fix(mesh): retain echo receive across housekeeping ticks - #7140
Conversation
Keep the pending reliable receive and Redis validation alive until a frame arrives or shutdown actually drains the stream. Drop its mutable borrow before the existing Goodbye/finish path. Cover consumed-frame pool contention, drain before and after community latch, EOF, sequential echoes, peer Goodbye, and stale lease rejection. Signed-off-by: Logan Johnson <loganj@squareup.com>
🔐 Codex Security Review
|
|
@buzz-security-review a02372a |
Desktop smoke failure: existing animation-sampling raceThe required Desktop aggregate remains red because smoke shard 3 failed The failure mechanism is identifiable:
On macOS arm64/Chromium 148.0.7778.96, with an isolated E2E build/private port and no relay, the exact unmodified single test passed once. A separate diagnostic recorded a running channel transition from transparent to Suggested separate test-only follow-up, not applied to this two-file mesh PR: await channel.hover();
+ await waitForAnimations(page);
const channelHoverColor = await channel.evaluate(A copy with this stabilization passed 3/3, no retries, against the same unchanged build. No production CSS change was needed. A lucky rerun can also compare transient values, so these local passes do not clear the required remote check; no remote rerun was dispatched. Maintainer action: choose a policy-compliant disposition for the red Desktop gate, preferably a separate test stabilization, then establish a valid green gate for the relevant revision. This PR remains draft; human/codeowner/last-push review and the choice versus overlapping #2745 remain outstanding. Independently, the existing repository-wide local |
1 participant
🤖
Summary
The relay's mesh echo probe can time out even after receiving the message it should echo. Slow session validation makes this more likely: a periodic shutdown check can discard a message that has already been read. This change keeps that pending receive alive until validation finishes or the stream actually shuts down.
The fix is limited to the echo consumer. It is independent of Multiverse and contains none of its feature changes.
A single pending
recv_validated()operation now survives non-draining 100ms housekeeping ticks. That protects both partially read transport frames and messages awaiting Redis, the shared session directory. The invariant is that housekeeping never discards an in-flight receive. Actual shutdown may discard it, but never echoes unvalidated data. The pending receive releases its mutable stream borrow before the existing Goodbye/finish path runs. Session ownership and community validation, EOF/error handling, and tick timing remain unchanged; this does not add drain priority over already-ready data or change transport backpressure behavior.Related issue
Related: #2458. Existing PR #2745 addresses the same cancellation mechanism with broader transport/API and test changes; this is a smaller consumer-only alternative, not a claim that the earlier work is merged or superseded. Maintainers should choose which approach to carry forward.
Testing
On standalone head
a02372ad5636856af41a219b87a64d3be3f98768, with isolated PostgreSQL/Redis and Rust 1.95.0:buzz-relaypackage, run serially: 997 library + 13 binary tests passed; 92 library + 1 binary ignored. The four new ignored-by-default Redis tests were explicitly run above.Repository-wide local
just cicompleted successfully (exit 0), including workspace/Tauri checks and tests, desktop checks/tests/build, web checks/build, and 2,015 mobile tests. Thejust testwrapper was not run because it overwrites inherited service URLs and invokes default-service startup on this shared host; package tests instead used explicit isolated resources. Worker-only Redis/database and local diagnostic listeners have been cleaned up.Remote CI completed with the required Desktop aggregate red: smoke shard 3 failed the profile/channel hover CSS assertion on all three built-in attempts. Diagnosis and separate test-only proposal: the test captures an intermediate channel animation color (.03/.027), then compares it to the profile's settled .04. Both selectors use the same 4% hover token. On the base-identical desktop tree, an isolated diagnostic confirmed equal settled colors in five samples; a copy with a pre-sample animation wait passed 3/3. These local results do not clear the required remote failure, and no frontend change is bundled here. Maintainer disposition of this existing test race is still required; no remote rerun was dispatched.
All other executed required checks passed, including Rust Lint, Unit Tests, Security, Windows Rust, macOS build, both Desktop E2E Integration shards/aggregate, Backend Integration, Desktop E2E Relay, Relay E2E, DCO, and Desktop Release Candidate. Remote Mobile and Web were path-filter skipped (local checks/build/tests above ran). Advisory exact-range security review run 33432941909 is still reported in progress as of 2026-08-31 20:36 UTC (over 43 minutes, no current-range result posted), separately from the passed required Security check. Workflow-owner follow-through is needed; no advisory approval or absence of findings is inferred. This remains a draft, not an all-green or approved PR; human/codeowner/last-push review is still required.
The regression's negative control uses the exact original consumer and the same test: it fails because the receive is recreated four times instead of once. This is reused evidence from the unchanged source/test pair, not a fresh full-main baseline build.
The separate real-QUIC echo fixture tests loopback transport and session routing. Controlled-transport drain tests are not QUIC fault injection. Neither proves HTTP authorization, model execution, Desktop compute parity, or packaging readiness.