mirror of
https://github.com/block/buzz.git
synced 2026-11-02 15:31:27 +00:00
998f1ef8b9
The identity-transition coordinator now drains owner-identity egress between the runtime drain and the durable B dispatch, closing the split-state class where an already-issued lease or durable capability could transmit under A after B commits. Because the coordinator body holds two std-mutex Layer-2 guards it cannot carry across .await, the drain is synchronous: a new `wait_egress_drain_blocking` parks on a Condvar beside the egress registry, notified from both lease Drop impls. Both guards stay held continuously across the barrier — releasing either permits A-runtime resurrection before B commits (the three-phase guard-release shape was ruled UNSAFE). Deadlock-freedom rests on leases taking only the egress mutex; a tree sweep found zero lease-vs-guard sites. The persist stage is now classified against durable fact (P27-C1) under the retained commit fence, after a fsync'd IdentityTransitionPending journal (P28-C1): Committed finishes the in-memory swap and clears the journal; DefinitelyUnchanged compensates the drain; Indeterminate latches fail-closed and leaves the journal for boot reconciliation. `commit_imported_identity` no longer performs the durable persist — it takes the proven storage and does only the in-memory swap, so it runs on the Committed arm alone. Retires the dead_code allows the coordinator now consumes across the egress, persistence, and journal modules. An RAII test guard resets the egress registry on drop so a latched Indeterminate state cannot leak into crate tests that read the indeterminate-gated key accessors without the registry lock. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>