Report artifact GC in one JSON shape and count every rollback leg

[Mikola Lysenko (mikolalysenko)]

Closes #1257. Closes #1066.

Both are JSON-contract drift that should be fixed before v5.0.0 ships (#1194).

Artifact GC: one shape (#1257)

Command	Before	After
repair --json	removed event, details: {count, checked}; no bytes; bumped summary.removed by 1	top-level gc + summary.bytesFreed; carrier event keeps count/checked, gains bytes, bumps no counter
remove --json	carrier details: {blobsRemoved, rolledBack, archivesRemoved}; no bytes	same carrier + bytes; top-level gc + summary.bytesFreed
rollback --json	hand-built gc json	same keys, built from GcReport
scan --prune --json	hand-built gc json	same keys, built from GcReport (plus scan's manifest/vendored keys)

• New json_envelope::GcReport {removedBlobs, removedDiffArchives, removedPackageArchives, bytesFreed}, folded from the three sweep passes.
• summary.bytesFreed is always present (0 when no GC ran). events[].bytes is set on the GC carrier and on --update's downloaded event. summary.bytesDownloaded was never emitted, so it is removed from the contract.
• remove's human output now prints the diff/package archives it sweeps, like repair does.
• scan's --dry-run GC preview uses the same keys too (MAJOR): prunableManifestEntries/orphanBlobs/orphanDiffArchives/orphanPackageArchives/revertableVendoredEntries/vendorOrphanDirs/bytesReclaimable became prunedManifestEntries/removedBlobs/removedDiffArchives/removedPackageArchives/revertedVendoredEntries/removedVendorOrphanDirs/bytesFreed. The preview leaves out only the keys a real pass alone can fill (keptVendoredEntries, failedVendoredEntries, skipped, warnings).

Rollback counters span every leg (#1066)

• rolledBack = agent restores + vendoredReverted + vendoredPreserved + hosted.reverted.
• failed = agent failures + vendoredKept + vendoredFailed + hosted.failed + hosted.unsupported.
• If something failed and nothing was rolled back, already original or not installed, the run now reports status: "error" with error.code: "rollback_failed" instead of partial_failure. Exit codes are unchanged (1).

Contract

• Envelope schema: adds update to command, plus rebuilt, bytesFreed and gc; drops bytesDownloaded.
• PatchEvent action enum now includes rebuilt.
• Fixed the "Emitted by" column and the per-command action matrix. Examples: apply never emits updated, discovered is list-only, vex was missing.
• The GC jq recipe now reads .gc.* and .summary.bytesFreed.
• New unit tests pin the documented summary, gc, top-level and PatchEvent key sets, and the action vocabulary rows, against what json_envelope serializes.

Tests

• --lib (910), plus the rollback, repair, remove, scan, in_process_scan, covgap rollback/scan-hosted and in-process rollback hosted/vendored suites, all pass locally.
• cargo clippy --locked --workspace --all-features -- -D warnings is clean.
• Updated tests that pinned the old summary.removed: 1 and the old partial_failure on all-failed rollbacks. The mixed hosted case now asserts rolledBack: 1, failed: 1 (was 0/0).
• e2e_bun_lockb (needs the real toolchain) is updated to the new status, but CI is the first to run it.

v5 blocker agent update (bc9c9be)

• e2e_bun_lockb was red on 9714d570: native_binary_hosted_vendored_takeover_roundtrip expected status: "error", but a staged manifest makes the agent leg report the copy alreadyOriginal: 1, so the run is partial_failure, as the contract says. The per-caller fix from 113c0177 was lost in the branch rewrite.
• rollback_refuses_binary_hosted_pin_then_checkout now takes a copy_already_original flag from each caller: takeover and shared-bundled-record legs (manifest staged) expect partial_failure + alreadyOriginal: 1; hosted-only alias/transitive shapes expect error / rollback_failed + alreadyOriginal: 0. All expect failed: 1.
• Merged origin/main (merge, not rebase) at 1e69b30.
• Local (bun 1.4.2): takeover roundtrip red -> green; 21/23 e2e_bun_lockb tests pass. The other 2 fail only because this sandbox can't reach patches-api.socket.dev / GitHub tarballs (proxy 403), not because of the change.
• cargo fmt --all -- --check clean.

🤖 Generated with Claude Code

---

Note

Medium Risk
MAJOR JSON shape changes (scan dry-run GC keys, rollback total-failure status) affect automation consumers; rollback counter semantics changed across vendored/hosted legs.

