chore(wolf): sync anatomy/cerebrum/memory/hooks/token-ledger bookkeeping

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AgYRU3zDTqNGV5Jk8aiKLg

.wolf/anatomy.md

@@ -1,7 +1,7 @@
 # anatomy.md
 
-> Auto-maintained by OpenWolf. Last scanned: 2026-08-25T13:49:34.701Z
-> Files: 740 tracked | Anatomy hits: 0 | Misses: 0
+> Auto-maintained by OpenWolf. Last scanned: 2026-08-25T14:45:35.964Z
+> Files: 741 tracked | Anatomy hits: 0 | Misses: 0
 
 ## ../../../../../../tmp/
 
@@ -960,13 +960,13 @@
 - `job.c` — include <assert.h>; bug-1693 (2026-08-25): `fetchfile_pending_t` gained a `worker_t* worker` field (set in `on_fetchfile()` before registering); new `void fetchfile_signal_worker_disconnect(worker_t*)` walks `g_fetchfile_list` and wakes every pending waiter proxied to a disconnected worker with `-ECONNRESET`, called from `handle_worker_leave()` (worker.c); `XCE_TESTING`-only `fetchfile_wait_for_test()` seam added for regression coverage (~38719 tok)
 - `join.c` — include "config.h" (~2994 tok)
 - `main.c` — build-time-versioning task 3.2 (argp_program_version runtime-composed into static `version_buf[128]`, "My name is..." startup INFO reads that buffer) PLUS dirty-content-fingerprint task 3.2 (2026-08-21): new static `version_display_buf[128]` composed via `xce_compose_version_ex()` (adds `STR(VERSION_DIRTY_FINGERPRINT)`) feeds `argp_program_version` instead; `version_buf`'s composition + the startup INFO log are byte-identical/untouched (Req 3.2). Live-verified: `--version` -> `7ebcba6d-cdb7cc7d`, startup log -> `7ebcba6d-dirty` (~5346 tok)
-- `meson.build` (src/controller/) — bug-1693: added `testsuite/test_fetchfile_disconnect.c` to `controller_unit_test_src` (~3533 tok)
+- `meson.build` (~3546 tok)
 - `misc.c` — include <errno.h> (~1359 tok)
 - `myapp.c` — define _GNU_SOURCE (~6287 tok)
 - `myconf.c` — define _GNU_SOURCE (~1180 tok)
 - `opget.c` — include "config.h" (~1730 tok)
 - `opupd.c` — include "config.h" (~714 tok)
-- `persist.c` — define _GNU_SOURCE (~103677 tok)
+- `persist.c` — define _GNU_SOURCE (~106216 tok)
 - `queue.c` — include <errno.h> (~1554 tok)
 - `repl.c` — include <assert.h> (~9240 tok)
 - `reply.c` — include "config.h" (~590 tok)
@@ -989,7 +989,7 @@
 - `clean_failover_preservation.sh` — clean_failover_preservation.sh — ha-term-safety task 5.2 live integration test. (~5327 tok)
 - `configcompare.c` — define _GNU_SOURCE (~2273 tok)
 - `configcompare.h` — pragma once (~1186 tok)
-- `controller_test.c` — include <argp.h>; bug-1693: registered `test_fetchfile_disconnect` (extern decl + TEST()) alongside existing `test_sched_admin_dispatch` (~2481 tok)
+- `controller_test.c` — include <argp.h> (~2506 tok)
 - `ctrlstatus_fmt.h` — ifndef _CTRLSTATUS_FMT_H_ (~631 tok)
 - `resval_typeresolve.c` — resval_resolve_type(): resource-name -> Value_u_which table lookup (14 known names unchanged) + task 2.1's numeric-default fallback / `-t` type_override for unrecognized names (~499 tok)
 - `resval_typeresolve.h` — declares resval_resolve_type()/RESVAL_TYPE_UNKNOWN; task 2.1 fallback now implemented (~676 tok)
@@ -1028,6 +1028,7 @@
 - `test_job_dispatch_fail_count.c` — scheduler-dispatch-commit task 1.3: proves job_t.dispatch_fail_count (xce/types.h wrapper struct, new uint32_t next to submit_lsn) is a plain, directly settable/incrementable/resettable in-memory-only field; bare stack-local job_t, no jobmgr/RTTI, mirrors test_persist_types.c's test_slot_key_t_fields precedent. Data-model only -- no dispatch_a_job_() wiring (~1600 tok)
 - `test_job_dispatch.c` — Declares in (~1205 tok)
 - `test_jobdispatch_no_double_notify.c` — Declares table (~5490 tok)
+- `test_persist_checkpoint_offload.c` — bug-1694 regression suite: proves checkpoint_task_fn (persist.c) no longer blocks the delaymgr thread with real checkpoint I/O -- gated XCE_TESTING hook (persist_checkpoint_test_hook) + park/release probe mirrors test_ha_liveness.c's reconnect/configpush offload tests. 3 tests: GREEN (trigger returns promptly, body runs on a slow-lane thread), RED (flag OFF reproduces pre-fix inline blocking), no-cluster fallback (~3456 tok)
 - `test_repl_apply.c` — include <dirent.h> (~5812 tok)
 - `test_resval_typeresolve.c` — Declares override (~1118 tok)
 - `test_sched_admin_dispatch.c` — Unity tests for OPCode_schedAdmin dispatch (cluster.c) via `myreq_handler_for_test`: standby/not-connected/admission-exhausted rejects, success/timeout/rpc-status-only/business-error round trips. bug-1693 (2026-08-25): added `test_schedadmin_disconnect_wakes_immediately`, calling the real `schedadmin_signal_disconnect()` (cluster.c) from a second thread against a real pending wait -- proves a disconnect wakes it in <1s (not the real unshrunk 5s deadline) with a distinguishable `"scheduler disconnected"` SchedAdminReply. Calls `schedadmin_signal_disconnect()` directly rather than `handle_scheduler_leave()` since this binary doesn't link the real sched.c (test_config_repl.c's stub would silently swallow the call -- see cerebrum.md) (~8752 tok)
@@ -1104,7 +1105,7 @@
 
