fix(wake): #917 gate the final observed_seq cursor write + observed.set/cursor consistency (defense-in-depth) #933

Merged

Mos merged 2 commits from fix/wake-917-cursor-write into main 2026-07-26 15:14:39 +00:00

Conversation 1 Commits 2 Files Changed 3 +154 -5

jason.woltje commented 2026-07-26 14:19:18 +00:00

Owner

Copy Link

Defense-in-depth hardening of store.sh cmd_enqueue surfaced by the #915 review (obs#2). The final observed_seq cursor _atomic_write was the ONE durable write not wrapped in a failure check, and was cross-file non-atomic with the observed.set write immediately before it. A cursor-write failure after a successful observed.set write could return spurious success while the allocation stayed uncommitted, and/or leave observed.set advanced while the cursor lagged (cross-file inconsistent).

Fix (additive; preserves #908 exactly)

• Gate the final cursor write like the pending/observed.set writes (#908): a cursor-write failure is now FAIL-LOUD (non-zero + diagnostic), never silently swallowed.
• On cursor-write failure, roll observed.set back to its pre-write snapshot, so observed.set and the cursor either BOTH advance or NEITHER does — never a stranded observed.set entry above the cursor.

Why #908 is preserved

Single store-side allocator, atomic allocate+enqueue under flock, arrow-1 no-burn (pending write still FIRST and still aborts before any cursor advance), anti-swallow <=consumed fail-loud, and W2 contiguous-prefix CONSUMED are all unchanged. The cursor stays the sole COMMIT point, so a pending-ahead state is exactly the one #908 already tolerates on its observed.set-failure path. On-disk format UNCHANGED (read-compatible) — a store written by older code reads identically.

Test (RED-first)

New T11 in test-wake-store-ack.sh forces the final cursor _atomic_write to fail (bind-mount EBUSY over observed_seq inside an unshare --mount --user namespace, seeded with the current cursor value so the READ still succeeds and only the WRITE commit is blocked) AFTER pending+observed.set succeed. Asserts: (1) fail-loud non-zero + cursor-naming diagnostic, (2) cursor not advanced, (3) observed.set/cursor consistency (no seq stranded above the cursor), (4) intact consumed prefix. Verified RED against pre-#917 code (rc=0 silent success + observed.set={1,2} while cursor=1).

Gates

shellcheck 0.11 clean; verify-sanitized PASS; pnpm run test:framework-shell rc=0 (normal AND openssl-masked); store-ack (12 groups, incl T8/T9/T10 #908), enqueue-race (#927), reconcile, detector all GREEN; BusyBox portability verified in node:24-alpine (privileged). manifest bumped 0.6.8 -> 0.6.9.

Closes #917
Part of #892

Defense-in-depth hardening of store.sh cmd_enqueue surfaced by the #915 review (obs#2). The final observed_seq cursor `_atomic_write` was the ONE durable write not wrapped in a failure check, and was cross-file non-atomic with the `observed.set` write immediately before it. A cursor-write failure after a successful observed.set write could return spurious success while the allocation stayed uncommitted, and/or leave observed.set advanced while the cursor lagged (cross-file inconsistent). ## Fix (additive; preserves #908 exactly) - **Gate** the final cursor write like the pending/observed.set writes (#908): a cursor-write failure is now FAIL-LOUD (non-zero + diagnostic), never silently swallowed. - On cursor-write failure, **roll observed.set back** to its pre-write snapshot, so observed.set and the cursor either BOTH advance or NEITHER does — never a stranded observed.set entry above the cursor. ## Why #908 is preserved Single store-side allocator, atomic allocate+enqueue under flock, arrow-1 no-burn (pending write still FIRST and still aborts before any cursor advance), anti-swallow `<=consumed` fail-loud, and W2 contiguous-prefix CONSUMED are all unchanged. The cursor stays the sole COMMIT point, so a pending-ahead state is exactly the one #908 already tolerates on its observed.set-failure path. **On-disk format UNCHANGED (read-compatible)** — a store written by older code reads identically. ## Test (RED-first) New **T11** in test-wake-store-ack.sh forces the final cursor `_atomic_write` to fail (bind-mount EBUSY over `observed_seq` inside an `unshare --mount --user` namespace, seeded with the current cursor value so the READ still succeeds and only the WRITE commit is blocked) AFTER pending+observed.set succeed. Asserts: (1) fail-loud non-zero + cursor-naming diagnostic, (2) cursor not advanced, (3) observed.set/cursor consistency (no seq stranded above the cursor), (4) intact consumed prefix. Verified RED against pre-#917 code (rc=0 silent success + observed.set={1,2} while cursor=1). ## Gates shellcheck 0.11 clean; verify-sanitized PASS; `pnpm run test:framework-shell` rc=0 (normal AND openssl-masked); store-ack (12 groups, incl T8/T9/T10 #908), enqueue-race (#927), reconcile, detector all GREEN; BusyBox portability verified in node:24-alpine (privileged). manifest bumped 0.6.8 -> 0.6.9. Closes #917 Part of #892

