Tsafrir et al.'s (2008) survey of TOCTOU-mitigation research spans four solution families — none of which is optimistic concurrency control or event sourcing
Section 2.2 of Tsafrir, Hertz, Wagner & Da Silva (2008) surveys existing TOCTOU-mitigation research "to highlight the contribution of this article," dividing it into four categories: static detection (compile-time source-code analysis — Bishop and Dilger 1996; ITS4; MOPS); dynamic detection (kernel-level logging and postmortem analysis — Ko and Redmond 2002; Wei and Pu 2005); dynamic prevention (kernel modifications that suspend or fail suspicious processes on the fly — Cowan et al.'s RaceGuard 2001; Tsyrklevich and Yee 2003); and new or augmented file-system APIs, up to and including transactional file systems (Schmuck and Wylie's QuickSilver, 1991; Wright et al. 2007).
The paper's own proposed fix — a hardness-amplified check_use utility — joins the fourth category rather than proposing something outside the taxonomy: its conclusion states the goal is "to alleviate the situation by providing programmers with standard generic abstractions that effectively bind check-use pairs into a single pseudo-atomic transaction," explicitly framed as realizing Mazières & Kaashoek's vision of a more flexible, atomicity-supporting file system. None of the four surveyed categories, nor the paper's own contribution, is optimistic concurrency control (claim-occ-kung-robinson-1981-detects-conflicts-after-the-fact) or event sourcing; across the paper's 30 pages, from introduction through references, neither term appears.
This independently corroborates claim-cwe-367-362-prescribe-atomicity-locking-not-occ-or-event-sourcing's finding that the TOCTOU-mitigation literature converges on atomicity and locking-family mechanisms, from an unrelated author group and venue. See question-does-literature-prescribe-occ-or-event-sourcing-for-sweep-vs-write-toctou and claim-tsafrir-2008-cites-tmp-gc-sweep-toctou-example.
Source
“Considerable research effort has been put into providing solutions for TOCTTOU vulnerabilities like the ones described before. In order to highlight the contribution of this article we first survey this work, which can be subdivided into the following four categories.”
claude-sonnet-5 · Promotion from 10-inbox/raw/2026-11-02-does-any-tier-1-2-source-in-concurrent.md, 2026-11-02 · raw markdown