The child forked by 'Daemon does not terminate unverified data-dir lock
holder' built an fs::path and called json::dump(), both of which allocate;
a fork in a multithreaded process can leave the malloc lock held, so the
child could fail before signaling readiness. Pre-compute the lock path in
the parent, format the payload with snprintf into a stack buffer, signal a
failure byte on open/flock error, and retry the parent's read on EINTR.
Portability allowlist line numbers updated for the shift.
Route the s3 backend through StorageBackendFactory::parseURL so scheme
detection, authority credentials, and query params flow through the same
path as the daemon's storage resolver, and reject a backend=s3 config
whose path is not an s3:// URL.
Add a mutex around all MemorySyncLoop access so the periodic sync worker
does not race publish/read/syncOnce on the loop's mutable version-vector
and logical-clock state. Reconcile before publish so a fresh loop instance
(e.g. a stateless CLI) resumes its node's causal history. Reject a zero
sync interval.
docker-compose with two saged daemons + MinIO (R2 stand-in) + shared
volume, a multi-stage saged.Dockerfile, and a validation script driving
filesystem<->filesystem convergence and causal-ordering determinism
(scenarios 1 + 3).
Thin p2p command over the memory-sync service: publish <key> <value|@file>,
read <key>, and status (merged index summary + backend identity). Binary
values are hex-encoded in JSON output; config resolves from [memory_sync]
with --backend/--path/--node-id overrides.
Add a typed [memory_sync] TOML section (enabled, node_id, backend,
path, sync_interval_ms) parsed into DaemonConfig, and start/stop the
MemorySyncService within ServiceManager: start after content-store init
(best-effort, relative paths resolve against the data dir), stop noexcept
in Phase 8 shutdown. No YAMS_* env knobs.
Typed MemorySyncDaemonConfig parsed from the [memory_sync] TOML section
(enabled, node_id, backend, path, sync_interval_ms) plus
createMemorySyncService() which resolves filesystem/s3 backends and
constructs the service. No YAMS_* env knobs.
Factor the post-setup 'what next / how to configure' guidance into pure
formatLaterCommand/formatInitSummary builders so each decision branch's
help is testable without stdout, and add a focused test asserting the
later-command and ready-summary text. Output is byte-identical.
Portability allowlist line numbers updated for the shift.
Factor the alreadyInitialized && !force_ branch out of the monolithic
execute() into a private handleAlreadyInitialized() helper. Behavior
preserved; setup decision/try nesting reduced. Portability allowlist
line numbers updated for the shift.
Daemon-facing service owns the backend + sync loop and reconciles on a
configurable interval via a stoppable worker thread. Typed
MemorySyncConfig (nodeId, syncIntervalMs); start/stop idempotent and
stop noexcept-safe. Backend injected so filesystem and S3/R2 resolution
stay with the caller.
Publish memory records as content-addressed blobs plus a
version-vector-tagged index record per write; sync lists the index,
pulls records, and LWW-merges to a deterministic winner per logical
key. Backend injected (filesystem / S3-R2 interchangeable).
Version vector (element-wise max merge, dominates/concurrent partial
order) plus hybrid timestamp and LWW resolution: causally-later writes
win, concurrent writes resolve deterministically by (ts, origin). JSON
serialization via nlohmann. Header-only, no library deps.
Stress-tagged cases ran in the default unit lane because only ~[slow]
was filtered. Tag them [slow] and add ~[slow]/[slow] splits to the five
binaries (mcp_submodule, work_coordinator, daemon_background,
plugin_infrastructure, hybrid_search) so they run in the slow suite.
Stress cases with 20 threads / 200 iterations run in the default unit
lane because only ~[slow] is filtered. Tag them [slow] so they move to
the storage_submodule_slow suite.
Retry setup.sh dependency resolution up to 3 times on Conan network
timeouts with backoff; report a distinct infra-retry (exit 77) when the
network failure persists, while real compile/test failures still fail
hard. Prevents a transient center2.conan.io timeout masquerading as a
code failure.
Detects mingw-w64/linux-gnu cross compilers and compiles a portability
probe with -fsyntax-only to catch narrow-vs-wide API and std::jthread
issues before GitHub CI. Skips cleanly when no toolchain is present;
--self-test proves dispatch and failure propagation with a fake compiler.
Catch Windows/Linux/macOS-only defect classes before push: raw
std::jthread, sqlite3_open* via bare path.c_str(), and raw getenv
reads outside the config boundary. Wired into pre-commit and the
unit/policy suite; 575 reviewed sites allowlisted.
copy_file of the migrated WAL-mode template plus -wal/-shm sidecars
corrupts WAL replay on Windows (stale -shm), losing kg_nodes. VACUUM
INTO produces a self-contained single-file copy; a probe verifies the
KG schema survived the clone.
_putenv_s removes a variable for "" and returns EINVAL for NULL, so the
CRT environment cannot represent an explicitly empty value; the boundary
collapsed unset and empty into one state. Read/write through the Win32
environment (SetEnvironmentVariableA/GetEnvironmentVariableA) instead,
keeping a best-effort _putenv_s sync so legacy std::getenv readers stay
coherent, and treat the empty-vs-unset read race fail-closed.
Use ExternalPluginHostConfig::defaultRpcTimeout for discovery, load, initialization, health, restart, and shutdown calls so sanitizer-slow plugin startup does not fall back to JsonRpcClient's hidden three-second default.
Rebuild macOS TSan outputs so compiler instrumentation and compiler-rt come from one Apple toolchain generation. Preserve daemon fixture dependencies until ServiceManager teardown so sanitizer lanes do not exercise a test-only use-after-free.
