FEATURE-ci-v3-runtime-green: bind Windows allocation faults to static proof

Author: etr

ChangeLog

@@ -1,4 +1,6 @@
 Version 3.0.0 - 2026-10-10
+	Run Windows allocation-failure injection against the installed static
+		library and require ordinary readiness cases in both linkage lanes.
 	Keep PSK cancellation lookup held until owner release and avoid artificial
 		per-fragment scheduling delays in the TLS test transport.
 	Avoid Windows DLL shutdown hangs by retaining the default timer service

scripts/lib/package_integration.py

@@ -38,6 +38,11 @@ def run_suites(inventory, host, mode, linkage, directory, prefix, source, build,
         receipt = dict(name=name, tls=mode, linkage=linkage, execution=definition.get('execution', 'installed-library'))
         try:
             flags = cflags + ['-DHTTPSERVER_COMPILATION', '-I' + str(source / 'src'), '-I' + str(source / 'test')]
+            if host == 'Windows' and linkage == 'shared' and definition.get('windows_static_cases'):
+                # An executable's operator new cannot interpose PE DLL imports.
+                # The installed static lane retains every fault-injection case.
+                flags += ['-DLHS_TEST_DLL_LINKAGE']
+                receipt['windows_static_cases'] = definition['windows_static_cases']
             for macro, value in (('TLS_TEST_DIR', source / 'test'), ('PARITY_TRANSCRIPT_DIR', source / 'test/parity/transcripts'),
                                  ('PARITY_DATA_ROOT', source / 'test'), ('HTTP2_CORPUS_DIR', source / 'test/conformance/http2')):
                 flags += ['-D' + macro + '="' + value.as_posix() + '"']
@@ -61,9 +66,7 @@ def run_suites(inventory, host, mode, linkage, directory, prefix, source, build,
             started = time.monotonic()
             output = command([str(executable)], source / 'test', env, timeout=180, allow_failure=True)
             receipt.update(matrix.suite_result(output, command.records[-1]['exit']))
-            missing = set(definition.get('required_cases', [])) - set(receipt['case_names'])
-            if missing:
-                raise ValueError('required suite cases absent: ' + ', '.join(sorted(missing)))
+            matrix.check_suite_cases(definition, host, linkage, receipt['case_names'])
             receipt.update(duration=time.monotonic() - started, log=command.records[-1]['log'])
             if name in ('tls_io_loopback', 'native_http1_tls_parity'):
                 matrix.check_tls_witnesses(output, inventory['platforms'][host])

scripts/lib/package_matrix.py

@@ -150,6 +150,18 @@ def suites(inventory, platform, tls):
     return {name: inventory['suites'][name] for name in names}
 
 
+def check_suite_cases(definition, host, linkage, observed):
+    required = set(definition.get('required_cases', []))
+    windows_static = set(definition.get('windows_static_cases', []))
+    if not windows_static <= required:
+        raise ValueError('Windows static cases must also be required suite cases')
+    if host == 'Windows' and linkage == 'shared':
+        required -= windows_static
+    missing = required - set(observed)
+    if missing:
+        raise ValueError('required suite cases absent: ' + ', '.join(sorted(missing)))
+
+
 def suite_result(output, status):
     output = output.replace('\r\n', '\n')
     tests = re.findall(r'^(\d+) tests executed$', output, re.M)

scripts/test-v3-installed-consumer.py

@@ -1580,5 +1580,32 @@ def test_nonzero_shutdown_is_failure(self):
         self.assertEqual(8, json.loads(receipt.read_text())['exit'])
 
