An issue arose when a user loads a page of notifications which include stories they don't have permission to view.

Nothing new has arisen for a while, so presuming this is resolved.

Seems like it works:

I think we can be slightly more general about this, and assume any token beginning with _ is substring search. This covers __FILE__, __construct, etc. Users almost certainly intend these to be substring searches.

Although I didn't look particularly hard, I can't immediately find any more evidence that this is occurring in production.

One remaining artifact here is this configuration option:

This promoted and has been in the Phacility cluster for a few days without issues.

This promoted without exploding.

Can Piledriver be implemented as an Arcanist toolset?

Long ago, we used to write a <package, commit> audit relationship with "AUDIT_NOT_REQUIRED", meaning "This commit affects the package, but package owners don't need to audit it.".

PhabricatorAuditStatusConstants appears to have a set of unused constants:

This is promoting to stable shortly and looks complete to me, thanks!

These contexts are covered:

I dug up another one of these in PHI1439, but there is a lot of text in that issue that I haven't re-read yet.

Evidence increasingly suggests that the root problem here was GET_LOCK() issue in T13627, not an error in an sshd subprocess context.

I deployed this to the hosts affected by PHI2009 yesterday, and it appears to have resolved the problem.

We might be able to detect that the --strategy-option theirs merge has done something suspicious by trying to merge C^ into the final state (or vice versa). If it merges cleanly, I think we can be fairly confident that the changes are actually independent. However, I'm not sure offhand what we could conclude if it doesn't merge cleanly.

A particular example is:

In the general case, the problem is that some invocations of arc, including arc land --pick A, may select an arbitrary range of commits to land which have some ancestors that we do NOT want to land.

git diff ...

Broadly, I believe these "certain changes" are approximately changes which include a merge commit.

This is actually very subtle.

In general, Phacility production hosts may interact with logs as several different users:

This ran into some filesystem permissions issues and needs followup.

When we are importing a commit, we often don't have any legitimate user to act as: the commit may come from an observed repository (so we never authenticated a pusher), and the "Author" and "Committer" strings are arbitrary and untrusted in Git and Mercurial.

All three of these are almost certainly diffusion.rawdiffquery, I think the first one just predated D21463 reaching production so it didn't show the method.

This deployed, and appears resolved.

I deployed this and nothing blew up, presuming this is resolved.

Presuming this is resolved until evidence to the contrary arises.

Calls to preg_* can still be swapped to phutil_preg_* to improve behavior, but this seems basically resolved.

Enable the SSH and HTTP application logs on the web, repo and admin tiers.

• This was originally implemented in D19357.
• This was broken by a refactoring change in D20775.
• I made problem observable in D21575 fixed it in D21576.

This is a brute force approach to support "context blocks" without taking any steps backwards (i.e., it supports older transactions and newer, modular transactions), but it feels like this is a lot of steps sideways and this change would be far better if it took a nuanced approach through T12921.

When users are @mentioned on an object, render their name in a disabled style if they've been muted.

See also T13068, which suggests rendering mentions in a special style when the user has muted the object.

This presumably worked. T12404 survives it, but that task captures everything remaining here.

• T12921 is adjacent to mail rendering.
• T13439 mentioned the hovercard summary text.

D21574 implements the hovercard and summary length changes.