Let the backends own their teardown budget and no-input story

Each backend now publishes the teardown budget its own constants add up to and
the CLI waits out the longest one reachable on this platform, so a ConPTY
teardown is no longer reported as a render that did not stop. The absent-input
note comes from the backend that ran rather than from sys.platform, which was
wrong under the escape hatch on Windows. The POSIX grace probes the process
group each tick and ends early once it is spent, and the precondition check asks
each repository once for the whole list of previous frids.

Author: gorandodig

git_utils.py

@@ -331,6 +331,19 @@ def has_commit_for_frid(repo_path: Union[str, os.PathLike], frid: str, module_na
         return bool(_get_commit_with_frid(repo, frid, module_name))
 
 
+def frids_missing_commits(
+    repo_path: Union[str, os.PathLike], frids: list[str], module_name: Optional[str] = None
+) -> list[str]:
+    """The frids from `frids` with no commit in the repository, in the order given.
+
+    One Repo answers for the whole list. Asking per frid instead opens and closes a Repo
+    each time, and close() runs gc.collect() twice on win32, so a render resumed late paid
+    that for every functionality before it.
+    """
+    with Repo(repo_path) as repo:
+        return [frid for frid in frids if not _get_commit_with_frid(repo, frid, module_name)]
+
+
 def _get_base_folder_commit(repo: Repo) -> str:
     """Finds commit related to copy of the base folder."""
     return _get_commit_with_message(repo, BASE_FOLDER_COMMIT_MESSAGE)

plain2code.py

@@ -51,30 +51,20 @@
 )
 from plain2code_state import RunState
 from plain2code_telemetry import capture_crash, initialize_telemetry
-from render_machine.terminal_process import (
-    DRAIN_DEADLINE_SECONDS,
-    REAP_DEADLINE_SECONDS,
-    SIGTERM_GRACE_PERIOD_SECONDS,
-)
+from render_machine.terminal_process import teardown_budget_seconds
 from system_config import system_config
 from tui.plain2code_tui import Plain2CodeTUI
 from tui.plain_module_render_choice_tui import PlainModuleRenderChoiceTUI
 
 DEFAULT_TEMPLATE_DIRS = "standard_template_library"
 
 # The render thread is cancelled, never killed, so the wait after cancellation has to
-# outlast the teardown a script execution is entitled to: the SIGTERM grace runs to its
-# end before the SIGKILL, the killed group is then reaped, and the output reader is joined
-# on its own drain and reap budgets. A shorter wait lets the CLI exit mid-escalation and
-# leave a descendant that ignores TERM alive, so the bound is those budgets in sequence.
+# outlast the teardown a script execution is entitled to. Each backend adds its own phases
+# up and publishes the total, and the longest one reachable on this platform is what has to
+# be waited out: a shorter wait lets the CLI exit mid-escalation and leave a descendant that
+# ignores TERM alive.
 RENDER_THREAD_UNWIND_MARGIN_SECONDS = 1.0
-RENDER_THREAD_SHUTDOWN_TIMEOUT = (
-    SIGTERM_GRACE_PERIOD_SECONDS
-    + REAP_DEADLINE_SECONDS
-    + DRAIN_DEADLINE_SECONDS
-    + REAP_DEADLINE_SECONDS
-    + RENDER_THREAD_UNWIND_MARGIN_SECONDS
-)
+RENDER_THREAD_SHUTDOWN_TIMEOUT = teardown_budget_seconds() + RENDER_THREAD_UNWIND_MARGIN_SECONDS
 
 # Exceptions that represent expected, user-facing error conditions. They are
 # reported to the user directly and must never be sent to Sentry as crashes.

plain_modules.py

@@ -283,34 +283,44 @@ def _ensure_module_folders_exist(self, first_render_frid: str, render_conformanc
                 f"  codeplain {self.module_name}{plain_file.PLAIN_SOURCE_FILE_EXTENSION}"
             )
 
-    def _ensure_frid_commit_exists(
+    def _raise_for_missing_frid_commits(
         self,
-        frid: str,
+        previous_frids: list[str],
         first_render_frid: str,
         render_conformance_tests: bool,
     ) -> None:
         """
-        Ensure commit exists for a single FRID in both repositories.
+        Ensure commits exist for every previous FRID in both repositories.
+
+        Each repository is asked once for the whole list rather than once per FRID, and the
+        first FRID that is missing anywhere decides the error, in the order given.
 