 
+class SuiteCaseCoverageTest(unittest.TestCase):
+    def setUp(self):
+        self.definition = dict(required_cases=['ordinary', 'allocation_failure'],
+                               windows_static_cases=['allocation_failure'])
+
+    def test_windows_dll_requires_all_ordinary_cases(self):
+        matrix.check_suite_cases(self.definition, 'Windows', 'shared', ['ordinary'])
+        with self.assertRaisesRegex(ValueError, 'ordinary'):
+            matrix.check_suite_cases(self.definition, 'Windows', 'shared', [])
+
+    def test_static_proof_requires_all_allocation_failure_cases(self):
+        for host in ('Windows', 'Linux', 'Darwin', 'FreeBSD'):
+            with self.subTest(host=host), self.assertRaisesRegex(ValueError, 'allocation_failure'):
+                matrix.check_suite_cases(self.definition, host, 'static', ['ordinary'])
+            matrix.check_suite_cases(self.definition, host, 'static', ['ordinary', 'allocation_failure'])
+
+    def test_other_shared_platforms_retain_allocation_failure_coverage(self):
+        for host in ('Linux', 'Darwin', 'FreeBSD'):
+            with self.subTest(host=host), self.assertRaisesRegex(ValueError, 'allocation_failure'):
+                matrix.check_suite_cases(self.definition, host, 'shared', ['ordinary'])
+
+    def test_windows_static_cases_must_also_be_required(self):
+        self.definition['required_cases'] = ['ordinary']
+        with self.assertRaisesRegex(ValueError, 'static.*required'):
+            matrix.check_suite_cases(self.definition, 'Windows', 'static', ['ordinary'])
+
+
 if __name__ == '__main__':
     unittest.main()

specs/tasks/FEATURE-ci-v3-runtime-green.md

@@ -1,6 +1,6 @@
 # FEATURE-ci-v3-runtime-green
 
-Status: Stages 1 and 3 implemented with focused proof; complete CI and remaining supported runtime repairs are pending. Groundwork validation is explicitly prohibited until FULL CI IS GREEN.
+Status: Stages 1, 3, 4 and 5 implemented with focused proof; complete CI and remaining supported runtime repairs are pending. Groundwork validation is explicitly prohibited until FULL CI IS GREEN.
 Base: `v3` at `8f3083977f49706e66cefbb3ee8b6f6685469719`.
 Working branch: `task/FEATURE-ci-v3-runtime-green`. User requested integration into `v3` before full CI completion; retain incomplete verification explicitly.
 Plan: primary checkout `.groundwork-plans/FEATURE-ci-v3-runtime-green-plan.md`.
@@ -91,3 +91,24 @@ The diagnostic Windows four-test program failed one of 52 checks in 0.741 second
 Fixture root cause: the cancellation rescue unconditionally released after250ms, before the owner could assert cancellation under slower scheduling. The transport also slept after every41/73-byte fragment, charging scheduler delays to real handshake deadlines. A minimal real TLS1.3 certificate fixture with1ms sleeps delayed to15ms failed at2089ms/outcome8(timeout); draining progress first passed at625ms. An intermediate full coarse-scheduling check still failed two held/capacity assertions because idle sleeps could expire the400ms pre-lookup deadline. Yielding while idle preserved that deadline and passed all313 checks in1.029seconds, with zero skips. The100ms owner-responsiveness assertion, cancellation/timeout/capacity/late-result assertions, bounded drains and all protocol settings remain unchanged. Only test source changed; production TLS is unchanged.
 
