From 7c421832b2594f6932aa35869f083e1843c0fab4 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 27 Aug 2026 19:13:43 +0000
Subject: [PATCH] fix(pm): serve a verify-lock queue whose holds outlast one
 foreground turn

The wait budget cannot be raised: it is spent inside one foreground agent
turn, which the harness kills at ~600s, so a larger number buys an
unreportable SIGTERM rather than a longer wait. What spans several turns is
the slot, and two things stopped it working:

- its ageing bound ran from the ORIGINAL arrival, so a caller queued behind
  two ~19-minute holds lost its place for the offence of the queue being
  long. The age now runs from when the place was last put down, which is the
  question the bound was always asking.
- it was named only in the exit-99 message, one whole budget after the place
  it would have kept was lost. A queueing caller is now told at second zero.

Exclusion, FIFO order, the cap and the budget are unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PfaSTikked61BkcsB5Rn69
---
 scripts/pm/os-verify-lock.sh | 276 ++++++++++++++++++++++++++++++++---
 1 file changed, 254 insertions(+), 22 deletions(-)

diff --git a/scripts/pm/os-verify-lock.sh b/scripts/pm/os-verify-lock.sh
index 23ca638a3c..dc5fe5ea90 100755
--- a/scripts/pm/os-verify-lock.sh
+++ b/scripts/pm/os-verify-lock.sh
@@ -243,6 +243,24 @@ set -uo pipefail
 # single foreground agent call (harness ceiling: 10 minutes). Everything above
 # this is unrepresentable through this entry point — that is the point of the
 # entry point, so it is a constant and not an option.
+#
+# ⛔ THIS IS NOT THE NUMBER TO RAISE, AND THE REASON IS ARITHMETIC RATHER THAN
+# TASTE. It was filed as one (#12538): holds on this lock were measured at 1164s
+# while the budget is 540s, so "raise the budget above the p95 legitimate hold"
+# reads as the obvious repair. It cannot be done. The budget is spent INSIDE one
+# foreground agent turn, and that turn is killed at ~600s by a ceiling nothing in
+# this file can move. A budget of, say, 1200s does not buy 1200s of waiting; it
+# buys a SIGTERM at 600s — no VERDICT line, no ledger record, no NOT MEASURED
+# note, the caller left with the one outcome this whole file exists to prevent
+# (see the bash 3.2 block above: 20 seconds of spinning and ZERO verdicts). The
+# cap at 540s is what keeps the refusal REPORTABLE, with ~60s of headroom for the
+# verdict and the ledger append. Raising it converts an honest exit 99 into an
+# unreportable exit 143.
+#
+# So a wait longer than one turn is not a longer BUDGET. It is a place kept
+# ACROSS turns — the slot mechanism further down, whose ageing bound is the
+# number that actually has to cover a long hold. The card's arithmetic is real;
+# it just indicts SLOT_MAX_AGE_S, not this constant.
 readonly HARD_CAP_S=540
 readonly DEFAULT_WAIT_S=540
 
@@ -275,10 +293,12 @@ HOLDER_FILE="${LOCK_FILE}.holder"
 LEDGER_FILE="${OS_VERIFY_LOCK_LEDGER:-${LOCK_FILE}.ledger}"
 readonly TICKET_MAX_AGE_S=$((HARD_CAP_S + 300))
 
-# How long a PARKED slot keeps the arrival stamp it is holding a place with.
-# Three budgets: long enough that an agent doing lock-free work between
-# attempts still finds its place, short enough that the priority a slot carries
-# over later arrivals is bounded and declared rather than indefinite.
+# How long a PARKED slot keeps the arrival stamp it is holding a place with,
+# measured from when it was LAST RELINQUISHED rather than from the original
+# arrival — see the ageing paragraph in the slots block below for why the clock
+# moved. Long enough that an agent doing lock-free work between attempts still
+# finds its place; short enough that a place nobody is coming back for stops
+# carrying priority over later arrivals.
 readonly SLOT_MAX_AGE_S=$((HARD_CAP_S * 3))
 
