kayg/calternal

Watch

Fork 0

WebDAV GET of a live Note can return an ETag that does not match its bytes (spurious 412) #966

New issue

Open

opened 2026-10-03 04:14:28 +00:00 by kayg · 9 comments

kayg commented

2026-10-03 04:14:28 +00:00

Owner

Found by the merge-round-7a full adversarial runs (#427, round 5), editor area external-write (tests/adversarial/editor.mjs, #634 three-surface case). Intermittent: it passed in one full run and failed in two.

Problem

While a live Note room is open, a WebDAV GET of the Note can return an ETag that does not match the returned bytes. The client's conditional PUT with that ETag then gets 412 Precondition Failed, although nothing changed the file between its GET and PUT.

Evidence (verbatim, run 4)

FINDING editor external Note body write during a live room seed=25608414: WebDAV write returns 412; bytes unchanged since GET; ETag "f0c38486a0918db28581d6d146847a27e0678c5064a70cac9c529fc4b0887cdb" -> "00c230ba454eb5fd00c2fffa…"

The probe GETs the Note over WebDAV with an App Password, PUTs the edited body with If-Match: <GET ETag>, receives 412, then GETs again: the body is byte-for-byte the same as the first GET, but the ETag differs. The Files DAV ETag is the indexed content hash (crates/plugins/files/src/dav.rs, open_read → indexed_hash → index::known_hash), so two different hashes for identical bytes mean that at least one GET returned a hash that does not describe its body.

Sequence before the GET: the live editor client deletes a root block, MCP calternal_api_update_body writes twice, the editor types and the save is observed through the Notes API. Run 3 failed the same way (412 only; the evidence line was added for run 4).

Impact

No data loss: the server rejects the write and the bytes stay intact. But a WebDAV client (Finder, a sync tool, an Apple Notes bridge) that edits a Note while it is open in calternal can get repeated spurious conflicts.

Suspected area

open_read holds the mutation lock and checks that the opened inode still matches the path, and identity_at_path checks the index row fingerprint. Check whether a Notes room save can record a files_index.hash that is not blake3 of the bytes it wrote (for example a hash computed before normalization), or update the file and its index row in two steps outside the Files mutation lock.

Regression test

A Files/Notes integration test: open a live room, save through the room, then assert that a WebDAV GET's ETag equals blake3 of the GET body, and that a PUT with that ETag succeeds.

Found by the merge-round-7a full adversarial runs (#427, round 5), editor area `external-write` (tests/adversarial/editor.mjs, #634 three-surface case). Intermittent: it passed in one full run and failed in two. ## Problem While a live Note room is open, a WebDAV `GET` of the Note can return an ETag that does not match the returned bytes. The client's conditional `PUT` with that ETag then gets `412 Precondition Failed`, although nothing changed the file between its GET and PUT. ## Evidence (verbatim, run 4) ``` FINDING editor external Note body write during a live room seed=25608414: WebDAV write returns 412; bytes unchanged since GET; ETag "f0c38486a0918db28581d6d146847a27e0678c5064a70cac9c529fc4b0887cdb" -> "00c230ba454eb5fd00c2fffa…" ``` The probe GETs the Note over WebDAV with an App Password, PUTs the edited body with `If-Match: <GET ETag>`, receives 412, then GETs again: the body is byte-for-byte the same as the first GET, but the ETag differs. The Files DAV ETag is the indexed content hash (`crates/plugins/files/src/dav.rs`, `open_read` → `indexed_hash` → `index::known_hash`), so two different hashes for identical bytes mean that at least one GET returned a hash that does not describe its body. Sequence before the GET: the live editor client deletes a root block, MCP `calternal_api_update_body` writes twice, the editor types and the save is observed through the Notes API. Run 3 failed the same way (412 only; the evidence line was added for run 4). ## Impact No data loss: the server rejects the write and the bytes stay intact. But a WebDAV client (Finder, a sync tool, an Apple Notes bridge) that edits a Note while it is open in calternal can get repeated spurious conflicts. ## Suspected area `open_read` holds the mutation lock and checks that the opened inode still matches the path, and `identity_at_path` checks the index row fingerprint. Check whether a Notes room save can record a `files_index.hash` that is not blake3 of the bytes it wrote (for example a hash computed before normalization), or update the file and its index row in two steps outside the Files mutation lock. ## Regression test A Files/Notes integration test: open a live room, save through the room, then assert that a WebDAV GET's ETag equals blake3 of the GET body, and that a PUT with that ETag succeeds.

kayg commented

2026-10-03 11:34:56 +00:00

Author

Owner

Started on job/davetag-966, base d4e7188810 (origin/dev). I will trace live Note saves and Files Index hash publication, then add the Files/Notes DAV regression requested by this issue. No UI changes planned.

