Repository navigation
Hold Windows generation custody through native-use disposition - #1121
Merged
Merged
Conversation
Guffawaffle
changed the base branch from
codex/windows-etw-stop-origin
to
main
October 30, 2026 04:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add the lifetime mechanism needed before an owned verifier or Node child can use a selected generation. One process-wide exclusive use retains the complete graph and ancestry. Disposal requests close; confirmed no-child or drained completion releases the use. Uncertainty, unfinished disposal or finalizer abandonment permanently quarantines the strongly rooted owner until process exit, preventing another use and avoiding premature SafeHandle finalization.
Synchronous selected-member handle consumption stays under the owner gate with AddRef/KeepAlive protection. Shared-position reads and hashing refuse during native use. No borrowed graph handle is part of a public runtime surface. Completion reports are trusted caller assertions, not OS probes: this change adds no actual operation dispatcher, does not qualify child drain, and leaves TryOpenInstalled false. Unknown effects still need a protected journal across restart; process exit is a residual release boundary, never permission to replay.
Signed head
91d55380873cda98ecebb3f8e27f1c9f42ad00e8, base631643792b2d3a3a72bccc3e76c147531635bcb0, tree5ff437c2645e0ce14881b13e22a854c2f74caa64. Independent full frozen-source and exact-head review by/root/native_v5_review: PASS. All 37 promoted source inputs and the complete six-file delta match the reviewed artifact. The intervening trace diagnostics are disjoint. This stacks above #1120 and needs fresh current-base review before final merge.Validation: pinned SDK 8.0.427 normal/fixture framework builds pass with zero warnings/errors. Retained evidence records 52 passing checks: 12 lifetime, 18 graph, three held-path/AddRef and 19 pure cases across temporary ReFS/NTFS roots. Fixed fixture subprocesses demonstrate uncertainty/abandonment keep files blocked until those exact processes exit; no actual operation child or positive OS-drain proof is claimed. Normal execute and new fixture routes remain helper_missing/exit 3. Patch SHA256
d0057867ca709c828f548a55ba050cf5ac49cb2fba3e411d53a0c5efb7641639; receiptec7c9a1cfce75ae375cb9dfb4a0f3e787221b97179767b22b77ee085495b05e0. Existing local bin/obj were preserved; hosted NativeAOT and full CI are required.The artifact README records a future fixed private GUI verifier mode in the already approved service executable. That is a proposal, with no new executable, dispatch, installation, service, identity, ACL, selection or trust-store change here. No governed Attempt or helper_missing clearance. Related to #997; release PR1113 and LexSona153 remain separate.