Timeline

'zit log' carried a -n K windowed-log flag: an extra grammar mode (a state machine with a positional-only '--' separator and a -n value token in either order) and a bad_count offense, for a bound no other query verb exposes. Its sibling 'update' already documents the target shape — one full check-in ID, help only, no windowing.

Collapse log onto that same one-positional grammar. parseLogArgs is now the plain scan parseUpdateArgs uses: -h/--help wins; -n, --all, and a bare '--' are all unknown options (log has no positional-only separator); a second positional is an extra argument. Drop LogArgs.count, the bad_count variant, parseLogCount, and walkLog's max_count / window early-exit — the ancestry walk is unconditionally unbounded again.

Usage errors (missing check-in, unknown option, extra argument) now exit 2 via cli.usageError; a well-formed-but-non-canonical ID stays a validation failure at exit 1. Help and 'zit help log' print the trimmed single-verb text. Net -110 lines. Unit + e2e (209/209) green; fmt clean; dst 6x1000 ok. closed check-in: 0973cf7e9e user: dmestas tags: recover-inflight

A conformant Fossil client POSTs sync to the repository URL path unchanged and MUST NOT append /xfer (sync §4 L759-764): a bare 'fossil clone http://host:port/' POSTs to "/". The server previously required the /xfer path and answered 404 for anything else, so a root-URL clone from a stock client failed.

Drop the path from the dispatch decision entirely. classifyXfer now keys only on method (POST) and a request-valid, outer-compressed Content-Type (application/x-fossil); the URL path is accepted but unused. Remove xfer_path, requestPath, and the not_found/404 disposition; Disposition collapses to ok / method_not_allowed / unsupported_media_type. A non-POST stays 405 rather than a home redirect this sync-only server can't honor (and a 302 to "/" would loop now that "/" is a valid endpoint).

The over-real-HTTP e2e clone now targets the bare root "/" to prove a root-URL client interoperates. Unit + e2e green; fmt clean. check-in: 9636157a85 user: dmestas tags: recover-inflight

The clone/sync receive path inflated every stored cfile container to prove the RFC1950 stream was intact (§3.9), then threw the result away: the store keeps the container verbatim and reconstructs lazily, and the persist commit hook runs the §7.7 integrity check on the reconstructed bytes. For the full form that inflate was pure waste. Move the decode into the delta branch (which genuinely needs the plaintext to reconstruct) so a full-form cfile is interned and retained without inflating.

Retaining an unvalidated container means a held artifact is no longer guaranteed reconstructable: content() can be null for a corrupt wire-backed container, so held() no longer implies content(). Reconcile the consumers that assumed it did. The pull .raw delta basis and the push upload path both degrade gracefully (round abort / silent skip) instead of tripping an unreachable or assert on hostile input; the read/derivation path keeps the decompression-bomb cap, and the eager clone-end image treats a corrupt container as an error.

Cuts clone peak RSS ~13% (651 -> 568 MB) on the fossil corpus by dropping the discarded plaintext allocation. Instruction count and wall are flat, since full-form cfiles are the minority of clone content. 1538 tests pass; fossil interop smoke green. closed check-in: d91a3cfe42 user: dmestas tags: clone-w4