 ## src/include/
 
-- `persist.h` — pragma once; bug-1689: declares persist_submit_job_finish_fact() (~26004 tok)
+- `persist.h` — pragma once (~26099 tok)
 - `utils.h` — dirty-content-fingerprint task 3.1: new `xce_compose_version_ex()` extern decl (--version-only sibling of xce_compose_version(), adds optional `dirty_fingerprint` param); startup-log call sites keep calling the untouched xce_compose_version() (~2720 tok)
 - `wal_types.h` — pragma once (~4524 tok)
 

.wolf/cerebrum.md

@@ -188,4 +188,6 @@
 - **A prior task's own test file can pre-emptively flag a specific assertion as "this will need to change once task N.M lands" in its own comment/message string — grep for the LATER task's own number in sibling test files before assuming "task boundary == only my new file changes."** Task 3.1's `test_dispatch_commit.c::test_dc_worker_not_found_leaves_job_pend_and_alloc_uncommitted` asserted `dispatch_fail_count` stayed unchanged with the message "incrementing it is task 3.3's job, not 3.1's" — a deliberate, anticipated staleness, not an accidental regression. Confirmed via the mandated RED (git-stash job.c only, rebuild, run new tests → fail as expected) → GREEN (restore, rebuild) cycle: the GREEN pass surfaced this ONE pre-existing sibling-test failure (seeded counter 2 → now correctly 3), fixed by updating that one assertion + its message, not by touching my own new file. This is explicitly within "test infrastructure under testsuite/ may change" boundary language even when the task brief's boundary section only names the NEW file — a task boundary permitting "test infrastructure" changes covers fixing a sibling test's own foreseen staleness, not just adding new tests.
 - **A "mirror the precedent's free-and-replace pattern exactly" instruction (bug-1678/1687/1689's own established shape) can be actively WRONG for a new field if that field's live-mutation path sources any nested pointer from `makeString()` (bug-1690, WAL_JOB_RUSAGE/job.run_usage).** `update_host_runusage()` (misc.c) builds `xce_host_runusage_t.host_name` from `makeString()` — an RTTI-managed, refcounted, HEADER-BEFORE-DATA pointer (confirmed by reading librtti's actual source in the nix store, `RTTI_DATA_TO_OBJ`: `((meta_obj_t*)(((char*)v) - RTTI_OBJ_HEADER_SIZE))`), NOT a plain `malloc()`. `persist_apply_pump_run()` (the LIVE online-apply pump, confirmed via its own doc comment to run continuously on the primary itself, not just boot replay) re-applies every committed fact — including one the SAME process just live-mutated moments earlier via the synchronous "mutate-then-persist" pattern (the SAME pattern bug-1678's `dispatch_a_job_()` uses for `job.allocs`). For DISPATCH this is safe because `job.allocs`'s nested `host` field is genuinely capnp-wire-decoded end-to-end (arrives from the scheduler already deserialized) — `free_JobAlloc_ptr()` on it is always consistent. For RUSAGE it is NOT safe: calling the capnp-generated `free_JobRunusage_ptr()` on the LIVE (xstring-backed) structure would `free()` a non-malloc'd pointer — guaranteed ASAN heap-corruption abort on the very first live report for a new host. **General check before reusing this "free-and-replace at apply time" precedent for any NEW WAL fact type: grep the field's LIVE-mutation call site for `makeString()` (or any other non-malloc allocator) on any pointer the apply seam might later free — if found, replace with a MERGE (overwrite scalars in place, only adopt genuinely-new nested pointers by ownership transfer, never free an existing one) instead of a free-and-replace.** Proved with a real regression test using an actual `makeString()`'d pointer and asserting POINTER IDENTITY survives the merge (not just value equality) — a value-only check would not have caught this class of bug. Also found, but explicitly NOT fixed (separate file/component, out of scope): `job_destroy()` (`src/lib/jobj.c`)'s own existing manual `FREEUP`-based walk over `run_usage` has this exact same latent host_name/xstring mismatch, independent of and pre-dating this fix.
