fix: reserve provider token storage before native creation

Author: abc354402600

.github/workflows/just_build_no_signature.yml

@@ -128,7 +128,7 @@ jobs:
         $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
         $vs = & $vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath
         $vcvars = Join-Path $vs 'VC\Auxiliary\Build\vcvars64.bat'
-          foreach ($name in @('Aurora_DLSSG_Frame_Guard_Tests','Aurora_Provider_Handle_Tests','Aurora_Input_Lock_Tests','Aurora_Streamline_Binding_Tests','Aurora_Provider_Create_Tests','Aurora_Provider_Publication_Tests','Aurora_Native_Device_Tests')) {
+          foreach ($name in @('Aurora_DLSSG_Frame_Guard_Tests','Aurora_Provider_Handle_Tests','Aurora_Input_Lock_Tests','Aurora_Streamline_Binding_Tests','Aurora_Provider_Create_Tests','Aurora_Provider_Publication_Tests','Aurora_Native_Device_Tests','Aurora_Provider_Publication_Allocation_Tests')) {
             $command = 'call "' + $vcvars + '" && cl /nologo /EHsc /std:c++20 /I OptiScaler tests\' + $name + '.cpp /Fe:x64\' + $name + '.exe && x64\' + $name + '.exe'
             & $env:ComSpec /d /c $command
             if ($LASTEXITCODE) { throw "Compatibility guard test failed: $name" }

OptiScaler/framegen/ProviderHandleCreation.h

@@ -12,6 +12,13 @@ Result CreateProviderHandle(Registry& registry, PublicHandle** output, Value ini
         return invalidParameter;
     *output = nullptr;
     auto pending = registry.Prepare(std::move(initial));
+    registry.Reserve(pending);
+    struct Reservation
+    {
+        Registry& registry;
+        decltype(pending)& entry;
+        ~Reservation() { registry.CancelUnpublished(entry); }
+    } reservation { registry, pending };
     const auto result = std::forward<Create>(create)(pending->value);
     if (result != success)
         return result;

OptiScaler/framegen/ProviderHandleRegistry.h

@@ -20,17 +20,37 @@ template <typename Value> class ProviderHandleRegistry
         bool releasing = false;
         bool retired = false;
         bool readsSuspended = false;
+        bool published = false; // Protected by the registry mutex.
         explicit Entry(Value v) : value(std::move(v)) {}
     };
     using Pending = std::shared_ptr<Entry>;
 
     static Pending Prepare(Value value) { return std::make_shared<Entry>(std::move(value)); }
 
+    // Allocate the map node/buckets before entering a provider Create callback.
+    // Reserved entries remain invisible to routing, Read, Release and drain.
+    void Reserve(const Pending& entry)
+    {
+        std::scoped_lock lock(_mutex);
+        _entries.emplace(&entry->value, entry);
+    }
+
+    void CancelUnpublished(const Pending& entry)
+    {
+        std::scoped_lock lock(_mutex);
+        if (!entry->published)
+            _entries.erase(&entry->value);
+    }
+
     Value* Publish(const Pending& entry)
     {
         std::scoped_lock lock(_mutex);
         auto* key = &entry->value;
-        _entries.emplace(key, entry);
+        // CreateProviderHandle reserves this exact entry before native work;
+        // that route performs no allocation after native creation succeeds.
+        if (!_entries.contains(key))
+            _entries.emplace(key, entry);
+        entry->published = true;
         return key;
     }
 
@@ -42,6 +62,8 @@ template <typename Value> class ProviderHandleRegistry
         std::scoped_lock lock(_mutex);
         for (const auto& [key, entry] : _entries)
         {
+            if (!entry->published)
+                continue;
             std::scoped_lock entryLock(entry->mutex);
             if (!entry->retired && predicate(static_cast<const Value&>(entry->value)))
                 keys.push_back(key);
@@ -148,7 +170,7 @@ template <typename Value> class ProviderHandleRegistry
     {
         std::scoped_lock lock(_mutex);
         const auto it = _entries.find(key);
-        return it == _entries.end() ? nullptr : it->second;
+        return it == _entries.end() || !it->second->published ? nullptr : it->second;
     }
     std::mutex _mutex;
     std::unordered_map<const void*, Pending> _entries;

