Review 5674

Review 5674 — route remaining gh-pages writers through publisher

PR

#5674 ci: route remaining gh-pages writers through publisher by cixzhang (bucket: the maintainer)

HEAD REVIEWED

574ee795b0eff2aded1da1d5537583cd816d439a — every claim below was verified at this exact head. It is a one-commit change on current main parent 20cf2b575d162a2c825b1511922f049023dfb352.

Replacement provenance: this commit has stable patch id fdd2a560785be2d100d6d549d2b9d00973508887, identical to the approved #5633 head 051e991c0d8de7f9b17991d81ec27d076141c30b. Both commits change the same 10 paths and every resulting blob id is identical. Their parent trees differ on 293 unrelated paths and on zero reviewed paths.

VERSIONS

LOOP VERSION: 1.9.1 AUDIT RUBRIC: 1.14.4

LANE

LANE: full WHY: this is an exact-head replacement revalidation of a privileged multi-workflow publication migration with prior review provenance, trusted API state, global serialization, destructive compaction, retention, and clean-runner CI behavior.

PRIOR REVIEW RECONCILIATION: #5633 Round 3 concluded Semantic verdict: approve at 051e991c, with one non-blocking same-name byte-assertion note. This replacement is semantically identical, but this review reverses that verdict because the combined compaction→cleanup sequence and clean-runner CI expose blockers the earlier round did not exercise.

PROBLEM

WHY 1: Preview, cleanup, compaction, and vibe-report writers mutate overlapping gh-pages state and need one reliable publication authority. WHY 2: A stale identity, concurrent writer, lost subtree, failed compaction, or ineffective retention policy leaves maintainers with missing or stale evidence and an ever-growing branch. WHY 3: Maintainers rely on every preview and report matching its eligible run while old bulk data is actually retired and shared publication remains recoverable.

USER-FACING PROBLEM: A maintainer inspecting repository previews or reports can receive stale content, failed maintenance, or retained screenshot bulk even though the workflows report a centralized reliability policy. PROBLEM SEVERITY: broken task — exact CI proves the weekly compactor cannot create its commit in a clean runner, and the scheduled compaction/cleanup sequence prevents stale screenshot age from maturing. NEW FEATURE CASE: not a product feature — this completes the repository-owned publication migration previously reviewed on #5633. EARLY STOP: clear — the need and prior design are established; this run revalidates the replacement and its integrated operating states.

VERDICT: clear

SOLUTION

Every writer is meant to enter one durable queue, mutate only its owned subtree, retry from the latest gh-pages tip, and release both rollout authorities. Trusted workflow code resolves preview eligibility from GitHub state, while report publication keeps current local bytes authoritative and cleanup applies the retention policy. Whole-tree compaction should preserve current content, remove terminal migration state, and remain able to run in the clean hosted environment.

SOLUTION (4 runtime decisions · 10 files / +1,198 −572)

1. Resolve automatic preview identity/readiness through trusted API state, cross-check artifacts, and recheck before invoking publication.
2. Route automatic/manual previews and cleanup through isolated subtree writers with bounded retry.
3. Route vibe report and screenshot publication through the same publisher, preserving current-source precedence and unrelated old paths.
4. Acquire exclusive whole-tree publication for compaction, remove terminal migration state, and retain an active shared successor.

BURDEN: high — five workflows, one shared publisher, two queue roots, trusted API/artifact boundaries, full-history retention, whole-tree compaction, and 44 focused tests. BURDEN MATCH: proportionate in ownership, but incomplete in operation — compaction cannot commit in a clean runner, and its root commit erases the history used as the retention clock.

VERDICT: BLOCKS — the two scheduled maintenance operations cannot jointly satisfy their production contract.

ARCHITECTURE

OWNER: the shared gh-pages publisher owns publication order and mutations; trusted default-branch workflows own preview identity; one compaction-independent source must own screenshot age. TIER 1: the shared run-id FIFO, temporary same-commit legacy projection, and Actions run liveness established by the preceding publisher stack. TIER 2: none. SEAMS: current/draft/closed/stale/wrong-repository preview state, API failure, forged/missing artifacts, same-name and remote-only report files, rejected pushes, 29/30/31-day retention, weekly root compaction, clean runner identity, terminal queue cleanup, and active successor preservation. BEHAVIOR UNIT: pure utility/module plus workflow contract — exact functions were driven against isolated bare remotes and exact workflow scripts were executed with mocked API/artifact states. COMPLEXITY BUDGET: one publication authority, one trusted preview identity source, one compaction-independent screenshot-age source, one owner per subtree, and hermetic tests that require neither developer credentials nor global Git config. ACTUAL BURDEN: 10 files; +1,198 −572; 5 changed workflows; 1 publisher module; 2 queue roots; 44 focused tests. Screenshot age is inferred from path commit history that weekly parentless compaction rewrites, and compaction invokes commit-tree without the identity configuration every other writer uses. BURDEN TREND: approved 051e991c → replacement 574ee795 is flat — stable patch ids, changed paths, and all 10 final blobs are identical; the new parent changes 293 unrelated paths and zero reviewed paths. RESET TRIGGER: not triggered — one model-level source conflict and one clean-runner wiring defect have direct contraction criteria inside the existing publisher.

domain fact	one authoritative writable source	generated / immutable projections	other writable copies
preview PR/head/repository/readiness	trusted Pull Requests API matched to workflow_run, then rechecked before the publish command	artifact PR/head/run cross-check	none
publication order	shared run-id FIFO with temporary same-commit legacy projection	run id/scope logs	no payload writer outside the publisher
report screenshot bytes	current report source	old remote paths fill source-absent paths	none
screenshot retention age	git log path timestamp	deletion plan	weekly parentless compaction replaces that timestamp — BLOCKS
compaction commit identity	expected bot identity	root commit author/committer	clean runner has no configured identity — BLOCKS
terminal migration state	compacted tree after removing the current turn and legacy root	one-commit history	active shared successor tickets preserved

seam	driven result
trusted current PR / associated-commit fallback	exact PR/head/ref/repository resolves and proceeds — pass
failed CI / draft / closed / stale head / stale ref / wrong repository	initial and final scripts reject or clean-skip as intended — pass
API failure	both trusted API stages fail closed; no ready output authorizes publication — pass
forged or missing artifact metadata	valid identity proceeds, missing metadata clean-skips, and wrong PR/head/run or invalid hash rejects — pass
final readiness order	artifact presence precedes final API recheck and the publish step consumes only final-preview.ready — pass at the workflow-step boundary
same-name report screenshot	current local-new wins over remote-old; remote-only survives — pass
rejected report/preview push and repeat publication	concurrent unrelated writes survive a fresh-tip retry; the second identical publication is a no-op — pass
retention without compaction	31-day screenshot subtree deletes; exact-30-day and 29-day screenshots, report HTML, live preview, baseline, and concurrent write survive — pass
retention after scheduled compaction	a July 1 screenshot compacted August 28 survives August 29 cleanup because its path timestamp becomes August 28 — fail
compaction state/exclusivity with identity available	dual holders serialize, terminal legacy/current state clears, active successor and all unrelated subtrees survive a stale-lease retry, final history has one commit — pass
compaction on a clean runner	git commit-tree fails with Author identity unknown — fail in exact CI and a scrubbed local environment
workflow permissions	cleanup, compaction, and vibe screenshot jobs each retain actions: read plus required contents access — pass
writer census	all six migrated files contain zero executable direct gh-pages writers; payload pushes exist only in the shared publisher, with the approved legacy module limited to rollout queue metadata — pass

VERDICT: BLOCKS — retention age and weekly compaction have incompatible authorities, and the compactor depends on undeclared ambient Git identity. Use one age source that survives compaction, configure compaction identity explicitly, and keep the new tests hermetic.

IMPACT

The weekly compaction job fails before publishing on a clean runner. Even when an identity is supplied, every compaction makes all surviving screenshot paths appear newly written, so the daily cleanup can never age them past 30 days while weekly compaction continues. Exact-head CI also remains red because one new queue test invokes the real unauthenticated GitHub CLI instead of its fixture. NEW FEATURE IMPACT: not a new feature — maintainers should receive reliable bounded gh-pages storage, but compaction and retention do not yet provide it.

VERDICT: BLOCKS — scheduled maintenance fails or defeats the policy it is meant to preserve.

