v0.19 more porting: basics of actor system and postgres driver #1483

vyzo · 2026-09-02T22:06:30Z

vyzo commented

2026-09-02 22:06:30 +00:00

assisted by ds4 flash on the spark and chatgpt sol.

vyzo added 6 commits

2026-09-02 22:06:30 +00:00

port std/net/sasl from v0.19-WIP b254388fa7

std/net/sasl: add type signatures to all procedures and structs c38a423f19

std/net/sasl: rename scram-context to ScramContext 4363244e40

std/net/sasl: use dot notation for struct accessors and mutators 7891e39ee9

std/net/sasl: replace struct-instance-init! with direct slot assignment in ScramContext constructor 49fc7c5823

std/net/sasl: use ScramContext constructor macro instead of make-ScramContext 65748f2d35

vyzo changed title from ~~WIP: v0.19 more porting: postgres driver~~ to WIP: v0.19 more porting: basics of actor system and postgres driver

2026-09-03 14:29:10 +00:00

vyzo added 27 commits

2026-09-04 13:10:33 +00:00

rename actor-nonce to actor-seqno 04edbf7248

remove seqno altogether 35bdc9b1a4

ensemble is in TODO status again 13a06c590a

move current-time-seconds d3d3653444

build-spec: ensemble is todo 450777f78a

gerbil-mode 684e1c374f

actor preliminaries 85ed47e225

std/actor: add actor package to stdlib b4aef9aa5e

std/actor/interaction: match protocol in ->>> reply envelope 9f09167f4a

std/actor/interaction: use equal? for protocol match (string comparison) bf8b4155a5

std/actor/interaction: add protocol matching support to <- 0ae7fc6f7f

make protocol specification mandatory in envelope reaction. c75c44e00a

it is a security issue otherwise, as the host authorizes based
on the protocol.

std/actor/state: add actor-local-host? 499a9e3400

std/actor/interaction-test: basic send/receive test 90dffa2333

agents 2de95b5bf2

protocol for structured interaction 5c4f43ea80

std/actor/interaction-test: add timeout test case 806946eb73

std/actor/interaction: fix expire computation in ->>> for flonum timeout 1d3c01ce26

std/actor/interaction-test: test flonum timeout (0.5) 5ab4007ace

std/actor/interaction-test: import ./api instead of :std/actor 3e4a9b1bfc

std/actor/interaction-test: add actor loop with exit test case c23a750370

explicitly support reply continuations in <- ee7a1889f7

add ---> 9eeae46623

gerbil-mode 5eb146643d

std/actor/interaction-test: add reply continuation test with ---> 56208cb228

std/actor/interaction-test: reorder ---> test case last 79a5b5f5fd

std/actor/proto-test: add defcall-actor, ping-actor, shutdown-actor test 6dfd376e13

vyzo added 16 commits

2026-09-04 19:05:48 +00:00

wip: port postgresql-driver to v0.19 actor + IO APIs 7470aca4da

remove unused connection/statement structs, with-driver/get-driver utilities; work with driver directly 3944a8a53b

wip: add type signatures, keyword args, Local return annotation to postgresql-connect! 2a6487b96d

fix indentation in postgresql-connect! and start-driver! 70378e082e

wrap sock.close with ignore-errors in catch; remove blank lines 1922d733cb

wrap sock.close with ignore-errors in finally block 987aa61579

remove buffer cache; let IO system handle buffering 04b410a725

use predefined small-buffer-size from io api 9dd49227ef

rename postgresql-connect! to start-postgresql-driver! 76a359720d

use shutdown-actor for postgresql-close! 23278e7a81

fix arg indentation in start-postgresql-driver! 0f53404baa

change ->>> to ->> in postgresql-driver fe5fb1bd3d

use defcall-actor for driver interactions; add Local type to driver args 0d03463545

add !token type annotation; remove manual !token? check 258b2c8d2a

rename postgresql-message/RowDescription/CommandComplete to PGMessage/PGRowDescription/PGCommandComplete a0f5e8d492

use struct-out for PG* exports 7812080bf2

vyzo added 2 commits

2026-09-04 19:56:46 +00:00

rename Local->LocalActor, Group->ActorGroup in std/actor; update all std references db76d4b018

change -> ->> ->>> dest type to Peer; remove thread? checks; update tests 4831336828

