prisma-risk / tsoracle / 26435733703

95%

push

github

fix(openraft-toolkit): clamp recovered write version to readable range (#478)

recover_active_write_version trusted the raw leading byte from the snapshot store and the log CF and only floored the result at BASELINE_WRITE_VERSION, so a durable byte greater than MAX_READABLE_VERSION (for example a record written by a newer release before a binary downgrade, or any local corruption that flips the leading byte upward) silently seeded the ActiveWriteVersion cell to a value the decode side cannot handle. Subsequent appends were then stamped at that unreadable version and the next read or snapshot build failed, leaving the node persistently unavailable.

Return Result<u8, CodecError> and reject any present input byte above MAX_READABLE_VERSION with CodecError::VersionUnsupported { min, max, actual } before the floor-at-baseline max chain runs. The single production caller in tsoracle-standalone maps the new error into StandaloneError::Bootstrap, matching the boxing of the surrounding snapshot_store.load and highest_log_record_version errors so a bad on-disk byte fails the node start at the same boundary instead of poisoning later writes. Floor semantics for bytes at or below MAX_READABLE_VERSION (including bytes below baseline) are preserved.

Verified with cargo test --workspace --all-features --no-fail-fast (130 binaries, 0 failures, including the e2e-max-readable-next variant where MAX_READABLE_VERSION = BASELINE + 1 = 5 so a Some(5) input is legitimately accepted) and cargo clippy --all-features --all-targets -- -D warnings.

51 of 53 new or added lines in 2 files covered. (96.23%)

13019 of 13638 relevant lines covered (95.46%)

436108.54 hits per line