Skip to content

Remove repository-wide publication freezes and reduce release reconciliation overhead #4753

Open

Description

@EHotwagner

Owner

Programme/root owns intake, selection, complete acceptance and integration under #4730. Retain existing release, publisher, journal and runtime owners. Existing Creator source owner knowledge_supplier carries the root-selected two-file source slice after dispatch. Source selection changes no current publication, reservation, PR or effect.

Done when

  • The maintained publication route accepts an approved immutable candidate revision, artifact digest, dependency closure and release intent while unrelated protected-main merges proceed. Candidate retention and each publication authorization use the revised contract. Preserve fresh current authorization/revocation, trusted workflow/run identity, coherent provenance and protection checks; simply deleting the live-main equality guard is not acceptance.
  • Reserve only genuinely conflicting package/version, tag, journal and release-channel resources. Define promotion ordering and any short shared critical section. Demonstrate that competing or obsolete promotions remain fenced while independent repository work proceeds.
  • Advance immediately after confirmed reconciliation progress. Use bounded observation/backoff only for genuine remote visibility waits, retaining original operation deadlines, ordered effects, independent readback, journal conflict checks and no blind retry of uncertain writes.
  • Reuse verified immutable artifact bytes and pure validation by exact digest where sound. Keep mutable authority, journal and provider state fresh at their required boundaries. Profile repeated prefix verification before changing it; preserve all required evidence rather than claiming cache reuse itself grants authority.
  • Expose bounded current-stage/effect timing, last confirmed progress and the exact wait/failure cause through maintained diagnostics. Reuse the existing observer and executor; do not create another scheduler, ledger, reporting worker or per-checkpoint wrapper family.
  • Deliver reviewed source and required CI, then qualify a separately admitted ordinary publication and applicable consumer adoption. Controls demonstrate that an unrelated documentation merge permits continued publication of the same approved candidate, changed/revoked authority and a conflicting promotion refuse, and an uncertain push is observed without duplicate publication. Preserve original attempts and failures. Source-only tests or a green workflow alone do not establish full adoption.
  • Compare merge-blocked time, publication critical-path duration, API calls and coordinator/agent preparation effort against a proportionate baseline with coverage limits. Separate functional acceptance from numerical savings; inconclusive economics is an explicit result. Coordinate shared orchestration/telemetry improvements with Qualify resource-aware parallel admission and reduce coordinator overhead #4743 and Establish routine activity, review and authoritative usage coverage #4639/[V2-EFF-01.2–.6] Qualify efficiency telemetry, dashboard and selected receiver adoption #4640 instead of duplicating their promises.

Current deliverable

Programme/root accepts the three protected source milestones: verified-progress advancement (PR4757), conservative report-addition source compatibility (PR4761), and diagnostic/readback exclusion from the unchanged writer mutex (PR4764, merge c0ad3a3). Their reviewed source, required CI, original failures and observability limits remain accepted at their recorded scopes. Full seven-clause acceptance remains incomplete.

The remaining resource-contract investigation is retired. Root selects the actual existing versioned release-visibility semantics: promotion changes only the selected release with draft=false and make_latest=false; there is no shared latest channel or monotonic pointer to invent. Journal CAS prevents conflicting journal updates but does not fence cross-run package or release writes. Same package/version, tag, selected journal or release-resource conflicts must remain excluded irrespective of candidate/run identity. Keep the current writer exclusion until root selects a maintained aggregate Authority/API/hosted-resource profile and enforcement for disjoint writers. No new writer parallelism, short promotion section, framework or effect authority is accepted.

No genuinely needed next ordinary Wizard release intent, immutable candidate and applicable consumer has been supplied or selected. Completed021 and frozen013 history are not eligible competing-run fixtures and must not be replayed. SDD1113 is unrelated to these prerequisites. Remaining publication/adoption, resource-contract, reuse/profile and economic evidence is not waived.

Historical immediately prior Current deliverable (retained verbatim):

Protected source boundary accepted: PR4764 final reviewed75742e5e2e0328978b39d91fed1886ebb3cc6417 merged normally as c0ad3a3 at2026-10-20T22:47:51Z. Independent native PR/commit/protected-main readbacks prove the exact reviewed/tested tree65a66bf6bc7a7a04f06919a778bc6cafc151f9b2. Actual compiled source CI39508773825/a1 and all eight current protected-required checks passed; complete74-check/41-workflow-run evidence retained all six historical failed/cancelled contexts beside their later same-workflow/job successes. Native merge eligibility was CLEAN. Actual211 credential-free pure tests, historical workflow/route inversions, source graph/fallback controls and independent original/base/epoch reviews passed.

