fix(manager): reject contradictory reconstruction

Author: vfusco

internal/advancer/advancer_test.go

@@ -2035,12 +2035,6 @@ func (m *MockMachineInstance) OutputsProof(ctx context.Context) (*OutputsProof,
 	}, nil
 }
 
-// Synchronize implements the MachineInstance interface for testing
-func (m *MockMachineInstance) Synchronize(ctx context.Context, repo manager.MachineRepository, batchSize uint64) error {
-	// Not used in advancer tests, but needed to satisfy the interface
-	return nil
-}
-
 // CreateSnapshot implements the MachineInstance interface for testing
 func (m *MockMachineInstance) CreateSnapshot(ctx context.Context, processInputs uint64, path string) error {
 	return m.createSnapshotError

internal/advancer/determinism_test.go

@@ -502,7 +502,7 @@ func newDeterminismHarness(
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
 	factory := newDeterminismRuntimeFactory(start, behaviors...)
 	instance, err := manager.NewMachineInstanceWithFactory(
-		context.Background(), app, processedInputs, logger, false, factory,
+		context.Background(), app, processedInputs, logger, factory,
 	)
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, instance.Close()) })
@@ -623,7 +623,6 @@ func (f *determinismRuntimeFactory) CreateMachineRuntime(
 	ctx context.Context,
 	_ *model.Application,
 	_ *slog.Logger,
-	_ bool,
 ) (machine.Machine, error) {
 	if err := ctx.Err(); err != nil {
 		return nil, err
@@ -743,11 +742,16 @@ func (m *determinismRuntime) Advance(
 		return nil, errors.New("determinism test input must not be empty")
 	}
 
+	// The revert root rides with the advance request and must be the machine's
+	// pre-input root — the instance always passes fork.Hash(). A mismatch is a
+	// harness (or caller) bug, not a determinism scenario.
 	if checkpointHash != m.state.machineHash {
 		m.mu.Unlock()
 		return nil, errors.New("determinism test requires the checkpoint hash to equal the pre-input machine root")
 	}
 	previous := m.state.clone()
+	// Recording the request's own revert root is the first mutation of the
+	// candidate, exactly like the CMIO response.
 	m.state.checkpointHash = checkpointHash
 	status := machine.CompletionStatusAccepted
 	switch {

internal/appstatus/appstatus.go

@@ -30,7 +30,7 @@ type Repository interface {
 // Recovery assumptions — FAILED is safe to re-enable only when:
 //   - The failure was a machine runtime error (not a DB desync).
 //   - The last snapshot is consistent with the database state.
-//   - Synchronize() will correctly replay inputs from the snapshot point.
+//   - replay.Run will correctly verify inputs from the snapshot point.
 //
 // The reason parameter must be a pre-formatted string describing the failure.
 // Returns the database error if the status update fails; returns nil on success.
@@ -134,7 +134,7 @@ func setTerminalStatus(
 	status ApplicationStatus,
 	reason string,
 ) error {
-	reason = truncateReason(reason)
+	reason = NormalizeReason(reason)
 	dbErr := setApplicationStatus(ctx, logger, repo, app, status, reason)
 	reasonErr := errors.New(reason)
 	if dbErr != nil {
@@ -143,9 +143,10 @@ func setTerminalStatus(
 	return reasonErr
 }
 
-// truncateReason truncates a reason string to maxReasonLength to avoid
-// exceeding the database VARCHAR(4096) constraint.
-func truncateReason(reason string) string {
+// NormalizeReason returns the exact reason representation persisted by status
+// helpers. Callers that compare a later readback must normalize before keeping
+// their expected value.
+func NormalizeReason(reason string) string {
 	if len(reason) > maxReasonLength {
 		return reason[:maxReasonLength] + "... (truncated)"
 	}
@@ -160,7 +161,7 @@ func setApplicationStatus(
 	status ApplicationStatus,
 	reason string,
 ) error {
-	reason = truncateReason(reason)
+	reason = NormalizeReason(reason)
 
