Commit Graph
4 Commits
Author SHA1 Message Date
jackandClaude Opus 4.8 6e1da519ca Adapt invalid-receipt test to quarantine semantics after rebase
The structurally invalid record is now quarantined aside on first
lookup instead of staying in place globally fail-closed, so the test
clears the .corrupt file before exercising journal validation alone.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-26 13:34:06 +02:00
jackandjack ad0d07d5db Make private media deletion transactional 2026-07-26 13:32:18 +02:00
jackandClaude Opus 4.8 52709addc1 Quarantine corrupt private-media receipts per record
A single unreadable or undecodable receipt record used to abort the
whole index install, leaving every lookup .unavailable and silently
dropping ALL inbound private media with no recovery path. Move the
damaged file aside to a .corrupt name (skipped by future scans, bytes
preserved), fail only that ID closed, and let the rest of the ledger
load. Directory-level create/enumerate failures stay globally
fail-closed and retryable.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-26 13:15:32 +02:00
jackandjack d7f5e8a864 Persist private media delivery receipts 2026-07-26 13:04:00 +02:00