Timeline

log opens once, on the zero-parse image; the open mode is declared, never defaulted. check-in: 61ae22616f user: dmestas tags: trunk, version-0.3.19

log reached past the open funnel and called Repository.open with the default options, which is the full record replay meant for write verbs, and did so twice for a symbolic name. On pkgsrc that was 0.94s before the first row; on the image path it is 0.05-0.10s, output byte-identical on every route. The open mode has no default any more: every direct caller declares it, so the next verb written past the funnel cannot inherit the expensive one silently. An e2e runs every log route under the derive-footprint seam and fails if any of them replays a record. check-in: 0910bc00f5 user: dmestas tags: trunk

A push trigger naming only a tag filter runs for tag pushes alone, so the tags-ignore alone ran nothing for two commits. branches: ['**'] restores every branch; the pin now allows exactly that form. check-in: c004c81e03 user: dmestas tags: trunk

The runners are self-hosted but checkout cleaned the workspace, so every step recompiled the same sources into its own binary from nothing; unit tests and e2e were 6 and 4 minutes on the ARM64 critical path, mostly compile. Zig's cache is content-addressed, so it now lives outside the workspace and warms across runs, in both workflows. The toolchain tarball is kept the same way and still verified against the pinned digest every run. Also pins the tag-ignore trigger the previous commit introduced, which the workflow pin test had rejected. check-in: 3106100d42 user: dmestas tags: trunk

A release tag lands on a commit whose branch push already ran ci, and the tag push ran it again on the same three single-slot runners the release workflow was queueing for. Every branch push still runs; the release workflow, triggered by the tag, gates what it ships. check-in: e9e2ba4431 user: dmestas tags: trunk

The file-history index is built by the derive at ingest, fossil's way. check-in: 09d191e634 user: dmestas tags: trunk, version-0.3.18

fossil fills mlink as each check-in arrives and answers finfo by lookup. zit's derive computed the same row per check-in and dropped it; the index was rebuilt by a separate pass on the first PATH query, 6.8 min on pkgsrc and not resumable. The derive now hands each change set to an index builder as it links, stores it beside the checkpoint, and extends it over the tail on append; a cache hit computes nothing. The on-query build is the fallback and checkpoints every 8192 entries. Index format 4 records completeness so a partial checkpoint is never adopted whole. crosslink reports a tree's files instead of unknown. pkgsrc, fresh clone to first answer: 11.7 min -> 7.1 min + 1s. check-in: df99743ca4 user: dmestas tags: trunk

A push with no URL keeps its credential; the tree-manifest index build is proportional to what changed. check-in: dbfe2adebc user: dmestas tags: trunk, version-0.3.17

Two tree check-ins were diffed by flattening both to full file lists, files-per-check-in per check-in: 34 minutes once on a pkgsrc mirror. The S-card runs are now walked side by side, skipping every sub-manifest whose hash did not move and resolving only where it did. Deletes are held to the end so a moved partition key cannot make a live file look deleted. Trees flatten on demand only for the root and flat/tree pairings; the derive feed never flattens. pkgsrc: 34.3 min -> 6.8 min. check-in: ea4abe48fd user: dmestas tags: trunk

push --user U --password P with no URL parsed to a payload-less no_url, which the verb rebuilt as a bare empty URL, dropping the credential; the push went out anonymous and a peer requiring a login refused it. The parser now mirrors sync: an omitted URL is an empty one, resolved to the saved remote at run time, and the credential comes through. S12 asserts an authenticated no-URL push and a stored-login push both land on fossil. check-in: 4dba18d355 user: dmestas tags: trunk

File index works on submanifest stores; artifact shows S cards; a saved login authenticates a push that names no user. check-in: 8cfa57ecd3 user: dmestas tags: trunk, version-0.3.16

push --user saved the derived secret, but the resolver returned anonymous the instant --user was absent, so autosync (which pushes with no arguments) always went anonymous and a peer requiring a login refused it. With --user absent the saved login now stands in, never prompting; --user "" still forces anonymous. push, sync and config pull share the resolver. Whether such a push lands on a fossil peer is zit#196, a separate pre-existing matter. check-in: e37768d073 user: dmestas tags: trunk

