Compact loose objects into indexed packs without changing their identities
Loose chunks compact into bounded indexed packs without changing logical identities. SDK ObjectStore.compact() and pm vcs compact publish under the shared writer lease; readers, GC and authorized erasure support mixed loose and packed storage.
The seventh-review repair binds certified bytes to published bytes. Fixed and CDC descriptor writers use an explicit start offset, independent of the caller cursor. Preflight records bounded block checksums; publication verifies each private block before storing those same bytes. In-place changes refuse with the existing source_changed error. Buffer, object-arrival, export and worktree publication now own their input snapshots; arrival batches recheck every declared identity before payload storage.
Accountability now checks namespaces after the last reopens and rehashes and requires two agreeing complete passes. Eight changing attempts refuse with typed unverifiable / storage_attempts; interrupted cleanup remains pending. Native object/pack writers share the authoritative store lease held through receipt publication. Direct filesystem writers that ignore the lease are outside serialization; observed changes through the final namespace barrier refuse. No perpetual-absence claim covers an out-of-protocol writer acting after that barrier.
Seventh-review class audit, concurrency scope and all 28 new behavioral revert controls. Reverting the descriptor repair fails all nine advanced-offset/GC tests; restoring it passes all nine. Reverting the accountability repair fails both loose/pack first-pass reopen cases; moving only the final namespace barrier backwards fails both second-pass cases. Reverting convergence fails its two regressions. All 28 new controls fail behaviorally when removed and pass after restoration; syntax/import/setup/timeouts are excluded.
Erasure retains whole-content equivalence through garbage collection. A whole blob, manifest and fragment set that reconstructs it share durable identity. Version-three certificates retain whole identity, native members, transitive inputs and unknown ancestry before recoverable bytes are published. GC retains certificates and upgrades older records while their inputs remain available. Missing evidence refuses with uncatalogued_provenance before deletion. After S -> equivalent manifest M -> derived record D -> GC(M), erasing S removes D and its registered worktree output in loose and packed storage. Pack/repack/unpack preserve identity and certificates; imports cannot invent clone-private origins. Independent FileIds retain erasure_dedup_conflict.
The receipt certifies removal of pm-vcs-derived representations in owned storage. User-authored alternate encodings, external/caller-owned copies, other clones, backups and media recovery remain outside that guarantee. The bounded residue audit is diagnostic and cannot gate benign data. Complete native parsing, ownership checks, all physical loose/pack copies, deadlines and lease fences remain mandatory. POSIX directory fsync provides stronger power-loss assurance than Windows namespace acknowledgment.
All 59 unresolved cubic threads and every comment were fetched with complete pagination. The retained ledger records 45 fixes, ten findings grouped into follow-ups, two obsolete findings, one physical-accounting refutation and one clarified iterator ownership contract. The previous 86 restored behavioral controls remain retained; this round adds 28. No review thread was replied to or resolved. The accepted equivalence and cubic P1 regressions remain in the final regression selection.
| Focused evidence | Result |
|---|---|
| Node 26 erasure storage/accountability/fragment/legacy repairs | 271/271, plus the later final-reopen cells in the final regression selection |
| Node 26 fixed/CDC/staging/review corpus | 187/187 |
| Node 26 and Node 22 final regression selection | 46/46 on each runtime |
| Native Bun provenance and reopen/convergence | 75/75 and 6/6 |
| Pack/GC and paged-manifest cases | 70/70 and 41/41; the diagnostic fragment-memory failure is corrected and passes in the final 187-case corpus |
| Packed power loss/recovery | 3/3; 6,247 boundaries / 538 distinct images / two convergent replays |
| Object/remote/history compatibility and composition edges | 94/94, 14/14 and 4/4 |
| PM-linked final denial/deadline/cleanup selection | 6/6 |
| Worktree race correction | 20/20 affected pruning cases; all sentinel/index/view assertions retained |
| Five touched production modules | 100% statements, branches, functions and lines; c8 all/per-file 100% gate passes |
| Static/artifact checks | Typecheck, lint, builds, zero duplicates, docstrings and privacy pass; 340 packed files / zero findings |
Full npm/Bun release matrices remain CI work under the seventh-review instruction. Native Bun lacks Node MockTracker fault support; that diagnostic invocation is excluded, and the fault corpus passes on Node 22 and 26. No installer timeout was retried. A fresh independent review remains orchestrator work; CodeRabbit's file-limit refusal is missing review evidence.
pako 3.0.2 is the first runtime dependency, for bounded synchronous verified streams and deterministic descriptor closure. Existing fixture and CI repairs preserve settled annotation teardown and owned per-gate scratch cleanup. #151: aee95e4. #154: b412ea5 and a06d928. #158: native erasure/recovery/provenance through this head. All issues remain open.
All tracker writes precede changelog generation/check, staged-source archive generation, commit and committed-HEAD self-host acceptance. The previously integrated main 82f8d63, including d2c4768 and f4d4cf6, remains an ancestor. A new main release 49cf8c3 appeared during this round; GitHub now reports merge conflicts and suppresses PR-triggered Actions. The requested single push is retained. CI was dispatched directly on this pushed branch head; no current-head CodeQL run has started. The earlier archive conflict was resolved by regeneration. Tracker history extends main byte for byte. Original uncovered-branch mappings and provenance/equivalence audit remain retained.
This round touches and releases only pm-vcs-phase6packs, retaining all existing follow-ups.
Pushed head: 56b241ac0255cb8ea506100a7e04cf3df2a780d8.
CI: in_progress (workflow_dispatch), windows-acceptance-launcher (26): in_progress, windows-acceptance-launcher (22): in_progress, test (26): in_progress, test (22): in_progress
Current-head CodeQL: not started because of the new main conflict. PR checks.