Beagle SCM

POST-031: dag walks fail on post-Jun-29 commits — false non-FF + false "broken tree" (stale graf.idx suspected)

Input

Context

Live incident (gritzko, 2026-07-18, maintree ///be/, cwd be/test): be post '?' → `JS exception: ? can not be fast-forwarded` (the post.js:327 FF-gate refusal in advanceBranch). Probes say the refusal is WRONG — the trunk tip is on cur's own line:

• jab 'sha1:?' → 00101ce103ac... ("correct post URI mishap", Fri17) — the trunk tip.
• jab log (cur) → 0d47c8ec → 226c6228 → 00101ce1 → ... — trunk tip is cur's 3rd entry; jab 'log:?' shows the same line from 00101ce1 down.
• type:?#00101ce1 and type:#226c6228 both → commit — objects present and readable in the store.
• So advanceBranch's dag.isAncestor(reader, expectedOld=00101ce1, parent=cur tip) returned false on ancestry the log view itself renders — trunk should FF to cur.

Incident 2, SAME class (gritzko, 2026-07-18, journal root, :post in bro): "err: broken tree: track and base share no common ancestor" (shared/quad.js:146, the BRO-030 quad merge-base). Wtlog+reflog forensics:

• Jul 17's post ?#08e9fdb2 HALF-landed: wtlog row 26717I7028 written, but the store refs row is stamped 26718Cf30e (today) — the refs advance died with the post (post was being fixed that day, "correct post URI mishap"). One-invocation rows share one be.now stamp — the split stamp proves the half-write.
• Today's :post repaired the advance (trunk → 08e9fdb2 = base; commit:#08e9fdb2 confirms parent 7e68484e = old trunk), THEN quad threw "no common ancestor" on track == base — the walk fails even on identical-sha lines.
• Prime suspect sharpened: newest ~/.be/journal/*.graf.idx is Jun 29; every trunk commit since (db7d2bd8, 7e68484e, 08e9fdb2) is UNINDEXED, and the walk resolves ids via the index (idOf, shared/dag.js:261-263) — unindexed commits dead-end it. Incident 1's be store presumably same staleness.
• Fallout to clear when fixed: today's staged gitlink puts (be#0d47c8ec, html#3f0d1736) are still UNCOMMITTED — the :post aborted at the quad throw before committing.

Goals

Repro first, then make post ? FF the trunk in exactly this shape.

• Suspects, reordered by incident 2: (1) STALE graf index — dag walks resolve ids via graf.idx runs that stop at Jun 29, unindexed commits dead-end the walk (fits BOTH false verdicts, incl. track==base); (2) cross-shard walk miss (/todo/BE/BE-039 family); (3) parent/ref-key resolution divergence between post's reader and the views.
• The repro must capture WHICH: instrument/probe the walk (what id the index returns for a post-Jun-29 sha, where the queue dies) before fixing; a log/log: twin walk succeeds on the same line — explain the difference.
• Fix must also answer WHY graf.idx went stale (posts since Jun 29 didn't extend it — missing index-on-post hook?) and whether a lazy reindex on walk-miss is the right recovery (the /todo/SPOT/SPOT-003 lazy-indexing shape).
• Both refusal messages are walk-verdict consumers, not causes: post.js:327 FF gate, quad.js:146 root — one dag fix clears both; a false "broken tree" must never abort the commit it decorates.

Constraints

• Wt state at incident: uncommitted pager.js changes present (the BRO-031-adjacent fix) — plausibly irrelevant (post logic untouched), but the repro should include a dirty-wt leg to rule it in/out.
• Fix in the dag/reader seam, not a post-local workaround; the FF gate's semantics (POST-027 refusal order) stay.
• No test edits without explicit permission; repro as a NEW test in test/post/ (the refuse/track-maintree pattern).

WIP

Design decisions

• SUSPECT (1) DISPROVEN by forensics on /tmp copies of the live shards: every walk the incidents blamed succeeds on the real bytes. journal: mergeBase(08e9fdb2,7e68484e)=7e68484e; be: isAncestor(00101ce1,0d47c8ec)=true. graf.idx is the NATIVE keeper's index; jab reads keeper.idx runs, and those covered every pack (ingest/idxmaint heal on open). No index miss.
• REAL cause 1 (post ? refusal): postSubs fans ctx.args into every mounted sub, so the sub's postOne re-ran the ? bare- advance on the SUB's OWN shard. be/test's shard (beagle-ext- tests) trunk 57b4996a vs pin 30b12f5b genuinely diverged, and that sub-shard refusal bubbled up spelled as the parent's ?. POST-030 already rules a recursed sub must not self-advance; it was enforced only for the no-Query form. Fix: postOne returns early on ctx._sub for the Query bare-advance arm too (verbs/post/post.js:863 arm). The parent then FFs fine.
• REAL cause 2 (broken-tree throw): journal's html sub was RE- CLONED from github Jul 17 (html/.be is a fresh colocated store); the parent's track-tree pin a63a583c does not exist in it. quadModel treated the dangling pin as a real tip, mergeBase found no common ancestor, and quad.js:146 killed the WHOLE bare status (and the :post that renders one).

  Fix

  a track pin with no readable commit in the sub's store

  degrades to the no-track rule (track:=base), per the wiki Status.mkd degenerate-roots family. The genuine two-real- tips broken-tree refusal STAYS (test/quad/model.js leg 3).
• Why log/log: survived: log renders the wtlog/refs rows of its own anchor shard; it never evaluates another shard's verdict.
• Fix is quad/post-seam, not dag: the walks were CORRECT; the verdicts were minted in the wrong shard (1) or from a dangling pin (2). dag.js untouched.

TODOs

• repro as a test: test/post/sub-diverged (both faces RED

  on pre-fix code, exact incident exceptions)

• trace the walk; pinned: NOT graf staleness — sub-shard

  fan-out (1) + dangling re-clone pin (2), evidence above

• fix; repro GREEN both faces; refuse/adv/quad suites green
• graf.idx staleness — N/A (native index; jab keeper.idx

  runs were complete; heal-on-open verified on copies)

• dirty-wt leg (unstaged parent edit rides the ? advance)
• replayed on a FULL /tmp replica of the live trees: bare

  status renders all sub hunks; be post ? FFs trunk 00101ce1 -> 0d47c8ec; journal commit lands staged be/html gitlinks. Live maintrees left untouched — the real :post / post ? re-runs are gritzko's call.

Blockers and bummers

• be/test's tests-shard trunk 57b4996a vs be-pinned 30b12f5b is a REAL fork (mergeBase 21fb27d4) — post ? typed INSIDE be/test still refuses, now correctly about that shard.
• html's old ~/.be/replicated.live store still holds the pre-re-clone line; the a63a583c work is not in the new store.

Outcome

Fixed in worktree work/POST-031, commit 611f5851 (+ test-sub 019ad68b): postOne skips the Query bare-advance for a recursed sub (post.js), quadModel degrades a dangling track pin to no-track instead of throwing (quad.js), new repro test test/post/sub-diverged. Suite 294/294. NOT merged.