amalgm 0.1.238 → 0.1.240

package/runtime/scripts/amalgm-mcp/tests/workspace-native-file-transaction.test.js

@@ -0,0 +1,364 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFile, execFileSync, spawn } = require('node:child_process');
+const { promisify } = require('node:util');
+
+const execFileAsync = promisify(execFile);
+
+test('checked-in descriptor-relative transaction binaries match their exact source', async () => {
+  const verifier = path.join(
+    __dirname,
+    '..',
+    'workspace',
+    'native-file-transaction',
+    'verify.mjs',
+  );
+  const { stdout } = await execFileAsync(process.execPath, [verifier]);
+  assert.match(stdout, /verified source [a-f0-9]{64} and 2 binaries/);
+});
+
+test('native process lifetime distinguishes live owners from exited PIDs', () => {
+  const platform = process.platform === 'darwin' && process.arch === 'arm64'
+    ? 'darwin-arm64'
+    : process.platform === 'linux' && process.arch === 'x64'
+      ? 'linux-x64'
+      : null;
+  if (platform === null) return;
+  const executable = path.join(
+    __dirname,
+    '..',
+    'workspace',
+    'native-file-transaction',
+    'bin',
+    platform,
+    'amalgm-file-transaction',
+  );
+  const identity = (pid) => JSON.parse(execFileSync(executable, [], {
+    input: JSON.stringify({
+      action: 'identity',
+      backend: 'process-identity',
+      pid,
+    }),
+    encoding: 'utf8',
+  }));
+
+  const current = identity(process.pid);
+  assert.equal(current.status, 'identified');
+  assert.match(current.identity, /.+/);
+  assert.equal(identity(1).status, 'identified');
+  assert.deepEqual(identity(2_147_483_647), { status: 'exited' });
+});
+
+test('same bytes on a replacement inode do not satisfy an exact document predecessor', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-file-cas-test-'));
+  const file = path.join(root, 'document.md');
+  fs.writeFileSync(file, 'same bytes\n', 'utf8');
+  const docDisk = require('../state/doc-disk');
+  const native = require('../workspace/native-file-transaction/client');
+  const expected = docDisk.observe(file);
+
+  const replacement = path.join(root, 'replacement.md');
+  fs.writeFileSync(replacement, 'same bytes\n', 'utf8');
+  fs.renameSync(replacement, file);
+
+  const targetContent = Buffer.from('new target\n', 'utf8');
+  const transaction = {
+    root: expected.root,
+    rootDev: expected.rootDev,
+    rootIno: expected.rootIno,
+    path: expected.relativePath,
+    id: crypto.createHash('sha256').update('same-byte-inode-cas').digest('hex'),
+    operation: 'same-byte-inode-cas',
+    expected: expected.identity,
+    target: docDisk.byteIdentity(targetContent),
+  };
+  try {
+    const result = native.run(transaction, 'apply', targetContent);
+    assert.equal(result.status, 'changed');
+    assert.equal(fs.readFileSync(file, 'utf8'), 'same bytes\n');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('document observation stays with one physical parent across rename and replacement', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-file-observe-test-'));
+  const parent = path.join(root, 'registered-parent');
+  const renamed = path.join(root, 'uuid-owned-parent');
+  const file = path.join(parent, 'document.md');
+  fs.mkdirSync(parent);
+  fs.writeFileSync(file, 'owned bytes\n', 'utf8');
+  const originalParent = fs.statSync(parent, { bigint: true });