On a submanifest store every check-in is a tree manifest, which the change-set capture refused as unknown, so the index recorded the whole log as unknown and a PATH query reconstructed per check-in anyway -- 39 minutes on a pkgsrc mirror. Trees now flatten inside the diff memo through the Repository seam, so the untouched diff sees a flat list; a tree that cannot be flattened stays unknown. Index format 2 -> 3 so a stale all-unknown blob is rebuilt once. check-in: 001c73defa user: dmestas tags: trunk

A tree check-in carries its file set entirely by S cards and the card renderer had no S lane, so it printed as a manifest with no files while ls on the same hash listed thousands. One lane, in card order, checked against --raw. check-in: da2598d1ca user: dmestas tags: trunk

Makes the file-history index durable across commits. check-in: 37e2519ac5 user: dmestas tags: trunk, version-0.3.15

The v1 index recorded no coverage, so every commit threw it away and re-walked the whole log. v2 records n_rids, the entry count the index covers, and a later query walks only the tail past it. A fresh query walks the new check-ins; a repeat query walks none. check-in: 788b69f097 user: dmestas tags: trunk

The negative-space pin requires every build.zig step to be either invoked by CI or listed with the reason it is not. The cross step was neither, so it failed all three runners -- the pin doing exactly its job on the commit that added an unregistered step.

CI compiles the real thing on all three shipped targets, so cross-compiling them again proves nothing new; the step is for the developer, before the push. Recorded as such. check-in: 770e641725 user: dmestas tags: trunk

This project links no libc and macOS links libc always, so a call that demands it compiles on a mac, passes every local lane, and refuses on both Linux runners -- the discovery order the fmt check already exists to prevent, and what zit#188 spent a red main on.

`zig build cross` compiles the CLI for x86_64-linux and aarch64-linux and runs nothing; gate depends on it. Verified to discriminate: reintroducing std.c.getenv fails cross while a plain macOS build still passes. check-in: 31c4850b95 user: dmestas tags: trunk

std.c.getenv demands libc linkage, which this project does not take, so both Linux runners refused to compile while macOS -- which always links libc -- built it and the local gate passed. cli.Ambient.environ documents exactly this rule; the seam existed and was bypassed.

Read $ZIT_NO_FILE_INDEX in main from init.environ_map like every other seam and hand the runner a flag. Cross-compiles clean to x86_64-linux and aarch64-linux. check-in: 1317aa9864 user: dmestas tags: trunk

The predicate reconstructed a manifest per visited check-in, so one file's history on a mirror of SQLite cost minutes and grew with the history behind it. Persist what the derive already computes and throws away: captureFileFacts is Fossil's mlink row, so invert it by path into .zit-cache/finfo, keyed to the log tail and shun fingerprint like its sibling sidecars.

The PATH walk now traverses the derived adjacency, as the unfiltered walk has since #98, and the index narrows it. The index only NARROWS: an F-card-level diff over-reports a delta that restates a path with the hash it already had (one check-in in 2,113 on SQLite), so every candidate is still confirmed by the B-log-2 predicate and the output is byte-identical. --long reads one manifest per emitted row instead of per visited node.

README.md 72s to 1.6s, btree.c 25s to 1.1s, reconstructions 25,106 to 141. check-in: 17c3b0aaa2 user: dmestas tags: trunk

logChangesPath computed a check-in's effective content for PATH twice — once as `here`, once as the `parent` of the child below it — and each call re-read, re-verified and re-parsed the manifest because fileAt takes neither the walk's plaintext cache nor a baseline memo. One file's history on a mirror of SQLite took 129s.

