W2/supply ingress - #32
Merged
Merged
Conversation
The greeting-declared set_len is a premise the window solve prices, but nothing on the remote decode path (read_reply / read_early) holds a still-open reply to it: every supplied record takes backend custody at Leaf::leaf with no charge, so a peer supplying past its declaration is detected only after whole-reply materialization, by the walk-side ledger. This commits the known-bad demonstration first: a census-metered malformed-suite pin showing decoded residency growing record for record with the stream, across two stream sizes so the growth reads as a slope. The ingress charge lands next and flips this pin to a typed failure under bounded residency. Claude-Session: https://claude.ai/code/session_01H26YwsygLvogog1aBm8Y2N
The greeting-declared set_len bounds the live leaves an honest peer can supply across a session, and the window solve prices absorbed-supply volume from it; until now the only charge sat walk-side, at absorption, after a decoded reply materializes whole. A peer streaming past its declaration inside one still-open reply therefore grew decoded residency without bound before any check could see it (the parent commit's census pin demonstrates this). Thread a per-session SupplyLedger, derived from the remote greeting's set_len, through the remote proxy into read_reply and read_early, and charge one leaf per supplied record immediately before Leaf::leaf takes payload custody. The first over-declaration record fails the session typed (DecodeError::OverdrawnSupply, carrying the declaration), while its reply is still open. The ledger is the proxy's own instrument over the same declaration the walk's ledger enforces: each leaf charges each ledger exactly once, the ingress charge fires first on the wire, and the walk-side charge stays as the in-process stack's enforcement. The census pin flips with the cure: a declaration exactly covering the stream admits it whole (every admitted leaf resident, the meter's liveness floor), and an allowance of one rejects at the second record with residency equal across a doubled overrun, custody provably stopping at the charge rather than the reply boundary. The session-level set_len tripwire now observes the ingress rejection instead of the walk's later violation; the SupplyLedger rustdoc states the two- instrument shape. No wire bytes move: the charge only reads what already crosses. The new DecodeError variant is additive; the codec error atlas covers the codec layer only and is untouched. Claude-Session: https://claude.ai/code/session_01H26YwsygLvogog1aBm8Y2N
The declaration matrix so far exercised set_len at its zero boundary: the first supplied record trips. The sharper lie admits some supply first and overruns mid-stream; on the wire it surfaces *within* one still-open reply, where only the ingress charge can see it (the walk charges at absorption, after a decoded subtree materializes). Remote axis: a four-against-eight pair whose initiator's whole content rides the opening-supply stream as one reply, with the heard set_len rewritten to one — election-preserving, first record admitted, second rejected typed as the ingress overdraw carrying the enforced declaration, in both orientations. Materialized axis: the driver consumes set_len too, so the same lie gets a GreetingLie variant (declare one leaf, hold more); the deceived walk classifies it as Violation::OverdrawnSupply through the ledger's accumulation rather than the zero-allowance first-charge path, and the greeting-lie proptest now draws both ends of the allowance. Claude-Session: https://claude.ai/code/session_01H26YwsygLvogog1aBm8Y2N
Mechanical formatting only: the ingress-ledger arguments were inserted textually and two files were left off rustfmt's line-breaking. Claude-Session: https://claude.ai/code/session_01H26YwsygLvogog1aBm8Y2N
… cap The summary line carries the lie and its violation; the contrast with the zero declaration and the wire decoder's within-one-reply catch moves below the fold. Claude-Session: https://claude.ai/code/session_01H26YwsygLvogog1aBm8Y2N
…'s change) just readme regenerates crates/before/README.md one line away from its committed form: the committed file carries a malformed intra-doc link rendering for Clock::recv that the current cargo-rdme run renders as a plain code span. The drift predates this branch (no commit here touches crates/), and readme-check blocks the gate on it; the README is a derived artifact, so the fix is the regeneration itself. Reported to the coordinator as unowned base drift: the before crate is the sibling lane's surface. Claude-Session: https://claude.ai/code/session_01H26YwsygLvogog1aBm8Y2N
The rejection helper's Ok type is a plain count, so clippy can suggest expect_err where the suite's other decodes (non-Debug Ok types) cannot; use expect_err directly. Claude-Session: https://claude.ai/code/session_01H26YwsygLvogog1aBm8Y2N
plaidfinch
marked this pull request as ready for review
August 18, 2026 22:27
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.