[codex] Fix mounted stub detection and archive linux-xr parity

docs/BENCHMARKS.md

@@ -65,6 +65,23 @@ The raw-Git project-tree canary is intentionally allowed to expose these
 storage bottlenecks, but those observations are performance evidence, not a
 production storage posture claim.
 
+Functional follow-up observations from
+`docs/release/evidence/home-canary-linux-xr-shadow-20260511T040325Z/`:
+
+- The isolated `linux-xr` correctness packet passed push reuse, honey mounted
+  `find -maxdepth 8`, selected hydrate, all 85 mounted symlink `readlink`
+  checks, and the Linux lifecycle companion.
+- `push-storage-summary.env` records 92,969 upload rows, 8,047,721,728 uploaded
+  bytes, 405,519 total chunks, `chunk_upload_concurrency_values=4`, and no push
+  errors.
+- Raw Git pack/index shape is still the dominant storage load: pack rows
+  account for 70,857 chunks and 6,216,112,937 bytes, while pack-index rows now
+  account for 4,600 chunks and 395,854,856 bytes.
+- The push started before the final fresh-prefix/progress telemetry landed, so
+  `chunk_exists_check_absent_rows=92969` and `chunk_upload_progress_rows=0`.
+  Treat this packet as functional and storage-observation evidence, not a
+  production storage posture proof.
+
 Pre-fix host observations from
 `docs/release/evidence/home-canary-linux-xr-shadow-20260510T201809Z/storage-posture-observations.md`:
 

