In response to clog notification from remote ames, we were sending a
%cork to clean up the flow. However, the wire we were using had the /sys
prefix already stripped off. Here, we put it back in.
Start by killing subscription nonce 0, then work our way up instead of
down. We enhance the printf with a "total nonces" indicator so we can
still easily see the progress being made.
Previous +ap-doff kicked the agent repeatedly. We needed to kick
it only once. Now publisher agents clear their incoming subscription
state without the subscriber making lots of new subscriptions because
of repeated kicking.
+on-plea gets called in two very different ways:
1) handling request from local vane to send %plea to peer
2) handling %cork request from another ship, which our local ames has %pass'ed
to ourselves
In the second case, we shouldn't print misleadingly, or bind a duct in the ossuary.
+ap-nuke was not including the nonce, but should.
+ap-handle-peers was potentially including a zero nonce.
(The latter shouldn't have been possible, but there's a bug in +load
where sub-nonce.yoke gets initialized as 0 instead of 1.)
Gall tells ames to %cork flows for subscriptions it has closed.
Receiving a kick also closes a subscription, but gall wasn't issuing a
%cork in that case. We correct that here.
Inlines +mo-handle-ames-response's logic at its only callsite.
Without this, a ship would send a cork on a max of one flow per
recork timer, which could take years to clear for some ships.
This starts a hot loop of trying the next cork once one gets
positively acked.
The previous recork timer queued up %cork messages without sending them.
It also relied on making sure pump timers didn't get set for recork bones.
This was fragile.
The new design enqueues up to one new %cork message per ship during each
recork timer, based on the state of the flow. If the flow is closing but
there are no outstanding messages in it, then it needs to be recorked.
Flows will be recorked in ascending numerical order by bone.
The condition got butchered during refactor: instead of avoiding the creation
of pump timers during recork wake, it was setting them _exclusively_ during
recork wake.
* next/vere: (49 commits)
vere: bumps version
vere: bumps version
ci: enable release version mgmt
Revert "ci: reenable release mgmt"
ci: reenable release mgmt
ames: track/log bad ciphertext crashes separately
u3: %evil leaves no trace
vere: drop bail:evil events without error notifications
jets: bail:evil in ae-siv decryption jets
vere: make uv_cancel return code check explicit
u3: check for overflow in interpreter if guard page not present
build: default to using guard page
u3: return 0 from u3e_fault() if guard page cannot be protected
u3: control presence of guard page using macro
Revert "u3: check for road stack overflow on every nock %2 and %9"
build: make bench is phony
u3: failure to mprotect() the new guard page is fatal
u3: removes/disables obsolete road stack overflow checks
u3: account for guard page in cellblock allocation conditional
u3: bump road heap offset before allocating cellblock
...
This test started failing presumably somewhere during #5886. Testing
with a comet on the network, the test seems inaccurate: the comet can
communicate and be communicated to just fine.
