Repository navigation
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
Reviewer's GuideThis PR introduces crash-safe, lease-coordinated compaction of verified loose objects into bounded SHA-256-addressed indexed packs, updates reads, GC, erasure, CLI/SDK reporting and documentation to support both representations, and adds extensive integrity, concurrency, interruption, and benchmark coverage. Sequence diagram for crash-safe indexed pack compactionsequenceDiagram
participant CLI as VcsCommand
participant Store as ObjectStore
participant Lease as SharedWriteLease
participant Packs as PackStorage
participant FS as Filesystem
CLI->>Store: compact()
Store->>Lease: withWriteLock()
Lease->>Packs: compact(store)
Packs->>Store: walkLooseInventory()
Packs->>Packs: publish(bytes, destination, store)
Packs->>FS: write and fsync staging payload
Packs->>FS: linkSync published pack
Packs->>FS: retire loose sources
Packs-->>Lease: PackReport
Lease-->>Store: PackReport
Store-->>CLI: PackReport
Sequence diagram for verified packed object readssequenceDiagram
participant Caller
participant Store as ObjectStore
participant Packs as PackStorage
participant Pack as IndexedPack
Caller->>Store: read(id)
Store->>Packs: read(id)
Packs->>Pack: validate index and locate range
Packs->>Pack: read compressed member range
Packs->>Packs: inflate and parseFramedObject()
Packs->>Packs: hashObject()
Packs-->>Store: StoredObject
Store-->>Caller: StoredObject
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
unbraind
changed the title
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
Loose objects can now be compacted into indexed packs while retaining their uncompressed content identities. The typed SDK and
pm vcs compactsupport both representations; GC rewrites survivors, and interrupted publication resumes with exact receipts.Fixes #151.
Physical namespace identity is captured when a storage handle is constructed. The documented
new ObjectStore(".pmvcs/objects").compact()now creates a pack and completes retirement. Eleven filesystem-owning constructors were audited; inventories, pack caches, lease keys and durable deletion sets use captured absolute coordinates. Explicit read hints, scan exclusions, lazy iterators and returned purge/deletion authority bind relative paths at API entry. Later cwd changes cannot redirect them. Equivalent spellings compare through the same captured base; a caller changing a live request's namespace fields receives a typed refusal before deletion.Every object reader uses one resolver with eight bounded attempts across loose/pack transitions. Streams retain their opened descriptor and check that descriptor after retirement. One handle helper closes deterministically on completion, early return, error, destroy and abort. One platform-aware durability helper owns flushes and namespace retirement; Windows uses file flushes and synchronous namespace acknowledgment, with its documented weaker power-loss guarantee.
Destructive operations validate all inputs and preconditions, persist a revision-bound exact deletion set, then retire only those members and finalize a receipt. Invalid requests delete nothing. Recovery keeps the original set. Changed eligibility or reachability durably supersedes obsolete authority before re-planning, so interrupted GC can progress when a candidate becomes reachable. Working-tree and lease cleanup preserve original inode authority. Completed receipts become historical when their root ends; pending entries resolve or cancel with a typed reason.
Obliteration requires every regular file under every current object root, regardless of name or extension, to be accountable native storage and payload-free. Unknown, renamed, copied, partial or truncated files refuse
unverifiable; explicit--purge-unaccountedrecords an identity-bound set, returns a receipt and re-verifies. Native decoding, raw inspection and encoded-payload inspection use the same pinned descriptor, followed by descriptor/path and whole-catalogue identity checks. Exhausting a depth, decode, byte, stream, context, count or time bound, or encountering a decoding error, yieldsunverifiedwith its bound. Incomplete integrity, reachability, checkpoint or receipt evidence never becomes a positive certificate.aee95e4,c56d797,1d372bd: await fixture owners before retrying teardown; explicit environments, ambient-agent injection and provenance assertions. Audit covers 103 isolated entrypoints and 170 explicit child launches.Behavioral revert proofs are recorded in pm-vcs-phase6packs. For the namespace class, 22 isolated behavioral reversions each fail the targeted regression; reverting the private served-owner constructor also fails the package-wide constructor invariant. Restored path and alias tests pass. Earlier reader, durability, deterministic-close, accountable-erasure, lifecycle, validate-first, named-bound and obsolete-GC-plan revert proofs remain recorded. Existing tests and thresholds were preserved.
Recovery journals now flush their file, parent, and every ancestor before destructive mutation, including separate newly created control and journal roots. Source and destination parents are flushed after rename/unlink. Destination-keyed publication receipts complete the original interrupted rename when retries use a new temporary; released source-keyed receipts migrate under their original lease. Descriptor-owned process leases make ref, log, registry and bisect recovery safe after owner publication. Foreign and live owners are preserved with typed remedies.