The exact five-path change moves the unchanged literal concurrency group and cancel-in-progress:false from workflow scope to BOTH write-capable jobs: ordinary publish and recovery-complete. Existing diagnostic/post-completion-readback is outside this release writer mutex; mixed ordinary preflight remains conservatively fenced. All write jobs still serialize, including cross-old-workflow/new-job same-group cases. Original actor/main/environment/candidate/journal/revocation/CAS/eight-effect guards and historical013 authority remain. The complete accepted021 route is immutable history; the current source epoch is explicitly reviewed, with unknown graphs retaining exact equality/refusal. This does not establish version-parallel publication or full resource-reservation acceptance. Earlier4757 progress and4761 report-only compatibility source milestones remain accepted.

Original source/watch deadlines, head-projection/reservation refusals, missing EOF and original birth gaps remain preserved. Independent later samples observed numeric watcher PID/PGID/SID absence only; they did not recreate missing EOF or prove escaped-descendant settlement. The later metadata joins found compiled and coherence terminal success before either potential watcher, so no new watcher was born. Source worktrees/evidence are retained. No new candidate, credential, publication, recovery, installation or consumer operation followed; full4753 is still incomplete.

Historical immediately prior Current deliverable, Next action and Blocked on (retained verbatim):

The SAME Creator owner continues PR4764, exact reviewed head75742e5e2e0328978b39d91fed1886ebb3cc6417 on protected-base3378eef9179aea164ce61001e84aaf4ce8608f0f, assembled tree65a66bf6bc7a7a04f06919a778bc6cafc151f9b2. This follows accepted source PR4761/merge0ef654b4 and preserves its original source/CI/watch evidence. The new five-path amendment moves the unchanged literal mutex and cancel-in-progress:false onto both write-capable jobs; existing diagnostic/readback alone is outside, while mixed ordinary preflight stays fenced. Independent governing-source and narrow base/epoch reviews passed; actual211 credential-free pure tests passed on both original82e4 and final757 candidates. Before explicit current-base epoch reseal, actual unknown-graph fallback and retained immutable fixture controls passed. No writer parallelism, historical013 authority or publication grant changes.

Normal governed creation retained its original reservation-identity refusal until existing PR4763 custody was repaired; one new admitted creation succeeded. Actual3378 base integration preserved all reviewed nonpolicy feature bytes. Original immediate head-projection refusal occurred before marker write; a fresh changed native join then permitted one governed marker update/readback. Exact-head compiled source CI39508773825/a1 and remaining ordinary required checks determine this source slice. Its actual state at this reconciliation is completed/success. Root selected a new bounded600-second metadata-only observation; earlier source/watch windows remain retired, with original missing EOF and birth gaps retained. Full4753 is not accepted and this PR does not close it.

Historical immediately prior Current deliverable, Next action and Blocked on (retained verbatim):

Protected source milestone accepted: PR4761 exact reviewed20a11190 passed compiled source CI39502572485/a1 and all eight protected-required checks, then merged normally as0ef654b4d80c1d933e47fb6bf06636c9fae4926c at2026-10-20T22:08:29Z. Native merged/protected readback and the exact reviewed/tested treeb9fdcc21919f798eead63cd983eae13d056ab471 are verified. The source-owned narrow added-report compatibility predicate and bounded immutable proof cache are delivered; unknown/nonreport graph changes still require exact-source equality or an explicitly reviewed reseal. Original source/CI/watch failures and EOF gaps remain history. This is source acceptance only.

Programme/root now dispatched the SAME existing Creator owner knowledge_supplier for the next bounded source slice from protected0ef: place the unchanged literal publisher concurrency group and cancel-in-progress:false on BOTH write-capable jobs (ordinary publish and historical recovery-complete), freeing the existing publication-read-only diagnostic/post-completion-readback job from that writer mutex. The mixed ordinary preflight/publish job remains conservatively fenced. No version-keyed write parallelism, historical013 authority, source/main/revocation/journal guard, operation budget or effect grant changes. The actual workflow, causal controls, complete historical route attestation and deliberate source-epoch seal are being updated on one isolated continuation branch for review/normal CI; no PR or runtime operation is yet claimed.

Historical immediately prior Current deliverable, Next action and Blocked on (retained verbatim):

The first bounded source slice is protected-delivered: PR #4757, reviewed source ee9ad92, current-base head b09da39 and normal squash merge cfd1990 at2026-10-20T21:02:00Z. The merged/protected tree00ac9937b3506cf85c6890f469ce3aaf66d072b2 exactly matches the tested synthetic merge. Both reviewed source blobs remained unchanged across BAR54 base integration. All eight required checks, current routine eligibility and compiled source workflow39495336554 passed. Local199 successor and15 shared execution controls passed; three causal controls were red against the original loop and green against the change. Original failed/pending watch observations and pre-marker refusals retain their scopes.

