review: stock-image gates, MinPartSize provenance, cleanup logging, drop ci-error.log

- The delete-finality and deferred-multipart gates run on the stock
  smelt-SDK images like every other itest: env gate and binary
  injection dropped. They need piri:main ≥ piri#30 and a hilt with
  hilt#36's blob.Abort grant; until those publish, the standard
  INGOT_ITEST_PIRI_IMAGE / (new) INGOT_ITEST_HILT_IMAGE overrides
  cover local runs. Validated end-to-end with branch-built piri+hilt
  images: both gates green, AbortRejects 0.12s.
- Pin smelt at the smelt#19 branch head — its generated stack proofs
  carry the /blob/release + /blob/reject node delegations the gates
  exercise; re-pin on merge.
- Complete's 5 MiB minimum-part floor now reads backend.MinPartSize:
  it is S3's protocol constant, not an operator knob.
- Log the previously discarded errors: the post-commit latch to
  'completed', and DeletePark / spool.Remove / DeleteIntent in
  cleanupPartBlobs.
- Restore the captured-store mask in abortOpenSession with the
  corrected rationale: s3:DeleteBucket delegates no blob commands, so
  DeleteBucket's implicit abort must run on the authority captured at
  UploadPart (blob.Abort rides the write set per hilt#36); fix the
  xfail and architecture-doc comments that misattributed the grant.
- Remove the stray ci-error.log.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: frrist

ci-error.log

@@ -840,9 +840,11 @@ paths below are exercised against the real stack by the smelt-based `itest/` har
   than `multipart_session_ttl` (default 7d) and reaps terminal session rows. A successful
   Complete retains its session in state `completed` so a duplicate Complete is idempotent
   per S3. `DeleteBucket` implicitly aborts the bucket's in-flight sessions before the space
-  delete (upstream's conformance teardown never aborts them); its `/blob/abort` leg is gated
-  on hilt granting `blob.Abort` for the bucket-delete operation. The network-side `/blob/abort`
-  unwind remains a parking-flow concern (above).
+  delete (upstream's conformance teardown never aborts them); because `s3:DeleteBucket`
+  delegates no blob commands, the abort runs on the space authority captured at `UploadPart`,
+  and its `/blob/abort` leg is gated on hilt delegating `blob.Abort` with the write set
+  (fil-forge/hilt#36). The network-side `/blob/abort` unwind remains a parking-flow
+  concern (above).
 
 ### Known correctness boundary
 

docs/architecture.md

@@ -10,7 +10,7 @@ require (
 	github.com/fil-forge/hilt v0.0.1-0.20260724134448-ba71f843f6a4
 	github.com/fil-forge/indexing-service v1.13.5-0.20260619142411-efe3f5fab717
 	github.com/fil-forge/libforge v0.0.0-20260727220215-5e299c46f62f
-	github.com/fil-forge/smelt v0.0.0-20260720130429-63116166a06c
+	github.com/fil-forge/smelt v0.0.0-20260728210138-0a0154e6e6d0
 	github.com/fil-forge/ucantone v0.0.0-20260727203046-ccb77059de44
 	github.com/fil-forge/versitygw v0.0.0-20260716095011-7a65883d595a
 	github.com/fxamacker/cbor/v2 v2.9.2

go.mod

@@ -252,8 +252,8 @@ github.com/fil-forge/indexing-service v1.13.5-0.20260619142411-efe3f5fab717 h1:W
 github.com/fil-forge/indexing-service v1.13.5-0.20260619142411-efe3f5fab717/go.mod h1:wFcakLohOqpMRkJzWRdGFGHRFpGB+PpEMCm9wkt2cqU=
 github.com/fil-forge/libforge v0.0.0-20260727220215-5e299c46f62f h1:QzgMg8GIE4IhgOE/7DBHFU/4T5oU7J4vAKxbUPKJPGA=
 github.com/fil-forge/libforge v0.0.0-20260727220215-5e299c46f62f/go.mod h1:0kXihIQ4L2uZ00nR5XrZ/Y8Db7Ht/qQNuiWslwMJ95M=
-github.com/fil-forge/smelt v0.0.0-20260720130429-63116166a06c h1:WHvsleEU6ZiNYDFgLx6KtorXulD+IuLiorMgmp4Th8s=
-github.com/fil-forge/smelt v0.0.0-20260720130429-63116166a06c/go.mod h1:NM/mk/XiP1Kzsy9HWGQeLsosPUvVY3bIrkUzqswThpU=
+github.com/fil-forge/smelt v0.0.0-20260728210138-0a0154e6e6d0 h1:QmwxgO2W6bL6B9Ce2E2nIvxc8EyIdS5hkrDvSlsTQE0=
+github.com/fil-forge/smelt v0.0.0-20260728210138-0a0154e6e6d0/go.mod h1:czwgD0nnuQ8h3GOHdwQ2Guw3C9R3zYP3K/mE+DEyh+Y=
 github.com/fil-forge/ucantone v0.0.0-20260727203046-ccb77059de44 h1:ofvb2Qq7++VPRelGsLbtnd1ZMKVT4n4QGoa79BhJ6VQ=
 github.com/fil-forge/ucantone v0.0.0-20260727203046-ccb77059de44/go.mod h1:oFY5BfD0bDeodGlbBHh3/nK99MAS93rGXjoQz7s5qgE=
 github.com/fil-forge/versitygw v0.0.0-20260716095011-7a65883d595a h1:lDwnNmF4LNbevx/YYNCC0CazMiL4eIe38MvfqbRR3RA=

