---
id: "bug-396"
status: "fixed"
status_updated: "2026-09-24"
status_note: ""
component: "worker"
severity: "unknown"
timestamp: "2026-06-10T22:45:00-07:00"
last_seen: "2026-09-19T09:00:00Z"
occurrences: 1
files: ["src/worker/src/controller_connector.c", "src/lib/xceapi.c", "src/controller/cluster.c"]
tags: ["ha", "notify", "silent-data-loss", "worker", "quorum", "ha-consistency-invariants"]
related: []
legacy: true
---

# bug-396: Worker job state notifications (OPCode_notify) are permanently lost when the controller dispatch…

## Description
Worker job state notifications (OPCode_notify) are permanently lost when the controller dispatch gate rejects them (quorum loss / COMMITTING window): worker never reads replies, never retries, no rejoin resync

## Environment
_Not recorded (migrated from buglog.json)._

## Reproduction
_Not recorded (migrated from buglog.json)._

## Root cause
xce_notify is enqueue-and-forget (no cbuf_get); error replies dropped via cbuf_tryput -EAGAIN (xcectx.c:304); xcecd_job_finished return ignored (FIXME at xcecd_worker_utils.c:298); xce_join_req carries no running-job state so rejoin cannot resync

## Fix
FIXED 2026-06-12 (ha-commit-barrier-rollout tasks 1.2+4.2+4.3): dispatch gate admits fact opcodes (notify/update/setpreason/clrpreason) without write quorum (ha.c CTRL_PRIMARY allowlist); facts append via RETAIN (log-is-the-queue, no timeout) and commit when quorum returns. End-to-end retention proof: test_fact_retention_across_quorum_loss. Worker-side redelivery gap remains (worker-rejoin-resync backlog covers disconnect windows).

## Verification
_Not recorded (migrated from buglog.json)._

## References
_Not recorded (migrated from buglog.json)._