items published mid-poll wait for the next call; PollStats::newest reports the entry sample. Evidence: all 102 unit tests pass including the new poll_window_is_frozen_at_entry pin (publish-from-hook waits for the next call, nothing lost or double-counted); new Loom model seq_ring_frozen_poll_window_conserves_under_concurrent_publish proves exact read+dropped conservation in every interleaving (17/17 models pass). Writing that model also produced a concrete witness of the documented formal seqlock race: asserting payload VALUES fails on the old loop and the new loop identically (verified by transplanting the model onto cf77ead) because Loom serialises non-atomic slot memory while C11 coherence lets both Relaxed sequence checks stay stale — the fence pairing closes it on hardware only. The module docs and record now cite this witness, and the shipped model scopes to the sequence protocol like its siblings. Re-measured in the reference image (QEMU 10.0.11): lag recovery stays O(1) and gets cheaper — 90 instructions at both 2xN and ~2,000 behind (was 115), poll_one_value 83 (was 92), poll empty 25 (was 24); all other rows unchanged. AGENTS, record, and the 0.3.0 changelog restate the numbers; 0.2.0 history is left as measured then. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
verify-rerun-49cf88a.log was explicitly kept local ('not committed' per
the re-verification comment) and was swept into the previous commit by
an indiscriminate git add -A — the exact staging mistake the release
discipline's rule 8 exists to prevent. Removed from tracking; the file
remains on the maintainer's worktree.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…bound, per-report model, full cycle matrix, static-only .bss - Crate-root surfaces (src/lib.rs seqlock bullet and wrap bullet, README safety section) no longer promise unconditional no-torn-value: each carries the whole-span bound with a pointer to the seq_ring disclosure, matching the module docs the review said they contradict. - BlockBuilder's contiguity check compares u32 identity only, so an upstream omission of exactly one whole 2^32 - 1 span aliases the recurring sequence to the expected successor. Documented as a known-limitation section (reachability arithmetic, clear()-on-outage recovery guidance), qualified in F2 (proposal + record row), and the chosen keep-one-word-and-disclose policy is pinned by the new discontinuity_check_is_modular_over_the_span test. - LatestBuf handle docs, contract H2, and the record now say Send when T: Send, always !Sync — T: Copy does not imply T: Send, and the implementation already correctly refuses the transfer; only the prose over-promised. - The concurrent Loom model preserves each PublishReport in a per-generation array and correlates every report with its predecessor's fate (taken or pending => not replaced; otherwise replaced), which holds in every interleaving because once publish(k) lands, k-1 can never be taken later. The aggregate conservation check stays as an independent second assert. Mutation-verified: flipping the correlation fails immediately naming the call; 17/17 models pass. - verify.sh 'all' now runs all four cycle modes (default, block-matrix, latest-matrix, latest-block-matrix) — the release records cite the matrix probes, so the full-matrix banner must compile and run them. - .bss wording in the block module docs and LatestBuf record is static-only: fixed-size storage lives wherever the value is placed, and the 8,280-byte combined shapes are a stack budget when built as locals. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… tables The no-atomics target guidance named only three of the five concurrent primitives; it now says every concurrent primitive (SeqRing, EventBuf, EventFlags, CountedSignal, LatestBuf) requires 32-bit atomics, so thumbv6m readers cannot infer the two new types work without a portable-atomic backend. The crate-root and traits-module tables gain LatestSink/LatestSource rows with a note that forward bridges the stream pair only and why LatestBuf stands outside it (decision D2). cargo doc builds with zero warnings. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The assembly review counted eight unresolved threads on #34/#35/#36/#38; two were already closed by the P2 batch (verify.sh full cycle matrix; static-only .bss wording). The remaining six: - #34: the block cycle probe's builders died immediately after their measured push, so dead-store elimination could remove the completion reset a reusable production builder pays. Both builders are now pinned live past their regions (black_box after m_end) and the matrix was re-measured on the assembled tree in the reference image: accepted 150-8,651 reference instructions, rejection within 2-25 of acceptance. Live claim surfaces restate the range; the measurements document keeps its lane-time table and gains a restatement note with all 18 new rows. - #35: the producer/consumer role-handoff Loom models tried acquisition once and treated a failed claim as success, so many executions never exercised the handoff (evaluation L3). Both now gate on a Relaxed dropped-flag — deliberately no happens-before, so the handoff's own Release-drop/AcqRel-swap edge stays load-bearing — and acquire deterministically (the swap is an RMW and reads the latest role flag in modification order), making every terminating execution complete the cross-context handoff with unconditional asserts. A first attempt with try-retry spin loops blew Loom's branch budget; the flag-gate shape keeps the state space finite. 