 - **This project's Unity build has `TEST_ASSERT_EQUAL_DOUBLE` silently non-functional (fails every call with "Unity Double Precision Disabled") because `unity_dep = dependency('unity')` is a prebuilt nix package with no `-DUNITY_INCLUDE_DOUBLE`** (Unity's own default is double support OFF unless explicitly opted in; float support is ON by default). Grep any existing test file comparing a C `double` field before assuming `TEST_ASSERT_EQUAL_DOUBLE` works — the established codebase convention (e.g. `test_apply_committed_entry.c`, `test_dispatch_commit.c`, `test_worker_join.c`) is `TEST_ASSERT_EQUAL_FLOAT` even for genuinely-`double`-typed fields (implicit narrow to float; fine for clean/round test fixture values). Caught only by actually running the RED build and reading the real failure message, not by reasoning from Unity's public API alone.
+- **When offloading a newly-discovered delaymgr/iomgr blocking-I/O violation, "vtask_enq_classified(pool, task, VTASK_LIVE_BLOCK)" is NOT automatically the right destination even though it's this codebase's most commonly cited fix-pattern name — check whether the SAME pool already carries a lock the new work also needs, via a DIFFERENT already-offloaded caller** (bug-1694, checkpoint_task_fn offload, 2026-08-25). This codebase actually has TWO distinct offload destinations, easy to conflate: the vtaskmgr N-thread pool (`vtask_enq_classified`, VTASK_LIVE_BLOCK/VTASK_REQ_BLOCK — used for *bounded* handler work, e.g. `persist_apply_pump_kick`'s apply-pump drain and `commit.c`'s `dispatch_continuation`) vs. the dedicated SlowLane (`slowlane_submit`, `c->slowlane`, `n_workers` separate pthreads — used for genuinely *long/unbounded* blocking I/O: snapshot send, config-push, reconnect, catch-up-streaming, demotion-truncate). `ha-async-io.md`'s own table already states this split ("vtaskmgr must NOT do: long/unbounded blocking I/O ... starves the pool") but it's easy to miss which category new work falls into. Concretely: `persist_apply_pump_run()` (the live WAL-apply walk) holds `apply_pump_lock` across its ENTIRE walk and is ITSELF dispatched onto the vtask pool via `persist_apply_pump_kick()`'s `vtask_enq_classified(..., VTASK_LIVE_BLOCK)` — so any OTHER unbounded, lock-holding work (checkpoint's `write_snapshot()`, also under `apply_pump_lock`) put on that SAME pool would risk starving it (a worker parked on the lock for the whole snapshot-write duration, stealing capacity from commit-continuation/apply-pump liveness work) — not a classic deadlock, but the exact "starves the pool" failure mode the split exists to prevent. The fix used the slow lane instead, exactly mirroring `ha_snapshot_do_send()`'s pre-existing (already-in-production, default-ON) call to the SAME function (`persist_checkpoint()`) from a slow-lane thread — i.e. the safest new offload destination is often "wherever an already-proven-safe sibling call already runs the identical function from," not a fresh pattern match on a fix-recipe's literal wording. **General technique: before picking an offload destination, grep every existing caller of the SAME blocking function/lock for its current thread context — if a sibling caller already runs it safely from candidate destination X, reuse X; if a DIFFERENT already-offloaded consumer of the same lock lives on candidate destination Y, that's evidence AGAINST Y.**
