alkblobs/tasks/review001-hygiene.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
review001-hygiene	review-001 D-5 hygiene — from_parts validation, the tautological test	completed	mem-default-on	narrow	low	isolated	implementation	wave-8 review-001 hygiene

Description

Review-001 D-5's surviving small items (the finding's third item — hex to dev-dependencies — was retracted 2026-10-15 before this task ran; see the resolution note below):

• Digest::from_parts performs its documented validation (src/hashing.rs:255-259): a debug_assert on bytes.len() == algorithm.digest_len() — the doc claims validation the fn does not perform, and this is the one-way door's front porch; the debug check closes the cheap slice of it. (Full construction validation stays the typed paths' job; this is the debug-integrity check the doc already promises.)
• error.rs's tautological test replaced (src/error.rs:128-132): None.map(|_| Error::Missing) is None by the semantics of Option — it tests nothing. Replaced with a real assertion of the behavior its name claims (whatever row it was asserting gets read at task time and asserted honestly, or deleted if it duplicates another row's assertion).
• Not in scope: the crate-root //! docs — deliberately deferred to wave 12 (release readiness owns crate docs; the review's D-5 note rides there).

Resolution note (2026-10-15): the original task carried a third item — move hex to [dev-dependencies] per review-001 D-5's "test-only unconditional dep" claim. The implementing session blocked on it with evidence, and the claim is false: hex is a runtime dependency — the key encoding's from_git_oid_hex decodes with it (src/hashing.rs:248, wave 1), the local engine's sharded flat-file names encode/decode with it (src/local.rs:154, 208, 715, wave 2), the pg engines' key hexes use it (postgres/cas.rs:602, pg_lo/windows.rs:710), and the ops token/wire surfaces use it (ops/tokens.rs:49, 57; ops/put.rs:375, 476, 480; ops/fetch.rs:462). cargo tree -i hex -e normal shows the runtime edge; tests/ uses no hex:: directly at all. The move would not compile; the item dissolves — hex stays unconditional in [dependencies]. The retraction is recorded on review-001 D-5 and the plan's wave-8 D-5 bullet. (The depends_on: [mem-default-on] edge remains for the wave's ordering; the Cargo.toml-overlap rationale it originally carried dissolved with this retraction.)

Acceptance Criteria

• from_parts carries the debug_assert and its doc now tells the truth
• the tautological test replaced or honestly deleted
• hex untouched in [dependencies] (the retraction's consequence — no dependency-graph change lands from this task)
• gates green: cargo test, cargo test --all-features server-less, clippy across variants, fmt, doc

References

• docs/reviews/001-storage-surface-general-review.md (D-5, including the 2026-10-15 correction)
• docs/plans/implementation.md (§Wave 8 — the D-5 bullet with the retraction note)
• src/hashing.rs:255-259, src/error.rs:128-132
• tasks/mem-default-on.md (the wave-ordering dependency)
• tasks/review-wave-8.md (the gate whose D-5 check reads this task)

Summary

Completed 2026-10-15. Digest::from_parts (src/hashing.rs) now carries the debug-integrity check the doc promised — a debug_assert on bytes.len() == algorithm.digest_len() — and its doc tells the truth: the typed paths (derivations, from_git_oid_hex, Key's boundary parsing) do the full validation; this constructor's own slice is the debug-only length agreement check, release builds trusting the typed paths. error.rs's tautological test (missing_is_exclusive_to_err_shaped_ops — None.map(|_| Error::Missing) is None by Option's semantics) was honestly deleted: the behavior its name claims (get/stat never carry Missing; both-tier misses are Ok(None)) is pinned by real read-path assertions at src/store/tests.rs:200-202 and tests/conformance/rows.rs:1079 (across every conformance column), so the in-module marker duplicated rows that actually build a store. The Error::Missing variant doc keeps ADR-012 §6.5 ruling 5's reference and now names the post-split pinning homes (src/store/read.rs + the read-path/conformance tests — the stale src/store.rs split references fixed in passing). hex untouched per the retraction note above; Cargo.toml not edited by this task. Gates: cargo test 185 passed / 0 failed (default: mem + sqlite); cargo test --all-features server-less 399 passed / 0 failed; the same shape re-run against the live pglo-poc harness (ALKBLOBS_PG_*, postgres:16-alpine on :15432) 399 passed / 0 failed — the pg columns ran for real; both clippy variants clean under -D warnings; cargo fmt --check clean; cargo doc --no-deps zero warnings.