Markk116/urus - urus - Kalsbeek.git

3 Commits

Include renames

Author SHA1 Message Date

Author	SHA1	Message	Date
Claude	8f0da2a806	feat(pubsub,channels)!: handles are addresses — bus, hub and session registries are supervised children smarm 0.7 (415effb, "lifetime is the actor's — refs are addresses") removed the rule these three actors were built on: a GenServerRef no longer owns the server, the loop holds its own inbox sender, and the inbox never closes when the last ref drops. urus's pubsub table, channel hub bus and session registries were still governed by that deleted rule — PubSub::new() spawned the table and the handle owned its life — so nothing commanded them to stop. What still terminated a run was the root-exit sweep, racing the drain: shutdown_with_open_chat_terminates and channels_wire::shutdown_with_open_channel_terminates failed 4 times in 25 --all-features runs with "serve did not return: ... outlived the drain: Timeout". Zero in 10 full-suite runs after this change. The fix is not a supervisor wrapped around the old shape. Every gotcha in this area descended from constructors that spawn: PubSub::new(), ChannelHub::new() and PrefixRouter::channel_session() all started actors, which forced in-runtime-only construction, which forced the Arc<OnceLock<..>> lazy-init from the first handler, which forced the "cell must not be static" and "a relay must never hold a PubSub clone" rules. Five documented rules propping up one inverted dependency. So: description is separated from instantiation. - PubSub<M> is a name, not a GenServerRef: const-constructible, Copy, spawns nothing, valid outside the runtime and in a static. Operations resolve through the registry per call, so a table restarted by its supervisor is reached transparently (one lookup per broadcast — bench before caching a ref, which would go stale across exactly the restart the supervisor exists to perform). PubSub::new() is gone; PubSub::new(name) + PubSub::child() replace it. - ChannelHub::new(bus, router) returns (hub, Vec<ChildSpec>) — the bus table plus one registry per session route. Returning both is the point: a hub whose children were never started compiles and fails on the first join, so the vec is not left behind a method you can forget to call. #[must_use]. - channel_session gains a registry name; each session registry is separately named and separately supervised. - serve_with/serve_with_shutdown take a Vec<ChildSpec> of app children and build the root as RestForOne[..app children, endpoint]. They start before the endpoint and, shutdown being ordered in reverse, stop after it has drained, so a request still in flight can reach the bus. RestForOne because a bus crash leaves live sockets addressing a table that no longer knows them. - Deleted: the Arc<OnceLock> idiom from both examples and both test pipelines, and the module rules that existed only to hand-manage a refcount. Known cost, not fixed here: channel_session("session:*", "chat-sessions", f) puts two unrelated string literals side by side and nothing catches a transposition — a RegistryName newtype is the obvious follow-up. Tests: 111 lib + 50 integration + 2 doc green, clippy clean, 10/10 full-suite runs. Unit tests poll for name binding before use — smarm's start-order-is-not- start-readiness gap; real apps don't hit it, since a handler only runs once a connection has been accepted.	2026-08-20 14:49:23 +00:00
Claude	b37888ec2c	docs+examples: v0.3 endpoint API; crud converted to the app-owns-the-tree shape - crud is now the demonstrator: app owns smarm runtime + root supervisor, store actor and urus::endpoint as ordered siblings (store first, so reverse-order shutdown drains HTTP before stopping the store), Shutdown::Infinity on the endpoint, shutdown via rt.handle().request_shutdown(root_sup) from the stdin thread. Deletes two kludges the old shape forced: * static OnceLock<Sender> spawn-on-first-use -> a supervised child that self-registers a typed Name; handlers use smarm::send per request and turn 'between incarnations' into a 503 instead of panicking on a dropped store. * static SHUTTING_DOWN AtomicBool + 250ms recv_timeout poll in the store loop and in the SSE ticker -> a plain park; the tree stops both. Smoke-tested live: CRUD round-trips, SSE stream, clean drain with the stream open, port closed after. - Other examples stay short and on serve, updated for the split config (serve_with(cfg, smarm::Config, pipe) / serve_with_shutdown(..., signal)). plain_serve's URUS_SCHED_THREADS now builds a smarm::Config. ws_chat's doc block explains the OnceLock is a serve-only workaround and points at crud for the clean shape. - README: new 'Your Own Supervision Tree' section (endpoint as the real API), graceful shutdown reframed as the serve*-only path, Config table loses scheduler_threads and gains name, PubSub rule 1 notes the supervised-sibling alternative. 111 lib + 50 integration + 2 doc tests green; clippy clean.	2026-08-20 13:20:28 +00:00
Claude (sandbox)	8bdec97842	feat(config): optional TOML config loading behind `config-file` feature A file-based way to set tuning knobs without recompiling. urus is a library, so it never presumes a config path or reads the environment — the binary hands the text in: - Config::with_toml_str(&str) -> Result<Config, ConfigError>: sparse overlay onto an existing Config (built with the addr the binary chose). Only keys present are applied; durations are integer seconds; unknown keys are a hard error (deny_unknown_fields) so a typo is loud, not a silent no-op. - Scope: the four slowloris knobs (head_timeout_secs, body_timeout_secs, body_burst_bytes, body_stall_timeout_secs). Migrating the rest of Config into the file is a separate, additive job — TomlOverrides just grows. - Feature `config-file = ["dep:serde", "dep:toml"]`; the optional serde dep gains the derive feature. The default build is unchanged (deps + code are all gated). - examples/serve_toml.rs (required-features = ["config-file"]): a `--config PATH` demo with no presumed default location. plain_serve and its env vars are left untouched. Tests (feature-gated): empty keeps defaults, partial overrides only named, full overrides all, unknown key errors, malformed errors. 84 lib with the feature / 79 without; clippy --lib clean both ways; e2e smoke serves 200 from a file and rejects an unknown key loudly.	2026-08-12 13:41:57 +00:00