docs/ops/feature-objective-matrix-2026-05-09.md

@@ -12,7 +12,7 @@ GitHub issues, and Linear mirrors. It should answer two questions quickly:
 | --- | --- | --- | --- |
 | Distribution install and upgrade proof | [#280](https://github.com/Jesssullivan/tummycrypt/issues/280) | [TIN-131](https://linear.app/tinyland/issue/TIN-131/prove-distribution-install-and-upgrade-flows-across-supported-release) | Open. Strong `v0.12.12` Homebrew/Nix/Linux package/amd64 container evidence exists; hosted production `.pkg` attempt `25613963424` adds install/signing/installed-CLI proof but not Finder; production macOS `.pkg` clean-host Finder proof and native arm64 container proof remain. |
 | Live neo-honey backend acceptance | repo docs | [TIN-132](https://linear.app/tinyland/issue/TIN-132/operationalize-the-neo-honey-live-fleet-acceptance-lane) | Backlog mirror. `neo-honey` proves live SeaweedFS/NATS sync when run, but it is not a Finder or lazy traversal proof by itself. |
-| Lazy traversal, unsync, and Finder/FileProvider reality | [#309](https://github.com/Jesssullivan/tummycrypt/issues/309) | [TIN-133](https://linear.app/tinyland/issue/TIN-133/prove-lazy-traversal-and-finderfileprovider-hydration-reality) | In progress. Extended fleet packet, same-fixture unsynced rehydrate packets, Linux-mounted reverse-read packet, M8 current-behavior packet, cross-host conflict packet, manual keep-both conflict recovery packet, independent sibling conflict packet, and daemon keep-both timeout blocker are archived; `task lazy:home-canary-linux-xr-shadow` stages the real `linux-xr` shadow canary without mutating the live repo; Linux and PZM lab evidence are strong; hosted production `.pkg` attempt `25613963424` failed before daemon/Finder on stale public storage endpoint; production Developer ID clean-host Finder remains open. |
+| Lazy traversal, unsync, and Finder/FileProvider reality | [#309](https://github.com/Jesssullivan/tummycrypt/issues/309) | [TIN-133](https://linear.app/tinyland/issue/TIN-133/prove-lazy-traversal-and-finderfileprovider-hydration-reality) | In progress. Extended fleet packet, same-fixture unsynced rehydrate packets, Linux-mounted reverse-read packet, M8 current-behavior packet, cross-host conflict packet, manual keep-both conflict recovery packet, independent sibling conflict packet, daemon keep-both timeout blocker, and the scoped `linux-xr` isolated-shadow project-tree packet are archived; Linux and PZM lab evidence are strong; hosted production `.pkg` attempt `25613963424` failed before daemon/Finder on stale public storage endpoint; production Developer ID clean-host Finder remains open. |
 | Tinyland branch hygiene | [#312](https://github.com/Jesssullivan/tummycrypt/issues/312) | none primary | Open. A non-destructive prune proposal exists; no tinyland branch deletion without explicit approval. |
 | On-prem source-owned cutover | [#327](https://github.com/Jesssullivan/tummycrypt/issues/327) | [TIN-720](https://linear.app/tinyland/issue/TIN-720/converge-remaining-tcfs-tailscale-proxy-source-ownership) | Open. Source/runbook work is ready, but live mutation waits on a named downtime window, rollback owner, and post-cut smoke owner. |
 | Residual Civo PVC retirement | [#298](https://github.com/Jesssullivan/tummycrypt/issues/298) | blocked by infra lane | Open, blocked on `#327` unless an operator explicitly separates it. |
@@ -27,8 +27,8 @@ GitHub issues, and Linear mirrors. It should answer two questions quickly:
 | Mounted reverse read | Prove one machine can keep only a physical `.tc` stub while another machine publishes newer bytes, then read exact latest content through the first machine's mounted clean-name view. | Linux-equivalent green; neo/macOS still blocked. Honey kept only a physical `.tc` stub, neo published newer bytes, and honey mounted `ls`/`find`/`cat` returned exact neo bytes. The neo row remains blocked because the NFS loopback mount failed with `Operation not permitted`. | `docs/release/evidence/honey-mounted-reverse-read-20260510T042203Z/`, blocker `docs/release/evidence/neo-mounted-reverse-read-20260510T035826Z/`, `task lazy:honey-mounted-reverse-read-plan`, `task lazy:neo-mounted-reverse-read-plan`, and `scripts/lazy-hydration-mounted-smoke.sh`. | Keep neo/macOS M4 open until macFUSE or a permitted NFS/mount path exists; do not treat the Linux-mounted proof as production Finder evidence. |
 | Delete/rename while peer-unsynced | Prove deterministic behavior when one machine has unsynced physical `.tc` stubs and another machine deletes or renames the corresponding remote paths. | Green for current behavior; not clean UX. Old-path pulls fail and renamed new path hydrates exact bytes, but stale old stubs remain present and tombstone semantics are undecided. Helper coverage now records repeated old-path pull failure, repeated new-path hydrate success, and stale-stub `sync-status` for future M8 packets. | `docs/release/evidence/neo-honey-delete-rename-unsynced-20260510T040456Z/`, `task lazy:neo-honey-delete-rename-unsynced-plan`, `scripts/neo-honey-delete-rename-unsynced-demo.sh`, `scripts/test-neo-honey-delete-rename-unsynced-demo.sh`. | Decide tombstone/stale-stub cleanup semantics before claiming clean delete/rename UX. Add mounted old-path behavior and delete-then-recreate/same-hash-vs-different-hash rows before promoting M8 beyond current behavior. |
 | Cross-host conflict detection and manual recovery | Prove divergent same-file edits do not silently overwrite remote bytes, preserve the losing peer's local content with conflict state, support a manual keep-both recovery pattern, and allow unrelated sibling progress. | Green for current CLI behavior; daemon resolution blocked. Honey's divergent push detects conflict, skips upload, reports `sync state: conflict`, preserves honey bytes, and remote pullback stays at neo's pushed bytes. The manual keep-both packet then preserves honey bytes under a sibling path, rehydrates the original to neo bytes, pushes the sibling copy, and pulls both exact contents back. The sibling packet proves another descendant can push and report `synced` while the original file remains conflicted. The daemon keep-both packet reaches `tcfsd 0.12.12` under auth bypass but `tcfs resolve` times out after 30s; post-timeout pullbacks show partial side effects, not clean resolution UX. | `docs/release/evidence/neo-honey-conflict-20260510T043741Z/`, `docs/release/evidence/neo-honey-conflict-keep-both-20260510T045908Z/`, `docs/release/evidence/neo-honey-conflict-sibling-20260510T051328Z/`, `docs/release/evidence/neo-honey-conflict-daemon-keep-both-20260510T054611Z/`, superseded blocker packets `docs/release/evidence/neo-honey-conflict-daemon-keep-both-20260510T054020Z/` and `docs/release/evidence/neo-honey-conflict-daemon-keep-both-20260510T054401Z/`, `task lazy:neo-honey-conflict-plan`, `task lazy:neo-honey-conflict-keep-both-plan`, `task lazy:neo-honey-conflict-sibling-plan`, `task lazy:neo-honey-conflict-daemon-keep-both-plan`, `scripts/neo-honey-conflict-demo.sh`, `scripts/test-neo-honey-conflict-demo.sh`, plus lower-level sync conflict tests. | Fix daemon-backed `tcfs resolve` completion and state/status cleanup, then add conflict-list/status UX, broader descendant/offline permutations, and Finder/provider conflict visibility before user-facing conflict UX claims. |
