Partial retries: a byte count is not a valid cache prefix

A chunk describes exact logical positions, layers or head shards, representation, byte length, and appropriate integrity evidence. Receiving a packet does not mean its asynchronous device copy has completed or its contents match the expected manifest. Integrity checks also have explicit assumptions; a checksum is not a universal proof against malicious substitution. Record completion only at the defined validation boundary. A partial final block must not advertise uninitialized positions as valid just because its backing allocation has the same size as a full block.

For each required shard, track the largest contiguous verified prefix rather than the highest position seen or the total number of positions stored. Holes matter. The logical request frontier is bounded by the least-complete required shard under a compatible layout. Layer-wise pipelining may permit earlier work on ready layers, but that is a separately validated dependency schedule; it does not justify declaring the entire handoff complete. Keep sparse coverage metadata if the transfer can arrive out of order, and derive contiguous frontiers from it correctly.

An idempotent chunk operation should recognize repeated delivery of the same immutable content and return a compatible result without advancing positions twice or allocating an unbounded duplicate. A duplicate key with different content is a conflict to reject, not a successful retry. Retain deduplication state for the promised retry interval and failure scope; process-local memory does not provide crash-persistent idempotency by itself. If a status acknowledgment was lost, query validated coverage before choosing which pieces to resend, subject to the actual protocol’s guarantees.

Generation and handoff epochs prevent an old transfer from overwriting a new request attempt that reused the same physical block. Enforce the identity at the destination and coordinate registration, cancellation, and cleanup with in-flight device or network operations. Canceling a logical request does not synchronously stop every DMA reader or writer. Reusing its address too early can corrupt an unrelated request even if the stale message is later rejected by the scheduler. Version checks and memory-lifetime protection must meet at the actual write boundary.

Test a lost chunk, a lost acknowledgment, duplicate delivery, an out-of-order block, a conflicting duplicate, and a late completion after cancellation. Compare the receiver’s verified prefix and content with the sender’s manifest before allowing the appropriate decode operation. Retrying all bytes can be simpler but still needs the same identity, capacity, and lifetime rules. Report retransmitted wire volume separately from logical payload and validated cache coverage. A successful retry test under one failure does not establish arbitrary transport durability or seamless continuation after every process loss.

The modular lab offers a finite coverage analogy. Reset, explicitly set modulus eight and additive step three, predict the orbit period, then Play or Step. Compare a fresh Reset with modulus eight and step two explicitly set. The first visits all eight residues over its period, while the second visits only four. This deterministic enumeration contains no chunks, acknowledgments, holes, manifests, or device transfers. Use it to question incomplete enumeration, then validate actual contiguous coverage and content in the transfer fixture.