fix(adoption): re-check donor growth at retire time, not just at export - #93739
Merged
kshitijk4poor merged 1 commit intoAug 24, 2026
Merged
Conversation
Closes the TOCTOU window flagged in review on NousResearch#93369 (merged via NousResearch#93430): the divergence guard compared EXPORT-TIME message counts, but another backend can append donor messages between the export snapshot and the retire loop — that growth would be stamped behind the non-recoverable adopted_by_profile archive, the exact H2 class the guard exists to prevent, just via a narrower race. The retire loop now re-reads live donor vs local counts immediately before end_session and leaves the donor unretired (donor_retired=False, warn-logged) on any donor-ahead signal; the next resume's export-time guard then handles the divergence normally. Equal-count CONTENT divergence (donor rewind+rewrite) remains invisible to count comparison — documented as accepted: bytes stay in the donor store either way. New red-first-verified regression simulates the exact race by appending to the donor from inside an export_session_lineage wrapper. adoption+ownership suites: 25 passed; ruff clean.
kshitijk4poor
force-pushed
the
fix/adoption-retire-toctou
branch
from
August 24, 2026 09:32
552464a to
2ea8e67
Compare
kshitijk4poor
enabled auto-merge (rebase)
August 24, 2026 09:33
alt-glitch
added
type/bug
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the TOCTOU window flagged by review on #93369 (adoption heal, merged via #93430): the divergence guard compared EXPORT-TIME message counts, so messages appended to the donor by another backend between the export snapshot and the retire loop could still be stamped behind the non-recoverable
adopted_by_profilearchive — the exact data-stranding class the guard exists to prevent, via a narrower race.Change
hermes_state_portability.py— the retire loop re-reads live donor vs local counts immediately beforeend_session; any donor-ahead signal skips the stamp (donor_retired=False, warn-logged). The next resume's export-time guard then handles the divergence normally. Equal-count CONTENT divergence (donor rewind+rewrite) remains invisible to count comparison — documented in-code as accepted: bytes stay in the donor store either way, only reachability differs.Validation
Follow-up to #93369/#93430; part of the #93091 train.