fix(kernel): adopt only a journal that resume can actually use (#185)

[kjgbot]

Fixes #185 — a regression I introduced in #177.

Two residues, not one

Engine::start creates the journal, appends RunSpawned, then registers. So a crash leaves two different things behind, and #177 only recognised one:

state	resumable?	#177	this PR
killed after RunSpawned — real run, no index entry	yes	adopted ✓	adopted ✓
killed before RunSpawned — empty journal, never a run	no	adopted, then internal error ✗	refused ✓

#177's gate was journal.run_id() == params.run_id. An empty journal still carries a meta row with the run id, so it passed: the file was adopted, registered, and resume then died on

read run spec: SQLite journal failed: Query returned no rows

Before #177 that case returned a clean run_not_found. The change traded a legible refusal for a confusing internal error in the one sub-case it didn't anticipate.

The fix

Adoption now also requires run_spec() to succeed — the honest predicate, because it is exactly what resume calls next. Adopt only what resume can actually use.

How it was found

By the diagnostics from #175 and #176, on run 33982088411. The crash-resume test failed in 63 seconds instead of hanging for 30 minutes, and the dump printed the cause outright:

stderr (114 bytes):
Error: journal_write_failed: read run spec: SQLite journal failed: Query returned no rows

--- journal (0 entries) ---

Zero entries. That is the whole diagnosis, and it came free.

Evidence

A fourth test — run_resume_refuses_a_journal_that_never_recorded_its_run — builds exactly that residue (valid journal, correct run id, no entries) and asserts both the run_not_found refusal and that no registry row is left behind.

The mutation drops the run_spec() requirement, restoring #177's gate exactly. It fails only the new test, while run_resume_adopts_a_real_journal_whose_registry_row_is_missing keeps passing — so this narrows adoption without undoing what #177 fixed. Full transcript with runnable commands and sha256 before/mutated/restored is in the commit message.

The four tests now state the rule together: refuse a file that is not a journal, refuse a journal that is not this run's, refuse a journal that never recorded its run, adopt the one that did.

Kernel workspace: 157 passed, 0 failed, no warnings.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FtQSAcGDta5VH9xiZFT4sR

[coderabbitai]

Warning

Review limit reached

Next included review available in 31 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: 48765bae-9e72-43fb-aa66-8d950b321b86

📥 Commits

Reviewing files that changed from the base of the PR and between 440a899 and 11edaa0.

📒 Files selected for processing (2)

• kernel/relayflowd/src/server.rs
• kernel/relayflowd/src/server/tests.rs

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}