Started on job/davetag-966, base d4e7188810a89fb0e8e6b162279917f7e23989f9 (origin/dev). I will trace live Note saves and Files Index hash publication, then add the Files/Notes DAV regression requested by this issue. No UI changes planned.

kayg commented

2026-10-03 11:38:46 +00:00

Author

Owner

Finding: prepare_index_write reused the previous hash under same || preserve. adopt_change calls record_preserve after a Root write, so it stored the old digest with the new inode fingerprint. A later Notes callback records a fresh digest, which explains identical GET bodies with different ETags. The fix permits cached hash reuse only under same; identity preservation still follows same || preserve. Added a live-room → change-bridge → DAV GET/If-Match PUT regression for both adoption paths (with and without the pre-write fingerprint). Final origin/dev sync: already up to date.

Finding: prepare_index_write reused the previous hash under `same || preserve`. adopt_change calls record_preserve after a Root write, so it stored the old digest with the new inode fingerprint. A later Notes callback records a fresh digest, which explains identical GET bodies with different ETags. The fix permits cached hash reuse only under `same`; identity preservation still follows `same || preserve`. Added a live-room → change-bridge → DAV GET/If-Match PUT regression for both adoption paths (with and without the pre-write fingerprint). Final origin/dev sync: already up to date.

kayg commented

2026-10-03 11:59:34 +00:00

Author

Owner

Progress: the focused regression is still compiling the cold job target under CARGO_BUILD_JOBS=4, with no compiler errors. It has reached calternal-plugin-notes. The implementation is complete (one hash-reuse condition plus comments); I am waiting for the required test/gate evidence before making the atomic fix commit. No server build, web build or broad adversarial round is running.

kayg commented

2026-10-03 12:17:29 +00:00

Author

Owner

Checkpoint commit created for the focused fix and regression because the initial build remains delayed on host I/O. Validation is PENDING, not claimed as passed. cargo fmt --check and git diff --check passed. The live regression compiler thread is waiting in folio_wait_bit_common; /proc/pressure/io reported some avg10=66.70, while free memory and disk remain available. Required per-crate tests and clippy will continue before the final report.

kayg commented

2026-10-03 12:27:23 +00:00

Author

Owner

Regression evidence: the fixed code passes the live-room DAV test (1 passed). Restoring only the old same || preserve hash-reuse condition makes it fail at the GET digest assertion: returned ETag b276683e1c3daa7f714d3755e20d686cb96dc0e2682b79c9bab6769f48de8a14 versus GET-body BLAKE3 70e000ec4b91842906464f54abcadde62c9482fde298b2cad9b2c8c39a262934. The fix is restored. A second atomic commit corrects the new test fixture to use a UUID User ID (the Hub rejected the initial short fixture ID). Final per-crate clippy/test gates are now running.

Regression evidence: the fixed code passes the live-room DAV test (1 passed). Restoring only the old `same || preserve` hash-reuse condition makes it fail at the GET digest assertion: returned ETag b276683e1c3daa7f714d3755e20d686cb96dc0e2682b79c9bab6769f48de8a14 versus GET-body BLAKE3 70e000ec4b91842906464f54abcadde62c9482fde298b2cad9b2c8c39a262934. The fix is restored. A second atomic commit corrects the new test fixture to use a UUID User ID (the Hub rejected the initial short fixture ID). Final per-crate clippy/test gates are now running.

kayg commented

2026-10-03 12:40:15 +00:00

Author

Owner

Progress: head f1b1398522; working tree clean. Fixed-code regression passes and old-condition comparison fails the intended digest assertion. Format gate passed. Files clippy is still checking the cold target dependency graph without warnings; per-crate tests and collaboration clippy remain queued. No broad suites, server build or screenshots have been started.

