From 8360f940bfb21cd3c7db2f2fde4a188ffb503cb8 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 3 Aug 2026 11:36:47 +0200 Subject: [PATCH] docs: seventh row in the shipped-guarantees table (R-181), versioned workspace CLAUDE.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Syncs documentation/runbooks/workspace-CLAUDE.md with the workspace root file. Row 7: the B2 refusal claimed the previous unit was untouched; nothing-deleted held, untouched was measured false. Also records WHY it survived review: it passed a full green suite AND three of its own red-proofs, because every one of them asserted the mechanism inside captureAllRecoveryUnits and none asserted the consequence across the whole backup run. The test that would have caught it is the one the fix ships — fingerprint the tree before and after, and compare. --- documentation/runbooks/workspace-CLAUDE.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/documentation/runbooks/workspace-CLAUDE.md b/documentation/runbooks/workspace-CLAUDE.md index 76ea98c..c8b46d3 100644 --- a/documentation/runbooks/workspace-CLAUDE.md +++ b/documentation/runbooks/workspace-CLAUDE.md @@ -178,7 +178,7 @@ turns a true alarm into one the operator dismisses. ### A comment asserting an invariant needs a test pinning it, or it is a wish -**Six instances in this project have shipped guarantees the code did not provide** — each survived +**Seven instances in this project have shipped guarantees the code did not provide** — each survived review because the comment read as settled: | # | Comment | What it claimed | What the code did | @@ -189,10 +189,14 @@ review because the comment read as settled: | 4 | `classifyRunStates` I1 | *"StateStopped means deliberately stopped by the user"* | quiesce stops stacks the same way — a failed restart was silent (F-CRIT-1) | | 5 | `inflight.go` | *"a caller that cannot acquire DEFERS"* | the backup caller recorded a failure and paged the operator (F-A1) | | 6 | `quiesce.go` | the agent's 409 *prevents* "a spurious failure" | on the start path it produced one (F-A1) | +| 7 | `recovery_unit.go` B2 refusal (R-181) | *"the previous unit is untouched and NOTHING was deleted"* | *nothing deleted* held; **untouched was measured false** — the floor was checked ONLY in `captureAllRecoveryUnits`, while the two dump legs wrote the bulk into the same tree first and unguarded, so a 182,272 B tar became 2,147,666,432 B under a manifest that had not moved | -Two of these (4 and 5/6) were found by Campaign 8 **on live hardware**, not by review or unit tests -— #4 had a green, red-proofed test suite over a production path that was broken two independent -ways. So: +Three of these (4, 5/6 and 7) were found **on live hardware**, not by review or unit tests — #4 had a +green, red-proofed test suite over a production path that was broken two independent ways, and #7 +survived a full green suite plus three of its own red-proofs, because every one of them asserted the +mechanism inside `captureAllRecoveryUnits` and none asserted the **consequence** across the whole +backup run. The test that would have caught it is the one #7's fix ships: fingerprint the tree before +and after, and compare. So: - If a comment states an invariant, **name the test that pins it**, or write one. - If an invariant has a stated dependency (*"if either invariant changes, revisit this"*), that is