Top-level Space create is not atomic — churn leaves content-less, grant-less ghost roots #638

Activity

1. rbuergi commented on Aug 8, 2026

   

   rbuergi

   on Aug 8, 2026

   ContributorAuthor

   More actions

   Status audit against current main (2026-08-08) — PARTIAL; re-scoping to what remains.

   Fixed — the hang half: writes into a confirmed-absent partition fail fast with a speaking error (PartitionWriteGuardValidator.cs:250-260 — 'no partition, no write'); PathResolutionService.cs:357-380 refuses to synthesize a placeholder root for an absent partition (404 instead of activating a grain onto a missing schema, pinned by PgOnlyProdShapeTests); grain activation is bounded and always terminal (MessageHubGrain FirstNodeResolutionTimeout 30s, 'no path leaves _hubReadyRaw pending forever', real cause surfaced via GrainActivationFailureRegistry, pinned by PartitionRootActivationTest). #909 additionally made ghost-root repair writes actually land (version floor vs MonotonicWriteGuard, MeshExtensions.cs:2781-2870, pinned by GhostPartitionRootRecoveryTest).

   Remaining (this issue now tracks exactly these):

   1. Create is still not atomic: order is provision → write row → post-creation grant, and a failed grant returns Fail while the row STAYS ('Node persisted but post-creation handler failed', MeshExtensions.cs:693-718) — no compensating delete. The Top-level Space create is not atomic — churn leaves content-less, grant-less ghost roots #638 residue (row present, grant absent) is still producible; only its reporting improved.
   2. Self-heal gaps for exactly that residue: EnsurePartitionBootstrap treats a content-less ghost row as 'root exists' (rootExists = root is not null, :1192) so it never repairs it, and the heal is gated on CheckPermission(Create) (:1208) — a grant-less partition denies precisely the user whose grant went missing, so it self-heals only under System/platform-admin.
   3. A provisioned-but-grant-less partition still surfaces as generic RLS 'access denied' (fast, but not the speaking partition-broken error asked for).
2. rbuergi

   closed this as completedin #942on Aug 8, 2026
3. rbuergi

   added 2 commits that reference this issue on Sep 16, 2026

   Act on two Copilot findings: tag a SYNCHRONOUS handler failure too, a…

   ...

   83de0e6

   Cover all three storage-stable mint sites, not one (Copilot review, #…

   ...

   b7d106f