wake/digest+reconcile (BLOCKING, pilot finding #6): render-refused entry wedges whole drain (quarantine) + reconciler enumerations misclassed actionable (→ class=digest) #920
Assignees
jason.woltje
Clear assignees
jason.woltje
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: mosaicstack/stack#920
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
BLOCKING-CLASS framework finding #6 from the live dragon-lin pilot (hit ~40min post-co-feed). Pre-vector (part of the complete pre-vector set with #912).
THE DEFECT (head-of-line blocking wedges the whole drain). A reconciler ENUMERATION was enqueued
class=actionablecarrying locators{kind,id,path,observed_hash}. digest.sh's §2.1 ACTIONABLE-tier requires a HARD locator (repo+issue | 40-hex sha | file(:anchor));{kind,id,path,observed_hash}does not satisfy that taxonomy → digest render exit-4s (malformed) → the ENTIRE cumulative-state drain fails to render → four consecutive timer failures, NOTHING delivers — including clean, unrelated entries (classic head-of-line blocking). The pilot cleared it manually via a protocol-legitimate live-verified drain.TWO FIXES (both ruled by Mos — do BOTH):
(1) REQUIRED availability fix — quarantine, don't wedge. The digest/drain must QUARANTINE a render-refused entry — DEAD-LETTER it + raise a fail-loud alarm for THAT specific entry — and CONTINUE rendering/delivering the rest. A single malformed entry blocking the entire drain is a §1.2 seam that will bite ANY feeder and ANY future malformation, not just this one. Preserve fail-loud (the bad entry is alarmed + dead-lettered, never silently dropped) while removing the all-or-nothing blocking. Decide the right layer (digest.sh per-entry quarantine within the render, or the drain catching a per-entry refusal) — the point is per-entry isolation, not whole-digest failure.
(2) SEMANTIC fix — reconciler enumerations are
class=digest, notactionable. Reconciler enumerations are state-pointers / ORIENTATION-tier (they point at source state to re-verify), NEVER consequential claims —actionablewas a MISCLASSIFICATION that forced them into a hard-locator taxonomy they structurally cannot meet. Change reconcile.sh's enumeration enqueue toclass=digest; digest-class entries render in the ORIENTATION tier (soft-locator, no exit-4 — see #914b's_locator_linedigest-class vocabulary which already renders{kind,id,observed_hash,...}). Alternative (a) — minting §2.1-conformant hard locators for enumerations — is REJECTED as symptom-treatment (they aren't claims; don't fake a claim's locator).RED-FIRST (mandatory):
actionablewith the pilot's EXACT locator shape{kind,id,path,observed_hash}as the repro fixture) → QUARANTINES (dead-letter + alarm for that entry) AND the rest of the drain still delivers (assert a clean sibling entry is rendered/delivered in the same drain).Preserve the digest contract otherwise: two-tier trust, the ACTIONABLE-tier hard-locator FAIL-LOUD (exit-4) for genuine actionable claims, and the scrub. Refs: #892, dragon-lin pilot co-feed; sibling pre-vector item #912.