Beagle SCM

JS-073 HIGH: ingest.add rewrites the refs ULOG non-atomically + restamps the reflog

ingest.add lands a re-get pack into an existing shard and updates refs (ingest.js:108-128). It drains the old reflog then rewrites the WHOLE file via writeUlog→writeBytes, which does io.resize(fd,0) then io.writeAll(fd,b) IN PLACE (ingest.js:24-32) — no temp file, no sync, no rename. A crash in that window leaves refs empty, losing every tip; the re-get path reaches it (get.js:126). The crash-safe ulog.write (temp+sync+rename) exists and is bypassed. Worse, writeUlog re-feeds rows with NO ts (ingest.js:37), restamping every surviving reflog row. Method: Issues.

Input

Context

• ingest.js:24-32 writeBytes: io.resize(fd,0) then io.writeAll(fd,b)

  on the live file — a destructive in-place truncate-and-rewrite.

• ingest.js:35-40 writeUlog: log.feed(r.verb, r.uri) — drops ts, so

  every drained reflog row is restamped to "now" on rewrite.

• ingest.js:119-127 add: drains refs (no ts captured —

  {verb,uri} only, line 122) then writeUlog(refs, old.concat(...)).

• get.js:126: the non-fresh re-get calls ingest.add — this IS reached.
• ulog.js write/_stage: temp sibling + io.sync + io.rename

  (ulog.js:107-126), the crash-safe writer that add bypasses.

• ulog.append preserves each row's original ts (ulog.js:131-143);

  test/ulog.js:62-63 asserts "old rows keep their ORIGINAL timestamps".

Goals

• ingest.add writes refs crash-safely (temp+sync+rename): a kill after

  the truncate leaves the OLD refs byte-intact, no tip loss.

• Surviving reflog rows keep their ORIGINAL ts; only the new tip rows

  get a fresh monotonic ts.

Constraints

• Route through ulog.write/ulog.append (already temp+rename + ts-aware);

  capture each drained row's log.time and feed it back.

• libabc+libdog ONLY; keep the 0000000001.keeper pack-log write path

  (writeBytes for the pack itself, content-addressed, is fine).

• Scope to ingest.js; do not change the clone fresh-store path's intent.

WIP

Design decisions

• Replace the add refs rewrite with ulog.write(refs, old+new) carrying

  each old row's ts, OR ulog.append(refs, newRows) (drains+preserves).

• Keep pack-log bytes on writeBytes; only refs needs the ULOG writer.

TODOs

• Repro-first test/js/ingest/*: kill-after-resize on refs leaves it

  intact (no empty refs / no lost tip).

• Repro: surviving reflog rows keep their original ts after add.
• Reroute add's refs write through ulog.write/append; drop the

  in-place writeUlog for refs.

Blockers and bummers

• ← shares the ulog.js writer surface; keep parity with JS-048 writers.

Outcome

• (pending)