tensorfs 0.3.23__tar.gz → 0.3.26__tar.gz

{tensorfs-0.3.23 → tensorfs-0.3.26}/Cargo.lock

@@ -392,7 +392,7 @@ checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
 
 [[package]]
 name = "tensorfs-core"
-version = "0.3.23"
+version = "0.3.26"
 dependencies = [
  "fs2",
  "minicbor",
@@ -404,7 +404,7 @@ dependencies = [
 
 [[package]]
 name = "tensorfs-py"
-version = "0.3.23"
+version = "0.3.26"
 dependencies = [
  "pyo3",
  "tensorfs-core",

{tensorfs-0.3.23 → tensorfs-0.3.26}/Cargo.toml

@@ -3,5 +3,5 @@ resolver = "2"
 members = ["crates/tensorfs-core", "crates/tensorfs-py"]
 
 [workspace.package]
-version = "0.3.23"
+version = "0.3.26"
 edition = "2021"

{tensorfs-0.3.23 → tensorfs-0.3.26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tensorfs
-Version: 0.3.23
+Version: 0.3.26
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Rust

{tensorfs-0.3.23 → tensorfs-0.3.26}/crates/tensorfs-core/src/checkpoint.rs

@@ -477,7 +477,11 @@ pub fn walk_cozytensors(store: &Store, snap: &Manifest) -> Result<Walk> {
 /// Repository completeness, checkout, retention, and accounting use this full walk; workers
 /// use `walk_cozytensors` because an optional README or sample image is not a runtime input.
 pub fn walk(store: &Store, snap: &Manifest) -> Result<Walk> {
-    let mut w = walk_cozytensors(store, snap)?;
+    let mut w = if snap.header().is_some() {
+        walk_cozytensors(store, snap)?
+    } else {
+        Walk::default()
+    };
 
     // Anything listed that the header does not account for is a sibling asset — with two
     // audit-driven tightenings (external review, folded in at tfs-003):

{tensorfs-0.3.23 → tensorfs-0.3.26}/crates/tensorfs-core/src/source_artifact.rs

@@ -8,12 +8,13 @@ use crate::{
     ids::{prefixed, Doc, ObjectRef, Plain},
     manifest::Manifest,
     storage::HeldKey,
-    store::Store,
+    store::{Fault, Store},
 };
 use fs2::FileExt;
 use std::{
     fs::{self, File, OpenOptions},
     io::{Read, Write},
+    os::unix::fs::OpenOptionsExt,
     path::PathBuf,
 };
 
