test(ha-commit-barrier-rollout): fact-retention-across-quorum-loss proof (task 4.3)

Green integration proof: 4 facts driven during total quorum loss append
RETAIN with rc 0 in <1000ms (vs 5000ms timeout — wrongly-applied WAIT
tripwire), pending with retained-depth=4 logged, present exactly once
on disk (real WAL header scan); reconnect + one covering ACK commits
the suffix with current_lsn unchanged (no redelivery). Completes the
bug-396 fix evidence (umbrella Req 2.8). Census 495/495.

.wolf/anatomy.md

@@ -1,7 +1,7 @@
 # anatomy.md
 
-> Auto-maintained by OpenWolf. Last scanned: 2026-06-12T11:16:47.642Z
-> Files: 513 tracked | Anatomy hits: 0 | Misses: 0
+> Auto-maintained by OpenWolf. Last scanned: 2026-06-12T15:29:40.114Z
+> Files: 515 tracked | Anatomy hits: 0 | Misses: 0
 
 ## ./
 
@@ -253,7 +253,7 @@
 - `requirements.md` — Requirements Document (~3181 tok)
 - `research.md` — Research & Design Decisions: ha-commit-barrier-rollout (~3672 tok)
 - `spec.json` (~143 tok)
-- `tasks.md` — Implementation Plan: ha-commit-barrier-rollout (~4653 tok)
+- `tasks.md` — Implementation Plan: ha-commit-barrier-rollout (~4663 tok)
 
 ## .kiro/specs/ha-commit-engine/
 
@@ -706,6 +706,7 @@
 
 ## src/controller/
 
+- `ha.c` — define _GNU_SOURCE (~43480 tok)
 - `job.c` — include <errno.h> (~8196 tok)
 - `join.c` — include "config.h" (~2530 tok)
 - `meson.build` (~1134 tok)
@@ -715,4 +716,5 @@
 ## src/controller/testsuite/
 
 - `controller_test.c` — include <argp.h> (~1368 tok)
-- `test_commit_barrier_reply.c` — Task 3.1 commit-first-then-reply integration tests + task 3.3 receipt-ACK verdict pins (jobdispatch/preason/rusage); cluster harness w/ real persist, wired commit engine, stub standbys, reply-capture endpoint, notify/get_ep_worker capture stubs (~17500 tok)
+- `test_commit_barrier_reply.c` — Commit-barrier reply-ordering integration tests (tasks 3.1/3.3/4.3): four restructured handlers, receipt-ACK verdict pins, fact-retention-across-quorum-loss (~21000 tok)
+- `test_commit_barrier_rollout.c` — Declares explicitly (~11136 tok)

.wolf/cerebrum.md

@@ -9,6 +9,8 @@
 <!-- How the user likes things done. Code style, tools, patterns, communication. -->
 
 ## Key Learnings
+- Census EXACT method (2026-06-12): count DISTINCT Unity `file:line:test:PASS` triples (`grep -aoE` + sort -u), not raw `2mPASS` occurrences — tinylog interleaving garbles ~9 verdict lines per run and duplicates others; distinct-triple count matched the 494-baseline arithmetic exactly (495 after task 4.3's +1).
+- repl registry reconnect semantics: repl_remove_standby vacates the slot (ep=NULL, keeps last_disconnected_lsn guard); repl_add_standby reuses the first empty slot and memsets it (acked_lsn=0). With both standbys removed, majority_candidate_locked zero-fills to n_peers-1 → candidate 0 → committed_lsn frozen (RETAIN entries safely pending); after re-add, ONE covering ack = 2-of-3 majority.
 - repl_wait_majority_ack walAck track is engine-only since barrier-rollout 2.2: entry_lsn==0 returns 0 immediately (documented once-per-lifetime LSN-0 first entry), everything else delegates to commit_submit unconditionally — ce==NULL surfaces as -EINVAL from commit_submit (unreachable in production; cluster_init_phase2 always wires the engine). The counting loop that remains in the function is configAck-ONLY (no self-count, n_active==0 shortcut is Req 8.5 config behavior). persist_wal_sync_append's residual non-engine branch can only store committed_lsn for the LSN-0 no-op case. (2026-06-12, task 2.2)
 - `commit_submit(COMMIT_MODE_RETAIN)` is fully lock-free: it returns 0 BEFORE `pthread_mutex_lock(&ce->lock)` (commit.c:233-239), so it is safe to call from hook functions even while entity write locks are held — only WAIT mode takes ce->lock. (barrier-rollout task 1.2, 2026-06-12)
 - ha-commit-engine: once repl.c references commit_* symbols (task 5.2), commit.c MUST be in controller_src (meson.build) or the production xce_controller link fails — the "linkage lands with 5.3" note in tasks.md only held while repl.c had no engine references. Lock order ce->lock → r->lock: repl.c calls engine hooks only AFTER releasing r->lock.

.wolf/memory.md

@@ -957,3 +957,8 @@
 | 07:14 | Edited src/controller/ha.c | expanded (+10 lines) | ~205 |
 | 14:35 | task 4.2 validated: gate switch admits notify/update/setpreason/clrpreason; build OK; 21/21 rollout, 494 census ZERO FAIL | src/controller/ha.c | success | ~3k |
 | 07:50 | Edited .kiro/specs/ha-commit-barrier-rollout/tasks.md | inline fix | ~12 |
+| 08:02 | Edited src/controller/testsuite/test_commit_barrier_reply.c | 5→6 lines | ~43 |
+| 08:03 | Edited src/controller/testsuite/test_commit_barrier_reply.c | added 3 condition(s) | ~3291 |
+| 08:03 | Edited src/controller/testsuite/test_commit_barrier_reply.c | 2→5 lines | ~72 |
+| 15:15 | Task 4.3 ha-commit-barrier-rollout: fact-retention-across-quorum-loss integration test (GREEN on landing) — quorum lost via repl_remove_standby x2, 4 worker facts via on_job_start/on_job_finish (cluster.c/do_notify not in test link), RETAIN pending + on-disk exactly-once scan, reconnect + covering ACK advances committed_lsn, no re-delivery, retained-depth=4 printed | src/controller/testsuite/test_commit_barrier_reply.c | census 495 distinct Unity PASS (494+1), ZERO FAIL | ~55k |
+| 08:29 | Edited .kiro/specs/ha-commit-barrier-rollout/tasks.md | inline fix | ~30 |