* fix(lbug): keep serve stable when sidecars are missing
Shared missing-shadow WAL recovery prevents repeated read-only open warnings when LadybugDB sidecars are absent, while the Express preflight fix keeps `gitnexus serve` compatible with Express 5 route parsing.
Constraint: LadybugDB read-only replay can require a `.shadow` sidecar that may be absent after interrupted writes or checkpoint edge cases.
Rejected: keep reactive WARN-only quarantine in each adapter | it leaves repeated user-visible warnings and duplicate recovery behavior.
Confidence: high
Scope-risk: broad
Directive: Do not silently delete large orphan WALs; only quarantine tiny orphan WALs before open and keep large WALs for explicit recovery.
Tested: cd gitnexus && npx vitest run test/unit/sidecar-recovery.test.ts test/unit/lbug-adapter-wal-schema.test.ts test/unit/pool-wal-recovery.test.ts test/unit/web-ui-serving.test.ts && npx tsc --noEmit
Not-tested: full npm test in this split branch; full unit suite passed on the source branch before PR split.
Co-authored-by: OmX <omx@oh-my-codex.dev>
* fix(lbug): pool-caller ENOENT guard, symmetric size gate, permission-aware errors (PR #1747 review)
Addresses the production-readiness review of PR #1747 (Findings 1, 2, 3 of 6).
Findings 4, 5, 6 are deferred to follow-ups per the plan.
1. ENOENT-tolerance scoped to pool-adapter callers only
- `quarantineWalForMissingShadow` stays strict in `sidecar-recovery.ts`.
The direct adapter calls it inside `acquireInitLock` (cross-process
file lock) — ENOENT there means the file vanished under lock and
remains a real bug to surface.
- New `tryQuarantineForMissingShadow` local helper in `pool-adapter.ts`
returns a discriminated union { kind: 'quarantined', path } |
{ kind: 'peer-handled' }. Catches ENOENT, re-verifies via
statIfExists, and converts to 'peer-handled' only when WAL really
is gone. Defensive: if ENOENT but WAL still present, throws as
classified error rather than silently returning success.
2. Symmetric WAL-size gate on both recovery paths
- `refuseLargeWalQuarantine` applied in both
`reopenReadOnlyAfterMissingShadow` and
`reopenWritableAfterMissingShadow`. Closes the read-only data-loss
vector (large orphan WAL silently discarded would never be replayed
by a later writable open).
3. Permission-aware error classifier
- New `renameFailureMessage` and `isPermissionRenameError` in
`sidecar-recovery.ts`. EACCES / EPERM / EBUSY now surface a
permission-specific message pointing at ACLs, AV exclusions, and
file-locks. Other codes (ENOSPC, EROFS, EIO, ENOENT) fall through
to `shadowSidecarRecoveryMessage`.
- Used at both pool-adapter and direct-adapter caller catches around
`quarantineWalForMissingShadow`.
- `doInitLbug`'s pass-through classifier extended to include the new
permission message. The lock-retry substring match tightened so
"file-lock error" in the permission message is not mistaken for a
LadybugDB lock-retry trigger.
Tests
- sidecar-recovery.test.ts: 7 new tests for `renameFailureMessage` and
`isPermissionRenameError`.
- pool-wal-recovery.test.ts: 6 new tests covering ENOENT race,
EACCES/EPERM/EBUSY classification, ENOSPC fallthrough, and the
defensive "WAL still present after ENOENT" branch.
- lbug-adapter-wal-schema.test.ts: 5 new tests covering the symmetric
size gate on both recovery paths, including the boundary at exactly
TINY_ORPHAN_WAL_BYTES (4096) and the off-by-one at 4097.
Deferred (tracked as follow-up work)
- Brittle LadybugDB error-string matching (Finding 4).
- PNA header end-to-end coverage gap (Finding 5).
- warnedKeys module-global persistence (Finding 6).
- Cross-process init lock for pool-adapter.
* fix(lbug): dedup shadow-replay predicate + counter-based warn anti-spam (PR #1747 review, Findings 4 & 6)
Smallest viable response to the two remaining non-blocking findings from the
production-readiness review of PR #1747. An earlier-revision plan proposed
regex widening + a near-miss detector + per-dbPath warn scoping; an
adversarial doc-review found those defended against hypothetical strings
LadybugDB does not produce, added observability theater with no recovery
behavior change, and did not actually fix the long-running gitnexus serve
case for hot dbPaths (where finalizeLbugSidecarsAfterClose rarely fires).
Scope shrunk to dedup + counter-based — strictly behavior-changing and
fully testable.
Finding 4 — dedup + version-coupling markers
- `isReadOnlyShadowReplayError` was inlined in both `lbug-adapter.ts:451`
and `pool-adapter.ts:317`. Centralized as an export from
`sidecar-recovery.ts`. The two local copies are removed; both adapters
now import from the shared module.
- Both LadybugDB-coupled predicates (`isMissingShadowSidecarError` and
`isReadOnlyShadowReplayError`) gain a `// LADYBUGDB-CONTRACT:` marker
comment citing `@ladybugdb/core ^0.16.1`. When bumping LadybugDB,
`git grep "LADYBUGDB-CONTRACT"` enumerates every version-coupled spot.
- Strict matcher unchanged — when LadybugDB actually changes the error
format, the failure mode stays loud (raw native error propagates) and
the markers make every affected predicate trivially greppable.
Finding 6 — counter-based warn anti-spam
- `warnedKeys: Set<string>` → `warnedKeyCounts: Map<string, number>`.
`warnOnce` keeps its signature `(logger, key, message)` and keying
convention unchanged — the swap is internal.
- `WARN_MILESTONES = [1, 10, 100, 1000, 10000]`. Logarithmic spacing
gives O(log N) warns for a condition that fires N times. Past the
first occurrence the warn message is suffixed with "(Nth occurrence
of this condition)" so persistence is visible in the log line itself.
- Solves the long-running serve case: a hot dbPath hitting the same
condition 100 times now fires 3 warns (occurrences 1, 10, 100)
instead of 1 warn + 99 silent debug lines.
Tests (10 new in sidecar-recovery.test.ts, all green)
- Centralized isReadOnlyShadowReplayError: positive match, false-positive
guard, structural assertion that the duplicate regex is gone from both
adapter files, LADYBUGDB-CONTRACT marker count.
- Counter-based warnOnce: milestone-at-10 with suffix, milestone-at-100,
key isolation across dbPaths, reset zeroes the counter, first-occurrence
message does NOT carry the suffix.
Deferred (tracked separately)
- Finding 5 — PNA header end-to-end coverage gap (CORS boundary is sound).
- LadybugDB structured error codes (if/when the library exposes them).
- Per-call milestone configurability — re-open if tuning is needed.
* chore(autofix): apply prettier + eslint fixes via /autofix command
* ci: trigger CI rebuild
---------
Co-authored-by: wangxc <wangxc_a_bj@si-tech.com.cn>
Co-authored-by: OmX <omx@oh-my-codex.dev>
Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
a9fef2c68d