Rohit Ghumare 648363af41 fix(phase-15/16): address CodeRabbit critical and major findings ...

- Checkpoint.save is now atomic: write to <path>.tmp, flush+fsync,
  then os.replace. A crash mid-write no longer leaves the checkpoint
  file truncated, so the retry can still find the prior idempotency
  record.
- run_transfer now short-circuits on EVERY terminal status, not just
  'committed'. Retries after 'verified', 'rolled-back', or
  'aborted-precondition' were previously able to re-execute, which
  broke the exactly-once-by-txid guarantee the lesson is teaching.
- docs/en.md: replace the 'mark-as-done-first' mitigation wording
  with the safer pattern — persist an in-flight intent before the
  side effect and promote to 'committed' only after post-action
  verification succeeds.
- skill-rollback-rehearsal.md: update the idempotency-audit item to
  require explicit execution states
  (pending -> executing -> committed/failed) and reserve-by-key
  ordering, so auditors do not sign off on the
  commit-before-execute pattern.
- Update the inline code comment next to the intent-save so readers
  understand why we persist before the side effect but only verify
  afterward.

2026-04-24 21:43:37 +01:00

..

skill-rollback-rehearsal.md

fix(phase-15/16): address CodeRabbit critical and major findings

2026-04-24 21:43:37 +01:00