test: cover outer-pump handle lifecycle (train148, v0.5.1523)

[proggeramlug]

Summary

Audit follow-up to #10002: add real pump-lifecycle regression coverage, repair
its unfinished HTTP comment, and bump the workspace to 0.5.1523.

Another actor already merged #10002 as 03d12cc.
Its author head d7edb34 is byte-identical to that
main commit. This follow-up does not claim or duplicate the original merge.
Draft #9998 remains out of scope.

Candidate: 2a7837d.
Validated tree: 69d36152f67e25826d56489908c5cdd1bb57c099.

Changes

• Isolated, bounded FFI test exercises allocation-only hook registration and the
  actual runtime pump without HTTP initialization. It checks prior-tick reuse,
  retention during callback re-entry, and reuse on the next outer tick.
  Observations are asserted outside the C callback boundary.
• Two-thread bookkeeping test proves overlapping outer guards share one tick;
  eager restoration releases only its thread's contribution. The worker does
  not run runtime callbacks or GC operations.
• Replace the unfinished HTTP comment with the outer-tick responsibility.
• Maintainer version/changelog update. No additional production behavior change.

The FFI regression actually ran with runtime-link; default-feature FFI results
are not substituted for that execution.

Validation

Suite	Passed	Cargo exit
Runtime	3488	0
Codegen, including integration/doc tests	1959	0
HIR	639	0
Stdlib	132	0
FFI, runtime-link	60	0
FFI, default features	33	0
Fastify	32	0
HTTP	87	0

6430 Rust tests passed, zero failures. Runtime/stdlib and the other suites
ran with RUST_TEST_THREADS=1. The new overlap and real-pump fixtures passed.
Native Fastify smoke: 12 checks passed, exit 0, including routing, request
bodies, sync/async throws and continued service afterward.

The compiler/core/both static wrappers/seven providers were built coherently at
the candidate commit. The native Fastify smoke used its supported automatic
build path: runtime/stdlib wrappers and Fastify in one Cargo invocation with
external-fastify-pump. The successful build stamp and all three nonempty
archives were verified. No high-volume stress claim is substituted for these
local checks.

Full lint: 79/80 pass, two CI-only commands skipped; exit 1 only for the
established public benchmark freshness failure. All four warning/Clippy scopes
and both API-doc checks pass. Standalone stdlib-default, runtime regex-tests,
and runtime wasm-host checks each exit 0. These source-tree checks ran at
459fb703916015cc1bea2381dbd929129e5bbccc, whose tree is byte-identical to the
candidate after reassembly on externally advanced main (git diff exit 0).
The raw-handle no-raise ratchet was additionally rerun against current main: 0.

Validation logs and actual exit-code sidecars are retained as v148b_* and
v148c_* in /tmp/p9176. The first native attempt used unsupported
PERRY_NO_AUTO_OPTIMIZE and exited 2 before generating/running the server;
the original release driver therefore exited 1. Its supported-mode retry
exited 0. The compiler guard was not changed or bypassed.

CI and issue hygiene

Author-head CI34270347188: cargo job102214176171 reports3469pass/1fail/4ignore,
only the previously established native_stack.rs:53/60 custom-thread bound.
Lint job102214176222 reports stale benchmark inputs; check/warnings pass.
The green e2e-scoped job102214176371 selected no integration suite. Gap/GC jobs
were still active during classification; no result is claimed for those jobs.
Our additional fixtures are not in the author-head logs.

#10002 has no closing-issue reference or closing keyword; it is already MERGED
and will not be closed again. Umbrella #9202 remains open. After this follow-up
lands, fresh-fetch main and verify exact equality with the validated tree.

Inherited OWNER worktree edit remains uncommitted. Only session-owned completed
cache/test executables were cleaned up under disk pressure, with ownership,
exact-file checks and announcements; source, compiler/libraries and logs remain.

Summary by CodeRabbit

• Bug Fixes

  • Improved native handle lifecycle management so retired handles are recycled at the correct event-loop tick.
  • Fixed recycling behavior across nested and overlapping event-pump activity, reducing the risk of stale or prematurely reused handles.
  • Improved HTTP callback handling during lifecycle transitions.

• Documentation

  • Added changelog coverage for lifecycle regression scenarios.

• Chores

  • Updated the application version to 0.5.1523.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 7b5007aa-068e-40f5-b7c7-a92acc8c7de9

📥 Commits

Reviewing files that changed from the base of the PR and between 03d12cc and 2a7837d.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (6)

• CLAUDE.md
• Cargo.toml
• changelog.d/10002-pump-lifecycle-regression.md
• crates/perry-ext-http/src/server/server.rs
• crates/perry-ffi/src/event_pump.rs
• crates/perry-runtime/src/lib.rs

---

📝 Walkthrough

Walkthrough

The change moves HTTP handle quarantine promotion to the runtime outer-tick hook and adds tests for handle recycling, nested pumps, callback ordering, and overlapping outer pump guards. It also updates the project version and changelog.

Changes

Pump lifecycle

Layer / File(s)	Summary
Outer-tick ownership and restoration crates/perry-runtime/src/lib.rs	The test verifies that overlapping outer pump guards share one logical tick and that pump_depth_restore(0) removes only the calling thread’s contribution.
Handle recycling and callback ordering crates/perry-ext-http/src/server/server.rs, crates/perry-ffi/src/event_pump.rs, changelog.d/10002-pump-lifecycle-regression.md, CLAUDE.md, Cargo.toml	HTTP no longer promotes quarantined handles at pump entry. Lifecycle tests verify delayed reuse, nested pump behavior, callback dispatch, and later-tick reuse. The changelog and version metadata are updated.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: jdalton

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch train148-followup

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[proggeramlug]

Train148 follow-up #10003 merged by rebase/admin at 2026-09-08T21:47:31Z.

• Landed main: 7651a36.
• Validated candidate: 2a7837d.
• Both trees: 69d36152f67e25826d56489908c5cdd1bb57c099.
• Fresh fetch followed by standalone git diff --exit-code origin/main HEAD:
  exit0, no output. All three maintainer commits are patch-negative on main.
• Only the inherited OWNER worktree edit remains uncommitted.

Validation:6430 Rust tests passed (core6218, FFI/runtime-link60, FFI/default33,
Fastify32, HTTP87), native Fastify12checks passed. All actual Cargo exits0.
Lint79/80pass with2CI-only skips, only established benchmark freshness red;
all warnings/Clippy and API-doc scopes pass. Three standalone feature checks0.
Native first attempt rejected unsupported PERRY_NO_AUTO_OPTIMIZE (exit2);
supported automatic coherent Fastify rebuild/retry exit0, build stamp verified.

#10002 was already externally merged at 03d12cc; this follow-up does not
claim or duplicate that merge. Both PRs have no closing-issue references.
#9202 freshly verified OPEN. Queue freshly verified0ready/13drafts.
No original PR or related issue needed closing in this follow-up.

Current tree-level checks v148b and final-head release/test logs v148c are
retained in /tmp/p9176, with actual per-command exit-code sidecars.
The native auto cache is target/perry-auto-150e3687d6e41e7f in the worktree;
successful stamp includes external-fastify-pump, source fingerprint
9510558ea7393d11e6976d58c1c96d97, and version0.5.1523.

Compiler/static archives remain built at candidate2a7837d2a, not the rewritten
main SHA. Do not use them for a post-merge source-stamped sweep on main without
rebuilding. No further local source changes or tests are pending.
Post-merge CI will be classified once results are available; no pending CI
job is claimed green. Continue watching the undrafted queue.

[proggeramlug]

Post-merge CI evidence pass for #10003:

• Exact base03d12cc3c: run34280702918, cargo102244553860 reports3469pass/1fail/
  4ignore; only native_stack::tests::stack_top_respects_custom_thread_stack_sizes
  at native_stack.rs:53/60. Lint102244553781 reports stale benchmark inputs.
• Follow-up run34282464691: cargo102250375427 reports3470pass/1fail/4ignore,
  same sole native-stack failure. The new overlapping_outer_guards test passes.
  Lint102250375436 reports the same stale benchmark inputs.
• Merged main7651a36c3, run34282522605: cargo102250492192 also3470pass/1fail/
  4ignore, same native-stack failure and new overlap test passing.
  Lint102250492052 reports the same benchmark failure.
• Follow-up warnings and security audit jobs passed. Its green scoped e2e job
  102250375575 explicitly selected no integration suites; it is not evidence
  of native smoke execution. The later FFI CI step was not reached after the
  runtime suite failure. Local runtime-linked FFI60pass and native Fastify
  12checkspass remain the explicit evidence for those paths.

No additional follow-up fix is indicated by these completed-job logs. No gate
or baseline test was suppressed. Other matrix jobs were still pending during
this pass; no verdict is claimed for them. Local validation and exact post-merge
tree proof remain as recorded in the landing receipt.

Logs retained: ci148_{base,train,main}_{cargo,lint}.log and
ci148_train_e2e.log in /tmp/p9176.