sandboxd: cross-node snapshot placement — operator-token lifecycle, gossip redirect, peer heal by doge-rgb · Pull Request #52 · cocoonstack/sandbox

sandboxd: let the node's root token drive the sandbox lifecycle

doge-rgb

committed

sandboxd: gossip checkpoint ownership so a branch can find its node

doge-rgb

committed

sandboxd: pull a checkpoint from a peer when no owner can serve the branch

doge-rgb

committed

simplify: drop the dead tar export and the tier-memory parser

CMGS

committed

review: comment budget, declaration layout and the lint/asl gates

CMGS

committed

simplify: drop a dead archive filter and three copy-forward duplications

CMGS

committed

review: propagate ctx into CheckpointIDs, dedup the owners scans

CMGS

committed

review: propagate ctx through UpdateSelf

CMGS

committed

review: carry the daemon ctx into mesh for callback logging

CMGS

committed

sandboxd: heal only after redirect cannot answer, gossip from memory

CMGS

committed

sdk: follow a checkpoint redirect instead of claiming nothing

CMGS

committed

sandboxd: one credential type instead of paired operator verbs

CMGS

committed

sandboxd: probe peers for a checkpoint instead of gossiping every id

CMGS

committed

sandboxd: bound the heal, gate the blob, and let a delete reach a replica

CMGS

committed

review: cut the comment budget back to the repo's own density

CMGS

committed

config: a healed replica needs a finite life, and a fleet-agreed one

CMGS

committed

sandboxd: make a delete and a heal of one id wait on each other

CMGS

committed

sdk: name the candidate's failure in the fallback test

CMGS

committed

sandboxd: pull outside the record lock, and let a delete veto the publish

CMGS

committed

mesh: a redirect spends the warmth it was promised

CMGS

committed

sandboxd: give the ownership probe a boundary

CMGS

committed

test: a delete must evict the probe cache, forwarded or not

CMGS

committed

docs: the checkpoint placement protocol, as it actually behaves

CMGS

committed

Revert "mesh: a redirect spends the warmth it was promised"

CMGS

committed

sandboxd: bound the single-owner probe and fence the cache against a delete

CMGS

committed

sandboxd: close the operator races, heal validation, and lock leak a third review found

CMGS

committed

sandboxd: reject a non-branchable or contentless healed record, and finish the docs

CMGS

committed

sandboxd: give the record transfer a completion marker

CMGS

committed

review: tighten comment budget and dedup the peer URL plumbing

CMGS

committed

docs: the three operator read/wake endpoints, and the probe fan-out as built

CMGS

committed

sdk: a redirect candidate's 401 is a rotation transient, not a verdict

CMGS

committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

sandboxd: cross-node snapshot placement — operator-token lifecycle, gossip redirect, peer heal - #52

sandboxd: cross-node snapshot placement — operator-token lifecycle, gossip redirect, peer heal#52
CMGS merged 31 commits into
mainfrom
feat/cross-node-snapshot-placement

Commits on Jul 26, 2026

sandboxd: let the node's root token drive the sandbox lifecycle

sandboxd: gossip checkpoint ownership so a branch can find its node

sandboxd: pull a checkpoint from a peer when no owner can serve the branch

simplify: drop the dead tar export and the tier-memory parser

review: comment budget, declaration layout and the lint/asl gates

simplify: drop a dead archive filter and three copy-forward duplications

review: propagate ctx into CheckpointIDs, dedup the owners scans

review: propagate ctx through UpdateSelf

review: carry the daemon ctx into mesh for callback logging

sandboxd: heal only after redirect cannot answer, gossip from memory

sdk: follow a checkpoint redirect instead of claiming nothing

sandboxd: one credential type instead of paired operator verbs

sandboxd: probe peers for a checkpoint instead of gossiping every id

sandboxd: bound the heal, gate the blob, and let a delete reach a replica

review: cut the comment budget back to the repo's own density

config: a healed replica needs a finite life, and a fleet-agreed one

sandboxd: make a delete and a heal of one id wait on each other

sdk: name the candidate's failure in the fallback test

sandboxd: pull outside the record lock, and let a delete veto the publish

mesh: a redirect spends the warmth it was promised

sandboxd: give the ownership probe a boundary

test: a delete must evict the probe cache, forwarded or not

docs: the checkpoint placement protocol, as it actually behaves

Revert "mesh: a redirect spends the warmth it was promised"

sandboxd: bound the single-owner probe and fence the cache against a delete

sandboxd: close the operator races, heal validation, and lock leak a third review found

sandboxd: reject a non-branchable or contentless healed record, and finish the docs

sandboxd: give the record transfer a completion marker

review: tighten comment budget and dedup the peer URL plumbing

docs: the three operator read/wake endpoints, and the probe fan-out as built

sdk: a redirect candidate's 401 is a rotation transient, not a verdict