+- **A buglog entry's own "root cause: NOT YET ROOT-CAUSED" (or similarly hedged) status is a real signal to re-derive the causal claim from primary evidence before citing it as settled, especially when later re-occurrences of the SAME symptom show it firing on completely unrelated diffs.** bug-1429 (cited by `config_repl.c`/`ha_convergence.c`'s catchup/demotion offload-flag comments as "the vtask pool that deadlocked controller_unit_test on 2026-07-10") is itself logged as never root-caused, and its OWN later occurrences (2026-08-20, 2026-08-23) reproduced the identical TIMEOUT/hang signature on diffs that touched neither the vtask offload code nor persist.c's checkpoint path at all — "strongly corroborates this is a pre-existing, systemic, timing/order-dependent hang in the controller_unit_test harness," per the buglog's own later entries, not proven caused by VTASK_LIVE_BLOCK dispatch specifically. Don't repeat a downstream comment's causal claim as fact in a new design doc/comment without checking the buglog entry it cites — the comment can be more confident than the evidence it's citing.
 - **`controller_unit_test` (the main shared meson.build `controller_unit_test_src` binary) does NOT link the real `sched.c`/`dataex.c` at all** (bug-1693, 2026-08-25) — `sched.c`'s own `on_scheduler_join()`/`collect_confvars()` and `dataex.c`'s `notify()` collide at link time with fake local definitions several OTHER files in that same binary already provide (`test_commit_barrier_reply.c`, `test_worker_join.c`), so `test_config_repl.c` instead ships a trivial no-op `handle_scheduler_leave(cluster_t *c) { (void)c; return 0; }` stub purely to satisfy the linker. **Any new/changed behavior added to a real `sched.c` function is therefore SILENTLY UNTESTED by any `controller_unit_test`-based test that calls that function by name** — the call resolves to the stub, not the real implementation, with no compile/link error to flag the mismatch (confirmed empirically: a new regression test asserting sub-second wake timing after calling `handle_scheduler_leave()` passed compilation and linking fine, then failed by taking the full 5s deadline — the stub had silently swallowed the call). `nm '<obj>.o' | grep ' T <symbol>$'` across every `.o` in the target's build dir is the fast way to confirm which TU actually provides a given symbol in a given binary before trusting a test's result. The two standalone binaries that DO link the real `sched.c` (`sched_push_unit_test`, `sched_worker_change_unit_test` — see their own `meson.build` comments for the collision rationale) don't link `cluster.c`, so neither binary alone can exercise a fix that spans both files for real; bug-1693's fix split verification across both (a direct-call test against `cluster.c`'s real new function in `controller_unit_test`, plus a small counting-spy test in `test_sched_worker_change.c` proving `sched.c`'s real caller invokes it) rather than inventing a third binary that links both (would need to duplicate most of `controller_unit_test_src`'s already-large dependency list to satisfy `cluster.c`'s own huge fan-out). General lesson: when a fix spans a function in `sched.c`/`dataex.c` AND a function in any of the ~15 other files real-linked into `controller_unit_test_src`, check with `nm`/grep for a same-name fake stub in a sibling test file in that binary BEFORE trusting a test that calls the `sched.c`/`dataex.c` side by name — it may be exercising a stub, not your change.

