Beagle SCM

SUBS-053: mount()'s error rollback unlinks a PRE-EXISTING sub anchor — a transient throw silently unmounts a healthy sub

Input

Context

Found 2026-07-14 on the journal repo (journal/be, jab): jab status reported 91 ok and emitted NO status test hunk; be/test/.be was gone while all 301 sub files were byte-identical to the gitlink pin a3b37c7b. The sub was intact — only its anchor had been deleted.

• shared/submount.js:334 — mount()'s catch-all does try { io.unlink(anchorPath); } catch (e2) {} (the GET-037 atomicity rollback), deleting the anchor on ANY throw.
• The rollback assumes mount() OWNS the anchor; on a RE-mount of an already-mounted sub it deletes an anchor it found, not one it created — a healthy sub is demoted to unmounted.
• mount() writes the anchor at submount.js:319 BEFORE store.open (:326) and checkout.apply (:327), so the anchor is live during the steps most likely to throw; the same write-then-checkout order repeats in the local-source reuse branch (:277-280).
• The catch swallows EVERYTHING, incl. a raw X is not a function from a stale require cache in a live jab session (a known quirk) — any transient blip becomes permanent damage.
• get re-runs mount() for every sub on a same-tip reconcile (noPrune, verbs/get/get.js:351-352) — verified: a bare re-get prints a new test row.
• Evidence in be/.be: line 53 26714CGTBr get ?#33295788 is a same-tip reconcile; be/test mtime 13:26:16 precedes the line-54 FF get's own record (13:26:24).
• Damage is STICKY: a later FF get never re-mounts an unchanged gitlink (verified — no new test row on an FF), so the sub stays lost until a same-tip reconcile happens to re-mount it.
• The loss is SILENT because status buckets an unmounted declared sub as ok: STATUS-007.
• The exact throw was NOT reproduced: today every input resolves clean (pin FOUND locally, store.open(beDir,'beagle-ext-tests') OK, and force / dirty-sub / FF re-gets all preserve the anchor). The failure was state-dependent; the rollback is what made it permanent.

Goals

• A failing re-mount NEVER destroys an existing, healthy mount — worst case it leaves the sub at its prior pin, visible in status.
• Keep GET-037's original guarantee: a FRESH mount that dies part-way leaves no anchor for be.find to resolve.
• Any mount failure is LOUD (a friendly surfaced error), never a silently downgraded sub.

Constraints

• Repro test first (work); fix in beagle-ext (JS), no C changes.
• Minimal diff; no edits to unrelated tests.
• Do not weaken the friendly-message wrapping at submount.js:340-342.

WIP

Design decisions

• Write the anchor LAST, as the commit point: reorder to store.open → checkout.apply → ulog.write(anchorPath, …), then DROP the unlink from the catch entirely.
• Write-last satisfies GET-037 for free: a fresh mount that throws never wrote an anchor, so nothing stale can outlive it — no rollback needed.
• Write-last is safe: checkout.apply takes k explicitly and never reads the anchor, and oldPin is already read up-front at submount.js:312 (GET-040).
• A re-mount that throws then leaves the old anchor at the old pin — the sub still lists in status (possibly mod/adv), which is the recoverable, visible failure we want.
• Apply the same reorder to the local-source reuse branch (submount.js:277-280).
• Rejected: "unlink only if we created it" (an entry-time existence check) — it keeps a destructive step on the error path for no gain over write-last.

TODOs

• repro test: a mounted sub + a mount() that throws after the anchor write → anchor SURVIVES at its prior pin
• repro test: a FRESH mount that throws → no anchor left behind (GET-037 parity kept)
• fix: reorder to checkout-then-anchor in mount(); drop io.unlink(anchorPath) from the catch
• fix: same reorder in the local-source reuse branch (submount.js:277-280)
• verify: jab status in journal/be still emits the status test hunk after a same-tip reconcile

Blockers and bummers

• Root-cause throw unreproduced — the fix is justified by the rollback's blast radius, not by the specific trigger.

Outcome

• be/test/.be restored 2026-07-14 by a same-tip jab get reconcile (re-mount); status test hunk renders again (301 ok, behind 1).