Timeline

An adversarial review found zit annotate could charge a line to the too-recent CHILD when a parent and child check-in share an identical (or non-monotone) event mtime — the chain was ordered (mtime asc, hash). Fossil orders its annotate walk by pure topology (generation number, descendants.c/diff.c), so a parent is ALWAYS processed before its child. Match that.

New repostate.ancestryLinearized runs Kahn's over the reversed (child->parent) ancestry edges within the file's ancestor set, emitting newest->oldest with a (mtime desc, hash) ready-queue among topologically-INCOMPARABLE nodes, then reverses to the engine's oldest-first order — topology is now the PRIMARY key, mtime/hash only orders incomparable versions. annotateFile consumes it in place of the old sort; the attribute engine (primary-parent pass-through, oldest origin, binary refusal, layout) is unchanged. Amends the RESOLVED annotate-attribution rule. Linear/monotone history is byte-identical (degenerates to mtime-ascending); new tests (same-mtime parent-first, non-monotone, merge primary-parent) fail against the old order. 1678 unit + 376 e2e green. check-in: ff9662dfee user: dmestas tags: cli

zit addremove [--dry-run] — checkout-layer convenience (fossil/hg parity; git add -A). ONE scan via the shipped extras.sweep (the exact untracked/exclusion walk zit extras and zit clean use) is the ADD set; every managed file absent from disk (no-follow stat, as status checks) is the REMOVE set. Both mutate the managed set through the shipped ManagedSet.insert/remove/write (write-temp + fsync + rename) — no second walker, no ad-hoc mutation. A present-but-modified file is never touched; control/never-tracked names are never added. --dry-run leaves .zit-managed byte-identical and prints the same report (ADDED block then REMOVED block, each ascending, root-relative). 1675 unit + 374 e2e green. check-in: f0dc5f4e2a user: dmestas tags: cli

Both are alternate-baseline choices inside the shipped merge machinery, per merge-flags contract B-merge-30..40 (which lifts merge.md's v1 non-goal); the flagless zit merge NAME surface is byte-identical (B-merge-31 re-asserts it).

- --cherrypick REV: three-way with base = REV's primary parent, other = REV, current = checkout (apply REV's own changes). --backout REV: base = REV, other = REV's primary parent (reverse REV). Same classifyFile/applyMerge engine; a root REV yields an empty side; zero entries refuse (B-merge-39). Flags are mutually exclusive and reject an extra positional / dirty tree. - A cherrypick/backout commit stays SINGLE-parent (REV is never a merge parent) and mints exactly one artifact 4.7.14 Q card (Q +rev / Q -rev), cleared one-shot; a plain merge keeps its two-token P card and empty Q. - The pending op is a new checkout special_op field (4th TLV, no default, threaded everywhere); undo serializes it (journal fmt v1->2) so undo unwinds a pending cherrypick/backout (B-merge-35).

B-merge-1..29 e2e all still pass. 1675 unit + 362 e2e green; fmt clean. Follow-up: B-merge-41 (zit info Q-card render line) deferred — its pinned text was absent from the plan; the Q card is already readable via zit artifact. check-in: 20bf0a31c6 user: dmestas tags: cli

zit annotate PATH — which check-in introduced each line of one tracked file at the current checkout, and when. One canonical spelling (no blame/praise). The engine walks the file's full-ancestry version chain (repostate.ancestorsOf, the same 3.3 walk merge-base/bisect use; per-version content via Repository.fileAt, the one 8 effective-set query), diffs adjacent versions with the one house line-diff core (merge3.matchLines), and pushes each line's origin back to the OLDEST version carrying it. Across a merge, a line in ANY parent side is charged to that parent (primary first, repo-state 3.2), never to the merge; the merge is charged only for lines in no parent version. Output: 10-char hash, ISO date from event mtime, the line verbatim; a binary file refuses exit 1. Reviewed adversarially (merge attribution hand-traced correct). 1673 unit + 352 e2e green. check-in: f774a1a2a7 user: dmestas tags: cli

