- hash_dict (4,420 commit objects -> commit:NNNN / twin / orphan; 150,280 prefixes; 0 ambiguous; 0 collisions with 1,480
cited content hashes; scratch mailmap), scrub (12/12 self-test; HEAD sample 731 distinct tokens == git's own lookup),
gate_scan (+ expected_offenders.txt fixture: the R39 negative control, PASS over 16.8 GB in 2 m 25 s; rom_blob_ids =
content/signature hits U purge-path blobs not shared with any other path), run_filter (module API; --force only for the
deleted tag), verify_rewrite (pairwise proof + no purge path survives + pruned set == derived purge-only set),
build_commit_map (0 old hashes asserted; unchanged commits exempted), resolve_tokens, absent_scan (positive control on the
current repo: FAIL 82,362), probe_github.sh (skips unchanged commits)
- trial #1 found two defects the plan had not foreseen: the EMPTY blob in the strip list (--strip-blobs-with-ids then
undid every "file emptied" change in history and pruned a restore commit) and the byte-identical Initial commit keeping
its hash; both fixed with controls
- trial #2: filter 269 s, exactly 1 pruned, verify 4,029 pairs / 0 failures, map 4,030 rows, absent_scan + gate PASS on
the clone, 1,231 tokens resolved at a trial tip (residue 7: the pruned commit x3, orphans x4), aggressive repack 500 -> 80 MB
- SETUP P33 C1 section + rows (R21); runbook §3/§5/§6/§10 measured; requirements-python.txt; CURRENT_PHASE -> NEXT = C2
- pre-checks: census (nothing project-authored under a purged dir), ignore coverage with `git check-ignore --no-index`
on every path, and the control that the public build needs none of it (main 143dbb89 byte-identical with tools/psyq
+ .run/obj40 + .run/obj42 moved aside; WITH state restored)
- after: git ls-files on every purge path = 0; no untracked purge path; tools/audit_public.py OK — 0 offenders among
6,566 tracked paths (255 before; the no-rom `audits` CI job goes green from here); make check-env 0
- docs/public-flip-runbook.md (NEW): Block C operational — decisions, actor table, C3..C11 with commands/checks, the
Support-ticket text, the probe, the fallback, the risk register, rollback; the mailmap is scratch, no personal
address in any tracked file
- SETUP §2.3/§2.4: the zips' sha256 + sizes (download-only now); verification.md: a --cached removal changes no
tracked-content byte, A5 holds for this tip; CLAUDE.md fail-safe: never `git clean -x` (ignored-but-present RE data);
decision-log R31 entry (why the purge leaves the index before the rewrite); CURRENT_PHASE -> NEXT = C1
Drew T