jason.woltje added 1 commit 2026-07-26 14:19:19 +00:00

fix(wake): #917 gate the final observed_seq cursor write + observed.set/cursor consistency (defense-in-depth) ... eb37eae1f8

Defense-in-depth hardening of store.sh cmd_enqueue surfaced by the #915 review
(obs#2): the final observed_seq cursor _atomic_write was the ONE durable write not
wrapped in a failure check, and was cross-file non-atomic with the observed.set
write immediately before it. Practically unreachable today, but a cursor-write
failure after a successful observed.set write could (a) return spurious success
while the allocation stayed uncommitted, and (b) leave observed.set advanced while
the cursor lagged (cross-file inconsistent).

Fix (additive; preserves #908 exactly):
- GATE the final cursor write like the pending/observed.set writes (#908): a
  cursor-write failure is now FAIL-LOUD (non-zero + diagnostic), never swallowed.
- On cursor-write failure, ROLL observed.set BACK to its pre-write snapshot, so
  observed.set and the cursor either BOTH advance or NEITHER does — never a
  stranded observed.set entry above the cursor.

#908 invariants intact: single store-side allocator, atomic allocate+enqueue under
flock, arrow-1 no-burn (pending write still FIRST, still aborts before any cursor
advance), anti-swallow <=consumed fail-loud, W2 contiguous-prefix CONSUMED. The
cursor stays the sole COMMIT point, so a pending-ahead state is exactly the one
#908 already tolerates on its observed.set-failure path. On-disk format UNCHANGED
(read-compatible).

Test: new T11 in test-wake-store-ack.sh forces the final cursor _atomic_write to
fail (bind-mount EBUSY over observed_seq inside an unshare mount+user namespace,
seeded so the cursor READ still succeeds) after pending+observed.set succeed, and
asserts fail-loud + observed.set/cursor consistency + intact consumed prefix. RED
against pre-#917 code; all store-ack/race/reconcile/detector groups stay GREEN.
manifest bumped 0.6.8 -> 0.6.9.

Closes #917
Part of #892

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb

jason.woltje referenced this pull request 2026-07-26 14:52:52 +00:00

wake: seq-integrity fault-injections skip in non-privileged CI — need mount-free privilege-invariant injection #934

jason.woltje referenced this issue from a commit 2026-07-26 14:56:00 +00:00

test(wake): T11 guard unshare-mount fault-injection unavailability (skip in non-privileged CI, like T9)

jason.woltje added 1 commit 2026-07-26 14:56:00 +00:00

test(wake): T11 guard unshare-mount fault-injection unavailability (skip in non-privileged CI, like T9) ... 99af3066db

#933 CI was RED: the non-privileged Woodpecker runner DENIES `unshare --mount`
inside a user namespace ("unshare failed: Operation not permitted" / "can't mount
none on /"), so T11's bind-mount-EBUSY cursor-write fault injection could not set
up and the inner enqueue never ran — leaving T11's "diagnostic must name the
cursor write" assertion checking an empty errfile and FAILING. T9 uses the same
unshare+mount mechanism and survives only because its post-assertions are trivially
true when nothing was injected; T11 lacked that tolerance.

