contract store · 10-store.md · 11-snapshot.md · 12-time.md · 13-replica.md · 14-drain.md · 15-endpoint.md · 16-collect.md · 17-merge.md · 18-pull.md · guide · card
Bucket manifest merges
A push commits the bucket manifest by merging its own entries into the remote ones under a conditional replace.
merge
Merging bucket manifests across writers, verifying tombstones and retrying conditional manifest commits.
tombstone-ownertesttesttheoremA tombstone whose owner differs from the owner of the entry it names raisesSyncTombstoneForeign, and the merge keeps the entry.tombstone-signedtestPush signs eachTombstonewith the node’s issuer key over the key it names, its owner and its deletion instant. A node without an issuer key writes unsigned tombstones.tombstone-unverifiedtesttesttheoremUnsigned tombstones, invalid signatures, or keys absent from the key-set ledger’s verifying set atdeleted_atraiseSyncTombstoneUnverified. Merge preserves the named entry; pull deletes nothing.tombstone-ttltesttesttesttheoremA tombstone leaves the manifest 30 d after itsdeleted_at.retriestest[sync] push_retries, default 5 attempts, bounds consecutive re-commit rounds whose re-read manifest carries no newer generation than the round before.round-ceilingtestA push stops its manifest commit loop after 64 rounds, whatever generations those rounds meet.exhaustedtestExhaustingretriesorround-ceilingraisesSyncManifestRebaseExhausted, reports every uploaded object as in the bucket and asks for a re-run.cursor-recencytesttesttheoremResolving a cursor by last-write time raisesSyncCursorConflict. A cursor resolves through its commit.scoped-uniontesttesttesttheoremA merge takes local entries owned by this writer or unowned, and all other remote entries. It tombstones a writer-owned remote entry only whenheld-recordlists the key and the store lacks the file.held-recordtestPush records locally held owned keys under its node id in.sync-held.json, adding before commit and replacing that node’s keys after; a pull holding the push guard adds each such key the bucket manifest lists.held-absenttestWith no keys for the node in.sync-held.json, a surviving.push.lockmeans the store holds every remote key the node owns, and none without it.held-unreadabletestAn unreadable.sync-held.jsonraisesSyncHeldRecordUnreadablewithout granting deletion authority or replacing the record.Why
because corruption establishes no ownership and a replacement discards other nodes’ entriescollected-directorytesttestA merge keeps out each key under a snapshot directory whose_collected.jsonthe bucket lists, save its_manifest.json, and each run filefolded-runsreclaims, whatever any record says.Why
because a lapsed record otherwise lets a node holding a copy list a reclaimed key againcollected-indextestA push finds the snapshot folding each candidate run ofcollected-directoryin the pointer’s valid bucket index, reading that snapshot’s manifest for its parent; without a valid index it walks the chain.collectedtesttestA merge drops from its entries each key a collected record names, a local copy included, and carries the record, unsigned, until it reaches the agetombstone-ttlsets.ownershiptestA key names its owner by the node in its run directory, request-ledger filename, commit-log directory or run-state directory; any other key is unowned and propagates no deletion.