Artifact Description [a3a1d0f864]

Artifact a3a1d0f864eebfac34043fbc81f01ebc18ec34fd45cb2319e937e5f7dc703a55:

• File src/dst.zig
  • 2026-07-20 04:13:50 — part of check-in [d2b5f729ef] on branch h3-crashsync — Compose storage and network faults in the sync DST

    The sync sweep and the storage sweep ran in disjoint PRNG streams off the same seed and never intersected: no exchange ever ran over a client store that could tear. A partial pull could leave torn frames that recovery accepts but a resumed session never converges past.

    runCrashResume backs the client store with a real LogStore over a tearable FaultyFile instead of the pure MemStore, seeded healthy then armed to tear. Between phase-1 rounds, on a seeded coin, it power-cuts the store mid-persist, reopens it, reloads the recovered prefix, and resumes with a fresh Client over the same durable store, mirroring cmd/sync's loadContentStore for wire-name to log-digest identity.

    The oracle keeps every existing sync invariant and adds the crash bite: post-recovery contents are a subset of the pre-crash held set, no corrupt frame crosses the boundary, and phase-2 liveness heals both domains before a fresh session converges in the bounded window (sync 3.7). One seeded PRNG stream drives the whole run, so a failure replays from the shared reproduce line.

    The composed-fault and liveness-under-faults discipline follows TigerBeetle's VOPR. (user: dmestas, size: 29328) [annotate] [blame] [check-ins using]

  • 2026-07-20 04:19:03 — part of check-in [9b689ebafe] on branch trunk — Merge h3-crashsync: run a sync over a store that can tear, across crashes

    The storage and network simulations ran off the same seed but never intersected, so no simulated exchange ever crossed a store that could lose its tail. This composes them: the sync client's content is backed by a real log over a tearable file, and between rounds -- on a seeded coin -- the store is crash-restarted mid-persist, reopened to its recovered prefix, and the session resumed with a fresh client. The existing safety and liveness oracles must survive the composition: no corrupt content accepted, the recovered set never exceeds what was held before the crash, and once both the network and the disk heal a fresh session still converges within the bounded window. Green across the gate and a deep 120-seed run; a retained switch that makes recovery accept a torn frame trips the oracle, so the check is not vacuous. The fault-composition follows TigerBeetle's VOPR. (user: dmestas, size: 29328) [annotate] [blame] [check-ins using]