Admission rejection and recovery boundary v1

Experimental local error handling · 5 September 2026

Behavior

An ordinary admission rejection no longer disables the isolated ledger writer. The ledger exposes needs_recovery(), its existing poisoned-state flag, so the owner can distinguish a nonmutating refusal from a potentially uncertain write without matching error strings or assuming an io::ErrorKind identifies policy failures.

The worker includes this flag with its bounded completion. A healthy refusal returns experimental status 0 and permits the next request. A poisoned ledger fences the writer and suppresses the response until explicit shutdown/reopen. Writer timeout and unexpected completion/channel failure remain separate reasons to fence. A late completion never automatically restores service.

False means the handle has no recorded journal uncertainty. It does not establish claim validity, current time, trust, availability, or global durability. Clock and capacity refusals can be nonmutating too. This is a local lifecycle boundary, not a new wire error taxonomy. The public unsigned response format is unchanged.

Evidence

Fourteen real loopback checks pass. An authentic but insufficient-work claim reaches the ledger, receives rejection, writes no journal bytes, and leaves the writer available for a valid admission. Prior replay, gated completion, timeout, exclusive ownership, queue cleanup and clean-recovery checks continue to pass.

Three worker tests inject completion metadata: ordinary refusal remains available, uncertain storage suppresses the response, and a missed deadline fences both rejection and success. These test completion routing, not actual disk faults.

Library tests separately check the recovery flag after a real failed write through a read-only descriptor, before mutation on a time refusal, and after clean reopen in both control and reserved modes. The existing 36-case sync-boundary matrix now asserts the public recovery flag at commit and rollover failures; lost-tail and receipt-safety tests remain in place. No actual stuck fsync or power loss is claimed.

Reproduce and scope

cargo run --locked --offline --features peer-recovery --example admission_isolated
cargo test --locked --offline --features peer-recovery --example admission_isolated
cargo test --locked --offline --features peer-recovery --lib admission
cargo test --locked --offline --features peer-recovery --test admission_wire

The example reports admission-error-boundary-v1. Historical isolated-writer and memory reports remain unchanged; their old conservative rejection behavior and binary measurements describe earlier snapshots. The new report is retained at docs/results/admission-error-boundary-v1.json, with a source/binary manifest.

This change preserves the existing single-owner, one-outstanding-request bounds. Next: compare these refusal/recovery outcomes with the independent driver model, including uncertain completion and retries. Complete transport errors, full-capacity memory measurements, live filesystem stalls and independent review remain open. No production ingress or Fly deployment is enabled.