Cassette Build Report 043 — One Log Needed One Owner
S16 had a durable operation record and a PAUSED state, but neither was load-bearing until the fixture tested ownership and attempted progress while paused.
Scope note: This report covers S16’s broker ownership and pause-state repair. It concerns one process, one runtime, and one durable operation log; it does not claim a distributed lease service or live source integration.
S16 had a durable log, cancellation across eight phases, and twenty-nine typed failure codes. It also had a PAUSED state that could be removed without making the fixture fail.
The pause result came from Opus 5 Max. The fixture paused one planned clone, checked the returned word PAUSED, resumed it, and checked RUNNING. It did not try to advance while paused. It did not close and reconstruct the broker. It did not pause live work or the other mutable phases. The word existed. The state was not yet part of the proof.
Kimi K3 Max reviewed the same step and found valuable things: a forged published record could not become callable without a store generation, torn and corrupt records refused typed, and a terminal-event mutation degraded to an error rather than a false admission. Kimi also called a forged non-preparation phase inert because it did not create a callable model revision. Sol reopened that judgment. A durable state machine that accepts an impossible phase has already lost its canonical grammar, even if the first illegal record does not publish a model.
The ownership failure was more direct. Two CanonicalBroker objects opened the same operation-log directory and started the same worker. Both callers received the first worker’s result. The durable record retained one terminal operation after two side effects had happened. The log looked singular after the work had become plural.
The repair chooses the boundary Cassette had already declared. One process. One asyncio runtime. One owner for the operation log.
descriptor = -1
try:
descriptor = os.open(self.operation_log, os.O_RDONLY)
fcntl.flock(descriptor, fcntl.LOCK_EX | fcntl.LOCK_NB)
except BlockingIOError:
with suppress(OSError):
os.close(descriptor)
_reject("OVERLOADED", f"broker:{self.operation_log}", "operation-log ownership is already held")
The broker ownership lock is implemented evidence for the repaired boundary. A second broker is refused before it reads, writes, or executes a worker. It does not make Cassette distributed. It enforces the single-owner design the queue already required.
The pause repair is larger in the fixture than in the product. Every mutable phase from EMPTY through EXEC_VERIFIED is cloned, paused, and tested against the next transition. Nothing moves. The broker is closed and rebuilt from the same durable record. Nothing moves again. A separate probe pauses live work, supplies a second worker, closes the broker, reconstructs it, resumes the operation, and completes one replacement worker. Remove either main PAUSED gate and the fixture fails at the behavior that gate owns.
The repair exposed a smaller public-boundary defect. An inactive pause() returned the raw internal record while a pause during live work returned the public operation projection. cancel() had the same split. A client received different fields based on timing. The first focused test failed because it compared those two shapes. The test was right. Both controls now return one public shape in every state.
The comparison between the agents is a record of coverage, not a contest. Opus found the missing mutation. Kimi found store-backed and crash-safe evidence that remained true, then narrowed one anomaly after Sol reproduced it. Sol made ownership, pause, and public result shape executable. Drew refused another vote and asked for the guards to become load-bearing.
The final suite passed 32 of 32 tests in 97.31 seconds, with a clean ledger. Eight disposable mutations failed: the two pause gates, the ownership lock, operation after close, record grammar, terminal-event agreement, and the two public projection paths. S16 now says what one log means, who may own it, and what PAUSED prevents.
The useful state was never the word PAUSED. It was the transition that could not happen while the durable record was paused, even after the process that wrote it had gone away.
