Make persistence failure tests deterministic across root and constrained filesystems

[seonghobae]

Problem

The historical persistence regression manufactured write failure with POSIX directory mode changes. Root/DAC-bypassing runners and permission-ignoring filesystems can still write through those settings, making a production error-path test environment-dependent. Skipping or returning early based on uid/filesystem semantics is not valid coverage.

Protected/default truth is now main@5829a0f08d78de464dd24393ce5d0f25fba9d126 through #159.

Current owning candidate — 2026-09-05

PR #93, test(persistence): replace permission-based fault injection with a deterministic seam, is Ready/mergeable at exact 4775abc66e5350bdbf07ccefca74c10ddb03701a. It was integrated non-destructively with protected main and is behind_by=0; its effective protected-main-relative delta is only CLAUDE.md plus src/lib.rs.

The candidate replaces permission-based fault manufacture with a narrow #[cfg(test)] persist_fault seam covering temporary-file write and atomic-rename failures, keeps the injection thread-local, fails loudly if used from a multi-thread Tokio runtime where the fault could be lost, and retains real-filesystem happy-path coverage. No public runtime configuration or production filesystem abstraction is introduced solely for testing.

This supersedes the old #64 environment-probe/skip approach as implementation authority while retaining that branch only as historical evidence of the original root/DAC failure.

All current inline review threads are resolved. Resolution is finding verification, not independent approval.

Current exact-head evidence

Fresh exact 4775abc66e5350bdbf07ccefca74c10ddb03701a now has terminal GREEN for every Wardnet-owned repository/security lane that has actually executed:

• CI 33905750474 — terminal success;
• Fuzz 33905750458 — terminal success;
• Security Scan 33905750409 — terminal success;
• SAST Semgrep 33905750388 — terminal success.

The remaining failures are centralized evidence/materialization defects, not Wardnet source failures:

• CodeQL PR 33905750435 is terminal failure. Detect-language succeeded; compatibility job 101187972238 successfully executed Request current-head CodeQL scan dispatch and then failed closed because no current-head CodeQL dispatch verdict arrived.
• Required OpenCode run 33905748322 successfully completed bootstrap, exact-head admission, and coverage-source-tree; coverage-evidence job 101250875127 remains queued. It is non-passing and must not be promoted from predecessor or partial evidence.
• Combined commit status contains CodeRabbit/Devin success but no terminal codeql-dispatch/* status for this SHA.

This exact evidence has been handed to central runner/dispatch owner .github#712. GREEN there requires the authenticated dispatch handler to publish the terminal per-language verdict to this exact SHA and materialize the queued coverage-evidence job, followed by a rerun of only the failed/required central job where needed. Do not alter this source head or create a no-op commit to redispatch.

Live organization ruleset 18156473 also retains the structurally impossible generic approval count for the declared solo-maintainer model. .github#772 and owner-plane successor #1644 own the causal governance repair. Self/model approval and routine administrator bypass remain forbidden.

Verification contract

• cargo fmt --check;
• cargo test --locked --workspace;
• cargo clippy --locked --workspace --all-targets -- -D warnings;
• deterministic temporary-write and atomic-rename fault tests exercise the intended error assertions on every supported runner identity;
• at least one real-filesystem integration path continues to exercise normal atomic persistence;
• no test skips based on uid, DAC enforcement, filesystem type or runner identity;
• owned production statement/branch/edge coverage and public docs remain complete under the then-live gate.

Completion gate

Close only after #93 or a verified successor carrying every unique code/test/docs delta reaches protected main, and the resulting protected tree plus one unchanged exact integration candidate has terminal current repository/security/coverage/package/SBOM/provenance/review/thread/governance evidence. No predecessor evidence reuse, self/model approval, routine administrator bypass, force push, gate weakening or no-op dispatch commit.