@@ -157,14 +158,16 @@ fn verify(store: &Store, manifest: &ObjectRef) -> Result<Manifest> {
         );
     }
     for (_, entry) in tree.entries() {
-        match store.record_valid(&entry.blob().sha256) {
-            Ok(record) if record.length == entry.blob().length => {}
-            _ => {
-                return refuse(
-                    Code::DURABILITY_UNPROVEN,
-                    "tree member has no standing verification record",
-                )
-            }
+        // Retention asks the same question as reading: are these exact bytes present and
+        // verified? Keep the native distinction between an absent member (a cache miss)
+        // and corrupt or unreadable bytes. The pinned reader also repairs a stale record
+        // by hashing only when its fast metadata check can no longer establish identity.
+        let file = store.open_verified(&entry.blob().sha256)?;
+        if file.len() != entry.blob().length {
+            return refuse(
+                Code::LENGTH_MISMATCH,
+                "tree member length differs from its manifest",
+            );
         }
     }
     Ok(tree)
@@ -272,6 +275,59 @@ pub fn create(store: &Store, owner: &str, tree: &Manifest) -> Result<TreeRoot> {
     }
     writer.finish(tree)
 }
+
+/// Import an exact ordinary-file roster under durable custody before admitting bytes.
+/// A retry needs local paths only for members without a standing verification record.
+pub fn import_tree(
+    store: &Store,
+    owner: &str,
+    tree: &Manifest,
+    files: &[(String, PathBuf)],
+    fault: &Fault,
+) -> Result<TreeRoot> {
+    check_roster(owner, tree)?;
+    if tree.header().is_some() {
+        return refuse(Code::WRONG_TYPE, "import requires an ordinary-file tree");
+    }
+    let paths: std::collections::BTreeMap<_, _> = files.iter().map(|(k, v)| (k, v)).collect();
+    if paths.len() != files.len()
+        || paths.len() != tree.entries().len()
+        || tree
+            .entries()
+            .iter()
+            .any(|(member, _)| !paths.contains_key(member))
+    {
+        return refuse(
+            Code::TRANSACTION_CONFLICT,
+            "import paths differ from the exact manifest roster",
+        );
+    }
+    let mut writer = Writer::open(store, owner, tree.object_ref())?;
+    if !writer.completed()? {
+        for (member, entry) in tree.entries() {
+            let object = entry.blob();
+            writer.hold_expected(object)?;
+            if !matches!(store.record_valid(&object.sha256), Ok(row) if row.length == object.length)
+            {
+                let path = paths[member];
+                if !fs::symlink_metadata(path).map_err(io)?.is_file() {
+                    return refuse(Code::WRONG_TYPE, "import member must be a regular file");
+                }
+                let mut file = OpenOptions::new()
+                    .read(true)
+                    .custom_flags(crate::store::O_NOFOLLOW)
+                    .open(path)
+                    .map_err(io)?;
+                if !file.metadata().map_err(io)?.is_file() {
+                    return refuse(Code::WRONG_TYPE, "import member must be a regular file");
+                }
+                store.put_stream(&mut file, Some(object), fault)?;
+            }
+            writer.landed(object)?;
+        }
+    }
+    writer.finish(tree)
+}
 /// Adopt only from a still-retained complete owner, before releasing the source owner.
 pub fn retain(store: &Store, source: &str, owner: &str) -> Result<TreeRoot> {
     let _writer = WriterGuard::acquire(store.root())?;

{tensorfs-0.3.23 → tensorfs-0.3.26}/crates/tensorfs-core/src/transport/hub.rs

@@ -593,7 +593,29 @@ fn call_once(
             })
         });
     }
-    let refusal = envelope(status, &raw, path);
+    let Some(refusal) = envelope(status, &raw, path) else {
+        // NOT THE HUB. Every refusal the hub can write carries its typed envelope, so a
+        // status that carries none was written by something in front of it — a tunnel
+        // whose agent is reconnecting, a load balancer with no backend, a captive
+        // gateway. That is weather over an immutable request, exactly like a connection
+        // that was never answered, and it is classified as such.
+        //
+        // Reading it as a verdict cost a paid H100 on 2026-09-08 (tfs-101): the public
+        // origin's tunnel agent was seventeen seconds out of a reconnect loop, its edge
+        // answered `POST /v1/tensorfs/presign` with its own 404 page, this function
+        // called that REF_NOT_FOUND, the pod supervisor's poisoned set made it terminal,
+        // and the pod journaled a permanent refusal for a placement set whose every
+        // object the hub was holding and would have signed.
+        return Err(Retryable {
+            wait: ledger.patience(),
+            refusal: Refusal {
+                code: Code::HUB_UNREACHABLE,
+                detail: format!(
+                    "{base}{path} answered HTTP {status} with no hub envelope, so the hub                      did not write it; artifacts already in the local store are usable offline"
+                ),
+            },
+        });
+    };
     if !crate::transport::pull::RETRYABLE_STATUS.contains(&status) {
         return Err(Retryable::from(refusal));
     }
@@ -626,7 +648,14 @@ fn stated_wait(raw: &[u8]) -> Option<std::time::Duration> {
 
