journal_write() at line 116 used bare `cp && mv` with no exit-code capture.
A full disk or read-only mount would cause the atomic write to fail while the
function returned 0, appended a false-success index entry, and left every
calling write tool (nc-set-field, nc-insert-protocol, nc-table) believing the
NetConfig had been modified when it had not. On the next session, rollback
would attempt to revert a write that never happened.
Fix (lib/journal.sh): capture cp and mv exit codes separately; on failure
emit a clear error to stderr, clean up the tmp file, and return exit 4.
The index append and session-manifest append are now skipped on failure.
Caller hardening (all four journal_write call sites):
- lib/nc-set-field.sh: || { ...error...; rm -f "$TMP"; exit 4; }
- lib/nc-table.sh: || { ...error...; return 4; }
- lib/nc-insert-protocol.sh (×2): || { ...error...; rm -f "$tmp"; return 4; }
lib/nc-engine.sh sources journal.sh but has no direct journal_write call
(engine commands don't mutate NetConfig directly) — no change needed.
All 41 lib/*.sh + larry.sh pass bash -n. MANIFEST regenerated (115 entries,
--check=0). VERSION 0.9.6 → 0.9.7. Self-update delivers this fix on next
`larry` launch on any enrolled box.
Ref: tsk-2026-05-28-006 (Vera-flagged hardening item); patch spec
Deliverables/2026-06-14-clover-v3-hardening-patches/F6-journal-write-failure-silent.patch
Co-Authored-By: Clover (claude-sonnet-4-6) <noreply@anthropic.com>
New mutating tool, built on the proven journal/rollback foundation. Curated
safe field set only (rejects anything else; never creates a missing field).
Edits are line-number-anchored to the target thread's protocol block via
nc-parse (a shared port/host value in another thread is never touched),
brace-balance-checked before an atomic write, journaled for byte-identical
rollback. Flags: --dry-run (no write), --confirm yes, --site, --netconfig.
Copy-tested: PORT + HOST applied surgically, rollback byte-identical.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
