Raised at crates/baley/src/update/deliver.rs:345 as high by openai, ruled downgraded.
Claim. The candidate is published and directory-synced before the displaced occupant is validated, allowing a conflicting activation to become durable without restoration.
Failure scenario. After activation_decision observes the original managed link, the owner replaces stable with an unmanaged executable X. apply(operations) exchanges the candidate into stable and syncs the parent directory, moving X to the temporary name. If the updater is killed after that sync but before read_link and rollback, stable durably points to the candidate and X remains stranded under the temporary name. Subsequent invocations execute the update even though the displaced occupant should have caused an activation conflict.
Filed by Cadence. Fingerprint f06e40e0252d1e3d over (file, claim).
Raised at crates/baley/src/update/deliver.rs:345 as high by openai, ruled downgraded.
Claim. The candidate is published and directory-synced before the displaced occupant is validated, allowing a conflicting activation to become durable without restoration.
Failure scenario. After activation_decision observes the original managed link, the owner replaces stable with an unmanaged executable X. apply(operations) exchanges the candidate into stable and syncs the parent directory, moving X to the temporary name. If the updater is killed after that sync but before read_link and rollback, stable durably points to the candidate and X remains stranded under the temporary name. Subsequent invocations execute the update even though the displaced occupant should have caused an activation conflict.
Filed by Cadence. Fingerprint
f06e40e0252d1e3dover (file, claim).