---
title: "Why Bumping mtime in test_session_index.py Drew a High Severity Review"
canonical: https://dxdev.com/blog/seeded-test-mtime-hid-racy-cache-bug/
datePublished: 2026-10-17
---
Four tests failed on the Linux side of our gate, and only there. One of them was the session index's same-size status flip test, and we made it pass by setting the file's mtime forward.

The index is the session manifest index from step 1 of a larger piece of work. Its `refresh()` walks the tree with `os.scandir` instead of `rglob` plus `stat`. On Windows `DirEntry.stat` is free, and the whole 4,780-file tree takes about 25 ms. It deliberately ignores directory mtimes, because an in-place status flip does not change them.

## The green we shipped

The test flips a manifest's status without changing its size. On the Linux box it failed. The commit that greened the gate handled it like the other three failures. The SessionStart budget fixture got a `detect_remote` stub, the presence-ledger sampler test was skipped off win32, and the reboot-cli test asserted `pythonw` only on win32. For the session index test, the commit's own line reads "bumps mtime explicitly (coarse Linux time…", and the text cuts off there in my log.

## What the reviewers saw

Three review runs flagged the same test file, `tests/test_session_index.py`, on that commit:

- manus, rated high: advancing mtime "makes the test pass while hiding the actual cache-correctness bug."
- codex, rated medium: "Forcing a later mtime hides the production bug exposed by Linux: `refresh()` compares only size…"
- codex again, rated medium, about twenty minutes later: "Advancing the mtime hides the production defect exposed by Linux: `refresh()` trusts unchanged `…`"

Both codex lines are cut off in the log, so I can't quote what they said `refresh()` trusts. The fix commit says it plainly: the index trusted same-size, same-mtime metadata for a manifest it had just parsed.

That changed what the Linux failure meant. All three reviews said the failure exposed a production bug and that my mtime bump made the test pass while hiding it. A follow-up commit of review fixes for the same change followed.

## The fix

The fix made the index stop trusting same-size, same-mtime metadata for a freshly parsed manifest. The commit calls this a racy-timestamp reparse.

The regression test goes the other way from the one I had edited. It keeps the metadata unchanged, and it fails without the production fix. The same commit also changed the reboot_cli test to follow production's `pythonw` existence check. `test_session_index` and `test_reboot_cli` pass together, 25 tests in all.