Overview
v5 JSON contract: artifact GC is reported through one shared gc object (removedBlobs, removedDiffArchives, removedPackageArchives, bytesFreed) on envelope commands (repair, remove) and aligned with rollback / scan --prune. summary.bytesFreed mirrors gc.bytesFreed; GC carrier events carry bytes but no longer inflate summary.removed. summary.bytesDownloaded is dropped from the contract.

Breaking (scan dry-run): GC preview keys are unified with the wet pass (prunedManifestEntries, removedBlobs, …) instead of the old prunable* / orphan* / bytesReclaimable names.

Rollback (#1066): top-level rolledBack / failed count agent, vendored, and hosted legs. When every targeted package fails and nothing is restored or already original, JSON is status: "error" with error.code: "rollback_failed" (still exit 1), not partial_failure.

Docs & tests: CLI_CONTRACT.md updated (envelope, update command, action matrix, jq recipes); contract tests pin serialized keys; broad test updates for GC shape and rollback status.

^{Reviewed by Cursor Bugbot for commit bc9c9be. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Tanmay Singla (Tanmay182003)]

[agent] Follow-up on my earlier comment: I had the diagnosis half wrong, and the flip in 3e6153c trades one red for two others.

1. rollback_refuses_binary_hosted_pin_then_checkout (tests/e2e_bun_lockb.rs:125) is shared by two callers that produce different envelopes:

   • native_binary_hosted_vendored_takeover_roundtrip (:1081) gets alreadyOriginal: 1 → partial_failure (now passes)
   • native_binary_alias_and_transitive (:973) gets alreadyOriginal: 0 → {"status":"error",...} (now fails at :135)

   The total_failure rule (rollback.rs:1604-1608) is right; the helper should take the expected status as a parameter (or derive it from env["alreadyOriginal"]) and assert error.code == "rollback_failed" when it's error. That's what keeps all 14 bun binary backtest cells and both e2e_bun_lockb legs red.

2. CI's merge with main also fails tests/apply/bun_global_store.rs:191 (rollback_refuses_bun_global_store_packages, from Fix open bun issues (#992, #861, #784, #764, #735, #635, #599, #578, #497, #443, #371) #1009). It expects partial_failure when every package is refused, but under the new rule the result is {"status":"error","rolledBack":0,"alreadyOriginal":0,"failed":2}. That's what fails test (windows-latest, 2), test-release (1) and coverage. A rebase plus updating that test to expect error / rollback_failed fixes it.

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: pushed 113c017 (with a merge of main at 2990e48), following Tanmay Singla (@Tanmay182003)'s diagnosis.

• e2e_bun_lockb's rollback_refuses_binary_hosted_pin_then_checkout now reads the expected status from alreadyOriginal. When it is above 0 it expects partial_failure (the takeover caller). Otherwise it expects error with error.code == rollback_failed (the alias/transitive caller).
• apply/bun_global_store rollback_refuses_bun_global_store_packages now expects error/rollback_failed. That matches this PR's total-failure rule: every package is refused.

These pass locally: apply, rollback, in_process_rollback_hosted, covgap_commands_rollback, e2e_bun_lockb. Note that hosted-e2e, e2e_safety_pnpm and the Bun native legs are red on main too (production no longer serves the free minimist@1.2.2 patch), so they don't block this PR.

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent).

• Head: 113c0177
• CI: every check green except main-wide failures that also fail on main at a8e9397: e2e (ubuntu-latest, e2e_safety_pnpm), hosted-e2e (withdrawn free minimist@1.2.2 patch, Merge queue blocked: production no longer publishes free minimist@1.2.2 patch #1293; fixes in Repin live minimist@1.2.2 suites to republished patch 642d7f02 (#1293) #1301/Follow the republished minimist canary patch #1302), the Bun/vlt native (*) compat legs, and the ci-ok roll-up.
• Bugbot: reviewed this head, no findings; no open review threads.
• No CHANGELOG.md changes.
• JSON contract change for repair/remove GC output ahead of v5.0.0.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[final reviewer] Not enqueuing. Tanmay Singla (@Tanmay182003), the commit you approved (113c0177) is no longer on this branch: the branch was rewritten afterwards, and the current head 9714d570 diverges from it (5 ahead, 4 behind). Non-merge commits on the new history are 7efdf798 (the main GC-report change), f7977faa (scan's GC dry-run preview in the shared gc shape) and ecbdd1ea (expect rollback_failed when every Bun global-store package is refused). ci-ok is red on this head. Please take another look once it's green.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit bc9c9be. Configure here.}