Legacy Note upload intents with later edits cannot recover after restart #1325

Open
opened 2026-10-07 06:02:29 +00:00 by kayg · 0 comments
Owner

Found during the #1295 source review, not as a non-SLOW finding in its final Journal check.

A legacy upload from production ff53d7b8b4 can rename the source, return an Index-busy 503, then leave its installing row while a later Log edit changes the Note hash. That older build writes no applied-upload witness. The #1295 regression fails on exact job/merge31 source with retry 500 instead of 204.

The new code seals failures created by the new binary. It cannot supply proof retroactively. In crates/plugins/files/src/uploads.rs, recover_installs (line 451) and resume_installed_intent (line 2305) still reject actual_hash != expected_hash && !was_installed. A changed legacy intent can therefore prevent Files startup recovery and remain unresumable after upgrade.

Keep the current bytes and do not infer that an upload applied from a changed inode alone: an intervening Note edit can change the inode before the upload rename. Define a safe legacy review/recovery path, with a regression fixture created without the new witness. Existing duplicate paragraphs also need separate review; do not delete them automatically. #1295 leaves this case conservative and reports it as a known gap.

Found during the #1295 source review, not as a non-SLOW finding in its final Journal check. A legacy upload from production ff53d7b8b4da5a21f862d57dcc3496f8c019f647 can rename the source, return an Index-busy 503, then leave its installing row while a later Log edit changes the Note hash. That older build writes no applied-upload witness. The #1295 regression fails on exact job/merge31 source with retry 500 instead of 204. The new code seals failures created by the new binary. It cannot supply proof retroactively. In crates/plugins/files/src/uploads.rs, recover_installs (line 451) and resume_installed_intent (line 2305) still reject `actual_hash != expected_hash && !was_installed`. A changed legacy intent can therefore prevent Files startup recovery and remain unresumable after upgrade. Keep the current bytes and do not infer that an upload applied from a changed inode alone: an intervening Note edit can change the inode before the upload rename. Define a safe legacy review/recovery path, with a regression fixture created without the new witness. Existing duplicate paragraphs also need separate review; do not delete them automatically. #1295 leaves this case conservative and reports it as a known gap.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1325
No description provided.