udo/uce
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: prevent stale mutation execution

Browse Source
This commit is contained in:
udo
2026-07-13 20:17:48 +00:00
parent 0187bb60cf
commit 92baaa6299
7 changed files with 140 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/wasm-runtime-architecture.md
+17 -11
View File
@@ -136,15 +136,19 @@ refreshes the epoch deadline before its first guest call. Otherwise a component
whose compilation outlasted the guest CPU budget would immediately trap in the
following allocator/relocation call even though no guest loop consumed it.
The proactive compiler and request workers coordinate through a per-unit file
lock. Unit compilation writes and validates a process-unique temporary wasm
file, then publishes it with an atomic rename. When proactive compilation is
enabled, HTTP and WebSocket requests keep using the last complete artifact
while stale units rebuild in the background; CLI and explicit compile paths
remain synchronous. A failed rebuild removes availability and surfaces the
compiler error rather than serving the old unit indefinitely. The per-unit lock
also keeps concurrent synchronous compilers from waiting across a transitive
graph when a last complete artifact is available.
The proactive compiler and request workers coordinate through per-unit file
locks and a lock-protected demand-priority queue under `BIN_DIRECTORY`. Unit
compilation writes and validates a process-unique temporary wasm file, then
publishes it with an atomic rename. When proactive compilation is enabled,
read-only HTTP requests keep using the last complete artifact while requesting
that stale unit at the head of the compiler queue. Non-read requests never run
a stale entry artifact: they return `503 Service Unavailable` with
`Retry-After: 1`, allowing the client to retry after the priority rebuild.
CLI and explicit compile paths remain synchronous. A failed rebuild removes
availability and surfaces the compiler error rather than serving the old unit
indefinitely. The per-unit lock also keeps concurrent synchronous compilers
from waiting across a transitive graph when a last complete artifact is
available.
Before preprocessing, the compiler verifies that the worker can actually read
the source. An unreadable path is a compile failure with a persisted diagnostic;
@@ -367,8 +371,10 @@ header free-functions are `inline`. The wasm backend exposes only declarations
parent request still renders it. The dependency-invalidation gate also holds
parent and child compile locks across a transitive source edit, proves a
warmed HTTP request returns the last atomically published result without
waiting, while a CLI request waits and returns only the current dependency
result after rebuild completion.
waiting, proves a POST returns a prompt retryable 503 without executing its
old mutation handler, and verifies demand-priority convergence. A CLI request
still waits and returns only the current dependency result after rebuild
completion.
- **WebSocket end-to-end**: a headless client performs a raw WS handshake to
`:HTTP_PORT` with path `/site/tests/websockets.ws.uce` (self-resolving