mirror of
https://github.com/block/buzz.git
synced 2026-11-01 23:11:58 +00:00
875c8f3468
The base persistence kernel returns a binary Result, but it is not transactional: a returned Err does not prove no durable key write happened. A coordinator that compensates on any Err can leave durable identity B on disk beside live in-memory identity A, and a later reachable-keyring restart activates B (the P25/P26 split-state class). Add persist_imported_identity_classified, which wraps the proven kernel and derives a three-valued PersistenceOutcome from durable fact: Committed (B proven canonical, compensation forbidden), DefinitelyUnchanged (B never landed, the only compensable outcome), and Indeterminate (neither proven, fail closed). On a kernel Err it re-reads the keyring and identity.key under the caller's held transition guards and classifies from what they hold; a keyring unreachable on re-read fails closed. The C5 coordinator consumes this in the barrier commit. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>