[Xe]

Summary

• A failed pack upload stays fatal for its writer. A later ref update on that writer cannot publish objects that are missing from the bucket. The storer flushes every bin and cue upload before it publishes a ref, so a hook can clone the ref safely.
• A reader can find packs that another writer published after the reader's first listing. On a miss, the reader lists packs/*.cue again. Concurrent misses share one refresh, and a cooldown limits how often the reader lists the bucket.
• HTTP shallow discovery ends its response at the shallow-update flush. The response no longer has an extra NAK.

Refs #28. We do not know the cause of the production failure yet, so this PR does not close the issue.

Details

Pack refresh

• A failed refresh does not make a read fail. Loose storage already returned 404, so the read returns ErrObjectNotFound. go-git accepts only that error for an unknown have. Any other error stops the whole upload-pack. The storer logs each failed refresh once, at warn level. A canceled storer still returns the cancellation error.
• The cooldown starts at 1 s. A refresh that finds no new pack, or that fails, doubles the cooldown, up to 10 s. A refresh that finds a pack sets the cooldown back to 1 s. This prevents many unknown haves from making the reader list the bucket again and again.
• During a refresh, known objects stay readable. Local registrations and iterator snapshots stay the same. The refresh never loads a pack that this storer registered while the listing was in progress.
• When an upload fails, the storer removes that pack from its index. If the bucket has the pack after all, a later refresh loads it.

Upload-pack

• uploadpack.go contains a small fork of go-git's transport.UploadPack. When a stateless request contains a deepen and nothing follows it, the fork writes the shallow update and returns. All other requests use the upstream code path.

Receive-pack

• The waiting for packfiles to finish pushing log line is removed. The storer already makes the uploads finish before it publishes a ref. TestTigrisPushPublication holds the fake S3 uploads open and checks that order.

Tests and docs

• Gated S3 tests use the real AWS SDK, the Tigris storer, the daemon, and real Git HTTP and SSH clients. They cover upload failures, the order of uploads and hooks, fresh shallow clones, and later fetches.
• Storer tests cover the adaptive cooldown, packs registered during a refresh, reloading a deregistered pack, and cancellation.
• docs/architecture/{hooks,tigris-storer,transports}.md describe the new behavior. docs/usage/pack-publication-check.md contains the procedure to validate on a personal cluster.

Test plan

• go build ./...
• go vet on the changed packages
• go test ./.... The commit hook also ran it.
• The commit hooks formatted the changed files with goimports and Prettier
• Validation on a live bucket and a personal cluster. The operator can use the procedure in docs/usage/pack-publication-check.md.

The bucket consistency requirements do not change.

[Copilot]

🔵 Needs a closer look

Concurrent storage refresh and wire-protocol changes warrant human review, with live-bucket and cluster validation still pending.

0 open findings

What changed in this PR

Hardens ObjGit’s pack publication and reader recovery for issue #28 without claiming to resolve the unconfirmed production cause.

Changes:

• Keeps upload failures fatal and logs the publication barrier before hooks.
• Adds coalesced pack-index refreshes and corrects HTTP shallow-response framing.
• Expands regression coverage and documents operator validation.

File	Description
internal/​storage/​tigris/​visibility_test.go	Tests refresh recovery, concurrency, and cancellation.
internal/​storage/​tigris/​upload.go	Preserves the first upload failure.
internal/​storage/​tigris/​tigris.go	Supports configured S3 clients.
internal/​storage/​tigris/​publication_test.go	Tests upload ordering and failed publication.
internal/​storage/​tigris/​packindex.go	Adds coalesced refreshes with cooldowns.
internal/​storage/​tigris/​objects.go	Refreshes packs after object misses.
internal/​storage/​tigris/​livebucket_test.go	Verifies published objects through fresh readers.
internal/​storage/​tigris/​client_test.go	Adds upload gates to the storage fixture.
docs/​usage/​pack-publication-check.md	Provides cluster validation steps.
docs/​plans/​2026-10-15-issue-28-pack-visibility.md	Records investigation, implementation, and validation.
docs/​architecture/​transports.md	Explains HTTP shallow-response handling.
docs/​architecture/​tigris-storer.md	Documents upload failures and refresh behavior.
docs/​architecture/​hooks.md	Clarifies publication-before-hook ordering.
cmd/​objgitd/​uploadpack.go	Adds bounded HTTP shallow-round handling.
cmd/​objgitd/​uploadpack_test.go	Tests packet forwarding and response framing.
cmd/​objgitd/​ssh_test.go	Checks wait-log ordering before SSH hooks.
cmd/​objgitd/​s3_publication_test.go	Exercises publication and fetches through HTTP/SSH.
cmd/​objgitd/​receivepack.go	Logs before the publication barrier.
cmd/​objgitd/​publication_test.go	Tests publication barriers and callback behavior.
cmd/​objgitd/​http.go	Routes fetches through the HTTP adapter.
cmd/​objgitd/​http_test.go	Checks wait-log ordering before HTTP hooks.
cmd/​objgitd/​hooks_test.go	Adds a shared log-order assertion.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.