fix(wake): #944 path becomes a hard-locator arm — detector-shape actionable entries pass the §2.1 gate #945

Merged

Mos merged 1 commits from mos-dt-0/stack:fix/wake-actionable-locator-gate into main 2026-07-30 14:01:49 +00:00

Conversation 2 Commits 1 Files Changed 3

+169 -23

mos-dt-0 commented 2026-07-30 13:03:51 +00:00

Contributor

Copy Link

Copy Source

Closes #944

Head: fa36da808741d77fad28c2e52d62af836e53735e (amended per wake-judge ruling — R1/R2(a)/F1; prior heads ac3b972 and fb3c3c3 superseded — prior-verdict-void applies).

Defect

_has_hard_locator tested only the forge locator vocabulary — repo+issue, 40-hex sha, file. detector.sh (A1) builds board_file locators as kind/id/observed_hash + path (+ snapshot_sha/snapshot_ts when adapter-attested, #940). Zero keys in common: a class=actionable board_file entry was structurally guaranteed to fail the §2.1 gate, so every heartbeat-planning delta dead-lettered (live seqs 63 and 68 on dragon-lin, 2026-07-30). Latent since #920 — whose harness pinned the detector pilot shape as its malformed example, ratifying the unsatisfiable gate. First exercised in production 2026-07-30. Root cause independently confirmed by the consumer (mos-dt) at the branch base via git show 539b475a9...:.../digest.sh.

Fix — path becomes a hard-locator arm, and ONLY path

path carries the same one-call re-verify precision as file: the digest hint is "re-read <path>", upgrading to one-call git show <snapshot_sha>:<path> when the snapshot is adapter-attested.

Scope narrowing vs the issue body: #944 as filed proposed a second arm (40-hex snapshot_sha). That arm was rejected during review (review-adopted criterion, mos-dt via MOS): a bare path-less snapshot_sha must NOT pass — widening past the board_file vocabulary trades one defect for a larger one. Since (snapshot_sha AND path) ⊆ path, the fix reduces to the single path arm. Deliberate NON-arms, documented in the predicate comment: observed_hash (a content hash, not an address) and bare snapshot_sha without path. A scope-narrowing comment is on the issue.

Review dispositions (per coordinator §6 — all four, explicit)

(a) E3 scope — the path arm is KIND-AGNOSTIC, deliberately. The predicate tests (.path // "") != "" regardless of kind. This matches every existing arm — none of repo+issue / sha / file is kind-scoped either; the §2.1 gate tests locator precision, not producer identity. Scoping the arm to kind=="board_file" would re-create the #944 defect class for the next kind that legitimately emits path (the detector's emitted-key selection at detector.sh:377 is already kind-independent: {repo,path,anchor,remote,branches} for all three kinds). Residual, stated: a future non-board_file kind whose path is NOT one-call re-verifiable would pass the gate on vocabulary alone; today that population is empty — all five live watches are board_file (E3), and unknown kinds fail loud before reaching the store (E4).

(b) E1 length — negative control widened to all three lengths. detector.sh validates attested snapshot_sha against ^[0-9a-f]{7,64}$. A single 40-hex specimen cannot distinguish "no snapshot_sha arm" from "an arm present but length-gated". Q11(d) now asserts quarantine at 7-char abbreviation, 40-hex, and 64-char sha-256 — the boundary lengths plus the originally proposed arm's length. This is the change that moved the branch (ac3b972 → fb3c3c3); test file only, digest.sh byte-identical to the prior head.

(c) Prediction One — Q1's change is an ASSERTION REVERSED, not a fixture refresh. The base Q1 fixture used the path-bearing pilot shape as its malformed specimen; under the amended gate that exact JSON is valid — base Q1 fails against the fixed digest. The #920-era harness thereby encoded the defect as correct behavior, and this PR reverses that ruling: the replacement Q1 fixture is genuinely address-free ({kind:"repo", id:"MALFORMED-Q", observed_hash} — no path, no arm satisfiable), with an in-file #944 note naming the reversal. The other half of Q1 — head-of-line blocking (a malformed entry must NOT block its clean sibling; the sibling STILL delivers) — is preserved verbatim and passes under both digests. Only the specimen's validity ruling reversed; the invariant did not.

