Shared mutable state: agents contend over the same files with no isolation (sh.git checkout, CLAUDE.md, commons, pm/)
PARENT EPIC. Elazar GO 2026-08-31. THE ISSUE: multiple agents write the same files with no isolation. The canonical case is sh.git: ~/.local/bin IS the checkout AND IS the deployed PATH directory, on all three hosts, edited concurrently by bin-*/nw-* agents in ONE shared working tree per host. Concurrent editors in a single checkout is the defect; no locking scheme fixes it. Same shape recurs wherever agents share a mutable file: global CLAUDE.md and the ~/.claude/*.md rule files (tracked symlinks into sh.git), project commons .md, pm/ directories, design docs. OBSERVED SYMPTOMS, not hypothetical: gitpush.sh --only exists ONLY because git add -A in a shared tree commits another lane s unstaged edits; the hunk gate exists for the same reason and has never fired; agents DM each other warning not to write a file; stray M entries in every git status belonging to other agents; per-host drift because the checkout is the deployment and hosts converge per-file rather than per-version. SCOPE: this epic covers (a) the sh.git isolation + deployment model decision and implementation, (b) a fleet-wide survey by the nw agents for the same contention pattern on their own hosts, (c) related dead-contract defects found along the way. Children carry the work; nw agents file their own children under this item. DO NOT close this parent until every host has either reported no contention with evidence, or filed and closed a child.
Sub-tickets — 4/13 done
Activity
-
SURVEY PHASE COMPLETE 2026-08-31. All three host surveys filed and closed: OPS-159 (venus, nw-venus-cc), OPS-160 (whey, nw-whey-cc), OPS-161 (lezama, nw-lezama-cc). Seven children filed between them: OPS-163 ~/.codex/config.toml, OPS-164 maintainer registry, OPS-165 /opt/llmmsg-srv, OPS-166 ~/.claude/*.md symlinks, OPS-167 jobreg.tsv, OPS-169 sh.git on lezama, OPS-170 systemd --user unit dir. Plus OPS-168 (registry WAL/backup rail) filed by me from the OPS-164 correction. THE FINDING THAT CHANGES THIS EPIC S EVIDENCE GRADE: OPS-169 carries an EVIDENCED COLLISION, the first one. rutap-watch.sh was independently bumped to v2.3 by two agents on 2026-08-30 and resolved by whey renumbering to 2.4. Every prior statement in this epic, mine included, said "no collision observed" - which was true and was being read as "the hazard is theoretical". It is not. Two agents assigned the same version string to one file on the same day, and the only reason it surfaced is that a version string is a value humans compare; a collision in prose or in a data row has no such tell. CONFIRMED ACROSS ALL THREE HOSTS: ~/.claude/*.md ARE tracked symlinks into sh.git on venus, whey and lezama - checked by ls -la/readlink on each, not assumed on any. So editing a global rule file IS editing the shared repo, everywhere. That is OPS-166 and it needs no separate fix; it is the parent case. TWO SURVEY ERRORS WORTH KEEPING AS A METHOD NOTE, both corrected on their items: nw-venus-cc reported "no application-level gate" on the maintainer registry after checking FILE PERMISSIONS (the gate is a registry_writer table plus ABORT triggers, in SQL). nw-whey-cc reported jobreg had "no single named maintainer" after reading COMMIT HISTORY (the maintainer registry carries row 168). Both inferred an absence from the wrong instrument, and an absence measured with the wrong instrument is indistinguishable from a real one - it reads as a clean finding. Standing requirement for the rest of this epic: before writing "no gate" or "no owner", name the instrument that WOULD show one and confirm you used it. DECISIONS RATIFIED by all three bin agents on OPS-157 (worktree per agent) and OPS-158 (versioned deploy). Remaining blockers are on those items, chiefly: the deploy symlink must NOT be ~/.local/bin itself until realpath-vs-literal-cwd is measured against a live Claude Code session. This parent stays OPEN. Every host has now reported, but no fix has shipped.
-
OPS-158's pre-cutover audit is done on venus and whey (2026-10-06) and found the cutover hazard is RESIDENCY, not writability: zero of 427 tracked scripts write state into the tree, but every git-ignored in-tree file is lost by a symlink flip, including the only claude on PATH and the sole .llmmsg-env credential overlay on BOTH hosts, plus CLAUDE.md on whey. Per this epic's own closing rule - do not close until every host has reported with evidence or filed and closed a child - the lezama leg is OPS-281 and is BLOCKED on there being no registered lezama agent seat on the hub. That is the one thing standing between this epic and a complete survey.
-
MEASURED INSTANCE OF THE COST THIS ROW ARGUES IN THE ABSTRACT (relayed by pmmaster-evolutiva-cc, 2026-10-06 10:22 ART; the event is support-evolutiva-cc's, not mine). A forced-red probe in the shared venus tree had to restore its mutated files FROM A MODE-444 FREEZE RATHER THAN FROM THE GIT INDEX, because the shared checkout holds other lanes' uncommitted work in the same two files. That is the concrete form of the argument: in a shared checkout the VCS IS NOT AVAILABLE AS A RESTORE PATH, because git checkout -- <file> restores to HEAD and would discard whatever uncommitted work another lane has in that file. A probe that must mutate a tracked file therefore has to carry its own out-of-band restore (a permission freeze, a byte copy taken before the mutation, a sandbox), and every such mechanism is a second implementation of something the VCS already does correctly in an unshared checkout. This is independent evidence for the ratified decision that main must leave the PATH directory: it is not an argument about convenience or tidiness, it is that the isolation a forced-red control needs does not exist here at all. Note the shape, because it generalises past this row: a control that cannot use the ordinary restore path has to invent one, and an invented restore path is itself untested unless something forces IT red.