mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-10-28 06:22:22 +00:00
c6e0271dea
U4. Adds the field, its codec, and its validation at the untrusted store boundary. Nothing emits it yet — that is U5 — so the field is absent in practice and no edge changes. A STRING, not `MixedChainStep[]`. The store's interning reviver re-shares objects only when they carry `nodeId` + `filePath`, which a chain step does not, so an object encoding survives every warm load as fresh allocations — per step, per site, per file. A string collapses to one interned instance per distinct chain. `1|svc|cgetUser|faddress` is 23 bytes against a 48-byte budget. Wire format follows `taint/path-codec.ts`: versioned, printable ASCII, one shared encoder/decoder both sides import. `|` and `~` cannot occur in an identifier in any supported language, so the format needs no escaping and a malformed payload cannot decode as a different valid chain. A member named `count` or `field` needs no special-casing — the kind sigil is positional. The encoder REFUSES rather than degrades: an empty chain, a name carrying a structural character, or an over-cap payload returns `undefined`. Minting a half-encoded chain would produce something that decodes cleanly as a DIFFERENT, shorter chain, and typing off that is how a missing edge becomes a wrong one. Depth truncation is explicit (`|~`) for the same reason: the tail a truncated chain is missing is exactly what determines the final type. Bounds are applied at EMIT as well as at load. Load-only bounds are a recurring defect here — the writer keeps minting what the reader keeps refusing, which is a permanent warm-cache-miss reparse loop. At the store boundary, `referenceSites` had no sanitizer at all, unlike `callableFlowSites`. Sanitation is per-FIELD rather than per-site: a chain that does not decode is stripped and the site is KEPT, because the site still resolves through the text cascade — dropping the reference would turn a degraded receiver into a missing edge. Only a non-array `referenceSites` rejects the file. The common case (nothing stripped) returns the original array and allocates nothing on the warm-load path. Also logs the reject path, which was the unlogged half of the same defect: a rejected entry silently re-extracts on EVERY load, so a writer/reader disagreement costs real time while saying nothing about why. 43 tests: codec round-trip, sigil-prefixed member names, every malformed payload decoding to `undefined` rather than throwing, emit/load agreement on the byte cap, and store round-trips covering a shard written before the field existed. |
||
|---|---|---|
| .. | ||
| src | ||
| package-lock.json | ||
| package.json | ||
| tsconfig.json | ||