-| S3-first storage posture | Prove the S3/SeaweedFS object model, chunk sizing, retry behavior, queue/concurrency posture, and endpoint/TLS/credential class are acceptable for project-tree workloads. | Open. `home-canary-linux-xr-shadow-20260510T201809Z/` is useful pre-fix evidence: a large `.idx` exploded into 72,598 chunks and a 6.2 GB `.pack` showed about 6.1 GiB snapshot footprint before upload. Local fixes now move `.idx` to the large-file profile, bound streaming snapshot memory, and add bounded chunk-upload fanout, but post-fix host evidence is still open. Correctness packets do not by themselves prove storage readiness. | `docs/release/evidence/home-canary-linux-xr-shadow-20260510T201809Z/storage-posture-observations.md`, `docs/BENCHMARKS.md`, storage rows in `docs/ops/lazy-traversal-qa-permutation-matrix-2026-05-09.md`, `crates/tcfs-chunks/src/fastcdc.rs`, and `crates/tcfs-sync/src/engine.rs`. | Rerun the large raw-Git proof with rebuilt neo+honey binaries, archive chunk/object counts, memory, retries, concurrency, and wall-clock metrics, then decide whether multipart/native SeaweedFS semantics are the next product change. |
-| Real project-tree canary | Snapshot `/Users/jess/git/linux-xr` into an isolated shadow, configure raw `.git`/hidden-dir/symlink sync, and collect honey/lifecycle command packets. | Green as a scoped canary, not full project parity. `20260510T023938Z` completed shadow push, honey mounted bounded traversal/hydration, and Linux lifecycle, but skipped symlinks. The fresh `20260510T201809Z` symlink-enabled packet proves local source/shadow symlink target manifests and records 85 symlink uploads, but honey mounted symlink verification failed and the Linux lifecycle companion failed during mounted `cat`. Full `linux-xr` parity remains blocked. | Green scoped packet `docs/release/evidence/home-canary-linux-xr-shadow-20260510T023938Z/`, partial blocker `docs/release/evidence/home-canary-linux-xr-shadow-20260510T201809Z/`, `task lazy:home-canary-linux-xr-shadow`, `scripts/home-canary-linux-xr-shadow.sh`, `scripts/test-home-canary-linux-xr-shadow.sh`, `cargo test -p tcfs-sync symlink --tests`, and `cargo test -p tcfs-vfs pushed_symlink_json_index_reads_through_vfs --test vfs_lifecycle_test`. | Rebuild/copy current tcfs binaries onto honey, rerun the real project-tree canary with mounted symlink target verification and lifecycle, and keep broad home-directory takeover out of scope. |
+| S3-first storage posture | Prove the S3/SeaweedFS object model, chunk sizing, retry behavior, queue/concurrency posture, and endpoint/TLS/credential class are acceptable for project-tree workloads. | Open. `home-canary-linux-xr-shadow-20260510T201809Z/` is useful pre-fix evidence: a large `.idx` exploded into 72,598 chunks and a 6.2 GB `.pack` showed about 6.1 GiB snapshot footprint before upload. `home-canary-linux-xr-shadow-20260511T040325Z/` is useful functional/storage-observation evidence: the `.idx` shape is improved, the 6.2 GB `.pack` still dominates object count, and mounted depth-8 traversal passed but was slow. It is not production storage proof because the push used debug binaries and predates `chunk_exists_check`/progress telemetry. | `docs/release/evidence/home-canary-linux-xr-shadow-20260510T201809Z/storage-posture-observations.md`, `docs/release/evidence/home-canary-linux-xr-shadow-20260511T040325Z/push-storage-summary.env`, `docs/BENCHMARKS.md`, storage rows in `docs/ops/lazy-traversal-qa-permutation-matrix-2026-05-09.md`, `crates/tcfs-chunks/src/fastcdc.rs`, and `crates/tcfs-sync/src/engine.rs`. | Rerun the large raw-Git proof on a new disposable prefix with release binaries, `TCFS_UPLOAD_ASSUME_FRESH_PREFIX=1` where safe, progress telemetry, endpoint/TLS/credential posture, memory, retries, object counts, and wall-clock/hydration timings; then decide whether multipart/native SeaweedFS semantics are the next product change. |
+| Real project-tree canary | Snapshot `/Users/jess/git/linux-xr` into an isolated shadow, configure raw `.git`/hidden-dir/symlink sync, and collect honey/lifecycle command packets. | Green for scoped isolated-shadow project-tree parity. `20260511T040325Z` reused the completed push, passed honey mounted `find -maxdepth 8`/hydrate, verified all 85 mounted symlink targets with `readlink`, and passed the Linux lifecycle companion. This does not claim production Finder, broad home-directory takeover, or production S3 posture. | `docs/release/evidence/home-canary-linux-xr-shadow-20260511T040325Z/`, earlier baseline `docs/release/evidence/home-canary-linux-xr-shadow-20260510T023938Z/`, blocker/storage packet `docs/release/evidence/home-canary-linux-xr-shadow-20260510T201809Z/`, `task lazy:home-canary-linux-xr-shadow`, `scripts/home-canary-linux-xr-shadow.sh`, `scripts/test-home-canary-linux-xr-shadow.sh`, `scripts/lazy-hydration-mounted-smoke.sh`, `cargo test -p tcfs-sync symlink --tests`, and `cargo test -p tcfs-vfs pushed_symlink_json_index_reads_through_vfs --test vfs_lifecycle_test`. | Keep broad home-directory takeover out of scope; next proof work is production macOS/Finder, release-binary S3 posture, neo/macOS M4, tombstone UX, and keep-synced/pin semantics. |
 | Linux clean-name mounted traversal | Browse remote trees without hydrating all file bodies. | Green on `honey` for the archived lifecycle lane. | `docs/release/evidence/lazy-linux-20260508T170825Z/`, `tcfs-vfs` lifecycle tests. | Keep harness green while cross-host pilot evidence is built. |
 | On-demand hydration | Hydrate exact selected content on open/read. | Green on Linux; green in PZM testing-mode FileProvider lab; production Finder still open. | Linux lifecycle evidence; PZM run IDs in FileProvider docs; `cargo test -p tcfs-vfs --test vfs_lifecycle_test`. | Prove production Developer ID clean-host hydrate through `#309`. |
 | Mounted write/readback | Edit through the mounted view and prove exact remote content. | Green on Linux lifecycle evidence and the extended fleet packet companion. | `mounted-write-remote-pull.log` in `docs/release/evidence/fleet-pilot-extended-20260509T2152Z/linux-lifecycle/` and the older Linux bundle. | Add same-fixture cross-host edit/pullback only if that becomes the acceptance bar. |
@@ -46,16 +46,13 @@ GitHub issues, and Linear mirrors. It should answer two questions quickly:
 
