REL-WSF-004 — Fail closed when historical diff content is unavailable
| Field | Value |
|---|---|
| Status | Open; source-verified against live data shape |
| Severity | High |
| Components | sparqd/workspace-file-management-backend, object storage, sparqd/oqullus |
| Associated issues | Not opened |
Concrete observed case
In w-t5e2kcxjd, the sampled history records contain no object-storage version
identifier. Restore rejects one of these records because its historical content
cannot be resolved. View Changes does not apply that check: the unresolved
version becomes an unversioned storage read, which returns the current object.
If both selected records lack version identifiers, the backend compares current
content with current content and can return a successful, usually empty diff.
The dialog opening successfully therefore does not prove that either selected historical version was retrieved.
Expected condition
Diff fails closed when either selected historical version is unavailable. The UI states which version cannot be retrieved and does not render a historical comparison. A successful response identifies the two immutable versions that were actually read.
Why it matters
A false successful diff can make users believe an old version is recoverable or that two saves contained no changes. They may then continue editing or delete an external backup based on incorrect recovery information.
Existing controls and workarounds
Restore exposes the missing-version failure, but View Changes does not. Until the paths are consistent, treat an empty diff as inconclusive and keep an external copy of important content.
Alternatives considered
- Recommended: require a retrievable version identifier for both diff inputs and return an explicit historical-content-unavailable result otherwise.
- Compare a historical version with current content only when the user explicitly selects Current, and label that side as current rather than as a history entry.
- Hide View Changes for unavailable records; acceptable as an interim control, but less informative than explaining why the version cannot be compared.
Silently substituting current content for a selected history record is rejected.
Component involvement
- The workspace file backend validates both resolved versions before reading content and reports unavailable history explicitly.
- Object storage returns only the requested immutable version for a historical read; an unversioned read remains a separate current-content operation.
- Oqullus disables or relabels unavailable comparisons and distinguishes a historical version from current content.
Reproduction and verification
Follow WSF-S005. Capture the selected history identifiers, whether each maps to a storage version, and the identifiers returned for both downloaded objects. Do not rely only on whether the diff dialog opens.
Resolution conditions
Close when automated backend and UI tests prove that a missing version fails closed, two available history versions compare their exact stored bytes, and an explicit historical-versus-current comparison is labeled accurately.
Validation and blockers
The asymmetric validation and unversioned-read fallback are source-confirmed; the deployed aggregate establishes that the missing-version condition applies to the assessed workspace. A controlled browser/network capture of the false successful diff remains pending.