Refresh dedup garbage fixture authority before empty Trash and inspect loaded-host timeout #1477

Open
opened 2026-10-08 16:51:14 +00:00 by kayg · 1 comment
Owner

m35triage (#1458) remaining 45-minute round: the 32-file dedup garbage fixture could not establish its empty-Trash precondition on the loaded host.

Unchanged check output:

!! dedup GC trash orphans: NO RESPONSE (b'timed out')
!! dedup GC empty trash: expected 204, got 403 b'{"code":"forbidden","message":"Access denied"}'

The following scrub completed, but all 32 requested garbage blobs remained. This is not yet evidence of failed garbage collection: the retained Index still has 29 fixture Items in Trash and three live Items, and empty Trash was denied, so those blobs remain referenced.

The fixture uses the owner Installation bearer. Its stored scope mask is 7 (account/data/admin). Empty Trash is a registered fresh-account action; SessionAuthority::fresh requires an assertion in the last 300 seconds. The probe refreshes before its scrub admission but does not refresh immediately before empty Trash. Its long upload/stat/crash sequence can exhaust that window. Production and merged authz.rs and Files lib.rs are identical. The 403 cause will receive a separate fresh/stale-session control; old expectations remain unchanged.

The 30-second trash timeout is retained as a separate responsiveness finding. At the later retained-Index check, 29 Items were in Trash and three remained live. The following explicit SIGKILL can cut off the timed-out operation; all 32 remain referenced. No missing or partial uploaded file was reported by the preceding dedup integrity and crash-publish checks. The check log is artifacts/m35triage/remaining.log and the retained fixture is target/tmp/adversarial.k8kaHs. Host load was above 50; this is a local result, not a perf VM result. Keep the latency and fixture findings open; do not treat still-referenced blobs as proven collector data loss.

m35triage (#1458) remaining 45-minute round: the 32-file dedup garbage fixture could not establish its empty-Trash precondition on the loaded host. Unchanged check output: ``` !! dedup GC trash orphans: NO RESPONSE (b'timed out') !! dedup GC empty trash: expected 204, got 403 b'{"code":"forbidden","message":"Access denied"}' ``` The following scrub completed, but all 32 requested garbage blobs remained. This is not yet evidence of failed garbage collection: the retained Index still has 29 fixture Items in Trash and three live Items, and empty Trash was denied, so those blobs remain referenced. The fixture uses the owner Installation bearer. Its stored scope mask is 7 (account/data/admin). Empty Trash is a registered fresh-account action; SessionAuthority::fresh requires an assertion in the last 300 seconds. The probe refreshes before its scrub admission but does not refresh immediately before empty Trash. Its long upload/stat/crash sequence can exhaust that window. Production and merged authz.rs and Files lib.rs are identical. The 403 cause will receive a separate fresh/stale-session control; old expectations remain unchanged. The 30-second trash timeout is retained as a separate responsiveness finding. At the later retained-Index check, 29 Items were in Trash and three remained live. The following explicit SIGKILL can cut off the timed-out operation; all 32 remain referenced. No missing or partial uploaded file was reported by the preceding dedup integrity and crash-publish checks. The check log is artifacts/m35triage/remaining.log and the retained fixture is target/tmp/adversarial.k8kaHs. Host load was above 50; this is a local result, not a perf VM result. Keep the latency and fixture findings open; do not treat still-referenced blobs as proven collector data loss.
Author
Owner

m35triage follow-up: both production af202e151 and the merged release completed the same real-server authority control with a real trashed folder:

M35 Trash fixture account scope True
M35 Trash fixture initial assertion fresh True
M35 Trash authority control {"fresh_before": 204, "stale": 403, "fresh_after": 204}

Only this disposable fixture's Installation assertion timestamp was set to 301 seconds old, then restored. The stale case rejects before deletion; the restored case succeeds. The relevant registered-action contract, authz.rs, calternal-auth and Files source trees are identical on production and the merge. This confirms the 403 is the expected fresh-authority boundary, not a newly denied owner operation. The earlier long garbage sequence did not refresh immediately before empty Trash; expiry is consistent with that sequence but its original timestamp was replaced by a later probe refresh, so exact historical expiry cannot be proved from the final row.

The original retained fixture still has 29 garbage Items in Trash and three live Items after the timeout and explicit crash. Its 32 retained blobs are therefore referenced, not orphan garbage. No collector corruption is established. Keep the responsiveness timeout and fixture-precondition repair open. They are filed non-SLOW findings, not a new data-loss or authorization blocker.

The first added production authority control returned 404/403/404 because a fresh Home had no Trash folder; that setup error is retained separately. The completed production control above establishes the missing precondition and exits 0. Logs: artifacts/m35triage/production-trash-control.log and merged-restart-control.log. No existing response expectation was changed.

m35triage follow-up: both production af202e151 and the merged release completed the same real-server authority control with a real trashed folder: ``` M35 Trash fixture account scope True M35 Trash fixture initial assertion fresh True M35 Trash authority control {"fresh_before": 204, "stale": 403, "fresh_after": 204} ``` Only this disposable fixture's Installation assertion timestamp was set to 301 seconds old, then restored. The stale case rejects before deletion; the restored case succeeds. The relevant registered-action contract, authz.rs, calternal-auth and Files source trees are identical on production and the merge. This confirms the 403 is the expected fresh-authority boundary, not a newly denied owner operation. The earlier long garbage sequence did not refresh immediately before empty Trash; expiry is consistent with that sequence but its original timestamp was replaced by a later probe refresh, so exact historical expiry cannot be proved from the final row. The original retained fixture still has 29 garbage Items in Trash and three live Items after the timeout and explicit crash. Its 32 retained blobs are therefore referenced, not orphan garbage. No collector corruption is established. Keep the responsiveness timeout and fixture-precondition repair open. They are filed non-SLOW findings, not a new data-loss or authorization blocker. The first added production authority control returned 404/403/404 because a fresh Home had no Trash folder; that setup error is retained separately. The completed production control above establishes the missing precondition and exits 0. Logs: artifacts/m35triage/production-trash-control.log and merged-restart-control.log. No existing response expectation was changed.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1477
No description provided.