Hardening: concurrency, cancellation, leak, and soak audit #101

New Issue

hugo · 2026-08-08T08:26:26Z

hugo commented

2026-08-08 08:26:26 +00:00

Objective

Exercise long-running clients, reconnects, event subscriptions, downloads, inventory/appearance operations, voice sessions, and shutdown under concurrency.

Deliverables

Add deterministic stress tests plus bounded soak scenarios for task/socket/file/handle/memory leaks.
Audit locks across await/callbacks, channel backpressure, cancellation races, idempotent teardown, and panic isolation.
Capture sanitized resource baselines and regression thresholds.

Validation

Stress/soak runs complete without deadlock or unbounded growth.
Task/socket/subscription counts return to baseline after shutdown.
Race regressions have focused tests.

Prerequisite

All implementation and program milestones are complete with their fixed parity suites green.

Project constraints

The released implementation is entirely native Rust and must pass the explicit no-CLR/no-bridge artifact audit.
Do not weaken API coverage or semantic parity to satisfy hardening, performance, or packaging goals.
Preserve reproducible evidence, update release documentation, and keep all default/live destructive boundaries explicit.

## Objective Exercise long-running clients, reconnects, event subscriptions, downloads, inventory/appearance operations, voice sessions, and shutdown under concurrency. ## Deliverables - Add deterministic stress tests plus bounded soak scenarios for task/socket/file/handle/memory leaks. - Audit locks across await/callbacks, channel backpressure, cancellation races, idempotent teardown, and panic isolation. - Capture sanitized resource baselines and regression thresholds. ## Validation - Stress/soak runs complete without deadlock or unbounded growth. - Task/socket/subscription counts return to baseline after shutdown. - Race regressions have focused tests. ## Prerequisite All implementation and program milestones are complete with their fixed parity suites green. ## Project constraints - The released implementation is entirely native Rust and must pass the explicit no-CLR/no-bridge artifact audit. - Do not weaken API coverage or semantic parity to satisfy hardening, performance, or packaging goals. - Preserve reproducible evidence, update release documentation, and keep all default/live destructive boundaries explicit.

hugo added this to the 12 - Hardening and release milestone 2026-08-08 08:26:26 +00:00

hugo added the enhancement label 2026-08-08 08:26:26 +00:00

hugo referenced this issue from a commit

2026-08-11 23:39:20 +00:00

Harden concurrency and resource lifecycle (#101)

hugo commented

2026-08-11 23:39:51 +00:00

Implemented in commit 3db144d and pushed to main.

Implementation:

Added the native Rust metacrate-concurrency-audit runner, reviewed thresholds, sanitized 16-cycle evidence, documentation, and an ubuntu-latest Gitea soak workflow.
Every cycle executes concurrent client shutdown, deduplicated and cancelled HTTP downloads, deterministic queue saturation, inventory and appearance work, subscription release, temporary file teardown, repeated UDP reconnects, and real encrypted WebRTC/Opus loopback setup and shutdown.
Fixed the download dispatcher so it acquires its concurrency permit before spawning work; its 256-entry queue now provides real backpressure instead of draining into an unbounded waiting task set.
Removed the client service-registry lock from around shutdown callbacks, isolated appearance and asset subscriber panics, and removed the WebRTC signaling lock from across awaited socket setup with a cancellation-safe single-provision guard.
Added public inventory worker, pending-operation, and disposed diagnostics used by exact teardown assertions.

Verification:

16 cycles x 32 operations completed in 1.099 seconds. Peak resources included 258 queued/active download records, 96 subscriptions, one client task, one inventory worker, one voice task, one signaling task, one file, and two sockets. Every recorded count returned exactly to zero; retained bytes and allocations not freed were both zero.
Focused race tests passed for re-entrant shutdown, panic isolation, queue backpressure/cancellation drain, concurrent WebRTC provisioning, explicit WebRTC shutdown, and drop-driven shutdown.
Related compatibility suites passed: download semantics 3/3, inventory semantics 15/15, appearance semantics 34/34, and the two WebRTC teardown cases. No related test was skipped or ignored.
Strict Rust 1.97 clippy, rustdoc, formatting, dependency-policy audit, and scoped compilation passed. Rust 1.96 MSRV compilation also passed separately as a compatibility claim.

This issue is intentionally deterministic-offline: it does not read .env or contact Second Life/OpenSim. Local injected HTTP, filesystem, UDP, and real WebRTC resources are always exercised; this is not a silent credential-dependent skip. The live OpenSim credential gate remains separate and explicit.

Implemented in commit 3db144d and pushed to main. Implementation: - Added the native Rust metacrate-concurrency-audit runner, reviewed thresholds, sanitized 16-cycle evidence, documentation, and an ubuntu-latest Gitea soak workflow. - Every cycle executes concurrent client shutdown, deduplicated and cancelled HTTP downloads, deterministic queue saturation, inventory and appearance work, subscription release, temporary file teardown, repeated UDP reconnects, and real encrypted WebRTC/Opus loopback setup and shutdown. - Fixed the download dispatcher so it acquires its concurrency permit before spawning work; its 256-entry queue now provides real backpressure instead of draining into an unbounded waiting task set. - Removed the client service-registry lock from around shutdown callbacks, isolated appearance and asset subscriber panics, and removed the WebRTC signaling lock from across awaited socket setup with a cancellation-safe single-provision guard. - Added public inventory worker, pending-operation, and disposed diagnostics used by exact teardown assertions. Verification: - 16 cycles x 32 operations completed in 1.099 seconds. Peak resources included 258 queued/active download records, 96 subscriptions, one client task, one inventory worker, one voice task, one signaling task, one file, and two sockets. Every recorded count returned exactly to zero; retained bytes and allocations not freed were both zero. - Focused race tests passed for re-entrant shutdown, panic isolation, queue backpressure/cancellation drain, concurrent WebRTC provisioning, explicit WebRTC shutdown, and drop-driven shutdown. - Related compatibility suites passed: download semantics 3/3, inventory semantics 15/15, appearance semantics 34/34, and the two WebRTC teardown cases. No related test was skipped or ignored. - Strict Rust 1.97 clippy, rustdoc, formatting, dependency-policy audit, and scoped compilation passed. Rust 1.96 MSRV compilation also passed separately as a compatibility claim. This issue is intentionally deterministic-offline: it does not read .env or contact Second Life/OpenSim. Local injected HTTP, filesystem, UDP, and real WebRTC resources are always exercised; this is not a silent credential-dependent skip. The live OpenSim credential gate remains separate and explicit.

hugo closed this issue

2026-08-11 23:40:00 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/MetaCrate#101