scripts/media-apply.py is the only door that moves library bytes. read_plan read its rows through an if/elif chain with no else: any row whose verb was not mkdir, keep or move was dropped in silence.
That is not hypothetical — it happened on 2026-11-02. A hand-written plan to rename two /mnt/entropy/TVShows series folders used the verb rename. The run printed
applied: 0 moved, 0 already done in an earlier run, 0 folders created, 0 files stayed put
and exited 0. No journal was written, nothing refused, and the only clue was that the folders had not moved — discovered by accident, not by the tool. Every other plan bug in this executor (occupied target, vanished source, cross-device move, plan built for another library) refuses before the first rename. An unread row was the one that did not, and a silent no-op is the worst failure a relayout tool can have on an 87 TiB array: it looks like success.
Change
read_plan collects unread verbs with their line number and refuses the whole plan:
line 2: unknown action 'rename' — this tool knows mkdir, keep and move (a rename is a move)
Tests
Two tests in the existing refusal group in tests/media_relayout.bats:
a bad verb mixed into an otherwise valid plan stops the run, and the rows the tool does understand do not run either (all-or-nothing holds);
a plan whose every row is a bad verb refuses instead of reporting success.
Both were written red first; the second failed exactly the way the incident did — exit 0.
./tests/run.sh → 789 tests, ALL TESTS PASSED.
Docs
The law joins the executor's existing refusal bullet in serverAppConfigs-docs/Dankserver/Media Relayout.md. No new page.
## Why
`scripts/media-apply.py` is the only door that moves library bytes. `read_plan` read its rows through an `if/elif` chain with **no `else`**: any row whose verb was not `mkdir`, `keep` or `move` was dropped in silence.
That is not hypothetical — it happened on 2026-11-02. A hand-written plan to rename two `/mnt/entropy/TVShows` series folders used the verb `rename`. The run printed
```
applied: 0 moved, 0 already done in an earlier run, 0 folders created, 0 files stayed put
```
and exited **0**. No journal was written, nothing refused, and the only clue was that the folders had not moved — discovered by accident, not by the tool. Every other plan bug in this executor (occupied target, vanished source, cross-device move, plan built for another library) refuses *before the first rename*. An unread row was the one that did not, and a silent no-op is the worst failure a relayout tool can have on an 87 TiB array: it looks like success.
## Change
`read_plan` collects unread verbs with their line number and refuses the whole plan:
```
line 2: unknown action 'rename' — this tool knows mkdir, keep and move (a rename is a move)
```
## Tests
Two tests in the existing refusal group in `tests/media_relayout.bats`:
- a bad verb mixed into an otherwise valid plan stops the run, **and the rows the tool does understand do not run either** (all-or-nothing holds);
- a plan whose every row is a bad verb refuses instead of reporting success.
Both were written red first; the second failed exactly the way the incident did — `exit 0`.
`./tests/run.sh` → 789 tests, `ALL TESTS PASSED`.
## Docs
The law joins the executor's existing refusal bullet in `serverAppConfigs-docs/Dankserver/Media Relayout.md`. No new page.
---
cwd: /home/blank/.omp/wt/wt-20261030-163847-6d1fc1f · session: 01a18f2e-18b1-7573-bcd5-ac99636f8bcb
read_plan's if/elif chain had no else, so any row that was not mkdir, keep
or move was dropped in silence. A plan of nothing but typos therefore
applied as a successful no-op: on 2026-11-02 a pass meant to rename two
TVShows series folders reported "applied: 0 moved" and exit 0, and the
journal was never written — nothing told the operator the plan had never
been read. An unread row is a plan bug, and every other plan bug in this
tool refuses before the first rename, so now this one does too, naming the
line and the verb.
cwd: /home/blank/.omp/wt/wt-20261030-163847-6d1fc1f · session: 01a18f2e-18b1-7573-bcd5-ac99636f8bcb
dank
merged commit f80148c5db into main2026-11-02 14:07:55 -08:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why
scripts/media-apply.pyis the only door that moves library bytes.read_planread its rows through anif/elifchain with noelse: any row whose verb was notmkdir,keepormovewas dropped in silence.That is not hypothetical — it happened on 2026-11-02. A hand-written plan to rename two
/mnt/entropy/TVShowsseries folders used the verbrename. The run printedand exited 0. No journal was written, nothing refused, and the only clue was that the folders had not moved — discovered by accident, not by the tool. Every other plan bug in this executor (occupied target, vanished source, cross-device move, plan built for another library) refuses before the first rename. An unread row was the one that did not, and a silent no-op is the worst failure a relayout tool can have on an 87 TiB array: it looks like success.
Change
read_plancollects unread verbs with their line number and refuses the whole plan:Tests
Two tests in the existing refusal group in
tests/media_relayout.bats:Both were written red first; the second failed exactly the way the incident did —
exit 0../tests/run.sh→ 789 tests,ALL TESTS PASSED.Docs
The law joins the executor's existing refusal bullet in
serverAppConfigs-docs/Dankserver/Media Relayout.md. No new page.cwd: /home/blank/.omp/wt/wt-20261030-163847-6d1fc1f · session: 01a18f2e-18b1-7573-bcd5-ac99636f8bcb