Repository navigation
land: views-4-2-composition-install - #993
Merged
Merged
Conversation
Add depth-one v3 manifest projection, independent readiness patches and leased plane readers. Consume all publication outcomes without inheriting a losing job's verification. Keep real base/referrer publication fail-closed behind the ordered PublicationBinding handoff; existing v2 routing stays unchanged. Replace the raw-revision refusal regression with epoch refusal and sustained-write replay regressions: ordinary delivered edits must no longer starve installation. Legacy drivers without a replay cut still strictly rewalk. Add differential no-marker and guard fixtures. Narrow suites, doctest and native typecheck passed; full gates and compiled mutation controls remain pending at this checkpoint. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Preserve reader-owned semantic runs and per-binding fill state across unbind and rebind. Old-snapshot readiness and pending work use the same pinned state as search. Adjust the existing chunk-index eviction test to retain runs while a bundle is held and preserve the original eviction assertion after the last owner drops; this is the required bundle-lifetime contract, not relaxed eviction. Restore the successful v2 publication's read-only pointer probe. Removing that pre-slice operation removed SQLite WAL/SHM sidecars and changed subsequent read-only-directory errors; keep the existing storage-error assertion unchanged. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Keep main's owner-only summary repairs and saved-vector availability behind the composed worker ownership gate. Add a regression covering inherited summaries and pending files. Borrower overlays now live in a pinned reader binding, not the owner's scope cache. Add a snapshot-aware cache observation helper and migrate the upstream borrower parity test to it, retaining all old/new vector assertions and additionally checking the older reader cache survives a newer binding. Owner cache callers and routing are unchanged. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Use per-key opening/live/retiring slots while the global cache only owns weak slot references. Adapter opens, reader teardown and residency-pin cleanup run without the global or per-key lock. Token checks prevent an old destructor from retiring a replacement. Swap installed bundles and live deltas as whole owners, then release both root guards before last-drop cleanup. Likewise defer InstalledDriver and callgraph-map retirement outside their write locks. Three new regressions failed before the fix on blocked open, blocked retirement and root-lock retirement; final batched views and Windows verification follows the audit remediation. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Keep the no-marker production boundary empty as required, and separately seed a populated opaque v3 namespace. Dry-run pruning must preserve both content digests and exact reader-floor bytes. Exercise real CheckoutDriver materialization, manifest and blob reads, retained SQLite reader resources, pointer CAS and installation ordering rather than relying only on nine-step mock labels. Final views/Windows checks are batched after audit remediation; no mutation controls are added or run. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Track publication progress before invoking CAS. Known losing attempts still abort-clean and revalidate, but published or indeterminate failures use a separate recovery operation that must preserve insertion intent and acquisition protection. Replace the old unsafe assertion that every failure runs terminal cleanup with phase-appropriate recovery checks. A filesystem-backed intent regression verifies both post-CAS preservation and pre-CAS release. Durable binding implementations remain fail-closed; final verification is batched per the latest instruction, without mutation controls. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Record only changed plane states in inherited readiness overrides. Applicability removal still uses a full entry, but unchanged planes in that representation remain inherited and cannot consume worker fills. Resolve override-fill content from the post-update inherited entry, never the previous replacement. Semantic live-patch ownership now requires an explicit semantic state for the matching content, not merely a path in another plane's map. Add regressions for trigram-only updates, applicability removal, B-to-A restoration, and trigram-only live patches. Final filtered views verification is batched; no mutation controls. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Only a completed strict walk tagged with the current epoch may clear startup Reconciling or directory membership uncertainty. Overflowed and Stopped states are refused rather than silently promoted; future watcher-resume integration must establish a new valid observation boundary. Validate exact installed identity before publication as well as installation. Add tests for unsafe watcher promotion, startup without a walk, and directory uncertainty surviving a non-strict install until a full walk. Ordinary edits still replay without requiring a quiet revision. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Run the SQLite publication probe after pointer sync but before scheduling generation maintenance. Preserve a landed pointer on callback failure and test a held managed probe connection against real scheduled maintenance. Treat any error after a possible CAS as requiring fresh revalidation, never unpublished rollback. Keep prepared reader leases until install validates; retire obsolete cut-sequence entries only after a successful swap and outside locks. Rebind immutable leases to post-publication query state without reopening data. Add real-driver post-CAS failure and rejected-install cache tests, and assert actual Conflict versus EquivalentWinner outcomes. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Seed an untrusted persisted base header directly and verify foreign opening refuses it. Together with the existing legacy-publication refusal regression, both accepting entry points remain closed until s3 supplies an authenticated identity object and canonical digest validation. The parent explicitly deferred the persisted identity contract to s3. This change does not invent a digest encoding or enable a v3 writer/resolver. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Capture the durable CAS predecessor before a strict walk and carry it through that job's seed installation. A foreign pointer published after the cut cannot become the old job's newly adopted CAS base. Serialize final cut validation/CAS with the installed sequence swap, without holding query locks across I/O. Carry pre-cut content-bound readiness through strict reconciliation rather than losing it when equality elides disk entries. Add regressions for superseded-cut pointer stability, foreign winners after a cut, and equal-content readiness carry; update external-driver result constructors mechanically. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Count live work only for registered composite planes whose applicability predicate accepts the path. A dirty trigram entry must not invent semantic or callgraph work. Add a direct installed-bundle coverage regression; no routing or producer defaults change. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
A worker deletion must name a member of its inherited base. Reject structural no-op/foreign tombstones and cover the refusal directly. This is membership consistency, not the authenticated base digest validation explicitly deferred to s3. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Intent and readiness updates are not disk observations. Keep their versioned replay separate, and retain the latest version even for repeated identical observations so a strict walk cannot overwrite a later real read. Require observed content and size to match the manifest before pinning, storing or promoting a callgraph attachment. Add real CheckoutDriver mid-walk revert persistence and direct mismatched-observation regressions, plus replay ordering tests. Existing valid-build rejection fixtures now refresh their installed cut after seed installation; their rejection/panic assertions are unchanged. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Retain owning run Arcs for every admitted fill, including cache/store/shared hits. Register real fills atomically with view lookup before pin setup or lookup work, and perform pin I/O outside the query-state mutex. Publication trims a new binding's copy only when no fill is active and its state version still matches. Held readers retain their previous fill map, run owners, cache and pin; fresh bindings receive the trimmed copy and obsolete content is not carried forward. Serialize post-CAS state advancement and rebinding with publication ownership, then retire displaced readers outside it. Add real early-fill/publication and never-overlaid held-fill/arena-trim regressions. Update the draft cleanup test to assert current-state trimming while explicitly preserving held reader state. No expected vector values or routing defaults changed; no mutation checks are run. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Coordinate probe and sweep activity per normalized view key, including sweeps already in flight. Coordination mutexes are released before filesystem/SQLite work; publishers do not take the existing I/O-held sweep mutex, and ordinary no-probe commits retain their old scheduling path. Add deterministic tests that hold a real managed SQLite probe while same-view maintenance waits and another view progresses, and that a probe waits for an older admitted sweep. This is the explicitly granted generation.rs extension; no global exclusion, root-query lock I/O, or mutation controls. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Record execution of the real pre-claim hook so a resident/store hit cannot silently bypass the active-fill registration assertion. This is an ordinary fixture coverage assertion, not a break or mutation control. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
The new watcher/membership fence correctly requires a cut-bound completed walk, but the marker-gated 4a prototype already performs full stable content and membership verification without going through SiblingLoader::reconciled. Tag that verified cut only after its walk succeeds. Keep selector conditions and all existing test expectations unchanged. The first final views run passed 532 tests and exposed five prototype-selection failures; rerun only that affected views filter and the pending Windows compile after this compatibility correction. No mutations or full-suite rerun. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
…-install Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Accepted agent delivery; branch-keyed search descriptor included.