8f0da2a806

feat(pubsub,channels)!: handles are addresses — bus, hub and session registries are supervised children

smarm 0.7 (415effb, "lifetime is the actor's — refs are addresses") removed the
rule these three actors were built on: a GenServerRef no longer owns the server,
the loop holds its own inbox sender, and the inbox never closes when the last ref
drops. urus's pubsub table, channel hub bus and session registries were still
governed by that deleted rule — PubSub::new() spawned the table and the handle
owned its life — so nothing commanded them to stop. What still terminated a run
was the root-exit sweep, racing the drain: shutdown_with_open_chat_terminates and
channels_wire::shutdown_with_open_channel_terminates failed 4 times in 25
--all-features runs with "serve did not return: ... outlived the drain: Timeout".
Zero in 10 full-suite runs after this change.

The fix is not a supervisor wrapped around the old shape. Every gotcha in this
area descended from constructors that spawn: PubSub::new(), ChannelHub::new() and
PrefixRouter::channel_session() all started actors, which forced in-runtime-only
construction, which forced the Arc<OnceLock<..>> lazy-init from the first handler,
which forced the "cell must not be static" and "a relay must never hold a PubSub
clone" rules. Five documented rules propping up one inverted dependency. So:
description is separated from instantiation.

- PubSub<M> is a name, not a GenServerRef: const-constructible, Copy, spawns
  nothing, valid outside the runtime and in a static. Operations resolve through
  the registry per call, so a table restarted by its supervisor is reached
  transparently (one lookup per broadcast — bench before caching a ref, which
  would go stale across exactly the restart the supervisor exists to perform).
  PubSub::new() is gone; PubSub::new(name) + PubSub::child() replace it.
- ChannelHub::new(bus, router) returns (hub, Vec<ChildSpec>) — the bus table plus
  one registry per session route. Returning both is the point: a hub whose
  children were never started compiles and fails on the first join, so the vec is
  not left behind a method you can forget to call. #[must_use].
- channel_session gains a registry name; each session registry is separately
  named and separately supervised.
- serve_with/serve_with_shutdown take a Vec<ChildSpec> of app children and build
  the root as RestForOne[..app children, endpoint]. They start before the
  endpoint and, shutdown being ordered in reverse, stop after it has drained, so
  a request still in flight can reach the bus. RestForOne because a bus crash
  leaves live sockets addressing a table that no longer knows them.
- Deleted: the Arc<OnceLock> idiom from both examples and both test pipelines,
  and the module rules that existed only to hand-manage a refcount.

