Timeline

feat: sub-manifest trees and sparse cones (draft-fossil-submanifests-00, draft-fossil-sparse-cone-00) check-in: 7244496a09 user: [email protected] tags: main, trunk

StartServer kills the server's process group and reaps the leader, but fossil server forks a child per connection, and SIGKILL reaches that child asynchronously. On a loaded machine the child could still finish a write after Wait returned, and t.TempDir's RemoveAll failed with "directory not empty" (TestCloneFromRealFossilUncompressedReply, load average ~20). This is the race #352 narrowed; cleanup now also waits, for at most five seconds, until the group has no member left. leaf check-in: f1b6155c8f user: [email protected] tags: feat/submanifest-reader, main, trunk

Five fixes the three-tool round trip and the fossil-scm.org comparison surfaced: an uncovered clone is refused with the push card first, repo status reports the checkout's changes, repo clone remembers last-sync-url, repo verify reports damage, transit phantoms and elision, and adding a directory adds the files beneath it. check-in: b3c5ad7bca user: [email protected] tags: feat/submanifest-reader, main, trunk

TestScenarioClusterConvergence calls content.GenerateClusters once the simulation is over, to check the API on a repository of 500 blobs. Buggify was still armed, so at hostile seeds 11 and 23 a write-path site corrupted a cluster artifact, blob.Store's round-trip check refused it, and the test failed on the refusal. That refusal is the safeguard working. The call now runs with injection suspended, as the invariant checks and fixtures do. check-in: 0be3dddeae user: [email protected] tags: feat/submanifest-reader, main, trunk

Repo.Verify expanded every non-phantom blob on its own with content.Verify. Each expansion re-applies the blob's whole delta chain, so the cost grows with the square of chain length. On a clone of fossil-scm.org's repository (67,894 blobs, chains averaging 532 deltas and reaching 2,546) repo verify took 49 minutes of CPU on both main and this branch, against six and a half minutes for fossil test-integrity.

content.ExpandAll already walks the delta forest from its roots and applies each delta once, binding every result to its name; internal/verify uses it. Verify now goes through it, with the same blob selection (size >= 0), and names the failing rid in its error. The same clone verifies in 19 seconds. check-in: 6f269e32a9 user: [email protected] tags: feat/submanifest-reader, main, trunk

The simulator arms Buggify when it is built, and the scenarios seed their fixtures after that. Two setups dropped blob.Store's error, so a store the injection failed left an empty UUID, and TestScenarioAuthRestrictedCaps panicked in blob.Exists's precondition when it asserted on it. The seed sweep hit this at adversarial seeds 5 and 8.

seedTx suspends injection for the fixture transaction and fails the test if it does not commit. Every unchecked setup transaction in the package now goes through it. check-in: c796b51895 user: [email protected] tags: feat/submanifest-reader, main, trunk

Manage stored a named directory, "." included, as a tracked file, and the next commit failed reading it. A named directory now expands through the checkout's bounded, cone-aware walk to the files beneath it, skipping paths with a dot component as fossil's add does without --dotfiles; a file named explicitly is kept as given. An uncovered path is refused as such before its absence on disk is reported. check-in: 9e28f473cc user: [email protected] tags: feat/submanifest-reader, main, trunk

repo verify hashed the held blobs and printed a fixed line. It now runs the full verifier the library uses for rebuild, prints each issue, and reports transit phantoms apart from elided artifacts, as sparse-cone 5.2 requires of a verification operation: a store complete within its cone verifies healthy and shows its elided count. check-in: 168062ca33 user: [email protected] tags: feat/submanifest-reader, main, trunk

go-libfossil read last-sync-url as the default peer for repo cone store, widening and required-content recovery, but nothing wrote it, so only a repository fossil had cloned had one. repo clone now stores its source as fossil clone does, with any user name and without the password. check-in: caf59be3b2 user: [email protected] tags: feat/submanifest-reader, main, trunk

Run from inside a checkout with the default --dir ".", repo status reported every tracked file MISSING: filepath.WalkDir's root entry is named ".", and the hidden-directory rule skipped it, and with it the whole tree. The command also compared the disk with tip rather than the checked-out version, so a checkout of an older version read as edited.

The command now opens the checkout and prints Checkout.Status, which classifies changes against the checkout's version as fossil's changes command does, cone included, with fossil's labels. Untracked files are no longer listed; fossil status leaves those to fossil extras. check-in: ea23bc8a41 user: [email protected] tags: feat/submanifest-reader, main, trunk

A sparse store that does not cover a clone (sparse-cone 5.3) answered with the error card alone. fossil 2.28's clone client reads a first round without a push card as an empty, finished clone: it exited 0 and left a repository with no project code and no artifacts.

