moonsize 0.5.1 — repair Mooncakes documentation builds

moonsize 0.5.1 fixes the Mooncakes documentation failure affecting public 0.4.0 and 0.5.0. The old compression dependency still shipped moon.mod.json, which the current documentation builder rejects. Pinned-toolchain CI had not detected this separate registry build failure.

Repair

• Remove the obsolete bikallem/compress → blit/async registry dependency chain. Ship only the pinned synchronous gzip/flate/checksum/blit runtime: 34 files, with original/adapted hashes, source URLs and Apache-2.0 license. Import paths, native symbol namespaces and equivalent deprecated syntax are adapted. Compressor algorithm/defaults remain unchanged.
• Five inputs (empty, small, repeated, deterministic noise, unchanged fib.wasm) produce byte-identical complete gzip streams versus public 0.5.0. Root generated public API is identical; no report schema or feature change. Historical measured examples are not rewritten.
• Existing pinned CI remains. An additional current-stable-toolchain job checks native code, compression regressions and actual moon doc. CI also verifies vendored file integrity. A manual trigger was added after no push run was listed; the successful run below targets the exact final SHA.

Verified delivery

• Full source 2b0db5a, main. Implementation commit 7ec0e4b, followed only by the manual CI trigger addition. Tag v0.5.1 points to the final verified SHA.
• Exact target Linux CI: all three jobs passed: 354 native tests, 914 CLI cases, four source demos, current-source budget 0/3, existing offline/PDF checks; current-toolchain 18 compression tests and documentation generation also passed. No full local CLI/browser/PDF matrix was repeated.
• Isolated current Windows toolchain: moon0.1.20261020 / moonc0.10.16+b1a0e846e; original0.10.13 toolchain unchanged. 31 non-blocking implicit trait-method deprecations remain on the newer compiler; warning-free current-toolchain compatibility is not claimed.
• Repository-external clean export from that exact SHA: audited 161 files, 1149347 bytes. Native output helper, vendored C stubs and package configs, chart resources and licenses are included. No build/cache directories, plans, AGENTS, screenshots/PDF evidence or generated API files.
• Actual registry ZIP SHA-256 e18e242d89e80d0989d79f5f94e336e0e7e9845b36171e4be614a288a643620e. Every file length and content SHA matches the audited source package. Public version: BigSaltyMan/moonsize@0.5.1; install with moon add BigSaltyMan/moonsize@0.5.1.
• Two separate repository-external exact-version consumers passed, one per toolchain: 11 public API checks each, no local dependency override. The public ZIP was separately extracted and built as a native CLI; HTML/data JSON generation (0), existing-output refusal preserving bytes (1), and data self-diff (0) passed.
• Mooncakes online documentation: success, verified from the actual version page and Build log. The log records native check, moondoc, example Wasm build and completion. This is separate from upload acceptance. The raw build log and verification JSON are attached.

Compatibility notes, 0.5 API migration. Older releases/tags/packages are preserved; users of 0.4.0/0.5.0 should upgrade to 0.5.1 rather than expect their immutable dependency archives to change. Historical browser/PDF/performance evidence keeps its prior identity. Retained/path/gzip/data-segment model boundaries remain unchanged.

moonsize 0.5.0 — protected outputs and data-segment reports

moonsize 0.5.0 publishes the output-protection and data-segment work since public 0.4.0. No new analysis feature was added by the release-preparation commit.

Changes and migration

• All report outputs use exclusive creation and refuse existing files/directories/link aliases. This changes the older HTML/graph overwrite behavior; failures return 1. Multiple outputs are preflighted but are not a filesystem transaction. No force flag.
• Data-entry encoding ledgers and exact-payload content-group baseline comparison, with duplicate counts and signed byte accounting. Expressions are recorded, not evaluated; groups do not assert identity or semantic equivalence.
• Opt-in HTML current-input data details: static first 20 rows, batches of 20, keyboard-accessible ranges, displayed-subset printing. HTML data comparison remains unsupported.
• Seven library functions and data metadata/comparison types are added. Options gains data_segments/data_json/diff_data; exhaustive WasmError matches must handle InvalidDataEncoding. Existing parser/analyze/render_html signatures and existing report formats retain their meaning. See 0.5 migration, data contract and output guarantees.

Verified release chain

1. Source: bdd223f, main; tag v0.5.0 targets this exact commit.
2. Exact-SHA Linux CI: all jobs passed: 354 native tests, 914 CLI cases across existing regression scripts, four source demos/rollback, small performance smoke, fresh-offline browser/A4 PDF and current-source budget pass/refusal (0/3). Counts describe this run; no timing threshold or test-growth promise.
3. A fresh repository-external export from this SHA produced the audited package: 122 files, 1,091,606 bytes. Native output_native.c / moon.pkg / exclusive-write code, data/HTML sources, pinned ECharts and third-party licenses are present. No build/cache directories, plans, AGENTS, review PDF/image attachments or repository screenshots. .moonignore unchanged. The package-list log was moved outside the export before final packaging to keep evidence out of the package.
4. Public Mooncakes: BigSaltyMan/moonsize@0.5.0. Install with moon add BigSaltyMan/moonsize@0.5.0 (library dependency, not a standalone CLI installer).
5. Actual registry ZIP, SHA-256 2a80b785d886f11000caf4d6282cfe79aea98032257a44819067a2279134303d. All 122 per-file lengths and SHA-256 hashes match the audited package. Container bytes also happen to match; content comparison is the acceptance condition. The registry index checksum matches the downloaded ZIP.
6. A fresh external consumer installed that exact registry version without local overrides, compiled with native --deny-warn and executed 11 checks: old parse/stat/build/path/diff/experiment/budget/Options coverage plus data ledger, zero self-diff and the new HTML entry point. Reproduce: node scripts/verify-release-consumer.mjs 0.5.0 consumer.json. The earlier local-path preflight was separate and is not public consumption evidence.
7. Another new directory extracted the actual registry ZIP and built its native CLI (including the C stub). Three tiny-fixture runs passed: HTML plus data JSON (0), existing HTML refusal without byte change (1), data self-comparison JSON (0). This checks publication completeness, not another full matrix.

Attached JSON contains the complete file-content hash list, exact CI, public consumer and registry CLI results. Local toolchain: moon 0.1.20260915 (2e1a46d 2026-09-15) ~.moon\bin\moon.exe; Node24.18.0, Windows10.0.26300 x64. No production Node or browser dependency was added.

Review materials and boundaries

Evidence index, project explanation, artifact hashes. Existing PDF/JSON evidence was copied byte-for-byte; historical attachments and hashes are preserved. Data PDF, 10 pages prints 40/45 rows; historical review covers pages5–10 manually and pages1–4 automatically. It is not a new release-time manual print acceptance. Original environment: Edge156.0.4314.36, Windows10.0.26300, Playwright1.58.2, Poppler26.07.0. Older 0.4.0 Release/tag and its two PDFs are unchanged.

Retained is fixed-model dominated encoding weight, not rebuilt savings. Reference paths are not execution traces; strict success does not prove full Wasm validation. Independent gzip sizes are non-additive local measurements, not transfer shares. Data file offsets are not memory addresses and file bytes are not runtime memory usage; no source ownership or deletion/deduplication gains are inferred. Native CLI embeds ECharts; library callers still choose resources (empty source retains CDN). 50k functions, peak memory, real large projects, other browser engines, OS file:// double-click and physical printers remain outside the recorded scope. Initial contest approval is not final acceptance. No contest submission or organizer contact is performed.

moonsize 0.4.0 — review evidence and verified public package

moonsize 0.4.0 closes the review-evidence and public-package gap. It includes the current parsing/graph diagnostics, independent gzip semantics, function/package diff, experiments, path explanations, multi-metric budgets and self-contained native HTML delivery. This pre-1.0 minor release includes breaking library signatures; see the migration guide.

• Exact source: 5f1452aad48012ed40f1b3673ee3e1ddf24197cd, main. Primary materials commit 63ce102, followed by a byte-preservation fix found in the clean export. No forced push/amend.
• Target Linux CI: all jobs successful, on this exact SHA: 336 native tests, 730 CLI scenarios, four source demos, real fresh-offline browser/A4 PDF regression and current-source budgets (pass 0, refusal 3).
• Public library: BigSaltyMan/moonsize@0.4.0. Install with moon add BigSaltyMan/moonsize@0.4.0. This does not install a standalone CLI; build the source with moon build --target native --release.
• Clean external source exported from the exact SHA passed check/test/build/fmt, identical API and pinned-resource generation checks. Audited package: 104 files, 1,030,262 bytes. Registry and downloaded public ZIP exactly match SHA-256 ec537f92634421fb60ff7375143a054f67f40bb40c8e2b62ac140607be13a60a. Caches, local plans, review attachments/proposal and unrelated images are excluded; implementation, generated ECharts and all associated licenses are included.
• A second new external consumer installed the exact public version without a local override and compiled/executed parse/stat/build, real return_call path evidence, diff, experiment, Options, and budget pass/exceeded 0/3. Reproduce with node scripts/verify-release-consumer.mjs 0.4.0 consumer-result.json. Raw result is attached.

Reviewer entry points

• One-page project description, response to the original concern, public evidence index, API migration.
• Human-reviewed example PDF, 5 pages, long-name/diagnostic PDF, 4 pages, all nine page reviews and original environment. These are byte-identical copies of the recorded historical Windows PDFs, not newly claimed clean-CI human review. CI generates its own automatically checked PDFs.
• Pinned resource/version/Apache+d3 licenses. ECharts 5.6.0 SHA-256 bf4a223524e40b77c304bec67e1222cf551f14880cf42c69dc046558e11c07b1; .gitattributes prevents Windows checkout/archive newline conversion. Native CLI is 2,893,824 B on Windows (prior inline-resource change +2,088,960 B); Wasm budget scope is unchanged.

Boundaries

Retained is dominated encoded function weight in a fixed graph/root model, not exact rebuilt savings or a general bound. Model-unreachable functions are investigation candidates. Paths are reference-model evidence, not execution traces. Independent gzip measures local compressibility, is non-additive and is not network attribution. Whole gzip is one representation under this compressor configuration, not HTTP/TLS or deployment cost. Source demos deliberately change optional output; base checks/rollback do not prove full behavior equivalence. Strict success does not prove exact savings or full Wasm validation.

Offline acceptance used copied HTML fulfilled only as an HTTP main document in a new context that was offline from creation, with zero external requests. A4 print, charts and state restoration passed. file:// OS double-click, non-Chromium and physical printers remain unverified. Library render_html's empty optional ECharts source retains CDN behavior; the native CLI embeds the pin. No new performance/scale promise or contest approval guarantee is made.

Attached JSON records supply source → exact CI → audited public ZIP → public consumer provenance; repository snapshots/PDFs remain directly readable even when CI artifacts expire. Toolchain: moon 0.1.20260915 / moonc v0.10.13+cbb11c36f; Node24.18.0 for local orchestration.