[joelteply]

Card 6b28a445, plan line 6 (every fast-path miss is loud). It builds on #5348 (c8011da). This serves fast minds: when a resident goes cold after a relaunch, the record says why, instead of blaming the page store.

The defect. A replacement now saves residents first (#5348), but three paths cannot save, and each lost the KV with no record:

• checkpoint_before_replacement returned Ok when the generation had already exited or paging was quarantined;
• retire_adopted skipped the checkpoint when paging was quarantined;
• retire_adopted returned Ok when the adopted engine was already dead.

The cold turn that followed reported no_page or page_on_disk_unconfirmed.

The change (new file slots/relaunch_discard.rs):

• Captured, then recorded at the observed death. While the old pool is still installed, the residents held without a confirmed save are captured as a PendingDiscard. A sent kill or signal is not a death, so the capture is recorded only when the death is observed:
  • Owned engine. checkpoint_before_replacement hands the capture to the endpoint, which holds it for that generation (DiscardLog's watch). EngineGeneration::observed_exit records it, or it is recorded at once if the exit was already observed. A generation that is already watched keeps its first capture, so re-entry never records twice. launch.rs is unchanged from canary.
  • Adopted engine. The capture rides the retirement custody next to retiring_adopted (LlamaServerProcess::retiring_discard). await_adopted_exit records it only when the exact process is seen gone, so a timed-out, cancelled or re-entered wait records nothing until then. A failed signal returns before custody, so its capture is dropped unrecorded. An engine already seen dead is recorded at once.
• Reported when recorded. Recording probes inference.kv_page.discarded_by_relaunch with the reason (engine_exited, paging_uncertain or adopted_engine_dead) and the count.
• The record lives on the endpoint. The pool is replaced along with the engine. Every admission takes its own page's record, so only the first turn after the relaunch is blamed on it. A cold turn then reports cause=discarded_by_relaunch and discard_reason.
• Bounded retention (DiscardLog). It keeps at most the latest discarding pool's slot count, oldest evicted first. One relaunch can't discard more minds than it had slots, so the latest is kept whole, and an empty capture evicts nothing. Forks die with their core and are not recorded, as in the ledger.

Tests:

• slots::tests::a_relaunch_records_unsaved_residents_only_at_the_observed_exit_and_once: through checkpoint_before_replacement with quarantined paging. Two attempts record nothing; the observed exit records only the unsaved mind, once; a re-entry after the exit adds nothing; the record survives the pool's replacement and is taken once.
• llama_server::adopted_retirement::tests::adopted_exit_wait_retains_custody_until_observed_exit (real child process): no loss is recorded after a cancelled poll or a zero-budget timeout, and the child's exit records it.
• slots::tests::discard_records_keep_one_pool_of_slots_across_generations.
• Not covered by a test: retire_adopted's failed-signal path, which needs a live-lane registry. There, signal_if_same returns an error before custody is set, so the capture is dropped, by reading of adopted_retirement.rs.

No file touched is over 1,000 lines (turn_admission.rs ends at 875).

Also deleted: two module_wiring_guard entries (PageFaultOnly, RecorderModule) naming modules that #5367 deleted. Every PR's core job failed on them.

Measured

CI at 84505ee: engine job 120816176947 reports 1218 passed, 0 failed, with all three new tests ok by name. Core job 120816176934 reports 2582 passed, 0 failed, warnings 15 (baseline 15).

Source and CI only; nothing was built on IntelMac. After deploy (owner Cormac): on the next forced or dead-engine relaunch on any node, inference.kv_page.discarded_by_relaunch names the count, and the affected residents' cold turns carry cause=discarded_by_relaunch.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FRQWzgSfo79JtnwZywHKrE

[joelteply]

Re-review #5357 exact 5d8e4c2: the retention regression is now order-independent; that finding is closed. The retirement receipt blocker remains: launch.rs calls void kill_child() then discarded.commit() before exit observation. Adopted retirement likewise commits before await_adopted_exit succeeds. A successful signal (or void helper that can log signal failure) is not evidence of actual death. Please retain PendingDiscard with the existing retirement custody until observed exit, including cancellation/re-entry, and test failed signal / cancelled wait produces no completed-loss receipt before exit. The regenerated TS doclink is fine; no duplicate edit from me.