Artifact Description [fb0910a75a]

Artifact fb0910a75a9fae4b7a0bf5e358dad4357c744e7df31b4679a850e820e5c49c94:

• File internal/manifest/dephantomize.go
  • 2026-10-24 03:44:17 — part of check-in [ed5e3ce5b5] on branch main — fix(sync): refuse pushed seeds by hash; judge only what a fill grounds (#471)

    Horizon F.1, push side, and the fourth review's blocking finding.

    Refusal by hash: - seedcheck keeps two store-local tables, carried by no config group: seedpending(rid, root) and seedrefused(uuid). - A seed judged after the request that pushed it, because a later push, pull, check-in or tag filled its basis, has its hash refused. Its rows are deleted by Sweep, and only where no receive pass holds rids: end of request, end of sync, check-in, tag and rebuild. A deleted rid is reused by the next row, and a pass's caches are keyed by rid. - Until swept, such a row is withheld and never linked. A delta on a refused seed is left unreadable and pending under no root. - requestPhantoms never asks for a refused hash. ownSeedReadable refuses a re-push of one, and a full-text re-push is refused on its bytes. - A purge still forgets pending rows (ForgetDeleted). Refusals are keyed by hash, so rid reuse cannot pass them on.

    Judging only what a fill grounds: - JudgeReadable rescanned every pending row on each fill. A pusher could plant dangling deltas without bound and make every later fill pay for all of them. - Pending rows now record the root of their basis chain, re-rooted when that root is itself stored as a dangling delta. - JudgeFilled judges only the rows pending on the rids just stored, and reports how many it examined. - Callers: AfterDephantomize and its batch, manifest.Checkin (its files and manifest) and tag.AddTag. linkArtifact still judges a pending row it reaches, caching which tables exist per transaction. - The sweep no longer judges.

    A seed-shaped artifact received by pull or clone stays ordinary, per the 0.7.1 B.2. Docs and the HZ-5.2-4 scope note cite F.1.

    Tests: - A seed package test: one fill examines its own row, not 200 planted elsewhere. Run as a rescan mutant, it fails. - A tag whose control artifact is a seed's basis refuses the seed. - The link step refuses a seed made readable by a raw store. - A re-push refused by hash, and an igot of the hash not gimme'd. - A delta on a refused seed withheld. - A purged pending rid reused by an innocent blob. - Disabling any judge call (cascade, check-in, tag, link) or any Sweep call (request, sync, check-in, tag) fails a test. (user: [email protected], size: 37469) [annotate] [blame] [check-ins using]

  • 2026-10-24 06:39:04 — part of check-in [81d00b2e3b] on branch main — Merge branch 'feat/471-seed-refusal' into feat/horizon-names-seed-refusal

    # Conflicts: # conformance/horizon_test.go # docs/site/data/conformance.json (user: [email protected], size: 37469) [annotate] [blame] [check-ins using]

  • 2026-10-24 12:32:24 — part of check-in [5a7c2ba12e] on branch main — Merge pull request #476 from danmestas/feat/horizon-names-seed-refusal

    feat(horizon): named horizons with depth, and origin seed refusal (user: [email protected], size: 37469) [annotate] [blame] [check-ins using]