 /// The hub's own typed envelope, crossed verbatim: its code and remedy are BETTER than
 /// anything invented here — the hub knows why it refused.
-fn envelope(status: u16, raw: &[u8], path: &str) -> Refusal {
+///
+/// `None` when the answer carried no envelope, and that is the point of the return type.
+/// The STATUS ALONE is not evidence about the catalog: a 404 means "the published catalog
+/// does not name this" only when the hub said so, and the presence of `error.code` is the
+/// only thing that distinguishes the hub's verdict from a proxy's opinion. Mapping status
+/// without that test is how a tunnel's error page came to mean a model does not exist —
+/// permanently, on a pod that had already paid to boot.
+fn envelope(status: u16, raw: &[u8], path: &str) -> Option<Refusal> {
     let mut code = String::new();
     let mut message = String::new();
     let mut remedy = String::new();
@@ -645,7 +674,7 @@ fn envelope(status: u16, raw: &[u8], path: &str) -> Refusal {
         }
     }
     if code.is_empty() {
-        code = format!("http.{status}");
+        return None;
     }
     if message.is_empty() {
         message = format!("the hub answered HTTP {status} to {path}");
@@ -655,7 +684,7 @@ fn envelope(status: u16, raw: &[u8], path: &str) -> Refusal {
     } else {
         format!("{code}: {message} — {remedy}")
     };
-    match status {
+    Some(match status {
         404 => Refusal {
             code: Code::REF_NOT_FOUND,
             detail,
@@ -672,5 +701,5 @@ fn envelope(status: u16, raw: &[u8], path: &str) -> Refusal {
             code: Code::HUB_REFUSED,
             detail,
         },
-    }
+    })
 }

{tensorfs-0.3.23 → tensorfs-0.3.26}/crates/tensorfs-core/src/transport/pull.rs

@@ -629,18 +629,34 @@ impl ObjectUrls for Leases<'_> {
             return Ok(url);
         }
         self.mint_from(at)?;
-        self.fresh(&object.sha256).ok_or_else(|| Refusal {
-            code: Code::HUB_REFUSED,
-            detail: format!(
-                "{}: the mint answered without leaving a usable URL for it — a URL whose \
-                 declared life is already spent when it is granted authorizes nothing",
-                object.id()
+        if let Some(url) = self.fresh(&object.sha256) {
+            return Ok(url);
+        }
+        // The mint answered and the URL was STILL not usable. With `minted` stamped on
+        // arrival this can only mean the hub granted a life it had already spent — it
+        // declared `expires_at_unix` at or before its own `server_time_unix` — so say
+        // that, and say the number, instead of leaving the reader to infer which of the
+        // two clocks was wrong.
+        refuse(
+            Code::HUB_REFUSED,
+            format!(
+                "{}: the mint answered but the URL was unusable on arrival; the hub \
+                 declared a life of {:?} for it, and a URL whose declared life is already \
+                 spent when it is granted authorizes nothing",
+                object.id(),
+                self.declared_lifetime(&object.sha256)
             ),
-        })
+        )
     }
 }
 
 impl Leases<'_> {
+    /// What the hub said this digest's URL was good for, for a refusal to quote.
+    fn declared_lifetime(&self, digest: &str) -> Option<Duration> {
+        let held = self.held.lock().unwrap();
+        held.get(digest).and_then(|lease| lease.lifetime)
+    }
+
     fn fresh(&self, digest: &str) -> Option<String> {
         let held = self.held.lock().unwrap();
         held.get(digest)
@@ -694,9 +710,6 @@ impl Leases<'_> {
         if digests.is_empty() {
             return Ok(());
         }
-        // Stamped BEFORE the call, so the call's own latency is spent out of the lease it
-        // is fetching rather than granted back to it.
-        let minted = Instant::now();
         let answer = hub::presign(
             self.client,
             self.base,
@@ -706,6 +719,24 @@ impl Leases<'_> {
             self.deadline,
             self.ledger,
         )?;
+        // Stamped when the ANSWER ARRIVES (tfs-102). It used to be stamped before the
+        // call, "so the call's own latency is spent out of the lease it is fetching
+        // rather than granted back to it" — but the URL does not exist for any of that
+        // time. The hub signs it while handling the call and states, in its own clock,
+        // the life it granted; the request leg, the hub's queueing, custody's signing and
+        // every retry `call` makes inside `presign` are all time the URL had not begun.
+        //
+        // Charging them to it made a slow mint POISON ITS OWN ANSWER. The hub's lifetime
+        // is ten minutes and a lease is spent at half of it, so a presign that took five
+        // minutes — one flaky tunnel, or two of `call`'s own retries — returned URLs that
+        // were unusable the instant they arrived, and the walk refused terminally on a
+        // paid pod with "a URL whose declared life is already spent when it is granted
+        // authorizes nothing". Twice on 2026-09-08, on gayong and weed, each after ~82 GB
+        // had already moved at 378 MB/s.
+        //
+        // What is left uncharged is the return leg alone, which is one hop and bounded by
+        // the call's own deadline.
+        let minted = Instant::now();
         let mut held = self.held.lock().unwrap();
         for (digest, url) in answer.urls {
             held.insert(

