From 3ee92fe2f55b84c0909096ea4b664ec5fcc5672b Mon Sep 17 00:00:00 2001 From: Libby Date: Thu, 12 Nov 2026 02:52:11 +0000 Subject: [PATCH] cultcache-py: changelog for read-only unread slots; batch and unlisted-id tests Co-Authored-By: Claude Sonnet 5.5 --- packages/cultcache-py/CHANGELOG.md | 2 ++ .../cultcache-py/tests/test_slot_readonly.py | 25 +++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/packages/cultcache-py/CHANGELOG.md b/packages/cultcache-py/CHANGELOG.md index 95f82042..b30ca93d 100644 --- a/packages/cultcache-py/CHANGELOG.md +++ b/packages/cultcache-py/CHANGELOG.md @@ -9,6 +9,8 @@ ### Breaking +- A record whose payload carries a slot past its reader's declared slots, at any depth (the document, a nested record, a list element, a union arm, a unit arm), is read, held read-only, and every write or removal of its key (`put`, `put_global`, `update`, `put_envelope`, `put_envelopes`, `delete`, `delete_global`) is refused with `SchemaConflictError` before any store is touched (`cultlib-gaps:ruling:extra-trailing-slots`). Reading dropped those slots silently and the next write shed them. `SchemaConflictError.unread_slots` is an `UnreadSlots(type_name, slot_count, declared_count, occurrences, depth0_only)` and the message names the type and both counts, never a slot value. A depth-0 mark is consented, and the record writable, only when the record arrived under an id the document lists in `compatible_schema_ids` and that id's catalog entry has slots past the document's, covering the mark's slot count (`cultlib-gaps:ruling:slot-mark-consent`); a nested mark, or a mark under the document's own id, keeps the record read-only whatever is declared. Missing trailing slots keep their declared defaults. An untouched marked record keeps its stored bytes through every other write. Added `CultCache.is_writable(document, key)` (advisory; the write still decides), `DocumentDefinition.decode_payload_marked`, and `UnreadSlots`. A document with a custom `decode` (no slot codec) never marks. A store holding a variant record is still unreadable here. Implies a minor bump while the version is 0.x (0.3.0 to 0.4.0): code that wrote back a record from a newer writer now gets `SchemaConflictError`. + - A cache holds one record per key whatever its type (`variants:ruling:cache-refuses-retype`). A `put`, `put_envelope`, `put_envelopes` or `put_global` of a second type under a key the cache holds, or under a key a store carries foreign, is refused with `SchemaConflictError` naming the key, even with no store, and changes nothing; retype a key by deleting it, then putting the new type. A write may replace another registered type's record only when the written type owns its schema id (declares it or lists it compatible) and both types share one home store. A load that reads one key from two stores, whatever the types, is refused with `CultCacheError` naming the key and both types, and admits nothing. A store that holds a record no registered type claims now loads and is carried: the cache does not serve it, the store keeps its bytes through every write, `delete` or `put` at its key is refused with `SchemaConflictError`, and registering a type that declares its schema id claims it at the next load. It raised `CultCacheError` "Unknown persisted document type". Two global types share the key `__global__`, so a second global type in one cache is now refused, and a store that already holds two global types at `__global__` (a JSONL store written by caches that never pulled could produce one) no longer loads: the pull raises `CultCacheError` and admits nothing. C# refuses a second persisted global on pull the same way (`cultcache-store-composition.md`, "Globals never invented"); repair such a file by deleting one of the two records with the runtime that wrote it. - Added `foreign_records()` and the frozen `ForeignRecord(key, schema_id, schema_name, stored_at)`, sorted by key in UTF-16 code-unit order. `stores.retyped` and `stores.written_owns` lose their underscore: the cache judge and the single-file store's commit guard ask one predicate. diff --git a/packages/cultcache-py/tests/test_slot_readonly.py b/packages/cultcache-py/tests/test_slot_readonly.py index ef6c0a7d..03cf6af9 100644 --- a/packages/cultcache-py/tests/test_slot_readonly.py +++ b/packages/cultcache-py/tests/test_slot_readonly.py @@ -226,6 +226,31 @@ class StoreRowTests(unittest.TestCase): cache.pull_all_backing_stores() self.assertFalse(cache.is_writable(surface_document, "arrived")) + def test_a_batch_of_envelopes_that_carry_extra_slots_is_held_read_only(self) -> None: + path, cache = self._store("extra-slot-store.cc") + envelope = cache.get_required_envelope(surface_document, "clean") + batch = [ + type(envelope)(**{**envelope.__dict__, "key": key, "payload": _vector(file)}) + for key, file in (("b1", "extra-slot-arm.msgpack"), ("b2", "union-surface.msgpack")) + ] + cache.put_envelopes(surface_document, batch) + self.assertEqual([cache.is_writable(surface_document, key) for key in ("b1", "b2")], [False, True]) + + def test_a_mark_under_an_id_the_reader_does_not_list_compatible_is_not_consented(self) -> None: + unlisted = define_database_entry_type( + "tests.union_surface", + [database_entry_field("id", 0, codec=t.string)] + [database_entry_field(n, i, codec=c) for n, i, c in ( + ("version", 1, t.int32), ("root", 2, _parity._node), ("outcomes", 3, t.list(_parity.outcome)), + ("part", 4, t.nullable(_parity.item)), ("crafted", 5, t.nullable(_parity.crafted)), ("missing", 6, _parity._node))], + name="id", + schema_id="tests.union_surface.v2", + schema_name="tests.union_surface", + ) + path = self.tmp / "unlisted.cc" + _copy_store_without_variants(VECTORS / "extra-slot-consent.cc", path) + cache = _open(path, unlisted) + self.assertFalse(cache.is_writable(unlisted, "consented")) + def test_writing_another_record_and_flushing_carries_the_marked_one_unchanged(self) -> None: path, cache = self._store("extra-slot-store.cc") original = {e.key: e for e in SingleFileMessagePackBackingStore(path).pull_all()}