The first full nightly soak found seed 22 at 10000 steps: the crash sweep flipped a bit inside a committed config frame, the store's checksum refused to serve it, and the harness reported a config mismatch because only its content-frame path knew that refusal as detection. The config check now routes rot inside the surviving config frame to the repair, and the repair's cut keeps every frame of either kind that ended before the rot, since config frames interleave with content. check-in: 79059346bc user: dmestas tags: trunk

ReleaseSafe keeps every assert as a detector; the build that ships is ReleaseFast, where only the simulation's own state-replay oracle can catch a bug that appears when the checks are gone. The nightly now runs the same DST sweep on both builds. DST_FAST=0 skips the second. check-in: 4df2fad0e6 user: dmestas tags: trunk

The runners keep Zig's cache outside the workspace, so the find under .zig-cache came up empty and xargs handed ls no arguments: ls listed the repo root and the newest entry, src, was run as the harness. The lookup honours ZIG_LOCAL_CACHE_DIR and an empty find is a build failure. check-in: b56ed097fd user: dmestas tags: trunk

scripts/soak.sh passed the optimize flag this Zig rejects, so it has been unrunnable since the toolchain moved; it takes --release=safe now. A scheduled workflow runs it at 03:00 UTC on the x64 runner with the script's nightly budgets, overridable from the dispatch form, keeps the log and any reproduce line as an artifact, and is pinned to the ci toolchain by ci_test like the other workflows. check-in: fa78377389 user: dmestas tags: trunk

The adversarial token generator capped fields at 24 bytes, and the igot parser has required a 40- or 64-byte name since the shun work, so the parser's accept arm was unreachable and the harness's own reachability floor said so at 256 rounds. CI swept 100 rounds, below the floor, and never saw it; the first bounded soak did. One field in four is now hash-shaped, and ci sweeps every target at the floor's round count. check-in: af292c3091 user: dmestas tags: trunk

The transport answers an HTTP Basic challenge; a gated first round is no longer fatal. check-in: 2a3106fcaf user: dmestas tags: trunk, version-0.3.23

A forge that gates a read answers a clone's first request with 401. The login card cannot answer that round, since its secret needs the project code the first reply teaches, and the status was fatal, so the credential never reached the wire. When a verb holds a plaintext password the transport keeps a Basic credential ready, sends nothing until a 401 names the Basic scheme, then repeats the round with the Authorization header and carries it on every later round, as fossil's --httpauth does. A 401 now says what the peer wanted. Proven by an e2e with an authenticating gate in front of zit serve. check-in: 5f541eccc7 user: dmestas tags: trunk

clone and pull authenticate; a private repository is readable. check-in: d75c7a741d user: dmestas tags: trunk, version-0.3.22

Only push and sync signed a login, so a private repository on a forge that gates reads was unreadable by the account that owned it, and a stored login sat unused while pull read anonymously. All four verbs now resolve the login the same way: --user, the URL's user@, then the stored login. A clone holds name and password until the round-0 reply teaches the project code, then signs every later round; a refused round 0 that taught the code is retried with the login, as fossil's client does. The accepted login is stored in the clone. A URL user with no password source is a hint and goes anonymous with a note; --user without a password is an error. Smoke S17 drives a read-gated fossil. check-in: 1d5a6c8fa7 user: dmestas tags: trunk