vyzo added 2 commits

2026-09-05 11:50:45 +00:00

add std/time/date module with libc FFI bindings b8093b105a

add tests for std/time/date a0b1a64538

vyzo added 1 commit

2026-09-05 18:53:33 +00:00

std/time/date module c7ddf36e7b

vyzo added 2 commits

2026-09-06 00:33:36 +00:00

db/postgresql: finish v0.19 port 800a6d8314

remove unused notices slot from postgresql-command 69f04e3aa5

vyzo added 2 commits

2026-09-06 13:14:02 +00:00

db/postgresql: fix query iteration and add tests cf92f30f3e

indentaion 147b82aeee

vyzo changed title from ~~WIP: v0.19 more porting: basics of actor system and postgres driver~~ to v0.19 more porting: basics of actor system and postgres driver

2026-09-06 13:14:53 +00:00

vyzo requested review from fare

2026-09-06 13:15:02 +00:00

vyzo commented

2026-09-06 13:15:16 +00:00

this is ready for review now.

vyzo added 3 commits

2026-09-06 14:23:15 +00:00

delete old files 255b7c54ac

db/connpool: port connection pool to v0.19 e776589d58

db/connpool: refine driver and timeout handling d9da644e79

fare commented

2026-09-06 19:22:35 +00:00

I'll give a manual look, but here's what GPT 5.6 Sol (High) says:

I reviewed the current head, d9da644e79. This is a fairly large PR—61 commits and 82 files—so I concentrated on the newly ported actor machinery, connection pool and time/date code, and skimmed the PostgreSQL changes. (cons.io git)

I would request changes. I see four fairly serious bugs and two lesser ones:

[P1] Expired actor messages are never removed from the mailbox. In generate-receive-envelope-e, the expired case is just (loop), whereas a successfully matched envelope calls thread-mailbox-extract-and-rewind. (cons.io git) Gambit's semantics matter here: thread-mailbox-next explicitly leaves the message in the mailbox; only thread-mailbox-extract-and-rewind removes the last examined message. (Gambit Scheme)

So a late reply to a timed-out interaction becomes permanent garbage. Every later selective receive can encounter it again after the cursor is rewound. Repeated timeouts can therefore cause unbounded mailbox growth and progressively slower receives.

I think the expired arm needs roughly:
```
(begin
  (thread-mailbox-extract-and-rewind)
  (loop))
```
plus a regression test with a late reply.
[P1] Direct numeric <- / << timeouts appear broken by a typo. reaction-timeout says:
```
(seconds->time (+ (##current-time-point timeo)))
```
i.e. timeo is being passed to ##current-time-point, rather than added to its result. This looks like it simply wants:
```
(seconds->time (+ (##current-time-point) timeo))
```
The generated receive path feeds real-valued timeout: arguments through this function. (cons.io git)

The tests don't catch this because the ->> tests ultimately pass an already-constructed time object to <-; there is no direct (<- timeout: 0.5 ...) test. (cons.io git)
[P1] ->>> computes relative deadlines incorrectly, especially for fractional timeouts. It currently does:
```
(+ (current-time-seconds) (exact (ceiling timeo)))
```
but current-time-seconds itself is floor(##current-time-point). (cons.io git)

Thus, at time 100.9, a timeout of 0.5 expires at 101, i.e. only 0.1 seconds later. A timeout of 5 seconds actually lasts between roughly 4 and 5 seconds. The new 0.5 test merely checks that it eventually times out, so it cannot catch this. (cons.io git)

I think there should be a precise local deadline based on ##current-time-point, distinct from the integer Unix-second expiration carried in the envelope. If the protocol requires integer expiry, doing ceiling should happen after adding the precise current time, not separately.
[P1] A closed connection pool can be resurrected by a late put. connection-pool-close closes both idle and checked-out connections, replaces cp.connect with an erroring procedure, and empties conns/out. But connection-pool-put unconditionally puts its connection back into cp.conns. And connection-pool-get checks cp.conns before invoking cp.connect. (cons.io git)

So:
```
A gets conn
close(pool)        ; closes conn, clears lists
A puts conn        ; closed conn goes back into cp.conns
B gets pool        ; receives closed conn
```
The new close test gets very close to this case—it deliberately closes a pool with a checked-out connection—but never returns that connection after closing. (cons.io git)

