Exercise goal admission and replay through task volume scenarios
Supersedes #600. Includes the private-goal cases previously folded from #700.
Goal coverage previously ran a test-owned continuation policy, so production admission or published completions could break while cases stayed green. Forty-five small case files now submit ordinary task request files through LocalHarness, follow real scheduler frames, check terminal states and final scratch/project bytes, then cold-reopen without redispatching the model. Every admitted task, including every automatic continuation, must publish its own terminal status before recovery can repair it; cold reopen and replay must preserve the complete status files.
Design
The shared dispatcher polls non-Send drivers on one event-loop thread. Send goal futures now use the existing runtime workers and original native schedule. An AbortOnDropHandle owns cancellation; the full five-second guard, workloads, admission and runtime configuration are preserved.
Two goal-path defects exposed by the fixtures are fixed at their shared boundaries. Authority publication advances past immutable rejected proposal slots while retaining the first committed operation. Content creation, retry and operation recovery reuse the immutable generation they already hold instead of reopening it.
This branch contains signed, non-merge commits from main. It contains only this lane's changes. The complete goal family passes without #985; no unmerged prerequisite is included or required.
Guarantee
- Class: I/H/C. One production-backed driver owns submission, followed frames, terminal status and cold-reopen assertions. Immutable rejected-slot identities distinguish rejected proposals from a committed operation. A private retained-generation reader is the single path for Create, Retry and Observe/recovery, preserving descriptor validation, cancellation and original native funding.
- Proof: All 45 scenarios, six schema/property/oracle tests, disabled-admission and file/view/request/frame/status mutation controls, and two worker/native-schedule checks. A shrinking property checks the complete admitted-task/status-file bijection under missing, wrong-identity, wrong-key, stale-state, channel and duplicate mutations at every task; restoring root-only scope accepts continuation faults, providing the negative control. The scenario runner applies the same oracle before cold reopen, immediately after open and after replay, comparing the complete files. The inline restoration control fails the same worker assertion. Independently initialized retained-read histories at N=16/32 compare full FileRefs/bytes, exact errors, ordered observations and all six allocation fields through every entry under unmetered, ordinary and original-native custody; restored reopening and unfunded-copy controls fail their invariants. Two-thread real-shim Loom covers every publication/retry cut and duplicate publication, including the actual original-key control. Shared-code codec fuzzing uses the checked-in corpus and shrinking round-trip properties. A racing Stream provider lands a rival in the operation slot between lookup and proposal: a rejected rival yields Conflict and the successor slot publishes, a rejected rival after a fence yields Fenced, a committed divergent rival replays as AlreadyCommitted, and a cancelled failing lookup reports Cancelled.
- Entry points: Task-file LocalHarness admission, every continuation terminal status before and after cold reopen/replay, settled automatic continuation, scratch/private GOAL.md and project isolation, settled replay/cold reopen; filesystem authority compare-and-append/find-operation; content creation, idempotent retry and retained-operation recovery; scenario parsing/serialization and fuzz entry.
- Gaps: none. The goal-scenario fuzz build and checked-corpus sweep passed as separate bb2 jobs (Claude pass, 9ae990b51).
Validation
All runtimes exclude compilation and queues. Linux and Windows GNU ran through bs.ps1 on bb2. Round-two validation below covers the final review fixes.
| Gate | Result | Runtime |
|---|---|---|
| Full goal family, both unchanged default-cap boundaries | 45 passed | 3.691 s |
| Original goal properties/oracles | 6 passed | 0.638 s |
| Goal parser/property/corpus target | 10 passed | 0.209 s |
| Worker placement and original native schedule | 2 passed | 0.012 s |
| Rejected-slot properties | 2 passed | 0.028 s |
| Authority regressions | 8 passed | 0.007 s |
| Pinned/retained reads, custody, exact-work controls | 5 passed | 0.632 s |
| Real-lock publication Loom, including original-key control | 3 passed | 0.09 s |
| Goal scenario fuzz build (standalone job, pinned nightly, shared target) | passed | 1,738 s compile |
| Goal scenario fuzz sweep, checked corpus, 512 runs | passed (cov 4379, no crash) | <1 s |
| Raced operation-slot regressions (Claude pass) | 4 passed; fence and cancellation controls fail on 34eca0962 | 0.02 s |
| Windows GNU filesystem/Harness lib + tests | passed | 320.532 s compile |
Native test compilation took 783.851 s. Artifacts: goal-clean-main-3as0vl16; buildbox log 2026-10-18T165756816Z-3104267.log. No deadline or limit was raised.
The paired retained-reader proof restores the actual old reopen inside the same production entry and initializes each side separately. At N=16/32 it removes exactly 63 allocations/20,720 bytes for unmetered Create, 101/27,658 for ordinary Create, and 131/29,794 for native Create. Retry and recovery save 102/28,039 ordinary and 132/30,562 native. Required tree comparisons can grow with the tree; the wrapper adds exactly two ordinary items or zero native items beyond the independently measured generation read. These are component work bounds, not a claim that an entire turn is constant-cost.
Paired measurement command (resolve the test executable once from Cargo JSON, then rerun it directly):
cargo test --locked -p acyclic-fs -p acyclic-harness --lib --test e2e --test goal-files --features acyclic-harness/filesystem-local,acyclic-harness/native-execution,acyclic-harness/mcp-http,acyclic-harness/grpc,acyclic-harness/terminal,acyclic-harness/search-http --no-run --message-format=json
"$harness_test" filesystem::pinned_read_tests::retained:: --nocapture
E2E_FILTER=/scenarios/goals/ "$e2e_test" scenarios --exact --nocapture
Run each qualification phase in a separate bs.ps1 job (never chain them):
bash scripts/qualify-goal-scenarios.sh models
bash scripts/qualify-goal-scenarios.sh fuzz-build
bash scripts/qualify-goal-scenarios.sh fuzz-sweep "$goal_fuzz_executable"
The scenario tier would have caught lost automatic admission, completions and persistence earlier. The former policy-owned runner could not; it is deleted. The worker control catches placement on the sole dispatcher thread without timing assertions.
Round 2 review (106ecd2fb77c1d5888d4a6ebdd086449c643fa31)
Reviewed 34eca0962..9ae990b51 and verified all three previous findings. One additional P2 test-coverage finding was fixed: automatic continuations had completion frames but no assertion that their terminal status files existed before recovery could repair them. One shared oracle now checks the exact set of admitted tasks, file keys, embedded identities and completed states. The full status files must also remain byte-identical immediately after cold open and after replay. No production behavior or deadline changed.
The shrinking property covers every task position under omission, misaddressing, stale-state, channel and duplication faults. The restored root-only scope accepts every continuation fault, the negative control for the missing assertion class. The same oracle runs through all 45 production-backed scenarios.
| Final-head gate | Result | Wall |
|---|---|---|
| Filesystem distributed authority | 35 passed | 0.031 s |
| Harness retained reads | 3 passed | 0.608 s |
| Goal properties/oracles, including the new mutation property | 9 passed | 0.590 s |
| Complete goal family with unchanged default-cap boundaries | 45 passed | 4.151 s |
| Goal-file parsing | 10 passed | 0.202 s |
| Windows GNU filesystem/Harness lib + tests, same canonical six features | passed | 76 s compile |
Native compilation took 638 s. Gate artifact: Q:/lanes/passes/1037/pr-1037-codex-gate.log; buildbox job 1792353978250-395910, log 2026-10-18T200618250Z-395910.log. Earlier real-lock Loom and fuzz results are reused because those sources are unchanged. The complete default-cap family and independent retained-read counters close this candidate's GOAL-speed row (R600-010638.1); no workload, limit, or guard was reduced.
Deletions and decisions
Delete two standalone goal catalogs and their continuation/write runners; retain their cases as discovered scenario files. The codec stays separate from worker scheduling so e2e and fuzz compile the same parser. Net delta: +2,430 / -427 lines (+2,003), across 84 files. No new store, protocol or goal API.
Coordinator: add cargo test --locked -p acyclic-fs --lib distributed:: and the separate models, fuzz-build and fuzz-sweep invocations to the bb2 qualification gate. The script rejects a missing phase; a sweep requires an existing executable and cannot compile. Each phase prints its elapsed time and exit status, and fuzz-build preserves the shared target directory. The model phase requires each named model/control to exist. No ceiling or deadline is raised and no GitHub-hosted Rust job is added.
The first combined qualification job reached the build-slot ceiling before fuzz execution. The split qualification phases subsequently passed: models (658 s including compilation), fuzz-build (1,738 s), and the checked-corpus 512-run sweep (<1 s runtime).
Live steps
The user deferred the macOS allocation-oracle run pending ivar/Tailscale access. Fuzzing is Linux-only and excluded from the Windows cross-check. Shared DST live-finding integration remains co-dst-owned under the coordinator's ordering; this PR's own production-path proofs are its merge requirement.
Summary by cubic
Goal e2e coverage previously ran a test-owned continuation policy, so production admission or published completions could break while cases stayed green. The 45 goal scenarios now run as ordinary task requests through LocalHarness, follow real scheduler frames, verify terminal states and final scratch/project bytes, and cold-reopen without redispatching the model. The test-owned runner is deleted.
Fixes
- Authority publication advances past immutable rejected proposal slots while retaining the first committed operation; racy idempotency mismatches are now classified Fenced or Conflict by the authority contract, and cancellation precedes failed operation lookups.
- Content creation, retry, and operation recovery read from the immutable generation they already hold instead of reopening it, preserving descriptor validation and cancellation.
Coverage
harness-fuzzgains agoal_scenariofuzz target sharing the same codec as the e2e runner, with a checked-in corpus.scripts/qualify-goal-scenarios.shsplits models, fuzz-build, and fuzz-sweep into separate build-slot phases; the fuzz sweep is pending an isolated run.