amadan
fix/carloku-vfs-main-pin-20261004
Experimental main-inode pin checkpoint e4ea1d49. Register validates accepted facts, reserves the process-wide registration before opening the main inode, and retains its descriptor through zero SQLite handles and failed cleanup. Disposal closes descriptors before releasing the reservation. Initial pin package normal/race tests and 16 targeted mutants passed. Independent Codex found no blocking source defect in that bounded change; REQUIRED OPUS CODE REVIEW REMAINS PENDING. This is not whole Part B acceptance.
Exact e4ea1d49 passes the full local build/vet/gofmt/test gate, three cross builds and an explicit linux/arm64 VFS test compile (2026-10-04T00:22:31Z). Exact Amadan gate, five cross shards and MinIO contract CI also pass. Earlier e72d327b failed because a cherry-picked readiness fixture depended on a sidecar-only helper. Commit 3e4f075a made it self-contained, then CI found an ARM64 Nlink test-field conversion error; e4ea1d49 adds the explicit uint64 conversion. Both failed outputs remain preserved; no flaky-pass attribution.
No production consumer, raw main/WAL handle interface, fork integration, helper activation or provider proof. Process-global exclusivity and no ordinary SQLite on the same inode remain preconditions. Separate from verified backend integration 2e489fd1. Do not merge or deploy. LIVE BILLING OFF.
Commits
100
Files changed
678
+218553 −528
Discussions
0
0 open
Tasks
0/0
done
Discussions
- No discussions on this branch yet.
Tasks
- No tasks yet.
Activity
- claude agent, operated by paul@keymail.dev pushed e4ea1d497 Normalize the main-pin fixture link count across Linux targets
- claude agent, operated by paul@keymail.dev pushed 3e4f075a9 Keep the readiness fixture independent of sidecar test helpers
- claude agent, operated by paul@keymail.dev pushed f427c7998 Pin the accepted database inode through VFS registration
- claude agent, operated by paul@keymail.dev pushed e72d327bc Join listener shutdown and correct asynchronous test witnesses
- claude agent, operated by paul@keymail.dev pushed 0e9de1b26 Refuse unsafe VFS opens and verify custom-first crash recovery
- claude agent, operated by paul@keymail.dev pushed f5cc00770 Make admission association deadline tests deterministic
- claude agent, operated by paul@keymail.dev pushed 36aa46029 Coordinate SQLite VFS connections and retain failed cleanup ownership
- claude agent, operated by paul@keymail.dev pushed a7eea0820 Copy SQLite callback memory through pinned runtime buffers
- claude agent, operated by paul@keymail.dev pushed 9d2fd891a Checkpoint descriptor-relative SQLite VFS experiment
- claude agent, operated by paul@keymail.dev pushed b634c4481 Isolate CLI test configuration and record admission recovery checkpoint
- claude agent, operated by paul@keymail.dev pushed 5d52edd19 Publish validated durability holds with fail-closed reader compatibility
- claude agent, operated by paul@keymail.dev pushed 819634465 Recover admission journals while retaining the producer fence
- claude agent, operated by paul@keymail.dev pushed 987f20c29 Associate durability attempts with their admitted requests
- claude agent, operated by paul@keymail.dev pushed 0e5267fa8 Select explicit config fixtures in login flow tests
- claude agent, operated by paul@keymail.dev pushed c2311d03f Isolate API test configuration and shorten control socket fixtures
- claude agent, operated by paul@keymail.dev pushed 1dc9a6c7b Retain admission cleanup ownership and close discovery races
- claude agent, operated by paul@keymail.dev pushed 358b25ee7 Plan Task 4's fifth slice: the gate and the fleet; the request gate returns an admission whose participants the middleware completes
- claude agent, operated by paul@keymail.dev pushed 3678b940a Review ten answered: the listing directory retained across the handoff; one open uncertainty per fleet; closure closes what nothing else will; the latch's days dirtied when it clears; publication from the ledger's earliest day with explicit bounds; the configuration reader refuses what it cannot take; design revision 16
- claude agent, operated by paul@keymail.dev pushed f11464eca Plan Task 4's fourth slice: the fleet journal, construction backfill and root-first acknowledgement in the durability ledger
- claude agent, operated by paul@keymail.dev pushed a579d845e Review nine answered: holds, the latch and settlements are publication events; the snapshot reads again across a replay; a latch keeps its computed bound or is unresolved; replay closes on the settlement's test; the discovery instant floors closure; design revision 15
- claude agent, operated by paul@keymail.dev pushed c824ed811 Review eight answered; plan Task 4's second and third slices (the barrier; discovery, the uncertainty and the latch); design revision 14
- claude agent, operated by paul@keymail.dev pushed 47efe06f3 Review seven answered; Part C's first ledger slice: the root governing a resolved stack tracked across an absolute platform link, a later ascent re-pinning higher in that pin's ancestry and re-walking the link; what an acquisition holds released directory by directory to the resolved chain (authority.Result.Release), so the descriptor count agrees with /proc on the systemd and composed shapes; a recheck error that is not a change is drift, stale only at the final look; a root with no owned file beneath it rechecked on its own; the stale window's start asserted; the design's parameter row, the authority doc, the pins comment, the churn list and the spike note reconciled; the durability ledger gains the admissions, fleets, uncertainties, inherited and holds tables and the admission row's transitions (Admit, Unissued, TransportDone, RecorderStarted, RecorderDone, settled by the later participant, a terminal final), with tests mirroring the admission model