Thread the walk's cache, a baseline memo, and an answer memo keyed by rid through the predicate, and through timeline -p, which shares the defect. Reconstructions per PATH walk fall from 2N-1 to exactly N; README.md 72s to 24s, btree.c 25s to 9s, timeline -p 16s to 7.5s, output byte-identical. check-in: 184cee5a2e user: dmestas tags: trunk

The write side of the A card. add stores the blob then the attachment artifact in one commit and prints both hashes; rm ends the association with a sourceless card; list folds latest-per-(target, name). The new attachment-size-limit setting (config key 17) caps add, fossil's semantics with a 1 MiB default. A quarry attachment stub lists as external and zit artifact describes it. Smoke S15 pushes an attachment to real fossil and reads it back from fossil's attachment table. check-in: 170a2e88d0 user: dmestas tags: trunk

Once a pull finds 100 or more held artifacts no cluster names, fold them into cluster artifacts — sorted, 800 M cards each, md5 Z — at fossil's create_cluster point and thresholds. They persist with the round and extend the index; the next reply announces the clusters, not the members. A zit-born repository clusters itself the first time anyone pulls from it: 161 artifacts, one cluster, 201 bytes on the next pull. check-in: 10c905d27b user: dmestas tags: trunk

A pull or push announced every held artifact with igot, every round — 1.25M lines, ~63 MB per direction on pkgsrc. Clusters are igot in bulk: index the held clusters (.zit-cache/clusters, keyed to the log prefix, kept warm by persist), announce held minus what they name, seed the promises they made that this repository never collected, absorb pushed clusters server-side so the reply begs for their members, and honour send-catalog (full inventory) and req-clusters (enclosed cluster igots). A no-op pkgsrc pull now sends 4.7 KB. Cluster promises the peer cannot keep are a warning, not a failed pull. No format changed. check-in: e1ca72a8ef user: dmestas tags: trunk

A pull walked every held artifact in persistStore, reading each once from the lazy disk-backed holdings store just to early-return it: 194s of a 197s no-op pull at 1.25M artifacts, reconstructing nothing. Received artifacts are appended beyond the holdings' log-backed prefix, so persist now begins the walk there and processes only the received set. A no-op pull persists nothing; an incremental pull persists what it received, not the millions it already holds. No-op pkgsrc pull 209s to 7s. check-in: a25dcf28f5 user: dmestas tags: trunk

emitReply walked every held rid and, for each, linear-scanned the peer's announced list to suppress a redundant igot — O(held × announced), so a no-op pull where both sides hold everything cost 760 s of server CPU at 1.25M artifacts. Build the announced/requested names into one set per reply and probe it once per rid. ZIT reports the probe count; a test pins it to the held count at two sizes regardless of what the peer announced. check-in: a93f014321 user: dmestas tags: trunk

One bit per log frame in .zit-cache/dispositions: crosslink-relevant or not. A full derive consults it and never reconstructs the file blobs and SUBMANIFEST tree nodes that were most of a wide store's walk; the walk distills a fresh map either way. Same trust tier as the log-scan index: self-checksummed, keyed to a validated log prefix, stamped with the shun fingerprint, absent on any doubt. pkgsrc submanifest cold derive 302 s to 22 s; a consuming derive's body is byte-identical, pinned by test. check-in: a18d2edd67 user: dmestas tags: trunk

repocache.store and checkpoint.store concatenated header + body + image into a full resident copy before writing; both now stream the pieces to the file with the checksum folded incrementally, byte-identical output. The clone path frees its view before the reopen builds a second derived state. ZIT_DERIVE_FOOTPRINT reports the derive body's composition. pkgsrc cold open: peak RSS 2.32 GB to 2.07 GB. check-in: 3107e23e24 user: dmestas tags: trunk

