Severity: medium · Confidence: high · Triage: confirmed-bug
APS: KINTEG-011 (plans/modules/06-downstream-integration-surface.aps.md)
Source: clawpatch/codex review of main, 2026-06-26. Deferred from #127 to avoid colliding with in-flight store work (KINTEG-002).
Where
crates/kindling-store/tests/store_integration.rs::close_capsule_validates_summary (~L226) documents the behaviour; the defect is in the close path.
Problem
On a close that fails summary validation, the capsule status update can succeed before SummaryNotFound is returned. The operation is therefore non-atomic: callers receive a failure while the capsule is left closed. That corrupts lifecycle state relative to the reported error and blocks a straightforward retry after the correct summary is created/selected.
Recommendation
Validate that the requested summary exists for the capsule before updating capsule status, or wrap the update + validation in a transaction that rolls back on validation failure. Update the integration test to assert that a failed close leaves the capsule open with closed_at unchanged.
Severity: medium · Confidence: high · Triage: confirmed-bug
APS: KINTEG-011 (
plans/modules/06-downstream-integration-surface.aps.md)Source: clawpatch/codex review of
main, 2026-06-26. Deferred from #127 to avoid colliding with in-flight store work (KINTEG-002).Where
crates/kindling-store/tests/store_integration.rs::close_capsule_validates_summary(~L226) documents the behaviour; the defect is in the close path.Problem
On a close that fails summary validation, the capsule status update can succeed before
SummaryNotFoundis returned. The operation is therefore non-atomic: callers receive a failure while the capsule is left closed. That corrupts lifecycle state relative to the reported error and blocks a straightforward retry after the correct summary is created/selected.Recommendation
Validate that the requested summary exists for the capsule before updating capsule status, or wrap the update + validation in a transaction that rolls back on validation failure. Update the integration test to assert that a failed close leaves the capsule open with
closed_atunchanged.