The refusal now goes through refuseClone, the path page_xfer's refusal of an unauthorized clone already took: the reply is reset, the push card naming the repository goes ahead of the error, and no later card is read. fossil then aborts with the refusal and leaves no file. go-libfossil's client, given the codes, re-asks once and stops at the second refusal, as fossil's does. The origin-refusal case now runs fossil clone against the refusing store. check-in: fb6c1d71a1 user: [email protected] tags: feat/submanifest-reader, main, trunk

The safety checks ran while simio's Buggify was armed, so the read-path sites in blob decompression and content expansion truncated or flipped the bytes each check expanded. Every seed at the adversarial and hostile levels then reported a blob-integrity violation that was never persisted; CI runs the normal level only, so nothing caught it.

simio.SuspendBuggify switches injection off and returns a resume that restores the previous state with its random stream intact, so a check mid-run does not change the run's later choices. Every exported check in dst/invariants.go suspends for its duration. A guard test arms Buggify over a clean repository and fails without the change.

Also records in the CHANGELOG that ExtractOpts and RepoOpenCmd are no longer comparable. check-in: dfdf391349 user: [email protected] tags: feat/submanifest-reader, main, trunk

zit #262 settled the pull-inventory cost in the draft: a dense inventory can cost a requester the out-of-cone blobs of check-ins announced in the same inventory, since those names stay transit phantoms until a held manifest classifies them, and the filtering of 6.3 elides them on arrival. That is what the requester here does, so SC-6.2-4 closes. Its case now checks both halves: a blob announced with its check-in is never held, and one announced after it is never requested. check-in: 07d79d60eb user: [email protected] tags: feat/submanifest-reader, main, trunk

The draft now settles zit #257 to #260, so the four rows that waited on it close against code:

- Compaction and local filtering keep every manifest and sub-manifest node, interiors included (5.4, 6.3). RetainProvenance previously let an outside interior whose children were all held leaves go; the draft now requires it held, since it is the range proof that reaches the leaf. - A server answering a cone request acknowledges the reply with pragma cone-served in its leading pragma run (6.3). This server applies a request's whole cone or refuses it, and a refusal resets the reply, so the pragma is never sent for a refused or dense reply. SyncResult and CloneResult report ConeServed beside Elided, now public too. - An empty cone is refused (3.2); a new row and case pin it, locally and over the wire. - The per-round bound covers the tree walk only (6.2). A new row tests that a requester does not act on a dense inventory. It stays partial: an out-of-cone blob announced in the same reply as its check-in cannot be classified yet and is fetched, then filtered; zit #262 asks the draft to account for that cost. check-in: b5a64230b3 user: [email protected] tags: feat/submanifest-reader, main, trunk

A sparse clone sends the spine, in-cone nodes and in-cone blobs of draft 6.2; a held blob no F card names is none of these, so it is not sent, though zit's keep set holds it. check-in: 4529a3f71c user: [email protected] tags: feat/submanifest-reader, main, trunk

The per-round walk serves a cone clone, and nothing but tests reached the prepared index or the service that built it, so both go with their successor index. The whole-store reference loader stays for the pull inventory, compaction, verification and crosslink, and keeps its budget tests. The shun and private gates the prepared tests covered are now checked against the walk. check-in: ef6efa9f1e user: [email protected] tags: feat/submanifest-reader, main, trunk

A sparse walk now sends one clone-cap cookie per round naming the row the next round starts at, with a part-walked check-in's progress. A request that returns to that check-in without echoing its progress comes from a client that drops it; the round steps past the row instead of resending the same batch forever, and the next pull fetches what the walk owed by name. A gimme in a cone request is answered densely, since the requester names it (6.4). The SC-6.2-1 note records the pull inventory's whole-store read, which matches zit's. check-in: 6766dd6cba user: [email protected] tags: feat/submanifest-reader, main, trunk

Revert wrote a restored file with vfile's bits, which a pending merge may have changed, and left them in vfile. Fossil's revert writes the file with the reverted-to version's permission and records it in vfile.isexe and islink, so reverting a file whose only change is a merged executable bit takes the bit back off. versionPaths now carries each file's permission. check-in: da5d6546bb user: [email protected] tags: feat/submanifest-reader, main, trunk

Apply now does what fossil's stash_apply does when a stashed file changed since the stash: it merges the stashed change (pivot: the stash baseline) onto the file on disk with merge_3way, writing fossil's conflict markers and NAME-baseline/-original/-merge on conflict, an empty file for binary content, and reporting each conflict. Previously the stashed bytes were restored verbatim, losing the current change.