 Setup evidence is retained honestly: system OpenSSL was rejected before selecting the existing3.5.9 provider; the first suite launch used build-root cwd instead of test cwd and failed fixture path lookup. Correcting cwd, as required by the generated relative TLS_TEST_DIR, produced the meaningful behavioral check. Neither setup failure justifies a source workaround. No broad baseline or Groundwork validation was run.
+
+## Stage 5: Windows allocator fault-injection fixture linkage
+
+- [x] Identify the current PR383 failed program from one bounded selected artifact assessment (3,891,726 range bytes; no full ZIP or original execution).
+- [x] Prove that executable operator-new replacement does not affect Windows DLL allocation, and that static linkage delivers the intended fault.
+- [x] Keep all 22 ordinary readiness cases against the installed Windows DLL; require all 27 cases, including the five unchanged allocation-failure cases, against the installed static archive.
+- [x] Make the required case names explicit in the inventory and reject every missing static fault case. Other platforms retain their original fault coverage.
+- [x] Pass native Windows focused DLL22/438 and static27/486 gates, Linux28/497, 28 package coverage/matrix checks, changed-file lint and diff checks.
+- [ ] Full exact-source CI with the corrected installed linkage profiles.
+
+Current PR383 package job122630892885 passed native62 in4.812276s and external4 in0.572681s, then failed external_readiness_adapter27/486 with13 failures, all inside five allocation-failure cases. The assertion expecting bad_alloc was false and regular work completed. The PSK change cannot affect these allocation boundaries; this repair is within the accepted overall CI goal. Member CRC/SHA are verified; the full212MB ZIP digest is metadata-only. Assessment is closed.
+
+A tiny native PE fixture reproduces the cause: executable allocation throws under its replacement operator new, DLL-owned allocation does not (exit1/0.362s). Linking the same owner object into the executable makes both throw (exit0/0.309s). Microsoft documents per-module DLL import binding: https://learn.microsoft.com/en-us/cpp/build/linking-an-executable-to-a-dll?view=msvc-170 . The chosen correction scopes allocation injection to linkage where it can actually reach the owner. Artificially throwing in the caller would not exercise the backend; a new production allocator hook or loader patch is unnecessary.
+
+Only Windows shared compilation selects LHS_TEST_DLL_LINKAGE; this omits allocator replacement and the five fault registrations from that executable. All five original assertion bodies remain unchanged and mandatory in the installed static lane. The inventory names all27 ordinary/static cases, and the receipt validator requires the22 DLL cases or all27 static cases. No test skip or failed/empty receipt is accepted. Every original C++ assertion line is preserved. The other platforms keep all five fault cases in both linkage lanes.
+
+Fresh current-source focused Windows backend DLL (16 owning translation units) passed22/438 in0.899s; matching static executable passed27/486 in1.237s, both zero skips and retired. Linux passes28/497 including its descriptor-zero case. Removing any one of the five fault names from the static receipt is rejected. Python coverage/matrix tests pass28 cases. Native setup initially missed net_address.cpp at link; adding that existing owning translation unit corrected the test build without a production workaround. Context is qualified local Windows11/cached LLVM23.1.4/GCC15.2 headers and retained runtime DLLs, not Server2022/MSYS2 CI. Evidence: primary `.debug/v3-ci-native-repairs-PJFEkn/allocator-linkage/`.
+
+## Approved Windows capture closure
+
+User approved exact430fa17e publication and ONE1/60 Windows original external-loop capture. Run40635371672 completed once:4tests/52checks/zero skips, exit0 in0.4701966s, retirement confirmed, stderr empty. Budget is CLOSED; no retry or remaining-time authority. This establishes nonreproduction in that context, not a fix or independence of the earlier WSAPoll10038 failure. The diagnostic branch remains NEVER MERGE. Only a proven repair may change production behavior.

test/installed/v3-package-matrix.json

@@ -73,6 +73,42 @@
     "external_readiness_adapter": {
       "sources": [
         "unit/external_readiness_adapter_test.cpp"
+      ],
+      "required_cases": [
+        "host_drives_read_write_and_snapshot_is_owned",
+        "spurious_unknown_and_wrong_generation_do_not_consume",
+        "omitted_then_republished_registration_rejects_old_callbacks",
+        "reopen_same_id_and_descriptor_rejects_every_old_flag_combination",
+        "detached_read_cannot_rearm_into_reopened_id",
+        "detached_accept_cannot_rearm_into_reopened_id",
+        "exclusive_retirement_expires_real_timer_without_host_dispatch",
+        "timers_use_host_clock_order_and_reject_decreasing_samples",
+        "timer_cancel_expiry_race_is_exactly_once",
+        "wake_is_doorbell_and_post_snapshot_work_survives_acknowledgement",
+        "overlapping_dispatch_rejects_without_consuming_valid_read",
+        "host_accept_and_close_deliver_once",
+        "wake_published_during_dispatch_survives_and_recursive_overlap_reject",
+        "release_during_completion_defers_close_and_cannot_step_replacement",
+        "hard_wake_failure_stops_and_unwinds_pending_work",
+        "decreasing_clock_rejects_a_valid_socket_event_before_io",
+        "exhausted_identity_never_wraps_and_closes_unregistered_socket",
+        "buffered_read_precedes_combined_close_error_and_duplicate_callback",
+        "complete_snapshots_prune_retired_connection_records",
+        "allocation_failure_read_batch_remains_owned_until_close",
+        "allocation_failure_write_batch_remains_owned_until_close",
+        "allocation_failure_accept_batch_remains_owned_until_close",
+        "allocation_failure_second_direction_keeps_first_direction_owned",
+        "allocation_failure_due_timers_remain_owned_until_close",
+        "exhausted_generation_fails_snapshot_and_shutdown_completes_once",
+        "successful_accept_after_listener_retirement_closes_fresh_handle",
+        "successful_accept_after_backend_close_closes_fresh_handle"
+      ],
+      "windows_static_cases": [
+        "allocation_failure_read_batch_remains_owned_until_close",
+        "allocation_failure_write_batch_remains_owned_until_close",
+        "allocation_failure_accept_batch_remains_owned_until_close",
+        "allocation_failure_second_direction_keeps_first_direction_owned",
+        "allocation_failure_due_timers_remain_owned_until_close"
       ]
     },
     "readiness_contract": {

