fix(adoption): the reserved-root mint exemption — int 0 is legitimate for exactly one id
All checks were successful
CI / Node 22 (push) Successful in 12m23s
CI / Node 24 (push) Successful in 12m9s
CI / Bun (latest) (push) Successful in 12m20s

The release-holding finding from the joint gate's six real depot brains:
the adoption path's positive-int mint check false-flagged the reserved
VFS-root sentinel (the all-zeros UUID, minted int 0 BY CONSTRUCTION at
genesis on existing brains) as a corrupt mint — so every existing brain
refused log-authority adoption and stayed on the old lossy-under-power-cut
durability, defeating the release's headline crash-safety exactly where
it matters most.

The exemption, at both mint seams (the host's minter thunk and the fact
log's encoder guard): int 0 is legal iff the id is the reserved root;
zero for ANY other id remains a corrupt-mint refusal naming the reserved
exception. The codec's u64 layer already tolerated 0 — only the guards
over-refused.

Pins: adoption goes green on a brain whose VFS root carries int 0 (the
depot-brain shape, previously refused) · a non-root zero still refuses
typed at the mint seam — held at the seam itself because a full write
SELF-HEALS a poisoned zero (the index cycle re-mints before the fact is
written, which is the correct outcome and was verified in the pinning).

Gates: unit 2065/2065 · integration 830 · conformance 31/31.
This commit is contained in:
David Snelling 2026-08-12 08:55:12 -07:00
parent 0e3facf4a8
commit 2abe8b3806
3 changed files with 118 additions and 4 deletions

View file

@ -1306,10 +1306,18 @@ export class Brainy<T = any> implements BrainyInterface<T> {
}
const minted = mapper.getOrAssign(id, undefined)
const asBigint = typeof minted === 'bigint' ? minted : BigInt(minted)
if (asBigint <= 0n) {
// THE RESERVED-ROOT EXEMPTION: the VFS root (the all-zeros UUID) is
// minted int 0 BY CONSTRUCTION at genesis on existing brains — the
// one legitimate zero in the id space. Zero for ANY other id is a
// corrupt mint and refuses. (Without this, every existing brain's
// adoption oracle false-flagged its own root and refused the flip.)
const isReservedRoot =
asBigint === 0n && id === '00000000-0000-0000-0000-000000000000'
if (asBigint < 0n || (asBigint === 0n && !isReservedRoot)) {
throw new Error(
`fact log v2: the id mapper minted ${asBigint} for ${kind} ${id}` +
`minted ints are positive; refusing to write`
`minted ints are positive (int 0 is reserved for the VFS root alone); ` +
`refusing to write`
)
}
return asBigint