Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
4.3 KiB
4.3 KiB
Filbert review: row 185 round 1 (#1683), approve
Request 29403. Candidate manifest bf87dbba645b5c4443670e4a81f44a99afedad6ab16ae0f125d6ab8de27bce3b (3 paths) on base 52ce57dfe. The brief is docs/plans/2026-10-20_activate-always-backs-up.md.
Verdict: approve. No findings block. N1 is a note, and N2 is doc-only.
What I ran
- I built
~/filbert-scratch/r185-r1/wtatb5d662cab(the refactor head), then rangit apply --index build.patch.sha256sum -con the manifest passed 3/3.- The patch-id is
774cd23186d5: 3 files, +121/-16.
- Base drift:
git log 52ce57dfe..refactoron the 3 paths is empty. - Readers and pins: the only test that reads
scripts/stack-release.shisstack-release.test.mjs. No test readsdocs/TOOLS.md, and no 64-hex pin names any of the 3 paths. - I took the slot after sage-1235. The /proc busy check was CLEAR at 07:04:01Z and 07:08:34Z, and TMPDIR was
~/fs185.stack-release.test.mjs: 125/125 pass, 0 fail, rc 0, from 07:04:02Z to 07:08:12Z. The counts are awk sums over the spec log.
- I ran two mutants of my own, each restored by
git checkout. After them the tree had only the 3 staged paths.- M4 moves
backup_storeahead of thestore-newerandmigration-needs-flagchecks. Run against T6 and T9: killed, rc 1, 2 of 2 failed. So BUILD.md's choice, no backup for a run that never touches the store, is pinned. - M5 removes the plan's
$OP != activatebranch, so a rollback plan prints the backup line too. Run against the row 185 tests: killed, rc 1, T50 failed (1 of 7).
- M4 moves
- Darkwing's run (125/125, m1-m3 killed) and Sage's gate are their receipts, not mine.
Checked against the brief
- Change 1. In
run_steps(candidate :845-855),backup_store || rollback_in_run backupnow runs on every activate insideif [ -e "$STORE" ]. It comes after thestore-uncleanand schema reads and before the migration. A missing store takes none (T51). - Change 2.
backup_storesets onlyBACKUP(:368).TAKEN="$ACT"is set in the migrate branch right beforemigrate-schema.mjs(:851), androllback_in_runrestores onlyTAKEN(:545).- So a same-schema gate failure puts back the units and the wrapper and keeps the store (T48, with the new
start-writes-row-<copy>fault making a restore visible by sha). rollback-failednames the backup (T11).- The
BACKUPcomments at :347-349 and :536-538 say this.
- So a same-schema gate failure puts back the units and the wrapper and keeps the store (T48, with the new
- Change 3. The plan prints one
backup:line for activate only (:814-820): the store-file form, ornone; there is no store file. T26, T29, T50 and T51 pin the exact text. The migration lines are unchanged. - Change 4.
run_steps migrateis called only from the activate path (:901). The rollback path callsrun_steps restore(:934).do_rollbackneeded no change for test 3. The same-schema backup's SCHEMA is the store's at the start, which is the rollback target's.- T49 covers the restore and the
post-backup-eventsrefusal with oneinstance_namesrow.--events 1then passes.
- Change 5. TOOLS.md steps 5-7 say a backup on every activate, a restore only when a migration ran, and a same-schema
--restore. My grep of TOOLS.md and the package READMEs found no remaining "only a migration backs up" text.packages/bus/README.md:859says--migrate"backs up the store first", which is still true. - Brief tests 1-5 are T47-T51. T5's old "no
backups/stack" assert became the activation's one backup, as the brief allows. T6 and T9 still assert no backup, and T8's migration case still restores. - Brief mutants: Darkwing's m1-m3 are the brief's three, so they're their receipts. My M4 and M5 add the two ordering and plan checks above.
Notes
- N1 (script output, doesn't block): the plan prints
backup: the run backs up the stopped store ...even when it also says the run would roll back withmigration-needs-flagorstore-newer. In those cases the run takes no backup (M4 shows the tests require that). T26's not-given case pins both lines together. BUILD.md chose this on purpose, and the roll-back line is right above it, so it reads as "if the run goes on". A follow-up could print the line only when the run reaches the backup. - N2 (doc-only, follow-up): TOOLS.md step 3 lists what
--plannames and doesn't mention the backup line. BUILD.md leaves step 3 for Sage, and no test reads TOOLS.md.