docs/PRIVATE_CREATE_ROLLBACK_20260926.md

@@ -76,3 +76,58 @@ access remain separate lifecycle work. No installer changes, game files, driver
 profiles, native SL1 policy or frame-multiplier algorithms were changed.
 Actual GPU/game behavior remains unverified at the user's request. No aurora
 synchronization or Release is implied by these focused checks.
+
+### Next implementation boundary checked against the current source
+
+- Exported D3D12 `Init_Ext` publishes path/application metadata and calls native
+  `RunDx12Init` before it reaches `Nvngx_FG::D3D12_Init_Ext` and its transition
+  admission. A busy provider can therefore reject after earlier side effects.
+  The analogous Vulkan entry and delegated Init variants need the same review.
+- Direct replacement-provider Init functions still admit repeated calls using
+  the attempted-Init sets as cleanup records, not readiness/idempotence records.
+  Native `NativeDeviceLifecycle::Initialize` already returns success for a known
+  ready device. Do not incorrectly replace attempted-Init obligations with a
+  success-only set or allow a failed partial Init to masquerade as ready.
+- Any new outer Init coordinator must acquire admission before metadata/native
+  side effects and use an explicit internal delegation route. A thread-local
+  "already owns transition" shortcut would let native callbacks bypass exclusion;
+  the existing `_skipInit` flags only describe path/native-call delegation and
+  must not become blanket authorization for reentrant mutation.
+- D3D11, D3D12 and Vulkan publish shared metadata through individually safe
+  snapshots. That does not make the combined path/application/project/logging
+  updates atomic. Direct `NVNGXProxy::InitDx12/InitVulkan` consumers also read these
+  snapshots and need consideration when defining the outer transaction.
+- Ordinary replacement Evaluate still admits concurrent readers. D3D12 uses
+  process-wide `_hudCopy`; `Nvngx_DllProxy::D3D12_EvaluateFeature` has a static depth
+  ring counter, provider-wide depth buffers and uses `currentD3D12Device` for
+  allocation. Per-token registry lifetime protection alone does not serialize
+  those mutable resources, nor prove their GPU lifetime or device affinity.
+  Simply changing every ordinary call to a transition would also reject valid
+  read/query callbacks; use a deliberately scoped design and explicit tests.
+
+## Adjacent publication-allocation follow-up
+
+After the Combo checkpoint `f2cd07b2`, review found a second ownership gap in
+`CreateProviderHandle`: the wrapper was allocated before the native call, but
+`ProviderHandleRegistry::Publish` still allocated its hash-map node/buckets after
+successful native creation. A bad allocation then lost the native handle despite
+successful child creation.
+
+The creation helper now reserves that registry entry before calling the provider.
+Reservations are invisible to identity routing, Read, Release and LiveKeys. An
+RAII scope removes unpublished reservations on error or exception; successful
+publication changes visibility without another map allocation. Existing
+Prepare/Publish callers remain supported. No SDK callback runs under the registry
+mutex, and immutable public identity is exposed only after creation finishes.
+
+`Aurora_Provider_Publication_Allocation_Tests.cpp` adds 34 executable checks with
+allocation failure injected into the actual standard-library allocation path:
+entry/node/bucket failures precede native callbacks, and all allocations may fail
+after native success without preventing publication. It also checks hidden
+reservation visibility, failure/exception cancellation and later Release.
+Existing 32 registry, 16 creation, 20 Release admission, 42 API routing, 50 drain
+and 44 Combo Release checks passed for the affected code. Removing reservation
+in temporary header copies fails the new test at check 3. The new suite is part
+of Windows CI. This does not infer ownership from a failing third-party Create
+that writes an arbitrary non-null output; its pre-existing conservative contract
+is unchanged.

