Artifact a51c31a6c7b2ca823a2846098961abc75d127f625fa5e3e4e9cd83a4096ffe14:
- File
internal/fsltype/fsltype.go
— part of check-in
[168e20fc91]
at
2026-07-19 16:30:58
on branch trunk
— fix: make Timeline pagination cursor an exact total order (#62)
* fix: make Timeline pagination cursor an exact total order
#54 (merged as 95cbbb7) split Repo.Timeline into a repository-wide enumeration and Repo.Ancestry, the original first-parent walk under an honest name. Its pagination cursor predicate used a tolerance window around the caller-supplied Before/After pair to work around a lossy julian<->time.Time round trip:
mtime < (C - eps) OR (mtime <= (C + eps) AND rid < After)
This reintroduces exactly the defect the composite cursor existed to prevent, and makes it worse: rows within eps of the boundary that are not real ties get filtered by rid instead of tie-broken by it, which can skip a row, duplicate another, or fail to advance the cursor at all — unlike canonical fossil's own bare-timestamp slop, which repeats rows but still advances. A pagination test using only exact-tie and one-hour-apart fixtures could not exercise the 0 < delta < eps range where the defect lives, so it stayed green.
Fix: make the predicate an exact total order, with rid as a true tie-break only at exact mtime equality:
mtime < C OR (mtime = C AND rid < After)
and stop deriving C from a time.Time altogether. TimelineOpts.After is now an opaque Cursor (internal/fsltype.Cursor, re-exported as libfossil.Cursor): obtained only from a LogEntry the library already produced, carrying the exact float64 mtime read off that row rather than one reconstructed from a rounded timestamp. A cursor built from parts can silently drift from the row it claims to follow; a cursor that can only ever be handed back cannot.
That exactness depends on the row's scanned mtime being faithful to begin with, which surfaced a second bug: under the ncruces/WASM sqlite driver, event.mtime scans as a time.Time via the driver's own internal REAL conversion, carrying ~13us of noise that db.ScanJulianDay's time.Time branch then truncated (via UnixMilli()) into a full missed millisecond — independent of and in addition to the JulianToTime truncation bug #54 already fixed on the read-back side. Fixed db.timeToJulian to round to the nearest millisecond, the same class of fix, at the point where the driver-specific noise actually enters.
Also tightened the regression coverage: - Pagination tests now use a fixed loop bound of exactly ceil(n/pageSize) pages rather than an open "while non-empty" loop, so a non-advancing cursor fails the test immediately instead of hanging it. - Added a sub-millisecond-boundary fixture (events 3ms apart, well inside the old epsilon window) with rid order deliberately decoupled from mtime order — a monotonic fixture cannot expose this class of bug, since rid and mtime need not move together in general (backdated commits, imports). - TestJulianRoundTrip now asserts exact equality for values originating from TimeToJulian instead of a *1ms tolerance, which would have passed under both the old truncating JulianToTime and the current rounding one and so was not a regression guard for that fix.
No change to Ancestry, event-type filtering, NULL tolerance, or either loop bound; all were already correct.
* fix: assert pagination termination; mark Cursor change breaking
Both pagination tests (the pre-existing ones and the sub-millisecond regression) ran exactly ceil(n/pageSize) pages and asserted each event appeared once, but neither ever called Timeline one more time to confirm the next page comes back empty. The headline symptom of the epsilon-cursor defect these tests exist to catch was non-termination — a caller paginating until empty never stops — and that specific failure mode was going unguarded: a cursor that enumerates every row correctly but never signals exhaustion would have passed all four tests as they stood.
Added one more Timeline call after the last expected page in all four tests, asserting it returns zero entries. Verified this is not vacuous: reverted the tie-break to <= (non-strict) and confirmed the existing per-event count checks catch it; separately, made Timeline phantom-return one row only on an already-exhausted call (isolated from the real per-page counts, which stayed correct in that experiment) and confirmed only the new final-page assertion fails — proving it exercises a real, non-redundant path, not one already covered by the count checks. Both experiments reverted before commit.