{tensorfs-0.3.23 → tensorfs-0.3.26}/crates/tensorfs-core/src/transport/tests.rs

@@ -1255,13 +1255,56 @@ fn hub_envelope_crosses_verbatim_as_typed_refusals() {
     assert!(refusal.detail.contains("models.unknown_ref"));
     assert!(refusal.detail.contains("check the ref"));
 
-    let denied: Dispatch = Arc::new(|_: &Request| status(401, b"{}"));
+    let denied: Dispatch = Arc::new(|_: &Request| {
+        status(
+            401,
+            br#"{"error":{"code":"auth.credential_required","message":"no credential"}}"#,
+        )
+    });
     let origin = self::origin(denied);
     let refusal = pull(&request_for(&store, &origin.base, &policy)).unwrap_err();
     assert_eq!(refusal.code, Code::CREDENTIAL_REQUIRED);
     let _ = std::fs::remove_dir_all(store_root);
 }
 
+// tfs-101. A status is evidence about the CATALOG only when the hub wrote it. On
+// 2026-09-08 the public origin's tunnel agent was seconds out of a reconnect loop and its
+// edge answered `POST /v1/tensorfs/presign` with its own 404 page; the status alone was
+// read as REF_NOT_FOUND, which the pod supervisor treats as poisoned, and a paid H100
+// journaled a permanent refusal for a placement set the hub was holding in full.
+#[test]
+fn a_status_with_no_hub_envelope_is_the_edge_and_stays_resumable() {
+    let store_root = temporary("unenveloped");
+    let store = Store::init(&store_root).unwrap();
+    let policy = SourcePolicy::default();
+    // Exactly what an ngrok endpoint answers while its agent session is down.
+    let edge_page: Dispatch = Arc::new(|_: &Request| {
+        status(
+            404,
+            b"<!DOCTYPE html><html><body>ERR_NGROK_3200 endpoint offline</body></html>",
+        )
+    });
+    let origin = origin(edge_page);
+    let refusal = pull(&request_for(&store, &origin.base, &policy)).unwrap_err();
+    assert_eq!(refusal.code, Code::HUB_UNREACHABLE);
+    assert!(refusal.detail.contains("no hub envelope"));
+    assert!(refusal.detail.contains("404"));
+
+    // A 401 page from a gateway is not this hub asking for a credential it does not take.
+    let gateway: Dispatch = Arc::new(|_: &Request| status(401, b"<html>Unauthorized</html>"));
+    let origin = self::origin(gateway);
+    let refusal = pull(&request_for(&store, &origin.base, &policy)).unwrap_err();
+    assert_eq!(refusal.code, Code::HUB_UNREACHABLE);
+
+    // And a well-formed JSON body that is simply not the envelope stays weather too: the
+    // test is the hub's own code, not the content type.
+    let shaped: Dispatch = Arc::new(|_: &Request| status(404, br#"{"detail":"not found"}"#));
+    let origin = self::origin(shaped);
+    let refusal = pull(&request_for(&store, &origin.base, &policy)).unwrap_err();
+    assert_eq!(refusal.code, Code::HUB_UNREACHABLE);
+    let _ = std::fs::remove_dir_all(store_root);
+}
+
 #[test]
 fn credential_headers_reach_the_hub_and_not_the_object_host() {
     let root = temporary("cred");
@@ -2320,6 +2363,79 @@ fn a_403_is_judged_by_the_leases_age_and_not_by_a_count() {
     );
 }
 
