[ckir]

🤖 New release

• flux-fs: 0.19.11 -> 0.19.12
• flux-hash: 0.19.11 -> 0.19.12
• flux-core: 0.19.11 -> 0.19.12
• flux-platform: 0.19.11 -> 0.19.12
• flux-ui: 0.19.11 -> 0.19.12
• flux-cli: 0.19.11 -> 0.19.12
• flux: 0.19.11 -> 0.19.12

Changelog

flux-fs

0.19.12 - 2026-11-08

Bug fixes

• (resume) a hard-linked partial is recopied, never written through (cut 9f-1 plan 2, final review I3)
• (flux-fs) state the interior-NUL rule instead of leaving it to two kernels
• (flux-fs) an unpaired surrogate smuggled any name past every check
• a name that is not one component, a create that followed links, and a twin status
• a wrapped name length, a directory that remove_file deleted, and a miscoded not-found
• (core) poison the walk before panicking on a bad entry name
• (core) refuse a directory entry name that is not one component
• (flux-core) stop discard destroying the error taxonomy

Features

• a nameless scratch file in a directory, and whether it is memory-backed
• stream a directory listing and carry the listing's inode number
• the --exclude matcher in flux-fs (cut 16 task 1)
• (fs) verification levels, VERIFY_MISMATCH and Outcome.verified
• (cli) --hardlinks, hardlink counters, summary suffixes and warnings
• (platform) DirHandle::create_hardlink on Unix, Windows and the fake
• (fs,platform) per-run hardlink index (redb) and its fake
• (fs) hardlink mode, option field and codes (cut 12)
• (fs) FileSystem::mount_root and CopyOptions.cross_filesystems, with the shared mount-root helpers (cut 10b)
• (fs) read_link and create_symlink on the traits, the Links option, the fake and the arms (cut 10a)
• (resume) a damaged checkpoint log is quarantined, a newer-format one stops the run (cut 9f-1 plan 2, owner ruling 23)
• (checkpoint) the run's WAL handle and the per-file sink (cut 9f-1 plan 2, task 4)
• (taxonomy) WAL_WRITE_FAILED and the checkpoint copy step (cut 9f-1 plan 2, task 1)
• (fs) DirHandle::open_existing, a non-following identity-checked write open (cut 9f-1 plan 1, Task 3)
• (fs) DirHandle::open_read, a streaming non-following read of a child (cut 9f-1 plan 1, Task 2)
• (fs) FileHandle::duplicate and truncate_to; Writer is Send (cut 9f-1 plan 1, Task 1)
• (copy) SyncAt and Staged.writer, the Writer: Sync bound; inline sync after the metadata step
• ClaimStore::prepare_many (one Immediate transaction for a batch of notes)
• claim store format 2 with the prepared table; note commits are immediate (cut 9c)
• PreparedRecord, RecoveryOp and the prepared-note surface of ClaimStore (cut 9c)
• Code::StateCorrupt and IncompatibleState, ClaimStore::count, DirHandle::open_claim_store (cut 9a)
• ExistingPolicy, Outcome.skipped and the --overwrite/--update/--skip-existing flags (cut 8b)
• DirHandle::create_claim_store on the fake, POSIX and Windows (cut 8b)
• the redb claim store and its crash acceptance test (cut 8b)
• the claim model, FluxPathKey, the ClaimStore trait and its conformance suite (cut 8b)
• DirHandle::canonical_path from the open handle on every platform (cut 8a, Part A's query)
• DirHandle::mount_root on the fake, POSIX and Windows (cut 8a, Part M's query)
• (fs) TARGET_LOCK_BUSY and CONTROL_PLANE_NAMESPACE_CONFLICT codes for the engine (cut 7a Part 3b-1)
• (fs) DirHandle::sync flushes a directory (cut 7a Part 3a)
• (fs) DirHandle::remove_dir, refusing files, links and full directories (cut 7a Part 3a)
• (fs) DirHandle::read_file, refusing links, directories and special files (cut 7a Part 3a)
• (fs) DirHandle::read_dir on POSIX, Windows and the fake (cut 7a Part 3a)
• lock capability from a built-in local allowlist (cut 7a Part 1, F1)
• lock files through a directory handle, with a non-blocking OS-native lock (cut 7a Part 1)
• (fs) LockCapability and the LockFile trait (cut 7a Part 1)
• (flux-fs) add SYMLINK_CREATION_UNAVAILABLE
• (flux-fs) DirHandle::identity, the resolved directory's own identity
• (flux-fs) Safety on CopyOptions and identity_degraded on Outcome
• (flux-fs) add the DirHandle and DestinationRoot traits
• (flux-fs) add the no-replace publication and namespace collision codes
• (fs) add Code::DirectoryChangedDuringScan
• (fs) add read_dir and create_dir across the trait and all implementors
• (fs) [breaking] Metadata carries file_type instead of is_file
• (fs) add FileType and DirEntry
• (flux-fs) Metadata carries a file identity
• (flux-fs) portable object identity with its reliability class
• (flux-fs) the FileSystem and FileHandle traits
• (flux-fs) copy options, outcome, and the normative temp name
• (flux-fs) the spec's error codes and the io::Error mapping

Miscellaneous

• add PolyForm Noncommercial header to source files
• cleanup of the deferred review findings (cut 8b)
• scaffold the Rust workspace and dev toolchain

Other

• return the published target's identity, read from the temporary's handle before the rename; prepare_file returns the source's
• FileHandle::identity - a file's identity from its own handle, POSIX fstat, Windows FileIdInfo, and the fake

Refactoring

• CopyOptions carries a selection (cut 16 task 3a)
• (fs) sort the tests by name instead of deriving Ord on FileType

flux-hash

0.19.12 - 2026-11-08

Features

• (hash) streaming BLAKE3 hasher for copy verification

Miscellaneous

• add PolyForm Noncommercial header to source files
• scaffold the Rust workspace and dev toolchain

