The on-disk format tag and the key labels say sapedb

Status

Done

Version

1.0.0

Component

server — pager, dbkey, naming

Commits

580bfa5, baaa754, 6cb845a

Opened

ISS-6, ISS-14

Description

Two things spelled the product's former name, and both of them decide whether a file opens at all: the eight-byte tag at the head of every database file, and the labels every encryption key is derived under. Both now spell sapedb.

• internal/pager/pager.go:61 — var Magic = [8]byte{'S','A','P','E','D','B', 0, 1}, read back at pager.go:569 and at led.go for an encrypted file.
• Three HKDF labels: sapedb/server:database:v1 (internal/dbkey/dbkey.go:34), sapedb/pager:page:v1 and sapedb/pager:key-check:v1 (internal/pager/crypt.go:70-71). Two of the three live in crypt.go; the database key's label lives in dbkey, which exists so that label has one source rather than a copy per caller.

internal/naming is the patrol that keeps the old name from coming back. Its Exceptions table held four rows — the format tag and the three labels. It is now the empty slice, and that empty state is what this ticket was written to reach.

Why it was in 1.0.0

Changing either one makes every database written by an earlier build unreadable, with no migration. An unencrypted file and an encrypted one fail the same way, at the same place, before any key is tried. That is a change you make before there is a first tag or never.

The argument for keeping the old spelling was that it breaks every database that already exists. That argument was spent the moment somebody checked it against the repository: there are no tags, so no released build has ever written such a file, so there is no such database.

How it was verified

1. internal/naming.Walk reads every regular file under the tree, not a sample, and reports every line carrying the old name case-insensitively. Exceptions is empty, so every hit it finds is unexcused.
2. allowedIn was split out from Allowed for one reason: against an empty live table the tests that measure what the table excuses would all pass without executing a single comparison. They run against fixtureTable instead, so widening Allowed still fails them.
3. Measured at 88178cc: the old name survives in exactly three non-test constants, each assembled from single-character literals, each deliberate — naming.target and two oldFileExt guards. See ISS-14; that issue is the measurement, not a leftover.
4. The CHANGELOG's Breaking entry names both surfaces and prints the refusal a stale file gets: sapedb/pager: not a sapedb file.

What it did not do

• No migration, and no compatibility read of the old tag. A file with the old tag is refused, not converted.
• Format was not bumped. It is still const Format uint16 = 1 at pager.go:63 — a field of its own, not the trailing 0, 1 of the Magic array. Confusing the two is what ISS-15 is about.
• The refusal a wrong Format takes has never been run. grep ErrFormat across all 76 _test.go files returns 0. That is ISS-4, and it is the one issue this ticket opened that is fixed in 1.0.0.
• The encryption test that guards the other half of this work — that documents do not reach the disk in the open — is flaky: ISS-6.