Progress: head f1b1398522bf20c2c8e201d927f5980220c82292; working tree clean. Fixed-code regression passes and old-condition comparison fails the intended digest assertion. Format gate passed. Files clippy is still checking the cold target dependency graph without warnings; per-crate tests and collaboration clippy remain queued. No broad suites, server build or screenshots have been started.

kayg commented

2026-10-03 12:57:48 +00:00

Author

Owner

Gate progress: Files clippy is still checking dependencies on the shared host (authentication/protocol graph now), with no warnings or errors. The deterministic regression has already passed with the fix and failed with the old condition. Remaining required work is the completion of per-crate clippy/tests, final verbatim gate report and cargo clean. No implementation changes since f1b139852.

kayg commented

2026-10-03 13:24:10 +00:00

Author

Owner

Gate finding: Files clippy passed. Files tests: test result: FAILED. 145 passed; 1 failed; 1 ignored; 0 measured; 0 filtered out; finished in 361.14s. The sole failure is internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm at lib.rs:5114: writes, reconcile scans, and watcher adoption complete within five minutes: Elapsed(()). A secondary worker reports atomic write 863 entry not found after the timeout aborts tasks and drops the temp directory. This is a bounded storm timing failure under the observed host I/O pressure; no assertion of an indexed temp path failed. Existing expectations are unchanged. No full-suite retry; defer this focused storm check to the merge round. Collaboration clippy and tests are still running.

Gate finding: Files clippy passed. Files tests: `test result: FAILED. 145 passed; 1 failed; 1 ignored; 0 measured; 0 filtered out; finished in 361.14s`. The sole failure is internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm at lib.rs:5114: `writes, reconcile scans, and watcher adoption complete within five minutes: Elapsed(())`. A secondary worker reports atomic write 863 entry not found after the timeout aborts tasks and drops the temp directory. This is a bounded storm timing failure under the observed host I/O pressure; no assertion of an indexed temp path failed. Existing expectations are unchanged. No full-suite retry; defer this focused storm check to the merge round. Collaboration clippy and tests are still running.

kayg commented

2026-10-03 13:33:34 +00:00

Author

Owner

Files:

crates/plugins/files/src/index.rs: restrict hash reuse to an unchanged fingerprint; document the invariant.
crates/plugins/files/src/lib.rs: document adoption's digest invariant.
crates/calternal-collab/tests/dav_etag.rs: save through a real live room, run both change-bridge adoption paths, keep a clean room open during DAV GET/PUT, assert the GET ETag equals BLAKE3 of the body, check stable item identity and successful If-Match PUT.
crates/calternal-collab/Cargo.toml and Cargo.lock: add existing workspace BLAKE3 and DAV test dependencies. No dependency version changes. cargo search verified BLAKE3 1.8.7.

Regression evidence: the fixed code passes. Restoring only the old hash-reuse condition fails the GET digest assertion (old ETag b276683e1c3daa7f714d3755e20d686cb96dc0e2682b79c9bab6769f48de8a14; body hash 70e000ec4b91842906464f54abcadde62c9482fde298b2cad9b2c8c39a262934). The initial test fixture used an invalid short User ID; the second atomic commit changes it to a UUID.

Decisions: no new product design. Put the Files/Notes/DAV integration regression in calternal-collab, which already depends on Files in tests. Invoke the Root change bridge after a live save to force it to win the race against the Notes save callback. No sleeps control this ordering.

Known gaps: Files suite has one load-sensitive timeout in the existing 1,000-write reconciliation storm. Its five-minute deadline expired at write 863; all 145 other tests passed and one test is ignored. No expectation changed. Existing Index rows with a stale digest recover on the next real content replacement. This change prevents new stale rows; it does not add a migration to audit old hashes. No UI change, UX gaps or screenshots apply. No benchmark measurement is required for this correctness issue under the 2026-10-02 verification policy.

For the merge round:

cargo test -p calternal-plugin-files internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm -- --test-threads=4 — complete all 1,000 writes and watcher adoption within the existing five-minute deadline and confirm no internal temp paths enter Index tables.
EDITOR_ONLY=1 EDITOR_AREA=external-write EDITOR_SEED=25608414 bash tests/adversarial/run.sh — check external Note writes with the combined real-server build and a live room. The current probe on this base covers Notes API; retain the round-7a three-surface DAV/MCP extension in the combined branch.
cargo test -p calternal-server -- --test-threads=4 — check the combined server's Files/Notes change bridge.
Full web tests, e2e and adversarial matrices run once on the combined branch, per the verification policy.

No push, deploy or merge to dev/main. origin/dev was fetched and merged once before final gates: Already up to date.

