Timeline

Exercise a caller-owned committed link, failed repair on cancellation and a normal candidate deferred until retry. Verify the same receive linker retains the original schedule and converges after retry. Update repair comments to describe the per-batch gates. leaf check-in: 72251e2dcd user: [email protected] tags: main, perf/tag-repair-batch, trunk

A control artifact can write a check-in's branch row before the check-in is linked; that write schedules the check-in while it has no parents. When the check-in is linked later, in another transaction, its plink rows name parents nothing rechecks, so a parent on the same branch keeps a leaf row it no longer earns. Applying leaf rechecks per link transaction made this common in a clone, which links each received artifact in its own transaction: a clone of fossil.fossil ended with 1435 leaves instead of fossil's 1426.

Linking a check-in that already carries a branch row now schedules it, and with it the parents it names. A check-in with no branch row is left alone, as fossil leaves it (#426). TestReparent's relink keeps propagated branch rows, so it now gives c2 the verdict a rebuild does.

Tracked in #432. check-in: 789434c556 user: [email protected] tags: main, perf/tag-repair-batch, trunk

TestArrivalOrderMatchesRebuild builds a random history per seed, delivers its blobs to a fresh repository in random order and rounds, crosslinking after each, and compares tags and leaves with a rebuild. It runs only when LIBFOSSIL_ARRIVAL_PROBE names a seed count. Without reparents every seed must match; with them it reports the seeds that differ, the divergence documented on ReparentCheckins.

Tracked in #432. check-in: 4f3f1669e6 user: [email protected] tags: main, perf/tag-repair-batch, trunk

A reparent propagates from the new parent, which fossil's manifest_reparent_checkin does not, and never removes the tags inherited from the old parent, which fossil does not either; fossil's own rebuild is order-dependent there. Say both in ReparentCheckins, and rename the reparent test so it no longer claims full convergence. Note in the CHANGELOG that a failed sync no longer sweeps before it returns, so artifacts committed outside a phantom fill wait for the next crosslink.

Tracked in #432. check-in: 9ff7dea0b5 user: [email protected] tags: main, perf/tag-repair-batch, trunk

Each link transaction now runs the whole repair gate before it commits: the reparent pass, tag propagation from the parents it linked, and the leaf rechecks it scheduled. Fossil's manifest_crosslink_end runs the reparent pass and leaf_do_pending_checks inside the transaction that linked the check-ins, so a crash can never leave a committed check-in without its leaf row; this does the same. The schedule records whether a transaction linked anything, so one that linked nothing skips the gate.

The gate at the end of a sweep or a receive is gone. Finalize repairs only what a caller linked through LinkStored in a transaction it opened itself rather than through ReceiveLinker.WithTx, which is all that can still leave work on the schedule.

Tracked in #432. check-in: 8c00d632b7 user: [email protected] tags: main, perf/tag-repair-batch, trunk

Each phantom-fill cascade batch already reparents, propagates and applies its leaf rechecks before it commits, so a sync's closing crosslink and the repair after a failed round owed the cascades nothing. Remove the cascade count that kept them running: CrosslinkAfterCascades folds into CrosslinkContext, the sync client and handler stop counting cascaded links, and the handler stores files through storeReceivedFile. The closing gate now runs only when its own sweep linked something, for the sweep's leaf rechecks and the reparent pass.

Tracked in #432. check-in: 1ed447441a user: [email protected] tags: main, perf/tag-repair-batch, trunk

Each link transaction (a sweep batch, a receive transaction, a retried waiter) now reparents and propagates from the parents it wrote plink rows for before it commits, as fossil's crosslink propagates from a check-in's parent in the transaction that links it. A link and the propagation it owes commit or roll back together, so a failed gate or an interrupted process can no longer leave a committed plink edge whose parent's tags never reached the child. The closing gate still applies the batch's leaf rechecks once, runs the reparent pass for parent tags no link transaction reached, and propagates from any parent left by a link outside a link transaction.

