Repository navigation
control.t27: bound how often one task re-runs a paid model call across crashes #7059
Description
Problem
control.t27 section 7 (#7006) re-runs a model call whose intent is open when its holder crashed: effect_action(EFF_INTENT, EK_MODEL_CALL, ...) is DO_RUN, because a model call cannot be looked up. Each crash that leaves the intent open pays for the call again. Nothing checks how many times that can happen for one task:
- actors.t27 bounds restarts of one runtime:
DOMAIN_MAX_RESTARTS3 perDOMAIN_PERIOD_SECONDS300, andUNSTABLE_GIVE_UP6 short runs. A run longer thanSTABLE_SECONDSresets the streak, and a reclaimed task can move to another runtime, so neither bound counts per task. - dispatch.t27 states the per-issue bound only as prose:
RETRY_RULEsays three free attempts with nothing judgeable escalate.counts_against_issue(true)is false, so an interrupted attempt is not a counted one.
Evidence
- control.t27
effect_may_repeat(EK_MODEL_CALL, true) == true(testa_restarted_holder_skips_what_landed_and_looks_up_what_may_have). - dispatch.t27
RETRY_RULEandcounts_against_issue(lines printed bygrep -n 'RETRY_RULE\|counts_against_issue' specs/queen/dispatch.t27). - Prior art: Temporal bounds an activity's retries with
maximumAttemptsin its retry policy, and Restate'sctx.runtakes retry options with a maximum number of attempts. Both count per step, not per worker.
Proposal
Add a pub fn to control.t27, model_call_may_rerun(open_intent_reruns: u32) -> bool, true below a bound. The bound must be the same number dispatch.t27's RETRY_RULE gives free attempts (3); per T7, write it as a literal with a comment naming its owner, not as an import. Past the bound, the journal answers an escalation instead of DO_RUN. A test pins the bound with runtime asserts, and an invariant ties the per-task bound to at most the free-attempt count.
Part of epic #6971.
Acceptance
- the rule is a
pub fnin specs/queen/control.t27, called by a test with runtime asserts (t27c test-report: 0 vacuous); - parse, typecheck, gen-rust, gen-c, gen-verilog exit 0;
t27c gen+zig testpass; tri mutate spec --fn NAMEon each new function: every survivor is killed by a new assert or named as equivalent in the commit body.
Activity
gHashTag commentedon Oct 6, 2026
Implemented as local commit
f8119a488onclaude/queen-actors-next2(control.t27 section 7). It will land in one PR after #7060 merges. Three changes against this issue's text, and why:DO_GIVE_UP: the attempt ends as a failure that counts against the issue (give_up_counts_against_issue() == true). Then dispatch.t27's send-back ceiling and review_valve.t27 take it automatically. An escalation would be a hold for a person, which the owner's rule (no person in the loop) forbids. A give-up is the opposite of a cancel (cancel_counts_against_issue() == false): dispatch.t27 does not count an interruption, so without a counted give-up the loop around the effect would still have no bound.runs_after_intent), before the effect runs, so a crash during the effect counts.MaxAttemptscounts retries, default 3.EFFECT_RUN_LIMITis 3. It counts runs, the first included, as Temporal does. Three is the number of free attempts dispatch.t27RETRY_RULEgives an issue, written as a literal per T7. An invariant keeps it in 2..3: one crash must not end an attempt, and one key never gets more runs than an issue gets attempts.Checks, printed by commands:
t27c gen+zig test, 0 vacuous; all 5 backends exit 0.spec(queen): bound an effect's re-runs; close the mutation gaps in fi…
spec(queen): review_valve names an effect give-up instead of reading …