go.sum

@@ -37,6 +37,16 @@ func ProofStore(ctx context.Context) (ucanlib.ProofStore, bool) {
 	return ps, ok
 }
 
+// WithoutProofStore returns a context whose request-scoped proof store is
+// masked. Hilt delegates Forge commands per S3 permission, and some
+// permissions (s3:DeleteBucket) carry no blob commands at all — a flow that
+// must invoke blob capabilities from such a request (DeleteBucket's implicit
+// abort of in-flight multipart uploads) hides the request store so the
+// uploader falls back to the space authority captured at UploadPart.
+func WithoutProofStore(ctx context.Context) context.Context {
+	return context.WithValue(ctx, proofStoreKey, nil)
+}
+
 type requestContextKey struct{}
 
 var requestKey any = requestContextKey{}

internal/reqscope/reqscope.go

@@ -4,7 +4,6 @@ package itest
 
 import (
 	"context"
-	"os"
 	"strings"
 	"testing"
 	"time"
@@ -20,38 +19,14 @@ import (
 // piri /blob/release (claim release; deferred physical deletion once the
 // PDP aggregate root retires on-chain).
 //
-// The published piri/sprue images predate the removal handlers, so this
-// test injects working-tree builds of both and skips when they aren't
-// provided:
-//
-//	(cd ../../piri  && CGO_ENABLED=0 GOOS=linux go build -o /tmp/piri  ./cmd)
-//	(cd ../../sprue && CGO_ENABLED=0 GOOS=linux go build -o /tmp/sprue ./cmd/main.go)
-//	ITEST_PIRI_BIN=/tmp/piri ITEST_SPRUE_BIN=/tmp/sprue \
-//	  go test -tags itest ./itest -run TestForgeDeleteReleasesNetworkBlob -v -timeout 900s
-//
-// Once images with the handlers publish, drop the env gate and the binary
-// injection.
+// Runs on the stock smelt-SDK images like every other itest. It needs
+// piri:main ≥ fil-forge/piri#30 (the /blob/release handler) and sprue:main ≥
+// fil-forge/sprue#33 (the forward); until piri#30 publishes, point
+// INGOT_ITEST_PIRI_IMAGE at a branch image (the forgeStack escape hatch).
 func TestForgeDeleteReleasesNetworkBlob(t *testing.T) {
-	piriBin := os.Getenv("ITEST_PIRI_BIN")
-	sprueBin := os.Getenv("ITEST_SPRUE_BIN")
-	if piriBin == "" || sprueBin == "" {
-		t.Skip("requires piri+sprue builds with the blob-removal chain: set ITEST_PIRI_BIN and ITEST_SPRUE_BIN (see test doc comment)")
-	}
-
 	ctx := t.Context()
 
-	// The Curio-based piri requires a Postgres node (harmonydb) and, until
-	// the published localdev image carries the mockrpc Ticket fix, an
-	// overridable blockchain image.
-	stackOpts := []stack.Option{
-		stack.WithPiriNodes(stack.PiriNodeConfig{Postgres: true}),
-		stack.WithServiceBinary("piri", piriBin),
-		stack.WithServiceBinary("upload", sprueBin),
-	}
-	if img := os.Getenv("ITEST_BLOCKCHAIN_IMAGE"); img != "" {
-		stackOpts = append(stackOpts, stack.WithBlockchainImage(img))
-	}
-	s, ingotEndpoint := forgeStack(t, stackOpts...)
+	s, ingotEndpoint := forgeStack(t)
 	accessKey, secretKey := hiltProvisionTenant(t, ctx, s, "delete")
 	cfg := forgeConfig(ingotEndpoint, accessKey, secretKey)
 