Confirmed verified reconciliation progress now continues immediately; waiting/unknown outcomes use bounded observation sleep clipped to the original deadline. The existing136-iteration/2700-second/Authority4200 limits, live-main/protection/revocation checks, journal CAS, ordered prefix readback and no-duplicate uncertain-write behavior remain. Six fixed nonsecret timing scalars are projected through the existing summary. This is source delivery only: no new ordinary publication, consumer adoption, narrowed reservation or measured economics result followed. Whole4753 remains open. Root now dispatched the SAME existing Creator owner for the bounded600-second source/read-only contract investigation on CPU3/1GiB: trace exact current authorization, candidate retention and publication preparation; propose determining closure/revocation/conflict controls and the next implementation touchset. This active investigation changes no source, runtime, publication or approval framework.

Historical prior Current deliverable (superseded only as current state; preserved verbatim):

Protected enrollment of all 53 items and installed110 full53 observation are accepted. The original membership visibility discrepancy is resolved without replaying item-add or prior effects. Root has selected the first bounded source slice: progress-aware reconciliation waits and compact stage/progress/wait timing in scripts/new-sdd-workspace-successor-publish.py, with actual-caller controls in tests/new-sdd-workspace-successor/run.py. Existing Creator source owner knowledge_supplier will carry these exact two files under Programme/root accountability. This source-ready decision does not claim implementation has started or publication/adoption has completed.

The retained source findings remain: live-main equality binds publication authorization, candidate retention repeats that check, and reconciliation sleeps after every nonterminal iteration including confirmed progress. The selected first slice does not relax main, authority, protection, journal, provenance or effect guards. Broader immutable-candidate authorization and resource-reservation contracts remain part of this Delivery.

Historical prior Next action:

The SAME existing Creator owner is actively investigating the next source-only contract slice under root dispatch: separate the approved immutable candidate/archive/content/dependency closure from fresh mutable publisher authorization and genuinely conflicting package/version/tag/journal/promotion resources. Recover the existing WizardAdmission.authorize live-main check, candidate workflow retention guard and prepare_publication source equality together; define the exact determining control/source closure and existing native cancellation/protection/revocation joins before editing. Ancestry alone or deleting main equality is not approval. Required controls must permit an unrelated documentation merge while refusing changed/revoked authority or conflicting promotion, and preserve readback-only observation of an uncertain push without duplicate writes. Root must admit the coherent next touchset after reviewing that contract. Later exact-head CI/protected delivery, a separately admitted fresh ordinary publication/consumer journey and comparable economics remain; do not replay the consumed021 release or reset its original journal.

Historical prior Blocked on:

No external supplier blocks the active scoped contract investigation. The completed first-slice operation is retired; the next bounded source/read-only investigation is now dispatched and active, while broader guard-changing implementation is not yet dispatched. The original immutable-candidate authorization and narrow conflicting-resource reservation contracts remain unchanged and require the next reviewed source amendment. Full ordinary publication/adoption and economics are unaccepted; no guard relaxation, publication retry, global hold release or whole-Outcome review/closure follows.

Historical prior Next action:

The SAME source owner completes the dispatched five-path concurrency/source-seal amendment, meaningful credential-free pure controls, one independent exact governing-source review and normal exact-head CI/protected delivery. Keep both writer jobs mutually exclusive under the original literal group; prove no workflow-global diagnostic exclusion, no missing/dynamic writer fence or cancellation weakening, and whole021/historical workflow inversion. No native diagnostic, publication, installation, credential exchange or recovery replay is selected by this source work. Later genuinely needed ordinary Wizard publication, applicable consumer adoption, remaining narrow-resource evidence and comparable economics remain separate full acceptance. Do not invent a successor version or replay consumed021.

Historical prior Blocked on:

No external supplier blocks the currently active admitted source implementation/review. Updated packaged work-board guidance creates a distinct coherent producer/adoption demand owned under4743; that route does not execute or qualify this Wizard publisher. A genuine next Wizard ordinary publication/consumer operation is not currently selected and cannot be replaced by consumed021 replay or blamed on SDD1113. All full Done when clauses, original effect custody, source/PR owners and known/Unknown reservations remain; source delivery does not complete4753 or4730.

Historical prior Next action:

Continue the one admitted bounded metadata observation of exact757 compiled CI39508773825/a1 and current required/material checks. Preserve its original native identity, first failures, full check population, current protected base and tested-tree correspondence. Root integrates only after normal exact-head/current-base/protection gates; no merge, CI rerun or publication is selected by this observation. A nonreport base change still requires deliberate reviewed epoch integration, not silent resealing. Whole ordinary Wizard publication, applicable consumer adoption, broader narrow-resource evidence and comparable economics remain separately unfinished; no consumed021 replay or invented successor.

Historical prior Blocked on:

No external supplier blocks the currently owned normal hosted-CI/source-delivery wait. Current determining CI truth is recorded above and must be refreshed at the next decision. The real4743 coherent guidance publication/adoption demand is distinct and cannot substitute for this Wizard code execution. A genuinely needed next Wizard ordinary publication/consumer operation is not yet selected; SDD1113 is not its attributed blocker. All seven Done when clauses, original effects and known/Unknown reservations remain.

