From 2928ebf0e354c9d4aeea4d8e260446aedc81c58f Mon Sep 17 00:00:00 2001 From: Transaction Science Date: Thu, 8 Oct 2026 14:36:19 -0400 Subject: [PATCH] wai: a from-rest burst asserted a 2 ms race, and linux-arm64 called it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `a_from_rest_burst_counts_only_work_begun_inside_the_window` asserted, inside the sampler callback, that at most one unit of work per worker had begun by the instant the window opened: assert!(begun <= 3, "no more than one unit per worker can have begun"); Nothing in `burst_from_rest` entails that. Once the barrier releases, each worker increments the counter and sleeps 2 ms; the caller then calls the closure. For `begun` to exceed the worker count the caller need only be descheduled for longer than that 2 ms at exactly this point. It is a race the test does not control, not a property of the code under test. A contended host duly called it: the assertion failed on the `linux-arm64` runner — a colima VM on a box at load 173 — while every other platform passed. I could not reproduce it here, including under 28 competing busy loops, so this is reasoned from the code and the CI log rather than from a local repro, and that is the honest basis for it. The argument does not need one: an assertion nothing establishes can fail without a defect, and the failing run is evidence that it does. The quantity is now recorded rather than asserted — it printed 2 on the first local run, already below the old bound, which is the variance the bound was pretending to constrain. Nothing is lost. What the test establishes about starting from rest is asserted elsewhere and does not depend on the scheduling: the window opened `FromRest`, every worker was in flight, and completions never exceed starts by more than the worker count. That last one bounds a *difference* by the worker count instead of asserting an instant arrived before a sleep finished, so it holds however the host schedules — and it now says what it saw when it fails. This is the fifth copy of this family in the repo. `eoc-meter`, `jouleclaw-energy` (#166), `proof-cascade` and `sandbox-meter` (#181) each put a floor on something the host's scheduler controls; this one puts a ceiling on how much work fits in an interval it does not control. Same mistake, opposite direction. wai-rs lib: 187 passed, clippy clean on the touched file. Pre-existing and untouched by any branch of mine — it surfaced on #183 only because a rebase fires every path-filtered workflow (#191). Co-Authored-By: Claude Opus 5 --- wai/wai-rs/src/energy_burst.rs | 35 +++++++++++++++++++++++++++++----- 1 file changed, 30 insertions(+), 5 deletions(-) diff --git a/wai/wai-rs/src/energy_burst.rs b/wai/wai-rs/src/energy_burst.rs index d91b7674f..9204a527e 100644 --- a/wai/wai-rs/src/energy_burst.rs +++ b/wai/wai-rs/src/energy_burst.rs @@ -1121,10 +1121,26 @@ mod tests { std::thread::sleep(std::time::Duration::from_millis(2)); }, move || { - // Called as the window opens: the workers may have begun the - // first unit, but none has completed one. + // Called as the window opens. How many units have *begun* by + // this instant is a race this test does not control, and it + // used to be asserted: `begun <= 3`, one per worker. + // + // Nothing in `burst_from_rest` entails that. Each worker, once + // the barrier releases, increments this counter and sleeps 2 ms; + // the caller then calls this closure. For `begun` to exceed the + // worker count, the caller need only be descheduled for longer + // than that 2 ms at exactly this point — which a contended host + // will do, and did: the assertion failed on the linux-arm64 + // runner (a VM on a box at load 173) while passing on every + // other platform. It is a 2 ms race, not a property. + // + // Recorded, not asserted. What the test establishes about + // starting from rest is asserted below and does not depend on + // this ordering: the window opened `FromRest`, every worker was + // in flight, and completions never exceed starts by more than + // the worker count. let begun = at_open.load(Ordering::SeqCst); - assert!(begun <= 3, "no more than one unit per worker can have begun"); + eprintln!("from-rest burst: {begun} unit(s) had begun as the window opened"); std::thread::sleep(std::time::Duration::from_millis(40)); vec![1.0, 2.0] }, @@ -1133,9 +1149,18 @@ mod tests { assert_eq!(count.in_flight, 3); assert!(count.completions > 0 && window_s > 0.0); // Every completion started inside the window: completions can never - // exceed starts, and starts exceed completions by at most N. + // exceed starts, and starts exceed completions by at most N — the + // in-flight units — plus the N a worker may begin between the window + // closing and this read. This is the test's real claim, and unlike the + // count at window-open it holds however the host schedules the threads: + // it bounds a difference by the worker count rather than asserting that + // a particular instant arrived before a 2 ms sleep finished. let starts = started.load(Ordering::SeqCst); - assert!(count.completions <= starts && starts <= count.completions + 3 + 3); + assert!( + count.completions <= starts && starts <= count.completions + 3 + 3, + "{} completions against {starts} starts with 3 workers", + count.completions + ); } #[test] -- 2.54.0 (Apple Git-157)