mirror of
https://github.com/block/buzz.git
synced 2026-11-01 06:51:17 +00:00
2d107740e2
An inbound private managed-agent (PMA) tombstone could be resurrected locally. The deleted branch of reconcile_inbound_private_managed_agent persisted nothing when no local record existed, and the generation guards only run when a record IS present. So a delayed stale active head at the tombstone's generation (or lower) — a fresh-device hydration/live race, or a post-erase replay — found no record, skipped every guard, and hit the no-match insert path, reconstructing the deleted agent including its nsec. Fix: give every coordinate a DURABLE generation floor, keyed by the retained managed_agent_aggregates rows (the MAX generation across active AND deleted rows). The deleted branch now seeds a confirmed tombstone row even when no local record exists, and both branches gate on the floor before touching the store: an inbound head at <= the floor generation is dropped, while a genuine re-creation at a strictly higher generation still passes. - seed_confirmed_managed_agent_tombstone: idempotent (INSERT OR IGNORE) confirmed deleted-row seed; never downgrades a flush-authored row. - reconcile_inbound_private_managed_agent: open retention once for both branches, read the floor, reject stale heads, seed the tombstone floor before erasing the local record. Regression: the exact active-N / deleted-N+1 / replay-active-N interleaving stays floored (agent absent), a re-created N+2 clears the floor, plus the seed's idempotency and synced-deleted-head contract. Full desktop/src-tauri workspace: 2310 passed / 0 failed / 13 ignored; fmt and clippy -D warnings clean. Addresses PR #4940 review thread discussion_r3724146156. Co-authored-by: Mongo <5c25403eab7271f9f94ddd4f2b270e8cac2c92e2c830c51877cca6ec974ffb3f@buzz.block.builderlab.xyz> Signed-off-by: Wes <wesbillman@users.noreply.github.com>