A dense clone no longer holds the repository in memory until the exchange ends: each round's artifacts land in the log and their resident bytes are released, the shape of git's index-pack. A delta whose basis has not arrived defers on its hash; a basis first seen as a phantom is revisited when its content lands. Cone-scoped clones keep the batched pass, whose keep set needs the converged store. Streamed and batched logs are byte-identical, pinned by test. ZIT_PERSIST_WAITING reports the drain's peak deferred set. check-in: 533b0a6490 user: dmestas tags: trunk

Fossil-dialect globs treat ! as a class member; only ^ negates. open reads a versioned-only manifest setting out of the check-in and remembers --manifest=off so update cannot re-enable stamps. add --force adds a named ignore-glob match; directory expansion always honours ignore and clean globs. .fos root names compare case-sensitively on Linux. check-in: b7e077e430 user: dmestas tags: trunk

The crosslink record now carries each changed file's artifact hash (fossil's mlink shape), so annotate reads blobs by hash instead of re-deriving every manifest on the walk. merge3 moves to a linear-space Myers LCS and annotate caches plaintext and baselines across versions. Repocache format 5, checkpoint format 5: the first open after upgrading re-derives. Help states the 12-character prefix annotate actually prints. check-in: a6c2215859 user: dmestas tags: trunk

The crosslink record, the state and the image now carry each check-in's Q cards (sign and target), so the cherrypick/backout line needs no manifest read. Record format 4, image layout 7. info NAME 16 ms to 6 ms on libspatialite, level with leaves; output unchanged. check-in: adb05cc14e user: dmestas tags: trunk

A cache whose image is absent or at an old layout replayed the record body on every fast_read open, since only a miss stored. The hit now serializes the image from the view it just built and stores it, so the fallback is paid once. check-in: 98c5d6c61a user: dmestas tags: trunk

The image has carried adjacency since layout 2 and comment/login since layout 6, so every default row renders from the zero-parse path; only full/-v/-p still read manifests. 60 ms to 8 ms on a 22k check-in store, output byte-identical across formats. check-in: 18ffce5678 user: dmestas tags: trunk

One record scan, as annotate, instead of a manifest per check-in: 20,937 reads to 272 on VERSION, 19s to 0.4s. Each version is reported once under its oldest introducer, matching fossil grep's list byte for byte. check-in: 6be0341149 user: dmestas tags: trunk

A front web server that appends "; charset=utf-8" made the clone reply look compressed, so its plaintext was read as a 1.6 GB container and refused as too large. parseMediaType now ignores parameters and case, as fossil does; serve uses it instead of its own copy. check-in: 8488af309e user: dmestas tags: trunk, version-0.3.6

Glob lists follow Fossil's tokenizer and '#' comment lines; crnl-glob, clean-glob, empty-dirs, encoding-glob, dotfiles and mimetypes work at every tier. Dotfiles are hidden by default and Fossil's checkout-state names are never listed. UTF-16 and invalid UTF-8 classify as Fossil's lookslike.c does; tokenizer rules from glob.c. check-in: 982afa3d8f user: dmestas tags: trunk

Every ancestor cost a manifest read and a full-file line diff — ~36k of each on SQLite where ~400 touched the file. The cache records already say who changed PATH (their diff is against the primary parent, so unlisted means byte-equal there): untouched ancestors inherit the parent's content pointer, the engine copies the parent's origins on pointer-identity, and the LCS trims the common prefix/suffix before its O(n*m) table.

Unfinishable on SQLite before; 0.5-1.2s typical, 57s for a 15k-line heavily-edited file (the multi-hunk quadratic middle remains — a real diff core is the named follow-up). Attribution of a repeated line between equally-valid origins can shift, as any LCS tiebreak may.

zit#172 check-in: 22bdf84fd3 user: dmestas tags: trunk

The default-format timeline inflated a manifest per row — the fetch condition still said 'a.format != .oneline' from when oneline was the default, so zit#170's medium default made every row read one for two strings the image now carries. 66.5s to 0.37s for the full SQLite timeline, output identical.