flux-core

0.19.12 - 2026-11-08

Bug fixes

• a failed identity build stops the run and a migrated index surfaces a step-5 stat error as the file's own
• serialise the 300k-file tests and name the directory when a poisoned index fails its retire
• the packer streams level 0 to disk instead of holding it in memory
• sort_keyed orders wide keys by every key byte before the name
• the temporary-home tests expect the Windows flux-scratch subdirectory
• an explicit scratch directory is opened at the first spill, and the final review's fixes
• the scratch home is found only at the first spill and released on close
• a scratch region dropped out of order cannot extend the file
• engine events build no arguments with logging off; a replaced link carries its target
• count carried bytes and skipped files in the live progress
• several-source resume text and documents tell the truth after cut 19
• final review wave for the several-source dry run cut (cut 18)
• final review wave for the selection cut (cut 16)
• (core) verify's root check names the root a containment query was about; the mode-000 test fails loudly under root
• (core) a destination-only unlistable directory is extra; root-check failures name the root; absent-destination hook
• final review wave - honest policy-split warning, link-aware abort, heartbeat-safe index removal
• (core) resume skip site reports an unreadable index; tighten resume tests
• (core) run the identity gate on linked replacements, test the Replace link path
• (core) lazy hardlink slot close and dry-run temp index, honest anchor-root check
• (core) fake rename_no_replace answers AlreadyExists for a same-object target
• (core) refuse a folder root's bad target before transfer
• (core) a pre-root abort leaves the root not started; pin the weak-destination corner
• (core) a root with any failure kind reports failed
• (core) refuse non-UTF-8 source names ending in .flux-lock
• (core) release a prefix lock when its record key cannot be built
• (core) a batch with a failed entry re-checks the lock before it is settled (cut 11c site 3)
• (core) the batched STOP-HELD cleanup re-checks the lock before discarding notes (cut 11c site 2)
• (core) the unbatched Strict discard re-checks the lock and keeps the note after a loss (cut 11c site 1)
• (core) the fake answers StateCorrupt for an undecodable claim on get and DestinationError for a special file at the store (cut 11c, 31a000d parity)
• (core,cli) cut 11b final-review wave: predicted lock refusals name the lock file; the dry takeover needs strong identity too; the CLI test crate builds on Windows; the real-fs fixture leaves its store unclean; single-file partial paths; notes before a predicted refusal (P10); prior_operation leaves unprobed on the predicted refusal; count failures refuse; the dead DryRunPriorUnreadable removed; forbidden_for_resume tightened
• (core) partials_under reports an unlistable root as unlistable, so sweep_partials keeps every prior's state as before (cut 11b Task 4 review); the test for it
• (core,cli) dry run final-review fold: a top-level source .flux mirrors live (merge, or the live failure), the lock and state checks reported as unperformed (unprobed: target_lock, prior_operation), an over-long temporary name predicted, no throughput for unmoved bytes; allow-list call-log checks, more corpus cases, the three pinning tests (cut 11a, rulings P10-P12)
• final-review wave (UNC payloads, error 87 retry and messages, links serialised only when skip, guard pins) (cut 10a)
• (run) the partial sweep, note recovery and cleanup accept link artefacts (cut 10a)
• (checkpoint) SpawnFails selects the worker for either durability, pin the worker in the pool-wait test (cut 9h, task 7 fix 1)
• (checkpoint) the worker checks cancel before every send; drop and cancel tests pinned (cut 9h, task 3)
• (copy) a skipped single-file resume removes its stale partial; close review gaps (cut 9g)
• (core) full with no partial reports nothing when the log cannot be read (cut 9f-2)
• (resume) wave D review fixes, ruling 24 (cut 9f-1 plan 2)
• (test) wave B follow-ups of the final fix-wave review (cut 9f-1 plan 2)
• (test) a_sender_dropped_mid_flush is deterministic (cut 9f-1 plan 2, final review M11)
• (checkpoint) one mtime encoding, true Display text, hard alignment assert (cut 9f-1 plan 2, final review M1 M4 M5)
• (resume) a hard-linked partial is recopied, never written through (cut 9f-1 plan 2, final review I3)
• (test) mtime fixtures use 100 ns multiples so Windows round-trips them (cut 9f-1 plan 2, final review C1)
• (wal) a true conflict message, drain kept in production, exact resume docs (cut 9f-1 plan 2, task 10, review fixes)
• (run) flag the WAL abandoned the moment the lock is lost (cut 9f-1 plan 2, task 8, review fixes)
• (wal) an aborted file discards its pending records instead of flushing them (cut 9f-1 plan 2, task 8, review fixes)
• (tree) only files at or above the checkpoint threshold take a checkpoint context (cut 9f-1 plan 2, task 8, review fixes)
• (state) retiring a workspace removes its wal directory (cut 9f-1 plan 2, task 8a)
• (copy) a partial with an unavailable identity is recopied, not wedged (cut 9f-1 plan 2, task 7, review fixes)
• (checkpoint) FileSink::begin accepts valid_through equal to the source length (cut 9f-1 plan 2, task 7)
• (state) pin the TRANSFERRING-time generation bump and keep the v1/v2 refusal text (cut 9f-1 plan 2, task 2, review fixes)
• (wal) a re-sent FileBegin starts a new attempt, oversized operation ids are refused at open, barrier the lazy-create test (cut 9f-1 plan 1, final review fixes, I3 M4 M6 M10)
• (fault_fs) an open_existing handle writes from offset 0 like the real one (cut 9f-1 plan 1, final review fixes, I2)
• (wal) trailing damage is a torn tail, mid-log damage stays corrupt, every cut is reported (cut 9f-1 plan 1, final review fixes, ruling 23)
• (wal) abandonment flag, Strict directory syncs, exact oversize refusal, pinned defaults (cut 9f-1 plan 1, Task 7 fix 1)
• (tree) a missing publish primitive is a drain stop class (RemoveAll); a three-frame drain-time test pins the mode switch
• (tree) a stop that first appears during the drain switches the drain mode for the remaining frames
• (tree) after a lost-lock or heartbeat stop the drain cleans up only; no barrier, no note (owner ruling B2')
• (run) FLUX_TEST_OPEN_WRITERS floors at 1; a debt bullet for an injectable e2e clock
• (copy) the barrier's deadline catches up after a stall; threads == 0 is the testable main-thread seam
• (tree) barrier wakes at half the heartbeat interval; a stopping cap flush is counted
• (copy) a refused worker thread no longer aborts the barrier; it falls back to fewer workers or the main thread
• pin the batch age in the end-to-end stall tests (debug-only FLUX_TEST_BATCH_AGE_MS); no real-clock reads in unit tests
• an undecodable claim at a recovery commit is STATE_CORRUPT, not a foreign claim
• cut 9c final review - corrupt note is STATE_CORRUPT by spec amendment, true round-trip e2e, evidence labels, validation tests
• failed listings exit 1, cross-platform e2e snapshot and destination, lease-gate reason text, single-file pointer guard (cut 9b final fixes)
• the cleanup lock acquisition applies the lease gate to a dead owner too; skipped rows are reported; pass order pinned (cut 9b)
• discovery - failed listings are reported, refusals proven before any probe, an untrusted lock is an UNCERTAIN row (cut 9b)
• final review follow-ups - foreign-claim pin, count() mapping, nested key pins, known limits 6 and 11 (cut 9a)
• compare resume paths through absolute_lexical so the tests hold on Windows (cut 9a)
• an adopted workspace survives a refused-unchanged copy; pin single-file adoption fields (cut 9a)
• report a lock this run created and could not remove when the run fails
• refuse a fold onto an entry another target owns, make learned spellings O(1), document that closing the store commits (cut 8b)
• created directories plan targets as new, pin the second claim and the symlink target (cut 8b)
• create state.db after the workspace is published (Windows refuses to rename a directory with an open file) (cut 8b)
• separator-insensitive call-log counts in the NameIndex tests (cut 8b)
• separator-insensitive call-log assertions in the case-insensitive fake tests (cut 8b)
• separator-insensitive call-log assertion in the claim-store fake test (cut 8b)
• cut 8a final review fold (copy_tree containment, probe error cleanup reported, retire removes probe files)
• (core) a target name is one component or PATH_COMPONENT_INVALID; the ownership refusal says what to do; conformance matches whole labels (capstone round 2)
• (core) the give-up message names no flag a break-lock run already used; recover's comment states its reorder (quality review)
• open_lock takes no controlling terminal; the fake forgets a removed name's type (Task 2 quality review)
• (flux-core) copy_tree refuses a destination directory that is the source root
• (flux-core) the fake created a file over a directory, and miscoded a missing component
• (core) poison the walk before panicking on a bad entry name
• (core) refuse a directory entry name that is not one component
• (flux-core) a rename of a missing source fails instead of conjuring the destination
• (flux-core) the fake mints identity at creation instead of hashing the path
• (flux-core) stop discard destroying the error taxonomy

