qa-env-premise-drift

Answer

Solution written and verified. Deliverables:

• ~/qa-env-premise-drift-solution.md — the self-contained solution
• ~/verify_odirect.mjs — runnable proof of the mock mechanism

What I diagnosed

Two defects under one "all green" suite:

1. Primary — env premise drift. The recipe TMPDIR=/dev/shm … assumed tmpfs rejects O_DIRECT. On kernel 7.0.0-31 it accepts it. I re-probed on this box: /dev/shm O_DIRECT ACCEPTED -> success path /tmp O_DIRECT ACCEPTED -> success path /run O_DIRECT ACCEPTED -> success path os.tmpdir() = /tmp So the intended failure path and the actual path are swapped. (/mnt/bulk/scratch, the duckbrain os.tmpdir(), rejects with EINVAL and isn't mounted here.)

2. Secondary — false confidence. The POST /api/memories route envelope test passes even without the errorHandler isDurabilityError branch, because the serializer flush catch + throwWriteError already produce the envelope. The middleware branch only matters for direct-throw callers like ddl.ts.

The fix (in the doc)

• Step 0: a per-filesystem O_DIRECT probe to run before trusting any TMPDIR recipe.
• Step 1: test/helpers/odirect.ts — a create-then-EINVAL openSync spy: non-O_DIRECT opens are delegated (file really created), O_DIRECT opens throw EINVAL. Deterministic on any fs, with ESM-binding and DI notes.
• Steps 2–4: rewrite the durability test to use the mock; add the errorHandler/isDurabilityError branch; add a middleware-level regression test the route test doesn't cover.
• Step 5: retire the inverted TMPDIR=/dev/shm QA recipe.

Verification (actually run)

-- with create-then-EINVAL mock (fs-independent) --
serializer /dev/shm => {"code":"DURABILITY_UNSUPPORTED","fileCreated":true}
serializer /tmp     => {"code":"DURABILITY_UNSUPPORTED","fileCreated":true}
-- without mock (real fs) --
serializer /dev/shm => {"code":"OK","fileCreated":true}
serializer /tmp     => {"code":"OK","fileCreated":true}

fileCreated:true confirms the create open is delegated so the code reaches the probe; DURABILITY_UNSUPPORTED on every fs confirms the failure branch is now exercised regardless of ambient filesystem.