Timeline

git export exports into MIRROR and remembers it, with an autopush URL, push branch and email domain, in repository config; a bare re-run does the round trip. Authors' addresses come from their user-table contact, set with the new users contact. Autopush URLs carrying a password are refused. The config payload bound is now sized from its key count. Release 0.3.34. check-in: 5fce7e867d user: dmestas tags: trunk, version-0.3.34

The rename that installs a new generation was never made durable, so a power loss after a reported success could bring the old store back, and with it content a shun had removed. The fault layer now reverts creates, renames and deletes no directory fsync made durable, and the shun sweep requires a rewrite that succeeded to survive a power cut. check-in: 3873759cfa user: dmestas tags: trunk

accept merged onto the target resolved by name at merge time, so a landing accepted meanwhile put an untested target under the merge. It now reads the target once and merges onto that check-in by hash. --expect-target HASH refuses with exit 7 and nothing written when the target is no longer at HASH. check-in: 676068f793 user: dmestas tags: trunk

Writers create .zit.lock with O_CREAT|O_EXCL before opening the store. A waiter names the holder and gives up after a minute; a dead holder's lock is broken; pack and shun --force hold the writer lock across their final check and rename. Release 0.3.33. check-in: d6cf7bf59c user: dmestas tags: trunk, version-0.3.33

import-git wrote no project code, so every sync peer and forge refused the store it made. It now derives one from the destination's absolute path, as init does, and the import request requires it. verify notes a repository with no project code without counting it as damage. check-in: add51a12d2 user: dmestas tags: trunk

It appended without the lock every other writer takes, so a concurrent commit, pull or push could overwrite its frames or have its own overwritten with valid frames nothing could detect. It now opens through openStoreAppend, which also resolves a detached worktree's store. Release 0.3.32. check-in: 2249f19056 user: dmestas tags: trunk

The artifact quota is shared with every repository on the account; a full one failed the log upload on two nights the soak passed. The log is now printed into the job output, which is kept 90 days outside the quota, and the upload no longer decides the run. check-in: 96b430bb17 user: dmestas tags: trunk

accept read the branch tip up to three times and merged it by name, so a push mid-accept could be merged unprobed. It now reads the tip once and merges that hash on both paths. --expect-tip HASH refuses with exit 6 and nothing written when the branch is no longer at HASH. Release 0.3.31. check-in: 60890d6661 user: dmestas tags: trunk, version-0.3.31

Every artifact it uploads is transit, published to the uv store and a GitHub release the day it is built. Thirty days kept ~40 MB per release against the 500 MB storage quota, and a full quota failed the soak's log upload. check-in: 29f07577ae user: dmestas tags: trunk

A Basic challenge was answered whatever the scheme, so over http the password crossed readable and the saved remote repeated it. It is now refused to non-loopback hosts, naming the https URL; a redirect to another host drops the credential; plain http to another host notes it on stderr. Release 0.3.30. check-in: b637cbd37c user: dmestas tags: trunk, version-0.3.30

A failing fuzz target is abandoned and the sweep moves on, so one recurring crash no longer hides the targets after it; the exit lists every finding. Each workflow clears its zig-local cache whole at job start once it passes 8 GB, since Zig never prunes it. check-in: 8ebc3e4dd8 user: dmestas tags: trunk

tossBitsShort added the consumed bits where it must subtract them, so a header ending one byte short tossed past the end of the input and the next peek read a wrapped length off the stack. Found by the nightly soak four nights running. Release 0.3.29. check-in: 362f18d357 user: dmestas tags: trunk, version-0.3.29

config export AREA [FILE] writes fossil's configuration export format, so an area can be backed up before import replaces it; import and merge now apply /shun cards, add-only in both modes. merge --probe with several NAMEs answers each against TARGET with the ones before it landed, holding merged files in memory and moving the merge base with the landing. Release 0.3.28. check-in: c5243e961f user: dmestas tags: trunk, version-0.3.28

The pusher's recovery from a refused push, amend --branch, was refused too. A cancel on an unheld target removes it from nothing held, so the check-in is judged where it joins, with a same-round branch move counted. A held check-in re-offered in a push is no longer judged as joining. The e2e raw-push fixture compared raw digests to hex and excluded nothing. Release 0.3.27. check-in: d4571a4b1a user: dmestas tags: trunk, version-0.3.27

The marker branch fell through to the operand slots, so it took VERSION's place and OUTPUTFILE was refused. A value option's argument is now also taken before the marker is considered. Release 0.3.26. check-in: 28cd7f506a user: dmestas tags: trunk, version-0.3.26