Historical immediately prior Next action and Blocked on (retained verbatim):

Historical prior Next action:

Programme/root reconciles the complete remaining4753 promise after these accepted source slices. No source/CI/merge action remains on PR4764, and no next effect is dispatched here. A genuinely needed Wizard feature/dependency release must establish its reviewed successor source/version/current binding and actual immutable candidate before separately admitted ordinary publication and applicable consumer adoption. Preserve fresh revocation/protection/journal/effect readbacks, no duplicate uncertain push, original operation limits and comparable timing/API/preparation evidence; inconclusive economics stays explicit. Broader resource/promotion and prefix-reuse assertions are not accepted merely because this narrow read-observation lock moved. Do not invent a release, replay consumed021 or create an economic campaign to manufacture qualification. Any independently meaningful remaining source contract work needs an exact rooted selection.

Historical prior Blocked on:

No source review, required-CI or protected-merge wait remains for the delivered source scope. The full ordinary Wizard publication/consumer, broader compatible-resource and prefix-profile evidence, and economic comparison remain unfinished. There is no currently selected genuinely needed next Wizard release/candidate operation; completed021 and its original journal cannot be reused as another publication. Programme/root owns the real release-demand/current source-binding and effect-selection prerequisite, reconsidered on an actual necessary change/release or a concrete independently meaningful source gap. This is not an SDD1113 attribution. Other active4730 work, all seven Done when clauses and every original known/Unknown reservation retain their scope. Status/closure remain root decisions; no whole-Delivery or parent completion follows.

Next action

Blocked pending two root-owned reopening events: (1) root/Creator supplies a genuinely needed ordinary next Wizard release intent, reviewed source/binding, immutable candidate and applicable consumer; (2) root selects a maintained aggregate Authority/API/hosted-resource profile and actual conflict enforcement for disjoint writers under the existing maximum per-writer profile. Then admit the specific remaining source/qualification action with fresh revocation/protection, original finite clocks, independent effect/journal readbacks and no duplicate uncertain writes. No artificial successor version,021 replay or independent publication is selected. Parent4730 remains open/In progress for its actual4743 and4766 work; this child does not change that scope.

Blocked on

Programme/root-owned genuine next Wizard publication/candidate+consumer prerequisite, and root-owned aggregate-resource profile/enforcement design for disjoint writers. Existing journal CAS alone is insufficient as a cross-run write fence. The current writer exclusion stays intact. No active source/CI/merge wait remains on the three accepted slices, and the bounded source investigation is retired. Full Done when, Acceptance evidence, historical attempts and all original known/Unknown reservations remain unchanged. Status is a separate root decision; no closure or parent completion follows.

Acceptance evidence

Requested in the 2026-10-20 side conversation after discussing publication-related merge serialization. Source evidence at inspected revision 12480a2:

Deduplication: bounded native searches covered 64 open issues matching release, all 101 issues matching main/publication, 19 polling matches including closures, and two open publication-related PRs. Reviewed full relevant promises in #4730, #4743, #4741, #2957, #2961 and closed #3278. #4741 owns the current Creator release; #4743 owns resource-aware local concurrency and coordinator overhead; #2957 owns broader provenance/security rollout; #2961 owns general event-driven reconciliation. This Delivery owns the distinct publication serialization/efficiency result, reusing those capabilities. Prior base-advance work referenced by #3278/#3274 is a reuse lead, not evidence that this current publisher already supports it. Closed #4731 retains its accepted observer scope. No global absence or measured performance gain is claimed.

Historical intake readback (superseded only as current readiness by the accepted reconciliation below): Issue #4753 and its native parent #4730 are verified. Direct native item PVTI_lADOEYAWY84BldpazhCL3Kg and the issue's projectItems relationship independently confirm active, non-archived membership in Coordination Project 3. The complete project-items connection and installed110 planning snapshot still return the prior 52 items and omit this new identity. This visibility discrepancy is unresolved; the initializer correctly sent no field effects. Programme/root should reconcile this original membership, then initialize absent Status Backlog, Work level Delivery, Track Follow-up and the owning Roadmap through the maintained guarded route. Do not create another issue or replay item-add. Protected enrollment and implementation remain pending; no existing board fields, releases or reservations were changed by this intake.

Current reconciliation: Programme/root accepts protected53 enrollment and installed110 full53 observation. The original visibility discrepancy and its no-write initializer remain retained history; membership and planning were reconciled without replay. Delivery4753 is source-ready for the exact two-file slice above. The complete Done when remains unchanged; parent4730 stays Ready pending actual dispatch.