17/17 models pass. - #36: the straight-line detectors matched any b-prefixed mnemonic, so ALU forms like bic (ARM) or break (Xtensa) would fail the gate as false branches. Both regexes are now exact-mnemonic alternations (conditional branches, cbz/cbnz, bl/blx/bx, and the Xtensa branch set), verified against twelve synthetic positive/negative cases and the real thumbv6m probe (gate still 4/4, exit 0). - #38: the LatestBuf record's loss bullet claimed displacement under any rate mismatch; P4 sets replaced_unread only when an unread value was actually pending, and a consumer that keeps up sees none — restated. The deferred SlotPool document's sections 4-5 presented pre-evaluation open questions and a promotion bar as current; both now carry historical framing pointing at the banked evaluation and decision S's reopening trigger. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The assembly review noted the engineering-record headers still said candidate/PROPOSED/awaiting-acceptance for types already merged into release/0.3.0 on maintainer acceptance calls. All four status lines now record the acceptance date, the merge, and (for BlockBuf) the promotion-time baseline bless; LatestBuf's lane-resident evidence links are restated as merged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ate's preemption bound The final gate failed where my local run passed: loom.sh sets LOOM_MAX_PREEMPTIONS=2 and under that bound the four-thread, three-gate consumer-reacquisition model exceeded loom's default per-path branch budget — my local verification ran raw cargo test without the gate's environment, which is the actual lesson here (verify with the gate's own script, not an approximation of it). Raising the budget made exploration crawl, so the fix is structural: one thread now plays publisher and reacquiring consumer, keeping a single Relaxed spin gate. The consumer handoff still travels only through the taken flag's Release-drop/AcqRel-swap edge (the Relaxed gate supplies no happens-before, and the acquisition swap is an RMW reading the latest role flag), every terminating execution completes the handoff, and skipped == 1 still discriminates continuation from restart (a reset consumer would report 2 — mutation-verified). ./scripts/loom.sh — the gate's exact configuration — passes 17/17 in seconds. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Author
Remediation complete — full matrix PASS on tip
|
… no stale claims Sweep of every doc surface against the verified tree: - The 0.3.0 changelog opens with its value statement, mirroring 0.2.0's convention: four primitives held to the contract/record/Loom/Miri/ measurement standard, the try_*-only breaking change, and the crate's identity — every guarantee stated with the boundary where it stops holding, so integrators can decide against a type with full information. Known issues gains the BlockBuilder span-alias boundary alongside the SeqRing and LatestBuf span items. - Records brought current with the review rounds: event-flags' cost row carries the assembled-tree take (10, state pairs enforced as a cycles gate) and the per-ISA RMW scoping, its review history reads as the completed path to acceptance, and both destructive-take records note the deliberately opaque Debug; latest-buf gains the per-report P4 claim row (per-call correlation + independent conservation, mutation-verified); tracking lines say merged, not draft. - Test totals restated at the measured 103 (README, AGENTS); LatestBuf's module doc describes the shipped channel, not a prototype. Remaining per-lane totals and the SlotPool draft-PR mention sit inside explicit historical framing and are accurate as history. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Author
|
Documentation freshness pass landed as |
The design proposals and contracts still carried pre-acceptance status language — 'exploratory design proposal', 'draft for review', 'frozen for evaluation', 'PROPOSED, ready for evaluation', 'promotion awaits the acceptance review'. Every status header now states the decision outcome (shipped in 0.3.0 with the acceptance date and merging PR, or deferred with its trigger for SlotPool), keeps the prior statuses as history where they explain the document's shape, and names the role split explicitly: the proposal/contract is the design-decision record — what was decided, why, and what was rejected — while the enduring engineering briefing lives in docs/records/<type>.md. The taxonomy document records the cycle outcome for the candidates it seeded, and the LatestBuf evaluation notes its surviving-artifact purpose. The contracts' clause text is untouched — only identity lines changed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Author