         Args:
-            frid: The FRID to check
+            previous_frids: The FRIDs that should already have been rendered
             first_render_frid: The first FRID in the render range (for error messages)
             render_conformance_tests: Whether to check for conformance tests
 
         Raises:
-            MissingPreviousFridCommitsError: If the commit is missing
+            MissingPreviousFunctionalitiesError: If any commit is missing
         """
-        # Check in build folder
-        if not git_utils.has_commit_for_frid(self.module_build_folder, frid, self.module_name):
-            raise MissingPreviousFunctionalitiesError(
-                f"Cannot start rendering from functionality {first_render_frid} for module '{self.module_name}' because the implementation of the previous functionality ({frid}) hasn't been completed yet.\n\n"
-                f"To fix this, please render the missing functionality ({frid}) first by running:\n"
-                f"  codeplain {self.module_name}{plain_file.PLAIN_SOURCE_FILE_EXTENSION} --render-from {frid}"
+        missing_in_build = set(
+            git_utils.frids_missing_commits(self.module_build_folder, previous_frids, self.module_name)
+        )
+        missing_in_tests = set()
+        if render_conformance_tests:
+            missing_in_tests = set(
+                git_utils.frids_missing_commits(self.module_conformance_tests_folder, previous_frids, self.module_name)
             )
 
-        # Check in conformance tests folder (only if conformance tests are enabled)
-        if render_conformance_tests:
-            if not git_utils.has_commit_for_frid(self.module_conformance_tests_folder, frid, self.module_name):
+        for frid in previous_frids:
+            if frid in missing_in_build:
+                raise MissingPreviousFunctionalitiesError(
+                    f"Cannot start rendering from functionality {first_render_frid} for module '{self.module_name}' because the implementation of the previous functionality ({frid}) hasn't been completed yet.\n\n"
+                    f"To fix this, please render the missing functionality ({frid}) first by running:\n"
+                    f"  codeplain {self.module_name}{plain_file.PLAIN_SOURCE_FILE_EXTENSION} --render-from {frid}"
+                )
+
+            if frid in missing_in_tests:
                 raise MissingPreviousFunctionalitiesError(
                     f"Cannot start rendering from functionality {first_render_frid} for module '{self.module_name}' because the conformance tests for the previous functionality ({frid}) haven't been completed yet.\n\n"
                     f"To fix this, please render the missing functionality ({frid}) first by running:\n"
@@ -342,8 +352,7 @@ def ensure_previous_frid_commits_exist(self, render_range: list[str], render_con
         self._ensure_module_folders_exist(first_render_frid, render_conformance_tests)
 
         # Verify commits exist for all previous FRIDs
-        for prev_frid in previous_frids:
-            self._ensure_frid_commit_exists(prev_frid, first_render_frid, render_conformance_tests)
+        self._raise_for_missing_frid_commits(previous_frids, first_render_frid, render_conformance_tests)
 
     def get_required_module_by_name(self, module_name: str) -> PlainModule:
         for module in self.all_required_modules:

render_machine/_conpty.py

@@ -56,6 +56,9 @@
     DRAIN_DEADLINE_SECONDS,
     GRACE_TICK_SECONDS,
     HANDSHAKE_TIMEOUT_SECONDS,
+)
+from render_machine.terminal_process import NO_INPUT_NOTE as DEFAULT_NO_INPUT_NOTE
+from render_machine.terminal_process import (
     OWNER_PARENT,
     OWNER_READER,
     POLL_INTERVAL_SECONDS,
@@ -139,11 +142,33 @@
 FINALIZER_DEADLINE_SECONDS = 60.0
 FINALIZER_TICK_SECONDS = 0.5
 
+# What one full teardown of this backend may spend, phase by phase and in sequence. The
+# pipeline is longer than the POSIX one — a control byte has to be delivered before the
+# grace it earns, the job's membership is waited out, the writer is stopped, and each
+# join_reader() round is bounded twice: a join on the bound, then a cancel-and-join loop
+# under the same bound again. A caller waiting on a render derives its own bound from this,
+# so it cannot report a stuck teardown while the backend is still inside its own budget.
+TEARDOWN_BUDGET_SECONDS = (
+    CONTROL_DELIVERY_DEADLINE_SECONDS  # teardown(): delivering the graceful control byte
+    + SIGTERM_GRACE_PERIOD_SECONDS  # teardown(): the grace a delivered byte earns
+    + REAP_DEADLINE_SECONDS  # teardown(): waiting for the job's membership to reach zero
+    + WRITER_JOIN_DEADLINE_SECONDS  # teardown(): stopping the input writer
+    + 2 * DRAIN_DEADLINE_SECONDS  # teardown(): join_reader() inside _close_pseudoconsole()
+    + 2 * DRAIN_DEADLINE_SECONDS  # close(): the join_reader() that follows the stack close
+)
+
 # The graceful signal: writing 0x03 into the pseudoconsole input is how terminal emulators
 # deliver Ctrl-C to a ConPTY client. `GenerateConsoleCtrlEvent` cannot be used, because it
 # reaches only processes sharing the caller's console and the target is on the pseudoconsole.
 CONTROL_C_BYTE = b"\x03"
 
