Timeline

git export exports into MIRROR and remembers it, with an autopush URL, push branch and email domain, in repository config; a bare re-run does the round trip. Authors' addresses come from their user-table contact, set with the new users contact. Autopush URLs carrying a password are refused. The config payload bound is now sized from its key count. Release 0.3.34. check-in: 5fce7e867d user: dmestas tags: trunk, version-0.3.34

The rename that installs a new generation was never made durable, so a power loss after a reported success could bring the old store back, and with it content a shun had removed. The fault layer now reverts creates, renames and deletes no directory fsync made durable, and the shun sweep requires a rewrite that succeeded to survive a power cut. check-in: 3873759cfa user: dmestas tags: trunk

accept merged onto the target resolved by name at merge time, so a landing accepted meanwhile put an untested target under the merge. It now reads the target once and merges onto that check-in by hash. --expect-target HASH refuses with exit 7 and nothing written when the target is no longer at HASH. check-in: 676068f793 user: dmestas tags: trunk

Writers create .zit.lock with O_CREAT|O_EXCL before opening the store. A waiter names the holder and gives up after a minute; a dead holder's lock is broken; pack and shun --force hold the writer lock across their final check and rename. Release 0.3.33. check-in: d6cf7bf59c user: dmestas tags: trunk, version-0.3.33

import-git wrote no project code, so every sync peer and forge refused the store it made. It now derives one from the destination's absolute path, as init does, and the import request requires it. verify notes a repository with no project code without counting it as damage. check-in: add51a12d2 user: dmestas tags: trunk

LogStore.open now takes the exclusive lock before it reads the file's length and scans for the end, and a read-only handle refuses to append. purge undo opens the store through the shared writer path.

A new DST sweep runs two to four writers interleaved against one log through a file that models the lock. It flags unlocked or misplaced appends as they happen, checks each writer sees everything committed before it locked and reads back its own writes, including deltas. A source check fails on any write-mode open of the store outside openStoreAppend. An e2e test races commits, tags and user-table writes on one store and counts what landed. check-in: 5c445bb3f3 user: dmestas tags: trunk, version-0.3.32

It appended without the lock every other writer takes, so a concurrent commit, pull or push could overwrite its frames or have its own overwritten with valid frames nothing could detect. It now opens through openStoreAppend, which also resolves a detached worktree's store. Release 0.3.32. check-in: 2249f19056 user: dmestas tags: trunk

accept read the branch tip up to three times and merged it by name, so a push mid-accept could be merged unprobed. It now reads the tip once and merges that hash on both paths. --expect-tip HASH refuses with exit 6 and nothing written when the branch is no longer at HASH. Release 0.3.31. check-in: 60890d6661 user: dmestas tags: trunk, version-0.3.31

A Basic challenge was answered whatever the scheme, so over http the password crossed readable and the saved remote repeated it. It is now refused to non-loopback hosts, naming the https URL; a redirect to another host drops the credential; plain http to another host notes it on stderr. Release 0.3.30. check-in: b637cbd37c user: dmestas tags: trunk, version-0.3.30

config export AREA [FILE] writes fossil's configuration export format, so an area can be backed up before import replaces it; import and merge now apply /shun cards, add-only in both modes. merge --probe with several NAMEs answers each against TARGET with the ones before it landed, holding merged files in memory and moving the merge base with the landing. Release 0.3.28. check-in: c5243e961f user: dmestas tags: trunk, version-0.3.28

A forge that gates a read answers a clone's first request with 401. The login card cannot answer that round, since its secret needs the project code the first reply teaches, and the status was fatal, so the credential never reached the wire. When a verb holds a plaintext password the transport keeps a Basic credential ready, sends nothing until a 401 names the Basic scheme, then repeats the round with the Authorization header and carries it on every later round, as fossil's --httpauth does. A 401 now says what the peer wanted. Proven by an e2e with an authenticating gate in front of zit serve. check-in: 5f541eccc7 user: dmestas tags: trunk

Only push and sync signed a login, so a private repository on a forge that gates reads was unreadable by the account that owned it, and a stored login sat unused while pull read anonymously. All four verbs now resolve the login the same way: --user, the URL's user@, then the stored login. A clone holds name and password until the round-0 reply teaches the project code, then signs every later round; a refused round 0 that taught the code is retried with the login, as fossil's client does. The accepted login is stored in the clone. A URL user with no password source is a hint and goes anonymous with a note; --user without a password is an error. Smoke S17 drives a read-gated fossil. check-in: 1d5a6c8fa7 user: dmestas tags: trunk

fossil --httptrace sends its cards uncompressed under this type, and the server refused it with a bare 415 on the premise that the reference client never sends it. The exchange now tells handleXfer whether the body is a zlib container or plain cards; the reply is framed as before, and fossil reads the reply's framing off the reply's own content type. x-fossil-uncompressed stays reply-only. check-in: cc96464a51 user: dmestas tags: trunk

