refactor(storage): consolidate unreleased StateOwner owner grammar in V2 - #1781
joshuajbouw wants to merge 9 commits into
Conversation
Add the explicit User owner to the pure StateOwnerCodecV2 wire grammar while keeping the runtime admission and recovery barrier crate-private. Durable commits, staging, quota, filesystem, migration, and recovery paths now fail closed before mutation, and the independent Python reader accepts the same canonical owner tags. Also register the in-band format identity amendment and preserve V1 and existing tags byte-for-byte. Signed-off-by: Joshua J. Bouw <[email protected]>
Keep the focused state-owner display decoder beside the other independent Runatal helpers while preserving the reader error boundary and direct execution path. Signed-off-by: Joshua J. Bouw <[email protected]>
Exercise PRE_USER_OWNER selection, repeated reopen-time amendment, and the process broker user-owner fail-closed boundary without changing durable semantics. Signed-off-by: Joshua J. Bouw <[email protected]>
Index the accepted successor specification from the exact predecessor before volume compatibility enforcement, while retaining fail-closed rejection for unrecognized predecessors and the runtime user-owner barrier. Signed-off-by: Joshua J. Bouw <[email protected]>
Canonical user owners are now distinguished from malformed recovery input and rejected before staging quarantine, owner migration promotion, or legacy volume promotion. Volume WAL preflight also prevents path replacement before recovery. Added byte and path preservation regressions. Signed-off-by: Joshua J. Bouw <[email protected]>
Perform read-only owner observation across root, WAL, migration, and staging recovery paths before durable mutation. Preserve existing torn and unsupported journal diagnostics while keeping resynchronization bounded. Signed-off-by: Joshua J. Bouw <[email protected]>
Bind hosted volume proof locks and identities through artifact selection and mutation, retain semantic owner errors across malformed recovery evidence, and stream WAL and staging owner scans without proportional allocation. Signed-off-by: Joshua J. Bouw <[email protected]>
Signed-off-by: Joshua J. Bouw <[email protected]>
Signed-off-by: Joshua J. Bouw <[email protected]>
|
Architecture HOLD — exact compatibility blocker This draft remains pinned at 7669e53 and is not mergeable. The bounded successor evidence remains uncommitted and unpublished. Owner-aware hosted reclaim cannot safely replace the authoritative inode under the accepted namespace-race boundary. The proof-only in-place alternative also fails: released ASTVOL1 uses the footer at physical EOF as its sole authority pointer, with absolute last_commit_offset, durable_len, and payload offsets. General lower-EOF compaction must destroy or overwrite the old authority before the new footer can become authoritative; interruption between construction, truncation, and footer publication can leave no recoverable generation. A crash-safe inode-stable shrink requires a new atomic volume-root authority mechanism (for example dual-footer/generation superblock or equivalent). That is a new on-media contract and is outside #1780. MacOS namespace mutation, directory retirement, and owner-aware reclaim remain frozen. No threat-boundary weakening, reclaim/receipt/quota semantic change, ASTVOL grammar change, merge, release, or User activation is authorized pending Joshua architecture decision. |
|
Architecture freeze — not reclaim-complete This draft remains frozen at Owner-proved same-inode shrink requires the successor inode-stable ASTVOL volume-root publication issue #1797. Generic released path-swap reclaim is unchanged. Do not add commits, retarget, or merge this pull request. Do not activate User-owned storage. |
Linked Issue
Tracking #1780. Successor work: #1797 and #1801.
Summary
Frozen predecessor for the unreleased StateOwner V2 grammar and hosted storage recovery work.
The branch is not reclaim-complete and is not a merge candidate. Its useful design and regression evidence is preserved while the inode-stable volume-root successor proceeds through #1797/#1801.
Changes
Verification
AI / Tool Assistance
Assisted-by: Codex:GLM-5.3 Flash
AI assistance was used for implementation and tests. The maintainer owns the architecture boundary and frozen disposition.
Checklist