Findings 11/12: the operator startup reconcile thread (rune_operator.py:1986)
IS the only reconcile cadence — no recurring timer exists in the codebase;
recorded as deviation 8 per the deviations contract. The O(N^2)
mark_consumed note is resolved by the finding-2 sidecar design. Full
finding -> commit -> red-evidence table appended to the Completion Record.
Follow-up to the AutoFiler protocol change: _reconcile_guarded carried
filer: Any; it now annotates the FailureAutoFiler (TYPE_CHECKING import,
string annotation — no future import in this module). The startup
reconcile thread is explicitly documented as the maintenance cadence
(finding 11's deviation record).
subsystem_health.set_auto_filer/record_failure carried filer: Any | None.
A minimal AutoFiler Protocol (callable with (subsystem, error, tier),
matching FailureAutoFiler.__call__ and the test doubles) now carries the
contract; _reconcile_guarded's filer param in rune_operator is typed to
FailureAutoFiler.
A 10KB single-token error string made a 10KB dedup marker (issue titles
and q= params unbounded). error_class_of now caps at 64 chars for both
exception names and string tokens. Also replaces the vacuous
forge_created_not_called() assertion (unconditional True) with real
fake-state assertions (zero client calls, failed=1, line left spooled).
queue.Queue() was unbounded — a forge outage could balloon failure-path
memory. The queue is now capped at 1000; an overflow occurrence is
dropped from the queue but spooled to the journal (nothing is lost) and
the drop is logged. put_nowait keeps the failure path non-blocking.
The red test called file() (synchronous inline write) instead of
submit(); the worker-vs-reconcile race the finding describes needs the
queued worker path. Also fixed the race double to return numbered
search results (real forge shape) so the dedup replay can comment.
The reconcile thread and the worker racing on the same signature could
each pass the search-then-create window and double-file. _write now
guards the write with an in-flight set (existing lock): a racing caller
returns False and its spool line stays spooled for a deduped replay.
Docstring notes the documented limitation: cross-PROCESS dedup remains
best-effort TOCTOU between search and create.
reconcile called _write directly with the record's tier, bypassing the
gate — a crafted tier=2 spool line replayed to the forge. The gate is
now a module-level predicate (tier_gated) shared by submit, file, the
worker batch (defense in depth) and reconcile; T2 spool lines resolve
journal-only on replay (consumed, never written, reported as skipped).
excerpt() fed raw str(error)[:200] into persistent forge issues and
spool lines — broker exceptions can embed credentialed URLs/DSNs. A
redaction pass now strips query-string credential params, URL userinfo
(scheme://user:pass@host DSNs), Authorization/bearer headers, and
assignment forms, keeping the error class and message shape visible.
Applied inside excerpt() so every create/comment/spool path is covered.
Per-line replay after an outage comment-flooded the issue. Reconcile
now groups unconsumed spool lines by signature and issues ONE write per
signature with the aggregated count ('+N occurrences while offline
(last: ...)'); all lines of a confirmed-written group are marked
consumed together.
JsonlSpool.mark_consumed's read-modify-write on the shared canonical
journal raced concurrent DurableEventStore.appends (silently destroyed
between read and rewrite) and a crash mid-rewrite poisoned the store.
Consumption is now an append-only <journal>.consumed sidecar (atomic
O(1) appends, no O(N) rewrite); unconsumed() = spool lines minus
sidecar ids. Canonical journal stays byte-identical.
Gitea/Forgejo has no repo-scoped /issues/search path — every dedup
search 404'd on a real forge, so everything spooled and nothing ever
filed. Dedup now queries GET /issues?state=open&type=issues&q=<marker>
(paginated, server-side q) with a client-side marker contains-check on
title/body. FakeForge keeps mirroring the server contract (q matches
titles only) instead of the client's filter; docs updated.
Nick