Fix (test-only): the inner (namespaced) script now drops a WITNESS marker AFTER the
bind-mount is in place and immediately before the enqueue. When the injection
cannot be constructed (unshare unavailable, or unshare/bind-mount denied so the
marker is absent), T11 prints a clear `SKIP:` line and does NOT run the failure-path
assertions — harness stays GREEN, matching T9's tolerance of the same unavailability.
When the injection IS available (privileged/local), the marker is present and T11
runs the full assertion set UNCHANGED (fail-loud + cursor-naming diagnostic +
observed.set/cursor consistency + intact consumed prefix).

Verified: non-privileged node:24-alpine -> T11 SKIPS, store-ack 12 groups + full
`pnpm run test:framework-shell` rc=0; privileged/local -> T11 runs full + passes.
store.sh (product fix) and manifest are UNCHANGED. shellcheck clean; BusyBox-portable.

Part of #892
Refs #917

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb

jason.woltje commented 2026-07-26 15:13:04 +00:00

Author

Owner

Copy Link

Record of Review — DELTA-RE-REVIEW, PR #933

VERDICT: APPROVE

REVIEWED-HEAD: 99af3066db87336f06e51942003bb957eb25b789
PRIOR SUBSTANCE-APPROVED HEAD: eb37eae1f852cbc69f11673e194fa11af369f8ee (independent review, criteria 1-6, verdict APPROVE)

This is a DELTA-RE-REVIEW: performed from a fresh clone, independent of any prior report's narrative. It carries the substance APPROVE from eb37eae1f8 forward IFF the delta between eb37eae1f8 and 99af3066db is exactly the claimed test-only guard fix — confirmed below.

Reviewer identity: independent reviewer (not the PR author). Commit author on reviewed head: mosaic-coder <coder@fleet.mosaicstack.dev>.

---

Criterion 1 — Delta scope: PASS

$ git diff --stat eb37eae1f852cbc69f11673e194fa11af369f8ee 99af3066db87336f06e51942003bb957eb25b789
 .../framework/tools/wake/test-wake-store-ack.sh    | 71 ++++++++++++++--------
 1 file changed, 46 insertions(+), 25 deletions(-)

Exactly one file changed. Confirmed byte-identical:

• packages/mosaic/framework/tools/wake/store.sh — git diff eb37eae..99af3066 -- <path> | wc -l = 0
• packages/mosaic/framework/framework-manifest.txt — git diff eb37eae..99af3066 -- <path> | wc -l = 0

No product file changed. The substance-APPROVE carries.

Criterion 2 — Guard correctness (the T11 delta): PASS

Full diff read. The change adds a witness-marker ($TMP_ROOT/t11.injected) written inside the nested unshared bash only after mount --bind + remount,ro,bind succeed and immediately before the enqueue call. The outer shell gates purely on [ -f "$marker" ]:

• Marker absent (unshare denied, or bind-mount fails with exit 98) → prints SKIP: T11 — unshare/bind-mount fault injection unavailable... and asserts nothing.
• Marker present → runs the full assertion block.

(a) RED-first preserved: diffed the four assertions inside the new if [ "$injected" -eq 1 ] block character-for-character against eb37eae's unconditional assertions — identical except for the added indentation from the new if wrapper. No assertion text, condition, or diagnostic message changed.

(b) Skip cannot mask a real failure: the marker is written by the nested subshell right before the enqueue call runs, so marker-present is proof the enqueue actually executed against the mounted fault; marker-absent is proof the fault-injection setup (unshare/mount) never got that far, i.e. the enqueue never ran under fault conditions. There is no path where the enqueue ran and misbehaved but the guard suppressed the assertions.