Repository.manifest counts its reads (ZIT_MANIFEST_READS=1 reports on exit), and an e2e runs ten listings over two history sizes and requires identical counts — a per-row reader fails by construction, no timing, no constants.

zit#172 check-in: 09fa1a7fb3 user: dmestas tags: trunk

zit leaves read and parsed a whole manifest per row — through its delta chain — for the comment's first line and the login. A warm store is image-backed and the image carried neither, so commentOf answered null and every row fell back to that read: 472 leaves, one second, on sqlite.

The image now materializes both: the comment CSR-addressed per rid, the login interned (a repository has a handful of committers). layout_version 6 — an older image is a miss and rebuilds, as the disposable cache intends.

0.3.2. check-in: 71d327a695 user: dmestas tags: trunk, version-0.3.2

The derive built the complete effective file list for every check-in and its parent, then compared them — O(files) per check-in, which on pkgsrc is 100k entries twice over, 305k times. Fossil's add_mlink merges the two deltas' own F cards and seeks the shared baseline; do the same, and walk the lists side by side when the baselines differ instead of materializing them. Keeps recently-read manifests parsed, pinned while a step holds them.

zit#172 check-in: 669593f624 user: dmestas tags: trunk

Twelve-character hashes and the weekday in day headers and leaf lines are the departures; -F oneline keeps the one-line timeline for scripts. check-in: 16c197b4dc user: dmestas tags: trunk

Twelve-character names and the weekday in the times are the only departures from Fossil's shape. cli.shortHash and cli.humanTime are the primitives the rest of the terminal-speech work builds on. check-in: d72b6372ab user: dmestas tags: trunk

Both found by running one session through fossil and zit side by side. check-in: a0690841c1 user: dmestas tags: trunk

A bare 'zit update' was a usage error; Fossil's means --latest. check-in: b618fc675d user: dmestas tags: trunk

The converter's hints are the source's own chains and each manifest's parent, so one delta usually settles it; the best-of-N window is the fallback. Conversion is now faster than the old convert-then-pack. check-in: 598d040de5 user: dmestas tags: trunk

Blobs take the flat source's own delta base as the hint, manifests their parent, carried artifacts the recent window. A 28x full-form gap on a toy corpus became 1.3x of packed, with no second pass and no double-disk peak. check-in: 38b9743ff8 user: dmestas tags: trunk

Fossil parity on the everyday verbs, landings and strata, protected branches behind a trusted front, Fossil's user table, and the read paths that now scale with the change rather than the store. check-in: 1e2a7bbc0d user: dmestas tags: trunk, version-0.3.0

Runs quarry ui on the checkout root with the terminal inherited; the binary comes from ZIT_QUARRY or PATH, and an absent one is a three-line pointer, exit 1. check-in: 95553946e3 user: dmestas tags: trunk

--by writes a side-by-side page under $TMPDIR and opens it from a terminal; -F html renders the timeline as a table; ui names quarry's local mode and exits 1 until it exists. check-in: 87f4be2914 user: dmestas tags: trunk

The two new settings ride the keyed config block; a configured editor makes commit editor-capable without a terminal. check-in: 7d9dcb2de1 user: dmestas tags: trunk

--merge three-way merges a stashed change into a dirty file; conflicts get markers, are listed, and exit 5 with the entry kept. check-in: 21ce2c785d user: dmestas tags: trunk

The checkout record carries the integrated leaf's hash as an optional sixth field; commit closes it with the same control artifact branch close mints. check-in: 2a522aab40 user: dmestas tags: trunk

-Z is -w; -N is accepted (an added file's hunks already carry it all). check-in: 39c88046ab user: dmestas tags: trunk