Known cost, not fixed here: channel_session("session:*", "chat-sessions", f) puts
two unrelated string literals side by side and nothing catches a transposition —
a RegistryName newtype is the obvious follow-up.

Tests: 111 lib + 50 integration + 2 doc green, clippy clean, 10/10 full-suite
runs. Unit tests poll for name binding before use — smarm's start-order-is-not-
start-readiness gap; real apps don't hit it, since a handler only runs once a
connection has been accepted.

2026-08-20 14:49:23 +00:00

Claude

b37888ec2c

docs+examples: v0.3 endpoint API; crud converted to the app-owns-the-tree shape

- crud is now the demonstrator: app owns smarm runtime + root supervisor,
  store actor and urus::endpoint as ordered siblings (store first, so
  reverse-order shutdown drains HTTP before stopping the store),
  Shutdown::Infinity on the endpoint, shutdown via
  rt.handle().request_shutdown(root_sup) from the stdin thread.
  Deletes two kludges the old shape forced:
    * static OnceLock<Sender> spawn-on-first-use -> a supervised child
      that self-registers a typed Name; handlers use smarm::send per
      request and turn 'between incarnations' into a 503 instead of
      panicking on a dropped store.
    * static SHUTTING_DOWN AtomicBool + 250ms recv_timeout poll in the
      store loop and in the SSE ticker -> a plain park; the tree stops
      both. Smoke-tested live: CRUD round-trips, SSE stream, clean drain
      with the stream open, port closed after.
- Other examples stay short and on serve*, updated for the split config
  (serve_with(cfg, smarm::Config, pipe) / serve_with_shutdown(..., signal)).
  plain_serve's URUS_SCHED_THREADS now builds a smarm::Config.
  ws_chat's doc block explains the OnceLock is a serve*-only workaround
  and points at crud for the clean shape.
- README: new 'Your Own Supervision Tree' section (endpoint as the real
  API), graceful shutdown reframed as the serve*-only path, Config table
  loses scheduler_threads and gains name, PubSub rule 1 notes the
  supervised-sibling alternative.

111 lib + 50 integration + 2 doc tests green; clippy clean.

2026-08-20 13:20:28 +00:00

Claude (sandbox)

8bdec97842

feat(config): optional TOML config loading behind config-file feature

A file-based way to set tuning knobs without recompiling. urus is a
library, so it never presumes a config path or reads the environment — the
binary hands the text in:

- Config::with_toml_str(&str) -> Result<Config, ConfigError>: sparse overlay
  onto an existing Config (built with the addr the binary chose). Only keys
  present are applied; durations are integer seconds; unknown keys are a
  hard error (deny_unknown_fields) so a typo is loud, not a silent no-op.
- Scope: the four slowloris knobs (head_timeout_secs, body_timeout_secs,
  body_burst_bytes, body_stall_timeout_secs). Migrating the rest of Config
  into the file is a separate, additive job — TomlOverrides just grows.
- Feature `config-file = ["dep:serde", "dep:toml"]`; the optional serde dep
  gains the derive feature. The default build is unchanged (deps + code are
  all gated).
- examples/serve_toml.rs (required-features = ["config-file"]): a `--config
  PATH` demo with no presumed default location. plain_serve and its env
  vars are left untouched.

Tests (feature-gated): empty keeps defaults, partial overrides only named,
full overrides all, unknown key errors, malformed errors. 84 lib with the
feature / 79 without; clippy --lib clean both ways; e2e smoke serves 200
from a file and rejects an unknown key loudly.

2026-08-12 13:41:57 +00:00