From bb3ecc8f309746c3cd2995d87144fcbf97d284be Mon Sep 17 00:00:00 2001
From: beardthelion <56458543+beardthelion@users.noreply.github.com>
Date: Fri, 17 Jul 2026 09:27:56 -0500
Subject: [PATCH] fix(node): tie the /ipfs walk ceiling to MAX_PIN_SOURCES + 1

A provenanced object has a bounded source set (first-pinner + up to
MAX_PIN_SOURCES additional). With the walk ceiling at 16 == MAX_PIN_SOURCES, an
authorizing public source sorting after 16 path-scoped denials was never reached:
the ceiling truncated the search and returned a false 503 for a readable object.
Raise the ceiling to MAX_PIN_SOURCES + 1 so the whole bounded provenance set is
always tried; the legacy scan stays bounded by MAX_LEGACY_PROBES_PER_REQUEST.
---
 crates/gitlawb-node/src/api/ipfs.rs | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/crates/gitlawb-node/src/api/ipfs.rs b/crates/gitlawb-node/src/api/ipfs.rs
index cb18d52a..9cb663b2 100644
--- a/crates/gitlawb-node/src/api/ipfs.rs
+++ b/crates/gitlawb-node/src/api/ipfs.rs
@@ -50,7 +50,15 @@ use crate::visibility::{visibility_check, Decision};
 /// serves on the first repo that grants them, so reaching it requires being
 /// denied by this many path-scoped repos first, which real traffic effectively
 /// never does. Tunable if that assumption stops holding.
-pub(crate) const MAX_HISTORY_WALKS_PER_REQUEST: u32 = 16;
+///
+/// Kept at `MAX_PIN_SOURCES + 1` so the ceiling can never truncate a request
+/// BEFORE its whole bounded provenance source set (first-pinner + up to
+/// `MAX_PIN_SOURCES` additional) has been tried: an authorizing public source that
+/// sorts after `MAX_PIN_SOURCES` path-scoped denials must still be reached and
+/// served, not falsely 503'd as a truncated search. The legacy scan's fan-out is
+/// separately bounded by `MAX_LEGACY_PROBES_PER_REQUEST`, so widening this by one
+/// does not loosen that path.
+pub(crate) const MAX_HISTORY_WALKS_PER_REQUEST: u32 = crate::db::MAX_PIN_SOURCES as u32 + 1;
 
 /// Hard per-request ceiling on how many legacy (NULL-provenance) repositories
 /// the CID resolver's scan fallback may PROBE (`acquire` + `git cat-file -t`).