Validate the writable tag namespace with a concrete prototype #6
Labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
phg/fuse-mail-dir-by-tag#6
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Blocked by: #2, #3, #5
Part of #1
Question
Using the cheapest disposable artifact that can exercise Dovecot against a FUSE or faithful fake namespace, what observable design correctly supports folder discovery, multiple Message projections, shared Seen and Flagged state, Deleted plus expunge, source cur/new transitions, external Dovecot metadata, dot and slash hierarchy separators, and rejection of unsupported writes?
Claimed by Claude Code for this wayfinding session.
Verdict: viable, with two required architectural boundaries.
Prototype artifact: throwaway
prototype/wayfinder-6branch ata430dc1581ed7fcb4b653267bbef779f13f1bedb.Evidence: one NixOS VM-test matrix passed all four combinations:
././The matrix exercises Dovecot-driven discovery and reads, Unicode/canonical Tag encoding, multiple projection identities, global
new -> cur, shared Seen/Flagged/Answered/Draft/Deleted state, EXPUNGE, COPY and MOVE out, synchronous rejection of APPEND/COPY/MOVE in and content writes with unchanged pre/post state, external Source delivery/rename/delete reconciliation, Dovecot metadata outside FUSE, and UID/UIDVALIDITY stability across flag changes, FUSE remount, and Dovecot restart. Six Rust unit tests pass;cargo fmt --checkand Clippy with warnings denied pass.Required boundaries:
rename(old, new)into a successful same-inode no-op before FUSE receivesrename; Source flags then remain unchanged. Canonical misses force Dovecot to rescan and issue a real rename. Positive dentry caching must therefore be zero or explicitly invalidated around these transitions; stale aliases cannot naively share the canonical inode.kandx. FUSE receives indistinguishable Message unlinks for valid MOVE/EXPUNGE and mailbox deletion, so it cannot atomically reject mailbox deletion by itself. Dovecot 2.3 uses a global vfile ACL and 2.4 uses the namespace ACL; both retain message rights while denying mailbox create/rename/delete. Privileged localdoveadmpaths can explicitly ignore ACLs, so production must also exclude autocreation and equivalent administrative bypasses in this namespace.Production omissions remain intentional: SQLite/persistence, direct inotify and recovery, scale testing, service-module packaging, full RFC parsing, Source Dovecot uidlist locking, production open-file-handle tracking, and coordinator serialization of scan publication against mutations. These are implementation concerns, not counterevidence to the filesystem/Dovecot contract validated here.