{"record":{"id":"9bdf31f0d9868ef8","repo":"BigPizzaV3/CodexPlusPlus","slug":"runtime-write-verification-failed","errorCode":null,"errorMessage":"Runtime write verification failed","messagePattern":"Runtime write verification failed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codex-plus-core/src/native_browser.rs","lineNumber":454,"sourceCode":"            modified_nanos: modified.subsec_nanos(),\n        };\n        // Durable original and journal precede any runtime write.\n        atomic_write(&journal_path, &serde_json::to_vec(&journal)?)?;\n    }\n    let (journal, original, candidate) = recovery_material(paths, key, contract)?;\n    if current == candidate {\n        return Ok(());\n    }\n    ensure!(\n        current == original && sha(&current) == journal.original_sha,\n        \"Runtime changed outside Codex++; refusing to overwrite\"\n    );\n    ensure!(\n        read_regular(&target, MAX_SERVICE)? == current,\n        \"Concurrent runtime change\"\n    );\n    atomic_write(&target, &candidate)?;\n    ensure!(\n        read_regular(&target, MAX_SERVICE)? == candidate,\n        \"Runtime write verification failed\"\n    );\n    Ok(())\n}\n\nfn recovery_material(\n    paths: &BrowserPaths,\n    key: &str,\n    contract: &RuntimeContract,\n) -> Result<(Journal, Vec<u8>, Vec<u8>)> {\n    ensure!(key_valid(key), \"Invalid recovery key\");\n    let dir = paths.state_root.join(key);\n    let journal: Journal = serde_json::from_slice(&read_regular(&dir.join(\"journal.json\"), 4096)?)?;\n    let original = read_regular(&dir.join(\"original.mjs\"), MAX_SERVICE)?;\n    ensure!(\n        journal.candidate_sha.len() == 64\n            && journal.candidate_sha.bytes().all(|b| b.is_ascii_hexdigit()),","sourceCodeStart":436,"sourceCodeEnd":472,"githubUrl":"https://github.com/BigPizzaV3/CodexPlusPlus/blob/b1ed92e5e4a2d74095d4b8db5af43cef7acba9c6/crates/codex-plus-core/src/native_browser.rs#L436-L472","documentation":"After `atomic_write(&target, &candidate)`, `prepare` reads the target back and verifies it now equals the candidate bytes. A mismatch means the atomic write did not take effect as observed — the filesystem lied, another writer immediately overwrote the file, or the read hit a stale/cached view. Codex++ treats this as a post-write invariant violation and fails rather than reporting success with an unpatched or corrupted runtime.","triggerScenarios":"`reconcile(paths, true)` completes `atomic_write` and the follow-up `read_regular(&target) != candidate`. Causes: an external process overwriting the file right after the write, network/overlay filesystem (network home dirs, some container mounts) with incoherent visibility, or full-disk conditions corrupting the write.","commonSituations":"Codex home on NFS/SMB or inside a VM shared folder; aggressive endpoint-protection rewriting files; another reconcile/codex update racing immediately after the write.","solutions":["Rerun reconcile on a local filesystem; move `CODEX_HOME` off network mounts if applicable.","Check for and stop other processes (codex desktop, sync/AV) that touch the plugin cache, then retry.","Verify disk health/free space (`dmesg`, `df`) if failures repeat.","Capture `read_regular(&target)` contents after the failure to confirm what actually landed before filing a bug."],"exampleFix":"// before\n// CODEX_HOME on NFS mount\nexport CODEX_HOME=/mnt/nfs/home/.codex\n// after\nexport CODEX_HOME=\"$HOME/.codex\"  # local disk, coherent fs semantics","handlingStrategy":"try-catch","validationCode":"// ensure CODEX_HOME is on a local filesystem with coherent write semantics\nlet meta = std::fs::metadata(codex_home)?; // reject network mounts in your launcher\nif is_network_mount(&meta) { bail!(\"CODEX_HOME must be on a local filesystem\"); }","typeGuard":null,"tryCatchPattern":"match reconcile(&paths, true) {\n    Err(e) if e.to_string().contains(\"Runtime write verification failed\") => {\n        // inspect what actually landed, check for external writers / fs issues\n        let landed = std::fs::read(runtime_root.join(&key).join(\"service.mjs\"))?;\n        eprintln!(\"write not observed; {} bytes landed\", landed.len());\n        // move CODEX_HOME to local disk or quiesce writers, then retry\n    }\n    other => other?,\n}","preventionTips":["Keep CODEX_HOME on local disk, not NFS/SMB/VM shared folders","Exclude plugin cache from endpoint-protection rewrite rules","Check disk health/free space if failures repeat","Only one writer at a time for the plugin cache"],"tags":["file-write","filesystem","verification"],"backgroundTag":"file-write-failed","analyzedSha":"b1ed92e5e4a2d74095d4b8db5af43cef7acba9c6","analyzedAt":"2026-09-19T23:35:21.129Z","contentChangedAt":"2026-09-19T23:35:21.129Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}