Beagle SCM

JS-077 MED: orphan keeper pack on a lost ref CAS (permanent disk leak)

POST writes the keeper pack-log + idx as the FIRST store mutation (post.js:242-243), THEN advances the ref with an expected-old CAS (post.js:246 → advanceRef, post.js:112-118). When the CAS loses — a concurrent advance, exactly the race the CAS defends — advanceRef throws POSTNOFF (post.js:114-116) AFTER the pack is on disk. There is no rollback and no GC path anywhere, so each lost-CAS post leaves the just-written pack-log + idx orphaned: a permanent per-incident disk leak. Content is content-addressed, so it is a leak, not corruption. Method: Issues.

Input

Context

• post.js:242-243: commitM.writePack(reader.shard, info.wt, …) —

  "the FIRST store mutation" (the comment :240 says so).

• post.js:246: `advanceRef(reader, reader.shard, branchKey,

  expectedOld, commit.sha)` runs AFTER the pack write.

• post.js:112-118 advanceRef: `if ((cur||"") !== (expectedOld||""))

  throw "POSTNOFF: REFS … advanced concurrently — retry"` — the lost CAS.

• No catch around :246 and no later GC of unreferenced pack-logs/idx —

  the NNNNNNNNNN.keeper(+.idx) just written stays on disk forever.

Goals

• A lost-CAS post leaves NO orphan pack-log/idx on disk (either the pack

  is written only after the ref slot is reserved, or it is unlinked on the POSTNOFF path).

Constraints

• Preserve the CAS semantics (POSTNOFF on a concurrent advance) and the

  POST-017 all-or-nothing intent.

• libabc+libdog ONLY; keep writePack byte-output unchanged.
• Scope to post.js's write/advance ordering; do not weaken the CAS.

WIP

Design decisions

• Option A: do the CAS/reserve BEFORE writePack (re-check expected-old,

  then write, then commit the ref).

• Option B: wrap advanceRef in a catch that unlinks the freshly written

  pack-log + idx before re-throwing POSTNOFF (record their paths from writePack).

TODOs

• Repro-first test/js/post/*: force a lost CAS (mutate the ref between

  pre-flight and advanceRef) and assert NO orphan pack-log/idx remains.

• Implement the chosen ordering/rollback; keep POSTNOFF behavior.
• Re-run the post parity suite (clean-FF posts byte-equal, unaffected).

Blockers and bummers

• writePack must surface the exact file names it created so a catch can

  unlink precisely (avoid clobbering a concurrent winner's pack).

• 2026-07-07 audit: STILL OPEN (line refs shifted) — verbs/post/post.js:685

  commitM.writePack(reader.shard,…) runs BEFORE :692 advanceRef(…); no catch/unlink, no GC. A lost CAS (advanceRef:222-225 POSTNOFF) leaves the pack-log+idx orphaned.

Outcome

• (pending)