[trissim]

P264: concrete recovery records and chunked tail commits

Head: 787a99bfb20e2c0b87edafb5eb7cab989126f972, including #1996. This PR is stacked on integrate/clean-batch-10.

Owner repair

• CheckpointSeal.recover, FinalSeal.recover and PendingSeal.recover always return a prefix record. The nullable result and caller's None branch are deleted.
• PrefixWitness owns the proved cursor and rebinds its physical revision before tail continuation. require_source still checks root, size, tail and sequence. Shared reads escalate before a repair; the write lock owns all publication.
• CheckedPrefix.commit_tail owns the shared SQL/pending/final publication path used by ordinary appends, physical rebinding and recovery. Seals own the recovery end and chunk boundary. Existing WireLog/WireScan decode only the requested range and continue its prior sequence.
• Deleted both full-prefix recovery scans and the 128 MB cold bound. Tail memory is bounded by chunk commits, not an arbitrary total bus size. Copied-index content revision checks remain.
• Desktop PR P724: resume bus indexing from its last sealed prefix #1976 (core-read-locks-2), head 1c7cd83, supplied the cold-bound deletion and chunked commit_tail ideas. Credit is in commit 787a99b. This is the single continuing repair; no competing desktop implementation was started.

Real grown-copy proof

The copied prefix and all appended bytes came from the actual live bus. No fabricated records, model input, extra agent, or uncertain input replay. A production WireScan profile counted only the real appended rows:

real_bus_bytes 162960802
saved_prefix_bytes 158113141
new_tail_bytes 4847661
actual_tail_rows 465 wire_records_decoded 465
commits [(158113141, 158113141, 0), (158113141, 162960802, 465)]
prefix_rescan False digest_matches_actual_live_bus True
grown_copy_rc=0; second checked open passed

The new digest exactly matches the live source's complete saved digest. p264-grown-copy.py and p264-grown-copy.log are under the sole owned scratch directory /home/ts/.cache/agent-scratch/pi-cn-load/. Its p264-real-bus/ is a disposable copied-root diagnosis, not an active agent or installation. Combined checkout/scratch remains below 3 GB.

Checks and remaining result

Source ratchet on this pushed head: rc=0; positive deltas {}; introduced {}. It ran alone in background under timeout 300 and faulthandler, using the shared QA interpreter and the exact existing pinned audit source. Tools ratchet: rc=0; positive deltas {}; introduced {}. The two checks ran serially. No suppression, cast, sentinel, new environment, clone or altered baseline.

The combined target was handed to claude-code for the actual installer rehearsal and live deployment. No full rehearse rc=0 or installation is claimed by this PR until that result arrives. Unit tests on a fake bus are not being substituted for that proof.

Assumed: the latest instruction to remove the cold bound supersedes the original keep-cap instruction; the private bus is append-only under its existing write lock; actual copied history is data, not permission to replay input; installer/build restrictions remain in force for this worker.

Agent-Comms-Order: 1d7ec808c13c

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.