Timeline

A cone-excluded row is charged at its expanded size plus card overhead, so a round over a long excluded run stops where a dense batch would and the cursor resumes it, instead of walking the whole run in one round. SC-6.2-1 stays partial: ordinary keep-set discovery still reads the whole store. check-in: 1da7f0f002 user: [email protected] tags: feat/submanifest-reader, main, trunk

Many check-ins sharing one wide sub-manifest cross the 1<<20 visit bound at depth two; 1023 roots are served and 1024 are refused the way depth 17 is. Clears the SC-8-2 scope note. check-in: 8652936469 user: [email protected] tags: feat/submanifest-reader, main, trunk

The sparse-store entry said nothing yet fills a store sparsely and the sparse-checkout entry said a merge touching an uncovered file is refused; both are no longer true on this branch. check-in: 7720f39cd0 user: [email protected] tags: feat/submanifest-reader, main, trunk

The checkout lane's review blockers are fixed and re-reviewed, so the two scope notes now name only what is unverified: durable crash recovery of the private marker, a conformance case for reverting a record-only change, and stash apply on a sparse checkout. check-in: 7163d16293 user: [email protected] tags: feat/submanifest-reader, main, trunk

Only managed revert steps reach it, each with a resolved path, so the fallback for an empty path was dead code standing in for a broken invariant. check-in: a3cc82b191 user: [email protected] tags: feat/submanifest-reader, main, trunk

Record-only merge steps return before the content switch, and a both-changed path outside the cone is refused, so storeMergePayload had no production caller. Its tests called it directly; they go with it, and the merge-failure test keeps its vmerge assertion. check-in: dac73e55c9 user: [email protected] tags: feat/submanifest-reader, main, trunk

A partial commit wrote every pending change outside the cone into the check-in. Such changes now behave as disk changes do: a full commit records them, a partial commit leaves them pending against the new version, and a partial commit is still refused while a merge is pending. Fossil-oracle tests cover the dense analog of each case. check-in: 802906e3b8 user: [email protected] tags: feat/submanifest-reader, main, trunk

After the observed generation changes, every request falls back to dense and the service never re-prepares. Say so where the type is documented, so a caller does not expect sparse serving to resume after a foreign commit. check-in: 322c8ef406 user: [email protected] tags: feat/submanifest-reader, main, trunk

Preparation counted newlines in every artifact against the 1M card budget, so a repository holding one large multi-line text file was refused far below its byte limits. Only an artifact with a verified Z card can parse as a deck, so only those are charged cards and parsed; the byte budgets still bound all content. check-in: 2f0f64f464 user: [email protected] tags: feat/submanifest-reader, main, trunk

The prepared index left private and shunned RIDs out, so a gimme for an in-cone private artifact failed keeps() and got no reply, where the dense handler sends the private igot. A client never told the artifact is private can keep requesting it. The index now answers cone membership only, as the dense keep-set does; the handler's live private and shun gates decide visibility, so no payload is exposed. check-in: 87f44dbf99 user: [email protected] tags: feat/submanifest-reader, main, trunk

Fossil's update leaves vmerge alone, so the next commit records the merge parent. The sparse update cleared vmerge, losing the parent and letting a partial commit through while the merge was still pending. check-in: 5a070508db user: [email protected] tags: feat/submanifest-reader, main, trunk

The fallback that explains a parent whose tree the store does not hold ran under context.Background, so a cancelled commit still paid for it. Commit passes its context; snapshot, which has no deadline, says so explicitly. check-in: c25e714b08 user: [email protected] tags: feat/submanifest-reader, main, trunk

The closure walk parsed a node before checking whether its frame had been visited, so a tree whose S cards name one sub-manifest many times parsed it once per reference: a 616 KB node took 0.46s at 50 references and 3.7s at 400. The visit and byte limits bound what is held, not that work, and a caller without a deadline could wait for days inside the budget.

The walk is its own function now, parsing through a callback it calls at most once per (artifact, baseline) pair, so a test can count parses. check-in: 6824f7701a user: [email protected] tags: feat/submanifest-reader, main, trunk

(cherry picked from commit f10fb0eca15614a98bdecfc9d715464615738924) check-in: db1f83c19a user: [email protected] tags: feat/submanifest-reader, main, trunk

(cherry picked from commit fc1c110fa16c178c73a4bbf937c1f01cc41d5795) check-in: 20b51362a4 user: [email protected] tags: feat/submanifest-reader, main, trunk

(cherry picked from commit 63520cd9e0d6ed4f96be8b302dfc217ee57da82f) check-in: 9d336c0907 user: [email protected] tags: feat/submanifest-reader, main, trunk

Keep the first pass metadata-only: typeof and direct length(BLOB) retain SQLite OP_Column length/type flags. Reject other storage classes without reading content. A CAST or substr in this pass can materialize a whole value before its stored-byte budget, so prefix reads now follow the complete stored-total proof.

Charge prefix reads and potential SQLite bytes separately; prove aggregate declared inflation before full driver payload reads. Both-driver EXPLAIN regressions reject full-content OP_Column operations in metadata preflight. check-in: d5eb1f3a5a user: [email protected] tags: feat/submanifest-reader, main, trunk

A BLOB-affinity column can hold TEXT; SQLite length(TEXT) stops at NUL and is not a byte-allocation bound. Cast content to BLOB in metadata and guarded payload reads so malformed dynamically typed values cannot bypass stored-byte preflight.

The adversarial TEXT fixture previously read a one-MiB payload and reserved sixteen MiB of inflation before rejecting corruption. Both drivers now reject before any payload read or inflation reservation. check-in: a08e7e9d71 user: [email protected] tags: feat/submanifest-reader, main, trunk

Never share RID-keyed cache state across prepared service transactions: protocol-fatal responses can roll back after expansion while returning a nil Go error. Reject canceled contexts before acquiring a transaction and propagate observer cancellation instead of serving densely.

Reproduce rollback, RID reuse and incorrect content under the replacement hash; verify cancellation and deadline responses do no dense work. Exercise newly shunned payload and basis suppression after prepared-proof invalidation. check-in: 632e7349e6 user: [email protected] tags: feat/submanifest-reader, main, trunk

Use metadata preflight and fixed-size inflation for ordinary reference discovery too. Bound artifacts, parser cards, stored bytes and declared expansions before payload and parser allocations. Preserve unknown retention for corrupt compression.

Retain only classification fields and structural identities, copying kept tokens so discarded wiki/forum bodies, cluster inventories and metadata cannot be pinned. Compare empty and large-body fixtures and reject oversized expansion reservations. check-in: a3c6ddef9a user: [email protected] tags: feat/submanifest-reader, main, trunk

Match Fossil 2.28 send_file and send_compressed_file payload gates. A source-first clone must expand a dependent when its stored basis is shunned rather than forwarding that withheld basis. Preserve private notices, authorization and SHA3 refusal ordering.

Exercise real encoded requests through the ordinary handler and Fossil HTTP oracle. Canonical compressed clone can name a shunned public basis without sending it; this server expands instead to preserve its source-first guarantee. check-in: a402aa5cc6 user: [email protected] tags: feat/submanifest-reader, main, trunk