wake/W4 hardening (low-pri): observed_seq incremented before store enqueue can permanently wedge the inbox #908

New Issue

jason.woltje · 2026-07-26T01:04:11Z

jason.woltje commented

2026-07-26 01:04:11 +00:00

Low-priority hardening tracked from the #907 (W4 detector) review (RoR comment 18933). Mos-ruled: file even though unreachable today, because the SEVERITY is a permanent inbox wedge.

Failure mode: detector.sh's _next_observed_seq increments the persistent monotonic counter BEFORE store.sh enqueue. If an enqueue ever fails, the detector fails loud and does NOT advance the per-watch last-observed hash (so the source re-observes with the NEXT seq) — but the BURNED seq never reaches the store's observed.set. By the §2.2 contiguous-prefix contract (triple-ratified in W2), every future consume --upto N with N beyond the burned seq then HARD-REJECTS on the interior-gap check — permanently wedging the consumer inbox.

Likelihood: unreachable on the validated call path today — store.sh enqueue only fails on malformed args or catastrophic disk/jq failure, none of which occur on the detector's validated call. Hence LOW priority. But awareness-only rots; the wedge is permanent if it ever fires, so it is tracked.

Fix (cheap, when the file is next touched): increment observed_seq only AFTER a successful store.sh enqueue — OR, on the enqueue failure path, record the seq as observed-with-tombstone so the contiguous-prefix stays gapless. Add a red-first test simulating an enqueue failure and asserting no permanent gap.

Part of #892. Ref: #907 RoR (comment 18933).

Low-priority hardening tracked from the #907 (W4 detector) review (RoR comment 18933). Mos-ruled: file even though unreachable today, because the SEVERITY is a **permanent inbox wedge**. **Failure mode:** `detector.sh`'s `_next_observed_seq` increments the persistent monotonic counter BEFORE `store.sh enqueue`. If an enqueue ever fails, the detector fails loud and does NOT advance the per-watch last-observed hash (so the source re-observes with the NEXT seq) — but the BURNED seq never reaches the store's `observed.set`. By the §2.2 contiguous-prefix contract (triple-ratified in W2), every future `consume --upto N` with N beyond the burned seq then HARD-REJECTS on the interior-gap check — **permanently wedging the consumer inbox**. **Likelihood: unreachable on the validated call path today** — `store.sh enqueue` only fails on malformed args or catastrophic disk/jq failure, none of which occur on the detector's validated call. Hence LOW priority. But awareness-only rots; the wedge is permanent if it ever fires, so it is tracked. **Fix (cheap, when the file is next touched):** increment `observed_seq` only AFTER a successful `store.sh enqueue` — OR, on the enqueue failure path, record the seq as observed-with-tombstone so the contiguous-prefix stays gapless. Add a red-first test simulating an enqueue failure and asserting no permanent gap. Part of #892. Ref: #907 RoR (comment 18933).

Mos referenced this issue

2026-07-26 01:04:54 +00:00

feat(wake): W4 — per-host delta-gated detector daemon (fail-loud source semantics, enqueues to W2 store) #907