← graph

fix-late-exit-overwrites-durable-success

Prevent late worker exit from overwriting durable success

Metadata

Statusdone
Agent identityfbb2d89fe44d6b761bcb4b67748ab3d417f29df70a65f8d9403308f5bb2bab78
Created2026-08-03T06:11:13.329395691+00:00
Started2026-08-03T06:11:22.593410725+00:00
Completed2026-08-03T09:42:51.498997602+00:00
Tagslifecycle, containment, graphsave

Description

Fix the repeated self-hosting contradiction where task-owned completion succeeds and finalization is durable/Cleaned, but the wrapper later exits nonzero or reports provider timeout/unavailable and service triage overwrites the graph task to Failed. This occurred for formalize-lifecycle-finish-lean4, fix-brokered-deliverable-preflight-worktree generations 0/1/2, and likely other tasks.

Implement a narrow terminal-precedence containment rule consistent with first-terminal-result-wins:

  • Once the exact attempt has a durable accepted promotion/output + cleanup receipt (or task-owned wg done has durably committed successful completion), later wrapper/process/provider exit diagnostics are observational evidence only and cannot emit AttemptFailed or change Done/accepted completion to Failed.
  • If a Cleaned accepted finalization exists but the graph projection is missing/contradictory, deterministic convergence projects success; it must not trust a later process exit over the durable transaction.
  • Before durable successful completion, genuine process failure remains failure.
  • Fence by graph/task/generation/attempt/fence; an old transaction cannot bless a newer attempt, and a stale process cannot mutate either.
  • Preserve the late failure diagnostic in logs/evidence without granting lifecycle authority.

Use exact incidents as fixtures: formal task finalization Cleaned + main 347a1696 followed by provider timeout; broker-preflight finalization Cleaned + main c433cb68, later retained smoke commits through ccf51d90, and worker summaries saying wg done succeeded followed by provider-unavailable/Failed. Do not implement the full atomic GraphSave design and do not silently mark unrelated legacy Done records successful.

Validation

  • Focused reducer/service tests: success then nonzero exit remains successful; Cleaned then provider timeout converges success; nonzero exit before success remains Failed; stale generation/attempt/fence cannot borrow an older Cleaned transaction; late diagnostic remains inspectable.
  • Candidate-binary smoke runs a worker that completes task-owned Land, then forces wrapper nonzero exit; task is Done/Landed/Cleaned exactly once, dependency becomes ready exactly once, no duplicate promotion, and process failure is diagnostic only.
  • Existing exited_worker_finish_convergence.sh and brokered_deliverable_worktree_preflight.sh pass.
  • cargo fmt --check, focused tests, cargo check, and cargo clippy pass.

Depends on

Required by

Log