 	switch status {
 	case ApplicationStatus_Failed:

internal/inspect/hardening_test.go

@@ -106,9 +106,6 @@ func (m *erroringMachine) ProcessedInputs() uint64   { return m.inner.ProcessedI
 func (m *erroringMachine) OutputsProof(ctx context.Context) (*OutputsProof, error) {
 	return m.inner.OutputsProof(ctx)
 }
-func (m *erroringMachine) Synchronize(ctx context.Context, repo manager.MachineRepository, batchSize uint64) error {
-	return m.inner.Synchronize(ctx, repo, batchSize)
-}
 func (m *erroringMachine) CreateSnapshot(ctx context.Context, processedInputs uint64, path string) error {
 	return m.inner.CreateSnapshot(ctx, processedInputs, path)
 }

internal/inspect/inspect_test.go

@@ -461,11 +461,6 @@ func (m *MockMachine) OutputsProof(ctx context.Context) (*OutputsProof, error) {
 	return nil, nil
 }
 
-// Not used in inspect tests, but needed to satisfy the interface
-func (mock *MockMachine) Synchronize(ctx context.Context, repo manager.MachineRepository, batchSize uint64) error {
-	return nil
-}
-
 // Not used in inspect tests, but needed to satisfy the interface
 func (mock *MockMachine) CreateSnapshot(ctx context.Context, processedInputs uint64, path string) error {
 	return nil

internal/manager/errors.go

@@ -0,0 +1,75 @@
+// (c) Cartesi and individual authors (see AUTHORS)
+// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
+
+package manager
+
+import (
+	"errors"
+	"fmt"
+)
+
+var ErrApplicationFailureNotDurable = errors.New("application failure status is not durably confirmed")
+
+// ApplicationFailurePersistenceError means local machine work is fenced but
+// the repository has not confirmed the corresponding FAILED (or a stronger
+// terminal/deleted) application state.
+type ApplicationFailurePersistenceError struct {
+	ApplicationID int64
+	WriteErr      error
+	ReadErr       error
+}
+
+func (e *ApplicationFailurePersistenceError) Error() string {
+	if e.ReadErr != nil {
+		return fmt.Sprintf(
+			"%v: application=%d write_error=%v read_error=%v",
+			ErrApplicationFailureNotDurable, e.ApplicationID, e.WriteErr, e.ReadErr,
+		)
+	}
+	return fmt.Sprintf(
+		"%v: application=%d write_error=%v durable status remains unconfirmed",
+		ErrApplicationFailureNotDurable, e.ApplicationID, e.WriteErr,
+	)
+}
+
+func (e *ApplicationFailurePersistenceError) Unwrap() []error {
+	errList := []error{ErrApplicationFailureNotDurable}
+	if e.WriteErr != nil {
+		errList = append(errList, e.WriteErr)
+	}
+	if e.ReadErr != nil {
+		errList = append(errList, e.ReadErr)
+	}
+	return errList
+}
+
+// IsOnlyApplicationFailurePersistenceErrors reports whether err is one or
+// more application-local durability failures and contains no global failure.
+// It deliberately examines joined top-level errors without descending into a
+// persistence error's write/read causes.
+func IsOnlyApplicationFailurePersistenceErrors(err error) bool {
+	if err == nil {
+		return false
+	}
+	if _, ok := err.(*ApplicationFailurePersistenceError); ok {
+		return true
+	}
+
+	switch wrapped := err.(type) {
+	case interface{ Unwrap() []error }:
+		children := wrapped.Unwrap()
+		if len(children) == 0 {
+			return false
+		}
+		for _, child := range children {
+			if !IsOnlyApplicationFailurePersistenceErrors(child) {
+				return false
+			}
+		}
+		return true
+	case interface{ Unwrap() error }:
+		return IsOnlyApplicationFailurePersistenceErrors(wrapped.Unwrap())
+	default:
+		return false
+	}
+}