.wolf/hooks/_session.json

@@ -108,7 +108,7 @@
       "first_read": "2026-08-25T07:26:07.781Z"
     },
     "/home/rshen/projects/xce/worktrees/scheduler-framework/.kiro/steering/ha-async-io.md": {
-      "count": 2,
+      "count": 3,
       "tokens": 4721,
       "first_read": "2026-08-25T07:26:43.249Z"
     },
@@ -118,8 +118,8 @@
       "first_read": "2026-08-25T07:27:17.276Z"
     },
     "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/persist.c": {
-      "count": 57,
-      "tokens": 103677,
+      "count": 62,
+      "tokens": 106216,
       "first_read": "2026-08-25T07:27:27.677Z"
     },
     "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/job.c": {
@@ -128,8 +128,8 @@
       "first_read": "2026-08-25T07:27:28.858Z"
     },
     "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/ha.c": {
-      "count": 35,
-      "tokens": 125491,
+      "count": 37,
+      "tokens": 126128,
       "first_read": "2026-08-25T07:27:55.853Z"
     },
     "/home/rshen/projects/xce/worktrees/scheduler-framework/src/lib/raft/raft.c": {
@@ -168,7 +168,7 @@
       "first_read": "2026-08-25T07:29:20.929Z"
     },
     "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/config_repl.c": {
-      "count": 6,
+      "count": 7,
       "tokens": 36913,
       "first_read": "2026-08-25T07:29:38.830Z"
     },
@@ -203,8 +203,8 @@
       "first_read": "2026-08-25T07:39:31.167Z"
     },
     "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/ha.h": {
-      "count": 1,
-      "tokens": 36503,
+      "count": 2,
+      "tokens": 34172,
       "first_read": "2026-08-25T07:41:57.960Z"
     },
     "/home/rshen/projects/xce/worktrees/scheduler-framework/src/include/wal_types.h": {
@@ -258,7 +258,7 @@
       "first_read": "2026-08-25T07:58:23.880Z"
     },
     "/home/rshen/projects/xce/worktrees/scheduler-framework/src/include/persist.h": {
-      "count": 7,
+      "count": 8,
       "tokens": 26004,
       "first_read": "2026-08-25T07:59:46.203Z"
     },
@@ -328,13 +328,13 @@
       "first_read": "2026-08-25T09:29:39.634Z"
     },
     "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/meson.build": {
-      "count": 6,
-      "tokens": 3521,
+      "count": 7,
+      "tokens": 0,
       "first_read": "2026-08-25T09:31:05.167Z"
     },
     "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/testsuite/controller_test.c": {
-      "count": 10,
-      "tokens": 2459,
+      "count": 13,
+      "tokens": 2494,
       "first_read": "2026-08-25T09:35:28.617Z"
     },
     "/home/rshen/projects/xce/worktrees/scheduler-framework/src/schema/controller.capnp": {
@@ -426,6 +426,26 @@
       "count": 1,
       "tokens": 0,
       "first_read": "2026-08-25T13:31:53.292Z"
+    },
+    "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/slowlane.c": {
+      "count": 1,
+      "tokens": 2392,
+      "first_read": "2026-08-25T14:19:43.327Z"
+    },
+    "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/testsuite/test_ha_liveness.c": {
+      "count": 2,
+      "tokens": 0,
+      "first_read": "2026-08-25T14:23:50.247Z"
+    },
+    "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/testsuite/test_apply_pump.c": {
+      "count": 1,
+      "tokens": 22429,
+      "first_read": "2026-08-25T14:24:53.563Z"
+    },
+    "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/testsuite/test_persist_checkpoint.c": {
+      "count": 1,
+      "tokens": 0,
+      "first_read": "2026-08-25T14:31:21.226Z"
     }
   },
   "files_written": [
