gen/release hardening - #533
Open
Skidamek wants to merge 66 commits into
Open
Conversation
Skidamek
force-pushed
the
gen/release-hardening
branch
from
August 20, 2026 11:12
178452e to
ad76958
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 178452ed9c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Skidamek
force-pushed
the
gen/release-hardening
branch
from
August 20, 2026 13:47
6db55da to
b29a50a
Compare
Skidamek
force-pushed
the
gen/release-hardening
branch
3 times, most recently
from
August 20, 2026 14:10
e77f036 to
5ec1999
Compare
Skidamek
force-pushed
the
gen/release-hardening
branch
from
August 20, 2026 14:14
5ec1999 to
a42815b
Compare
Skidamek
force-pushed
the
gen/release-hardening
branch
from
August 20, 2026 18:57
d662faf to
ffaa099
Compare
Skidamek
force-pushed
the
gen/release-hardening
branch
2 times, most recently
from
August 21, 2026 10:49
6c91fb3 to
3a62cf9
Compare
Inspection hashes files through a pure cache-bypassing path instead of publishing file records or reinspecting mods into the mod cache, and recover models nothing-left-to-recover as an empty Optional instead of a null receipt.
Storage measurement and compaction preview no longer run interrupted compaction recovery or publish object-cache records while measuring, and the mod cache test imports HashUtils instead of spelling out the fully qualified name.
Canonical data-root identity keys the open-storage registry and JVM mutation lock so symlink aliases serialize; OS detection is a typed mutually exclusive classification; ownership receipts survive an offline drive instead of being retired by one missing-path observation; data-root creation happens under the cross-process lock with the lock file outside the created directory; preload treats already-recovered repair as success; screens use explicit imports and the shared action-area layout with dynamic pagination; the autotester resets CAS objects only through an isolated-data-root verb and its fake bridge mirrors the real screen contract.
Skidamek
force-pushed
the
gen/release-hardening
branch
from
August 21, 2026 10:57
3a62cf9 to
2870806
Compare
Pack A now preserves more claims, so the removed-file claim no longer sits on page two at the harness resolution. Re-check 'when' before each 'repeat' iteration so a step can loop while a condition holds, and use it to click Next until the claim shows up. Enable mcholepunch transport tracing in the harness so a mid-login holepunch close leaves a receipt.
Cherry-picked from 39c8077 without the loader-core test and plan doc.
The camouflage was armed by wall clock between the handoff prepare and commit, so plain application bytes still in flight from the peer could arrive after the decoder was armed and get 'decoded' as framed data, killing download connections mid-login. HolepunchSocket now camouflages exactly the raw era: reads split by onRead/onRawRead, writes keyed on isRaw(), and the server bridge holds produced output while the upgrade is in flight so pre-raw bytes can never enter the raw stream queue. Rebuilds vendored mcholepunch jars with the era-split delivery.
The cleanup toggle carried its state in a mutating label whose width changed with every click, while prose elsewhere contradicted it, and the continue button renamed itself per mode. The toggle now keeps one constant label; a separate status line carries the state in yellow (keep, default) or gray (removal consequence), and the primary action is always 'Continue with defaults'. Status lines word-wrap instead of clipping at narrow widths. The shared action-area layout grew buttons to fit their labels but lost the shrink path, stacking rows and shifting pagination on screens that compute row counts from control height; growth now applies only when the grown row fits and otherwise shrinks back toward minimums.
Mod construction branched on a --launchTarget heuristic that only the early-window bootstrapper populates; past preload it misreported a real dedicated server as CLIENT, so client packet registration ran and its lambda bootstrap methods resolved net.minecraft.client.Minecraft, crashing mod construction. The heuristic now applies only during preload; at mod-construction time every loader trusts its native dist. Client packet registration moved into an isolated holder class so no server-reachable class carries eager client-type references even if a guard regresses. ClientLeakTripwireTest scans every stonecutter target's compiled classes for net/minecraft/client/Minecraft reachable from the init entrypoints, so this class of crash fails CI instead of shipping. The autotester now rejects release-mode artifacts in seconds instead of hanging 600s per connection path waiting for a bridge that cannot exist.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR addresses failure modes in the completed generation workflow. It covers immutable storage, interrupted recovery, client update races, autotester isolation, and the connection integrations used by the supported loaders.
Shared CAS state now publishes immutable objects with create-only semantics, durable ownership receipts, and verification before cache insertion. Collection keeps objects referenced by other game instances, rejects changed hard-linked cache entries, handles read-only objects, and distinguishes corrupt objects from missing objects. Server compaction and client projection swaps record durable receipts and resume after interruption, including cross-filesystem moves. Client storage roots and identity creation are serialized and validated before reuse.
The update transaction rechecks live files and requests a replan when they changed after planning. Deferred updates use latest-wins semantics, stale settings are invalidated, Windows projection locks move to the recovery helper, and reviewed consequences survive pending-update recovery. Transfer paths use the updated optimized flow.
The autotester adds cache deduplication, a detached supervisor for cleanup, fail-fast interruption handling, retry handling, cold-cache and legacy-target cases, and controlled concurrency. Loader integration updates mcholepunch artifacts and raw Minecraft and TLS frame camouflage, and requires stable MixinExtras hooks for critical mixins. Locale catalogues and management UI copy and navigation are synchronized.
Coverage
The layer adds storage, compaction, repair, cache, update-race, autotester, transport, and mixin tests and fixtures.