+/// **A SLOW MINT MUST NOT POISON ITS OWN ANSWER.**
+///
+/// tfs-102, from two paid H100s on 2026-09-08. `gayong` and `weed` each moved ~82 GB of
+/// `paul/minimax-h3` at 378 MB/s, then stopped dead and refused with "a URL whose declared
+/// life is already spent when it is granted authorizes nothing". Nothing was wrong with the
+/// objects — the same closure landed clean on two other pods within the hour.
+///
+/// `minted` was stamped BEFORE the presign call, and a lease is spent at half the life the
+/// hub declared. The hub's life is ten minutes, so a presign that took five — one flaky
+/// tunnel, or two of `call`'s own retries — returned URLs that were unusable the instant
+/// they arrived, and the walk refused terminally with 82 GB already on disk.
+///
+/// The URL does not exist for the duration of the call that fetches it. The hub signs it
+/// while handling the request and states the life it granted in its own clock; the request
+/// leg, the queueing and the signing are time the URL had not begun. Stamping on ARRIVAL
+/// charges it only for the return leg, which is one hop.
+///
+/// Reaching the decision needs a mint slower than half a declared life, so the fixture
+/// shortens the LIFE rather than lengthening the call. Everything else is production.
+#[test]
+fn a_slow_mint_does_not_poison_the_urls_it_returns() {
+    let root = temporary("slow-mint");
+    let store = Store::init(&root).unwrap();
+    let checkpoint = Arc::new(checkpoint(3, 4 * 1024));
+    // The shortest life the wire can express is one second — the hub states its clocks in
+    // whole seconds — so the call need only take past half of it. Stamped before the call,
+    // every URL in the answer is over half its life on arrival and the walk has none it
+    // may use; stamped on arrival, every one is whole.
+    const DECLARED: u64 = 1;
+    let slow = Duration::from_millis(700);
+    let base_slot: Arc<Mutex<String>> = Arc::default();
+    let dispatch_base = Arc::clone(&base_slot);
+    let mints = Arc::new(AtomicUsize::new(0));
+    let minted = Arc::clone(&mints);
+    let served = Arc::clone(&checkpoint);
+    let dispatch: Dispatch = Arc::new(move |request: &Request| {
+        let base = dispatch_base.lock().unwrap().clone();
+        match (request.method.as_str(), request.path.as_str()) {
+            ("POST", "/v1/tensorfs/closure") => ok_json(&closure_value(&served, &base)),
+            ("POST", "/v1/tensorfs/presign") => {
+                minted.fetch_add(1, Ordering::Relaxed);
+                std::thread::sleep(slow);
+                let now = std::time::SystemTime::now()
+                    .duration_since(std::time::UNIX_EPOCH)
+                    .unwrap()
+                    .as_secs();
+                let Value::Obj(mut fields) = presign_value(&request.body, &base) else {
+                    panic!()
+                };
+                fields.push(("expires_at_unix".into(), Value::uint(now + DECLARED)));
+                fields.push(("server_time_unix".into(), Value::uint(now)));
+                fields.sort_by(|a, b| a.0.cmp(&b.0));
+                ok_json(&Value::Obj(fields))
+            }
+            ("GET", path) if path.starts_with("/obj/") => {
+                match served.bodies.get(&path["/obj/".len()..]) {
+                    Some(body) => status(200, body),
+                    None => status(404, b"no such object"),
+                }
+            }
+            _ => status(404, b"no such route"),
+        }
+    });
+    let origin = origin(dispatch);
+    *base_slot.lock().unwrap() = origin.base.clone();
+    let policy = SourcePolicy::default();
+    let report = pull(&request_for(&store, &origin.base, &policy))
+        .expect("a mint slower than half a declared life still returns usable URLs");
+    assert_eq!(report.fetched, checkpoint.objects.len() as u64 + 1);
+    assert!(mints.load(Ordering::Relaxed) >= 1);
+    let _ = std::fs::remove_dir_all(root);
+}
+
 /// **A hub that says "wait" is waited for, and the same request is then answered.**
 ///
 /// A rate limit is the purest resumable refusal in the protocol — the identical request gets