The bisect check-in landed every edited file but not the new bisect.zig itself (committed without a prior add), so that check-in would not build from a clean checkout. Add the file; no code change. check-in: b937bca55b user: dmestas tags: cli

zit log CHECKIN [PATH]. With no PATH, behavior is byte-identical to today. With PATH, the ancestry walk emits only the check-ins that CHANGE that path: a check-in K changes PATH iff PATH's effective content (via Repository.fileAt, the one artifact 8 effective-set query — no CLI-side F-card re-derivation) differs from PATH's content in K's PRIMARY parent (first-listed P card, repo-state 3.2). Presence flips count (root add, delete, rename departure/arrival as delete+add, no old-name following); equal hashes are no change; a phantom parent reads as absent. walkLog gained an optional filter; the null path preserves the shipped DFS verbatim. The finfo/log split was historical accident, not design — one deep log replaces a shallow sibling, no new verb. 1661 unit + 343 e2e green; fmt clean. check-in: 6a360f33ff user: dmestas tags: cli

zit bisect bad NAME | good NAME | next | status | reset. Marking bad/good moves the checkout to the next probe automatically (fossil parity); next re-announces it; reset restores. The candidate set (full-ancestry ancestors of bad minus the good ancestor-sets minus skipped), the lower-median probe by ascending event-mtime with hash tiebreak, and the culprit are ONE general-purpose repostate query RepoState.bisectSpan, composed from collectAncestors / mergeBaseOf / isAncestorOf / mtimeOf / hashOf per the RESOLVED bisect-midpoint rule (repo-state 2/3.2/3.3/8.3) — the CLI never walks ancestry. Bisection state is checkout-local in .zit-bisect on the undo.zig state-file tier (atomic write + fsync, magic/CRC frame, corrupt -> exit 1), in the never-tracked/extras set; probe/culprit/reset moves go through the journal-armed update.applyCheckin behind requireCleanTree. Refusals (inverted marks, unrelated histories) exit 1. 1661 unit + 339 e2e green; fmt clean. check-in: 343d41b2f3 user: dmestas tags: cli

zit artifact HASH [--raw] — zit's cat-file/whatis. No flag: a whatis summary (hash, structural type per artifact 5.1/5.3, size, one line per A..W card in stored order, and the 6.2 Z self-checksum verdict). A blob reports type file, size, and binary-or-not. --raw emits the verbatim stored bytes. Resolves a 4-64 hex prefix over the LogStore (ambiguous -> exit 1), reads via the existing 7.2 blob path. Everything shown comes from the ONE existing artifact parser — refactored into frameNoZ/frame/assemble with a Z-tolerant parseWindow — never a CLI-side re-parse. 1649 unit + 335 e2e (13 new B-artifact) green; fmt clean. check-in: f477c3bf19 user: dmestas tags: cli

zit amend NAME [--comment TEXT] [--user NAME] [--date ISO] [--branch NAME] mints ONE control artifact whose T cards change how the target check-in displays — comment, user, date, and the repo-state 6.2 branch-move set — retargeted at the check-in hash, never '*'. History stays append-only: the original manifest is untouched and a new control artifact is crosslinked in (artifact 4.7.16 T / 4.7.5 D / 4.7.17 U / 4.7.19 Z; repo-state 4/5 crosslink, 5 tag propagation). Display is honored through a new general RepoState.activeTagValue / Repository.override consumed by timeline and info.