 # Past this the ledger stops growing. A record is ~150 bytes, so this is tens
@@ -448,9 +468,18 @@ queue_usable() {
 
 # ticket file: "<pid> <starttime> <arrival-epoch> <label>"
 #
-# A PARKED slot writes pid 0 and starttime 0 -- there is no process behind it,
-# which is the whole point -- so pid 0 is what tells the two kinds apart. It is
-# not a value a real ticket can carry: no waiter here runs as pid 0.
+# A PARKED slot writes pid 0 -- there is no process behind it, which is the
+# whole point -- so pid 0 is what tells the two kinds apart. It is not a value a
+# real ticket can carry: no waiter here runs as pid 0.
+#
+# In a parked record the STARTTIME field carries the relinquish time instead:
+# there is no process, so there is no start time to hold, and the age that
+# decides whether the place is still wanted is measured from there (see the
+# ageing paragraph in the slots block). The field is reused rather than appended
+# because the label is last and must stay last -- a label containing spaces
+# cannot be allowed to displace a field. A 0 there means no relinquish time was
+# recorded (a record written before this, or one whose clock failed), and those
+# age from arrival exactly as they did.
 #
 # Three states, not two, and the third is why this is a classifier rather than
 # the predicate it replaced. `dead` is removed from disk, `active` is queued,
@@ -480,6 +509,18 @@ ticket_state() {
   }
   age=$((now - stamp))
   if [[ "$pid" == 0 ]]; then
+    # A parked place ages from when it was PUT DOWN, not from when it was first
+    # taken. `start` carries that instant for a parked record; a 0 or an
+    # unreadable one falls back to the arrival stamp, which is what every record
+    # written before this did. `since` can only move the age DOWN -- the
+    # relinquish is never earlier than the arrival -- so a clock that went
+    # backwards cannot lengthen a place's life past the arrival-based bound.
+    local since="$stamp"
+    case "$start" in
+      '' | *[!0-9]*) ;;
+      *) ((start > since)) && since="$start" ;;
+    esac
+    age=$((now - since))
     ((age <= SLOT_MAX_AGE_S)) && {
       printf 'parked'
       return 0
@@ -506,6 +547,16 @@ ticket_state() {
     # identity rather than requiring the dying process to have written it. It
     # costs nothing and wedges nothing: parked blocks nobody, and the ageing
     # bound below is the same one every other parked place is held to.
+    #
+    # This shape carries no relinquish time -- the field holds the dead
+    # process's real start time -- so it ages from ARRIVAL, the shorter of the
+    # two windows. Stated rather than fixed, because the direction is the safe
+    # one: such a place expires EARLIER than a politely parked one, never later,
+    # so the worst case is a caller sent to the back, never a line-cut that
+    # outlives its bound. It is also transient in practice -- SIGTERM (what the
+    # foreground ceiling sends) leaves through the trap and parks properly, and
+    # the next resume rewrites the record, so only a slot SIGKILLed on every
+    # turn it ever takes stays in this shape.
     case "${file##*/}" in
       *-s?*)
         ((age <= SLOT_MAX_AGE_S)) && {
@@ -617,13 +668,22 @@ take_ticket() {
 }
 
 # Turn our ticket into a kept place instead of deleting it. Writing pid 0 is
-# what makes it parked; the arrival stamp is preserved verbatim.
+# what makes it parked; the arrival stamp is preserved verbatim, because that
+# stamp IS the place. The relinquish time goes where the starttime was -- a
+# parked record has no process, so it has no start time, and the age that
+# decides whether this place is still wanted runs from here.
+#
+# A clock that will not answer is not a reason to refuse the park: the place is
+# worth more than the freshness of its age. Such a record writes 0 and is aged
+# from arrival, exactly as records written before this mechanism are.
 park_ticket() {
-  local pid0 start0 stamp0 label0
+  local pid0 start0 stamp0 label0 parked_at
   [[ -n "$TICKET" && -f "$TICKET" ]] || return 1
   read -r pid0 start0 stamp0 label0 < "$TICKET" 2> /dev/null || return 1
   case "$stamp0" in '' | *[!0-9]*) return 1 ;; esac
-  printf '0 0 %s %s\n' "$stamp0" "${label0:-?}" > "$TICKET" 2> /dev/null || return 1
+  parked_at="$(now_s 2> /dev/null)" || parked_at=0
+  case "$parked_at" in '' | *[!0-9]*) parked_at=0 ;; esac
+  printf '0 %s %s %s\n' "$parked_at" "$stamp0" "${label0:-?}" > "$TICKET" 2> /dev/null || return 1
   return 0
 }
 
