amadan
fix/carloku-vfs-review-20261003
Experimental VFS checkpoint f5cc0077 fixes read-only main-open handling, accidental main-file creation, unsupported large kernel pages, shared-memory allocation failures and custom-first crash recovery tests. Actual Opus accepted the bounded F1–F5 fixes. The branch also reuses the reviewed deterministic lease deadline fixture a1177cde; all three affected lease files match the verified backend integration byte for byte. Production recorder deadlines are unchanged.
Full local build/vet/gofmt/make test and three cross builds passed at22:35:03Z using private scratch. Exact-tip Amadan gate/cross/MinIO contract passed. Two earlier0e9 local failures remain preserved: unexplained disappearing files under shared scratch, then a real25ms test-fixture scheduling dependency fixed by the reused change. No earlier run is relabeled as passing.
No production consumer, main merge, deployment or provider operation. Main-inode lifetime pinning, filesystem support constraints, broader error contracts, helper/IPC/fencing and whole PartB integration remain outstanding. Tests and local process crash checks do not prove real provider durability or all filesystem/power-loss behavior.
Commits
100
Files changed
675
+217874 −517
Discussions
0
0 open
Tasks
0/0
done
Discussions
- No discussions on this branch yet.
Tasks
- No tasks yet.
Activity
- claude agent, operated by paul@keymail.dev pushed 0e9de1b26 Refuse unsafe VFS opens and verify custom-first crash recovery
- claude agent, operated by paul@keymail.dev pushed f5cc00770 Make admission association deadline tests deterministic
- claude agent, operated by paul@keymail.dev pushed 36aa46029 Coordinate SQLite VFS connections and retain failed cleanup ownership
- claude agent, operated by paul@keymail.dev pushed a7eea0820 Copy SQLite callback memory through pinned runtime buffers
- claude agent, operated by paul@keymail.dev pushed 9d2fd891a Checkpoint descriptor-relative SQLite VFS experiment
- claude agent, operated by paul@keymail.dev pushed b634c4481 Isolate CLI test configuration and record admission recovery checkpoint
- claude agent, operated by paul@keymail.dev pushed 5d52edd19 Publish validated durability holds with fail-closed reader compatibility
- claude agent, operated by paul@keymail.dev pushed 819634465 Recover admission journals while retaining the producer fence
- claude agent, operated by paul@keymail.dev pushed 987f20c29 Associate durability attempts with their admitted requests
- claude agent, operated by paul@keymail.dev pushed 0e5267fa8 Select explicit config fixtures in login flow tests
- claude agent, operated by paul@keymail.dev pushed c2311d03f Isolate API test configuration and shorten control socket fixtures
- claude agent, operated by paul@keymail.dev pushed 1dc9a6c7b Retain admission cleanup ownership and close discovery races
- claude agent, operated by paul@keymail.dev pushed 358b25ee7 Plan Task 4's fifth slice: the gate and the fleet; the request gate returns an admission whose participants the middleware completes
- claude agent, operated by paul@keymail.dev pushed 3678b940a Review ten answered: the listing directory retained across the handoff; one open uncertainty per fleet; closure closes what nothing else will; the latch's days dirtied when it clears; publication from the ledger's earliest day with explicit bounds; the configuration reader refuses what it cannot take; design revision 16
- claude agent, operated by paul@keymail.dev pushed f11464eca Plan Task 4's fourth slice: the fleet journal, construction backfill and root-first acknowledgement in the durability ledger
- claude agent, operated by paul@keymail.dev pushed a579d845e Review nine answered: holds, the latch and settlements are publication events; the snapshot reads again across a replay; a latch keeps its computed bound or is unresolved; replay closes on the settlement's test; the discovery instant floors closure; design revision 15
- claude agent, operated by paul@keymail.dev pushed c824ed811 Review eight answered; plan Task 4's second and third slices (the barrier; discovery, the uncertainty and the latch); design revision 14
- claude agent, operated by paul@keymail.dev pushed 47efe06f3 Review seven answered; Part C's first ledger slice: the root governing a resolved stack tracked across an absolute platform link, a later ascent re-pinning higher in that pin's ancestry and re-walking the link; what an acquisition holds released directory by directory to the resolved chain (authority.Result.Release), so the descriptor count agrees with /proc on the systemd and composed shapes; a recheck error that is not a change is drift, stale only at the final look; a root with no owned file beneath it rechecked on its own; the stale window's start asserted; the design's parameter row, the authority doc, the pins comment, the churn list and the spike note reconciled; the durability ledger gains the admissions, fleets, uncertainties, inherited and holds tables and the admission row's transitions (Admit, Unissued, TransportDone, RecorderStarted, RecorderDone, settled by the later participant, a terminal final), with tests mirroring the admission model
- claude agent, operated by paul@keymail.dev pushed f0ed32b7b Required coverage (plan Task 3): RequiredDatabases (the registry this process has open, the console database when CONSOLE_DB names it; no role configuration exists on this branch to name a console box, recorded), each looked at through its root in fleetInventory with why it cannot be reached, an unreachable one a problem and, at a fleet build, the options' Hold told the instant before the build is refused; carlos ops inventory, the read-only command rendering the external replicator's configured list beside the platform replicator's inventory and the required databases' reachability
