Artifact Description [720be41b7f]

Artifact 720be41b7f9bd64b9fd2586201e2f62d79c6d60452196eedeb9708b170093424:

• File src/sim/faulty_file.zig
  • 2026-07-20 03:29:09 — part of check-in [fde61b03b2] on branch h8-readrot — Add online read-fault injection to the storage DST sweep

    FaultyFile injected corruption only at crash/restart boundaries. Add a read_rot_pct knob: a read of an intact byte interns one offset in its span as permanently corrupt (payload-derived mask, never self-heals) -- a latent sector error surfacing at content() time on a store that opened clean, independent of any crash. A healthy disk draws nothing, so existing sweeps keep a byte-identical PRNG stream.

    New storage_sweep.readRotSweep joins the dst gate: after a healthy open, every content-bearing hash reads back either its exact bytes or a declared corruption error -- wrong bytes presented as success is SilentCorruption. The append open path re-runs each frame's whole-frame CRC per read, so latent rot is detected and the gate stays green. The verified-on-open read path (openReadOnly) trusts the scan-time CRC on an immutable-length assumption that bit rot violates; a test drives that path to prove the oracle fires SilentCorruption.

    Read-fault model follows TigerBeetle's storage-fault-injection lineage. (user: dmestas, size: 15525) [annotate] [blame] [check-ins using]

  • 2026-07-20 03:34:52 — part of check-in [ba805e5913] on branch trunk — Merge h8-readrot: simulate latent read rot, prove the read path detects it

    The fault simulator only ever corrupted at crash and restart boundaries. It could not model a latent sector error: bit rot that surfaces during a read of a store that opened clean. A new read_rot_pct knob does that -- a read returns payload-derived, never-self-healing corruption for a frame that is intact on disk -- and a sweep reopens a healthy store, arms it, and reads every held hash. The oracle: each read returns exactly the stored bytes or a declared corruption error, never wrong bytes as success. The append open path re-runs the whole-frame checksum per read, so it catches the rot; the sweep is green and a companion test proves the sweep can fail by reading through the checksum-skipping read-only open. The knob is inert at zero, so every existing seed keeps its byte stream. The crash-point fault technique follows TigerBeetle's storage fault model. (user: dmestas, size: 15525) [annotate] [blame] [check-ins using]