+  const child = spawn(process.execPath, [
+    '-e',
+    'const fs=require("fs");'
+      + `setTimeout(()=>{fs.renameSync(${JSON.stringify(parent)},${JSON.stringify(renamed)});`
+      + `fs.mkdirSync(${JSON.stringify(parent)});`
+      + `fs.writeFileSync(${JSON.stringify(file)},"unrelated bytes\\n","utf8");},75);`,
+  ], { stdio: 'ignore' });
+
+  try {
+    const observed = require('../state/doc-disk').observe(file, {
+      pauseAfterParentOpen: 350,
+    });
+    assert.equal(observed.text, 'owned bytes\n');
+    assert.equal(observed.rootDev, originalParent.dev.toString());
+    assert.equal(observed.rootIno, originalParent.ino.toString());
+    assert.notEqual(observed.text, fs.readFileSync(file, 'utf8'));
+  } finally {
+    child.unref();
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('receipt release keeps proof when its physical parent moved', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-receipt-move-test-'));
+  const parent = path.join(root, 'original-parent');
+  const movedParent = path.join(root, 'moved-parent');
+  const file = path.join(parent, 'document.md');
+  fs.mkdirSync(parent);
+  fs.writeFileSync(file, 'before\n', 'utf8');
+  const docDisk = require('../state/doc-disk');
+  const native = require('../workspace/native-file-transaction/client');
+  const expected = docDisk.observe(file);
+  const targetContent = Buffer.from('after\n', 'utf8');
+  const transaction = {
+    root: expected.root,
+    rootDev: expected.rootDev,
+    rootIno: expected.rootIno,
+    path: expected.relativePath,
+    id: crypto.createHash('sha256').update('moved-receipt-parent').digest('hex'),
+    operation: 'moved-receipt-parent',
+    expected: expected.identity,
+    target: docDisk.byteIdentity(targetContent),
+  };
+
+  try {
+    assert.equal(
+      native.run(transaction, 'apply', targetContent).status,
+      'applied',
+    );
+    fs.renameSync(parent, movedParent);
+
+    const retained = native.run(transaction, 'release');
+    assert.equal(retained.status, 'pending');
+    assert.match(retained.reason, /receipt parent is unavailable/);
+    assert.equal(
+      fs.existsSync(path.join(
+        movedParent,
+        `.amalgm-apply-${transaction.id}`,
+      )),
+      true,
+    );
+
+    const rebound = native.run({
+      ...transaction,
+      root: fs.realpathSync(movedParent),
+    }, 'release');
+    assert.equal(rebound.status, 'released');
+    assert.equal(
+      fs.existsSync(path.join(
+        movedParent,
+        `.amalgm-apply-${transaction.id}`,
+      )),
+      false,
+    );
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('exclusive tree moves preserve a destination created during the rename window', () => {
+  const native = require('../workspace/native-file-transaction/client');
+  for (const kind of ['file', 'directory']) {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), `amalgm-tree-cas-${kind}-`));
+    const source = path.join(root, `source-${kind}`);
+    const destination = path.join(root, `destination-${kind}`);
+    if (kind === 'directory') {
+      fs.mkdirSync(source);
+      fs.writeFileSync(path.join(source, 'value.txt'), 'source directory\n', 'utf8');
+    } else {
+      fs.writeFileSync(source, 'source file\n', 'utf8');
+    }
+    const rootStats = fs.lstatSync(root, { bigint: true });
+    const sourceStats = fs.lstatSync(source, { bigint: true });