+# The absent-input note this backend adds to, stated where the asymmetry is documented: a
+# script that reads input blocks until the execution timeout rather than seeing end-of-file.
+NO_INPUT_NOTE = DEFAULT_NO_INPUT_NOTE + (
+    " On Windows the terminal carries no synthetic end-of-file, so such a script blocks until the "
+    "timeout instead of reading end-of-file."
+)
+
 
 class COORD(ctypes.Structure):
     _fields_ = [("X", ctypes.c_short), ("Y", ctypes.c_short)]
@@ -1077,6 +1102,9 @@ def write_input(self, data: bytes) -> InputWriteResult:
         result, _ = self._input_queue.submit(data)
         return result
 
+    def no_input_note(self) -> str:
+        return NO_INPUT_NOTE
+
     def infrastructure_failure(self) -> Optional[str]:
         detail = super().infrastructure_failure()
         if detail is not None:

render_machine/_legacy_pipe.py

@@ -58,6 +58,16 @@
 # that inherited the write end keeps the pipe open past the leader's exit.
 CLOSE_JOIN_SECONDS = 1.0
 
+# What one full teardown of this backend may spend, phase by phase and in sequence. A
+# caller waiting on a render derives its own bound from this, so it cannot report a stuck
+# teardown while the backend is still inside the budget its own constants grant it.
+TEARDOWN_BUDGET_SECONDS = (
+    SIGTERM_GRACE_PERIOD_SECONDS  # terminate_tree(): the grace before the SIGKILL
+    + REAP_DEADLINE_SECONDS  # terminate_tree(): reaping the killed process
+    + DRAIN_DEADLINE_SECONDS  # close(): the first join, while the pipe is still open
+    + CLOSE_JOIN_SECONDS  # close(): the second, after the pipe is closed under the reader
+)
+
 # Windows gives a child the parent's console unless told otherwise, and a child on that
 # console can read the renderer's keystrokes through CONIN$ regardless of where its
 # standard input handle points. CREATE_NO_WINDOW gives it a console of its own instead.

render_machine/_posix_pty.py

@@ -68,6 +68,16 @@
 # forks, so termination is immediate and the full grace would only slow failures down.
 ROLLBACK_GRACE_SECONDS = 0.1
 
+# What one full teardown of this backend may spend, phase by phase and in sequence. A
+# caller waiting on a render derives its own bound from this, so it cannot report a stuck
+# teardown while the backend is still inside the budget its own constants grant it.
+TEARDOWN_BUDGET_SECONDS = (
+    SIGTERM_GRACE_PERIOD_SECONDS  # terminate_tree(): the grace before the SIGKILL
+    + REAP_DEADLINE_SECONDS  # terminate_tree(): reaping the killed group
+    + DRAIN_DEADLINE_SECONDS  # close(): the reader's final drain
+    + REAP_DEADLINE_SECONDS  # close(): the rest of the same reader join
+)
+
 
 class _ProtocolError(Exception):
     """The launcher's status stream did not follow the handshake protocol."""
@@ -82,20 +92,25 @@ def _close_quietly(fd: Optional[int]) -> None:
         pass
 
 
-def _signal_group(pgid: int, sig: int) -> None:
-    """The only killpg site in this module.
+def _signal_group(pgid: int, sig: int) -> bool:
+    """The only killpg site in this module. False once the group has nothing left to signal.
 
     ESRCH: the group is gone.
     EPERM: verified on macOS — killpg() returns EPERM, not ESRCH, when the group's only
     remaining member is our own unreaped zombie leader. That is the NORMAL state after a
     graceful exit, so it must not raise.
+
+    Both are terminal for the group, which is what lets signal 0 serve as a liveness probe
+    without a second killpg site.
     """
     try:
         os.killpg(pgid, sig)
     except ProcessLookupError:  # ESRCH — nothing left
-        return
+        return False
     except PermissionError:  # EPERM — zombie-only group
         console.debug(f"killpg({pgid}, {sig}): EPERM, treating as terminal")
+        return False
+    return True
 
 
 def _background_reap(proc: subprocess.Popen) -> None:
@@ -548,6 +563,8 @@ def terminate_tree(self, grace: float = SIGTERM_GRACE_PERIOD_SECONDS) -> None:
                 self._deliver(proc, pgid, signal.SIGCONT)
                 deadline = time.monotonic() + grace  # independent clock — NOT stop_event
                 while time.monotonic() < deadline:  # never waits on the leader either
+                    if self._group_spent(pgid):
+                        break  # the tree handled the SIGTERM; the escalation still follows
                     self._grace_tick()
             finally:
                 # Unconditional: an interruption mid-grace must still escalate.
@@ -998,6 +1015,17 @@ def _deliver(self, proc: subprocess.Popen, pgid: Optional[int], sig: int) -> Non
     def _grace_tick(self) -> None:
         time.sleep(GRACE_TICK_SECONDS)
 
