C Half\sa\srule,\sand\sone\sflipped\sbit
D 2026-09-19T15:18:35.557
E 2026-09-19T15:18:35.557 56adb4239c6ce5f5e324eb5f55ac2b69b5231fc1
N text/x-markdown
U dmestas
W 2378
# Half a rule, and one flipped bit

Two things landed in 0.3.24, and both are about a check that covered the
case it was written for and not its neighbour.

Branch protection judged a pushed tag by the branch it named. `sym-B` and
`branch=B` name the branch in the tag, so they were refused under any sign,
with the self-cancel that lets a branch-off leave its parent. A `closed` tag
names a check-in, so it was admitted, and a test said so on purpose: closing
a leaf is not a membership change. True, and beside the point. An account
with check-in rights and no ownership of trunk's protection could not push
onto trunk and could close its tip, and the owners' next commit was then
refused against a closed leaf with a message that named neither cause nor
actor. The cheapest way past a protected branch was not to push to it. The
gate now treats lifecycle as it treats membership: a `closed` tag aimed at a
held check-in resolves that check-in's branch and is refused when the
branch is protected, under any sign, saying close or reopen. A release name
on the leaf, a close off the branch, and a close of a check-in this server
does not hold stay admitted. The line is lifecycle of a protected branch,
not any tag that touches one.

The second came from the nightly soak on its first night. Its fuzz target
for the container codec took a valid container, flipped one bit, and the
process died inside the standard library's inflate: an integer underflow in
the bit peek that runs when input ends, arranged by a truncated stream.
Every sync request and reply passes through that decoder, so any peer could
send those bytes to a server or a client. The decoder is now the tree's own
copy of the standard one with the comparison reordered so the stream ends,
its origin noted at the top of the file.

With the crash gone, the same bytes decoded to fifty-eight bytes reported
as good. The flip had made a block final, the stream ended early and
cleanly, and the zlib checksum in the footer was read by the decoder and
verified by nobody. The codec now requires a finished stream and checks the
footer's Adler-32 against what it produced. The exact bytes are a fixed
test, and the soak's seed runs clean at its full depth.

A shallow fuzz sweep had run that target on every push for months and never
reached this round. Depth is what found it, and depth is what the nightly
is for.

Z 84b9d07c38247a6a1b44876f1c24ef07