API

No installed-consumer or package API changes. Repository-only publisher commands add preview, cleanup, vibe report/screenshot, and compaction operations behind the established queue.

	change	public?	class	doc’d?	verdict
+	repository publication commands and workflow outputs	no — CI/operator surface	existing shared publisher family	CLI usage and workflows/tests	note — runtime blockers are owned by architecture/behavior

OSSIFICATION: installed consumers cannot depend on this surface, but repository automation does. The age source and clean-runner identity must be explicit before every remaining writer depends on them.

VERDICT: note — installed-consumer API is unchanged; runtime defects are owned by ARCHITECTURE and BREAKING.

THEMING

No component CSS, token, theme target, variable, style contract, rendered element, or visual state changes; exact changed-file scans returned zero style hits.

VERDICT: clear

BREAKING

BEHAVIOR: yes — the migrated weekly compaction job fails without ambient Git identity, and successful weekly compaction prevents the 30-day screenshot deletion condition from becoming true. API: no installed-consumer API change. VISUAL: no component/story render change; report files are publication payload and were verified by exact bytes. THEME: no theme change.

VERDICT: BLOCKS — existing maintenance workflows no longer meet their claimed runtime behavior.

PERFORMANCE & RESOURCES

EFFECTS: zero. RENDER: no application render path change. LISTENERS/OBSERVERS: none. LAYOUT: none. BUNDLE: no dependency or package change. CI/runtime cost: full-history cleanup is bounded by weekly compaction, but that compaction currently resets the very path age cleanup reads. Focused tests complete in about 96 seconds locally.

VERDICT: clear — no application-runtime regression; the retention defect is correctness/ownership, not measured performance.

VISUAL EVIDENCE

VISUAL CHECK: not applicable WHY: all 10 changed paths are workflow YAML, shell/Node publication code, tests, or a repository tool. The exact diff has zero style/DOM/ARIA/i18n hits; payload correctness was checked by file bytes.

VERDICT: clear

REMEDY SEARCH

REMEDY SEARCH: not triggered — no proven visual defect

A11Y & I18N

No rendered component, interaction, role, accessible string, locale formatting, or direction-sensitive behavior changes; the structural scan returned zero render/a11y hits.

VERDICT: clear

JUDGEMENT

slot	verdict
PROBLEM	clear
SOLUTION	BLOCKS — maintenance operations do not jointly work
ARCHITECTURE	BLOCKS — retention clock is destroyed by its compactor; identity is ambient
IMPACT	BLOCKS — compaction fails and retained screenshots never age out
API	note — internal repository commands only; runtime blockers are carried elsewhere
THEMING	clear
BREAKING	BLOCKS — scheduled maintenance behavior fails
PERFORMANCE	clear
VISUAL	clear — not applicable
A11Y & I18N	clear — not applicable

GOAL: partly met — trusted preview resolution, adversarial rejection, report precedence, subtree preservation, writer routing, permissions, retries, idempotency, dual-holder exclusivity, and terminal queue cleanup pass; clean-runner compaction and compaction-aware retention fail independently. DISPOSITION: replacement provenance → resolved; trusted identity/readiness/artifact rejection → resolved; same-name current-source precedence → resolved in runtime but its checked-in byte assertion remains absent; direct-writer/permission/subtree/retry/idempotency invariants → resolved; clean-runner compaction identity → blocks now; compaction-preserved retention age → blocks now; non-hermetic terminal-state test → blocks exact CI now. ADVICE: bounded outcome criteria — configure the compactor’s commit identity before commit-tree; store or derive screenshot age from a source the parentless compaction preserves; add a compact→cleanup regression and isolate queue liveness tests from developer GitHub credentials. AUTHOR CAN PROCEED: yes — the failures and acceptance criteria are exact and require no new product/API/design decision. WORST OUTCOME: “Even when an identity is supplied, every compaction makes all surviving screenshot paths appear newly written, so the daily cleanup can never age them past 30 days while weekly compaction continues.” → request changes.

JUDGEMENT NEEDED: none — these are reproducible repository-workflow defects.

request changes (self-authored fallback COMMENT; no merge or auto-merge)

1. Compaction has no clean-runner Git identity. → the scheduled job and exact CI fail before producing the one-commit tree · .github/scripts/lib/gh-pages-publisher.mjs:2034-2042

2. Compaction destroys cleanup’s retention clock. → old report screenshots become “new” every week and never cross the 30-day cutoff · .github/scripts/lib/gh-pages-publisher.mjs:1654-1673

3. The terminal-state test invokes the real GitHub CLI. → exact CI is red without a developer credential even though the fixture already supplies a fake client · .github/scripts/lib/gh-pages-publisher.test.mjs:1196-1233

REVIEW

Semantic verdict: request changes

Thanks for preserving #5633’s approved patch exactly. Two production boundaries still break:

• Compaction never configures Git identity, so the clean runner and exact CI fail at commit-tree.
• Cleanup dates screenshots from Git history, but weekly parentless compaction resets every surviving path’s timestamp. A July 1 screenshot still survived August 29 cleanup after August 28 compaction.

The terminal-state test also reaches the real unauthenticated gh, leaving exact CI red. Could we make age compaction-safe, configure commit identity, and keep the tests hermetic?

[Reviewed by Robohands]

INLINE (0–3, only when genuinely line-anchored)

None — both production findings cross the cleanup/compaction boundary, and the CI harness failure is named in the summary.

EVIDENCE I DID NOT SPEND

• The exact replacement proof is unusually strong: same stable patch id, same 10 changed paths, same 10 resulting blobs, and zero parent-tree overlap on those paths.
• The immediate trusted resolver/recheck matrix passed current/fallback and rejected failed-CI, draft, closed, stale SHA/ref, wrong-repository, API-error, and forged/missing artifact cases.
• The earlier #5633 non-blocking note remains: the checked-in same-name fixture still does not assert new bytes; a remote-wins mutant passes that named test, while the independent byte probe proves current production order is correct.

TIME

TIME total 26m

• setup/rules: 6m — fresh loop 1.9.1, official audit 1.14.4, main instructions, #5633 approved round, exact metadata/history, and trust preflight
• worktree/install: 1m — fresh detached exact-head worktree and lockfile-matched dependency clone/reconcile
• build/server: 0m — not applicable
• browser/a11y: 0m — non-rendering change
• focused tests: 4m — 44/44 focused tests, actionlint, syntax, Prettier, focused ESLint, diff-check, and check:repo
• code/history/probes: 8m — patch/tree/blob proof; API/artifact matrix; queue, report, preview, retention, compaction, retry/idempotency, and negative controls
• critique/wiki/delivery: 7m — presentation, critic pass, exact-head recheck, fallback COMMENT, record/index update, and readback
• CI wait: 5m overlapped — exact CI completed red while local evidence ran
• waste: 2m — the first writer scan matched a comment, and the first old-head fetch followed the later closed-PR ref rather than the approved commit

WHAT I COULD NOT VERIFY

• A live gh-pages overlap or scheduled compaction was not dispatched because that would mutate the shared public branch; exact production functions and workflow scripts were driven against isolated bare remotes instead.

Current CI and landing gate

At exact head 574ee795b0eff2aded1da1d5537583cd816d439a, CLI Smoke Test, Internal Registry, Lint, Vercel, build, build-sandbox, build-storybook, check-components, check-scope, docsite-test, fixture-contrast, theme-layers, Meta CLA, and review-required are green. CI run 33224257939 is red: 1 of 628 test files failed, with 2 of 13,128 tests failing in the changed publisher suite. Visual/a11y/RTL jobs skipped by scope and visual-acceptance remains pending. Landing is not ready; no merge or auto-merge was requested or armed.

Required invariant evidence

• Replacement proof: pass — stable patch id fdd2a560785be2d100d6d549d2b9d00973508887; identical 10-path set and resulting blobs versus approved #5633 head 051e991c; old/new parents differ on 293 unrelated paths and zero reviewed paths.
• Trusted preview identity/readiness: pass at the workflow-step boundary — trusted API resolution and associated-commit fallback accept only one open, non-draft exact head/ref/repository; artifact PR/head/run are cross-checked; final API recheck directly gates publication.
• Adversarial rejection: pass — failed CI and draft clean-skip; closed, stale SHA/ref, wrong repository, API failure, invalid hash, and forged artifact PR/head/run fail closed.
• Report screenshot precedence: runtime pass — current same-name bytes win, remote-only bytes survive, rejected-push retry preserves a concurrent write, and repeat publication is a no-op. Checked-in negative control remains green without the byte assertion.
• 30-day retention: fail in the scheduled interaction — standalone cleanup deletes 31-day screenshots and keeps the exact boundary, but weekly compaction resets path history so a 59-day screenshot survives the following cleanup.
• Compaction migration state/exclusivity: runtime logic passes with identity available — dual holders are atomic/exclusive; terminal legacy/current state clears; active successor and subtrees survive a stale-lease retry; history becomes one commit. Production clean-runner execution fails before that point because identity is unset.
• Deploy-report migration: pass — the old direct clone/push path is removed; report deployment invokes gh-pages-publisher.mjs vibe-report with shell-quoted inputs.
• Permissions: pass — cleanup, compaction, and vibe screenshot publisher jobs each retain actions: read and contents: write.
• Writer census: pass — zero executable direct writers in the six migrated files; repository production push calls are limited to the shared publisher and the approved legacy queue-metadata bridge.
• Subtree/retry/idempotency: pass — preview/report/current bytes and unrelated preview/report/baseline/visual/concurrent paths survive; rejected pushes re-clone; repeat preview/report/cleanup operations are no-ops.