I'd give the pool an explicit closed? state. get should check it first, and put after closure should at least drop/close the returned connection rather than enqueue it.
[P2] envelope-expired? assumes every Options has an expiration, although the type explicitly says otherwise. Options.expire is optional with default #f, alongside independent continue and auth fields, but:
```
(and e.options
     (<= e.options.expire ...))
```
compares #f numerically whenever an envelope has options but no expiration. (cons.io git)

At minimum:
```
(and e.options
     e.options.expire
     (<= e.options.expire ...))
```
This may not be exercised much while ensemble support is back in TODO state, but the data model explicitly permits such envelopes.
[P2] string->date silently ignores strptime failure. The C wrapper deliberately throws away strptime's return value, then string->date returns the Date structure unconditionally. (cons.io git) That means malformed input—or possibly partially consumed input—produces whatever struct tm happens to contain instead of reporting a parse failure.

I would have the wrapper preserve whether strptime returned NULL and probably also require complete input consumption for string->date.

The first one is the nastiest to me: it's a subtle selective-receive leak that could survive ordinary testing for a long time. The pool-close race is also a definite lifecycle bug. The two timeout calculations deserve direct timing tests rather than merely checking that a Timeout? is eventually raised.

I didn't spot anything comparably alarming in the PostgreSQL query port itself from this pass.