Regression evidence includes both durability capabilities, 17 competing publication schedules, 16 directory-recovery schedules, eleven foreign-directory classes, released source-keyed receipt compatibility and forced fail-closed receipt budgets. Behavioral reverts for ancestry, interrupted rename reconciliation, empty-directory recovery and copied receipt capabilities fail; restored implementations pass. Reverting additive audit preparation also fails its new regression (0 audit objects instead of 1), then passes after restoration. All proofs are recorded in the PM item.
Erasure prepares immutable audit objects before freezing purge membership and activates denial only after intent publication. This prevents an interrupted purge from creating an unplanned audit temporary. Existing native SIGKILL tests and their exact receipt assertions remain intact. Caller-specific bisect lock remedies and ref expected/current details are retained.
The power-loss harness now covers seventeen publication/retirement/recovery sequences. Native namespace-only link, rename and unlink restoration preserves content mtime while reflecting inode metadata changes; both cached and uncached oracles check this rule. The completed recovery matrix retains every native fault cut and executes two convergent replays for each distinct crash image. The new completed sweeps cover 3,430 repack boundaries / 383 images, 2,980 packed-GC boundaries / 323 images, 2,304 obliteration boundaries / 272 images and 553 native process-stage recovery boundaries / 66 images: 9,267 boundaries and 1,044 full crash images in total, with two recovery replays each. Earlier completed metadata/ref/compaction/unpack/lease/prune/log and journal-recovery evidence remains recorded in the PM item. Unfinished or superseded sweeps are not claimed as passes.
Resuming the prior CI exposed six failures on each Node gate (2,211/2,217 passing). Native lease stages are now fully parsed and identity-bound; orphan retirement uses durable exact-set authority under the new lease and preserves live/foreign owners. Erasure deduplicates its operation log inside that same log lease. Staging alias cleanup settles before a new pack deletion snapshot, with pinned post-unlink identity evidence so peer replacements still refuse. Public recovery takes the store writer lease. GC resumes its recorded survivor rewrite even when interruption left only loose live objects, and preview/apply share exact-key checkpoint inspection with named verification bounds and explicit foreign-record outcomes. The reader roster classifies the existing additive audit writer without changing its 25-reader enumeration. Eight isolated function/condition revert proofs each fail once and pass after restoration; the PM item records them.
Validation on pushed head
3865a97abf8369b47edce223a90a5ab08137218b: source/test typecheck, lint, 554 documented declarations, zero duplication, strict PM health and changelog checks pass. PM-linked corpus/stream/CLI pack tests pass 5/5; the current regression selection passes 17/17, including 39 competing-owner transitions and three real SIGKILL modes. Rebuilt and npm-packed Node/Bun SDK consumers plus the installed project CLI pass 6/6, zero skipped; package privacy inspects 312 files with zero findings. Committed self-host acceptance: passed after regeneration and commit; all three commits in this resume completed their required write/commit/accept cycle.Current-head CI: pending at the 19:07 UTC observation cutoff within the requested 45-minute cap. Windows GC passed 2/2; CodeQL passed 1/1. Both Node 22/26 npm release gates are running and their Bun gates follow: 0/4 full release gates complete. Current main is merged through
bef2611by two-parent mergefc403e4(parents8b945ebandbef2611); no rebase or force push. Full npm/Bun release certification remains pending until the exact-head gates pass. Existing tests, thresholds and dependency pins are unchanged.Real public-fleet validation used a read-only tracker copy at
c7790d45aab22a3a28b4d44955a592dfc06e715e, outside Git: 330 tracker files, 343 objects and 686 matching loose/packed reads.301 samples per representation on a busy host; no median speed-improvement claim. Durable audit metadata is measured separately. Reproduction:
scripts/pack-benchmark.ts,docs/indexed-pack-benchmark.json. Format, SDK example and remedies: README,docs/indexed-packs.md,docs/destructive-operations.md.PM items remain unclosed; the feature remains in_progress and the implementation claim is released: pm-vcs-phase6packs, pm-vcs-annotationteardown, pm-vcs-testenv; parent pm-vcs-b7cb. Optional erasure-fingerprint transport is tracked in pm-vcs-erasureprooftransport.
SDK capability audit: existing item lookup, list/history, locks, settings, transactions and renderers remain on the PM SDK. Public asynchronous
commitWorkspaceTransactionexists; there is no synchronous descriptor-bound compressed-range primitive.PmClienthas item-closing methods but no client-disposal/pending-worker-drain API. A cappedlistAssuranceVerdictsquery refuses certification. Native fingerprint transport is a package follow-up, not an SDK gap. No implementation requirement is deferred as an SDK gap; final CI certification remains pending.Limits: packed GC/erasure needs temporary loose capacity. Verification proves a stable inspected namespace under its lease; it does not wipe sectors or external backups. Receipts retain their audit history. No merge or release.