Durable authority commit is indeterminate; reload is require

Error message

Durable authority commit is indeterminate; reload is required.

What it means

The durable store persists state with an atomic write that can leave the commit outcome unknown (write may or may not have landed). When that happens the store sets an indeterminate flag; assertWritable then refuses every subsequent commit with this error, forcing the caller to reload state from disk rather than risk divergent authority.

Source

Thrown at packages/paperclip-runner/src/control-plane/durable-prp-control-plane.ts:1224

      this.#state = parsed;
    } else {
      this.#state = initialCoreState(identity);
      this.save();
    }
  }

  get state(): StoredCoreState {
    return this.#state;
  }

  save(): void {
    this.assertWritable();
    atomicPrivateWrite(this.path, `${JSON.stringify(this.#state, null, 2)}\n`);
  }

  assertWritable(): void {
    if (this.#writeIndeterminate)
      throw new Error(
        "Durable authority commit is indeterminate; reload is required.",
      );
  }

  /** Persist a complete candidate before publishing any new authority in memory. */
  commit(candidate: StoredCoreState): void {
    this.assertWritable();
    try {
      atomicPrivateWrite(this.path, `${JSON.stringify(candidate, null, 2)}\n`);
      this.#state = candidate;
    } catch (error) {
      // Rename may already have succeeded before directory fsync failed.
      // Never overwrite that possibly durable receipt using stale memory.
      this.#writeIndeterminate = true;
      throw error;
    }
  }
}

View on GitHub (pinned to 01ad858492)

Solutions

Reload the durable state from disk (reconstruct the store from the persisted file) to resolve the indeterminacy, then retry.
Check disk space and filesystem health for the volume holding the state file.
If the on-disk state is corrupt, restore from the last known-good backup of the state file.
Restart the runner/control-plane process with state reconstruction so the indeterminate flag is cleared safely.

Defensive patterns

Strategy: retry

Validate before calling

if (store.isIndeterminate?.()) throw new Error('reload durable state before further commits');

Try / catch

try {
  store.commit(candidate);
} catch (e) {
  if (e.message.includes('indeterminate')) {
    checkDiskSpace(store.path);
    store = reloadStoreFromDisk(store.path);
    store.commit(candidate);
  } else throw e;
}

Prevention

Monitor disk space on the volume hosting the durable state file.
Back up the state file before deployments so recovery is possible after an ambiguous write.
Treat any mid-write crash as requiring a full state reload, never in-memory continuation.

When it happens

Trigger: Any commit after a previous atomic write failed ambiguously (EIO/ENOSPC mid-rename, process crash during fsync/rename), which set #writeIndeterminate; the next commit()/assertWritable call throws.

Common situations: Disk-full during a state write; container killed mid-write then restarted on the same state file; filesystem errors (EIO) on the volume hosting the state path.

Understand the failure class

Background: "failed to write file", "Could not save figure", "Error saving remote file" — file write failed: causes and fixes across languages and libraries — this error's family across 38 libraries.

Related errors

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-09-10). Data as JSON: /api/errors/acc430d25827deca. Report an issue: GitHub.