Save reverts a file with a pending merge to the checked-out version's executable and symlink bits, and records them in vfile, as fossil's revert does; the stash keeps the merged bits and the pop restores them. checkout.VersionPaths becomes VersionPerms to supply those bits.

The sparse stash-record-only conformance case now expects fossil's result: a file the merge took unchanged keeps the checked-out content after a stash round trip. check-in: 04e3ea8301 user: [email protected] tags: feat/submanifest-reader, main, trunk

Committing deltifies each manifest against its successor, so the first check-in's chain puts later manifests on the wire before their rows. A sparse round skipped those rows as already sent and never walked them, leaving their in-cone files to a later pull. The row is now walked without being sent again. Walk-only clones in the new cases hold no transit phantoms. check-in: 6791486470 user: [email protected] tags: feat/submanifest-reader, main, trunk

A clone round now reads and walks only its batch. What remains of the MUST is a cone-scoped pull, which still classifies the whole held store to filter its igot inventory and gimme answers. The walk also carries its request context explicitly. check-in: cbc0f9a21e user: [email protected] tags: feat/submanifest-reader, main, trunk

A cone-scoped clone no longer classifies the whole held store before its first round. Each round reads only the rows it reaches: structural artifacts go out at their row, and a check-in's row walks its tree, descending only nodes whose key range meets the cone and that its primary parent's tree does not carry over the same range, then sends the in-cone nodes and blobs that walk reaches. Content and sub-manifest rows wait for those walks and are charged as excluded rows are, so a round's work tracks its batch. A check-in whose walk outgrows a round resumes in the next one from progress kept in the clone-cap cookie. Delta bases the round did not reach are served in full form. The walk keeps the depth and visited-node bounds per request.

A round spent wholly inside an excluded run sends nothing yet advances its cursor; a coned clone now continues on that progress instead of reporting that the server stopped sending.

HandleEnd reports the artifacts a cone request classified. check-in: 2909f2a676 user: [email protected] tags: feat/submanifest-reader, main, trunk

Save no longer refuses while a merge is pending. As fossil's stash save, it stashes each changed file against the content last written for it (mrid) and reverts only the stashed files, so vmerge is kept and the next commit records the merge parent. A file the merge added is not in the checked-out version, so its revert deletes it.

Apply now fails before writing anything when a stashed modified file is missing from disk, as fossil's pop fails with "no such file" and rolls back; this is what a merge-added file meets after the save.

In a sparse checkout the record-only merge outside the cone is left pending and unmaterialized, and the in-cone files round-trip. check-in: c314e928f8 user: [email protected] tags: feat/submanifest-reader, main, trunk

In the linked crash state both marker names are one file, and SQLite on Linux warns about the multiple links on stderr while fossil lists the record normally. CombinedOutput folded the warning into the file list. check-in: 83f574dc8f user: [email protected] tags: feat/submanifest-reader, main, trunk

Reverting a merge's out-of-cone changes by name, and with no names, leaves the record exactly where fossil's revert leaves the dense analog, without materializing anything. On a sparse checkout stash refuses a pending merge with the dense checkout's refusal, round-trips an in-cone edit as fossil does, and refuses to apply an out-of-cone file, naming the cone and keeping the entry. Clears the SC-4.4-1 scope note. check-in: 902108ace9 user: [email protected] tags: feat/submanifest-reader, main, trunk

A crash between moveMarker's link and unlink left one checkout database under both the native and the private name, which discovery refused, so the checkout could not be opened again. moveMarker now records its target name in the database before linking, and Open completes the move to that name. A still-running transition keeps the same name, so an Open racing it converges instead of removing both names, and moveMarker treats an old name already removed as done.

