two new failure modes on FAILURE-MODES.md, both found in our own fleet this week. both live in the sync layer the ledger rides on, not in the protocol — so both are marked [production-only] and explained rather than hidden.
J — the instrument that only knew how to call a human. four separate instruments detected sync conflicts on ledger and journal files. all four printed the same sentence: merge unique lines into the live copy first, then delete the conflict file. none of the four merged anything. the nightly sweep left LEFT 78 for review every night, and one journal had nine conflict copies holding nine lines that existed in no live file.
the fix is an executor hung on a door that already runs — and the half that matters more: the executor knows what it cannot do. a dry run before rollout showed line-wise merging would have poured 92 lines into a python registry, 119 into a json ranking file and 95 into a dashboard html. every one of those a corrupt file. auto-merge is now allowed only for append-only artefacts; everything else goes to review untouched. first live run: 102 lines merged, queue 78 → 76.
K — delivery asserted from the sender's own disk. for three weeks the gate that registers a fix as a parcel for the other machines took "the file exists here" as proof it would arrive there. an audit of 315 parcels found the commonest shape of the class: an apply step that runs only its own _test_* file and never carries — or even names — the thing under test (22 parcels). one of them died on a peer on 11 aug and the fleet went on believing it had shipped.
truth about delivery now comes from the receiver's sync ignore-rules, read at registration time, not from a path list in our code. cannot read the rules = don't know = fail-closed. named limits: mtime is not a version, and the same filename on both ends is not the same content.
if your shards travel by a file-sync tool, you inherit both of these whether or not you use this engine.
also in this release: the changelog backfills v0.3.0, which was cut on 25 aug and never written down — the same lapse v0.2.1 records about v0.2.0. we write those down instead of backdating them quietly.
cut by the weekly release pass, run #2.