M12-04H Status

status: done task: remove extraction staging on cancellation without modifying the committed project updated: 2026-08-18 America/New_York enablingTask: false parityStateChange: false

Scope

The production archive extraction transaction checks cancellation before staging, around every payload read and write, and immediately before atomic commit. A pre-commit cancellation returns IO_ARCHIVE_CANCELLED, removes every staged file, publishes no project, and re-reads the committed project identity to prove that revision and SHA-256 did not change. Once atomic commit starts, cancellation no longer converts the completed commit into a cancelled result.

Payload identity failure and staging creation/write failure use the same cleanup path. If cleanup leaves a staged entry or the committed identity drifts, the transaction fails with STORAGE_TRANSACTION instead of claiming successful cancellation.

Evidence

npm --prefix web run test:library-archive-cancellation passed 6/6 unit tests against real temporary directories.
Cancellation before staging, after one staged file, and after the final staged write all leave zero staging files, zero published projects, and the original committed project bytes.
The success path publishes revision 9 only after both staged payload hashes pass.
Payload mismatch, rollback identity drift, stale revision, unsafe path, prefix conflict, and undeclared-field negatives fail closed.

Artifact Hashes

parent manifest: c35e675e8f512e85b748f0b5578874fed8c99df7674a152e698236a67c9f4fa4
protocol: c40adc1449172014cc1820db567e155828314abb404b66e4de13c26ddee06e4b
error codes: 751c70c898540fa7e82fb1b1a79254756ec8db8e4201a88b6d817d7c3d92103f
unit: 77e7d5bc64dd6b313006ebf523602601acdaf7949a1484da872ddcd046983786
package commands: cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c
manifest: 7fce600a416aec5ade1a91a13d86caf4cb1f65b710054b59d525ff8b1d3c7409

Next Task

M12-04I: release temporary files after quota/OOM and allow a small archive to recover.

Rollback

Remove the extraction transaction protocol, cancellation code, real-filesystem unit suite, manifest, package command, and this status entry. Restore M12-04G as the queue tail and move the machine queue back to M12-04H. No parity ledger rollback is required.

2.3 KiB Raw Blame History