Crash injection at every step of narrowing, widening and legacy migration reopens as the old or new state with files matching the cone; stock fossil either refuses the directory or lists the dense record, before and after recovery. Clears the SC-4.1-2 scope note. check-in: bb9805a794 user: [email protected] tags: feat/submanifest-reader, main, trunk

# Conflicts: # cli/repo_cone.go # conformance/requirements/sparse-cone.tsv # conformance/sparsesync_test.go check-in: afd72285e5 user: [email protected] tags: feat/submanifest-reader, main, trunk

Section 5.1 permits holding out-of-cone nodes while 5.4 and 6.3 read as dropping or eliding them; zit holds them and so do we. The notes keep the rows PARTIAL until the draft says which sentence governs. check-in: 8ea7bd1ec4 user: [email protected] tags: feat/submanifest-reader, main, trunk

(cherry picked from commit 1e7b5f246ef9f5af5b366140eb03e7a80227f9bb) check-in: 42a5ef6dd7 user: [email protected] tags: feat/submanifest-reader, main, trunk

Repo.SetStoreConeContext replaces the store cone and pulls newly covered elided artifacts from an explicit peer through ordinary cone-scoped sync; with no peer it refuses naming the elided count, and a cancelled context refuses before any request, both leaving policy unchanged. repo cone store shows or replaces the store cone, defaulting the peer to last-sync-url. Closes SC-6.4-1 and SC-6.4-2. check-in: 08efefff20 user: [email protected] tags: feat/submanifest-reader, main, trunk

An aware clone and pull hold exactly the spines, in-cone nodes and in-cone blobs and never request or receive the remainder. Against a cone-ignorant server the requester elides exactly the blobs every F card names out of the cone and keeps every structural artifact, as zit does. Expected sets come from the origin's decks. check-in: af86aff844 user: [email protected] tags: feat/submanifest-reader, main, trunk

Extract now runs fossil's repo-cksum check after materializing: a present R card is compared with the aggregate over every file the manifest names, read from the store, so a sparse checkout over a dense store reaches the same verdict as a dense one, and a sparse store skips the check. Like fossil, a disagreement is a warning delivered through ExtractOpts.Warn and never fails the extract; repo-cksum off disables it. The conformance case builds its repository with fossil and checks fossil warns exactly where go-libfossil does. Clears the SC-4.3-4 scope note. check-in: 318f46de9e user: [email protected] tags: feat/submanifest-reader, main, trunk

A sparse store refuses a clone its cone does not cover unless the boolean partial-mirror repository setting is on, read as fossil reads a boolean setting. It reaches HandleSync, XferHandler, ServeHTTP and repo serve alike; libfossil.SettingPartialMirror names it. Closes SC-5.3-2. check-in: 6012d82bd6 user: [email protected] tags: feat/submanifest-reader, main, trunk

The public entry point refuses a dense store, as zit's pack --drop-elided does, and drops exactly the blobs that only out-of-cone F cards name. The test computes that set from the held artifacts, then verifies the store and recovers every dropped payload by widening through SetConeContext. check-in: 774f579bfa user: [email protected] tags: feat/submanifest-reader, main, trunk

A cone-excluded row is charged at its expanded size plus card overhead, so a round over a long excluded run stops where a dense batch would and the cursor resumes it, instead of walking the whole run in one round. SC-6.2-1 stays partial: ordinary keep-set discovery still reads the whole store. check-in: 1da7f0f002 user: [email protected] tags: feat/submanifest-reader, main, trunk

Many check-ins sharing one wide sub-manifest cross the 1<<20 visit bound at depth two; 1023 roots are served and 1024 are refused the way depth 17 is. Clears the SC-8-2 scope note. check-in: 8652936469 user: [email protected] tags: feat/submanifest-reader, main, trunk

Widening a sparse-store checkout with a peer fetches and materializes exactly the newly covered payloads; with no peer it refuses naming the elided class and changes nothing; a peer lacking the content is refused with the unavailable artifact named. Clears the SC-3.5-2 scope note. check-in: fcb7f90f2c user: [email protected] tags: feat/submanifest-reader, main, trunk

The sparse-store entry said nothing yet fills a store sparsely and the sparse-checkout entry said a merge touching an uncovered file is refused; both are no longer true on this branch. check-in: 7720f39cd0 user: [email protected] tags: feat/submanifest-reader, main, trunk

The checkout lane's review blockers are fixed and re-reviewed, so the two scope notes now name only what is unverified: durable crash recovery of the private marker, a conformance case for reverting a record-only change, and stash apply on a sparse checkout. check-in: 7163d16293 user: [email protected] tags: feat/submanifest-reader, main, trunk

Only managed revert steps reach it, each with a resolved path, so the fallback for an empty path was dead code standing in for a broken invariant. check-in: a3cc82b191 user: [email protected] tags: feat/submanifest-reader, main, trunk