Parents and children of check-in [07d79d60eb]
|
2026-10-21
| ||
| 15:55 |
fix(dst): run invariant checks with fault injection suspended
The safety checks ran while simio's Buggify was armed, so the read-path sites in blob decompression and content expansion truncated or flipped the bytes each check expanded. Every seed at the adversarial and hostile levels then reported a blob-integrity violation that was never persisted; CI runs the normal level only, so nothing caught it. simio.SuspendBuggify switches injection off and returns a resume that restores the previous state with its random stream intact, so a check mid-run does not change the run's later choices. Every exported check in dst/invariants.go suspends for its duration. A guard test arms Buggify over a clean repository and fails without the change. Also records in the CHANGELOG that ExtractOpts and RepoOpenCmd are no longer comparable. check-in: dfdf391349 user: [email protected] tags: feat/submanifest-reader, main, trunk | |
| 15:43 |
conform(sparse): pin sparse-cone at horizon-rfc e6ee276c89
zit #262 settled the pull-inventory cost in the draft: a dense inventory can cost a requester the out-of-cone blobs of check-ins announced in the same inventory, since those names stay transit phantoms until a held manifest classifies them, and the filtering of 6.3 elides them on arrival. That is what the requester here does, so SC-6.2-4 closes. Its case now checks both halves: a blob announced with its check-in is never held, and one announced after it is never requested. check-in: 07d79d60eb user: [email protected] tags: feat/submanifest-reader, main, trunk | |
| 14:43 |
feat(sparse): adopt sparse-cone at horizon-rfc a5741263ab
The draft now settles zit #257 to #260, so the four rows that waited on it close against code: - Compaction and local filtering keep every manifest and sub-manifest node, interiors included (5.4, 6.3). RetainProvenance previously let an outside interior whose children were all held leaves go; the draft now requires it held, since it is the range proof that reaches the leaf. - A server answering a cone request acknowledges the reply with pragma cone-served in its leading pragma run (6.3). This server applies a request's whole cone or refuses it, and a refusal resets the reply, so the pragma is never sent for a refused or dense reply. SyncResult and CloneResult report ConeServed beside Elided, now public too. - An empty cone is refused (3.2); a new row and case pin it, locally and over the wire. - The per-round bound covers the tree walk only (6.2). A new row tests that a requester does not act on a dense inventory. It stays partial: an out-of-cone blob announced in the same reply as its check-in cannot be classified yet and is fetched, then filtered; zit #262 asks the draft to account for that cost. check-in: b5a64230b3 user: [email protected] tags: feat/submanifest-reader, main, trunk | |