+    def _group_spent(self, pgid: Optional[int]) -> bool:
+        """Signal 0 as a liveness probe: True once the group can no longer be signalled.
+
+        Only the grace loop uses it, and only to stop waiting early. Nothing is reaped here
+        — the SIGKILL and the reap that follow are unconditional — because reaping before
+        the escalation would recycle the group the escalation still has to reach.
+        """
+        if pgid is None:  # pre-ack: no group recorded, so the grace runs to its end
+            return False
+        return not _signal_group(pgid, 0)
+
     def _rollback(self) -> None:
         try:
             if self._proc is not None:

render_machine/render_utils.py

@@ -10,6 +10,7 @@
 from plain2code_exceptions import RenderCancelledError
 from render_machine.terminal_process import (
     ENVIRONMENT_ERROR_EXIT_CODE,
+    NO_INPUT_NOTE,
     TerminalProcess,
     TerminalProcessError,
     create_terminal_process,
@@ -28,30 +29,6 @@
 # than on bytes written: a script that blocks on input has written nothing either way.
 INPUT_DRIVER: Optional[object] = None
 
-NO_INPUT_DIAGNOSTIC_BASE = (
-    " No input driver was attached to the script's terminal, so a script that waits for input "
-    "never receives any and runs to the timeout."
-)
-
-# A documented platform asymmetry, not an implementation detail. POSIX injects the
-# terminal's EOF byte at spawn when no input driver is attached, so a script that reads
-# input sees end-of-file at once. ConPTY has no parent-side equivalent that leaves the input
-# channel open, and the channel has to stay open for the graceful control byte and for
-# terminal-query replies, so the same script blocks until the timeout.
-WINDOWS_NO_EOF_DIAGNOSTIC = (
-    " On Windows the terminal carries no synthetic end-of-file, so such a script blocks until the "
-    "timeout instead of reading end-of-file."
-)
-
-
-def no_input_diagnostic(platform: str) -> str:
-    if platform == "win32":
-        return NO_INPUT_DIAGNOSTIC_BASE + WINDOWS_NO_EOF_DIAGNOSTIC
-    return NO_INPUT_DIAGNOSTIC_BASE
-
-
-NO_INPUT_DIAGNOSTIC = no_input_diagnostic(sys.platform)
-
 # Conditions the arbiter chooses between, highest precedence last.
 CONDITION_EXIT = "exit"
 CONDITION_TIMEOUT = "timeout"
@@ -148,6 +125,9 @@ def __init__(self) -> None:
         self.raw_output = b""
         self.reply_failed = False
         self.reply_detail = ""
+        # The backend that ran states this itself. Keyed on the platform it would describe
+        # the wrong backend whenever the escape hatch selected another one.
+        self.no_input_note = NO_INPUT_NOTE
 
 
 def _await_target(
@@ -221,6 +201,7 @@ def _collect_backend_state(process: TerminalProcess, execution: _ScriptExecution
         execution.raw_output = process.read_raw_output()
         execution.reply_failed = process.terminal_reply_failed
         execution.reply_detail = process.terminal_reply_detail()
+        execution.no_input_note = process.no_input_note()
     except Exception as exc:
         _record_backend_failure(execution.outcome, exc, "while reporting its result")
 
@@ -340,8 +321,9 @@ def _publish_timeout(
     output: str,
     reply_failed: bool,
     reply_detail: str,
+    no_input_note: str,
 ) -> tuple[int, str, Optional[str]]:
-    diagnostics = NO_INPUT_DIAGNOSTIC if INPUT_DRIVER is None else ""
+    diagnostics = no_input_note if INPUT_DRIVER is None else ""
     if reply_failed:
         diagnostics += f" Terminal replies the script asked for could not be delivered: {reply_detail}."
 
@@ -398,7 +380,13 @@ def execute_script(
         raise RenderCancelledError()
     elif outcome.condition == CONDITION_TIMEOUT:
         result = _publish_timeout(
-            script, script_type, script_timeout, execution.output, execution.reply_failed, execution.reply_detail
+            script,
+            script_type,
+            script_timeout,
+            execution.output,
+            execution.reply_failed,
+            execution.reply_detail,
+            execution.no_input_note,
         )
     elif outcome.exit_code is None:
         result = _publish_environment_error(