A bare -- ends the options in every verb; zip names are flagged UTF-8. check-in: 726efdca6b user: dmestas tags: trunk, version-0.3.25

A file whose name begins with '-' could not be named at all: passed bare it parses as a flag, and './-x.txt' parses and then matches nothing, because a path is compared literally against the check-in's file list. A forge serving such a repository answered 500 for every content route on that file. Twenty parsers already honoured the marker, including the shared flag scanner behind add, rm, commit and mv; the twenty-five with hand-written loops did not, cat among them. Each now gates its flag branches behind the marker, so operands fall through to the positional handling untouched and '-n' after '--' is a name rather than a limit. Documented as its own help topic rather than an options row in thirty-nine verbs: '--' is not a verb's option, it is the rule every verb parses by. check-in: 85a1d4bf3f user: dmestas tags: trunk

The name bytes were always correct UTF-8 and general-purpose bit 11 was never set, so a conforming reader must decode them as CP437 and a committed 'café.txt' extracted as 'caf├⌐.txt'. Both headers now take the flag from one constant: a reader trusts the central directory for metadata, so setting it on the local header alone would still ship the bug. Set unconditionally, since ASCII is a subset of UTF-8 and one value cannot disagree with itself. Content and the data-descriptor bit are unchanged. check-in: 3caf366005 user: dmestas tags: trunk

Closing a protected branch is a protected move; a damaged sync container is an error, not a crash. check-in: 3bcbc1c903 user: dmestas tags: trunk, version-0.3.24

The first nightly soak flipped one bit in a valid container and brought the process down inside the standard inflate: an integer underflow in its end-of-input bit peek that a truncated stream can arrange, reachable from any peer through every sync body. The decoder is now the tree's own copy of the standard one (Zig 0.16.0, MIT) with the comparison reordered so the stream ends, and its origin noted. With the crash gone the same bytes decoded to 58 bytes reported as good: the flip made a block final, and the zlib footer's Adler-32 was read but never checked, by the decoder or by us. The codec now requires a finished stream and verifies the footer against the output. The exact bytes are a fixed test. check-in: 46fcd75fc3 user: dmestas tags: trunk

The push gate judged tags by the branch they named, so sym-B and branch=B were refused under any sign while a closed tag, which names a check-in, was admitted: an account that could not push onto trunk could close its tip, and the owners' next commit was refused against a closed leaf with no cause named. A closed tag aimed at a held check-in now resolves that check-in's branch and is refused when the branch is protected, under any sign, saying close or reopen. A release name on the leaf, a close off the branch, and a close of an unheld target stay admitted; a resolver fault still fails closed. check-in: ff30ba16e8 user: dmestas tags: trunk

The first full nightly soak found seed 22 at 10000 steps: the crash sweep flipped a bit inside a committed config frame, the store's checksum refused to serve it, and the harness reported a config mismatch because only its content-frame path knew that refusal as detection. The config check now routes rot inside the surviving config frame to the repair, and the repair's cut keeps every frame of either kind that ended before the rot, since config frames interleave with content. check-in: 79059346bc user: dmestas tags: trunk

ReleaseSafe keeps every assert as a detector; the build that ships is ReleaseFast, where only the simulation's own state-replay oracle can catch a bug that appears when the checks are gone. The nightly now runs the same DST sweep on both builds. DST_FAST=0 skips the second. check-in: 4df2fad0e6 user: dmestas tags: trunk

The runners keep Zig's cache outside the workspace, so the find under .zig-cache came up empty and xargs handed ls no arguments: ls listed the repo root and the newest entry, src, was run as the harness. The lookup honours ZIG_LOCAL_CACHE_DIR and an empty find is a build failure. check-in: b56ed097fd user: dmestas tags: trunk

scripts/soak.sh passed the optimize flag this Zig rejects, so it has been unrunnable since the toolchain moved; it takes --release=safe now. A scheduled workflow runs it at 03:00 UTC on the x64 runner with the script's nightly budgets, overridable from the dispatch form, keeps the log and any reproduce line as an artifact, and is pinned to the ci toolchain by ci_test like the other workflows. check-in: fa78377389 user: dmestas tags: trunk

The adversarial token generator capped fields at 24 bytes, and the igot parser has required a 40- or 64-byte name since the shun work, so the parser's accept arm was unreachable and the harness's own reachability floor said so at 256 rounds. CI swept 100 rounds, below the floor, and never saw it; the first bounded soak did. One field in four is now hash-shaped, and ci sweeps every target at the floor's round count. check-in: af292c3091 user: dmestas tags: trunk