Head SHA: f1b1398522

Gate output (verbatim result lines; full logs remain under artifacts/):

cargo fmt --check (exit 0):

(no output)

cargo clippy -p calternal-plugin-files --all-targets -- -D warnings (exit 0):

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 39m 59s

cargo test -p calternal-plugin-files -- --test-threads=4 (exit 101):

    Finished `test` profile [unoptimized + debuginfo] target(s) in 10m 32s
test result: FAILED. 145 passed; 1 failed; 1 ignored; 0 measured; 0 filtered out; finished in 361.14s
writes, reconcile scans, and watcher adoption complete within five minutes: Elapsed(())

cargo clippy -p calternal-collab --all-targets -- -D warnings (exit 0):

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 4m 11s

cargo test -p calternal-collab -- --test-threads=4 (exit 0):

    Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 34s
test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.65s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.78s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.57s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 75.03s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.36s
test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.20s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.71s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.93s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 12.20s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.49s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 36.74s
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 26.86s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

Cleanup: cargo clean completed. Verbatim output:

     Removed 9888 files, 5.7GiB total

Web build output removed if present. Working tree is clean.

Fixed #966: Files Index adoption now preserves the immutable item ID without reusing a content hash from an old fingerprint. A changed inode is hashed again. This prevents a live Note GET from returning a stale DAV ETag. Files: - crates/plugins/files/src/index.rs: restrict hash reuse to an unchanged fingerprint; document the invariant. - crates/plugins/files/src/lib.rs: document adoption's digest invariant. - crates/calternal-collab/tests/dav_etag.rs: save through a real live room, run both change-bridge adoption paths, keep a clean room open during DAV GET/PUT, assert the GET ETag equals BLAKE3 of the body, check stable item identity and successful If-Match PUT. - crates/calternal-collab/Cargo.toml and Cargo.lock: add existing workspace BLAKE3 and DAV test dependencies. No dependency version changes. cargo search verified BLAKE3 1.8.7. Regression evidence: the fixed code passes. Restoring only the old hash-reuse condition fails the GET digest assertion (old ETag b276683e1c3daa7f714d3755e20d686cb96dc0e2682b79c9bab6769f48de8a14; body hash 70e000ec4b91842906464f54abcadde62c9482fde298b2cad9b2c8c39a262934). The initial test fixture used an invalid short User ID; the second atomic commit changes it to a UUID. Decisions: no new product design. Put the Files/Notes/DAV integration regression in calternal-collab, which already depends on Files in tests. Invoke the Root change bridge after a live save to force it to win the race against the Notes save callback. No sleeps control this ordering. Known gaps: Files suite has one load-sensitive timeout in the existing 1,000-write reconciliation storm. Its five-minute deadline expired at write 863; all 145 other tests passed and one test is ignored. No expectation changed. Existing Index rows with a stale digest recover on the next real content replacement. This change prevents new stale rows; it does not add a migration to audit old hashes. No UI change, UX gaps or screenshots apply. No benchmark measurement is required for this correctness issue under the 2026-10-02 verification policy. For the merge round: - cargo test -p calternal-plugin-files internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm -- --test-threads=4 — complete all 1,000 writes and watcher adoption within the existing five-minute deadline and confirm no internal temp paths enter Index tables. - EDITOR_ONLY=1 EDITOR_AREA=external-write EDITOR_SEED=25608414 bash tests/adversarial/run.sh — check external Note writes with the combined real-server build and a live room. The current probe on this base covers Notes API; retain the round-7a three-surface DAV/MCP extension in the combined branch. - cargo test -p calternal-server -- --test-threads=4 — check the combined server's Files/Notes change bridge. - Full web tests, e2e and adversarial matrices run once on the combined branch, per the verification policy. No push, deploy or merge to dev/main. origin/dev was fetched and merged once before final gates: Already up to date. Head SHA: f1b1398522bf20c2c8e201d927f5980220c82292 Gate output (verbatim result lines; full logs remain under artifacts/): `cargo fmt --check` (exit 0): ```text (no output) ``` `cargo clippy -p calternal-plugin-files --all-targets -- -D warnings` (exit 0): ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 39m 59s ``` `cargo test -p calternal-plugin-files -- --test-threads=4` (exit 101): ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 10m 32s test result: FAILED. 145 passed; 1 failed; 1 ignored; 0 measured; 0 filtered out; finished in 361.14s writes, reconcile scans, and watcher adoption complete within five minutes: Elapsed(()) ``` `cargo clippy -p calternal-collab --all-targets -- -D warnings` (exit 0): ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 4m 11s ``` `cargo test -p calternal-collab -- --test-threads=4` (exit 0): ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 34s test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.65s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.78s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.57s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 75.03s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.36s test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.20s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.71s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.93s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 12.20s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.49s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 36.74s test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 26.86s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` Cleanup: cargo clean completed. Verbatim output: ```text Removed 9888 files, 5.7GiB total ``` Web build output removed if present. Working tree is clean.

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

kayg/calternal#966

No description provided.

Rows
Columns