Keep temporary storage in each Home private directory

kayg commented

2026-10-28 22:12:35 +00:00

Owner

Superseded by #750, which preserves the current dev ADR updates with the same tested runtime code.

Temporary notes, uploads, import images and metadata snapshots now start in one private .calternal/tmp directory per Home on the target filesystem. Publication uses atomic rename. Temporary cleanup refuses public paths; explicit Trash, creation undo and backdrop deletion use separate user-action APIs.

Replaces #744 for #642.

Private recovery covers data and split state roots. Format owners authorize legacy migration; a creator receipt alone cannot make authoritative state disposable. Unknown legacy files retain their original names. Hard links and existing descriptors prevent disposal, including a read-only descriptor later reopened for writing. Case-only moves retain a durable restoration intent. Destination group and ACL inheritance are preserved before placement.

The production cards lint exemption is removed. Removal, rename and overwrite bans cover the standard and Tokio filesystem APIs. Tests verify direct production removal and async overwrite calls are rejected. Private content stays out of note scans, watchers, lists, search, sync and attachment serving; future WebDAV and File Provider bridges must keep that boundary.

Validation passed: formatting, workspace Clippy with warnings denied, workspace tests, all 74 fsio tests, the permanent reviewer regressions from #737/#740/#742/#744, ordinary-binary startup cases, upload memory bounds, watcher publication and tree confinement. The settled 1,000-stop run preserved every acknowledged Unicode marker exactly once, matched canonical bytes to notes.get, and left no staging entries in either root. Final Rust and Cargo inputs match that binary; only five static async overwrite bans were added afterward and independently checked.

Legacy replay cleared 211 proven file images from a local 511-entry old state tree. It retained 285 directories and 15 files without sufficient proof; retained file bytes were unchanged and new private staging was empty. This is the conservative choice required by the rule to leave unproven legacy entries alone. ADR 0062 and docs/storage.md document it and the separate Trash lifecycle.

The designated performance VM was unreachable through NetBird and its direct hostname could not resolve, so there is no latency measurement claim. Detailed gate output and earlier failed checks are recorded on #642. Evidence and run artifacts remain outside the commit.

Superseded by https://git.kayg.org/kayg/calternal/pulls/750, which preserves the current dev ADR updates with the same tested runtime code. Temporary notes, uploads, import images and metadata snapshots now start in one private `.calternal/tmp` directory per Home on the target filesystem. Publication uses atomic rename. Temporary cleanup refuses public paths; explicit Trash, creation undo and backdrop deletion use separate user-action APIs. Replaces #744 for #642. Private recovery covers data and split state roots. Format owners authorize legacy migration; a creator receipt alone cannot make authoritative state disposable. Unknown legacy files retain their original names. Hard links and existing descriptors prevent disposal, including a read-only descriptor later reopened for writing. Case-only moves retain a durable restoration intent. Destination group and ACL inheritance are preserved before placement. The production cards lint exemption is removed. Removal, rename and overwrite bans cover the standard and Tokio filesystem APIs. Tests verify direct production removal and async overwrite calls are rejected. Private content stays out of note scans, watchers, lists, search, sync and attachment serving; future WebDAV and File Provider bridges must keep that boundary. Validation passed: formatting, workspace Clippy with warnings denied, workspace tests, all 74 fsio tests, the permanent reviewer regressions from #737/#740/#742/#744, ordinary-binary startup cases, upload memory bounds, watcher publication and tree confinement. The settled 1,000-stop run preserved every acknowledged Unicode marker exactly once, matched canonical bytes to notes.get, and left no staging entries in either root. Final Rust and Cargo inputs match that binary; only five static async overwrite bans were added afterward and independently checked. Legacy replay cleared 211 proven file images from a local 511-entry old state tree. It retained 285 directories and 15 files without sufficient proof; retained file bytes were unchanged and new private staging was empty. This is the conservative choice required by the rule to leave unproven legacy entries alone. ADR 0062 and docs/storage.md document it and the separate Trash lifecycle. The designated performance VM was unreachable through NetBird and its direct hostname could not resolve, so there is no latency measurement claim. Detailed gate output and earlier failed checks are recorded on #642. Evidence and run artifacts remain outside the commit.

kayg added 6 commits

2026-10-28 22:12:35 +00:00

fix: recover interrupted note renames and staged saves

CI / server (pull_request) Successful in 57s

Details

CI / rust (pull_request) Successful in 20m26s

Details

CI / web (pull_request) Failing after 2h59m10s

Details

66f27ce3cd

Preserve unjournaled staging bytes across canonical file races

CI / server (pull_request) Successful in 1m18s

Details

CI / rust (pull_request) Successful in 15m56s

Details

CI / web (pull_request) Has been cancelled

Details

e46ce1c306

wip(storage): move-then-verify quarantine for staging cleanup (unfinished) 90d8834635

Saved by the coordinator after the job stopped early; gates not yet run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013Cj2Q1hCskP8Frsk6X7EHw

test(storage): verify quarantine cleanup at concurrent replacement boundaries

CI / server (pull_request) Successful in 1m18s

Details

CI / rust (pull_request) Successful in 21m5s

Details

CI / web (pull_request) Has been cancelled

Details

ccc7a2b790

fix(storage): require durable creator receipts for all cleanup

CI / server (pull_request) Successful in 1m26s

Details

CI / rust (pull_request) Failing after 30m1s