- claude agent, operated by paul@keymail.dev pushed 28e7f4d61 Review six answered; inventory on retained descriptors, third slice: the fleet holds its pins and each owned file's retained chain for its life (fileFacts.keep, FleetInventory.Close, recheck and Descriptors; checkOwnedFileOn and strictTreeDBsOn against a fleet's pins), rechecks every chain, name and root by descriptor before each look's rebuild and releases them at Close, a report keeping none; the root re-established higher when a later platform link's ascent needs it, a slash target pinned, the platform-directory claim refusing a link at the claimed directory, a relative claim refused, a failed look after a changed directory a problem, an absolute tenant link spelled through the tree's own root walked relative from the confined root; tests through two composed links, the slash target, the directory already listed replaced under the inspection, a directory removed before its listing, an unsearchable directory, a mode-only change on a chain that only the retained edge sees, descriptors released; the model checks right after the final recovery; design revision 13 and the plan reconciled with the implemented boundary
- claude agent, operated by paul@keymail.dev pushed cc1500a90 Review five answered; inventory on retained descriptors, second slice: checkOwnedFile on the retained chain (the climb by ownership on Parent pointers, the directory above the top the platform's, every component acquired with O_NOFOLLOW, sidecars by Lookat), the root rule where the platform's authority ends (as many levels above a link's directory as its target ascends, the parent of the first non-platform component, an absolute platform-link target's parent pinned), the predicate's classes named (out of its platform root; a further link said before ownership), a directory changed under the look looked at again, a listing's per-entry errors, a pre-pin absent target as churn, resolvePlatformLinks, walkWithoutLinks, sqliteHeader and openRegularNoFollow retired, Facts.Nlink; inventory-level tests through systemd's shapes and each refusal, between the listing and the look, descriptor accounting; the model checks right after recovery, at-the-bound and first-change tests; design revision 12 (the root rule in Part A; the backstop limited to the witness; link shapes beside decisions 10 to 13); the plan's pre-wiring census
- claude agent, operated by paul@keymail.dev pushed ccfd331ad Inventory on retained descriptors (plan Task 2, first slice): the fleet's pins (the pinned slash and a platform root per spelled directory, the parent of the first platform link's directory or of the spelled directory), the platform-link predicate on descriptors, strictTreeDBs walking Dirs with every link class named (may lead to a database, a link to a link, neither a file nor a directory, out of the tree by Within, cannot be looked at, a file in the tree skipped with its target, absent as churn), the pathname link look deleted; the owners tests keep their strings, three expectations move to the design's classes, and a link-class test covers each class and Astra 2's layout
- claude agent, operated by paul@keymail.dev pushed a26cba8e6 Review four answered; design revision 11: the historical term excludes only the empty terminals (unrecorded sent), the cutoff is the bound fixed before the rows are read, a look's start is the bound by what it observes rather than an order; the model's fixed cutoff, a later witness change, four tests; Within's early-result contract documented and guarded; the plan rewritten in terms of Within
- claude agent, operated by paul@keymail.dev pushed 7ba5fc728 Review three answered; design revision 10: the historical term's threshold is the earlier of the proof and the clean look, empty terminals excluded, and every look reads the witness and rechecks every chain first; the model gains a witness change the proof discovers, crash deduplication of a landed row, one row per token, seven tests; authority gains Result.Parent and Within, keeps the pin on absent and linked tails, and tests a sibling tenant under one pin, a replacement link at Recheck and an other-writable component; dispositions mark superseded rows and the spike note's claims are corrected
- claude agent, operated by paul@keymail.dev pushed 36b4805c2 Plan: the replicator's authority as tasks (the roots a fleet pins, the predicate and the inventory on Dirs, required coverage, Part C's ledger changes after the model)
- claude agent, operated by paul@keymail.dev pushed 0a5279246 Review two answered; design revision 9: the uncertainty's lower bound also takes the admission instant of every admission settled at or after the last clean look's start (an in-flight request across a change, settled clean before the discovery, was outside it); the model's change is its own action discovered by a later look, a landed ambiguous row is durable at once, a per-step inheritance check, closed implies no unsettled admission, explicit quiescence, five new tests; authority reports the pin an absolute walk ended beneath, keeps the errno before a pin, and its tests distinguish Equal from Same, observe close-on-exec and count descriptors across refused opens, ancestry rewalks and Root.Close; dispositions and the spike note corrected
- claude agent, operated by paul@keymail.dev pushed 50a6f0561 Review one answered: authority gains Confine, Equal in Recheck and Child, slash as a pin, ErrLink for ELOOP too, OpenRoot's path rules, a Platform predicate over Facts, and tests for the tenant boundary, the retained-parent pop, chmod, a foreign-owned component and descriptor accounting; the model's protocol boundaries become separate actions with a send, the ancestry barrier stated from the chain, sticky terminals and closed-implies-no-latch, nine new tests; dispositions and the spike note corrected
- claude agent, operated by paul@keymail.dev pushed 0bf0d3a4b Spike note: the fork's pathname entry points enumerated by reading every call (Part B's task list), grouped by the directory each must take
- claude agent, operated by paul@keymail.dev pushed 5bfcc7ba7 authority: retained directory descriptors (plan step 1, Part A): Dir with Child, List, Lookat, Readlink, OpenRegular, Recheck and Walk; Root by the platform walk from a pinned slash with its ancestry; the design's Part A tests; a link under O_DIRECTORY named as one; the walk's grammar refused before any system call
- claude agent, operated by paul@keymail.dev pushed f331b55a6 Spike: the admission protocol as an executable model (plan step 0): Part C's transition table, both holds, the latch and its replay, construction backfill, ancestry reach, root-first acknowledgement, helper death, the producer fence and recovery, with the design's named sequences as tests and randomised schedules under barrier, hazard, reach and liveness invariants; 30000 schedules pass; fourteen mutants killed