amadan

carlos / platform Public

Clone 
git clone https://amadan.net/carlos/platform

Plain git — no account needed to clone.

Download

Download this file

Request changes: two P2 findings. HEAD c6dc57d0 is not ready to merge.

  1. P2 — Exempt skipped paths still cause unbounded ancestor processing. The exemption at publisher.go:74 admits arbitrarily deep skipped paths. Both Restore and Present call superseded():226, which walks every ancestor, including those of skipped entries. Each path.Dir cleans the remaining prefix, making this quadratic in depth, with no cancellation check. A valid skipped entry at strings.Repeat("d/", 100000)+"f" therefore causes substantial uncancellable work even on an empty destination. Bound or redesign overlap processing while preserving skipped entries’ sequence semantics.
  1. P2 — A skipped flag bypasses the cap on a tombstone. At publisher.go:74, an over-cap entry containing both Deleted: true and Skipped: "too-large" passes validation. Neither decoding nor checkEntry rejects that combination. Restore gives Deleted precedence at restore.go:109, then performs the ancestor marking and removal that the revised design intends to forbid. This requires a malformed or crafted manifest; normal writers do not produce it. Exempt only !e.Deleted && e.Skipped != "", or reject contradictory states consistently.

The remaining requested checks:

  • Round 3’s findings against removePastCap are moot: that implementation is gone.
  • For ordinary skipped entries, the StageDelete no-op is safe: it preserves an unpublished entry and cannot resurrect content. Restore → scan → commit succeeds when the deep file and over-cap directories are absent.
  • An existing deep file or directory still makes scanning—and therefore flushing—fail. That is the existing scan-cap limitation described in the brief as #279-class.
  • CopyManifest, NewFromCopy, and moves’ Establish consistently carry ordinary skipped entries through the shared validation.
  • The census overlay is envelope-only; its hash matches exactly. Plan 9 and Plan 14 legacy units and the legacy seal are unchanged.

Static review only; no tests ran, including the full internal/host suite.

---

FIRST PROMPT: Review the round-4 brief at c6dc57d0, read-only; avoid the full internal/host suite.

WHAT: Assess the revised cap, downstream recovery behavior, census, and merge readiness.

STATUS: Complete: two P2 findings; request changes.

NEEDED: Nothing from you for this review.

RECOMMENDED: Address both findings and add focused regressions before merging.

SESSION: Safe to close. HEAD and working tree are unchanged; no files or background processes were created.