Changelog: 31-finding fix wave, 500 MiB Cheap LFS parts, append-guarded uploads (ed016ad292)

[DingDingChae]

Pushed e27976c337..ed016ad292 to main — the full ten-group fix wave for the adversarially-verified sweep, plus the #56 fix. CI on the pushed commit is running; no remote success is claimed here.

Performance

• Cheap LFS hashing collapsed to one authoritative pass (Refs Cheap LFS perf tranche 2: stream-hash uploads (cloud hash) + deferred findings / 上傳邊行邊hash #35). The pin path hashed the same file up to six times and materialize re-read the verified payload roughly seven more; identity proofs (device/inode/size/ns timestamps) now carry revalidation and a single streamed content hash remains the authoritative proof, with a full re-hash fallback and fail-closed behavior preserved. Materialize claims a verified sibling temp by rename on the same device instead of copying.
• Per-file Git spawns batched. Commit-prep required-pointer proofs went from ~7 serial spawns per pointer to bounded cat-file --batch-check/--batch and chunked ls-files/ls-tree passes with :(literal) pathspecs; filesNotTrackedByLFS now uses one check-attr --stdin -z. Per-file failure semantics are unchanged.
• Pointer scans no longer hash before their size guards, and the OCI migration preflight no longer re-hashes what the inventory just hashed.
• Lists virtualized and memoized: Large Files, GitHub Packages (packages and versions), releases, notification centre, version history, plus O(n^2) row rendering and unbounded diff splitting removed from version history, and the Actions view no longer rebuilds sorted indexes every render.
• 500 MiB release parts (Refs Cheap LFS perf tranche 2: stream-hash uploads (cloud hash) + deferred findings / 上傳邊行邊hash #35). Parts were 1.5 GiB, so one failed part re-transferred gigabytes and slow links frequently broke mid-part. Only newly written pointers change; existing pointers with parts up to the 2 GiB legacy cap keep materializing unchanged.

Fixed

• Spurious mid-batch upload failures (Refs Cheap LFS batch upload: spurious 'reviewed release/asset changed' errors mid-batch / 批量上傳無故話release變咗 #56). uploadAsset revalidated the whole release fingerprint — including every sibling asset's label, updatedAt and downloadCount — so a batch's own annotator, the auto-installed compression Action, or a stranger downloading an unrelated asset aborted pending uploads with "The reviewed release, asset, repository, or account changed." Uploads are now guarded as appends: release identity and every reviewed asset must be unchanged, and a name collision with a different digest still fails closed, while added siblings and changed sibling metadata are tolerated. Every other mutation keeps the strict guard verbatim. The annotator also splices each provider response back into its cached snapshot — previously only the first asset per release ever received its commit= provenance — and now runs serialized per repository.
• Cheap LFS network paths canonicalize the remote first, closing the three bypasses (first-publish anchor push, workflow-commit push, publication-state probe) left open by the earlier hardening.
• GitHub Packages transfer/version state machine: canceling an upload or download no longer wedges the UI permanently, and switching packages mid-load no longer strands loadingVersions and block all later loads.
• UI clipping: the conflict banner no longer pushes its action out of view, Actions job-log lines scroll instead of being cut off, and a long filtered-empty-state message no longer paints over the Clear filters button.
• Memory leak: document-level cut/copy listeners are removed when a diff unmounts.

Added

• Tracked-content search wired to the shared filter stack with full regex-builder access, and the registry audit hardened so an unregistered search input can no longer evade it.

Verification on the merged tree

Root npx tsc --noEmit exit 0; prettier clean; app/test/unit/cheap-lfs 450/450 across 34 files. Each branch was independently green before merge (notably 497/0 across 38 files for the hashing work, and 83/0 across 14 app-store source-regex suites for the append guard). A broader app/test/unit/git + releases-store run was still executing at push time and is reported separately.

Not yet fixed

#55 (commit re-downloads payloads) and #59 (git add -A hashing multi-GB payloads into .git/objects) remain open with confirmed root causes. Resumable parts, three-at-a-time uploads, and auto-retry are next — they build directly on the append guard shipped here.

---

呢轉係大掃除嘅主菜:三十一條經過對抗式覆核嘅蟲一次過修完。最抵讚係Cheap LFS唔再重複hash同一個檔六七次,git spawn又批量化咗;仲有#56嗰條「明明冇人郁過都話release變咗」— 原來連兄弟asset俾人download過都算數,而家改成淨係查真正相關嘅嘢。Release分件由1.5GB切細做500MB,跌親retry都唔肉痛。斷點續傳、三件齊發、自動重試就緊接住嚟,全部要靠今次呢個append guard打底。