Features

• a copy indexes a large pre-existing destination through its scratch space
• the destination name index spills to sorted families and a store above the threshold
• a redb store for this run's publications, over an unlinked scratch file
• packed sorted-run families with a block index, built on two threads
• scratch lanes, a poison that carries its error, ordinals and FaultFs inode hints
• --scratch-dir for copy and verify
• verify, the sweep and the dry restart stop on a fatal walk error
• a copy spills into its workspace and beats while it lists
• the walk spills a large directory to sorted runs and merges them
• sorted runs of directory entries and their k-way merge
• a scratch space whose regions are truncated in stack order
• a nameless scratch file in a directory, and whether it is memory-backed
• scan a user directory for names without listing it whole
• stream a directory listing and carry the listing's inode number
• build a frame's name index by whether the directory is fresh
• an index for a directory the run created records nothing
• render the -v lines, route them above the bar, escape names
• the engine emits tracing events for each file, directory, link and removal
• count bytes per chunk and a single file's size for the live display
• the engine ticks a live Progress from its own counters
• Progress counters for a live display
• dry-run preview of a several-source resume
• resume a crashed several-source run
• resume compatibility compares every root
• fold-probe for a dry several-source run (cut 18 task 4)
• prefix lock, directory lock and target previews for a dry several-source run (cut 18 task 3)
• flux copy --dry-run with several sources, the fresh plan (cut 18 task 2)
• --restart with several sources passes the CLI gate; texts name --restart (cut 17 task 3)
• prefix lock refusals name the lock file and promise only what helps (cut 17 task 2)
• MultiPlace::remove keeps this run's prefix locks when retiring a prior (cut 17 task 1)
• verify selects both sides and counts what it excluded (cut 16 task 5)
• the selection is part of the resume fingerprint (cut 16 task 4)
• copy selects through the walker and counts what it excluded (cut 16 task 3b)
• the walker filters by selection (cut 16 task 2)
• (cli) accept --resume together with --verify (cut 15 task 3)
• (core) stage_file hashes the resumed prefix and verifies it (cut 15 task 2)
• (core) resume deciders feed a prefix hasher (cut 15 task 1)
• (core) verify_several refuses two roots that are one directory on the destination
• (core) verify_several probes each root's type and reports an unreadable root at its turn
• (core) verify_several runs each root under DEST/ in prefix order; the CLI maps every VerifyError through one refusal_line
• (core) a three-way control-state filter for the verify destination side
• (core) verify a single file against a destination path
• (core) refuse nested or identical roots, treat an absent destination as empty, prune mount points
• (core) symlinks, special files, read errors and the control-state filter in verify
• (core) merge two walks into one stream of verify records
• (core) count verified files and mismatches in the tree outcome
• (core) verify the destination (and the source) before publication
• (fs) verification levels, VERIFY_MISMATCH and Outcome.verified
• (hash) streaming BLAKE3 hasher for copy verification
• (core) dry run predicts hardlinks without destination I/O
• (core) --resume rebuilds the hardlink index from the walk and relinks independent members
• (core) link hardlink group members to their canonical for fresh copies
• (core) hardlink candidacy, weak-identity and unknown-link-count degradations
• (core) per-run hardlink slot, anchor directory, index name in retire, run plumbing
• (platform) DirHandle::create_hardlink on Unix, Windows and the fake
• (fs,platform) per-run hardlink index (redb) and its fake
• (fs) hardlink mode, option field and codes (cut 12)
• (core) refusal hint for a several-source prior; compatibility tests
• (core) run::trees copies several roots under one operation
• (core) per-root driver for several roots
• (core) MultiPlace for several roots
• (core) plan several roots and cap their number
• (core) prefix locks for several sources
• (core) lock codes for several sources; fake folds lock names
• (core) state format 5 for several roots
• (core) cut 11b, the single-file dry --resume validates the prior and reports its partial; create_claim_store joins the banned lists
• (core) cut 11b, a dry --resume previews the walk from a repaired, recovered copy of the prior's claim store in a private temporary directory (TempDir, copy_store, dry_adopt, Recovered.strays, would_resume, CopyOverPartial)
• (core) cut 11b, the dry --restart lists the states and partials a real run would discard (partials_under extracted from the sweep)
• (core) cut 11b, the dry run previews the lock record and classifies priors as the real run does; a plain dry run with a resumable prior predicts RESUMABLE_OPERATION_EXISTS (D1)
• (core) cut 11b, the read-only lock-record preview (dry_lock) and the refusal constructors shared with obtain
• (core) cut 11b, the resume and discard words, DryPrior, the dry-run report fields, the dry temp root and the six dry-run notes
• (core) the dry branches of run::tree and run::file, prior-operation notes, DEST counted per I7 (cut 11a)
• (core) dry mode for a tree copy: Option frames, a planned root identity, the null claim store, per-entry dry stops (cut 11a)
• (core,cli) dry-run types, the null claim store, the Planned cause and the RunConfig/Run/Report fields (cut 11a)
• (cli) --cross-filesystems, recorded in the resume configuration only when set (cut 10b)
• (core) skipped source mounts as empty directories, MountSkipped records, the Unknown policy, and the report lines (cut 10b)
• (walk) MountPolicy, walk_with, and the MountSkipped/MountUnknown events before the cycle check (cut 10b)
• (fs) FileSystem::mount_root and CopyOptions.cross_filesystems, with the shared mount-root helpers (cut 10b)
• (cli) --links=<copy|skip>, part of the resume configuration (cut 10a)
• (tree) link policies, resume, strict notes, batch backstops and the claim upgrade (cut 10a)
• (tree) recreate symlinks through the per-entry protocol; --links=skip records; link failures are copy failures (cut 10a)
• (fs) read_link and create_symlink on the traits, the Links option, the fake and the arms (cut 10a)
• (checkpoint) hash on the worker only for Normal durability (cut 9h, task 7)
• (copy) the copy loop hands written buffers to the hashing worker (cut 9h, task 5)
• (checkpoint) FileSink hashes on a worker thread, with Inline fallback (cut 9h, task 4)
• (checkpoint) the hashing worker thread (cut 9h, task 3)
• (wal) WalLink, a cloneable send/fault view for a worker thread (cut 9h, task 2)
• (run) a single-file resume continues its proven prefix (cut 9g)
• (copy) a log-free resume hook for single files (cut 9g)
• (core) --resume-verify=full in plan_resume, the proven prefix re-recorded (cut 9f-2)
• (core) FileSink::record_proven re-records a proven prefix as Range records (cut 9f-2)
• (core) decide_full proves a partial against the source without the WAL (cut 9f-2)
• (core) ResumeVerify level carried by RunConfig and CheckpointPolicy (cut 9f-2)
• (resume) a damaged checkpoint log is quarantined, a newer-format one stops the run (cut 9f-1 plan 2, owner ruling 23)
• (run) report the WAL tail the replay cut (cut 9f-1 plan 2, task 10c)
• (report) bytes reused and every discard named (cut 9f-1 plan 2, task 9)
• (tree) the tree outcome carries each file's reuse and checkpoint discard (cut 9f-1 plan 2, task 9)
• (run) the tree run owns the checkpoint WAL (cut 9f-1 plan 2, task 8)
• (copy) stage_file resumes a partial from its proven prefix (cut 9f-1 plan 2, task 7)
