The five TestCaseSource tests each run over two sources (committed, live): ten cases, plus the one OldReaderRefListProbe case. The
first run of the count check reported 10 and 1.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
OldReaderRefListProbe.cs is staged into the 2.0.1 tree by old-reader-refusal.sh and is not part of this tree's build; its method
lacked a closing brace at fd9bbaf4, which the gate's 2.0.1-reader stage reported.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
old-reader-refusal.sh pins the expected case count of each stage as a constant (C# stages from the TRX the run writes, by class; Rust,
Python and TypeScript from their own output) and fails naming '<stage>-count' on any other number, so a probe renamed out of its filter
or a skipped leaf test no longer passes with nothing run.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Only StoredAt moves (Soul s1 vec2.log); the writer is deterministic (two runs, identical trees). The directory page is renamed by its new
content hash. A README says how they are made and compared.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The 1.0.60 ref-list summary is taken after attach, an upsert of alpha, beta and the list reversed, and a flush, at 2.0.1 and at
head, and names records by schema id (the restamp-on-write ruling makes them equal). C2aGateWriter stamps every record with one
instant and compares the committed vectors byte for byte, the directory store as relative path and bytes with lock files left out.
The committed vectors are regenerated in the next commit, so TheCommittedVectorsAreWhatC2aWrites is red at this commit; it builds.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Kills the two survivors of the claimant lookup over written entries (Named inverted, Owner dropped).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
ReadStore refuses a record whose schema the catalog does not publish, so the
file-level scenario the spec named cannot be built; the rule is pinned where it is decided.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
CultDocumentRegistry.Claimant is now the only precedence that decides which entry
reads a persisted catalog entry, static over a lookup (a registry's indexes, or the
entries a registry-less cacheless write writes). ClaimantEntry is deleted. A cacheless
WriteDocument or WriteRecord lent a registry is never more permissive than a cache
registering the same types; an unpublished id is carried, not owned, through Owns' catch.
Fixes the four Low findings of variants:verdict:cut-restamp-on-write.s2.
Not yet verified on Yggdrasil when committed.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Hand mutants dropping each copy survived the full Caching suite; the flag is read only through the store's Entries (RefuseUndeclared), which
ToStoredDocument sets, so the cache's resolved variants and flattens were never asked.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Owns is now a static rule over (declared, claimantOf): a registry supplies both from its indexes, a cacheless writer supplies its one entry, so
the hand-written cacheless lambda is deleted and a renamed entry listing the writer's id is owned by both. The schema-name check is the
claimant selection and is pinned. Variant read-whole flag pinned for rewrite, flatten and remove.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Stryker found the true default and the two Wrote sets equivalent: a constructed or written record is stored under its type's declared id, so the flag is never asked. Not run at this commit.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The spec's account (guess null, then a successful attach) takes two gates, not three: the guess gate is taken only for a non-null guess.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The ForeignRecordTests read-only fixtures (another runtime's deck, the moving deck) had the same shape as the deck, which the
type now reads whole and owns; each gets a slot the deck lacks, so it is read only by dropping it. RestampOnWriteTests and the
successful-churn gate test are corrected from the first run. Not run at this commit.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
CultDocumentRegistry.Owns replaces Declares as the one answer to whether a writer may write, relabel or remove a record under a
schema id: the id is declared, or the type that reads it reads it whole (equal content hash, or compatible shapes with no persisted
slot ignored). Staging asks the declared half or CultStoredDocument.StoredSchemaReadWhole; the apply halves (single file,
directory, cacheless CultMesh) ask Owns over the durable catalog, once per distinct id. A record read only by dropping slots
stays read-only until its id is declared compatible.
Not built or run at this commit: verified on Yggdrasil at the cut's head.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A cacheless write that re-enters its own store's hold now consults Cache first, so a journal's WriteDocument or WriteRecord gets the same refusal during an attach as after it (the attached text); the re-entry text no longer names an attach's pull. InStoreHold takes the store instead of its gate.
CacheBackingStore.GateTakes (internal, thread-static) counts the gates Gate takes; OneStoreCallTakesAtMostThreeGatesUnderFailingAttachChurn asserts at most three per call under failing-attach churn, which pins the stale-guess loop (M4b).
The contract and AddBackingStore say what holds: other threads may guess the tentative cache, but none runs a body against it.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The folded-in writedoc case used to assert the refusal left the attach's registry in place and a later PullAll succeeded; the per-entry-point test now asserts that for every entry point.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The previous code commit's AJournalOnTheAttachingThreadCannotReachItsStore failed all 21 cases:
AddAsync mints its own key, so "later" never appeared. That commit builds; its new test is red.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Cache is the one attachment fact. AddBackingStore, the only writer, publishes it right after the
registry loan and sets it back to null in the catch, all inside its hold of both gates, so a
journal's store call during the attach is refused as it is after it (it used to stage or write
records the cache never admitted). Gate loses MaxPasses and its loop: the guessed cache's gate,
the store's gate (where Cache cannot change), then the settled cache's gate. Tests: one per store
entry point through a real attach (single-file and directory), each asserting the attaching cache
and a fresh cache agree after a flush; the second-store refusal pinned before the same-store one;
the three attach tests renamed to the published-cache shape. The old
AJournalOnTheAttachingThreadCannotWriteItsStoreCacheless is the writedoc case of the new test.
This commit builds; docs follow in the next commit.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Fixes two tests of the previous commit that failed on their own fixtures (the inner call's
exception was swallowed in the hook; a variant that shares its base's name is refused). Builds.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
InStoreHold gains a cacheless flag: on re-entry of the same gate a cacheless call throws
instead of running, so the attach's hold (until it publishes Cache) and an enclosing store
call's user code cannot write the store behind the cache. Gate passes the flag; no field
mirrors Cache. Tests through a real attach and a nested cacheless write, a header pin for
attached variant stores, contract and CHANGELOG.
Builds on the previous commit; neither is built or run until the verify job.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Deletes CacheBackingStore._codec and UseRegistry's codec parameter, the reflection LentCodec
test helper and the bare-store codec test. The cache re-resolves every pulled variant with its
own codec when it admits the load.
Not yet built or tested; the verify job at the head covers every commit.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
UseRegistry(registry, codec) is the single writer of both loans; the pull builds
variants with the store's own codec, a failed attach takes both back through the
same call, and AddBackingStore sets store.Cache last. Cache now goes from null to
a cache at most once, so Gate's retry makes at most two passes: the 1,000 stale
cap becomes MaxPasses = 2 and its comments say why.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kills the survivors of the first mutation table (no recheck in the store branch, a Gate() that refuses the held cache, a stale
retry result, a same-store reentry refusal).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CultCache owns the per-thread gate facts: _storeHeld joins _held. InStoreHold marks the store gate; Gate() is where every
cache gate entry (holds and reads) refuses while that mark is set and the gate is not already the thread's. A getter run by a cacheless
call or an attach that reaches a cache or a second store throws instead of deadlocking against an attach.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