tensorfs-0.3.26/crates/tensorfs-core/tests/import_tree.rs

@@ -0,0 +1,217 @@
+use std::{
+    fs,
+    path::{Path, PathBuf},
+    process::{Command, Stdio},
+    thread,
+    time::Duration,
+};
+use tensorfs_core::{
+    err::Code,
+    gc,
+    ids::{Doc, ObjectRef},
+    manifest::{Draft, Entry, Manifest},
+    source_artifact,
+    store::{Fault, Store},
+};
+
+fn directory(label: &str) -> PathBuf {
+    std::env::temp_dir().join(format!(
+        "tfs-import-{label}-{}-{}",
+        std::process::id(),
+        tensorfs_core::meta::now_nanos_unique()
+    ))
+}
+fn owner() -> String {
+    ObjectRef::of(b"local import").id()
+}
+fn tree() -> Manifest {
+    Manifest::from_files(vec![
+        ("a.json".into(), ObjectRef::of(b"first member")),
+        ("nested/b.bin".into(), ObjectRef::of(b"second member")),
+    ])
+    .unwrap()
+}
+fn files(dir: &Path) -> Vec<(String, PathBuf)> {
+    vec![
+        ("a.json".into(), dir.join("a")),
+        ("nested/b.bin".into(), dir.join("b")),
+    ]
+}
+
+#[test]
+fn refuses_roster_and_typed_header_before_starting_custody() {
+    let dir = directory("roster");
+    let store = Store::init(&dir).unwrap();
+    let paths = files(&dir);
+    for bad in [
+        paths[..1].to_vec(),
+        vec![paths[0].clone(), paths[0].clone()],
+        vec![paths[0].clone(), ("extra".into(), dir.join("extra"))],
+    ] {
+        assert_eq!(
+            source_artifact::import_tree(&store, &owner(), &tree(), &bad, &Fault::default())
+                .unwrap_err()
+                .code,
+            Code::TRANSACTION_CONFLICT
+        );
+        assert!(source_artifact::read(&store, &owner()).unwrap().is_none());
+    }
+    let typed = Draft {
+        entries: vec![(
+            "model.ct".into(),
+            Entry::CozyTensors(ObjectRef::of(b"header")),
+        )],
+    }
+    .seal()
+    .unwrap();
+    assert_eq!(
+        source_artifact::import_tree(&store, &owner(), &typed, &paths, &Fault::default())
+            .unwrap_err()
+            .code,
+        Code::WRONG_TYPE
+    );
+    assert!(source_artifact::read(&store, &owner()).unwrap().is_none());
+    fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+fn verifies_bytes_and_resumes_only_missing_members() {
+    let dir = directory("verify");
+    let store = Store::init(&dir).unwrap();
+    fs::write(dir.join("a"), b"first member").unwrap();
+    fs::write(dir.join("b"), b"short").unwrap();
+    assert_eq!(
+        source_artifact::import_tree(&store, &owner(), &tree(), &files(&dir), &Fault::default())
+            .unwrap_err()
+            .code,
+        Code::LENGTH_MISMATCH
+    );
+    fs::write(dir.join("b"), b"wrong! member").unwrap();
+    assert_eq!(
+        source_artifact::import_tree(&store, &owner(), &tree(), &files(&dir), &Fault::default())
+            .unwrap_err()
+            .code,
+        Code::OBJECT_ID_MISMATCH
+    );
+    assert!(
+        !source_artifact::read(&store, &owner())
+            .unwrap()
+            .unwrap()
+            .complete
+    );
+    fs::remove_file(dir.join("a")).unwrap();
+    gc::collect(&dir, false).unwrap();
+    fs::write(dir.join("b"), b"second member").unwrap();
+    let result =
+        source_artifact::import_tree(&store, &owner(), &tree(), &files(&dir), &Fault::default())
+            .unwrap();
+    assert!(result.complete);
+    assert_eq!(result.manifest, tree().object_ref());
+    fs::remove_file(dir.join("b")).unwrap();
+    assert_eq!(
+        source_artifact::import_tree(&store, &owner(), &tree(), &files(&dir), &Fault::default())
+            .unwrap(),
+        result