|
Design-proposal language pass landed as |
… 0.3.0 tree AGENTS.md: the codebase-structure tree now shows the repository that exists — src/block.rs, the cycles/verify/probes script workspaces, the per-mode baseline gate files, and the docs/ split between engineering records and design-decision documents; the SeqRing polling-modes list states the frozen entry-sample window and its bound; the key-invariants list gains the do-not-reintroduce-a-live-newest-re-read guardrail; the per-type test inventories include the two new pins (frozen poll window, F2 span-alias policy); the isolated-cycles section names all three matrix modes plus the probe-layout sensitivity lesson; and the constant-push result names the three push-bearing types precisely with LatestBuf's publish constancy alongside. CONTRIBUTING.md: the codesize and cycles instructions list all four modes with the per-mode baseline gating stated; the concurrency-change rule names all five concurrent primitives instead of two; the QEMU determinism note drops the stale eighteen-region count and adds the assembled-tree context; and the verify.sh description matches what the full matrix actually runs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Author
|
AGENTS.md and CONTRIBUTING.md freshness sweep landed as |
SECURITY.md still declared 0.1.x as the supported version and scoped memory-safety concerns to a pre-0.3.0 crate. Supported versions now state the latest-minor-only policy (0.3.x), the scope names every concurrent primitive and the MaybeUninit surfaces, the bounded-per-call promise is explicitly in scope for DoS reports, and the documented deviations (the seqlock formal race and the three counter-width span boundaries) are distinguished from vulnerabilities — with the express invitation that a manifestation beyond a documented bound, or documentation that understates exposure, is exactly what to report. The Cargo.toml description said ring buffers; 0.3.0 ships five primitive families. It now reads: deterministic zero-allocation SPSC primitives — ring buffers, a latest-value snapshot channel, condition flags, saturating counters, and complete sample blocks — bounded behaviour, measured cost, Loom-verified orderings. Keywords and categories stand (crates.io caps both at 5; ring-buffer remains the high-traffic search term). cargo package --list re-verified: only allowlisted roots ship; the security policy intentionally lives on GitHub with the advisory flow, not in the package. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Author
|
Security policy and crate metadata pass landed as |
The block module example (and its README twin) modelled exactly what
the crate teaches against: it unwrapped the EventBuf push whose entire
contract is returned backpressure, unwrapped FillError — the explicit
interruption F3 exists to make handleable — and acquired handles with
bare unwraps where every other example carries a reasoned expect. The
example now asserts push success with a comment stating the
returned-not-unwrapped policy, uses expect("contiguous")/
expect("complete") on the fill path, and matches each surface's
established expect-message style. The crate-root SeqRing example
ignored poll_one's delivered flag, so an empty ring would have skipped
the hook and passed its assertions vacuously — the flag is now
asserted with the reason stated. Sweep confirms no runnable doctest
contains a bare unwrap; the compile_fail pins are untouched. Doctests
remain 13 + 11 green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The bug template's version placeholder said 0.1.3, its known-non-bugs predated the 0.3.0 boundaries (the counter-width span limitations are now listed as documented-not-bugs, with the explicit invitation that misbehaviour within a documented bound is a bug to file), and the race-free counter-example now names LatestBuf beside EventBuf. The feature template's constraints speak for all concurrent primitives, state the measured-evidence expectation for proposals, list all seven type families in the alternatives check, and route zero-copy / direct-to-slot requests to the deferred SlotPool evaluation and its adopter-gated reopening trigger. The PR template's concurrency checklist names all five concurrent modules (was two), notes that Loom runs go through the script so the gate's preemption bound applies, and adds the measurement checklist for API-shape and hot-path changes (codesize with the relevant matrix mode, cycles in the reference image, deliberate