Beagle SCM

DIFF-009: tree diff silently drops files — 1-2 headers on Ubuntu CI, once ALL headers locally — exit 0 either way

be diff:?v1..v2 (test be-diff-17-tree-no-truncate, 80 modified files) intermittently emits fewer file diffs than it should, with exit 0. Two observed signatures: (A) Ubuntu CI drops 1-2 MID-LIST headers with the tail intact (2026-07-06 run 28809192096: 79/80, highest header f079 present; earlier runs: 2 dropped); (B) once locally (musl, default build): tree.got.out entirely EMPTY, still exit 0. Local hammering never reproduces A (33 runs green across gcc/clang x default/Release, then 20 more). A partial fix is drafted (see WIP). Related: DIFF-007 "diff:<largefile> silently empty" (the silent-empty family), DIFF-008 (the per-file BASS rewind this test guards).

Input

Context

• CI evidence (logs_77867460502.zip, ubuntu job): FAIL: 79 / 80 file headers present, highest header: --- a/f079.txt, last-12-lines tail complete — so ONE file among f000..f078 emitted nothing; runner scratch not preserved.
• Since DIFF-008, the per-file GRAFDiff2Layer is call()-propagated (graf/DIFFREF.c:600) — a per-file FAILURE cannot silently truncate anymore; the only remaining silent-skip paths in the loop are the two soft-guarded KEEPGetExact reads (graf/DIFFREF.c:571-584): ANY non-OK read left a side empty, and empty-vs-empty renders nothing — one dropped file, exit 0.
• Signature B (local, once): the whole diff empty with exit 0 — upstream of the per-file loop (ref resolve / set build / output path), undiagnosed; smells like DIFF-007's family.

Goals

• No silent drops: a read/render failure inside a tree diff either fails the verb loudly or renders an explicit placeholder — never exit-0-with-missing-files.
• Signature A gone on Ubuntu CI (watch the next runs); signature B reproduced or bounded (keep tree.got.out + stderr on failure — the test already keeps scratch).

Constraints

• Do not regress the legitimate soft cases: KEEPNONE (absent object) and non-blob types still soft-skip a side; only genuine ERRORS propagate.
• Repro-first where possible; signature A has no local repro, so the CI runs ARE the verifier for the drafted guard.

WIP

Design decisions

• Drafted (uncommitted, graf/DIFFREF.c): both KEEPGetExact calls in the to-set loop now fail(code) on any code other than OK/KEEPNONE, so a transient keeper read error aborts the diff loudly instead of dropping the file. Diff suite 17/17 locally with fresh scratch.

TODOs

• Land the KEEPGetExact guard — IN TREE + committed (beagle wt clean 2026-07-07): to-set loop fails on non-OK/KEEPNONE (graf/DIFFREF.c:574-577, :585-586); carried by 91fd5f14 per file-scoped jab log graf/DIFFREF.c (no DIFF-009-tagged commit).
• Watch Ubuntu CI for signature A recurrence (the guard's only verifier — no local repro).
• Audit the from-only (deletion) loop: STILL soft-skips ANY non-OK read (DIFFREF.c:623 KEEPGetExact(…) != OK || ot != DOG_OBJ_BLOB → continue) — a transient error there still eats a deletion silently; + diffref_set_* builders.
• Signature B: instrument or keep stderr with the scratch; find how an entirely empty diff exits 0 (ref resolution? empty set? output path).

Blockers and bummers

• No local repro for signature A despite 53 runs across compilers/opt levels — CI-environment-coupled (slower IO / different fs); verification is CI-statistical.

Outcome

• OPEN — evidence + drafted guard 2026-07-06 (the beagle-split session; failures pre-date the split).
• 2026-07-07 audit: the to-set KEEPGetExact guard is COMMITTED (in 91fd5f14, untagged); still open: CI verification of signature A, the deletion-loop soft-skip (DIFFREF.c:623), signature B.
• Bookkeeping: this page supersedes the older DIFF-009/README.mkd (the CI-only framing); the topic README now links here.