fix(publication): recover durable generation journals - #56
Merged
Conversation
Preserve protected retirement evidence through explicit initial-path observation hooks and retain exact v2 client fixtures for the remaining migration work. Read-evidence prerequisite for fixes #53; publication remains gated on the complete journal replacement.
Implement the bounded generation-format and publication group of the journal replacement. Existing public v2 entrypoints remain active; rotation integration, migration, and final safety evidence remain pending. Fixes #53
Partial group 3 implementation toward fixes #53. Public v3 entrypoints remain disabled; projection temporary ownership and crash cleanup still require followup before group 3 is complete.
Checkpoint the read-only historical authority parser for fixes #53; public migration remains protected v2 until the acknowledged blocker and installation contract is complete.
Preserve mandatory core, crash, stress and maximum CI gates as explicit sequential suites. Fixes #53.
43 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Managed Prime publication is blocked by a race between journal rotation and readers following the journal directory path. This replaces that authority with immutable generation containers: a complete successor becomes authoritative through one durable rename, and recovery accepts only authenticated state on the same filesystem inode.
Legacy migration requires explicit acknowledgement that old clients are stopped. It durably fences fresh old clients before source retirement, preserves the original v1 directories and complete v2 provenance, and reconstructs the initial generation from that state. Callback writes stay staged until return; delayed projection writers repair forward; bounded cleanup retains proof through its final deletion. Interrupted receipt and guard publication complete their missing durability barriers before dependent work.
Regression coverage preserves the historical parser, migration and valid handoff matrices. Deterministic negative controls reproduce v2's known root-discovery and stale-link-proof refusals without callbacks or projection changes. Current public v3 tests require 36 processes across three rounds to survive stale root listings with identical receipts, and require unsafe pinned reads to fail closed before a fresh operation converges.
Startup heartbeats and projection repair are included in bounded claim admission. If they consume the remaining capacity, the exact owned claim is released and rotation finishes before any callback or heartbeat scheduler starts. Hook, I/O and ownership errors retain their original identity. Migration stress also reproduces a stale pre-intent snapshot encountering a peer's new blocker receipt: that exact refusal is accepted only for known migration scenarios, followed by fresh-process checks of the original source inode, complete provenance and unchanged state.
Validation: final commit 890e410 passes all 203 core tests and 28 stress tests with no failures or skips. The exact Linux crash-cut regression fails before the fix and passes after it with the same 1,024-byte fixture; focused macOS operation and migration tests also pass. All 18 recorded crash traces retain their exact counts and hashes (3,034 cuts). Required static checks, normal commit hooks and all three scoped checkpoint reviews pass.
Final CI run 34588962552 and its required aggregate are green on commit 890e410. Ubuntu 24.04 and macOS 15 each passed all 203 core tests, 28 stress tests, all 3,034 process-crash cuts across 18 scenarios, and the actual 16 MiB maximum, with zero failures, cancellations or skips in these suites. Downloaded artifacts on both platforms match reviewed tree 7aeeec169d3f843f363fa1c3fa8bf9edc17512c4 and Node 22.23.2. Every crash diagnostic was checked for exact index, pinned trace hash, SIGKILL, distinct captured owner/recovery PIDs and a valid root inode. The full-size test charged 492,146,332 bytes on Linux and 492,146,436 bytes on macOS. Full logs and source/runtime identifiers are retained in the CI artifacts. Ordinary tests, package reproducibility, both installed artifact checks and changelog checks also pass. Preview/stable workflow policy bytes are unchanged.
Closes #53. Managed preview/stable publication and Pylon installation follow through the existing protected workflows after recorded maintainer merge approval.
Implemented with GPT-6 using Codex in Pylon.