A pass's credit-error mark ignores a grant seen since the pass started #3

New issue

Open

opened 2026-11-02 18:34:14 +00:00 by jorijnvdgraaf · 0 comments

jorijnvdgraaf commented

2026-11-02 18:34:14 +00:00

Owner

When a pass ends with the credit error, Settle calls Ledger::MarkOut unconditionally. Ledger::Reconcile (1.1.0) records a probe's credit error only when no grant was seen since the probe started (grantSeen), because the reading may predate the grant. A pass has the same race: its request can hit the credit error just before the credits land, and the process can end after another driver's probe has lifted the key. The late mark then holds a freshly granted key out until the next run's probe lifts it again.

A fix records a pass's credit error under Reconcile's rule, against the pass's start, with a test of a mark that arrives after a grant seen since the pass began.

Found by the 1.1.0 push gates.

When a pass ends with the credit error, `Settle` calls `Ledger::MarkOut` unconditionally. `Ledger::Reconcile` (1.1.0) records a probe's credit error only when no grant was seen since the probe started (`grantSeen`), because the reading may predate the grant. A pass has the same race: its request can hit the credit error just before the credits land, and the process can end after another driver's probe has lifted the key. The late mark then holds a freshly granted key out until the next run's probe lifts it again. A fix records a pass's credit error under Reconcile's rule, against the pass's start, with a test of a mark that arrives after a grant seen since the pass began. Found by the 1.1.0 push gates.