+    const child = spawn(process.execPath, [
+      '-e',
+      'const fs=require("fs");'
+        + `setTimeout(()=>{`
+        + (kind === 'directory'
+          ? `fs.mkdirSync(${JSON.stringify(destination)});`
+            + `fs.writeFileSync(${JSON.stringify(path.join(destination, 'value.txt'))},"racing directory\\n","utf8");`
+          : `fs.writeFileSync(${JSON.stringify(destination)},"racing file\\n","utf8");`)
+        + '},75);',
+    ], { stdio: 'ignore' });
+
+    try {
+      const result = native.moveNoReplace({
+        root: fs.realpathSync(root),
+        rootDev: rootStats.dev.toString(),
+        rootIno: rootStats.ino.toString(),
+        source: path.basename(source),
+        sourceIdentity: {
+          kind: kind === 'directory' ? 'folder' : kind,
+          dev: sourceStats.dev.toString(),
+          ino: sourceStats.ino.toString(),
+        },
+        sourceParentIdentity: {
+          kind: 'folder',
+          dev: rootStats.dev.toString(),
+          ino: rootStats.ino.toString(),
+        },
+        targetParentIdentity: {
+          kind: 'folder',
+          dev: rootStats.dev.toString(),
+          ino: rootStats.ino.toString(),
+        },
+        path: path.basename(destination),
+        id: crypto.createHash('sha256').update(`tree-cas-${kind}`).digest('hex'),
+        operation: `tree-cas-${kind}`,
+      }, {
+        pauseBeforeInstall: 300,
+      });
+      assert.equal(result.status, 'changed');
+      assert.match(result.reason, /destination changed/);
+      if (kind === 'directory') {
+        assert.equal(
+          fs.readFileSync(path.join(source, 'value.txt'), 'utf8'),
+          'source directory\n',
+        );
+        assert.equal(
+          fs.readFileSync(path.join(destination, 'value.txt'), 'utf8'),
+          'racing directory\n',
+        );
+      } else {
+        assert.equal(fs.readFileSync(source, 'utf8'), 'source file\n');
+        assert.equal(fs.readFileSync(destination, 'utf8'), 'racing file\n');
+      }
+    } finally {
+      child.unref();
+      fs.rmSync(root, { recursive: true, force: true });
+    }
+  }
+});
+
+test('exclusive tree moves restore a source name swapped during the rename window', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-tree-source-cas-'));
+  const source = path.join(root, 'source.txt');
+  const movedOriginal = path.join(root, 'moved-original.txt');
+  const destination = path.join(root, 'destination.txt');
+  fs.writeFileSync(source, 'original source\n', 'utf8');
+  const rootStats = fs.lstatSync(root, { bigint: true });
+  const sourceStats = fs.lstatSync(source, { bigint: true });
+  const child = spawn(process.execPath, [
+    '-e',
+    'const fs=require("fs");'
+      + `setTimeout(()=>{`
+      + `fs.renameSync(${JSON.stringify(source)},${JSON.stringify(movedOriginal)});`
+      + `fs.writeFileSync(${JSON.stringify(source)},"replacement source\\n","utf8");`
+      + '},75);',
+  ], { stdio: 'ignore' });
+
+  try {
+    const result = require('../workspace/native-file-transaction/client')
+      .moveNoReplace({
+        root: fs.realpathSync(root),
+        rootDev: rootStats.dev.toString(),
+        rootIno: rootStats.ino.toString(),
+        source: path.basename(source),
+        sourceIdentity: {
+          kind: 'file',
+          dev: sourceStats.dev.toString(),
+          ino: sourceStats.ino.toString(),
