Found on the box, minutes after the live store was folded for the first time: the second fold
answered -EINVAL. `build_merged` parsed the packed layout — `space | key | len | value`, repeated —
so it could read a store that had never been folded and nothing else. The first fold reads packed
and writes addressed; every fold after that reads addressed, which is what a store does for the rest
of its life. As written, a store could be folded exactly once and then never again — the log would
grow until it filled.
No gate folded twice, which is why it got this far: verify-kernel-checkpoint.sh, verify-frontend.sh
and verify-enum-cost.sh each folded a packed store once. The guest's bench folds twice now, and
verify-enum-cost.sh insists on the second one — "a store can be folded once and then never again,
which is not a layout" — so the case is covered rather than remembered.
The v3 branch reads through the shared format's own arithmetic: the space table gives each space's
index range, the index gives each key and the value's place, and the log is applied over the result
exactly as before. The packed path is untouched.
Verified: verify-enum-cost.sh (which now folds twice and still measures 1.0x for a 40x store) and
verify-kernel-checkpoint.sh (the image a fold writes holds exactly what userspace holds).
Two build systems cannot share a crate: the kernel's Rust build compiles what is in its own module
tree, and a cargo crate is not that. So they share a *file* — `drivers/cube/cube_format.rs`, which
the driver declares with `mod` and `crates/cube-format` includes by path. There is no copy to drift
from, which is the only arrangement that cannot go stale. What happened when v3 landed and userspace
did not is the argument: an hour of `unsupported-version`, one gate red, and two implementations of
one format each believing itself.
The file holds what both sides must agree about, and nothing else — pure functions over slices, no
allocation, no I/O, no logging:
* the constants every reader and writer derives its arithmetic from,
* the header, in all three versions, with refusal rather than guessing: a reader that invents an
extent can read somebody else's bytes,
* the v3 space table and index, and the three equalities a reader computes its addresses from,
* the packed record and the log entry, the two framings a fold and a walk have to parse alike,
* CRC-32, FNV-1a, and the digest line both sides print.
The driver's copies of the constants are now aliases of the shared ones, and the two functions that
*validate* a header — `parse_header` and the v3 geometry — delegate to it, because validation is
where a second description gets believed. The readers stay where they are: this driver streams from
a file with its own buffers while userspace already holds the whole image, and that difference is
real rather than duplicated.
Nothing changed in behaviour, which is the point: verify-enum.sh, verify-enum-cost.sh,
verify-frontend.sh, verify-kernel-checkpoint.sh and verify-kernel-append.sh all pass, and the shared
crate's own tests include a kernel-written image — ten records, three spaces, 110 value bytes — read
through its arithmetic.
surface-camera-build