Repository navigation
plugin-loader: a plugin's open and close run only on the permanent FFI workers - #745
Merged
MattJackson merged 17 commits intoOct 11, 2026
Merged
Conversation
…the permanent FFI workers Every validate, open, refresh, retire, close and ready crossing, of every kind, compiled in or dropped in, now enters plugin code on an ffi_thread worker from Instance::cross_gated, carrying the crossing's serving unit, dispatcher-worker mark and tokio runtime with it. The door function, and a plane's hydrate, start, claims and admission, are routed too. Each routed FFI call asserts in debug builds that it runs on a permanent worker. Tests: open and close from a throwaway thread (RED: the assertion panicked it), the assertion tripping off the workers, and a dropped-in store opened, used, closed and unloaded 200 times across 8 exiting threads.
…ir own With every lifecycle crossing on the FFI pool, any crate test can take the idle worker between the reuse and panic-survival tests' two calls. They now run the same code (on_plugin_thread_in) against a private pool.
promote into
|
| gate | row | detail |
|---|---|---|
| construction | one-pick-site |
3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:298; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8 |
| kind-isolation | kind-isolation:deps |
3 finding(s), 93 shipped edge instance(s) over 30 class(es), 93 declaration(s); 56 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w |
| kind-isolation | kind-isolation:test-deps |
3 finding(s), 35 test edge instance(s) over 21 class(es), 35 declaration(s); 20 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge cleanliness -> legacy busbar-core-admin -> busbar-a2a is a test edge |
| kind-isolation | kind-isolation:law0 |
11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabular |
| kind-isolation-ship | kind-isolation:deps |
10 finding(s) over 93 shipped edge(s): ship-edge kernel -> hooks busbar-kernel -> busbar-hook-ranking is 'not-allowed': the architecture grants no kernel -> hooks edge, and the ship criterion is the a |
| kind-isolation-ship | kind-isolation:test-deps |
10 finding(s) over 35 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship |
| kind-isolation-ship | kind-isolation:law0 |
11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabular |
| kind-isolation-ship | kind-isolation:faces |
2 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is |
| kind-isolation-ship | kind-isolation:legacy-drain |
3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier) |
| ship-ready | ship-ready:ship-twin |
'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is |
| structure-lint | structure-lint:plane-dup:unledgered |
22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger |
Judged against base 17b55f973: 0 new red, 0 worse, 5 standing (excused).
tests passed: 23081, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/38097361858 . Artifact verdict-f06008ddedee2dd8b2199063e8214d7de24d4043 (failures.json, junit.xml, raw.log; 90 days).
…mment The comment added in dispatch/plugin.rs spelled thread-local storage as "TLS". `tls` is a transport instance word, so the line added one hit to busbar-plugin-loader x transport, a cell already over its [[law0]] ceiling, and kind-isolation:law0 (and its ship twin) rose 11 -> 12. "thread-local" says the same thing without naming a transport. Not proved on a Latchkey runner: the dev run budget is spent (RUN_CAP). Reasoned from the diff: it is the only counted token the PR adds to plugin-loader (the crate's TLS count rose by exactly this one line). The PR's CI is the proof.
…not a new extern "C"
kind-isolation:law0 (and its ship twin) rose 11 -> 12 because the new
lifecycle_worker_tests.rs wrote `extern "C" fn a_slot`. The instance scan
reads every whole string literal lowercased, and `c` is the registered
secret instance `busbar-secret-c` (plugins.yaml alias `c`), so the ABI
string was one more busbar-plugin-loader x instance:secret hit against a
ceiling of 111. The earlier TLS rewording removed a token no needle counts
(no transport declares `tls`), which is why the figure did not move.
Ruling: the ceiling stays. BUSBAR-1.6.0.md:2092 (Law 9) pins each ceiling
at today's measured value and "refuses every rise from that moment", and
:3334 says never bless a ratchet. The test keeps its slot and its
assertions; it spells the ABI through `c_abi!`, the one spelling
dispatch_tests.rs already keeps for exactly this reason ("each spelling of
its literal is a Law 0 hit"), now re-exported for the crate's tests.
Not proved on a Latchkey runner: the dev run budget is spent (RUN_CAP).
The PR's CI is the proof.
…en-close-permanent-workers
MattJackson
added this pull request to the merge queue
Oct 11, 2026
MattJackson
added a commit
that referenced
this pull request
Oct 12, 2026
- plugin-loader lib.rs: the raw JSON lane stays deleted. predev's #745 worker asserts are kept in dlopen_on_worker, dlclose_on_worker and ffi_guard_confined; its set_log_sink assert went with wire_up and hostlog. - xtask population FLOOR: 938, re-measured on the merged tree (predev 941 less the three cold-auth files), with predev's one_file_short plant note.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
plugin-loader: a plugin's open and close run only on the permanent FFI workers