The managed set records one pending rename per moved file. mv moves files into a directory or a tracked directory as a unit, --soft records without moving, -n previews. revert -r VERSION restores another check-in's content; revert/undo/redo -n name what they would touch. add -f takes ignored files; clean gains -n/-f and --emptydirs. check-in: ece16d74a9 user: dmestas tags: trunk

branch new/close/reopen/hide/unhide/current/info. clone DIR defaults from the URL and is followed by open (--no-open keeps the bare store); open URL delegates to clone. check-in: 5d2f9a7e6e user: dmestas tags: trunk

timeline gains -b/-c/-p/-u filters, -r and --offset, -F medium|full (a date header per day, *CURRENT* on the checkout's check-in, user and tags) and -v for changed files; the default line is unchanged. status gains --classify (Fossil's words, aligned), --added/--edited/--missing/--conflict/--extra/ --differ filters, -v's header block, CONFLICT for an edited file still carrying markers under a pending merge, and MERGED_WITH. pull, push, sync and remote accept -R, so a bare mirror needs no working tree. current/ ckout/prev/next take effect in these verbs through the same hint. Refs zit#163. check-in: 6c84f304f4 user: dmestas tags: trunk

update prints Fossil's receipt on stderr (per-file UPDATE/ADD/REMOVE/MERGE/ CONFLICT, the from/to block, the undo hint) and gains -n, --latest and -v. Every sync-family line names the peer, a no-op is always 'already in sync', clone prints the project code, an unreachable peer is named, and pull/push/ sync show per-round progress on a terminal. commit takes -M FILE, composes the comment in $VISUAL/$EDITOR/--editor over a template of the change set (kept in .zit-ci-comment when the commit then fails), and gains -n and --allow-empty; --no-warnings is accepted as Fossil's spelling of --no-checks — the content gate stays opt-in by design. The names current/ ckout, prev/previous and next resolve against the checkout. The muscle harness now enforces all of it. Closes zit#157, zit#158, zit#159, zit#160, zit#161. check-in: e5beabd7c0 user: dmestas tags: trunk

zig build muscle runs one scripted session — 27 lines a Fossil user types most — through the real fossil and the real zit against local servers, and compares each step's exit-status class and whether the verb spoke at all. Deliberate divergences carry their reason, known gaps carry their issue; anything else fails the run. CI runs it beside smoke. Closes zit#162. check-in: 741f6d428b user: dmestas tags: trunk

Any unambiguous prefix of a command dispatches (zit up, zit tim); an ambiguous one names its candidates; an exact verb always wins, so stat stays the store census. Aliases: ci/checkin, co/checkout, changes, delete/forget/ remove, rename, blame/praise, new. A token of three letters or fewer is only suggested at edit distance 1, and an unknown verb prints two lines, never the command list. Closes zit#156. check-in: e114f7a174 user: dmestas tags: trunk

repo.files re-read and re-parsed the B-card baseline for every delta check-in — 79% of the mint phase on pkgsrc. Repository.filesMemo takes a caller-owned BaselineMemo keyed by artifact name; consecutive deltas over one baseline borrow the parsed manifest and read nothing. On a 30k-file history of 300 deltas, source enumeration went from 10s to 0.3s and the conversion from 13.5s to 3.7s, every check-in hash identical. The memo holds a heap entry with a stable address; the optional-by-value form did not persist under ReleaseFast. Closes zit#167. check-in: c80728261e user: dmestas tags: trunk

The rebirth arm of import-fossil required a zit store, so the verb that says 'import a fossil' could not take one. It now accepts the fossil's sync URL like --compatible does, cloning a transient flat store beside DIR and removing it after; a local store stays accepted. The zit->zit conversion gets its proper home as 'zit submanifest convert SRC DEST', beside 'enable', which now says what it does not do: existing check-ins stay flat, and fossil peers receive nothing new from the next commit. Diagnostics carry the verb the operator typed. Closes zit#168. check-in: abd850dc4c user: dmestas tags: trunk