@@ -794,12 +854,44 @@ ledger_append() {
 # while parked it was not waiting. It resumes its place among the callers
 # waiting now, which is the honest meaning of the place it kept.
 #
-# And the priority a slot carries is bounded: the retained arrival stamp ages
-# out at SLOT_MAX_AGE_S from the ORIGINAL arrival, after which the slot is
+# And the priority a slot carries is bounded: past SLOT_MAX_AGE_S the slot is
 # pruned like any dead ticket and the caller starts a fresh one at the back.
 # Without that bound a long-lived slot would cut ahead of newer arrivals
 # indefinitely, which is the same unfairness in the other direction.
 #
+# ⭐ THAT AGE IS MEASURED FROM THE LAST RELINQUISH, NOT FROM THE ORIGINAL
+# ARRIVAL, and the difference is the whole of #12538. Measured against the
+# original-arrival clock: legitimate holds on this lock reach 1164s, and a
+# caller queued behind two of them needs to keep its place for ~40 minutes,
+# while the bound was 27 (3 × the cap). So the caller that did everything right
+# — named a slot, came back every turn, never ran unlocked — was still dropped
+# to the back of the queue by the ageing bound, for the offence of the queue
+# ahead of it being long. That is waiter asymmetry (mechanism 1 at the top of
+# this file) reappearing a third time: obeying the cap remains the losing
+# strategy, now because obedience takes more turns than the place survives.
+#
+# ⚠️ The repair is NOT a bigger constant, and the reason is that the number to
+# size it against does not exist. The ledger cannot price a p95 of legitimate
+# holds: it lives in this container's /tmp and starts empty on every reset, so
+# the population it holds is one shift's worth of whatever ran since — read on
+# 2026-08-27 it was 24 records, max hold 344s, max wait 3s, ZERO queue-timeouts
+# and arrival depth 1 on every single record, i.e. not one contended run of the
+# kind this card is about. Picking `HARD_CAP_S * 6` off the back of four
+# hand-correlated anecdotes would be a constant with the same standing as the
+# one it replaced, and it would be wrong again the first time three long holds
+# queue up instead of two.
+#
+# What the bound is actually FOR is discarding a place nobody is coming back
+# for. So it asks that, and nothing else: the age is the time since the slot
+# was last put down. A caller that keeps returning — the compliant one, the one
+# that spent its turn waiting and came back — keeps its place for as long as it
+# keeps coming back, and its priority is still exactly its arrival stamp, so it
+# is FIFO and not a line-cut. A caller that walks away ages out on the same
+# clock it always did, from the moment it walked away. Nothing here is
+# unbounded: a returning caller can only ever be ahead of arrivals it genuinely
+# preceded, and the tickets ahead of IT can only disappear, so it reaches the
+# head in finite time and its ticket is consumed there.
+#
 # ⛔ None of this touches `flock`. Slots are advisory ordering only, exactly as
 # the ticket queue is; exclusion, the budget and the hard cap are untouched,
 # and a slot cannot acquire, hold or release anything.
@@ -856,6 +948,60 @@ not_measured_note() {
   fi
 }
 