Also removes amend from the git-reflex rejection table: teaching against fossil-semantics amend with the immutability lesson conflated it with git's history-rewriting amend — amend is in fact the proof of zit's immutability, not a violation. 1643 unit + 322 e2e (15 new B-amend) green; fmt clean. check-in: 6c6d1babc2 user: dmestas tags: cli

The prior cli leaf was a closed integration point from before the recent slice; this reopens cli development at current trunk (timeline, mv, undo/redo, extras, clean, merge all present). The next verb slice — bisect, annotate, amend, artifact, addremove per the VCS verb survey — builds here and converges on cli, then one merge cli -> trunk. check-in: 9b5605ad79 user: dmestas tags: cli

Completes the checkout-and-history CLI slice — merge is the sixth and final verb (after timeline, mv, undo/redo, extras, clean). Line-based three-way merge into the working tree with fossil-style conflict markers, a mtime-independent up-to-date/ancestry gate, and a commit that mints the primary-first two-token P card and refuses while any marker remains. 1629 unit + 307 e2e green; dst 6x1000. check-in: c2c837c5e1 user: dmestas tags: trunk

zit merge NAME computes a three-way merge of NAME (other) into the current checkout and records the merge parent; commit then mints the two-token P card. Built from the RFC oracle + the RESOLVED merge-base and conflict-model rules.

- merge3.zig: a pure diff3 line engine + per-path classifier (no I/O, injected allocator, error{OutOfMemory}). Both-modified binary, add-vs-add, and modify-vs-delete are whole-file conflicts by construction, never laundered through the line merger (artifact §8.2; B-merge-21). Seeded-deterministic fuzz. - repostate.mergeBaseOf: the merge base over full ancestry (§3.3, merge parents included) — greatest event.mtime, ties by least artifact hash (§2/§8.3, the RESOLVED merge-base rule). repostate.isAncestorOf: a pure, mtime-independent full-ancestry membership test — the authoritative up-to-date gate, so a same-mtime ancestor can never slip the refusal. - merge verb: resolve NAME (§8, one resolver), refuse (exit 1, nothing mutated) a dirty tree / a pending merge / an up-to-date or unrelated NAME; else classify each §8.2 merge-walk path and materialize transactionally via update.applyMerge (journal + checkout written before the first byte moves). Conflicts write fossil-style markers, name each path on stderr, exit 1, and still record the pending merge; zit undo unwinds it (B-merge-13). - commit: with a merge pending, scan the committed set for the conflict sentinel and refuse until resolved (no override); otherwise emit the primary-first two-token P card and clear the merge one-shot (§4.7.13; B-merge-8/9).

v1 non-goals held: no rename-aware, binary-content, cherrypick, or octopus merge. 1629 unit + 307 e2e green; dst 6x1000; fossil interop unaffected. closed check-in: 6bdb918f18 user: dmestas tags: merge-verb

Two untracked-file management verbs over one shared control-name/sweep module (artifact §8 never-tracked superset; the .zit control files and derived sidecars are the exclusion set):

- extras: list files present in the working tree but not in the managed set and not control/derived files — the untracked surface, one path per line. - clean: remove those extras from the working tree, refusing to touch any tracked or control file; the sweep propagates allocation failure without leaking and never crashes on a hostile tree (fuzzed).

Slice tail: merge remains unshipped (its plan/implement agent repeatedly lost its API connection mid-response this session). Full unit + e2e (290/290) green on the merged trunk. check-in: bbfa0715f0 user: dmestas tags: trunk

Three checkout-and-history CLI verbs, each built to its B-verb contract and RFC oracle, each gated green (unit + e2e) before commit:

- timeline: list every check-in newest-first by event.mtime with an ascending full-hash tiebreak (repo-state §2, §8.3 item 7), merge check-ins marked M (§3.2), each on its branch with the configured main-branch fallback (§6.1/§6.4). - mv OLD NEW: rename a tracked file, moving it on disk and swapping the managed entry atomically; refuses (exit 1) an untracked OLD, an existing/tracked NEW, or a self-move; the rename records a one-shot NEW three-token on the next commit. - undo / redo: journal each sheltered mutation's pre-image (fsynced before the mutation) so update/revert are reversible; a corrupt or empty journal is a clean exit 1 with no partial restore.