itest/forge_delete_test.go

@@ -5,7 +5,6 @@ package itest
 import (
 	"bytes"
 	"context"
-	"os"
 	"strings"
 	"testing"
 	"time"
@@ -23,35 +22,14 @@ import (
 // (parked — outside the PDP pipeline), Complete must conclude (accept) every
 // part, and Abort must unwind parked blobs with /blob/abort → /blob/reject.
 //
-// Requires piri + sprue builds with the blob-removal chain (/blob/remove →
-// /blob/release, /blob/abort → /blob/reject); the published images predate
-// them, so inject working-tree binaries and skip otherwise (same gate as
-// TestForgeDeleteReleasesNetworkBlob):
-//
-//	(cd ../../piri  && CGO_ENABLED=0 GOOS=linux go build -o /tmp/piri  ./cmd)
-//	(cd ../../sprue && CGO_ENABLED=0 GOOS=linux go build -o /tmp/sprue ./cmd/main.go)
-//	ITEST_PIRI_BIN=/tmp/piri ITEST_SPRUE_BIN=/tmp/sprue \
-//	  go test -tags itest ./itest -run TestForgeDeferredMultipart -v -timeout 1200s
+// Runs on the stock smelt-SDK images like every other itest. It needs
+// piri:main ≥ fil-forge/piri#30 (/blob/reject) and sprue:main ≥
+// fil-forge/sprue#33 (/blob/abort forwarding); until piri#30 publishes,
+// point INGOT_ITEST_PIRI_IMAGE at a branch image (the forgeStack escape
+// hatch).
 func TestForgeDeferredMultipart(t *testing.T) {
-	piriBin := os.Getenv("ITEST_PIRI_BIN")
-	sprueBin := os.Getenv("ITEST_SPRUE_BIN")
-	if piriBin == "" || sprueBin == "" {
-		t.Skip("requires piri+sprue builds with the /blob/abort chain: set ITEST_PIRI_BIN and ITEST_SPRUE_BIN (see test doc comment)")
-	}
-
 	ctx := t.Context()
-	// The Curio-based piri requires a Postgres node (harmonydb) and, until
-	// the published localdev image carries the mockrpc Ticket fix, an
-	// overridable blockchain image.
-	stackOpts := []stack.Option{
-		stack.WithPiriNodes(stack.PiriNodeConfig{Postgres: true}),
-		stack.WithServiceBinary("piri", piriBin),
-		stack.WithServiceBinary("upload", sprueBin),
-	}
-	if img := os.Getenv("ITEST_BLOCKCHAIN_IMAGE"); img != "" {
-		stackOpts = append(stackOpts, stack.WithBlockchainImage(img))
-	}
-	s, endpoint := forgeStack(t, stackOpts...)
+	s, endpoint := forgeStack(t)
 	accessKey, secretKey := hiltProvisionTenant(t, ctx, s, "mpdeferred")
 	cl := sdkClient(forgeS3Conf(endpoint, accessKey, secretKey))
 

itest/forge_multipart_deferred_test.go

@@ -124,6 +124,10 @@ func forgeStack(t *testing.T, extra ...stack.Option) (*stack.Stack, string) {
 		t.Logf("using piri image override: %s", img)
 		opts = append(opts, stack.WithPiriImage(img))
 	}
+	if img := os.Getenv("INGOT_ITEST_HILT_IMAGE"); img != "" {
+		t.Logf("using hilt image override: %s", img)
+		opts = append(opts, stack.WithHiltImage(img))
+	}
 	// Same idea one step earlier in the pipeline: mount a locally-built piri
 	// binary (linux, static) over the image's /usr/bin/piri — validates an
 	// unreleased piri/ucantone change with no image build at all.

itest/stack_test.go

@@ -160,10 +160,9 @@ var completeMultipartXFail = []forgeCase{
 	// The conditional matrix itself passes; the case then fails its bucket
 	// teardown: upstream's teardown never aborts in-flight uploads, so
 	// DeleteBucket implicitly aborts them (s3frontend/bucket.go), but the
-	// /blob/abort goes out proofless — hilt's per-operation proof grants
-	// carry blob.Abort for the S3 Abort operation only, not for
-	// DeleteBucket/UploadPart. Promote once hilt's s3perm map grants
-	// blob.Abort on bucket delete.
+	// /blob/abort goes out proofless — hilt's s3perm map delegates no
+	// blob.Abort today. fil-forge/hilt#36 adds it to the write set;
+	// promote once a hilt image with it publishes.
 	{name: "conditional_writes", fn: integration.CompleteMultipartUpload_conditional_writes},
 	{name: "invalid_checksum_part", fn: integration.CompleteMultipartUpload_invalid_checksum_part},
 	{name: "multiple_checksum_part", fn: integration.CompleteMultipartUpload_multiple_checksum_part},

itest/versity_multipart_test.go

@@ -24,15 +24,12 @@ import (
 
 	msbucket "github.com/fil-forge/ingot/bucket"
 	"github.com/fil-forge/ingot/bucketop"
+	"github.com/fil-forge/ingot/internal/reqscope"
 	"github.com/fil-forge/ingot/mst"
 	"github.com/fil-forge/ingot/registry"
 	"github.com/fil-forge/ingot/uploader"
 )
 
