Artifact 7c9b88c03667df22b2073361bf06487d4a3f9c85fcfd408f670beb020184144f:
- File
src/dst.zig
-
2026-07-20 03:29:09
— part of check-in
[fde61b03b2]
on branch h8-readrot
— Add online read-fault injection to the storage DST sweep
FaultyFile injected corruption only at crash/restart boundaries. Add a read_rot_pct knob: a read of an intact byte interns one offset in its span as permanently corrupt (payload-derived mask, never self-heals) -- a latent sector error surfacing at content() time on a store that opened clean, independent of any crash. A healthy disk draws nothing, so existing sweeps keep a byte-identical PRNG stream.
New storage_sweep.readRotSweep joins the dst gate: after a healthy open, every content-bearing hash reads back either its exact bytes or a declared corruption error -- wrong bytes presented as success is SilentCorruption. The append open path re-runs each frame's whole-frame CRC per read, so latent rot is detected and the gate stays green. The verified-on-open read path (openReadOnly) trusts the scan-time CRC on an immutable-length assumption that bit rot violates; a test drives that path to prove the oracle fires SilentCorruption.
Read-fault model follows TigerBeetle's storage-fault-injection lineage. (user: dmestas, size: 28846) [annotate] [blame] [check-ins using]
-
2026-07-20 03:34:52
— part of check-in
[ba805e5913]
on branch trunk
— Merge h8-readrot: simulate latent read rot, prove the read path detects it
The fault simulator only ever corrupted at crash and restart boundaries. It could not model a latent sector error: bit rot that surfaces during a read of a store that opened clean. A new read_rot_pct knob does that -- a read returns payload-derived, never-self-healing corruption for a frame that is intact on disk -- and a sweep reopens a healthy store, arms it, and reads every held hash. The oracle: each read returns exactly the stored bytes or a declared corruption error, never wrong bytes as success. The append open path re-runs the whole-frame checksum per read, so it catches the rot; the sweep is green and a companion test proves the sweep can fail by reading through the checksum-skipping read-only open. The knob is inert at zero, so every existing seed keeps its byte stream. The crash-point fault technique follows TigerBeetle's storage fault model. (user: dmestas, size: 28846) [annotate] [blame] [check-ins using]
-
2026-07-20 03:29:09
— part of check-in
[fde61b03b2]
on branch h8-readrot
— Add online read-fault injection to the storage DST sweep