The transport answers an HTTP Basic challenge; a gated first round is no longer fatal. check-in: 2a3106fcaf user: dmestas tags: trunk, version-0.3.23

A forge that gates a read answers a clone's first request with 401. The login card cannot answer that round, since its secret needs the project code the first reply teaches, and the status was fatal, so the credential never reached the wire. When a verb holds a plaintext password the transport keeps a Basic credential ready, sends nothing until a 401 names the Basic scheme, then repeats the round with the Authorization header and carries it on every later round, as fossil's --httpauth does. A 401 now says what the peer wanted. Proven by an e2e with an authenticating gate in front of zit serve. check-in: 5f541eccc7 user: dmestas tags: trunk

clone and pull authenticate; a private repository is readable. check-in: d75c7a741d user: dmestas tags: trunk, version-0.3.22

Only push and sync signed a login, so a private repository on a forge that gates reads was unreadable by the account that owned it, and a stored login sat unused while pull read anonymously. All four verbs now resolve the login the same way: --user, the URL's user@, then the stored login. A clone holds name and password until the round-0 reply teaches the project code, then signs every later round; a refused round 0 that taught the code is retried with the login, as fossil's client does. The accepted login is stored in the clone. A URL user with no password source is a hint and goes anonymous with a note; --user without a password is an error. Smoke S17 drives a read-gated fossil. check-in: 1d5a6c8fa7 user: dmestas tags: trunk

A multi-check-in fossil push lands; --httptrace reaches a zit server. check-in: 575cd3fcdd user: dmestas tags: trunk, version-0.3.21

fossil --httptrace sends its cards uncompressed under this type, and the server refused it with a bare 415 on the premise that the reference client never sends it. The exchange now tells handleXfer whether the body is a zlib container or plain cards; the reply is framed as before, and fossil reads the reply's framing off the reply's own content type. x-fossil-uncompressed stays reply-only. check-in: cc96464a51 user: dmestas tags: trunk

fossil sends a batch of check-ins as one round with each manifest a delta against the previous one, and the scan reconstructed every pushed delta against the committed store, so the basis was never there and the round was refused as a malformed file card. Every multi-check-in push from a stock fossil failed. The scan now parks a delta whose basis is not held and settles it once the whole round is seen, to a fixpoint, so order within the round does not matter. A basis absent from both the store and the round is refused by name: error delta basis not held: TARGET against BASIS. Smoke S16 pushes three fossil check-ins in one round and checks all three landed. check-in: df556319a8 user: dmestas tags: trunk

The tracker is disposable and does not live with the source, so a number is a dangling pointer. Every zit#NN and #NN reference in code comments, test names, help text, smoke labels, identifiers, release notes and errata is replaced by enough context to stand alone, or by a short plain statement of the problem. No behaviour changed. check-in: 9033c13f21 user: dmestas tags: trunk

The ABNF and §10.1 already make every error card one fossilized TEXT; the unknown-operator prose writes "error bad command: LINE" and reads as four tokens. Records the wire form and the two-token client rule. check-in: ec7d3fc9f7 user: dmestas tags: trunk

Server error cards are encoded so a fossil client reads a refusal; remote refuses a non-URL. check-in: d11082197c user: dmestas tags: trunk

zit remote list saved the word list as the remote and reported success; the loss surfaced at the next push. The help already defines the argument as an http:// or https:// address, and the parser now holds it to that with a usage error that says there are no subcommands. A valid URL is still stored verbatim. check-in: c280025388 user: dmestas tags: trunk

The bad-command and malformed-card refusals were written with raw spaces, so on the wire they were four tokens. A stock fossil client reads an error card as two, reported the rest as unknown commands, dropped the refusal and printed its success summary; a refused push looked landed and re-sent the same artifacts on every autosync. Every error card is now assembled at one point with its text encoded, as fossil's own server writes it. A test drives each refusal through the emitter and fails on a raw space after the operator. check-in: 8f5dff81b0 user: dmestas tags: trunk

log opens once, on the zero-parse image; the open mode is declared, never defaulted. check-in: 61ae22616f user: dmestas tags: trunk, version-0.3.19

log reached past the open funnel and called Repository.open with the default options, which is the full record replay meant for write verbs, and did so twice for a symbolic name. On pkgsrc that was 0.94s before the first row; on the image path it is 0.05-0.10s, output byte-identical on every route. The open mode has no default any more: every direct caller declares it, so the next verb written past the funnel cannot inherit the expensive one silently. An e2e runs every log route under the derive-footprint seam and fails if any of them replays a record. check-in: 0910bc00f5 user: dmestas tags: trunk

