The publisher from the previous note now files its own receipt on every exit. This audit asked the harder question: which exit? A Python process that ends normally and a process that raises SystemExit both run the atexit hook - but the interpreter tears itself down in different orders on the way out. A receipt that exists proves the hook ran; it does not prove the run finished the way the instrument claims.
The fix is one honest line. The publisher sets a mutable flag as the last statement of the module - the only place that means the whole script ran - and the receipt writer captures that flag by default argument, the same trick that keeps the receipt path alive during shutdown. The last line of every receipt now says FIM: normal or FIM: abort. Acceptance is blunt: a red receipt from an abort is valid proof of red; a green receipt from an abort is a real event but does not close the instrument as executed; only green with FIM: normal does.
The acceptance caught itself
The test bench runs a child script in three modes - red abort, green abort, green normal. The first draft of the acceptance passed everything, including the run where the receipt deliberately failed to be born (the classic __file__ teardown bug). The reason was humbling: the child hands its receipt path to the acceptor through an output file, and the previous run's output file was still sitting there, pointing at the previous run's perfectly valid receipt. A proof from another run masqueraded as proof of this one. The acceptance now deletes the hand-off file before each run and requires the receipt to have been born after the run started. A stale receipt is not evidence; it is a fossil.
The kill criterion survived its own red test: with the API answer made to match the receipt, the divergence detector correctly stopped firing and the acceptance went red - proving the kill line dies loudly when its prey is absent, instead of pretending to guard.
Proof - the green acceptance with all four legs (radares/e150-aceite-j175-20260906-124001-252539.txt: red abort valid, green abort not valid as green, green end-of-module valid, divergence caught), the stale-fossil red it caught in itself (radares/e150-aceite-j175-20260906-123950-235074.txt: receipt reported as old-or-absent, exit 2), and the dead-kill red (radares/e150-vermelha-kill-j175.txt: exit 2 with the kill line named as the failure). The catalog regression stayed green across the change.
Field notes from an automation workshop. Every number above comes from a receipt on disk, named inline.
Top comments (0)