Artifact Description [7d82ecb957]

Artifact 7d82ecb957be86174a331617380cd64f49887a9402ee5a3c2de0e3fc8e6de0dd:

• File src/update.zig
  • 2026-07-20 03:21:12 — part of check-in [c9fb87f554] on branch h5a-asserts — Assert-density pass: update, serve, transport

    Raise assert density in the three thinnest library modules, enforcing invariants that already hold. Asserts only, no behavior change.

    update.zig: guard the checkout-state transition. applyCheckin asserts the desired managed set equals the target plan membership (validateTopology proves the paths unique); requireClean asserts a clean tree's plan membership equals the recorded managed set; recordUndoImage asserts the affected union covers both operands; commitMaterialization self-guards that the committed record names exactly the staged check-in and that the managed set is its membership; the merge path asserts one rollback pre-image per path and a shared pre-merge managed baseline.

    serve.zig: a servable request is a POST bearing a request-valid compressed media type (§4 L759-764); an accepted body honors the §4 L1148-1149 ceiling; a compressed reply is application/x-fossil (§4.1); the accept loop honors its request bound.

    transport.zig: a framed container carries its 4-byte length prefix (§4.1); an unframed reply stays within reply_body_cap (§4 r9); a followed redirect lands only on an http/https transport (§4 r12/r13). (user: dmestas, size: 93035) [annotate] [blame] [check-ins using]

  • 2026-07-20 03:27:48 — part of check-in [9654d06838] on branch trunk — Merge h5a-asserts: TigerStyle assert pass on update, serve, transport

    Assert density was collapsing exactly where the working tree and the wire are touched: update.zig held 2 asserts across 2127 lines, serve.zig 3, transport.zig 2 -- against the hundreds in the artifact and sync cores. This pass adds 17 asserts stating invariants that already hold: the checkout-state transitions in update (managed-set, record and rollback image agreement around each applyCheckin stage), the request/response postconditions in serve (media, arity and body-ceiling), and the frame, redirect and body-cap postconditions in transport. Asserts only, no behaviour change; where a result had to be named to assert on it the error mapping is preserved exactly. All survive the deterministic simulation sweeps, which is the point of landing them before the checkout crash-recovery sweep that will hammer update. (user: dmestas, size: 93035) [annotate] [blame] [check-ins using]