Activity

  1. EHotwagner commented on Oct 23, 2026

    @EHotwagner
    ContributorAuthor

    fdev 2026-10-23: two findings from the Creator 0.22.0 publication attempt (#4811). Concurrent Authority writes, and single transient Authority reads, defeat the Wizard publisher's exact-equality and re-authorization checks. The second finding leaves an unsent intent stranded. Both are observations, not proposals; the evidence is linked below. They belong to this issue's writer, resource and reconciliation contract.

    1. Preparation equality check racing concurrent ordinary-ledger writers (failure without effects).

    • prepare_publication (scripts/new-sdd-workspace-successor-publish.py:158, at 150d5c43) requires Authority main to be unchanged between classify_journal_destination and journal admission.
    • Preflight 39924649699 classified Authority at 99c6d495, from 08:27:52Z. Another actor's "ordinary v2 settlement shard 5782a96c…" commit moved Authority main to 1aae2927 at 08:28:03Z, and the check ran at 08:28:13Z. The result was Refused at stage: preparation, with journalMutationMayHaveOccurred: false.
    • Settlement shards arrive in bursts of about 30 s every few minutes. For example, a36d2688…b4f255bf at 08:23:59–08:24:33Z, and fd4e1603…1aae2927 at 08:27:31–08:28:03Z.
    • An earlier preflight, 39923388464, and an admitted rerun timed after a burst, 39925179125, both passed. So the outcome depends on timing against unrelated writers, not on the candidate.

    2. A transient read during dispatch re-authorization strands a committed intent.

    • Publish run 39925400140 did the following:
      1. initialized the fresh board-v2-product-creator-022 journal (81c4f827/7874ba13);
      2. won the tag: intent compare-and-swap, generation 2 (ed5d0349/011386cf, 08:34:48–50Z);
      3. refused 2 s later, before provider.dispatch: lastDispatch: null, tag new-sdd-workspace/v0.22.0 absent.
    • The run's Authority counter shows get attempted 52 / succeeded 51.
    • ProtectedPublisherAdmission.authorize (scripts/release-successor-publish.py:613-625) re-reads Authority protection for dispatch and maps KeyError/TypeError/ValueError/OSError/RuntimeError to a denial. The inference is that one failed read became "dispatch admission denied" after the intent was durable.
    • full_transition then treats intent with observation absent as "waiting" forever (scripts/release_successor_execution.py:283-285), by design: a 404 after a possible send is not proof of no effect. The opt-in BoundIntentFence (Add opt-in bound-intent fence to the ordered-effect engine #4805) also never re-permits an inherited intent.
    • Result: the journal holds an intent that was provably never sent, and the ordinary existing-journal recovery cannot settle it or complete the release. Recovering needs either a fresh journal identity or a reviewed operation that settles an unsent intent from same-run evidence.

    Scope and status. No package, tag, release or feed effect occurred. Readback: tag 404, no release, nuget.org 0.22.0 404. The original attempts and summaries are retained, and nothing has been retried. Owner decision for the 0.22.0 route is pending on #4811 (comment).

  2. EHotwagner commented on Oct 23, 2026

    @EHotwagner
    ContributorAuthor

    fdev 2026-10-23: scoped proposal (ii), following up the Creator 0.22.0 incident: bounded re-read after an uncertain journal write. fdev will assign this after the 0.22.0 publish. Nothing below is implemented.

    Corrected diagnosis of run 39925400140. This supersedes the "dispatch re-authorization" inference in my earlier comment.

    • Both generation-2 PATCHes landed (ed5d0349/011386cf, tag: intent).
    • The GET that reads the write back then failed: self.read() inside ProtectedReleaseJournal._compare_state, at scripts/release_successor_journal.py:830.
    • Evidence: the summary still shows generation 1 (ReportingJournal.capture runs in finally); Authority GETs were 52 attempted and 51 succeeded; lastDispatch is null.
    • The engine therefore never reached dispatch admission. full_transition then treats intent plus absent as waiting forever (release_successor_execution.py:283-285), so the journal is stranded.
    • The likely trigger is quota or secondary-rate-limit pressure: the shared REST quota hit zero at 08:46Z.
    • PR Retry transient publisher admission reads and move Creator022 to a fresh journal (Refs #4811) #4831 adds a bounded retry for admission reads. That is related hardening, but it does not cover this readback site.

    Proposal. After an exception from an intent compare-and-swap, do a bounded re-read to settle the uncertain outcome:

    1. Re-read the journal fresh, up to 3 attempts with short backoff. This is GET-only; never re-PATCH.

    2. If the observed state equals exactly the expected state plus one, return a won CAS:

      • generation is the expected generation + 1;
      • the contentId is the same;
      • the effects are the expected effects plus this effect at this state;
      • the logical head is the commit this invocation created.

      Include this invocation's identity in the check. Add opt-in bound-intent fence to the ordered-effect engine #4805's BoundIntentFence arms only from its own won write, and the commit identity proves it is this invocation's write rather than a lookalike.

    3. Otherwise re-raise the original refusal unchanged. That covers: a pre-write refusal, a write that did not land, persistent read failure, and a different state.

    Placement options.

    • (a) In ProtectedReleaseJournal (release_successor_journal.py). Here the created commit identity is available. This is a pinned helper, so it needs a Coordination re-pin decision.
    • (b) In the shared ReportingJournal wrapper (release-successor-publish.py). The wrapper cannot see the created commit, so it could compare state only. It is also commit-pinned by Coordination's eng/execution-pair-forward-admission.json, with no automatic adoption.

    Tests and policy.

    • test_lost_cas_response_is_observed_under_original_identity_without_replay (tests/new-sdd-workspace-successor/run.py) currently codifies "refuse, then wait forever, never send". It would split:
      • a lost response whose write is verified as this invocation's exact expected+1 commit proceeds to the single admitted send;
      • a lost response with an unverifiable or foreign state keeps today's refusal.
    • Add causal controls for:
      • transient readback failure followed by success (proceeds);
      • persistent failure (refuses);
      • a foreign writer's lookalike state (refuses);
      • a write that did not land (refuses, keeps the original message);
      • Add opt-in bound-intent fence to the ordered-effect engine #4805 fence interplay: the fence is armed only by this invocation's verified write.
    • Needs Add opt-in bound-intent fence to the ordered-effect engine #4805-level review. The executable-route and recovery suites and the authentication manifests must stay green.

    Out of scope.

    • Settling inherited intents. A stranded journal from an earlier run, such as the abandoned board-v2-product-creator-022, stays unsettleable by design.
    • The preparation-equality race with settlement writers (finding 1 above).
  3. EHotwagner commented on Oct 23, 2026

    @EHotwagner
    ContributorAuthor

    fdev 2026-10-23: correction to the 39925400140 diagnosis. There was no failed GET. The 52/51 Authority GET gap is the expected 404 that the publisher gets when it checks that the fresh journal ref is absent. Every fresh preflight shows the same gap, including the passing ones: 39923388464, 39925179125 and 39938911336 (18 attempted / 17 succeeded).

    Evidence:

    • Authority PATCHes: 2 attempted / 2 succeeded, so generation 2 landed on main (011386cf).
    • The summary's lastObservedJournal is still generation 1.
    • No other Authority commit occurred between 08:34 and 08:36Z.

    What fits: a stale GitHub read right after the write.

    1. ProtectedReleaseJournal._compare_state PATCHes, then self.read() (scripts/release_successor_journal.py:830).
    2. That read observed the previous head.
    3. Either the compare-and-swap returned False (the engine then raises "journal intent CAS conflict"), or read()'s two-GET check raised "journal head moved during read".

    Consequences:

  4. EHotwagner commented on Oct 23, 2026

    @EHotwagner
    ContributorAuthor

    fdev finding: two coherent-publisher stops in the coherent113 window (evidence)

    Two separate defects in the coherent publisher each stopped a run during this window. The publisher was scripts/release-successor-publish.py and scripts/release_successor_provider.py at M 79db622ff4a51498e22ae5820eeb2b470fc743c5; candidate 39959647376, journal coord113-claude-usage-20261023-01.

    Both stops were safe: nothing was replayed or repacked, and the journal was left consistent. But each stop cost a forward run that had to be separately admitted. One finding is new; the other repeats what happened in 0.112.

    1. The draft-release lookup races with the release list's pagination

    • Where: first publish=true run 39961563619, attempt 1.
    • What the run did: it applied the draft effect (journal generation 4, tag already verified). It then refused with Refused: ordinary draft lookup identity is malformed or duplicate. That came after a 404 on releases/tags/coherent-set/v0.113.0, which is normal for a draft.
    • Run outcome: disposition failed-or-unknown, stage pending-observation, journalMutationMayHaveOccurred: true.
    • Code: _ordinary_release_witness (release_successor_provider.py:1576-1590 at M). It pages releases?per_page=100&page=N and refuses as soon as the same release id appears twice across pages.
    • Likely cause: the draft the run had just created shifted the list between page reads. The repo had 113 releases (pages of 100 + 13), so one item moved across the page boundary.
    • Evidence it was transient: an independent re-read a few minutes later found 113 distinct ids and exactly one coherent-set/v0.113.0 match (draft 421880935, body marker binding sha256:14c8ba3f…). The forward run that followed got past this point.
    • Suggestion: the draft effect already knows the release id it created. Observe that id directly, or retry a whole consistent page set before refusing. A duplicate across pages is not evidence of ambiguity.

    2. The nuget.org visibility probe window is shorter than nuget.org indexing (repeats 0.112)

    • Where: ordinary forward 39962349653, from 13:34:33Z to 13:50:53Z.
    • What the run did: it reached generation 14 with tag, draft, all three GitHub Packages pushes and nuget.org Coord.Cli verified. nuget:FS.GG.Kit was applied but stayed unobserved, with pending reason finite pending visibility probe window exhausted (ORDINARY_VISIBILITY_PROBES = 135, release-successor-publish.py:774). The run made 10 iterations and used 343 GET, 10 PATCH and 70 POST of its Authority budget.
    • nuget.org state at 13:51Z: www.nuget.org/api/v2/package/FS.GG.Kit/0.113.0 → 302, so the package was accepted. The flat container fs.gg.kit/index.json still listed only 0.112.0, and the exact nupkg URL → 404, so indexing was still pending.
    • Same as 0.112: first publisher 39633207670 stopped with the same generation-14 Kit checkpoint, and ordinary forward 39639020615 completed it.
    • Suggestion: spend the visibility budget for nuget.org on wall-clock time or backoff rather than a fixed probe count. Alternatively, have the run leave the checkpoint as soon as nuget.org returns a 302/accepted result, and let a later forward observe it; the current approach burns 16 minutes of runner time on probes. Either way, the operator runbook should say up front that a coherent publication normally needs two runs.

    fdev has admitted one more ordinary forward, to be dispatched only after the flat container lists fs.gg.kit 0.113.0. Completion and readback will be recorded separately.

    — fdev

  5. EHotwagner commented on Oct 24, 2026

    @EHotwagner
    ContributorAuthor

    Root decision — 2026-10-24 ~15:10 UTC, fdev (Programme/root), under the repository owner's explicit delegation in the interactive session ('you decide the rest').

    Concurrent publishers: one org-wide serialized publication writer (a single GitHub concurrency group shared by all publishing workflows, never cancel-in-progress), instead of an aggregate-resource profile for disjoint writers. The existing writer exclusion becomes this lock. The 'genuine next Wizard release' prerequisite is dropped. The first ordinary publication of any component after the lock lands serves as the qualifying consumer journey. The rest of Done when is unchanged.

  6. EHotwagner commented on Oct 24, 2026

    @EHotwagner
    ContributorAuthor

    fdev 2026-10-24: org-wide serialized publication writer delivered (ADR-0097). Source and adoption only; no publication, recovery or credential operation was run.

    Mechanism. GitHub concurrency groups are per repository, so no group can serialize publishers in different repositories. Producer GITHUB_TOKENs cannot write elsewhere, the ledger App credentials exist only in .github (and one Coordination environment), and the nuget.org Trusted Publishing policy pins each producer's own workflow, so a journal-CAS lock or central workflow had no credential route. The lock is therefore a bakery lock over the public Actions job list: every write-capable publisher job carries the pinned step Acquire org publication writer lock and [org-publication-writer] in its job name (the Actions step list is often empty, so participants are recognised by job-level name/status/started_at only). The oldest in-progress participant in any registered repository proceeds; the job's end releases the lock, so a crashed holder cannot deadlock; a 7 h lease ignores ghosts; waiters fail closed after a bounded wait; reads retry 5xx with backoff. It grants no authority. The live-main equality guard and "hold main stable" for candidate/source equality are unchanged (Done when clause 1 remains).

    Merged. .github #4858 c799a9f9b21d52eb9766cf0950722e3e55145d39 (lock, ADR-0097, registry, coverage checker, controls, the three .github publishers; reviewed twice by an independent critic), #4859 f36a11ce4d76702019fd2914231646a8d0f63ef9, #4862 bdfdc39baf3270983a56bcfd78ea23c2c2c22d3a. Adoption: FsQuint #46 9d28d27d, Audio #340 20e92115, SDD #1130 d667ecd8, Templates #777 0a039966, Game #729 084c000c, Rendering #1471 8574c14d, Governance #474 f186cb14.

    Not adopted. FS.GG.Net #113 is open: its required Build + test (locked restore) fails on main too (NU1902/NU1903 advisories for System.Security.Cryptography.Pkcs/Xml 10.0.12 treated as errors), so Net needs a dependency bump first. FS.GG.Coordination is exempt in the registry (its Actions allow-list admits only GitHub-owned actions and one NuGet/login digest; its publishers are byte-pinned). Historical .github saga routes are exempt because their publishers are disabled_manually. scripts/check-publication-writer-coverage.py --remote on the live org reports only Net.

    How to observe the qualifying journey. At the next ordinary publication by its own owner, GH_TOKEN=$(gh auth token) python3 scripts/publication_writer_lock.py observe lists the holder and contenders, and the Acquire org publication writer lock step log shows ticket, waited seconds and other live participants. Two concurrently dispatched publishers should show the younger one waiting.

