A handle opened while an older event sat in the invalidation queue
started with a zero watermark, so the delayed worker rolled its freshly
looked-up entry back. The open now fences the handle with the event
cursor captured before the lookup: the entry it installs reflects every
event applied by then, so anything queued at or before that position is
old news. Captured before, never after, so an event arriving mid-open
cannot inflate the fence past the state the lookup returned — and the
cursor now advances only after the store write, so the pairing is
sound. Handles reusing an existing entry are not fenced, since that
entry did not come from the lookup.
The delivered-event cursor also misses events committed on the filer
but not yet delivered to the subscription, which let a late-arriving
older event roll back a server-side copy or an already-cached remote
download. Those paths now take a barrier from a filer self-ping issued
before the operation: events are stamped with that same clock, so the
returned state is at least as new as anything at or below it. The ping
is a single bounded attempt with the cursor as fallback.
Chris Lu
239cfe64d3