Repair packed agent startup and bound activation metadata retention

2026-10-08 11:19:19 -07:00
parent ffd728b061
commit 165510341d
3 changed files with 93 additions and 21 deletions
@@ -4,6 +4,62 @@ import { mkdtemp, writeFile, symlink, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { CandidateMetadataBudget, readCandidateMetadata } from "../src/execution-world/metadata.js";
+import { loadCheckedInstallationCandidate } from "../src/execution-world/candidate.js";
+
+test(
+  "a real checked application can stage its replacement within the default metadata budget",
+  {
+    skip: !process.env.QX_CHECKED_CANDIDATE,
+  },
+  async () => {
+    const root = process.env.QX_CHECKED_CANDIDATE!;
+    const budget = new CandidateMetadataBudget();
+    const first = await loadCheckedInstallationCandidate(root, {}, { budget, owner: "reader" });
+    try {
+      const retained = budget.snapshot().bytes;
+      const second = await loadCheckedInstallationCandidate(root, {}, { budget, owner: "reader" });
+      try {
+        assert.equal(budget.snapshot().bytes, retained * 2);
+        assert.deepEqual(second.reference, first.reference, "Compaction preserves exact checked identity");
+        assert.equal(second.graphExecution.kernel, second.kernel, "Graph representation shares the validated program");
+        assert.equal(second.graphExecution.queries, second.queries);
+        // A deliberately tighter pool admits the serving installation but must
+        // reject replacement parsing without leaking a candidate or tree lease.
+        const tight = new CandidateMetadataBudget({
+          bytes: retained + 1,
+          ownerBytes: retained + 1,
+          candidates: 2,
+        });
+        const blocker = tight.acquire("reader");
+        blocker.charge(retained);
+        try {
+          await assert.rejects(
+            loadCheckedInstallationCandidate(root, {}, { budget: tight, owner: "reader" }),
+            /CANDIDATE_METADATA_LIMIT/,
+          );
+          assert.equal(tight.snapshot().bytes, retained);
+          assert.equal(tight.snapshot().candidates, 1);
+        } finally {
+          blocker.release();
+        }
+        const other = budget.acquire("other");
+        try {
+          assert.throws(() => other.charge(budget.limits.bytes), /CANDIDATE_METADATA_LIMIT/);
+          assert.equal(budget.snapshot().bytes, retained * 2, "Rejected admission must not leak charges");
+        } finally {
+          other.release();
+        }
+      } finally {
+        second.metadata.release();
+      }
+      assert.equal(budget.snapshot().bytes, retained, "The serving candidate survives failed or completed staging");
+    } finally {
+      first.metadata.release();
+    }
+    assert.equal(budget.snapshot().bytes, 0);
+    assert.equal(budget.snapshot().candidates, 0);
+  },
+);

 test("concurrent candidate reservations enforce aggregate and owner limits and release exactly once", () => {
  const budget = new CandidateMetadataBudget({ bytes: 1000, ownerBytes: 600, candidates: 3 });