A create at a key the repository already holds is refused with 400 InvalidRequest ("Record already exists: <uri>"), as the reference PDS does, instead of replacing the record and announcing an update. This holds for createRecord and applyWrites#create. applyWrites checks every create before it writes, so a batch with one taken key, or two creates of the same key, writes nothing. mstAdd still replaces a key it already holds, so the tree can never hold a key twice.
Why
Clients claim a key by creating at it. knotless keys a repository's dev.knotless.repo record by its name and relies on the create failing when the name is taken. On 2026-10-28, creating a repository named knotless on chadtmiller.com replaced the existing one's record and orphaned every ref and pack; it was restored by hand from Jetstream.
npm run ci passes: biome, typecheck, and 3,236 tests across 212 files. New tests: createRecord at a held key is refused and keeps the record; applyWrites with one taken key among others writes nothing; two creates of one key in a batch are refused. The concurrent-writes test that pinned the overwrite now expects one create to win and the other three to be refused.
Shortcomings
applyWrites#update on an absent key still adds it. Space applyWrites#create (packages/spaces) was not checked here.
chadtmiller.com/pds.js
What changes
A create at a key the repository already holds is refused with 400
InvalidRequest("Record already exists: <uri>"), as the reference PDS does, instead of replacing the record and announcing an update. This holds forcreateRecordandapplyWrites#create.applyWriteschecks every create before it writes, so a batch with one taken key, or two creates of the same key, writes nothing.mstAddstill replaces a key it already holds, so the tree can never hold a key twice.Why
Clients claim a key by creating at it. knotless keys a repository's
dev.knotless.reporecord by its name and relies on the create failing when the name is taken. On 2026-10-28, creating a repository namedknotlesson chadtmiller.com replaced the existing one's record and orphaned every ref and pack; it was restored by hand from Jetstream.Fixes A create over an existing record overwrites it instead of failing
How it was checked
npm run cipasses: biome, typecheck, and 3,236 tests across 212 files. New tests:createRecordat a held key is refused and keeps the record;applyWriteswith one taken key among others writes nothing; two creates of one key in a batch are refused. The concurrent-writes test that pinned the overwrite now expects one create to win and the other three to be refused.Shortcomings
applyWrites#updateon an absent key still adds it. SpaceapplyWrites#create(packages/spaces) was not checked here.🤖 Generated with Claude Code