mirror of
https://github.com/block/buzz.git
synced 2026-11-01 15:01:12 +00:00
29d04a5cf4
run_file_commit_recovery is now called immediately after reset handling succeeds, before run_boot_migrations*, backfill_persona_snapshots, and every other canonical-store reader/writer. A stale stage from a pre-crash commit can no longer overwrite migration/backfill output. Fail closed: a recovery error sets store_recovery_failed on AppState (same pattern as reset_failed) and returns early, keeping all store-touching setup closed. get_identity surfaces the flag to the frontend. spawn_boot_recovery (publication-only since round 9) is the sole remaining background recovery path; it cannot enter file repair at any schedule. New test: test_setup_order_recovery_completes_before_migration_reads_canonical plants stale canonical + stage file with repaired content, runs file_commit_recovery_at_pub (the exact function production delegates to), then asserts the canonical holds the repaired content — proving any subsequent migration read sees the repaired state. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>