Check-in [7c834d64ec]

leaf.Audit reads same-branch both as the draft does (active branch rows, the main-branch setting) and as fossil 2.28's leaf_check does (any branch row, the literal trunk). A row is stale only when both read a child as same-branch, and missing only when neither does, so Verify accepts the tables fossil writes when main-branch is not trunk or a branch tag was cancelled, and a go-built table after main-branch changes.

checkPlink no longer reports a P-card parent missing from plink when the check-in carries a parent tag, which replaces those rows in fossil. check-in: a6a1038b60 user: [email protected] tags: fix/verify-leaf-rule, main, trunk

* feat(cli): checkout-free snapshot, per-path log, cat --at and diff --json

repo snapshot commits one file's bytes onto trunk with no checkout, a no-op when they equal the tip. repo log --path lists the check-ins that changed a path, repo cat --at reads a file as a version holds it, and repo diff --json A B [PATH] diffs two versions. Exit 2 means not found. A snapshot re-checks the check-in stamp inside its write transaction and retries, so concurrent processes build one linear trunk.

Tracked in #451

* test(cli): cover log across a rename; order exit statuses in the docs

Tracked in #451

* fix(db): convert Julian days to the millisecond SQLite gives

log --json printed most check-in times 1ms before their D card: db.julianToTime truncated where SQLite's date.c rounds with (sqlite3_int64)(r*86400000.0+0.5). fsltype.MillisFromJulianDay now does exactly that, JulianToTime and ScanTime use it, and ScanTime rounds the time.Time ncruces hands back to the millisecond as well.

* fix(cli): print usage errors on stderr and pin their exit status 80

The documented status was right for the binary; go run turns it into 1. Usage text went to stdout, so an embedder reading stdout saw it on a failure. The doc now says which status a measurement under go run shows, and a test pins 80 for an unknown flag, a missing flag or argument and an unknown subcommand.

* fix(cli): refuse a snapshot path holding a control byte or a reserved name

validateRepoPath now applies fossil's own rules for a new file name: file_is_simple_pathname in strict form (deck.StrictPathname), no byte below 0x20, and file_is_reserved_name, whose existing port in deck is exported as IsReservedName. Each refusal exits 1 and names the reason.

* fix(cli): diff A B PATH matches fossil's PATH rules

A PATH in neither version printed [] and exited 0; fossil diff --from A --to B fails with "not found". It now exits 2 (not found), and PATH also matches a directory, as fossil's file_dir_match does. The test runs fossil on the same repository as the oracle.

* fix(cli): refuse a snapshot into a repository with no main-branch check-in

When the main branch resolved to nothing, snapshot took the repository for empty and committed a second root beside the existing history. It now treats only a repository with no check-ins as empty, and otherwise fails at exit 1 naming the branch.

* test(cli): compare log across a rename with fossil finfo

The rename test built its history through manifest.Checkin and checked our own idea of the result. It now builds the history with the fossil binary and compares repo log with fossil finfo on the same repository: both stop a name's history at the rename. The doc tells an embedder how to follow a file across renames, and where log differs from finfo.

* fix(db): set busy_timeout before any other pragma on open

The drivers build the DSN's _pragma parameters from a map and run them in that order, so journal_mode or foreign_keys often ran before busy_timeout. An open while another process held a lock then failed at once with "database is locked" instead of waiting: one cause of TestSnapshotConcurrentProcesses failing under -tags test_ncruces.

* fix(cli): hold the write lock from snapshot's read of the tip to its commit

Under -tags test_ncruces, TestSnapshotConcurrentProcesses failed 8 of 20 runs. Besides the open-time lock error fixed in db, a snapshot read the tip's manifest outside any transaction while another process's check-in re-deltaed it, and failed with a hash mismatch. A snapshot now runs in one bound write transaction from the read of the tip to its commit, so no other check-in can land in between; the optimistic retry loop it replaces is gone. check-in: 90345545d3 user: [email protected] tags: main, trunk

Review follow-ups for the leaf audit:

- leaf.Audit reports a row for a rid that no recheck reaches, that is a rid with no branch row in no plink row. A file artifact or a rid with no artifact used to pass. - Verify collects the parents named by every parent tag, as well as by P-cards, whose link plink no longer holds. A parent that an earlier, since replaced, reparent linked is then excused. repostate.7.3.reparent-twice-no-recheck covers that order. - The stale finding excuses a child carrying a parent tag row of any type, since a cancelled reparent leaves its link in place until a rebuild. - Every leaf-table case also runs Verify on the tables fossil(1) derives, per artifact and rebuilt, except where the case records fossil departing from the draft.

Tracked in #433. check-in: 41e39a41fc user: [email protected] tags: fix/verify-leaf-rule, main, trunk