Drop snapshot fences and harden CI and tests

Merged
JS
1d ago
+889-386

The note snapshot cache's generation fence guarded nothing: a snapshot is served only on a 304 to its stored validator, and every body or title edit measurably changes HackMD's ETag. It cost a full second download instead, since any write discarded every read in flight and refetched it without a validator. Writes now detach reads in flight (they answer their callers, unkept), a confirmed read-back detaches that note's read even when it keeps nothing, hackmd_get_note seeds the body it reads so the following edit revalidates, and snapshots default to off for any HACKMD_API_URL other than the public API, where the ETag behavior was never measured.

The rest comes from a review of the commits since 2026-10-09. Snapshot limits are read only from the environment, and the .env key rules live in one table so a new key cannot be honored by default. The coverage ratchet no longer hides production match arms after a test-only arm, counts a moved file only by the lines it edits, ignores local git config, and runs as it is at the comparison commit. cargo audit fails on unsound and yanked crates. Startup tests require a log line only a configured server writes, the tool-call test no longer calls api.hackmd.io, and the live suites poll through 429 and 5xx replies.

Verified locally on macOS: cargo fmt --check, clippy with -D warnings (all features and default), make check (382 unit and 12 stdio tests), python3 tests/coverage.py (11 tests), actionlint, cargo machete, cargo audit --deny warnings, and an MSRV build with 1.88.0. Each commit passes clippy and the tests on its own. Changed-line coverage measured with cargo llvm-cov is 177/177 against the 93% floor, macOS only. New tests were checked to fail with their fix reverted. Nothing was run against the live API, so the live-suite changes are compiled but unexercised.

Summary by cubic

Removes the snapshot cache's generation fence and hardens CI and tests.

A snapshot is served only on a 304 to its stored validator, and every body or title edit changes HackMD's ETag, so the fence guarded nothing while costing a full second download: any write discarded every read in flight and refetched it without a validator. Writes now detach reads in flight, a confirmed read-back detaches that note's read even when it keeps nothing, hackmd_get_note reads as a flight that a write can detach yet seeds the body it reads so a following edit revalidates, and a read it cannot keep discards the note's older entry. An update releases a read once its hash is checked, and snapshots default to off for any HACKMD_API_URL other than the public API, where the ETag behavior was never measured.

CI and tests

  • Snapshot limits are read only from the environment; the .env key rules live in one table so a new key cannot be honored by default.
  • The coverage ratchet no longer hides production match arms after a test-only arm, counts a moved file only by the lines it edits, ignores local git config, runs as it is at the comparison commit, and fails when the previous main commit is gone instead of judging a change with an older floor.
  • cargo audit now fails on unsound and yanked crates.
  • Startup tests require a log line only a configured server writes; the tool-call test no longer calls api.hackmd.io; live suites poll through 429 and 5xx replies and watch a resent body through the read-back window.