From 1a59242709242b5c9b8fb85e13a20141d4153d15 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Thu, 24 Sep 2026 18:04:37 -0700 Subject: [PATCH] memory: r3 arc live and pushed; the upload route's three known gaps --- persistent-memory.md | 39 +++++++++++++++++++++++---------------- 1 file changed, 23 insertions(+), 16 deletions(-) diff --git a/persistent-memory.md b/persistent-memory.md index 12d1f12..aee59ba 100644 --- a/persistent-memory.md +++ b/persistent-memory.md @@ -19,22 +19,28 @@ loop it turned out to actually be. _As of 2026-09-24:_ -- ✅ **r3 COMPARE IS LIVE, NOT PUSHED** (operator: "merge r3 once the - mutation check is clean", 2026-09-24). Fast-forwarded to design-dev's - `f8d136a` after our own run of the gate on that exact commit: 918 passed, and - 148/148 falsifiers proved (r2b 55, r2c 36, r3 57). Service restarted at 1557 - and checked with `/healthz`, the Desk, `/openapi.json` and an empty-pair 404 - only. **origin/main is still `d5ead3f`; the push is the operator's call.** - Our seam pass on the contract caught 12 mismatches before code, the two that - mattered being duplicate `data-region` ids (a save would have made B's flag - button flag A) and 22 mutation-table rows anchored in the script that moved. - **Open, design-dev's to take or refuse:** the review route calls - `cring.index(f)` after a second resolve of `f`, so a file removed or relinked - mid-request is a `ValueError` 500 on the review page (a narrow race; compare's - `ring.index(a)` is the same shape). The accepted-not-fixed list from the heid - bug hunt is in `docs/contracts/r3_compare.contract.md`. -- ✅ **PUSHED: origin/main = `d5ead3f`, 888 green** (local main is ahead: the - 09-24 memory snapshot, r3 and its roadmap commit). On 09-23 landed, in +- ✅ **r3 COMPARE IS LIVE AND PUSHED** (operator: "merge r3 once the mutation + check is clean", then "merge and push", 2026-09-24). origin/main is the r3 + arc's tip: r3 (`f8d136a`), design-dev's race fix (`d54bb04`: one compare ring + per request, the review's Compare control hidden when its item vanished + mid-request, and a NUL in a raw file path returning 404) and our upload-name fix + (`225ba32`). The gate on that exact tip: 928 passed, and 245/245 falsifiers + across all 8 tables. The service was restarted at 1804. Our seam pass on the + contract caught 12 mismatches before code; the two that mattered were + duplicate `data-region` ids (a save would have made B's flag button flag A) + and 22 mutation-table rows anchored in the script that moved. +- ⚠ **THE UPLOAD ROUTE HAS THREE KNOWN LIFECYCLE GAPS, unfixed on purpose** + (hulda, 2026-09-24; the operator was told and did not ask for them): + - the pickup-id `mkdir` sits outside the try, so a racing writer that + creates the same id first gives a FileExistsError, a 500; + - `rmtree(ignore_errors=True)` hides its own failure, so a failed cleanup + can leave a half-written booth; + - `except Exception` misses CancelledError, so a cancelled upload skips + cleanup. + All three are rare. The helper next to them, `safe_upload_name`, is done: + unencodable characters go first, the cap is in bytes, and a cut never + manufactures a kind. +- ✅ **Pushed on 09-23 (`d5ead3f`, 888 green).** Landed that night, in order: r2b merge 1 (`b92b002`, reveal all + booth fog), r2b merge 2 (`cce6a20`, Desk row + dates + theme toggle), the Desk sort (`64f6488`), the blur round-trip (`6880ab3`), 768-wide thumbnails (`1d31ab0`), r2c the review @@ -85,6 +91,7 @@ _As of 2026-09-24:_ ## Recent decisions +- `[2026-09-24]` ✅ **Upload names: two crashes found, then two holes in the fix** — a NUL and a name over NAME_MAX in BYTES both 500'd /upload. Our first fix then dropped a lone surrogate AFTER the dot rule (`\ud800.forever` came out as the keep marker) and let a cut manufacture `.png`. A single hulda arm found both after heid's own read found nothing. READ BEFORE WRITING A SANITISER: drop everything droppable FIRST, then apply the structural rules. A NUL test through httpx `files=` sends a literal `%00` and proves nothing. - `[2026-09-24]` ✅ **r3 compare merged on the operator's word, gated by our own run** — fast-forward to `f8d136a` only after 918 green and 148/148 falsifiers on that exact commit, run here rather than taken from design-dev's report. The seam pass is what made the build clean: 12 contract-vs-code mismatches folded before a line was written. - `[2026-09-24]` ✅ **r3 compare ruled: pick two, flag the winner** — operator, in design-dev's session. No `booth_items` or marks work; the URL is rel-keyed. The A/same/B pairwise verdict is **PARKED (deferred)**, with our ordered-pair-of-rels note attached. Tracked in design-dev's r3 contract parked entry, althing thread `01M3952NCDRRJX5XDFSPMSP5HJ`. - `[2026-09-23]` ✅ **The Desk's "Everything else" sorts by last UPDATE, not last activity** — the operator chose the simple fix over repairing `.viewed` from the access log. READ BEFORE CHECKING THE LIVE SERVICE → `persistent-memory.d/2026-09-23-desk-sorts-by-last-update.md`