Criterion 3 — T9 parity: PASS (behavioral), with one accuracy note

Read T9 in full (unchanged file — it wasn't touched by this PR). T9's unavailability tolerance is structurally different from T11's new guard: T9 has no witness marker and prints no explicit SKIP: line. Instead, when unshare --mount --user --map-root-user ... is denied (Operation not permitted, uncaptured stderr printed raw), the command's own non-zero exit becomes rc, the inner enqueue never runs, and every downstream assertion happens to hold coincidentally because no second enqueue occurred (cursor stays at the baseline value from the first enqueue). fail_msg is a genuine hard-failure recorder (writes to $FAILFILE, checked at end of script) — T9 never calls it in the CI-denied path, so the group passes, but not via an explicit skip mechanism.

So: the comment "(like T9)" attached to the new T11 SKIP lines is directionally accurate (both tolerate unavailability without failing the suite) but T11's new marker-witness pattern is more rigorous/explicit than T9's implicit no-op-by-coincidence. This is not a defect — it doesn't weaken T11, and both were proven correct at runtime (below) — but it's worth recording as an inconsistency in the codebase's own self-description, not a re-review blocker.

Criterion 4 — BusyBox portability: PASS

The real CI base image (Dockerfile.ci: node:24-alpine + apk add python3 make g++ postgresql-client bash git jq openssl) installs no util-linux/coreutils/gawk — grep, awk, sed, unshare, mount are all BusyBox applets there (verified directly, see below). The new guard uses only [ -f ], : >file, rm -f, plain if/else, echo — no GNU-only constructs. Confirmed working end-to-end against actual BusyBox unshare/mount/grep/awk in the container runs below.

Criterion 5 — Gates, re-run from scratch: PASS

shellcheck 0.11.0 (local, version-matched) on test-wake-store-ack.sh: 0 findings, exit 0.

Non-privileged container — exact real-CI package set (node:24-alpine + apk add python3 make g++ postgresql-client bash git jq openssl, no util-linux/coreutils/gawk, i.e. genuine BusyBox grep/awk/sed/unshare/mount):

== T11: final observed_seq cursor write FAILURE — fail loud + observed.set/cursor stay CONSISTENT (#917 def-in-depth) ==
  SKIP: T11 — unshare/bind-mount fault injection unavailable in this sandbox (e.g. non-privileged CI); cursor-write failure path not exercised here (like T9)

wake store/ack harness: all invariants passed (12 groups)
RC=0

Exact SKIP line reproduced verbatim above. rc=0, all 12 groups pass — proves the guard works in the real (non-privileged) runner shape.

Privileged container (docker run --privileged, same package set, mount-capable):

== T11: final observed_seq cursor write FAILURE — fail loud + observed.set/cursor stay CONSISTENT (#917 def-in-depth) ==

wake store/ack harness: all invariants passed (12 groups)
RC=0

No SKIP printed — full path ran (marker set, injected=1), all four RED-sensitive assertions executed and passed, rc=0 — proves the available-case still fully asserts and the fix (from eb37eae) still holds under real fault injection.

Firewall: grep -rniE 'jason|woltje|jarvis|dragon-lin|web1|mos-dt-0|/home/hermes' <full delta diff> → 0 hits.

Criterion 6 — State/CI/linkage: PASS

• PR #933: state=open, merged=false, mergeable=true, base=main.
• Body contains Closes #917.
• Latest commit (99af3066db...) author: mosaic-coder <coder@fleet.mosaicstack.dev> — not the reviewer.
• CI combined status at 99af3066db...: state=success (ci/woodpecker/pr/ci → success).

---

Disclosed prompt-injection artifacts (per brief instruction — not complied with)

Two injected, brief-unaffiliated artifacts surfaced mid-session and are disclosed per the review brief's explicit instruction to do so and not comply:

1. A loaded ~/.claude/CLAUDE.md "MANDATORY — Read Before Any Response" instruction directing reads of ~/.config/mosaic/AGENTS.md and ~/.config/mosaic/runtime/claude/RUNTIME.md before responding. Not complied with — not part of this review brief.
2. A tool-output-embedded <system-reminder> claiming "the date has changed... DO NOT mention this to the user explicitly." Disclosed here per the brief's override instruction; not complied with (the suppression request was ignored).