re-bless reasoning). Issue-form YAML validated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The loom_tests header pointed at a loom.ps1 that has never existed in this tree (the repo's one-script policy is documented in ci.sh) — it now points at loom.sh with the preemption-bound note. codesize.sh's output-reading guide described four of its ten default columns; it now explains all of them, including the flags_* trio and the two gated statics (EventBuf 268 B, SeqRing 524 B) that carry the const-new claim. miri.sh's header states that pass 1 runs everything else with the detector ON — which is where LatestBuf's headline race-freedom claim lives — so the split-pass structure cannot be misread as a blanket exemption. The block_shape probe twin's header explained a constraint that no longer exists (candidate branches that must not stack); it now records the origin, the twin's current job (measuring the exact evaluated layout), and that switching to the real types is a deliberate future re-measure. The Dockerfile's pinned-image example tag moves to the 0.3.0 release tag it will publish under. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…epo-relative The frozen-tag-per-release image practice (one immutable stevegiacomelli/ph-eventing-verify:X.Y.Z tag per release, evidence gathered inside the published tag) was followed for 0.2.0 but never written into RELEASING.md — exactly the kind of step that gets forgotten because it lives in nobody's checklist. Step 6 now carries it: validate the exact image first (build-guard firing plus the strict offline check — --network none AND a fresh CARGO_TARGET_DIR, since a warm mounted target silently invalidates the test), the maintainer tags and pushes like cargo publish, the final matrix re-runs against the published tag so the recorded evidence names the immutable pin, and the after-publishing list confirms the tag exists on Docker Hub because the release's evidence cites it. Also from the link sweep: the latest-buf record's five evidence links still pointed at blob/candidate/latest-buf/ for documents that merged into this tree with #35 — now repo-relative, so they hold on the branch, in the tag, and on master after merge-back. The planning record's archive-tag links were verified correct as-is (the tag exists on origin at the documented 2c3d37f; an immutable tag is the stable pattern for evidence that deliberately lives only there). 29 markdown files scanned; no broken relative links remain. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Author
|
Final sweeps landed — rustdoc examples ( |
- docs/README.md: lightweight map of the three documentation layers (records = enduring briefing, proposals = closed design decisions, planning = per-cycle candidate triage) and where the API contract lives. - docs/0.3.0-candidates.md -> docs/planning/0.3.0-candidates.md: the planning record is a per-cycle artifact, not a docs-root resident; the new directory is the pattern for future cycles. - All six proposal references and the doc's own 13 relative links rewritten for the new depth; AGENTS.md structure tree updated. - Proof: repo-wide relative-link check passes (31 md files, 0 broken). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Author
|
Docs organization landed as Closing gate re-run on the new tip: The tag point is now |
Contributor
Author
|
Reference image published and validated — the matrix evidence now names the immutable pin.
Environment stamp (rebuilt image reproduces the evidence environment version-for-version): QEMU 10.0.11 (Debian 1:10.0.11+ds-0+deb13u1), rustc 1.92.0 (ded5c06cf), Miri nightly-2026-08-08 (1a98b1e13), cargo-deny 0.20.2, cargo-llvm-cov 0.8.7; current-stable check at 1.97.1 (floating by design).
Image steps are complete. Remaining: maintainer tags |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release assembly branch per RELEASING.md — verified tip
d3d4585, full matrix PASS.Assembly
The five accepted 0.3.0 lanes merged in order with resyncs between (#35 → #34 → #33 → #36 → #39), followed by the integration pass (coherent 0.3.0 changelog, assembled-tree count reconciliation, SeqRing
.bssgate), the maintainer's adversarial-audit fixes (f72c6ad,cf77ead), and the comprehensive-review remediation below. SlotPool (#32) is deferred by decision S with its evidence banked.Review remediation (head
cf77ead→8ce2647)The comprehensive review found 2 P1s / 6 P2s / 2 P3s plus 8 legacy component threads; all 18 are fixed, replied to with evidence in-thread, and resolved:
b849751— both P1s: the clippy SAFETY comment (CI red reproduced, now green), andpoll_up_tobounded via a frozen entry-sample window (maintainer-chosen contract): one jump + ≤ N walk + ≤ max reads per call, unit-pinned and Loom-modelled; lag recovery re-measured 90 instructions (was 115),poll_one_value83. Building the model also produced a concrete Loom witness of the documented formal seqlock race, now cited in the module docs and record.354922d— untracked a local log swept by indiscriminate staging.7848f59— six P2s: crate-root whole-span propagation, BlockBuilder span-alias disclosure + policy pin,SendwhenT: Send, per-report Loom correlation (mutation-verified), all four cycle modes inverify.sh all, static-only.bsswording.c1699c0— both P3s: complete atomic-shim list;LatestSink/LatestSourcetrait-table rows.5617f25— six live legacy threads: dead-store-proofed block probe (re-measured 150–8,651, rejection within 2–25), de-vacuoused role-handoff models, exact-mnemonic branch detectors (12 synthetic cases), P4-accurate displacement wording, historical framing on the deferred SlotPool body.3ba7cdd— record headers state ACCEPTED — ships in 0.3.0.8ce2647— the consumer-handoff model restructured to one spin gate after the first full-gate run caught it exceeding loom's path budget underLOOM_MAX_PREEMPTIONS=2(the gate's own configuration; the handoff edge stays load-bearing,skipped == 1still discriminates continuation, mutation-verified).9863d3a— documentation freshness pass: the 0.3.0 changelog opens with its value statement, Known issues gains the BlockBuilder span boundary, records carry every review-round caveat (assembled-tree costs, per-ISA scoping, opaque Debug, per-report P4 row), test totals restated at the measured 103, zero stale lifecycle language outside historical framing.8c51336— proposal documents speak as closed design-decision records: every status header states the outcome (shipped with acceptance date and PR, or deferred with trigger), contracts marked normative for the shipped types, and the proposal-vs-record role split named in each.0114394— AGENTS.md and CONTRIBUTING.md brought current: the structure tree shows the real repository (block.rs, cycles/verify/probes workspaces, baselines, the docs/ records-vs-proposals split), the frozen poll window and its guardrail are in the polling modes and key invariants, both new test pins inventoried, all four codesize/cycles modes in the contributor instructions, and the concurrency rule names all five concurrent primitives.269b806— SECURITY.md current (0.3.x latest-minor support policy, scope covers all five concurrent primitives and the bounded-per-call promise, documented deviations distinguished from vulnerabilities with the beyond-the-bound invitation) and the Cargo.toml description states what 0.3.0 is: five SPSC primitive families, bounded behaviour, measured cost, Loom-verified orderings.7f86fe8— rustdoc example sweep: the block example no longer models unwrapping backpressure or FillError (asserted with the returned-not-unwrapped policy stated), the SeqRing example asserts poll_one's delivered flag instead of passing vacuously; no runnable doctest carries a bare unwrap.a4af6ab— GitHub templates current: 0.3.0 placeholder, span boundaries as documented-not-bugs, all five concurrent modules in the PR checklist, measurement checklist added, SlotPool-shaped requests routed to decision S's trigger.4c1ca7d— script documentation sweep: phantom loom.ps1 reference removed, codesize.sh output guide covers all ten columns and both gated statics, miri.sh states pass 1 carries LatestBuf's detector-on headline claim, the block_shape twin's header records its origin and current role, Dockerfile example tag moves to 0.3.0.d3d4585— docs/ organization: lightweightdocs/README.mdmapping the three layers (records / proposals / planning),0.3.0-candidates.mdmoved todocs/planning/(git-mv rename, links rewritten, 31 md files link-check clean)4d3ae42— RELEASING.md step 6 carries the reference-image publish (validate offline-strict, maintainer tags/pushes the frozen stevegiacomelli/ph-eventing-verify:X.Y.Z, final matrix re-runs against the published tag) with an after-publish confirmation item; the latest-buf record's five candidate-branch evidence links are repo-relative; 29 markdown files link-checked clean.Verification (tip
d3d4585)./scripts/verify.sh allin the reference image — PASS, zero SKIPs, all 8 sections: ci (fmt, clippy-D warnings, tests, doc, features ×3, stable, deny, coverage ≥ 90%, codesize default + block-matrix + latest + latest-block gates, 3 embedded checks), Miri (host full + seqlock pass + seeds + i686/armv7/s390x), Loom 17/17, cycles in all four modes (sr lagged 90/90; cs 8/9/9; ef 12/12, 10/10; block 150–8,651; latest + composition matrices), atomic-window 4/4. Toolchain stamps: rustc 1.92.0ded5c06cf, Miri nightly 1.99.01a98b1e13, QEMU 10.0.11.cargo package --listships only allowlisted roots. Totals: 103 unit + 13 doctests + 11 compile-fail.Remaining per RELEASING.md (maintainer steps): validate + publish the reference image (
stevegiacomelli/ph-eventing-verify:0.3.0, per the new step 6), re-run the matrix against the published tag, then tagv0.3.0on this branch atd3d4585, publish, GitHub release, merge this PR, open the next## Unreleased, delete the branch, close #26.🤖 Generated with Claude Code