 ## Next Workstream Todo List
 
-1. Close the symlink host-proof gap for real project-tree parity.
-   The scoped `linux-xr` canary is archived in
-   `docs/release/evidence/home-canary-linux-xr-shadow-20260510T023938Z/` with a
-   completed shadow push, bounded honey traversal/hydration, and Linux lifecycle
-   companion. The fresh symlink-enabled attempt in
-   `docs/release/evidence/home-canary-linux-xr-shadow-20260510T201809Z/` proved
-   local source/shadow target manifests and symlink uploads, but failed mounted
-   symlink verification and lifecycle. Do not claim full project parity until a
-   rebuilt host packet proves all inventoried symlinks through mounted
-   `readlink` and the lifecycle companion passes.
+1. Preserve the scoped `linux-xr` parity boundary.
+   `docs/release/evidence/home-canary-linux-xr-shadow-20260511T040325Z/` closes
+   the isolated-shadow project-tree parity bar: completed push, mounted
+   traversal/hydration, all 85 mounted symlink `readlink` checks, and Linux
+   lifecycle passed without mutating the live source tree. Do not broaden that
+   into production Finder, broad home-directory takeover, or production S3
+   readiness.
 
 2. Keep M4 split by platform.
    `task lazy:honey-mounted-reverse-read-plan` is green as Linux-mounted VFS