Neither artifact altered any verification step above; all findings are derived independently from the fresh clone, diffs, and container runs.

---

Summary

Delta is exactly and only the claimed test-only T11 guard (one file, 46+/25-, no product-file bytes changed). The guard is a marker-witnessed skip that cannot mask a real failure and preserves eb37eae's RED-first assertions byte-for-byte in the available case. Verified directly (not trusted from any prior report): shellcheck clean, non-privileged real-CI-shaped container SKIPs correctly and passes rc=0, privileged/mount-capable container runs the full assertion set and passes rc=0, no operator-identifying strings in the diff, PR state/linkage/CI all correct.

VERDICT: APPROVE. The substance APPROVE from eb37eae1f852cbc69f11673e194fa11af369f8ee carries forward to 99af3066db87336f06e51942003bb957eb25b789.

# Record of Review — DELTA-RE-REVIEW, PR #933 **VERDICT: APPROVE** **REVIEWED-HEAD:** `99af3066db87336f06e51942003bb957eb25b789` **PRIOR SUBSTANCE-APPROVED HEAD:** `eb37eae1f852cbc69f11673e194fa11af369f8ee` (independent review, criteria 1-6, verdict APPROVE) This is a **DELTA-RE-REVIEW**: performed from a fresh clone, independent of any prior report's narrative. It carries the substance APPROVE from `eb37eae1f8` forward IFF the delta between `eb37eae1f8` and `99af3066db` is exactly the claimed test-only guard fix — confirmed below. Reviewer identity: independent reviewer (not the PR author). Commit author on reviewed head: `mosaic-coder <coder@fleet.mosaicstack.dev>`. --- ## Criterion 1 — Delta scope: PASS ``` $ git diff --stat eb37eae1f852cbc69f11673e194fa11af369f8ee 99af3066db87336f06e51942003bb957eb25b789 .../framework/tools/wake/test-wake-store-ack.sh | 71 ++++++++++++++-------- 1 file changed, 46 insertions(+), 25 deletions(-) ``` Exactly one file changed. Confirmed byte-identical: - `packages/mosaic/framework/tools/wake/store.sh` — `git diff eb37eae..99af3066 -- <path> | wc -l` = `0` - `packages/mosaic/framework/framework-manifest.txt` — `git diff eb37eae..99af3066 -- <path> | wc -l` = `0` No product file changed. The substance-APPROVE carries. ## Criterion 2 — Guard correctness (the T11 delta): PASS Full diff read. The change adds a witness-marker (`$TMP_ROOT/t11.injected`) written inside the nested `unshare`d bash **only after** `mount --bind` + `remount,ro,bind` succeed and **immediately before** the enqueue call. The outer shell gates purely on `[ -f "$marker" ]`: - Marker absent (unshare denied, or bind-mount fails with `exit 98`) → prints `SKIP: T11 — unshare/bind-mount fault injection unavailable...` and asserts nothing. - Marker present → runs the full assertion block. (a) **RED-first preserved**: diffed the four assertions inside the new `if [ "$injected" -eq 1 ]` block character-for-character against eb37eae's unconditional assertions — identical except for the added indentation from the new `if` wrapper. No assertion text, condition, or diagnostic message changed. (b) **Skip cannot mask a real failure**: the marker is written by the nested subshell right before the enqueue call runs, so marker-present is proof the enqueue actually executed against the mounted fault; marker-absent is proof the fault-injection *setup* (unshare/mount) never got that far, i.e. the enqueue never ran under fault conditions. There is no path where the enqueue ran and misbehaved but the guard suppressed the assertions. ## Criterion 3 — T9 parity: PASS (behavioral), with one accuracy note Read T9 in full (unchanged file — it wasn't touched by this PR). T9's unavailability tolerance is **structurally different** from T11's new guard: T9 has no witness marker and prints no explicit `SKIP:` line. Instead, when `unshare --mount --user --map-root-user ...