Focused evidence

• Checked-in Vitest: 2 files / 44 tests passed locally in 96.32s.
• Independent fixture matrix: trusted API and artifact state, dual-queue exclusion, preview/report subtree preservation, current-source precedence, 29/30/31-day cleanup, compaction retry/state cleanup, and repeat no-ops all driven; the combined compaction→retention case failed.
• Clean-environment negative control: the focused compaction test fails with Author identity unknown, matching exact CI.
• Test-harness negative control: reversing report staging to remote-wins still leaves the named checked-in test green (1 passed / 23 skipped), while the independent probe detects the wrong byte.
• Repository checks: actionlint passed 11 workflows; Node and shell syntax passed; Prettier, diff-check, focused TypeScript ESLint, and check:repo passed. Focused ESLint reported only the repository’s three expected ignored-file warnings for .github MJS files.
• Security/public-safety preflight: all changed workflow/script/test files were read before execution; no dependency, lockfile, package hook, executable-mode, styling, rendered/a11y, or private-residue delta exists.

What changed before posting

Posted as drafted after one critic pass; the public self-authored request-changes COMMENT is 119 words.

Delivery

GitHub review: https://github.com/facebook/astryx/pull/5674#pullrequestreview-5056134505

Cleanup

No long-lived process was started. The dedicated exact-head worktree, wiki clone, temporary refs, and isolated probe data were removed after delivery; the parent claim was not released.

Round 2 — 12bf8338

PR

#5674 ci: route remaining gh-pages writers through publisher by cixzhang (bucket: the maintainer)

HEAD REVIEWED

12bf8338270f472c55a29907d3475ff56f2e2347 — every claim below was verified at this exact head. Its sole parent is current main at 20cf2b575d162a2c825b1511922f049023dfb352.

VERSIONS

LOOP VERSION: 1.9.1 AUDIT RUBRIC: 1.14.4

LANE

LANE: full WHY: this is an exact-head re-review of a privileged publication subsystem after changes to clean-runner behavior, destructive parentless compaction, and the retention source that the prior round blocked.

PRIOR REVIEW RECONCILIATION: Round 1 requested changes at 574ee795 for three exact failures: non-hermetic queue liveness, ambient compaction identity, and screenshot age erased by parentless compaction. The current delta changes only the publisher and its focused test file. It fixes the first two and adds the previously requested same-name byte assertion, but it works around rather than preserves the retention clock.

PROBLEM

WHY 1: Weekly history compaction and daily screenshot cleanup must keep gh-pages bounded without deleting recent evidence. WHY 2: If compaction makes surviving screenshots look newly written, daily cleanup cannot tell when they actually cross the 30-day retention boundary. WHY 3: Maintainers need old bulk evidence to retire predictably while recent reports remain available.

USER-FACING PROBLEM: A maintainer relying on the 30-day cleanup policy keeps screenshot bulk indefinitely once weekly compaction repeatedly rewrites its only age signal. PROBLEM SEVERITY: broken task — the retention job reports success but cannot eventually delete a screenshot that survives one compaction. NEW FEATURE CASE: not a new feature — this repairs the existing repository-owned publication and retention contract. EARLY STOP: clear — the need and acceptance criteria were established in Round 1.

VERDICT: clear

SOLUTION

Before writing a one-commit history, compaction now checks the old history and drops screenshots that are already expired. It also configures its temporary repository with the shared bot identity, while the tests put the fixture GitHub client first in PATH. This repairs the immediate old-screenshot and clean-runner failures, but every recent survivor is still stamped with the new root commit and loses its original age.

SOLUTION (2 runtime decisions · 2 files / +150 −40)

1. Configure the temporary compaction checkout with the established local bot name and email before creating the parentless commit.
2. Clone full history and delete already-expired screenshot subtrees immediately before creating the parentless commit.

Test-only evidence adds fixture-scoped run-status stubbing, a scrubbed-identity compaction path, the missing same-name byte assertion, and one old/recent first-compaction case.

BURDEN: medium for this repair — one shared retention helper is called from cleanup and compaction, plus clean-environment fixture coverage; the full migration remains 10 files / +1,308 −572. BURDEN MATCH: proportionate in scope but ineffective — localizing age handling in the shared publisher is right, but this implementation does not preserve the source it reads.

VERDICT: BLOCKS — a surviving screenshot still loses the only age that can make it expire.

ARCHITECTURE

OWNER: the shared gh-pages publisher owns publication order and whole-tree compaction; screenshot retention needs one age source that parentless compaction cannot rewrite. TIER 1: the shared run-id FIFO, temporary legacy projection, and Actions-run liveness from the approved publisher stack. TIER 2: none. SEAMS: clean global Git config, fixture-only GitHub run status, first and repeated weekly compaction, 29/30/31-day boundaries, stale push retry, terminal dual-queue cleanup, active successor preservation, report-byte precedence, and trusted preview identity. BEHAVIOR UNIT: pure utility/module plus workflow contract — production publishers run against isolated bare remotes and workflow invariants are checked as repository text. COMPLEXITY BUDGET: one publication authority, one compaction-independent screenshot-age source, one local bot identity, no new durable owner, and one regression spanning more than one compaction. ACTUAL BURDEN: full PR 10 files / +1,308 −572; repair delta 2 files / +150 −40; one shared age helper; two deletion call sites; one parentless root writer; 45 focused tests. Age remains the latest path commit timestamp, and each surviving path is rewritten into every root commit. BURDEN TREND: first reviewed 574ee795 → current 12bf8338 grew by 31/16 production lines and 119/24 test lines. Identity and test isolation contract cleanly; retention adds another point-in-time guard without preserving its source. RESET TRIGGER: triggered — the repair for the source-of-truth finding adds compaction-time retention handling while the disputed history clock is still destroyed. Stop patching individual compaction dates and restore one age source that survives any number of compactions.

domain fact	one authoritative writable source	generated / immutable projections	other writable copies
screenshot retention age	latest path commit timestamp before the first compaction	deletion plan	every parentless compaction rewrites the timestamp — BLOCKS
compaction commit identity	local github-actions[bot] name/email in the temporary checkout	root commit author/committer	none — pass
fixture run liveness	fixture gh response	queue wait result	developer credentials excluded — pass
report screenshot bytes	current report source	old remote paths fill source-absent paths	none — pass
preview PR/head/repository/readiness	trusted Pull Requests API matched to workflow_run, then rechecked	artifact PR/head/run cross-check	none — pass
publication order	shared run-id FIFO with temporary same-commit legacy projection	run id/scope logs	no payload writer outside the publisher — pass

seam	driven result
terminal compaction test on clean CI	fixture GitHub status is used; no real credential is reached — pass
compaction with no global/system identity	local bot identity creates the parentless commit — pass
identity scope	only the temporary checkout receives user.name and user.email; no global config mutation — pass
already-expired screenshot at first compaction	58-day screenshot is removed while report HTML survives — pass
recent screenshot at first compaction	8-day screenshot survives — pass
survivor across later weekly compactions	September 4, 11, and 18 runs each see only the previous 7-day-old root, retain the bytes, and rewrite the path timestamp — fail
following cleanup	at 32 original days it appears 3 days old and remains — fail
same-name report screenshot	checked-in assertion now proves new bytes beats old bytes — pass
substantive compaction assertions	terminal legacy/current state clears; active successor, scoped content, and one-commit result remain asserted — pass
inherited trust/queue/writer contract	eight non-delta blobs are identical to 574ee795; 45 focused tests pass — pass

VERDICT: BLOCKS — retention still has no compaction-independent source; repeated compaction keeps a survivor permanently young.