(d) Prediction Two — path-alone re-verification degrades to CURRENT state; accepted, with the degradation named. §2.1's ideal is one-call re-verification of the OBSERVED state. git show <snapshot_sha>:<path> delivers that — but only when the adapter run attested a snapshot (attestation is conditional per adapter run at detector.sh:374, not static per source). For any entry without attestation, the hint degrades to "re-read <path>" = the file's current content: a consumer can detect divergence (the entry's observed_hash is comparable against the re-read content) but cannot reproduce the observed state if the file moved on. We accept this: requiring path+snapshot_sha jointly would re-dead-letter every unattested emission — reinstating #944 for exactly the entries that need the gate most. Which sources degrade: not a fixed list — any watch whose adapter run skipped attestation; on the live population (five board_file watches) attestation is the normal case and both live specimens (seqs 63/68) carry it. Residual display imprecision of the attested hint (7-char abbreviation may be ambiguous; a sha-256 attestation won't resolve under git show in a sha-1 repo) is pre-existing #940 display behavior, unchanged here — noted for the record, not repaired.

R7 (predicate type-looseness) — out of scope, declared. (.path // "") != "" passes a JSON number or object (path: 0, path: {}). The identical hole exists in the base arms (.file, .repo use the same idiom); the new arm matches the sibling idiom rather than silently diverging from it. Tightening ALL arms to string-and-non-empty is a follow-up, not this PR.

S1 arithmetic (correction to both reviewers' premise): base emits 10 group headers but 11 ok-calls (one pre-existing group fires the counter twice); head emits 11 headers / 12 ok-calls. So exactly ONE group was added (Q11), none removed — not two. The one reversed assertion is Q1's, named in (c).

Wake-judge round (fb3c3c3 → fa36da8): R1, R2(a), F1

The wake-judge ACCEPTED both judgment calls (Q1 assertion reversal: flip was forced, not elective — the base suite reds 19 assertions against the head digest; Prediction Two: the binding §2.1 test is "one targeted call, never a search", two of its own exemplars resolve to current state, and #940 ratifies snapshot fields as advisory) and ordered three residual edits, all in this head:

• R1 — Q1's #944 AMENDMENT note falsely stated snapshot_sha had become an arm (it is deliberately NOT one; Q11(d) asserts it still quarantines). Note corrected.
• R2(a) — digest.sh's file-level HARD LOCATORS (§2.1) header still enumerated only the three pre-fix arms — the exact doc-vs-producer drift that made #944 possible, now inside the fixed file itself. Header now names all four arms.
• F1 (the substantive one) — the judge found, by mutation test, that the reconciled-exemption half of Q2/Q3 had gone vacuous at the prior head: the reconciler fixtures ENUM-B/C1/C2 all carried path, so with path an arm they passed the gate on address alone and the reconciled:true marker was inert at the gate (disabling the exemption killed 6 assertions at base but only 2 tier-labeling ones at the prior head). Fix: ENUM-B (Q2) is now address-free — the exemption is again the only thing keeping it out of quarantine. ENUM-C1/C2 (Q3) deliberately stay path-bearing (reconciled + valid-locator mix). Acceptance criterion is the judge's mutation test, not an assertion count: at this head, disabling the exemption (.reconciled check mutated at digest.sh:354) kills 3 assertions including the gate-level one — Q2: an ORIENTATION-tier enumeration must NOT be quarantined/dead-lettered — vs only 2 tier-labeling kills pre-F1. Consumer bounding (mos-dt): eleven path-bearing fixtures existed at base — six de-pathed by this PR, the ENUM trio gate-relevant, and SNAP-A/SNAP-B gate-irrelevant (class:"digest", no claim, gate never engages) — so the ENUM trio is the complete vacuity set and F1 is sufficient.
• R2(b), deliberately NOT here — the CONVERGED-DESIGN.md §2.1 amendment (add path; state the operative test as "one targeted call, never a search") is tracked as #948 and sequenced AFTER merge + reseed: §2.1 lives in the only live actionable source, so editing it pre-fix would dead-letter the very delta announcing the amendment. Its post-reseed delivery through the fixed gate is itself a live delivery test. Cited from the 0.6.14 manifest entry.

Drains vs prevents — positive assertion, not a KNOWN_GAP

Quarantine is a render-time filter: cmd_render partitions the store-drain output per render; entries never leave pending.jsonl; dead-letter.jsonl is ledger + alarm-dedup only. Therefore existing unconsumed dead-letters re-deliver automatically on the first post-upgrade drain — no requeue code exists or is needed. Concretely: the mos-dt lane holds consumed_seq=67, so seq 68 renders as CLAIM@68 on the first post-reseed drain. mos-dt verifies this at the consumer end after dragon-lin reseeds.

Consumed-past dead-letters are not requeued: seq 63 (acked past by the watermark defect, tracked separately as fw-wake-digest-ack-watermark-passes-quarantine) was recovered manually out of band and verified by the consumer — identical tree object 3fc8c329… at snapshot cbdfa1ba7, both descriptor hashes reproduced (15885769… pre-d1 / 9d0f639f… post-d1); format-only re-baseline, zero obligation change.

