changes() dropped every per-resource status that was neither 2xx nor
404/410, so a per-object ACL answering 403 read as "unchanged" and the
row kept whatever it held until the next full reconciliation noticed the
ETag differed. The same reasoning error as fetch's, and the same fix
shape now exists next door: it is carried as a change with no validator,
which forces the multiget, and the multiget already grades a refusal.
An SRV target is not required to live inside the domain it was queried
for, and this ladder is walked over plain UDP DNS with no DNSSEC — then
walked again after a 401 with the authenticated client. Since the
credential is scoped to the typed address's registrable domain, an
out-of-domain target could only ever answer 401 anyway. Refusing it
leaves the well-known ladder on the typed domain, which is where a
correctly delegated install answers.
CalDavHttp, three of them. Accept-Encoding: identity takes OkHttp's
transparent gunzip out of the loop, so a proxy that gzips regardless
handed raw deflate to the iCalendar parser and a good resource was
quarantined as unreadable; the header the response carries is now
honoured. Prefer was set rather than appended, so a caller's own
preference was silently dropped on every write. And there was no
call-level ceiling: readTimeout is per-read, so a server trickling a
byte every 119 seconds held a sequential sync for the whole WorkManager
window and every later collection was skipped. Three minutes is well
above a full multiget batch on a slow link and well below the window —
c2166b9's note said the opposite, and the revocation still sets its own
budget because it needs seconds, not minutes.
The KDoc claimed the handler caches which scheme worked "so the
challenge is paid once", while authenticated() builds a fresh handler per
call. It says what it actually does now.
makiolaj
210e394163