eed04d55a5
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
T9 (burn-before-enqueue, #908 arrow #1) forced the durable pending-write failure via `chmod 500 "$STATE_DIR"`. That works only as a non-root user: DAC permission checks (including a read-only directory) are bypassed entirely by root, and Woodpecker CI containers run as root — so the write silently succeeded, observed_seq advanced, and all three "failed-write" assertions went spuriously green. The chmod also blocked the cursor's (observed_seq) own mktemp in the same directory, so even under a non-root run T9 could never have caught a premature cursor commit — narrower coverage than its comment claimed. The product code (store.sh) was already correct: the durable pending write is textually first and the cursor write is gated on its success (verified independently, unchanged here). Fix: bind-mount a throwaway file over $STATE_DIR/pending.jsonl (the exact _atomic_write rename TARGET for the durable write) so the atomic write's `mv -f tmp target` hits EBUSY — the kernel refuses to rename any file onto an ACTIVE MOUNT POINT. That is a structural VFS constraint, not a DAC check: no uid, root included, can bypass it short of an explicit umount. observed_seq is left an ordinary writable file, untouched by the mount, so a regression that commits the cursor before/independent of the durable write is now genuinely caught. The mount + forced enqueue run inside a private `unshare --mount --user --map-root-user` namespace so the same mechanism applies whether the harness runs unprivileged (dev) or as root (CI); the bind mount is private to that namespace and vanishes the instant it exits, so no manual cleanup step is needed afterward. sweep: grep chmod/chattr across all packages/mosaic/framework/tools/wake/test-*.sh -> T9's `chmod 500 "$STATE_DIR"` (fixed here) was the ONLY permission-based fault-injection use. Every other chmod hit is `chmod +x` making a mock/ fixture script executable (benign setup, not failure injection, unaffected by root): test-wake-reconcile.sh:68, test-wake-detector.sh:110, test-wake-digest-hmac.sh:164, test-wake-beacon.sh:70/79/88/103/311, test-wake-store-ack.sh:246 (mock curl/wget/nc/ssh binaries). Verified: enqueue under the injection exits non-zero as the current non-root user, with the process reporting uid 0 INSIDE the namespace (genuine kernel-mapped root) and still failing EBUSY — a direct proof the mechanism is root-proof, not just an argument. fakeroot was tried per request but only fakes stat/chown (no real mount capability), so it is not a meaningful vehicle for this injection and was not used as the proof. Coverage-RED reproduction: temporarily moved the observed_seq cursor write in store.sh to before the durable pending write (premature commit) -> T9 went RED (observed_seq wrongly advanced to 2, post-failure allocation wrongly resumed at 3); reverted -> GREEN again, diff-clean against origin. Full `pnpm run test:framework-shell` rc=0 (all harnesses, T9 included, 11/11 wake store/ack groups green); re-run with openssl masked from PATH (command -v openssl confirmed empty) rc=0, wake store/ack harness unaffected (an unrelated harness, test-wake-digest-hmac.sh, gracefully SKIPs without openssl -- pre-existing, orthogonal, HMAC is W3/A5 not W2). shellcheck 0.11 clean (one deliberate SC2016 on nested-shell variable expansion, disabled inline per this repo's existing convention). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb