A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live

I2706

An own event whose append failed is never acknowledged as durable, and a journal reload is bounded in size

Where it stands

devtask.issue

Readiness: ready no dependency and no gate holds it; nobody has started it
Status: READY
Can start: startable
Milestone: mesh-journal-converges
Milestone status: ACTIVE
Wave: 1
Waiting on: none
Holds back: none
Behind it in all: 0
Evidence: 0 of 2

Moves

plan.transition

What it is

Objective: Refuse to acknowledge an own mesh event as durable when its append failed, and bound how much a journal reload reads.
Why: Split from I2137 on 2026-10-14. I2137 made appends synced and failure-counting, reloads count unreadable lines, compaction atomic and the file owner-only, and its desired_state said 'Not done here' of a reload size bound and of refusing to acknowledge an own event whose append failed (it is held in memory and replicated, and the loss is reported), while its acceptance criteria still required that the event not be acknowledged as durable, so it could never close. Baseline audit of 2026-10-09 at master 1fb8d6be44, failure gap 4 and the failure-class rows disk full and truncated journal.
Now: Journal::append_own (apps/majordomus-cli/src/mesh/journal.rs) returns Ok when the write to disk fails: the event is held in memory and replicated, and JournalTallies.write_failures counts the loss, which mesh doctor reports (apps/majordomus-cli/src/mesh/doctor.rs, journal_check). The test a_failed_append_is_counted_and_the_file_is_the_owners_alone asserts exactly that Ok. Reload reads the whole file with no size bound.
Wanted: An own event whose append failed is reported to its caller as not durable (held and replicated, but not acknowledged), so a capability that writes it does not claim it is on disk; a reload reads at most a declared number of bytes and reports what it left unread, and mesh doctor names it.
Done when: unknown: the record declares no `completion`
Risk: unknown: the record declares no `risk`

Acceptance

A failed write on a read-only or full file system in a test leaves its event not acknowledged as durable to the caller that appended it
A journal larger than the reload bound is reloaded up to the bound, and the part left unread is counted and reported by mesh doctor

Validation: bin/majordomus plan validatecargo test --lib mesh::journal
Evidence required: failed_append_not_acknowledged_testreload_size_bound_test
Evidence present: unknown: the record carries no `evidence` entries

Scope

Touches: apps/majordomus-cli/src/mesh/journal.rsapps/majordomus-cli/src/mesh/doctor.rsapps/majordomus-cli/src/capability/builtin/mesh.rstest/casesdocs/MESH.md
Not: Synced appends, the write-failure and unreadable-line tallies, atomic compaction and owner-only creation, which I2137 delivered
Depends on: I2137
Priority: p0
Profile: implementation
Parallel safe: false
Owner: unknown: the record declares no `owner`

The work so far

Branches: none
Merged: none
Commits: 0
Trunk: master
Sessions: none
Created: 2026-10-14
Updated: 2026-10-14
Started: unknown: the record declares no `started_at`
Verified: unknown: the record declares no `verified_at`
Completed: unknown: the record declares no `completed_at`

Synchronisation

Adapter: scripts/github-sync
Repository: unknown: the derived plan's header carries no repository
External issue: unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
State there: unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

Findings

Level	Code	Message	Reproduce
WARN	`scope_conflict`	shares apps/majordomus-cli/src/mesh/journal.rs with I2708; they may not run concurrently	`majordomus plan validate`
WARN	`scope_conflict`	shares apps/majordomus-cli/src/mesh/journal.rs with I2709; they may not run concurrently	`majordomus plan validate`