When the commit code finds a matching checksum in the rep-cache the
revision/offset pair is assumed to be a valid representation of the checksum.
The commit code discards the incoming data based on this assumption. If the
revision/offset pair is not valid the repository will be corrupt.
This has not yet been identified as a cause of corruption, but it is simple
enough to trigger manually by deliberately corrupting the rep-cache.
The commit code should at least check that the revision/offset looks like the
start of a representation. It could also check that the representation really
does have the expected checksum.
Improvement
Major