feat(agent,sync): universal control-lane reservation + process-wide disk bound (W2.5) - #50
Merged
Merged
Conversation
…wide The per-connection stream budget reserved one lane only in grant mode, so a non-grant connection's long-lived data services could occupy every JoinSet slot and starve even Ping/Info. The reservation is now universal: whenever a connection can carry more than one stream, the service pool is streams - 1, and only long-lived data bodies (Tcp, Desktop, Sync, Audio) consume it. Ping, Info and the Authz/RenewAuthz exchanges bypass the pool, so a saturated data plane cannot starve observability or authorization turnover; an over-capacity data greeting is refused with a hello-timeout-bounded HelloAck::Error instead of competing for the lane. rds-sync filesystem work is funneled through one static 32-permit semaphore: every spawn_blocking site acquires a permit on the async side before entering the blocking pool, and the journal store worker holds its permit for its whole lifetime. A transfer storm can no longer fill Tokio's blocking pool ahead of identity, revocation and announcement work. Tests: a saturated two-stream connection keeps TCP live, refuses a second TcpConnect and still answers Ping; the grant renewal regression now asserts Ping reaches through the reserved lane; the managed desktop refusal test asserts the data budget holds 63 slots and the 64th is refused; a 64-job disk storm never exceeds 32 concurrent blocking jobs. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
service_slotsnow reserves one stream lane whenever a connection can carry >1 stream, not only in grant mode — a saturated data plane could previously occupy every JoinSet slot and starve even Ping/Info on non-grant connections.Ping,Info,AuthzandRenewAuthzgreetings bypass the data-service pool; onlyTcp/Desktop/Sync/Audiobodies consume it. An over-capacity data greeting gets atimeouts.hello_secs-boundedHelloAck::Error("service capacity reached; a lane is reserved for control traffic") instead of waiting on the pool.rds-syncspawn_blockingfilesystem work (preflight, opens, manifest/journal, chunk reads) funnels through a static 32-permitDISK_JOBSsemaphore acquired on the async side; the long-lived journal store worker holds its permit for its entire lifetime.Semantics change (test-encoded behavior)
renewal_preserves_streampreviously asserted Ping fails while TCP holds the sole service slot; it now asserts Ping succeeds — observability through the reserved lane is the intended guarantee.managed_desktop_reports_remote_refusal_without_leakingpreviously opened 64 TCP streams on a 64-stream connection; it now proves 63 data slots admit, the 64th is refused, and the refused desktop open leaked no permit.Test plan
saturated_data_plane_still_admits_control_streams(new): live TCP + refused 2nd TcpConnect + answered Ping on a 2-stream conn, both backends.disk_jobs_share_one_bounded_pool(new): 64-job storm never exceeds 32 concurrent blocking jobs.cargo fmt --check,cargo clippy --workspace --all-targets -- -D warnings(default +rds-desktop/x11lanes),cargo test --workspace— all green locally.Generated with Devin