A push trigger naming only a tag filter runs for tag pushes alone, so the tags-ignore alone ran nothing for two commits. branches: ['**'] restores every branch; the pin now allows exactly that form. check-in: c004c81e03 user: dmestas tags: trunk

The runners are self-hosted but checkout cleaned the workspace, so every step recompiled the same sources into its own binary from nothing; unit tests and e2e were 6 and 4 minutes on the ARM64 critical path, mostly compile. Zig's cache is content-addressed, so it now lives outside the workspace and warms across runs, in both workflows. The toolchain tarball is kept the same way and still verified against the pinned digest every run. Also pins the tag-ignore trigger the previous commit introduced, which the workflow pin test had rejected. check-in: 3106100d42 user: dmestas tags: trunk

A release tag lands on a commit whose branch push already ran ci, and the tag push ran it again on the same three single-slot runners the release workflow was queueing for. Every branch push still runs; the release workflow, triggered by the tag, gates what it ships. check-in: e9e2ba4431 user: dmestas tags: trunk

The file-history index is built by the derive at ingest, fossil's way. check-in: 09d191e634 user: dmestas tags: trunk, version-0.3.18

fossil fills mlink as each check-in arrives and answers finfo by lookup. zit's derive computed the same row per check-in and dropped it; the index was rebuilt by a separate pass on the first PATH query, 6.8 min on pkgsrc and not resumable. The derive now hands each change set to an index builder as it links, stores it beside the checkpoint, and extends it over the tail on append; a cache hit computes nothing. The on-query build is the fallback and checkpoints every 8192 entries. Index format 4 records completeness so a partial checkpoint is never adopted whole. crosslink reports a tree's files instead of unknown. pkgsrc, fresh clone to first answer: 11.7 min -> 7.1 min + 1s. check-in: df99743ca4 user: dmestas tags: trunk

A push with no URL keeps its credential; the tree-manifest index build is proportional to what changed. check-in: dbfe2adebc user: dmestas tags: trunk, version-0.3.17

Two tree check-ins were diffed by flattening both to full file lists, files-per-check-in per check-in: 34 minutes once on a pkgsrc mirror. The S-card runs are now walked side by side, skipping every sub-manifest whose hash did not move and resolving only where it did. Deletes are held to the end so a moved partition key cannot make a live file look deleted. Trees flatten on demand only for the root and flat/tree pairings; the derive feed never flattens. pkgsrc: 34.3 min -> 6.8 min. check-in: ea4abe48fd user: dmestas tags: trunk

push --user U --password P with no URL parsed to a payload-less no_url, which the verb rebuilt as a bare empty URL, dropping the credential; the push went out anonymous and a peer requiring a login refused it. The parser now mirrors sync: an omitted URL is an empty one, resolved to the saved remote at run time, and the credential comes through. S12 asserts an authenticated no-URL push and a stored-login push both land on fossil. check-in: 4dba18d355 user: dmestas tags: trunk

File index works on submanifest stores; artifact shows S cards; a saved login authenticates a push that names no user. check-in: 8cfa57ecd3 user: dmestas tags: trunk, version-0.3.16

push --user saved the derived secret, but the resolver returned anonymous the instant --user was absent, so autosync (which pushes with no arguments) always went anonymous and a peer requiring a login refused it. With --user absent the saved login now stands in, never prompting; --user "" still forces anonymous. push, sync and config pull share the resolver. Whether such a push lands on a fossil peer is zit#196, a separate pre-existing matter. check-in: e37768d073 user: dmestas tags: trunk

On a submanifest store every check-in is a tree manifest, which the change-set capture refused as unknown, so the index recorded the whole log as unknown and a PATH query reconstructed per check-in anyway -- 39 minutes on a pkgsrc mirror. Trees now flatten inside the diff memo through the Repository seam, so the untouched diff sees a flat list; a tree that cannot be flattened stays unknown. Index format 2 -> 3 so a stale all-unknown blob is rebuilt once. check-in: 001c73defa user: dmestas tags: trunk

A tree check-in carries its file set entirely by S cards and the card renderer had no S lane, so it printed as a manifest with no files while ls on the same hash listed thousands. One lane, in card order, checked against --raw. check-in: da2598d1ca user: dmestas tags: trunk

Makes the file-history index durable across commits. check-in: 37e2519ac5 user: dmestas tags: trunk, version-0.3.15