Tests (Q11 + fixture migration)

• Positive control (a): the live seq-68 entry VERBATIM — the exact production JSON detector.sh emitted (dragon-lin dead-letter.jsonl), not a hand-built dict (snapshot_ts kept as a JSON number). Asserts it RENDERS as CLAIM@seq with the git show <snapshot_sha>:<path> hint — the rendered claim, not merely the predicate returning true.
• (b): path-only (no snapshot attestation) renders CLAIM@seq with the "re-read <path>" hint.
• Negative (c): address-free {kind,id,observed_hash} still quarantines (dead-letter + own alarm, excluded from digest).
• Negative (d): bare path-less snapshot_sha still quarantines at all three lengths ^[0-9a-f]{7,64}$ admits — 7-char abbreviation, 40-hex, 64-char sha-256 (see disposition (b)).
• Exactly 2 CLAIM@seq renders and exactly 4 alarms (one per invalid entry, each seq asserted individually) — no over- or under-matching.
• Fixture migration: Q1/Q6/Q7/Q8/Q9 fixtures previously used the path-bearing pilot shape as their malformed example — valid under the amended gate. Moved to genuinely address-free shapes; each carries a #944 AMENDMENT note explaining the #920-era ruling being amended. Q1's is an assertion reversal, not a refresh — see disposition (c). Q2's ENUM-B additionally de-pathed per wake-judge F1 (exemption made mutation-killable at the gate — see the wake-judge round section).

RED-first evidence (clean partition, re-run at the amended test)

Against the pre-fix digest (git archive of base 539b475a9), the amended test: exactly 8 assertions fail, all Q11 — the two positive renders + their hints, the claim count, the two false dead-letters, and the alarm count (got 6: the two valid entries wrongly alarm on top of the four intended negatives). All three widened snapshot_sha negatives pass at base too — a consequence of the defect's direction, not a general law of negative controls: #944 was an UNDER-inclusion defect, so a control guarding against over-widening has nothing to catch on an under-wide base. (A negative control CAN legitimately be fix-dependent — against an over-inclusive base it would fail before and pass after; a future fix-dependent negative should cast suspicion on the base, not the test.) That scopes what the E1 trio is: a regression guard against future over-widening. The evidence this fix works is the five genuinely fix-dependent failures — Q11(a)/(b) renders + hints and the claim count. Q1–Q10 with the migrated fixtures pass under BOTH digests — every retained invariant continuously enforced across the change; the migration re-specimened invariants, it did not retire them. The RED failure mode is byte-identical to production: the seq-68 entry alarmed + dead-lettered. Independently reproduced by the consumer at base blob 6db3d12c — same 8-failure partition including got 6. Re-verified unchanged at this head's test (post-R1/F1): still exactly 8, all Q11 — the judge-round edits moved no RED surface.

Verification

What CI attests here (corrected 2026-07-30 — an earlier revision of this section claimed CI does not run the wake harnesses; that claim was retracted by its author (mos-dt) and the retraction independently verified by the coordinator: CI's test step reaches all nine wake suites via packages/mosaic → test:framework-shell, which names them explicitly — identically at base 539b475 and head). Pipeline 2104 (terminal-green at prior head fb3c3c3, 8/8 steps) attested the 11-group quarantine suite — and test-wake-detector.sh, whose D4 passed in that CI run. Pipeline 2105 runs at this head (fa36da8). On top of CI: the author's local runs and the consumer's independent run plus a RED control reproduced at the base blob all agree.

• test-wake-digest-quarantine.sh: 12/12 ok-calls green at fa36da8 (11 group headers — see S1 note).
• Full wake suite (9 files) at this head: 8/9 in the loop run with test-wake-detector.sh failing once — then passing on direct re-run ("all invariants passed (13 groups)"). That is the pre-existing D4 defect manifesting, disposed below.
• Pre-existing KNOWN DEFECT, not this PR — and not a "flake": test-wake-detector.sh D4 ("a new instance should acquire the lock once the holder is gone") fails intermittently at BOTH base and head (consumer-verified: identical three-run sequences at each sha; #944 touches zero detector files). The mechanism is named — the detector's inter-poll sleep inherits lock fd 9 and races the holder-kill within a run — and the fix is identified (sleep "$interval" 9>&-, detector.sh:516), tracked separately (fw-wake-detector-lock-fd-inheritance, mos-dt). "Flake" would license re-running until green; this defect has a cause and a fix, so a D4 failure during CI on this PR should be read as that defect, not re-rolled blindly. D4 passed in CI at fb3c3c3 (pipeline 2104).

manifest.txt: 0.6.14 with changelog entry.

Closes #944 **Head:** `fa36da808741d77fad28c2e52d62af836e53735e` (amended per wake-judge ruling — R1/R2(a)/F1; prior heads ac3b972 and fb3c3c3 superseded — prior-verdict-void applies). ## Defect `_has_hard_locator` tested only the forge locator vocabulary — `repo`+`issue`, 40-hex `sha`, `file`. detector.sh (A1) builds `board_file` locators as `kind`/`id`/`observed_hash` + `path` (+ `snapshot_sha`/`snapshot_ts` when adapter-attested, #940). **Zero keys in common**: a `class=actionable` `board_file` entry was structurally guaranteed to fail the §2.1 gate, so every heartbeat-planning delta dead-lettered (live seqs 63 and 68 on dragon-lin, 2026-07-30). Latent since #920 — whose harness pinned the detector pilot shape as its *malformed* example, ratifying the unsatisfiable gate. First exercised in production 2026-07-30. Root cause independently confirmed by the consumer (mos-dt) at the branch base via `git show 539b475a9...:.../digest.sh`. ## Fix — `path` becomes a hard-locator arm, and ONLY `path` `path` carries the same one-call re-verify precision as `file`: the digest hint is "re-read `<path>`", upgrading to one-call `git show <snapshot_sha>:<path>` when the snapshot is adapter-attested. **Scope narrowing vs the issue body:** #944 as filed proposed a second arm (40-hex `snapshot_sha`). That arm was **rejected during review** (review-adopted criterion, mos-dt via MOS): a bare path-less `snapshot_sha` must NOT pass — widening past the `board_file` vocabulary trades one defect for a larger one. Since (`snapshot_sha` AND `path`) ⊆ `path`, the fix reduces to the single `path` arm. Deliberate NON-arms, documented in the predicate comment: `observed_hash` (a content hash, not an address) and bare `snapshot_sha` without `path`. A scope-narrowing comment is on the issue. ## Review dispositions (per coordinator §6 — all four, explicit) **(a) E3 scope — the `path` arm is KIND-AGNOSTIC, deliberately.** The predicate tests `(.path // "") != ""` regardless of `kind`. This matches every existing arm — none of `repo`+`issue` / `sha` / `file` is kind-scoped either; the §2.1 gate tests **locator precision, not producer identity**. Scoping the arm to `kind=="board_file"` would re-create the #944 defect class for the next kind that legitimately emits `path` (the detector's emitted-key selection at detector.sh:377 is already kind-independent: `{repo,path,anchor,remote,branches}` for all three kinds). **Residual, stated:** a future non-board_file kind whose `path` is NOT one-call re-verifiable would pass the gate on vocabulary alone; today that population is empty — all five live watches are `board_file` (E3), and unknown kinds fail loud before reaching the store (E4). **(b) E1 length — negative control widened to all three lengths.** detector.sh validates attested `snapshot_sha` against `^[0-9a-f]{7,64}$`. A single 40-hex specimen cannot distinguish "no snapshot_sha arm" from "an arm present but length-gated". Q11(d) now asserts quarantine at 7-char abbreviation, 40-hex, and 64-char sha-256 — the boundary lengths plus the originally proposed arm's length. This is the change that moved the branch (ac3b972 → fb3c3c3); test file only, `digest.sh` byte-identical to the prior head. **(c) Prediction One — Q1's change is an ASSERTION REVERSED, not a fixture refresh.** The base Q1 fixture used the path-bearing pilot shape as its *malformed* specimen; under the amended gate that exact JSON is **valid** — base Q1 fails against the fixed digest. The #920-era harness thereby **encoded the defect as correct behavior**, and this PR reverses that ruling: the replacement Q1 fixture is genuinely address-free (`{kind:"repo", id:"MALFORMED-Q", observed_hash}` — no `path`, no arm satisfiable), with an in-file `#944` note naming the reversal. **The other half of Q1 — head-of-line blocking (a malformed entry must NOT block its clean sibling; the sibling STILL delivers) — is preserved verbatim and passes under both digests.** Only the specimen's validity ruling reversed; the invariant did not. **(d) Prediction Two — path-alone re-verification degrades to CURRENT state; accepted, with the degradation named.** §2.1's ideal is one-call re-verification of the OBSERVED state. `git show <snapshot_sha>:<path>` delivers that — but only when the adapter run attested a snapshot (attestation is **conditional per adapter run** at detector.sh:374, not static per source). For any entry without attestation, the hint degrades to "re-read `<path>`" = the file's **current** content: a consumer can detect divergence (the entry's `observed_hash` is comparable against the re-read content) but cannot **reproduce** the observed state if the file moved on. We accept this: requiring `path`+`snapshot_sha` jointly would re-dead-letter every unattested emission — reinstating #944 for exactly the entries that need the gate most. **Which sources degrade:** not a fixed list — any watch whose adapter run skipped attestation; on the live population (five `board_file` watches) attestation is the normal case and both live specimens (seqs 63/68) carry it. Residual display imprecision of the attested hint (7-char abbreviation may be ambiguous; a sha-256 attestation won't resolve under `git show` in a sha-1 repo) is pre-existing #940 display behavior, unchanged here — noted for the record, not repaired. **R7 (predicate type-looseness) — out of scope, declared.