I'll give a manual look, but here's what GPT 5.6 Sol (High) says: I reviewed the current head, `d9da644e79`. This is a fairly large PR—61 commits and 82 files—so I concentrated on the newly ported actor machinery, connection pool and time/date code, and skimmed the PostgreSQL changes. ([cons.io git][1]) I would **request changes**. I see four fairly serious bugs and two lesser ones: 1. **[P1] Expired actor messages are never removed from the mailbox.** In `generate-receive-envelope-e`, the expired case is just `(loop)`, whereas a successfully matched envelope calls `thread-mailbox-extract-and-rewind`. ([cons.io git][2]) Gambit's semantics matter here: `thread-mailbox-next` explicitly *leaves the message in the mailbox*; only `thread-mailbox-extract-and-rewind` removes the last examined message. ([Gambit Scheme][3]) So a late reply to a timed-out interaction becomes permanent garbage. Every later selective receive can encounter it again after the cursor is rewound. Repeated timeouts can therefore cause unbounded mailbox growth and progressively slower receives. I think the expired arm needs roughly: ```scheme (begin (thread-mailbox-extract-and-rewind) (loop)) ``` plus a regression test with a late reply. 2. **[P1] Direct numeric `<-` / `<<` timeouts appear broken by a typo.** `reaction-timeout` says: ```scheme (seconds->time (+ (##current-time-point timeo))) ``` i.e. `timeo` is being passed to `##current-time-point`, rather than added to its result. This looks like it simply wants: ```scheme (seconds->time (+ (##current-time-point) timeo)) ``` The generated receive path feeds real-valued `timeout:` arguments through this function. ([cons.io git][2]) The tests don't catch this because the `->>` tests ultimately pass an already-constructed time object to `<-`; there is no direct `(<- timeout: 0.5 ...)` test. ([cons.io git][4]) 3. **[P1] `->>>` computes relative deadlines incorrectly, especially for fractional timeouts.** It currently does: ```scheme (+ (current-time-seconds) (exact (ceiling timeo))) ``` but `current-time-seconds` itself is `floor(##current-time-point)`. ([cons.io git][2]) Thus, at time `100.9`, a timeout of `0.5` expires at `101`, i.e. only 0.1 seconds later. A timeout of 5 seconds actually lasts between roughly 4 and 5 seconds. The new `0.5` test merely checks that it eventually times out, so it cannot catch this. ([cons.io git][4]) I think there should be a precise local deadline based on `##current-time-point`, distinct from the integer Unix-second expiration carried in the envelope. If the protocol requires integer expiry, doing `ceiling` should happen **after adding** the precise current time, not separately. 4. **[P1] A closed connection pool can be resurrected by a late `put`.** `connection-pool-close` closes both idle and checked-out connections, replaces `cp.connect` with an erroring procedure, and empties `conns`/`out`. But `connection-pool-put` unconditionally puts its connection back into `cp.conns`. And `connection-pool-get` checks `cp.conns` *before* invoking `cp.connect`. ([cons.io git][5]) So: ```text A gets conn close(pool) ; closes conn, clears lists A puts conn ; closed conn goes back into cp.conns B gets pool ; receives closed conn ``` The new close test gets very close to this case—it deliberately closes a pool with a checked-out connection—but never returns that connection after closing. ([cons.io git][4]) I'd give the pool an explicit `closed?` state. `get` should check it first, and `put` after closure should at least drop/close the returned connection rather than enqueue it. 5. **[P2] `envelope-expired?` assumes every `Options` has an expiration, although the type explicitly says otherwise.** `Options.expire` is optional with default `#f`, alongside independent `continue` and `auth` fields, but: ```scheme (and e.options (<= e.options.expire ...)) ``` compares `#f` numerically whenever an envelope has options but no expiration. ([cons.io git][6]) At minimum: ```scheme (and e.options e.options.expire (<= e.options.expire ...)) ``` This may not be exercised much while ensemble support is back in TODO state, but the data model explicitly permits such envelopes. 6. **[P2] `string->date` silently ignores `strptime` failure.** The C wrapper deliberately throws away `strptime`'s return value, then `string->date` returns the `Date` structure unconditionally. ([cons.io git][7]) That means malformed input—or possibly partially consumed input—produces whatever `struct tm` happens to contain instead of reporting a parse failure. I would have the wrapper preserve whether `strptime` returned NULL and probably also require complete input consumption for `string->date`. The first one is the nastiest to me: it's a subtle selective-receive leak that could survive ordinary testing for a long time. The pool-close race is also a definite lifecycle bug. The two timeout calculations deserve direct timing tests rather than merely checking that a `Timeout?` is eventually raised. I didn't spot anything comparably alarming in the PostgreSQL query port itself from this pass. [1]: https://git.cons.io/mighty-gerbils/gerbil/pulls/1483 "#1483 - v0.19 more porting: basics of actor system and postgres driver - mighty-gerbils/gerbil - cons.io git" [2]: https://git.cons.io/mighty-gerbils/gerbil/src/commit/d9da644e79efd22e44178fd05355fafe3dd42d04/src/std/actor/interaction.ss "gerbil/src/std/actor/interaction.ss at d9da644e79efd22e44178fd05355fafe3dd42d04 - mighty-gerbils/gerbil - cons.io git" [3]: https://gambitscheme.org/4.9.7/manual/ "Gambit, a portable implementation of Scheme" [4]: https://git.cons.io/mighty-gerbils/gerbil/pulls/1483/files "#1483 - v0.19 more porting: basics of actor system and postgres driver - mighty-gerbils/gerbil - cons.io git" [5]: https://git.cons.io/mighty-gerbils/gerbil/src/commit/d9da644e79efd22e44178fd05355fafe3dd42d04/src/std/db/connpool.ss "gerbil/src/std/db/connpool.ss at d9da644e79efd22e44178fd05355fafe3dd42d04 - mighty-gerbils/gerbil - cons.io git" [6]: https://git.cons.io/mighty-gerbils/gerbil/src/commit/d9da644e79efd22e44178fd05355fafe3dd42d04/src/std/actor/message.ss "gerbil/src/std/actor/message.ss at d9da644e79efd22e44178fd05355fafe3dd42d04 - mighty-gerbils/gerbil - cons.io git" [7]: https://git.cons.io/mighty-gerbils/gerbil/src/commit/d9da644e79efd22e44178fd05355fafe3dd42d04/src/std/time/date.ss "gerbil/src/std/time/date.ss at d9da644e79efd22e44178fd05355fafe3dd42d04 - mighty-gerbils/gerbil - cons.io git"

vyzo commented

2026-09-06 19:30:14 +00:00

ok i shall fix with the help of my friend sol max.

fare requested changes

2026-09-06 19:45:50 +00:00

fare left a comment

My admittedly cursory review didn't find much.

But in general, I think the tests should include more tests about failure cases and recovery from them.

My admittedly cursory review didn't find much. But in general, I think the tests should include more tests about failure cases and recovery from them.

src/std/AGENTS.md Outdated

					
				@ -40,6 +40,12 @@ If you want to run all the tests in a directory and

				it's subdirectory recursively, do `./build.sh test your-directory/...`.

				If you want to run all tests in the stdlib do `./build.sh test std/...`

				## Runing a build-local gxi