Timeline

In the linked crash state both marker names are one file, and SQLite on Linux warns about the multiple links on stderr while fossil lists the record normally. CombinedOutput folded the warning into the file list. check-in: 83f574dc8f user: [email protected] tags: feat/submanifest-reader, main, trunk

Reverting a merge's out-of-cone changes by name, and with no names, leaves the record exactly where fossil's revert leaves the dense analog, without materializing anything. On a sparse checkout stash refuses a pending merge with the dense checkout's refusal, round-trips an in-cone edit as fossil does, and refuses to apply an out-of-cone file, naming the cone and keeping the entry. Clears the SC-4.4-1 scope note. check-in: 902108ace9 user: [email protected] tags: feat/submanifest-reader, main, trunk

A crash between moveMarker's link and unlink left one checkout database under both the native and the private name, which discovery refused, so the checkout could not be opened again. moveMarker now records its target name in the database before linking, and Open completes the move to that name. A still-running transition keeps the same name, so an Open racing it converges instead of removing both names, and moveMarker treats an old name already removed as done.

Crash injection at every step of narrowing, widening and legacy migration reopens as the old or new state with files matching the cone; stock fossil either refuses the directory or lists the dense record, before and after recovery. Clears the SC-4.1-2 scope note. check-in: bb9805a794 user: [email protected] tags: feat/submanifest-reader, main, trunk

# Conflicts: # cli/repo_cone.go # conformance/requirements/sparse-cone.tsv # conformance/sparsesync_test.go check-in: afd72285e5 user: [email protected] tags: feat/submanifest-reader, main, trunk

Section 5.1 permits holding out-of-cone nodes while 5.4 and 6.3 read as dropping or eliding them; zit holds them and so do we. The notes keep the rows PARTIAL until the draft says which sentence governs. check-in: 8ea7bd1ec4 user: [email protected] tags: feat/submanifest-reader, main, trunk

(cherry picked from commit 1e7b5f246ef9f5af5b366140eb03e7a80227f9bb) check-in: 42a5ef6dd7 user: [email protected] tags: feat/submanifest-reader, main, trunk

Repo.SetStoreConeContext replaces the store cone and pulls newly covered elided artifacts from an explicit peer through ordinary cone-scoped sync; with no peer it refuses naming the elided count, and a cancelled context refuses before any request, both leaving policy unchanged. repo cone store shows or replaces the store cone, defaulting the peer to last-sync-url. Closes SC-6.4-1 and SC-6.4-2. check-in: 08efefff20 user: [email protected] tags: feat/submanifest-reader, main, trunk

An aware clone and pull hold exactly the spines, in-cone nodes and in-cone blobs and never request or receive the remainder. Against a cone-ignorant server the requester elides exactly the blobs every F card names out of the cone and keeps every structural artifact, as zit does. Expected sets come from the origin's decks. check-in: af86aff844 user: [email protected] tags: feat/submanifest-reader, main, trunk

Extract now runs fossil's repo-cksum check after materializing: a present R card is compared with the aggregate over every file the manifest names, read from the store, so a sparse checkout over a dense store reaches the same verdict as a dense one, and a sparse store skips the check. Like fossil, a disagreement is a warning delivered through ExtractOpts.Warn and never fails the extract; repo-cksum off disables it. The conformance case builds its repository with fossil and checks fossil warns exactly where go-libfossil does. Clears the SC-4.3-4 scope note. check-in: 318f46de9e user: [email protected] tags: feat/submanifest-reader, main, trunk

A sparse store refuses a clone its cone does not cover unless the boolean partial-mirror repository setting is on, read as fossil reads a boolean setting. It reaches HandleSync, XferHandler, ServeHTTP and repo serve alike; libfossil.SettingPartialMirror names it. Closes SC-5.3-2. check-in: 6012d82bd6 user: [email protected] tags: feat/submanifest-reader, main, trunk

The public entry point refuses a dense store, as zit's pack --drop-elided does, and drops exactly the blobs that only out-of-cone F cards name. The test computes that set from the held artifacts, then verifies the store and recovers every dropped payload by widening through SetConeContext. check-in: 774f579bfa user: [email protected] tags: feat/submanifest-reader, main, trunk

A cone-excluded row is charged at its expanded size plus card overhead, so a round over a long excluded run stops where a dense batch would and the cursor resumes it, instead of walking the whole run in one round. SC-6.2-1 stays partial: ordinary keep-set discovery still reads the whole store. check-in: 1da7f0f002 user: [email protected] tags: feat/submanifest-reader, main, trunk

Many check-ins sharing one wide sub-manifest cross the 1<<20 visit bound at depth two; 1023 roots are served and 1024 are refused the way depth 17 is. Clears the SC-8-2 scope note. check-in: 8652936469 user: [email protected] tags: feat/submanifest-reader, main, trunk

Widening a sparse-store checkout with a peer fetches and materializes exactly the newly covered payloads; with no peer it refuses naming the elided class and changes nothing; a peer lacking the content is refused with the unavailable artifact named. Clears the SC-3.5-2 scope note. check-in: fcb7f90f2c user: [email protected] tags: feat/submanifest-reader, main, trunk

The sparse-store entry said nothing yet fills a store sparsely and the sparse-checkout entry said a merge touching an uncovered file is refused; both are no longer true on this branch. check-in: 7720f39cd0 user: [email protected] tags: feat/submanifest-reader, main, trunk