    Residuals. No real publication has run under the lock; job-list visibility lag beyond the 20 s settle could overlap two jobs (journal CAS and effect guards remain the fence); the retired-but-dispatchable .104 continuation census refuses while a second dispatch waits; Net and Coordination adoption; the remaining Done when clauses (live-main immutable-candidate authorization, prefix reuse profile, economics) are unchanged.

  7. EHotwagner commented on Oct 24, 2026

    @EHotwagner
    ContributorAuthor

    Root (fdev) acceptance at source scope (2026-10-24)

    The org-wide serialized publication writer (ADR-0097) is merged in .github and adopted in seven producer repositories:

    It had one independent review plus a delta re-review. The credential-free controls cover ordering, broken-lock variants, crash replacement, the lease, fail-closed waits and a pile-up. The three per-repo .github publisher concurrency freezes are removed.

    Follow-ups, assigned to one owner:

    Qualifying consumer journey (per decision 6385677196): the first ordinary publication of any component under the lock, observed with scripts/publication_writer_lock.py observe plus the step log. #4753 stays open until that journey is read back and coverage includes Net and Coordination.

  8. EHotwagner commented on Oct 24, 2026

    @EHotwagner
    ContributorAuthor

    fdev 2026-10-24: publication writer lock follow-ups delivered; check-publication-writer-coverage.py --remote on the live org reports 0 unmet. Source and adoption only; no publication, recovery or credential operation was run; no Status write.

    • FS.GG.Net. FS.GG.Net#114 8ad240c118b19b04f45bffdca6542957eb881a12 bumps System.Security.Cryptography.Xml 10.0.12 to 10.0.13 (first patched version of Xml and, through its dependency, Pkcs; five GHSA ids named in the PR), two sample lock files regenerated, no audit suppression. FS.GG.Net#113 e7f691edff75a6b652e62b67a9c1315c302a0444 (the lock adoption) then merged green. Net main gate is green again.
    • FS.GG.Coordination (exemption removed). FS.GG.Coordination#1068 81c4229a284305217d0031e371178929b505891b plus .github#4865 a7bd729017bf578fabbae2c19bf83a09a80b634b. The Actions allow-list is unchanged. Each write-capable job of the four dispatch-only publishers has a plain run: step that fetches scripts/publication_writer_lock.py from this repository at c799a9f9 (sha256 dca3fe60...53e6, verified before execution), the [org-publication-writer] marker and a timeout raised by the 30 minute wait. The coverage checker accepts exactly that step and --remote verifies each pin against the real script. The Execution forward route stays dormant (admission disabled); its test now proves the original 0.3.0 publisher differs from the admitted bytes only by the gate. Repinned in the same PR: GS2-06-4 corpus and expected seal, GS2-06-7 execution pins extension, one architecture-test literal.
    • Hosted image. .github#4864 6b745cf98db0625e4e24c54a17c93137ea86ca38 adds 20261023.334.3 with official runner-images source bf62c713fd9c48247e2a4d3ce99a9f0554cd745e as a third closed tuple, after reading the runner-images tag, commit and readme (differs from the admitted 20261012.334.1 only in Bazel). The PR's own telemetry-host-package ran on that image and completed the fresh census (102 packages, 3642 files); it is not native, installed or publication acceptance.
    • Residuals. The real journey (a publication under the lock) still has not run. The original 0.3.0 pair-recovery route is pinned to a historical tag whose publisher has no gate and would be invisible to the lock if enabled. HIJACK_ENV in the checker is key-shape only; the checker's step splitter ignores 4-space steps (pre-existing). FS.GG.Net has no routine-eligibility producer, so tools/routine-delivery.py refused its PRs ("routine eligibility check is missing") and they were merged natively on exact head with green required checks. Net's post-merge V2 ordinary post-merge settlement for registry: flip fs-gg-ui-template 0.1.58 → 0.1.60-preview.1 (Rendering#42) #113 refused with SettlementJournalConflict (run 40125856460) after registry: scaffold-provenance 1.0.0 → 1.1.0 (+sha256, ADR-0014 P0.D0.2) #114's settled; not retried.
  9. EHotwagner commented on Oct 24, 2026

    @EHotwagner
    ContributorAuthor

    Root (fdev) reconciliation of the follow-ups (6389992997), 2026-10-24

    Accepted at source scope:

    Live check-publication-writer-coverage.py --remote reports 0 unmet across all 10 registered producer repositories.

    Root selection record, hosted image 20261023.334.3: Root selects this image as an admitted tuple for telemetry-host-package, with source bf62c713fd9c48247e2a4d3ce99a9f0554cd745e. Evidence:

    • the tag and commit exist in actions/runner-images;
    • the readme diff against 20261012.334.1 is limited to the image version and Bazel;
    • the PR run and the main run completed the census on that image.

    This is source qualification only.

    Dispositions:

    #4753 stays open until the first ordinary publication under the lock is observed and read back.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions