feat(event): add ADR-0010 rotating admission prototype (unwired) - #1870
Conversation
RotatingAdmissionChannel<N, P>: one SPSC descriptor ring spanning a continuous sequence across a bounded series of published-prefix page epochs (generation tag = epoch as u32, at most P live). - rotation only on typed page/descriptor-full results and only before ring reservation; ADR-0009's [P]->[R]->[C] phase discipline unchanged - typed PageQuotaExhausted backpressure with zero page/ring mutation when all P slots are outstanding (quota check precedes the seal) - reclamation via one consumer->producer released-epoch Release/Acquire edge; the frame lease's mutable borrow of the consumer proves no payload borrow survives a release - successor readers travel a bounded SPSC handoff ring whose publication happens-before the epoch's first data-ring descriptor; an absent handoff at a seam is terminal, never transient - seam-strengthened terminal semantics: epoch-boundary committed-count shortfall, generation skip, handoff identity mismatch, orphaned final prefix all fail closed; caught-unwind rotation faults leave a retained producer terminal Disclosed prototype deviations (ADR §Prototype notes): rebind allocates one bounded page per rotation (in-place reuse precedes shadow); P is a power of two >= 2; construction rejects a nonzero arena_generation. Evidence: 11 native unit tests (rotation at byte/descriptor exhaustion with sequence/generation continuity, quota refusal + recovery with nothing mutated, seam shortfall, generation skip, faulted orphan, clean aggregate end, post-seal unwind, alignment), 10k-event cross-thread rotation stress + pool-bound test (wired into the ASan/TSan CI lanes as --test rotating), a bounded Loom seam model (seal/handoff/[R]/[E] interleavings; the initial unbounded-poll model was rewritten after it demonstrably exploded Loom's state space), full Miri, all-features clippy. Status honesty: ADR-0010 remains Proposed; the fabric remains target with no shadow traffic and no performance claim.
|
Warning Review limit reached
Next review available in: 8 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (12)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
ECC bundle files are already tracked in this repository. Skipping generation of another bundle PR. |
Conformance scan findings: the workspace tree omitted lib/event (present on main since #1861 under Proposed ADRs), and 'introduced only through accepted ADRs' contradicted the ADR index rule that Proposed ADRs permit unwired prototypes — which is exactly how lib/event exists today.
|
ECC bundle files are already tracked in this repository. Skipping generation of another bundle PR. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request implements an unwired prototype for bounded page rotation (RotatingAdmissionChannel) under Proposed ADR-0010, adding the core implementation in lib/event/src/rotating.rs along with native, Loom, and cross-thread stress tests. The documentation and roadmaps are updated to reflect this new prototype. The review feedback suggests improving error reporting by implementing the source method of the std::error::Error trait for the newly introduced error enums (RotatingConfigError, TryRotatingAdmitError, and TryRotatingConsumeError) to correctly expose the underlying wrapped errors.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| } | ||
| } | ||
| } | ||
|
|
There was a problem hiding this comment.
The RotatingConfigError enum wraps other errors (RingConfigError and SlabConfigError) but its std::error::Error implementation does not override the source method. To improve error reporting and match the pattern used in AdmissionConfigError (in admission.rs), implement source to return the underlying errors.
impl Error for RotatingConfigError {
fn source(&self) -> Option<&(dyn Error + 'static)> {
match self {
Self::Ring(error) => Some(error),
Self::Handoff(error) => Some(error),
Self::Slab(error) => Some(error),
_ => None,
}
}
}| } | ||
| } | ||
| } | ||
| } |
There was a problem hiding this comment.
The TryRotatingAdmitError enum wraps other errors (SlabAppendError, RingInvariantError, and SlabConfigError) but its std::error::Error implementation does not override the source method. Implement source to return the underlying errors, matching the pattern in TryAdmitError.
impl Error for TryRotatingAdmitError {
fn source(&self) -> Option<&(dyn Error + 'static)> {
match self {
Self::Slab(error) => Some(error),
Self::RingInvariant(error) => Some(error),
Self::RotationConfig(error) => Some(error),
_ => None,
}
}
}| } | ||
| } | ||
| } | ||
| } |
There was a problem hiding this comment.
The TryRotatingConsumeError enum wraps other errors (RingInvariantError and PublishedSlabReadError) but its std::error::Error implementation does not override the source method. Implement source to return the underlying errors, matching the pattern in TryConsumeError.
impl Error for TryRotatingConsumeError {
fn source(&self) -> Option<&(dyn Error + 'static)> {
match self {
Self::RingInvariant(error) => Some(error),
Self::Page(error) => Some(error),
_ => None,
}
}
}Conformance scan: the onboarding tour pointed agents at settings.rs, axum_app.rs, tonic_app.rs, handlers/, middleware.rs and startup.rs — none of which exist. The actual gateway binary is src/src/ with main.rs, routes/, and grpc.rs; the thin-adapter law those names illustrated lives in docs/architecture.md §5 and is unchanged.
|
ECC bundle files are already tracked in this repository. Skipping generation of another bundle PR. |
Summary
Follow-up to #1869, which squash-merged the design-only ADR-0010 before the prototype commit reached its branch (same race as #1861/#1862). This PR carries that stranded commit, rebased onto main: the unwired
RotatingAdmissionChannel<N, P>prototype plus the ADR's §Prototype-notes amendments and ledger updates.Prototype (
lib/event/src/rotating.rs, permitted by Proposed status):generation = epoch as u32, at mostPlive); rotation only on typed page-full results, before ring reservation — ADR-0009's[P]→[R]→[C]phase discipline unchangedPageQuotaExhaustedbackpressure with zero page/ring mutation (quota check precedes the seal)released_epochRelease/Acquire edge; the frame lease's mutable borrow of the consumer proves no payload borrow survives a releaseDisclosed deviations (added to the ADR's new §Prototype notes): rebind allocates one bounded page per rotation (in-place reuse is a hard gate before
shadow);Pis a power of two ≥ 2; construction rejects a nonzeroarena_generation.Evidence
--test rotating); both sanitizers green locally-D warnings; fmt; workspace check; docs validators greenStatus honesty
ADR-0010 stays Proposed; index note updated from "design-only" to "prototype follows in the same review". The fabric remains
target: noshadowtraffic, no protected evidence, no performance claims. ROADMAP and the Implementation_Status v2 ledger name the remaining gates including in-place slot reuse.Test plan
event-concurrency/event-miri/event-sanitizersnow include the rotating suites)