The checkout lane's review blockers are fixed and re-reviewed, so the two scope notes now name only what is unverified: durable crash recovery of the private marker, a conformance case for reverting a record-only change, and stash apply on a sparse checkout. check-in: 7163d16293 user: [email protected] tags: feat/submanifest-reader, main, trunk

Only managed revert steps reach it, each with a resolved path, so the fallback for an empty path was dead code standing in for a broken invariant. check-in: a3cc82b191 user: [email protected] tags: feat/submanifest-reader, main, trunk

Record-only merge steps return before the content switch, and a both-changed path outside the cone is refused, so storeMergePayload had no production caller. Its tests called it directly; they go with it, and the merge-failure test keeps its vmerge assertion. check-in: dac73e55c9 user: [email protected] tags: feat/submanifest-reader, main, trunk

A partial commit wrote every pending change outside the cone into the check-in. Such changes now behave as disk changes do: a full commit records them, a partial commit leaves them pending against the new version, and a partial commit is still refused while a merge is pending. Fossil-oracle tests cover the dense analog of each case. check-in: 802906e3b8 user: [email protected] tags: feat/submanifest-reader, main, trunk

After the observed generation changes, every request falls back to dense and the service never re-prepares. Say so where the type is documented, so a caller does not expect sparse serving to resume after a foreign commit. check-in: 322c8ef406 user: [email protected] tags: feat/submanifest-reader, main, trunk

Preparation counted newlines in every artifact against the 1M card budget, so a repository holding one large multi-line text file was refused far below its byte limits. Only an artifact with a verified Z card can parse as a deck, so only those are charged cards and parsed; the byte budgets still bound all content. check-in: 2f0f64f464 user: [email protected] tags: feat/submanifest-reader, main, trunk

The prepared index left private and shunned RIDs out, so a gimme for an in-cone private artifact failed keeps() and got no reply, where the dense handler sends the private igot. A client never told the artifact is private can keep requesting it. The index now answers cone membership only, as the dense keep-set does; the handler's live private and shun gates decide visibility, so no payload is exposed. check-in: 87f44dbf99 user: [email protected] tags: feat/submanifest-reader, main, trunk

Fossil's update leaves vmerge alone, so the next commit records the merge parent. The sparse update cleared vmerge, losing the parent and letting a partial commit through while the merge was still pending. check-in: 5a070508db user: [email protected] tags: feat/submanifest-reader, main, trunk

The fallback that explains a parent whose tree the store does not hold ran under context.Background, so a cancelled commit still paid for it. Commit passes its context; snapshot, which has no deadline, says so explicitly. check-in: c25e714b08 user: [email protected] tags: feat/submanifest-reader, main, trunk

The closure walk parsed a node before checking whether its frame had been visited, so a tree whose S cards name one sub-manifest many times parsed it once per reference: a 616 KB node took 0.46s at 50 references and 3.7s at 400. The visit and byte limits bound what is held, not that work, and a caller without a deadline could wait for days inside the budget.

The walk is its own function now, parsing through a callback it calls at most once per (artifact, baseline) pair, so a test can count parses. check-in: 6824f7701a user: [email protected] tags: feat/submanifest-reader, main, trunk

(cherry picked from commit f10fb0eca15614a98bdecfc9d715464615738924) check-in: db1f83c19a user: [email protected] tags: feat/submanifest-reader, main, trunk

(cherry picked from commit fc1c110fa16c178c73a4bbf937c1f01cc41d5795) check-in: 20b51362a4 user: [email protected] tags: feat/submanifest-reader, main, trunk

(cherry picked from commit 63520cd9e0d6ed4f96be8b302dfc217ee57da82f) check-in: 9d336c0907 user: [email protected] tags: feat/submanifest-reader, main, trunk

Propagate tags and apply scheduled leaf rechecks before each link transaction commits. Preserve sparse metadata repair, pretagged merge-parent rechecks, and rollback-safe retries. Tracked in #432. check-in: b38bf23f79 user: [email protected] tags: feat/submanifest-reader, main, trunk

Use same-branch and arrival-order evidence for leaf validation, validate parent overrides, and match Fossil parent tokenization. Preserve sparse readiness and delta-tree scans within one verification snapshot. Tracked in #433. check-in: 35672aadc7 user: [email protected] tags: feat/submanifest-reader, main, trunk

Keep Fossil's mandatory operation-less second round without accepting any cleanup payload or clearing the refusal. Exercise dense and sparse refusal alongside the existing client compatibility cases. check-in: a453db484d user: [email protected] tags: feat/submanifest-reader, main, trunk

Exercise mixed held and nested missing S siblings after clearing and rebuilding derived tables. Repeated compaction preserves holdings and elided identities; ordinary sync must not request the rebuilt elided artifacts. check-in: 29a11b0aa8 user: [email protected] tags: feat/submanifest-reader, main, trunk

Use raw cone references while independently verifying held bytes. Preserve leaves and nonterminal paths so missing descendants keep their range proofs. Exercise missing S nodes, stale derived indexes, and cancellation after an observed demotion. check-in: 55b3ca7155 user: [email protected] tags: feat/submanifest-reader, main, trunk

Import content-only changes from ab9f98d845b8ff29fedea32ac65561959c564fd4, retaining optional forumpost table handling. check-in: 5220dbc3f3 user: [email protected] tags: feat/submanifest-reader, main, trunk