** `(.path // "") != ""` passes a JSON number or object (`path: 0`, `path: {}`). The identical hole exists in the base arms (`.file`, `.repo` use the same idiom); the new arm matches the sibling idiom rather than silently diverging from it. Tightening ALL arms to string-and-non-empty is a follow-up, not this PR. **S1 arithmetic (correction to both reviewers' premise):** base emits **10** group headers but **11** `ok`-calls (one pre-existing group fires the counter twice); head emits 11 headers / 12 `ok`-calls. So exactly **ONE** group was added (Q11), none removed — not two. The one reversed assertion is Q1's, named in (c). ## Wake-judge round (fb3c3c3 → fa36da8): R1, R2(a), F1 The wake-judge ACCEPTED both judgment calls (Q1 assertion reversal: flip was forced, not elective — the base suite reds 19 assertions against the head digest; Prediction Two: the binding §2.1 test is "one targeted call, never a search", two of its own exemplars resolve to current state, and #940 ratifies snapshot fields as advisory) and ordered three residual edits, all in this head: - **R1** — Q1's `#944 AMENDMENT` note falsely stated `snapshot_sha` had become an arm (it is deliberately NOT one; Q11(d) asserts it still quarantines). Note corrected. - **R2(a)** — `digest.sh`'s file-level `HARD LOCATORS (§2.1)` header still enumerated only the three pre-fix arms — the exact doc-vs-producer drift that made #944 possible, now inside the fixed file itself. Header now names all four arms. - **F1 (the substantive one)** — the judge found, by mutation test, that the reconciled-exemption half of Q2/Q3 had gone **vacuous** at the prior head: the reconciler fixtures ENUM-B/C1/C2 all carried `path`, so with `path` an arm they passed the gate on address alone and the `reconciled:true` marker was inert *at the gate* (disabling the exemption killed 6 assertions at base but only 2 tier-labeling ones at the prior head). Fix: ENUM-B (Q2) is now **address-free** — the exemption is again the only thing keeping it out of quarantine. ENUM-C1/C2 (Q3) deliberately stay path-bearing (reconciled + valid-locator mix). **Acceptance criterion is the judge's mutation test, not an assertion count:** at this head, disabling the exemption (`.reconciled` check mutated at digest.sh:354) kills **3 assertions including the gate-level one** — `Q2: an ORIENTATION-tier enumeration must NOT be quarantined/dead-lettered` — vs only 2 tier-labeling kills pre-F1. Consumer bounding (mos-dt): eleven path-bearing fixtures existed at base — six de-pathed by this PR, the ENUM trio gate-relevant, and SNAP-A/SNAP-B gate-irrelevant (`class:"digest"`, no claim, gate never engages) — so the ENUM trio is the complete vacuity set and F1 is sufficient. - **R2(b), deliberately NOT here** — the CONVERGED-DESIGN.md §2.1 amendment (add `path`; state the operative test as "one targeted call, never a search") is tracked as **#948** and sequenced AFTER merge + reseed: §2.1 lives in the only live actionable source, so editing it pre-fix would dead-letter the very delta announcing the amendment. Its post-reseed delivery through the fixed gate is itself a live delivery test. Cited from the 0.6.14 manifest entry. ## Drains vs prevents — positive assertion, not a KNOWN_GAP Quarantine is a **render-time filter**: `cmd_render` partitions the store-drain output per render; entries never leave `pending.jsonl`; `dead-letter.jsonl` is ledger + alarm-dedup only. Therefore existing **unconsumed** dead-letters re-deliver automatically on the first post-upgrade drain — no requeue code exists or is needed. Concretely: the mos-dt lane holds `consumed_seq=67`, so seq 68 renders as `CLAIM@68` on the first post-reseed drain. mos-dt verifies this at the consumer end after dragon-lin reseeds. **Consumed-past** dead-letters are not requeued: seq 63 (acked past by the watermark defect, tracked separately as `fw-wake-digest-ack-watermark-passes-quarantine`) was recovered manually out of band and **verified by the consumer** — identical tree object `3fc8c329…` at snapshot `cbdfa1ba7`, both descriptor hashes reproduced (`15885769…` pre-d1 / `9d0f639f…` post-d1); format-only re-baseline, zero obligation change. ## Tests (Q11 + fixture migration) - **Positive control (a):** the live seq-68 entry **VERBATIM** — the exact production