+        },
+        sourceParentIdentity: {
+          kind: 'folder',
+          dev: rootStats.dev.toString(),
+          ino: rootStats.ino.toString(),
+        },
+        targetParentIdentity: {
+          kind: 'folder',
+          dev: rootStats.dev.toString(),
+          ino: rootStats.ino.toString(),
+        },
+        path: path.basename(destination),
+        id: crypto.createHash('sha256').update('tree-source-cas').digest('hex'),
+        operation: 'tree-source-cas',
+      }, {
+        pauseBeforeInstall: 300,
+      });
+    assert.equal(result.status, 'changed');
+    assert.match(result.reason, /source changed during exclusive move and was restored/);
+    assert.equal(fs.existsSync(destination), false);
+    assert.equal(fs.readFileSync(source, 'utf8'), 'replacement source\n');
+    assert.equal(fs.readFileSync(movedOriginal, 'utf8'), 'original source\n');
+  } finally {
+    child.unref();
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('exclusive tree moves retain both names when a second source wins the undo race', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-tree-source-both-'));
+  const source = path.join(root, 'source.txt');
+  const movedOriginal = path.join(root, 'moved-original.txt');
+  const destination = path.join(root, 'destination.txt');
+  fs.writeFileSync(source, 'original source\n', 'utf8');
+  const rootStats = fs.lstatSync(root, { bigint: true });
+  const sourceStats = fs.lstatSync(source, { bigint: true });
+  const child = spawn(process.execPath, [
+    '-e',
+    'const fs=require("fs");'
+      + `setTimeout(()=>{`
+      + `fs.renameSync(${JSON.stringify(source)},${JSON.stringify(movedOriginal)});`
+      + `fs.writeFileSync(${JSON.stringify(source)},"first replacement\\n","utf8");`
+      + '},250);'
+      + `setTimeout(()=>{`
+      + `fs.writeFileSync(${JSON.stringify(source)},"second replacement\\n","utf8");`
+      + '},900);',
+  ], { stdio: 'ignore' });
+  try {
+    const result = require('../workspace/native-file-transaction/client')
+      .moveNoReplace({
+        root: fs.realpathSync(root),
+        rootDev: rootStats.dev.toString(),
+        rootIno: rootStats.ino.toString(),
+        source: path.basename(source),
+        sourceIdentity: {
+          kind: 'file',
+          dev: sourceStats.dev.toString(),
+          ino: sourceStats.ino.toString(),
+        },
+        sourceParentIdentity: {
+          kind: 'folder',
+          dev: rootStats.dev.toString(),
+          ino: rootStats.ino.toString(),
+        },
+        targetParentIdentity: {
+          kind: 'folder',
+          dev: rootStats.dev.toString(),
+          ino: rootStats.ino.toString(),
+        },
+        path: path.basename(destination),
+        id: crypto.createHash('sha256').update('tree-source-both').digest('hex'),
+        operation: 'tree-source-both',
+      }, {
+        pauseBeforeInstall: 600,
+        pauseAfterTreeMove: 600,
+      });
+    assert.equal(result.status, 'changed');
+    assert.match(result.reason, /both entries were retained/);
+    assert.equal(fs.readFileSync(movedOriginal, 'utf8'), 'original source\n');
+    assert.equal(fs.readFileSync(destination, 'utf8'), 'first replacement\n');
+    assert.equal(fs.readFileSync(source, 'utf8'), 'second replacement\n');
+  } finally {
+    child.unref();
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});

