Repository navigation
actors.t27: restart jitter so a domain's agents do not restart in lockstep #7002
Description
Problem
backoff_seconds (#6975) is deterministic: agents of one domain that crashed on the same provider outage all retry at the same second, and hit the rate limit together again.
Evidence
Akka backoff supervision takes a randomFactor beside min and max backoff (https://doc.akka.io/libraries/akka-core/current/fault-tolerance.html).
Proposal
A bounded jitter as a pure function of (wait, a seed the host supplies, e.g. the pid's slot), so every backend computes the same value and the spread is testable: never below wait, never above wait plus a stated fraction, never above the cap.
Part of epic #6971 (BEAM-style actors under the Queen, specs/queen/actors.t27). Source: the competitor table in the epic's comments.
Acceptance
- the rule is a
pub fnor constant in specs/queen/actors.t27 (or control.t27 where named), called by a test with runtime asserts (t27c test-report: 0 vacuous); - parse, typecheck, gen-rust, gen-c, gen-verilog exit 0;
t27c gen+zig testpass; tri mutate spec --fn NAME(tri mutate spec: guard and operator mutants of a .t27 spec, run through t27c gen + zig test #6993) on each new function: every survivor is killed by a new assert or named as equivalent in the commit body.
Activity
gHashTag commentedon Oct 6, 2026
Design change while implementing (local commit 557945709 on claude/queen-actors-next2, stacked on #7001):
The proposal's three bounds -- never below the wait, never above the wait plus a fraction, never above the cap -- leave zero spread at the cap. A long outage leaves every agent of a domain at the cap, which is exactly where they must not restart together.
So
jittered_seconds(wait, seed)pulls the wait down by up toJITTER_PERCENT(20): never above the wait (hence never above the cap), never more than 20 per cent below it, and 9 distinct seconds for 10 slots at the cap. Akka'srandomFactorand gRPC's +-20% instead cross their configured maximum; AWS's "equal jitter" pulls down by half.The seed goes through Knuth's multiplicative hash with floor(2^32 / phi) = 2654435769 first. A plain
seed % rangeputs slots taken at a stride equal to the range in the same second (10 slots at stride 3: 1 second instead of 3); the test asserts all 3.Mutation:
tri mutate specfinds one site injittered_seconds(killed) and none inseed_hash-- it does not mutate arithmetic (filed separately). 12 arithmetic mutants by hand, 12 killed, after pinning slot 61 (292) to tell 2654435769 from Knuth's prime 2654435761.feat(tri): tri mutate spec -- guard, operator and arithmetic mutants …
spec(queen): actors jitter, significant children, call cycle, max chi…
feat(t27b): std.mem.eql/indexOf on byte slices and byte-array pointers (
fix(codegen): gen-rust enum order and gen-zig float-call cast (#6941) (…