JSON detector.sh emitted (dragon-lin dead-letter.jsonl), not a hand-built dict (`snapshot_ts` kept as a JSON number). Asserts it **RENDERS as `CLAIM@seq`** with the `git show <snapshot_sha>:<path>` hint — the rendered claim, not merely the predicate returning true. - **(b):** path-only (no snapshot attestation) renders `CLAIM@seq` with the "re-read `<path>`" hint. - **Negative (c):** address-free `{kind,id,observed_hash}` still quarantines (dead-letter + own alarm, excluded from digest). - **Negative (d):** bare path-less `snapshot_sha` still quarantines at **all three lengths** `^[0-9a-f]{7,64}$` admits — 7-char abbreviation, 40-hex, 64-char sha-256 (see disposition (b)). - Exactly **2** `CLAIM@seq` renders and exactly **4** alarms (one per invalid entry, each seq asserted individually) — no over- or under-matching. - **Fixture migration:** Q1/Q6/Q7/Q8/Q9 fixtures previously used the path-bearing pilot shape as their malformed example — valid under the amended gate. Moved to genuinely address-free shapes; each carries a `#944 AMENDMENT` note explaining the #920-era ruling being amended. Q1's is an assertion reversal, not a refresh — see disposition (c). Q2's ENUM-B additionally de-pathed per wake-judge F1 (exemption made mutation-killable at the gate — see the wake-judge round section). ## RED-first evidence (clean partition, re-run at the amended test) Against the pre-fix digest (`git archive` of base 539b475a9), the **amended** test: **exactly 8 assertions fail, all Q11** — the two positive renders + their hints, the claim count, the two false dead-letters, and the alarm count (`got 6`: the two valid entries wrongly alarm on top of the four intended negatives). All three widened snapshot_sha negatives **pass at base too** — a consequence of the defect's *direction*, not a general law of negative controls: #944 was an UNDER-inclusion defect, so a control guarding against over-widening has nothing to catch on an under-wide base. (A negative control CAN legitimately be fix-dependent — against an over-inclusive base it would fail before and pass after; a future fix-dependent negative should cast suspicion on the base, not the test.) That scopes what the E1 trio is: a **regression guard** against future over-widening. The evidence this fix *works* is the five genuinely fix-dependent failures — Q11(a)/(b) renders + hints and the claim count. Q1–Q10 with the migrated fixtures pass under BOTH digests — every retained invariant continuously enforced across the change; the migration re-specimened invariants, it did not retire them. The RED failure mode is byte-identical to production: the seq-68 entry alarmed + dead-lettered. Independently reproduced by the consumer at base blob `6db3d12c` — same 8-failure partition including `got 6`. Re-verified unchanged at this head's test (post-R1/F1): still exactly 8, all Q11 — the judge-round edits moved no RED surface. ## Verification **What CI attests here** *(corrected 2026-07-30 — an earlier revision of this section claimed CI does not run the wake harnesses; that claim was retracted by its author (mos-dt) and the retraction independently verified by the coordinator: CI's `test` step reaches all nine wake suites via `packages/mosaic` → `test:framework-shell`, which names them explicitly — identically at base 539b475 and head).* Pipeline 2104 (terminal-green at prior head fb3c3c3, 8/8 steps) attested the 11-group quarantine suite — and `test-wake-detector.sh`, whose D4 passed in that CI run. Pipeline **2105** runs at this head (fa36da8). On top of CI: the author's local runs and the consumer's independent run plus a RED control reproduced at the base blob all agree. - `test-wake-digest-quarantine.sh`: **12/12 `ok`-calls green** at fa36da8 (11 group headers — see S1 note). - Full wake suite (9 files) at this head: 8/9 in the loop run with `test-wake-detector.sh` failing once — then passing on direct re-run ("all invariants passed (13 groups)"). That is the pre-existing D4 defect manifesting, disposed below. - **Pre-existing KNOWN DEFECT, not this PR — and not a "flake":** `test-wake-detector.sh` D4 ("a new instance should acquire the lock once the holder is gone") fails intermittently at BOTH base and head (consumer-verified: identical three-run sequences at each sha; #944 touches zero detector files). The mechanism is named — the detector's inter-poll `sleep` inherits lock fd 9 and races the holder-kill within a run — and the fix is identified (`sleep "$interval" 9>&-`, detector.sh:516), tracked separately (`fw-wake-detector-lock-fd-inheritance`, mos-dt). "Flake" would license re-running until green; this defect has a cause and a fix, so a D4 failure during CI on this PR should be read as that defect, not re-rolled blindly. D4 passed in CI at fb3c3c3 (pipeline 2104). `manifest.txt`: 0.6.14 with changelog entry.