+# ⭐ WHAT A QUEUEING CALLER IS TOLD AT SECOND ZERO, AND WHY IT IS NOT LEFT TO
+# THE EXIT-99 MESSAGE.
+#
+# The slot mechanism above works, and it is the only thing in this file that can
+# serve a wait longer than one foreground turn. Both devs who used it in the
+# shift that produced #12538 found it the same way: from `not_measured_note`,
+# after spending the full 540s budget. That is nine minutes late by
+# construction, and not by a little -- the place a timed-out call loses is
+# EXACTLY the thing a slot would have kept, so learning the name at the moment
+# of loss is learning it after the only moment it was worth anything. A slot
+# named on the next call starts a fresh place at the back.
+#
+# So the disclosure moves to arrival, where it is still actionable, and it is
+# spent only where it buys something: a caller that walks up to a free lock with
+# nobody ahead is told nothing, because it is about to acquire.
+#
+# ⛔ It does NOT refuse, shorten or reshape the wait. Predicting that a wait will
+# not fit and acting on the prediction would be this file's own doctrine
+# inverted -- the filter preflight refuses only what is CERTAINLY worthless and
+# fails open in every other direction, and a queue can drain far faster than any
+# estimate. The full budget is still spent; the caller just gets to decide,
+# before spending it, whether to spend it holding a place.
+announce_arrival() {
+  local depth="$1" ahead=-1 holder contended=0
+  case "$depth" in
+    '' | *[!0-9]*) ;;
+    *) ((depth > 0)) && ahead=$((depth - 1)) ;;
+  esac
+  holder="$(holder_line)"
+  ((ahead > 0)) && contended=1
+  ((contended == 0)) && lock_is_held && contended=1
+  if ((ahead >= 0)); then
+    log "queued: ${ahead} ahead of you · budget ${BUDGET}s · ${holder}"
+  else
+    log "queued: unordered fallback (no ticket) · budget ${BUDGET}s · ${holder}"
+  fi
+  ((contended == 1)) || return 0
+  if [[ -n "$SLOT_SLUG" ]]; then
+    log "  slot '${SLOT_SLUG}' is set — if the budget runs out, this place is KEPT, not lost."
+    return 0
+  fi
+  log "⚠ NO SLOT IS SET and this call is queueing behind someone else."
+  log "⚠   The budget above is capped at ${HARD_CAP_S}s because an acquisition wait has to fit"
+  log "⚠   inside ONE foreground agent turn. It is NOT raisable — and holds on this lock have"
+  log "⚠   been measured at 19 minutes, so a queue can outlast the whole budget honestly."
+  log "⚠   What spans several turns is a SLOT: re-run with OS_VERIFY_LOCK_SLOT=<name> and a"
+  log "⚠   call that gives up PARKS its place instead of returning to the back of the queue"
+  log "⚠   behind everyone who arrived while it was away."
+  log "⚠   ⛔ Set it NOW, not after this call exits: a slot named later starts a NEW place —"
+  log "⚠   it cannot recover the one this call is about to lose."
+  log "⚠   (\`--status\` shows who holds it and who is queued; \`--report\` shows the holds.)"
+  return 0
+}
+
 # Does a count-based backstop have grounds to blame the CLOCK?
 #
 # Both backstops below bound this script by counting something that cannot lie
@@ -1260,15 +1406,25 @@ usage:
 
 There is deliberately no -w / --timeout: the acquisition budget is capped at the
 call site. OS_VERIFY_LOCK_WAIT may LOWER it; a value above the cap is clamped.
-
-KEEPING YOUR PLACE ACROSS CALLS. An acquisition wait is capped so it fits inside
-one foreground agent turn; nothing here can stop that turn's own ceiling from
-counting the wait, so the remedy is not to spend a second turn re-queueing from
-the back. Set OS_VERIFY_LOCK_SLOT=<name> and a call that never acquires PARKS its
-place instead of losing it; the next call with the same name resumes it. A parked
-slot BLOCKS NOBODY -- it can be overtaken while you are away, which is the honest
-meaning of a place kept by someone who was not waiting -- and its priority ages
-out, so it cannot cut the line indefinitely. Being killed mid-wait parks it too.
+⛔ The cap is not a tuning knob and raising it is not the remedy for a long
+queue: the budget is spent inside ONE foreground agent turn, which is killed at
+its own ~600s ceiling, so a larger number buys a kill with no VERDICT line
+instead of a longer wait. A wait longer than one turn is a SLOT, below.
+
+KEEPING YOUR PLACE ACROSS CALLS -- ⭐ SET THIS BEFORE YOU QUEUE, NOT AFTER YOU
+TIME OUT. An acquisition wait is capped so it fits inside one foreground agent
+turn; nothing here can stop that turn's own ceiling from counting the wait, so
+the remedy is not to spend a second turn re-queueing from the back. Set
+OS_VERIFY_LOCK_SLOT=<name> and a call that never acquires PARKS its place instead
+of losing it; the next call with the same name resumes it, keeping its ORIGINAL
+arrival stamp. A parked slot BLOCKS NOBODY -- it can be overtaken while you are
+away, which is the honest meaning of a place kept by someone who was not waiting.
+Its priority is bounded by an age measured from when the place was last PUT DOWN,
+so a caller that keeps coming back keeps its place however long the queue ahead
+of it is, while a place nobody returns for expires and stops cutting the line.
+Being killed mid-wait parks it too. A call that queues behind somebody with no
+slot set is told all this at second zero -- naming it in the timeout message
+alone is naming it one whole budget too late to be worth anything.
 
