From 0fd0ca137323619b63b49b248fa5dee1f4cd9e67 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Wed, 29 Jul 2026 08:25:58 +0200 Subject: [PATCH] PROMPT-TEMPLATE: defer is graceful-exit-only, not crash-safety The crash-safety checklist listed "guaranteed cleanup via defer" alongside real crash-safety primitives, which reads as though defer covers a crash. It does not: a defer does not run on SIGKILL. Campaign 8 fault 10 proved this on live hardware. Crash-safe cleanup needs an on-disk marker plus a startup Recover(); defer covers graceful exits only. Both are useful, they are not substitutes. --- documentation/PROMPT-TEMPLATE.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/documentation/PROMPT-TEMPLATE.md b/documentation/PROMPT-TEMPLATE.md index f31acc8..9513726 100644 --- a/documentation/PROMPT-TEMPLATE.md +++ b/documentation/PROMPT-TEMPLATE.md @@ -279,7 +279,9 @@ Then: [exact refusal — HTTP status, error, and the proven non-effect, e.g. "m **DO:** [explicit positive instructions; tricky code snippets only — CC fills the obvious parts] **DO NOT:** [the specific anti-pattern for THIS task] **Crash-safety (if stateful):** journal-before-mutate; atomic tmp+fsync+rename; `Recover` on startup; -guaranteed cleanup via `defer`; single-flight mutex; `ListLXC`-style ground truth in recovery. +guaranteed cleanup via `defer` **for graceful exits only** — a `defer` does NOT run on SIGKILL, so a +crash-safe cleanup needs an on-disk marker plus a startup `Recover()` (Campaign 8 fault 10 proved +this on live hardware); single-flight mutex; `ListLXC`-style ground truth in recovery. **Green gate:** `go build ./... && go vet ./... && go test ./internal//`