Reviewed source: e0fd9c3886d6396d2a951523d45039d3ea3ad469. Reproductions were run directly on macOS ARM64 with .NET 10.0.12.
Publisher.cs:58, Subscriber.cs:89
Every successful publish posts a permit, but successful immediate reads do not consume one. After 100,000 successful enqueue/dequeue pairs, the empty queue still had exactly 100,000 permits. A later empty blocking read must work through these stale notifications. At the platform semaphore limit, Release can throw after the message is already committed, making enqueue outcome ambiguous. Overflow was not exercised in this audit.
This is a promising performance target, but do not blindly skip posts or add a native wait to every successful read: the former can lose wakeups and the latter adds a syscall to the fast path. A bounded/coalesced notification design needs proof for multiple publishers/readers and mixed versions. Overflow handling should acknowledge that the message is already committed.
Acceptance criteria
Prevent unbounded stale-notification work and avoid reporting a committed message as an enqueue failure solely because the semaphore count is full. Prove wakeup behavior with multiple publishers/subscribers and existing participants; benchmark burst-to-idle traffic.
Reviewed source:
e0fd9c3886d6396d2a951523d45039d3ea3ad469. Reproductions were run directly on macOS ARM64 with .NET 10.0.12.Publisher.cs:58, Subscriber.cs:89
Every successful publish posts a permit, but successful immediate reads do not consume one. After 100,000 successful enqueue/dequeue pairs, the empty queue still had exactly 100,000 permits. A later empty blocking read must work through these stale notifications. At the platform semaphore limit, Release can throw after the message is already committed, making enqueue outcome ambiguous. Overflow was not exercised in this audit.
This is a promising performance target, but do not blindly skip posts or add a native wait to every successful read: the former can lose wakeups and the latter adds a syscall to the fast path. A bounded/coalesced notification design needs proof for multiple publishers/readers and mixed versions. Overflow handling should acknowledge that the message is already committed.
Acceptance criteria
Prevent unbounded stale-notification work and avoid reporting a committed message as an enqueue failure solely because the semaphore count is full. Prove wakeup behavior with multiple publishers/subscribers and existing participants; benchmark burst-to-idle traffic.