The one promise with no measurement: an execution survives the death of its process

[gplanchat]

What this closes

The Durable/LangGraph parity note ranks its own inventory by what has to be true before anything else is worth building, and line 1.2 sits at the top: interprocess crash recovery — never tested; the bench runs in a single process. It is the product's central promise and the only one with no measurement behind it. Every other bench in this repository runs in one process, and a single process cannot tell a journal from a leaked static: both survive a replay, and only one survives a SIGKILL.

What it does

Two real OS processes sharing nothing but a SQLite journal file.

1. Process A starts a workflow with two activities, runs the first, and SIGKILLs itself between the two awaits — the instant where the journal holds the first outcome and knows nothing of the second.
2. Process B, spawned fresh by the test, resumes the same execution id.

It asserts that B returns what an uninterrupted run returns, and that the first activity appears exactly once in the shared log. It was run by a process that no longer exists, and B was served its result by the journal rather than paying for it again.

SIGKILL and not exit(): no destructors, no shutdown functions, no chance to flush anything a real crash would have taken. The slice is an exec()ed script and not a fork() inside PHPUnit, because a fork shares the parent's memory image — which is exactly the class of leak this is looking for.

The verdict, and what it buys

Green. Per the bifurcation the note wrote before the measurement: the bare bench passing means that if the agent maquette later fails the same shape, the leak lives in the maquette's ~4 100 lines and the parity plan survives whole. Red here would have meant the core, and the plan stopping. It is green, so the plan stands.

Teeth

Checked by mutation, by hand rather than by a second test: point process B at an empty journal and the first activity runs twice, ['bench.first', 'bench.first', 'bench.second'] against the expected ['bench.first', 'bench.second']. The assertion falls, so it is measuring what it claims to.

Deliberately out of scope

A worker killed while an activity is in flight. That leaves a scheduled slot with no outcome, and what should answer it is a redelivery — a property of the activity transport and its retry policy, neither of which this bare setup has. Measured on the way here: with no transport worker and maxActivityRetries: 0, resuming such an execution waits forever, which is the correct behaviour for a runtime that has nobody to ask. It is a real question and it deserves its own bench, not a footnote in this one.

Notes for review

• Test-only. No production code changed; had any needed to, that would have been the finding and it would have got its own slice.
• The bench uses the DBAL store on a file-backed SQLite database, because two processes need a journal that outlives either of them. Same construction as DbalEventStoreConformanceTest, with a path instead of memory.
• Skips itself where posix or pdo_sqlite is missing.
• php-cs-fixer and phpstan clean on the three new files.