The tracker is disposable and does not live with the source, so a number is a dangling pointer. Every zit#NN and #NN reference in code comments, test names, help text, smoke labels, identifiers, release notes and errata is replaced by enough context to stand alone, or by a short plain statement of the problem. No behaviour changed. check-in: 9033c13f21 user: dmestas tags: trunk

zit remote list saved the word list as the remote and reported success; the loss surfaced at the next push. The help already defines the argument as an http:// or https:// address, and the parser now holds it to that with a usage error that says there are no subcommands. A valid URL is still stored verbatim. check-in: c280025388 user: dmestas tags: trunk

log reached past the open funnel and called Repository.open with the default options, which is the full record replay meant for write verbs, and did so twice for a symbolic name. On pkgsrc that was 0.94s before the first row; on the image path it is 0.05-0.10s, output byte-identical on every route. The open mode has no default any more: every direct caller declares it, so the next verb written past the funnel cannot inherit the expensive one silently. An e2e runs every log route under the derive-footprint seam and fails if any of them replays a record. check-in: 0910bc00f5 user: dmestas tags: trunk

fossil fills mlink as each check-in arrives and answers finfo by lookup. zit's derive computed the same row per check-in and dropped it; the index was rebuilt by a separate pass on the first PATH query, 6.8 min on pkgsrc and not resumable. The derive now hands each change set to an index builder as it links, stores it beside the checkpoint, and extends it over the tail on append; a cache hit computes nothing. The on-query build is the fallback and checkpoints every 8192 entries. Index format 4 records completeness so a partial checkpoint is never adopted whole. crosslink reports a tree's files instead of unknown. pkgsrc, fresh clone to first answer: 11.7 min -> 7.1 min + 1s. check-in: df99743ca4 user: dmestas tags: trunk

push --user U --password P with no URL parsed to a payload-less no_url, which the verb rebuilt as a bare empty URL, dropping the credential; the push went out anonymous and a peer requiring a login refused it. The parser now mirrors sync: an omitted URL is an empty one, resolved to the saved remote at run time, and the credential comes through. S12 asserts an authenticated no-URL push and a stored-login push both land on fossil. check-in: 4dba18d355 user: dmestas tags: trunk

push --user saved the derived secret, but the resolver returned anonymous the instant --user was absent, so autosync (which pushes with no arguments) always went anonymous and a peer requiring a login refused it. With --user absent the saved login now stands in, never prompting; --user "" still forces anonymous. push, sync and config pull share the resolver. Whether such a push lands on a fossil peer is zit#196, a separate pre-existing matter. check-in: e37768d073 user: dmestas tags: trunk

On a submanifest store every check-in is a tree manifest, which the change-set capture refused as unknown, so the index recorded the whole log as unknown and a PATH query reconstructed per check-in anyway -- 39 minutes on a pkgsrc mirror. Trees now flatten inside the diff memo through the Repository seam, so the untouched diff sees a flat list; a tree that cannot be flattened stays unknown. Index format 2 -> 3 so a stale all-unknown blob is rebuilt once. check-in: 001c73defa user: dmestas tags: trunk

A tree check-in carries its file set entirely by S cards and the card renderer had no S lane, so it printed as a manifest with no files while ls on the same hash listed thousands. One lane, in card order, checked against --raw. check-in: da2598d1ca user: dmestas tags: trunk

The v1 index recorded no coverage, so every commit threw it away and re-walked the whole log. v2 records n_rids, the entry count the index covers, and a later query walks only the tail past it. A fresh query walks the new check-ins; a repeat query walks none. check-in: 788b69f097 user: dmestas tags: trunk

std.c.getenv demands libc linkage, which this project does not take, so both Linux runners refused to compile while macOS -- which always links libc -- built it and the local gate passed. cli.Ambient.environ documents exactly this rule; the seam existed and was bypassed.

Read $ZIT_NO_FILE_INDEX in main from init.environ_map like every other seam and hand the runner a flag. Cross-compiles clean to x86_64-linux and aarch64-linux. check-in: 1317aa9864 user: dmestas tags: trunk

The predicate reconstructed a manifest per visited check-in, so one file's history on a mirror of SQLite cost minutes and grew with the history behind it. Persist what the derive already computes and throws away: captureFileFacts is Fossil's mlink row, so invert it by path into .zit-cache/finfo, keyed to the log tail and shun fingerprint like its sibling sidecars.

The PATH walk now traverses the derived adjacency, as the unfiltered walk has since #98, and the index narrows it. The index only NARROWS: an F-card-level diff over-reports a delta that restates a path with the hash it already had (one check-in in 2,113 on SQLite), so every candidate is still confirmed by the B-log-2 predicate and the output is byte-identical. --long reads one manifest per emitted row instead of per visited node.

README.md 72s to 1.6s, btree.c 25s to 1.1s, reconstructions 25,106 to 141. check-in: 17c3b0aaa2 user: dmestas tags: trunk

logChangesPath computed a check-in's effective content for PATH twice — once as `here`, once as the `parent` of the child below it — and each call re-read, re-verified and re-parsed the manifest because fileAt takes neither the walk's plaintext cache nor a baseline memo. One file's history on a mirror of SQLite took 129s.

Thread the walk's cache, a baseline memo, and an answer memo keyed by rid through the predicate, and through timeline -p, which shares the defect. Reconstructions per PATH walk fall from 2N-1 to exactly N; README.md 72s to 24s, btree.c 25s to 9s, timeline -p 16s to 7.5s, output byte-identical. check-in: 184cee5a2e user: dmestas tags: trunk

The write side of the A card. add stores the blob then the attachment artifact in one commit and prints both hashes; rm ends the association with a sourceless card; list folds latest-per-(target, name). The new attachment-size-limit setting (config key 17) caps add, fossil's semantics with a 1 MiB default. A quarry attachment stub lists as external and zit artifact describes it. Smoke S15 pushes an attachment to real fossil and reads it back from fossil's attachment table. check-in: 170a2e88d0 user: dmestas tags: trunk