IMPACT

The clean runner and first compaction now work. Under the real weekly schedule, however, a screenshot that is recent during one compaction is re-dated every later Monday and can remain after it is older than the 30-day policy; an isolated replay kept the August 20 bytes after September 21 cleanup. NEW FEATURE IMPACT: not a new feature — maintainers regain clean CI and compaction, but not bounded retention.

VERDICT: BLOCKS — old screenshot bulk can survive indefinitely while cleanup stays green.

API

No installed-consumer or package API changes. The delta changes only repository-internal compaction behavior and its focused fixtures.

	change	public?	class	doc’d?	verdict
~	compaction expiration and local commit identity	no — repository automation	existing publisher contract	workflow/tests	finding — retention source still resets

OSSIFICATION: no package surface ossifies. Repository automation does depend on the retention source, so its age invariant must be explicit and stable across root rewrites.

VERDICT: note — no consumer API change; the internal retention defect is owned by ARCHITECTURE and BREAKING.

THEMING

No component CSS, token, theme target, variable, painting element, or style contract changes.

VERDICT: clear

BREAKING

BEHAVIOR: yes — clean-runner compaction is repaired, but repeated scheduled compaction still prevents surviving screenshots from aging out. API: no installed-consumer API change. VISUAL: no component/story render path changes; report payload correctness is checked by exact files and history. THEME: no theme change.

VERDICT: BLOCKS — the existing 30-day retention behavior remains false under its scheduled interaction.

PERFORMANCE & RESOURCES

EFFECTS: zero. RENDER: no application render path change. LISTENERS/OBSERVERS: none. LAYOUT: none. BUNDLE: no dependency or package change. CI/runtime cost: both cleanup and compaction clone full history; weekly compaction bounds that history. The focused 45-test run completed in 138.83 seconds. The remaining issue is correctness, not an unmeasured performance claim.

VERDICT: clear

VISUAL EVIDENCE

VISUAL CHECK: not applicable WHY: the current delta changes Node publication logic and its tests only. It changes no component, CSS, DOM, story, theme, ARIA, locale, or rendered application path.

VERDICT: clear

REMEDY SEARCH

REMEDY SEARCH: not triggered — no proven visual defect

A11Y & I18N

The delta changes no rendered element, interaction, role, accessible string, locale formatting, or direction-sensitive behavior.

VERDICT: clear

JUDGEMENT

slot	verdict
PROBLEM	clear
SOLUTION	BLOCKS — recent survivors still lose age
ARCHITECTURE	BLOCKS — compaction rewrites the retention source
IMPACT	BLOCKS — old bulk can survive indefinitely
API	note — internal automation only
THEMING	clear
BREAKING	BLOCKS — 30-day scheduled behavior remains false
PERFORMANCE	clear
VISUAL	clear — not applicable
A11Y & I18N	clear — not applicable

GOAL: partly met — clean CI fixture isolation, local bot identity, same-name byte precedence, first-compaction expiry, and every inherited trust/queue/writer invariant pass; weekly compactions on September 4, 11, and 18 each reset the survivor again, and day-32 cleanup retains it. DISPOSITION: Round 1 fixture-credential failure → resolved; Round 1 ambient identity failure → resolved; #5633 same-name assertion note → resolved; repeated-compaction retention age → blocks now; trusted identity/readiness/adversarial rejection, permissions, direct-writer census, retries/idempotency/subtree preservation/exclusivity/terminal cleanup → unchanged and resolved. ADVICE: bounded outcome criteria — preserve one original screenshot-subtree age across any number of parentless compactions; a recent subtree survives before the cutoff, becomes deletable after crossing it, and no weekly compaction can make it young again. Add a repeated-compaction regression that crosses the cutoff after the first compaction. AUTHOR CAN PROCEED: yes — the invariant and reproducer are exact; implementation choice remains with the author. WORST OUTCOME: “Under the real weekly schedule, a screenshot that is recent during one compaction is re-dated every later Monday and can remain after it is older than the 30-day policy.” → request changes.

JUDGEMENT NEEDED: none — this is reproducible correctness against the existing retention contract.

request changes (self-authored fallback COMMENT; no merge or auto-merge)

1. [BLOCKS] parentless compaction still rewrites the only retention clock → a screenshot that survives one Monday can remain after day 30 and be re-dated every later Monday · .github/scripts/lib/gh-pages-publisher.mjs:2022-2025

REVIEW

Semantic verdict: request changes

Thanks — the clean-runner failures are fixed: the terminal-state tests use the fixture GitHub client, compaction configures the local bot identity, and exact-head focused tests pass.

One retention boundary remains. Compaction deletes screenshots already older than 30 days, then writes every survivor into a new parentless root commit. A screenshot 8 days old on the first compaction therefore looks newly written. Each later weekly compaction sees it as only 7 days old and resets it again; at 32 original days cleanup still sees the September 18 root date and leaves it in place.

Could we preserve each surviving screenshot subtree’s original age independently of compacted commit history, and add a repeated-compaction regression?

[Reviewed by Robohands]

INLINE (0–3, only when genuinely line-anchored)

None — the defect is the interaction between the path-history clock and repeated parentless compaction.

EVIDENCE I DID NOT SPEND

• The local identity repair is minimal: two repository-local config writes immediately before commit-tree; a scrubbed global/system identity test passes.
• Eight inherited production/workflow/test blobs are byte-identical to the prior reviewed head, and the full focused suite increased from 44 to 45 assertions without removing the substantive compaction checks.
• The exact-head static checks and CI state are recorded below rather than repeated in the public comment.

TIME

TIME total 20m

• setup/rules: 5m — fresh loop 1.9.1, official audit 1.14.4, full kit, prior #5674 round, #5633 provenance, exact metadata, and untrusted workflow/script preflight
• worktree/install: 2m — fresh detached exact-head worktree and lockfile-matched dependency clone/reconcile
• build/server: 0m — not applicable
• browser/a11y: 0m — non-rendering change
• focused tests: 3m — 45/45 focused tests plus actionlint, syntax, Prettier, focused ESLint, diff-check, and check:repo
• code/history/probes: 5m — exact delta/blob proof, clean identity/fixture inspection, writer/permission census, and repeated weekly-compaction retention replay
• critique/wiki/delivery: 5m — full presentation, critic pass, exact-head/CI recheck, semantic COMMENT, record/index update, and readback
• CI wait: 10m overlapped — exact CI ran while local evidence and writing continued
• waste: 1m — one first probe lacked queue path fixtures, and one wiki-native measurement page was compared as if it were a mirror

WHAT I COULD NOT VERIFY

• A live gh-pages compaction was not dispatched because that would mutate the shared public branch; exact production functions were driven against isolated bare remotes instead.

Current CI and landing gate

At exact head 12bf8338270f472c55a29907d3475ff56f2e2347, CI run 33225953588 completed success: test, build, build-sandbox, build-storybook, check-components, check-scope, docsite-test, fixture-contrast, and theme-layers are green. CLI Smoke Test, Internal Registry, Lint, Vercel, Meta CLA, and review-required are also green. pr-a11y, pr-rtl, and Stable visual regression skipped by non-rendering scope; the synthetic visual-acceptance status remains pending after that skip. CI is green, but landing is not ready because repeated compaction still defeats retention. No merge or auto-merge was requested or armed.

Required invariant evidence

• Delta scope: current versus prior reviewed head changes only the publisher and its test; the other eight inherited blobs are identical.
• Clean fixture: pass — terminal queue/compaction tests prepend the fixture GitHub client; the focused suite no longer reaches developer credentials.
• Local bot identity: pass — the temporary checkout receives only github-actions[bot] name/email before commit-tree; clean global/system identity is explicitly scrubbed.
• Substantive compaction assertions: pass — the fixture wrapper changes no result assertion; terminal legacy/current state deletion, active successor preservation, scoped-content survival, and one-commit history remain asserted.
• Retention: mixed — 58-day screenshots delete and 8-day screenshots survive the first compaction, but a survivor is re-dated; a two-compaction replay leaves it present at 32 original days.
• Trusted preview identity/readiness: pass by unchanged blob plus focused tests — one open exact PR/head/ref/repository is resolved from the trusted API, artifact PR/head/run is cross-checked, and a final API recheck directly gates publication.
• Adversarial rejection: pass by unchanged blob plus focused tests — failed CI and draft clean-skip; closed, stale SHA/ref, wrong repository, API failure, invalid hash, and forged artifact PR/head/run fail closed.
• Staged-byte precedence: pass — the new checked assertion proves current same.png bytes win while remote-only bytes survive.
• Permissions: pass — cleanup, compaction, and vibe screenshot jobs retain actions: read plus required contents access.
• Zero direct writers: pass — the six migrated call sites contain no executable direct gh-pages clone/ref/push pattern; payload writes remain in the shared publisher.
• Retries/idempotency/subtree preservation: pass — the unchanged focused matrix covers fresh-tip retries, repeat no-ops, and unrelated preview/report/baseline/visual/concurrent paths.
• Exclusive authority/terminal cleanup: pass — dual-holder exclusion, current/legacy terminal cleanup, active successor preservation, and compaction stale-lease retry remain covered and green.

Focused evidence

• Checked-in Vitest: 2 files / 45 tests passed in 138.83s.
• Retention negative control: original screenshot 2026-08-20; first compaction 2026-08-28 rewrote its path date; weekly compactions on September 4, 11, and 18 retained it and rewrote that date again; September 21 cleanup retained it at 32 original days while Git history reported September 18.
• Repository checks: actionlint passed 11 workflows; Node and shell syntax passed; Prettier, git diff --check, focused ESLint (zero errors; three expected ignored-file warnings), and check:repo passed.
• Security/public-safety preflight: every changed workflow/script/test diff was read before checkout and execution; no dependency, lockfile, package hook, executable-mode, styling, rendered/a11y, or private-residue delta exists.

What changed before posting

Posted as drafted after one critic pass with no violations; the public self-authored request-changes COMMENT is 131 words.

Delivery

GitHub comment: https://github.com/facebook/astryx/pull/5674#issuecomment-5459529463

Cleanup

No long-lived process was started. The dedicated code worktree, temporary wiki clone, and isolated probe data were removed after delivery; the parent claim was retained.

Round 3 — c9ca570b

PR

#5674 ci: route remaining gh-pages writers through publisher by cixzhang (bucket: the maintainer)

HEAD REVIEWED

c9ca570b3fd16e788cd61972eb0bd75ce41770f5 — every claim below was verified at this exact head. Its sole parent remains 20cf2b575d162a2c825b1511922f049023dfb352; this amended one-commit replacement is not a descendant of Round 2.

VERSIONS

LOOP VERSION: 1.9.1 AUDIT RUBRIC: 1.14.4

LANE

LANE: full WHY: this is a third exact-head review of a privileged publication subsystem after a source-of-truth repair; it must combine destructive terminal migration cleanup, repeated weekly compaction, daily retention, stale-push retry, and inherited trust boundaries.

PRIOR REVIEW RECONCILIATION: Round 2 found the clean fixture, local bot identity, first-compaction expiry, and same-name byte precedence fixed, but requested a compaction-independent age source plus a repeated-compaction regression. The current 12bf8338 → c9ca570b delta changes one production file (+154 −31); the other nine reviewed blobs, including both focused test files and all workflows, are identical. The durable index fixes the age source in isolation, but the exact repeated production sequence exposes a separate standing assumption the checked-in tests never exercise.

PROBLEM

WHY 1: Weekly compaction and daily cleanup must keep screenshot storage bounded without making recent evidence disappear. WHY 2: The migration compaction also removes its obsolete queue state, and later weekly compactions must continue after that terminal cleanup. WHY 3: Maintainers need a maintenance schedule that remains operable every week, not one successful migration run followed by a permanently failing job.

USER-FACING PROBLEM: After the first successful compaction, a maintainer gets a failing weekly maintenance job before any later age-preserving compaction can publish. PROBLEM SEVERITY: broken task — the exact August 28 → September 4 schedule exits at git add on the second compaction. NEW FEATURE CASE: not a product feature — this repairs the repository-owned publication and retention contract. EARLY STOP: clear — the contract and prior acceptance criteria are established.

VERDICT: clear

SOLUTION

A durable publication-tree index now owns when each screenshot path was first seen. The first compaction seeds missing entries from full pre-compaction Git history, later compactions carry those values unchanged, and cleanup removes the file and its metadata after the cutoff. This fixes the retention clock, but compaction still treats terminal legacy queue state as present after it has deliberately removed it.

SOLUTION (1 runtime decision · 1 file / +154 −31 in this repair)

1. Replace compacted path history as the retention authority with one durable first-seen index, using history only to seed missing paths.

BURDEN: medium — one internal JSON map, one migration projection, four writer/maintenance integration points, and a full-history scan at cleanup/compaction. BURDEN MATCH: proportionate — persistent age is required by destructive parentless compaction; the remaining failure is an execution precondition, not another age representation.

VERDICT: BLOCKS — the model preserves age, but the scheduled sequence cannot reach its second compaction.

ARCHITECTURE

OWNER: the shared gh-pages publisher owns publication order, terminal migration cleanup, compaction, and screenshot-age metadata. TIER 1: the shared run-id FIFO, temporary same-commit legacy projection, and Actions-run liveness from the approved publisher stack. TIER 2: none. SEAMS: first migration, absent terminal legacy state, repeated parentless compaction, stale-lease retry, 30-day cleanup, screenshot replacement, unrelated publication subtrees, and active successor tickets. BEHAVIOR UNIT: pure utility/module plus isolated bare-remote integration — the production publisher was driven through exact dated commits and rejected-push retry. COMPLEXITY BUDGET: one publication authority, one durable age source, one one-way history migration, zero permanent legacy authority, and one regression spanning terminal cleanup plus repeated compaction. ACTUAL BURDEN: full PR 10 files / +1,431 −572; repair delta 1 production file / +154 −31; one JSON map at .astryx-gh-pages/retention/screenshot-created-at.json; 45 checked-in focused tests, none invoking compaction twice. BURDEN TREND: first reviewed 574ee795 → Round 2 12bf8338 added first-compaction deletion; Round 3 c9ca570b replaces the resetting history clock with one durable source. The age model contracts correctly, while the required repeated sequence reveals a pre-existing terminal-path assumption. RESET TRIGGER: not triggered anew — the Round 2 source-of-truth reset is satisfied by one authoritative index; the remaining defect is a reproducible lifecycle join between terminal cleanup and the next run.

domain fact	one authoritative writable source	generated / immutable projections	other writable copies
screenshot first-seen age	.astryx-gh-pages/retention/screenshot-created-at.json	pre-index git log timestamp seeds a missing live path once	none — pass
terminal legacy queue state	absence after the first compaction	first compaction deletion	every later compaction still requires the absent pathspec — BLOCKS
publication order	shared run-id queue and holder	temporary legacy projection until terminal compaction	none after terminal cleanup
report screenshot bytes	current report/screenshot source	remote-only paths fill source-absent paths	none

seam	driven result
initial migration from pre-compaction history	August 20 path seeds exactly 2026-08-20T00:00:00.000Z — pass
age-only August 28 / September 4 / September 11 / September 18 compactions	the August 20 value remains byte-stable while Git path history changes each week — pass
screenshot added September 10	seeds to September 10 at the September 11 compaction and remains recent — pass
September 21 cleanup	deletes the 32-day-old August 20 PNG and its key; preserves the September 10 PNG/key — pass when compaction can run
stale metadata	injected orphan and non-PNG keys are removed; final index contains only the live recent PNG — pass
rejected September 11 compaction push	fresh-tip retry preserves the concurrent unrelated write and both age values — pass
repeat cleanup	zero deletions and identical branch head — pass
first terminal compaction	removes current ticket/holder and legacy queue, preserves active successor and all public subtrees — pass
second terminal-state compaction	git add -A ... visual-gate/publication-queue exits because the path no longer exists — fail
inherited trust/readiness/adversarial/byte/permission/writer matrix	nine unchanged blobs plus 45/45 focused tests and direct census — pass

VERDICT: BLOCKS — repeated compaction assumes the terminal legacy queue it removed still exists. The production sequence must tolerate that absence and be pinned by a multi-compaction regression.

IMPACT

The durable index now preserves screenshot age correctly, including across a stale-push retry, and cleanup keeps recent evidence while removing expired bytes and metadata. In the actual migration lifecycle, however, the August 28 compaction removes terminal legacy state and the September 4 compaction fails before writing a new root, so maintainers lose the continuing weekly compaction guarantee. NEW FEATURE IMPACT: not a new feature — this restores bounded, recoverable repository maintenance.

VERDICT: BLOCKS — the maintenance schedule succeeds once and then cannot continue.

API

No installed-consumer or package API changes. The delta adds one repository-internal metadata representation under the existing publication authority.

	change	public?	class	doc’d?	verdict
+	screenshot-path → ISO first-seen timestamp index	no — publication-tree metadata	existing retention policy	encoded by publisher/tests	note — one-source model is sound; lifecycle blocker is elsewhere

OSSIFICATION: no package surface changes. The metadata stays under .astryx-gh-pages/retention/; no preview, report, Storybook, sandbox, baseline, or visual-evidence URL/path literal changes.

VERDICT: note — internal metadata only; no consumer API change.

THEMING

Structural-only CI code: no component CSS, token, theme target, variable, painting element, or style contract changes.

VERDICT: clear

BREAKING

BEHAVIOR: yes — repeated scheduled compaction fails after the first terminal cleanup. API: no installed-consumer API change. VISUAL: no rendered component/story path changes; publication payloads were checked by exact bytes and paths. THEME: no theme change.

VERDICT: BLOCKS — the weekly maintenance behavior is not repeatable.

PERFORMANCE & RESOURCES

EFFECTS: zero. RENDER: no application render path change. LISTENERS/OBSERVERS: none. LAYOUT: none. BUNDLE: no dependency or package change. CI/runtime cost: cleanup and compaction already use full history; this repair adds one live-PNG scan and JSON read/write. No application-runtime cost or measured degradation was introduced.

VERDICT: clear

VISUAL EVIDENCE

VISUAL CHECK: not applicable WHY: the exact delta is one Node publication module and changes no CSS, DOM, component, story, theme, ARIA, locale, or visible application endpoint.

VERDICT: clear

REMEDY SEARCH

REMEDY SEARCH: not triggered — no proven visual defect

A11Y & I18N

No rendered element, interaction, role, accessible string, locale formatting, direction-sensitive behavior, or catalog changes.

VERDICT: clear

JUDGEMENT

slot	verdict
PROBLEM	clear
SOLUTION	BLOCKS — exact repeated schedule stops on run two
ARCHITECTURE	BLOCKS — terminal absence is not accepted by the next compaction
IMPACT	BLOCKS — weekly maintenance succeeds only once
API	note — internal metadata only
THEMING	clear
BREAKING	BLOCKS — repeated compaction fails
PERFORMANCE	clear
VISUAL	clear — not applicable
A11Y & I18N	clear — not applicable

GOAL: partly met — the durable index preserves August 20 age through four isolated compactions, deletes it on September 21, preserves a September 10 screenshot, prunes stale metadata, survives retry, and leaves unrelated subtrees intact; the exact terminal-cleanup sequence fails on the September 4 compaction. DISPOSITION: Round 2 compaction-independent age source → resolved; Round 2 repeated-compaction acceptance → blocks now because production run two fails; checked-in repeated-compaction regression → still absent and blocks because 45/45 tests remain green on the failing sequence; inherited trust/readiness/adversarial/precedence/permissions/writer/retry/idempotency/exclusivity/subtree guarantees → resolved except this terminal-cleanup interaction. ADVICE: bounded outcome criteria — a compaction after terminal legacy cleanup must succeed with the legacy path absent; the checked-in regression must drive August 28, September 4/11/18, and September 21 cleanup, including age values and final metadata. AUTHOR CAN PROCEED: yes — the failing lifecycle and acceptance test are exact; implementation choice remains with the author. WORST OUTCOME: “The maintenance schedule succeeds once and then cannot continue.” → request changes.

JUDGEMENT NEEDED: none — this is reproducible correctness against the existing maintenance contract.

request changes (self-authored fallback COMMENT; no merge or auto-merge)

1. [BLOCKS] the first compaction removes terminal legacy queue state, then every later compaction requires that absent path → maintainers get one successful migration compaction followed by a failing weekly job · .github/scripts/lib/gh-pages-publisher.mjs:2157-2170

REVIEW

Semantic verdict: request changes

Thanks — the durable first-seen index itself fixes the age reset: an August 20 screenshot kept that timestamp through four isolated compactions, and September 21 cleanup removed it while a September 10 screenshot survived.

One production boundary remains: the first scheduled compaction succeeds, but the next weekly run fails before publishing. The first run removes terminal legacy queue state, while every later run still passes that absent path to git add -A, which exits fatal: pathspec 'visual-gate/publication-queue' did not match any files. The 45 checked-in tests stay green because each compaction case runs only once.

Could we make compaction tolerate its own terminal cleanup and add the August 28 → September 21 repeated-compaction regression?

[Reviewed by Robohands]

INLINE (0–3, only when genuinely line-anchored)

None — the defect spans terminal deletion and the following scheduled invocation.

EVIDENCE I DID NOT SPEND

• The age-only negative control at 12bf8338 re-dated the target to every compaction and retained it on September 21; the exact same probe at c9ca570b preserved August 20 and deleted it.
• The index survives a rejected-push fresh-tip retry, keeps the concurrent unrelated write, and leaves only the recent live key after cleanup.
• Nine of ten full-PR blobs are identical to Round 2; the unchanged test suite still lacks any test that invokes compaction twice.

TIME

TIME total 21m

• setup/rules: 5m — fresh loop 1.9.1, official audit 1.14.4, full kit/mirror check, both prior #5674 rounds, exact metadata, and untrusted delta preflight
• worktree/install: 2m — fresh detached exact-head worktree and lockfile-matched dependency clone/reconcile
• build/server: 0m — not applicable
• browser/a11y: 0m — non-rendering change
• focused tests: 4m — 45/45 focused tests plus actionlint, syntax, Prettier, focused ESLint, diff-check, and check:repo
• code/history/probes: 6m — exact blob/delta proof, four-date old/new retention replay, stale-push retry, metadata cleanup, terminal-state composition, permissions, and writer census
• critique/wiki/delivery: 4m — full presentation, one critic pass, exact-head/CI recheck, semantic COMMENT, record/index update, and readback
• CI wait: 5m overlapped — exact CI completed while local evidence and writing continued
• waste: 2m — the first test wrapper lost a successful exit code in shell-specific pipeline state, and the first Prettier list included the shell file it cannot parse

WHAT I COULD NOT VERIFY

• A live gh-pages compaction was not dispatched because that would mutate the shared public branch; exact production functions were driven against isolated bare remotes instead.

Current CI and landing gate

At exact head c9ca570b3fd16e788cd61972eb0bd75ce41770f5, CI run 33227123317 completed success: test, build, build-sandbox, build-storybook, check-components, check-scope, docsite-test, fixture-contrast, and theme-layers are green. CLI Smoke Test, Internal Registry, Lint, Vercel, Meta CLA, and review-required are also green. pr-a11y, pr-rtl, and Stable visual regression skipped by non-rendering scope; the synthetic visual-acceptance status remains pending after that skip. CI is green, but landing is not ready because the exact repeated production schedule fails. No merge or auto-merge was requested or armed.

Required invariant evidence

• Delta scope: 12bf8338 → c9ca570b changes only .github/scripts/lib/gh-pages-publisher.mjs (+154 −31); the other nine reviewed blobs are identical.
• Migration/age authority: pass in isolation — no-index first compaction seeds August 20 from pre-compaction history; later root commits change Git path timestamps but not the index value.
• Repeated schedule: fail in the exact production lifecycle — August 28 terminal compaction succeeds; September 4 exits on the absent legacy queue path, so September 11/18 cannot run.
• September 21 cleanup: pass in the age-isolated arm — 32-day-old PNG/key removed, September 10 PNG/key preserved, injected orphan/non-PNG metadata removed, and repeat cleanup is a no-op.
• Subtree/retry/idempotency: pass outside the blocker — unrelated Storybook, sandbox, preview, report HTML, baseline, active successor, and concurrent retry write survive; second cleanup leaves the head unchanged.
• Exclusive authority/terminal cleanup: mixed — dual-holder and terminal-cleanup tests pass; combining terminal cleanup with the next compaction fails.
• Trusted preview identity/readiness: pass by unchanged workflow blobs plus focused tests — exact open PR/head/ref/repository, artifact cross-check, and final API recheck remain.
• Adversarial rejection: pass by unchanged workflow blobs plus focused tests — failed CI/draft clean-skip; closed, stale SHA/ref, wrong repository, API failure, and forged artifact identity fail closed.
• Staged-byte precedence: pass — unchanged checked assertion proves current same-name bytes win and remote-only bytes survive.
• Permissions: pass — cleanup, compaction, and vibe screenshot jobs retain actions: read and required contents access.
• Zero direct writers: pass — six migrated call sites contain zero executable direct gh-pages clone/ref/push actions; the lone peaceiris text hit is a comment, and all six invoke the shared publisher.
• User-visible paths: pass — the repair introduces only .astryx-gh-pages/retention/screenshot-created-at.json; no preview/report/Storybook/sandbox/baseline/visual URL literal changes.

Focused evidence

• Checked-in Vitest: 2 files / 45 tests passed locally; all three compaction cases invoke compaction only once.
• Independent dated probe: old head retained August 20 at day 32; current head preserved the exact August 20 ISO value through four age-isolated compactions and removed it on September 21 while keeping September 10.
• Exact lifecycle probe: current head’s first compaction removed terminal legacy state; the second failed with fatal: pathspec 'visual-gate/publication-queue' did not match any files at the exact git add call.
• Repository checks: actionlint passed 11 workflows; Node and shell syntax, git diff --check, Prettier, focused ESLint (0 errors; 3 expected ignored-file warnings), and check:repo passed.
• Security/public-safety preflight: exact delta was read before checkout/execution; same-repo trusted head, no dependency/lockfile/package-hook/mode/private-residue change, and only the documented test-clock environment read was added.

What changed before posting

Posted as drafted after one critic pass with no violations; the public self-authored request-changes COMMENT is 121 words.

Delivery

GitHub comment: https://github.com/facebook/astryx/pull/5674#issuecomment-5459666278

Cleanup

No long-lived process was started. The dedicated exact-head code worktree, official-wiki read clone, isolated probe data, temporary commit materialization, and test/CI logs were removed after delivery; the parent claim was not released. The fork-wiki clone is removed after its commit is pushed and read back.

Round 4 — 429de6a0

PR

#5674 ci: route remaining gh-pages writers through publisher by cixzhang (bucket: the maintainer)

HEAD REVIEWED

429de6a080aae6e9c56e69edccf594e0b4cbfe7b — every claim below was verified at this exact head. Its sole parent is current main at 20cf2b575d162a2c825b1511922f049023dfb352.

VERSIONS

LOOP VERSION: 1.9.1 AUDIT RUBRIC: 1.14.4

LANE

LANE: full WHY: this is an exact-head delta re-review of privileged whole-tree publication after a standing correctness block; it must combine terminal migration cleanup, repeated parentless compaction, durable retention metadata, stale-push retry, and the inherited trust boundary.

PRIOR REVIEW RECONCILIATION: Round 3 requested changes at c9ca570b because the first compaction removed terminal legacy state and a later direct compactGhPages call staged that absent leaf. It also required an August 28 / September 4 / 11 / 18 compaction regression followed by September 21 cleanup. The current delta changes only the publisher and its test, and both asks now pass.

PROBLEM

WHY 1: Repeated whole-tree compaction must continue after the migration’s first run permanently removes the legacy queue leaf. WHY 2: A staging command that requires that deleted leaf makes later maintenance fail before it can preserve retention metadata or publish a new one-commit tree. WHY 3: Maintainers need weekly compaction and daily cleanup to remain repeatable so old screenshot bulk retires without losing recent evidence or unrelated Pages content.

USER-FACING PROBLEM: After terminal migration cleanup, a maintainer could receive a failing weekly compaction instead of a bounded, recoverable gh-pages branch. PROBLEM SEVERITY: broken task — the prior direct production-function sequence stopped on its second compaction. NEW FEATURE CASE: not a new feature — this repairs the existing repository-owned publication and retention contract. EARLY STOP: clear — the contract and Round 3 acceptance criteria are established.

VERDICT: clear

SOLUTION

Whole-tree compaction now stages the tree it actually owns instead of naming an optional legacy leaf that may no longer exist. Missing terminal state therefore remains absent rather than becoming an invalid path requirement. The focused regression repeats the scheduled queue/compaction sequence four times and then runs cleanup across the retention cutoff.

SOLUTION (1 runtime decision · delta 2 files / +68 −23)

1. Replace compaction’s explicit subtree pathspec list with whole-tree git add -A; add the repeated August 28 through September 21 sequence to focused coverage.

BURDEN: low for this repair — one production staging line and one focused sequence; the full migration remains 10 files / +1,476 −572 with one publisher, one durable retention index, and five workflow integrations. BURDEN MATCH: proportionate — whole-tree staging matches compaction’s existing whole-tree checkout, tree write, and exclusive authority without adding an owner or representation.

VERDICT: clear

ARCHITECTURE

OWNER: the shared gh-pages publisher owns publication order, whole-tree compaction, terminal migration cleanup, and screenshot-age metadata. TIER 1: the shared run-id FIFO, temporary legacy projection, and Actions-run liveness established by the publisher stack. TIER 2: none. SEAMS: first terminal cleanup, permanently absent legacy leaf, four repeated parentless compactions, stale-lease retry, screenshot publication between compactions, 30-day cleanup, metadata pruning, active successor preservation, and unrelated preview/report/baseline content. BEHAVIOR UNIT: pure production utility/module plus isolated bare-remote integration — compactGhPages, publishMutableSubtree, and cleanupPreviews were driven directly at exact dates. COMPLEXITY BUDGET: one publication authority, one durable age source, one one-way history migration, zero permanent legacy authority, and one whole-tree staging operation. ACTUAL BURDEN: full PR 10 files / +1,476 −572; repair delta 1 production line replacing 9 plus 67/14 test lines; one JSON first-seen index; five workflows; 45 focused tests. BURDEN TREND: first reviewed 574ee795 → c9ca570b grew to add the required durable age source; c9ca570b → 429de6a0 contracts the staging model from four named leaves to the one whole tree it already owns and adds sequence evidence, with no new owner or representation. RESET TRIGGER: not triggered — the Round 2 source-of-truth reset remains satisfied, and this delta removes the terminal-path assumption instead of adding another guard.

domain fact	one authoritative writable source	generated / immutable projections	other writable copies
screenshot first-seen age	.astryx-gh-pages/retention/screenshot-created-at.json	pre-index Git timestamp seeds a missing live path once	none
terminal legacy queue state	absence after terminal compaction	none	none; whole-tree staging accepts absence
compaction tree	the full checkout held under the exclusive publication turn	one parentless tree/commit	no separately staged leaf list
publication order	shared run-id queue and holder	temporary legacy projection until terminal cleanup	none after terminal cleanup

seam	driven result
old-head control	c9ca570b completes August 28, then fails September 4 with pathspec 'visual-gate/publication-queue' did not match any files
exact-head repeated compaction	August 28, September 4, September 11, and September 18 all publish one-commit histories — pass
terminal legacy state	absent after every compaction and never recreated by staging — pass
durable age	August 20 remains exactly 2026-08-20T00:00:00.000Z; a screenshot published September 15 seeds exactly 2026-09-15T00:00:00.000Z — pass
September 21 cleanup	August 20 PNG/key removed; September 15 PNG/key survives — pass
stale metadata	injected orphan PNG and non-PNG keys are absent; final index contains only the live September 15 PNG — pass
stale-push retry	rejected September 11 lease retries from a fresh tip and preserves an unrelated concurrent report write — pass
subtree and successor state	Storybook, sandbox, preview, baseline, report HTML, and active shared successor survive — pass
repeat cleanup	zero deletions and branch head unchanged — pass
inherited trust/readiness/adversarial/byte/permission/writer contract	eight non-delta blobs are identical to Round 3; 45/45 focused tests and the direct census pass

VERDICT: clear — one whole-tree authority now stages one whole tree, and the terminal legacy absence, durable index, retries, and unrelated subtrees all survive the required sequence.

IMPACT

Weekly compaction remains operable after terminal migration cleanup. Maintainers keep recent September 15 evidence, lose the expired August 20 screenshot and its metadata on September 21, and retain unrelated Pages content through retry and repeated maintenance. NEW FEATURE IMPACT: not a new feature — this restores the existing bounded-maintenance guarantee.

VERDICT: clear

API

No installed-consumer or package API changes. The delta changes one repository-internal staging operation and its focused test sequence.

	change	public?	class	doc’d?	verdict
~	compaction stages the full owned tree instead of optional named leaves	no — repository automation	existing whole-tree publisher contract	workflow/tests	ok

OSSIFICATION: no public surface changes; the durable index path and user-visible preview/report URLs remain unchanged.

VERDICT: clear

THEMING

No component CSS, token, theme target, variable, painting element, or style contract changes; the exact diff’s structural scan is empty.