@@ -1562,6 +1582,66 @@
       "action": "edit",
       "tokens": 17,
       "at": "2026-08-25T13:49:34.709Z"
+    },
+    {
+      "file": "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/persist.c",
+      "action": "edit",
+      "tokens": 2915,
+      "at": "2026-08-25T14:28:56.142Z"
+    },
+    {
+      "file": "/home/rshen/projects/xce/worktrees/scheduler-framework/src/include/persist.h",
+      "action": "edit",
+      "tokens": 591,
+      "at": "2026-08-25T14:30:07.978Z"
+    },
+    {
+      "file": "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/persist.c",
+      "action": "edit",
+      "tokens": 441,
+      "at": "2026-08-25T14:32:25.433Z"
+    },
+    {
+      "file": "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/persist.c",
+      "action": "edit",
+      "tokens": 218,
+      "at": "2026-08-25T14:32:38.211Z"
+    },
+    {
+      "file": "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/testsuite/test_persist_checkpoint_offload.c",
+      "action": "create",
+      "tokens": 3703,
+      "at": "2026-08-25T14:33:46.517Z"
+    },
+    {
+      "file": "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/testsuite/controller_test.c",
+      "action": "edit",
+      "tokens": 38,
+      "at": "2026-08-25T14:33:59.425Z"
+    },
+    {
+      "file": "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/testsuite/controller_test.c",
+      "action": "edit",
+      "tokens": 31,
+      "at": "2026-08-25T14:34:10.107Z"
+    },
+    {
+      "file": "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/meson.build",
+      "action": "edit",
+      "tokens": 36,
+      "at": "2026-08-25T14:34:15.876Z"
+    },
+    {
+      "file": "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/persist.c",
+      "action": "edit",
+      "tokens": 84,
+      "at": "2026-08-25T14:39:21.240Z"
+    },
+    {
+      "file": "/home/rshen/projects/xce/worktrees/scheduler-framework/src/controller/persist.c",
+      "action": "edit",
+      "tokens": 61,
+      "at": "2026-08-25T14:45:35.971Z"
     }
   ],
   "edit_counts": {
@@ -1583,13 +1663,13 @@
     "src/controller/ha.c": 2,
     "src/controller/testsuite/test_ha_durability.c": 3,
     "src/controller/CLAUDE.md": 1,
-    "src/include/persist.h": 2,
+    "src/include/persist.h": 3,
     "src/include/wal_types.h": 6,
-    "src/controller/persist.c": 36,
+    "src/controller/persist.c": 41,
     "src/controller/job.c": 15,
     "src/controller/testsuite/test_wal_job_start_fact.c": 1,
-    "src/controller/meson.build": 6,
-    "src/controller/testsuite/controller_test.c": 12,
+    "src/controller/meson.build": 7,
+    "src/controller/testsuite/controller_test.c": 14,
     "src/scheduler/testsuite/test_limit_plugin.c": 2,
     "src/scheduler/testsuite/meson.build": 4,
     "src/scheduler/src/plugins/limit.c": 1,
@@ -1608,11 +1688,12 @@
     "src/controller/testsuite/test_sched_admin_dispatch.c": 6,
     "src/controller/testsuite/test_fetchfile_disconnect.c": 1,
     "src/controller/testsuite/test_job_array_sched_push.c": 1,
-    "src/controller/testsuite/test_sched_worker_change.c": 6
+    "src/controller/testsuite/test_sched_worker_change.c": 6,
+    "src/controller/testsuite/test_persist_checkpoint_offload.c": 1
   },
-  "anatomy_hits": 52,
-  "anatomy_misses": 33,
-  "repeated_reads_warned": 247,
+  "anatomy_hits": 54,
+  "anatomy_misses": 35,
+  "repeated_reads_warned": 263,
   "cerebrum_warnings": 0,
-  "stop_count": 42
+  "stop_count": 43
 }