tests/Aurora_Provider_Publication_Allocation_Tests.cpp

@@ -0,0 +1,136 @@
+#include "../OptiScaler/framegen/ProviderHandleRegistry.h"
+#include "../OptiScaler/framegen/ProviderHandleCreation.h"
+#include <atomic>
+#include <cstdlib>
+#include <iostream>
+#include <new>
+#include <stdexcept>
+
+// Fail individual ordinary allocations, or every allocation after the native
+// callback succeeds. No production allocation hooks or test toggles are added.
+static thread_local int allocationBudget = -1;
+void* operator new(std::size_t size)
+{
+    if (allocationBudget == 0)
+        throw std::bad_alloc();
+    if (allocationBudget > 0)
+        --allocationBudget;
+    if (auto* p = std::malloc(size ? size : 1))
+        return p;
+    throw std::bad_alloc();
+}
+void operator delete(void* p) noexcept { std::free(p); }
+void operator delete(void* p, std::size_t) noexcept { std::free(p); }
+
+struct Handle
+{
+    unsigned id;
+    int* nativeHandle = nullptr;
+};
+
+int main()
+{
+    int checks = 0;
+    auto check = [&](bool ok)
+    {
+        if (!ok)
+        {
+            std::cerr << "publication allocation check " << checks + 1 << " failed\n";
+            std::exit(2);
+        }
+        ++checks;
+    };
+    int native = 9;
+    bool observedPreflightFailure = false;
+    bool observedSuccess = false;
+    // Covers the entry, hash node and possible bucket allocations across STL
+    // implementations. Every throw must occur before the native callback.
+    for (int budget = 0; budget != 8; ++budget)
+    {
+        ProviderHandleRegistry<Handle> registry;
+        Handle* out = reinterpret_cast<Handle*>(1);
+        int calls = 0;
+        allocationBudget = budget;
+        bool threw = false;
+        try
+        {
+            CreateProviderHandle(registry, &out, Handle { 1 }, 0, -2, -1,
+                                 [&](Handle& h)
+                                 {
+                                     ++calls;
+                                     h.nativeHandle = &native;
+                                     return 0;
+                                 });
+        }
+        catch (const std::bad_alloc&)
+        {
+            threw = true;
+        }
+        allocationBudget = -1;
+        if (threw)
+        {
+            observedPreflightFailure = true;
+            check(calls == 0 && !out);
+            check(registry.LiveKeys([](auto&) { return true; }).empty());
+        }
+        else
+        {
+            observedSuccess = true;
+            check(calls == 1 && out);
+        }
+    }
+    check(observedPreflightFailure && observedSuccess);
+
+    ProviderHandleRegistry<Handle> registry;
+    Handle* out = nullptr;
+    const void* privateAddress = nullptr;
+    auto create = [&](bool fail, bool throws)
+    {
+        return CreateProviderHandle(
+            registry, &out, Handle { 2 }, 0, -2, -1,
+            [&](Handle& h)
+            {
+                privateAddress = &h;
+                check(!out);
+                check(!registry.GetIdentity(&h, [](auto& v) { return v.id; }));
+                check(registry.Read(&h, -3, [](auto&) { return 0; }) == -3);
+                check(registry.Release(&h, -3, [](auto&) { return 0; }, [](int r) { return r == 0; }) == -3);
+                check(registry.LiveKeys([](auto&) { return true; }).empty());
+                if (throws)
+                    throw std::runtime_error("native create");
+                if (fail)
+                    return -1;
+                h.nativeHandle = &native;
+                allocationBudget = 0; // No allocation may follow native success.
+                return 0;
+            });
+    };
+    check(create(true, false) == -1 && !out);
+    check(!registry.GetIdentity(privateAddress, [](auto& v) { return v.id; }));
+    bool threw = false;
+    try
+    {
+        create(false, true);
+    }
+    catch (const std::runtime_error&)
+    {
+        threw = true;
+    }
+    check(threw && !out && registry.LiveKeys([](auto&) { return true; }).empty());
+    int result = -1;
+    threw = false;
+    try
+    {
+        result = create(false, false);
+    }
+    catch (const std::bad_alloc&)
+    {
+        threw = true;
+    }
+    allocationBudget = -1;
+    check(!threw && result == 0 && out);
+    check(registry.Read(out, -3, [](auto& h) { return *h.nativeHandle; }) == native);
+    check(registry.LiveKeys([](auto&) { return true; }).size() == 1);
+    check(registry.Release(out, -3, [](auto&) { return 0; }, [](int r) { return r == 0; }) == 0);
+    std::cout << "PASS: " << checks << " publication allocation checks\n";
+}