prisma-risk / tsoracle / 26409571283

95%

push

github

fix(paxos-toolkit)!: enforce PaxosRunner::start guard in release builds (#412)

PaxosRunner::start guarded against a double-start with a debug_assert!,
which compiles away in release. There a second start() silently overwrote
self.handle and orphaned the prior tick task, briefly running two tick
loops on one OmniPaxos handle — double BLE ticks and a double
outgoing_messages drain.

Mirror the host primitive that already learned this (StandaloneHost::start
returns Err(AlreadyRunning)): start now returns Result<(), AlreadyRunning>
with a runtime guard that runs before spawning either the tick task or its
outbound sender task, so a rejected call spawns nothing and leaves the live
task untouched.

StandaloneHost::start bridges the toolkit's AlreadyRunning onto its own and
now starts the runner before spawning the apply task, so a rejection cannot
orphan a freshly-spawned apply task. Remaining direct callers (toolkit
tests, the lifecycle integration test, and the paxos-piggyback example)
consume the new Result.

This is a breaking change to the PaxosRunner::start signature.

32 of 34 new or added lines in 2 files covered. (94.12%)

9349 of 9841 relevant lines covered (95.0%)

580386.27 hits per line