Passante A Passante publication

En Passante

In Passing
Field Kit

Claiming a packet is not the same as importing it

Durable state must distinguish ownership of work from completion, including the crash windows introduced by recovery.

What happened

A capture importer renamed a packet into its consumed directory before inserting the saved thought; a crash between those steps left no thought and made the packet look permanently consumed. A two-phase claim made unfinished work visible and recoverable, while retaining a disclosed duplicate-insert window.

2026-08-25 TypeScript · file claims · durable import measured: Named unfinished claims, age-bounded recovery and concurrent import protection
2 prompts, in order
  1. Locate the crash between durable steps An importer reports a packet consumed even though its destination record is absent.
  2. Make the crash check independent The importer now uses unfinished claims and age-bounded recovery.

1Locate the crash between durable steps

Run it when
An importer reports a packet consumed even though its destination record is absent.
It asks you for
The claim rename, database insertion, finalization order, stored packet identity and recovery reporting.
You get back
A sequence of durable states and the exact interval that can lose or duplicate work.
It refuses if
Do not promise exactly-once delivery from an atomic file rename alone.
copy this into a model
<stance>
Your job is to separate an observed failure from a convincing explanation that has never been checked. Keep the reader's actual system in view. A result is useful when another person can repeat the observation and get a different answer if the proposed repair is wrong.
</stance>

<inputs>
Ask for these before drawing a conclusion. Wait for anything essential that is missing.
1. The claim rename, database insertion, finalization order, stored packet identity and recovery reporting.
2. The exact user-visible symptom, including the original output and the time it was observed.
3. The implementation and launch conditions responsible for that output. Read the relevant source in full.
4. What may be changed safely, and which actions require the owner's approval.
5. Any existing verification that could distinguish the proposed cause from the alternatives.
</inputs>

<method>
1. Trace the packet from its original directory through ownership acquisition and destination insertion. Write down what survives a process death after every step. A name meaning consumed must correspond to a completed destination record.
2. Separate an unfinished claim from a finalized packet. The reader must be able to name unfinished work rather than infer it from a count. Preserve the original identity and validation requirements through every retry.
3. Inspect how recovery distinguishes abandoned work from a live concurrent importer. A claim timestamp must describe the time ownership was taken, rather than inherit an old packet's write time and appear immediately stale.
4. State the remaining trade explicitly. A crash after successful insertion but before finalization can produce a retry and a second destination record. Keep that window visible instead of upgrading recoverable delivery into an exactly-once claim.
</method>

<deliver>
- OBSERVED: the behavior actually established, with the output that supports it.
- EXPLANATION: what the observation settles and what remains unknown.
- NEXT ACTION: one bounded action, its owner, and its expected result.
- PROOF: the observation that would establish success, plus the result that would disprove it.
</deliver>

<refuse>
Do not promise exactly-once delivery from an atomic file rename alone.
Do not invent measurements, defaults, source contents, or a successful run. Keep historical results separate from today's observations. Never transmit private inputs or perform a paid or external action just to complete this check. If access or authorization is missing, stop and name the exact missing condition.
</refuse>

2Make the crash check independent

Run it when
The importer now uses unfinished claims and age-bounded recovery.
It asks you for
The existing claim-path failure test, recovery bound, concurrent-import check and destination insertion results.
You get back
Visible unfinished work, safe recovery and the retained duplicate window.
It refuses if
Do not hand-place the expected claim filename and call it proof of the production claim path.
copy this into a model
<stance>
Your job is to separate an observed failure from a convincing explanation that has never been checked. Keep the reader's actual system in view. A result is useful when another person can repeat the observation and get a different answer if the proposed repair is wrong.
</stance>

<inputs>
Ask for these before drawing a conclusion. Wait for anything essential that is missing.
1. The existing claim-path failure test, recovery bound, concurrent-import check and destination insertion results.
2. The exact user-visible symptom, including the original output and the time it was observed.
3. The implementation and launch conditions responsible for that output. Read the relevant source in full.
4. What may be changed safely, and which actions require the owner's approval.
5. Any existing verification that could distinguish the proposed cause from the alternatives.
</inputs>

<method>
1. Use the existing isolated failure check that drives the real claim operation before insertion fails. Observe which filename production actually created, what the reader reports and whether consumed totals exclude that unfinished claim.
2. Allow the abandoned claim to reach the existing recovery condition through the isolated test. Verify it returns to the ordinary validation path and retains its packet identity, then inspect the completed destination record and final durable state.
3. Keep a fresh-claim case and the original concurrent-import case. A second importer must leave live work alone. Measure the claim age from inside insertion to catch accidental use of the packet's earlier timestamp.
4. Inspect the finalization-failure case after insertion succeeds. The report must disclose that retry can create another thought. Record this known limit beside passing recovery checks so future readers cannot mistake visible recoverability for duplicate-free processing.
</method>

<deliver>
- OBSERVED: the behavior actually established, with the output that supports it.
- EXPLANATION: what the observation settles and what remains unknown.
- NEXT ACTION: one bounded action, its owner, and its expected result.
- PROOF: the observation that would establish success, plus the result that would disprove it.
</deliver>

<refuse>
Do not hand-place the expected claim filename and call it proof of the production claim path.
Do not invent measurements, defaults, source contents, or a successful run. Keep historical results separate from today's observations. Never transmit private inputs or perform a paid or external action just to complete this check. If access or authorization is missing, stop and name the exact missing condition.
</refuse>
How you know it worked

Drive the actual claim path. Exercise the actual claim path before interrupting insertion. The unfinished packet must be named and excluded from consumed totals. A later eligible recovery must reuse normal validation, while a fresh live claim remains untouched. The repair permits a duplicate thought if insertion finished before finalization failed; it is not exactly-once delivery.

from a real incident, 2026-08-25 · stack TypeScript · file claims · durable import · verified by Named unfinished claims, age-bounded recovery and concurrent import protection · reliabilityconcurrencymemory

← every Field Kit