#6730 (LWS access grants and requests) is parked at c06f57b. The earlier grant-durability highs are closed on that head: Codex found no recurrence (#6730 (comment)). Two new findings remain:
- [high] A stored record that can't be read back stops every later startup (
lws/access.rs:1121). An access request (or grant) whose document nests close to serde_json's depth limit is accepted. Wrapping it in {"document", "author"} adds one more level, so the stored record no longer parses, and load_with aborts startup (a grant just drops out of authorization). Fix: check that the serialized wrapper parses back before storing it, as encode_meta already does for metadata. Refuse with 400 otherwise. Add a regression test that posts a deeply nested document and restarts.
- [medium] A withdrawn request comes back at startup (
lws/access.rs:496). When a withdrawal's removal intent is recorded but the record is neither marked unsettled nor removed, the next start hides it. load_with skips hidden grants but not hidden requests, so the request is loaded, stays readable and keeps using quota after the background removal lands. Fix: skip hidden records of both kinds, and add a regression test.
Both fixes are small. #6731 and #6650 stay held behind #6730.
Generated by Claude Code
#6730 (LWS access grants and requests) is parked at c06f57b. The earlier grant-durability highs are closed on that head: Codex found no recurrence (#6730 (comment)). Two new findings remain:
lws/access.rs:1121). An access request (or grant) whose document nests close to serde_json's depth limit is accepted. Wrapping it in{"document", "author"}adds one more level, so the stored record no longer parses, andload_withaborts startup (a grant just drops out of authorization). Fix: check that the serialized wrapper parses back before storing it, asencode_metaalready does for metadata. Refuse with400otherwise. Add a regression test that posts a deeply nested document and restarts.lws/access.rs:496). When a withdrawal's removal intent is recorded but the record is neither marked unsettled nor removed, the next start hides it.load_withskips hidden grants but not hidden requests, so the request is loaded, stays readable and keeps using quota after the background removal lands. Fix: skip hidden records of both kinds, and add a regression test.Both fixes are small. #6731 and #6650 stay held behind #6730.
Generated by Claude Code