 EXIT 99 IS NOT A RESULT. It means this call never got a turn: nothing built,
 nothing tested, no gate decided. Record it as NOT MEASURED -- never as a red
@@ -1631,6 +1787,7 @@ mode_run() {
     # into is gone.
     ARRIVAL_DEPTH="$(queue_live | wc -l | tr -d ' ')"
     case "$ARRIVAL_DEPTH" in '' | *[!0-9]*) ARRIVAL_DEPTH=-1 ;; esac
+    announce_arrival "$ARRIVAL_DEPTH"
   else
     ordered=0
     log "⚠ ticket queue at ${QUEUE_DIR} is unusable — falling back to unordered acquisition (the cap and the lock itself are unaffected)."
@@ -1891,6 +2048,20 @@ mode_self_test() {
   # shellcheck disable=SC2064
   trap "rm -rf '$tmp'" EXIT
   local L="${tmp}/lock"
+
+  # ⚠ THE SUITE MUST TEST THE SCRIPT, NOT THE SHELL IT WAS LAUNCHED FROM. Every
+  # knob below changes what a case OBSERVES while leaving it well-formed, and
+  # they are exactly the knobs an agent has in its environment when it runs this
+  # suite from inside a wrapped call. Measured while adding the arrival-notice
+  # cases (#12538): a self-test invoked from a shell carrying
+  # OS_VERIFY_LOCK_SLOT put every child on the has-a-slot branch, so a case
+  # asserting the no-slot notice failed against a script that was behaving
+  # correctly. The failure direction was the lucky one; the same inheritance can
+  # silence a case instead (OS_VERIFY_LOCK_NO_FILTER_CHECK=1 skips the very
+  # check two cases below assert). The cases that want one of these set it
+  # themselves, per command, which still works.
+  unset OS_VERIFY_LOCK_SLOT OS_VERIFY_LOCK_WAIT OS_VERIFY_LOCK_NO_FILTER_CHECK
+
   # Both halves matter: the export reaches the child invocations, and the three
   # globals redirect the helpers called IN THIS PROCESS. Without the second, a
   # self-test would serialise the real fleet behind its own fixtures.
@@ -2180,6 +2351,39 @@ mode_self_test() {
   st_case 'and tells a caller with no slot how to keep its place next time' \
     "$([[ "$ordout" == *OS_VERIFY_LOCK_SLOT* ]] && echo yes || echo no)" yes
 
+  # --- and the same name, at second zero (#12538) ---------------------------
+  #
+  # ⭐ THE ASSERTION IS THE ORDER, NOT THE PRESENCE. The exit-99 message above
+  # already names the slot, and naming it there was measured to be nine minutes
+  # too late: the place a timed-out call loses is precisely what the slot would
+  # have kept, so a caller reading the name in the verdict reads it after the
+  # only moment it was worth anything. Asserting only that the string appears
+  # SOMEWHERE would pass on the version this fix exists to replace. So the pin
+  # is that the first mention precedes the VERDICT line — the same output,
+  # early enough to act on.
+  local firsthint firstverdict
+  firsthint="$(printf '%s\n' "$ordout" | grep -n 'OS_VERIFY_LOCK_SLOT' | head -1 | cut -d: -f1)"
+  firstverdict="$(printf '%s\n' "$ordout" | grep -n 'VERDICT ' | head -1 | cut -d: -f1)"
+  st_case 'and named the slot BEFORE the wait was spent, not only in the verdict' \
+    "$(case "$firsthint" in
+         '' | *[!0-9]*) echo 'NO-ARRIVAL-HINT' ;;
+         *) case "$firstverdict" in
+              '' | *[!0-9]*) echo 'NO-VERDICT-LINE' ;;
+              *) ((firsthint < firstverdict)) && echo yes || echo no ;;
+            esac ;;
+       esac)" yes
+  st_case 'and the arrival line says how many are ahead and what the budget is' \
+    "$([[ "$ordout" == *'ahead of you · budget '* ]] && echo yes || echo no)" yes
+
+  # ⛔ AND IT IS NOT PRINTED WHEN IT WOULD BUY NOTHING. A caller walking up to a
+  # free lock is about to acquire; telling it how to keep a place it is not
+  # about to lose is the noise that gets a warning filtered out, and this one
+  # has to still be read the day it matters.
+  local freeout
+  freeout="$(bash "$SELF" -c true 2>&1)"
+  st_case 'an uncontended call is not told to set a slot' \
+    "$([[ "$freeout" == *OS_VERIFY_LOCK_SLOT* ]] && echo yes || echo no)" no
+
   # --- the ledger -----------------------------------------------------------
   #
   # The two directions that matter, and the second is the one a ledger gets
@@ -2252,6 +2456,16 @@ mode_self_test() {
   read -r _ _ parked_stamp _ < "$sq"/*-sprobe-slot 2> /dev/null || parked_stamp=''
   st_case 'and the parked ticket carries pid 0 — nobody is waiting behind it' \
     "$(awk '{print $1}' "$sq"/*-sprobe-slot 2> /dev/null)" 0
+  # The relinquish time is what the ageing bound is measured from (#12538), so
+  # a park that did not record one would silently restore the arrival clock.
+  local parked_at parked_at_ok=no
+  parked_at="$(awk '{print $2}' "$sq"/*-sprobe-slot 2> /dev/null)"
+  case "$parked_at" in
+    '' | *[!0-9]*) ;;
+    *) ((parked_at > 0 && parked_at >= $(now_s) - 120)) && parked_at_ok=yes ;;
+  esac
+  st_case 'and it records WHEN it was put down, not a start time it does not have' \
+    "$parked_at_ok" yes
 
   # THE SAFETY INVARIANT. Another caller must acquire straight past the parked
   # place while the lock is free — if a parked slot could hold the head, one
@@ -2309,13 +2523,31 @@ mode_self_test() {
   mkdir -p "$sq"
 
   # Ageing: a place older than SLOT_MAX_AGE_S is pruned like any dead ticket,
-  # so the priority it carries is bounded rather than indefinite.
+  # so the priority it carries is bounded rather than indefinite. These two
+  # fixtures carry NO relinquish time (field 2 is 0) — the shape every record
+  # written before #12538 has — and they must still age from arrival.
   mkdir -p "$sq"
   printf '0 0 %s stale-slot\n' "$(($(now_s) - SLOT_MAX_AGE_S - 60))" > "${sq}/00000000000000000009-sstale"
   printf '0 0 %s fresh-slot\n' "$(now_s)" > "${sq}/00000000000000000010-sfresh"
   st_case 'an over-age parked slot is dead' "$(ticket_state "${sq}/00000000000000000009-sstale")" dead
   st_case 'a fresh parked slot is parked, not active and not dead' \
     "$(ticket_state "${sq}/00000000000000000010-sfresh")" parked
+
+  # ⭐ WHICH CLOCK THE BOUND RUNS ON (#12538). The two fixtures below differ ONLY
+  # in the relinquish time, and both have an arrival stamp far past the bound —
+  # so under the arrival clock both are dead and this pair cannot pass. It is
+  # the pair that pins the fix rather than either case alone: a caller that
+  # keeps coming back keeps its place however long the queue ahead of it has
+  # been, and a place nobody has come back for still expires on schedule.
+  printf '0 %s %s returning-slot\n' "$(now_s)" "$(($(now_s) - SLOT_MAX_AGE_S * 4))" \
+    > "${sq}/00000000000000000012-sreturning"
+  printf '0 %s %s abandoned-slot\n' "$(($(now_s) - SLOT_MAX_AGE_S - 60))" "$(($(now_s) - SLOT_MAX_AGE_S * 4))" \
+    > "${sq}/00000000000000000013-sabandoned"
+  st_case 'a slot put down just now keeps its place however old its arrival is' \
+    "$(ticket_state "${sq}/00000000000000000012-sreturning")" parked
+  st_case 'while one nobody came back for still ages out on the same bound' \
+    "$(ticket_state "${sq}/00000000000000000013-sabandoned")" dead
+  rm -f "${sq}/00000000000000000012-sreturning" "${sq}/00000000000000000013-sabandoned"
   queue_live > /dev/null 2>&1
   st_case 'and a queue scan removes the stale one' \
     "$([[ -e "${sq}/00000000000000000009-sstale" ]] && echo yes || echo no)" no