Timeline

Two independent slices recovered from an interrupted session, each gated green.

- Sync now dispatches on method + Content-Type at any URL path (§4 L759-764), so a stock 'fossil clone http://host:port/' at the bare root interoperates; the /xfer-only requirement and its 404 are gone. - 'zit log' is reduced to the signed one-verb surface: one check-in ID, help only, no -n windowing; usage errors exit 2, a bad ID exits 1.

Unit + e2e (209/209) green; fmt clean; dst 6x1000 ok. check-in: dbb2735bff user: dmestas tags: trunk

A conformant Fossil client POSTs sync to the repository URL path unchanged and MUST NOT append /xfer (sync §4 L759-764): a bare 'fossil clone http://host:port/' POSTs to "/". The server previously required the /xfer path and answered 404 for anything else, so a root-URL clone from a stock client failed.

Drop the path from the dispatch decision entirely. classifyXfer now keys only on method (POST) and a request-valid, outer-compressed Content-Type (application/x-fossil); the URL path is accepted but unused. Remove xfer_path, requestPath, and the not_found/404 disposition; Disposition collapses to ok / method_not_allowed / unsupported_media_type. A non-POST stays 405 rather than a home redirect this sync-only server can't honor (and a 302 to "/" would loop now that "/" is a valid endpoint).

The over-real-HTTP e2e clone now targets the bare root "/" to prove a root-URL client interoperates. Unit + e2e green; fmt clean. check-in: 9636157a85 user: dmestas tags: recover-inflight

The clone/sync receive path inflated every stored cfile container to prove the RFC1950 stream was intact (§3.9), then threw the result away: the store keeps the container verbatim and reconstructs lazily, and the persist commit hook runs the §7.7 integrity check on the reconstructed bytes. For the full form that inflate was pure waste. Move the decode into the delta branch (which genuinely needs the plaintext to reconstruct) so a full-form cfile is interned and retained without inflating.

Retaining an unvalidated container means a held artifact is no longer guaranteed reconstructable: content() can be null for a corrupt wire-backed container, so held() no longer implies content(). Reconcile the consumers that assumed it did. The pull .raw delta basis and the push upload path both degrade gracefully (round abort / silent skip) instead of tripping an unreachable or assert on hostile input; the read/derivation path keeps the decompression-bomb cap, and the eager clone-end image treats a corrupt container as an error.

Cuts clone peak RSS ~13% (651 -> 568 MB) on the fossil corpus by dropping the discarded plaintext allocation. Instruction count and wall are flat, since full-form cfiles are the minority of clone content. 1538 tests pass; fossil interop smoke green. closed check-in: d91a3cfe42 user: dmestas tags: clone-w4