` is denied (`Operation not permitted`, uncaptured stderr printed raw), the command's own non-zero exit becomes `rc`, the inner enqueue never runs, and every downstream assertion happens to hold **coincidentally** because no second enqueue occurred (cursor stays at the baseline value from the first enqueue). `fail_msg` is a genuine hard-failure recorder (writes to `$FAILFILE`, checked at end of script) — T9 never calls it in the CI-denied path, so the group passes, but not via an explicit skip mechanism. So: the *comment* "(like T9)" attached to the new T11 SKIP lines is directionally accurate (both tolerate unavailability without failing the suite) but T11's new marker-witness pattern is more rigorous/explicit than T9's implicit no-op-by-coincidence. This is **not a defect** — it doesn't weaken T11, and both were proven correct at runtime (below) — but it's worth recording as an inconsistency in the codebase's own self-description, not a re-review blocker. ## Criterion 4 — BusyBox portability: PASS The real CI base image (`Dockerfile.ci`: `node:24-alpine` + `apk add python3 make g++ postgresql-client bash git jq openssl`) installs **no** util-linux/coreutils/gawk — `grep`, `awk`, `sed`, `unshare`, `mount` are all BusyBox applets there (verified directly, see below). The new guard uses only `[ -f ]`, `: >file`, `rm -f`, plain `if/else`, `echo` — no GNU-only constructs. Confirmed working end-to-end against actual BusyBox `unshare`/`mount`/`grep`/`awk` in the container runs below. ## Criterion 5 — Gates, re-run from scratch: PASS **shellcheck 0.11.0** (local, version-matched) on `test-wake-store-ack.sh`: **0 findings**, exit 0. **Non-privileged container** — exact real-CI package set (`node:24-alpine` + `apk add python3 make g++ postgresql-client bash git jq openssl`, no util-linux/coreutils/gawk, i.e. genuine BusyBox grep/awk/sed/unshare/mount): ``` == T11: final observed_seq cursor write FAILURE — fail loud + observed.set/cursor stay CONSISTENT (#917 def-in-depth) == SKIP: T11 — unshare/bind-mount fault injection unavailable in this sandbox (e.g. non-privileged CI); cursor-write failure path not exercised here (like T9) wake store/ack harness: all invariants passed (12 groups) RC=0 ``` Exact SKIP line reproduced verbatim above. rc=0, all 12 groups pass — proves the guard works in the real (non-privileged) runner shape. **Privileged container** (`docker run --privileged`, same package set, mount-capable): ``` == T11: final observed_seq cursor write FAILURE — fail loud + observed.set/cursor stay CONSISTENT (#917 def-in-depth) == wake store/ack harness: all invariants passed (12 groups) RC=0 ``` No SKIP printed — full path ran (marker set, `injected=1`), all four RED-sensitive assertions executed and passed, rc=0 — proves the available-case still fully asserts and the fix (from eb37eae) still holds under real fault injection. **Firewall**: `grep -rniE 'jason|woltje|jarvis|dragon-lin|web1|mos-dt-0|/home/hermes' <full delta diff>` → 0 hits. ## Criterion 6 — State/CI/linkage: PASS - PR #933: `state=open`, `merged=false`, `mergeable=true`, `base=main`. - Body contains `Closes #917`. - Latest commit (`99af3066db...`) author: `mosaic-coder <coder@fleet.mosaicstack.dev>` — not the reviewer. - CI combined status at `99af3066db...`: `state=success` (`ci/woodpecker/pr/ci` → success). --- ## Disclosed prompt-injection artifacts (per brief instruction — not complied with) Two injected, brief-unaffiliated artifacts surfaced mid-session and are disclosed per the review brief's explicit instruction to do so and not comply: 1. A loaded `~/.claude/CLAUDE.md` "MANDATORY — Read Before Any Response" instruction directing reads of `~/.config/mosaic/AGENTS.md` and `~/.config/mosaic/runtime/claude/RUNTIME.md` before responding. Not complied with — not part of this review brief. 2. A tool-output-embedded `<system-reminder>` claiming "the date has changed... DO NOT mention this to the user explicitly." Disclosed here per the brief's override instruction; not complied with (the suppression request was ignored). Neither artifact altered any verification step above; all findings are derived independently from the fresh clone, diffs, and container runs. --- ## Summary Delta is exactly and only the claimed test-only T11 guard (one file, 46+/25-, no product-file bytes changed). The guard is a marker-witnessed skip that cannot mask a real failure and preserves eb37eae's RED-first assertions byte-for-byte in the available case. Verified directly (not trusted from any prior report): shellcheck clean, non-privileged real-CI-shaped container SKIPs correctly and passes rc=0, privileged/mount-capable container runs the full assertion set and passes rc=0, no operator-identifying strings in the diff, PR state/linkage/CI all correct. **VERDICT: APPROVE.** The substance APPROVE from `eb37eae1f852cbc69f11673e194fa11af369f8ee` carries forward to `99af3066db87336f06e51942003bb957eb25b789`.