-// minPartSize is S3's minimum size for every part except the last one,
-// enforced at CompleteMultipartUpload (EntityTooSmall).
-const minPartSize = 5 << 20
-
 // defaultMaxListing is the S3 default and cap for max-parts / max-uploads.
 const defaultMaxListing = 1000
 
@@ -295,10 +292,12 @@ func (b *Backend) CompleteMultipartUpload(ctx context.Context, input *s3.Complet
 		requested = append(requested, sp)
 		etagHasher.Write(sp.ETagMD5)
 	}
-	// Every part but the last must meet S3's 5 MiB minimum.
+	// Every part but the last must meet S3's protocol-level 5 MiB minimum
+	// (backend.MinPartSize — an S3 constant clients and SDKs assume, not an
+	// operator knob).
 	var total int64
 	for i, sp := range requested {
-		if i < len(requested)-1 && sp.Size < minPartSize {
+		if i < len(requested)-1 && sp.Size < backend.MinPartSize {
 			return s3response.CompleteMultipartUploadResult{}, "", s3err.GetAPIError(s3err.ErrEntityTooSmall)
 		}
 		total += sp.Size
@@ -390,7 +389,10 @@ func (b *Backend) CompleteMultipartUpload(ctx context.Context, input *s3.Complet
 	// parts so a duplicate Complete is idempotent; the sweeper reaps it later.
 	// Best-effort: a failed latch leaves the row in 'completing', which the
 	// sweeper also treats as terminal after the TTL.
-	_, _ = b.multipart.LatchSession(ctx, uploadID, registry.SessionCompleting, registry.SessionCompleted)
+	if _, err := b.multipart.LatchSession(ctx, uploadID, registry.SessionCompleting, registry.SessionCompleted); err != nil {
+		b.logger.Warn("latch session to completed failed; sweeper reaps the completing row after the TTL",
+			zap.String("uploadID", uploadID), zap.Error(err))
+	}
 
 	etagQ := `"` + etag + `"`
 	return s3response.CompleteMultipartUploadResult{Bucket: &bucket, Key: &key, ETag: &etagQ}, "", nil
@@ -449,6 +451,13 @@ func (b *Backend) AbortMultipartUpload(ctx context.Context, input *s3.AbortMulti
 // drop the session, release its parts' now-unreferenced blobs. Used by
 // DeleteBucket's implicit abort of in-flight uploads.
 func (b *Backend) abortOpenSession(ctx context.Context, space did.DID, sess registry.MultipartSession) {
+	// s3:DeleteBucket delegates no blob commands (hilt's s3perm maps it to
+	// nil), so the surrounding request's proofs cannot authorize
+	// /blob/abort; mask them so the uploader falls back to the blob
+	// authority captured at UploadPart — the same resolution the
+	// session-expiry sweeper uses. blob.Abort rides the write set as of
+	// fil-forge/hilt#36.
+	ctx = reqscope.WithoutProofStore(ctx)
 	won, err := b.multipart.LatchSession(ctx, sess.UploadID, registry.SessionOpen, registry.SessionAborting)
 	if err != nil || !won {
 		return
@@ -522,11 +531,20 @@ func (b *Backend) cleanupPartBlobs(ctx context.Context, space did.DID, uploadID
 							zap.String("digest", hex.EncodeToString(d)), zap.Error(aerr))
 					}
 				}
-				_ = b.parks.DeletePark(ctx, d)
+				if derr := b.parks.DeletePark(ctx, d); derr != nil {
+					b.logger.Warn("delete park row failed",
+						zap.String("digest", hex.EncodeToString(d)), zap.Error(derr))
+				}
 			}
 		}
-		_ = b.spool.Remove(mh.Multihash(d))
-		_ = b.intents.DeleteIntent(ctx, d)
+		if rerr := b.spool.Remove(mh.Multihash(d)); rerr != nil {
+			b.logger.Warn("remove spooled blob failed",
+				zap.String("digest", hex.EncodeToString(d)), zap.Error(rerr))
+		}
+		if derr := b.intents.DeleteIntent(ctx, d); derr != nil {
+			b.logger.Warn("delete upload intent failed",
+				zap.String("digest", hex.EncodeToString(d)), zap.Error(derr))
+		}
 	}
 }