Repository navigation
v3.52.4-3.52.8: 5 verified defect fixes (Grok hunt 2026-10-31) - #147
Merged
Merged
Conversation
consume fsyncs the journal line before the SQLite commit, because a committed latch must not race ahead of the journal. The JSONL file is outside the transaction. If record_event then hits a duplicate idempotency key, or commit fails, the row rolls back to approved and unconsumed while the consume line stays. authorise treats consume as sticky, so every retry is AlreadyConsumed and the approval can never be used. The Drop guard appends consume_void only when this call wrote a consume line, and it runs while the write lock is still held. A refusal, or a later attempt after someone clears consumed_at, does not void a consume that committed. rolled_back_consume_is_voided_and_can_be_retried fails the event insert on a colliding uuid, asserts the row is still approved, sees consume_void, and consumes successfully on retry. clearing_the_db_latch_does_not_reopen_a_committed_consume drops the trigger, clears consumed_at, and asserts two further consumes stay AlreadyConsumed with no consume_void in the journal. (cherry picked from commit c1de08de7bda32f722867d734cd67500133a3b67) Found and fixed by a Grok Build worker (grok-4.7 xhigh), verified by a second Grok pass and reviewed by HAL. Co-Authored-By: Claude Opus 5.5 <[email protected]>
The documented executor is payload, then act, then consume. In enforce mode only consume consulted the journal. A seat that can INSERT an approved row passes the database gate, payload returns the bytes with exit 0, and the action happens. consume then returns Unverified (exit 7), which is too late. payload and verify now call Journal::authorises, the same match as consume without appending a line. Shadow logs and still releases. Off is unchanged. preview and in_force stay database reads. forged_row_does_not_release_payload_or_verify inserts an approved row with payload bytes and no journal record, and asserts payload and verify are Unverified. A request that is approved through the journal still releases those bytes and verifies. (cherry picked from commit d691ee3ec6dc9bfb2baa4a97773b8586cb169e3f) Found and fixed by a Grok Build worker (grok-4.7 xhigh), verified by a second Grok pass and reviewed by HAL. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Unmerge deleted the canonical pt_recurrence row whenever the merge had copied one. update_deadline on that task rewrites next_occurrence and anchor, and a completion advances the occurrence, but the deadline edit is not itself undoable and it does not protect the duplicate's dismissal. The next undo of the merge then deleted the edited rule. The canonical kept the new deadline and stopped recurring. Delete the row only when rrule, mode, original input, next occurrence and anchor still match the duplicate's copy. An untouched copy is still removed. The duplicate keeps its original rule either way. undo_merge_keeps_a_recurrence_edited_after_the_copy undoes an untouched copy and asserts the canonical rule is gone, then moves the deadline after a second merge and asserts undo leaves that rule in place. The second assertion failed on the unconditional delete. (cherry picked from commit 7005484d6490dd718ac06c8bbff68ab68a1768d4) Found and fixed by a Grok Build worker (grok-4.7 xhigh), verified by a second Grok pass and reviewed by HAL. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Unmerge removed every carried criterion from the canonical task. A check made after the merge, including its evidence, lives only on that copy: the duplicate kept its own criterion unchecked. Undo then reopens the duplicate, and reopen clears checks, so copying the check across would drop it too. The checklist on both tasks lost the evidence. Unchecked carried criteria are still removed. A checked one stays on the canonical task, done, with its evidence. undo_merge_keeps_a_checked_carried_criterion merges two criteria, checks one with evidence, undoes the merge, and asserts that criterion is still done on the canonical task while the unchecked one is gone. Removing every carried row failed that assertion. (cherry picked from commit 6bb674e56221b63dfa79ac2fd27862c5469d5d57) Found and fixed by a Grok Build worker (grok-4.7 xhigh), verified by a second Grok pass and reviewed by HAL. Co-Authored-By: Claude Opus 5.5 <[email protected]>
The shadow Err arm of check_and_record_consume appended a consume and returned Ok(true) even when authorise returned AlreadyConsumed. ConsumeVoidGuard arms only after Ok(true), so a committed consume, a cleared consumed_at and a colliding event uuid wrote a second consume and then consume_void. consume_is_open is a boolean, so that void reopens the approval and a later flip to enforce allows another consume. When a consume is already open the arm now writes nothing and returns Ok(false). A refusal with nothing open still appends and returns Ok(true), so a rolled-back first shadow consume is still voided. Before this change, shadow_rollback_must_not_void_a_committed_consume failed with journal events request, approve, consume, consume, consume_void. After, it passes, and enforce on the cleared latch stays AlreadyConsumed. shadow_rolled_back_first_consume_is_voided passed on the parent and still passes: the first rollback is voided and a retry latches. (cherry picked from commit b9b3a3e26736e5c4a10242faa8aebd9f91afd3f2) Found and fixed by a Grok Build worker (grok-4.7 xhigh), verified by a second Grok pass and reviewed by HAL. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
5 fixes from a Grok Build defect hunt (grok-4.7 xhigh) on 2026-10-31. Every commit was re-checked by a second adversarial Grok pass: the regression test fails on the parent and passes on the fix. Verifier MERGE-WITH-EDIT items are applied as the 'follow-up' commits. HAL rebuilt the series on current main and re-ran every touched test file on this branch.
HAL re-run on this branch:
Worker report (findings left unfixed, with reasons) is kept with the burn harness on tensor-core: /mnt/storage/hal-worktrees/grok-burn-20261031/units/ptask/report.md
🤖 Generated with Claude Code