Tracked in #432. check-in: e9eeab7e17 user: [email protected] tags: main, perf/tag-repair-batch, trunk

Each phantom-fill cascade batch now runs the repair gate, so the reparent pass runs once per batch rather than once per sync. A check-in whose plink rows already name the parent tag's parents, each a linked check-in, is no longer re-expanded and rewritten, and its parent is not propagated from again. A rewrite against a parent that is not linked yet is still redone at every gate until it is.

Tracked in #432. check-in: 4701ed89a2 user: [email protected] tags: main, perf/tag-repair-batch, trunk

repairTagPropagation re-propagated tags from every primary parent in the repository at every gate, so the gate at the end of a sweep, clone or sync cost the repository, not the batch. The batch now records the primary parents it writes plink rows for, and the new parents of a reparent, in a set beside its leaf schedule; the set is marked, rolled back and reset with the schedule, and the gate propagates from it alone. A rebuild links every check-in, so its set is every primary parent and nothing changes there.

A phantom-fill cascade's parents are known only to the cascade, so each cascade batch runs the gate itself before it commits rather than leaving propagation to the end of the sync.

Tracked in #432. check-in: 08820292b8 user: [email protected] tags: main, perf/tag-repair-batch, trunk

* fix(checkout): keep uncommitted changes across Update, as fossil does

Update compared only committed versions: it wrote the target over a locally edited file, deleted an edited file the target removed, and merged the current and target check-ins with their ancestor while ignoring the working file.

It now follows fossil's update (src/update.c): scan the checkout, then for each file take the target's content when there is no local change, merge a local edit three ways (the checkout's version as base, the working file as local, the target as other) with conflicts listed in Conflicted, keep an edited file the target deletes as an untracked file, keep pending adds and removals, restore a missing file, and copy an untracked file the target adds over to NAME-original first. A dry run writes nothing. Files written with the target's content record the mtime of the write. Files are matched by name; a target-side rename is not followed.

The two tests that relied on merging two branches' committed changes now make the clashing edit locally. A fossil 2.28 interop test runs the same edits through fossil update and compares files, fossil changes and Status.

Tracked in #443

* fix(checkout): make Update safe on binary files, failures and dry runs

A binary file (a NUL byte, or a line over 32,767 bytes, as fossil's line diff refuses) is no longer line-merged. Update saves the working copy as NAME-original and writes the target, as fossil's update does; Merge keeps the checkout's copy, as fossil's merge does. Both used to splice the versions and report a clean merge. merge.IsText is fossil's test.

Update refuses before writing anything when a file it must write or delete has a directory or a read-only file in the way, moves the checkout database to the target in one transaction, and in a dry run leaves the database untouched (the scan's findings stay in memory). Every target file gets the target's executable bit, as fossil's checkout_set_all_exe does, so a bit-only change reaches the disk.

UpdateResult.Unmerged lists files left to reconcile without markers: edited files the target deletes, files added both locally and by the target, and binary conflicts. The interop test now covers a binary conflict against fossil 2.28.

Tracked in #443

* fix(checkout): check real write access before Update writes anything

The pre-write check read the owner-write bit: it missed an unwritable directory (a remove failed after a merge had been written), files owned by others, and wrongly refused for root. It now asks the storage, via an optional CheckWritable: OSStorage uses access(2) with W_OK on unix and a read-only-attribute check elsewhere (js/wasm, Windows). Every step needs its directory writable; a write or merge over an existing file needs the file writable too.

A read-only untracked file where the target adds one is backed up to NAME-original, deleted and replaced, as fossil does, instead of refused.

Merge keeps a binary file whatever its strategy, as fossil's merge does. setVVar's precondition now catches a nil *sql.DB or *sql.Tx inside the interface.

Tracked in #443 check-in: 6e6969bf97 user: [email protected] tags: main, trunk