+    );
+    let changed = Manifest::from_files(vec![("a.json".into(), ObjectRef::of(b"other"))]).unwrap();
+    assert_eq!(
+        source_artifact::import_tree(
+            &store,
+            &owner(),
+            &changed,
+            &files(&dir)[..1],
+            &Fault::default()
+        )
+        .unwrap_err()
+        .code,
+        Code::TRANSACTION_CONFLICT
+    );
+    let recipient = ObjectRef::of(b"recipient").id();
+    source_artifact::retain(&store, &owner(), &recipient).unwrap();
+    source_artifact::release(&store, &owner()).unwrap();
+    gc::collect(&dir, false).unwrap();
+    assert_eq!(store.read_manifest(&result.manifest).unwrap(), tree());
+    for (_, entry) in tree().entries() {
+        assert!(store.contains(&entry.blob().sha256));
+    }
+    assert_eq!(
+        source_artifact::import_tree(&store, &owner(), &tree(), &files(&dir), &Fault::default())
+            .unwrap_err()
+            .code,
+        Code::TRANSACTION_CLOSED
+    );
+    fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+fn import_child() {
+    let Some(dir) = std::env::var_os("TFS_IMPORT_TREE_CHILD") else {
+        return;
+    };
+    let dir = PathBuf::from(dir);
+    let store = Store::open(&dir).unwrap();
+    source_artifact::import_tree(
+        &store,
+        &owner(),
+        &tree(),
+        &files(&dir),
+        &Fault {
+            stage: Some("record".into()),
+            ready: Some(dir.join("ready")),
+        },
+    )
+    .unwrap();
+    panic!("fault should wait for the parent to kill this process");
+}
+
+#[test]
+fn symlink_member_is_refused_before_reading_its_target() {
+    let dir = directory("symlink");
+    let store = Store::init(&dir).unwrap();
+    fs::write(dir.join("target"), b"first member").unwrap();
+    std::os::unix::fs::symlink(dir.join("target"), dir.join("a")).unwrap();
+    assert_eq!(
+        source_artifact::import_tree(&store, &owner(), &tree(), &files(&dir), &Fault::default())
+            .unwrap_err()
+            .code,
+        Code::WRONG_TYPE
+    );
+    assert!(!store.contains(&ObjectRef::of(b"first member").sha256));
+    fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+fn killed_after_admission_before_landed_keeps_member_live_for_gc_and_resume() {
+    let dir = directory("kill");
+    let store = Store::init(&dir).unwrap();
+    fs::write(dir.join("a"), b"first member").unwrap();
+    fs::write(dir.join("b"), b"second member").unwrap();
+    let mut child = Command::new(std::env::current_exe().unwrap())
+        .args(["--exact", "import_child", "--nocapture"])
+        .env("TFS_IMPORT_TREE_CHILD", &dir)
+        .stdout(Stdio::null())
+        .spawn()
+        .unwrap();
+    for _ in 0..1000 {
+        if dir.join("ready").is_file() {
+            break;
+        }
+        assert!(child.try_wait().unwrap().is_none());
+        thread::sleep(Duration::from_millis(5));
+    }
+    assert!(dir.join("ready").is_file());
+    child.kill().unwrap();
+    child.wait().unwrap();
+    let partial = source_artifact::read(&store, &owner()).unwrap().unwrap();
+    assert!(!partial.complete);
+    assert_eq!(partial.objects, vec![ObjectRef::of(b"first member")]);
+    gc::collect(&dir, false).unwrap();
+    fs::remove_file(dir.join("a")).unwrap();
+    let completed =
+        source_artifact::import_tree(&store, &owner(), &tree(), &files(&dir), &Fault::default())
+            .unwrap();
+    assert!(completed.complete);
+    gc::collect(&dir, false).unwrap();
+    assert_eq!(store.read_manifest(&completed.manifest).unwrap(), tree());
+    fs::remove_dir_all(dir).unwrap();
+}