test/unit/external_readiness_adapter_test.cpp

@@ -39,6 +39,7 @@
 #include "./io_backend_contract.hpp"
 #include "./littletest.hpp"
 
+#ifndef LHS_TEST_DLL_LINKAGE
 // Fault injection is confined to this test executable and the dispatching
 // thread. Restore allocation before asserting or shutting down the backend.
 namespace {
@@ -79,6 +80,7 @@ void* operator new(std::size_t size) {
 void operator delete(void* memory) noexcept { std::free(memory); }
 void operator delete(void* memory, std::size_t) noexcept { std::free(memory); }
 #endif
+#endif  // LHS_TEST_DLL_LINKAGE
 
 namespace srv = httpserver::server;
 namespace {
@@ -203,6 +205,7 @@ void detached_reopen(littletest::test_runner* __lt_tr__, const char* __lt_name__
     LT_CHECK_EQ(fx.backend.pending_count(), std::size_t{0});
 }
 
+#ifndef LHS_TEST_DLL_LINKAGE
 void failed_direction_collection(littletest::test_runner* __lt_tr__,
                                  const char* __lt_name__, hd::io_op_kind kind) {
     fixture fx;
@@ -253,6 +256,8 @@ void failed_direction_collection(littletest::test_runner* __lt_tr__,
     LT_CHECK_EQ(second.delivered.load(), 1);
 }
 
+#endif  // LHS_TEST_DLL_LINKAGE
+
 void accepted_after_teardown(littletest::test_runner* __lt_tr__,
                              const char* __lt_name__, bool shutdown) {
     fixture fx;
@@ -855,6 +860,9 @@ LT_BEGIN_AUTO_TEST(external_adapter_suite, complete_snapshots_prune_retired_conn
     }
 LT_END_AUTO_TEST(complete_snapshots_prune_retired_connection_records)
 
+#ifndef LHS_TEST_DLL_LINKAGE
+// PE DLL allocations bind their own allocator imports. These cases run against
+// the installed static library, where this executable's override reaches them.
 LT_BEGIN_AUTO_TEST(external_adapter_suite, allocation_failure_read_batch_remains_owned_until_close)
     failed_direction_collection(__lt_tr__, __lt_name__, hd::io_op_kind::read);
 LT_END_AUTO_TEST(allocation_failure_read_batch_remains_owned_until_close)
@@ -923,6 +931,7 @@ LT_BEGIN_AUTO_TEST(external_adapter_suite, allocation_failure_due_timers_remain_
     LT_CHECK_EQ(first.delivered.load(), 1);
     LT_CHECK_EQ(second.delivered.load(), 1);
 LT_END_AUTO_TEST(allocation_failure_due_timers_remain_owned_until_close)
+#endif  // LHS_TEST_DLL_LINKAGE
 
 LT_BEGIN_AUTO_TEST(external_adapter_suite, exhausted_generation_fails_snapshot_and_shutdown_completes_once)
     fixture fx;