Recover LocalHarness checkout and admission interruptions

Merged
VA
3d ago
+1147-100

Problem

Follow up the four explicitly deferred #495 findings and the #615 admission cancellation finding: pending directory preparation could never reopen, checkout selection loaded Git state twice, concurrent volume opens shared and deleted staging, multiple path writes reused one native publication journal, and a cancelled submission could leave an unadmitted current head blocking later runs or resume.

Design

  • Resume pending preparation through the original journal custody, exclusive record lock, root/parent identities, and empty held staging directories. Re-derive and persist the child identities idempotently; reject foreign content or changed allocations.
  • Read the selected workspace and reconciliation marker together through checkout_selection(). Open passes that marker directly to recovery and performs no second Git-state load when it is absent.
  • Exclusively create a unique private staging directory for each volume-open attempt. Publish a complete view with the existing native-runtime atomic no-replace rename. A losing attempt removes only its own completed staging directory.
  • Derive each retained checkout journal identity from the original operation and accepted canonical file path. Retries retain the same identity without overwriting subsequent user edits.
  • Treat a current request with no durable admission as replaceable after authoritative reconciliation confirms absence. Explicit resume may admit that retained current request under the existing admission gate. Uncertain admissions and mismatched current requests remain errors.

Deletions

Remove the shared project-initializing deletion path, operation-only publication key, duplicate open-time Git load, and unrecoverable preparation error. Repoint callers to the single selection API; no compatibility shim. Delta: +1147/-100, net +1047 lines, predominantly crash/cancellation/property/model verification.

Decisions

  • State stays in the existing filesystem provider journals, Git state and request files. No service, gateway, transport, alternate admission store, polling, or global fault state is added. Task-file execution/publication remains #645 and its immediate follow-up.
  • Every native write and durability call is observed on the original per-invocation ledger in unit tests. The crash sweep discovers its complete write count, exits child processes without unwinding at every cut, reopens the original allocations, and compares disk with the target generation and unchanged logical head. The broken control reinstates rejection of a pending preparation. Separate shrinking properties reject foreign staging contents.
  • Existing funded LogBuffer serialization now emits one journal record write rather than a syscall for each JSON token. Encoding and every buffer backing remain charged to the original ledger. A round-trip/work-count property proves that payload token count does not add native writes. This buffers one record; it does not batch events or defer their publication.
  • Bootstrap Loom executes the production initialization function with the atomic filesystem primitive modeled explicitly; the shared-staging negative control must fail. Admission models use the real crate-local owned-lock shim with cfg(acyclic_harness_loom), including an orphan-recovery/replacement race and missing-gate negative controls. Ordinary builds keep ordinary synchronization.
  • Admission tests drop the actual publication future at its head-write and admission acknowledgement boundaries, using push signals without sleeps. They demonstrate the former outcome/attach failures and verify new-run recovery and reopen/resume exactly once with ScriptedModelProvider.
  • A cancelled, unpublished bootstrap attempt may retain its private staging directory. It never cleans another attempt or removes a directory while its native job may still be writing.
  • Based on main 13590b5c7, including newly merged #495 and #615 APIs. No README changes in this PR.

Tests run

Passed: rustfmt on touched Rust files, git diff --check, old-call/key/shared-staging/error-path searches, and source/test size checks.

Validation pending bb1 maintenance. The prior #495 and qualifier jobs expired without admission after the maintenance marker remained for 60 minutes; no runtime pass is claimed. One combined remote gate is queued through bs.ps1 for this signed head: focused filesystem and harness library builds; direct-binary preparation/write-cut, journal/accounting, LocalHarness, reconciliation interruption, admission cancellation and goal-consumer suites; then the dedicated cfg-only Loom models and broken controls. The gate unsets RUST_MIN_STACK, prints reusable binaries and per-suite timings, stops on the first failure, and checks the 10-second verification budget after compilation. There is no second lane build queued.

Live steps

Post the queued runtime/model results and timings when bb1 admits the gate. Windows/macOS native no-replace directory publication remains to be exercised on those platforms. Continue #645 after this PR is opened, and update README-only #509 separately without checking the human-written box.

Summary by cubic

Recovers LocalHarness checkout, publication, and admission interruptions that previously left pending work unrecoverable or blocked later runs.

  • Pending directory preparation resumes from its original journal instead of failing as indeterminate, and rejects foreign staging content.
  • Open reads the workspace selection and reconciliation marker in one Git-state load instead of loading twice.
  • Each volume-open attempt owns a private staging directory; losing attempts remove only their own.
  • Publication journal identities now bind the operation and file path, so retries keep one identity and never overwrite subsequent user edits.
  • A cancelled submission with no durable admission no longer blocks a new run; explicit resume may admit the retained current request.
  • Journal serialization writes one record instead of one syscall per JSON token, without changing event publication.
  • Crash sweeps cut every native write in child processes and verify recovery at each cut; Loom models cover shared-staging and orphan-recovery races.