package/runtime/scripts/amalgm-mcp/tests/workspace-object-tunnel.test.js

@@ -123,7 +123,7 @@ test('repo object chunks travel through the shared tunnel one at a time', async
   }
 });
 
-test('repo object chunks retry when an acknowledgement is lost', async () => {
+test('repo object chunks retry after the tunnel reconnects', async () => {
   const uploadBytes = Buffer.from('retry this content-addressed chunk');
   const uploadSha = crypto.createHash('sha256').update(uploadBytes).digest('hex');
   const resourceId = 'shr_cp1abcdefghijklmnopqrstuvwx';
@@ -165,14 +165,25 @@ test('repo object chunks retry when an acknowledgement is lost', async () => {
     localPort: () => server.address().port,
     localHeaders: (headers) => headers,
     warn: () => {},
-    repoObjectRequestTimeoutMs: 25,
   });
 
   try {
+    tunnel.enable(['shared.mutation.v1']);
+    await until(
+      () => frames.filter((frame) => frame.type === 'repo.object.put').length === 1,
+      'the original upload',
+    );
+    await new Promise((resolve) => { setTimeout(resolve, 50); });
+    assert.equal(
+      frames.filter((frame) => frame.type === 'repo.object.put').length,
+      1,
+      'a healthy ordered tunnel never duplicates an in-flight upload',
+    );
+    tunnel.stop();
     tunnel.enable(['shared.mutation.v1']);
     await until(
       () => frames.filter((frame) => frame.type === 'repo.object.put').length >= 2,
-      'the unacknowledged upload retry',
+      'the upload after reconnect',
     );
     const puts = frames.filter((frame) => frame.type === 'repo.object.put');
     assert.notEqual(puts[0].request_id, puts[1].request_id);
@@ -189,3 +200,70 @@ test('repo object chunks retry when an acknowledgement is lost', async () => {
     server.close();
   }
 });
+
+test('a healthy tunnel sends one request for one durable mutation', async () => {
+  const envelope = {
+    resourceId: '018f0000-0000-7000-8000-000000000050',
+    authorityEpoch: 1,
+    mutationId: 'mut_one_ordered_request',
+    deviceId: 'machine-a',
+    baseVersion: 0,
+    contract: 'code-project-stream@2',
+    schemaVersion: 2,
+    operationKind: 'code.publish',
+    operation: {
+      kind: 'code.publish',
+      project: '018f0000-0000-7000-8000-000000000050',
+      delta: { kind: 'checkpoint.set' },
+    },
+  };
+  let wakeResponse = null;
+  const server = http.createServer((req, res) => {
+    req.resume();
+    req.on('end', () => {
+      res.setHeader('content-type', 'application/json');
+      if (req.url === '/state/shared/replicas') {
+        res.end('{"replicas":[]}');
+      } else if (req.url.startsWith('/state/stream')) {
+        res.writeHead(200, { 'content-type': 'text/event-stream' });
+        res.write('\n');
+        wakeResponse = res;
+      } else if (req.url === '/state/mutations/claim') {
+        res.end(JSON.stringify({ mutations: [{ envelope }] }));
+      } else if (req.url.endsWith('/claim')) {
+        res.end('{}');
+      } else {
+        res.end('{}');
+      }
+    });
+  });
+  await new Promise((resolve) => { server.listen(0, '127.0.0.1', resolve); });
+
+  const frames = [];
+  const tunnel = createSharedRealtimeTunnel({
+    send: (frame) => { frames.push(frame); return true; },
+    sendLarge: (frame) => { frames.push(frame); return true; },
+    localPort: () => server.address().port,
+    localHeaders: (headers) => headers,
+    warn: () => {},
+  });
+  const submits = () => frames.filter((frame) => frame.type === 'shared.mutation.submit');
+
+  try {
+    tunnel.enable(['shared.mutation.v1']);
+    await until(() => submits().length === 1 && wakeResponse, 'the original mutation request');
+    for (let index = 0; index < 3; index += 1) {
+      wakeResponse.write('event: state\ndata: {"sharedResourceId":"shr_cp1abcdefghijklmnopqrstuvwx"}\n\n');
+      await new Promise((resolve) => { setTimeout(resolve, 20); });
+    }
+    assert.equal(submits().length, 1, 'wake signals never duplicate an in-flight mutation');
+
+    tunnel.stop();
+    tunnel.enable(['shared.mutation.v1']);
+    await until(() => submits().length === 2, 'the mutation after reconnect');
+    assert.notEqual(submits()[0].request_id, submits()[1].request_id);
+  } finally {
+    tunnel.stop();
+    server.close();
+  }
+});

package/runtime/scripts/amalgm-mcp/tests/workspace-objects.test.js

@@ -25,16 +25,37 @@ fs.writeFileSync(
 const { closeLocalDb } = require('../state/db');
 const { hasCommit, headOid } = require('../workspace/git');
 const {
+  _test: { locatorChecksum },
   acknowledgeUpload,
   claimDownload,
   claimUpload,
   importFromLocator,
   objectSourceFor,
+  prepareBundleImport,
   publishPayload,
   readPayload,
   receiveDownload,
 } = require('../workspace/objects');
 