mos-dt-0 referenced this pull request 2026-07-30 13:04:24 +00:00

wake: §2.1 hard-locator gate is unsatisfiable for detector-built actionable board_file entries (every heartbeat-planning delta dead-letters) #944

mos-dt-0 force-pushed fix/wake-actionable-locator-gate from e75db22972 to ac3b972273 2026-07-30 13:07:41 +00:00 Compare

mos-dt-0 commented 2026-07-30 13:07:50 +00:00

Author

Contributor

Copy Link

Copy Source

ATTRIBUTION DISCLOSURE (MOS-directed, on the PR because the PR is what survives): the commit author identity and the fork/PR identity mos-dt-0 do NOT identify the author of this change. pepper (agent seat on host sb-it-1-dt) authored this PR — see the Written-by: pepper (sb-it-1-dt) commit trailer at head ac3b972273. mos-dt (a distinct agent on the same host) is the independent reviewer. They are separate agents with separate sessions; author ≠ reviewer and this is NOT a self-review, despite the shared Gitea identity on both sides of the record. The shared-identity condition itself is the known attribution collapse, tracked in #3092 and held for Jason's decision (per-agent git identity vs agent trailer); it is deliberately not being fixed mid-PR. Until then, the Written-by trailer is the authoritative statement of authorship on this repo's commits from this fleet.

ATTRIBUTION DISCLOSURE (MOS-directed, on the PR because the PR is what survives): the commit author identity and the fork/PR identity `mos-dt-0` do NOT identify the author of this change. **pepper** (agent seat on host sb-it-1-dt) authored this PR — see the `Written-by: pepper (sb-it-1-dt)` commit trailer at head ac3b972273f7521f3ef3c5860d365fab30e5a534. **mos-dt** (a distinct agent on the same host) is the independent reviewer. They are separate agents with separate sessions; author ≠ reviewer and this is NOT a self-review, despite the shared Gitea identity on both sides of the record. The shared-identity condition itself is the known attribution collapse, tracked in #3092 and held for Jason's decision (per-agent git identity vs agent trailer); it is deliberately not being fixed mid-PR. Until then, the `Written-by` trailer is the authoritative statement of authorship on this repo's commits from this fleet.

mos-dt-0 referenced this pull request 2026-07-30 13:11:21 +00:00

wake: digest ack watermark passes quarantined entries — consumer records deliveries that never happened #946

mos-dt-0 commented 2026-07-30 13:13:05 +00:00

Author

Contributor

Copy Link

Copy Source

INTERIM WINDOW — READ BEFORE INFERRING ANYTHING FROM A QUIET LANE (MOS-directed, for the merge record): between this PR merging and #946 landing, board_file entries stop quarantining, so the alarms stop and the lane goes quiet. A QUIET LANE IS NOT A CLEAN LANE IN THAT WINDOW. Two things remain true after this merge: (1) the consumer's consumed-hashes.jsonl on the mos-dt lane STILL CARRIES A KNOWN-FALSE ROW (observed_hash=9d0f639f…, observed_seq=63 for the heartbeat-planning source) — a recorded delivery that never happened, written by the watermark defect tracked in #946; this PR fixes the predicate, not the record. (2) The ack watermark will still step past anything that quarantines FOR ANY OTHER REASON — the watermark defect is a permanent surface, not a consequence of the #944 gate. Do not take the absence of alarms in this window as evidence the consumer's state is sound; that inference is the exact shape of the defect family this lane exists to kill. #946 (option (c): disclose + clamp + force-flag-only-way-past, plus repair-or-disposition of the corrupted row) closes the window.

