fix(adoption): the reserved-root mint exemption — int 0 is legitimate for exactly one id
All checks were successful
CI / Node 22 (push) Successful in 12m23s
CI / Node 24 (push) Successful in 12m9s
CI / Bun (latest) (push) Successful in 12m20s

The release-holding finding from the joint gate's six real depot brains:
the adoption path's positive-int mint check false-flagged the reserved
VFS-root sentinel (the all-zeros UUID, minted int 0 BY CONSTRUCTION at
genesis on existing brains) as a corrupt mint — so every existing brain
refused log-authority adoption and stayed on the old lossy-under-power-cut
durability, defeating the release's headline crash-safety exactly where
it matters most.

The exemption, at both mint seams (the host's minter thunk and the fact
log's encoder guard): int 0 is legal iff the id is the reserved root;
zero for ANY other id remains a corrupt-mint refusal naming the reserved
exception. The codec's u64 layer already tolerated 0 — only the guards
over-refused.

Pins: adoption goes green on a brain whose VFS root carries int 0 (the
depot-brain shape, previously refused) · a non-root zero still refuses
typed at the mint seam — held at the seam itself because a full write
SELF-HEALS a poisoned zero (the index cycle re-mints before the fact is
written, which is the correct outcome and was verified in the pinning).

Gates: unit 2065/2065 · integration 830 · conformance 31/31.
This commit is contained in:
David Snelling 2026-08-12 08:55:12 -07:00
parent 0e3facf4a8
commit 2abe8b3806
3 changed files with 118 additions and 4 deletions

View file

@ -1325,10 +1325,16 @@ export class FactLog {
)
}
const minted = this.intMinter(kind, id)
if (typeof minted !== 'bigint' || minted <= 0n) {
// Reserved-root exemption: int 0 is legitimate for exactly one id —
// the all-zeros VFS root, minted 0 by construction at genesis on
// existing brains. Zero anywhere else is a corrupt mint.
const isReservedRoot =
minted === 0n && id === '00000000-0000-0000-0000-000000000000'
if (typeof minted !== 'bigint' || minted < 0n || (minted === 0n && !isReservedRoot)) {
throw new Error(
`fact log v2: the int minter returned ${String(minted)} for ${kind} ${id}` +
`minted ints are positive bigints; refusing to write`
`minted ints are positive bigints (int 0 reserved for the VFS root alone); ` +
`refusing to write`
)
}
return minted