+const PROJECT = '018f0000-0000-7000-8000-000000000030';
+const PROJECT_BINDING = require('../workspace/wall').bindProject(
+  PROJECT,
+  '11111111-1111-4111-8111-111111111111',
+  tempRoot,
+);
+const REPO_KEY = PROJECT_BINDING.repoKey;
+
+test('a locator checksum binds the exact ordered chunk list', () => {
+  const first = { sha256: 'a'.repeat(64), bytes: 3 };
+  const second = { sha256: 'b'.repeat(64), bytes: 4 };
+  assert.equal(locatorChecksum([first, second]), locatorChecksum([first, second]));
+  assert.notEqual(locatorChecksum([first, second]), locatorChecksum([second, first]));
+  assert.notEqual(
+    locatorChecksum([first, second]),
+    locatorChecksum([first, { ...second, bytes: 5 }]),
+  );
+});
+
 test.after(() => {
   closeLocalDb();
   fs.rmSync(tempRoot, { recursive: true, force: true });
@@ -49,7 +70,7 @@ async function git(cwd, ...args) {
   return stdout;
 }
 
-test('an unpushed commit travels as card-owned chunks and imports without moving a ref', async () => {
+test('every committed card travels as project-owned chunks and imports without moving a ref', async () => {
   const origin = path.join(tempRoot, 'origin.git');
   await git(tempRoot, 'init', '--bare', '-b', 'main', origin);
   const source = path.join(tempRoot, 'source');
@@ -61,12 +82,12 @@ test('an unpushed commit travels as card-owned chunks and imports without moving
 
   const destination = path.join(tempRoot, 'destination');
   await git(tempRoot, 'clone', '-q', origin, destination);
-  assert.equal((await objectSourceFor(source, 'repo:test', await headOid(source))).kind, 'remote');
+  assert.equal((await objectSourceFor(source, REPO_KEY, await headOid(source))).kind, 'pending');
 
   fs.appendFileSync(path.join(source, 'app.js'), 'two\n');
   await git(source, 'commit', '-am', 'two');
   const unpushedOid = await headOid(source);
-  assert.equal((await objectSourceFor(source, 'repo:test', unpushedOid)).kind, 'pending');
+  assert.equal((await objectSourceFor(source, REPO_KEY, unpushedOid)).kind, 'pending');
 
   const uploaded = new Map();
   const deadline = Date.now() + 10_000;
@@ -78,10 +99,10 @@ test('an unpushed commit travels as card-owned chunks and imports without moving
     }
     uploaded.set(upload.sha256, upload.dataBase64);
     acknowledgeUpload(upload.resourceId, upload.sha256);
-    const sourceState = await objectSourceFor(source, 'repo:test', unpushedOid);
+    const sourceState = await objectSourceFor(source, REPO_KEY, unpushedOid);
     if (sourceState.kind === 'bundle') break;
   }
-  const locator = await objectSourceFor(source, 'repo:test', unpushedOid);
+  const locator = await objectSourceFor(source, REPO_KEY, unpushedOid);
   assert.equal(locator.kind, 'bundle');
   assert.ok(locator.chunks.length > 0);
 
@@ -103,7 +124,7 @@ test('an unpushed commit travels as card-owned chunks and imports without moving
 
 test('a large checkpoint uses the same verified chunk lane', () => {
   const content = Buffer.alloc(1_300_000, 0x61);
-  assert.equal(publishPayload('large-checkpoint', content, 'repo:test').kind, 'pending');
+  assert.equal(publishPayload('large-checkpoint', content, REPO_KEY).kind, 'pending');
 
   const uploaded = new Map();
   while (true) {
@@ -112,7 +133,7 @@ test('a large checkpoint uses the same verified chunk lane', () => {
     uploaded.set(upload.sha256, upload.dataBase64);
     acknowledgeUpload(upload.resourceId, upload.sha256);
   }
-  const locator = publishPayload('large-checkpoint', content, 'repo:test');
+  const locator = publishPayload('large-checkpoint', content, REPO_KEY);
   assert.equal(locator.kind, 'chunks');
   assert.ok(locator.chunks.length >= 3);
 
