moonsize 0.5.0 — protected outputs and data-segment reports

moonsize 0.5.0 publishes the output-protection and data-segment work since public 0.4.0. No new analysis feature was added by the release-preparation commit.

Changes and migration

• All report outputs use exclusive creation and refuse existing files/directories/link aliases. This changes the older HTML/graph overwrite behavior; failures return 1. Multiple outputs are preflighted but are not a filesystem transaction. No force flag.
• Data-entry encoding ledgers and exact-payload content-group baseline comparison, with duplicate counts and signed byte accounting. Expressions are recorded, not evaluated; groups do not assert identity or semantic equivalence.
• Opt-in HTML current-input data details: static first 20 rows, batches of 20, keyboard-accessible ranges, displayed-subset printing. HTML data comparison remains unsupported.
• Seven library functions and data metadata/comparison types are added. Options gains data_segments/data_json/diff_data; exhaustive WasmError matches must handle InvalidDataEncoding. Existing parser/analyze/render_html signatures and existing report formats retain their meaning. See 0.5 migration, data contract and output guarantees.

Verified release chain

1. Source: bdd223f, main; tag v0.5.0 targets this exact commit.
2. Exact-SHA Linux CI: all jobs passed: 354 native tests, 914 CLI cases across existing regression scripts, four source demos/rollback, small performance smoke, fresh-offline browser/A4 PDF and current-source budget pass/refusal (0/3). Counts describe this run; no timing threshold or test-growth promise.
3. A fresh repository-external export from this SHA produced the audited package: 122 files, 1,091,606 bytes. Native output_native.c / moon.pkg / exclusive-write code, data/HTML sources, pinned ECharts and third-party licenses are present. No build/cache directories, plans, AGENTS, review PDF/image attachments or repository screenshots. .moonignore unchanged. The package-list log was moved outside the export before final packaging to keep evidence out of the package.
4. Public Mooncakes: BigSaltyMan/moonsize@0.5.0. Install with moon add BigSaltyMan/moonsize@0.5.0 (library dependency, not a standalone CLI installer).
5. Actual registry ZIP, SHA-256 2a80b785d886f11000caf4d6282cfe79aea98032257a44819067a2279134303d. All 122 per-file lengths and SHA-256 hashes match the audited package. Container bytes also happen to match; content comparison is the acceptance condition. The registry index checksum matches the downloaded ZIP.
6. A fresh external consumer installed that exact registry version without local overrides, compiled with native --deny-warn and executed 11 checks: old parse/stat/build/path/diff/experiment/budget/Options coverage plus data ledger, zero self-diff and the new HTML entry point. Reproduce: node scripts/verify-release-consumer.mjs 0.5.0 consumer.json. The earlier local-path preflight was separate and is not public consumption evidence.
7. Another new directory extracted the actual registry ZIP and built its native CLI (including the C stub). Three tiny-fixture runs passed: HTML plus data JSON (0), existing HTML refusal without byte change (1), data self-comparison JSON (0). This checks publication completeness, not another full matrix.

Attached JSON contains the complete file-content hash list, exact CI, public consumer and registry CLI results. Local toolchain: moon 0.1.20260915 (2e1a46d 2026-09-15) ~.moon\bin\moon.exe; Node24.18.0, Windows10.0.26300 x64. No production Node or browser dependency was added.

Review materials and boundaries

Evidence index, project explanation, artifact hashes. Existing PDF/JSON evidence was copied byte-for-byte; historical attachments and hashes are preserved. Data PDF, 10 pages prints 40/45 rows; historical review covers pages5–10 manually and pages1–4 automatically. It is not a new release-time manual print acceptance. Original environment: Edge156.0.4314.36, Windows10.0.26300, Playwright1.58.2, Poppler26.07.0. Older 0.4.0 Release/tag and its two PDFs are unchanged.

Retained is fixed-model dominated encoding weight, not rebuilt savings. Reference paths are not execution traces; strict success does not prove full Wasm validation. Independent gzip sizes are non-additive local measurements, not transfer shares. Data file offsets are not memory addresses and file bytes are not runtime memory usage; no source ownership or deletion/deduplication gains are inferred. Native CLI embeds ECharts; library callers still choose resources (empty source retains CDN). 50k functions, peak memory, real large projects, other browser engines, OS file:// double-click and physical printers remain outside the recorded scope. Initial contest approval is not final acceptance. No contest submission or organizer contact is performed.