Timeline

git export exports into MIRROR and remembers it, with an autopush URL, push branch and email domain, in repository config; a bare re-run does the round trip. Authors' addresses come from their user-table contact, set with the new users contact. Autopush URLs carrying a password are refused. The config payload bound is now sized from its key count. Release 0.3.34. check-in: 5fce7e867d user: dmestas tags: trunk, version-0.3.34

The rename that installs a new generation was never made durable, so a power loss after a reported success could bring the old store back, and with it content a shun had removed. The fault layer now reverts creates, renames and deletes no directory fsync made durable, and the shun sweep requires a rewrite that succeeded to survive a power cut. check-in: 3873759cfa user: dmestas tags: trunk

accept merged onto the target resolved by name at merge time, so a landing accepted meanwhile put an untested target under the merge. It now reads the target once and merges onto that check-in by hash. --expect-target HASH refuses with exit 7 and nothing written when the target is no longer at HASH. check-in: 676068f793 user: dmestas tags: trunk

Writers create .zit.lock with O_CREAT|O_EXCL before opening the store. A waiter names the holder and gives up after a minute; a dead holder's lock is broken; pack and shun --force hold the writer lock across their final check and rename. Release 0.3.33. check-in: d6cf7bf59c user: dmestas tags: trunk, version-0.3.33

import-git wrote no project code, so every sync peer and forge refused the store it made. It now derives one from the destination's absolute path, as init does, and the import request requires it. verify notes a repository with no project code without counting it as damage. check-in: add51a12d2 user: dmestas tags: trunk

LogStore.open now takes the exclusive lock before it reads the file's length and scans for the end, and a read-only handle refuses to append. purge undo opens the store through the shared writer path.

A new DST sweep runs two to four writers interleaved against one log through a file that models the lock. It flags unlocked or misplaced appends as they happen, checks each writer sees everything committed before it locked and reads back its own writes, including deltas. A source check fails on any write-mode open of the store outside openStoreAppend. An e2e test races commits, tags and user-table writes on one store and counts what landed. check-in: 5c445bb3f3 user: dmestas tags: trunk, version-0.3.32

It appended without the lock every other writer takes, so a concurrent commit, pull or push could overwrite its frames or have its own overwritten with valid frames nothing could detect. It now opens through openStoreAppend, which also resolves a detached worktree's store. Release 0.3.32. check-in: 2249f19056 user: dmestas tags: trunk

The artifact quota is shared with every repository on the account; a full one failed the log upload on two nights the soak passed. The log is now printed into the job output, which is kept 90 days outside the quota, and the upload no longer decides the run. check-in: 96b430bb17 user: dmestas tags: trunk

accept read the branch tip up to three times and merged it by name, so a push mid-accept could be merged unprobed. It now reads the tip once and merges that hash on both paths. --expect-tip HASH refuses with exit 6 and nothing written when the branch is no longer at HASH. Release 0.3.31. check-in: 60890d6661 user: dmestas tags: trunk, version-0.3.31

Every artifact it uploads is transit, published to the uv store and a GitHub release the day it is built. Thirty days kept ~40 MB per release against the 500 MB storage quota, and a full quota failed the soak's log upload. check-in: 29f07577ae user: dmestas tags: trunk

A Basic challenge was answered whatever the scheme, so over http the password crossed readable and the saved remote repeated it. It is now refused to non-loopback hosts, naming the https URL; a redirect to another host drops the credential; plain http to another host notes it on stderr. Release 0.3.30. check-in: b637cbd37c user: dmestas tags: trunk, version-0.3.30

A failing fuzz target is abandoned and the sweep moves on, so one recurring crash no longer hides the targets after it; the exit lists every finding. Each workflow clears its zig-local cache whole at job start once it passes 8 GB, since Zig never prunes it. check-in: 8ebc3e4dd8 user: dmestas tags: trunk

tossBitsShort added the consumed bits where it must subtract them, so a header ending one byte short tossed past the end of the input and the next peek read a wrapped length off the stack. Found by the nightly soak four nights running. Release 0.3.29. check-in: 362f18d357 user: dmestas tags: trunk, version-0.3.29

config export AREA [FILE] writes fossil's configuration export format, so an area can be backed up before import replaces it; import and merge now apply /shun cards, add-only in both modes. merge --probe with several NAMEs answers each against TARGET with the ones before it landed, holding merged files in memory and moving the merge base with the landing. Release 0.3.28. check-in: c5243e961f user: dmestas tags: trunk, version-0.3.28

The pusher's recovery from a refused push, amend --branch, was refused too. A cancel on an unheld target removes it from nothing held, so the check-in is judged where it joins, with a same-round branch move counted. A held check-in re-offered in a push is no longer judged as joining. The e2e raw-push fixture compared raw digests to hex and excluded nothing. Release 0.3.27. check-in: d4571a4b1a user: dmestas tags: trunk, version-0.3.27

The marker branch fell through to the operand slots, so it took VERSION's place and OUTPUTFILE was refused. A value option's argument is now also taken before the marker is considered. Release 0.3.26. check-in: 28cd7f506a user: dmestas tags: trunk, version-0.3.26

A bare -- ends the options in every verb; zip names are flagged UTF-8. check-in: 726efdca6b user: dmestas tags: trunk, version-0.3.25

A file whose name begins with '-' could not be named at all: passed bare it parses as a flag, and './-x.txt' parses and then matches nothing, because a path is compared literally against the check-in's file list. A forge serving such a repository answered 500 for every content route on that file. Twenty parsers already honoured the marker, including the shared flag scanner behind add, rm, commit and mv; the twenty-five with hand-written loops did not, cat among them. Each now gates its flag branches behind the marker, so operands fall through to the positional handling untouched and '-n' after '--' is a name rather than a limit. Documented as its own help topic rather than an options row in thirty-nine verbs: '--' is not a verb's option, it is the rule every verb parses by. check-in: 85a1d4bf3f user: dmestas tags: trunk

The name bytes were always correct UTF-8 and general-purpose bit 11 was never set, so a conforming reader must decode them as CP437 and a committed 'café.txt' extracted as 'caf├⌐.txt'. Both headers now take the flag from one constant: a reader trusts the central directory for metadata, so setting it on the local header alone would still ship the bug. Set unconditionally, since ASCII is a subset of UTF-8 and one value cannot disagree with itself. Content and the data-descriptor bit are unchanged. check-in: 3caf366005 user: dmestas tags: trunk