fix: recover portable checkouts from stale index locks and missing source databases - #128
Merged
Conversation
…urce databases The ordinary read/refresh path treated a checkout with a stale .git/index.lock as dirty forever, silently blocking refreshes (observed 9 days on a maintainer Mac); it now removes verified-stale locks (aged, unheld per lsof) and retries, and the fast-forward pull uses the same stale-lock retry. A missing portable source database previously surfaced as a permanent stat error; for repair-eligible checkouts it now routes through the standard reset-pull/reclone repair with the healthy-mirror fallback preserved.
…ecoverable Review follow-up: the repair/reclone chain for a missing source database now degrades to the healthy runtime mirror on any failure - including a reclone that completes without restoring the database - instead of only covering the initial repair error.
Review follow-up: an unrecoverable missing source previously re-ran reset/pull plus a full reclone (accumulating checkout backups) on every runtime open. Recovery attempts now honor a 15-minute backoff keyed on the recorded repair timestamp; a restored source bypasses the gate because the stat succeeds before it is consulted.
|
ClawSweeper status: review started. I am starting a fresh review of this pull request: fix: recover portable checkouts from stale index locks and missing source databases This is item 1/1 in the current shard. Shard 0/1. This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking. Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted. |
osolmaz
pushed a commit
to osolmaz/gitcrawl
that referenced
this pull request
Jul 29, 2026
…urce databases (openclaw#128) The ordinary read/refresh path treated a checkout with a stale .git/index.lock as dirty forever, silently blocking refreshes (observed 9 days on a maintainer Mac); it now removes verified-stale locks (aged, unheld per lsof) and retries, and the fast-forward pull uses the same stale-lock retry. A missing portable source database previously surfaced as a permanent stat error; for repair-eligible checkouts it now routes through the standard reset-pull/reclone repair with the healthy-mirror fallback preserved. Review follow-up: the repair/reclone chain for a missing source database now degrades to the healthy runtime mirror on any failure - including a reclone that completes without restoring the database - instead of only covering the initial repair error. Review follow-up: an unrecoverable missing source previously re-ran reset/pull plus a full reclone (accumulating checkout backups) on every runtime open. Recovery attempts now honor a 15-minute backoff keyed on the recorded repair timestamp; a restored source bypasses the gate because the stat succeeds before it is consulted.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Incident
A maintainer Mac portable-store checkout was silently broken for nine days: a crashed Git process left a zero-byte stale
.git/index.lock, and the tracked source database had been locally deleted. The ordinary refresh path reported the checkout dirty forever, while the missing database surfaced as a permanent stat error that never reached repair.Fix
The refresh path now removes only verified-stale locks using the existing conservative helper: the lock must be aged and unheld according to
lsof. Fast-forward pulls also run through the stale-lock retry helper.A missing source database on a repair-eligible checkout now routes through the standard reset-pull/reclone repair chain, with the healthy-mirror fallback preserved.
Recovery failures degrade to a healthy runtime mirror, including when a reclone completes without restoring the database; a dedicated regression test covers this case.
Recovery attempts back off for 15 minutes, so an unrecoverable source serves the healthy mirror quietly instead of re-cloning on every read. A regression test verifies that repeated reads do not create additional checkout backups.
Whether reset/pull failures should escalate to reclone is deferred to a tracked follow-up covering both the long-standing corruption path and the new missing-source path symmetrically.
Proof
GOWORK=off go test ./...passes.