2.5.2 — The session-start run is bounded and a vault node that is not a regular file never blocks it

Fixed

• A vault node that is not a regular file no longer blocks a run. A transaction entry, a preimage slot or a lock path that is a symlink, a named pipe or a directory is not opened: the entry is reported as a damaged transaction, the slot refuses the mutation that needs it and the lock path is refused. Each ERROR names the node. In 2.5.1, init, journal --check, journal --resolve and journal --repair could hang on such a node, and a dangling symlink at the lock path made init loop forever.
• status reports a vault entry that is not a regular file as journal: unreadable; run journal --check, and journal --check answers for it without opening it.
• The harness path is read again immediately before the link is replaced. A path that changed while the repair waited is left alone with a WARNING, where 2.5.1 overwrote it; a path that cannot be looked at is a WARNING and no longer an uncaught error.

Added

• init --lock-wait SECONDS (default 10) sets one deadline for every lock a run takes. The SessionStart hook passes 3, so a busy lock costs a session about three seconds and leaves the harness link for the next start. The bound covers waiting for the lock, not the work done under it.

Changed (refusals an adopter upgrading from 2.5.1 can meet)

• A transaction entry that is a symlink to a valid transaction file, which 2.5.1 read, is now a damaged transaction and gates init until it is replaced with a regular file or removed.
• A preimage slot that is a dangling symlink, which 2.5.1 replaced, now refuses the mutation until it is removed.
• A lock path that is a symlink to a lock file of a dead process, which 2.5.1 broke, is now refused.

Known limits

• A process outside the plugin that replaces the harness path between its last reading and the rename, or the staged link between its last identification and the rename or cleanup, is not guarded against. The standard library has no compare-and-swap on a pathname; the relink never replaces a directory. This narrows the limit declared in 2.5.1.
• A process outside the plugin that replaces a regular preimage slot between its second lstat and its removal has its file removed.
• Two runs breaking the same dead lock can both end up holding it. The race predates this release and is not widened by it.

Decision record: ADR 0030.