• (copy) stage_file checkpoints large files (cut 9f-1 plan 2, task 6)
• (checkpoint) decide where a resumed partial may continue (cut 9f-1 plan 2, task 5)
• (checkpoint) the run's WAL handle and the per-file sink (cut 9f-1 plan 2, task 4)
• (state) manifest format 4 records the WAL generation (cut 9f-1 plan 2, task 2)
• (taxonomy) WAL_WRITE_FAILED and the checkpoint copy step (cut 9f-1 plan 2, task 1)
• (wal) single writer thread, bounded channel, 1 s / 64 MiB flush, Strict data-before-checkpoint (cut 9f-1 plan 1, Task 7)
• (wal) two-pass replay, scan index and per-file state with FILE_BEGIN reset (cut 9f-1 plan 1, Task 6)
• (wal) record encoding with BLAKE3-16 checksum, torn-tail and corruption classes (cut 9f-1 plan 1, Task 5)
• (wal) ChunkHasher, 1 MiB BLAKE3 chunk digests from arbitrary writes (cut 9f-1 plan 1, Task 4)
• (fs) DirHandle::open_existing, a non-following identity-checked write open (cut 9f-1 plan 1, Task 3)
• (fs) DirHandle::open_read, a streaming non-following read of a child (cut 9f-1 plan 1, Task 2)
• (fs) FileHandle::duplicate and truncate_to; Writer is Send (cut 9f-1 plan 1, Task 1)
• (cli) debug-only FLUX_TEST_COUNTERS_FILE with the barrier, cap and heartbeat-gap counters
• (tree) cap open writers across the frame stack at min(256, RLIMIT_NOFILE/4), flushing the shallowest batch first
• (tree) the data-sync barrier runs before the flush's heartbeat and guard; failed syncs discarded before the notes
• (copy) sync_staged_many, the barrier with a main-thread heartbeat deadline; fake delay, drop records and rendezvous
• (copy) SyncAt and Staged.writer, the Writer: Sync bound; inline sync after the metadata step
• group commit of Strict tree publications is on (64 files / 64 MiB / 1 s)
• batch failure isolation (per-entry fallbacks), lost-lock and heartbeat stops, abort drain
• stage Strict tree files into a per-directory batch and flush it with prepare_many + apply_recovery (off by default)
• ClaimStore::prepare_many (one Immediate transaction for a batch of notes)
• commit recovery at --resume - classify every note, apply all or refuse COMMIT_STATE_UNCERTAIN (cut 9c)
• strict tree publications leave a prepared note and commit it with the claim (cut 9c)
• copy_file_guarded's before_publish hook carries the temporary's identity (cut 9c)
• the fake claim store's prepared notes, formats and fault keys (cut 9c)
• PreparedRecord, RecoveryOp and the prepared-note surface of ClaimStore (cut 9c)
• a copy finishes a prior operation's recorded cleanup and removes workspace debris (cut 9b)
• the cleanup deletion pass - revalidate under the lock, leftovers first, workspace last (cut 9b)
• Classified::Orphan, obtain_cleanup_lock, checked_held, finish_retire, sweep_partials (cut 9b seams)
• cleanup discovery - the transient lock probe, the listing, the facts (cut 9b)
• the cleanup status table (cut 9b)
• cleanup artifact rules - validated relative partial names, deleted through handles (cut 9b)
• the walk skips files the prior run completed and claimed (cut 9a)
• --resume adopts the one resumable prior as the same operation (cut 9a)
• resume::validate - the compatibility check for --resume (cut 9a)
• manifest format 3 - roots, options and the configuration fingerprint (cut 9a)
• the fake's open_claim_store, count and set_claim_store_format (cut 9a)
• RedbClaimStore::open_file and count, open_claim_store on both platforms (cut 9a)
• Code::StateCorrupt and IncompatibleState, ClaimStore::count, DirHandle::open_claim_store (cut 9a)
• guarded directory-end and final claim syncs (cut 8b)
• a directory copy replaces existing files under claims, with skip and update (cut 8b)
• the workspace creates, passes to the walk and removes state.db (cut 8b)
• replacement counts, ClaimNotRecorded and the report fields (cut 8b)
• NameIndex, name resolution by listing and identity (cut 8b)
• the copy path's before_create callback and the single-file existing-destination policy (cut 8b)
• ExistingPolicy, Outcome.skipped and the --overwrite/--update/--skip-existing flags (cut 8b)
• DirHandle::create_claim_store on the fake, POSIX and Windows (cut 8b)
• probe the destination for no-replace publication inside the unpublished workspace (cut 8a, Part P)
• refuse a destination whose resolved location lies inside the source, before the lock (cut 8a, Part A)
• never merge into a pre-existing destination mount root (cut 8a, Part M)
• DirHandle::canonical_path from the open handle on every platform (cut 8a, Part A's query)
• DirHandle::mount_root on the fake, POSIX and Windows (cut 8a, Part M's query)
• (core) RunConfig's test hook before each guarded mutation; a lock refusal names the lock (cut 7a Part 3b-2)
• (core) the single-file run - B1 checks first, the record beside the target, the same finish (cut 7a Part 3b-1)
• (core) --restart supersedes each resumable prior under a full still_owned before every mutation (cut 7a Part 3b-1)
• (core) the run - a tree copy under the destination's lock, from the capability gate to the release (cut 7a Part 3b-1)
• (core) Held::rewrite_record rewrites the record in place, keeping its owner (Q-K, cut 7a Part 3b-1)
• (core) a single file's records are looked up by the target's own name (E3, cut 7a Part 3b-1)
• (core) retire a workspace before removing it, remove a record with its temporary, check the control plane (cut 7a Part 3b-1)
• (core) copy_tree_at writes through a given root under a guard; reserved .flux paths are refused (cut 7a Part 3b-1)
• (core) copy_file_guarded runs a guard before every destination mutation (cut 7a Part 3b-1)
• (core) the §21.1 prior-state scan for trees and single files (cut 7a Part 3a)
• (core) the crash-safe state write, and a workspace that never exists without its manifest (cut 7a Part 3a)
• (core) the version-1 operation state codec and the three state refusal codes (cut 7a Part 3a)
• (fs) DirHandle::sync flushes a directory (cut 7a Part 3a)
• (fs) DirHandle::remove_dir, refusing files, links and full directories (cut 7a Part 3a)
• (fs) DirHandle::read_file, refusing links, directories and special files (cut 7a Part 3a)
• (fs) DirHandle::read_dir on POSIX, Windows and the fake (cut 7a Part 3a)
• (core) obtain a destination lock through the checked protocol (cut 7a Part 2)
• (core) take an uncertain lock over in place (§240.5) (cut 7a Part 2)
• (core) recover a dead owner's lock (§240.3) (cut 7a Part 2)
• (core) classify an existing lock (§240.1) (cut 7a Part 2)
• (core) acquire a destination lock (§96.1) and hold it (cut 7a Part 2)
• (core) lock errors, lock sites, keys and workspace trust (cut 7a Part 2)
• (core) the lock record codec, format_version 1 (cut 7a Part 1)
• (core) random operation and owner-instance ids (cut 7a Part 1)
• lock capability from a built-in local allowlist (cut 7a Part 1, F1)
• lock files through a directory handle, with a non-blocking OS-native lock (cut 7a Part 1)
• (flux-core) a special file is skipped, a symlink fails; tree counts for --json
• (flux-core) a tree abort keeps its partial outcome
• (flux-core) copy_tree, the safe engine
• (flux-core) the tree outcome types
• (flux-core) under NoReplace, Step 2a refuses an existing destination before copying
• (flux-core) CopyError names the step a copy failed at
• (flux-fs) DirHandle::identity, the resolved directory's own identity
• (flux-core) refuse a copy onto the source itself by identity (Step 2a)
• (flux-fs) Safety on CopyOptions and identity_degraded on Outcome
• (core) refuse an entry that stopped being a directory
• (core) ancestor-set cycle detection gated on Strong identity
• (core) the ordered depth-first walk
• (fs) add read_dir and create_dir across the trait and all implementors
• (fs) [breaking] Metadata carries file_type instead of is_file
• (flux-core) FaultFs carries configurable object identities
• (flux-fs) Metadata carries a file identity
• (flux-core) copy_file, with metadata applied before publication

Miscellaneous

• drop the dead-code allows the index consumers made stale
• add PolyForm Noncommercial header to source files
• cleanup of the deferred review findings (cut 8b)
• rustfmt the heartbeat copy tests
• scaffold the Rust workspace and dev toolchain

Other

• Merge origin/main into feat/bounded-listing
• Avoid logging lock record field contents
• Pulse::beat's doc says what it returns after a failure (capstone r2, DEBT)
• --restart heartbeats before each ownership check of its sweep; a failure there stops the run at the lock step
• the heartbeat during the copy, retried once; its failure is one error naming the lock, and a torn record ends with nothing written
• a heartbeat callback beside the guard, every 64 KiB and before each guarded mutation; its failure aborts a tree
• Held::heartbeat rewrites the record's time without a flush; a rewrite keeps the newest time
• a failed COMPLETED write leaves a FAILED record the next run can read
• a single-file record's artifact_type is "state" - the artifact's role, not the operation's kind
• write version 2 - the single-file record's §249.1 fields at creation, one time for the state and its lock record; the COMPLETED write carries cleanup_pending, the leftovers and the published target's identity (§218)
• return the published target's identity, read from the temporary's handle before the rename; prepare_file returns the source's
• FileHandle::identity - a file's identity from its own handle, POSIX fstat, Windows FileIdInfo, and the fake
• version 2 - cleanup_pending, the single-file record's §249.1 fields, identity text, native-unit hex; version 1 still read and never upgraded

Performance

• the merge feeds the packer encoded records without rebuilding a name per entry
• the destination index buffers a run as encoded bytes and sorts descriptors
• (copy) a batch with one writer syncs on the main thread; SyncOutcome.workers reports the pool size (owner ruling after the measurement)
• size the copy buffer from the source, capped at 256 KiB

Refactoring

• the spill engine sorts and merges keyed records
• split dry_lock into the record read and the leftover scan (cut 18 task 1)
• CopyOptions carries a selection (cut 16 task 3a)
• (core) split the verify root check from the walk
• (core) split TreePlace::create into create_dest and create_workspace
• (core) tree engine can key a walk under a root prefix
• (core) extract the read-only prelude of stage_file (plan_file) and of gate_link (gate_link_read), live behaviour unchanged (cut 11a)
• (wal) remove the temporary dead_code allows; delete or test-gate what they hid (cut 9f-1 plan 2, task 10a)
• (tree) the failed-sync discard propagates a stop with ?; the unreachable kept-report loops are gone
• split copy_file_guarded into stage_file and publish_staged
• (flux-core) copy_file writes through a destination handle (copy_file_at)
• (fs) sort the tests by name instead of deriving Ord on FileType
• (core) key FaultFs by PathBuf and unify its type state
• (flux-core) make a leaking ? fail to compile

flux-platform

0.19.12 - 2026-11-08

Bug fixes

• an explicit scratch directory is opened at the first spill, and the final review's fixes
• end the Windows streaming listing with Ok(()) now that it keeps no accumulator
• (core) fake rename_no_replace answers AlreadyExists for a same-object target
• (platform) a socket at the lock or claim-store path is DestinationError, not IoError; ClaimStore::get on an undecodable record is StateCorrupt
• (platform) statx EPERM falls back to the device comparison on the source side; real-mount-point test skips instead of failing; document the final review's limits (cut 10b)
• final-review wave (UNC payloads, error 87 retry and messages, links serialised only when skip, guard pins) (cut 10a)
• (platform) Windows creation over a directory is AlreadyExists; the directory-link retry is for symlinks only
• (platform) Windows symlink creation review findings (cut 10a)
• (test) wave B follow-ups of the final fix-wave review (cut 9f-1 plan 2)
• (resume) a hard-linked partial is recopied, never written through (cut 9f-1 plan 2, final review I3)
• an undecodable claim at a recovery commit is STATE_CORRUPT, not a foreign claim
• final review follow-ups - foreign-claim pin, count() mapping, nested key pins, known limits 6 and 11 (cut 9a)
• (fs) read_file refuses a socket on both platforms; Windows lists one as Other (Part 3a capstone round 1)
• (platform) a name deleted while open vanishes at once on Windows (cut 7a Part 1 capstone)
• (platform) boot_session_id review fixes (Task 5 quality review)
• open_lock takes no controlling terminal; the fake forgets a removed name's type (Task 2 quality review)
• (flux-platform) a handle-created file can read its own attributes on Windows
• (flux-platform) the handle rename_replace refuses a read-only target on Windows
• (flux-platform) the handle rename_replace refuses a read-only target on POSIX
• (flux-platform) report a directory as IsADirectory from remove_file on macOS
• (flux-platform) build the handle-relative stat paths on macOS and Linux clippy
• (flux-platform) let the variant carry the reparse bit, and pin the row the table was missing
• (flux-platform) stop reading every stat failure as a vanished name, and record why the rename has no fallback
• (flux-platform) reparse_tag_of broke every directory on a volume that cannot answer
• (flux-fs) state the interior-NUL rule instead of leaving it to two kernels
• (flux-fs) an unpaired surrogate smuggled any name past every check
• a name that is not one component, a create that followed links, and a twin status
• (flux-platform) ask the removal guard twice, and judge it on the tag
• snake-case the junction-root test, and drop a stray file from the tree
• (flux-platform) a guard that failed open, a race this cut exists to remove, and an unvalidated root
• a wrapped name length, a directory that remove_file deleted, and a miscoded not-found
• (flux-platform) three capstone findings in the Windows handle arm
• (flux-platform) ungate std_file_from, and let both Windows arms share one Metadata builder
• (flux-platform) refuse a same-object publish where identity cannot answer
• (flux-platform) refuse a name published onto itself on macOS too
• (flux-platform) stop the same-object veto front-running the filesystem
• (flux-platform) close the same-object hole where identity is unavailable
• (flux-platform) veto a same-object publish on the Windows arm
• (flux-platform) reject interior NULs, and pin the atomic body's error order
• (test) macOS refuses non-UTF-8 filenames, so skip rather than assume
• (platform) derive Windows metadata and identity from one handle
• (test) let the symlink-follow test build on non-Windows
• (flux-platform) Windows must ask the same question as Unix
• (flux-platform) ask whether we can write the destination, not whether a bit is set
• (flux-platform) rename_no_replace must judge the name too
• (flux-platform) the read-only guard must judge the name, not its target
• (flux-platform) refuse to publish over a read-only destination

Build and CI

• publish cargo doc to GitHub Pages

Features

• a nameless scratch file in a directory, and whether it is memory-backed
• stream a directory listing and carry the listing's inode number
• (platform) DirHandle::create_hardlink on Unix, Windows and the fake
• (fs,platform) per-run hardlink index (redb) and its fake
• (fs) FileSystem::mount_root and CopyOptions.cross_filesystems, with the shared mount-root helpers (cut 10b)
• (platform) replace an existing Windows directory link atomically (cut 10a)
• (platform) Windows symlink creation through CreateSymbolicLinkW (cut 10a)
• (fs) read_link and create_symlink on the traits, the Links option, the fake and the arms (cut 10a)
• (fs) DirHandle::open_existing, a non-following identity-checked write open (cut 9f-1 plan 1, Task 3)
• (fs) DirHandle::open_read, a streaming non-following read of a child (cut 9f-1 plan 1, Task 2)
• (fs) FileHandle::duplicate and truncate_to; Writer is Send (cut 9f-1 plan 1, Task 1)
• (tree) cap open writers across the frame stack at min(256, RLIMIT_NOFILE/4), flushing the shallowest batch first
• ClaimStore::prepare_many (one Immediate transaction for a batch of notes)
• claim store format 2 with the prepared table; note commits are immediate (cut 9c)
• PreparedRecord, RecoveryOp and the prepared-note surface of ClaimStore (cut 9c)
• RedbClaimStore::open_file and count, open_claim_store on both platforms (cut 9a)
• Code::StateCorrupt and IncompatibleState, ClaimStore::count, DirHandle::open_claim_store (cut 9a)
• DirHandle::create_claim_store on the fake, POSIX and Windows (cut 8b)
• the redb claim store and its crash acceptance test (cut 8b)
• DirHandle::canonical_path from the open handle on every platform (cut 8a, Part A's query)
• DirHandle::mount_root on the fake, POSIX and Windows (cut 8a, Part M's query)
• (fs) DirHandle::sync flushes a directory (cut 7a Part 3a)
• (fs) DirHandle::remove_dir, refusing files, links and full directories (cut 7a Part 3a)
• (fs) DirHandle::read_file, refusing links, directories and special files (cut 7a Part 3a)
• (fs) DirHandle::read_dir on POSIX, Windows and the fake (cut 7a Part 3a)
• (platform) the host's boot session id (cut 7a Part 1)
• lock capability from a built-in local allowlist (cut 7a Part 1, F1)
• lock files through a directory handle, with a non-blocking OS-native lock (cut 7a Part 1)
• (flux-fs) DirHandle::identity, the resolved directory's own identity
• (flux-platform) the Windows handle-relative helpers
• (flux-platform) the Windows DirHandle
• (flux-platform) the POSIX DirHandle
• (flux-platform) publish without replacing atomically
• (core) refuse an entry that stopped being a directory
• (fs) add read_dir and create_dir across the trait and all implementors
• (fs) [breaking] Metadata carries file_type instead of is_file
• (flux-platform) real object identity on both platforms
• (flux-fs) Metadata carries a file identity
• (flux-platform) StdFileSystem over std::fs

Miscellaneous

• add PolyForm Noncommercial header to source files
• cleanup of the deferred review findings (cut 8b)
• wrap the open_lock flag comment
• scaffold the Rust workspace and dev toolchain

Other

• Merge origin/main into feat/bounded-listing
• Stop logging boot session identifiers
• FileHandle::identity - a file's identity from its own handle, POSIX fstat, Windows FileIdInfo, and the fake

Refactoring

• (flux-platform) separate the reparse judgement from the syscalls, so its branches can be tested
• (fs) sort the tests by name instead of deriving Ord on FileType

flux-ui

0.19.12 - 2026-11-08

Bug fixes

• count carried bytes and skipped files in the live progress
• disambiguate the render intra-doc link
• render survives any Snapshot and the crate doc is accurate

Features

• render the -v lines, route them above the bar, escape names
• the summary line reads correctly, shows time and human sizes
• flux-ui renders and draws the live progress display

Miscellaneous

• add PolyForm Noncommercial header to source files
• scaffold the Rust workspace and dev toolchain

flux-cli

0.19.12 - 2026-11-08

Bug fixes

• an explicit scratch directory is opened at the first spill, and the final review's fixes
• verify --json prints the stopped summary when the walk fails
• omit boot session IDs from diagnostics
• --quiet keeps a dry run's skip records and verify's absent-destination notice; correct the --quiet help
• elapsed_text cannot overflow and rounds 9.995 s up to 10.0s; restore the copy summary tail check
• count carried bytes and skipped files in the live progress
• several-source resume text and documents tell the truth after cut 19
• final review wave for the selection cut (cut 16)
• (core) verify's root check names the root a containment query was about; the mode-000 test fails loudly under root
• (cli) keep the typos gate green in the display_path test
• (cli) verify routes records through a tested function, stops on a failed stdout write, escapes awkward names
• (cli) verify --help shows the exit codes; real copy-then-verify and --links/--cross-filesystems tests
• final review wave - honest policy-split warning, link-aware abort, heartbeat-safe index removal
• (core) refuse a folder root's bad target before transfer
• (cli) a several-source checkpoint failure points at cleanup, not resume
• (core,cli) cut 11b final-review wave: predicted lock refusals name the lock file; the dry takeover needs strong identity too; the CLI test crate builds on Windows; the real-fs fixture leaves its store unclean; single-file partial paths; notes before a predicted refusal (P10); prior_operation leaves unprobed on the predicted refusal; count failures refuse; the dead DryRunPriorUnreadable removed; forbidden_for_resume tightened
• (core,cli) dry run final-review fold: a top-level source .flux mirrors live (merge, or the live failure), the lock and state checks reported as unperformed (unprobed: target_lock, prior_operation), an over-long temporary name predicted, no throughput for unmoved bytes; allow-list call-log checks, more corpus cases, the three pinning tests (cut 11a, rulings P10-P12)
• (copy) a skipped single-file resume removes its stale partial; close review gaps (cut 9g)
• (wal) a true conflict message, drain kept in production, exact resume docs (cut 9f-1 plan 2, task 10, review fixes)
• pin the batch age in the end-to-end stall tests (debug-only FLUX_TEST_BATCH_AGE_MS); no real-clock reads in unit tests
• cut 9c final review - corrupt note is STATE_CORRUPT by spec amendment, true round-trip e2e, evidence labels, validation tests
• failed listings exit 1, cross-platform e2e snapshot and destination, lease-gate reason text, single-file pointer guard (cut 9b final fixes)
• report a lock this run created and could not remove when the run fails
• (flux-core) stop discard destroying the error taxonomy

Features

• a copy indexes a large pre-existing destination through its scratch space
• --scratch-dir for copy and verify
• verify, the sweep and the dry restart stop on a fatal walk error
• a copy spills into its workspace and beats while it lists
• render the -v lines, route them above the bar, escape names
• --quiet prints only causes, warnings and dry-run output
• -v, -vv, -vvv and --quiet flags shared by the three commands
• the summary line reads correctly, shows time and human sizes
• flux copy shows live progress on a terminal
• the engine ticks a live Progress from its own counters
• dry resume over several sources in the CLI; documents
• flux copy --resume accepts several sources
• flux copy --dry-run accepts several sources (cut 18 task 5)
• prefix lock, directory lock and target previews for a dry several-source run (cut 18 task 3)
• --restart with several sources passes the CLI gate; texts name --restart (cut 17 task 3)
• --exclude and --recursive/--no-recursive on copy and verify (cut 16 task 6)
• verify selects both sides and counts what it excluded (cut 16 task 5)
• the selection is part of the resume fingerprint (cut 16 task 4)
• copy selects through the walker and counts what it excluded (cut 16 task 3b)
• (cli) accept --resume together with --verify (cut 15 task 3)
• (cli) flux verify takes several sources, each compared with DEST/
• (cli) report helpers for a several-source verify and a sources array in its summary
• (core) verify_several runs each root under DEST/ in prefix order; the CLI maps every VerifyError through one refusal_line
• (cli) the flux verify subcommand
• (cli) --verify and --hash for flux copy
• (fs) verification levels, VERIFY_MISMATCH and Outcome.verified
• (cli) --hardlinks, hardlink counters, summary suffixes and warnings
• (core) dry run predicts hardlinks without destination I/O
• (core) per-run hardlink slot, anchor directory, index name in retire, run plumbing
• (fs) hardlink mode, option field and codes (cut 12)
• (cli) flux copy takes several sources
• (core) state format 5 for several roots
• (cli) cut 11b, --dry-run combines with --resume, --restart and --break-lock; the resume and discard lines, the notes, the summary extras and the unprobed keys; tests 79 and 136
• (core) cut 11b, the resume and discard words, DryPrior, the dry-run report fields, the dry temp root and the six dry-run notes
• (cli) flux copy --dry-run: per-entry lines, the dry summary, the unprobed note, dry_run and unprobed in the JSON (cut 11a)
• (core) the dry branches of run::tree and run::file, prior-operation notes, DEST counted per I7 (cut 11a)
• (core,cli) dry-run types, the null claim store, the Planned cause and the RunConfig/Run/Report fields (cut 11a)
• (cli) --cross-filesystems, recorded in the resume configuration only when set (cut 10b)
• (core) skipped source mounts as empty directories, MountSkipped records, the Unknown policy, and the report lines (cut 10b)
• (fs) FileSystem::mount_root and CopyOptions.cross_filesystems, with the shared mount-root helpers (cut 10b)
• (cli) --links=<copy|skip>, part of the resume configuration (cut 10a)
• (tree) recreate symlinks through the per-entry protocol; --links=skip records; link failures are copy failures (cut 10a)
• (fs) read_link and create_symlink on the traits, the Links option, the fake and the arms (cut 10a)
• (cli) report a single-file resume and its level (cut 9g)
• (run) a single-file resume continues its proven prefix (cut 9g)
• (cli) --resume-verify=<chunks|full>, metadata refused, level line and resume_verify JSON field (cut 9f-2)
• (core) ResumeVerify level carried by RunConfig and CheckpointPolicy (cut 9f-2)
• (resume) a damaged checkpoint log is quarantined, a newer-format one stops the run (cut 9f-1 plan 2, owner ruling 23)
• (run) report the WAL tail the replay cut (cut 9f-1 plan 2, task 10c)
• (report) bytes reused and every discard named (cut 9f-1 plan 2, task 9)
• (run) the tree run owns the checkpoint WAL (cut 9f-1 plan 2, task 8)
• (state) manifest format 4 records the WAL generation (cut 9f-1 plan 2, task 2)
• (taxonomy) WAL_WRITE_FAILED and the checkpoint copy step (cut 9f-1 plan 2, task 1)
• (cli) debug-only FLUX_TEST_COUNTERS_FILE with the barrier, cap and heartbeat-gap counters
• (tree) cap open writers across the frame stack at min(256, RLIMIT_NOFILE/4), flushing the shallowest batch first
• group commit of Strict tree publications is on (64 files / 64 MiB / 1 s)
• commit recovery at --resume - classify every note, apply all or refuse COMMIT_STATE_UNCERTAIN (cut 9c)
• claim store format 2 with the prepared table; note commits are immediate (cut 9c)
• flux cleanup DEST - the command, its report and exit codes (cut 9b)
• a copy finishes a prior operation's recorded cleanup and removes workspace debris (cut 9b)
• flux copy --resume, the resume report lines and the cut 9a known limits (cut 9a)
• --resume adopts the one resumable prior as the same operation (cut 9a)
• resume::validate - the compatibility check for --resume (cut 9a)
• manifest format 3 - roots, options and the configuration fingerprint (cut 9a)
• a directory copy replaces existing files under claims, with skip and update (cut 8b)
• replacement counts, ClaimNotRecorded and the report fields (cut 8b)
• the copy path's before_create callback and the single-file existing-destination policy (cut 8b)
• ExistingPolicy, Outcome.skipped and the --overwrite/--update/--skip-existing flags (cut 8b)
• probe the destination for no-replace publication inside the unpublished workspace (cut 8a, Part P)
• render the mount-root and containment warnings (cut 8a)
• (cli) flux copy runs under the destination's lock, with --restart and --break-lock (cut 7a Part 3b-2)
• (cli) a run's stop and warnings on stderr, the holder one field per line (cut 7a Part 3b-2)
• (cli) the exit status of a run - its own stop first, then the copy's rule (cut 7a Part 3b-2)
• (flux-cli) flux copy copies folders, reports, and exits per §55
• (flux-cli) resolve SOURCE and DEST per §4.1, K6 and K7
• (flux-cli) record lines, warnings, summary and the §53 JSON report
• (flux-cli) a library target, and the §55 exit codes
• (flux-fs) Safety on CopyOptions and identity_degraded on Outcome
• (flux-cli) wire flux copy to the engine

Miscellaneous

• add PolyForm Noncommercial header to source files
• cleanup of the deferred review findings (cut 8b)
• scaffold the Rust workspace and dev toolchain

Other

• Merge origin/main into feat/bounded-listing
• the 5 s heartbeat, overridable in a debug build; end to end, a stalled run's lock record shows it
• the heartbeat during the copy, retried once; its failure is one error naming the lock, and a torn record ends with nothing written
• return the published target's identity, read from the temporary's handle before the rename; prepare_file returns the source's

Refactoring

• CopyOptions carries a selection (cut 16 task 3a)
• (cli) the several-source resolver takes its usage verb

flux

0.19.12 - 2026-11-08

Bug fixes

• (model) retry a body cut short, and give the translation job time for the retries
• (model) back off between TLC jar download attempts
• an explicit scratch directory is opened at the first spill, and the final review's fixes
• verify --json prints the stopped summary when the walk fails
• omit boot session IDs from diagnostics
• --quiet keeps a dry run's skip records and verify's absent-destination notice; correct the --quiet help
• elapsed_text cannot overflow and rounds 9.995 s up to 10.0s; restore the copy summary tail check
• count carried bytes and skipped files in the live progress
• several-source resume text and documents tell the truth after cut 19
• final review wave for the selection cut (cut 16)
• (core) verify's root check names the root a containment query was about; the mode-000 test fails loudly under root
• (cli) keep the typos gate green in the display_path test
• (cli) verify routes records through a tested function, stops on a failed stdout write, escapes awkward names
• (cli) verify --help shows the exit codes; real copy-then-verify and --links/--cross-filesystems tests
• final review wave - honest policy-split warning, link-aware abort, heartbeat-safe index removal
• (core) refuse a folder root's bad target before transfer
• (cli) a several-source checkpoint failure points at cleanup, not resume
• (core,cli) cut 11b final-review wave: predicted lock refusals name the lock file; the dry takeover needs strong identity too; the CLI test crate builds on Windows; the real-fs fixture leaves its store unclean; single-file partial paths; notes before a predicted refusal (P10); prior_operation leaves unprobed on the predicted refusal; count failures refuse; the dead DryRunPriorUnreadable removed; forbidden_for_resume tightened
• (core,cli) dry run final-review fold: a top-level source .flux mirrors live (merge, or the live failure), the lock and state checks reported as unperformed (unprobed: target_lock, prior_operation), an over-long temporary name predicted, no throughput for unmoved bytes; allow-list call-log checks, more corpus cases, the three pinning tests (cut 11a, rulings P10-P12)
• (copy) a skipped single-file resume removes its stale partial; close review gaps (cut 9g)
• (wal) a true conflict message, drain kept in production, exact resume docs (cut 9f-1 plan 2, task 10, review fixes)
• pin the batch age in the end-to-end stall tests (debug-only FLUX_TEST_BATCH_AGE_MS); no real-clock reads in unit tests
• cut 9c final review - corrupt note is STATE_CORRUPT by spec amendment, true round-trip e2e, evidence labels, validation tests
• failed listings exit 1, cross-platform e2e snapshot and destination, lease-gate reason text, single-file pointer guard (cut 9b final fixes)
• report a lock this run created and could not remove when the run fails
• (flux-core) stop discard destroying the error taxonomy
• a failed identity build stops the run and a migrated index surfaces a step-5 stat error as the file's own
• serialise the 300k-file tests and name the directory when a poisoned index fails its retire
• the packer streams level 0 to disk instead of holding it in memory
• sort_keyed orders wide keys by every key byte before the name
• the temporary-home tests expect the Windows flux-scratch subdirectory
• the scratch home is found only at the first spill and released on close
• a scratch region dropped out of order cannot extend the file
• engine events build no arguments with logging off; a replaced link carries its target
• final review wave for the several-source dry run cut (cut 18)
• (core) a destination-only unlistable directory is extra; root-check failures name the root; absent-destination hook
• (core) resume skip site reports an unreadable index; tighten resume tests
• (core) run the identity gate on linked replacements, test the Replace link path
• (core) lazy hardlink slot close and dry-run temp index, honest anchor-root check
• (core) fake rename_no_replace answers AlreadyExists for a same-object target
• (core) a pre-root abort leaves the root not started; pin the weak-destination corner
• (core) a root with any failure kind reports failed
• (core) refuse non-UTF-8 source names ending in .flux-lock
• (core) release a prefix lock when its record key cannot be built
• (core) a batch with a failed entry re-checks the lock before it is settled (cut 11c site 3)
• (core) the batched STOP-HELD cleanup re-checks the lock before discarding notes (cut 11c site 2)
• (core) the unbatched Strict discard re-checks the lock and keeps the note after a loss (cut 11c site 1)
• (core) the fake answers StateCorrupt for an undecodable claim on get and DestinationError for a special file at the store (cut 11c, 31a000d parity)
• (core) partials_under reports an unlistable root as unlistable, so sweep_partials keeps every prior's state as before (cut 11b Task 4 review); the test for it
• final-review wave (UNC payloads, error 87 retry and messages, links serialised only when skip, guard pins) (cut 10a)
• (run) the partial sweep, note recovery and cleanup accept link artefacts (cut 10a)
• (checkpoint) SpawnFails selects the worker for either durability, pin the worker in the pool-wait test (cut 9h, task 7 fix 1)
• (checkpoint) the worker checks cancel before every send; drop and cancel tests pinned (cut 9h, task 3)
• (core) full with no partial reports nothing when the log cannot be read (cut 9f-2)
• (resume) wave D review fixes, ruling 24 (cut 9f-1 plan 2)
• (test) wave B follow-ups of the final fix-wave review (cut 9f-1 plan 2)
• (test) a_sender_dropped_mid_flush is deterministic (cut 9f-1 plan 2, final review M11)
• (checkpoint) one mtime encoding, true Display text, hard alignment assert (cut 9f-1 plan 2, final review M1 M4 M5)
• (resume) a hard-linked partial is recopied, never written through (cut 9f-1 plan 2, final review I3)
• (test) mtime fixtures use 100 ns multiples so Windows round-trips them (cut 9f-1 plan 2, final review C1)
• (run) flag the WAL abandoned the moment the lock is lost (cut 9f-1 plan 2, task 8, review fixes)
• (wal) an aborted file discards its pending records instead of flushing them (cut 9f-1 plan 2, task 8, review fixes)
• (tree) only files at or above the checkpoint threshold take a checkpoint context (cut 9f-1 plan 2, task 8, review fixes)
• (state) retiring a workspace removes its wal directory (cut 9f-1 plan 2, task 8a)
• (copy) a partial with an unavailable identity is recopied, not wedged (cut 9f-1 plan 2, task 7, review fixes)
• (checkpoint) FileSink::begin accepts valid_through equal to the source length (cut 9f-1 plan 2, task 7)
• (state) pin the TRANSFERRING-time generation bump and keep the v1/v2 refusal text (cut 9f-1 plan 2, task 2, review fixes)
• (wal) a re-sent FileBegin starts a new attempt, oversized operation ids are refused at open, barrier the lazy-create test (cut 9f-1 plan 1, final review fixes, I3 M4 M6 M10)
• (fault_fs) an open_existing handle writes from offset 0 like the real one (cut 9f-1 plan 1, final review fixes, I2)
• (wal) trailing damage is a torn tail, mid-log damage stays corrupt, every cut is reported (cut 9f-1 plan 1, final review fixes, ruling 23)
• (wal) abandonment flag, Strict directory syncs, exact oversize refusal, pinned defaults (cut 9f-1 plan 1, Task 7 fix 1)
• (tree) a missing publish primitive is a drain stop class (RemoveAll); a three-frame drain-time test pins the mode switch
• (tree) a stop that first appears during the drain switches the drain mode for the remaining frames
• (tree) after a lost-lock or heartbeat stop the drain cleans up only; no barrier, no note (owner ruling B2')
• (run) FLUX_TEST_OPEN_WRITERS floors at 1; a debt bullet for an injectable e2e clock
• (copy) the barrier's deadline catches up after a stall; threads == 0 is the testable main-thread seam
• (tree) barrier wakes at half the heartbeat interval; a stopping cap flush is counted
• (copy) a refused worker thread no longer aborts the barrier; it falls back to fewer workers or the main thread
• an undecodable claim at a recovery commit is STATE_CORRUPT, not a foreign claim
• the cleanup lock acquisition applies the lease gate to a dead owner too; skipped rows are reported; pass order pinned (cut 9b)
• discovery - failed listings are reported, refusals proven before any probe, an untrusted lock is an UNCERTAIN row (cut 9b)
• final review follow-ups - foreign-claim pin, count() mapping, nested key pins, known limits 6 and 11 (cut 9a)
• compare resume paths through absolute_lexical so the tests hold on Windows (cut 9a)
• an adopted workspace survives a refused-unchanged copy; pin single-file adoption fields (cut 9a)
• refuse a fold onto an entry another target owns, make learned spellings O(1), document that closing the store commits (cut 8b)
• created directories plan targets as new, pin the second claim and the symlink target (cut 8b)
• create state.db after the workspace is published (Windows refuses to rename a directory with an open file) (cut 8b)
• separator-insensitive call-log counts in the NameIndex tests (cut 8b)
• separator-insensitive call-log assertions in the case-insensitive fake tests (cut 8b)
• separator-insensitive call-log assertion in the claim-store fake test (cut 8b)
• cut 8a final review fold (copy_tree containment, probe error cleanup reported, retire removes probe files)
• (core) a target name is one component or PATH_COMPONENT_INVALID; the ownership refusal says what to do; conformance matches whole labels (capstone round 2)
• (core) the give-up message names no flag a break-lock run already used; recover's comment states its reorder (quality review)
• open_lock takes no controlling terminal; the fake forgets a removed name's type (Task 2 quality review)
• (flux-core) copy_tree refuses a destination directory that is the source root
• (flux-core) the fake created a file over a directory, and miscoded a missing component
• (core) poison the walk before panicking on a bad entry name
• (core) refuse a directory entry name that is not one component
• (flux-core) a rename of a missing source fails instead of conjuring the destination
• (flux-core) the fake mints identity at creation instead of hashing the path
• (flux-fs) state the interior-NUL rule instead of leaving it to two kernels
• (flux-fs) an unpaired surrogate smuggled any name past every check
• a name that is not one component, a create that followed links, and a twin status
• a wrapped name length, a directory that remove_file deleted, and a miscoded not-found
• end the Windows streaming listing with Ok(()) now that it keeps no accumulator
• (platform) a socket at the lock or claim-store path is DestinationError, not IoError; ClaimStore::get on an undecodable record is StateCorrupt
• (platform) statx EPERM falls back to the device comparison on the source side; real-mount-point test skips instead of failing; document the final review's limits (cut 10b)
• (platform) Windows creation over a directory is AlreadyExists; the directory-link retry is for symlinks only
• (platform) Windows symlink creation review findings (cut 10a)
• (fs) read_file refuses a socket on both platforms; Windows lists one as Other (Part 3a capstone round 1)
• (platform) a name deleted while open vanishes at once on Windows (cut 7a Part 1 capstone)
• (platform) boot_session_id review fixes (Task 5 quality review)
• (flux-platform) a handle-created file can read its own attributes on Windows
• (flux-platform) the handle rename_replace refuses a read-only target on Windows
• (flux-platform) the handle rename_replace refuses a read-only target on POSIX
• (flux-platform) report a directory as IsADirectory from remove_file on macOS
• (flux-platform) build the handle-relative stat paths on macOS and Linux clippy
• (flux-platform) let the variant carry the reparse bit, and pin the row the table was missing
• (flux-platform) stop reading every stat failure as a vanished name, and record why the rename has no fallback
• (flux-platform) reparse_tag_of broke every directory on a volume that cannot answer
• (flux-platform) ask the removal guard twice, and judge it on the tag
• snake-case the junction-root test, and drop a stray file from the tree
• (flux-platform) a guard that failed open, a race t