fix: shutdown admission, recovery identity/order, rollback journal retention, pickup merge

1 files changed, 12 insertions, 1 deletions

diff --git a/internal/persistence/txn.go b/internal/persistence/txn.go
index 7d86cc8..93d186a 100644
--- a/internal/persistence/txn.go
+++ b/internal/persistence/txn.go
@@ -11,6 +11,11 @@ package persistence
 // Transactions do NOT serialize concurrent callers: like single-file saves,
 // they must be executed by an owner that prevents concurrent mutations of
 // the same files (the game's owner goroutine).
+//
+// On apply failure the applied operations are rolled back and the journal is
+// removed. If the ROLLBACK itself fails, the journal is deliberately kept:
+// its before-images are then the only durable record of the pre-transaction
+// state, and the next Recover retries the rollback.
 
 import (
 	"crypto/rand"
@@ -184,7 +189,13 @@ func (t *Transaction) Commit() error {
 
 	if err := t.apply(); err != nil {
 		if rbErr := t.rollback(); rbErr != nil {
-			err = fmt.Errorf("%v; rollback failed: %v", err, rbErr)
+			// The rollback could not restore the before-images: the journal
+			// is now the only durable record of the pre-transaction state.
+			// KEEP it so the next Recover call (or operator repair of the
+			// underlying fault) can retry the rollback instead of silently
+			// losing the before-images forever. See
+			// TestCommitKeepsJournalAfterFailedRollback.
+			return fmt.Errorf("%v; rollback failed (journal kept for recovery: %s): %v", err, journalPath, rbErr)
 		}
 		if rErr := os.Remove(journalPath); rErr != nil && !os.IsNotExist(rErr) {
 			err = fmt.Errorf("%v; journal cleanup failed: %v", err, rErr)