zit 0.3.37

zit 0.3.37 closes a hole in the sync server: it stored content from requests that were not pushes, including anonymous ones. It also adds cherry-picks and backouts to the zit crosslink stream.

No artifact, tag namespace, or on-disk repository format changed.

Only a push writes

zit serve stored every file card a request carried, whether or not the request had sent push, and made a phantom of every igot, so the next reply asked the client for it. A front that gates pushes by looking for the push card, as quarry does, was bypassed by a pull request carrying content. The responder also let a request with no login push when it was given a credential.

The server now follows Fossil's rule. File content is taken only from a request that sent push, and when the responder has a credential, only from one that also logged in. Anything else is refused whole with Fossil's own error not authorized to write, and nothing is stored. An igot from a client that may not write no longer makes a phantom. Pulls are answered as before. zit serve itself has no credential and still takes any push: put it behind a front that checks logins, or keep it to hosts you trust.

zit's own client always sends push when it pushes, so push and sync between zit peers are unchanged.

crosslink names cherry-picks

Each zit crosslink record now has one line per Q card:

cherrypick (+|-)HASH

+ is a check-in cherry-picked into this one and - one it backs out, signed as the Q card writes it. The line comes after the tag lines and before the file lines. The stream stays crosslink 1: a consumer skips a line it does not know.

Compatibility

• No on-disk repository or wire format changed; Fossil RFC revision 00 remains the target.
• A client that sent file content without a push card, or pushed anonymously to a server with a credential, is now refused. Fossil's server refuses both.
• zit crosslink records may carry the new cherrypick line.

Qualification

zig fmt --check, zig build test, e2e, smoke (18 scenarios), git-import-e2e, git-export-e2e, and dst, plus the three-runner battery.