fix(storage): stop comparing allocated blocks of unsynced encoded artifacts

[DecisionNerd]

Closes #1928

Cause

An encoded artifact is not synced when it is captured. ext4 delayed allocation changes st_blocks afterwards with no change to inode or content, and four places compared a fresh allocation measurement with one taken earlier:

Site	Kind	Change
CapturedEncodedArtifact::revalidate	identity check on an unsynced file	allocation compare removed; inode, named link, length and link authority remain
CapturedEncodedInventory::open (ledger vs fresh)	identity check	ledger presence admits the inode; allocation not compared
authenticate_encoded_artifact_identities (supersession sweep)	identity check	same
record_encoded_active_artifacts (retried encode)	accounting	an existing ledger entry keeps the allocation observed first

Content is still authenticated where it was: the commit boundary admits every installed object by exact length and XXH64, and the install checks the SHA-256 address. Nothing in this change weakens that.

Left alone, deliberately: ledger vs receipt comparisons in supersession, shape and progress (both sides are recorded values, not a fresh measurement), the gc.rs and private_storage_ownership.rs same-pass comparisons (not unsynced encoded artifacts), and restore_encoded_ledger, whose checkpoint digest covers recorded allocations (see below).

Tests (encoding_publication/tests/unsynced_allocation.rs)

• captured_encoded_source_survives_allocation_change_with_unchanged_content: fallocate(KEEP_SIZE) past EOF changes st_blocks of a captured artifact with length, content and inode unchanged; revalidation, a fresh capture, the install, the supersession sweep and a retried encode record all hold.
• captured_encoded_source_still_refuses_content_change_after_capture: with the allocation moved as well, an append is refused by revalidation and a same-length edit is refused by commit-boundary admission.

Mutation proof (each reverted afterwards):

• Old encoding_publication.rs restored: test 1 fails with captured encoded source identity or length changed (the issue's message).
• Old supersession.rs only: test 1 fails at the reclaim sweep.
• Old io_evidence.rs only: test 1 fails with encoded artifact identity allocation changed.
• Old ledger compare in open only: test 1 fails with captured encoded source allocation identity changed.
• Length check removed from revalidate: test 2 fails (append installed).
• XXH64 comparison in admit_checksum_file disabled: test 2 fails (same-length edit admitted).

Verification

• make check: exit 0.
• make test-rust ARGS="-p graphforge-storage": 1819 passed, 9 skipped.
• make test-rust ARGS="-p graphforge-api": 1664 of 1665 passed. algorithm_runs::tests::subprocess_kill_reopens_as_exactly_one_interrupted_event failed with "child did not publish the start generation" at 192 s while my S20 loops and a sync loop were running (host load 20 to 30); it passes alone in 8.7 s.
• S20 import-session builds (gf import-session begin, register nodes, register edges, validate, commit; 2^20 nodes, 2^24 edges, UUIDv7 Parquet inputs, release gf, separate target dirs, binaries differ by sha256), alternating base (03a39dd) and candidate: 12 plain pairs and 10 pairs with a concurrent sync -f loop forcing writeback. Candidate: 22 runs, 0 refusals. Base: 22 runs, 0 refusals.

Not reproduced on current main

The 5-in-6 failure was measured on 171120c, before #1910. I could not reproduce a refusal on 03a39dd with this driver, even with forced writeback. #1910 replaces the copy with a link, which shortens the capture-to-revalidate window, so the S20 count does not by itself discriminate this fix; the deterministic test does (it fails on main).

Open

restore_encoded_ledger (session reopen) still compares freshly measured allocations with the checkpoint's encoded-ledger digest, which records allocations. The same drift would refuse a reopen of a session whose encoded artifacts were not yet written back. I did not change it: the checkpoint evidence totals depend on those recorded values, so fixing it is a format and accounting decision. It did not fire in 44 S20 runs.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: CurateLabs/graphforge/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 02d8185e-83fb-4c54-b770-93fe161e587f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}