VERDICT: clear

BREAKING

BEHAVIOR: no regression — repeated compaction now tolerates terminal absence while preserving existing retention, cleanup, retry, exclusivity, and subtree behavior. API: no installed-consumer API change. VISUAL: no rendered component/story path changes; publication payloads were checked by exact bytes and paths. THEME: no theme change.

VERDICT: clear

PERFORMANCE & RESOURCES

EFFECTS: zero. RENDER: no application render path change. LISTENERS/OBSERVERS: none. LAYOUT: none. BUNDLE: no dependency or package change. CI/runtime cost: compaction already performs a full checkout and write-tree; staging now matches that existing whole-tree authority. No new network call, process lifetime, or durable representation is added.

VERDICT: clear

VISUAL EVIDENCE

VISUAL CHECK: not applicable WHY: the exact delta changes one Node publication staging call and its test. It changes no component, CSS, DOM, story, theme, ARIA, locale, or visible application endpoint.

VERDICT: clear

REMEDY SEARCH

REMEDY SEARCH: not triggered — no proven visual defect

A11Y & I18N

No rendered element, interaction, role, accessible string, locale formatting, direction-sensitive behavior, or catalog changes.

VERDICT: clear

JUDGEMENT

slot	verdict
PROBLEM	clear
SOLUTION	clear
ARCHITECTURE	clear
IMPACT	clear
API	clear
THEMING	clear
BREAKING	clear
PERFORMANCE	clear
VISUAL	clear — not applicable
A11Y & I18N	clear — not applicable

GOAL: met — the exact old-head control fails on the second compaction, while 429de6a0 completes all four dates, preserves exact first-seen values and terminal absence, deletes only expired bytes/metadata on September 21, prunes orphan keys, and keeps retry, successor, and unrelated subtree state. DISPOSITION: Round 3 missing-legacy-leaf blocker → resolved; Round 3 repeated-sequence evidence → resolved; durable index/metadata cleanup → resolved; inherited trust/readiness/adversarial/byte precedence/retention/permissions/zero-writer/subtree/retry/idempotency/exclusive-authority/terminal-cleanup guarantees → resolved. ADVICE: omitted — no remaining defect or human-owned decision. AUTHOR CAN PROCEED: yes — no changes requested. WORST OUTCOME: none found → approve.

JUDGEMENT NEEDED: none — defect repair against the existing repository-maintenance contract.

approve (self-authored semantic COMMENT; no merge or auto-merge)

REVIEW

Semantic verdict: approve

Thanks — at 429de6a, four compactions preserve dates and legacy absence. September 21 removes August 20, keeps September 15, and leaves no orphan metadata. No blocker remains.

[Reviewed by Robohands]

INLINE (0–3, only when genuinely line-anchored)

None — the resolved defect spans the removed legacy leaf and the following compaction.

EVIDENCE I DID NOT SPEND

• The checked-in queued sequence passes at both heads because each enqueue recreates a temporary legacy ticket; the independent permanent-absence control is the red-before/green-after proof for the staging delta.
• Eight inherited production/workflow blobs are byte-identical to Round 3; the full 45-test matrix rechecks trusted preview resolution, adversarial rejection, byte precedence, permissions, zero direct writers, exclusivity, retry, idempotency, and subtree preservation.
• Security/public-safety preflight found no dependency, lockfile, package-hook, executable-mode, credential-read, network-exfiltration, or private-residue delta.

TIME

TIME total 24m

• setup/rules: 4m — fresh loop 1.9.1, official audit 1.14.4, byte-identical kit mirrors, all three prior #5674 rounds, current-main review sources, exact metadata, and workflow/script trust preflight
• worktree/install: 2m — fresh detached exact-head worktree and lockfile-matched dependency clone/reconcile
• build/server: 0m — not applicable
• browser/a11y: 0m — non-rendering change
• focused tests: 4m — targeted repeated sequence plus 45/45 full focused tests
• code/history/probes: 6m — exact delta/blobs, old/new four-date production-function replay, stale-push retry, metadata cleanup, permissions, and writer census
• critique/wiki/delivery: 8m — presentation, two critic passes, exact-head/CI recheck, semantic COMMENT, record/index update, push, and readback
• CI wait: 18m overlapped — exact CI ran while local evidence and writing continued
• waste: 2m — one writer-census shell pipeline mishandled a zero-match exit, and the checked-in sequence needed an old-head control to show it does not isolate the changed staging line

WHAT I COULD NOT VERIFY

• A live gh-pages compaction was not dispatched because that would mutate the shared public branch; exact production functions were driven against isolated bare remotes instead.

Current CI and landing gate

At exact head 429de6a080aae6e9c56e69edccf594e0b4cbfe7b, CI run 33228234889 completed success: 626 test files / 13,116 tests passed, with 2 files / 13 tests skipped; build, build-sandbox, build-storybook, check-components, check-scope, docsite-test, fixture-contrast, and theme-layers are green. CLI Smoke Test, Internal Registry, Lint, Vercel, Meta CLA, and review-required are also green. pr-a11y, pr-rtl, and Stable visual regression skipped by non-rendering scope. The required synthetic visual-acceptance status resolved to success with No stable visual scope; all required checks pass and GitHub reports mergeStateStatus: CLEAN. This is landing-ready for the parent; no merge or auto-merge was requested or armed.

Required invariant evidence

• Delta scope: c9ca570b → 429de6a0 changes only .github/scripts/lib/gh-pages-publisher.mjs (+1 −9) and .github/scripts/lib/gh-pages-publisher.test.mjs (+67 −14); the other eight reviewed blobs are identical.
• Missing legacy leaf: pass — old head fails on compaction two with the exact legacy pathspec error; exact head completes four direct production-function compactions while legacy state remains absent.
• Repeated dated sequence: pass — August 28, September 4, September 11, and September 18 compactions each publish a one-commit tree; September 21 cleanup succeeds.
• Durable first-seen authority: pass — August 20 and September 15 retain exact ISO dates across parentless compaction.
• Retention and metadata: pass — September 21 removes August 20 PNG/key, preserves September 15 PNG/key, and leaves no injected orphan or non-PNG entry.
• Trusted preview identity/readiness: pass by unchanged workflow blob plus focused tests — exact open PR/head/ref/repository resolution, artifact PR/head/run cross-check, and final API recheck remain.
• Adversarial rejection: pass by unchanged workflow blob plus focused tests — failed CI/draft clean-skip; closed, stale SHA/ref, wrong repository, API failure, invalid hash, and forged artifact identity remain fail-closed.
• Staged-byte precedence: pass — current same-name report bytes win while remote-only bytes survive.
• Permissions and writer authority: pass — cleanup, compaction, and vibe screenshot jobs retain actions: read plus required contents access; six migrated call sites have zero executable direct writers and all invoke the shared publisher.
• Subtree/retry/idempotency: pass — unrelated Storybook, sandbox, preview, report HTML, baseline, active successor, and a concurrent retry write survive; repeated cleanup leaves the head unchanged.
• Exclusive authority/terminal cleanup: pass — the focused suite retains dual-holder exclusion and terminal cleanup; direct sequence proves subsequent whole-tree compactions accept terminal absence.

Focused evidence

• Targeted exact-head regression: 1 passed / 24 skipped; four queued production compactions plus cleanup completed.
• Full focused Vitest: 2 files / 45 tests passed in 118.86s.
• Independent delta control: c9ca570b failed at the second direct compaction on the missing legacy path; 429de6a0 passed all four dates, a stale-push retry, September 15 publication, metadata pollution/pruning, September 21 cleanup, and repeat cleanup.
• Repository checks: actionlint passed 11 workflows; Node and shell syntax, Prettier, git diff --check, focused ESLint (0 errors; 3 expected ignored-file warnings), and check:repo passed.
• Exact CI includes the repeated test because .github/workflows/ci.yml runs unfiltered pnpm test; its exact-head test job passed 626/628 files and 13,116/13,129 tests, with the remainder intentionally skipped.

What changed before posting

Critic pass 1 removed the over-broad “Landing-ready” claim while the required synthetic status was pending and cut one more word to meet the 30-word cap; pass 2 found no violations. The status projected No stable visual scope immediately after the comment, without a code change.

Delivery

GitHub comment: https://github.com/facebook/astryx/pull/5674#issuecomment-5459794490

Cleanup

No long-lived process was started. The dedicated exact-head code worktree, official-wiki read clone, isolated bare remotes, probe modules/data, and local logs were removed after delivery; the fork-wiki clone was removed after push/readback. The parent’s exact-head worktree/claim was retained.