local-fs: make post_comment atomic (write-temp + rename), with a crash test #13

New issue

Closed

opened 2026-08-11 14:56:49 +00:00 by jbr870 · 1 comment

jbr870 commented

2026-08-11 14:56:49 +00:00

Owner

Observed failure

An mtime-pin failure left an orphaned partial test-plan:v1 with a malformed created_ms (axana
dogfood run). The comment existed, the pin did not, so the record was unreadable by the consumers that
order on created_ms.

What it needs

local-fs allocates a comment in several steps — pick the next number, write the file, pin the mtime to
epoch_ms (which is what makes created_at = mtime, and therefore what makes an edit detectable as
mtime > epoch_ms). Those steps must become one commit point: write to a temp file, pin it, then
rename into place. A crash anywhere before the rename must leave no visible comment at all.

Plus a crash test: interrupt between the steps and assert that no partial comment is observable.

Why it matters more here than it looks

local-fs is the adapter the contract is developed against, and the mtime pin is load-bearing for the
immutability check (phase-outcome.md read_all step 3). A partial write does not just lose a comment
— it can produce a false edit signal on a record that was never edited.

Source: dogfood retrospective 2026-08-07 (F5), deferred backlog.

## Observed failure An mtime-pin failure left an **orphaned partial `test-plan:v1`** with a malformed `created_ms` (axana dogfood run). The comment existed, the pin did not, so the record was unreadable by the consumers that order on `created_ms`. ## What it needs `local-fs` allocates a comment in several steps — pick the next number, write the file, pin the mtime to `epoch_ms` (which is what makes `created_at = mtime`, and therefore what makes an *edit* detectable as `mtime > epoch_ms`). Those steps must become **one commit point**: write to a temp file, pin it, then `rename` into place. A crash anywhere before the rename must leave no visible comment at all. Plus a **crash test**: interrupt between the steps and assert that no partial comment is observable. ## Why it matters more here than it looks `local-fs` is the adapter the contract is developed against, and the mtime pin is load-bearing for the immutability check (`phase-outcome.md` `read_all` step 3). A partial write does not just lose a comment — it can produce a **false edit signal** on a record that was never edited. *Source: dogfood retrospective 2026-08-07 (F5), deferred backlog.*

jbr870 referenced this issue

2026-08-13 07:34:30 +00:00

local-fs comment integrity — portable mtime pinning + atomic post_comment #26

jbr870 referenced this issue

2026-08-13 07:35:14 +00:00

local-fs comment integrity — portable mtime pinning + atomic post_comment #26

jbr870 commented

2026-08-13 07:35:14 +00:00

Author

Owner

{"status":"active","into_issue":"26","source_kind":"sibling-stub","absorbed_finding_refs":[],"rationale":"post_comment atomicity (write-temp + pin + rename, crash test) consolidated into the local-fs comment-integrity feature (#26) — the blast radius of the mtime-pin failure #23 observed"}

```json {"status":"active","into_issue":"26","source_kind":"sibling-stub","absorbed_finding_refs":[],"rationale":"post_comment atomicity (write-temp + pin + rename, crash test) consolidated into the local-fs comment-integrity feature (#26) — the blast radius of the mtime-pin failure #23 observed"} ```

jbr870 closed this issue

2026-08-13 07:35:15 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

jbr870/devwork-skills#13

No description provided.

Rows
Columns