repro(candidate): WAL commit frame is acknowledged as committed without an fsync, so a committed transaction is lost on power loss [wal_commit_requires_fsync-563dc58c]

[aretta-ci]

Auto-generated reproduction CANDIDATE — human review required. This draft was produced by the aretta-conductor Triage "Create repro PR" feature and validated by an automated output gate (red at the violating commit + independence audit; coverage tether INCONCLUSIVE — see the caveat below). The gate reduces — does not eliminate — the risk of a non-faithful reproduction; the requesting human named below is the accountable reviewer. Not a verified reproduction.

⚠ coverage tether inconclusive (instrumentation produced no data); repro RED-verified, bug-site coverage UNCONFIRMED — human review required.

Provenance

• violation id: wal_commit_requires_fsync-563dc58c
• finding key: wal_commit_requires_fsync@core/storage/wal.rs:1601
• DT (canon property): wal_commit_requires_fsync
• conductor session/evidence: https://code.aretta.ai/conductor/dashboard (job repro-8643ada870087d23, cc 1/5a8c775ba76837188577ece6d071d0b9b183989fac27b517e9d7b2ed15027cf6/397abd27c1a9e0b0da179959b5c9eb4650471019852c5e0121131cd98fe693db)
• SUT commit at generation (red leg): 7b6cbaec04e86c0d9ac47819c77444af5054c50a
• tip at generation: 84df3f61cdedb25ecc93da2c7f52cabbc05d13d9 — repro is RED at tip (live bug)
• generated: 2026-07-03T07:59:50.377590156Z
• generated-by: aretta-conductor 0.0.0
• requested-by: dev-operator

Reproduce

cargo test -p core_tester --test integration_tests repros::

Expected vs actual

• expected: A committed transaction survives a power loss because its WAL commit frame is fsync'd to stable storage before the commit is reported durable
• actual: The commit returns success after only pwriting the commit frame (no fsync), so the row is lost after a power loss + reopen
• evidence divergence: divergence:value|expected=true|actual=false

Coverage tether

• ⚠ coverage tether inconclusive (instrumentation produced no data); repro RED-verified, bug-site coverage UNCONFIRMED — human review required.
• ⚠ NO reference oracle: this scenario has no rusqlite/SQLite equivalent to diff against, so the differential leg did not run. The claim rests on the coverage tether + the red-run evidence; the honest-framing floor's residual is load-bearing here — please review the assertion's correctness manually.

Observed red run (at 7b6cbaec04e86c0d9ac47819c77444af5054c50a)

running 1 test
test repros::wal_commit_requires_fsync__563dc58c::wal_commit_requires_fsync__563dc58c ... FAILED

failures:

---- repros::wal_commit_requires_fsync__563dc58c::wal_commit_requires_fsync__563dc58c stdout ----

thread 'repros::wal_commit_requires_fsync__563dc58c::wal_commit_requires_fsync__563dc58c' panicked at tests/integration/repros/wal_commit_requires_fsync__563dc58c.rs:301:5:
assertion `left == right` failed: committed row lost across power loss + reopen: the INSERT was acknowledged as committed but its WAL commit frame was never fsync'd, so it did not reach stable storage (WAL durability violation); expected 1 surviving row, got 0 [repro:wal_commit_requires_fsync-563dc58c] [divergence:value|expected=true|actual=false]
  left: 0
 right: 1
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace


failures:
    repros::wal_commit_requires_fsync__563dc58c::wal_commit_requires_fsync__563dc58c

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 887 filtered out; finished in 0.02s


   Compiling core_tester v0.7.0-pre.4 (/home/ubuntu/conductors/aretta-ai-turso/state/repo-state/worktrees/repo-747430dcccd441a7/7b6cbaec04e86c0d9ac47819c77444af5054c50a/tests)
    Finished `test` profile [unoptimized + debuginfo] target(s) in 23.61s
     Running integration/mod.rs (target/debug/deps/integration_tests-02d1e1ec40d6d6d2)
error: test failed, to rerun pass `-p core_tester --test integration_tests`

ℹ this test carries its own minimal fault-injecting IO implementation over the public IO abstraction (contract-permitted). Reviewers: please confirm the fault expression is environmental only (bug-neutral).