Also corrected the CHANGELOG bullet describing the Cursor redesign: it described the new Cursor type but never stated that TimelineOpts.Before (time.Time) and TimelineOpts.After (FslID) were deleted outright, not deprecated. A reader diffing releases would have read it as an addition rather than a second compile-breaking change on top of #54. (user: [email protected], size: 4395) [annotate] [blame] [check-ins using]
// Package fsltype defines shared types used across internal packages. // These are re-exported by the root libfossil package. package fsltype import ( "math" "time" ) // FslID is a row-id in the blob table (content-addressed artifacts). type FslID int64 // FslSize represents a blob size; negative values indicate phantom blobs. type FslSize int64 const ( // PhantomSize is the sentinel size for phantom (not-yet-received) blobs. PhantomSize FslSize = -1 // FossilApplicationID is the SQLite application_id for Fossil repositories. FossilApplicationID int32 = 252006673 ) // EventKind is the type discriminator on the event table's newest-first // timeline: one of the single-letter codes fossil assigns per row (see // src/schema.c:303-312). The zero value ("") means "all kinds" — the // canonical default a bare `fossil timeline` uses when no -t/--type is // given (src/timeline.c:timeline_cmd(), guarded by `zType && zType[0]!='a'`). type EventKind string const ( // EventKindCheckin is a check-in ('ci'). EventKindCheckin EventKind = "ci" // EventKindTechnote is a technote / event artifact ('e'). EventKindTechnote EventKind = "e" // EventKindForum is a forum post ('f'). EventKindForum EventKind = "f" // EventKindTag is a tag/control artifact ('g'). EventKindTag EventKind = "g" // EventKindTicket is a ticket change ('t'). EventKindTicket EventKind = "t" // EventKindWiki is a wiki page edit ('w'). EventKindWiki EventKind = "w" ) // Valid reports whether k is the zero value ("all kinds") or one of the // six recognized event.type codes. func (k EventKind) Valid() bool { switch k { case "", EventKindCheckin, EventKindTechnote, EventKindForum, EventKindTag, EventKindTicket, EventKindWiki: return true default: return false } } const julianEpoch = 2440587.5 // TimeToJulian converts a time.Time to a Fossil Julian day number. func TimeToJulian(t time.Time) float64 { return julianEpoch + float64(t.UTC().UnixMilli())/(86400.0*1000.0) } // JulianToTime converts a Fossil Julian day number to time.Time. // // Rounds to the nearest millisecond rather than truncating: a julian value // produced by TimeToJulian for an exact millisecond carries float64 error // on the order of 1e-10 days, which a plain int64() truncation can turn // into a full millisecond of drift when that error lands the value just // below the true integer. Rounding makes the pair a true round trip // (TimeToJulian(JulianToTime(m)) == m) for any m that itself came from // TimeToJulian — the property the Timeline enumeration's composite // (mtime, rid) pagination cursor depends on. func JulianToTime(j float64) time.Time { millis := int64(math.Round((j - julianEpoch) * 86400.0 * 1000.0)) return time.UnixMilli(millis).UTC() } // Cursor is an opaque pagination token for a Timeline enumeration. Obtain // one from a returned LogEntry's Cursor field and hand it back as the next // page's cursor to resume immediately after that entry, in the same // (mtime DESC, rid DESC) order Timeline itself produces. The zero Cursor // (Valid() == false) means "start from the newest event". // // The julian/rid pair is deliberately unexported. A cursor built from // parts — e.g. re-deriving mtime by round-tripping a LogEntry.Time back // through TimeToJulian — is not guaranteed to equal the row's actual // stored mtime bit-for-bit, which silently reintroduces skipped or // duplicated rows at a page boundary (the exact defect this type exists // to make impossible to construct). Only NewCursor, called by Timeline's // own row-scanning code with the float64 read directly off the row, may // produce a valid one. type Cursor struct { julian float64 rid FslID valid bool } // NewCursor builds a Cursor from a row's exact scanned mtime and rid. // Callers outside this package's Timeline implementation should not need // this — obtain a Cursor from a LogEntry instead. func NewCursor(julian float64, rid FslID) Cursor { return Cursor{julian: julian, rid: rid, valid: true} } // Julian returns the cursor's julian-day mtime component. func (c Cursor) Julian() float64 { return c.julian } // RID returns the cursor's rid component. func (c Cursor) RID() FslID { return c.rid } // Valid reports whether c was produced by NewCursor (as opposed to being // a zero-value Cursor{}, which means "no cursor"). func (c Cursor) Valid() bool { return c.valid }