[namedgraph]

Problem

A version is committed after the write that made it (VersioningFilter → commitAsync, queued per branch), and the write's response names no version. Right after a write the TimeGate therefore redirected to the version before it. A client that needs the version equal to the state it read, such as an approval that pins a version, had to poll the TimeMap and compare graphs. It also could not tell "not committed yet" from "commit failed" (failures are only logged).

Change

• GraphVersioningService counts each document's queued and running commits (isCommitPending) and remembers whether its last commit failed (isCommitFailed, cleared by a later success). The failure is recorded before the commit stops counting as pending.
• The TimeGate (?timegate) answers 503 with Retry-After: 1 (no-store) while a commit is pending, and 500 when the last one failed. Otherwise it redirects as before.
• Unchanged: writes and their responses, every other response, and dataspaces without a versioning repository (VersioningFilter schedules nothing for them, so ?timegate stays 404).
• ldh get --timemap/--timegate follow the document's Link (rel="timemap"/"timegate"), falling back to the query parameters. --timegate waits as a 503 with Retry-After asks, up to 30 tries; a 503 without Retry-After fails as before.
• Lean (formal/http/LdhHttp/Memento.lean): reconcileFails, Versioning.timeGate, and timeGate_current, which proves that a redirect without a datetime is always to the document's graph, never an older version.

Synchronous commits were considered and not taken: they would add a GitHub commit to every write and serialise bulk loads.

Tests

• GraphVersioningServiceTest: pending until the commit ends; failure kept until a later success; an unversioned application has no commit state. 591 unit tests pass.
• CLI CommandOutputTest: Link discovery for both roles; a 503 with Retry-After is asked again; a 503 without it fails. 120 tests pass.
• HTTP:
  • versioning/GET-timegate-after-write.sh: after a write, the TimeGate waits or redirects to the new commit, never the previous one.
  • versioning/GET-timegate-unversioned.sh: the unversioned admin dataspace still answers 404, with no Retry-After.
  • GET-timegate.sh and memento-conformance.sh wait out the brief window between GitHub recording a commit and the service ending it.
  • These run in CI against the versioning repository. They have not been run locally.
• lake build of formal/http passes.

🤖 Generated with Claude Code