Beagle SCM

PATCH-013: VERIFY patch stamps every affected file per the DIS-057 band — fix any gap

INVARIANT (gritzko, 2026-07-17): every file affected by get/patch and every file undirtied by post carries that wtlog record's ts as its mtime (patch: the DIS-057 band slot — row ceil-2ms pat / ceil-1ms mrg / ceil cnf), so status confirms outcomes with no content reads. patch HAS a stamp site (be/verbs/patch/patch.js:417, BE-011) — this ticket VERIFIES full coverage and exactness, and fixes what falls short. Siblings: GET-049 (get stamps nothing), POST-029.

Input

Context

The DIS-057 band is reconstructed by classify.patchStamps (be/shared/classify.js:176) via ulog.ronStepMs — a stamp that is off by even the ms packing makes the band miss and the outcome silently degrades to mod (the DIS-057 REOPEN incident class).

• Verify EVERY file the patch touched gets stamped: clean applies, merges, conflicts, take-theirs ADDS (base-absent paths), files under dirs, symlinks.
• Verify the stamp value: exact band slot of the patch ROW ts (ronStepMs(t,-2/-1/0)), row appended before stamping.
• Verify status reads them back: pat/mrg/cnf buckets with zero content reads on clean applies (STATUS-011 fast path must NOT swallow band stamps into ok — the !pb guard).

Goals

A repro test that patches a wt with all four outcome classes and asserts on-disk mtimes == the reconstructed band, and that status buckets match with no content read for clean applies. Fix any file class the stamp loop misses.

Constraints

• DIS-057 semantics are the spec — this ticket verifies conformance, it does NOT redesign the band.
• Files the patch did NOT write keep their mtimes.
• Minimal diff in patch.js if a gap is found; repro first.

WIP

Design decisions

• ONE scenario case (test/patch/stampband/, run.sh + assert.js) drives a REAL jab patch over all classes at once, then asserts the band off the PERSISTED patch row (ulog.ronStepMs(row.ts, -2/-1/0) vs io.lstat mtimes) and re-runs classify with an io.open hook.
• The STAMP side verified fully correct — the gap found was READ-side: classify.js:418-428 ran wtEqBase (a content read) on every band-stamped in-base file, so a clean apply paid one io.open, violating the 2026-07-17 ruling's "no content read on clean applies". Fix is at the band READ, not patch.js:417 (nothing was unstamped/mis-stamped).
• Minimal fix: route pb (pat/mrg/con) BEFORE the stamp-set/wtEqBase ladder — the exact ms slot only exists where patch wrote it, the same trust STATUS-011 extends to the wtlog stamp-set. The !pb guard becomes implicit (a pb file never reaches the stamp-set test, so cnf==row-ts still never collapses to ok — statusfast C stays green).
• slink deliberately points at f-merge.txt (the mrg slot): a follow-the-link io.setMtime would clobber the target's mrg stamp to pat, so the case proves nofollow stamping, which exec-symlink's golden could not distinguish.

TODOs

• Verify test: 4 outcome classes × {file, subdir file, add} — mtime == band slot, status buckets pat/mrg/con.
• If a class is unstamped/mis-stamped: fix at patch.js:417's loop, repro-first. (No stamp gap existed; the RED was read-side — fixed at classify.js's band read, one hunk.)
• Full suite green; note verified-OK classes in Outcome even if no fix needed.

Blockers and bummers

Outcome

VERIFIED-OK stamp classes (all mtimes == exact band slot off the persisted row; unaffected files' mtimes byte-identical pre/post):

• clean take-theirs, top-level (f-take.txt) → ceil-2ms, status pat.
• clean take-theirs under a dir (sub/f-deep.txt) → ceil-2ms, pat.
• take-theirs ADD, base-absent (f-add.txt, sub/f-newadd.txt) → ceil-2ms, pat.
• take-theirs ADD symlink (slink) → ceil-2ms on the LINK (nofollow), pat; target's own mrg stamp intact.
• weave merge (f-merge.txt) → ceil-1ms, mrg.
• true conflict (f-conf.txt) → ceil (== row ts), con.
• unaffected files (own.txt, keep.txt): mtimes untouched, clean count-only ok.

GAP FOUND+FIXED (read side, NOT a stamp gap): classify content-read every band-stamped in-base file (wtEqBase), breaking "zero content reads on clean applies" — repro RED at exactly that assert, then shared/classify.js routes pb before the content ladder (ONE hunk, 11→14 lines: the if (pb && !eqBase) arm hoisted to if (pb) above the stamp-set/wtEqBase reads, !pb guard now implicit). Suite 273/273 (baseline 272/272), incl. patch/conflict, patch/exec-symlink, post/patch-pat, post/patch-absorb, unit patchband + statusfast. Uncommitted in work/PATCH-013 for review: shared/classify.js (mod), test/patch/stampband/{run.sh,assert.js} (new).

Behavior delta of the fix (deliberate, per the ruling): a band-stamped file whose bytes were hand-reverted to equal OURS previously read ok; the stamp now wins (pat). Reachable only via mtime forgery/collision — the accepted-risk class statusfast B already documents for the stamp-set.

• Landed e3a937bd (2026-07-17, "PATCH-013: fix timestamping").