Guards at the top of mark_job_start/finish/update under the caller's job lock, before BEFORE_EVENT: duplicate (FINISH on terminal) → INFO no-op skipping the AFTER_EVENT hook (no WAL append, lsn frozen); terminal→non-terminal backward (START/UPDATE) → WARN reject preserving state. Shared job_state_is_backward predicate provably admits every production forward merge (PDONE/PERR/suspend bit-OR) while rejecting overwrites. mark_job_fail intentionally unguarded (its merges are always terminal-forward; job_ctrl pre-gates terminal). 5/5 guard tests green; full job-lifecycle suite green; census 0 FAIL. |
||
|---|---|---|
| .. | ||
| settings | ||
| specs | ||
| steering | ||