Slice partial: extras, clean, and merge were not completed this run. Full unit + e2e green on the merged trunk. check-in: 89ef496c3b user: dmestas tags: trunk

Two independent slices recovered from an interrupted session, each gated green.

- Sync now dispatches on method + Content-Type at any URL path (§4 L759-764), so a stock 'fossil clone http://host:port/' at the bare root interoperates; the /xfer-only requirement and its 404 are gone. - 'zit log' is reduced to the signed one-verb surface: one check-in ID, help only, no -n windowing; usage errors exit 2, a bad ID exits 1.

Unit + e2e (209/209) green; fmt clean; dst 6x1000 ok. check-in: dbb2735bff user: dmestas tags: trunk

'zit log' carried a -n K windowed-log flag: an extra grammar mode (a state machine with a positional-only '--' separator and a -n value token in either order) and a bad_count offense, for a bound no other query verb exposes. Its sibling 'update' already documents the target shape — one full check-in ID, help only, no windowing.

Collapse log onto that same one-positional grammar. parseLogArgs is now the plain scan parseUpdateArgs uses: -h/--help wins; -n, --all, and a bare '--' are all unknown options (log has no positional-only separator); a second positional is an extra argument. Drop LogArgs.count, the bad_count variant, parseLogCount, and walkLog's max_count / window early-exit — the ancestry walk is unconditionally unbounded again.

Usage errors (missing check-in, unknown option, extra argument) now exit 2 via cli.usageError; a well-formed-but-non-canonical ID stays a validation failure at exit 1. Help and 'zit help log' print the trimmed single-verb text. Net -110 lines. Unit + e2e (209/209) green; fmt clean; dst 6x1000 ok. closed check-in: 0973cf7e9e user: dmestas tags: recover-inflight

A conformant Fossil client POSTs sync to the repository URL path unchanged and MUST NOT append /xfer (sync §4 L759-764): a bare 'fossil clone http://host:port/' POSTs to "/". The server previously required the /xfer path and answered 404 for anything else, so a root-URL clone from a stock client failed.

Drop the path from the dispatch decision entirely. classifyXfer now keys only on method (POST) and a request-valid, outer-compressed Content-Type (application/x-fossil); the URL path is accepted but unused. Remove xfer_path, requestPath, and the not_found/404 disposition; Disposition collapses to ok / method_not_allowed / unsupported_media_type. A non-POST stays 405 rather than a home redirect this sync-only server can't honor (and a 302 to "/" would loop now that "/" is a valid endpoint).

The over-real-HTTP e2e clone now targets the bare root "/" to prove a root-URL client interoperates. Unit + e2e green; fmt clean. check-in: 9636157a85 user: dmestas tags: recover-inflight

The clone/sync receive path inflated every stored cfile container to prove the RFC1950 stream was intact (§3.9), then threw the result away: the store keeps the container verbatim and reconstructs lazily, and the persist commit hook runs the §7.7 integrity check on the reconstructed bytes. For the full form that inflate was pure waste. Move the decode into the delta branch (which genuinely needs the plaintext to reconstruct) so a full-form cfile is interned and retained without inflating.

Retaining an unvalidated container means a held artifact is no longer guaranteed reconstructable: content() can be null for a corrupt wire-backed container, so held() no longer implies content(). Reconcile the consumers that assumed it did. The pull .raw delta basis and the push upload path both degrade gracefully (round abort / silent skip) instead of tripping an unreachable or assert on hostile input; the read/derivation path keeps the decompression-bomb cap, and the eager clone-end image treats a corrupt container as an error.

Cuts clone peak RSS ~13% (651 -> 568 MB) on the fossil corpus by dropping the discarded plaintext allocation. Instruction count and wall are flat, since full-form cfiles are the minority of clone content. 1538 tests pass; fossil interop smoke green. closed check-in: d91a3cfe42 user: dmestas tags: clone-w4