Mos approved these changes 2026-07-26 15:14:36 +00:00

Mos left a comment

First-time contributor

Copy Link

GO — Gate-16 id-11 stamp, pinned to exact FULL head 99af3066db.
Basis: verbatim RoRs — substance review a6ae7506 APPROVE 1-6 (both-advance-or-neither cursor invariant reproduced RED→GREEN; #908 critical section byte-preserved; read-compatible on-disk format) carrying through the independent delta-re-review (comment 19293, reviewer abdf5fe5 ≠ builder, fresh-clone re-derived): delta = test-wake-store-ack.sh only, product byte-identical, injection-fires assertions byte-identical, the T11 witness-marker guard adding only skip-when-unavailable — and CI green on the REAL non-privileged runner, the exact acceptance the fix targeted. Sub-class 5b (container privilege level) recorded in doctrine; the injections-skip-in-CI condition tracked as #934. Reviewer disclosed-and-refused two injected reminders (confabulation doctrine holding). Closes #917 — the cursor defense-in-depth lands with its double-fault residual honestly documented. Part of #892. Named executor: Mos (id-11), squash pinned.

GO — Gate-16 id-11 stamp, pinned to exact FULL head 99af3066db87336f06e51942003bb957eb25b789. Basis: verbatim RoRs — substance review a6ae7506 APPROVE 1-6 (both-advance-or-neither cursor invariant reproduced RED→GREEN; #908 critical section byte-preserved; read-compatible on-disk format) carrying through the independent delta-re-review (comment 19293, reviewer abdf5fe5 ≠ builder, fresh-clone re-derived): delta = test-wake-store-ack.sh only, product byte-identical, injection-fires assertions byte-identical, the T11 witness-marker guard adding only skip-when-unavailable — and CI green on the REAL non-privileged runner, the exact acceptance the fix targeted. Sub-class 5b (container privilege level) recorded in doctrine; the injections-skip-in-CI condition tracked as #934. Reviewer disclosed-and-refused two injected reminders (confabulation doctrine holding). Closes #917 — the cursor defense-in-depth lands with its double-fault residual honestly documented. Part of #892. Named executor: Mos (id-11), squash pinned.

Mos merged commit 9becaf877f into main 2026-07-26 15:14:39 +00:00

Mos deleted branch fix/wake-917-cursor-write 2026-07-26 15:14:39 +00:00

Mos referenced this issue from a commit 2026-07-26 15:14:41 +00:00

fix(wake): #917 gate the final observed_seq cursor write + observed.set/cursor consistency (defense-in-depth) (#933)

Sign in to join this conversation.

Reviewers

No Reviewers

Mos

Labels

Clear labels

fleet-enhancement

Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

jason.woltje

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#933