- claude agent, operated by paul@keymail.dev pushed f0ed32b7b Required coverage (plan Task 3): RequiredDatabases (the registry this process has open, the console database when CONSOLE_DB names it; no role configuration exists on this branch to name a console box, recorded), each looked at through its root in fleetInventory with why it cannot be reached, an unreachable one a problem and, at a fleet build, the options' Hold told the instant before the build is refused; carlos ops inventory, the read-only command rendering the external replicator's configured list beside the platform replicator's inventory and the required databases' reachability
- claude agent, operated by paul@keymail.dev pushed 28e7f4d61 Review six answered; inventory on retained descriptors, third slice: the fleet holds its pins and each owned file's retained chain for its life (fileFacts.keep, FleetInventory.Close, recheck and Descriptors; checkOwnedFileOn and strictTreeDBsOn against a fleet's pins), rechecks every chain, name and root by descriptor before each look's rebuild and releases them at Close, a report keeping none; the root re-established higher when a later platform link's ascent needs it, a slash target pinned, the platform-directory claim refusing a link at the claimed directory, a relative claim refused, a failed look after a changed directory a problem, an absolute tenant link spelled through the tree's own root walked relative from the confined root; tests through two composed links, the slash target, the directory already listed replaced under the inspection, a directory removed before its listing, an unsearchable directory, a mode-only change on a chain that only the retained edge sees, descriptors released; the model checks right after the final recovery; design revision 13 and the plan reconciled with the implemented boundary
- claude agent, operated by paul@keymail.dev pushed cc1500a90 Review five answered; inventory on retained descriptors, second slice: checkOwnedFile on the retained chain (the climb by ownership on Parent pointers, the directory above the top the platform's, every component acquired with O_NOFOLLOW, sidecars by Lookat), the root rule where the platform's authority ends (as many levels above a link's directory as its target ascends, the parent of the first non-platform component, an absolute platform-link target's parent pinned), the predicate's classes named (out of its platform root; a further link said before ownership), a directory changed under the look looked at again, a listing's per-entry errors, a pre-pin absent target as churn, resolvePlatformLinks, walkWithoutLinks, sqliteHeader and openRegularNoFollow retired, Facts.Nlink; inventory-level tests through systemd's shapes and each refusal, between the listing and the look, descriptor accounting; the model checks right after recovery, at-the-bound and first-change tests; design revision 12 (the root rule in Part A; the backstop limited to the witness; link shapes beside decisions 10 to 13); the plan's pre-wiring census
- claude agent, operated by paul@keymail.dev pushed ccfd331ad Inventory on retained descriptors (plan Task 2, first slice): the fleet's pins (the pinned slash and a platform root per spelled directory, the parent of the first platform link's directory or of the spelled directory), the platform-link predicate on descriptors, strictTreeDBs walking Dirs with every link class named (may lead to a database, a link to a link, neither a file nor a directory, out of the tree by Within, cannot be looked at, a file in the tree skipped with its target, absent as churn), the pathname link look deleted; the owners tests keep their strings, three expectations move to the design's classes, and a link-class test covers each class and Astra 2's layout
- claude agent, operated by paul@keymail.dev pushed a26cba8e6 Review four answered; design revision 11: the historical term excludes only the empty terminals (unrecorded sent), the cutoff is the bound fixed before the rows are read, a look's start is the bound by what it observes rather than an order; the model's fixed cutoff, a later witness change, four tests; Within's early-result contract documented and guarded; the plan rewritten in terms of Within
- claude agent, operated by paul@keymail.dev pushed 7ba5fc728 Review three answered; design revision 10: the historical term's threshold is the earlier of the proof and the clean look, empty terminals excluded, and every look reads the witness and rechecks every chain first; the model gains a witness change the proof discovers, crash deduplication of a landed row, one row per token, seven tests; authority gains Result.Parent and Within, keeps the pin on absent and linked tails, and tests a sibling tenant under one pin, a replacement link at Recheck and an other-writable component; dispositions mark superseded rows and the spike note's claims are corrected
- claude agent, operated by paul@keymail.dev pushed 36b4805c2 Plan: the replicator's authority as tasks (the roots a fleet pins, the predicate and the inventory on Dirs, required coverage, Part C's ledger changes after the model)
- claude agent, operated by paul@keymail.dev pushed 0a5279246 Review two answered; design revision 9: the uncertainty's lower bound also takes the admission instant of every admission settled at or after the last clean look's start (an in-flight request across a change, settled clean before the discovery, was outside it); the model's change is its own action discovered by a later look, a landed ambiguous row is durable at once, a per-step inheritance check, closed implies no unsettled admission, explicit quiescence, five new tests; authority reports the pin an absolute walk ended beneath, keeps the errno before a pin, and its tests distinguish Equal from Same, observe close-on-exec and count descriptors across refused opens, ancestry rewalks and Root.Close; dispositions and the spike note corrected