Epoch advance currently logs a failed pin_add, continues to swap the CidTree root, and unpins the previous root. A failed recursive pin can therefore leave both the newly selected root and the previous active root unpinned and collectible.
Make the pin/swap/unpin transition safe: do not unpin the prior root or publish the new epoch unless the new root is durably pinned (or define and expose an explicit alternative recovery state).
Acceptance criteria:
- pin failure preserves the previous root and pin;
- success maintains the documented ordering;
- focused tests cover pin failure, pre-warm failure, and successful advancement.
Epoch advance currently logs a failed
pin_add, continues to swap the CidTree root, and unpins the previous root. A failed recursive pin can therefore leave both the newly selected root and the previous active root unpinned and collectible.Make the pin/swap/unpin transition safe: do not unpin the prior root or publish the new epoch unless the new root is durably pinned (or define and expose an explicit alternative recovery state).
Acceptance criteria: