Beagle SCM

BRO-046: idle pager leaks 19 ULOG mmaps/sec — every session dies of VMA exhaustion in ~57 min

Now

DONE

A long-running pager with NOBODY TOUCHING IT leaks 19.2 file mappings per second and dies. The 100 ms key-wait spin calls _ciBadge() per pass; the badge pays two uncached treeAt climbs, each mmapping a .be ULOG that nothing ever unmaps. At vm.max_map_count (65530, ~57 min) every mmap fails and the process spins in the kernel forever. Observed live as be todo at 462% CPU / 71.0g VIRT (evidence); reproduced identically by jab log, so this is EVERY pager, not the todo view.

Input

Context

Live incident 2026-08-05 (gritzko, main tree): be todo pid 13475, 1h54m old, 71.0g 462% 12% be todo. Read-only forensics on /proc plus a clean pty re-run (ptyprobe.py, evidence).

• The wedged pid held 65531 VMAs — vm.max_map_count is 65530, so EVERY mmap in it had been failing for a while.
• 62749 of those VMAs were the SAME 4 KiB r--s map of ONE file, work/WORK-013/.be (inode 73807828, offset 0).
• CPU split was utime 690 s vs stime 6325 s — 92% kernel: the 100 ms loop retrying an mmap that can no longer succeed.
• RSS 654 MB and climbing; VmSize 74 GB is jab's normal arena reservation and is NOT the leak (a fresh pager starts there).
• Fresh pty repro, ZERO keystrokes: jab todo grew be/.be maps 96 per 5 s (19.2/s), strictly monotonic, 594 after 40 s.
• Same run of jab log: same 96 per 5 s on the same file — the leak is the PAGER LOOP, no view is implicated.
• Which .be leaks is just the pager's context: pid 13475 sat in //WORK-013, the repro sat in //be.
• Chain: pager.js:1522,1532 _ciBadge() → ci.js:289 contextWt → discover.wtdir + discover.treeAt = 2 × resolveAnchor → discover.row0Row → ulog.js:44 each() → abc.mmap("ULOG",…).
• Nothing unmaps: abc.close is a no-op and release is GC-finalize-only (ABC-020); a 4 KiB VMA adds ~no JS-heap pressure, so GC effectively never runs and the maps just pile up.
• CI-004 put the badge INSIDE the wait spin and parked "the key wait is the pre-existing 100 ms VTIME spin" — the spin was harmless until the badge started paying two file opens per pass.
• BE-050 already owns this seam but scoped it "per keypress" (pager.js:461,858); an IDLE pager paying 19 opens/s is not covered by its goal.

Goals

An idle pager costs ZERO file opens per tick and a session's VMA count plateaus, so a pager left open all day neither grows nor slows.

• Red-first pty repro: sample /proc/<pid>/maps of an idle pager over 40 s — grows 96/5 s today, FLAT after the fix.
• The badge keeps working: a bg CI job finishing must still reach the bar without a keystroke (CI-004 TODO 8).
• Fix stands on its own with abc.close still inert — the cut comes from not opening, not from closing (ABC-020 is On1 for the deeper half only).

Constraints

Pager context changes ONLY by navigation (BRO-024, pager-context-only-changes-by-nav) — so a context-keyed memo is sound and invalidates on nav.

• ALL URI/hash resolution stays on be/core/resolve_hash.js: memoize AROUND the canonical calls, never reimplement or bypass them.
• FORBIDDEN: any parallel ULOG read path (whole-file byte copies etc.) — the 2026-07-19 attempt got its worktree rm -rf-ed; mmap stays the one read mechanism.
• Do not widen into BE-050's status/work-view row work; this ticket is the IDLE TICK only.
• Verify through the real UI path: a pty repro that flips, never a unit probe (verify-through-real-ui-path).
• Clone ///be/ per work; stop and report on any clone failure, no improvised fallback.

WIP

Design decisions

TODOs

• red pty repro: idle-pager VMA growth, asserted flat; red today (start from ptyprobe.py)
• memo _ciBadge's contextWt per pager context — the spin must not re-resolve an unchanged context
• check the OTHER per-pass probes in the same loop (_resized, _tickDue) pay no file opens
• confirm the badge still flips without a keystroke when a bg CI job ends (CI-004)
• re-measure both jab todo and jab log idle for ≥ 5 min; report VMA counts before/after
• full suite green

Blockers and bummers

Outcome