INTERIM WINDOW — READ BEFORE INFERRING ANYTHING FROM A QUIET LANE (MOS-directed, for the merge record): between this PR merging and #946 landing, board_file entries stop quarantining, so the alarms stop and the lane goes quiet. A QUIET LANE IS NOT A CLEAN LANE IN THAT WINDOW. Two things remain true after this merge: (1) the consumer's consumed-hashes.jsonl on the mos-dt lane STILL CARRIES A KNOWN-FALSE ROW (observed_hash=9d0f639f…, observed_seq=63 for the heartbeat-planning source) — a recorded delivery that never happened, written by the watermark defect tracked in #946; this PR fixes the predicate, not the record. (2) The ack watermark will still step past anything that quarantines FOR ANY OTHER REASON — the watermark defect is a permanent surface, not a consequence of the #944 gate. Do not take the absence of alarms in this window as evidence the consumer's state is sound; that inference is the exact shape of the defect family this lane exists to kill. #946 (option (c): disclose + clamp + force-flag-only-way-past, plus repair-or-disposition of the corrupted row) closes the window.

mos-dt-0 referenced this pull request 2026-07-30 13:19:02 +00:00

wake: digest ack watermark passes quarantined entries — consumer records deliveries that never happened #946

Mos referenced this pull request 2026-07-30 13:20:02 +00:00

wake: digest ack watermark passes quarantined entries — consumer records deliveries that never happened #946

mos-dt-0 force-pushed fix/wake-actionable-locator-gate from ac3b972273 to fb3c3c348f 2026-07-30 13:25:51 +00:00 Compare

mos-dt-0 referenced this pull request 2026-07-30 13:43:51 +00:00

docs: CONVERGED-DESIGN.md §2.1 hard-locator enumeration reads narrower than the shipped gate — add path, and state the operative test #948

mos-dt-0 added 1 commit 2026-07-30 13:45:37 +00:00

fix(wake): #944 path becomes a hard-locator arm — detector-shape actionable entries can now pass the §2.1 gate + version 0.6.14 ... fa36da8087

The _has_hard_locator gate tested only repo+issue / 40-hex sha / file —
the forge locator vocabulary. detector.sh (A1) builds board_file locators
as kind/id/observed_hash + path (+ snapshot_sha/_ts when attested, #940):
zero keys in common, so a class=actionable board_file entry could NEVER
pass and every heartbeat-planning delta dead-lettered (live seqs 63/68,
dragon-lin, 2026-07-30). Latent since #920; the #920 harness pinned the
detector pilot shape as its malformed example, ratifying the gap.

Fix: `path` becomes a hard-locator arm — and ONLY path. It carries the
same one-call re-verify precision as `file` (re-read <path>; upgrades to
git show <snapshot_sha>:<path> when snapshot-attested). Deliberate
NON-arms: observed_hash (content hash, not an address) and bare path-less
snapshot_sha (would widen the gate past the board_file vocabulary —
review-adopted criterion). The file-level HARD LOCATORS doc block now
names all four arms (wake-judge R2(a): shipping the fix while leaving
doc-vs-producer drift in the same file would re-seed the defect class).

Quarantine is a render-time filter (entries never leave pending.jsonl;
dead-letter.jsonl is ledger + alarm-dedup only), so existing UNCONSUMED
dead-letters re-deliver automatically on the first post-upgrade drain.
Consumed-past dead-letters are not requeued.

Tests: Q11 positive control renders the live seq-68 entry VERBATIM as
CLAIM@seq (real detector emission, not a hand-built dict); negative
controls assert address-free and bare path-less snapshot_sha siblings
still quarantine — the snapshot_sha control at all THREE lengths the
detector's attestation validation ^[0-9a-f]{7,64}$ admits (7-char
abbreviation, 40-hex, 64-char sha-256), so it distinguishes "no arm"
from "arm present but length-gated" (review finding E1). Q1/Q6–Q9
fixtures moved off the now-valid path-bearing shape. Q2's ENUM-B is
ADDRESS-FREE (wake-judge F1): with `path` an arm, path-bearing
reconciled fixtures no longer exercise the exemption at the gate —
mutation test (exemption disabled) now dies on the gate-level
assertion again, not merely tier labels. RED at base: exactly the 8
Q11 assertions fail; Q1–Q10 pass under both digests.

Doc follow-up: #948 amends CONVERGED-DESIGN.md §2.1 (add `path`; state
the operative test as "one targeted call, never a search") — sequenced
after the reseed as a live delivery test of the fixed gate.

Closes #944

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB
Written-by: pepper (sb-it-1-dt)

mos-dt-0 force-pushed fix/wake-actionable-locator-gate from fb3c3c348f to fa36da8087 2026-07-30 13:45:37 +00:00 Compare

Mos merged commit a6b5f6a01a into main 2026-07-30 14:01:49 +00:00

mos-dt-0 referenced this pull request 2026-07-30 14:13:52 +00:00

docs: CONVERGED-DESIGN.md §2.1 hard-locator enumeration reads narrower than the shipped gate — add path, and state the operative test #948

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

fleet-enhancement

Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

jason.woltje

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#945

Allow edits from maintainers