fix(runtime): recheck POSIX dispatch identity before commit

[wordingone]

Ember authority binding

goal_id: EMBER-02
workstream_id: EMBER-02A
next_executed_outcome: EMBER-02 first sufficiently pretrained clean-genesis 3B Ember

PR kind

kind:engineering

Linked issue or governing contract

Refs #1344. Follow-up repair for the POSIX verification-token identity race merged in #1684; this does not close the issue.

Exact base SHA

a1cb7e62e0212c59ca41b63cdc24cb5c363f83a4

Exact reviewed head SHA

fbfe2ac4cb885f67d5905b37377a05e0938ddaac

Intended outcome

Require a second POSIX process-identity observation inside the token transaction immediately before event insertion and commit, so process exit, replacement, or identity drift rolls back token consumption and emits no consumption event.

Why this is one coherent PR

One runtime file contains both the transaction-local observation seam and its deterministic rollback regression.

Affected areas

area:training, area:provenance

Affected milestones

EMBER-02 — Three-billion-parameter foundation birth

Implementation summary

• Extract the common atomic token transaction while retaining the Windows live-handle fence.
• On POSIX, observe start-token and executable identity before the transaction and again immediately before event insertion.
• Require the second observation to match the initial observation and the persisted identity already fenced by SQL.
• Refuse observation errors or mismatches before the event and let the transaction roll back consumed_at_ms.

Acceptance-clause mapping

• First matching observation plus second mismatching observation deterministically refuses.
• Refusal leaves consumed_at_ms NULL and publishes zero dispatch_token_consumed events.
• Existing stale-start, foreign-executable, SQL identity-race, and one-shot positive selectors remain green.
• Complete entrypoint inventory, remaining execution classes, live CLI evidence, break-glass receipts, and issue closure remain open.

Local reproduction commands

cargo test --locked --offline --lib dispatch_token_second_process_observation_mismatch_rolls_back_consumption_and_event -- --nocapture
cargo test --locked --offline dispatch_token -- --nocapture
cargo test --locked --offline --test dispatch_manifest -- --nocapture
cargo fmt --check
cargo check --locked --offline --tests
cargo check --locked --offline --tests --target x86_64-pc-windows-msvc
powershell.exe -NoLogo -NoProfile -NonInteractive -File C:\Users\Admin\.codex\headless-python.ps1 -- -B scripts/verify_authority_conservation.py --staged
C:\Program Files\Git\bin\bash.exe tools/repo-guard.sh --base a1cb7e62e0212c59ca41b63cdc24cb5c363f83a4

Automated tests

• Deterministic second-observation rollback regression: RED 0/1, GREEN 1/1.
• All dispatch-token selectors: 5/5 PASS.
• Full dispatch_manifest target: 30/30 PASS.
• Native and Windows-target offline Cargo checks: PASS.
• Format, authority, diff, commit hook, and pre-push guard: PASS.
• Exact scope: one path, +208/-68.

Executed evidence

Source/test/compile evidence only. No model launch, training, checkpoint, evaluation, export result, or issue closure occurred.

Generated receipts and artifacts

• Commit: fbfe2ac4cb885f67d5905b37377a05e0938ddaac
• Base: a1cb7e62e0212c59ca41b63cdc24cb5c363f83a4

Known failures

An optional broad library replay encountered an unrelated existing scratch-path/target ACL failure. All bounded #1344 selectors and required compile gates are green.

Unverified areas

Fresh exact-head independent review and public checks, merge, complete entrypoint inventory, remaining execution classes, live CLI execution, receipted break-glass, and public issue closure.

Claim boundary

POSIX verification-token transaction-local identity repair only. completion_credit=false; closure_credit=false. No model launch, GPU allocation, training, checkpoint, evaluation/export result, milestone completion, or issue closure. NO_NEW_PARALLEL_AUTHORITY.

Review provenance

PR #1684 merged before its POSIX observation-to-commit race finding was repaired. This follow-up carries only the current-master one-file successor and requires exact-head independent review.

Rollback or revert procedure

Revert the squash merge through the normal guarded path. Preserve refusal and dispatch-event evidence; never reinterpret an unconsumed token as successful execution.

Follow-up obligations that remain

Review and merge this repair, then complete inventory and every remaining execution class, run governed live CLI and break-glass evidence, and verify #1344 publicly CLOSED before terminal credit.

[wordingone]

Independent exact-head SOURCE PASS - no P0/P1. Verified base a1cb7e6, head fbfe2ac, one path runtime/ember-lab/src/lib.rs (+208/-68), file SHA-256 056063DA90F2CA21F8D253B05AD77290DDB5D2D70DC4B945B6458AD2F35BBC78. POSIX now observes identity before and inside the transaction immediately before event insertion; start-token/executable must match initial and persisted identity; error/mismatch rolls back consumed_at_ms and event. Windows retains live-handle fence. Independent replay: rollback 1/1 PASS; all token selectors 5/5 PASS. No runtime, completion, merge, or closure credit.

[wordingone]

Parked-until: this hardens a POSIX process-identity race left open when #1344 closed via a different (Python dispatch-token) path — not superseded, not conflicting (still MERGEABLE, CI green as of last run), just not currently in an active goal lane. Parked until either (a) the #898 daemon-resource-guard work touches this same dispatch-token/process-identity fencing surface again, or (b) explicitly reprioritized. Flagged in Leo's 2026-08-13 check-in as open-draft debt; this comment is the disposition.