# zit 0.3.43

zit 0.3.43 targets revision -01 of the Fossil drafts, which fold every
erratum into the text, and brings its behaviour into line with them where
Fossil and the -00 text disagreed. It also closes a weakness in the sync
server's handling of authentication.

`zit version` now reports `targets Fossil RFC rev 01`. The -01 drafts ship
in `docs/rfcs/` beside the -00 texts they replace.

No artifact, tag namespace, wire, or on-disk repository format changed. The
repository cache's layout version changed, so the first command after
upgrading rebuilds derived state once.

## Security: cards before a valid login no longer borrow its rights

The sync server used to grant a request's rights once, after verifying its
login card, to every card in the request, including cards placed before the
login. A captured signed request could be extended with cards ahead of the
login card, and those cards ran with the signer's rights. Each card is now
judged by the rights in force where it appears, as the draft requires and
as Fossil does. Hosts that serve a repository over `zit serve` should
upgrade.

## Check-in times follow a date tag

A check-in amended with a `date` tag is ordered by the tag's value, not by
its original D card, as Fossil orders it. The newest date tag wins, a
cancelled one restores the original time, and a value that does not parse
is ignored. Tips, leaves, `tip`, plain-name resolution, `info`, `timeline` and
`log --long` all follow the retimed check-in. `log --long` now prints the
event time in whole seconds, as `info` and `timeline` do, rather than the D
card's milliseconds. Dates before 1970 are outside zit's time range, for D
cards and date tags alike, as before.

## A reply cut short no longer aborts the sync

A sync reply whose body ends inside a file, cfile or uvfile payload used to
abort the exchange. `pull`, `push`, `sync`, `config` and `uv` now keep
everything they processed before the cut, print one warning naming the
count, and continue as after any other handler error, exiting 0 as Fossil's
do. `clone` prints the warning, says the clone is incomplete, leaves the
directory for you to remove, and exits non-zero, as Fossil's clone fails.
The server's answer to a short payload is unchanged: `malformed file line`.

## Artifact format

- An F card naming a reserved filename is dropped before it can set the
  artifact's type, as Fossil drops it; a manifest whose only F cards are
  reserved resolves to a control artifact and is rejected.
- A delta manifest whose baseline is itself a delta is read as Fossil reads
  it: one level, from the baseline's own F cards. zit used to reject it. A
  commit atop such a baseline writes a full manifest.
- An F card without a hash in a manifest that is not a delta is rejected.

## Repository state

- A singleton tag applied by a T card now walks the check-in's descendants as
  a cancel, removing the same-named inherited tag, as Fossil's crosslink does.
- A tag operation that is skipped as older than the row it would replace no
  longer starts a propagation walk.
- Trailing punctuation in a symbolic name is retried exactly as Fossil
  retries it: one or two of `. _ ) > ! ? ,` are stripped from a name long
  enough to carry them. `trunk^`, `rel.` and `release;` no longer resolve;
  0.3.0's notes advertised `trunk^`, and that form is gone.

## Sync protocol

- Artifact names on file and cfile cards are validated as 40 or 64 lowercase
  hex characters; anything else is `malformed file line`.
- A second login card is `multiple login cards`.
- A duplicate delta card is ignored, and an absent delta source becomes a
  phantom that a later gimme requests, as in Fossil.
- A failed login's reply carries the timestamp line, and a push refused after
  an accepted pull is answered with `message pull only - not authorized to
  push` rather than an error.
- A redirect target has one trailing `/xfer` stripped, not every one.

## Compatibility

- The release ships `docs/rfcs/draft-fossil-{artifact-format,repo-state,
  sync-protocol}-01.txt`; section numbers are unchanged from -00, and each
  -01 ends with an appendix listing its changes.
- `trunk^` and other non-Fossil trailing punctuation no longer resolve.
- No other command's output changed.

## Qualification

Qualified on macos-aarch64 with the full local battery: format check,
ReleaseSafe build, unit tests, e2e, deterministic simulation (seed 1,
1000 steps), all 32 fuzz targets at 100 rounds, and the smoke suite three
times against fossil 2.28 [52445a27f1]. Linux targets are qualified when
the release is cut.