@@ -130,9 +151,94 @@ test('a large checkpoint uses the same verified chunk lane', () => {
   assert.equal(received.state, 'ready');
   assert.deepEqual(received.bytes, content);
   assert.equal(
-    publishPayload('same-content-after-download', content, 'repo:test').kind,
+    publishPayload('same-content-after-download', content, REPO_KEY).kind,
     'chunks',
     'verified downloaded content is immediately reusable by a later checkpoint',
   );
   assert.equal(claimUpload(), null);
 });
+
+test('zero-byte chunks are not legal transport work', () => {
+  const chunks = [
+    { sha256: '0'.repeat(64), bytes: 0 },
+    { sha256: '1'.repeat(64), bytes: 1 },
+  ];
+  const common = {
+    resourceId: PROJECT,
+    checksum: locatorChecksum(chunks),
+    bytes: 1,
+    chunks,
+  };
+  assert.throws(
+    () => readPayload({
+      kind: 'chunks',
+      contract: 'opaque-chunks@2',
+      ...common,
+    }),
+    /invalid checkpoint payload locator/,
+  );
+  assert.throws(
+    () => prepareBundleImport({
+      kind: 'bundle',
+      contract: 'git-bundle-chunks@2',
+      oid: 'a'.repeat(40),
+      ref: `refs/amalgm/exports/${'a'.repeat(40)}`,
+      ...common,
+    }),
+    /invalid git bundle locator/,
+  );
+});
+
+test('a corrupt pending upload is retired and rebuilt from the writer', () => {
+  const content = Buffer.from('rebuild this upload');
+  assert.equal(publishPayload('corrupt-upload', content, REPO_KEY).kind, 'pending');
+  const first = claimUpload();
+  assert.ok(first);
+  const chunkFile = path.join(
+    process.env.AMALGM_DIR,
+    'state',
+    'repo-objects',
+    'chunks',
+    `${first.sha256}.bin`,
+  );
+  fs.writeFileSync(chunkFile, 'corrupt');
+  assert.equal(claimUpload(), null, 'the corrupt manifest is retired instead of retrying forever');
+
+  assert.equal(publishPayload('corrupt-upload', content, REPO_KEY).kind, 'pending');
+  const rebuilt = claimUpload();
+  assert.equal(rebuilt.sha256, first.sha256);
+  assert.equal(Buffer.from(rebuilt.dataBase64, 'base64').toString(), content.toString());
+  acknowledgeUpload(rebuilt.resourceId, rebuilt.sha256);
+});
+
+test('one malformed download request cannot block valid requests behind it', () => {
+  const content = Buffer.from('download me');
+  const chunks = [{
+    sha256: require('crypto').createHash('sha256').update(content).digest('hex'),
+    bytes: content.length,
+  }];
+  const locator = {
+    kind: 'chunks',
+    contract: 'opaque-chunks@2',
+    resourceId: PROJECT,
+    checksum: locatorChecksum(chunks),
+    bytes: content.length,
+    chunks,
+  };
+  fs.rmSync(path.join(
+    process.env.AMALGM_DIR,
+    'state',
+    'repo-objects',
+    'chunks',
+    `${chunks[0].sha256}.bin`,
+  ), { force: true });
+  assert.equal(readPayload(locator).state, 'downloading');
+  const requests = path.join(process.env.AMALGM_DIR, 'state', 'repo-objects', 'requests');
+  fs.writeFileSync(path.join(requests, '000-malformed.json'), '{');
+
+  const claimed = claimDownload();
+  assert.equal(claimed.resourceId, PROJECT);
+  assert.equal(claimed.sha256, chunks[0].sha256);
+  assert.equal(fs.existsSync(path.join(requests, '000-malformed.json')), false);
+  receiveDownload(PROJECT, chunks[0].sha256, content.toString('base64'));
+});