sandboxd: cross-node snapshot placement — operator-token lifecycle, gossip redirect, peer heal - #52

Merged

CMGS merged 31 commits into

mainfrom

feat/cross-node-snapshot-placement

Jul 26, 2026

Commits on Jul 26, 2026

sandboxd: let the node's root token drive the sandbox lifecycle
doge-rgb
committed
485e055
sandboxd: gossip checkpoint ownership so a branch can find its node
doge-rgb
committed
d9ff169
sandboxd: pull a checkpoint from a peer when no owner can serve the branch
doge-rgb
committed
6f7f22c
simplify: drop the dead tar export and the tier-memory parser
CMGS
committed
1904cf9
review: comment budget, declaration layout and the lint/asl gates
CMGS
committed
838220c
simplify: drop a dead archive filter and three copy-forward duplications
CMGS
committed
a2a5a56
review: propagate ctx into CheckpointIDs, dedup the owners scans
CMGS
committed
2383e9d
review: propagate ctx through UpdateSelf
CMGS
committed
48d9aaf
review: carry the daemon ctx into mesh for callback logging
CMGS
committed
0feb179
sandboxd: heal only after redirect cannot answer, gossip from memory
CMGS
committed
c72dae8
sdk: follow a checkpoint redirect instead of claiming nothing
CMGS
committed
6850744
sandboxd: one credential type instead of paired operator verbs
CMGS
committed
eeaed37
sandboxd: probe peers for a checkpoint instead of gossiping every id
CMGS
committed
b961e3b
sandboxd: bound the heal, gate the blob, and let a delete reach a replica
CMGS
committed
19f6a86
review: cut the comment budget back to the repo's own density
CMGS
committed
14a4f88
config: a healed replica needs a finite life, and a fleet-agreed one
CMGS
committed
c483590
sandboxd: make a delete and a heal of one id wait on each other
CMGS
committed
a19d72e
sdk: name the candidate's failure in the fallback test
CMGS
committed
b3a7ec9
sandboxd: pull outside the record lock, and let a delete veto the publish
CMGS
committed
1f9bc40
mesh: a redirect spends the warmth it was promised
CMGS
committed
60ee474
sandboxd: give the ownership probe a boundary
CMGS
committed
c020050
test: a delete must evict the probe cache, forwarded or not
CMGS
committed
1e78e1f
docs: the checkpoint placement protocol, as it actually behaves
CMGS
committed
e61268e
Revert "mesh: a redirect spends the warmth it was promised"
CMGS
committed
cf3efbf
sandboxd: bound the single-owner probe and fence the cache against a delete
CMGS
committed
489bacf
sandboxd: close the operator races, heal validation, and lock leak a third review found
CMGS
committed
177d5dd
sandboxd: reject a non-branchable or contentless healed record, and finish the docs
CMGS
committed
1dfc1e8
sandboxd: give the record transfer a completion marker
CMGS
committed
a25df7d
review: tighten comment budget and dedup the peer URL plumbing
CMGS
committed
171cd0f
docs: the three operator read/wake endpoints, and the probe fan-out as built
CMGS
committed
66268da
sdk: a redirect candidate's 401 is a rotation transient, not a verdict
CMGS
committed
7f2b97a

Navigation Menu

Uh oh!

sandboxd: cross-node snapshot placement — operator-token lifecycle, gossip redirect, peer heal - #52

sandboxd: cross-node snapshot placement — operator-token lifecycle, gossip redirect, peer heal#52
CMGS merged 31 commits into
mainfrom
feat/cross-node-snapshot-placement

Commits on Jul 26, 2026

sandboxd: let the node's root token drive the sandbox lifecycle

sandboxd: gossip checkpoint ownership so a branch can find its node

sandboxd: pull a checkpoint from a peer when no owner can serve the branch

simplify: drop the dead tar export and the tier-memory parser

review: comment budget, declaration layout and the lint/asl gates

simplify: drop a dead archive filter and three copy-forward duplications

review: propagate ctx into CheckpointIDs, dedup the owners scans

review: propagate ctx through UpdateSelf

review: carry the daemon ctx into mesh for callback logging

sandboxd: heal only after redirect cannot answer, gossip from memory

sdk: follow a checkpoint redirect instead of claiming nothing

sandboxd: one credential type instead of paired operator verbs

sandboxd: probe peers for a checkpoint instead of gossiping every id

sandboxd: bound the heal, gate the blob, and let a delete reach a replica

review: cut the comment budget back to the repo's own density

config: a healed replica needs a finite life, and a fleet-agreed one

sandboxd: make a delete and a heal of one id wait on each other

sdk: name the candidate's failure in the fallback test

sandboxd: pull outside the record lock, and let a delete veto the publish

mesh: a redirect spends the warmth it was promised

sandboxd: give the ownership probe a boundary

test: a delete must evict the probe cache, forwarded or not

docs: the checkpoint placement protocol, as it actually behaves

Revert "mesh: a redirect spends the warmth it was promised"

sandboxd: bound the single-owner probe and fence the cache against a delete

sandboxd: close the operator races, heal validation, and lock leak a third review found

sandboxd: reject a non-branchable or contentless healed record, and finish the docs

sandboxd: give the record transfer a completion marker

review: tighten comment budget and dedup the peer URL plumbing

docs: the three operator read/wake endpoints, and the probe fan-out as built

sdk: a redirect candidate's 401 is a rotation transient, not a verdict