.wolf/memory.md

@@ -4101,3 +4101,15 @@
 | 06:49 | Edited src/controller/sched.c | 3→3 lines | ~19 |
 | 06:49 | Edited src/controller/worker.c | 4→4 lines | ~16 |
 | 14:10 | bug-1693 FIXED: schedAdmin/fetchfile disconnect-wait Decision Log violations (timeout was sole failure-detection) | src/controller/cluster.c, sched.c, job.c, worker.c, include/cluster.h, testsuite/test_sched_admin_dispatch.c, testsuite/test_fetchfile_disconnect.c (new), testsuite/test_sched_worker_change.c, testsuite/test_job_array_sched_push.c, meson.build, testsuite/controller_test.c | RED confirmed (5001ms/backstop timeout pre-fix, 3 tests) -> GREEN (all <1s post-fix); full suite 1181 Tests 2 Failures (bug-1561 only, pre-existing), 0 new failures | ~95000 |
+| 07:14 | Session end: 189 writes across 43 files (persistence.md, SKILL.md, plugin.h, plugin.c, driver.c) | 85 reads | ~871610 tok |
+| 07:28 | Edited src/controller/persist.c | added error handling | ~2721 |
+| 07:30 | Edited src/include/persist.h | expanded (+30 lines) | ~552 |
+| 07:32 | Edited src/controller/persist.c | modified also() | ~412 |
+| 07:32 | Edited src/controller/persist.c | modified if() | ~203 |
+| 07:33 | Created src/controller/testsuite/test_persist_checkpoint_offload.c | — | ~3456 |
+| 07:33 | Edited src/controller/testsuite/controller_test.c | 2→3 lines | ~36 |
+| 07:34 | Edited src/controller/testsuite/controller_test.c | 2→3 lines | ~29 |
+| 07:34 | Edited src/controller/meson.build | 2→3 lines | ~34 |
+| 07:39 | Edited src/controller/persist.c | 4→5 lines | ~78 |
+| 07:45 | Edited src/controller/persist.c | 5→4 lines | ~57 |
+| 14:51 | xce-audit-invariants dim1 fix: checkpoint_task_fn (delaymgr thread) blocked on real persist_checkpoint() I/O -- no offload existed at all, unlike every sibling (snapshot-send/config-push/reconnect). Investigated apply_pump_lock lock-order risk first: ruled OUT vtask pool (persist_apply_pump_run holds the same lock and is ITSELF dispatched onto that pool via VTASK_LIVE_BLOCK -- would starve it), used the SLOW LANE instead (slowlane_submit), matching snapshot-send's already-proven-safe precedent (persist_checkpoint already runs there today via ha_snapshot_do_send). New flag g_persist_checkpoint_offload defaults ON (not flagged off like catchup/demotion -- verified no test-fixture-hang precedent applies, checkpoint's trigger is fire-and-forget). bug-1694 logged. RED (probe forced pre-fix inline path, GREEN test hung, kill -9'd, confirmed real detection) then GREEN (reverted, rebuilt) both verified via full synchronous `/xce-build controller asan build-asan --incremental` runs | src/controller/persist.c, src/include/persist.h, src/controller/testsuite/test_persist_checkpoint_offload.c (new), src/controller/testsuite/controller_test.c, src/controller/meson.build, .wolf/buglog.json | 1184 Tests 2 pre-existing Failures (bug-1561, unrelated) 0 Ignored, 0 NEW failures, 3/3 new tests PASS | ~145k |