The gate replayed every commit through the from-scratch tree builder three times to predict what the conversion itself measures, and on pkgsrc that was 14 of 26 hours before a byte was written. The conversion writes a new project beside an untouched source, so the honest evidence is the converted store: the summary now reports its bytes against the flat source's. The partition parameter comes from --k or the tip sweep; a history no k partitions is refused, as 'submanifest enable' refuses it. 'zit submanifest analyze --replay-all' keeps the model for anyone who wants it first. Closes zit#129. check-in: 04d944c1dd user: dmestas tags: trunk

Every check-in went through artifact.buildTree from scratch, so a wide tree cost its whole file set per commit against a few changed slices actually written. The converter now applies each check-in's change set over its primary parent's root with TreeEditor — the commit verb's builder — keeps a parent cache released as children consume it, interns the retained cards, runs the pair proof through the run-scoped flatten memo, and parses each source manifest once. The Git importer's LogTreeStore moves to a shared module. Output is unchanged: every check-in hash matches the from-scratch build on libfossil and on a 30k-file synthetic history. Refs zit#167. check-in: 5e0155427e user: dmestas tags: trunk

The converter only stripped PGP armor, so an SSH-signed check-in re-minted with its envelope inside and failed its own verify silently. Verification now runs as each pair is minted, the census counts come from the first pass instead of a second corpus read, and --k narrows the gate's replay to one arm (skipped with --force). Each phase reports its wall time on stderr; the summary points at 'zit pack'. Closes zit#155. check-in: 75c8669553 user: dmestas tags: trunk

Their repository and global tiers, and config's user/shun areas, all live in the store, not the working tree -- fossil serves them under -R too. Move both out of the -R blanket refusal, resolve the override, and name a bad -R path with the #97 diagnostic rather than the discovery message that advises the flag already given.

Issue #153. closed check-in: b342686fd9 user: dmestas tags: settings-config-repo-flag-153

The reverse of accept, through the same ephemeral-checkout merge, now one function that does not know which direction it runs. Always merges in a working area of its own, checkout or not, so a tree is never left half-merged. Up to date is exit 0 with nothing written; a conflict is refused with its paths; a settled record is refused; a stacked landing is not, since refreshing a rung is what the rungs above it need. The refresh is a reply in the record's thread. Issue #152. check-in: c4b949ebbf user: dmestas tags: trunk

A self-targeted +sym-B is not how a branch is joined, but nothing legitimate mints one on a protected name. maintain now derives the fast-read image only when the log grew, so a pull-heavy fronted server does not pay an image load per connection. Pins that a merge with a protected secondary parent stays on its primary's branch. Issue #151. closed check-in: 13760d0c92 user: dmestas tags: serve-protected-branches

A front that authenticates every push knows who is pushing; the store knows which branch a pushed check-in resolves to. The front sends only the rule -- X-Zit-Protect, a glob list -- and zit serve --fronted refuses the whole round when a check-in would join one of those branches or a tag would move a held check-in in or out of one. Same error card as a content-policy refusal, so a stock fossil client reads it.

Without --fronted the header is ignored and the server is unchanged. Nothing new on the wire or in the repository. Resolution is crosslink's own, through the fast-read image, which maintain keeps warm between connections. A parent not yet held is admitted: it is judged on arrival. Resolver faults fail closed. Issue #151. check-in: 63ec7d6dc8 user: dmestas tags: serve-protected-branches

comment collapsed the G and I cards onto the record root, so a landing thread could not branch. Split mintForum's root and reply-to; landing comment takes --reply-to POST, resolving the thread root with the same helper forum uses and refusing a target outside the record's own thread. closed check-in: fed51b20cb user: dmestas tags: landing-reply-to-149

An unguarded vector parses as a real artifact, so Fossil crosslinks it into every clone -- two check-ins, a technote, twelve sub-manifest slices and a phantom pair that sync chases forever. Each vector now carries a leading # block; rfc_vectors.zig strips it at comptime so callers still see the exact RFC bytes.

Background and the cleanup that follows: see wiki page 'rfc-vector-ledger'. closed check-in: 32ef56aaf4 user: dmestas tags: rfc-vector-guard